## What changed
Add `codex.guardian.decision.duration_ms` around the complete approval decision operation, including fast decisions, preparation, and cancellation alongside model review time.
GitOrigin-RevId: e5a8d5a3b9a0ff81e1b866be87b8f3a439ae6a1d
## Why
Partial answers contain answer fragments while a turn is still in progress. Treating them as final answers defers mailbox delivery and can count empty fragments as empty final responses; filtering them from forked histories and guardian transcripts loses answer content.
## What changed
- Allow mailbox preemption after `partial_answer` messages and keep mailbox delivery open.
- Preserve partial answers in forked agent histories and include them as protected assistant entries in guardian transcripts.
- Exclude empty partial answers from empty-final-response accounting for goals.
## Testing
Add regression coverage for partial-answer phases in live events, sampling continuations, follow-up requests, and forked child requests, plus mailbox preemption, goal accounting, and guardian transcript inclusion.
GitOrigin-RevId: 208c8933e211b42b6c2d0bec6952527b8c9c120e
## What changed
- Accept per-environment `skills.required` lists through `environment/add` and `environments.toml`.
- Before inference, require each named skill to be enabled and supplied by the selected environment. Missing skills fail the turn before a model request, including when environment setup fails.
- Stop applying an environment's requirements after it is deselected. Exempt isolated Guardian reviewers, which have no skill catalog.
## Testing
Add tests for available, missing, disabled, and wrong-environment skills, failed environment setup, recovery after deselection, and propagation of TOML requirements to the correct environment.
GitOrigin-RevId: 302ced4774697d2f414f745fe0535e71f747eda2
## What changed
Move base instructions from the top-level `instructions` field into a prefixed `developer` message in `input` for standard Responses requests, matching Responses Lite. Remove the field from HTTP and WebSocket request types and assign instruction messages stable IDs derived from the thread and instruction text.
## Testing
Extend standard and Responses Lite tests to cover instruction message serialization, stable IDs, and resume consistency. Update WebSocket tests to verify that changed instructions trigger a full request without `previous_response_id`.
GitOrigin-RevId: e2de4b8e30a9339377fac133ceda981abd1a112b
## Why
A Guardian review restarting from the parent checkpoint must bypass cached reviewer sessions and snapshots, even when another review is using the cached session.
## What changed
- Add `ReviewerRequest::requires_fresh_session` and enable it for parent-checkpoint recovery.
- Replace an idle cached session with a fresh reusable session, or start a fresh ephemeral session when the cached session is busy. Neither recovery path inherits a cached snapshot.
- Reserve the review permit before validating a cached session and before exposing a newly spawned session to concurrent requests.
## Testing
Add tests covering recovery with idle and busy cached sessions, verifying that recovery receives no cached snapshot and that subsequent reviews reuse the appropriate session.
GitOrigin-RevId: 894f685736da54312336932aa2037e74a20629d9
## What changed
Use `OPENAI_API_KEY` for the Guardian Decisions sampler when `CODEX_GUARDIAN_DECISIONS_API_KEY` is absent, the provider is `openai`, and no custom base URL is configured. Preserve dedicated-key precedence, including empty values, and do not fall back for other providers or custom base URLs.
## Testing
Add a credential-selection test covering fallback, dedicated-key precedence, empty dedicated keys, and provider and base URL restrictions.
GitOrigin-RevId: a2a62c28789597f013544b51e142b21f9e214080
## Why
Manual, pre-turn, and post-turn compaction previously deferred rebuilding initial context until the next turn. Their saved replacement history could omit refreshed instructions and skill catalogs.
## What changed
- Install initial context during local and remote compaction, before the last real user message or summary, keeping the compaction summary last.
- Persist matching full world-state and turn-context baselines with every replacement instead of retaining only partial extension metadata.
- Build replacement context and recompute token usage for the current model even when the previous model performs compaction. Reuse that captured context for eligible current-model retries.
- Capture manual compaction context centrally and propagate preparation errors to the task runner.
## Testing
Update assertions and snapshots for context ordering, refreshed instructions, resume and fork history, current-model checkpoint baselines, and cloud skill catalog retention across compaction and resume.
GitOrigin-RevId: 8572a76c31c6884a3c580b3bbb350d49af876bd1
## Why
The Decisions adapter rejected developer messages, including host-annotated trusted-tool context. Requests containing that context could not be classified.
## What changed
Append developer text annotated with `TrustedTool::KIND` to the classification rubric, preserving its authority while keeping user evidence in the input messages. Accept only a single text part with a single matching annotation; continue rejecting other developer messages and unsupported evidence.
