## Why
Truncating verified answers can obscure the association between questions and responses. Elastic entry caps must preserve that association.
## What changed
Mark verified answer records in root conversation and trusted user answer sections so elastic preparation keeps them intact when they fit. Replace oversized records with the protected incomplete-answer notice and record zero retained evidence bytes.
## Testing
Add a regression test with two questions and opposite answers, checking that both evidence sections omit oversized records whole and preserve complete records when the entry cap allows them.
GitOrigin-RevId: 0fe9e8c0955cb09845a929274e3d52b816119624
## Why
A reviewer receiving retained REPL responses after compaction can exhaust its context budget on protected response headers alone when the store contains many small results.
## What changed
Select a contiguous suffix of the newest responses before allocating body budgets, bounding elastic selection by the token-derived cost of provenance headers and separators. Preserve retained response bodies and images for subsequent allocation, and include dropped responses in the omission count. Apply this selection to both text-only and multimodal evidence.
## Testing
Extend the elastic REPL regression test with 10,000 responses in both evidence modes, checking budget admission, contiguous newest-response retention, preserved text and images, and combined storage and selection omission counts.
GitOrigin-RevId: 47c10d2f50e863ce4ba186be888788b8be5299dc
Pass `uuid_v7_item_id_generator_for_test()` to the two remaining
`record_user_message` calls in the transcript source-proof and budgeting test
to match the required API signature.
GitOrigin-RevId: d9ea7da605de895e009a67a3ab378111599b5bbd
## Why
Elastic allocation could shrink section minimums under budget pressure and bypass section maxima when the complete request fit. Instruction deduplication also needs to account for which transcript entries actually survive allocation.
## What changed
- Fund demand-capped section minimums before scaling headroom up to section maxima. Reject requests whose minimum reservations cannot fit after duplicate credit.
- Prioritize required records over optional records within each section, reconsider selections when redistributing packing gaps, and reserve global space for protected content and framing.
- Deduplicate retained instructions only against complete selected transcript sources, keep that proof selected during refills, and reuse the released budget.
- Retain elastic transcript history by byte limits instead of fixed item counts. On non-user byte overflow, evict whole older entries toward half the byte allowance.
## Testing
Add regression coverage for section minimums and maxima, priority selection, shared framing, duplicate-proof refills, and elastic history retention and replay.
GitOrigin-RevId: d73b40b88ba1bdab97a619014577f4a297171413
## What changed
Introduce `ItemIdGenerator` and pass the runtime-owned generator through sessions, model clients, history, hooks, tool outputs, and memory requests. Keep UUIDv7 generation as the default and replace direct calls to `ResponseItemId::new` with the shared callable.
Preserve existing item IDs and backfill missing or empty IDs through the same generator, including forked history before reconstruction and persistence.
## Testing
Extend coverage for UUIDv7 IDs on user messages, agent messages, and additional tools, and assert that forked model context matches the backfilled items persisted to history.
GitOrigin-RevId: 0dd9ccf0f46f0f1005a6acfc740133b03ce82259
## What changed
Tag untrusted additional context rendered as tool outputs with history metadata and apply `guardian_include_additional_context` when building Guardian review history. Preserve this metadata across session resume and apply the current session's setting to restored review checkpoints.
Keep ordinary tool outputs in review history and preserve the acting model's additional-context payload.
## Testing
Add coverage for inclusion and exclusion after restart, restored checkpoints after compaction, and asynchronous Guardian review. Verify both line and JSON transcripts and check that metadata does not alter the acting model's request.
GitOrigin-RevId: 8ba270a6aac16398c88db3282e9d666702f462fe
## What changed
- Move approval-request and prompt-composition tests from `core` to `guardian-reviewer`.
- Move transcript collection, budgeting, and approval-reason truncation tests to `guardian-context`, removing the test-only rendering helper from `core`.
- Move the managed-feature reviewer configuration test to `guardian-v2`.
GitOrigin-RevId: 1886a10cd6aba07b7ca2bcce28d45e0a698111a6
## What changed
Add `max_total_section_tokens` to `ElasticSectionLimits`, with a builder and accessor. Reject maximums below the section minimum during construction and deserialization. Default to no section maximum and omit the field from serialized output when unset.
