## What changed
- Add `features.guardianv2.review_scope.computer_use_only` to restrict asynchronous classification and fast approvals to browser and computer-use REPL tools.
- Keep other tools on the synchronous approval path without letting them age or reuse scores from in-scope calls.
- Give this scope precedence over `sandboxed_exec_commands` when both options are enabled.
## Testing
- Cover configuration precedence, direct and code-mode tool detection, fast-approval isolation, and end-to-end approval routing for browser, computer-use, and unrelated MCP servers.
GitOrigin-RevId: bfd9ab6abdbd90634b265d354e038724b1e81d65
## What changed
- Split the approval review contributor into a `fast_decision` path for existing evidence and a `full_review` path for structured reviews.
- Add host-owned full-review inputs with action evidence, conversation history, thread and turn identifiers, approval context, and extension data.
- Add structured assessment and error types, and resolve full reviews using the first contributor that claims the request.
## Testing
- Cover full-review input propagation, first-claim ordering, and short-circuit behavior in the extension registry tests.
GitOrigin-RevId: 6f763d874af8c0b66a0d760b7b7c7dfe32251c9e
## What changed
- Track truncation and omission across Guardian v2 actions, transcript entries and images, and synchronous review evidence.
- Emit `codex.guardian_v2.classification.truncation` counters and byte histograms for original, retained, and omitted content after successful classifications.
- Tag observations by input component and whether content was truncated or fully omitted.
## Testing
- Extend async scorer coverage for action truncation metrics.
- Verify the app-server Guardian flow records truncated review evidence.
GitOrigin-RevId: 70680897f75716770aa072f866d60bd37e171c1d
## What changed
- Retain completed synchronous Guardian reviews as structured records until the async scorer builds its classification input.
- Render and bound review correlation, action, rationale, and full evidence body with the async scorer's transcript truncation marker.
- Extend the Guardian V2 integration test to verify oversized action and rationale content is truncated and the resulting review evidence remains bounded.
GitOrigin-RevId: 0000ba77b810748e34254dd00df4a69f8492e175
## What changed
- Increase the Guardian sampler's initial WebSocket pool from 2 connections to 8.
- Keep pool growth and recovery tests focused on the two-connection scenarios they exercise while making the remaining tests derive their expectations from the initial pool size.
GitOrigin-RevId: e2eabcdde5828ac7df333271f3253e74d696f396
## What changed
- Replace structured numeric classifier output with a single `high` or `low`
token and map those classifications to `1.0` and `0.0` risk scores.
- Require the classification contract in both default and overridden prompts,
including when classifier instructions are truncated.
- Return the first streamed classification immediately while draining the
remaining response for connection reuse and token accounting.
## Testing
- Cover prompt rendering and truncation, classification parsing, early streamed
results, conflicting later output, WebSocket reuse, and approval routing.
GitOrigin-RevId: 31a57e4eb9bf8df2a161b84aa3d5b16ab8f2937b
## What changed
- Recognize `cua_repl` alongside `node_repl` when collecting Guardian review evidence, applying computer-use policy, and capturing transcript images.
- Render `cua_repl.js` results with the compact REPL history and transcript views.
- Preserve failed MCP call status and result content when replaying app-server history.
## Testing
- Cover both REPL server names across Guardian policy, evidence, image capture, history rendering, and failed-call replay tests.
GitOrigin-RevId: 8c13a721f718add403b07e727c1634b59203c51a
## What changed
- Mark Guardian classifier requests with `thread_source: guardian_classifier` in turn metadata.
- Remove the classifier-specific `request_kind` and `is_guardian_mode` fields.
- Update sampler and extension tests to expect the new metadata shape.
GitOrigin-RevId: 1654389ea538b7bd879045634816cbace4bd8f5c
## What changed
- Emit a structured log event for each completed Guardian V2 classification with its thread, turn, tool call, risk score, review threshold, sample time, and whether the score was accepted or superseded.
- Verify that accepted async classification events appear in the reviewed thread's log export with the expected context and decision fields.
GitOrigin-RevId: a027d5991b12a1968b9327da57e2993f0a529ca1
## What changed
- Retain bounded evidence from completed synchronous Guardian allow and deny reviews and supply it to subsequent Guardian v2 async classifier samples as trusted developer context.
- Keep review evidence isolated from the conversation transcript, escape and truncate its fields, and ignore failed or incomplete reviews.
- Invalidate retained evidence after conversation history rewrites or new user messages, including authorization changes in a worker's root thread.