## Testing
Add a regression test covering trusted-tool context alongside untrusted user text, plus rejection of incorrect roles, missing or mismatched annotations, multiple annotations or content parts, and image content.
GitOrigin-RevId: 65b6301b2ee1ac54d67275978ccb5e37dcac7c16
## What changed
Measure `responses_duration` directly around `sampler.sample()` in the snapshot classification path. Leave it unset for conversation classification instead of timing submission and waiting for the score.
GitOrigin-RevId: 4cfac9db6f19f3c8513d7bf839ea9631d41bf3ac
## What changed
Record `agree`, `disagree`, or `unavailable` comparisons between Decisions risk classifications and accepted Responses scores. Emit paired latency histograms only when both backends succeed, and include request preparation and queue time in Decisions duration. Report unavailable comparisons when the comparison feature is enabled but the Decisions sampler is not initialized.
## Testing
Extend lifecycle coverage for an uninitialized Decisions sampler, checking skipped outcome and unavailable comparison metrics while preserving the baseline score.
GitOrigin-RevId: f11789ab5d5fd6957b7913d849bbb2ae7006d3ed
## What changed
Add the disabled-by-default `guardianv2_decisions_comparison` feature to run Decisions alongside Guardian V2 snapshot classification using the same policy and evidence. Initialize the comparison sampler with `CODEX_GUARDIAN_DECISIONS_API_KEY`.
Publish the baseline score before awaiting comparison results, and keep comparison results and failures from changing approvals. Apply Guardian's input token budget, skip conversation evidence, and cancel comparison work when the baseline classification is superseded. Record success, failure, and skip outcomes with bounded diagnostic reasons, including setup failures.
## Testing
Add lifecycle tests covering disabled comparison, disagreeing classifications, backend failures, unchanged published scores, matching policy and evidence, and rejection of over-budget requests before either backend sends them.
GitOrigin-RevId: 743d34c8ee440362da94f001058366027b39bd11
## What changed
Add a Decisions sampler under `#[cfg(test)]` for Guardian's optional comparison classifier, without wiring a runtime caller.
- Encode text and inline image evidence as a `guardian_risk` choice request using `gpt-6-luna`, accepting only `low` or `high` responses. Reject the complete request when evidence cannot be represented.
- Bound concurrency to 16 requests, cancel the oldest unfinished request at capacity, and abort unfinished work when its owning task is dropped.
- Enforce a six-second HTTP deadline, an 8 MiB inline image data limit, and a 16 KiB response limit. Keep credentials and wire bodies out of errors.
## Testing
Add tests for the HTTP contract, unsupported evidence, inline image preservation and size limits, response validation, oldest-request cancellation, and capacity release when a caller is dropped while awaiting completion.
GitOrigin-RevId: e7209ca49a04505acf10ff1aeaca941514589e13
## Why
Environment changes and overlapping catalog refreshes can cause a step to use another step's selected plugins or executor skills. Model context and skill tools need to agree on the capabilities captured for that step.
## What changed
- Resolve selected plugins from each step's ready capability roots, honoring disabled plugins, and retain the snapshot with the step's extension data.
- Use that snapshot for skill attribution in World State and the first step's active-plugin telemetry.
- Return executor skill catalogs directly from refresh so overlapping requests render their own results while retaining thread caches.
## Testing
Add regression coverage for overlapping executor catalogs and environment changes during step preparation. Verify that `skills.list` retains the original step's skills, the next step advertises the new skills, and disabled executor and plugin skills remain absent from model context.
GitOrigin-RevId: 37d3cbe8c7e062fd06290aa985ada4d3b3462d43
## Why
The rolling retained-context window can change as assistant messages are added or evicted. Placing it before the transcript invalidates the reusable history prefix.
## What changed
Move retained user instructions and context after the transcript and action-specific attestations, immediately before the planned action in asynchronous Guardian requests. Keep synchronous section ordering unchanged.
## Testing
Extend the cache-prefix regression test to cover retained assistant message growth and eviction alongside changing attestations. Update app-server and async scorer assertions to verify the new request ordering.
GitOrigin-RevId: 59953d582d4b174ce3e083606626c7532ce0776d
## Why
Executor skill reads need to use the environments and permissions captured for the current step, including newly approved grants. Cached continuation pages must remain bound to the filesystem and permissions that produced them.
## What changed
- Supply borrowed `EnvironmentAccess` to turn-input contributors and extension tools, with session and originating-turn grants already applied.
