## Why
A low-risk score for a later action could release an earlier pending Guardian review when the thread's score lag reached zero, bypassing that action's synchronous review result.
## What changed
Track the accepted score's source action and allow it to release a pending review only when it comes from that action or an earlier one. Keep cached-score approval available before synchronous review starts, but prevent the initial computer-use allowance from releasing an already pending review.
## Testing
Add an app-server regression test with two pending reviews: a later low-risk score approves its own action while the earlier action remains pending and honors its synchronous denial.
GitOrigin-RevId: ed8b9c4793b2538f634edfc5699797a6983358cc
## Why
A synchronous Guardian review could keep an action waiting even after an asynchronous score supplied valid low-risk evidence for approval.
## What changed
- In adaptive mode, race the synchronous review against score updates that satisfy the existing cached-approval checks, unless a fresh review is required.
- When asynchronous approval wins, cancel and drain the pending review, then revalidate the action and history lifetime and enforce cancellation and timeout limits before approving.
- Emit an approved review completion without a synchronous assessment or risk level, and use the cached-approval path for the final decision.
## Testing
Add an app-server regression case that holds the synchronous review pending, releases a low-risk score, and verifies approval completes without a risk level. Sequence existing scenarios to finish synchronous reviews before releasing classification results when they test synchronous evidence.
GitOrigin-RevId: 04f5ad6b960b819b565fccb1b85c8039ccbd0479
## What changed
Render web URLs in TUI asynchronous question titles as terminal hyperlinks, preserving the full destination when a URL wraps across lines or is partially clipped. Exclude trailing question punctuation such as `)?` from detected URLs while preserving balanced parentheses and query strings.
## Testing
Add a rendering regression test and snapshot for a wrapped URL, checking complete hyperlink destinations at full and reduced heights. Extend URL detection tests for trailing question punctuation and balanced parentheses in query strings.
GitOrigin-RevId: 6c9a807466d7b7e3a23bc6e86aae8410ae378161
## Why
Serial connection opens let a stalled handshake delay healthy sockets. Waiting until the idle pool is empty to refill also leaves classification bursts using HTTP fallback.
## What changed
- Open up to four WebSockets concurrently and start replenishing when the idle pool falls to half capacity. Preserve successful in-flight opens when another open fails or times out.
- Make explicit prewarming wait for an existing refill before checking readiness.
- Add `ResponsesWebsocketClient::connect_with_connector` and reuse one connector per sampler, initializing TLS configuration on a blocking task while retaining per-connection authentication and destination policy checks.
- Record connection lease durations for admission, setup, and total time, tagged by transport.
## Testing
Add regression tests for a stalled handshake alongside a healthy socket and replenishment before the last idle socket is leased. Update cooldown, authentication, and transport retry tests to account for concurrent handshake completion.
GitOrigin-RevId: f4a8258977c1f2a58e00c6badc7b599280ef22ad
## Why
Spawn failures can share an error kind and message despite different causes, such as execution and residency capacity limits. Telemetry needs enough detail to distinguish these failures without using error messages or correlation IDs as metric labels.
## What changed
- Add `AgentErrorContext` annotations for capacity limits, registry rejections, runtime availability, and spawn stages. Preserve the first annotation so outer stages retain the more precise failure origin.
- Add bounded `detail` and `error_kind` labels to spawn failure metrics, using `unknown` when no context is available.
- Emit spawn failure trace events with these classifications and the call and turn IDs for both multi-agent versions.
## Testing
Add tests for distinct capacity and registry failure contexts, preservation of manager, fork, and shutdown errors, and metric aggregation across different error messages and correlation IDs. Verify that annotations preserve existing error kinds and user-visible messages.
GitOrigin-RevId: 5bbe3d32f6ce408622f38e559fddeab05b8ccb65
## Why
File replay can accommodate shell state larger than the 512 KiB budget used for environment replay.
## What changed
Allow up to 4 MiB of shell state and 8 MiB of capture output for file replay. Keep captured environments capped at 512 KiB and preserve the 512 KiB combined state-and-environment limit for environment replay. Report distinct failures for oversized capture output, state, and environments.
## Testing
Add replay-specific size-limit tests and enlarge the Bash integration-test snapshot to exercise file replay beyond the environment replay budget.