Clarify how required evidence uses section minimums and optional evidence can use unused reservations up to section maximums.
GitOrigin-RevId: 850f8ff2795c6e9d2b0d16d3bb0db1c3720e2354
## Why
Elastic entry caps can shorten review framing and authorization warnings along with supporting evidence. Those boundaries and warnings need to remain intact when evidence is truncated.
## What changed
- Preserve protected framing, host notices, and exact planned actions during elastic entry preparation.
- Carry protection metadata through root conversation, trusted answer, and `node_repl` evidence composition while allowing supporting text to be capped.
- Wrap sender evidence in protected boundaries and a warning that partial context does not transfer permission.
## Testing
Extend elastic-budget regression coverage to verify that exact action JSON, permission boundaries, and sender evidence warnings survive while supporting text is capped.
GitOrigin-RevId: 0b4bebb5a9da3611c92d8176cec99c504e8b7b7b
## Why
Deduplicating against optional transcript entries can remove retained instructions or required tool calls even though the optional copies may later be evicted. Elastic instruction caps can also report evidence loss for revisions already delivered in full.
## What changed
- Capture the review's budget policy and use it for feasibility checks, admission, and restoration after compaction.
- Prefer required and protected native messages over optional duplicates, and use only complete, required pending transcript entries as proof of instruction delivery.
- Match elastic instruction duplicates by source revision and discard truncation observations for copies already delivered in full.
## Testing
Extend coverage for compaction recovery under fixed and elastic budgets, required and protected tool-call deduplication, and capped instruction duplicates covered by complete delivery metadata.
GitOrigin-RevId: fe456e645cdba6f782fb16ad582702d3b7ed012c
## What changed
- Thread `ContextBudgeting` through synchronous context and image preparation. Elastic mode preserves candidates for later entry capping and allocation; existing reviewer callers continue to use `Fixed`.
- Defer transcript selection, supporting-text caps, and image budget admission in elastic mode while preserving exact planned actions. Mark host framing as protected and distinguish optional user messages from required manual approvals.
- Add `ElasticBudgetConfig` validation requiring section minimums, including fallback policies, to sum to `DEFAULT_MAX_INPUT_TOKENS`.
## Testing
Extend tests for elastic transcript preservation, deferred native tool-call limits, oversized planned actions, image allocation, and section minimum totals above and below the required budget.
GitOrigin-RevId: 46a4605e12e2bab5973097eb1caf5fd99f6640aa
## What changed
Introduce `ContextBudgeting::Elastic` to prepare captured root conversation and Node REPL evidence without the fixed per-section request caps. Elastic preparation preserves message text and candidates for later allocation while retaining storage omission notices and legacy source deduplication.
Keep `ContextBudgeting::Fixed` as the default and use it at existing call sites.
## Testing
Add tests covering elastic root message preservation and legacy source deduplication, plus REPL text, images, and omission counts in text-only and multimodal modes.
GitOrigin-RevId: ce4fae9d725694456525a413fb511166df6f5e2c
## What changed
- Add `prepare_elastic_entries` to cap required and optional supporting text before allocating whole optional entries. Measure rendered content, including JSON escaping, metadata, and framing, while preserving truncation markers.
- Keep exact planned-action JSON, images, audio, and opaque native payloads whole. Mark shortened sources incomplete and record truncation sizes.
- Expose token estimation and synchronous delivery preparation on `PreparedElasticContext` so deduplication uses the capped representations.
## Testing
Add tests for required and optional entry caps, transcript metadata preservation, unchanged short entries and opaque payloads, and exact action preservation with rejection when the request budget cannot accommodate the action.
GitOrigin-RevId: 23008fb03d15d501e5d602f0584f70b473c2c2e8
## What changed
- Allow audio inputs to carry uploaded file references via `fileId` in the app-server API and `file_id` in model content, preserving existing inline audio shapes and Python class names.
- Preserve mixed inline and file-backed audio ordering through history reconstruction and migration, and budget file-backed audio conservatively when duration is unknown.
- Keep uploaded audio disabled at runtime: reject it before inference or raw history injection, preserve accompanying text, and prevent rejected attachments from reaching follow-up or resumed requests.
