## What changed
- Skip Guardian prewarming and asynchronous scoring when `approvalsReviewer` is
`"user"`, including when the reviewer changes during an active turn.
- Automatically accept ordinary `node_repl.js` execution confirmations in this
mode while continuing to surface sensitive-action checks and requests for user
input.
- Cover transitions between User approval, automatic review, and Full Access in
the app-server integration tests.
GitOrigin-RevId: 599c8ebb672728b9bf3d64c34377ddec230325f8
## Why
Full Access already combines `approvalPolicy: "never"` with unrestricted
permissions, so confirmation-only actions do not require a model review.
## What changed
- Detect Full Access consistently across the thread and every selected
environment. Pending, failed, or restricted environments are not treated as
Full Access.
- Approve confirmation-only Guardian and MCP requests without synchronous
review, sampler prewarming, or background scoring. Cancellation, explicit
denials, and forms that require user input keep their existing behavior.
- Re-evaluate the active permission state on each turn so an existing thread
can enter or leave Full Access safely.
## Testing
Added coverage for switching approval modes, strict sensitive MCP
confirmations, failed and pending environments, and suppression of Guardian
requests and background-scoring connections.
GitOrigin-RevId: 089ab4296dde473b8e33ab8324be79c5446c46f6
## What changed
- Emit `codex_guardian_v2_classification` events with the outcome, risk
level, duration, model, and thread attribution.
- Emit `codex_guardian_v2_fast_decision` events when Guardian V2 approves an
action without a full review.
- Add `guardian_v2_enabled` to turn analytics, accounting for review scope
and model requirements.
## Testing
- Extend the Guardian V2 app-server coverage to verify event payloads,
attribution, enablement state, and scoped event emission.
GitOrigin-RevId: 0805975f8e8f9d954aa1058ea8c60545a090ae74
## What changed
- Add `SectionRegistry::compose` to group collected authorization fragments and transcript entries while preserving fragment boundaries and registration order.
- Use the shared composed context in the core Guardian prompt and Guardian V2 synchronous and asynchronous reviewers.
- Keep transcript rendering, retention, and delta handling with each caller while removing duplicated section grouping and authorization rendering.
## Testing
- Cover composition for synchronous and asynchronous targets, including root conversation role handling, trusted user answers, transcript entries, empty context, and contributor failures.
- Verify the synchronous reviewer preserves authorization fragment boundaries in prompt items.
GitOrigin-RevId: 9268343631fd6417bb05a3c0abce883559a37685
## What changed
- Add typed context sections for root-conversation evidence, trusted user answers, and conversation transcripts to `codex-guardian-context`.
- Use the shared section registry when building core Guardian prompts and asynchronous Guardian V2 scoring context.
- Preserve source-role labeling while delivering authorization evidence as user-role context, and fail closed when context collection fails.
## Testing
- Cover shared section ordering and role preservation for synchronous and asynchronous targets.
- Verify trusted user answers appear exactly once as user-role input in Guardian V2 approval flows.
GitOrigin-RevId: 1d5d793ffbf166077411a66e85e039596907fb7e
## What changed
- Add a shared `select_user_messages` helper in `guardian-context` that always
anchors the first user message and fills the remaining token budget from
newest to oldest.
- Use the helper for both core Guardian prompt rendering and the Guardian V2
async scorer so they apply the same retention policy.
## Testing
- Cover empty and single-message transcripts, over-budget anchors, and
newest-first selection across multiple token budgets.
GitOrigin-RevId: 7db246013875263ceb5806d2a6a19b4e2a3db1c4
## Why
Composer drafts include attachments, mention targets, and deferred paste payloads in addition to visible text. Vim undo needs to restore that complete state as a single edit.
## What changed
- Add bounded, draft-level Vim undo history, with `u` as the configurable default binding in normal mode.
- Group complete Vim commands and insert sessions into undo steps, including direct composer changes such as pastes and attachments.
- Preserve undo, repeat, and search state when a reverse-history preview is canceled, and start fresh history when another prompt is accepted.
## Testing
- Cover grouped edits, custom bindings, history and search interactions, attachments, and large paste payloads.
GitOrigin-RevId: 12ecdb3c34a2d66f5d856aa2f82dc15bd91b230b
## Why
Guardian reviews need the original conversation evidence even after the parent context has been compacted, while rollback must still remove evidence from reverted turns.
