fix: seal drafts with empty artifact lists

[ianw-oai]

Summary

A draft with scan.artifacts: [] was treated as a sealed scan. Finalization failed before it could create the report and SARIF export. Treat the empty list as absent when the draft has no seal timestamp.

Fixes #930.

Changes

• Remove the empty artifact list before draft finalization.
• Extend the existing zero-finding test to cover the empty list in a diff scan and check report and SARIF output.
• Check that an existing seal with an empty artifact list is still rejected.

Testing

All passed:

• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 PYTHONDONTWRITEBYTECODE=1 python -m pytest plugins/codex-security/tests/test_finalize_scan_contract.py plugins/codex-security/tests/test_validate_scan_contract.py plugins/codex-security/tests/test_scan_contract_examples.py -q — 184 tests.
• python -m ruff check --config plugins/codex-security/pyproject.toml plugins/codex-security — Ruff 0.16.6, run through uv.
• python -m ruff format --check --config plugins/codex-security/pyproject.toml plugins/codex-security — Ruff 0.16.6, run through uv.
• pnpm --dir sdk/typescript run build:ci.
• node .github/scripts/check_plugin_source_compatibility.mjs.
• node --test .github/scripts/test_check_plugin_source_compatibility.mjs — 9 tests.
• git diff --cached --check.

Risk and rollout

Low risk. The change applies only to drafts with no seal timestamp and an empty artifact list. Existing seal validation stays in place. No public CLI changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-16T15:04:37.141589Z	71b606a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.