## What changed
- Track the latest tool call and latest scored tool call for each Guardian v2 thread.
- Skip approval review when the score lags by more than `max_tool_call_lag` tool calls.
- Add `max_tool_call_lag` to the Guardian v2 configuration and schema, with a default of three.
## Testing
- Cover approval review at, above, and after recovering from the configured lag limit.
- Cover deserialization of `max_tool_call_lag`.
GitOrigin-RevId: fd870e143d95ee76491180e2aed742717248ff78
## What changed
- Add optional `guardian_v2` model-message defaults for classifier instructions,
review thresholds, reasoning effort, transcript selection and limits, and
action and compaction token limits.
- Apply those defaults when Guardian v2 samples a tool call, while preserving
explicit `[features.guardianv2]` settings over catalog values.
- Preserve the new catalog configuration when applying model overrides.
## Testing
- Cover model-catalog serialization and model override behavior.
- Verify that sampling uses catalog defaults while retaining local overrides.
GitOrigin-RevId: 4ae9ec235c647acbca05a20b7c4b87a4e1331161
## What changed
- Add the `features.guardianv2.transcript.include_images` opt-in setting.
- Include recent images from user and assistant messages and configured tool outputs in Guardian v2 sampling requests.
- Bound image context to the four most recent images and 8 MiB total, and omit image detail hints when constructing the sampling request.
## Testing
- Cover configuration parsing and image forwarding from messages and tool outputs.
GitOrigin-RevId: b0ae6b6182535fd084ea103ed01dc3c803d7d1f7
## What changed
- Add `max_parent_compaction_tokens`, defaulting to 25,000 tokens, to the Guardian v2 feature configuration.
- Reuse the latest encrypted parent compaction only when its complete serialized item fits within the configured limit.
- Fail closed with the maximum action-risk score when the latest encrypted compaction is oversized, instead of sampling with older context.
## Testing
- Cover exact-boundary and oversized compaction items, including oversized passthrough metadata.
- Verify that an oversized latest compaction bypasses sampling and prevents approval.
GitOrigin-RevId: 0b308e7bec0f41d46433dfdf656948cee5cba667
## What changed
- Allow `features.guardianv2` to remain a boolean toggle or specify classifier instructions, the review threshold, reasoning effort, and action and instruction token limits.
- Add transcript controls for included sources, per-entry and total token budgets, and the number of recent non-user entries.
- Validate configured ranges and relationships, expose them in the generated config schema, and apply the resolved settings throughout Guardian v2 classification and approval review.
## Testing
- Cover boolean compatibility, configuration parsing and boundaries, config-manager rejection, and the resulting classifier request and approval decision.
GitOrigin-RevId: dc018b53b782e2d6b4d6a795cca4945130a71678
## What changed
- Include the resolved Guardian security policy in the v2 classifier's developer instructions.
- Prefer an explicit `guardian_policy_config`, then the reviewer model's catalog policy, and finally the bundled policy.
- Limit the combined classifier instructions and policy to 10,000 tokens.
## Testing
- Cover configured and catalog policies, policy truncation, and the bundled-policy fallback.
GitOrigin-RevId: 1b84d70081dd924e214636b4b470d57a63d7cb88
## What changed
- Give approval review contributors the first opportunity to resolve an action when automatic review is not required for the model.
- Return an extension's decision directly and fall back to Guardian when no extension claims the review.
- Update Guardian V2 to approve actions below its risk threshold through the review contributor API, and remove the extension approval-policy API.
## Testing
- Verify that an extension approval bypasses both the Guardian model call and the user approval prompt.
- Cover Guardian V2 review decisions for low-risk, high-risk, and disabled threads.
GitOrigin-RevId: 5be56941143aff6f358b75b5f8101b7c047147ae
## Why
Oversized tool arguments could make Guardian V2's model-visible action unbounded.
## What changed
- Cap serialized actions at 10,000 tokens while preserving the trusted tool name and `call_id`.
- Truncate nested string values evenly across the available budget.
- Omit lower-priority fields when the JSON structure alone exceeds the limit, while retaining useful action fields when they fit.
## Testing
Add coverage for oversized nested strings, arrays, and object keys, including spoofed identity fields and omission-marker collisions.
GitOrigin-RevId: 13f7dc93da3761db18a34087225196318a3b8098
## Why
Concurrent Guardian samples can finish out of order, allowing an older sample to
replace the thread's newer in-memory security risk score.
## What changed
- Record when each `SecurityRiskScore` sample starts while preserving compatibility
with records that have no timestamp.
- Add `ExtensionData::insert_if` so checking and replacing a typed attachment happen
under the same lock.
- Update Guardian V2 to replace the thread's risk score only when the completed sample
is newer than the stored one.
## Testing
- Verify concurrent conditional inserts retain the newest value.
- Verify Guardian-generated risk scores include a sampling timestamp.
GitOrigin-RevId: 6543a4e5497da4c623331050789e91613f931c4b
## What changed
- Add a thread-scoped extension API for requesting automatic review, resolving
multiple contributors to the strongest requirement.
- Have Guardian v2 request automatic review when it is enabled and the latest
`action_risk` score is at least `0.8`.
