Allow guardian bare allow output

[maja-openai]

Summary

Allow guardian to skip other fields and output only {"outcome":"allow"} when the command is low risk.
This change lets guardian reviews use a non-strict text format while keeping the JSON schema itself as plain user-visible schema data, so transport strictness is carried out-of-band instead of through a schema marker key.

What changed

• Add an explicit output_schema_strict flag to model prompts and pass it into codex-api text formatting.
• Set guardian reviewer prompts to non-strict schema validation while preserving strict-by-default behavior for normal callers.
• Update the guardian output contract so definitely-low-risk decisions may return only {"outcome":"allow"}.
• Treat bare allow responses as low-risk approvals in the guardian parser.
• Add tests and snapshots covering the non-strict guardian request and optional guardian output fields.

Verification

• cargo test -p codex-core guardian::tests::guardian
• cargo test -p codex-core guardian::tests::
• cargo test -p codex-core client_common::tests::
• cargo test -p codex-protocol user_input_serialization_includes_final_output_json_schema
• cargo test -p codex-api
• git diff --check

Note: cargo test -p codex-core was also attempted, but this desktop environment injects ambient config/proxy state that causes unrelated config/session tests expecting pristine defaults to fail.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a04b390dbf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Fail closed when guardian omits structured risk fields

The parser now accepts payloads where only outcome is present because risk_level and user_authorization are optional. That means malformed/partially formatted allow responses (e.g., missing or misspelled risk fields) are treated as valid approvals instead of parse failures, weakening the previous fail-closed behavior for malformed guardian output.

Useful? React with 👍 / 👎.

[sayan-oai]

not sure if this is a super big concern. if a field is misspelled or mangled, it changes the reported risk level, not the outcome.

[dylan-hurd-oai]

agree!