## What changed
Add `ContextProfile` to `codex-guardian-context` and route synchronous and asynchronous Guardian transcript rendering through it. Move default limits, retention, formatting, and async chunked eviction into the shared crate while preserving the distinct retention policies and host-managed full/delta cursors.
Carry transcript truncation observations through `RenderedTranscript` into context composition, and derive async image collection flags from the resolved profile.
## Testing
Add a profile regression test covering distinct sync/async retention priorities, original entry numbering, omission notes, and async truncation observations. Adapt existing transcript tests to the updated input API.
GitOrigin-RevId: 7f7dc249629d8017e9547085f6617f815ae43a1b
## Why
Synchronous approval reviews and asynchronous scoring assemble Guardian evidence separately, duplicating transcript framing and section placement.
## What changed
- Move evidence ordering, framing, and delivery into `codex-guardian-context`, while keeping transcript retention, budgets, and delta cursors with their callers.
- Pass composed messages directly to the asynchronous sampler, preserving roles, annotations, trusted message boundaries, and image placement.
- Reject unsupported synchronous delivery with `SectionError::UnsupportedDelivery` instead of silently dropping content.
## Testing
Add composition coverage for preserving separate messages and rejecting them for synchronous delivery. Extend Guardian integration coverage to check trusted tool and skill messages, mixed text and image evidence ordering, and full and delta review framing.
GitOrigin-RevId: efc06695ee4e2b7400b123b77ef2a21c8bf40646
## What changed
Move completed REPL response rendering into `codex-guardian-context` and register a synchronous-only `NodeReplEvidence` section. Core supplies a borrowed view of its evidence snapshot and retains responsibility for capture, storage eviction, and the delivery cursor.
Preserve the existing text and multimodal layouts, rendering bounds, omission markers, image ordering, and deduplication. Exclude evidence payloads from the rendered section's debug output.
## Testing
Adapt the existing evidence tests to exercise the shared renderer. Extend registry coverage to verify synchronous-only inclusion, rendered content, and omission of evidence payloads from debug output.
GitOrigin-RevId: eb181870558a7f2f77270dee7c17d36700f3e148
## What changed
Move bounded transcript image collection into `codex-guardian-context` and expose it through an optional `TranscriptImages` section. Update the async scorer to consume this section, preserving source filtering, image detail, omission accounting, and the existing limits of four images and 8 MiB of image URL data.
## Testing
Add coverage for source order, tool-output filtering, disabled image collection, oldest-image eviction, oversized images, and omitted-byte accounting.
GitOrigin-RevId: 097799ea1be6d73b347088f959de1fd23f02ec2c
## What changed
Move trusted skill rendering into `codex-guardian-context` as `TrustedSkills` and collect it through an async-only context section. Pass the collected section to the sampler, preserving the separate developer message and bounded JSON rendering. Omit skill paths from `Debug` output, exposing only their count.
## Testing
Move rendering tests alongside the shared type, covering multiple paths and escaped UTF-8 within the size budget. Extend registry tests to cover async-only inclusion, omission for empty input, section ordering, and path redaction in debug output.
GitOrigin-RevId: c0778067f19d31e693ca954aee1a7d7be8f9739a
## What changed
Represent host-verified tool metadata as `TrustedTool` in `codex-guardian-context` and collect it through an async-only context section. Route Guardian v2 sampling through that section while preserving separate developer-message delivery and the 512-token rendering budget. Omit tool metadata from debug output.
## Testing
Move the rendering-budget test into the shared crate, extend registry coverage for async-only collection and debug redaction, and narrow the scoped approval test to messages tagged `guardian.trusted_tool`.
GitOrigin-RevId: ee7cb4e9b9ceced70438cb58060d1a2973e1dc6a
## What changed
Move prior-review rendering and developer-message construction into `codex_guardian_context`, and route async scorer evidence through a dedicated `PreviousReviews` context section.
Validate a maximum of eight review fragments and a per-fragment byte budget equivalent to 1,000 approximate tokens. Reject oversized evidence without rewriting or dropping records, and fail closed when validation fails. Preserve authorization-version filtering and the existing developer-role delivery. Keep review contents out of debug output.
## Testing
Add coverage for count and UTF-8 byte-size boundaries, preservation of accepted fragments, async-only section delivery, and omission of review contents from debug output.
