Remove the hard-coded 9,000-token cap for encrypted agent messages in both synchronous and asynchronous guardian context. Use `message_tokens` directly when converting the configured limit to a byte budget, allowing larger messages when the configured limit permits them.
Messages that exceed the configured budget still produce an omission notice; encrypted content remains intact when retained.
GitOrigin-RevId: a9032ca19102ebad44be8df1ac4d4892d4404ead
## What changed
Preserve complete Node REPL tool outputs during synchronous transcript collection and apply the configured output token limit during prompt preparation, after full or delta transcript selection.
## Testing
Update transcript assertions to verify that oversized Node REPL outputs remain intact during collection and are truncated to the selected token cap when rendered.
GitOrigin-RevId: 30ced935c04db456a277f7e58281d45e0e2047dd
## What changed
Defer truncation of synchronous Guardian assistant and reasoning entries until `ContextProfile::prepare_transcript`, so the resolved profile's message limit applies before rendering and retention accounting. Keep encrypted agent messages whole when they fit, or replace them with an omission notice at the same transcript position when they exceed the limit.
## Testing
Extend coverage to verify that oversized-action reviews retain assistant commentary and final-answer evidence up to the synchronous message cap, and that encrypted-message omission produces equivalent output through synchronous transcript collection.
GitOrigin-RevId: e17fbfa7b7131559b0599ac1d57987a8d94e137c
## What changed
Preserve tool outputs during sync transcript collection and apply the profile's `tool_tokens` limit during transcript preparation, matching tool-call handling. Keep async and Node REPL output truncation unchanged.
GitOrigin-RevId: cf1594bcf25553c08d53b86bee1dd151e4c5db64
## What changed
Preserve complete tool-call text when collecting synchronous Guardian context, then apply the profile's tool token limit when preparing the transcript. Calculate retained bytes and token usage from the truncated text.
## Testing
Extend the oversized-action regression test to verify that a subsequent review includes the previous call's arguments truncated to the 1,000-token history limit.
GitOrigin-RevId: 2b52505d9ccfa3651b3535e67cc12597be819459
## Why
Local compaction stores generated summaries with the `user` wire role, but those summaries are not user authorization. Guardian transcripts need to preserve that distinction when reviewing compacted history.
## What changed
Classify messages marked with `compaction.summary` as assistant entries in Guardian transcripts, while preserving the attribution of actual user messages.
## Testing
Add transcript collection coverage and regression tests for both line and JSON transcripts that verify generated summaries are attributed to the assistant and original user instructions remain attributed to the user.
GitOrigin-RevId: 66183028ce70a2500d47d3347b110f95471ba868
## What changed
- Add the disabled-by-default `output_token_replay` feature to request `output.encrypted_content` from OpenAI providers.
- Preserve encrypted message and tool-call output, message and function-call status, and output-text `annotations` and `logprobs` through history and replay. Update the generated protocol schemas and SDK types.
- Strip output ciphertext from requests to other providers while retaining it in stored history, including after replay is disabled. Remove encrypted content from memory extraction inputs.
## Testing
Add integration coverage for the feature/provider combinations, metadata replay across follow-up requests, and history preservation when resuming with replay disabled.
GitOrigin-RevId: 77729a021b6771933402aebe74ece8eb39c057e2
## What changed
Add `preserve_fork_prefix` to the multi-agent v2 configuration, defaulting to `false`. When enabled, full forks retain the parent's model-visible history, including commentary and tool records, and append the child's instructions. Legacy compaction without a reusable context baseline still rebuilds the child context.
Mark copied history as inherited, complete unfinished tool calls in the fork snapshot, and exclude inherited manual approvals from authorization review while retaining them in model context.
## Testing
Add coverage for preserved request prefixes, child instructions, legacy and paginated histories, Code Mode, missing inherited tool outputs, compaction fallback, and approval isolation across checkpoint replay. Update the noisy helper failure test to read its response before starting cleanup.
GitOrigin-RevId: ce9235dfa111c88d6ce66cb93d564fb63b326489
## Why
Partial answers contain answer fragments while a turn is still in progress. Treating them as final answers defers mailbox delivery and can count empty fragments as empty final responses; filtering them from forked histories and guardian transcripts loses answer content.
## What changed
- Allow mailbox preemption after `partial_answer` messages and keep mailbox delivery open.
- Preserve partial answers in forked agent histories and include them as protected assistant entries in guardian transcripts.
- Exclude empty partial answers from empty-final-response accounting for goals.
## Testing
Add regression coverage for partial-answer phases in live events, sampling continuations, follow-up requests, and forked child requests, plus mailbox preemption, goal accounting, and guardian transcript inclusion.
GitOrigin-RevId: 208c8933e211b42b6c2d0bec6952527b8c9c120e
## Why
Guardian transcripts omitted encrypted agent messages, leaving reviews without evidence such as encrypted parent replies.
## What changed
- Carry encrypted `agent_message` items through synchronous reviews and asynchronous scoring, preserving their order, author, recipient, and ciphertext.
- Account for native messages in context budgets and omit them whole with an explicit notice when limits require it.
- Support mixed text and native messages during review admission while retaining user-content annotations.
## Testing
Add coverage for transcript ordering and budget eviction in both reviewer profiles, plus a mocked scenario verifying that an encrypted parent reply appears exactly once in each of two incremental Guardian reviews.