- Require executor skill reads to use filesystem access from an environment available to the callback, and replace separate optional read contexts with `SkillReadContext`.
- Bind skill pagination snapshots to `EnvironmentAccessKey`, which identifies the source filesystem and callback permissions.
- Route image-generation filesystem operations through the same accessor.
## Testing
Extend skill-read integration coverage to verify that a denied reference becomes readable after a turn-scoped grant is captured by the next model step. Update Windows coverage to verify that restricted reads fail when the executor cannot enforce a sandbox, and add a test requiring turn environment selection before exposing capability roots.
GitOrigin-RevId: 825b49302319965835d61c77fc5bcdb951e10543
## What changed
Return snapshots and model-visible fragments together from world-state rendering, and use those snapshots for history baselines, step updates, compaction, and new context windows.
Update `WorldStateSectionContribution` so its renderer returns an optional replacement snapshot and an optional fragment. A missing snapshot preserves stored section state, even when retained history requires a fresh render; a null snapshot removes the section. Derive step patches from the history baseline rather than a separately captured live world state.
Adapt skills and Git attribution contributors to the new contract.
## Testing
Add coverage for skipped snapshot updates, explicit section removal, changed-state patch replay, unchanged-state deduplication, and matching live and persisted checkpoints when starting a new context window.
GitOrigin-RevId: af71606a278358ae937853cb76e8a019a501408e
## Why
Shadow skill selection runs synchronously during turn input construction, making turn preparation wait for experimental rankings.
## What changed
Run ranking on background blocking workers with a process-wide limit of two concurrent rankings. Wait for capacity in the background and hold each slot until its blocking worker finishes, even if the async evaluation is cancelled.
Freeze catalog, query, and relevance history at turn start. Record eligible invocations immediately for future turns, then score queued observations against the frozen rankings once they are ready, including observations queued before the turn state is dropped.
## Testing
Add tests for turn preparation and history updates while ranking is blocked, deferred invocation scoring against each turn's history, and shared ranking capacity that remains occupied until cancelled workers finish. Update existing metric assertions to collect asynchronous observations across snapshots.
GitOrigin-RevId: f7776e9aaeb45d3a792de167abbe35f7ec5a513e
## Why
Retained Guardian classifier conversations already contain previously delivered synchronous reviews. Appending those reviews again repeats evidence and consumes input budget.
## What changed
Track each review completion with a stable identity in host-only history metadata. Filter already delivered reviews before composing and budgeting continuation input, while preserving distinct completions even when their text is identical.
Fresh conversations receive the review evidence again, and shortened messages no longer count as complete delivery. Delivery metadata stays out of model requests.
## Testing
Add coverage for delivering retained reviews once, appending newly completed reviews, restoring evidence after failed streams, and retaining reviews when history lacks complete delivery metadata.
GitOrigin-RevId: b8d58ffdd7d9c484676af707c65fa50020aae73c
## What changed
- Add `features.guardianv2.async_classifier_mode` with `snapshot` and `conversation` modes. Local configuration overrides model defaults; snapshots remain the fallback.
- Retain completed classifier requests and responses in conversation mode, appending transcript deltas without repeating previously delivered user instructions.
- Rebuild retained history when authorization, classifier instructions, or parent compaction changes, after an incomplete response, or when the next request exceeds the configured token limit. Add `async_classifier_conversation_token_limit`, defaulting to 100,000 tokens, while preserving the model's input limit for fresh requests.
- Serialize conversation requests in observation order, bound outstanding work, and reject stale work after authorization changes or thread shutdown. Record retained and new input token costs.
## Testing
Add tests for configuration precedence, history reuse and resets, ordered admission, queue overflow, and stale or stopped requests. Exercise the approval matrix in both modes, including resume, fork, mandatory review, authorization changes, and stream failure after an early score.
GitOrigin-RevId: 35b9800104648cde4f467086e678dee12458c3e5
## What changed
- Add request preparation that preserves committed classifier history and appends transcript deltas, filtering instructions and images already delivered. Account for the complete input budget before transferring history; rejected requests leave the checkpoint and cursor intact.
- Add retained sampling that publishes the early score while collecting completed assistant output and encrypted reasoning for reuse. Preserve item IDs and input metadata, and discard unusable history without retracting an already published score.
- Keep the existing snapshot sampling path and share input preparation and execution with the new retained path. Retained sampling is not yet wired into the active backend.
## Testing
Add coverage for transcript and image deduplication, immutable history prefixes, budget boundaries, rejected preparation, WebSocket output retention, and retention failures that preserve the early score.
