feat(api): expand Live Decision item and question types (#4175)

## Summary

Support more message, tool call, and question input types in Live
Decisions.

## Changes

- Accept user, developer, system, and assistant messages in Live
Decision items.
- Add function and custom tool call and output types.
- Allow strings or structured instruction parts in Live Decision
questions.

Co-authored-by: dpiet-oai <326640584+dpiet-oai@users.noreply.github.com>

Author: dpiet-oai

.castiron.stats.yml

@@ -1,8 +1,8 @@
 schema_version: 1
-generation_id: c6c71409-c9d1-487b-ad35-c8973d3274a6
-openapi_spec_hash: 23f0bfa58ad53fef090bea6a72a05dda
-openapi_transformed_spec_hash: 39f2336a30336863627b56624b390f24
-config_hash: 249b5f41fe1b916955299cea75cddfbf
-codegen_sha: 73e15aa409d55f8731c775cab5a85c9e93d66b3c
-codegen_hash: 166545ad5fafe31085bb865842a68c605eea009ccfec4e4247b851e46d7c34fb
-public_codegen_sha: 74fb1f948524997714d02fb52f387e0ab93ce338
+generation_id: a5a7ff8f-541f-4e46-88c8-51581e690980
+openapi_spec_hash: fb762e4e737fb2210a01948c7cf70c31
+openapi_transformed_spec_hash: 60911088041eda7d04c1a205c2f337a9
+config_hash: d356dda7ff9ca3fbc614107eb546de9f
+codegen_sha: 29ea9cdfc0d23a284e49573298b06f55482ce078
+codegen_hash: 4ff0d4017ca05d7692d4bcdc2e471f62bcb681f9e920035d5b7b42e612c37d74
+public_codegen_sha: 9b7555d4163e7448417845732af4bb31f0f51fa7

.github/workflows/castiron-custom-code-comment.yml

@@ -29,13 +29,6 @@ jobs:
       pull-requests: read
       statuses: write
     steps:
-      # Execute only the helper belonging to this immutable workflow revision.
-      - name: Check out the trusted review policy
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.workflow_sha }}
-          persist-credentials: false
-
       - name: Re-evaluate current PR and queue after review changes
         env:
           GH_TOKEN: ${{ github.token }}
@@ -70,12 +63,26 @@ jobs:
               return sha;
             }
             async function requiresHuman(pr, mainSha) {
+              if (!/^[0-9a-f]{40}$/.test(mainSha || '')) throw new Error('Invalid authenticated main');
               const path = require('node:path');
               const fs = require('node:fs');
               const root = fs.mkdtempSync(path.join(process.env.RUNNER_TEMP, 'castiron-review-'));
               try {
+                // Bind executable policy and its dependency to the authenticated
+                // main snapshot for this decision, including after a retry.
+                for (const name of ['custom_code_policy.py', 'custom_code_report.py']) {
+                  const {data: file} = await github.rest.repos.getContent({
+                    ...context.repo, path: `scripts/castiron/${name}`, ref: mainSha,
+                  });
+                  if (file.type !== 'file' || file.encoding !== 'base64' ||
+                      !Number.isSafeInteger(file.size) || file.size <= 0 || file.size > 1048576 ||
+                      typeof file.content !== 'string') throw new Error('Invalid trusted policy file');
+                  const content = Buffer.from(file.content, 'base64');
+                  if (content.length !== file.size) throw new Error('Invalid trusted policy content');
+                  fs.writeFileSync(path.join(root, name), content, {flag: 'wx'});
+                }
                 const result = await exec.getExecOutput('python3', ['-I',
-                  'scripts/castiron/custom_code_policy.py', 'review-required',
+                  path.join(root, 'custom_code_policy.py'), 'review-required',
                   '--repository', repo, '--repo', path.join(root, 'objects.git'),
                   '--base', pr.base.sha, '--head', pr.head.sha, '--main', mainSha], {silent: true});
                 const decision = JSON.parse(result.stdout);

api.md

@@ -1125,12 +1125,6 @@ Methods:
 - <code title="get /chatkit/threads">client.beta.chatkit.threads.<a href="./src/openai/resources/beta/chatkit/threads.py">list</a>(\*\*<a href="src/openai/types/beta/chatkit/thread_list_params.py">params</a>) -> <a href="./src/openai/types/beta/chatkit/chatkit_thread.py">SyncConversationCursorPage[ChatKitThread]</a></code>
 - <code title="delete /chatkit/threads/{thread_id}">client.beta.chatkit.threads.<a href="./src/openai/resources/beta/chatkit/threads.py">delete</a>(thread_id) -> <a href="./src/openai/types/beta/chatkit/thread_delete_response.py">ThreadDeleteResponse</a></code>
 - <code title="get /chatkit/threads/{thread_id}/items">client.beta.chatkit.threads.<a href="./src/openai/resources/beta/chatkit/threads.py">list_items</a>(thread_id, \*\*<a href="src/openai/types/beta/chatkit/thread_list_items_params.py">params</a>) -> SyncConversationCursorPage[Data]</code>
-<a id="sessions-2"></a>
-
-<a id="transcriptionsessions"></a>
-
-
-## [Realtime](docs/beta-realtime-api.md)
 
 ## Assistants