## What changed
- Mark Guardian classifier requests with `thread_source: guardian_classifier` in turn metadata.
- Remove the classifier-specific `request_kind` and `is_guardian_mode` fields.
- Update sampler and extension tests to expect the new metadata shape.
GitOrigin-RevId: 1654389ea538b7bd879045634816cbace4bd8f5c
## What changed
- Emit a structured log event for each completed Guardian V2 classification with its thread, turn, tool call, risk score, review threshold, sample time, and whether the score was accepted or superseded.
- Verify that accepted async classification events appear in the reviewed thread's log export with the expected context and decision fields.
GitOrigin-RevId: a027d5991b12a1968b9327da57e2993f0a529ca1
## What changed
- Retain bounded evidence from completed synchronous Guardian allow and deny reviews and supply it to subsequent Guardian v2 async classifier samples as trusted developer context.
- Keep review evidence isolated from the conversation transcript, escape and truncate its fields, and ignore failed or incomplete reviews.
- Invalidate retained evidence after conversation history rewrites or new user messages, including authorization changes in a worker's root thread.
## Testing
- Cover approved, denied, malformed, and forged review inputs, plus root rollback and authorization-change scenarios.
GitOrigin-RevId: 27817e1fde9a136de727048c4220d148fcf72f42
## What changed
- Add an extension API for spawning host-owned internal sessions and a
`ThreadReadyInput` lifecycle callback that runs after thread registration.
- Add Guardian reviewer session scaffolding that records the parent thread and
effective model, plus the under-development `guardian_ext` feature flag.
- Start internal sessions with fresh history while preserving parent lineage,
shared session controls, and internal-thread visibility rules.
- Scope internal-session prompt cache keys to their source and parent thread,
and expose `guardian` as an internal session source.
## Testing
- Cover internal-session spawning, parent metadata, history isolation, prompt
cache keys, and extension spawner argument forwarding.
GitOrigin-RevId: 682dae80397d62bb36247796b447042e760ca364
## Why
Legacy classifier prompts without a `{{ tenant_policy_config }}` placeholder
append the security policy during rendering. Truncating the prompt before and
after that step can unnecessarily truncate the final classifier instructions
twice.
## What changed
Keep configured classifier instructions intact until the policy has been
rendered, then apply `max_classifier_instruction_tokens` once to the complete
prompt.
## Testing
Add an extension test that verifies the bounded developer message sent for a
legacy prompt with an appended policy.
GitOrigin-RevId: 3d776a159340f4dffb6e3c2d7a10b33392fa2240
## Why
Models listed in `auto_review.required_on_models` must always use the full
automatic review path, regardless of any cached Guardian v2 risk score.
## What changed
- Skip Guardian v2 risk classification for models that require automatic
review and clear any cached `SecurityRiskScore` before review routing.
- Count thread lookup failures as failed scoring attempts so stale scores
cannot continue approving later tool calls.
## Testing
- Verify required-review models do not start a classifier and always run full
reviews.
- Verify failed thread lookups advance score lag and fall back to strict review.
GitOrigin-RevId: 048d9a80ac2a282e05437a3abb0c46ec21391be8
## Why
MultiAgent V2 workers can be reviewed after the root conversation has received
new user authorization that is absent from the worker's own transcript. Guardian
reviews need that genuine user context without treating forwarded or
assistant-authored claims as authorization.
## What changed
- Add the bounded root conversation to Guardian prompts for worker reviews.
- Preserve user and assistant roles, and explicitly treat only root user messages
as authorization evidence.
- Exclude summaries, review artifacts, and assistant commentary from the root
conversation evidence.
- Apply the same evidence to both core Guardian prompts and Guardian V2
classification.
## Testing
Add an integration test covering late root-user authorization, forged role text,
forwarded agent claims, and filtered synthetic authorization.
GitOrigin-RevId: 8846de69ba214a88f58f70675798d324e213427c
## Why
Guardian v2 applied an implicit token limit to classifier instructions even when
no limit was configured, which could truncate the rendered policy.
## What changed
- Leave classifier instructions unbounded by default.
- Continue honoring `max_classifier_instruction_tokens` from local or model
configuration, with local configuration taking precedence.
## Testing
- Cover full policy rendering without a configured cap and truncation when an
explicit cap is present.
GitOrigin-RevId: 70eb42d43858e0656129dd438b10b60940fd97c6
## What changed
- Treat standalone `function_call_output` items without a `call_id` as external context, including items injected into new and forked threads, and mark the thread memory mode polluted when `memories.disable_on_external_context` is enabled.