GitOrigin-RevId: 0fa33db8b8ea4483eb64d75e207690f1d349123b
## Why
A database can open successfully while containing corruption that startup previously missed. Detecting it before runtime initialization completes allows recoverable databases to be rebuilt while preserving the damaged files.
## What changed
- Run `PRAGMA quick_check(1)` when opening writable databases, with a 100 ms scan budget. Share attempts across cloned `SqliteConfig` instances by file identity so repeated opens skip validation and replacement files are checked again.
- Back up and rebuild runtime databases that support recovery. Report corruption without rebuilding thread history or other databases without an automatic recovery policy. Treat interrupted or locked checks as incomplete rather than confirmed corruption.
- Collect startup backups across recovery retries and include their locations in the app server warning. Explain that saved conversations can restore the thread list and history, while some database-only metadata may be unavailable.
- Record confirmed corruption in `codex.sqlite.corruption.count`.
## Testing
Add tests for recovery policies, backup preservation, validation caching and concurrency, cancelled and interrupted checks, and locked databases. Add app server coverage for recovery warnings and saved conversation restoration, a TUI warning snapshot, and message board post preservation.
GitOrigin-RevId: 43e26328888e0301def642d69bd324acee867566
## What changed
Emit `codex.skill_invocation` logs for explicit skill injection and detected implicit use, including skill-tool reads. Include skill name, invocation type, conversation, turn, model, and client metadata, plus scope, plugin ID, and ChatGPT user and account IDs when available.
Exclude skill contents, resource paths, email addresses, prompts, and tool payloads. Use the existing OTEL log exporter without an additional opt-in; `otel.exporter = "none"` continues to export no logs.
Document the event fields, exporter configuration, and detection semantics in `codex-rs/otel/README.md`.
GitOrigin-RevId: 0f9c492c3f224455f3de3660be89692d776c1951
## What changed
- Start a turn-owned notification receiver using the same remote board client and session identity as the board tools. Deliver post previews as agent messages and cancel the receiver when the turn stops, aborts, or errors.
- Wait for the initial connection attempt before inference, then retry failed or disconnected streams without waking idle agents.
- Skip malformed notices, mismatched recipients or turns, and oversized previews. Reject delivery to stale or canceled turns and bound remote notices to a 1 KiB context budget.
## Testing
Extend remote board tests to cover interrupted setup, connection failures, reconnection, invalid and stale notices, preview delivery into model context, and receiver shutdown after turn completion.
GitOrigin-RevId: c7c8d977fe74b7a5cb3bd8216dc0146f3f297e44
## Why
User goal edits and clears need to reach the model as user instructions, including when a thread is unloaded or history is being compacted. Automatic goal lifecycle updates must not supply user authorization.
## What changed
- Add optional `origin` values of `user` and `automatic` to `thread/goal/set` and `thread/goal/clear`, and mark TUI goal requests as user actions. Omitted origins do not supply user authorization.
- Persist explicit user objective, status, and clear instructions before changing goal state. Recording failures leave goal state unchanged.
- Coordinate goal edits with thread resume, reload stored history under writer ownership, and preserve edits accepted after the compaction input snapshot.
- Update generated protocol schemas and TypeScript and Python bindings.
## Testing
Add coverage for user edits and clears on loaded and unloaded threads, concurrent path-based resume, exclusion of automatic goals from user instructions, preservation of edits during compaction, and recording failures that leave goal state unchanged.
GitOrigin-RevId: d779d7c678a0c32a6ef76975dbe5b1400d1df245
## Why
`TurnAborted` could be emitted before extension abort callbacks finished, allowing consumers to observe a terminal event while lifecycle cleanup was still pending.
## What changed
Await `on_turn_abort` within task abort handling before emitting `TurnAborted`, retaining callback delivery for already-cancelled tasks. Document that `on_turn_stop` and `on_turn_abort` complete before their corresponding terminal events, if emitted.
## Testing
Add regression coverage for interrupt, conditional interrupt, and shutdown. Hold the abort callback open to verify that `TurnAborted` waits for completion, then verify that the callback runs exactly once with the expected turn ID and abort reason.
GitOrigin-RevId: f34d7e94d04c02544178dc445b85abc65a6ce499
## Why
Guardian review and classification telemetry lacks the context mode needed to distinguish `legacy`, `independent`, and `thread_owned` reviews.
## What changed
- Add `guardian_context_mode` to review and classification analytics and `context_mode` to their metrics.
