## What changed
- Add a bounded developer context fragment identifying the MCP server or connector and the user-owned configuration that declared it.
- Emit the fragment only when the effective entry matches the user configuration or an active plugin declaration resolves inside the Codex home directory.
- Keep tool descriptions, outputs, and unrelated tools untrusted, and reject unsupported sources or paths that escape through symlinks.
## Testing
- Cover user-configured servers and connectors, plugin-provided capabilities, token truncation, symlink escapes, and app-server request integration.
GitOrigin-RevId: 0bfe2a2f3a48334d1d5faad692b5d36452febb68
## What changed
- Add optional `McpToolContext` metadata to `ToolStartInput`, exposing the
model-visible MCP tool details and its source classification without exposing
the executable client.
- Classify MCP calls as connectors, configured servers, plugin servers,
executor-selected plugins, or other registrations based on the prepared call.
- Prepare each MCP call before notifying tool lifecycle contributors and reuse
that same call for execution so the callback describes the call that runs.
## Testing
- Cover host-owned connector calls and extension-owned Apps server calls,
including their distinct provenance and executed tool names.
GitOrigin-RevId: efd23f511b1045ffdd96349d621ad62365569b2b
## Why
Models that require automatic review previously skipped Guardian v2 risk scoring
entirely, even when Guardian was limited to computer-use tools. That scope cannot
use a low-risk result to approve unrelated tools, so the blanket skip is
unnecessary.
## What changed
- Retain Guardian v2 risk scoring for required-review models in
`ComputerUseOnly` scope while continuing to skip it in standard scope.
- Preserve strict automatic approval review for Node REPL-backed tools, including
when classification fails.
## Testing
Added coverage for low-risk, high-risk, and invalid classifications across the
Node REPL and computer-use REPL paths, plus an unrelated MCP tool.
GitOrigin-RevId: ee38fabf82e196df0ae13b4216b5892be9b799cf
## What changed
- Add a synchronous reviewer prompt builder that combines root authorization,
trusted user answers, bounded conversation history, parent environment and
permission context, retained REPL evidence, and the proposed action.
- Select text or image REPL evidence from Guardian feature and transcript
settings while respecting the reviewer model's supported modalities and
shared image limits.
- Render network access requests with trigger-specific guidance and bound
approval reasons and nested action strings before including them.
## Testing
- Add a prompt test covering root authorization, untrusted transcript framing,
retry reasons, denied-read restrictions, and action serialization.
GitOrigin-RevId: d1cf886c2e30f7abbf94cce977cef14439ef3f2e
## What changed
- Classify `response.failed` events with the `rate_limit_exceeded` code as a distinct retryable error while preserving any parsed retry delay.
- Expose the error as `rateLimitExceeded` through the core protocol and app-server schemas after stream retries are exhausted.
- Preserve the upstream message for TUI display while keeping it out of telemetry summaries.
## Testing
- Cover SSE classification, retry metadata, protocol conversion and serialization, exhausted stream retries, telemetry redaction, and TUI rendering.
GitOrigin-RevId: 02dab4d3477dcd7653a58c49c4bd38687a616579
## What changed
- Add effective workspace roots to `EnvironmentConfig` and use them when
materializing permission profiles and filesystem context.
- Preserve selection roots for thread-owned configurations while allowing a
ready environment attachment to supply its resolved roots.
- Propagate resolved roots to child environments and validate both command and
`apply_patch` writes in owner-provided secondary workspaces.
GitOrigin-RevId: 1832c168ce1fc37fa67efc2a472998ab4f448c70
## What changed
- Add the `features.guardianv2.persist_scores` configuration option for debugging.
- Default the option to `false`, so Guardian V2 reviewed actions and risk scores are only written to rollout files when explicitly enabled and the session is not ephemeral.
## Testing
- Cover configuration deserialization, default non-persistence, and opt-in persistence for nested code-mode actions.
GitOrigin-RevId: 452af99ef14553d45140340ececc2913389124d0
## What changed
- Add optional `call_id` and `action` fields to `SecurityRiskScore` so a persisted score identifies the tool call and bounded action that produced it.
- Populate the fields after Guardian V2 classifies an action while leaving fail-closed and legacy scores without provenance.
## Testing
- Verify scores preserve action details for direct tool calls and nested code-mode calls.
- Verify rollout serialization retains the new fields.
