## Why
HTTP callers currently cannot bound response bodies. Callers accepting provider-controlled model catalogs need a size limit before decoding the response.
## What changed
- Add per-request `response_body_limit_bytes` for buffered, streaming, and error responses, leaving requests unbounded by default. Reject oversized declared lengths early and count observed bytes across chunks.
- Return a non-retryable `ResponseTooLarge` error that reports only the byte limit. Preserve HTTP status and headers when a bounded error body fails to read without exceeding the limit.
- Expose `ModelsClient::list_models_raw` to fetch bytes and an optional ETag using provider authentication and retries, with an optional body limit. Keep existing `list_models` decoding behavior.
## Testing
Add HTTP fixture tests covering size boundaries, chunked and missing-length responses, early rejection, stream termination, interrupted bodies, error text decoding, and request isolation. Add a models-client test verifying that limits survive authentication retries without affecting subsequent ordinary requests.
GitOrigin-RevId: 61b8940bc8a549588cee6865a3b5d1cff789074d
## What changed
- Accept `fileId` alongside the existing `url` form for app-server image inputs, and forward file references to the Responses API as `file_id`. Update generated schemas and client types.
- Preserve file references, image detail hints, and mixed inline/file image ordering through user-message events, thread history, and rollout migration. Retain file images when truncating tool output.
- Pass file references through image preparation without resolving them, while keeping resize-notice numbering correct. Omit them from unsupported TUI display and Guardian image context.
- Reject image-edit requests whose recent-image window includes a file reference, preventing selection of an older inline image instead.
## Testing
Add coverage for serialization, request and rollout preservation, mixed-image history ordering, incomplete ordering metadata, tool-output truncation, and rejection of unsupported image-edit selections.
GitOrigin-RevId: 6ca20a8577155cc934b720803c3b7b3bffdf972a
## Why
A checkpoint produced by a previous model may be incompatible with the selected Guardian reviewer. Legacy review must retain user restrictions and verified answers across compaction and restart until a compatible checkpoint is available.
## What changed
- Expose retained user evidence independently of whether Guardian reviews the legacy transcript or parent context.
- Resolve the selected reviewer's compaction compatibility hash during resume and remote compaction. Preserve the legacy transcript when checkpoint compatibility is unknown or mismatched.
- Activate parent-context review immediately after compatible compaction and invalidate pending reviews bound to the previous evidence policy. Ordinary compaction preserves pending reviews.
- Keep strict compatibility checks for previously migrated checkpoints whose complete legacy transcript is no longer available.
## Testing
Add coverage for mismatched checkpoint hashes, retained evidence during legacy review, and pending-review cancellation on migration. Add a request-history scenario covering a model switch, incompatible automatic compaction, restart, and compatible manual compaction with preserved user restrictions and verified answers.
GitOrigin-RevId: b52bfd7c21ce7ebed482174c8d7c327e50b1ada8
## Why
Older compaction checkpoints can lack a producer model hash. Enabling thread-owned Guardian context must accommodate those checkpoints without losing user instructions or verified answers.
## What changed
- Select review policy from each history snapshot independently of the session's evidence capture policy.
- Keep legacy review for checkpoints with missing or empty producer hashes when the transcript preserves the evidence. Preserve strict compatibility checks when review depends on retained-only evidence.
- Continue capturing retained instructions and answers during migration, while supplying legacy reviews with runtime answers and subagent reviews with root authorization evidence.
- Record producer model hashes on new compactions regardless of context mode.
## Testing
Add coverage for checkpoint migration across compaction and resume in both history storage modes, snapshot policy stability, retained-evidence preservation, and authorization revalidation for owning sessions and subagents.
GitOrigin-RevId: ec72b4a51d40729173e24ac1b53b7d516ddaa825
## What changed
- Replace dedicated Guardian endpoints with `/responses`, sending `x-codex-guardian: reviewer` or `x-codex-guardian: classifier` for eligible Codex backend requests over HTTP and WebSocket.
- Add model-scoped thread headers, recheck backend authentication on each request attempt, and reconnect WebSockets when the applicable headers change.
- Retain `features.guardianv2.free_guardian` for configuration compatibility while removing its routing gate; the backend now controls Guardian billing.
