From aa905bb9625d777a2f64b20408e5ddedbf173395 Mon Sep 17 00:00:00 2001
From: jif <jif@openai.com>
Date: Fri, 14 Aug 2026 12:11:52 +0000
Subject: [PATCH] Store security risk scores as a snapshot (#38567)

## What changed

- Replace the single `category` and `score` fields in `SecurityRiskScore` with a
  deterministic map of category names to scores.
- Validate the full Guardian V2 classifier response before storing it as one
  thread extension value and, for non-ephemeral threads, one rollout item.
- Cover serialization and rollout loading with snapshots containing multiple
  score categories.

GitOrigin-RevId: 24525de691f96bd34ccfe04acab2f01aca309837
---
 .../app-server-exports-stable.json.zst        | Bin 133494 -> 133502 bytes
 .../thread_history_projection_tests.rs        |   4 +--
 .../session/rollout_reconstruction_tests.rs   |   4 +--
 codex-rs/ext/guardian-v2/src/extension.rs     |  33 +++++++++---------
 .../ext/guardian-v2/src/extension_tests.rs    |   4 +--
 .../src/sessions/append_tests.rs              |   4 +--
 codex-rs/history/src/tests.rs                 |   7 +++-
 codex-rs/memories/write/src/phase1.rs         |   4 +--
 codex-rs/protocol/src/security_risk.rs        |   6 ++--
 codex-rs/rollout/src/recorder_tests.rs        |   7 ++--
 10 files changed, 41 insertions(+), 32 deletions(-)

diff --git a/codex-rs/app-server-protocol/schema/precomputed/app-server-exports-stable.json.zst b/codex-rs/app-server-protocol/schema/precomputed/app-server-exports-stable.json.zst
index d5e25f6099c6538f0cfb7c66eab4466b496b3371..5e41454f63308f80d7e5b37c5d3b4cee42d67ee7 100644
GIT binary patch
delta 5323
zcmV;+6g2Dhk_i5i2!ON!NAw1zsQ{MWU6)Pt0VM`d09OD}0GE060Z^CB^Z_A%{L0nh
z<F}G|>(e7q8O);~?u<GS^{hf^sF1i|8kC8aQZXmJ0S=BxrZJ{|O`eUS^!Lp#^c;$@
zU|^pb7MGz?q3^AST9@C+(gp^<&pu8`-|oO`=3NjNi_5%<8L*}iLMQRIr7k&$^-YZ!
z5<0d+M~8_HE$JQ!f-+K1*KM8%jA``%-xquVmvr?3B7eqP$-l2V?32XA!_=IsgRza(
z@jr1C(@cC_I_Bb3+p9*MlTwkPye+)H|JFg>Q-3)DhDWHw{gz3R3<pCX5J;dvA)*p_
zC?JSLgTgWl^#LPLK!Lz05(bN)AUFsH0)jvwzzBjM2!bFyf*=S2A`puZm5AQ71`N^2
zWB#B-gMUW_>n*_9_fJm!k)t=|nKPw<lt2S))>Ccj;3DGvKCoC5bRhVA+mElxwQSU*
zrFrG}ocH2GjgQOo%%uD&EI+M*%_7?>*#>!dZ_xmNWdhrw+kh{^(BRgbrA6Az2nk^4
zcgMJVpxkPoBc$1%u8Or-(xWlnnN11OWQ1xp=zoFTh{1deSEZow>0$_{fCftdgAUDt
zDJMbuw<z*An%vJ%2QvF0m9LsR|6&xjIycrAo1;B9#26kymjYKZeK{vA#nUIGSQ<&2
z8IK6Zrr+fWGm&rsyJ?o2i?kw~KQda;vSIW^C^8nP)p|2!*ZN*ZeKh?BXsa?nw%+gy
zk$;mW#1vST#W1NhWV9Sr@Sr9itx(dy#73o*tOY)#C5b&zumLiOO6xexa_IgBrc8Pl
z{HQ1&bd!k{l%C_y%2tbLutdDth^Ec1IvP_tlBZ$HaVZ}~*8c>JnT&qTnz1_HL^<VH
zloDr33Rr#PvdxVYL1tSJJr9gzL9Z@AF@HoB9Z3`fu4b1%AGGO^J3t*4WmooZo@GAT
zTkBz4L02{ZgBtxRyv+WQJz2TBR_-51lXT945b?fHP80CfX{;B-c-}m8)M27!*x%|G