- Include these outputs in guardian transcripts with their namespaced tool name and a placeholder for non-text content.
- Allow image generation to reuse images from standalone and otherwise unpaired function or custom-tool outputs.
## Testing
- Cover injected thread items, external-context detection, guardian transcript rendering, and recent-image selection.
GitOrigin-RevId: ca4e8c16a4b731e1256a5956908d00f785b4feb1
## Why
External tool events may need to enter thread history without a preceding function call and therefore do not have a `call_id`.
## What changed
- Allow `function_call_output` items to omit `call_id` and carry optional `name` and `namespace` fields.
- Preserve named standalone outputs during history normalization and agent forks while retaining existing pairing behavior for outputs with a `call_id`.
- Accept, persist, and forward these outputs through `thread/inject_items`, and update the app-server schemas and documentation.
## Testing
- Cover paired and standalone JSON round trips, history normalization, agent forks, and injected thread history.
GitOrigin-RevId: a3258163a7dc93777c7c3023116fe204819bdbb0
## What changed
- Remove the legacy `shell_command` handler and runtime, leaving `exec_command`
and `write_stdin` as the shell execution tools.
- Treat legacy `shell_command` model metadata as `unified_exec`, and normalize
legacy user opt-outs so they do not disable command execution. Managed feature
requirements and `shell_tool` can still disable it.
- Preserve shell approvals, sandboxing, zsh-fork support, and output truncation
through the unified execution path.
## Testing
- Cover legacy configuration and model-metadata compatibility.
- Exercise unified shell execution, approvals, truncation, and `apply_patch`
serialization across the app-server and core test suites.
GitOrigin-RevId: 5c2fd6164fc3519cdae4944cb9db276b8467311c
## What changed
- Add `max_tool_call_lag`, `reuse_parent_compaction`, and transcript
`include_images` to the Guardian model configuration.
- Inherit these settings from model defaults while preserving explicit local
overrides.
- Enable image capture for Node REPL review evidence when transcript images are
included.
## Testing
- Cover inheritance and local override precedence for the new settings.
- Verify that enabling transcript images initializes review-evidence capture.
GitOrigin-RevId: 7c1965c2ec00a78a0436fa916b630be0004dbb51
## What changed
- Exclude sandboxed `exec_command` and `shell_command` calls from Guardian v2 classification by default while continuing to classify calls that request `require_escalated` permissions.
- Add `guardianv2.review_scope.sandboxed_exec_commands` to opt sandboxed shell commands back into classification.
- Keep other tools and namespaced shell tools in scope, and advance tool-call progress when a call is skipped.
## Testing
- Cover the default and configured review scopes, tool namespaces, permission modes, and skipped-call progress tracking.
GitOrigin-RevId: 32fb540c69959b9a82569f0f2fc76b5517496e6b
## What changed
- Move the Guardian thread lifecycle contributor and subagent-spawn context into `codex-guardian-v2`.
- Install the lifecycle contributor and asynchronous risk scorer through a single extension entry point.
- Remove the redundant `codex-guardian` crate and group the existing scorer implementation under `async_scorer`.
GitOrigin-RevId: 97141190c843e588b8c09c9ccd3fe00e1fae39a4
## Why
Selecting only the newest entries changes the retained transcript prefix whenever a new entry arrives, reducing cache stability.
## What changed
- Replay non-user transcript entries through a bounded buffer and evict half of the applicable pool when an entry or token limit overflows.
- Keep message and tool token budgets independent, and reject entries that cannot fit without evicting retained evidence.
- Preserve user-message selection and emit retained entries in transcript order.
## Testing
Added coverage for stable tool prefixes, message-budget overflow, rejected messages, and chunked entry-count eviction.
GitOrigin-RevId: e6181f5a229a6de06c7ef5db21a5c74980a53e97
## What changed
- Treat configuration, action serialization, thread lookup, and classification errors as elevated risk instead of retaining a prior low-risk result.
- Track asynchronous scoring failures separately from completed scores so approval review falls back to strict review when the latest tool call could not be scored.
- Preserve newer classification results when recording a fail-closed score.
## Testing
- Add coverage for each failure path and for ordering fail-closed scores with concurrent classifications.
GitOrigin-RevId: 7012f078a24031848f2943354a206866286ad9f4
## What changed
- Stop writing Guardian v2 security risk scores to rollout history.
- Treat resumed and forked threads as having no previous Guardian score, so their
first tool approval is classified and reviewed normally.
