## Why
Answers collected by `request_user_input` can change what the user authorizes, but post-tool hooks may replace or reject the tool output that Guardian normally sees.
## What changed
- Record bounded, host-observed answers before post-tool hooks run and provide them as trusted evidence to synchronous and asynchronous Guardian reviews.
- Include root-thread answers in worker review context.
- Count successful answers as authorization changes so earlier review evidence becomes stale, while ignoring empty or unrelated answers.
## Testing
Add coverage for allowed and denied stale reviews, empty and oversized answers, hook-modified output, and root-to-worker propagation.
GitOrigin-RevId: 970c52e40338ecd057c7cd2a69d04b06e97cd068
## What changed
- Emit `codex.shell_snapshot` and `codex.shell_snapshot.duration_ms` for each
exec-server capture attempt, including success and failure tags.
- Label exec-server metrics as `v2` and existing core snapshot metrics as `v1`
so the two implementations can be distinguished.
- Use the exec server's metrics client when available and fall back to the
configured global client for local execution.
## Testing
- Extend the bounded-retry and single-flight snapshot test to verify metric
counts and tags for first-attempt success, retries, recovery, and exhaustion.
GitOrigin-RevId: 94f73e58a4a1a90c518fa102f138ca7ee29b5627
## What changed
- Add `serviceTierForTurn` to `turn/start` so a newly started turn can override the service tier without changing the thread's saved tier.
- Treat `"default"` as standard speed and omitted or `null` values as inheriting the thread tier.
- Keep `serviceTier` authoritative for subsequent turns when both fields are supplied, and ignore the turn-scoped override when steering an active turn.
## Testing
- Extend the app-server turn-start test to verify both the one-turn `"default"` override and inheritance on the following turn.
GitOrigin-RevId: 4c2c4db21d8d31617a7a6e6df65bf54834e72383
## Why
Pending user input or agent mail could cause a regular task to restart immediately after a terminal compaction error, retrying the failed turn instead of completing it and preserving the pending input.
## What changed
- Stop the regular-task continuation loop when the turn records a terminal error.
- Allow turn completion to persist pending input so a later explicit request can retry it after the error is resolved.
## Testing
Added coverage for pre-turn and mid-turn compaction failures with steered input, queued agent mail, and mail that triggers a turn.
GitOrigin-RevId: 48c7a2cba44ac2444957556dd94910fb34515f09
## Why
History estimation and executed-tool-call limits only need the size of serialized JSON, not the serialized output itself.
## What changed
- Add a shared `serialized_json_bytes` helper that streams JSON into a byte counter.
- Use it for response-item size estimates and executed-tool-call argument limits.
- Preserve serialization errors so callers can apply their existing fallback behavior.
## Testing
- Cover response-item sizing with escaped characters, newlines, and multibyte text.
GitOrigin-RevId: a4417996df96df5c51cae62830adc496912f69c7
## Why
Background memory consolidation must honor managed completion policies without
running project completion checks or sending user-facing notifications.
## What changed
- Add a memory-consolidation stop target that selects managed policy hooks and
executor-scoped cleanup while excluding user, project, session, and plugin
stop hooks.
- End memory consolidation with an error when a managed stop hook rejects it,
and propagate that turn error into agent status.
- Disable legacy completion notifications for the background memory worker.
## Testing
- Cover hook selection, executor cleanup, managed rejection, agent error
status, and notification suppression.
GitOrigin-RevId: be350679ddcde2dde8a408b0972f08facff01a37
## What changed
- Record collaboration tool analytics for `send_message`, `followup_task`,
`interrupt_agent`, and `list_agents`, including receiver attribution, duration,
failures, and interrupted calls.
- Include these calls in per-turn subagent tool counts while keeping the existing
`subAgentActivity` output unchanged and omitting additional public collaborator
tool items.
- Extend the collaboration tool schemas with the new tool variants and the
`interrupted` terminal status.
## Testing
- Add an app-server integration test covering successful and failed calls,
receiver attribution, duration, prompt omission, activity items, and turn
counts.
GitOrigin-RevId: e73eaa05c508261e5fc97e7d08d7881a31e04e22
## What changed
- Add the under-development `transcript_v2` feature for the interactive
transcript composer and turn-selection UI.
- Keep it disabled by default and expose it through the configuration schema
and `codex features enable transcript_v2`.
## Testing
- Verify explicit configuration overrides and CLI persistence for the new
feature.