GitOrigin-RevId: fce69af37f368cecf1d9bce42bfc38a969e969b7
## What changed
- Add the opt-in `features.guardianv2.free_guardian` setting to route eligible
Guardian reviews to `/guardian` and asynchronous classifications to
`/guardian-classifier`.
- Support endpoint selection for both HTTP and WebSocket Responses clients,
including endpoint-aware connection reuse.
- Keep `/responses` for API-key authentication, custom provider URLs,
non-Guardian models, and configurations where the option is disabled.
- Omit routing hints and `service_tier` from requests sent to the dedicated
Guardian endpoints.
## Testing
- Cover route selection across authentication modes, provider URLs, HTTP
fallback, WebSocket review sessions, and classifier sampling.
GitOrigin-RevId: 9c88673c710d009e0239559b9245a4e6c4f4befc
## What changed
- Append accepted Guardian V2 classification results to rollout history for non-ephemeral threads.
- Keep resumed and forked threads from restoring a persisted score into active Guardian state.
## Testing
- Verify that asynchronous scoring records the resulting `SecurityRiskScore` rollout item.
- Seed resume and fork tests with a persisted score and verify that approvals ignore it.
GitOrigin-RevId: 40d63a2ea7e7cf6398402c6aed7d5e5727dc9d68
## What changed
- Default Guardian v2's review scope to computer-use tools. Set
`features.guardianv2.review_scope.computer_use_only = false` to retain the
broader tool review scope.
- Include images in Guardian transcripts by default. Set
`features.guardianv2.transcript.include_images = false` to disable them.
## Testing
- Update configuration and app-server coverage for the new defaults and
explicit broader-scope overrides.
GitOrigin-RevId: 88c3cfe6dd2a96df052111794ad59c5c9ea39b78
## What changed
- Evaluate recent unknown-authorization or critical-risk actions over the last five actions instead of ten.
- Flag predicted high- or critical-risk actions when they are credibly expected within the next two actions, rather than treating any potential risk within ten actions as high.
- Remove privileged or broad access as a standalone high-risk condition and classify a trajectory as low when none of the explicit high-risk conditions apply.
- Clarify the user-authorization and reviewer terminology in the classifier instructions.
GitOrigin-RevId: 1eaf63c3327f57a9c8560df085e1fe0afad99cd4
## What changed
- Express nullable history and notes arguments with `anyOf` and remove unsupported schema constraints.
- Forward valid JSON object arguments to the backend without enforcing client-side limits.
- Clarify history ID, ordering, cross-agent path, and consistency semantics in the tool descriptions.
## Testing
- Cover forwarding previously restricted argument values for every history and notes tool.
- Verify app-server requests expose the Bridge-compatible schemas and still reject non-object arguments locally.
GitOrigin-RevId: 28809fe9da5099944fd04962b5e71ffda4163eea
## What changed
- Add a policy prompt and output contract for synchronous Guardian reviews.
- Build reviewer thread options with a preferred review model, low reasoning effort when supported, and a fallback to the parent model and effective effort.
- Isolate reviewer sessions from parent instructions, MCP servers, optional features, and write access while preserving read restrictions, resolved environments, managed network constraints, and rollout persistence.
- Mark prepared threads as internal Guardian review sessions for later host-managed startup.
## Testing
- Cover reviewer isolation, read-only environment inheritance, review-model overrides, and parent-model fallback behavior.
GitOrigin-RevId: 5133be99674b64e06e19e7f2dbc86439e1678790
## What changed
- Add `plugin_id`, `model_slug`, and `reasoning_effort` dimensions to
`codex.skill.injected` metrics for explicit and implicit skill invocations.
- Propagate plugin IDs from orchestrator skill metadata so resource-backed skill
invocations can emit the same attribution.
- Record `codex.skill.turn.duration_seconds` once per plugin used in a turn,
tagged with the model, reasoning effort, and completed, aborted, or error
status.
GitOrigin-RevId: d249a9c4e85682b1106ac49d9e598535c6cbb06d
## What changed
- Read `x-codex-imagegen-request-id` from image generation and edit responses.
- Propagate the ID to `codex_image_generation_event` analytics.
- Keep the ID in process only, excluding it from extension item serialization, generated types, app-server wire data, and rollout history.
## Testing
- Cover response-header extraction and missing-header behavior in the images client.
- Verify end-to-end analytics emission and the unchanged image-generation item wire shape.