## Testing
Update tests for reviewer and classifier headers, model and authentication scoping, HTTP fallback, WebSocket reuse, and parent-response metadata across retries.
GitOrigin-RevId: 1c2b3c458ab77fb40aae4ee6784f6d827c60e76c
## Why
MXC is a sandbox implementation, not a restricted-token sandbox level. Executor requests need to represent that choice separately from `WindowsSandboxLevel`.
## What changed
- Introduce `WindowsSandboxSelection` for executor sandbox contexts and remove `Mxc` from `WindowsSandboxLevel`.
- Preserve the `windowsSandboxLevel` wire field and its serialized values for compatibility.
- Share sandbox selection between executor process launches and filesystem helpers, and use the new selection in capability discovery and skill reads.
- Disable Windows sandbox selection for executor paths that do not use Windows path conventions.
## Testing
Extend coverage for MXC wire serialization, Windows skill-read sandbox checks, and capability discovery with distinct permissions. Exercise remote filesystem write restrictions with both restricted-token and MXC sandboxes, including rejection when native MXC is unavailable.
GitOrigin-RevId: 266211377bcb138a0dc75861e9ff2225fa37a53d
## What changed
Move concrete reviewer settings into `guardian-v2` and replace `ReviewerConfigOverrides` with a `ReviewerConfig` callback stored in thread extension data. Apply the callback to each captured parent configuration before preparing context and checking session reuse.
Keep model selection, policy prompt construction, and live network state in the core adapter. Preserve the existing read-only reviewer settings and share `reviewer_permission_profile` with inherited environment configuration.
## Testing
Update existing Guardian configuration, session reuse, and prewarming tests to use the extension's actual configuration builder, including compiling the shared source in core's test host.
GitOrigin-RevId: dfa1dae9f8d4469f2e4f6e64ab842cc662970898
## What changed
- Add `AllowedTools` to the extension API, captured once at thread startup to restrict which tools can be advertised or executed. An empty list disables all tools; an absent value preserves ordinary tool setup. Callers must supply the list again when resuming a thread.
- Filter tool registration and hosted tool specifications before Code Mode and discovery. Match names with their namespaces and require generated tools such as `exec` and `wait` to be explicitly allowed.
- Move Guardian reviewer tool selection into the allowlist while retaining feature and sandbox restrictions, with a fallback for older reviewer sessions.
## Testing
Add coverage for selected, empty, and absent allowlists across tool sources and Code Mode. Add managed-thread tests verifying advertised tools, rejection of excluded calls, and that replacing extension state after startup cannot change the captured allowlist.
GitOrigin-RevId: 33c1722c4241f368963d8385fa0415112e16a72d
## What changed
Introduce `ReviewRequest` in `codex-guardian-reviewer` to own contributor routing, cached approvals, synchronous fallback, and review cancellation. Keep action validation and session-specific preparation in the host.
Track the complete approval operation through parent shutdown, driving cancellation through reporting and reviewer cleanup before releasing it. Preserve fresh-review requirements and validate cached approvals before recording their outcome.
## Testing
Extend coverage for cancellation before routing and during cached approval, parent shutdown cleanup, and required fresh review overriding a cached allow result with matching assessment events and a denial warning.
GitOrigin-RevId: 8dcf26cc3660e91ef94e28e0bee7327ebe34ae6c
## What changed
Make `parse_guardian_assessment`, the rejection circuit breaker types and methods, and `AUTO_REVIEW_DENIAL_WINDOW_SIZE` crate-visible with `pub(crate)`. Update their re-exports in `guardian-reviewer` to match.
GitOrigin-RevId: 39521c7859936ebc9af570d7f1ad7b2348f3673d
## What changed
- Mark `guardian_ext` as a removed compatibility flag.
- Remove `InternalSessionSpawner`, `InternalSessionSpawnFuture`, `ApprovalReviewInput`, and `ApprovalReviewError` from the extension API, along with the spawner test.
- Remove `NodeReplReviewEvidence::review_inputs` and make the core re-exports of `NodeReplReviewEvidenceMode` crate-private.
GitOrigin-RevId: 1c532bc57264644cf521ef8077285a9b8ed67391
## What changed
- Make `SynchronousReview` own assessment events, telemetry, warnings, evidence-recording decisions, and consecutive-denial accounting.