GitOrigin-RevId: 138ab7851621c066e8121cc3eb6cd4e7299f9c31
## What changed
- Add Windows sandbox mode, private-desktop behavior, and legacy Landlock selection to each `EnvironmentConfig`.
- Centralize sandbox context construction on `TurnEnvironment`, preserving environment-owned permissions, paths, and backend settings while applying additional permission grants.
- Use the environment-derived context for project instructions, capability discovery, file uploads, and filesystem-oriented tools.
## Testing
- Verify capability discovery uses the selected environment's permission profile and sandbox backends when they differ from the thread defaults.
GitOrigin-RevId: 7ae2fed90c8ada950f2e8431e571e9b2c793c291
## What changed
- Add a `ContextWindow` prompt slot for thread-scoped extension contributions.
- Include fragments in that slot in the token-budget context-window message.
- Keep the MCP `notes/thread_hint` bridge when the native history-notes extension is disabled, without falling back to it after a native request failure.
GitOrigin-RevId: befcb7cc8570b846094b2b542a112b186b39a30a
## What changed
- Add a `writeStdin` Guardian action carrying the approval, process, input, and working-directory details.
- Distinguish `command` and `writeStdin` execution approval requests while defaulting missing kinds to `command` for compatibility with older events.
- Render terminal-input review progress, denials, timeouts, and retry actions in the TUI, and record the action separately in analytics.
- Keep terminal-input reviews as child approvals so they do not change the parent command item's lifecycle or reconstructed history.
## Testing
- Cover Guardian serialization, app-server protocol conversion, command history reconstruction, analytics classification, and TUI review flows for terminal input.
GitOrigin-RevId: b083d5e2963bdd23b928644ec03c7eb68ebf2950
## Why
A provider auth command can fail during initial credential resolution, leaving
no cached authentication. A subsequent `401` should still give the configured
provider one bounded opportunity to recover.
## What changed
- Treat configured external authentication with an empty cache as eligible for
unauthorized recovery.
- Allow authority refresh to invoke the external provider when no prior auth is
cached, while preserving the existing requirements for managers without an
external provider.
## Testing
Added unit and client coverage for a provider command that fails initially and
succeeds during `401` recovery.
GitOrigin-RevId: 7cab9a03f90ce29b412be8fbd97b297acdad4482
## What changed
- Bind `.` in Vim normal mode to repeat the last complete edit.
- Record semantic delete, change, replace, paste, and insert-mode actions so repeats preserve motions, text objects, inserted text, and editor actions across keymap changes.
- Expose `vim_normal.repeat_last_change` in the configurable keymap and keymap picker, including conflict handling for existing custom bindings.
## Testing
- Add coverage for repeating deletes, replacements, complete changes, pasted and literal text, insert-mode editor actions, custom bindings, unavailable motions, and cleared buffers.
GitOrigin-RevId: 3213df964811e7902377ff1d93641e59f4037914
## What changed
- Add an `Interrupt` hook event that runs for an active top-level turn before its
interrupted abort event is emitted.
- Flush the turn transcript before invoking the hook and provide the session,
turn, transcript, working directory, model, and permission mode in its input.
- Support command and MCP handlers, including asynchronous commands, with a
one-second default timeout and a three-second maximum.
- Expose the event through hook configuration, managed requirements, app-server
notifications, generated schemas, analytics, and the TUI hook views.
## Testing
- Cover handler discovery, timeout normalization, output parsing, protocol
compatibility, TUI rendering, and interrupt execution ordering.
GitOrigin-RevId: 163fa7c098d94ac2775f6d137f8e916f8ea9b6eb
## Why
Clients need a bounded view of realtime conversations that preserves the order of speech, agent work, and turn lifecycle events without loading the full thread history.
## What changed
- Persist realtime session boundaries, transcript segments, and promoted agent items in paginated thread rollouts.
- Add the experimental `thread/timeline/list` API to page ordinary items, realtime items, and turn boundaries in canonical rollout order. Include `activeRealtimeSessionAtPageStart` so each page can be rendered independently.
- Emit typed `thread/realtime/item/started`, `thread/realtime/item/transcript/delta`, and `thread/realtime/item/completed` notifications around durable realtime items.
- Keep the existing `thread/items/list` response and legacy thread history behavior unchanged.