- Capture the mode from the conversation history snapshot before review preparation or classification setup so failure metrics retain it, including when review preparation or reviewer startup fails.
- Use `unknown` for review metric tags when no context mode is available.
## Testing
Update metric assertions to cover `thread_owned` classification tags and the `unknown` review fallback.
GitOrigin-RevId: 79f7d11b3e4ccfc53681890d75fbc7c54e1ce7de
## Why
Missing retained root instructions could indefinitely block a worker's matching low-risk cached score from approving an action.
## What changed
Require complete retained local context for cached approvals, while allowing incomplete root context when the cached score matches the current authorization. Root omissions remain visible to the classifier.
## Testing
Extend the cached-delivery regression test to verify that a worker with complete local context and an `IncompleteRootInstructions` marker can approve using a matching low-risk cached score.
GitOrigin-RevId: 06feda47fe47feb933c67239d32bf154b2032615
## Why
Turn error hooks receive only a `CodexErrorInfo` category, which omits backend metadata such as usage-limit reset times and rate-limit snapshots.
## What changed
Add borrowed `CodexErrorDetails` to `TurnErrorInput` and pass the original details through turn and compaction error notifications, alongside the existing error category.
## Testing
Add coverage for usage-limit metadata during sampling, manual compaction, and post-turn compaction, including preservation of completed answers and existing error events. Extend lifecycle tests to verify that an `InvalidImageRequest` retains its details when surfaced as `BadRequest`.
GitOrigin-RevId: 6f2058992126da0f69508ef51998e7581557deea
## Why
Skills available from both cloud and executor providers consume duplicate catalog space, leaving less room for descriptions of unique skills.
## What changed
- Prefer model-visible cloud skills over executor listings with the same `plugin:skill` name before allocating the metadata budget.
- Preserve aliases from the full visible executor inventory so filtering duplicates does not renumber remaining packages. Continue choosing full locators when they fit the budget better.
- Keep executor packages available through `skills.list` and `skills.read`, and retain executor listings when cloud skills are disabled.
## Testing
Add regression tests and a model-request snapshot covering description retention, stable aliases across turns, executor availability changes, package reads, and full-locator selection after deduplication.
GitOrigin-RevId: 477e4cf16b8968dbe61438dd5af1eca9cbfa78c8
## Why
Responses stopped by `content_filter` previously followed generic stream-error retry handling without guidance about the block. Retried requests need instructions to explain the limitation and offer a permitted alternative.
## What changed
- Recognize content-filter failures as a distinct error while preserving retryability and the existing public error representation.
- Append developer guidance to the conversation after each sampling block, retaining delivered output and using the existing retry handling.
- Support a model catalog override through `model_messages.content_filter_guidance`. Missing, null, blank, or values exceeding 512 UTF-8 bytes fall back to bundled guidance.
- The bundled guidance tells the model to avoid reproducing or working around blocked content, briefly explain the limitation, offer a permitted alternative, and continue unrelated authorized work.
## Testing
Add a scenario and request-history snapshot covering repeated blocks, catalog guidance on each retry, retained partial output, and eventual completion. Add error-mapping assertions for retryability, public error classification, and error text.
GitOrigin-RevId: ba0c201b3a5a3acf5cfa971332027240e0690225
## Why
Guardian transcripts omitted encrypted agent messages, leaving reviews without evidence such as encrypted parent replies.
## What changed
- Carry encrypted `agent_message` items through synchronous reviews and asynchronous scoring, preserving their order, author, recipient, and ciphertext.
- Account for native messages in context budgets and omit them whole with an explicit notice when limits require it.
- Support mixed text and native messages during review admission while retaining user-content annotations.
## Testing
Add coverage for transcript ordering and budget eviction in both reviewer profiles, plus a mocked scenario verifying that an encrypted parent reply appears exactly once in each of two incremental Guardian reviews.
GitOrigin-RevId: abc2f1ce5accd83beb06f799ef9ed9d7fa2cd90a
## Why
The transcript supplied to Guardian may omit earlier user instructions, restrictions, or revoked permissions. History retrieval lets the reviewer check relevant authorization before approving actions with side effects.
## What changed
- Add the disabled-by-default `guardian_conversation_history_tools` feature. With Apps enabled, expose `user_message.search_messages` and `user_message.read_messages` through the parent's live Apps connection and conversation identity.
- Recheck the parent's current app and tool policy on each call, rejecting disabled tools and calls requiring approval.
- Add retrieval instructions that distinguish user authorization from assistant context and account for later revocations and incomplete results. Allow overrides through `auto_review.experimental_conversation_history_prompt`.
