[mldangelo-oai]

Summary

Six severity tests launched Node 28 times per operating system just to query their fixture databases. They now run those reads and mutations in the Bun test process.

Changes

• Open a scoped Bun SQLite connection for each fixture query and enable foreign-key checks to match the previous driver.
• Let SQLite errors propagate directly to the calling test.

Testing

• The full severity file passed all 30 tests before and after the fixture change on the preceding base, with the same seed and 30-second timeout. The assertion count went from 190 to 162. The difference is the 28 exit-status checks on the removed fixture subprocesses.
• Traced all six callers plus the two Node and NUL controls. Both versions ran the bundled Node helper 96 times. Fixture-only Node launches went from 28 to zero. After refreshing the branch on main, the same eight cases passed with 70 assertions.
• Replayed the 28 actual statements against copies of their original fixture databases. All returned rows and resulting logical database contents matched. The median time for the queries was 2.90 seconds before and 0.50 seconds after across four local runs per version. The untraced full-file timings varied with host load and showed no wall-clock gain in the local pair.
• The TypeScript SDK and MCP type checks passed, along with formatting for the changed file. For the single modified SDK test file, the CI selector chose the Ubuntu Node 24 installation check and retained the package build and cross-platform SDK tests.
• Both drivers rejected invalid columns, foreign-key and uniqueness violations, and writes under an exclusive lock. Byte checks covered Unicode, embedded NULs and a BLOB. The lock could be reacquired after closing each connection.

Risk and rollout

The change is confined to the test fixture. Production severity reads and writes still enter the packaged Node helper. The dedicated embedded-NUL test continues to verify the Node round trip.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T14:22:43.549898Z	2945c2e	PR opened
🔒 Security Review	✅ Completed 2026-10-26T14:22:55.072432Z	2945c2e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for simplifying these fixture queries. Owner-level merge-safety review of 2945c2e: no material findings. Scoped Bun connections preserve the fixture operations and foreign-key checks, while production Node calls and the embedded-NUL control remain covered.

Builds, typechecks, formatting, and 19 SQL-equivalence cases passed. I verified all 30 severity tests (162 assertions, no failures or skips) in the hosted Linux report for the tested merge of this head. The full local severity run was blocked by fixture-directory ancestry checks in the review environment.