## Why
Guardian's retrieval, channel selection, and evidence delivery depend on concrete local message-board types. Expose the required operations through shared interfaces so these consumers can use trait-based board handles.
## What changed
- Introduce `BoardReadView` for captured catalogs and post boundaries, with read operations and JSON search configuration but no mutation methods.
- Extend `AgentMessageBoard` with namespace identification, read-view capture, and channel subscription operations, and implement them for the local board.
- Add `message_board_read_tools` to bind the five read-only tools to a captured view.
- Migrate Guardian consumers to `AgentMessageBoard` and `BoardReadView`, retaining Guardian namespace checks and captured read boundaries.
## Testing
Adapt read-view and Guardian retrieval tests to the trait interfaces. Add assertions for the five retrieval tools and rejection of ordinary boards by retrieval binding, subscription capture, and delivery planning.
GitOrigin-RevId: f8c5bc65d8297f6df6e3b02d6c09006bcaea4b1a
## What changed
Add `LocalAgentMessageBoard::set_subscriptions` to apply a caller's subscribe and unsubscribe choices for multiple channels in one transaction. Validate all supplied channels before applying changes, and preserve subscriptions for other channels, threads, and agents.
Allow this self-only operation on read-only live connections, reject fixed views, and emit no notifications. Share subscription and opt-out updates with the existing single-subscription API.
## Testing
Add coverage for bulk updates through a read-only connection, atomic failure when a channel is missing, preservation of other channels and agents, and the absence of notifications.
GitOrigin-RevId: 83ed587f9c5deaa3e9de87adb6319f9de0c804b1
## What changed
Add `ReviewerSubscriptions` to capture a Guardian catalog and expose self-only `subscribe` and `unsubscribe` tools. Restrict requests to channels in that catalog and return captured post IDs so later evidence stays outside the review boundary. Read current membership from storage and filter it through the captured catalog.
Share message-board tool size limits and query the latest channel post directly when updating subscriptions.
## Testing
Add coverage for caller-only subscription changes, rejection of later channels and explicit agent targets, captured post IDs, and unchanged subscriptions for other agents. Extend message-board tests to check unsubscribe post IDs and reject missing channels.
GitOrigin-RevId: 48bf4270d6079f7e436096175c67bb211ccbc248
## What changed
- Expose `guardian_board` tools to list channels and threads, search posts, and read evidence through a captured read-only view. Require a Guardian storage namespace and keep reads within the review's fixed cutoff, including searches across unsubscribed channels.
- Support literal, case-insensitive searches over decoded JSON fields and nested function-call arguments so quotes, Windows paths, and Unicode escapes do not hide matching evidence.
- Strip response-envelope harness metadata from captured evidence except for `user_input_order`, preserving message payloads and source ordering.
## Testing
Add retrieval coverage for unsubscribed channels, fixed cutoffs, and escaped JSON searches. Update evidence tests to verify serialized payloads retain source order while excluding other harness metadata.
GitOrigin-RevId: 3128e4a2d59d1f71f2cce0bc6b1fbdf7e2aba287
## Why
Concurrent appends can shift live results between pages. Readers need a fixed catalog and post boundary to browse without including later activity.
## What changed
- Add `LocalAgentMessageBoard::read_view` and export `LocalBoardReadView`, exposing the captured channel catalog and a read-only board handle.
- Freeze channel summaries and apply a post sequence cutoff to searches, thread listings, reply summaries, and individual reads. Later appends are excluded even when backdated.
- Reject all mutations through fixed views, including subscription changes, while preserving live handle behavior.
Views share SQLite storage without holding a transaction open. They do not retain deleted posts.
## Testing
Add integration coverage for frozen catalogs and paginated reads, exclusion of newer and backdated appends, mutation denial, and continued live updates.
GitOrigin-RevId: d32cd4989d07040891fa5d38f6ee91fa1960d0d6
## Why
Recording evidence on a message board needs a write operation that does not automatically subscribe the author or notify existing subscribers.
## What changed
- Add `AppendRequest` and `AgentMessageBoard::append` for local and in-memory boards, supporting new channels, existing channels, and thread replies without subscription or notification side effects.
- Expose an explicitly selected `append` tool that accepts a destination and text, with no notification recipients.
- Share caller-scoped request IDs with `post`: identical retries return the original metadata, while changes to the payload or operation are rejected. Local appends retain write permission checks and durable storage.
- Reject remote appends as unsupported without issuing an HTTP request.
## Testing
Add coverage for silent writes on both supported backends, tool argument validation and retry conflicts, local read-only access and retries after reopening storage, and remote rejection without network requests.
GitOrigin-RevId: 01fb9d3e2cfcb3de362b28f2bf2ee83bafada80d
## Why
Local message boards use a fixed database filename. Callers need separate storage for boards that share a session identity.
## What changed
- Add `LocalBoardOptions` with a validated `storage_namespace`, and support it when opening, configuring, and permanently deleting boards.
- Allow `LocalBoard::with_options` to select storage for its connections.
- Store custom namespaces in `message_board_<namespace>_1.sqlite`, while preserving `agent_message_board_1.sqlite` for the default namespace.
- Have the agent message board extension select the same namespace for opening, setup, and deletion.
## Testing
Add coverage for namespace isolation, reopening saved posts, and avoiding collisions with other runtime databases. Update setup tests to exercise a custom namespace through reopening and deletion.
GitOrigin-RevId: a6ea8d171809625edeedc3a8ac3ee2e1bbf1682a
## What changed
Move the message-board API, types, permissions, storage backends, and tool implementations into the new `codex-message-board` crate. Keep extension registration in `codex-agent-message-board-extension`, and update core and the remote client to use the shared crate directly.
Move the existing board tests with the implementation and add the crate to the Cargo workspace and Bazel build.
GitOrigin-RevId: 33ce527c2bef7f862eba55cb9b32222902ccf4ad
felixxia-oai