- Limit history responses to an estimated 4,000 tokens by default, configurable through `auto_review.conversation_history_max_output_tokens`, while preserving stricter parent and reviewer limits.
- Allow explicit extension registries for isolated sessions and prevent those sessions from inheriting the implicit Apps connection.
## Testing
Add scenarios covering history tool exposure, parent connection and identity reuse, custom prompts, output truncation, stricter reviewer budgets, and live permission changes on a reused reviewer. Extend configuration coverage for blank prompt overrides.
GitOrigin-RevId: 055a69b113c8548bd58e7d5618ea026ba6d1ffb1
## Why
Message-board notifications delivered as ordinary injected input could cause an agent to sample again after its final answer.
## What changed
Route notifications through the current turn's mailbox as `InterAgentCommunication`, checking atomically that the turn is running and still accepts mailbox delivery. Skip notifications when delivery is closed. Accepted notifications may remain in conversation history for a later turn without reopening the finalized answer or starting a new turn.
Report pending inter-agent communications as mailbox activity, while preserving priority for steering input.
## Testing
Add regression scenarios for notifications arriving before and after finalization, asserting no extra sampling and the expected notification presence in the next turn. Extend input-queue coverage to recognize already-pending mailbox activity.
GitOrigin-RevId: 41d786041b4eccc5ccf926f2f190473676a3ac2f
## What changed
- Give tool fragment sizes and namespace counts logarithmic boundaries through 32,768.
- Give enabled and kept skill counts integer boundaries from 0 through 512, removed description characters logarithmic boundaries through 131,072, and skill truncation flags boundaries at 0 and 1.
- Record these metrics with explicit boundaries, separating zero values and retaining overflow buckets above each range.
## Testing
Extend tool and skill metric tests to assert explicit boundaries. Add an export test covering zero, one, the upper boundary, and overflow, including bucket counts, ordering, and sample totals.
GitOrigin-RevId: 9fbf3acbe352d7c74f3ad11f0b690148c083a6ef
## Why
Guardian denial-limit interruptions lack a structured error identifying the cause. Make this opt-in because older clients may not recognize the new error in shared history.
## What changed
- Add `auto_review.circuit_break_action = "strict"` to attach `TooManyDenials` to the interrupted turn. The default leaves the error unset.
- Expose `turn.error.codexErrorInfo = "tooManyDenials"` in app-server notifications and saved history, and update protocol schemas and generated types.
- Preserve the warning, denial limit, and interrupted status without emitting a separate error notification.
## Testing
Add an integration test covering omitted, `default`, and `strict` settings, checking warnings, live turn errors, the absence of separate error notifications, and persisted turn errors after restart.
GitOrigin-RevId: cb5d379e64728d4d7b9daf834c13756e4a70db31
## Why
Guardian reviews need to retain original evidence across parent compaction when checkpoint reuse is disabled, including after resume and rollback.
## What changed
- Make disabling `guardian_reuse_parent_compaction` select a bounded, independent review transcript while preserving thread-owned authorization.
- Keep synchronous reviews and asynchronous scoring independent of parent checkpoints, and allow reviewer sessions to continue using transcript deltas across parent compaction.
- Persist transcript entries with rollback provenance while remaining compatible with older checkpoint readers and metadata-free checkpoints.
- Exclude compaction output from the transcript and synthetic summaries from rollback turn boundaries. Use acceptance ordering to remove rolled-back evidence even when persistence order differs.
## Testing
Add regression coverage for reviewer continuity, evidence retention across compaction and resume, rollback after local and remote compaction, and checkpoint serialization compatibility.
GitOrigin-RevId: fea0852cc5537372854f4a34bacb6bfda6d13e88
## Why
Guardian needs the assistant's delivered question to interpret a user's reply. Messages sent through nested Code Mode tools must remain available as review context, and approvals based on earlier context must become stale when a new delivery is confirmed. Assistant messages do not themselves grant authorization.
## What changed
- Capture successful hosted User Messaging sends after input rewriting and before result callbacks or post-tool hooks.
- Retain bounded delivery text in acceptance order, persist it through cancellation and shutdown, and preserve it across compaction and resume with an older-client-compatible rollout encoding.
- Track assistant review context separately from user authorization, invalidating pending and cached approvals for both local and worker reviews when that context changes.
- Associate retained deliveries with the correct instruction or communication boundary during rollback.
## Testing
Add coverage for nested messaging review context, fast replies and communication ordering, shutdown persistence, stale local and worker approvals, rollout compatibility, and rollback retention.
