## Summary
- add docs/architecture/security-model.md as the canonical Codex
Security threat model
- keep SECURITY.md focused on coordinated disclosure and point it to the
canonical model
- clarify repository-code authority while preserving runtime parser,
webhook, metadata, and CI/release boundaries

## Validation
- verified 98 source citations resolve to existing files and valid lines
- resolved SECURITY.md policy chain for
docs/architecture/security-model.md
- git diff --check
- ./scripts/lint (blocked before linting by the preexisting base-state
uv.lock needing update under --locked)

## Summary

Add GPT-6 Astra support, Responses WebSocket steering, safety alert
retrieval, safety webhooks, and expanded safety metadata. This changes
the public ResponsesClientEvent models from response-creation classes
into discriminated unions, requiring users who instantiate those classes
to use ResponseCreate instead.

## Changes

- Add `gpt-6-astra` to supported chat and Responses model literals.
- Add synchronous and asynchronous safety alert retrieval through
client.safety.alerts, including raw and streamed response access and the
SafetyAlert type.
- Add project and organization safety alert webhook event types and
include them in webhook unwrapping.
- Add response.steer WebSocket methods for stable and beta Responses
clients, with text, image, and file input support.
- Add steering client and server event types for accepted, pending, and
failed states, including pending reasons, required input, and error
codes.
- Change ResponsesClientEvent and BetaResponsesClientEvent from
response-creation model classes to discriminated unions covering
response creation and steering; expose the original creation payloads as
ResponseCreate and BetaResponseCreate while retaining aliases for
existing helper types.
- Extend response lifecycle, tool definition, and tool-call types with
steering-related metadata and optional asynchronous tool execution
support.
- Add optional misalignment details and continuation guidance to shared,
Responses WebSocket, and video error models.

Co-authored-by: apcha-oai <228803254+apcha-oai@users.noreply.github.com>

Automated Release PR
---


##
[3.8.0](v3.7.0...v3.8.0)
(2026-09-03)


### Features

* **api:** add gpt-6-astra and related features
([#3791](#3791))
([09f446f](09f446f))


### Documentation

* add canonical SDK security model
([#3778](#3778))
([2a097b9](2a097b9))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: openai-sdks[bot] <284451331+openai-sdks[bot]@users.noreply.github.com>