[sentry-junior]

Each Guardian review reads the run evidence and the author-labeled thread. The evidence repeated the thread and carried the bulky parts of the run. This cuts it down to what Guardian uses to judge the action.

What Guardian reads now

	Before	After
User messages	In the thread section, and again in the evidence without authors	Once, in the thread section. The evidence keeps only messages that the thread section does not show, such as a message whose thread copy was truncated, or any message in a run with no thread section
Assistant text	In the evidence (up to the 10k-token message budget, shared with users)	Not in the evidence. Replies that people saw stay in the thread section as assistant: lines
Tool calls	Name and input	Unchanged, same order
Tool results	Body	A Not shown. marker that keeps the result's place in the order

RUN_RULES and the evidence line in the policy now say this. Dedupe happens when the prompt is rendered (guardianPrompt), so the evals go through it too. It matches on the message text after line-break normalization. A message that the two sides truncate differently is not deduped. It is sent twice, as it was before.

data_exposure and SCRIPT_RULES judge the data in the proposed input and the earlier calls' inputs and status. Neither needs result bodies. A read of a private source followed by a public write still shows up as two calls in order.

Policy changes

• withheld_step: a condition on the agent's own work, such as tests that pass, is the agent's to check.
• In a Watch that maintains a pull request, answering a reviewer's question in its thread is part of the work.

Size on the guardian eval fixtures (105 cases)

• Evidence section: 52,963 → 16,010 characters (−70%)
• Whole user prompt: 469,735 → 437,544 characters, about 117k → 109k tokens at 4 chars/token (−6.9%)
• System policy: 13,222 → 13,626 characters, because of the policy changes. With it, the total per call is about the same (+0.6%).

The fixtures already shorten tool output and assistant messages, so these numbers understate the savings in production.

The eval helper still records a full transcript for each case. It builds the thread section from the transcript, then projects the evidence the way core builds it. No case input or expected decision changed.

Prior art

• Claude Code auto mode: the classifier sees only user messages and tool calls. Assistant text is removed so the agent can't argue its case, and tool results are removed as the main prompt-injection defense. Anthropic says this costs some provenance ("the classifier can't tell whether the agent pulled it from a query or fabricated it"). In their tests, adding assistant messages and tool results made results worse.
• Codex Guardian reads a compact transcript, and its evidence selection is the base of buildToolActionEvidence.

Not changed

• Prompt-prefix caching. The system policy, the preamble, and RUN_RULES already come before the random section key. Only SCRIPT_RULES comes after it. Keeping the key the same for a whole run would weaken the section, so I left it alone.
• Proposal size limits and read-only review are handled in separate PRs.

Open decision

Guardian no longer sees result bodies, so it can't see where some data came from, such as the number of a PR that the agent created. Should we accept that? If not, the fallback is to show a short head of each result.

via @dcramer.

--

View Session [Sentry]

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
junior-docs	Ready	Preview	Nov 13, 2026 5:24am UTC

[github-actions]

11 screenshot changes — 11 changed · 0 added · 0 removed

Review screenshots in Frameshift

Conversation Captured Memories Popover · Desktop Changed	Conversation Child Agents · Desktop Changed	Conversation Details Watched Linked Work · Desktop Changed
Conversation Event Log Virtual · Desktop Changed	Conversation Event Log Virtual · Mobile Changed	Conversation Long Transcript Touch · Mobile Changed

Show 5 more changed screenshots

Conversation Share Details · Desktop Changed	Conversation Task Line · Desktop Changed	Memories · Mobile Changed
Review Desk Item · Mobile Changed	Settings Mcp · Desktop Changed