## Testing
- Cover approved, denied, malformed, and forged review inputs, plus root rollback and authorization-change scenarios.
GitOrigin-RevId: 27817e1fde9a136de727048c4220d148fcf72f42
## What changed
- Add an extension API for spawning host-owned internal sessions and a
`ThreadReadyInput` lifecycle callback that runs after thread registration.
- Add Guardian reviewer session scaffolding that records the parent thread and
effective model, plus the under-development `guardian_ext` feature flag.
- Start internal sessions with fresh history while preserving parent lineage,
shared session controls, and internal-thread visibility rules.
- Scope internal-session prompt cache keys to their source and parent thread,
and expose `guardian` as an internal session source.
## Testing
- Cover internal-session spawning, parent metadata, history isolation, prompt
cache keys, and extension spawner argument forwarding.
GitOrigin-RevId: 682dae80397d62bb36247796b447042e760ca364
## Why
Legacy classifier prompts without a `{{ tenant_policy_config }}` placeholder
append the security policy during rendering. Truncating the prompt before and
after that step can unnecessarily truncate the final classifier instructions
twice.
## What changed
Keep configured classifier instructions intact until the policy has been
rendered, then apply `max_classifier_instruction_tokens` once to the complete
prompt.
## Testing
Add an extension test that verifies the bounded developer message sent for a
legacy prompt with an appended policy.
GitOrigin-RevId: 3d776a159340f4dffb6e3c2d7a10b33392fa2240
## Why
Models listed in `auto_review.required_on_models` must always use the full
automatic review path, regardless of any cached Guardian v2 risk score.
## What changed
- Skip Guardian v2 risk classification for models that require automatic
review and clear any cached `SecurityRiskScore` before review routing.
- Count thread lookup failures as failed scoring attempts so stale scores
cannot continue approving later tool calls.
## Testing
- Verify required-review models do not start a classifier and always run full
reviews.
- Verify failed thread lookups advance score lag and fall back to strict review.
GitOrigin-RevId: 048d9a80ac2a282e05437a3abb0c46ec21391be8
## Why
MultiAgent V2 workers can be reviewed after the root conversation has received
new user authorization that is absent from the worker's own transcript. Guardian
reviews need that genuine user context without treating forwarded or
assistant-authored claims as authorization.
## What changed
- Add the bounded root conversation to Guardian prompts for worker reviews.
- Preserve user and assistant roles, and explicitly treat only root user messages
as authorization evidence.
- Exclude summaries, review artifacts, and assistant commentary from the root
conversation evidence.
- Apply the same evidence to both core Guardian prompts and Guardian V2
classification.
## Testing
Add an integration test covering late root-user authorization, forged role text,
forwarded agent claims, and filtered synthetic authorization.
GitOrigin-RevId: 8846de69ba214a88f58f70675798d324e213427c
## Why
Guardian v2 applied an implicit token limit to classifier instructions even when
no limit was configured, which could truncate the rendered policy.
## What changed
- Leave classifier instructions unbounded by default.
- Continue honoring `max_classifier_instruction_tokens` from local or model
configuration, with local configuration taking precedence.
## Testing
- Cover full policy rendering without a configured cap and truncation when an
explicit cap is present.
GitOrigin-RevId: 70eb42d43858e0656129dd438b10b60940fd97c6
## What changed
- Treat standalone `function_call_output` items without a `call_id` as external context, including items injected into new and forked threads, and mark the thread memory mode polluted when `memories.disable_on_external_context` is enabled.
- Include these outputs in guardian transcripts with their namespaced tool name and a placeholder for non-text content.
- Allow image generation to reuse images from standalone and otherwise unpaired function or custom-tool outputs.
## Testing
- Cover injected thread items, external-context detection, guardian transcript rendering, and recent-image selection.
GitOrigin-RevId: ca4e8c16a4b731e1256a5956908d00f785b4feb1
## Why
External tool events may need to enter thread history without a preceding function call and therefore do not have a `call_id`.
## What changed
- Allow `function_call_output` items to omit `call_id` and carry optional `name` and `namespace` fields.
- Preserve named standalone outputs during history normalization and agent forks while retaining existing pairing behavior for outputs with a `call_id`.
- Accept, persist, and forward these outputs through `thread/inject_items`, and update the app-server schemas and documentation.
## Testing
- Cover paired and standalone JSON round trips, history normalization, agent forks, and injected thread history.