GitOrigin-RevId: 0210848eb398d75426cb8b4b3bfaa0bce25264b8
## What changed
Add `codex.shell_snapshot.command` and `codex.shell_snapshot.wait_ms` metrics for eligible command preparations in the unified exec runtime and exec server. Tag observations with snapshot version, availability state, and whether replay was selected (`used`) or normal shell startup was used (`fallback`). Exclude background prewarming from command observations; `used` measures replay selection, not successful restoration or command completion.
## Testing
Extend snapshot retry tests to verify command counts and wait observations across fallback and recovery, excluding prewarm captures. Extend credential-broker approval tests to verify one `protected` snapshot observation for login-shell commands.
GitOrigin-RevId: d3d9f370b6bbba6dfc930a44044ce09373841799
Refresh the ranked tool catalog and partial-answer fork snapshots to reflect instructions requiring `fork_turns: "none"` when overriding the model or reasoning effort. Update the affected collaboration tool and message hashes.
GitOrigin-RevId: 5c3cbdd734f57eaefee0b0412e555e3882b1472e
## What changed
Increment `codex.guardian.denial_limit_reached` when automatic approval review reaches a turn's denial limit, immediately before interrupting the turn. Record the counter once per turn, matching the denial warning's existing behavior.
GitOrigin-RevId: ec8eeeff6a681a261572496e59cf694e87e813ce
## What changed
Carry `multi_agent_version` from the turn context through resolved configuration facts into turn analytics events.
## Testing
Extend the turn event serialization test to assert that `MultiAgentVersion::V2` is emitted as `"v2"` in `multi_agent_version`.
GitOrigin-RevId: f3e8c98588926d41a18c3db9aa229677e68cf5c1
## What changed
Record elapsed time for completed `wait_agent` waits in `codex.multi_agent.wait.duration_ms`, with an `outcome` tag of `mailbox`, `steered`, or `timed_out`. Exclude dropped waits because they have no observed outcome.
GitOrigin-RevId: 6378b98bfadab69d47aa2e9c93fa9d720f9cd0ef
## What changed
Increment `codex.multi_agent.result_delivery` when sending a terminal child result to its parent, with `outcome=queued` for queue acceptance and `outcome=failed` for delivery errors.
GitOrigin-RevId: 7571f66c2c2d2baea1a54dce3741f6393e809b66
## What changed
Add `codex.guardian.decision.duration_ms` around the complete approval decision operation, including fast decisions, preparation, and cancellation alongside model review time.
GitOrigin-RevId: e5a8d5a3b9a0ff81e1b866be87b8f3a439ae6a1d
## What changed
- Limit multi-agent V2 `fork_turns` guidance to `all` and `none`. Accept legacy positive integer strings as full-history forks instead of truncating parent history.
- Remove partial-history fork handling and telemetry, and direct model override usage to `fork_turns: "none"`.
- Strip inherited `multi_agent.role_instructions` and `multi_agent.usage_hint` content by kind, including persisted hints whose wording predates the current bundled instructions.
## Testing
Update regression coverage for legacy `"1"` and `"3"` values inheriting full history, invalid and zero values being rejected, and stale parent hints being removed from compacted history with both marked and unmarked instructions.
GitOrigin-RevId: 8f6017dc66ad8deefd7745399ef76e1bb1435bb2
## Why
Messages with the `partial_answer` phase contain answer text without declaring a terminal answer. They should remain searchable and speakable without being treated as final messages.
## What changed
- Preserve explicit `partial_answer` phases in streamed and completed realtime handoffs, bypassing legacy channel-prefix parsing and routing them to the `speakable` channel.
- Treat partial answers as nonterminal in V1 handoffs and omit the final-message prefix.
- Include partial answers in thread occurrence searches and normalize them to the final conversation channel in rollout traces.
## Testing
Extend coverage for realtime phase routing, streamed and completed handoffs, partial-answer search results, and rollout normalization. Verify that turn summaries still exclude nonterminal messages.
GitOrigin-RevId: aa183da783f6e7e0b78ddd51073cba533297e121
## Why
A native launcher can pass PowerShell 7 module paths to Windows PowerShell, preventing `Get-FileHash` from loading and blocking archive checksum verification.
## What changed
Update `scripts/install/install.ps1` to compute SHA-256 directly with .NET APIs after resolving the archive path. Dispose the file stream and hash provider, and retain the existing checksum mismatch error.