GitOrigin-RevId: 1bc1ec9e8947560b99f4b39a42ddb9f2099f519b
## Why
Changes in executor availability can alter cloud skill catalog rendering under a shared budget and repeat an unchanged executor catalog when it reconnects.
## What changed
- Cap cloud skills at three quarters of the metadata budget initially, leaving the remaining budget and unused cloud allowance for filesystem skills. Reduce the cloud cap only when doing so allows all skill entries to fit; description truncation alone does not trigger rebalancing.
- Persist the allocation across disconnects, compaction, and thread resume. Recompute it when the cloud inventory or total budget changes.
- Emit a short availability update when an unchanged selected-environment catalog returns and its full text remains in history. Reinject the full catalog when that text is missing.
## Testing
Add coverage for allocation stability, catalog and budget changes, omission handling, and full catalog reinjection after compaction and resume. Extend the selected capability stack test to verify reconnection avoids repeating the catalog.
GitOrigin-RevId: 839fe98024e00c4082a46e6a40675e15fd2c16c6
## Why
Complete assistant messages with empty text can produce misleading omitted-context notices in Guardian reviews.
## What changed
- Skip complete, empty assistant messages when recording and rendering retained context, while preserving omission notices for incomplete messages.
- Separate retained instruction fragments with blank lines and keep blank lines free of role prefixes, while labeling every nonempty line with its original role.
- Update source-order guidance detection and empty-section deduplication for the added spacing.
## Testing
Extend retained-context tests to cover empty completed messages across resume, restored empty messages, incomplete-message notices, blank-line spacing, and role labeling. Update Guardian prompt snapshots.
GitOrigin-RevId: e945717b18689fa4538d9b617b89a644858ab1c8
## Why
Cached executor MCP declarations must not gain access to host environment credentials when reconnecting to an executor that lacks environment credential resolution.
## What changed
- Retain credential policy through MCP registration, catalog materialization, and runtime setup. Derive selected HTTP plugin policy from the plugin's source environment.
- Reject host bearer-token fallback and transports requiring host environment headers or helpers for executor-owned declarations. Preserve host-configured credential resolution.
- Include credential policy in connection and tool catalog cache identities, and avoid reading host environment values for executor-only identities.
## Testing
Add regression coverage for legacy executors, cached declarations after a capability downgrade, policy preservation through catalog rebuilds, and connection and tool cache isolation.
GitOrigin-RevId: 2d5b85e4e98668c637c538cbe528914c936bd831
## Why
Async Guardian requests include retained user instructions even when complete copies are already present in the same request's transcript.
## What changed
- Include retained source metadata and order labels in async user transcript entries.
- Omit retained instructions when the current transcript contains the same complete source revision. Keep ordering guidance in every async sample and never rely on previous samples for deduplication.
- Preserve retained originals when transcript copies are incomplete or lack source metadata.
## Testing
Extend retained-instruction tests to cover async deduplication, preservation of originals without complete source proof, and budget protection. Update async scorer expectations for source order labels and deduplicated instructions.
GitOrigin-RevId: 7029731b296d2342eea4ad74ffa9d3447578d83e
## Why
Synchronous Guardian reviews can include the same user instruction in both the retained instructions section and the conversation transcript. Avoid this duplication while preserving complete authorization evidence and its original acceptance order.
## What changed
- Carry retained source metadata into transcript rendering. Omit a retained instruction when the transcript delivers its complete matching source revision.
- Label qualifying transcript entries with retained source order and protect them from budget truncation. Keep separate retained instructions when source metadata is missing or incomplete.
- Track delivery of source-order guidance so it remains available even when all retained instructions are delivered through the transcript. Invalidate that delivery proof when messages are shortened.
## Testing
Add coverage for complete-source deduplication, missing or incomplete metadata, budget protection, guidance redelivery, and source metadata preservation across resume. Update Guardian review assertions and snapshots to verify instructions are delivered once.
GitOrigin-RevId: 20ad0304501fa49f1596c4cfaf3ef89d64815753
Derive `Serialize` and `Deserialize` for `CreateChannelRequest`,
`ReadPostRequest`, and `SubscriptionRequest`.
GitOrigin-RevId: 7da638c029f7d57b59e865a3a45ae80924780fba
## What changed
Return post metadata from the in-memory message board after updating board state when no notification recipients remain. This avoids constructing an unused notification preview, including when the author is the only requested recipient.
## Testing
Run the existing post-and-search model-context scenario against both disk and in-memory message boards, checking that post metadata and search results reach the model without self-notifications.
