felixxia-oai 86cfa90536 Revalidate Guardian denials when parent authorization changes (#59225) ...

## Why

Parent input can change authorization while a Guardian assessment is in flight. A denial based on stale context must be retried, just as an approval is, so newly granted authorization can take effect.

## What changed

Revalidate both verdicts before publishing reviewer checkpoints or recording failed-review records. Discard invalidated assessments so they do not persist in reviewer history or count toward the denial limit.

## Testing

Extend authorization-refresh regression coverage for approval arriving during a denial and repeated stale denials. Verify refreshed reviews omit invalidated assessments and stale denials produce neither denial-limit errors nor failed-review records.

GitOrigin-RevId: c699178bc3b5e2d8b075279b00967a4e09fc533c

2026-11-03 21:00:31 +00:00

..

common

Wire shared runtime authentication through threads and API clients (#59177)

2026-11-03 15:02:57 +00:00

remote_env_windows

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

suite

Revalidate Guardian denials when parent authorization changes (#59225)

2026-11-03 21:00:31 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

code_mode_tracing.rs

Add code-mode output truncation protocol contracts (#57272)

2026-10-26 21:36:35 +00:00

mcp_trace_propagation.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

responses_headers.rs

Wire shared runtime authentication through threads and API clients (#59177)

2026-11-03 15:02:57 +00:00

windows_sandbox.rs

Move Windows sandbox tests into a dedicated integration binary (#51678)

2026-10-07 12:47:04 +00:00