GitOrigin-RevId: 86e6232bd83c888811fc3b76fcad0aaf046f4bf8
## Why
A stopped provisioning service is treated as unavailable by the connection path, preventing registered Core setup from provisioning the sandbox.
## What changed
Start a stopped Windows sandbox service before provisioning during explicit registered Core setup. Request service-start permission through the Windows Service Control Manager and tolerate the service already running if another caller starts it concurrently. Preserve existing unavailable-service handling when the service is missing or marked for deletion.
GitOrigin-RevId: fab87c10dfabd4324f631077262f7e0dccc170f6
## Why
Fast mode previously gated both Fast and Ultra Fast, preventing policies from allowing one while disabling the other.
## What changed
- Add the default-enabled `features.ultrafast_mode` flag and enforce it independently of `features.fast_mode` in service-tier selection, requests, and agent prewarming.
- Filter TUI service-tier commands and selections by the corresponding policy and model catalog support.
- Report `supportsIndependentSpeedModes: true` from `configRequirements/read` and update the protocol schemas and generated bindings. Retain the shared Fast gate when connecting to older servers that omit this capability.
- Preserve legacy cloud speed denials by translating `rbac-fast-mode` fragments with `fast_mode = false` into a denial of both modes, while retaining higher-priority enterprise overrides.
## Testing
Add coverage for all four Fast/Ultra Fast policy combinations in requirements responses and request routing, agent prewarm inheritance, TUI command visibility and saved selections, and legacy cloud denial normalization and override precedence.
GitOrigin-RevId: 147e08524c4b228ea9d46b25a9f8aa64c359e169
## Why
Partial answers contain answer fragments while a turn is still in progress. Treating them as final answers defers mailbox delivery and can count empty fragments as empty final responses; filtering them from forked histories and guardian transcripts loses answer content.
## What changed
- Allow mailbox preemption after `partial_answer` messages and keep mailbox delivery open.
- Preserve partial answers in forked agent histories and include them as protected assistant entries in guardian transcripts.
- Exclude empty partial answers from empty-final-response accounting for goals.
## Testing
Add regression coverage for partial-answer phases in live events, sampling continuations, follow-up requests, and forked child requests, plus mailbox preemption, goal accounting, and guardian transcript inclusion.
GitOrigin-RevId: 208c8933e211b42b6c2d0bec6952527b8c9c120e
## Why
Assistant answer text may be followed by more output or tools. A distinct `partial_answer` phase lets callers represent this separately from commentary and a terminal `final_answer`.
## What changed
- Add `MessagePhase::PartialAnswer` and expose `partial_answer` in the app-server schemas and generated TypeScript and Python types.
- Keep the TUI working indicator visible after partial answers and exclude them from the thread history's final-answer summary field.
- Route partial answers to the speakable channel in realtime V3 BEM-tag mode.
## Testing
Add coverage for phase preservation through serialization, input-message conversion, and SSE item start/completion events. Extend TUI snapshot coverage to verify that partial answers keep the working indicator visible while final answers hide it.
GitOrigin-RevId: 1ae3ad9264b6e36ae1cbe6b93df3d345ab4460e6
## What changed
Remove `SelectionItem::is_default` and stop appending `(default)` to model picker entries. Keep the `(current)` marker and explicitly label the workspace owner notification prompt's negative option as `No (default)`.
## Testing
Update the model selection popup snapshot to reflect the removed label and adjusted column spacing.
GitOrigin-RevId: 1f8b85f896541ef7354d5979b4244d7df4b867d6
## Why
Session activity can move unread threads ahead of a pagination cursor, and timestamp-only cursors can skip threads with equal creation times. Either can prevent a session label lookup from detecting duplicate labels. Database failures must also remain distinguishable from an exhausted listing.
## What changed
- Resolve session labels using database-only listings ordered by `CreatedAt`, with thread IDs breaking timestamp ties. Accept unique matches across pages with valid timestamp-and-ID cursors, while retaining ambiguity errors for older cursors that cannot establish uniqueness.
- Preserve timestamp index ranges for database continuation queries and timestamp-only cursors for listings that may fall back to the filesystem.
- Propagate database-only listing and name-resolution failures. Keep best-effort name enrichment for ordinary listings and retry latest-session lookup with scan-and-repair after a database-only error.
- Keep loaded sessions selectable in the resume and fork pickers when a later page fails, stop further pagination, and display `Could not load more sessions`.
