Skip to content

Harden Guardian reviews after context compaction - #42852

Merged
copyberry[bot] merged 1 commit into
mainfrom
copyberry/codex-internal-to-codex-oss/f30d837197e0d838e656a632109f490c38208f5e
Sep 4, 2026
Merged

Harden Guardian reviews after context compaction#42852
copyberry[bot] merged 1 commit into
mainfrom
copyberry/codex-internal-to-codex-oss/f30d837197e0d838e656a632109f490c38208f5e

Conversation

@copyberry

@copyberry copyberry Bot commented Sep 4, 2026

Copy link
Copy Markdown

Harden Guardian reviews after context compaction

Why

Guardian reviews must not lose user authorization constraints or reuse an
unreadable or incompatible parent checkpoint after compaction.

What changed

  • Retain bounded excerpts of oversized root user messages across compaction,
    resume, and rollback, and recover excerpts from legacy Guardian history when
    available.
  • Require thread-owned Guardian review sessions and asynchronous scoring to
    reuse only non-empty checkpoints produced by a compatible review model.
  • Fail closed instead of reviewing without the required checkpoint when reuse
    is disabled, compatibility is unknown, or checkpoint content is unusable.

Testing

Expanded retained-context, review-session, asynchronous-scoring, and app-server
coverage for oversized instructions, legacy recovery, model incompatibility,
missing content, resume, rollback, and disabled checkpoint reuse.

## Why

Guardian reviews must not lose user authorization constraints or reuse an
unreadable or incompatible parent checkpoint after compaction.

## What changed

- Retain bounded excerpts of oversized root user messages across compaction,
  resume, and rollback, and recover excerpts from legacy Guardian history when
  available.
- Require thread-owned Guardian review sessions and asynchronous scoring to
  reuse only non-empty checkpoints produced by a compatible review model.
- Fail closed instead of reviewing without the required checkpoint when reuse
  is disabled, compatibility is unknown, or checkpoint content is unusable.

## Testing

Expanded retained-context, review-session, asynchronous-scoring, and app-server
coverage for oversized instructions, legacy recovery, model incompatibility,
missing content, resume, rollback, and disabled checkpoint reuse.

GitOrigin-RevId: f30d837197e0d838e656a632109f490c38208f5e
@copyberry
copyberry Bot force-pushed the copyberry/codex-internal-to-codex-oss/f30d837197e0d838e656a632109f490c38208f5e branch from cf35d08 to 4636819 Compare September 4, 2026 21:08
@copyberry
copyberry Bot merged commit 4636819 into main Sep 4, 2026
26 of 32 checks passed
@copyberry
copyberry Bot deleted the copyberry/codex-internal-to-codex-oss/f30d837197e0d838e656a632109f490c38208f5e branch September 4, 2026 21:09
@github-actions github-actions Bot locked and limited conversation to collaborators Sep 4, 2026
@MoonOMT
MoonOMT deployed to issue-triage September 4, 2026 21:19 — with GitHub Actions Active
@MoonOMT
MoonOMT deployed to issue-triage September 4, 2026 21:19 — with GitHub Actions Active
@MoonOMT
MoonOMT deployed to issue-triage September 4, 2026 21:19 — with GitHub Actions Active
@MoonOMT
MoonOMT deployed to issue-triage September 4, 2026 21:20 — with GitHub Actions Active
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants