jamy-OAI b313cca1cf Enforce host-required cyber access programs per thread (#59754) ...

## What changed

- Expose `RequiredCyberAccessPrograms` so hosts can require an explicit allowed program on a thread. Snapshot the requirement before extension callbacks; hosts must reapply it on cold resume.
- Validate resolved `access_programs` before HTTP and WebSocket model requests, rejecting omitted or disallowed programs. Explicit `Standard` remains distinct from omission. Reject memory summarization and realtime requests when a requirement is present.
- Keep required programs scoped to the parent thread by preventing Guardian reviewers from inheriting its program, including Guardian v2 reviews.

## Testing

Add HTTP and WebSocket coverage for allowed programs, omission, disallowed programs, unsupported providers, and connection reuse. Extend Guardian tests to verify parent-only program scope and that removing the public attachment does not erase the startup snapshot.

GitOrigin-RevId: 9306a9af0e03e7a1728dfeb610cd7ec7517367fd

2026-11-05 22:49:46 +00:00

..

src

Enforce host-required cyber access programs per thread (#59754)

2026-11-05 22:49:46 +00:00

BUILD.bazel

Add codex-core public API listing (#20243)

2026-04-29 22:58:08 +00:00

Cargo.toml

Wire shared runtime authentication through threads and API clients (#59177)

2026-11-03 15:02:57 +00:00