- Keep action preparation, stale-approval validation, evidence storage, and event publication in the host adapter.
- Extract `Session::interrupt_turn_with_warning` to apply extension-requested interruptions to the selected active turn and emit the interrupted thread-idle lifecycle event.
## Testing
Adapt session tests to verify that extension interruptions emit the thread-idle lifecycle event and survive shutdown of the calling runtime.
GitOrigin-RevId: b234ad86206fedc2434f48fc44dc57679443c69f
## What changed
- Use cancellation guards to tie reusable reviewers and temporary forks to their lifetimes, including when a review future is dropped. Replace cancelled reusable reviewers before reuse.
- Share `ReviewerTasks` between the pool and `ThreadManager`, and wait for tracked cleanup during pool shutdown. Remove the separate session shutdown protocol.
- Move denial cleanup from core task handling into Guardian's turn start, stop, and abort hooks. Expose `install_reviewer` to register both thread and turn lifecycle contributors together.
## Testing
Add an integration test that exercises stale denial cleanup at turn start, completion, and interruption, including starting another turn after interruption.
GitOrigin-RevId: 85badb235309c1e1576547d1746f7ee9fc66d545
Update the image generation tool guidelines to avoid printing full results
or base64 image data with `text()` or `notify()`. Recommend printing only
small metadata when needed.
GitOrigin-RevId: f62b67b384dd39a1cc1adad0956b6fcf69d09c72
## What changed
Represent images in `ContentItem` and `FunctionCallOutputContentItem` with `ImageReference::Inline`, flattened to preserve the existing `image_url` wire format. Update image producers and consumers and regenerate app-server schemas and SDK artifacts.
Preserve the Python SDK's `InputImageContentItem` and `InputImageFunctionCallOutputContentItem` class names during generation.
## Testing
Add a regression test for stable Python image class names and adapt existing image tests to the shared representation.
GitOrigin-RevId: c38a780ac3314c2ac2deb3afc1b93b94b6f93fec
## Why
Guardian reviews must stop when their parent shuts down or their history is reset. Shutdown must also finish reviewer cleanup before closing the parent's persistent history, including when a review is waiting to retry after a rate limit.
## What changed
- Let the Guardian extension own reviewer startup, prewarming, and shutdown through `ThreadManager`, tracking and joining outstanding work during teardown.
- Cancel reviews on history reset or parent shutdown and reject decisions returned after cancellation, including cached extension decisions.
- Keep background prewarm previews from overwriting the active turn's model metadata.
## Testing
Extend regression coverage to verify reviewer cleanup after parent shutdown, prompt shutdown during a 60-second Guardian retry with the network request denied, and preservation of active model review requirements during prewarming.
GitOrigin-RevId: 05efc369b9a1642a10365eac8a09da77f3f6e28c
## What changed
Replace `ReviewerSessionFactory` with a startup callback installed through
`ReviewerPool::new`. Review requests supply shared setup data and reuse context,
while the pool uses its callback to create both reusable and forked reviewers.
Update Guardian session setup, prewarming, and existing test fixtures to use the
new pool API.
GitOrigin-RevId: fa171503afcee8bdbdf6822573bea8ded50ce117
## Why
Inline delegates have no entry in the thread registry, so reviewer creation cannot depend on looking up the parent or waiting for its thread-ready notification.
## What changed
- Capture parent identity, authentication, shared agent control, originator, and inherited instructions in `StartThreadOptions` so `ThreadManager` can start a child without a registered parent.
- Route Guardian reviewer creation through this path, remove the standalone fallback and readiness gate, and require a Guardian extension host.
- Install explicit reviewer hosts in unit tests and the Guardian reviewer extension in the integration test harness, using `ExtensionRegistry::to_builder()` to preserve existing contributors.
## Testing
Extend the thread-manager regression test to remove the parent from the registry before starting a child, then verify inherited lineage, originator, session identity, and authentication, and exclusion from the public thread list.
GitOrigin-RevId: 468ded6fdce7520cb39d55c1a884dcfa5aaea2d9
## What changed
Restrict `run_before_review_deadline_with_cancel` and its re-export to `codex-guardian-reviewer`. Move its timeout, abort, and successful-completion tests from core into the reviewer's deadline module, and remove the standalone `run_before_review_deadline` tests from core.
