Deep Security Scan

Deep Security Scan repeats finding discovery to reduce variance, then runs validation, attack-path analysis, and reporting once over the merged candidates. Use start_codex_security_deep_scan for the repeated discovery phase. This thread handles setup, preflight, the scan goal, and the phases after discovery.

Phase Ownership

Deep MCP owns repeated discovery only. It does not run centralized validation, attack-path analysis, canonical JSON assembly, completion, or generated reporting. After discovery returns a terminal manifest, the parent resumes the ordinary $codex-security:security-scan workflow at its post-discovery tail and owns every remaining phase exactly once.

Treat the discovery-to-parent handoff as a hard phase boundary:

1. Accept and read the terminal discovery manifest.
2. Synthesize the canonical validation threat model.
3. Run centralized validation.
4. Run attack-path analysis.
5. Author complete scan-manifest.json, findings.json, and coverage.json.
6. Verify those canonical files exist on disk at the workflow-owned scan path.
7. Only then call complete_codex_security_scan.
8. Return a final answer or benchmark JSON only after completion succeeds and the generated report.md exists.