- Remove the now-unused `codex-history` dependency from the Guardian v2
extension.
## Testing
- Update app-server coverage for new, resumed, and forked threads to wait for
classification completion and verify the expected approval reviews.
GitOrigin-RevId: 74d9caa903a1ff9d38e577b4697b5f8970f11ebb
## What changed
- Pass session-attributed extension metrics to the Guardian v2 sampler.
- Record `codex.guardian_v2.classification.token_usage` histograms for total, input, cached input, cache-write input, non-cached input, output, and reasoning output tokens.
- Preserve token accounting when streamed JSON produces an early score by recording usage from the terminal response in the background.
## Testing
- Cover token metrics through the Guardian v2 extension and the sampler's early-score path.
GitOrigin-RevId: 04fadc07f3b9cbe83f9fa3737536860b5cf5b4be
## What changed
- Replace the minimal default classifier prompt with predictive security-review guidance covering authorization, action risk, untrusted evidence, and browser or computer use.
- Trigger full Guardian review at an `action_risk` score of `0.5` or higher for the new default prompt, while retaining the `0.8` calibration for custom and model-provided prompts unless they specify a threshold.
- Render security policy configuration into prompt templates before enforcing the classifier instruction token limit. Prompts without the policy placeholder retain the existing append-and-truncate behavior.
## Testing
- Cover default, custom, and model-provided prompt thresholds and precedence.
- Verify policy substitution, truncation, sampling requests, and full review at the threshold boundary.
GitOrigin-RevId: 7aad9e2d8c9fbea453dc52147a3d0a46bf191aec
## Why
Guardian sampling uses a pool of WebSockets, while the bridge routes each
connection by thread ID. Each socket therefore needs its own identity instead
of reusing the source thread ID across the pool.
## What changed
- Generate a classifier thread ID for every pooled connection and use it for
request, window, and subagent attribution.
- Preserve the originating thread ID in turn metadata alongside the Guardian
classifier request kind.
- Build request metadata after leasing a connection so retries use the identity
of the socket that carries the request.
## Testing
- Cover unique identities across pooled and replacement connections.
- Verify classifier attribution metadata for extension requests and retries.
GitOrigin-RevId: 1c36207125157ff05cab9487a2fa37bf85e5fdd8
## What changed
- Emit a `codex.guardian_v2.classification` counter for each classification.
- Record classification latency in `codex.guardian_v2.classification.duration_ms`.
- Tag both metrics with `success`, `failure`, or `superseded` outcomes.
## Testing
- Verify metrics for successful classification and fail-closed handling.
GitOrigin-RevId: 021702f3b26565d6da5708d2b8f1f8881942a441
## Why
`node_repl` screenshots are nested tool results and do not appear in the parent
conversation history, so Guardian v2 transcript image collection could miss
them.
## What changed
- Allow Guardian v2 to enable bounded, thread-scoped `node_repl` image capture
when transcript images are configured.
- Add retained `node_repl` screenshots to review requests when transcript
sources include tool outputs, while deduplicating images and keeping them out
of the parent turn input.
## Testing
- Add an integration test covering screenshot capture without the synchronous
Guardian transcript feature flags and verifying that screenshots stay out of
the parent request.
GitOrigin-RevId: 5f70c5f2e80389aa8b2a286c3b7f9b1104865486
## What changed
- Pass metrics bound to the active turn's model to approval-review contributors.
- Add counter support to `ExtensionMetrics` while preserving host session attribution.
- Record Guardian v2 tool-call score lag and count stale-score fallbacks with the `score_lag` reason.
## Testing
- Cover counter forwarding and session metadata tags.
- Verify Guardian v2 metric samples for current and stale scores.
GitOrigin-RevId: 0ec34736d29d2e37ed217a27e773b4f6230ae38a
## Why
Guardian sampling WebSockets authenticate when the connection is opened. Reusing
a pooled connection after credentials change can therefore keep using the old
authorization.
## What changed
- Track authentication changes on each pooled sampling connection.
- Discard stale connections after an auth change and reject connections whose
authentication changes while the handshake is in progress.
## Testing
- Verify the sampler reconnects with the refreshed bearer token instead of
reusing its existing connection.
- Verify the installed Guardian extension reconnects after an external auth
refresh.
GitOrigin-RevId: 6d2e7df776fd21c78be0928f71162f5419a8b8f0
## What changed
- Add the experimental `autoApprovalReview/strictReviewRequired` app-server notification with the review's `threadId`, `turnId`, and `startedAtMs`.