GitOrigin-RevId: dd9f1ed571a40a4bd66b08c88f3ee2be071f4870
## What changed
Extract tool observation and evidence capture into `observation.rs`, background classification into `classification.rs`, and score tracking and failure handling into `score.rs`. Keep lifecycle hooks in `extension.rs` and pass captured evidence through a `Classification` struct, preserving the existing snapshot and background task boundaries.
## Testing
Move the fail-closed score-ordering test into `score_tests.rs` and extend it to verify that a failed sample replaces an equally dated score while preserving newer scores.
GitOrigin-RevId: b25b9e828cce78fb2be522d7209346b63403d824
## What changed
- Remove `AgentSpawner` and `AgentSpawnFuture` from the extension API, along with the Guardian wrapper, thread lifecycle context, and app-server injection plumbing.
- Define `InternalSessionSpawnFuture` directly as a boxed future instead of aliasing `AgentSpawnFuture`.
- Raise the workspace `rustls` minimum version to `0.23.45`.
GitOrigin-RevId: b7319dee41bfb869479afeb7555a6f050c4d00a5
## Why
Command execution and plugin measurement events lack model and reasoning-effort labels. Attribution needs to reflect the step that invoked the command, even when model settings change before a background process finishes.
## What changed
- Add `model_slug` and `reasoning_effort` to command execution and plugin measurement analytics.
- Capture model context from resolved step settings and carry it through execution, approval, Guardian review, and plugin metrics collection.
- Preserve the first command-start model context when subsequent start notifications arrive.
- Keep the carried context out of serialized protocol items and generated schemas.
## Testing
Extend analytics tests to cover model switches before invocation and during background execution, default reasoning effort, Guardian-denied commands, and repeated start notifications retaining the original model context.
GitOrigin-RevId: af90e1c0d39bab625f2e89786085b61a9b96c0ce
## Why
MCP tool parsing eagerly cloned structured output schemas and built full call-result envelopes. Cloning tool definitions also copied their output-schema JSON, even before a consumer needed it.
## What changed
- Introduce `ToolOutputSchema` with immutable `Arc` storage so tool definitions share output schemas when cloned.
- Retain MCP structured output schemas and materialize the call-result envelope only when JSON is requested.
- Update code-mode consumers and schema mutation sites to materialize JSON explicitly, reusing uniquely owned storage when possible.
- Move structured content into the MCP envelope without an extra clone, preserving property order.
## Testing
Add tests for JSON preservation, mutation isolation, equality between lazy and materialized schemas, reuse of uniquely owned storage, and equivalent code-mode definitions.
GitOrigin-RevId: e98ba4c2f0efedc99f7cbc7bba206cc63a3bd8f4
## What changed
Move request execution from `LunaSampler` into `SamplingExecution` in
`sampler/execution.rs`, keeping request preparation and active-request tracking
in the sampler. Preserve the existing retry, authentication recovery,
cancellation, streaming, connection reuse, and token accounting behavior.
GitOrigin-RevId: 5e50116459fe9cc196c30c58e42773fc32be3d02
## What changed
Add `ConversationState` and `ConversationCheckpoint` to `codex-guardian-reviewer` and use them in core review sessions to track transcript cursors, completed review counts, and committed snapshots. Keep history and admitted evidence host-owned.
Preserve the separation between live review progress and committed checkpoints so forks inherit the history, cursor, and review count from the last committed snapshot.
## Testing
Add a unit test verifying that forks retain committed history and progress after an uncommitted review, then advance when the next snapshot is committed.
GitOrigin-RevId: 9f92410b11beec6b8f413c4c922fabba65852399
## What changed
After resolving startup configuration and model defaults, reject `features.token_budget.use_history_notes_extension` when the starting model lacks `supports_experimental_context`. Return an error directing users to disable the option or select a compatible model.
## Testing
Add startup coverage for explicit configuration and model defaults, verifying rejection for unsupported models and successful activation for supported models and standalone token budgets. Update history-notes test fixtures to declare experimental context support.
GitOrigin-RevId: abf1a024efc5acf97cfc858fbb93821363769dc0
## Why
ChatGPT derives Responses cache affinity from the `session-id` header. Ephemeral forks need to reuse their parent's cache routing while retaining their own session and thread identities.