- Honor extension review requirements across tool approvals, MCP elicitation,
and remote execution while preserving host configuration and managed-policy
constraints.
## Testing
- Cover contributor registration and requirement resolution.
- Verify Guardian v2 requests review at the threshold, returns to the default
below it, and does not affect threads where the extension is disabled.
- Exercise extension-requested strict review with a remote model override.
GitOrigin-RevId: 6329fc23585d5cc7173c39bb9952c3109ec3884b
## What changed
- Replace the single `category` and `score` fields in `SecurityRiskScore` with a
deterministic map of category names to scores.
- Validate the full Guardian V2 classifier response before storing it as one
thread extension value and, for non-ephemeral threads, one rollout item.
- Cover serialization and rollout loading with snapshots containing multiple
score categories.
GitOrigin-RevId: 24525de691f96bd34ccfe04acab2f01aca309837
## Why
Guardian V2 classification requests should retain compacted conversation context only when the parent and classifier model configurations can share the encrypted compaction.
## What changed
- Resolve the classifier model's compaction compatibility hash when initializing its sampler.
- Add the latest encrypted parent compaction to classification input when both models have the same non-empty compatibility hash.
- Ignore missing, empty, or unidentified compactions, and omit parent context when compatibility cannot be established.
## Testing
- Cover latest-compaction selection and invalid compaction data.
- Cover matching, mismatched, missing, empty, and changed compatibility hashes.
GitOrigin-RevId: f0fcb09fd028cd2f397fdbc3d541b4bc464b0beb
## What changed
- Replace the single byte limit with token-derived per-entry and separate message and tool transcript budgets.
- Preserve the first and latest user messages, then fill the remaining budgets with recent user, assistant, and tool context while limiting retained non-user entries.
- Truncate oversized entries in the middle without splitting UTF-8 characters, and report the approximate omitted token count.
- Exclude reasoning from the default transcript sources while retaining support when it is explicitly configured.
## Testing
- Cover oversized message and tool-result truncation, user-message retention, separate tool budgeting, configured reasoning, and the resulting Guardian sampling request.
GitOrigin-RevId: aaeaa5fb5d902b5a1581a8a819bf34724bde794b
## What changed
- Represent Guardian sampling input as an ordered list of text entries.
- Send each transcript entry and approval-request delimiter as a separate input
content item while preserving the existing transcript byte limit.
## Testing
- Update transcript and sampler tests to verify entry boundaries, multi-item
request serialization, and bounded transcript behavior.
GitOrigin-RevId: 433e2e6ca18ce9288025715f5956295bfe852e98
## What changed
- Register Guardian V2 for thread startup as well as tool-call lifecycle events.
- When `guardianv2` is enabled, create and store a thread-local Luna sampler using the thread's model provider, authentication policy, session metadata, originator, and service tier.
- Emit a warning if sampler initialization fails, and skip tool classification when the thread has no sampler.
## Testing
- Update the extension test to enable `guardianv2`, run thread startup, and verify tool-call sampling through the initialized connection.
GitOrigin-RevId: 5ab732e85c9827495c67f57117eb5be450a7f90e
## What changed
- Parse and validate the structured risk scores returned for each classified tool call.
- Publish each score through thread extension data and persist it in rollout history for non-ephemeral threads.
- Report parsing, thread lookup, validation, and persistence failures through the extension warning sink.
## Testing
- Extend the Guardian V2 tool-classification test to verify that the sampled `action_risk` score is available from thread extension data and written to rollout history.
GitOrigin-RevId: 46614fe0d686736dfb1f09398c6fcd848c7d8b2c
## What changed
- Opt Guardian V2 Luna sampler WebSocket connections into responses lite.
- Send `reasoning.context` as `all_turns` on sampling requests.
## Testing
- Extend sampler and extension tests to verify the connection header and reasoning context.
GitOrigin-RevId: 4b0263c01b8259ed5268c222dcf7559912baba8c
## Why
Guardian V2 needs the requested action and its conversation context to assess
risk; a tool name and call ID alone do not describe what the tool will do.
## What changed
- Expose the original, pre-hook `ToolPayload` to tool lifecycle contributors.
- Build Guardian V2 classifier input from the bounded conversation transcript
and a structured planned-action object containing the tool name and arguments.
- Warn and skip classification if the planned action cannot be serialized.
## Testing
- Verify lifecycle contributors receive tool arguments.
- Verify Guardian V2 sends transcript history and planned-action JSON to the
classifier.
GitOrigin-RevId: 28266ef7c1d2267ba705fcfbd9be4ef48e64e104
## What changed
- Register a tool lifecycle contributor when Guardian V2 is installed.
- On tool start, asynchronously ask the existing Luna sampler for a low-effort
`action_risk` score constrained to the range from `0.0` to `1.0`.
- Bound the tool metadata supplied to the classifier and treat it as untrusted
input.
- Emit an extension warning if classification sampling fails.
## Testing
Add an integration test that verifies the contributor reuses the configured
Luna pool and sends the expected model, attribution metadata, reasoning effort,
strict output schema, and tool-call context.
GitOrigin-RevId: 6b69fcc0443086544086849c38bcdd90560a291f
jif