## Testing
Add regression coverage for creation-time continuation after session activity, cursor query plans, filesystem fallback, database and name-query errors, cross-page label uniqueness, older server cursors, and selection after picker pagination failures.
GitOrigin-RevId: 264ab2e69b8ad12d9edaa31fd253cb9805a46a90
## What changed
- Remove `instructions_variables`, its protocol type, and unused personality templates. Continue accepting older catalogs by ignoring their legacy variables.
- Report `supports_personality` as `false` in app-server model listings and TUI model presets.
- Preserve pinned model metadata and base instructions when only personality settings change. Reuse Guardian review sessions across friendly and pragmatic settings, while keeping the `none` opt-out distinct.
## Testing
Update coverage for legacy catalog deserialization, personality override notifications, opt-out behavior during model switches, and preservation of instructions and history on resume.
GitOrigin-RevId: bee8a263ef84046301888d02347f43929ececce9
## What changed
Introduce `TurnEnvironmentRequest` for caller-supplied environment input and construct `TurnEnvironmentSelection` at session startup and app-server settings boundaries. Update thread startup, default environments, and inherited environment handoffs to use requests, with explicit conversions when reusing runtime selections.
Move the environment types into `protocol::environment` while retaining their `protocol` re-exports. Update test fixtures and existing tests to build request inputs separately from runtime selections.
GitOrigin-RevId: 12e7daaece95aae136afae8b055b4dbaebdffc75
## Why
Some metrics backends require cumulative metrics, while configured OTLP exporters previously always used delta temporality.
## What changed
Read `OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE` for configured HTTP and gRPC metrics exporters. Accept `delta`, `cumulative`, and `lowmemory` case-insensitively, retaining delta for unset, empty, or unrecognized values. Document the setting and preserve existing temporality for the built-in Statsig exporter and runtime snapshots.
## Testing
Update the HTTP loopback test to set the preference in an isolated subprocess and assert that the exported counter uses cumulative aggregation temporality.
GitOrigin-RevId: ca212eea20054b947005d323186c8b9a819ace9d
## What changed
- Carry opaque `review_target` values through misalignment errors and expose optional `reviewTarget` in the app-server protocol and generated clients. Preserve the value verbatim and redact it from debug output.
- Keep target-based `misalignment_override` metadata on turn requests, preserve it across steering updates, and exclude it from compaction and external MCP metadata. Reject overrides from global Responses metadata while retaining legacy timestamp behavior for per-turn overrides.
## Testing
Extend coverage for error propagation, debug and rollout redaction, steering preservation, and metadata filtering. Verify that automatic compaction omits the review target while turn requests before and after compaction retain it.
GitOrigin-RevId: 8c1abb076a206ff5927a4acc31bd25e3efc2bff9
## What changed
Record the total serialized JSON size of raw MCP tool definitions in the `codex.mcp.binding_catalog.raw_definition_json_bytes` histogram, before filtering or model preparation.
Emit an `mcp.binding_catalog` trace event for each server with its tool count, definition size, server kind, plugin ID, and cached or live catalog source. Reuse bounded product SKU attribution for both metrics and events, and skip size measurement when neither telemetry output is enabled.
GitOrigin-RevId: abda7cbf46d5470eb321455f047dd7429084740e
## Why
Bubblewrap discovery probes executables before confinement. Excluding only the command's current directory leaves candidates in other writable roots eligible to run outside the sandbox.
## What changed
- Filter canonical `PATH` candidates using the filesystem policy and effective user permissions, including writable ancestors, symlinked roots, and full-disk write access. Preserve protected system installations while rejecting replaceable paths.
- Select the launcher with the command's permissions before the proc-mount preflight, retaining the bundled bubblewrap fallback.
- Use the effective permission profile and policy working directory for startup warning probes.
## Testing
Add unit coverage for writable roots, symlinks, read-only carveouts, replaceable parents, and full-disk policies. Add Linux integration tests showing writable `bwrap` candidates are neither probed nor launched, including when the command runs in a workspace subdirectory or uses managed networking with full-disk write access.
GitOrigin-RevId: 188c9f45e727eaace062f5abb1205dc23fdf3c51
## What changed
- Add the default-disabled `code_mode_tool_search` feature to expose `await tools.tool_search({query: "...", limit: 8})` in code mode when the model supports tool search.
- Return BM25-ranked deferred tools as `{tools: [{name, description}]}`, including callable names and TypeScript declarations for use in later code cells.