## Testing
- Cover mixed timeline pagination, realtime-session state at page boundaries, rollout replay, subagent history prefixes, transcript streaming, steering, and promoted agent artifacts.
GitOrigin-RevId: faa2c420192d63e060e8fb32446e3c797422656e
## Why
Internal Guardian reviews must remain independent of parent-session customization while still honoring managed execution and environment restrictions.
## What changed
- Apply the restricted Guardian session path to both internal and subagent review sources.
- Start internal reviews without inherited user instructions, extensions, MCP servers, or multi-agent behavior.
- Preserve managed execution policy and selected environment constraints while exposing only the allowed review tools. Honor shell feature restrictions across every selected environment and retain code mode when enabled.
## Testing
- Cover internal review isolation from parent state and managed instructions.
- Cover optional tool filtering, managed shell restrictions, code mode, and secondary environment profiles.
GitOrigin-RevId: edbf7d8a6fe3ee8213a1c75bc8ec331a1cf49006
## What changed
- Emit control-tool analytics for history and notes extension calls and for
`send_user_message_async`.
- Preserve non-default namespaces in reported tool names, such as
`history.read_item` and `notes.write_file`.
## Testing
- Add an app-server integration test covering successful and failed calls,
turn-level tool counts, and omission of tool argument values from analytics.
GitOrigin-RevId: b15a53a311228339f4d577a7b96146ed67f22253
## Why
`skills.read` paginated resources against a fixed response limit, so a page could exceed a smaller tool-call response budget.
## What changed
- Size each serialized `skills.read` page to the current call's response budget, accounting for JSON escaping and UTF-8 boundaries.
- Cache one bounded executor-resource snapshot per thread so cursor continuations return consistent contents without rereading the file. Replace the snapshot when another resource is read, and reject stale cursors after a reread.
- Tie cached executor snapshots to the selected environment and sandbox context without keeping the environment alive.
## Testing
- Cover budget-constrained reads, escaped and multibyte contents, multi-page reconstruction, changed resources, snapshot eviction, and expired turn-scoped access.
GitOrigin-RevId: e515935b82771b3f29b3fb91ea7a7a72e19a65ee
## Why
Managed network requirements can remain present when `enabled = false`, but a
disabled configuration should not create or expose an active proxy runtime.
## What changed
- Start the managed network proxy only when its effective specification is
enabled.
- Clear an existing proxy when a permission-profile refresh disables managed
networking.
- Keep remote executor launches free of managed-network proxy settings when the
requirements explicitly disable the feature.
## Testing
Added session and unified-exec coverage for initial startup and refresh with
disabled managed networking.
GitOrigin-RevId: f76699802e079eb746d5b1ea6547d19a4bfb7715
## What changed
- Add `codex-agent-roles` for agent role configuration types, parsing,
discovery, validation, and layered loading.
- Update `codex-core` to consume the new crate's public role configuration and
parsing APIs.
GitOrigin-RevId: 5a963a219a581b2848dae6fd071aa31a0b5ff22c
## Why
Analytics need to associate subagent activity with the top-level turn that
caused it, while avoiding a stale association when steering makes that origin
ambiguous.
## What changed
- Add `root_turn_id` to turn and tool-item analytics events.
- Read the root from live turn metadata when each event is built, reporting
`null` when the root is unknown or ambiguous.
- Propagate the metadata through control-tool and code-mode completion facts so
correlated and background tool events retain the correct root.
## Testing
- Cover root IDs for top-level turns, subagent turns, correlated code-mode
calls, and tool events emitted after turn completion.
- Verify that queued and subsequent events report `null` after the live root is
invalidated.
GitOrigin-RevId: 42fd76541c3c716cec74787d47b50adb2d22e6d2
## What changed
- Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests.
- Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup.
- Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched.
- Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect.
## Testing
- Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup.
GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723
## What changed
- Add `features.guardianv2.review_scope.computer_use_only` to restrict asynchronous classification and fast approvals to browser and computer-use REPL tools.
- Keep other tools on the synchronous approval path without letting them age or reuse scores from in-scope calls.
- Give this scope precedence over `sandboxed_exec_commands` when both options are enabled.
## Testing
- Cover configuration precedence, direct and code-mode tool detection, fast-approval isolation, and end-to-end approval routing for browser, computer-use, and unrelated MCP servers.
GitOrigin-RevId: bfd9ab6abdbd90634b265d354e038724b1e81d65
## Why
Multi-Agent V2 children are owned by their parent at runtime. Resuming an
unloaded child directly could rebuild it from caller-provided settings instead
of the parent's current authority.