zU}lFiMvw_m8H1g?A!8*dW~)B+qV9%hbnC$=?N-(ZgzH)f4WE#d`5U#S36o?s-hZ`}
z40v@!KSG5xoa=m`OwvL|>!Wh0eZkt<OCHQl$Sr2*C29}B-Yw*=xXaZ3do}P;dneQg
zgLa5<onuA|)`KgEoW$~Av8nh@xz;^wXv`#6Tdpk*J~`9;*gZq8X$iFO$gUsBQ1b;Y
zT%~wa*C9ruHluOfMaG`g1dGJJT7RpR9eCk+xefnO<S8HR3V`*>o7_7u)0s@l4ex|E
zu^~{`!OyPbBMoSNe_pK}Md}?DYj^43npno2q9jC|9?Ty{qyp!F4CoRB;>OVHs2^RJ
zoESH4nZF8WMz@E|fb{fx?dxcQ$3T<t(z)?6n%f)S?N0ywb}vjE(!K8CHGh@wg~%!H
zq^)qXAMeF8KfOXs0cLQA6;MrPI;tmXP1sAlp8PRH*Kku3cqQs+#?!ji8rgt@lk<^C
z;HQz(=_B#=)h=HH_L0c2>o64Ny2(r&#j~j$iMX)g0Y>jtA|a^<s=S2a3p>QHs_d&m
zUe+ZMXBlo&VjTfKBXNhgC4V3h=0WC2aKCyKcH+WtIBgd4H8hq=GgqFO#DD@ArY@$r
z-Or)#`mPuQ2~7OrFlCrvPn*<J?|<t8FMbp3l8W}S=1`c&F8|2EJ}z2|ErXgvu8rg>
zY7W!)?(_o#UzRkfilsyWddY{TZ5W|KGXvNG-+-;GXURTCmrsAj;(sKa+>d7FzRU?t
z@1tSK&2xw+4wpOJ#hgaXt7hajq5=O%+g%f1{lS^^&ez$6;{iwZom@b-lH}lm8>l?#
z!Uw00RPY-wQg)E5KpSyN%KPAsUw0NgFK5xXNqgRwrMsT*b!(N-xBx(P-%foqYrv@`
zN>(~pJ(X!Ieg_e`9DnAybX}~$wvwakvSDqKL<UsV?!COKQ!Fql0H$rHP<aCl?5q99
zM81|dWMl$aeyv{|+COgzxnWlTF6*1iBjjhyDUS#5s*%QDU-jEfm}*FSTKhh!rk@0(
zYD&#}4WH^!Q>sW55KJ4HRFR6MI^-Fj4J@bc13F9xqWJO}3V)K9b+N8DQM^kY0Bl)+
z$koZk*EM!ojz`t_jeR;+m<%Z^i@?D<X|V^N3u$!qGS{^l-~dpx2S`S*3Y)Mz4<@IN
z83wVTl%jF#i6&iV8af0+cHTf(cyV{VkVwmn%`ZP*%1du-3(4T|LPD6d2LoJE!*iHa
z>g9s?fM3g8!+#S-&h-osqN%~3?<B7f=fWX32J88BR@%h5SRGuW7Adn)izm9OWwrt`
zc!&5wAK%K1bT{RS0=Hxx|H#{jJ<9BqYVB&DPus#MV_lYHAbDzR(#G2y05~gjXI%~J
z{+LBL)EXEk5knA_h@<DuWqVv`w}xHBk<lE1$Dk|dB7f4055dXH)-dx+PHwCFd>pRf
zv5yYRjvFP74w06JpcOQRFw6`kPqc2Rqoe{OOL3+o6){&gas~SI6i&T$BDn8QI1aRW
z@3cJ@{XqUQlr=b!j7YF&LkopXhRQt~c3en24N+O1Vy=TBE*okiaM^JA>8T18_OyaW
z7G9aeDSx_@qfsc!R$JGT`VC1r-Kkma3#ZH0D~Hqj7e<_-l4QszyjpKC8L?Govgpwb
zf#7ZRTP1BYgqWe>ByHHW4iTBaBxw6iX>x-<0OSgJZ03@QuofgBW}}(vaE7f$|GRg9
zLx*Z8JJARr)alr)(P7{#X9zaM$(M)@i@X?)Yk%j?&SvUe*JM@?9Zn{_{SNd?uuEu{
zHW%zf5F!AB*p?J1owCLck+-l3gZnJ`R(MW#l@zfruF9lL*%R^yZ7)FY&aAF@HX7@W
zl-yh?MmX~`4SJKps0Hx?R8bfYe)Io8zm$*eO2A^V3|egfwZJ%WPG!XF={ynXF~_!$
zV}HfCOi+vUnYyw*he$~aMlk<?DUi7o@VP$hZcYf5>*@Bxkdw%GMmVFJ;0VRbB4m;`
zX5@D(wf?}CD#g+a=%X}@&#<r<VSl*ICN<7s>NcG}CRI7k;cuB-^f-qGYuqV=ka|JR
z;YE?$n`&ndH`7m~9Z^_|T~Rzp;U8L=r+*DS3NV&%UHo3Ic&lB0ecZgxB*d#KfURop
zgTnEpUiY<vaefG=t|Uubx|HEVat5S$h0V>oH-c$^C!qnGHW5_NUWG05GlRi;&9>A2
zJV<X}$-z_sojPR)>}pcvwR5(Cs>T5Wwm+HzHRjw+1BI{67lMF3>+FUR;z9_okbm1d
zCpfS?F&kR*cIUj0xoEJj-SP!yvR$hp5rgy{W()LOMp#QcX)=yM=428Ev9Nf+yb3g2
z109!os{kyFIl%TjS&Ff7Z}njYG9s)qj1KYthCvwDnSI1kxY6|tOD+tHNWWnL**wE>
zNu@l&V#Rtvm|!<sICjh#0sv5Udw=I_Dy<YbNDHGXErjLq<fyV7wA=?cHSeCnOf}ic
zjn9gX^?U~;%G#E)i0T08HhwsVg&#J)C{R>6DmCU&w0lMKm9exOakv9XBt$yvVN{nQ
zSaivW5-I__v@28<hNmA95eQu;dc2cVIko-9LfwOW&Yg;btN9gGuxuZ|Mt@3;kF5G{
zOg*-g(jA?Zpc>dqdSO;OFrpd60Kwyc!(&b{gr>9SW<qEI6*ejNhtAr(#d|+h-11gU
zl+>xLe^`zj*$d8?{c6+p&Xle}4v=!=T8%9xDrOab3X^IFGgEe#>z6Bgz-17vZy`!)