- Filter results through the current step's nested-tool policy before applying the limit, preserving namespace restrictions, normalized identities, description prefixes, and schema budgets.
- Add ranked-search guidance while retaining `ALL_TOOLS` catalog discovery and description overrides.
## Testing
Add coverage for feature and model-capability gating, namespace restrictions, argument validation, schema budgets, and discovery followed by deferred MCP and dynamic tool calls. Extend the scenario snapshot to cover search, invocation, yielding, and completion through `wait`.
GitOrigin-RevId: 092a29dd5f0773c518f53a001b9cafb917422f13
## What changed
Add `features.cli_daybreak`, disabled by default, to gate Daybreak controls and automatic access-program selection in the TUI and `codex exec`. Apply the gate to resumed sessions and background task turns, and hide `/daybreak` when disabled. Explicit `--cyber-access-program` overrides remain available.
## Testing
Extend tests to cover disabled controls, history replay, foreground and background turn requests, exec resume/fork behavior, and explicit access-program overrides with the feature disabled.
GitOrigin-RevId: ae96a4a8c7ab97c619716b9f39ea9f295df6e5a6
## Why
Reloaded subagent threads did not emit initialization analytics, and subagent initialization events always reported `new`.
## What changed
Emit initialization events for resumed spawned subagents before notifying thread listeners. Inherit parent client metadata before reserving a residency slot can evict the parent, preserve the thread's original `created_at`, and report `initialization_mode` as `resumed`. Refresh stored analytics metadata when a subagent resumes; newly created subagents continue to report `new`.
## Testing
Extend the cold-resume integration test to verify a single worker initialization event with the expected session, parent, source, resume mode, and original creation timestamp. Update serialization and session tests to check initialization modes.
GitOrigin-RevId: e78b0c4d88b6ddbe993ca7e1fe7717b6f74bf3d9
## Why
Updating a CRLF file with `apply_patch` previously normalized its line endings to LF unless preservation was explicitly enabled. Preserve the file's existing line endings without requiring an opt-in.
## What changed
- Use line-ending-preserving updates for both tool calls and standalone `apply_patch` invocations, removing the legacy normalization mode.
- Mark `apply_patch_preserve_line_endings` as removed.
- Always set `CODEX_APPLY_PATCH_PRESERVE_LINE_ENDINGS=1` in child environments for compatibility with older patch executables, overriding stale values.
## Testing
Update CLI, tool-call, shell-heredoc, and app-server tests to check CRLF preservation by default. Keep coverage for overriding stale compatibility environment values.
GitOrigin-RevId: 96d0b0e5350faa3fc7a45d63627a132657b44523
## Why
Removing a whole namespace previously listed both the namespace and every member as unavailable tools.
## What changed
Emit separate namespace and individual-tool sections in one removal notice for Responses Lite. A removed namespace subsumes its members, with instructions allowing tools declared in a later update to become available again. Keep individual removal notices for tools in surviving namespaces and for built-ins.
## Testing
Expand unit tests and snapshots to cover mixed removals, empty catalogs, restoration, and replacing a namespace with a built-in of the same name. Extend the MCP refresh scenario to verify namespace removal and restoration, successful calls after restoration, preserved request history, and no repeated updates on unchanged turns.
GitOrigin-RevId: 66aa43a41db956cb5458121ea1db8c673a7ce948
## What changed
Update `.bazelversion` from 9.0.0 to 9.2.0 and refresh
`MODULE.bazel.lock`, including lockfile format version 28, registry hashes,
module extension digests, and cached crate metadata.
GitOrigin-RevId: 52689e818bf0eb37d9339df8d8a09c6cbe43e4d8
## Why
Release builds for different tags can run concurrently, but publication must remain serialized so channel checks and updates cannot race or move release pointers backward.
## What changed
Scope workflow concurrency to `${{ github.workflow }}-${{ github.ref }}`. Keep `release`, `publish-r2`, `publish-npm`, `winget`, and `update-branch` on a shared `rust-release` concurrency group with `queue: max` and `cancel-in-progress: false`.
GitOrigin-RevId: 75b42fd765db6091fb9190aae2ecccd2bb959d08
## What changed
Support `browser_use.extension.request_headers` as a list of `name`/`value` pairs and expose it through `config/requirements/read` as `browserUse.extension.requestHeaders`. Update the generated JSON schemas, TypeScript types, and Python models.