GitOrigin-RevId: 05e9f53a6405f490b2424b2491a834cd90ab24f0
## What changed
- Store the shared `GuardianReviewSessionManager` in thread extension data and let the Guardian extension spawn and fork reviewers through `ThreadManager`, independently of async scorer startup.
- Preserve reviewer reuse, concurrent forks, cancellation, inherited environments, and user instructions. Gate managed reviewer startup on parent registration and remove terminated reviewers from the manager.
- Retain the `guardian` subagent identity in saved conversations. Reject resume of live Guardian reviewers and reject client archive or delete of live owner-managed workers with JSON-RPC error `-32600`; allow normal access after the owner releases them.
- Keep standalone reviewer support for inline delegates and remove duplicated extension prompt and configuration code.
## Testing
Add app-server tests covering reviewer reuse and concurrent forks, inherited instructions and prompt cache keys, live resume and removal rejection, saved reviewer discovery and resume after parent shutdown, and strict Guardian assessment inside an inline review.
GitOrigin-RevId: 4f9893c1ade151eacb4c11ffeae3d9e9ec019187
## What changed
Represent denied read paths and globs with `PermissionContext` and render them through a sync-only section in `codex-guardian-context`. Keep policy resolution in the host and preserve the existing permission warning in Guardian review prompts.
## Testing
Extend registry tests to verify permission sections appear only for synchronous reviews. Extend the session reuse test to check that resolved denied paths and globs appear in both the initial review request and the next review's delta.
GitOrigin-RevId: a966a14b367f1eedb5a577f7ed74a869559ae646
## What changed
- Replace `ComposedContext` with ordered `ContextSection` values that retain section identities through transcript selection and rendering.
- Add a shared `PlannedAction` section and renderer for core synchronous approval prompts and the Guardian V2 asynchronous scorer, preserving full, delta, terminal-input, and network-request framing.
- Keep action JSON and retry reasons out of `PlannedAction` debug output.
## Testing
Update registry and transcript tests to assert section identities and source roles. Extend registry coverage to verify planned-action collection for both consumers and omission of action JSON and reasons from debug output.
GitOrigin-RevId: 675b841a2cad06afce03f414615b4d7aa0553b13
## Why
A code-mode `exec` wrapper and its nested tool calls each advance Guardian's score lag. Counting the unscored wrapper against its own nested approval can trigger a synchronous review sooner than needed.
## What changed
Track originating response items and approval tool-call IDs so cached approvals discount their own wrapper when it is newer than the latest score. Preserve wrapper identity across yields and waits, and retain the full lag when provenance is missing or evicted. Other wrappers and scoring failures still count.
Use the current `write_stdin` call's identity for approval freshness, and omit tool-call identity for `execve` intercepts that only retain the launch ID.
## Testing
Add coverage for wrapper-specific discounts, already-scored wrappers, missing and evicted provenance, identity across code-mode resumes, and approval identities for stdin writes and `execve` intercepts.
GitOrigin-RevId: 4002a06d64c4e1e0a13c072303503d6ddfacad09
## What changed
- Remove the `fast_decision` and `full_review` extension hooks and `ApprovalAssessment`, leaving `ApprovalReviewContributor::decide` as the approval decision interface.
- Remove the duplicate Guardian V2 fast-approval implementation and `StrictReviewReason` state.
- Require an explicit `GuardianReviewReason` for synchronous reviews.
## Testing
Migrate Guardian reviewer tests to the production `decide_approval` path and cached-score tests to the registry's decision interface.
GitOrigin-RevId: 1f9092c0ff5bb1eed0c63fa557fb3807e2e71564
## What changed
Resolve `GuardianContextMode` once at session construction and share it across history retention, replay, evidence capture, compaction, and review consumers.
Extract synchronous reviewer context policy and consolidate Guardian V2 parent checkpoint selection so sampling and fast approval use the same eligibility checks. Preserve legacy checkpoint omission and strict compatibility requirements for thread-owned context.
## Testing
Adapt existing review and history tests to the explicit context mode. Move checkpoint tests alongside the extracted selector, retaining coverage for latest-item identity, unusable checkpoints, and complete-item size limits.