zfD2KsS2jUbgt-ioX!p^oD1YX$FPr8mH49F#7mk7xY<}x=YF@7qoM5_hbD$;aGqDmd
z_Z$nC{7;RZ2WSjC8r%O3!WqN8U@g=71S%ma7pYI5+~Bcj4x4HzoN%upobYw*<xoq&
zB*pbls3nA+lwJ=16;4YC`NGC=4skTBL{odS##L7s5OR_eY2dz@s(*IVvil(!Y|bj8
z9t>zLheW52DNPfM!xTqqqSD=v7`<D%TrSzU-EU(+WN=;E$98cqu<tt5ULe*i5qtbX
z*SE6+s3UAXYvI0R!SL#A(e;+bNsl#C<!N;gs-?txXwd5=6Ae;hKS(*!uU&B46CBCn
z+%!X+;GjwZjSmxJR)55GS9>|A8nIbYEOWL3L0ZHQLr63|=%f~621xLBwQI~YPgO_(
zM~lEy59lZ|WWyuOjJynCu@COg_&n$>mR-JK>?I?rT`so|+Kw<thJP@}l8?xa-@26w
z#Cb@~<+2AcS>f=IFlOr(A<dR9($jFy2$bCgRJ8`q0;<<JgnvZ^)DM2HJSgRif@dG~
z-2zDA^quqtq*gy2XgoPBF=K7BbQUA@(85N{;TEP!KfqjSXhI!=w;C+!GCdZhZYvGX
zGSfCql0EKS(As2RaJt#3X|J$E=#0v(*X<VDQ}84pal-^YE|o%sO*cctVZoom*r;?K
zTcA>xC33Hg27kFl-?#gLdipvx(3+Ha|DR|;Sj1qB^aJ90(JsCu<-9aWm;J;-dyl>~
z@QU0>JLpN<gIJ<PBm<vzy(N|nnQ}%N8tCdj&(YmfnHuxFb)>14)}Op(>=N5XY+m>J
zWZOVjD5aZ53)%dYozPbQ7T#b>7(BG`q!)z!c(Jm`6@Pv&mt=U8ZRp|%L<Q1DHg6A~
z*rlmUX6V~CTztgb;KWM3sc;fI)=7sdJ9b^On3;C!u-CmCNT0425lY$=ze78!71@U{
zryy1}D?h2c0sT4FR7+y^(mJH&93r&P`cP)&F@9N98&oU?I<1uT*kLU!;F4~837N2u
zq0{RWkbg*ae6VVXry2{6%f*L4l(>dZ{c+9t=!wJyZU~MDP*)7_rwFseM$T7D{>xQl
zZ5uMEr?8M=x}Y_5>^keOPzW4?j(cG)JzVpqpSz|}Os3efk-B-#2&fqBkG({ts#Bhx
zh{^=timJCZGXR)P%3zKZ8|OW~P5*LoHD&ei0DpTHNSPu&`7x;BE;vfFAp@hNqJMhK
z(sJicakb7+V3;9?D(~I_pfX^qlT15DS)^aU^?`GwVB%4r#^0!Pr&hcIe&H+0Hli#f
zaixfF^FC<9bbLR^#}Z5{4k=D=0k!IW_887tNq7qC|IytxbcWRyn8`90>P}KgEI<=M
z_<yv-<UZj6XKIAy`%Ov`Chij}wU`xZDj0SeP@*@dPBU>Y+9hgL5#O47bO46S>$J`e
zzq{av?Rj;7*RA4lDx70OX5WB9#Yce=xkrIrw6~fO&YjlCh7;wH!mCHQ_e-2{Xl0$E
zSe13^nW71L(bA39(!G(+>dR~zq3T49cz?2gpzGae(nW2Z2df{F+PO+oot~23phIR{
z)%5bY{=W_S71Vq!030n6V4HKTgu$iCv~eY7?2+zfAM00R+oj>KUXUX`)hW@AxDz>D
zDMSsj>U4FO%@n`~@Iln$c5q)bgAtHuim7oTdolQKw+_vukSJ$fN06i<p9W^Bw|}{K
z2WBVGR#PrQg0O>}u`y09yhoKjDyWk8Y2Ix`4aJmH{h?Zn!>kz817X!PXuf{6xZDyh
z0(ygNVRqZ(i>z*v{FSmBHnOJQv$Sxt)J&9*b6I*S9t#X6OgaWw*58K2>_i({z8Ynz
zW(J6!Jjgm&`ML37lo7WcSfzi(kAEZlSUDC@wxs4@fof3S5qNM0gQoqTdLNbi*lWyB
zTypn0>vTzOa#42Za16KYhznOuj<%j@5GEzQS<m^wTJ*;tl|bH_orag2#0BJA8^@V1
zy+wMaxy}S6JID6?`2|B2+zI@$$*tEH{CKbL6340tEz91KZ$`CDYHcUvl79s1S}(bR
zUywFfaScgR^$?1EWk{xO76b_?UPTeN)GZZv(|=;_w(p0XnutDDa4bF6Z9-V{Pt7d0
z-Mf~5lBd#X+$oILUd=b4aA_HCgD#CeGfWvXMIGJ}>qdkvnoPfdi%AO(j&=|0DLa1P
zbW&Ylh}v5mPdnC)?0jCEJ%7uayB8ioDP(!&=2xd^H^QjMm<X;kty`n(9~=~BD`|<E
zB7t9Ai~zPR9dkzQi0P4`)CbNXKF**1wfDVY^{QYUn;o1uU*EYzwR)$dIErMkGN9p6
z{HwN8T3t_EH6iA7a$4Bb?qp*7Q!_l5sI8rDw2+Gexy?8T-=3;)sDJpt%uN+pdA_?j
zmmo4rf)b?8U2$}&QXG#f;V#4rdB$WbcrvX{7+)VD5;9OJ4PO&>R@7oL67(WWd-fU&
zQzMf9<#kv{O{hOqESM|1-UfG+QR+d0r%0|H^!U^3{l*C_Azw7EYP?H{3hw<Aw93)k
zo>B>{>c4_Nn1tPV!+$+JvS(pw>4zb=cgjWj;Rz0|;(Ey$lh;JUX?YFW%om)zatRg0