Preserve header values, including template strings, verbatim. Higher-priority requirement layers replace the entire header list, including with an explicit empty list. Redact header values in Rust debug output while retaining them in API serialization.
## Testing
Add coverage for parsing and malformed entries, extension scoping, empty-list overrides, API mapping and read responses, and debug redaction without changing serialized values.
GitOrigin-RevId: 02299e82a91aa863966d0277091bc5e8cc1ebe07
Extend the app-server thread metadata test to archive a thread after pinning
and unpinning it, before any turn starts. Assert that the thread appears in
`thread/list` results with `archived: true` and `use_state_db_only: true`.
GitOrigin-RevId: dde58e892b28843870bc3f678134fc86b93cd79c
## What changed
Install a temporary `SIGCONT` handler and unblock the signal during `Ctrl+Z` suspension. After sending `SIGTSTP`, wait for the handler to confirm resumption, returning a timeout error if no confirmation arrives within the bounded wait.
Restore the previous signal handler and thread signal mask, resume terminal stderr handling, and reapply terminal modes even when suspension fails. Propagate signal setup, delivery, and restoration errors to the caller.
GitOrigin-RevId: 1a7e10e982b1f6b2c7c7d75362a01989409b3b4d
## Why
Unix control-socket shutdown removes the socket and rendezvous link but leaves the startup lock file behind.
## What changed
Keep a removable startup lock with the control-socket guard and release the lock after publishing the rendezvous link. On cleanup, reacquire the lock and verify that the path still identifies the same file before removing it.
Use nonblocking acquisition with asynchronous retries, checking file identity after acquisition to handle lock-file replacement.
## Testing
Add tests for nonblocking lock contention and dangling symlink rejection, and extend the control-socket lifecycle test to verify that the lock file is removed on shutdown.
GitOrigin-RevId: 469ed5269f32ae1c0655d40d28519ef5e94ba6be
## What changed
- Record nonempty base instructions as a developer message after tool declarations at the start of each incremental tool context window, and omit the request-level `instructions` field.
- Preserve this prefix when rebuilding history after local or remote compaction, while keeping the compaction summary last.
- Count recorded base instructions once when estimating context usage and trimming tool outputs.
## Testing
Add regression coverage for instruction placement, omission of request-level instructions, compaction ordering, and token accounting. Exercise remote compaction trimming with both request-level and recorded base instructions.
GitOrigin-RevId: 6a6fda92c5c6eb33852a77b38d34c028cf78b164
## Why
Publishing an older stable version should not replace a newer release as the default download or installation target.
## What changed
- Compare stable versions before marking a GitHub release as latest, allowing same-version reruns to finish publication.
- Guard npm `latest` and platform dist-tags, publishing older versions under separate `release-<version>-<tag>` tags.
- Check R2's `latest` channel before updating it or the installer aliases, while allowing same-version reruns to repair interrupted installer updates.
- Reject invalid existing stable release metadata and consolidate GitHub latest and canary checks in `releases.py`.
## Testing
Add regression tests for stable version ordering, same-version reruns, npm package and platform tags, and invalid channel metadata. All 21 tests in `.github/scripts/test_releases.py` pass.
GitOrigin-RevId: e6bad3ee163b279ac1661b9070712a41eedd50ff
## Why
Transient admission errors or connection resets can prevent a code-mode session from opening before any execution starts.
## What changed
- Retry `OpenSession` and the initial lease message on `Unavailable` or `ResourceExhausted`, with at most three attempts and 100 ms and 200 ms delays within a single startup deadline.
- Classify HTTP connection and request failures as `Unavailable` so admission can recover from connection resets, while preserving error sources.
- Keep retries limited to initial admission so established executions are never replayed.
## Testing
Add gRPC integration tests covering transient status recovery, the retry limit, immediate failure for non-retryable statuses, and successful session execution after a connection reset.
GitOrigin-RevId: 3b654bcd377a5addf7c3ed58bb1c72a449b2f7f7
## Why
Thread-owned Guardian context is always enabled, and `guardianv2.thread_context` is deprecated and ignored.
## What changed
Remove explicit `GuardianThreadContext` enables from retained-context and heartbeat tests. Parameterize the heartbeat skill-context test with optional feature lists so it covers the default behavior and `GuardianRootHandoffContext`, each with one or three heartbeats.
