exec-server: add Noise relay transport by viyatb-oai · Pull Request #26242 · openai/codex

viyatb-oai · 2026-06-03T20:24:24Z

Why

Rendezvous forwards traffic between the orchestrator and exec-server. The endpoints need to authenticate each other and encrypt that traffic without trusting Rendezvous with plaintext or endpoint keys.

Changes

Adds a hybrid Noise IK channel through Clatter using X25519, ML-KEM-768, AES-256-GCM, and SHA-256.
Binds each handshake to environment_id, executor_registration_id, and stream_id.
Pins the registry-provided executor key and carries the harness authorization inside the encrypted handshake.
Orders relay frames before consuming Noise nonces and fragments large JSON-RPC messages into bounded records.
Bounds handshake payloads, frames, streams, and message reassembly.

Runtime activation is in openai/codex#26245.

Stack

openai/codex#26242: Noise channel and relay transport
openai/codex#26245: remote registration and runtime activation

Verification

just test -p codex-exec-server
Oversized initiator payload regression coverage
just fix -p codex-exec-server
just bazel-lock-check
cargo shear

Co-authored-by: Codex noreply@openai.com

Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex noreply@openai.com

Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex noreply@openai.com

…b/noise-relay-state

Co-authored-by: Codex noreply@openai.com

…b/noise-relay-state

Co-authored-by: Codex noreply@openai.com

…b/noise-relay-state # Conflicts: # codex-rs/exec-server/src/noise_channel.rs

Co-authored-by: Codex noreply@openai.com

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai · 2026-06-12T18:03:03Z

@codex review

chatgpt-codex-connector · 2026-06-12T18:05:49Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: a1e295805a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…lay-state

Co-authored-by: Codex noreply@openai.com

viyatb-oai force-pushed the codex/viyatb/noise-relay-wire branch from ec4dff7 to d06fd3c Compare June 3, 2026 20:45

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch 2 times, most recently from 0d9f9a0 to f7c6737 Compare June 4, 2026 00:41

viyatb-oai force-pushed the codex/viyatb/noise-relay-wire branch from d06fd3c to d293187 Compare June 4, 2026 00:41

viyatb-oai mentioned this pull request Jun 4, 2026

exec-server: Noise remote opt-in #26273

Closed

viyatb-oai changed the title ~~exec-server: Noise relay state~~ exec-server: Noise relay transport Jun 4, 2026

jmillican-oai reviewed Jun 4, 2026

View reviewed changes

Comment thread codex-rs/exec-server/src/noise_channel.rs

viyatb-oai added 2 commits June 9, 2026 15:17

feat: add Noise channel foundation

df0bd43

Co-authored-by: Codex noreply@openai.com

refactor: keep Noise foundation independently usable

fd62a24

Co-authored-by: Codex noreply@openai.com

viyatb-oai force-pushed the codex/viyatb/noise-relay-wire branch from d293187 to a7ef55a Compare June 9, 2026 22:21

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from f7c6737 to 491c3a6 Compare June 9, 2026 22:21

fix: use BLAKE3 intrinsics for Windows Bazel

1ec9593

Co-authored-by: Codex noreply@openai.com

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from 491c3a6 to 2488836 Compare June 9, 2026 23:20

viyatb-oai force-pushed the codex/viyatb/noise-relay-wire branch from a7ef55a to 657fe01 Compare June 9, 2026 23:20

viyatb-oai changed the title ~~exec-server: Noise relay transport~~ exec-server: add Noise relay transport Jun 10, 2026

viyatb-oai changed the base branch from codex/viyatb/noise-relay-wire to codex/viyatb/noise-channel-foundation June 10, 2026 09:04

refactor(exec-server): validate Noise keys at use

29b362f

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from fa5ddce to e9ec60c Compare June 10, 2026 16:35

fix(exec-server): keep Noise foundation self-contained

5bd2787

Co-authored-by: Codex noreply@openai.com

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from e9ec60c to 1c45005 Compare June 10, 2026 16:47

fix(exec-server): retain Clatter byte array trait

3088d8f

Co-authored-by: Codex noreply@openai.com

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from 1c45005 to 592f3d2 Compare June 10, 2026 16:51