- Emit it when Guardian v2 leaves an approval review in progress because the action risk is elevated or its score is stale.
- Export the notification through the Rust, TypeScript, and JSON schema surfaces and route it to the associated thread.
## Testing
- Cover strict-review reason tracking for elevated and stale risk scores.
- Verify that high-risk approval routing emits one notification whose identifiers and timestamp match the review-started event.
GitOrigin-RevId: e65352894520bfb756c75b2c95e2e149f9767bb2
## Why
Guardian stores a `SecurityRiskScore` before advancing its scored-tool-call
counter. Waiting only for the score can therefore let the test continue while
the asynchronous sampler is still updating its progress state.
## What changed
Wait for `latest_scored_tool_call` to advance before exercising Guardian v2
approval decisions, and reuse the same progress tracker for the subsequent
assertions.
GitOrigin-RevId: 3d92c9a3ccf52f4f43a2454aac60d2479258c1c8
## What changed
- Track the latest tool call and latest scored tool call for each Guardian v2 thread.
- Skip approval review when the score lags by more than `max_tool_call_lag` tool calls.
- Add `max_tool_call_lag` to the Guardian v2 configuration and schema, with a default of three.
## Testing
- Cover approval review at, above, and after recovering from the configured lag limit.
- Cover deserialization of `max_tool_call_lag`.
GitOrigin-RevId: fd870e143d95ee76491180e2aed742717248ff78
## Why
Guardian sampling can encounter temporary connection or service failures while
opening a WebSocket, starting a request, or consuming its response stream.
## What changed
- Retry transient transport, streaming, rate-limit, and server failures up to
two times across the full sampling flow.
- Recover from unauthorized responses through the configured auth manager and
discard pooled connections that may contain stale credentials.
- Allow sampler initialization to continue when its initial WebSocket prewarm
fails, so the first sample can establish a fresh connection.
## Testing
Added coverage for recovery after prewarm failures and `503` responses, and for
stopping once the transient retry budget is exhausted.
GitOrigin-RevId: af74c2df95c4241184ca641ef4418db6aa4ab695
## What changed
- Add optional `guardian_v2` model-message defaults for classifier instructions,
review thresholds, reasoning effort, transcript selection and limits, and
action and compaction token limits.
- Apply those defaults when Guardian v2 samples a tool call, while preserving
explicit `[features.guardianv2]` settings over catalog values.
- Preserve the new catalog configuration when applying model overrides.
## Testing
- Cover model-catalog serialization and model override behavior.
- Verify that sampling uses catalog defaults while retaining local overrides.
GitOrigin-RevId: 4ae9ec235c647acbca05a20b7c4b87a4e1331161
## What changed
- Add the `features.guardianv2.transcript.include_images` opt-in setting.
- Include recent images from user and assistant messages and configured tool outputs in Guardian v2 sampling requests.
- Bound image context to the four most recent images and 8 MiB total, and omit image detail hints when constructing the sampling request.
## Testing
- Cover configuration parsing and image forwarding from messages and tool outputs.
GitOrigin-RevId: b0ae6b6182535fd084ea103ed01dc3c803d7d1f7
## What changed
- Add `max_parent_compaction_tokens`, defaulting to 25,000 tokens, to the Guardian v2 feature configuration.
- Reuse the latest encrypted parent compaction only when its complete serialized item fits within the configured limit.
- Fail closed with the maximum action-risk score when the latest encrypted compaction is oversized, instead of sampling with older context.
## Testing
- Cover exact-boundary and oversized compaction items, including oversized passthrough metadata.
- Verify that an oversized latest compaction bypasses sampling and prevents approval.
GitOrigin-RevId: 0b308e7bec0f41d46433dfdf656948cee5cba667
## What changed
- Allow `features.guardianv2` to remain a boolean toggle or specify classifier instructions, the review threshold, reasoning effort, and action and instruction token limits.
- Add transcript controls for included sources, per-entry and total token budgets, and the number of recent non-user entries.
- Validate configured ranges and relationships, expose them in the generated config schema, and apply the resolved settings throughout Guardian v2 classification and approval review.
## Testing
- Cover boolean compatibility, configuration parsing and boundaries, config-manager rejection, and the resulting classifier request and approval decision.
GitOrigin-RevId: dc018b53b782e2d6b4d6a795cca4945130a71678
## What changed
- Include the resolved Guardian security policy in the v2 classifier's developer instructions.
- Prefer an explicit `guardian_policy_config`, then the reviewer model's catalog policy, and finally the bundled policy.