## What changed
- Route child reloads through their loaded immediate parent and reject direct
cold resume when that parent is unavailable.
- Preserve the child's recorded model, provider, reasoning effort, and role
while inheriting the parent's execution policy and MCP extensions.
- Validate cached environments against the parent, intersect local permission
profiles, and reject stale remote or workspace-root configurations.
- Keep paginated cold-resume token usage attribution when attaching to the
reloaded child.
## Testing
Add coverage for owner validation, nested-parent reloads, permission and
environment changes, role instruction restoration, paginated usage replay,
and app-server child resume behavior.
GitOrigin-RevId: 84014762bcdb57f94fc23974c9c1af55dc1babf1
## What changed
- Split the approval review contributor into a `fast_decision` path for existing evidence and a `full_review` path for structured reviews.
- Add host-owned full-review inputs with action evidence, conversation history, thread and turn identifiers, approval context, and extension data.
- Add structured assessment and error types, and resolve full reviews using the first contributor that claims the request.
## Testing
- Cover full-review input propagation, first-claim ordering, and short-circuit behavior in the extension registry tests.
GitOrigin-RevId: 6f763d874af8c0b66a0d760b7b7c7dfe32251c9e
## What changed
- Add `features.network_proxy.credential_broker` and preserve structured network proxy settings when toggling the feature through config APIs.
- Protect broker enablement and provider context variables from project config, while carrying trusted context into filtered shell environments.
- Propagate brokered credentials through shell snapshots and restore real credentials for unsandboxed escalated commands.
- Normalize broker context environment keys case-insensitively on Windows and avoid conflicting remote managed-network enforcement when no proxy launch configuration is available.
## Testing
- Cover config layering, editing, project sanitization, Windows environment handling, shell snapshots, escalated execution, and end-to-end GitHub credential brokering in the zsh-fork runtime.
GitOrigin-RevId: 500e51e804e1988022052ccfe00b8fac5e495f4f
## What changed
- Add the under-development `content_item_kinds` feature, disabled by default.
- Strip content item classifications from Responses input when the feature is
disabled while preserving other passthrough metadata.
## Testing
- Add coverage that disables the feature and verifies requests omit content item
kinds without removing the turn ID.
GitOrigin-RevId: f938feb2895d766d979b1666fc7b97fd128fe8a7
## What changed
- Record the initiating agent path when inter-agent communication triggers a turn.
- Emit completed subagent activity to that agent's turn instead of always using the completed agent's parent thread.
- Keep parent-directed completion messages unchanged.
## Testing
Added a multi-agent v2 regression test where one sibling requests follow-up work from another and receives the resulting completion activity on the requesting turn.
GitOrigin-RevId: 949dd1116cccdd461c66a9b213a5bcd554cb3720
## What changed
- Detect readable symbolic `:root` entries separately from effective full-disk access so narrower deny-read rules do not disable the Windows sandbox's broad-read setup.
- Add explicit readable roots to that setup while omitting the filesystem root itself, and prevent read roots at or below denied paths from being granted access.
## Testing
- Extend the elevated Windows sandbox integration test to verify that an allowed bundled skill under the user profile remains readable while exact and glob-based secrets stay denied.
GitOrigin-RevId: 8f6f267b78718b9e8609a9205c489f253f478491
## Why
A Multi-Agent V2 child can finish after the parent turn that spawned it, so its
successful completion needs to remain associated with that parent turn in
notifications and history.
## What changed
- Add `completed` to `SubAgentActivityKind` and emit the corresponding started
and completed item events on the spawning parent turn when a child succeeds.
- Persist completed activity as a canonical turn item in both legacy and
paginated history, and expose it through app-server history and schemas.
- Render completed activity as terminal in the TUI without counting it as a
separate tool call or tool-runtime event.
## Testing
- Cover successful completion in legacy and paginated history, late updates to
completed parent turns, TUI rendering, analytics, and rollout tracing.
- Verify that terminal child errors do not emit completed activity.
GitOrigin-RevId: 6c71eb8b10e7327611c6af84f70e294e27d94d02
## What changed
- Register the stable, requirements-only `in_app_local_automation` feature for desktop apps.
- Add the feature to the configuration schema.
- Verify that an enterprise requirement can disable local automation.
