[fylorn]

Enterprise side of ThinkWatchProject/ThinkWatch-Core#368.

OpenAI Responses with store: false (how Codex always sends) hands the client encrypted state to send back every turn: reasoning, remote compactions, Codex sub-agent messages, encrypted tool output. Only the account that encrypted it can read it. A conversation that moved to another provider (affinity expiry, a tripped breaker, failover) was refused with invalid_encrypted_content on every turn from then on.

What changes

• The gateway remembers, per conversation (authenticated user + x-session-id, or the client's own session header such as Codex's session_id), the provider that last answered it: Redis, 30 days, independent of the affinity settings.
• A Responses request carrying encrypted content (tw_dialect::sealed) goes back to that provider:
  • more than reasoning encrypted: only that provider, no strategy pick, no failover, even with its breaker open; if it no longer has a route for the model, refused up front with SealedHistoryUnavailable (409);
  • only reasoning encrypted: that provider first, normal failover after it.
• An upstream refusing encrypted history (4xx, or an error event inside a 200 stream) becomes SealedHistoryRefused, which explains what happened and what to do, followed by the upstream's words. It no longer counts against the route.
• The request log detail records pinned_by: encrypted_history.

Before the next release

The core crates point at core main at the merge of ThinkWatchProject/ThinkWatch-Core#368 (rev, set on the dependency lines so core's CI can still append its [patch]). Replace with the next core tag before the next enterprise release.

Tests

crates/test-support/tests/gateway_sealed_history.rs (5 integration tests) plus one in gateway_responses_ws.rs; unit tests for the decision, narrowing, failure classification and refusal mapping. Full integration suite and workspace unit tests pass locally; fmt and clippy clean.

🤖 Generated with Claude Code