felixxia-oai 5b85aea979 Keep Guardian review evidence consistent and reject stale approvals (#43442) ...

## Why

Concurrent parent compaction can remove evidence between Guardian checkpoint selection and prompt construction. New user instructions or answers received during a review can also invalidate an approval based on earlier authorization.

## What changed

- With `GuardianThreadContext` enabled, use the same parent history snapshot for checkpoint selection and prompt evidence.
- Cancel completed allow decisions if the owning session's user-message revision or root authorization version changed during the review, even without cacheable review evidence.

## Testing

Add regression coverage for evidence preservation during concurrent compaction and aborted approvals after new user instructions or verified answers. Extend reviewer context rollover coverage to exercise `GuardianThreadContext`.

GitOrigin-RevId: 1c2c82197a27c0d3d45b6fe08d200a835d80cc30

2026-09-07 11:51:20 +00:00

..

common

Avoid WebSocket connection waits in Guardian v2 classification (#43408)

2026-09-07 09:24:03 +00:00

fixtures

Organize bundled Rust resources under asset directories (#41477)

2026-08-29 06:05:28 +00:00

remote_env_windows

Apply remote platform semantics to exec safety checks (#42113)

2026-09-01 18:24:56 +00:00

suite

Keep Guardian review evidence consistent and reject stale approvals (#43442)

2026-09-07 11:51:20 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

responses_headers.rs

Sanitize credentials from Git remote metadata (#40713)

2026-08-25 21:34:05 +00:00