## Testing
Add coverage for wire-format round trips, SDK compatibility, mixed audio history ordering, and rejection during turn start, steering, task completion, and raw injection.
GitOrigin-RevId: 70895c47a2494c0c9936348ad1250eb1b7b892a6
## What changed
Add `PreparedElasticContext::enforce_budget` to reserve existing context, required evidence, history, and an omission notice before allocating remaining tokens across optional evidence groups. Scale minimum reservations to fit, favor recent whole entries, and redistribute unused capacity while preserving retained content and order.
Account for shared section framing and keep images whole. Record omitted entries and reject requests when required evidence cannot fit. Supply defaults for unconfigured groups and rename allocation groups to match their source sections, retaining previous serialized names as aliases.
## Testing
Add unit tests for recent-entry selection, redistribution of packing gaps, whole-image retention, shared framing, default limits, and preservation of required instructions and historical approvals under tight budgets.
GitOrigin-RevId: a3c789a5936ec3f22893a31a0014c0902197a281
## What changed
Return `CatalogModel` from model lookups, keeping metadata together with its `Bundled`, `Provider`, `ExplicitConfig`, or `Synthetic` origin through config overrides and runtime snapshots. Replace `used_fallback_model_metadata` checks with explicit `Synthetic` origin checks.
Share the underlying `Arc<ModelInfo>` with extension stores and use copy-on-write for metadata changes. Keep origin tracking outside serialized model metadata.
## Testing
Extend coverage for origin retention across cache reloads, namespaced model lookups, catalog fallback, and config overrides. Verify that step snapshots and extension stores share the same model metadata allocation.
GitOrigin-RevId: bb6130c94a7a795aa168ee24664a1dd453579fba
## What changed
Export `ElasticBudgetConfig`, named `ElasticSection` groups, and validated `ElasticSectionLimits` for optional evidence. Each group can specify a minimum token reservation and a per-entry text cap.
Validate limits during construction and deserialization: both values must be positive, and the entry cap must fit within the minimum reservation and the existing text-part delivery allowance. Reject unknown configuration fields.
This adds configuration types only; elastic allocation is not activated.
## Testing
Add a serialization round-trip test and deserialization checks for zero limits, entry caps above the minimum reservation, and entry caps above the delivery allowance.
GitOrigin-RevId: c869018cfc0d96377b1adbfbdd98e1d88bd1b32a
Expose `MAX_TEXT_PART_ESTIMATED_TOKENS` from `codex-guardian-context` and use it for native tool calls, transcript entries, and delivery-size assertions. Keep the existing 9,000-token limit while replacing duplicated limits in code and tests.
GitOrigin-RevId: 90cb98eea9bade34f18db0d1666ed7ed1e93febe
## What changed
- Separate evidence collection from prompt preparation and pass reviewer history, model limits, and image preparation policy through shared `guardian-context` APIs.
- Detect captured images before composition and measure reviewer history tokens only when images and a valid context window require it.
- Share instruction and native-message delivery filtering across budget checks, including restoration of retained evidence after history changes.
GitOrigin-RevId: 65ef53cf0bc22e1bde9abfb7a9ffce65cfab6f1c
## What changed
Keep original scheduled messages and heartbeat provenance during synchronous transcript collection. Add `prepare_sync_context` to compress repeated heartbeat instructions across the complete collected transcript before selecting the requested suffix, preserving reference numbering in full and delta prompts.
Route synchronous reviewer prompts through this preparation step and reject composition of unprepared scheduled messages. Move transcript profiles and REPL evidence rendering into the preparation module. Asynchronous heartbeat compression remains in collection.
## Testing
Extend heartbeat transcript coverage to compare prepared full and delta prompts with the existing rendering and verify that direct composition rejects unprepared scheduled messages.
GitOrigin-RevId: c9824b8862021301a1f537a74f83bc7eb20aa0ad
## What changed
- Retain captured root conversation sources until synchronous preparation applies request limits. Keep asynchronous snapshots limited to the bounded messages.
- Move approval-reason truncation and tool-description escaping and truncation from composition into preparation.
- Extract synchronous image preparation and admission into `guardian-context`, preserving the prompt token cap and model context-window checks.
GitOrigin-RevId: d3a864c77d8f16bd3e77df436d80c4d2738c43cc
## Why
Native multi-agent calls must stay intact for backend decryption during Guardian review.
## What changed
When `guardian_native_multi_agent_history` is enabled for multi-agent v2, preserve `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent` function calls in the configured tool namespace as native transcript items. Use `functions` when no namespace is configured.
Include the paired evidence-only output in token accounting, and omit native evidence whole when limits require it.
## Testing
Extend transcript tests to cover native call ordering, paired-output budgeting, and whole-item omission. Add a native-history snapshot alongside the existing text-history delegation handoff scenario.
GitOrigin-RevId: e7d9b4f5ea772890bf14b79fdb53b0f9d0a842e4
## What changed
- Add `CoreToolRuntime::requires_guardian_review` to review opted-in function calls before dispatch and stop execution when review rejects the call.
- Deliver proposed calls as native review evidence, preserving encrypted argument metadata. When hooks rewrite arguments, review the updated arguments and discard the original encrypted replay content.
- Deduplicate native call evidence against reviewer history and include paired evidence outputs in input budgets.
- Keep review accounting and metrics for native calls without emitting action-specific client assessment events, and omit approval payloads from debug output.
## Testing
Extend regression coverage for rewritten native calls across review retries, denied calls that never execute their handlers, oversized native evidence, and review metrics without client events.
GitOrigin-RevId: c3b22c0220344581c2b38f233001abaed49cba34
## Why
Verified answers omitted because of request-size limits must be marked as missing. Legacy checkpoint messages also need to match retained excerpts after truncation so workers receive only one copy.
## What changed
Move root message preparation into `codex-guardian-context::prepare_root_context`, including handoff selection, shared message limits, legacy matching, and incomplete-context markers. Pass original legacy text into preparation and mark verified answers incomplete when oversized records are excluded.
## Testing
Add a handoff regression scenario for an ID-less checkpoint with a retained excerpt and an oversized verified answer. Assert that the worker receives one capped user message, both incomplete-evidence markers, and an incomplete authorization version.
GitOrigin-RevId: bd3f5fe164ae2fddba440e9269fd63b52e8b12f8
## What changed
Collect original retained instructions, assistant context, and verified answers before applying synchronous request limits in `guardian-context` preparation. Carry original record sizes through collection, preserving whole-record omission notices, source ordering, and host assistant-context framing.
Apply retained transcript source size checks during synchronous transcript preparation as well.
## Testing
Extend regression assertions for synchronous/asynchronous retained-context parity and equivalent verified-answer omissions when oversized records are filtered during preparation.
GitOrigin-RevId: 9042ee3fe60ebd455f6656b4008efb2acc44ac3d
## What changed
Collect REPL evidence as shared immutable response records, then select and render it during synchronous context preparation. Share response selection logic between text and multimodal layouts while preserving rendering limits, omission markers, and image order.
Use the shared `NodeReplResponse` type in core evidence storage and preserve existing snapshots through copy-on-write image eviction.
## Testing
Extend tests to verify shared response identity during collection, unchanged rendering after preparation, and snapshot stability when storage pressure evicts images.
GitOrigin-RevId: 8564d3732faa5adf01a66bca523d4c03cfbe1822
Remove the hard-coded 9,000-token cap for encrypted agent messages in both synchronous and asynchronous guardian context. Use `message_tokens` directly when converting the configured limit to a byte budget, allowing larger messages when the configured limit permits them.
Messages that exceed the configured budget still produce an omission notice; encrypted content remains intact when retained.
GitOrigin-RevId: a9032ca19102ebad44be8df1ac4d4892d4404ead
## What changed
Preserve complete Node REPL tool outputs during synchronous transcript collection and apply the configured output token limit during prompt preparation, after full or delta transcript selection.
## Testing
Update transcript assertions to verify that oversized Node REPL outputs remain intact during collection and are truncated to the selected token cap when rendered.
GitOrigin-RevId: 30ced935c04db456a277f7e58281d45e0e2047dd
## What changed
Remove snapshot instruction deduplication, separate retained-assistant framing, and the associated omission-metadata special cases. Use `retain_new_instructions` in transcript rendering tests and replace the test-only Decisions snapshot adapter with the conversation adapter.
