Skip to content

fix: honor exact call approval decisions - #4447

Merged
seratch merged 1 commit into
mainfrom
fix/per-call-approval-overrides
Aug 15, 2026
Merged

seratch merged 1 commit into
mainfrom
fix/per-call-approval-overrides

Conversation

@seratch

@seratch seratch commented Aug 15, 2026 •

Copy link
Copy Markdown
Member

This pull request supersedes #4430 and fixes sticky approval defaults taking precedence over later exact per-call decisions. An exact decision now overrides the sticky default only for the matching call, while unrelated calls retain the sticky outcome. Reversing an exact decision also updates its effective status and rejection message consistently.

The change bumps the RunState schema from 1.15 to 1.16. This does not add a new serialized field; it changes the semantics of the existing approval record. For example, approved: true together with rejected: ["call-2"] now means that calls are approved by default except for call-2. Exact call-ID decisions are evaluated before sticky booleans.

New snapshots use schema 1.16 so older SDKs reject them instead of resuming with the previous precedence rule and potentially executing an explicitly rejected call. The current reader continues to accept older snapshots and preserves any explicit exact decisions they contain.

The schema 1.16 compatibility fixtures are reproduced from a schema 1.15 writer commit retained in repository history, with only the schema label canonicalized. The frozen payloads remain unchanged, and the provenance metadata records this distinction explicitly.

Fixes #4429.

@seratch seratch added this to the 0.21.x milestone Aug 15, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b7ec76c3a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@seratch
seratch force-pushed the fix/per-call-approval-overrides branch from b7ec76c to 109f633 Compare August 15, 2026 23:31
@seratch
seratch merged commit dde0bc9 into main Aug 15, 2026
14 checks passed
@seratch
seratch deleted the fix/per-call-approval-overrides branch August 15, 2026 23:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Rejecting a single call after always_approve is ignored, so the tool still runs

1 participant