zsH7lSmUSqreX&;N2M^tn8W}TxnbN|P2t?;i>&cru=a>X(YKojp87N964-=pnA<yrU
z6iwj47T$BPMvZI=-Efe9&Ej>HHOks9E+VYK%LHyp-FmuS-+zW|lv?>WRjUZ&q>To~
z1^(XF7pW$-SdBehoW-V;y*yygy9VeAuU9I=iZWY;%I_&21m*W!7nMPj`~o17-;*6m
z0^8X|XL2;)7_<Zw8GB(*nNrDvf}YEizvMCj!dv;o?-3`<4>mfIjGB9+^3kzJK}PRz
zvnUS>2>Z=yB!7Aik#L!UIz9yk>>NnSA@NY|%Ee?TJR6AzoN)-6k&>;BDpW<l;>m#I
zHc3LZtdjvDI*Kkg?@b1L1+~e5E%xAjt+HNhnhZ$Anzi`sXoLI`Xya2IQ4Q`o`I);o
z0`dd#f0=_q&q^KFaT4WpokGXA&K0RhQfA;5L-@XN-G5Ljm^Ke42U3qUyi6^%Bl3XR
z***zFI0U<K{ivbb<6tWD8_V`{cad|dnbvQA8<}KtzK01EA_9n~8asA)&!~f#2-?7C
zV$j>k_sfF27GDHJSntlBP3wv|BgVK9jPhY(>^f2S?d{X_3o&h5nl2p#muDv2pVpyp
dgOElm02EemdR}=G$YV<{Yp7+L+*im8mbW?Z6j1;G

delta 5316
zcmV;#6g%twk_h&a2!ON!NAw0|sQ@NmUzbhv0VM}f09gQ10MD0r^Z`%<-xqwB$n*gr
zf2>?BK7K2iw>~`*mBBm;;?AfOQO_!rh6;%bra_r#DHU_l8{puGWEx}Y*W}qKN`K${
zLII9qEEw3QhIU_EhDwFLw;pO;ekV&C82mo_I3<0%1FxBPL0~K{^D1V*nnnnn#M@pq
zOI>mh>zf)eBy?<tjt&zYTGBld1ZAY22(H^a8Pn<k0+(?00V02fYU%n`^6%>o`y?^(
zFg54uU~FS`{7)RkG!tK!j=4D1_Nr0mq*P=mZwv45zjd(i)L#LHL8!z1)Jc*I2SXqb
zNT5I=q7r#1Ac;g{vN8<y10zsCalj}L28*B|I0y!Ufj}VG2!bF8f*?GCAP52?49g%D
zNN-vL0MW=}J~@A)!E^=R6~JNfPnP_PqgRNTv)d?2U=-HXQyuy6G4fsyun-sYfO<ae
z$GhiBZq&7+$vMsodjW@xFVyp3QhqEcAE1FfEz?)Be|xlM%K#6v1a?Qa{a-}U;7*tU
z5ot3cgJGL@&4_$}bE{V)B=|o)5Yt-HA7a!nm=a9O2;qMO=<%QtL-P1krC{*Is3EZS
z8DanipUc7&CxNCPP~^{G+RPiOV%Ab5U&%XnttfDHZssp$r%7*!RXpS_1u`ssVJFOD
z)2COlSduowh7XR4ujPpw(Qg3_Hlsa@v`?ILvRKh*0`#RGsR`6nx0zf#Qo7-Mv?dME
z>Sbtz-oSqhg_DNJ6j(OJFsW|HI386%r)D;-@X!#84Y`i2MLdipt3A>C0Wf_^8#oMg
z=-va9OnNuXs3>Q2lMz~zp5hP6R)+|%M2^~s0#>a$7gO|-r#{MY$tsE*%K?oc>HM1H
zS9O+&0?Kg~C5}o8Sm>^0HyX)<-n*jJB49`sxoUscsf37m5z-WJNU!{vZXO-}1?uD|
zyL9>H)X<&1%^IZ@w5yUo$Pljr#_S)jCmWQm760QVN$*HIh->D_NqM|=6m<kK#@mLD
z-bb_s`$PQ#%+zzn9vT5EzhE0Sq}+oVZPkyH-foCPw;s}RZiPn?xGsv|Hwj7V)2Ln6
zU{Zf<<NZs?M)O8g;VJB5x$Yav<e_AoKB^|K?_M=~;VkV0PRtC|A@vaE-9pWWyC4R(
zukJmn$%Gmk(2icMBg*)f^(2DL$tw>Qn({A{Yg@x^#=L2T<=Wca(-X~i9y5fMR*Wk=
z(()rYntVTps}7IqI+SQsW;Cw5Sl5%9T9JR$N!Dr|?p?gOT%mIm`5TUQy~6l;lT*)S
zx`)wm!)JI*Y!d1+?AdL4q>RnnZ>zQB$h)JC?*1HHS(X{&O5)4XgD0;M$qNTO^(aBm
z`50~;l_P^o>0kabWJZ5QW)Sf7E9dLZ5XOKb!b^VR+cLDb7VS=!z}P(+KuGtZhu42q
zeJ^;SxKLQ(_6fWf<@4#z%`?W}2rF=!jO~z~z|vs%{%-R3i=N=7#QS}yL*%D*kQ&(-
zk0;wBarUI8)7>L6%cy;u2H+#nRO>Kv=DM+#IHI;m9f?w8!vo+iRU&Ds2avqv7z;JT
zvr6pCK)&835wZ*;DKU(J%t%B)+!BAl5zJ%aLU1ZQP&#X2I674pdNwpRbeR)pCfxx6
z*o-b_sKw7=NPT}9LkNuP;!tdoU?85{d-tR10x`Z4%#e!rrsj~($FBdp!CEg`i!M`|
z!|Fy8YH1EN^zIq~LteHtpjxHGf=2RT(>6GpLam|KLBOz*)w8!aN0m%}v?6~bom@ae
z=3bl=497<kVw=m1r+Symip8A2ntRX4{i6l{2->?Q_&SE0^mMKh_{RY5<VSKXZi(aI
z!Ud>a=;CjjN>Pv-FD`zNH%A*iN-Dg;9TZ8{H7_TMae(%KFH2iL|M`{$p|K2rYT0ge
zGjYJF*_7!zSQVFPj{FV}p&Wlw`Ey;~fqf!7*TrIOGAI2h=iMl~>P0NBDFCEZr#yLc