GitOrigin-RevId: abc2f1ce5accd83beb06f799ef9ed9d7fa2cd90a
## Why
Synchronous Guardian reviews can include the same user instruction in both the retained instructions section and the conversation transcript. Avoid this duplication while preserving complete authorization evidence and its original acceptance order.
## What changed
- Carry retained source metadata into transcript rendering. Omit a retained instruction when the transcript delivers its complete matching source revision.
- Label qualifying transcript entries with retained source order and protect them from budget truncation. Keep separate retained instructions when source metadata is missing or incomplete.
- Track delivery of source-order guidance so it remains available even when all retained instructions are delivered through the transcript. Invalidate that delivery proof when messages are shortened.
## Testing
Add coverage for complete-source deduplication, missing or incomplete metadata, budget protection, guidance redelivery, and source metadata preservation across resume. Update Guardian review assertions and snapshots to verify instructions are delivered once.
GitOrigin-RevId: 20ad0304501fa49f1596c4cfaf3ef89d64815753
## Why
Unchanged scheduled heartbeat instructions should not become fresh authorization evidence that supersedes a later human override or floods Guardian review context.
## What changed
- Capture heartbeat provenance per input, including when steering an active turn, and persist it in history and retained context.
- Coalesce unchanged instructions for each automation at their original acceptance order. Preserve changed instruction versions and ordinary human messages.
- Represent repeated heartbeats as references to earlier instructions in Guardian transcripts, while tracking the latest input turn separately for trusted skill selection.
- Limit coalescing to recognized, bounded heartbeat envelopes with host-provided provenance.
## Testing
Add regression coverage for human overrides across repeated and steered heartbeats, instruction changes, checkpoint restoration, transcript references, envelope parsing, and latest-turn trusted skills in delegated reviews.
GitOrigin-RevId: 31e444ddb685a1a618be26d3cc32fb562296946b
## Why
Transcript limits could shorten user instructions or omit later messages before Guardian evaluated the complete request budget, losing restrictions or prior approvals even when they would fit.
## What changed
- Keep user messages and manual approvals complete and in source order through transcript collection and retention.
- Preserve historical instructions while synchronous review can still compact history. If the final request still cannot fit, discard optional evidence before shortening older historical entries with truncation markers, preserving later restrictions where possible.
- Warn that shortened instructions and approvals are incomplete and that missing evidence does not authorize actions.
- Let asynchronous review defer to synchronous review when complete instructions exceed its budget.
## Testing
Add coverage for complete instruction retention, approval and restriction ordering, marked truncation of oversized Unicode text, compaction before truncation, and asynchronous fallback when instructions do not fit.
GitOrigin-RevId: e6159e876231347986b937ee7e07f944b83bfbe6
## What changed
Add `ContextProfile` to `codex-guardian-context` and route synchronous and asynchronous Guardian transcript rendering through it. Move default limits, retention, formatting, and async chunked eviction into the shared crate while preserving the distinct retention policies and host-managed full/delta cursors.
Carry transcript truncation observations through `RenderedTranscript` into context composition, and derive async image collection flags from the resolved profile.
## Testing
Add a profile regression test covering distinct sync/async retention priorities, original entry numbering, omission notes, and async truncation observations. Adapt existing transcript tests to the updated input API.
GitOrigin-RevId: 7f7dc249629d8017e9547085f6617f815ae43a1b
## Why
Reasoning configuration changes need to retain their position and trusted provenance when model history is persisted and replayed. Client-injected history must not be able to forge these controls.
## What changed
- Add a typed `configuration_update` response item carrying reasoning effort, including custom model-defined values.
- Persist harness-authored updates with provenance and preserve them across history reconstruction, thread resume, raw response notifications, and agent forks.
- Exclude untrusted configuration updates from model history, strip client-supplied provenance metadata, and reject configuration updates supplied as turn input.
- Export the new item through the JSON and TypeScript app-server schemas and classify it in telemetry and persistence metrics.
## Testing
- Cover serialization, provenance persistence, history filtering and rollback, resume reconstruction, and injection attempts before and after restart.
GitOrigin-RevId: eb5559d2b52b7a931621e7c9812f009ff9fb8939
## What changed
- Add typed context sections for root-conversation evidence, trusted user answers, and conversation transcripts to `codex-guardian-context`.
- Use the shared section registry when building core Guardian prompts and asynchronous Guardian V2 scoring context.
- Preserve source-role labeling while delivering authorization evidence as user-role context, and fail closed when context collection fails.
## Testing
- Cover shared section ordering and role preservation for synchronous and asynchronous targets.
- Verify trusted user answers appear exactly once as user-role input in Guardian V2 approval flows.
GitOrigin-RevId: 1d5d793ffbf166077411a66e85e039596907fb7e
## What changed
- Add a reusable transcript contributor for synchronous and asynchronous Guardian context, with borrowed conversation history and request-specific configuration.
- Preserve conversation order and role or tool attribution while applying separate per-entry limits for messages, ordinary tools, and Node REPL-backed outputs.
- Make tool calls, tool outputs, and reasoning independently configurable, and expose transcript collection without requiring section composition.
- Register the transcript contributor in a process-wide default registry that retains no request state.
## Testing
- Add unit coverage for role and tool attribution, optional evidence sources, orphaned and named tool outputs, registry reuse, and request-specific entry limits.
GitOrigin-RevId: 2b60f8db4618de8a7175f8ee0183375a526a87db
ioanbudea-OAI