fix: reconcile Linear publication recovery identities

[mldangelo-oai]

Summary

Linear publication could treat incomplete or conflicting identity evidence as determinate. This change verifies exact mutation arguments, reconciles human issue keys, entity UUIDs, and URLs across connector events and durable handoffs, and preserves uncertain outcomes for recovery instead of recording them as published.

Changes

• Share one exact Linear mutation-argument builder across publication and recovery validation, matching exact arguments before the finding and occurrence fallback.
• Normalize surrounding claim whitespace, canonicalize UUID spelling so same-owner case aliases deduplicate, traverse supported nested result carriers iteratively, and distinguish human issue keys from entity UUIDs without changing human key spelling.
• Index publication evidence once and reserve every recognized claim in one global canonical-value namespace after claim normalization, including claims from failed, invalid, wrong-argument, and unowned evidence.
• Require nonempty connector-event and durable handoff or receipt claim sets to share a normalized canonical claim before combining them; disjoint evidence remains indeterminate.
• Reject reused or relabeled claims with value-free diagnostics, retain handoffs, connector-event evidence, and partial receipts for indeterminate outcomes, and persist independently verified siblings in publication order.
• Emit neutral per-item mutation_settled checkpoints only after each direct API result or error is durable, and emit batch_settled only for fully durable batches. On cancellation, stop later batches while allowing every started non-idempotent mutation to settle into confirmed or possibleMutation recovery evidence.
• Keep CLI checkpoint output and TTY phase counts separate from terminal finding progress, and report created or failed findings only from reconciled outcomes.
• Let the first CLI interrupt stop new work and wait for durable recovery, while a later signal provides a forced-exit escape for a permanently stalled mutation without claiming success or deleting recovery state.
• Redact credential-shaped details when the final indeterminate receipt cannot be written while preserving ordinary local receipt diagnostics.
• Document manual reconciliation. Publication still performs no remote readback or retry deduplication.

Testing

• Original failing-first unit regression: 0 passed, 1 failed, 4 assertions.
• Original failing-first database-backed CLI regression: 0 passed, 1 failed, 7 assertions.
• Follow-up failing-first UUID resolver: 0 passed, 1 failed, 1 assertion.
• Follow-up failing-first event and handoff case-order matrix: 0 passed, 4 failed, 4 assertions.
• Follow-up failing-first direct checkpoint regressions: 0 passed, 3 failed, 15 assertions.
• Follow-up failing-first database-backed CLI regression: 0 passed, 1 failed, 8 assertions.
• Repair failing-first disjoint-evidence matrix: 0 passed, 4 failed, 4 assertions.
• Repair failing-first neutral CLI progress regression: 0 passed, 1 failed, 11 assertions.
• Final failing-first in-flight cancellation and TTY phase regressions: 0 passed, 3 failed, 11 assertions.
• Final failing-first later-signal regression: 0 passed, 1 failed, 4 assertions.
• Final failing-first database-backed receipt regression: 0 passed, 1 failed, 4 assertions.
• Targeted stalled-mutation, indeterminate-receipt, and ordinary-diagnostic regressions: 3 passed, 0 failed, 27 assertions in 2.59s.
• Current publication-events, publication-integration, publication-store, publish, and CLI publication suites: 226 passed, 0 failed, 1,939 assertions in 30.45s.
• Model generation and TypeScript checks: passed in 6.75s.
• Build: passed in 7.54s.
• Changed-file Prettier check and git diff --check: passed.
• Package pack/check/smoke: passed with 265 archive entries; tar SHA-256 8f9526bd389b52d2d3e912b018a3833a6c7ef7d60f015426b42123a18963b9f3. Installed public import, NodeNext import, CLI, bundled plugin, and nested worker validations passed.
• Broad suite under the repository's Node 22 runtime with seed 12345: 1,748 passed, 28 skipped, 0 failed; 22,697 assertions across 92 files in 279.13s.
• Fresh exact-head native review: three independent gpt-5.6-sol passes at maximum reasoning on exact head 147ab759a1cad88945e6ebe64586530a1d18413d against base 86e1c3f5b29c7ca92958a41c62d2bdb58b30483f; all exited 0 with no actionable defects.

Risk and rollout

Reconciliation is intentionally stricter: ambiguous, mismatched, or globally reused claims now produce an indeterminate recovery error instead of being recorded as successful publication. Canonical UUID spelling is normalized before claim resolution, so same-owner case aliases deduplicate while globally reused UUID claims, including case variants, remain indeterminate. Independently verified siblings may already be persisted, so retained evidence must be reconciled before retrying.

PublishScanProgress gains neutral mutation_settled and batch_settled variants. They are durable recovery checkpoints, not successful publication outcomes; per-finding terminal progress is emitted only after reconciliation. Exhaustive consumers of the progress union must handle or ignore the new variants.

Cancellation prevents later direct API batches, but requests already sent to Linear are allowed to settle so their outcomes are durably reconciled. A slow in-flight request can therefore delay cooperative cancellation completion; at the CLI boundary, a later signal forces process exit while leaving recovery evidence intact.

No remote readback or automatic retry deduplication is added.

Public disclosure review

The final pre-host and hosted audits covered the branch name, exact head and base, title and description, seven branch commits, eight changed files, documentation, comments, diagnostics, fixtures, identifiers, checks, links, and metadata. Fixtures use explicit synthetic keys, SEC-* and SYNTH-* identifiers, patterned UUIDs, and linear.app/example URLs. No screenshots or attachments are included.

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-23T20:52:53.481372Z	147ab75	Manual request
🔒 Security Review	✅ Completed 2026-08-23T20:52:18.227735Z	147ab75	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 147ab759a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

Superseded by #624, which rebuilds this Linear publication-recovery change from current main on a clean, fully reviewed branch. Closing this successor only; the original #482 remains open.