GitOrigin-RevId: a3258163a7dc93777c7c3023116fe204819bdbb0
## What changed
- Remove the legacy `shell_command` handler and runtime, leaving `exec_command`
and `write_stdin` as the shell execution tools.
- Treat legacy `shell_command` model metadata as `unified_exec`, and normalize
legacy user opt-outs so they do not disable command execution. Managed feature
requirements and `shell_tool` can still disable it.
- Preserve shell approvals, sandboxing, zsh-fork support, and output truncation
through the unified execution path.
## Testing
- Cover legacy configuration and model-metadata compatibility.
- Exercise unified shell execution, approvals, truncation, and `apply_patch`
serialization across the app-server and core test suites.
GitOrigin-RevId: 5c2fd6164fc3519cdae4944cb9db276b8467311c
## What changed
- Add `max_tool_call_lag`, `reuse_parent_compaction`, and transcript
`include_images` to the Guardian model configuration.
- Inherit these settings from model defaults while preserving explicit local
overrides.
- Enable image capture for Node REPL review evidence when transcript images are
included.
## Testing
- Cover inheritance and local override precedence for the new settings.
- Verify that enabling transcript images initializes review-evidence capture.
GitOrigin-RevId: 7c1965c2ec00a78a0436fa916b630be0004dbb51
## What changed
- Exclude sandboxed `exec_command` and `shell_command` calls from Guardian v2 classification by default while continuing to classify calls that request `require_escalated` permissions.
- Add `guardianv2.review_scope.sandboxed_exec_commands` to opt sandboxed shell commands back into classification.
- Keep other tools and namespaced shell tools in scope, and advance tool-call progress when a call is skipped.
## Testing
- Cover the default and configured review scopes, tool namespaces, permission modes, and skipped-call progress tracking.
GitOrigin-RevId: 32fb540c69959b9a82569f0f2fc76b5517496e6b
## What changed
- Move the Guardian thread lifecycle contributor and subagent-spawn context into `codex-guardian-v2`.
- Install the lifecycle contributor and asynchronous risk scorer through a single extension entry point.
- Remove the redundant `codex-guardian` crate and group the existing scorer implementation under `async_scorer`.
GitOrigin-RevId: 97141190c843e588b8c09c9ccd3fe00e1fae39a4
## Why
Selecting only the newest entries changes the retained transcript prefix whenever a new entry arrives, reducing cache stability.
## What changed
- Replay non-user transcript entries through a bounded buffer and evict half of the applicable pool when an entry or token limit overflows.
- Keep message and tool token budgets independent, and reject entries that cannot fit without evicting retained evidence.
- Preserve user-message selection and emit retained entries in transcript order.
## Testing
Added coverage for stable tool prefixes, message-budget overflow, rejected messages, and chunked entry-count eviction.
GitOrigin-RevId: e6181f5a229a6de06c7ef5db21a5c74980a53e97
## What changed
- Treat configuration, action serialization, thread lookup, and classification errors as elevated risk instead of retaining a prior low-risk result.
- Track asynchronous scoring failures separately from completed scores so approval review falls back to strict review when the latest tool call could not be scored.
- Preserve newer classification results when recording a fail-closed score.
## Testing
- Add coverage for each failure path and for ordering fail-closed scores with concurrent classifications.
GitOrigin-RevId: 7012f078a24031848f2943354a206866286ad9f4
## What changed
- Stop writing Guardian v2 security risk scores to rollout history.
- Treat resumed and forked threads as having no previous Guardian score, so their
first tool approval is classified and reviewed normally.
- Remove the now-unused `codex-history` dependency from the Guardian v2
extension.
## Testing
- Update app-server coverage for new, resumed, and forked threads to wait for
classification completion and verify the expected approval reviews.
GitOrigin-RevId: 74d9caa903a1ff9d38e577b4697b5f8970f11ebb
## What changed
- Pass session-attributed extension metrics to the Guardian v2 sampler.
- Record `codex.guardian_v2.classification.token_usage` histograms for total, input, cached input, cache-write input, non-cached input, output, and reasoning output tokens.
- Preserve token accounting when streamed JSON produces an early score by recording usage from the terminal response in the background.
## Testing
- Cover token metrics through the Guardian v2 extension and the sampler's early-score path.
GitOrigin-RevId: 04fadc07f3b9cbe83f9fa3737536860b5cf5b4be
## What changed
- Replace the minimal default classifier prompt with predictive security-review guidance covering authorization, action risk, untrusted evidence, and browser or computer use.