- Limit the combined classifier instructions and policy to 10,000 tokens.
## Testing
- Cover configured and catalog policies, policy truncation, and the bundled-policy fallback.
GitOrigin-RevId: 1b84d70081dd924e214636b4b470d57a63d7cb88
## Why
Concurrent Guardian samples can finish out of order. A stale result rejected by
the thread's latest-score update could still be appended to the rollout.
## What changed
Return without persisting a risk score when `insert_if` rejects it as older than
the score already stored on the thread.
GitOrigin-RevId: 7b2c895742753a19dfe48fd7f8ecd912d3cd3af6
## What changed
- Expand the Guardian sampling pool from 8 to 16 WebSocket connections.
- When the pool is full, supersede the oldest request that has already produced a score before replacing an unfinished classification. Treat superseded classifications as a no-op in the extension.
- Stop response WebSocket work when its event consumer is dropped, including while waiting for the connection lock or draining a completed sample.
- Allow retries across both initially warmed connections for retryable stream failures.
## Testing
- Add a concurrent sampler test that fills the pool and verifies scored drains are replaced before an unfinished classification.
GitOrigin-RevId: 9e4df7b01516094726ff3e11878f8ca742d21b03
## What changed
- Give approval review contributors the first opportunity to resolve an action when automatic review is not required for the model.
- Return an extension's decision directly and fall back to Guardian when no extension claims the review.
- Update Guardian V2 to approve actions below its risk threshold through the review contributor API, and remove the extension approval-policy API.
## Testing
- Verify that an extension approval bypasses both the Guardian model call and the user approval prompt.
- Cover Guardian V2 review decisions for low-risk, high-risk, and disabled threads.
GitOrigin-RevId: 5be56941143aff6f358b75b5f8101b7c047147ae
## Why
Oversized tool arguments could make Guardian V2's model-visible action unbounded.
## What changed
- Cap serialized actions at 10,000 tokens while preserving the trusted tool name and `call_id`.
- Truncate nested string values evenly across the available budget.
- Omit lower-priority fields when the JSON structure alone exceeds the limit, while retaining useful action fields when they fit.
## Testing
Add coverage for oversized nested strings, arrays, and object keys, including spoofed identity fields and omission-marker collisions.
GitOrigin-RevId: 13f7dc93da3761db18a34087225196318a3b8098
## Why
Concurrent Guardian samples can finish out of order, allowing an older sample to
replace the thread's newer in-memory security risk score.
## What changed
- Record when each `SecurityRiskScore` sample starts while preserving compatibility
with records that have no timestamp.
- Add `ExtensionData::insert_if` so checking and replacing a typed attachment happen
under the same lock.
- Update Guardian V2 to replace the thread's risk score only when the completed sample
is newer than the stored one.
## Testing
- Verify concurrent conditional inserts retain the newest value.
- Verify Guardian-generated risk scores include a sampling timestamp.
GitOrigin-RevId: 6543a4e5497da4c623331050789e91613f931c4b
## What changed
- Add a thread-scoped extension API for requesting automatic review, resolving
multiple contributors to the strongest requirement.
- Have Guardian v2 request automatic review when it is enabled and the latest
`action_risk` score is at least `0.8`.
- Honor extension review requirements across tool approvals, MCP elicitation,
and remote execution while preserving host configuration and managed-policy
constraints.
## Testing
- Cover contributor registration and requirement resolution.
- Verify Guardian v2 requests review at the threshold, returns to the default
below it, and does not affect threads where the extension is disabled.
- Exercise extension-requested strict review with a remote model override.
GitOrigin-RevId: 6329fc23585d5cc7173c39bb9952c3109ec3884b
## What changed
- Replace the single `category` and `score` fields in `SecurityRiskScore` with a
deterministic map of category names to scores.
- Validate the full Guardian V2 classifier response before storing it as one
thread extension value and, for non-ephemeral threads, one rollout item.
- Cover serialization and rollout loading with snapshots containing multiple
score categories.
GitOrigin-RevId: 24525de691f96bd34ccfe04acab2f01aca309837
## Why
Guardian V2 classification requests should retain compacted conversation context only when the parent and classifier model configurations can share the encrypted compaction.
## What changed
- Resolve the classifier model's compaction compatibility hash when initializing its sampler.
- Add the latest encrypted parent compaction to classification input when both models have the same non-empty compatibility hash.
- Ignore missing, empty, or unidentified compactions, and omit parent context when compatibility cannot be established.
