felixxia-oai b68acc4d4b Trust invoked user skills in Guardian reviews (#41006) ...

## Why

Guardian treated all skill instructions as untrusted, so it could not use the
invocation of a user-owned skill as authorization evidence.

## What changed

- Record explicit and implicit skill invocations through extension contributors.
- Send Guardian a bounded, deduplicated list of canonical skill paths only when
  they resolve under the user's Codex or `.agents` skill directories.
- Keep repository skills and symlinks that escape trusted roots untrusted, and
  send only verified paths rather than skill contents to the classifier.
- Avoid recording host skill prompts that were superseded by core skill
  injection.

## Testing

- Added unit coverage for trusted roots, symlink escapes, deduplication, and
  size limits.
- Added integration coverage showing that Guardian trusts invoked user skills
  while rejecting a forged repository skill.

GitOrigin-RevId: 1cc0be230f7e6649110201c23c3de8f26447ff36

2026-08-27 00:07:26 +00:00

..

common

Track window and fork positions in turn metadata (#40987)

2026-08-26 22:37:59 +00:00

suite

Trust invoked user skills in Guardian reviews (#41006)

2026-08-27 00:07:26 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00