- Trigger full Guardian review at an `action_risk` score of `0.5` or higher for the new default prompt, while retaining the `0.8` calibration for custom and model-provided prompts unless they specify a threshold.
- Render security policy configuration into prompt templates before enforcing the classifier instruction token limit. Prompts without the policy placeholder retain the existing append-and-truncate behavior.
## Testing
- Cover default, custom, and model-provided prompt thresholds and precedence.
- Verify policy substitution, truncation, sampling requests, and full review at the threshold boundary.
GitOrigin-RevId: 7aad9e2d8c9fbea453dc52147a3d0a46bf191aec
## Why
Guardian sampling uses a pool of WebSockets, while the bridge routes each
connection by thread ID. Each socket therefore needs its own identity instead
of reusing the source thread ID across the pool.
## What changed
- Generate a classifier thread ID for every pooled connection and use it for
request, window, and subagent attribution.
- Preserve the originating thread ID in turn metadata alongside the Guardian
classifier request kind.
- Build request metadata after leasing a connection so retries use the identity
of the socket that carries the request.
## Testing
- Cover unique identities across pooled and replacement connections.
- Verify classifier attribution metadata for extension requests and retries.
GitOrigin-RevId: 1c36207125157ff05cab9487a2fa37bf85e5fdd8
## What changed
- Emit a `codex.guardian_v2.classification` counter for each classification.
- Record classification latency in `codex.guardian_v2.classification.duration_ms`.
- Tag both metrics with `success`, `failure`, or `superseded` outcomes.
## Testing
- Verify metrics for successful classification and fail-closed handling.
GitOrigin-RevId: 021702f3b26565d6da5708d2b8f1f8881942a441
## Why
`node_repl` screenshots are nested tool results and do not appear in the parent
conversation history, so Guardian v2 transcript image collection could miss
them.
## What changed
- Allow Guardian v2 to enable bounded, thread-scoped `node_repl` image capture
when transcript images are configured.
- Add retained `node_repl` screenshots to review requests when transcript
sources include tool outputs, while deduplicating images and keeping them out
of the parent turn input.
## Testing
- Add an integration test covering screenshot capture without the synchronous
Guardian transcript feature flags and verifying that screenshots stay out of
the parent request.
GitOrigin-RevId: 5f70c5f2e80389aa8b2a286c3b7f9b1104865486
## What changed
- Pass metrics bound to the active turn's model to approval-review contributors.
- Add counter support to `ExtensionMetrics` while preserving host session attribution.
- Record Guardian v2 tool-call score lag and count stale-score fallbacks with the `score_lag` reason.
## Testing
- Cover counter forwarding and session metadata tags.
- Verify Guardian v2 metric samples for current and stale scores.
GitOrigin-RevId: 0ec34736d29d2e37ed217a27e773b4f6230ae38a
## Why
Guardian sampling WebSockets authenticate when the connection is opened. Reusing
a pooled connection after credentials change can therefore keep using the old
authorization.
## What changed
- Track authentication changes on each pooled sampling connection.
- Discard stale connections after an auth change and reject connections whose
authentication changes while the handshake is in progress.
## Testing
- Verify the sampler reconnects with the refreshed bearer token instead of
reusing its existing connection.
- Verify the installed Guardian extension reconnects after an external auth
refresh.
GitOrigin-RevId: 6d2e7df776fd21c78be0928f71162f5419a8b8f0
## What changed
- Add the experimental `autoApprovalReview/strictReviewRequired` app-server notification with the review's `threadId`, `turnId`, and `startedAtMs`.
- Emit it when Guardian v2 leaves an approval review in progress because the action risk is elevated or its score is stale.
- Export the notification through the Rust, TypeScript, and JSON schema surfaces and route it to the associated thread.
## Testing
- Cover strict-review reason tracking for elevated and stale risk scores.
- Verify that high-risk approval routing emits one notification whose identifiers and timestamp match the review-started event.
GitOrigin-RevId: e65352894520bfb756c75b2c95e2e149f9767bb2
## Why
Guardian stores a `SecurityRiskScore` before advancing its scored-tool-call
counter. Waiting only for the score can therefore let the test continue while
the asynchronous sampler is still updating its progress state.
## What changed
Wait for `latest_scored_tool_call` to advance before exercising Guardian v2
approval decisions, and reuse the same progress tracker for the subsequent
assertions.
GitOrigin-RevId: 3d92c9a3ccf52f4f43a2454aac60d2479258c1c8
## What changed
- Track the latest tool call and latest scored tool call for each Guardian v2 thread.
