fix(tooling): bind native audit challenge digest

[gfyrag]

DISCOVERY: NO_EXISTING_WORK
BEFORE_FIX: BUG_REPRODUCED
AFTER_FIX: PASS
BASELINE_CLASSIFICATION: ENVIRONMENTAL

Summary

• require sourceAuditDigest in the Codex challenge output schema
• pass the launcher-computed digest as trusted target data and reject missing, malformed, or mismatched values
• preserve exact finding id, title, and severity checks
• cover a zero-finding ai-audit to ai-audit-challenge chain

Root cause

The challenge schema declared sourceAuditDigest in properties but omitted it from required. Strict Codex structured outputs reject schemas unless every declared object property is required, so the challenge failed before provider analysis.

Validation

• reproduced HTTP 400 invalid_json_schema against the preserved read-consistency audit artifact
• go test -race ./scripts/aiaudit ./scripts/aiauditchallenge ./scripts/aiauditjira
• live Codex schema validation with zero results
• live zero-finding ai-audit-challenge artifact; source digest matched exactly
• sensitivity: restoring the previous required list makes the focused schema regression fail
• bash scripts/agent-check
• GOFLAGS=-p=1 AI_REVIEW_BASE_SHA=b0fcefd07175a1ec6787df30b7b842129fc0bdab bash scripts/agent-check-pr
• git diff --check

The default-parallel agent-check-pr run encountered the unrelated existing scripts/rootguard TestRunnerComparesRootAfterCancellation timeout twice; the exact test and full package passed in isolation, and the same complete exact-base gate passed with Go package parallelism serialized.

No Jira publication, audit redesign, PR orchestration change, or product/runtime change. Do not merge automatically.

[NumaryBot]

✅ Approve — automated review

The schema, prompt, runtime validation, documentation, and regression tests consistently bind the provider output to the launcher-computed source audit digest. No actionable correctness issue was found.

No findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.18%. Comparing base (b0fcefd) to head (89df848).

Additional details and impacted files

@@               Coverage Diff                @@
##           release/v3.0    #1886      +/-   ##
================================================
- Coverage         77.20%   77.18%   -0.02%     
================================================
  Files               478      478              
  Lines             51258    51258              
================================================
- Hits              39573    39565       -8     
+ Misses             8255     8254       -1     
- Partials           3430     3439       +9     

Flag	Coverage Δ
e2e	77.18% <ø> (-0.02%)	⬇️
scenario	77.18% <ø> (-0.02%)	⬇️
unit	77.18% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.