Propagate response tickets to Guardian reviews (#42758)

## What changed

- Request and parse server-issued Guardian tickets for eligible Codex backend responses.
- Scope each ticket to the response that produced a Guardian review or classifier request, including HTTP and WebSocket retries, without adding it to model-visible or persisted context.
- Validate ticket shape, reserve its metadata keys, redact it from debug and request-body logging, and attach it only at the Guardian transport boundary.

## Testing

- Cover ticket parsing, endpoint and authentication routing, retry scoping, classifier retries, and redaction for compressed and uncompressed requests.

GitOrigin-RevId: 6219dd15c9f19ed3387de516aac1b8e7c9cdb0e3

codex-rs/codex-api/src/common.rs

@@ -96,7 +96,10 @@ pub struct MemorySummarizeOutput {
 
 #[derive(Debug)]
 pub enum ResponseEvent {
-    Created,
+    Created {
+        /// Runtime-only receipt for this exact server response.
+        guardian_ticket: Option<codex_protocol::guardian_ticket::GuardianTicket>,
+    },
     SafetyBuffering(SafetyBuffering),
     OutputItemDone(ResponseItem),
     OutputItemAdded(ResponseItem),

codex-rs/codex-api/src/endpoint/responses.rs

@@ -60,6 +60,8 @@ pub struct ResponsesOptions {
     pub extra_headers: HeaderMap,
     pub compression: Compression,
     pub turn_state: Option<Arc<OnceLock<String>>>,
+    /// Runtime-only parent receipt, attached after inference tracing.
+    pub guardian_ticket: Option<codex_protocol::guardian_ticket::GuardianTicket>,
 }
 
 impl<T: HttpTransport> ResponsesClient<T> {
@@ -101,7 +103,7 @@ impl<T: HttpTransport> ResponsesClient<T> {
     )]
     pub async fn stream_request(
         &self,
-        request: ResponsesApiRequest,
+        mut request: ResponsesApiRequest,
         options: ResponsesOptions,
     ) -> Result<ResponseStream, ApiError> {
         let ResponsesOptions {
@@ -111,10 +113,19 @@ impl<T: HttpTransport> ResponsesClient<T> {
             extra_headers,
             compression,
             turn_state,
+            guardian_ticket,
         } = options;
+        crate::guardian_ticket::attach(
+            &mut request.client_metadata,
+            guardian_ticket.as_ref(),
+            self.endpoint,
+        );
 
-        let body = EncodedJsonBody::encode(&request)
+        let mut body = EncodedJsonBody::encode(&request)
             .map_err(|e| ApiError::Stream(format!("failed to encode responses request: {e}")))?;
+        if guardian_ticket.is_some() {
+            body = body.without_body_logging();
+        }
 
         let mut headers = extra_headers;
         if let Some(ref thread_id) = thread_id {

codex-rs/codex-api/src/endpoint/responses_websocket.rs

@@ -234,9 +234,10 @@ impl ResponsesWebsocketConnection {
     )]
     pub async fn stream_request(
         &self,
-        request: ResponsesWsRequest<'_>,
+        mut request: ResponsesWsRequest<'_>,
         connection_reused: bool,
         turn_state: Option<Arc<OnceLock<String>>>,
+        guardian_ticket: Option<&codex_protocol::guardian_ticket::GuardianTicket>,
     ) -> Result<ResponseStream, ApiError> {
         let (tx_event, rx_event) =
             mpsc::channel::<std::result::Result<ResponseEvent, ApiError>>(1600);
@@ -270,6 +271,12 @@ impl ResponsesWebsocketConnection {
             warmup: ws_request.generate == Some(false),
             connection_reused,
         };
+        let ResponsesWsRequest::ResponseCreate(ws_request) = &mut request;
+        crate::guardian_ticket::attach(
+            &mut ws_request.client_metadata,
+            guardian_ticket,
+            self.endpoint,
+        );
         let request_text = serialize_websocket_request(&request)?;
 
         let current_span = Span::current();

codex-rs/codex-api/src/guardian_ticket.rs

@@ -0,0 +1,33 @@
+//! Adds opaque receipts only to Guardian requests at the transport boundary.
+
+use std::collections::HashMap;
+
+use crate::endpoint::responses::ResponsesEndpoint;
+
+use codex_protocol::guardian_ticket::GUARDIAN_TICKET_METADATA_KEY;
+use codex_protocol::guardian_ticket::GuardianTicket;
+
+pub(crate) fn attach(
+    metadata: &mut Option<HashMap<String, String>>,
+    ticket: Option<&GuardianTicket>,
+    endpoint: ResponsesEndpoint,
+) {
+    if let Some(metadata) = metadata.as_mut() {
+        metadata.remove(GUARDIAN_TICKET_METADATA_KEY);
+        if endpoint != ResponsesEndpoint::Responses {
+            metadata.remove("guardian_ticket_requested");
+        }
+    }
+    if endpoint != ResponsesEndpoint::Responses
+        && let Some(ticket) = ticket
+    {
+        metadata.get_or_insert_with(HashMap::new).insert(
+            GUARDIAN_TICKET_METADATA_KEY.to_owned(),
+            ticket.as_str().to_owned(),
+        );
+    }
+}
+
+#[cfg(test)]
+#[path = "guardian_ticket_tests.rs"]
+mod tests;