- Skip approval review when the score lags by more than `max_tool_call_lag` tool calls.
- Add `max_tool_call_lag` to the Guardian v2 configuration and schema, with a default of three.
## Testing
- Cover approval review at, above, and after recovering from the configured lag limit.
- Cover deserialization of `max_tool_call_lag`.
GitOrigin-RevId: fd870e143d95ee76491180e2aed742717248ff78
## Why
Guardian sampling can encounter temporary connection or service failures while
opening a WebSocket, starting a request, or consuming its response stream.
## What changed
- Retry transient transport, streaming, rate-limit, and server failures up to
two times across the full sampling flow.
- Recover from unauthorized responses through the configured auth manager and
discard pooled connections that may contain stale credentials.
- Allow sampler initialization to continue when its initial WebSocket prewarm
fails, so the first sample can establish a fresh connection.
## Testing
Added coverage for recovery after prewarm failures and `503` responses, and for
stopping once the transient retry budget is exhausted.
GitOrigin-RevId: af74c2df95c4241184ca641ef4418db6aa4ab695
## What changed
- Add optional `guardian_v2` model-message defaults for classifier instructions,
review thresholds, reasoning effort, transcript selection and limits, and
action and compaction token limits.
- Apply those defaults when Guardian v2 samples a tool call, while preserving
explicit `[features.guardianv2]` settings over catalog values.
- Preserve the new catalog configuration when applying model overrides.
## Testing
- Cover model-catalog serialization and model override behavior.
- Verify that sampling uses catalog defaults while retaining local overrides.
GitOrigin-RevId: 4ae9ec235c647acbca05a20b7c4b87a4e1331161
## What changed
- Add the `features.guardianv2.transcript.include_images` opt-in setting.
- Include recent images from user and assistant messages and configured tool outputs in Guardian v2 sampling requests.
- Bound image context to the four most recent images and 8 MiB total, and omit image detail hints when constructing the sampling request.
## Testing
- Cover configuration parsing and image forwarding from messages and tool outputs.
GitOrigin-RevId: b0ae6b6182535fd084ea103ed01dc3c803d7d1f7
## What changed
- Add `max_parent_compaction_tokens`, defaulting to 25,000 tokens, to the Guardian v2 feature configuration.
- Reuse the latest encrypted parent compaction only when its complete serialized item fits within the configured limit.
- Fail closed with the maximum action-risk score when the latest encrypted compaction is oversized, instead of sampling with older context.
## Testing
- Cover exact-boundary and oversized compaction items, including oversized passthrough metadata.
- Verify that an oversized latest compaction bypasses sampling and prevents approval.
GitOrigin-RevId: 0b308e7bec0f41d46433dfdf656948cee5cba667
## What changed
- Allow `features.guardianv2` to remain a boolean toggle or specify classifier instructions, the review threshold, reasoning effort, and action and instruction token limits.
- Add transcript controls for included sources, per-entry and total token budgets, and the number of recent non-user entries.
- Validate configured ranges and relationships, expose them in the generated config schema, and apply the resolved settings throughout Guardian v2 classification and approval review.
## Testing
- Cover boolean compatibility, configuration parsing and boundaries, config-manager rejection, and the resulting classifier request and approval decision.
GitOrigin-RevId: dc018b53b782e2d6b4d6a795cca4945130a71678
## What changed
- Include the resolved Guardian security policy in the v2 classifier's developer instructions.
- Prefer an explicit `guardian_policy_config`, then the reviewer model's catalog policy, and finally the bundled policy.
- Limit the combined classifier instructions and policy to 10,000 tokens.
## Testing
- Cover configured and catalog policies, policy truncation, and the bundled-policy fallback.
GitOrigin-RevId: 1b84d70081dd924e214636b4b470d57a63d7cb88
## Why
Concurrent Guardian samples can finish out of order. A stale result rejected by
the thread's latest-score update could still be appended to the rollout.
## What changed
Return without persisting a risk score when `insert_if` rejects it as older than
the score already stored on the thread.
GitOrigin-RevId: 7b2c895742753a19dfe48fd7f8ecd912d3cd3af6
## What changed
- Expand the Guardian sampling pool from 8 to 16 WebSocket connections.
- When the pool is full, supersede the oldest request that has already produced a score before replacing an unfinished classification. Treat superseded classifications as a no-op in the extension.
- Stop response WebSocket work when its event consumer is dropped, including while waiting for the connection lock or draining a completed sample.