## Testing
- Cover latest-compaction selection and invalid compaction data.
- Cover matching, mismatched, missing, empty, and changed compatibility hashes.
GitOrigin-RevId: f0fcb09fd028cd2f397fdbc3d541b4bc464b0beb
## What changed
- Replace the single byte limit with token-derived per-entry and separate message and tool transcript budgets.
- Preserve the first and latest user messages, then fill the remaining budgets with recent user, assistant, and tool context while limiting retained non-user entries.
- Truncate oversized entries in the middle without splitting UTF-8 characters, and report the approximate omitted token count.
- Exclude reasoning from the default transcript sources while retaining support when it is explicitly configured.
## Testing
- Cover oversized message and tool-result truncation, user-message retention, separate tool budgeting, configured reasoning, and the resulting Guardian sampling request.
GitOrigin-RevId: aaeaa5fb5d902b5a1581a8a819bf34724bde794b
## What changed
- Represent Guardian sampling input as an ordered list of text entries.
- Send each transcript entry and approval-request delimiter as a separate input
content item while preserving the existing transcript byte limit.
## Testing
- Update transcript and sampler tests to verify entry boundaries, multi-item
request serialization, and bounded transcript behavior.
GitOrigin-RevId: 433e2e6ca18ce9288025715f5956295bfe852e98
## What changed
- Register Guardian V2 for thread startup as well as tool-call lifecycle events.
- When `guardianv2` is enabled, create and store a thread-local Luna sampler using the thread's model provider, authentication policy, session metadata, originator, and service tier.
- Emit a warning if sampler initialization fails, and skip tool classification when the thread has no sampler.
## Testing
- Update the extension test to enable `guardianv2`, run thread startup, and verify tool-call sampling through the initialized connection.
GitOrigin-RevId: 5ab732e85c9827495c67f57117eb5be450a7f90e
## What changed
- Parse and validate the structured risk scores returned for each classified tool call.
- Publish each score through thread extension data and persist it in rollout history for non-ephemeral threads.
- Report parsing, thread lookup, validation, and persistence failures through the extension warning sink.
## Testing
- Extend the Guardian V2 tool-classification test to verify that the sampled `action_risk` score is available from thread extension data and written to rollout history.
GitOrigin-RevId: 46614fe0d686736dfb1f09398c6fcd848c7d8b2c
## What changed
- Opt Guardian V2 Luna sampler WebSocket connections into responses lite.
- Send `reasoning.context` as `all_turns` on sampling requests.
## Testing
- Extend sampler and extension tests to verify the connection header and reasoning context.
GitOrigin-RevId: 4b0263c01b8259ed5268c222dcf7559912baba8c
## Why
Guardian V2 needs the requested action and its conversation context to assess
risk; a tool name and call ID alone do not describe what the tool will do.
## What changed
- Expose the original, pre-hook `ToolPayload` to tool lifecycle contributors.
- Build Guardian V2 classifier input from the bounded conversation transcript
and a structured planned-action object containing the tool name and arguments.
- Warn and skip classification if the planned action cannot be serialized.
## Testing
- Verify lifecycle contributors receive tool arguments.
- Verify Guardian V2 sends transcript history and planned-action JSON to the
classifier.
GitOrigin-RevId: 28266ef7c1d2267ba705fcfbd9be4ef48e64e104
## What changed
- Add a configurable renderer that converts conversation messages, agent
messages, tool calls and outputs, and reasoning into a numbered plaintext
transcript.
- Keep only relevant readable content, including manual-approval developer
messages, while omitting media payloads, encrypted content, and unsupported
response items.
- Limit transcripts to the most recent 320 KiB without splitting UTF-8
characters.
## Testing
- Cover source selection, content filtering, tool-name correlation, and bounded
UTF-8 truncation with unit tests.
GitOrigin-RevId: e2c6535f4a895862ca744258399fb36fc92e42c6
## What changed
- Register a tool lifecycle contributor when Guardian V2 is installed.
- On tool start, asynchronously ask the existing Luna sampler for a low-effort
`action_risk` score constrained to the range from `0.0` to `1.0`.
- Bound the tool metadata supplied to the classifier and treat it as untrusted
input.
- Emit an extension warning if classification sampling fails.
## Testing
Add an integration test that verifies the contributor reuses the configured
Luna pool and sends the expected model, attribution metadata, reasoning effort,
strict output schema, and tool-call context.
GitOrigin-RevId: 6b69fcc0443086544086849c38bcdd90560a291f