codex-rs/codex-api/src/guardian_ticket_tests.rs

@@ -0,0 +1,60 @@
+use super::*;
+use crate::common::ResponseEvent;
+use crate::sse::responses::ResponsesStreamEvent;
+use crate::sse::responses::process_responses_event;
+use pretty_assertions::assert_eq;
+use serde_json::json;
+
+#[test]
+fn response_created_receipt_is_runtime_only_and_redacted() {
+    let raw = "a".repeat(43);
+    let event: ResponsesStreamEvent = serde_json::from_value(json!({
+        "type": "response.created",
+        "response": {"id": "resp-1", "headers": {"x-codex-guardian-ticket": raw}}
+    }))
+    .unwrap();
+    let ResponseEvent::Created { guardian_ticket } =
+        process_responses_event(event).unwrap().unwrap()
+    else {
+        panic!("expected response.created");
+    };
+    let ticket = guardian_ticket.unwrap();
+    assert_eq!(ticket.as_str(), raw);
+    assert!(!format!("{ticket:?}").contains(&raw));
+    let mut metadata = Some(HashMap::from([("turn_id".into(), "turn-1".into())]));
+    attach(&mut metadata, Some(&ticket), ResponsesEndpoint::Guardian);
+    assert_eq!(
+        metadata,
+        Some(HashMap::from([
+            ("turn_id".into(), "turn-1".into()),
+            (GUARDIAN_TICKET_METADATA_KEY.into(), raw),
+        ]))
+    );
+    attach(
+        &mut metadata,
+        /*ticket*/ None,
+        ResponsesEndpoint::Guardian,
+    );
+    assert_eq!(
+        metadata,
+        Some(HashMap::from([("turn_id".into(), "turn-1".into())]))
+    );
+}
+
+#[test]
+fn missing_or_malformed_response_receipts_do_not_become_tickets() {
+    for response in [
+        json!({}),
+        json!({"headers": {"x-codex-guardian-ticket": "invalid"}}),
+    ] {
+        let event =
+            serde_json::from_value(json!({"type": "response.created", "response": response}))
+                .unwrap();
+        assert!(matches!(
+            process_responses_event(event).unwrap(),
+            Some(ResponseEvent::Created {
+                guardian_ticket: None
+            })
+        ));
+    }
+}

codex-rs/codex-api/src/lib.rs

@@ -4,6 +4,7 @@ pub(crate) mod common;
 pub(crate) mod endpoint;
 pub(crate) mod error;
 pub(crate) mod files;
+mod guardian_ticket;
 pub(crate) mod images;
 pub(crate) mod provider;
 pub(crate) mod rate_limits;

codex-rs/codex-api/src/sse/responses.rs

@@ -9,6 +9,8 @@ use crate::telemetry::SseTelemetry;
 use codex_client::ByteStream;
 use codex_client::StreamResponse;
 use codex_protocol::ResponseUsageMetadata;
+use codex_protocol::guardian_ticket::GUARDIAN_TICKET_HEADER;
+use codex_protocol::guardian_ticket::GuardianTicket;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::protocol::MisalignmentErrorDetails;
 use codex_protocol::protocol::ModelVerification;
@@ -406,8 +408,18 @@ pub fn process_responses_event(
             }
         }
         "response.created" => {
-            if event.response.is_some() {
-                return Ok(Some(ResponseEvent::Created {}));
+            if let Some(response) = event.response {
+                let guardian_ticket = response
+                    .get("headers")
+                    .and_then(Value::as_object)
+                    .and_then(|headers| {
+                        headers
+                            .iter()
+                            .find(|(name, _)| name.eq_ignore_ascii_case(GUARDIAN_TICKET_HEADER))
+                    })
+                    .and_then(|(_, value)| value.as_str())
+                    .and_then(GuardianTicket::from_server);
+                return Ok(Some(ResponseEvent::Created { guardian_ticket }));
             }
         }
         "response.failed" => {
@@ -1396,7 +1408,7 @@ mod tests {
         }
 
         fn is_created(ev: &ResponseEvent) -> bool {
-            matches!(ev, ResponseEvent::Created)
+            matches!(ev, ResponseEvent::Created { .. })
         }
         fn is_output(ev: &ResponseEvent) -> bool {
             matches!(ev, ResponseEvent::OutputItemDone(_))
@@ -1578,7 +1590,7 @@ mod tests {
         .await;
 
         assert_eq!(events.len(), 2);
-        assert_matches!(&events[0], ResponseEvent::Created);
+        assert_matches!(&events[0], ResponseEvent::Created { .. });
         assert_matches!(
             &events[1],
             ResponseEvent::Completed {
@@ -1616,7 +1628,12 @@ mod tests {
             &events[0],
             ResponseEvent::ServerModel(model) if model == CYBER_RESTRICTED_MODEL_FOR_TESTS
         );
-        assert_matches!(&events[1], ResponseEvent::Created);
+        assert_matches!(
+            &events[1],
+            ResponseEvent::Created {
+                guardian_ticket: None
+            }
+        );
         assert_matches!(
             &events[2],
             ResponseEvent::Completed {
@@ -1738,7 +1755,7 @@ mod tests {
         .await;
 
         assert_eq!(events.len(), 7);
-        assert_matches!(&events[0], ResponseEvent::Created);
+        assert_matches!(&events[0], ResponseEvent::Created { .. });
         assert_matches!(
             &events[1],
             ResponseEvent::SafetyBuffering(buffering)