## What changed
- Inherit the parent session ID as the `prompt_cache_key` for ephemeral root forks.
- Use the prompt cache key for root-agent Responses `session-id` headers, including WebSocket handshakes. Preserve the actual session identity in turn metadata and leave non-root-agent routing unchanged.
- Keep enabled goal tool definitions visible on ephemeral threads, but reject execution with `Goal tools require a persistent thread.` and disable automatic goal continuation without persistent state.
## Testing
Add regression coverage for inherited cache routing with distinct fork identities, matching parent and fork tool definitions, WebSocket session headers, and rejection of ephemeral goal tool execution.
GitOrigin-RevId: d235e97630068b27f7ebd562dd23ac6266ebc1b9
## What changed
- Expose `ThreadInstructionsProvider` through `StartThreadOptions`. Load its snapshot at startup and model-request boundaries, composing it after global instructions and before repository instructions. Empty or blank output clears only the thread contribution.
- Reject thread instructions exceeding 10,000 estimated tokens independently of the repository instruction budget. Allow host-provided instructions without a filesystem source and rename the shared future type to `LoadInstructionsFuture`.
- Retain the provider across warm resumes; require hosts to supply it again for cold resumes and offline forks. Live forks and subagents inherit applied snapshots without inheriting the source thread's provider, including when the parent is unloaded during setup or reload.
- Include thread instructions in guardian reviewer inheritance and reuse decisions.
## Testing
Add coverage for composition and clearing, refresh within an active turn, size rejection before sampling, cancellation-safe refresh, fork and resume behavior, parent eviction, and reviewer reuse invalidation.
GitOrigin-RevId: 7be9a523cbbfd67704067dfd526188dad89a3c88
## Why
Running root threads retained their startup global instructions, so edits to global `AGENTS.md` files did not take effect during an active session.
## What changed
- Reload global instructions when capturing model-request context, including after tools within the same turn. Apply changes without repeating unchanged instructions or rediscovering repository instructions when the environment and trust level are unchanged.
- Preserve the last successful global instructions on read failures, suppress recurring warnings until recovery, and clear instructions when their source is removed or blank.
- Serialize refreshes and allow cancellation without blocking subsequent requests.
- Give new subagents the parent's applied instruction snapshot and update Guardian reviewer reuse to account for refreshed instructions.
## Testing
Add regression coverage for live edits and removal, read failures and recovery, warning suppression, cancellation, subagent inheritance, and Guardian reviewer reuse. Update resume, fork, and compaction tests to verify refreshed instructions.
GitOrigin-RevId: f7e9b399740fa4f45e482c070f6e901ee7cf85cd
## Why
An unscored `exec_command` requesting additional permissions could reuse an earlier Guardian v2 approval score, even though that score did not cover the expanded permissions.
## What changed
When `UnscoredAction::AgeScore` applies, invalidate the cached score for default-namespace `exec_command` calls with `sandbox_permissions` set to `with_additional_permissions` by marking the call as a scoring failure.
## Testing
Extend the review-scope regression test to verify that an ordinary sandboxed command preserves cached approval, while a command requesting additional network permissions clears it and causes review to fail closed with `scoring_failure`.
GitOrigin-RevId: d6e3e1ec7d618dff2ef03ffcb92869249f0e547a
## Why
Extension-owned HTTP MCP servers previously inherited the default protocol mode. Extensions need to select a mode for their own server independently of other HTTP servers.
## What changed
- Add `McpServerContribution::SetWithProtocolMode` and re-export `McpProtocolMode` through the extension API.
- Carry the winning registration's protocol override through catalog resolution and materialization, and apply it to Streamable HTTP connections.
- Preserve existing defaults when no override is present. Selecting a protocol mode does not grant host-owned Apps cache access or environment authority.
## Testing
Add coverage for registration precedence and materialization, and extend cache isolation tests to cover explicit protocol selection. Add an integration test verifying that extension servers can select either the legacy or newer protocol while other HTTP servers retain the default mode.
GitOrigin-RevId: 606cecc03094a93258ffc433849f575020b81473
## Why
Transcript limits could shorten user instructions or omit later messages before Guardian evaluated the complete request budget, losing restrictions or prior approvals even when they would fit.
## What changed
- Keep user messages and manual approvals complete and in source order through transcript collection and retention.