GitOrigin-RevId: c73fb6fea556921acfffe758a5f709d7494019dd
## What changed
- Let approval extensions choose between cached approval, synchronous review, and a user prompt for tool and permission requests, while core enforces mandatory Guardian and fresh-review requirements.
- Carry an optional `review_reason` on Guardian assessment events and use it to trigger strict-review notifications, retaining the fallback for older events.
- Require synchronous review when cached evidence has an unusable encrypted parent compaction.
## Testing
Add regression coverage for manual prompts and cached approvals with non-UTF-8 working directories. Update approval contributors in existing tests to use the decision API.
GitOrigin-RevId: a4e66416070bdaa881daa41429c49021629f44c1
## Why
When no healthy pooled WebSocket is available, classification waits for a new connection to open and can stall on its handshake.
## What changed
- Use HTTP streaming when no healthy idle WebSocket is ready, and replenish the pool in the background with a five-minute cooldown after connection timeouts.
- Share concurrency limits and the sampling retry budget across both transports, and bound the wait for HTTP response headers.
- Cancel superseded requests while awaiting response headers and stop SSE polling when the consumer closes.
## Testing
Add coverage for HTTP fallback and recovery after cooldown, shared transport capacity, stalled response headers, and cancellation before headers or during body draining. Update sampler and extension tests to cover fallback after socket expiry, authentication changes, and transient failures.
GitOrigin-RevId: 0b23ccc1bfb2dfdbc8d2791d097706cd4dd44f39
## What changed
Replace `features.guardian_thread_context` with `features.guardianv2.thread_context` and update the configuration schema. The setting controls thread-owned context for synchronous and asynchronous Guardian, defaults to `false`, and remains independent of `features.guardianv2.enabled`.
## Testing
Update configuration tests to cover the nested setting, profile overrides, and enabling thread context while Guardian v2 is disabled. Migrate Guardian approval, history, and async scorer tests to the new configuration key.
GitOrigin-RevId: 54a91555eb68001e0adedc8a07bdbc5ea2273f9b
## Why
Classification metrics report failures without distinguishing their causes, and WebSocket connection attempts lack a dedicated duration metric.
## What changed
- Add `failure_reason` tags to classification counters and duration histograms, covering setup, sampler, and output-processing errors.
- Record `codex.guardian_v2.connection.duration_ms` for WebSocket connection attempts with endpoint, outcome, and failure reason tags.
- Map sampler errors to fixed, low-cardinality categories instead of using error messages that may contain server responses or credentials.
GitOrigin-RevId: bb366be92af2f605643ea7cd527678fa8dbfe53f
## What changed
Capture the ID from `response.created` and pass it as `parent_response_id` in Guardian review and classifier request metadata. Clear the current response ID before sampling retries so tool reviews cannot inherit a failed response's ID.
Request Guardian credits with `guardian_credits_requested` on eligible parent requests. Remove the ticket protocol, transport attachment, and ticket-specific body redaction. Keep ordinary app-server client `parent_response_id` values inside `x-codex-turn-metadata` rather than promoting them to Guardian request metadata.
## Testing
Update coverage for HTTP fallback, WebSocket review reuse, missing response IDs, classifier transport retries, and code-mode yield/resume attribution. Extend app-server tests to verify client metadata placement over HTTP and WebSocket.
GitOrigin-RevId: c1665e56382ecec8d260fc2ca0ecd5e20b0b2391
## Why
Guardian reviews must not lose user authorization constraints or reuse an
unreadable or incompatible parent checkpoint after compaction.
## What changed
- Retain bounded excerpts of oversized root user messages across compaction,
resume, and rollback, and recover excerpts from legacy Guardian history when
available.
- Require thread-owned Guardian review sessions and asynchronous scoring to
reuse only non-empty checkpoints produced by a compatible review model.
- Fail closed instead of reviewing without the required checkpoint when reuse
is disabled, compatibility is unknown, or checkpoint content is unusable.
## Testing
Expanded retained-context, review-session, asynchronous-scoring, and app-server
coverage for oversized instructions, legacy recovery, model incompatibility,
missing content, resume, rollback, and disabled checkpoint reuse.
GitOrigin-RevId: f30d837197e0d838e656a632109f490c38208f5e
## Why
Guardian reviews need the original user instructions even when compaction or
transcript selection removes them from the active conversation window.