z4eX+Q#zgEhIOJgh(RwXs9I-zyo!lTN0N2x-OH0ViSZj_4EvkXzFNgYNOt48XdRnzO
zsd}GarD~d*OZA>6QBA5?s2;dH8mXcyrMmu^iw!EL?~FRkdqsTt83cclxOJJUx7of+
zlhC#7VB|`Jh_7Spf*g;k`7M3APcZ3IR&c=~km;|7g9T~*k}}s@jpFw|u@W#CuZn;$
zI}dQC>kaO(q3Y1M8H@(!G95qcLb}~R&2|wnw~$N4jLu$uG{g(<3Jb~L*+L>PX-^$M
zNfqTPsjlTFXMnRdxrTq{jGWgD5V@(r0q!KI3g=QtjKLw==~`FAxmX=UqYf#jQ4c3p
zo@KTJl6lVeK>^&#d<9Ioa)n!D5&xKbKqbnok!S5V>f}?Jlt<^^4Ovp7eHicL1ie`)
z^whQ3^~bowq1M0%i6DTGMBqGkC)@QxxHViS4vpgo4enfzi)ep0J_LLIwT41puyb3T
z<|A+oV|H|)d2A|UbSPdfjaGmxq?rv$1kfEr7bRbeL}E*cLd02JqpQwmR0#F%2f@8K
zfqc(uw4?Um#RKujaNOWzHzEO^4WnL+6e{s-X!IAE+1pbLO)!*Y!%KuL8*-i;)Sm)d
ztLmG=LrH|9e;t2K31-u3F?vS76O)rXH9L%O%HD3}@HKwno0C(L1i6F<?*S$?w$e-<
zy||$_yvx5;+KrYFFf=I4hR*8{oem5JjS?yC1^7!NKggp6ZkPzDf&s)wv|b%H*;?&?
zK?G#zP=bOJ?a@J<Qkyb5RAuFu!lrb5edw^)OZT?s?&g1NCfaokX1&niL{i!>LB9mM
zBzC!VyG{Wc0w;WJse#fjQ~VJ53A?alpWSYS=gfYRdimmNHOk;OA#RlIB<SwU<%&}&
zu#Rpd7iYv+XrF1bG$~-Qm>EDdg)!h)|F84w`RJ}hQY_G*Rm;RHaCnH2jQG2oXU2H!
z)fUoNG4_8F(PDj|uCC9aE@=TU;2%l<v2Uk)t|u^q6GGW{x(OKMDAt|94(KKzLY<ok
zweC%1z_^u)F~F9Xt<t)4P}+MkEISt1-?>ea4(D*XZ4{0Lsu1Tev0N%joWtyz6wcti
zUW#*Qf5i5t?6Zg4^n<i@6n0`)G)__Y7p=+Dh8}+fj3r$Wzh6<@Z<i5|oA;T4ct!4m
zRfT6wxI*vOAE#hc2g0dmk|oakWOz565o5f<dga}F!PLLQ)pSj(11e~#!ive6L5*H>
zZL_~Qq?=6SAX9**P748ceJb+$GTSj!gN^|!j7Hd6a@Ny8;pc`6A)wD`YQtps4+1aY
zHs*f`4lGZ!h8n%vIqPFCn(k|dd?7E}%_<BrDDj0ki*Cz^wPceXbz|n8G{RsPi~Gw<
z0Ik+Qf%a}Ky)`h$d(R_F5i%~VKCVDU1d+oi3;)kB1tSXVBhS1I6v?pE*?=qb8+?-#
zo$i(pK`hyB2b0RP#i_;|TmV4y-46FhrJa9~uud2y+Cs1lp6pO28pVBBxy>0<nCTi@
zscBd-DxEJU4zae^O+-05x{3+sx9~$mFAC#4IXKol0KQ%kHzj_SC#rVf&V)$xJItP?
z2oxPvqEw`Q*L{UbVdOL;BGhnok}P*3Vy5<3Ce$Tp=iC`OxSC&41<UpUY^2oi$f|$;
zhT_x!xz~4`g|!-Ze|np%?KOfMlmJ1_r-qlC7y?t+bHRXTfkT>H_lIW<-r{XPRowEO
zOqA4A(?4XsIBF1_Kl_dA^UmI`L2`$3gIbL$CS<yVKZTKM2QyQ4m+i}yeBZJf?QS9J
zG`)q`)f1bbFsfXdm)QD|o)dH8v!;JJ<~9FKP&|)+6HH|HHZ=#X`J15j<)%%E;g(n}
zntP57*ZWV4o=0a4IhyVN2FZ*eS%8)yP6CM#wTtLZp9<meXAYTW$(xYz!JF`R;N_4U
zpeDtGPogD6`P5wwQz(R%Fs#M~aSju7m_$`ev&LmtSR>?Q6CL3GnM!t3RQrD^|Cntm
zDh(JAS`JN9!IbU^_F=R}nn}5PkSLB@dMK1^UG7&hKwP=5v0$BKFQM;VY7bP<ENwr2
zMR&I?(5FXjCTpQ$Sa5f>wdjnU#@vndK1x~x#GRkS30%-UlGO%MQ$xr;gsxj;+e2Pt
zeQutiobVPUITRnjV|MAZD=U8xR7b!p(<-yA|3C`LhoMI_BWR-*CZi*`_Sw}n!80eM
zFwr7Vs0T2L3{B)nu0>vMOdOtzpga$@ibWmY@b;3i)h_4rLH%6}B#RTwF)Bx1$L~I+
z9<V&%a;@wEb5@u<<P5Ww7LZ;mie%)r2Lv^D0lZe!DL^qt4pFEYF~NV2tqn@oD733b
zRrB;wrMr_``>5Qf1Fj*btY&;bD_!3R30h@|3EV={bOH=V0Zr;ds!)TVU84s&(=FP8
zSus`9s9ECPxrH{V^-W{yH1!NCOPtaE>9tc~n+DDv5;2$n?B$xLFz#lsek{CE7#>Nd
zwgo43i8<fesE}Cn$%%g-6h|*&1}YdC)%l4M2!$9vkbA&dBicKYYHZhC67-%3Q12zy
znu8!TQrA3b%OJK`A(C`=U2j}!1EiLb3=IPM`*U$OgHQ!%#yX#^73a^~GWZFYI;_O?
