## What changed
- Allow `features.guardianv2` to remain a boolean toggle or specify classifier instructions, the review threshold, reasoning effort, and action and instruction token limits.
- Add transcript controls for included sources, per-entry and total token budgets, and the number of recent non-user entries.
- Validate configured ranges and relationships, expose them in the generated config schema, and apply the resolved settings throughout Guardian v2 classification and approval review.
## Testing
- Cover boolean compatibility, configuration parsing and boundaries, config-manager rejection, and the resulting classifier request and approval decision.
GitOrigin-RevId: dc018b53b782e2d6b4d6a795cca4945130a71678
## Why
Guardian V2 needs the requested action and its conversation context to assess
risk; a tool name and call ID alone do not describe what the tool will do.
## What changed
- Expose the original, pre-hook `ToolPayload` to tool lifecycle contributors.
- Build Guardian V2 classifier input from the bounded conversation transcript
and a structured planned-action object containing the tool name and arguments.
- Warn and skip classification if the planned action cannot be serialized.
## Testing
- Verify lifecycle contributors receive tool arguments.
- Verify Guardian V2 sends transcript history and planned-action JSON to the
classifier.
GitOrigin-RevId: 28266ef7c1d2267ba705fcfbd9be4ef48e64e104
## What changed
- Add a configurable renderer that converts conversation messages, agent
messages, tool calls and outputs, and reasoning into a numbered plaintext
transcript.
- Keep only relevant readable content, including manual-approval developer
messages, while omitting media payloads, encrypted content, and unsupported
response items.
- Limit transcripts to the most recent 320 KiB without splitting UTF-8
characters.
## Testing
- Cover source selection, content filtering, tool-name correlation, and bounded
UTF-8 truncation with unit tests.
GitOrigin-RevId: e2c6535f4a895862ca744258399fb36fc92e42c6
## What changed
- Register a tool lifecycle contributor when Guardian V2 is installed.
- On tool start, asynchronously ask the existing Luna sampler for a low-effort
`action_risk` score constrained to the range from `0.0` to `1.0`.
- Bound the tool metadata supplied to the classifier and treat it as untrusted
input.
- Emit an extension warning if classification sampling fails.
## Testing
Add an integration test that verifies the contributor reuses the configured
Luna pool and sends the expected model, attribution metadata, reasoning effort,
strict output schema, and tool-call context.
GitOrigin-RevId: 6b69fcc0443086544086849c38bcdd90560a291f
## What changed
- Add a `LunaSampler` that opens an authenticated Responses WebSocket and reuses it for structured, tool-free `gpt-5.6-luna` requests.
- Carry the host's provider, authentication, proxy, attribution, and service-tier configuration into the connection and requests.
- Require strict JSON schemas, preserve per-request reasoning effort and turn metadata, and reject missing or oversized output.
## Testing
- Add a WebSocket test covering authentication and attribution headers, connection reuse, structured request fields, per-turn metadata, reasoning effort, and returned output.
GitOrigin-RevId: aef85fd8ddcfcb7c76a9ede0d3191e3a0321656b
## What changed
- Add the `codex-guardian-v2` crate with an extension install entry point that does not register contributors yet.
- Register the crate in the Cargo workspace and add its Bazel target.
GitOrigin-RevId: 7c0c9479c6722d65f0f0dad9b0fd4a756e4649b3
felixxia-oai