## Why
A standalone root forked from a worker needs its inherited user instructions for Guardian review, including after compaction. Parent input counters belong to a different thread, and omitted parent answers may have restricted an inherited authorization.
## What changed
- Adopt inherited user instructions into thread-owned retained context for standalone roots, recovering surviving checkpoint messages when needed.
- Keep inherited instructions before local evidence without sharing local acceptance counters, and preserve that distinction during reconciliation and rollback.
- Mark parent verified answers as incomplete and treat recovered checkpoint instructions as incomplete excerpts.
## Testing
Add coverage for standalone forks from copied history and truncated checkpoints, retention through compaction and resume, inherited/local ordering collisions, and rollback scope.
GitOrigin-RevId: bf716e224a1d29d6c528ef0dd7cdb118a413a08c
## Why
Incomplete retained checkpoints can omit root user instructions that still survive in live history. Queued input can also reach model history after a later-accepted answer, so recording order cannot reliably order grants and restrictions for subagent authorization reviews.
## What changed
- Reconcile retained evidence with surviving local user messages using source identity and persisted acceptance order, including answers present only in the checkpoint.
- Preserve checkpoint gaps and mark evidence incomplete when recovered instructions lack an order or conflict with an existing order.
- Restore the input-order counter from surviving local metadata so new instructions sort after recovered evidence, even without a retained checkpoint.
## Testing
Add unit coverage for source matching, acceptance ordering, persistent gaps, conflicting orders, and counter restoration. Extend subagent authorization tests to cover checkpoint resume, queued approvals, missing sources, and a subsequent revocation.
GitOrigin-RevId: 8bfbfd2c797d725796187e5cecf7f3f11a5f3380
## Why
Guardian reviews must not lose user authorization constraints or reuse an
unreadable or incompatible parent checkpoint after compaction.
## What changed
- Retain bounded excerpts of oversized root user messages across compaction,
resume, and rollback, and recover excerpts from legacy Guardian history when
available.
- Require thread-owned Guardian review sessions and asynchronous scoring to
reuse only non-empty checkpoints produced by a compatible review model.
- Fail closed instead of reviewing without the required checkpoint when reuse
is disabled, compatibility is unknown, or checkpoint content is unusable.
## Testing
Expanded retained-context, review-session, asynchronous-scoring, and app-server
coverage for oversized instructions, legacy recovery, model incompatibility,
missing content, resume, rollback, and disabled checkpoint reuse.
GitOrigin-RevId: f30d837197e0d838e656a632109f490c38208f5e
## Why
Guardian reviews need the original user instructions even when compaction or
transcript selection removes them from the active conversation window.
## What changed
- Capture complete user messages in host-owned retained context and include them
as ordered authorization evidence alongside verified answers.
- Omit oversized instructions atomically and emit an explicit incomplete-evidence
notice instead of exposing a potentially misleading partial permission.
- Mark user messages inherited by forked agents so they remain model-visible
without becoming child-local authorization.
## Testing
- Cover retained instructions across compaction, resume, rollback, and agent
forks, including oversized evidence and legacy context behavior.
GitOrigin-RevId: 97122509d818c90d2f87c6a1b29c99c05ad0316e
## Why
Queued prompts and `request_user_input` answers can be persisted in a different
order from when the host accepted them. Using persistence order can therefore
reorder retained instructions during replay or apply the wrong rollback
boundary.
## What changed
- Reserve an acceptance sequence for user prompts and elicitation responses
when retained thread context is enabled.
- Persist that sequence with user-message metadata and verified answers, and
use it when ordering, bounding, replaying, and rolling back retained context.
- Keep events without acceptance metadata compatible with legacy recording
order.
## Testing
- Cover delayed queued-input recording, rejected prompts, checkpoint replay,
compaction, rollback migration, and legacy retained-context behavior.
GitOrigin-RevId: 42d24465cc2033bc51c0c2da79d3c0884a8ad98a
## Why
Guardian review needs the original user instructions alongside verified answers, even after compaction, resume, or rollback. A summarized or legacy checkpoint cannot establish a complete instruction history.
## What changed
- Capture text user messages in retained context when `guardian_thread_context` is enabled, preserving their message identity through compaction and replay.
- Keep retained instructions and verified answers in arrival order, with independent size and completeness tracking for each family.
- Roll back retained evidence at the exact user-message boundary, including steers that share a turn ID, and apply the same semantics during rollout migration.
- Treat checkpoints without retained user messages as incomplete while preserving their verified answers.
## Testing
- Cover capture, compaction, resume, rollback, child forks, legacy checkpoints, storage bounds, and rollout migration.
GitOrigin-RevId: 72706731b54e5ac8645db61b446d2401afb42235
## Why
Guardian can reuse an opaque parent compaction only when the checkpoint's
recorded producer hash matches the scoring model. Missing or incompatible
provenance must not allow an asynchronous score or cached approval to omit
compacted context.
## What changed
- Record the producing model's compatibility hash on compaction history items
and expose the latest checkpoint hash through conversation snapshots.