## What changed
- Capture complete user messages in host-owned retained context and include them
as ordered authorization evidence alongside verified answers.
- Omit oversized instructions atomically and emit an explicit incomplete-evidence
notice instead of exposing a potentially misleading partial permission.
- Mark user messages inherited by forked agents so they remain model-visible
without becoming child-local authorization.
## Testing
- Cover retained instructions across compaction, resume, rollback, and agent
forks, including oversized evidence and legacy context behavior.
GitOrigin-RevId: 97122509d818c90d2f87c6a1b29c99c05ad0316e
## Why
Guardian reviews for delegated workers need the current root instructions and verified answers even after the parent context is compacted. Approvals must also become stale when that root authorization changes.
## What changed
- Build bounded root review evidence from retained context, preserving source order and answer scope while prioritizing user instructions over optional assistant context.
- Recover retained instructions from Guardian history after compaction and mark authorization incomplete when required instructions or answers are unavailable.
- Version root authorization in synchronous and reusable review sessions so an allow result is cancelled when its evidence changes.
- Strip parent-only Guardian approvals when forking worker history in retained-context mode.
## Testing
- Cover retained and legacy context modes, oversized evidence, message limits, parent compaction, and authorization changes during review.
GitOrigin-RevId: 658219b7cee08f2752adcea9966268fd21727976
## Why
Approval routing must remain available even when the async scorer does not start successfully.
## What changed
- Register a dedicated Guardian approval reviewer before the existing async scorer contributor.
- Reuse eligible cached low-risk evidence, including the initial computer-use allowance, without waiting for a fresh score.
- Route requests to the user when automatic review does not apply, and fall back to a synchronous assessment with the applicable review reason when cached evidence cannot be used.
GitOrigin-RevId: 956427040456bed4c497da952f0bed7f22e93fa6
## What changed
- Request and parse server-issued Guardian tickets for eligible Codex backend responses.
- Scope each ticket to the response that produced a Guardian review or classifier request, including HTTP and WebSocket retries, without adding it to model-visible or persisted context.
- Validate ticket shape, reserve its metadata keys, redact it from debug and request-body logging, and attach it only at the Guardian transport boundary.
## Testing
- Cover ticket parsing, endpoint and authentication routing, retry scoping, classifier retries, and redaction for compressed and uncompressed requests.
GitOrigin-RevId: 6219dd15c9f19ed3387de516aac1b8e7c9cdb0e3
## What changed
- Add optional per-model Guardian modes for computer use, shell, code mode,
file changes, MCP, network, and permission requests.
- Apply disabled, synchronous, or adaptive review by action category while
preserving legacy configuration when model policy is absent.
- Bind cached risk scores to the active model policy, thread settings, and
environment selections so outdated scores cannot approve later actions.
- Keep unknown review modes on the synchronous path and ignore unknown policy
fields for forward compatibility.
## Testing
- Cover policy serialization, legacy fallback, scoped tool classification,
disabled categories, and score invalidation after policy changes.
GitOrigin-RevId: f334a5f4fffb198da66cde3a400233e0df650516
## Why
Guardian can reuse an opaque parent compaction only when the checkpoint's
recorded producer hash matches the scoring model. Missing or incompatible
provenance must not allow an asynchronous score or cached approval to omit
compacted context.
## What changed
- Record the producing model's compatibility hash on compaction history items
and expose the latest checkpoint hash through conversation snapshots.
- In thread-owned context mode, fail closed and require synchronous review when
checkpoint reuse is enabled but the latest checkpoint is incompatible or has
unknown provenance.
- Reject incompatible checkpoints in the sampler while preserving the legacy
context behavior.
## Testing
Add coverage for local, remote, resumed, compacted, and rolled-back histories,
including matching, mismatched, missing, and empty compatibility hashes.
GitOrigin-RevId: 1ce959cb276edc602fd7dfa442133c7fe5e53857
## Why
Guardian authorization reviews need host-verified `request_user_input` answers to
remain aligned with thread history across compaction, resume, and rollback.
## What changed
- Record verified question-and-answer pairs in retained thread context when
`GuardianThreadContext` is enabled, and source both local and delegated Guardian
review evidence from that context.