## Testing
Extend retained-source delivery and incomplete-metadata coverage to both synchronous and asynchronous context profiles. Keep Decisions HTTP, eviction, and cancellation tests exercising the conversation adapter.
GitOrigin-RevId: 3906f7d7349f73931e570ffa649377c3a235317a
## What changed
Defer truncation of synchronous Guardian assistant and reasoning entries until `ContextProfile::prepare_transcript`, so the resolved profile's message limit applies before rendering and retention accounting. Keep encrypted agent messages whole when they fit, or replace them with an omission notice at the same transcript position when they exceed the limit.
## Testing
Extend coverage to verify that oversized-action reviews retain assistant commentary and final-answer evidence up to the synchronous message cap, and that encrypted-message omission produces equivalent output through synchronous transcript collection.
GitOrigin-RevId: e17fbfa7b7131559b0599ac1d57987a8d94e137c
## What changed
Preserve tool outputs during sync transcript collection and apply the profile's `tool_tokens` limit during transcript preparation, matching tool-call handling. Keep async and Node REPL output truncation unchanged.
GitOrigin-RevId: cf1594bcf25553c08d53b86bee1dd151e4c5db64
## What changed
Preserve complete tool-call text when collecting synchronous Guardian context, then apply the profile's tool token limit when preparing the transcript. Calculate retained bytes and token usage from the truncated text.
## Testing
Extend the oversized-action regression test to verify that a subsequent review includes the previous call's arguments truncated to the 1,000-token history limit.
GitOrigin-RevId: 2b52505d9ccfa3651b3535e67cc12597be819459
## What changed
Move `GuardianToolDescriptions` into `codex-guardian-context` and carry structured tool and connector descriptions in `PlannedAction` instead of pre-rendered text. Prepare them during synchronous context composition, escaping closing tags before applying the existing 400-token limit to each source and rendering the untrusted-description fragment.
Keep descriptions optional under the context budget and preserve the complete action JSON. Reject descriptions that reach rendering without preparation.
## Testing
Strengthen the MCP approval integration test to assert the exact rendered descriptions, including independent truncation and escaped closing markers. Adapt the budget enforcement test to use structured descriptions.
GitOrigin-RevId: 4a9f1855f2958758b4be711914c00e4d954cee39
## What changed
Apply the 512-token approval reason cap in `guardian-context` when composing synchronous full and delta reviews, before request budget enforcement. Remove truncation from the requesting host and preserve exact action JSON.
## Testing
Extend the planned-action budget test to cover long approval reasons in both synchronous presentations, verifying that optional tool descriptions can be omitted without changing action arguments.
GitOrigin-RevId: 8cdb6aadd5f50194f63ebd2402193e69bed127cc
## What changed
Represent collected fragments with `RetainedInstructionItem`, preserving their content, semantic kind, and source. Assign retention policy when composing context: user instructions, host notices, and framing remain required, while assistant context remains optional at commentary priority.
GitOrigin-RevId: 0080f3abd0d763bd402e78da0ac1b0fa0cd7678d
## Why
Full-transcript fallback can select encrypted agent messages already present in the reviewer's history. These duplicates should not consume the input budget or displace new evidence.
## What changed
- Reconcile native agent messages with the effective reviewer history and earlier messages in the pending input before budgeting, including after compaction.
- Deduplicate messages with nonempty IDs while preserving messages without IDs. Allow delivery again when the prior copy is absent from the current history.
- Reject conflicting authors, recipients, or content under the same ID without modifying the pending context.
## Testing
Add coverage for duplicate admission, conflicting payloads, redelivery after history removal, and retained reviewer requests. Extend the history eviction regression to verify that full-transcript fallback reuses the reviewer and preserves a single encrypted agent message.
GitOrigin-RevId: 97e90f6359a7cf5a75d1c5967fc98cd885afb4e4
## Why
Guardian request counts grouped by input size should reflect admitted sampling inputs without counting synchronous transport retries more than once.
## What changed
- Add a shared `token_bucket` label to admitted total-input observations in `codex.guardian.context.request_tokens` for synchronous and asynchronous reviews. Use inclusive upper bounds in 20k-token steps through 240k, followed by 256k and overflow buckets.
- Record synchronous request tokens after budget admission, once per sampling step, including the complete input. A fresh step counts again even when its input is identical.