GitOrigin-RevId: 9b8e09b7d655c0c2faa84f0eee99aabae583668d
## What changed
Rename the `UserInstructions` type to `Instructions` across the extension API,
its core API re-export, and all consumers. This keeps loading behavior and the
`LoadedUserInstructions` provider interface unchanged.
GitOrigin-RevId: 1ac236b34c31718e7aa38ff5eae5e9b179aeedd8
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## What changed
- Add an optional `turnTrigger` field to app-server `turn/start` requests and
expose it in the generated protocol schemas.
- Propagate non-empty trigger values to Responses request metadata as the
reserved `turn_trigger` field, while preserving the original value when a
request steers an active turn.
- Classify turns started by queue dispatch, goal continuation, retry recovery,
and realtime handoff.
## Testing
- Cover HTTP and WebSocket metadata forwarding, steering behavior, reserved
metadata handling, and the built-in trigger classifications.
GitOrigin-RevId: c12fe2c522286db21b76081ae6154fbf6bfb3639
## Why
Selected executor plugin roots could still expose capabilities when managed
requirements disabled the `plugins` feature.
## What changed
- Suppress MCP servers, skills, apps, and connectors from selected executor
plugins when `plugins` is disabled, while preserving the selected-root
identity used to filter those capabilities.
- Apply the policy consistently to direct selected-root discovery and batched
executor capability discovery.
## Testing
- Add contributor-level and app-server coverage that verifies disabled plugin
capabilities are absent and their MCP servers never start.
GitOrigin-RevId: e30bd8a936c4b0e083908b89a65f4d02e01747de
## What changed
- Add the under-development `skip_host_skill_discovery` feature to bypass host
skill snapshots during session warmup and turn setup.
- Let skill invocation contributors declare whether they require host-owned
skills. Preserve host discovery when no contributors are registered or any
contributor requires it.
- Keep executor and orchestrator skill catalogs and instruction loading
available when host discovery is skipped.
## Testing
- Cover executor-only, orchestrator, mixed-contributor, and legacy host-skill
behavior.
GitOrigin-RevId: 48169403090b234e1a304c6523633fd867df454a
## What changed
- Teach goal continuations to distinguish concrete progress, verified waits on live handles, and turns that made no progress.
- Re-poll live work after observation timeouts instead of treating the work as terminal or restarting it, and carry equivalent blockers through the existing blocked audit.
- Remove the duplicate goal prompt renderers and templates from `codex-prompts`; goal steering remains owned by the goal extension.
GitOrigin-RevId: 4ec64721164743e879ae946a2dd024bba5869fbe
## Why
Answers collected by `request_user_input` can change what the user authorizes, but post-tool hooks may replace or reject the tool output that Guardian normally sees.
## What changed
- Record bounded, host-observed answers before post-tool hooks run and provide them as trusted evidence to synchronous and asynchronous Guardian reviews.
- Include root-thread answers in worker review context.
- Count successful answers as authorization changes so earlier review evidence becomes stale, while ignoring empty or unrelated answers.
## Testing
Add coverage for allowed and denied stale reviews, empty and oversized answers, hook-modified output, and root-to-worker propagation.
GitOrigin-RevId: 970c52e40338ecd057c7cd2a69d04b06e97cd068
## What changed
- Track protected messages, ordinary messages, and tool entries in separate pools with cached token totals.
- Evict the oldest eligible evidence across pools while preserving transcript token and entry limits and the reserved recent tool entries.
## Testing
- Add regression coverage that a small, tool-heavy transcript window retains the latest final assistant reply.
GitOrigin-RevId: 7aa78d0b0609d8e45cb82e4f7773c0877a4d8224
## What changed
- Protect developer messages and final assistant replies from eviction by ordinary message evidence in bounded Guardian v2 transcripts.
- Exclude legacy inter-agent messages from that protection and keep recent tool evidence available when the entry limit is reached.
- Retain cache-friendly chunked eviction when protected messages themselves exceed transcript bounds.
## Testing
- Add transcript unit coverage for message and token limits, rejected commentary, legacy inter-agent messages, and recent tool evidence.
- Add an extension test for preserving a final assistant reply after older tool entries are evicted.
GitOrigin-RevId: f37d5f25e4105d2ec8fae226a558b703cda69288
## What changed
- Register the history-notes extension as a context contributor and fetch `thread_hint` from the configured history-notes backend.
- Add non-empty hints of at most 4,000 bytes to the context-window prompt, and omit hints when the request fails or the response is missing, empty, or oversized.
- Verify that app-server sessions use the native backend when `use_history_notes_extension` is enabled and retain the MCP bridge behavior when it is disabled.
## Testing
- Cover hint injection, request context, response validation, backend failures, and disabled-extension behavior in history-notes and app-server tests.
GitOrigin-RevId: 344a7bb79d962ea8b7c969f25b67a79423fc7fcc
## What changed
- Add a `ContextWindow` prompt slot for thread-scoped extension contributions.
- Include fragments in that slot in the token-budget context-window message.
- Keep the MCP `notes/thread_hint` bridge when the native history-notes extension is disabled, without falling back to it after a native request failure.
GitOrigin-RevId: befcb7cc8570b846094b2b542a112b186b39a30a
## Why
`skills.read` paginated resources against a fixed response limit, so a page could exceed a smaller tool-call response budget.
## What changed
- Size each serialized `skills.read` page to the current call's response budget, accounting for JSON escaping and UTF-8 boundaries.
- Cache one bounded executor-resource snapshot per thread so cursor continuations return consistent contents without rereading the file. Replace the snapshot when another resource is read, and reject stale cursors after a reread.
- Tie cached executor snapshots to the selected environment and sandbox context without keeping the environment alive.
## Testing
- Cover budget-constrained reads, escaped and multibyte contents, multi-page reconstruction, changed resources, snapshot eviction, and expired turn-scoped access.
GitOrigin-RevId: e515935b82771b3f29b3fb91ea7a7a72e19a65ee
## What changed
- Add `features.guardianv2.review_scope.computer_use_only` to restrict asynchronous classification and fast approvals to browser and computer-use REPL tools.
- Keep other tools on the synchronous approval path without letting them age or reuse scores from in-scope calls.
- Give this scope precedence over `sandboxed_exec_commands` when both options are enabled.
## Testing
- Cover configuration precedence, direct and code-mode tool detection, fast-approval isolation, and end-to-end approval routing for browser, computer-use, and unrelated MCP servers.
GitOrigin-RevId: bfd9ab6abdbd90634b265d354e038724b1e81d65
## What changed
- Split the approval review contributor into a `fast_decision` path for existing evidence and a `full_review` path for structured reviews.
- Add host-owned full-review inputs with action evidence, conversation history, thread and turn identifiers, approval context, and extension data.
- Add structured assessment and error types, and resolve full reviews using the first contributor that claims the request.
## Testing
- Cover full-review input propagation, first-claim ordering, and short-circuit behavior in the extension registry tests.
GitOrigin-RevId: 6f763d874af8c0b66a0d760b7b7c7dfe32251c9e
## What changed
- Track truncation and omission across Guardian v2 actions, transcript entries and images, and synchronous review evidence.
- Emit `codex.guardian_v2.classification.truncation` counters and byte histograms for original, retained, and omitted content after successful classifications.
- Tag observations by input component and whether content was truncated or fully omitted.
## Testing
- Extend async scorer coverage for action truncation metrics.
- Verify the app-server Guardian flow records truncated review evidence.
GitOrigin-RevId: 70680897f75716770aa072f866d60bd37e171c1d
## What changed
- Retain completed synchronous Guardian reviews as structured records until the async scorer builds its classification input.
- Render and bound review correlation, action, rationale, and full evidence body with the async scorer's transcript truncation marker.
- Extend the Guardian V2 integration test to verify oversized action and rationale content is truncated and the resulting review evidence remains bounded.
GitOrigin-RevId: 0000ba77b810748e34254dd00df4a69f8492e175
## What changed
- Build `skills.list` pages against the current tool-call response-byte budget.
- Skip entries that cannot fit, preserve pagination across retained entries, and report oversized metadata without repeating the warning for the same budget.
- Keep existing cursors compatible while encoding the response budget in new cursors.
## Testing
- Cover direct and Code Mode listing, budget changes between pages, provider and omission warnings, oversized entries, legacy cursors, and budgets too small to return discovery warnings.
GitOrigin-RevId: 4b34cd2714e4849fe9155ce3f0021b218763c395
## What changed
- Increase the Guardian sampler's initial WebSocket pool from 2 connections to 8.
- Keep pool growth and recovery tests focused on the two-connection scenarios they exercise while making the remaining tests derive their expectations from the initial pool size.