- Preserve complete answer records within the evidence budget. Mark authorization
context incomplete when records are unavailable or oversized, and defer cached
fast approvals in that case.
- Keep the existing runtime-only answer path for threads that do not enable the
thread-owned context.
## Testing
- Cover answer retention through compaction and resume, removal after rollback,
source-call eviction, oversized answers, delegated review evidence, and legacy
behavior.
GitOrigin-RevId: 01f6f4541515434a0d00fdde318ff59f2f8bd2eb
## Why
Computer-use-only Guardian scoring should follow the active model's REPL
auto-review requirement, including when the model changes within a live thread.
## What changed
- Run computer-use scoring and fast approval decisions only when the active
model sets `node_repl_auto_review_required`.
- Invalidate prior or in-flight scores when a model switch skips scoring, so
switching back to a reviewed model cannot revive a stale decision.
## Testing
- Cover model switches for both `node_repl` and `cua_repl` MCP servers.
- Verify skipped scoring and stale-score rejection across requirement changes.
GitOrigin-RevId: 46aec4d017bea8f135b435bcd769b87369b8ce95
## What changed
- Skip Guardian prewarming and asynchronous scoring when `approvalsReviewer` is
`"user"`, including when the reviewer changes during an active turn.
- Automatically accept ordinary `node_repl.js` execution confirmations in this
mode while continuing to surface sensitive-action checks and requests for user
input.
- Cover transitions between User approval, automatic review, and Full Access in
the app-server integration tests.
GitOrigin-RevId: 599c8ebb672728b9bf3d64c34377ddec230325f8
## Why
Full Access already combines `approvalPolicy: "never"` with unrestricted
permissions, so confirmation-only actions do not require a model review.
## What changed
- Detect Full Access consistently across the thread and every selected
environment. Pending, failed, or restricted environments are not treated as
Full Access.
- Approve confirmation-only Guardian and MCP requests without synchronous
review, sampler prewarming, or background scoring. Cancellation, explicit
denials, and forms that require user input keep their existing behavior.
- Re-evaluate the active permission state on each turn so an existing thread
can enter or leave Full Access safely.
## Testing
Added coverage for switching approval modes, strict sensitive MCP
confirmations, failed and pending environments, and suppression of Guardian
requests and background-scoring connections.
GitOrigin-RevId: 089ab4296dde473b8e33ab8324be79c5446c46f6
## What changed
- Emit `codex_guardian_v2_classification` events with the outcome, risk
level, duration, model, and thread attribution.
- Emit `codex_guardian_v2_fast_decision` events when Guardian V2 approves an
action without a full review.
- Add `guardian_v2_enabled` to turn analytics, accounting for review scope
and model requirements.
## Testing
- Extend the Guardian V2 app-server coverage to verify event payloads,
attribution, enablement state, and scoped event emission.
GitOrigin-RevId: 0805975f8e8f9d954aa1058ea8c60545a090ae74
## What changed
- Add `SectionRegistry::compose` to group collected authorization fragments and transcript entries while preserving fragment boundaries and registration order.
- Use the shared composed context in the core Guardian prompt and Guardian V2 synchronous and asynchronous reviewers.
- Keep transcript rendering, retention, and delta handling with each caller while removing duplicated section grouping and authorization rendering.
## Testing
- Cover composition for synchronous and asynchronous targets, including root conversation role handling, trusted user answers, transcript entries, empty context, and contributor failures.
- Verify the synchronous reviewer preserves authorization fragment boundaries in prompt items.
GitOrigin-RevId: 9268343631fd6417bb05a3c0abce883559a37685
## What changed
- Add typed context sections for root-conversation evidence, trusted user answers, and conversation transcripts to `codex-guardian-context`.
- Use the shared section registry when building core Guardian prompts and asynchronous Guardian V2 scoring context.
- Preserve source-role labeling while delivering authorization evidence as user-role context, and fail closed when context collection fails.
## Testing
- Cover shared section ordering and role preservation for synchronous and asynchronous targets.
- Verify trusted user answers appear exactly once as user-role input in Guardian V2 approval flows.
GitOrigin-RevId: 1d5d793ffbf166077411a66e85e039596907fb7e
## What changed
- Add a shared `select_user_messages` helper in `guardian-context` that always
anchors the first user message and fills the remaining token budget from
newest to oldest.