## What changed
- Build synchronous and asynchronous Guardian transcripts from the retained review-history snapshot.
- Use the shared Guardian transcript collector for consistent entry formatting, tool attribution, and per-entry truncation while preserving the existing transcript retention budgets.
## Testing
- Add app-server coverage for retaining user and tool evidence after compaction and discarding it after rollback.
- Extend transcript tests for standalone tool outputs, shell calls, attribution, truncation, and retention limits.
GitOrigin-RevId: a18b1176f14a4d006c263aa82d4e593afee66bc3
## Why
Context compaction can replace original conversation items that Guardian still needs to review approval-sensitive actions.
## What changed
- Retain a bounded, chronological review history independently of the model's compacted history.
- Keep separate limits for user messages and other transcript items so tool traffic cannot evict user instructions.
- Use the retained evidence for synchronous and asynchronous Guardian transcripts, while resetting it after rollback or history reconstruction.
## Testing
- Cover retention through compaction and eviction, reset behavior after rollback, independent size limits, and asynchronous transcript construction.
GitOrigin-RevId: c5851e992820504fc18de8cfec7f6f9f1b69f316
## Why
The first REPL execution should proceed while its initial asynchronous Guardian
classification is still pending.
## What changed
- Fast-approve the first `js` execution from a Node REPL-backed server while
continuing its asynchronous classification.
- Track `js` executions separately so setup and reset tools do not consume the
first-execution allowance.
- Apply the normal Guardian review policy to subsequent executions.
## Testing
Add coverage for browser and computer-use startup, reset, and module-directory
setup sequences, verifying that only the first `js` execution skips the wait.
GitOrigin-RevId: 7297b35411a6317bcf9e7058c08c6db3e3310ac8
## Why
Compaction and host-injected context can rewrite the model-visible conversation
without changing what the user authorized. Treating those updates as authorization
changes prevents Guardian from reusing an otherwise valid review.
## What changed
- Track a host-owned user-message revision separately from the conversation history
generation.
- Advance the revision for genuine user messages and history resets, while preserving
it across compaction and internal context injection.
- Use message content-kind metadata to distinguish host context from user input,
conservatively treating unknown or incomplete metadata as user authorization.
## Testing
Added coverage that cached Guardian authorization survives compaction and internal
context, but is invalidated by user input and rollback.
GitOrigin-RevId: c7960fa182d1686042c23764d2abc58acbc4b882
## What changed
- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.
## Testing
- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.
GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298
## What changed
- Assign type-prefixed IDs to Guardian classifier input items before sending the request, preserving existing IDs and reusing generated IDs across WebSocket retries.
- Add a prefixed ID to the memory phase-one user message.
## Testing
- Verify retried Guardian requests contain the same unique, prefixed item IDs.
- Verify the memory phase-one request includes a prefixed user-message ID.
GitOrigin-RevId: e01da49d9a661b6bfd2088f091a3ddf69d601e40
## Why
After switching a thread to a model that requires automatic review, a
standard-scope approval could reuse a cached low-risk score for an action that
skipped classification. This allowed the action to bypass the required full
review.
## What changed
Check the thread's current model requirements before making a fast Guardian
decision. Defer required models to the full review path instead of approving
from cached scoring state.
## Testing
Add coverage for switching to a required model and reviewing a sandboxed
command without running another classification.
GitOrigin-RevId: e79e6a5df19c46acd5c4176f522a859793177639
Expand Windows deny-read globs robustly across protected directories while preserving filesystem enforcement. Preserve structured MCP tool and resource errors through app-server responses. Bind cached Guardian classifications to current local and root authorization state so stale scores cannot approve actions.
Add regression coverage for the sandbox resolver, structured protocol errors, and authorization changes.
GitOrigin-RevId: 4b80ed724d869afeca79204222d8465fa99d3a24
## Why
Guardian tests could continue after a WebSocket handshake but before the
connection entered the idle pool. The shared request waiter could also miss a
notification delivered between checking the request log and registering its
wait.
## What changed
- Wait for Guardian prewarming to populate the idle connection pool instead of
treating completed handshakes as sufficient.
- Use two initial Guardian connections in tests while retaining eight in
non-test builds.