- In thread-owned context mode, fail closed and require synchronous review when
checkpoint reuse is enabled but the latest checkpoint is incompatible or has
unknown provenance.
- Reject incompatible checkpoints in the sampler while preserving the legacy
context behavior.
## Testing
Add coverage for local, remote, resumed, compacted, and rolled-back histories,
including matching, mismatched, missing, and empty compatibility hashes.
GitOrigin-RevId: 1ce959cb276edc602fd7dfa442133c7fe5e53857
## Why
Directly deserializing the flattened `RolloutLine` envelope can reject nested
decimal values, preventing affected paginated sessions from resuming.
## What changed
- Add canonical string, byte, and reverse-scanner helpers that decode rollout
records through `serde_json::Value` before decoding the flattened item.
- Route rollout readers across session discovery, history, migration, search,
thread storage, and transcript previews through those helpers.
- Remove `Deserialize` from `RolloutLine` so new readers cannot bypass the
canonical persistence decoder.
## Testing
Add coverage that resumes a paginated rollout after a token-count record with
a decimal rate-limit value and verifies that ordinal sequencing continues.
GitOrigin-RevId: 49abac1e0751c073daa5a93a840d8a483fd2d013
## Why
Reasoning configuration changes need to retain their position and trusted provenance when model history is persisted and replayed. Client-injected history must not be able to forge these controls.
## What changed
- Add a typed `configuration_update` response item carrying reasoning effort, including custom model-defined values.
- Persist harness-authored updates with provenance and preserve them across history reconstruction, thread resume, raw response notifications, and agent forks.
- Exclude untrusted configuration updates from model history, strip client-supplied provenance metadata, and reject configuration updates supplied as turn input.
- Export the new item through the JSON and TypeScript app-server schemas and classify it in telemetry and persistence metrics.
## Testing
- Cover serialization, provenance persistence, history filtering and rollback, resume reconstruction, and injection attempts before and after restart.
GitOrigin-RevId: eb5559d2b52b7a931621e7c9812f009ff9fb8939
## Why
A steer creates a new instruction boundary without creating a new turn ID. Retained `request_user_input` answers that share that turn ID must not all be discarded when only the later steer is rolled back.
## What changed
- Associate retained answers with their originating function call and instruction boundary.
- Keep answers whose source calls survive rollback, including through compaction, resume, and rollout migration.
- Remove answers whose source calls belong to the rolled-back instruction.
## Testing
- Cover live rollback and resume with answers before and after a steer.
- Cover rollout migration when delayed answers share a turn ID but originate from different calls.
GitOrigin-RevId: 225e7eb7b6a3ae5a5e7fa6fcb80cb7d259db90d0
## Why
Compaction replaces the model history window, but host-verified user answers may
still be needed for the rest of the owning thread.
## What changed
- Add bounded, model-invisible retained context for verified
`request_user_input` answers.
- Persist retained context in rollout events and compaction checkpoints, and
restore it when a thread resumes.
- Remove answers when their source turns are rolled back, and prevent
parent-local answers from being inherited by child forks.
## Testing
Add lifecycle coverage for deduplication and size limits, compaction and resume,
rollback, rollout migration, and child forks.
GitOrigin-RevId: c32900d3e8120a9899b71f0576683acd67a4b898
## Why
Guardian review evidence must remain available after a compacted thread is resumed or forked, while rolled-back or parent-local evidence must not grant authorization in a different context.
## What changed
- Store the bounded, model-invisible Guardian transcript alongside compacted rollout history and restore it from the newest surviving checkpoint during replay.
- Trim Guardian history at rollback boundaries, clearing it when the boundary has already been evicted.
- Preserve the checkpoint for user-initiated forks, but remove it when spawning a subagent so parent review evidence is not inherited.
- Keep the new rollout field optional for compatibility with existing compacted records and legacy readers.
## Testing
- Cover Guardian history across compaction, restart, paginated and pathless stores, user forks, rollback, bounded replay, serialization, and subagent forks.
GitOrigin-RevId: 6ab076d5e0c3aac4d6a41ebd50ba2b200c90213e
## Why
Resumed threads need to continue per-turn and per-thread token totals without scanning arbitrarily far beyond the latest compaction checkpoint.
## What changed
- Add durable `TokenUsageRecord` rollout items with response, turn, thread, session, and root-turn attribution.
- Restore accumulated usage on resume and snapshot the latest record plus the compaction response ID in compaction checkpoints.
- Preserve root-turn lineage in persisted turn context, while ensuring forked child threads start with their own usage totals.
## Testing
- Cover usage accumulation across multiple responses and resumed turns.
- Cover local and remote compaction checkpoints, invalid remote compaction output, rollout reconstruction, and fork isolation.
GitOrigin-RevId: ef9e0c4a9102a08a2c382be4cdac68c84353c90a
## What changed
- Add a positive `output_token_limit` setting to each entry under an MCP server's `tools` configuration.
- Apply the most restrictive limit when plugin and user policies overlap, while keeping approval policy independent.
- Carry the effective MCP output budget in conversation history so tool output, post-tool hook responses, and resumed sessions use the same truncation limit.