- Use the helper for both core Guardian prompt rendering and the Guardian V2
async scorer so they apply the same retention policy.
## Testing
- Cover empty and single-message transcripts, over-budget anchors, and
newest-first selection across multiple token budgets.
GitOrigin-RevId: 7db246013875263ceb5806d2a6a19b4e2a3db1c4
## Why
Composer drafts include attachments, mention targets, and deferred paste payloads in addition to visible text. Vim undo needs to restore that complete state as a single edit.
## What changed
- Add bounded, draft-level Vim undo history, with `u` as the configurable default binding in normal mode.
- Group complete Vim commands and insert sessions into undo steps, including direct composer changes such as pastes and attachments.
- Preserve undo, repeat, and search state when a reverse-history preview is canceled, and start fresh history when another prompt is accepted.
## Testing
- Cover grouped edits, custom bindings, history and search interactions, attachments, and large paste payloads.
GitOrigin-RevId: 12ecdb3c34a2d66f5d856aa2f82dc15bd91b230b
## Why
Guardian reviews need the original conversation evidence even after the parent context has been compacted, while rollback must still remove evidence from reverted turns.
## What changed
- Build synchronous and asynchronous Guardian transcripts from the retained review-history snapshot.
- Use the shared Guardian transcript collector for consistent entry formatting, tool attribution, and per-entry truncation while preserving the existing transcript retention budgets.
## Testing
- Add app-server coverage for retaining user and tool evidence after compaction and discarding it after rollback.
- Extend transcript tests for standalone tool outputs, shell calls, attribution, truncation, and retention limits.
GitOrigin-RevId: a18b1176f14a4d006c263aa82d4e593afee66bc3
## Why
Context compaction can replace original conversation items that Guardian still needs to review approval-sensitive actions.
## What changed
- Retain a bounded, chronological review history independently of the model's compacted history.
- Keep separate limits for user messages and other transcript items so tool traffic cannot evict user instructions.
- Use the retained evidence for synchronous and asynchronous Guardian transcripts, while resetting it after rollback or history reconstruction.
## Testing
- Cover retention through compaction and eviction, reset behavior after rollback, independent size limits, and asynchronous transcript construction.
GitOrigin-RevId: c5851e992820504fc18de8cfec7f6f9f1b69f316
## Why
The first REPL execution should proceed while its initial asynchronous Guardian
classification is still pending.
## What changed
- Fast-approve the first `js` execution from a Node REPL-backed server while
continuing its asynchronous classification.
- Track `js` executions separately so setup and reset tools do not consume the
first-execution allowance.
- Apply the normal Guardian review policy to subsequent executions.
## Testing
Add coverage for browser and computer-use startup, reset, and module-directory
setup sequences, verifying that only the first `js` execution skips the wait.
GitOrigin-RevId: 7297b35411a6317bcf9e7058c08c6db3e3310ac8
## Why
Compaction and host-injected context can rewrite the model-visible conversation
without changing what the user authorized. Treating those updates as authorization
changes prevents Guardian from reusing an otherwise valid review.
## What changed
- Track a host-owned user-message revision separately from the conversation history
generation.
- Advance the revision for genuine user messages and history resets, while preserving
it across compaction and internal context injection.
- Use message content-kind metadata to distinguish host context from user input,
conservatively treating unknown or incomplete metadata as user authorization.
## Testing
Added coverage that cached Guardian authorization survives compaction and internal
context, but is invalidated by user input and rollback.
GitOrigin-RevId: c7960fa182d1686042c23764d2abc58acbc4b882
## What changed
- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.
## Testing
- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.
GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298
## What changed
- Assign type-prefixed IDs to Guardian classifier input items before sending the request, preserving existing IDs and reusing generated IDs across WebSocket retries.
- Add a prefixed ID to the memory phase-one user message.
## Testing
- Verify retried Guardian requests contain the same unique, prefixed item IDs.
- Verify the memory phase-one request includes a prefixed user-message ID.
GitOrigin-RevId: e01da49d9a661b6bfd2088f091a3ddf69d601e40
## Why
After switching a thread to a model that requires automatic review, a
standard-scope approval could reuse a cached low-risk score for an action that
skipped classification. This allowed the action to bypass the required full
review.