- Register for request-log notifications before inspecting the log to avoid a
lost wakeup.
GitOrigin-RevId: 88f6a22c5401e03c24e6e114f2563fc641bfef80
## What changed
- Lower the default `max_tool_call_lag` from three tool calls to two, causing
older async risk scores to fall back to strict review sooner.
- Update the async scorer integration test to verify score expiration using the
default lag instead of a test-specific override.
GitOrigin-RevId: a07cae3634428a1e64745674eced92fb770f441a
## Why
Guardian classification must not proceed after silently dropping a parent
compaction that cannot fit within its configured size limit.
## What changed
- Distinguish an absent or unusable parent compaction from serialization and
size-limit failures.
- Record a fail-closed score and failed classification when the latest encrypted
parent compaction cannot be serialized or exceeds the complete-item byte
budget.
- Preserve omission of compactions with missing or empty encrypted content
without falling back to older context.
## Testing
Cover compactions at the exact byte limit, one byte over it, and oversized
passthrough metadata.
GitOrigin-RevId: 8e607c88f10003cdfab273963bc73c848b09c821
## What changed
- Move bounded planned-action JSON rendering from the Guardian V2 extension implementation into a dedicated `async_scorer::action` module.
- Keep the structural size-limit tests alongside the extracted implementation.
GitOrigin-RevId: 9292b164588ba0119b4c5ff81056bf7416352d69
## What changed
- Store per-turn trusted skill paths directly in a `BTreeSet` instead of a
mutex-protected set.
- Mutably record paths and consume the collection when producing the final
ordered path list.
- Strengthen the bounded-deduplication test to verify the exact collected paths.
GitOrigin-RevId: 69e87fc7783738d85ed204f18a3968d0837c3693
## What changed
Represent completed and superseded Guardian V2 classifications with a dedicated
`ClassificationOutcome` enum. Map the typed outcome to the existing metrics
status and emit truncation metrics only for scored classifications.
GitOrigin-RevId: b00d345cb0162ed3fc7f53632630b631f18820e7
## Why
Guardian reviews for delegated workers need to recognize skills explicitly
invoked by the user on the root turn.
## What changed
- Record verified user-owned skill paths as bounded, turn-matched Guardian
evidence.
- Include trusted paths from the current worker and its root snapshot when
building review context.
- Exclude skill trust from later root turns so stale authorization is not
inherited.
## Testing
- Add an app-server lifecycle test covering inheritance of a root-invoked
skill by a delegated worker and its removal on the next root turn.
GitOrigin-RevId: aa28f485edb7a447e51d51de8dc89b959fd63d40
## Why
Plugin MCP trust decisions must describe the exact host-discovered server
registration. Looking up a plugin again by ID can resolve a different root.
## What changed
- Retain the host plugin root in MCP catalog attribution and connection identity.
- Reconnect an MCP server when its attributed plugin root changes.
- Pass the retained root through tool lifecycle attribution and use it directly
when building trusted tool context.
## Testing
Add coverage for catalog identity, connection reconciliation, lifecycle
attribution, and rejecting a different root associated with the same plugin ID.
GitOrigin-RevId: bc92743dd40ab44065a07c3ea972b4956ef8351f
## What changed
Define a shared 30-second timeout for Guardian V2 async tests and use it
for classifier requests, score updates, and authentication refresh waits.
GitOrigin-RevId: fa0e63e5e4c2b9ba0e3a09f0c8758886a867e546
## What changed
- Record classified risk levels in `codex.guardian_v2.classification.risk`.
- Record fast approval outcomes and their reasons in
`codex.guardian_v2.fast_decision`, including low-risk approvals and deferred
decisions caused by missing, stale, failed, out-of-scope, or elevated-risk
scores.
- Cover the new metric labels across approval and failure paths.
GitOrigin-RevId: e180054e0b3796e479a706157dd9ea7c9f03c001
## Why
Guardian treated all skill instructions as untrusted, so it could not use the
invocation of a user-owned skill as authorization evidence.
## What changed
- Record explicit and implicit skill invocations through extension contributors.
- Send Guardian a bounded, deduplicated list of canonical skill paths only when
they resolve under the user's Codex or `.agents` skill directories.
- Keep repository skills and symlinks that escape trusted roots untrusted, and
send only verified paths rather than skill contents to the classifier.
