## Why
A conversation classifier waiting for preparation or full response completion can block newer classifications. Concurrent reviews also need to prevent a later action's evidence or low-risk score from being reused for an earlier action.
## What changed
- Run conversation classifications independently, forking the latest compatible completed history from an earlier action. Only a valid completion with a newer action index can replace retained history.
- Keep admission and observation ordering atomic, and hold capacity permits through full response completion.
- Reject cached low-risk scores from later actions for tool-linked approvals, including initial approval checks.
- Track originating tool-call IDs separately from approval display IDs, preserving stdin write provenance and excluding synthetic MCP elicitation IDs from tool ordering.
## Testing
Add regression coverage for delayed preparation, capacity admission, out-of-order completion, cancellation, invalid retained output, and history snapshots. Exercise pending approval ordering in both `snapshot` and `conversation` modes, and verify linked and unlinked MCP elicitation provenance.
GitOrigin-RevId: 097476ccb3b8718369a69f55c3c39132f7f1a4c1
## Why
Guardian needs the assistant's delivered question to interpret a user's reply. Messages sent through nested Code Mode tools must remain available as review context, and approvals based on earlier context must become stale when a new delivery is confirmed. Assistant messages do not themselves grant authorization.
## What changed
- Capture successful hosted User Messaging sends after input rewriting and before result callbacks or post-tool hooks.
- Retain bounded delivery text in acceptance order, persist it through cancellation and shutdown, and preserve it across compaction and resume with an older-client-compatible rollout encoding.
- Track assistant review context separately from user authorization, invalidating pending and cached approvals for both local and worker reviews when that context changes.
- Associate retained deliveries with the correct instruction or communication boundary during rollback.
## Testing
Add coverage for nested messaging review context, fast replies and communication ordering, shutdown persistence, stale local and worker approvals, rollout compatibility, and rollback retention.
GitOrigin-RevId: 1bc1ec9e8947560b99f4b39a42ddb9f2099f519b
## What changed
- Add `ResolvedModelMessages` to resolve catalog text and bundled defaults while preserving explicit empty overrides and their source.
- Move base-instruction rendering, Guardian prompt composition, multi-agent role rendering, and `update_plan` guidance filtering into `codex-prompts`; migrate consumers to the shared APIs.
- Separate permission-profile resolution from prompt composition, and annotate Guardian policy and classifier instructions with content kinds.
## Testing
Add and update coverage for missing versus empty templates, literal overrides, multi-agent role composition, Guardian policy substitution and truncation, and preservation of permission path spellings and order.
GitOrigin-RevId: 52335bb7acec0f432d5c57acb2accd5f0276056e
## What changed
Move concrete reviewer settings into `guardian-v2` and replace `ReviewerConfigOverrides` with a `ReviewerConfig` callback stored in thread extension data. Apply the callback to each captured parent configuration before preparing context and checking session reuse.
Keep model selection, policy prompt construction, and live network state in the core adapter. Preserve the existing read-only reviewer settings and share `reviewer_permission_profile` with inherited environment configuration.
## Testing
Update existing Guardian configuration, session reuse, and prewarming tests to use the extension's actual configuration builder, including compiling the shared source in core's test host.
GitOrigin-RevId: dfa1dae9f8d4469f2e4f6e64ab842cc662970898
## What changed
- Store the shared `GuardianReviewSessionManager` in thread extension data and let the Guardian extension spawn and fork reviewers through `ThreadManager`, independently of async scorer startup.
- Preserve reviewer reuse, concurrent forks, cancellation, inherited environments, and user instructions. Gate managed reviewer startup on parent registration and remove terminated reviewers from the manager.
- Retain the `guardian` subagent identity in saved conversations. Reject resume of live Guardian reviewers and reject client archive or delete of live owner-managed workers with JSON-RPC error `-32600`; allow normal access after the owner releases them.
- Keep standalone reviewer support for inline delegates and remove duplicated extension prompt and configuration code.
## Testing
Add app-server tests covering reviewer reuse and concurrent forks, inherited instructions and prompt cache keys, live resume and removal rejection, saved reviewer discovery and resume after parent shutdown, and strict Guardian assessment inside an inline review.
GitOrigin-RevId: 4f9893c1ade151eacb4c11ffeae3d9e9ec019187
## What changed
- Add a policy prompt and output contract for synchronous Guardian reviews.
- Build reviewer thread options with a preferred review model, low reasoning effort when supported, and a fallback to the parent model and effective effort.
- Isolate reviewer sessions from parent instructions, MCP servers, optional features, and write access while preserving read restrictions, resolved environments, managed network constraints, and rollout persistence.
- Mark prepared threads as internal Guardian review sessions for later host-managed startup.
## Testing
- Cover reviewer isolation, read-only environment inheritance, review-model overrides, and parent-model fallback behavior.
GitOrigin-RevId: 5133be99674b64e06e19e7f2dbc86439e1678790
## What changed
- Move the Guardian thread lifecycle contributor and subagent-spawn context into `codex-guardian-v2`.
- Install the lifecycle contributor and asynchronous risk scorer through a single extension entry point.
- Remove the redundant `codex-guardian` crate and group the existing scorer implementation under `async_scorer`.
GitOrigin-RevId: 97141190c843e588b8c09c9ccd3fe00e1fae39a4
## What changed
- Replace the minimal default classifier prompt with predictive security-review guidance covering authorization, action risk, untrusted evidence, and browser or computer use.
- Trigger full Guardian review at an `action_risk` score of `0.5` or higher for the new default prompt, while retaining the `0.8` calibration for custom and model-provided prompts unless they specify a threshold.
- Render security policy configuration into prompt templates before enforcing the classifier instruction token limit. Prompts without the policy placeholder retain the existing append-and-truncate behavior.
## Testing
- Cover default, custom, and model-provided prompt thresholds and precedence.
- Verify policy substitution, truncation, sampling requests, and full review at the threshold boundary.
GitOrigin-RevId: 7aad9e2d8c9fbea453dc52147a3d0a46bf191aec
## What changed
- Add the `codex-guardian-v2` crate with an extension install entry point that does not register contributors yet.
- Register the crate in the Cargo workspace and add its Bazel target.
GitOrigin-RevId: 7c0c9479c6722d65f0f0dad9b0fd4a756e4649b3
felixxia-oai