- Preserve historical instructions while synchronous review can still compact history. If the final request still cannot fit, discard optional evidence before shortening older historical entries with truncation markers, preserving later restrictions where possible.
- Warn that shortened instructions and approvals are incomplete and that missing evidence does not authorize actions.
- Let asynchronous review defer to synchronous review when complete instructions exceed its budget.
## Testing
Add coverage for complete instruction retention, approval and restriction ordering, marked truncation of oversized Unicode text, compaction before truncation, and asynchronous fallback when instructions do not fit.
GitOrigin-RevId: e6159e876231347986b937ee7e07f944b83bfbe6
## Why
Truncating action arguments can leave approval reviewers evaluating incomplete actions. Large actions need complete review input and explicit handling when they exceed the review budget.
## What changed
- Remove action truncation and the fixed synchronous action byte limit. Admit complete actions against the whole-request budget, splitting long text losslessly into bounded transport parts and accounting for their framing.
- Route actions exceeding the asynchronous action budget to synchronous review. Prevent cached scores from covering oversized calls, including expanded approval arguments, while allowing later small actions to recover score reuse.
- Request user approval when optional review exhausts its local input budget. Keep required review and compaction service failures closed to approval, and retire exhausted review sessions.
## Testing
Add coverage for complete large-action delivery, optional user fallback, required-review denial, subsequent review recovery, async overflow through MCP approval routing, and lossless text splitting with budget accounting.
GitOrigin-RevId: 08f06e68a94b2f779480dd6b6cf5bc30b241f6dd
## What changed
- Move assessment event construction, metrics, and analytics tracking into `codex-guardian-reviewer` through `ReviewReport`.
- Store denial accounting in thread extension data through `ReviewDenials`, with core retaining turn interruption and lifecycle cleanup.
- Move failed-review record selection and bounded serialization into the extension, with core supplying captured review context.
## Testing
Add coverage that denial accounting clears on turn completion and interruption. Move the oversized-record test into the extension and exercise the new API.
GitOrigin-RevId: 6e5b3d9d4128b356f99b1d0e74a68111e40261ab
## What changed
- Move reviewer configuration overrides, turn request construction, and deadline, cancellation, and completion handling into `codex-guardian-reviewer`.
- Adapt core sessions through `ReviewerRuntime`, keeping context construction, managed constraints, and live network rules in core.
- Make `GuardianReviewSession` crate-private and remove direct reviewer pool initialization and the reviewer dependency from `guardian-v2`.
## Testing
Update the turn-draining test to exercise `wait_for_guardian_review`, checking that prior-turn completion events are ignored and the session remains reusable after draining the current turn.
GitOrigin-RevId: fdf2b335b88b3f405d2370298ee68932808e1186
## Why
Session isolation relied on Guardian source attribution. An explicit policy lets callers control inherited capabilities independently of how a session is attributed.
## What changed
- Add `SessionIsolation` with default `Inherit` and opt-in `Isolated` modes, captured at session startup through `ExtensionDataInit`.
- Use the policy to control inherited instructions, extensions, execution rules, and MCP resources. Isolated sessions retain managed execution rules and omit executor-discovered MCP servers.
- Explicitly isolate Guardian reviewers while preserving source-based fallback for older callers and saved reviewers.
## Testing
Extend delegate tests to cover isolation independently of attribution, update execution-policy coverage to supply the explicit policy, and assert that managed reviewers do not inherit the parent's configured MCP tools.
GitOrigin-RevId: f0ab42fa2f0237860ec661e72693ab191216afbf
## Why
MCP tool and connector descriptions were included in required action JSON, consuming review input budget even though they are optional metadata.
## What changed
Move `tool_description` and `connector_description` into an optional, explicitly untrusted `guardian_tool_descriptions` fragment. Limit each description to 400 estimated tokens, escape closing tags, and allow budget enforcement to omit the fragment while retaining the required action JSON. Preserve nested arguments such as `arguments.description` and mention tool descriptions in the budget omission notice.
## Testing
Add regression coverage for oversized descriptions, escaped closing markers, and budget eviction without changing action arguments. Update MCP approval and elicitation tests to verify descriptions appear separately from the action JSON.
GitOrigin-RevId: 30734567c2ebc4b180110276c83d79ddb315ceab
## Why
Transient rate limits can end automatic approval reviews prematurely, and review failures currently report high risk even when no assessment completed.