- Avoid recording host skill prompts that were superseded by core skill
injection.
## Testing
- Added unit coverage for trusted roots, symlink escapes, deduplication, and
size limits.
- Added integration coverage showing that Guardian trusts invoked user skills
while rejecting a forged repository skill.
GitOrigin-RevId: 1cc0be230f7e6649110201c23c3de8f26447ff36
## Why
Opening Guardian's initial WebSocket connections can be delayed, but thread startup and resume do not need to wait for those connections.
## What changed
- Install the Guardian sampler and related thread state before opening its initial connections.
- Prewarm the sampler's WebSocket pool in a background task while retaining the existing on-demand connection behavior.
## Testing
- Verify extension startup returns before a delayed WebSocket handshake completes, then warms the full initial connection pool.
- Verify resuming a thread likewise returns before Guardian's delayed handshake completes.
GitOrigin-RevId: 58c91cf045b223f917c67d7e8dc82eac529db4ce
## What changed
- Add a bounded developer context fragment identifying the MCP server or connector and the user-owned configuration that declared it.
- Emit the fragment only when the effective entry matches the user configuration or an active plugin declaration resolves inside the Codex home directory.
- Keep tool descriptions, outputs, and unrelated tools untrusted, and reject unsupported sources or paths that escape through symlinks.
## Testing
- Cover user-configured servers and connectors, plugin-provided capabilities, token truncation, symlink escapes, and app-server request integration.
GitOrigin-RevId: 0bfe2a2f3a48334d1d5faad692b5d36452febb68
## What changed
- Add optional `McpToolContext` metadata to `ToolStartInput`, exposing the
model-visible MCP tool details and its source classification without exposing
the executable client.
- Classify MCP calls as connectors, configured servers, plugin servers,
executor-selected plugins, or other registrations based on the prepared call.
- Prepare each MCP call before notifying tool lifecycle contributors and reuse
that same call for execution so the callback describes the call that runs.
## Testing
- Cover host-owned connector calls and extension-owned Apps server calls,
including their distinct provenance and executed tool names.
GitOrigin-RevId: efd23f511b1045ffdd96349d621ad62365569b2b
## Why
Models that require automatic review previously skipped Guardian v2 risk scoring
entirely, even when Guardian was limited to computer-use tools. That scope cannot
use a low-risk result to approve unrelated tools, so the blanket skip is
unnecessary.
## What changed
- Retain Guardian v2 risk scoring for required-review models in
`ComputerUseOnly` scope while continuing to skip it in standard scope.
- Preserve strict automatic approval review for Node REPL-backed tools, including
when classification fails.
## Testing
Added coverage for low-risk, high-risk, and invalid classifications across the
Node REPL and computer-use REPL paths, plus an unrelated MCP tool.
GitOrigin-RevId: ee38fabf82e196df0ae13b4216b5892be9b799cf
## What changed
- Add a synchronous reviewer prompt builder that combines root authorization,
trusted user answers, bounded conversation history, parent environment and
permission context, retained REPL evidence, and the proposed action.
- Select text or image REPL evidence from Guardian feature and transcript
settings while respecting the reviewer model's supported modalities and
shared image limits.
- Render network access requests with trigger-specific guidance and bound
approval reasons and nested action strings before including them.
## Testing
- Add a prompt test covering root authorization, untrusted transcript framing,
retry reasons, denied-read restrictions, and action serialization.
GitOrigin-RevId: d1cf886c2e30f7abbf94cce977cef14439ef3f2e
## What changed
- Classify `response.failed` events with the `rate_limit_exceeded` code as a distinct retryable error while preserving any parsed retry delay.
- Expose the error as `rateLimitExceeded` through the core protocol and app-server schemas after stream retries are exhausted.
- Preserve the upstream message for TUI display while keeping it out of telemetry summaries.
## Testing
- Cover SSE classification, retry metadata, protocol conversion and serialization, exhausted stream retries, telemetry redaction, and TUI rendering.
GitOrigin-RevId: 02dab4d3477dcd7653a58c49c4bd38687a616579
## What changed
- Add effective workspace roots to `EnvironmentConfig` and use them when
materializing permission profiles and filesystem context.
- Preserve selection roots for thread-owned configurations while allowing a
ready environment attachment to supply its resolved roots.