## Testing
- Cover configuration parsing, serialization, schema validation, and plugin policy merging.
- Cover MCP output below and above the configured limit, post-tool hook responses, and session resume.
GitOrigin-RevId: d0beb4fca9ba6055d9e1d31c137373b465d50d61
## Why
Clients need a bounded view of realtime conversations that preserves the order of speech, agent work, and turn lifecycle events without loading the full thread history.
## What changed
- Persist realtime session boundaries, transcript segments, and promoted agent items in paginated thread rollouts.
- Add the experimental `thread/timeline/list` API to page ordinary items, realtime items, and turn boundaries in canonical rollout order. Include `activeRealtimeSessionAtPageStart` so each page can be rendered independently.
- Emit typed `thread/realtime/item/started`, `thread/realtime/item/transcript/delta`, and `thread/realtime/item/completed` notifications around durable realtime items.
- Keep the existing `thread/items/list` response and legacy thread history behavior unchanged.
## Testing
- Cover mixed timeline pagination, realtime-session state at page boundaries, rollout replay, subagent history prefixes, transcript streaming, steering, and promoted agent artifacts.
GitOrigin-RevId: faa2c420192d63e060e8fb32446e3c797422656e
## Why
Compaction can remove the tool-call events that associate an MCP app widget with
the tool, account, and URI needed to authorize later resource reads.
## What changed
- Store a bounded MCP resource-origin checkpoint with each compacted rollout.
- Restore the checkpoint when resuming a session so existing widgets remain
readable after compaction and restart.
- Discard saved origins when rollback rewrites history across the compaction
boundary, and reject oversized or invalid checkpoints during restoration.
## Testing
- Extend the app-server MCP resource-origin test to compact a paginated thread,
continue the conversation, and read the original widgets before and after a
restart.
- Verify rollback clears provenance that no longer matches retained history.
GitOrigin-RevId: 7f91c6202fe8d9be21c78dda42fa205937c44263
## What changed
- Replace the single `category` and `score` fields in `SecurityRiskScore` with a
deterministic map of category names to scores.
- Validate the full Guardian V2 classifier response before storing it as one
thread extension value and, for non-ephemeral threads, one rollout item.
- Cover serialization and rollout loading with snapshots containing multiple
score categories.
GitOrigin-RevId: 24525de691f96bd34ccfe04acab2f01aca309837
## What changed
- Add a `SecurityRiskScore` rollout item containing a category and numeric score.
- Persist the item in both thread history modes while excluding it from model context, user-visible thread history, search text, forks, and reconstructed conversation history.
- Re-export the score type from the extension API.
## Testing
- Cover serialization, persistence and loading, thread history projection, session reconstruction, append planning, and memory filtering.
GitOrigin-RevId: 1926fe366aeaa75052708a6da589f45a38eefb52
## What changed
- Mark developer messages received from clients with `client_authored` harness
metadata when `retain_client_developer_messages` is enabled.
- Carry that provenance through pending input and persist it alongside rollout
response items without adding it to provider requests or the serialized
`TurnInput` payload.
- Preserve existing behavior for unannotated response items and when the
feature is disabled.
## Testing
- Cover client item injection before and during turns, additional application
context, rollout replay, image resize notices, and serialization boundaries.
GitOrigin-RevId: f385c177732becde732272e4b8440eb91f5c1039
## What changed
- Wrap response items with optional harness-owned metadata while keeping the persisted response payload shape backward compatible.
- Store compacted-history metadata in an aligned sidecar and reject malformed sidecars.
- Carry metadata through history normalization, compaction, resume, fork, truncation, migration, and rollout recording without sending it to model providers.
## Testing
- Cover legacy rollout compatibility, metadata serialization and validation, compaction retention, and resume/fork reconstruction.
GitOrigin-RevId: 17a6127c9048ff984cb4df4d97c0751a38c29f5f
## What changed
- Add `ResponseItemEnvelope` as the history-owned wrapper for a `ResponseItem`.
- Store envelopes in `ContextManager` while keeping raw-item iteration and consuming APIs for existing callers.
- Preserve envelopes when compaction and history normalization rewrite retained items, and wrap newly synthesized items.
## Testing
- Cover envelope access, mutation, and conversion back to raw response items.
- Cover annotated history replacement and annotated user-message collection for compaction.
GitOrigin-RevId: 3fa2e7bdd981b08cc7aec410c80deccaecdabab4
## What changed
- Add `codex-history` for model-history and persisted-rollout domain types, including `RolloutItem`, `RolloutLine`, `CompactedItem`, and initial/resumed history state.
- Re-export the persisted types from `codex-rollout` and update consumers to use the new crate boundary instead of `codex-protocol`.
- Preserve existing rollout serialization, including legacy numeric compacted-window IDs.
## Testing
- Add `codex-history` tests for rollout JSON round trips, compacted-history compatibility, persisted history modes, and multi-agent version selection.
GitOrigin-RevId: 944daa9297ddd231d3aebbdcb05fff4adf8b4e1b