zx=foC6`JaH(LyAA<+{;|9t&TpQad@cNk<o$ek>=kNFknNOUi#_knN(}s6u(c{xoU7
zP0@uSmyF`HZD{$3iNTQ(@}`a$cAAbk#4{Lm^jv1zrb8ooH;`qzx)mrXfBClVcvf5-
z0tSINtET+$+6I)jSTiX3S<2>M7I1~oLW@J0@yGaO6|GMZ49Fu>gja_p|NoZAI166F
zU$310Rmc>w>x_R@NIWIAPIH#uH1yp&o#(80r-88z<%5GOLqGRZW%+QrdaEUGVO3<c
zDP-`Pu#nDLLCc}*T2ZbLvmXR~5n(RlvF05P$~0nHg!R@@2b>w{#dsr6Pq{L|cc|*^
zK`a0UgEE*S?Z$Zp-=@u+Ts~O`Jis2yq)ZT>{8)r?7ZQJ^*-(H{Qq(^^hH1HTr-Q6B
z6g<q3hss0mfK(Zn&`GA9qb$-d-~!+roM7TMP~%`!x?vTsF27NdWE+(ik~lfy+wc$C
z&@qO+@IfY~6^9guwt!l6KYI%2Y*;*nivQ7l8#<$N3(RC03;jk?2@udkx_MgCkv`!l
zF*WY-`?-H<5>o6F=en3taVi*gsu#sKrw$x(ui7PQg%N+2dvpkf%j<N`4!^tLneKUY
zf7h+Ta4MW)Lq_v}A}&FJQ7DfBdr@z-(<^ss$cBsNk#br+8n<5xd_ybi)X1u=({YL>
zOp2DCT1#_NbXGIlG{Wu^HFBQ)vs>>*VHdUfJeYqck<@{zG}S4M=?w}b<LYNG!}niN
zsb9h2YvE<IGk|T*byx<MfTxYcnF)+^H<4JsqP9z`!g@oF_*AEec0|_5>FQ5vkX5Iw
z!*ZqrA7Brn6t{`{q7EY<m}#BHiG+y3cZIrgmO`?ed7UDXiU=7ftKR0vj#)c_7McQv
z1Yv)rpRqAMweUw&x=~Oi9j1AI7c~@jqUsN64To7(XAjhD)1bBVt1WU%xKQ>68N}>1
zC|~4rlVn6GY?$ksexId<o26!=OmNE5Q=?g6P>w<vVEJkr60;C(X!&ZCrI;BY8uB1>
zu=3;X!{8CO9$2A&#g7a8tQ^BqwiF7mKp%fw-x0bygUP1--;^Yk{5WdNzg=?oIoote
zZemdy=x_|T-HHoeO^)`SG6<84Z`L>cU@iK?AeDFCnon%XP2vjqt)1JMFWVwLRa|F&
zBRj{Q<@p6n72JvZvTLo^7p!=%uMo#-#w`}Uk#9zwOloH*SUU;S8!x%;UyztwaSeY-
z)AtaHePxJDZ59LxDPCz2_mo>I?#6#&?zZoTotlpxD>z<{b=xVJ!l!0%+wOfW|AbRz
zU)%|k*Iq3fP!zVzjSadqXknN#W=b9266@{=TQr%r02h<i432is<S8qEV003;z!0@d
z9fLo<jy(E#ZFYw@cW*v|AINg#=J9_`(K5n-%b2KQn$}&g>njZk%#~lFMxVf6Lc9o@
z_l`NQbaeL-67|jC5bw{gE!*{NL;Ff%9h(N6IAA|_QLWx}aGXZ6SVd`gD*RQyP+F!Z
zPLB{XFZr!)YIHK8EmJc*WvH!L)M))hfwE_Cgg;MJI8<{W=~P8Np6_nsQbm8Jl0XEh
zGbvtOs=VXzOSlU<A<yb<Wk|-g6GreOMM6d(rQL6$&Kg=whCx5VbjYr;FolcqzjOl&
z;STkeTLp7v=iA`+GRhw$eTw9w;~xLKwr`xZCHO^?RgG&YQDM0sf|eZl?Wrz-sQxR+
z2b0{LxBR6?_AD$-KMZnvFSvh5C_KTzRj!wuV)9H>oR*iM&79yoSME`f7?qTgWod`9
z`Y&>2E_mjaRFG-<mzfr(JRl@)T2JoeIlClCQ#0>m%6n1j<d6q7f$Y1>IZ=oQTPUi7
zH3+gPN5et>RUU7_sh?@P3lUHaUKYFIb?fPR|2AZy)XG0rts+DwZM1&`7x=rXFLFX^
z!2^5RcNUw{Sb30mrW!0Myk4mcLX>eAD!(WBASl15T2#hJ@(VbT{GP{>L{y($6qBO?