## What changed
- Retry rate limits and recoverable exhausted-stream errors, while excluding non-transient HTTP failures.
- Preserve server retry delays after stream retries are exhausted and honor them within the review deadline. Scope retry advice to the current turn so reused sessions cannot apply stale delays.
- Keep failed reviews denied, but leave risk and authorization unset and explain that the review could not complete without declaring the action unsafe.
## Testing
Add an integration test covering rate-limit recovery through approval and tool execution, asserting that the action executes exactly once after approval. Update failure assertions to check absent assessment fields and the review-failure explanation.
GitOrigin-RevId: 1163cfde35c6b8eb23b6f24f1f24461b86ded838
## Why
Automatic goal continuations can repeatedly return empty final answers without
making progress. Stop this loop by marking the goal as `blocked` after three
consecutive empty turns with no other activity.
## What changed
- Observe completed turn items through a new `on_item_completed` lifecycle hook.
- Track empty final answers only for automatically admitted goal turns, resetting
the streak on activity, user turns, or goal changes.
- Preserve normal turn completion and streamed message deltas when blocking a goal.
## Testing
Add accounting coverage for the three-turn threshold and streak resets, plus
app-server tests for empty continuations and recovery through final-answer text,
commentary, or tool activity.
GitOrigin-RevId: 4b9d2cb2e306b0adc316972429cc35000115b88b
## What changed
Populate `turn_trigger` in request metadata with `guardian_review` for guardian reviews, `guardian_classifier` for classifier requests, and `memory_consolidation` for both detached memory requests and consolidation agent turns.
## Testing
Extend request metadata assertions to cover each trigger across guardian reviews, classifier requests, and both memory startup phases.
GitOrigin-RevId: 2dc3c173ede6563b942b8099ad9901c32967b969
## Why
Async classifications need to account for the complete request, including parent compaction checkpoints and images, before sending it to the classifier.
## What changed
- Resolve the input allowance from the classifier's model metadata, independently of parent-model context-window overrides.
- Reject requests whose estimated input exceeds that allowance minus a 256-token reserve. Record `input_too_large` and defer to synchronous review without sending the oversized request or dropping evidence to make it fit.
## Testing
Add integration coverage for checkpoint and image budgets, verifying that oversized inputs defer to synchronous review and inputs that fit retain their evidence. Update Guardian context-budget tests to exercise V2 remote compaction.
GitOrigin-RevId: 765060e08d2d5f3028ef5207508d256d4bf8d856
## Why
`update_goal` only accepted `complete` and `blocked`, preventing the agent from pausing a goal in response to an explicit user request.
## What changed
- Accept `paused` and account for final goal progress when pausing, with budget limits taking precedence.
- Update tool instructions and goal prompts to allow pauses only at the user's explicit request, report the returned status, and stop goal work. A later resume revokes the pause request.
## Testing
Extend coverage for pause accounting, budget-limit precedence, rejection of resume and system-limit statuses, and preservation of a tool-paused goal when resuming a thread.
GitOrigin-RevId: c3c15a51f848ce6eb65854d51b1a1bc75bb456a7
## What changed
Move the synchronous review loop, outcome mapping, deadline helpers, and session pool into `codex-guardian-reviewer`. Core supplies adapters for evidence capture, authorization checks, session creation, and event publication through the new host interfaces.
Have `guardian-v2` initialize the reviewer pool and host separately, with the pool managing prewarming, session reuse, concurrent forks, invalidation, and shutdown.
## Testing
Extend the app-server reviewer lifecycle test to cover interrupted concurrent reviews as well as completed reviews, including resuming a reviewer after parent shutdown. Adapt core reviewer tests to use the pool and factory interfaces.
GitOrigin-RevId: 2d69bd20c169b20534764b98cbdb63f38564a530
## What changed
Move assessment parsing and schema, model selection, review outcomes, retry handling, and rejection circuit breakers into `codex-guardian-reviewer`. Update core to use the extracted APIs while retaining session execution and decision enforcement in the host.
## Testing
Move existing assessment, circuit breaker, and retry tests into the new crate, including coverage for transient errors, cancellation, and deadlines.