GitOrigin-RevId: 78e3159832bff08b79c7977d876d9acb587e9c71
## What changed
Extend the Windows signing action with an `additional-files` input and sign `scripts/install/install.ps1` with Azure Trusted Signing in the x64 release job. Stage the architecture-independent installer after compression so it remains a plain script, and publish the signed artifact as `install.ps1` instead of copying the unsigned source.
## Testing
The Windows release workflow verifies that the installer has a valid Authenticode signature and a timestamp certificate before staging it, failing the job if either check fails.
GitOrigin-RevId: 6f16a084b8f350fbf3644c36d75651a6f4b88506
## What changed
- Accept per-environment `skills.required` lists through `environment/add` and `environments.toml`.
- Before inference, require each named skill to be enabled and supplied by the selected environment. Missing skills fail the turn before a model request, including when environment setup fails.
- Stop applying an environment's requirements after it is deselected. Exempt isolated Guardian reviewers, which have no skill catalog.
## Testing
Add tests for available, missing, disabled, and wrong-environment skills, failed environment setup, recovery after deselection, and propagation of TOML requirements to the correct environment.
GitOrigin-RevId: 302ced4774697d2f414f745fe0535e71f747eda2
## What changed
Move base instructions from the top-level `instructions` field into a prefixed `developer` message in `input` for standard Responses requests, matching Responses Lite. Remove the field from HTTP and WebSocket request types and assign instruction messages stable IDs derived from the thread and instruction text.
## Testing
Extend standard and Responses Lite tests to cover instruction message serialization, stable IDs, and resume consistency. Update WebSocket tests to verify that changed instructions trigger a full request without `previous_response_id`.
GitOrigin-RevId: e2de4b8e30a9339377fac133ceda981abd1a112b
## What changed
Give the initial Guardian review and its checkpoint recovery attempt separate recovery flags instead of resetting a shared flag. Keep the single restart under the original review deadline.
Represent reviewer selection explicitly with `ReuseIfAvailable` and `FreshParentCheckpoint`, so recovery requires a fresh session and ignores reusable fork snapshots.
GitOrigin-RevId: 35f63f375e2a8bef10271944e222ffce1d1939c4
## Why
A Guardian review restarting from the parent checkpoint must bypass cached reviewer sessions and snapshots, even when another review is using the cached session.
## What changed
- Add `ReviewerRequest::requires_fresh_session` and enable it for parent-checkpoint recovery.
- Replace an idle cached session with a fresh reusable session, or start a fresh ephemeral session when the cached session is busy. Neither recovery path inherits a cached snapshot.
- Reserve the review permit before validating a cached session and before exposing a newly spawned session to concurrent requests.
## Testing
Add tests covering recovery with idle and busy cached sessions, verifying that recovery receives no cached snapshot and that subsequent reviews reuse the appropriate session.
GitOrigin-RevId: 894f685736da54312336932aa2037e74a20629d9
## Why
Reviewer compaction can invalidate previously admitted transcript evidence. When a parent checkpoint is available, restarting from that checkpoint preserves the captured parent context instead of relying on a lossy reviewer summary.
## What changed
- Restart an invalidated reviewer once from the action-time parent checkpoint, within the original review deadline.
- Preserve fresh checkpoints during startup and fit review input using the existing budget selection.
- Select transcript evidence from the checkpoint actually loaded by the reviewer. Track the transcript source so cursors remain valid across legacy-history eviction and reset when the source changes.
- Resume transcript deltas after successful recovery, including authorization added after the parent checkpoint.
## Testing
Add regression coverage for checkpoint recovery, post-checkpoint authorization, resumed deltas, and stopping after one restart. Extend history tests to cover both legacy retention and parent-checkpoint reuse, and update the checkpoint-migration snapshot.
GitOrigin-RevId: bc20fb9489afaad963303beff1c79f62fa5023f7
## What changed
Use `OPENAI_API_KEY` for the Guardian Decisions sampler when `CODEX_GUARDIAN_DECISIONS_API_KEY` is absent, the provider is `openai`, and no custom base URL is configured. Preserve dedicated-key precedence, including empty values, and do not fall back for other providers or custom base URLs.
## Testing
Add a credential-selection test covering fallback, dedicated-key precedence, empty dedicated keys, and provider and base URL restrictions.
GitOrigin-RevId: a2a62c28789597f013544b51e142b21f9e214080
jif