GitOrigin-RevId: dcf07a5fd55738fbcd6edd3dce3f6fb8fc910eaf
## Why
Reused Guardian sessions already contain previously delivered instructions. Follow-up reviews can avoid repeating that evidence, but must deliver it again if it changes or compaction removes it.
## What changed
- Track retained source identity, revision, and completeness in host-owned history metadata, preserving revisions during replay.
- Omit retained instructions from synchronous review inputs only when the same complete revision remains in reviewer history.
- Restore missing evidence after reviewer compaction, enforcing the request budget before persisting additions. Classify restored evidence as context rather than new user authorization.
- Keep source-order labels stable across eviction and retain full delivery for legacy records without reliable provenance.
## Testing
Add coverage for consecutive-review deduplication, changed revisions, missing or incomplete metadata, and restoring compacted evidence exactly once. Extend compaction and resume coverage to verify retained revisions.
GitOrigin-RevId: e90fca16cde0a0970da36dd873af2ca1dbaaf4d3
## What changed
- Recognize `flex_unavailable` in HTTP 429 responses and streamed `error` and `response.failed` events. End normal turns without retries and report `Flex capacity unavailable.`
- Expose `flexUnavailable` through the core and app-server protocols and generated schemas and SDK types.
- Keep Flex capacity failures eligible for Guardian review and sampler retries, with a distinct telemetry classification.
- Map unexpected HTTP responses to `HttpConnectionFailed`, preserving their status codes.
## Testing
Add regression coverage for terminal Flex failures over HTTP, SSE, and WebSocket, HTTP 504 status preservation after a stream retry, and protocol serialization. Update Guardian retry and sampler recovery tests to cover Flex failures.
GitOrigin-RevId: f2e03a6d2d36a6d9748c35952e40397f8670d121
## Why
Editing recent conversation images failed when the selected images included a file reference from a message or tool output.
## What changed
Use `ImageReference` in `ImageEditRequest` to accept both `image_url` and `file_id` inputs. Pass file references from conversation history through to image edit requests while preserving image selection order.
## Testing
Update tests to cover file references from messages and tool outputs, and serialization of mixed inline and file references in image edit requests.
GitOrigin-RevId: 2764bf36a81a62ddd25cf9df27346a434a10c449
## Why
Dropping the last board handle releases its state but leaves a stale entry in
`InMemoryMessageBoards`, allowing registry entries to accumulate across sessions.
## What changed
Prune entries whose state has no remaining strong references whenever a board is
opened, while preserving shared state for live boards.
## Testing
Add a regression test that repeatedly opens and drops boards, checks that expired
entries are removed, and verifies that reopening a live board shares its state.
GitOrigin-RevId: c3f1c27b42ee17915f0ece01b85a22d0fdf632ce
## Why
Ephemeral sessions cannot use the SQLite-backed agent message board. An in-memory backend lets agents share discussions without creating durable board storage.
## What changed
- Add the opt-in `message_board_in_memory` setting to the multi-agent v2 configuration, allowing the board to run in ephemeral sessions when both required features are enabled.
- Share board state across agents in the same tree and release it when the last handle is dropped.
- Implement channels, posts, subscriptions, notifications, search, and paginated reads through the existing `AgentMessageBoard` interface, including request deduplication.
## Testing
Add coverage for shared handles, concurrent request deduplication, tree isolation, and state release. Run existing query and tool test cases against both backends, and extend the parent/child scenario to verify ephemeral board sharing without creating a board database.
GitOrigin-RevId: d0b2083f8ea5b1c5a3a70f258ef738b87ea74cef
## Why
Plugin identity and skill ownership need to be available independently of MCP data, including for plugins without servers or connectors. Hosted plugins have no executor root and should not own executor skills.
## What changed
- Add `McpServerContributor::selected_plugins` to declare executor plugin identities with deferred MCP data. Let the host assign server attribution and precedence across contributors.
- Represent hosted connectors with `HostedPluginConnectors` and make `SelectedPluginIdentity::selected_root_id` optional instead of assigning synthetic roots to hosted plugins.
- Resolve executor contributions before reading hosted connectors, and clear stale hosted state on account changes before executor loading can wait.
- Preserve connector declarations from disabled plugins so Apps can hide those connectors.
## Testing
Add coverage for account changes while executor loading is pending. Update tests to verify hosted identities have no executor root and disabled plugins hide their connectors even when plugin IDs differ from root IDs.
GitOrigin-RevId: e7f511264c5874c1b56d5f3e4a46820724046db0
jif