GitOrigin-RevId: e2eabcdde5828ac7df333271f3253e74d696f396
## What changed
- Replace structured numeric classifier output with a single `high` or `low`
token and map those classifications to `1.0` and `0.0` risk scores.
- Require the classification contract in both default and overridden prompts,
including when classifier instructions are truncated.
- Return the first streamed classification immediately while draining the
remaining response for connection reuse and token accounting.
## Testing
- Cover prompt rendering and truncation, classification parsing, early streamed
results, conflicting later output, WebSocket reuse, and approval routing.
GitOrigin-RevId: 31a57e4eb9bf8df2a161b84aa3d5b16ab8f2937b
## What changed
- Add `ToolCallSource` to extension `ToolCall`s and propagate direct or Code Mode
invocation metadata, including the runtime cell and nested tool-call IDs.
- Add `ToolCall::response_byte_budget` so extension tools can bound direct-call
responses by the host truncation policy while allowing Code Mode responses up
to the tool's own limit.
- Share the skills extension's response-size limit between its `list` and `read`
tools.
## Testing
- Verify that Code Mode source metadata is preserved when core constructs an
extension tool call.
GitOrigin-RevId: b10aef01be30d35b67bee3af24a1a4175c9ee112
## What changed
- Recognize `cua_repl` alongside `node_repl` when collecting Guardian review evidence, applying computer-use policy, and capturing transcript images.
- Render `cua_repl.js` results with the compact REPL history and transcript views.
- Preserve failed MCP call status and result content when replaying app-server history.
## Testing
- Cover both REPL server names across Guardian policy, evidence, image capture, history rendering, and failed-call replay tests.
GitOrigin-RevId: 8c13a721f718add403b07e727c1634b59203c51a
## What changed
- Carry each contextual fragment's `ContentItemKind` through initial context assembly and world-state updates.
- Attach the classifications to merged response messages through `content_item_kinds`, preserving their order alongside the message content.
- Convert extension prompt fragments into annotated developer fragments and classify built-in developer and guardian instructions.
## Testing
- Add an integration test covering roles and content annotations in the first request.
- Update world-state and persisted-history tests to account for annotation metadata.
GitOrigin-RevId: 71c48dad5b17bffd47ba03263e3eb6d5e74fbf4b
## What changed
- Require each `ContextualUserFragment` to provide a stable `<feature>.<name>`
`ContentItemKind`.
- Add `AnnotatedContent` and `RenderedFragment` so rendered text, its role, and
its classification can travel together to API boundaries.
- Derive extension-owned world-state classifications from the extension ID and
keep the skills catalog classification with its fragment implementation.
## Testing
- Verify that an extension-owned world-state section renders with an
`<extension-id>.instructions` content kind.
GitOrigin-RevId: e46b74a0bb41e0b6112667c9d36bc9e7f2714451
## What changed
- Require each `PromptFragment` to include a producer-owned `ContentItemKind`.
- Re-export `ContentItemKind` from `codex_extension_api` and assign stable kinds to skills, memories, examples, and test contributors.
- Limit prompt slots to developer policy and developer capabilities, and combine contributed fragments into a single developer update.
## Testing
- Update extension registry tests to verify fragment ordering with the new content-kind metadata.
GitOrigin-RevId: ef8624a9b4ae9dce025bca9c0954d91dd8075e85
## What changed
- Mark Guardian classifier requests with `thread_source: guardian_classifier` in turn metadata.
- Remove the classifier-specific `request_kind` and `is_guardian_mode` fields.
- Update sampler and extension tests to expect the new metadata shape.
GitOrigin-RevId: 1654389ea538b7bd879045634816cbace4bd8f5c
## What changed
- Emit a structured log event for each completed Guardian V2 classification with its thread, turn, tool call, risk score, review threshold, sample time, and whether the score was accepted or superseded.
- Verify that accepted async classification events appear in the reviewed thread's log export with the expected context and decision fields.
GitOrigin-RevId: a027d5991b12a1968b9327da57e2993f0a529ca1
## What changed
- Retain bounded evidence from completed synchronous Guardian allow and deny reviews and supply it to subsequent Guardian v2 async classifier samples as trusted developer context.
- Keep review evidence isolated from the conversation transcript, escape and truncate its fields, and ignore failed or incomplete reviews.
- Invalidate retained evidence after conversation history rewrites or new user messages, including authorization changes in a worker's root thread.