- Propagate resolved roots to child environments and validate both command and
`apply_patch` writes in owner-provided secondary workspaces.
GitOrigin-RevId: 1832c168ce1fc37fa67efc2a472998ab4f448c70
## What changed
- Add the `features.guardianv2.persist_scores` configuration option for debugging.
- Default the option to `false`, so Guardian V2 reviewed actions and risk scores are only written to rollout files when explicitly enabled and the session is not ephemeral.
## Testing
- Cover configuration deserialization, default non-persistence, and opt-in persistence for nested code-mode actions.
GitOrigin-RevId: 452af99ef14553d45140340ececc2913389124d0
## What changed
- Add optional `call_id` and `action` fields to `SecurityRiskScore` so a persisted score identifies the tool call and bounded action that produced it.
- Populate the fields after Guardian V2 classifies an action while leaving fail-closed and legacy scores without provenance.
## Testing
- Verify scores preserve action details for direct tool calls and nested code-mode calls.
- Verify rollout serialization retains the new fields.
GitOrigin-RevId: fce69af37f368cecf1d9bce42bfc38a969e969b7
## What changed
- Add the opt-in `features.guardianv2.free_guardian` setting to route eligible
Guardian reviews to `/guardian` and asynchronous classifications to
`/guardian-classifier`.
- Support endpoint selection for both HTTP and WebSocket Responses clients,
including endpoint-aware connection reuse.
- Keep `/responses` for API-key authentication, custom provider URLs,
non-Guardian models, and configurations where the option is disabled.
- Omit routing hints and `service_tier` from requests sent to the dedicated
Guardian endpoints.
## Testing
- Cover route selection across authentication modes, provider URLs, HTTP
fallback, WebSocket review sessions, and classifier sampling.
GitOrigin-RevId: 9c88673c710d009e0239559b9245a4e6c4f4befc
## What changed
- Append accepted Guardian V2 classification results to rollout history for non-ephemeral threads.
- Keep resumed and forked threads from restoring a persisted score into active Guardian state.
## Testing
- Verify that asynchronous scoring records the resulting `SecurityRiskScore` rollout item.
- Seed resume and fork tests with a persisted score and verify that approvals ignore it.
GitOrigin-RevId: 40d63a2ea7e7cf6398402c6aed7d5e5727dc9d68
## What changed
- Default Guardian v2's review scope to computer-use tools. Set
`features.guardianv2.review_scope.computer_use_only = false` to retain the
broader tool review scope.
- Include images in Guardian transcripts by default. Set
`features.guardianv2.transcript.include_images = false` to disable them.
## Testing
- Update configuration and app-server coverage for the new defaults and
explicit broader-scope overrides.
GitOrigin-RevId: 88c3cfe6dd2a96df052111794ad59c5c9ea39b78
## What changed
- Evaluate recent unknown-authorization or critical-risk actions over the last five actions instead of ten.
- Flag predicted high- or critical-risk actions when they are credibly expected within the next two actions, rather than treating any potential risk within ten actions as high.
- Remove privileged or broad access as a standalone high-risk condition and classify a trajectory as low when none of the explicit high-risk conditions apply.
- Clarify the user-authorization and reviewer terminology in the classifier instructions.
GitOrigin-RevId: 1eaf63c3327f57a9c8560df085e1fe0afad99cd4
## What changed
- Add a policy prompt and output contract for synchronous Guardian reviews.
- Build reviewer thread options with a preferred review model, low reasoning effort when supported, and a fallback to the parent model and effective effort.
- Isolate reviewer sessions from parent instructions, MCP servers, optional features, and write access while preserving read restrictions, resolved environments, managed network constraints, and rollout persistence.
- Mark prepared threads as internal Guardian review sessions for later host-managed startup.
## Testing
- Cover reviewer isolation, read-only environment inheritance, review-model overrides, and parent-model fallback behavior.
GitOrigin-RevId: 5133be99674b64e06e19e7f2dbc86439e1678790
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## Why
Answers collected by `request_user_input` can change what the user authorizes, but post-tool hooks may replace or reject the tool output that Guardian normally sees.
## What changed
- Record bounded, host-observed answers before post-tool hooks run and provide them as trusted evidence to synchronous and asynchronous Guardian reviews.
- Include root-thread answers in worker review context.