- Preserve asynchronous component histograms for oversized classifications, but omit `token_bucket` so rejected inputs do not contribute to counts grouped by that label.
## Testing
Add coverage for bucket boundaries, synchronous retry deduplication and budget rejection, asynchronous retained-history reuse and reset, and admitted versus oversized classification metrics.
GitOrigin-RevId: fac2f102a4c48c5fd21d56bfa701b95a1ff852d0
## Why
Contextual fragments and extension-owned world-state sections currently return strings, limiting them to text content.
## What changed
- Return `ContentItem` from fragment bodies and rendering, preserving classification and attribution. Apply text markers only to `InputText`; pass other content through unchanged.
- Allow extension prompt and world-state contributions to carry typed content, and preserve media in context-window hints.
- Hash non-text world-state fragments by their serialized content and role while retaining the existing text hashing behavior.
- Add shared content-to-tool-output conversion that preserves image references, image detail, and audio.
## Testing
Add coverage for typed world-state hashing and preservation of image content and attribution. Expand code-mode output tests to cover input text, output text, file-backed and inline images, and audio.
GitOrigin-RevId: 2ed00d466a3f169b151202f3eef71e667ea64be1
## What changed
Replace duplicated content-kind strings with constants shared by fragment producers and consumers, including authorization checks, forked-history filtering, and memory instructions. Share the compaction summary kind between core and Guardian's transcript filter.
## Testing
Add a regression test verifying that Guardian excludes compaction summaries while retaining surrounding user messages, including a user message with identical text.
GitOrigin-RevId: 36dbdf0f82c61b52d2571ac1c392fb151c98151b
## Why
Local compaction stores generated summaries with the `user` wire role, but those summaries are not user authorization. Guardian transcripts need to preserve that distinction when reviewing compacted history.
## What changed
Classify messages marked with `compaction.summary` as assistant entries in Guardian transcripts, while preserving the attribution of actual user messages.
## Testing
Add transcript collection coverage and regression tests for both line and JSON transcripts that verify generated summaries are attributed to the assistant and original user instructions remain attributed to the user.
GitOrigin-RevId: 66183028ce70a2500d47d3347b110f95471ba868
## What changed
- Add `ComposedContext::retain_new_images` and use it in Guardian review sessions and the async scorer. Compare host-prepared image references against admitted history, ignoring image detail, and skip scanning history when no images need checking.
- Restore `ConversationState` directly from a checkpoint, retaining committed history for rollback or transferring it with `take_history` for ephemeral forks.
## Testing
Extend tests for prepared-image matching across differing detail levels, image-free continuations that avoid scanning history, and checkpoint restoration and history transfer.
GitOrigin-RevId: bafeb6de9babc721182be43d0eb1a653955a0ebb
## Why
Unsupported evidence currently shares a single Decisions comparison reason, making it difficult to distinguish why a comparison was skipped.
## What changed
Report separate reasons for unsupported developer messages, other non-user messages, trusted skills, images, and audio. Keep these outcomes classified as `skipped` and retain the generic reason for other unsupported evidence. Expose `TrustedSkills::KIND` for identifying trusted skill fragments.
## Testing
Expand adapter tests for the distinct rejection reasons and add a lifecycle case verifying that trusted skill evidence skips the Decisions request, reports `trusted_skills`, and preserves the baseline score.
GitOrigin-RevId: 98f076d1aa6771d0209e7f5910eed0dcc40c6263
## Why
Encrypted compaction payloads can include sampled-token replay caches that increase their size roughly threefold. Budgeting them as ordinary text can reject checkpoints that fit the model context budget.
## What changed
Use a shared estimate of one token per twelve ciphertext bytes, rounded up, for encrypted `Compaction` and `ContextCompaction` items in history and Guardian context budgeting. Guardian continues to count framing and metadata separately.
Check parent compactions against the configured token budget and a separate hard wire-size limit. Preserve the complete encrypted checkpoint when it fits. The token estimate remains a heuristic and can underestimate legacy checkpoints without replay caches.
## Testing
Add coverage for token-estimate rounding, parent compaction token and wire-size limits, and reviewer continuation with a cached compaction preserved intact.