## Testing
- Cover approved, denied, malformed, and forged review inputs, plus root rollback and authorization-change scenarios.
GitOrigin-RevId: 27817e1fde9a136de727048c4220d148fcf72f42
## What changed
- Add an extension API for spawning host-owned internal sessions and a
`ThreadReadyInput` lifecycle callback that runs after thread registration.
- Add Guardian reviewer session scaffolding that records the parent thread and
effective model, plus the under-development `guardian_ext` feature flag.
- Start internal sessions with fresh history while preserving parent lineage,
shared session controls, and internal-thread visibility rules.
- Scope internal-session prompt cache keys to their source and parent thread,
and expose `guardian` as an internal session source.
## Testing
- Cover internal-session spawning, parent metadata, history isolation, prompt
cache keys, and extension spawner argument forwarding.
GitOrigin-RevId: 682dae80397d62bb36247796b447042e760ca364
## Why
Legacy classifier prompts without a `{{ tenant_policy_config }}` placeholder
append the security policy during rendering. Truncating the prompt before and
after that step can unnecessarily truncate the final classifier instructions
twice.
## What changed
Keep configured classifier instructions intact until the policy has been
rendered, then apply `max_classifier_instruction_tokens` once to the complete
prompt.
## Testing
Add an extension test that verifies the bounded developer message sent for a
legacy prompt with an appended policy.
GitOrigin-RevId: 3d776a159340f4dffb6e3c2d7a10b33392fa2240
## Why
Models listed in `auto_review.required_on_models` must always use the full
automatic review path, regardless of any cached Guardian v2 risk score.
## What changed
- Skip Guardian v2 risk classification for models that require automatic
review and clear any cached `SecurityRiskScore` before review routing.
- Count thread lookup failures as failed scoring attempts so stale scores
cannot continue approving later tool calls.
## Testing
- Verify required-review models do not start a classifier and always run full
reviews.
- Verify failed thread lookups advance score lag and fall back to strict review.
GitOrigin-RevId: 048d9a80ac2a282e05437a3abb0c46ec21391be8
## Why
MultiAgent V2 workers can be reviewed after the root conversation has received
new user authorization that is absent from the worker's own transcript. Guardian
reviews need that genuine user context without treating forwarded or
assistant-authored claims as authorization.
## What changed
- Add the bounded root conversation to Guardian prompts for worker reviews.
- Preserve user and assistant roles, and explicitly treat only root user messages
as authorization evidence.
- Exclude summaries, review artifacts, and assistant commentary from the root
conversation evidence.
- Apply the same evidence to both core Guardian prompts and Guardian V2
classification.
## Testing
Add an integration test covering late root-user authorization, forged role text,
forwarded agent claims, and filtered synthetic authorization.
GitOrigin-RevId: 8846de69ba214a88f58f70675798d324e213427c
## What changed
Rename the token-budget configuration key and its Rust field from
`use_history_notes_history` to `use_history_notes_extension`. Update the config
schema, extension gating, explicit-setting detection, and tests to use the new
name consistently.
GitOrigin-RevId: b6a514e23f02095fcd1d35dc42eeb7394b800c77
## Why
Token-budget sessions need a way to recover prior conversation context and preserve working state across context-window transitions.
## What changed
- Add direct-model `history` tools for listing windows and items, reading items, and searching conversation contents.
- Add direct-model `notes` tools for listing, reading, searching, appending, and writing persistent notes.
- Route tool calls through the configured Codex backend with trusted session and agent context, bounded request arguments, and truncation-aware output handling.
- Expose the extension when `features.token_budget.use_history_notes_history` is enabled with an OpenAI provider and Codex backend authentication.
## Testing
- Cover tool registration, configuration changes, provider and authentication requirements, backend request context, encrypted output preservation, and request and response limits.
GitOrigin-RevId: 43b259f01014ba3f30803dd7cd5634942407a9bb
## Why
Guardian v2 applied an implicit token limit to classifier instructions even when
no limit was configured, which could truncate the rendered policy.
## What changed
- Leave classifier instructions unbounded by default.
- Continue honoring `max_classifier_instruction_tokens` from local or model
configuration, with local configuration taking precedence.
## Testing
- Cover full policy rendering without a configured cap and truncation when an
explicit cap is present.
GitOrigin-RevId: 70eb42d43858e0656129dd438b10b60940fd97c6