GitOrigin-RevId: 96ec9989a0066acb012bf3bec0b9f7d8bf11a4ef
## Why
Model switches within a turn can leave extension context using stale model metadata. Skill catalogs, context windows, and metric attribution need to match the model captured for each sampling step.
## What changed
- Pass captured model metadata and step-specific telemetry to world-state contributors.
- Use that metadata for skill catalog budgets and usage instructions, preserving configured budget overrides.
- Supply the captured model's usable context window to turn-context contributors, including when rebuilding context.
## Testing
Add regression coverage for model switches during skill discovery, catalog budgets and metric attribution, and extension context windows after `new_context` and retained-step context rebuilds.
GitOrigin-RevId: c51b40b739a380b9767a54ea8c8ee6de45bf01c8
## Why
Guardian request and section cost distributions need shared bucket boundaries across synchronous and asynchronous reviewers so their measurements align.
## What changed
- Add `histogram_with_boundaries` to session telemetry and extension metrics while preserving session attribution.
- Use shared request-token buckets up to 2,000,000 tokens and section-cost buckets up to 16,777,216 for both review paths.
## Testing
Extend telemetry tests to verify explicit bucket boundaries and sample counts, and Guardian integration coverage to check exported request and section metric bounds for both synchronous and asynchronous reviews.
GitOrigin-RevId: e34f6972b3418bac3b061939b62eeeccaec5a299
## What changed
- Record per-section text bytes, estimated text tokens, image bytes, and image counts for synchronous reviews and asynchronous scoring without logging evidence payloads.
- Emit estimated request tokens through `codex.guardian.context.request_tokens`. Synchronous estimates include assembled history, instructions, tool definitions, and output format, and measure the full logical request before WebSocket delta generation. Asynchronous estimates cover the assembled input.
- Add shared context budgeting helpers, including conservative image token reservations independent of encoded payload size and model-aware input limit calculation.
## Testing
Add coverage for separate text and image accounting, image estimates independent of encoded size, and section estimates that bound delivered messages. Extend asynchronous scorer and app-server tests to verify cost metric emission.
GitOrigin-RevId: aed45ecd9c23706f88caa51f2a4f2c77872d3bdb
## What changed
Parse optional `generation_id` values from image API responses and carry the selected image's ID through the image generation tool into analytics events. Keep the ID out of serialized extension items, JSON schemas, and TypeScript types. Responses without an ID remain supported.
## Testing
Add coverage for distinct IDs in multi-image responses and responses without IDs. Extend analytics and app-server tests to verify that the selected image's ID reaches analytics, and item tests to verify that it is omitted from serialization and TypeScript types.
GitOrigin-RevId: 70a600856990140b76fdbda51a0d73b3414338b1
## Why
Hosts need to stop new turn-input work during shutdown without consuming pending input or preventing already-running delegated work from finishing.
## What changed
- Add an optional `TurnStartAdmission` extension gate, checked before reserving or starting a new turn. Hosts without a gate retain existing behavior.
- Return `NotSubmittedReason::ServerDraining` for refused starts and surface an app-server error instructing clients to reconnect and retry.
- Keep steering, parent-delegated subagent input, and memory-only mailbox wakeups available during drain, while gating automatic starts.
- Close realtime conversations with an ordered handoff, error, and close event sequence when a handoff is refused during drain.
## Testing
Add regression coverage for rejected input staying out of subsequent requests, persisted queue items remaining available for later starts, delegated agent and review work completing during drain, mailbox wakeups, and realtime handoff error ordering.
GitOrigin-RevId: 03dbdcd71eab200e597c0649e6eb39bd92dbc82f
## What changed
- Consolidate v2 rollout summaries into `memory_summary.md` without generating `raw_memories.md` or requiring `MEMORY.md`. Validate the summary's required sections and size below 10,000 UTF-8 bytes.
- Add v2 read instructions for selective history retrieval, evidence-grounded preferences, citations, and explicit memory edits. Split injected instructions into fragments to preserve the complete summary within fragment byte limits.
- Record memory citation usage in the store selected by `memories.version`.
## Testing
Add coverage for v2 consolidation without a handbook, summary validation, version-isolated memory reads, and resetting both memory versions while preserving threads.
GitOrigin-RevId: 1d895fb4a23a973f1a45ba03be07a1f480c10227