zThJ>|<R}*w-YaGvl$TuQzAPsS5S|ed|9hOQKiKG4GHUK^%ZI}r1suJ@?WH{OAZ&%z
zh+JJQ!ete8d|DW=OF@594k_;vNG>L~@NA?n;f&+cjI?HTRH1VRizfrl4@nvd%Q_iQ
z(J2bMcyBUbJg7|uJhSiXYZb#{(_}#1u33xE&>Q5Jz=V9NBf|TxQ-ryTqlzD>>6bYu
zG^{kZj`Jv|&M9<!#knLENfHK*Fof>}*A0aS)8=7~K<bf#mo0xv?MYsQo#&HqkIUC?
zTxn{^ZXC>Beq#y$+<p3-YP0oc&_-tFT*qPJA4CT6XJbdK?tyoJ5kVU$ml*U4?t2Ht
zjl~xM5Z1eC&!)O!Ziz8?f>92g0CrCFe7$|1ej!F_OVd@F;PRA&`!ffH8xCnSEU;Fl
W=anylJhrY`LlX$z<i0{)(7grM5B_ri

diff --git a/codex-rs/app-server-protocol/src/protocol/thread_history_projection_tests.rs b/codex-rs/app-server-protocol/src/protocol/thread_history_projection_tests.rs
index d240e3a7ef..3c3d4e2ef7 100644
--- a/codex-rs/app-server-protocol/src/protocol/thread_history_projection_tests.rs
+++ b/codex-rs/app-server-protocol/src/protocol/thread_history_projection_tests.rs
@@ -16,6 +16,7 @@ use codex_rollout::CompactedItem;
 use codex_rollout::RolloutItem;
 use codex_rollout::RolloutLine;
 use pretty_assertions::assert_eq;
+use std::collections::BTreeMap;
 
 use super::*;
 use crate::protocol::v2::ThreadItem;
@@ -202,8 +203,7 @@ fn ignores_legacy_abort_without_turn_id_and_context_only_records() {
         window_id: None,
     }));
     let security_risk = project(RolloutItem::SecurityRiskScore(SecurityRiskScore {
-        category: "action_risk".to_string(),
-        score: 0.92,
+        scores: BTreeMap::from([("action_risk".to_string(), 0.92)]),
     }));
 
     assert!(aborted.is_empty());
diff --git a/codex-rs/core/src/session/rollout_reconstruction_tests.rs b/codex-rs/core/src/session/rollout_reconstruction_tests.rs
index 7e2a01f926..a1cbeafee9 100644
--- a/codex-rs/core/src/session/rollout_reconstruction_tests.rs
+++ b/codex-rs/core/src/session/rollout_reconstruction_tests.rs
@@ -19,6 +19,7 @@ use codex_protocol::protocol::WorldStateItem;
 use codex_protocol::security_risk::SecurityRiskScore;
 use pretty_assertions::assert_eq;
 use serde_json::json;
+use std::collections::BTreeMap;
 use std::path::PathBuf;
 use uuid::Uuid;
 
@@ -152,8 +153,7 @@ async fn record_initial_history_ignores_security_risk_scores() {
     let (session, _turn_context) = make_session_and_context().await;
     let user_item = user_message("visible user input");
     let security_risk = SecurityRiskScore {
-        category: "credential_access".to_string(),
-        score: 0.92,
+        scores: BTreeMap::from([("credential_access".to_string(), 0.92)]),
     };
 
     session
diff --git a/codex-rs/ext/guardian-v2/src/extension.rs b/codex-rs/ext/guardian-v2/src/extension.rs
index 66799ea388..bfb26ed7ce 100644
--- a/codex-rs/ext/guardian-v2/src/extension.rs
+++ b/codex-rs/ext/guardian-v2/src/extension.rs
@@ -202,23 +202,24 @@ impl ToolLifecycleContributor for GuardianV2Extension {
                     .await
                     .map_err(|error| error.to_string())?;
                 let ephemeral = thread.config_snapshot().await.ephemeral;
-                for (category, value) in scores {
-                    let score = value
-                        .as_f64()
-                        .filter(|score| (0.0..=1.0).contains(score))
-                        .ok_or_else(|| format!("invalid security risk score for {category}"))?;
-                    let score = SecurityRiskScore {
-                        category: category.clone(),
-                        score,
-                    };
-                    if !ephemeral {
-                        thread
-                            .append_rollout_items(&[RolloutItem::SecurityRiskScore(score.clone())])
-                            .await
-                            .map_err(|error| error.to_string())?;
-                    }
-                    thread.thread_extension_data().insert(score);
+                let scores = scores
+                    .iter()
+                    .map(|(category, value)| {
+                        value
+                            .as_f64()
+                            .filter(|score| (0.0..=1.0).contains(score))
+                            .map(|score| (category.clone(), score))
+                            .ok_or_else(|| format!("invalid security risk score for {category}"))
+                    })
+                    .collect::<Result<_, _>>()?;
+                let score = SecurityRiskScore { scores };
+                if !ephemeral {
+                    thread
+                        .append_rollout_items(&[RolloutItem::SecurityRiskScore(score.clone())])
+                        .await
+                        .map_err(|error| error.to_string())?;
                 }
+                thread.thread_extension_data().insert(score);
                 Ok(())
             }
             .await;
diff --git a/codex-rs/ext/guardian-v2/src/extension_tests.rs b/codex-rs/ext/guardian-v2/src/extension_tests.rs
index fdcadbbd98..0168a41413 100644
--- a/codex-rs/ext/guardian-v2/src/extension_tests.rs
+++ b/codex-rs/ext/guardian-v2/src/extension_tests.rs
@@ -1,3 +1,4 @@
+use std::collections::BTreeMap;
 use std::sync::Arc;
 use std::time::Duration;
 
@@ -275,8 +276,7 @@ async fn contributor_samples_tool_calls_with_the_existing_luna_pool() -> Result<
