fix: make diff-scan writeups and hardening optional

sdk/typescript/_bundled_plugin/references/scan-artifacts.md

@@ -114,5 +114,5 @@ Compact Standard and Deep scans use the nested `attack_path` record above. Other
 
 - Put scan phase outputs and supporting evidence under the numbered artifact subdirectories above.
 - Keep fix-finding outputs outside the numbered scan phases because fix-finding can run standalone or against an existing scan.
-- Do not author the final `report.md` directly. Put complete scan-level report semantics in the canonical JSON files. Detailed per-finding prose in `findings/<slug>/<slug>.md` and derived design guidance under `hardening/` are optional for Standard and Deep scans. Finalization deterministically writes the unsealed `report.md` projection and links any recorded write-ups and hardening portfolio. Do not add these derived documents to the sealed artifact list.
+- Do not author the final `report.md` directly. Put complete scan-level report semantics in the canonical JSON files. Detailed per-finding prose in `findings/<slug>/<slug>.md` and derived design guidance under `hardening/` are optional for every scan mode. Finalization deterministically writes the unsealed `report.md` projection and links any recorded write-ups and hardening portfolio. Do not add these derived documents to the sealed artifact list.
 - Keep the full scan bundle together under `scan_dir`.

sdk/typescript/_bundled_plugin/skills/security-diff-scan/SKILL.md

@@ -104,10 +104,10 @@ Follow this plan in order. Do not skip ahead to a later phase until the current
   - Each candidate finding's `findings/<candidate_id>/candidate_ledger.jsonl` is part of the attack-path input. Every candidate finding that reaches attack-path analysis must have an attack-path receipt before final reporting, even when the final decision is `ignore`, suppressed, or deferred.
 8. Assemble the complete canonical JSON contract last using `../../references/final-report.md`; do not author `report.md`.
   - Populate the optional structured details in `../../references/finding-detail-fields.md` from the same validated evidence used in the generated report.
-  - For every reportable finding, run `$vulnerability-writeup` with exactly one dedicated write-up sub-agent. Give it only that finding, its validation and attack-path evidence, relevant source paths and revision, PoC inputs, and the target output directory.
-  - Write the derived report to `findings/<slug>/<slug>.md` with supporting PoC files under `findings/<slug>/poc/`. Verify the report is a regular file, then set that finding's `writeup.reportPath` to the matching safe relative path. Do not add the derived report to the sealed artifact list.
-  - After every write-up is ready, run `$propose-security-hardening` once over the complete finding collection, detailed write-ups, threat model, coverage, and relevant source. Write its portfolio to `hardening/hardening.md`, its structured analysis to `hardening/hardening.json`, and any proposals and diagrams below `hardening/`. Verify `hardening/hardening.md` is a regular file, then set `scan.hardening.portfolioPath` to the fixed relative path `hardening/hardening.md`. Do not add these derived files to the sealed artifact list. Skip this step and omit `scan.hardening` when there are no reportable findings.
-  - Complete the scan once, after all write-ups, hardening guidance, and canonical JSON are ready, so finalization projects the validated JSON and derived-document links into `report.md`. In the terminal/chat workflow without `complete_codex_security_scan`, run `python <plugin_dir>/scripts/finalize_scan_contract.py --scan-dir <scan_dir> --source-root <repo_root>` directly.
+  - Detailed vulnerability write-ups and structural hardening are optional. Run each only when the corresponding additional output is requested.
+  - When detailed write-ups are requested, run `$vulnerability-writeup` for every reportable finding with exactly one dedicated write-up sub-agent. Give it only that finding, its validation and attack-path evidence, relevant source paths and revision, PoC inputs, and the target output directory. Write the derived report to `findings/<slug>/<slug>.md` with supporting PoC files under `findings/<slug>/poc/`. Verify the report is a regular file, then set that finding's `writeup.reportPath` to the matching safe relative path. Do not add the derived report to the sealed artifact list.
+  - When structural hardening is requested and there are reportable findings, run `$propose-security-hardening` once over the complete finding collection, any requested detailed write-ups, threat model, coverage, and relevant source. Write its portfolio to `hardening/hardening.md`, its structured analysis to `hardening/hardening.json`, and any proposals and diagrams below `hardening/`. Verify `hardening/hardening.md` is a regular file, then set `scan.hardening.portfolioPath` to the fixed relative path `hardening/hardening.md`. Do not add these derived files to the sealed artifact list. Otherwise, omit `scan.hardening`.
+  - Complete the scan once, after the canonical JSON and any requested write-ups or hardening guidance are ready, so finalization projects the validated JSON and derived-document links into `report.md`. In the terminal/chat workflow without `complete_codex_security_scan`, run `python <plugin_dir>/scripts/finalize_scan_contract.py --scan-dir <scan_dir> --source-root <repo_root>` directly.
   - After `complete_codex_security_scan` succeeds, include its returned measured total, input, and cached input token counts in the final response. Label partial coverage explicitly; if measurement is unavailable, say so instead of reporting zero or estimating.
 
 ## Phase Scope
@@ -160,7 +160,7 @@ This keeps diff scans precise while avoiding the common failure mode where one r
 
 ## Final Output
 
-Populate all final report semantics in the canonical manifest, findings, and coverage JSON using `../../references/final-report.md`. Generate one detailed `vulnerability-writeup` for every reportable finding, then run `propose-security-hardening` once over the complete collection and record the safe derived-document paths. Complete the scan once after both stages; finalization owns `report.md` generation. After successful MCP completion, retrieve measured token usage once and include it with the completed report. Emit Codex app review directives from the completed canonical findings. Commit scans use this same final-output contract because they are a diff-scan target type.
+Populate all final report semantics in the canonical manifest, findings, and coverage JSON using `../../references/final-report.md`. Detailed vulnerability write-ups and structural hardening are optional; invoke the corresponding skill only when that additional output is requested and record any resulting safe derived-document paths. Complete the scan once after the canonical JSON and any requested optional outputs are ready; finalization owns `report.md` generation. After successful MCP completion, retrieve measured token usage once and include it with the completed report. Emit Codex app review directives from the completed canonical findings. Commit scans use this same final-output contract because they are a diff-scan target type.
 
 ## Hard Rules