- Allow retries across both initially warmed connections for retryable stream failures.
## Testing
- Add a concurrent sampler test that fills the pool and verifies scored drains are replaced before an unfinished classification.
GitOrigin-RevId: 9e4df7b01516094726ff3e11878f8ca742d21b03
## What changed
- Give approval review contributors the first opportunity to resolve an action when automatic review is not required for the model.
- Return an extension's decision directly and fall back to Guardian when no extension claims the review.
- Update Guardian V2 to approve actions below its risk threshold through the review contributor API, and remove the extension approval-policy API.
## Testing
- Verify that an extension approval bypasses both the Guardian model call and the user approval prompt.
- Cover Guardian V2 review decisions for low-risk, high-risk, and disabled threads.
GitOrigin-RevId: 5be56941143aff6f358b75b5f8101b7c047147ae
## Why
Oversized tool arguments could make Guardian V2's model-visible action unbounded.
## What changed
- Cap serialized actions at 10,000 tokens while preserving the trusted tool name and `call_id`.
- Truncate nested string values evenly across the available budget.
- Omit lower-priority fields when the JSON structure alone exceeds the limit, while retaining useful action fields when they fit.
## Testing
Add coverage for oversized nested strings, arrays, and object keys, including spoofed identity fields and omission-marker collisions.
GitOrigin-RevId: 13f7dc93da3761db18a34087225196318a3b8098
## Why
Concurrent Guardian samples can finish out of order, allowing an older sample to
replace the thread's newer in-memory security risk score.
## What changed
- Record when each `SecurityRiskScore` sample starts while preserving compatibility
with records that have no timestamp.
- Add `ExtensionData::insert_if` so checking and replacing a typed attachment happen
under the same lock.
- Update Guardian V2 to replace the thread's risk score only when the completed sample
is newer than the stored one.
## Testing
- Verify concurrent conditional inserts retain the newest value.
- Verify Guardian-generated risk scores include a sampling timestamp.
GitOrigin-RevId: 6543a4e5497da4c623331050789e91613f931c4b
## What changed
- Add a thread-scoped extension API for requesting automatic review, resolving
multiple contributors to the strongest requirement.
- Have Guardian v2 request automatic review when it is enabled and the latest
`action_risk` score is at least `0.8`.
- Honor extension review requirements across tool approvals, MCP elicitation,
and remote execution while preserving host configuration and managed-policy
constraints.
## Testing
- Cover contributor registration and requirement resolution.
- Verify Guardian v2 requests review at the threshold, returns to the default
below it, and does not affect threads where the extension is disabled.
- Exercise extension-requested strict review with a remote model override.
GitOrigin-RevId: 6329fc23585d5cc7173c39bb9952c3109ec3884b
## What changed
- Replace the single `category` and `score` fields in `SecurityRiskScore` with a
deterministic map of category names to scores.
- Validate the full Guardian V2 classifier response before storing it as one
thread extension value and, for non-ephemeral threads, one rollout item.
- Cover serialization and rollout loading with snapshots containing multiple
score categories.
GitOrigin-RevId: 24525de691f96bd34ccfe04acab2f01aca309837
## Why
Guardian V2 classification requests should retain compacted conversation context only when the parent and classifier model configurations can share the encrypted compaction.
## What changed
- Resolve the classifier model's compaction compatibility hash when initializing its sampler.
- Add the latest encrypted parent compaction to classification input when both models have the same non-empty compatibility hash.
- Ignore missing, empty, or unidentified compactions, and omit parent context when compatibility cannot be established.
## Testing
- Cover latest-compaction selection and invalid compaction data.
- Cover matching, mismatched, missing, empty, and changed compatibility hashes.
GitOrigin-RevId: f0fcb09fd028cd2f397fdbc3d541b4bc464b0beb
## What changed
- Replace the single byte limit with token-derived per-entry and separate message and tool transcript budgets.
- Preserve the first and latest user messages, then fill the remaining budgets with recent user, assistant, and tool context while limiting retained non-user entries.
- Truncate oversized entries in the middle without splitting UTF-8 characters, and report the approximate omitted token count.
- Exclude reasoning from the default transcript sources while retaining support when it is explicitly configured.
## Testing
- Cover oversized message and tool-result truncation, user-message retention, separate tool budgeting, configured reasoning, and the resulting Guardian sampling request.
GitOrigin-RevId: aaeaa5fb5d902b5a1581a8a819bf34724bde794b
jif