Small, reviewable patches for issues filed against the public openai/codex-security mirror.
#290 reports that deep scans pass the literal $CODEX_SECURITY_SCAN_ID to a structured MCP call. #292 shows the same placeholder reaching standard-scan artifact instructions, which can make the generated manifest use the wrong UUID.
Both failures have the same cause: the agent prompt is built before the workbench registers the scan and returns its authoritative ID.
The patch builds the prompt after registration and inserts that UUID directly for both standard and deep scans. Its regression matrix covers both modes, with and without false-positive feedback.
Patch: 0001-fix-scan-pass-the-registered-scan-ID-to-the-agent.patch
Apply it to openai/codex-security at the recorded base:
git am /path/to/0001-fix-scan-pass-the-registered-scan-ID-to-the-agent.patchValidation results and the exact base are recorded in VALIDATION.md.
The public repository is documented as a one-way mirror, so this patch is shared as a commit-ready reference while the maintainers decide whether to carry it into the canonical source or invite a focused pull request.