GitOrigin-RevId: cc18ca29802491865167eef992830efcf93d97da
## What changed
- Add the disabled-by-default `output_token_replay` feature to request `output.encrypted_content` from OpenAI providers.
- Preserve encrypted message and tool-call output, message and function-call status, and output-text `annotations` and `logprobs` through history and replay. Update the generated protocol schemas and SDK types.
- Strip output ciphertext from requests to other providers while retaining it in stored history, including after replay is disabled. Remove encrypted content from memory extraction inputs.
## Testing
Add integration coverage for the feature/provider combinations, metadata replay across follow-up requests, and history preservation when resuming with replay disabled.
GitOrigin-RevId: 77729a021b6771933402aebe74ece8eb39c057e2
## What changed
Add `preserve_fork_prefix` to the multi-agent v2 configuration, defaulting to `false`. When enabled, full forks retain the parent's model-visible history, including commentary and tool records, and append the child's instructions. Legacy compaction without a reusable context baseline still rebuilds the child context.
Mark copied history as inherited, complete unfinished tool calls in the fork snapshot, and exclude inherited manual approvals from authorization review while retaining them in model context.
## Testing
Add coverage for preserved request prefixes, child instructions, legacy and paginated histories, Code Mode, missing inherited tool outputs, compaction fallback, and approval isolation across checkpoint replay. Update the noisy helper failure test to read its response before starting cleanup.
GitOrigin-RevId: ce9235dfa111c88d6ce66cb93d564fb63b326489
## What changed
Add the disabled-by-default `guardian_trust_orchestrator_connectors` feature flag. When enabled, Guardian V2 accepts connectors with nonblank IDs from the host-owned plugin service orchestrator as a trusted source without requiring a matching user configuration declaration.
Distinguish orchestrator provenance from user configuration in trusted-tool context. Trust remains scoped to the exact server or connector identity and source; descriptions, outputs, other tools, and other connectors remain untrusted.
## Testing
Add coverage for host-owned connector context, rejection of extension-owned Apps lookalikes and blank connector IDs, source-specific trust metadata, and context token limits. Snapshot the connector approval request history.
GitOrigin-RevId: fbd87dd71110ca7b2b92d50eef02e1e739a74a02
## What changed
Update retained instruction splitting and empty assistant-context detection to match `SectionContent::Other`, and convert assistant framing markers into `SectionContent`.
## Testing
Extend the snapshot-splitting regression test to use `prepare_transcript` with both line and JSON formats, with and without source message IDs. It checks evidence preservation, deduplication, and a stable instruction prefix as assistant context and reviews change.
GitOrigin-RevId: e2205eaf9b31a2b8291dc6c0c22a899596b10206
## Why
Retained assistant context changes as the conversation grows. Keeping it separate from retained user instructions lets independent Guardian snapshots preserve a reusable instruction and transcript prefix.
## What changed
Move retained user instructions before the transcript and place assistant originals and their omission notice in a separate `RETAINED ASSISTANT CONTEXT` section afterward. Preserve evidence, delivery roles, source metadata, and deduplication across both retained sections. Clear omission delivery metadata when a split assistant notice cannot be attributed to a single section.
## Testing
Add regression coverage for prefix stability as assistant context and previous reviews change, evidence preservation, repeated preparation, and deduplication. Update approval-routing and scorer tests to check the new section order and retention of assistant text outside a smaller transcript budget.
GitOrigin-RevId: 15cda59d24bee0106f6a66c067f6a790fa91df69
## What changed
Introduce `TranscriptRecord` and `PreparedTranscript` to retain attributed transcript text through preparation and composition. Cache rendered content, byte counts, and token estimates, refreshing them when text or framing changes.
Keep JSON records structured during budget recovery so truncation replaces only `text`, preserving metadata, field order, and framing without reparsing serialized JSON. Preserve whole-entry truncation for line transcripts and update synchronous and asynchronous consumers to use the preparation API.
## Testing
Expand coverage for cached estimates and delivery with escaped text, Unicode, and large payloads; metadata and framing preservation during recovery; and stable asynchronous history prefixes in both line and JSON formats.
GitOrigin-RevId: 8b3b5231ca4a6ee47d17dcc788ea68c56dd1a9bc
jif