GitOrigin-RevId: 939f7f3ee15f662dc85589cd1bcc3838e4cd1287
## What changed
- Retain completed synchronous Guardian reviews as structured records until the async scorer builds its classification input.
- Render and bound review correlation, action, rationale, and full evidence body with the async scorer's transcript truncation marker.
- Extend the Guardian V2 integration test to verify oversized action and rationale content is truncated and the resulting review evidence remains bounded.
GitOrigin-RevId: 0000ba77b810748e34254dd00df4a69f8492e175
## What changed
- Add a `GuardianPolicy` contextual fragment that renders as a standalone
developer message with the `guardian.policy` content kind.
- Use the fragment when rebuilding Guardian context and verify that its content
kind remains attached after history compaction.
GitOrigin-RevId: f7028fb29a48ad2453437f3d3a4405fcab7a2fd7
## What changed
- Build `skills.list` pages against the current tool-call response-byte budget.
- Skip entries that cannot fit, preserve pagination across retained entries, and report oversized metadata without repeating the warning for the same budget.
- Keep existing cursors compatible while encoding the response budget in new cursors.
## Testing
- Cover direct and Code Mode listing, budget changes between pages, provider and omission warnings, oversized entries, legacy cursors, and budgets too small to return discovery warnings.
GitOrigin-RevId: 4b34cd2714e4849fe9155ce3f0021b218763c395
## What changed
- Cover forwarding a legacy `env_vars` entry when the portable MCP server has no `env` map.
- Use the test workspace variable instead of `PATH` in the stdio round-trip test, keeping overlay forwarding distinct from portable environment expansion.
GitOrigin-RevId: c5cfb333e553581fc856d43a04e5be0abd9f65ef
## Why
Yielding once after spawning the test executor does not guarantee that its TCP
listener is ready, so the environment can race the server during setup.
## What changed
Poll the executor address until it accepts a TCP connection, with a five-second
timeout and a clear error if startup does not complete.
GitOrigin-RevId: b44b5bbef666a97da1299d05790f5e9c976d914f
## What changed
- Add `ToolCallSource` to extension `ToolCall`s and propagate direct or Code Mode
invocation metadata, including the runtime cell and nested tool-call IDs.
- Add `ToolCall::response_byte_budget` so extension tools can bound direct-call
responses by the host truncation policy while allowing Code Mode responses up
to the tool's own limit.
- Share the skills extension's response-size limit between its `list` and `read`
tools.
## Testing
- Verify that Code Mode source metadata is preserved when core constructs an
extension tool call.
GitOrigin-RevId: b10aef01be30d35b67bee3af24a1a4175c9ee112
## Why
On macOS, rejecting a symlinked writable root during sandbox setup could be
misreported as corrupt session data because both paths surfaced an
`InvalidInput` I/O error.
## What changed
- Treat only `InvalidData` errors as evidence of corrupt session storage.
- Preserve `InvalidInput` failures so the original sandbox preparation error
and its actionable details reach the user.
## Testing
Add a macOS regression test that configures a symlinked writable root and
verifies thread creation reports the sandbox failure without suggesting that
session data is corrupt.
GitOrigin-RevId: 2b83d9f92a517407b88c21b471fa8bff5fd20d1d
## What changed
Pass the session source associated with each MCP configuration snapshot into
selected-environment server projection. This keeps Guardian reviewer isolation
decisions aligned with the snapshot being projected instead of rereading the
session's mutable configuration.
GitOrigin-RevId: 61fd891fec13f62cfea9886d13e2f94f6f60922f
## What changed
- Apply local `env_vars` declarations from `.codex-plugin/plugin.json` to matching stdio servers loaded from an Agent Plugin manifest.
- Replace matching `${NAME}` entries in the portable server environment with host environment forwarding while preserving the portable command, arguments, and unrelated servers.
- Ignore remote-sourced environment variables and support both inline and file-based Codex MCP declarations.
## Testing
- Cover matching-server filtering, local and remote sources, inline declarations, and an end-to-end `PATH` forwarding round trip.
GitOrigin-RevId: 843e1232a084fa5f571fe56e07266995b87fd53d
## What changed
- Use `gpt-live-1-codex` as the default model for frameless realtime sessions.
- Preserve an explicitly supplied per-session model override.
## Testing
- Cover both default and explicit model selection in the WebRTC frameless conversation test.
- Update the app-server live session request expectation for the new default.
