## Why
Concurrent imports and consolidation can modify the same memory workspace, leaving a partial import across memory versions or interfering with consolidation snapshots and baselines.
## What changed
- Add a cross-process workspace lock shared by memory imports and consolidation.
- Acquire locks for every import destination before modifying any workspace. Return a retryable busy error if a destination is locked, and skip consolidation when its workspace is busy.
- Hold locks through import completion even if the caller drops the future, and through consolidation agent termination and baseline finalization.
## Testing
Add an app-server integration test that blocks an active consolidation, verifies import rejection without partial writes or snapshot changes, then retries successfully and confirms imported resources remain visible to the next consolidation.
GitOrigin-RevId: c4ce945f916dcb4d75a3190ea869751fac51de83
## What changed
Increase memory extension resource retention from 7 to 14 days before pruning.
## Testing
Update pruning and startup test fixtures for the 14-day retention window, including resources at the exact cutoff.
GitOrigin-RevId: 5044a1262c8806245d90d567cd84b21aa0d3da43
## Why
Memory summaries should preserve task history and the scope of user corrections and preferences without turning task-specific instructions into general claims about the user.
## What changed
- Give memory v2 dedicated extraction prompts that emphasize chronological task history, evidence provenance, and uncertainty, with working directory and branch hints.
- Require only `rollout_summary` and `rollout_slug` for v2, store an empty raw memory, and redact secrets before truncating summaries with a 9,000-byte budget.
- Split v2 input into memory context messages while preserving the v1 prompts and output contract.
## Testing
Extend startup tests to check v2 output storage, schema, branch hints, and redaction before truncation. Verify that budgeted input preserves human and agent evidence in order, omits media payloads and lower-priority noise, and keeps message chunks bounded.
GitOrigin-RevId: 89e1c797450bd8f8e192fbe7161b5159bff8f931
## Why
Memory extraction has a limited rollout budget. Select evidence by source so human input and assistant final responses take priority over commentary, context, and tool output.
## What changed
- Use tiered selection for memory v2, preferring newer evidence within each tier and rendering selected items in chronological order with omission markers.
- Keep answered `request_user_input` questions alongside human replies, label evidence sources, replace message media with placeholders, and bound tool output and individual rows.
- Add typed memory context fragments with bounded messages and Unicode-safe extraction chunking.
## Testing
Add tests for memory v2 startup using tiered input and for extraction chunks preserving Unicode evidence within message bounds.
GitOrigin-RevId: 1b2bba4e3264b4fda271e429ad3b7d5f69caed59
## What changed
- Reject a symbolic link used as the memory root.
- Recursively remove symbolic links before preparing or seeding the memory workspace.
- Remove and reject symbolic links created during consolidation, including when the worker fails, so they cannot affect files outside the workspace.
## Testing
Add Unix startup tests covering pre-existing extension links and links created by both successful and failed consolidation workers.
GitOrigin-RevId: f96e03812773f7beaa16455dd77370ee47d8a71f
## Why
Memory startup used hardcoded OpenAI model slugs for extraction and
consolidation. That works for the default OpenAI-compatible path, but
provider-specific backends can require different model identifiers. In
particular, Amazon Bedrock should use its Bedrock model ID for these
background memory requests instead of the OpenAI `gpt-5.4-mini` /
`gpt-5.4` slugs.
## What Changed
- Added provider-owned preferred memory model methods alongside
`approval_review_preferred_model`.
- Updated memory extraction and consolidation to resolve their default
model through the active `ModelProvider`.
- Added Amazon Bedrock overrides so both memory stages use
`openai.gpt-5.4` through Bedrock’s provider-specific model ID.
- Kept explicit `memories.extract_model` and
`memories.consolidation_model` config overrides taking precedence.
- Added startup coverage for default OpenAI and Bedrock memory model
selection.
#closes #26288
## Why
Memory startup runs in the background after an eligible turn, but it can
consume Codex backend quota at exactly the wrong time: when the user is
already near a rate-limit boundary. This PR adds a guard so the memory
pipeline backs off when the Codex rate-limit snapshot says the remaining
budget is too low.
## What Changed
- Added `memories.min_rate_limit_remaining_percent` with a default of
`25`, clamped to `0..=100`, and regenerated `core/config.schema.json`.
- Added `codex-rs/memories/write/src/guard.rs`, which fetches Codex
backend rate limits before memory startup and skips phase 1 / phase 2
when the Codex limit is reached or either tracked window is above the
configured usage ceiling.
- Keeps startup best-effort: non-Codex auth or rate-limit fetch/client
failures preserve the existing memory startup behavior.
- Records a `codex.memory.startup` counter with
`status=skipped_rate_limit` when startup is skipped.
- Added config parsing/clamping coverage and guard unit tests.
## Verification
- Added `codex-rs/memories/write/src/guard_tests.rs` for threshold,
primary/secondary window, and reached-limit behavior.
- Added config tests for TOML parsing and clamping.
Keep extracting memories out of core and moving the write trigger in the
app-server
This is temporary and it should move at the client level as a follow-up
This makes core fully independant from `codex-memories-write`
---------
Co-authored-by: Codex <noreply@openai.com>
jif