- Count successful answers as authorization changes so earlier review evidence becomes stale, while ignoring empty or unrelated answers.
## Testing
Add coverage for allowed and denied stale reviews, empty and oversized answers, hook-modified output, and root-to-worker propagation.
GitOrigin-RevId: 970c52e40338ecd057c7cd2a69d04b06e97cd068
## What changed
- Track protected messages, ordinary messages, and tool entries in separate pools with cached token totals.
- Evict the oldest eligible evidence across pools while preserving transcript token and entry limits and the reserved recent tool entries.
## Testing
- Add regression coverage that a small, tool-heavy transcript window retains the latest final assistant reply.
GitOrigin-RevId: 7aa78d0b0609d8e45cb82e4f7773c0877a4d8224
## What changed
- Protect developer messages and final assistant replies from eviction by ordinary message evidence in bounded Guardian v2 transcripts.
- Exclude legacy inter-agent messages from that protection and keep recent tool evidence available when the entry limit is reached.
- Retain cache-friendly chunked eviction when protected messages themselves exceed transcript bounds.
## Testing
- Add transcript unit coverage for message and token limits, rejected commentary, legacy inter-agent messages, and recent tool evidence.
- Add an extension test for preserving a final assistant reply after older tool entries are evicted.
GitOrigin-RevId: f37d5f25e4105d2ec8fae226a558b703cda69288
## What changed
- Add `features.guardianv2.review_scope.computer_use_only` to restrict asynchronous classification and fast approvals to browser and computer-use REPL tools.
- Keep other tools on the synchronous approval path without letting them age or reuse scores from in-scope calls.
- Give this scope precedence over `sandboxed_exec_commands` when both options are enabled.
## Testing
- Cover configuration precedence, direct and code-mode tool detection, fast-approval isolation, and end-to-end approval routing for browser, computer-use, and unrelated MCP servers.
GitOrigin-RevId: bfd9ab6abdbd90634b265d354e038724b1e81d65
## What changed
- Split the approval review contributor into a `fast_decision` path for existing evidence and a `full_review` path for structured reviews.
- Add host-owned full-review inputs with action evidence, conversation history, thread and turn identifiers, approval context, and extension data.
- Add structured assessment and error types, and resolve full reviews using the first contributor that claims the request.
## Testing
- Cover full-review input propagation, first-claim ordering, and short-circuit behavior in the extension registry tests.
GitOrigin-RevId: 6f763d874af8c0b66a0d760b7b7c7dfe32251c9e
## What changed
- Track truncation and omission across Guardian v2 actions, transcript entries and images, and synchronous review evidence.
- Emit `codex.guardian_v2.classification.truncation` counters and byte histograms for original, retained, and omitted content after successful classifications.
- Tag observations by input component and whether content was truncated or fully omitted.
## Testing
- Extend async scorer coverage for action truncation metrics.
- Verify the app-server Guardian flow records truncated review evidence.
GitOrigin-RevId: 70680897f75716770aa072f866d60bd37e171c1d
## What changed
- Retain completed synchronous Guardian reviews as structured records until the async scorer builds its classification input.
- Render and bound review correlation, action, rationale, and full evidence body with the async scorer's transcript truncation marker.
- Extend the Guardian V2 integration test to verify oversized action and rationale content is truncated and the resulting review evidence remains bounded.
GitOrigin-RevId: 0000ba77b810748e34254dd00df4a69f8492e175
## What changed
- Increase the Guardian sampler's initial WebSocket pool from 2 connections to 8.
- Keep pool growth and recovery tests focused on the two-connection scenarios they exercise while making the remaining tests derive their expectations from the initial pool size.
GitOrigin-RevId: e2eabcdde5828ac7df333271f3253e74d696f396
## What changed
- Replace structured numeric classifier output with a single `high` or `low`
token and map those classifications to `1.0` and `0.0` risk scores.
- Require the classification contract in both default and overridden prompts,
including when classifier instructions are truncated.
- Return the first streamed classification immediately while draining the
remaining response for connection reuse and token accounting.
## Testing
- Cover prompt rendering and truncation, classification parsing, early streamed
results, conflicting later output, WebSocket reuse, and approval routing.
GitOrigin-RevId: 31a57e4eb9bf8df2a161b84aa3d5b16ab8f2937b
jif