viyatb-oai and others added 2 commits June 11, 2026 19:52

refactor: group Noise harness connection arguments

9803566

Co-authored-by: Codex noreply@openai.com

chore(exec-server): finish Noise dependency update

bbd64c3

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from 2dc2270 to bbd64c3 Compare June 12, 2026 02:57

viyatb-oai changed the base branch from codex/viyatb/noise-channel-foundation to main June 12, 2026 02:57

viyatb-oai and others added 2 commits June 11, 2026 20:16

refactor(exec-server): preserve transport naming

63376d6

Co-authored-by: Codex <noreply@openai.com>

docs(exec-server): clarify plain transport naming

faf5a6e

Co-authored-by: Codex noreply@openai.com

github-actions Bot mentioned this pull request Jun 12, 2026

📊 AI CLI 工具社区动态日报 2026-06-12 jasonalang/big_model_radar#76

Open

viyatb-oai and others added 12 commits June 11, 2026 21:05

chore: merge main into Noise relay

9bd7e9e

Co-authored-by: Codex noreply@openai.com

refactor(exec-server): defer nonce state to Clatter

fb051b7

Co-authored-by: Codex noreply@openai.com

Merge branch 'codex/viyatb/noise-channel-foundation' into codex/viyat…

56c4fbe

…b/noise-relay-state

refactor(exec-server): simplify Noise reconnect state

0fa9f53

Co-authored-by: Codex noreply@openai.com

refactor(exec-server): trim Noise identity surface

2e43748

Co-authored-by: Codex noreply@openai.com

Merge branch 'codex/viyatb/noise-channel-foundation' into codex/viyat…

3a42371

…b/noise-relay-state

refactor(exec-server): inline Noise public key construction

0ec082d

Co-authored-by: Codex noreply@openai.com

Merge branch 'codex/viyatb/noise-channel-foundation' into codex/viyat…

ddb682f

…b/noise-relay-state # Conflicts: # codex-rs/exec-server/src/noise_channel.rs

refactor(exec-server): trim Noise relay plumbing

eb10e5c

Co-authored-by: Codex noreply@openai.com

refactor(exec-server): simplify noise integration

6c6ea8d

Co-authored-by: Codex noreply@openai.com

fix(exec-server): preserve rendezvous connection API

75858fb

Co-authored-by: Codex noreply@openai.com

fix(exec-server): bound Noise handshake payload

a1e2958

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai marked this pull request as ready for review June 12, 2026 17:43

viyatb-oai requested a review from apanasenko-oai June 12, 2026 17:43

apanasenko-oai approved these changes Jun 15, 2026

View reviewed changes

Comment thread codex-rs/exec-server/src/noise_relay/harness.rs Outdated

Comment thread codex-rs/exec-server/src/noise_relay/harness.rs

Comment thread codex-rs/exec-server/src/noise_relay/harness.rs Outdated

Comment thread codex-rs/exec-server/src/noise_relay/harness.rs

viyatb-oai added 3 commits June 15, 2026 13:32

Merge remote-tracking branch 'origin/main' into codex/viyatb/noise-re…

19b5169

…lay-state

fix(exec-server): log Noise relay write failures

60d0968

Co-authored-by: Codex noreply@openai.com

fix(exec-server): clarify Noise relay diagnostics

d887e21

Co-authored-by: Codex noreply@openai.com

viyatb-oai merged commit 428cd44 into main Jun 15, 2026
45 checks passed

viyatb-oai deleted the codex/viyatb/noise-relay-state branch June 15, 2026 23:39

github-actions Bot locked and limited conversation to collaborators Jun 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

exec-server: add Noise relay transport - #26242

exec-server: add Noise relay transport#26242
viyatb-oai merged 49 commits into
mainfrom
codex/viyatb/noise-relay-state

viyatb-oai commented Jun 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

viyatb-oai commented Jun 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

viyatb-oai commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

Changes

Stack

Verification

Uh oh!

Uh oh!

viyatb-oai commented Jun 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

viyatb-oai commented Jun 3, 2026 •

edited

Loading