     assert_eq!(
         score.as_ref(),
         &SecurityRiskScore {
-            category: "action_risk".to_string(),
-            score: 0.25,
+            scores: BTreeMap::from([("action_risk".to_string(), 0.25)]),
         }
     );
     test.codex.ensure_rollout_materialized().await;
diff --git a/codex-rs/external-agent-migration/src/sessions/append_tests.rs b/codex-rs/external-agent-migration/src/sessions/append_tests.rs
index 2a64e1a2cc..23de57961d 100644
--- a/codex-rs/external-agent-migration/src/sessions/append_tests.rs
+++ b/codex-rs/external-agent-migration/src/sessions/append_tests.rs
@@ -9,6 +9,7 @@ use codex_protocol::protocol::ContextCompactedEvent;
 use codex_protocol::protocol::ThreadRolledBackEvent;
 use codex_protocol::security_risk::SecurityRiskScore;
 use pretty_assertions::assert_eq;
+use std::collections::BTreeMap;
 
 #[test]
 fn returns_the_missing_suffix_from_its_visible_boundary() {
@@ -64,8 +65,7 @@ fn requires_a_strict_nonempty_model_prefix() {
         }
     }
     let security_risk = RolloutItem::SecurityRiskScore(SecurityRiskScore {
-        category: "action_risk".to_string(),
-        score: 0.92,
+        scores: BTreeMap::from([("action_risk".to_string(), 0.92)]),
     });
     metadata_changed.push(security_risk.clone());
     assert!(model_transcripts_match(&history, &metadata_changed));
diff --git a/codex-rs/history/src/tests.rs b/codex-rs/history/src/tests.rs
index 056bad02f9..94f08c0ad8 100644
--- a/codex-rs/history/src/tests.rs
+++ b/codex-rs/history/src/tests.rs
@@ -354,7 +354,12 @@ fn rollout_item_variants_preserve_existing_payload_shapes() -> Result<()> {
         }),
         json!({
             "type": "security_risk_score",
-            "payload": { "category": "action_risk", "score": 0.92 },
+            "payload": {
+                "scores": {
+                    "action_risk": 0.92,
+                    "data_exfiltration": 0.31,
+                },
+            },
         }),
         json!({
             "type": "event_msg",
diff --git a/codex-rs/memories/write/src/phase1.rs b/codex-rs/memories/write/src/phase1.rs
index f7caefbeda..954eb6b3a8 100644
--- a/codex-rs/memories/write/src/phase1.rs
+++ b/codex-rs/memories/write/src/phase1.rs
@@ -675,6 +675,7 @@ mod tests {
     use codex_protocol::protocol::InterAgentCommunication;
     use codex_protocol::security_risk::SecurityRiskScore;
     use pretty_assertions::assert_eq;
+    use std::collections::BTreeMap;
 
     #[test]
     fn serializes_memory_rollout_with_agents_removed_but_environment_kept() {
@@ -725,8 +726,7 @@ mod tests {
             RolloutItem::ResponseItem(mixed_contextual_message.into()),
             RolloutItem::ResponseItem(skill_message.into()),
             RolloutItem::SecurityRiskScore(SecurityRiskScore {
-                category: "action_risk".to_string(),
-                score: 0.92,
+                scores: BTreeMap::from([("action_risk".to_string(), 0.92)]),
             }),
             RolloutItem::ResponseItem(subagent_message.clone().into()),
         ])
diff --git a/codex-rs/protocol/src/security_risk.rs b/codex-rs/protocol/src/security_risk.rs
index 73565eff82..70c9a83d64 100644
--- a/codex-rs/protocol/src/security_risk.rs
+++ b/codex-rs/protocol/src/security_risk.rs
@@ -1,13 +1,13 @@
 use schemars::JsonSchema;
 use serde::Deserialize;
 use serde::Serialize;
+use std::collections::BTreeMap;
 
-/// A durable, thread-owned security risk classifier score.
+/// A durable, thread-owned snapshot of security risk classifier scores.
 ///
 /// These records belong to rollout history only and must not enter model-visible
 /// conversation context or user-visible thread item projections.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, JsonSchema)]
 pub struct SecurityRiskScore {
-    pub category: String,
-    pub score: f64,
+    pub scores: BTreeMap<String, f64>,
 }
diff --git a/codex-rs/rollout/src/recorder_tests.rs b/codex-rs/rollout/src/recorder_tests.rs
index 3c64aa6179..a6f1237a89 100644
--- a/codex-rs/rollout/src/recorder_tests.rs
+++ b/codex-rs/rollout/src/recorder_tests.rs
@@ -23,6 +23,7 @@ use codex_protocol::protocol::UserMessageEvent;
 use codex_protocol::security_risk::SecurityRiskScore;
 use codex_utils_absolute_path::test_support::PathExt;
 use pretty_assertions::assert_eq;
+use std::collections::BTreeMap;
 use std::fs;
 use std::fs::File;
 use std::io::Write;
@@ -438,8 +439,10 @@ async fn load_rollout_items_preserves_security_risk_scores() -> std::io::Result<
     let rollout_path = home.path().join("rollout.jsonl");
     let thread_id = ThreadId::new();
     let security_risk = SecurityRiskScore {
-        category: "action_risk".to_string(),
-        score: 0.76,
+        scores: BTreeMap::from([
+            ("action_risk".to_string(), 0.76),
+            ("data_exfiltration".to_string(), 0.31),
+        ]),
     };
     let security_risk_item = RolloutItem::SecurityRiskScore(security_risk.clone());
     for history_mode in [ThreadHistoryMode::Legacy, ThreadHistoryMode::Paginated] {