viyatb-oai 208f05b233 Enforce automatic review for managed models (#37511) ...

## What changed

- Add the managed `auto_review.required_on_models` requirement, unioning model slugs across requirement layers and exposing the result through `configRequirements/read`.
- Force listed models to use `on-request` approvals with the `auto_review` reviewer. Downgrade Full Access to workspace-write when starting a protected session, and reject incompatible runtime overrides or use when automatic review is disabled.
- Preserve these protections across thread starts, resumes, forks, model changes, turn overrides, MCP approvals, and TUI session attachment.

## Testing

- Add coverage for layered model requirements and exact provider-alias matching.
- Add app-server tests for protected thread lifecycle operations, unsafe setting overrides, legacy thread upgrades, disabled automatic review, and requirements API output.

GitOrigin-RevId: c4b1d52c3b5b75e86880725412b8f0812e0dfcd9

2026-08-07 23:43:14 +00:00

..

common

Allow injecting model catalog caches (#36992)

2026-08-04 23:04:11 +00:00

remote_env_windows

Scope runtime workspace roots to execution environments (#32952)

2026-07-14 04:41:08 +00:00

suite

Enforce automatic review for managed models (#37511)

2026-08-07 23:43:14 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

responses_headers.rs

Include sandbox mode in response metadata (#37507)

2026-08-07 22:41:20 +00:00