## What changed
Check the thread's current model requirements before making a fast Guardian
decision. Defer required models to the full review path instead of approving
from cached scoring state.
## Testing
Add coverage for switching to a required model and reviewing a sandboxed
command without running another classification.
GitOrigin-RevId: e79e6a5df19c46acd5c4176f522a859793177639
Expand Windows deny-read globs robustly across protected directories while preserving filesystem enforcement. Preserve structured MCP tool and resource errors through app-server responses. Bind cached Guardian classifications to current local and root authorization state so stale scores cannot approve actions.
Add regression coverage for the sandbox resolver, structured protocol errors, and authorization changes.
GitOrigin-RevId: 4b80ed724d869afeca79204222d8465fa99d3a24
## Why
Guardian tests could continue after a WebSocket handshake but before the
connection entered the idle pool. The shared request waiter could also miss a
notification delivered between checking the request log and registering its
wait.
## What changed
- Wait for Guardian prewarming to populate the idle connection pool instead of
treating completed handshakes as sufficient.
- Use two initial Guardian connections in tests while retaining eight in
non-test builds.
- Register for request-log notifications before inspecting the log to avoid a
lost wakeup.
GitOrigin-RevId: 88f6a22c5401e03c24e6e114f2563fc641bfef80
## What changed
- Lower the default `max_tool_call_lag` from three tool calls to two, causing
older async risk scores to fall back to strict review sooner.
- Update the async scorer integration test to verify score expiration using the
default lag instead of a test-specific override.
GitOrigin-RevId: a07cae3634428a1e64745674eced92fb770f441a
## Why
Guardian classification must not proceed after silently dropping a parent
compaction that cannot fit within its configured size limit.
## What changed
- Distinguish an absent or unusable parent compaction from serialization and
size-limit failures.
- Record a fail-closed score and failed classification when the latest encrypted
parent compaction cannot be serialized or exceeds the complete-item byte
budget.
- Preserve omission of compactions with missing or empty encrypted content
without falling back to older context.
## Testing
Cover compactions at the exact byte limit, one byte over it, and oversized
passthrough metadata.
GitOrigin-RevId: 8e607c88f10003cdfab273963bc73c848b09c821
## What changed
- Move bounded planned-action JSON rendering from the Guardian V2 extension implementation into a dedicated `async_scorer::action` module.
- Keep the structural size-limit tests alongside the extracted implementation.
GitOrigin-RevId: 9292b164588ba0119b4c5ff81056bf7416352d69
## What changed
- Store per-turn trusted skill paths directly in a `BTreeSet` instead of a
mutex-protected set.
- Mutably record paths and consume the collection when producing the final
ordered path list.
- Strengthen the bounded-deduplication test to verify the exact collected paths.
GitOrigin-RevId: 69e87fc7783738d85ed204f18a3968d0837c3693
## What changed
Represent completed and superseded Guardian V2 classifications with a dedicated
`ClassificationOutcome` enum. Map the typed outcome to the existing metrics
status and emit truncation metrics only for scored classifications.
GitOrigin-RevId: b00d345cb0162ed3fc7f53632630b631f18820e7
## Why
Guardian reviews for delegated workers need to recognize skills explicitly
invoked by the user on the root turn.
## What changed
- Record verified user-owned skill paths as bounded, turn-matched Guardian
evidence.
- Include trusted paths from the current worker and its root snapshot when
building review context.
- Exclude skill trust from later root turns so stale authorization is not
inherited.
## Testing
- Add an app-server lifecycle test covering inheritance of a root-invoked
skill by a delegated worker and its removal on the next root turn.
GitOrigin-RevId: aa28f485edb7a447e51d51de8dc89b959fd63d40
## Why
Plugin MCP trust decisions must describe the exact host-discovered server
registration. Looking up a plugin again by ID can resolve a different root.
## What changed
- Retain the host plugin root in MCP catalog attribution and connection identity.
- Reconnect an MCP server when its attributed plugin root changes.
- Pass the retained root through tool lifecycle attribution and use it directly
when building trusted tool context.
## Testing
Add coverage for catalog identity, connection reconciliation, lifecycle
attribution, and rejecting a different root associated with the same plugin ID.
GitOrigin-RevId: bc92743dd40ab44065a07c3ea972b4956ef8351f