GitOrigin-RevId: ce5dc978911ff0289d677b60fae2dd8cb1058d22
## What changed
- Add a dedicated contextual fragment for developer instructions that emits the
`generic.developer_instructions` content kind.
- Use the fragment when adding child-specific developer instructions to a
full-history subagent fork, preserving their classification and ensuring they
reach the child exactly once without appearing in the parent request.
## Testing
- Extend full-history subagent coverage to verify the child-only instructions'
annotation, placement, and count.
GitOrigin-RevId: 82589d311535225fed76d500a19458fda72f40f2
## What changed
- Build Responses Lite base instructions through a dedicated context fragment so the developer message carries the `model.base_instructions` content kind.
- Apply provider metadata cleanup after adding the base-instructions message, preserving the existing behavior for non-OpenAI providers.
## Testing
- Extend Responses Lite request coverage to verify the annotation is present for OpenAI requests and omitted for a third-party provider.
GitOrigin-RevId: b0317f92dfb9570860688b49e3a7668da516ee8c
## What changed
- Change the permission prompt content kind from
`generic.permissions_instructions` to `permissions.instructions`.
- Update request annotation tests to expect the new content kind.
GitOrigin-RevId: e1e39c74ac24668ac1f3467bb0cc1335a9408712
## What changed
- Derive each `InternalModelContextFragment` content kind from its source as
`<source>.internal_context` instead of using a shared generic kind.
- Cover the source-specific kind in the contextual user fragment test.
GitOrigin-RevId: 2075d558265fc1ae1ce394e9a865210d1bc270af
## Why
Image preparation can rewrite message content, including replacing images that
cannot be processed with model-visible error text. The positional content-kind
metadata must stay aligned with those rewrites.
## What changed
- Process message images together with their content-kind annotations.
- Preserve existing kinds for unchanged and resized content.
- Classify failed-image placeholders as `images.preparation_error`.
## Testing
- Cover metadata preservation across successful, resized, and failed images.
- Verify Responses Lite sends `user.image` and `images.preparation_error` kinds.
GitOrigin-RevId: 1be7bcbe47014251019bfff0d826c9dfe3239dec
## Why
Remote compaction's retained-message budget counted text but not images, so
image-heavy history could retain more context than the budget represented.
## What changed
- Add the opt-in `compaction_image_budget` feature to charge retained images
using the existing image size estimate.
- Keep images and their adjacent labels atomic when truncating a boundary
message, while preserving existing text, audio, metadata, and
client-authored developer-message behavior.
- Stop backfilling older messages when an image at the truncation boundary
does not fit.
## Testing
- Add unit coverage for image boundaries, annotations, audio, text-only
messages, and client-authored developer messages.
- Add an integration test covering repeated remote compaction with the feature
enabled, disabled, and left at its default.
GitOrigin-RevId: 88868bbd09d2858939dbae3f8402e1f497b4e3c6
## What changed
- Render omitted image and audio inputs as contextual fragments tagged with
`images.unsupported` and `audio.unsupported` content kinds.
- Normalize message media through annotated content so metadata for surrounding
content remains intact when switching to a model without media support.
## Testing
- Extend history and model-switching tests to verify content-kind annotations
before and after unsupported media is replaced.
GitOrigin-RevId: 4ee6577f8b78bd5a850ee01ea9d4590c20272850
## What changed
- Represent compaction summaries and Guardian-approved actions as typed contextual fragments.
- Inject subagent notifications through the same fragment path.
- Annotate the resulting request items with `compaction.summary`, `guardian.approved_action`, and `multi_agent.subagent_notification` content kinds while preserving their existing roles and text.
## Testing
- Verify the content-kind metadata on compacted summaries, approved actions, and subagent notifications.
GitOrigin-RevId: 01c93e7f08b2dc1c1e85ba69e82bfb5f56e6cca5
## Why
Local compaction rebuilds preserved user input as a single text item. Carrying
over the original per-item content kinds can leave its annotation metadata out
of sync with the rebuilt content.
## What changed
- Set the rebuilt item's content kind to `user.text` when the original message
had content-kind metadata.
- Preserve the remaining message and harness metadata.
## Testing
- Cover metadata normalization in compacted history.
- Verify persisted replacement history contains the merged text and a matching
`user.text` content kind.
GitOrigin-RevId: cd10b8ec68ef8ec2a272a90182e69875b60dc35c
jif