mirror of
https://github.com/openai/codex.git
synced 2026-09-05 15:18:41 +00:00
428cd44154
## Why Rendezvous forwards traffic between the orchestrator and exec-server. The endpoints need to authenticate each other and encrypt that traffic without trusting Rendezvous with plaintext or endpoint keys. ## Changes - Adds a hybrid Noise IK channel through Clatter using X25519, ML-KEM-768, AES-256-GCM, and SHA-256. - Binds each handshake to `environment_id`, `executor_registration_id`, and `stream_id`. - Pins the registry-provided executor key and carries the harness authorization inside the encrypted handshake. - Orders relay frames before consuming Noise nonces and fragments large JSON-RPC messages into bounded records. - Bounds handshake payloads, frames, streams, and message reassembly. Runtime activation is in [openai/codex#26245](https://github.com/openai/codex/pull/26245). ## Stack 1. **[openai/codex#26242](https://github.com/openai/codex/pull/26242)**: Noise channel and relay transport 2. [openai/codex#26245](https://github.com/openai/codex/pull/26245): remote registration and runtime activation ## Verification - `just test -p codex-exec-server` - Oversized initiator payload regression coverage - `just fix -p codex-exec-server` - `just bazel-lock-check` - `cargo shear` --------- Co-authored-by: Codex <noreply@openai.com>
62 lines
2.0 KiB
Rust
62 lines
2.0 KiB
Rust
// This file is @generated by prost-build.
|
|
#[derive(Clone, PartialEq, ::prost::Message)]
|
|
pub struct RelayMessageFrame {
|
|
#[prost(uint32, tag = "1")]
|
|
pub version: u32,
|
|
#[prost(string, tag = "2")]
|
|
pub stream_id: ::prost::alloc::string::String,
|
|
#[prost(uint32, tag = "3")]
|
|
pub ack: u32,
|
|
#[prost(uint32, tag = "4")]
|
|
pub ack_bits: u32,
|
|
#[prost(oneof = "relay_message_frame::Body", tags = "5, 6, 7, 8, 9, 10")]
|
|
pub body: ::core::option::Option<relay_message_frame::Body>,
|
|
}
|
|
pub mod relay_message_frame {
|
|
#[derive(Clone, PartialEq, ::prost::Oneof)]
|
|
pub enum Body {
|
|
#[prost(message, tag = "5")]
|
|
Data(super::RelayData),
|
|
#[prost(message, tag = "6")]
|
|
AckFrame(super::RelayAck),
|
|
#[prost(message, tag = "7")]
|
|
Resume(super::RelayResume),
|
|
#[prost(message, tag = "8")]
|
|
Reset(super::RelayReset),
|
|
#[prost(message, tag = "9")]
|
|
Heartbeat(super::RelayHeartbeat),
|
|
#[prost(message, tag = "10")]
|
|
Handshake(super::RelayHandshake),
|
|
}
|
|
}
|
|
#[derive(Clone, PartialEq, ::prost::Message)]
|
|
pub struct RelayData {
|
|
#[prost(uint32, tag = "1")]
|
|
pub seq: u32,
|
|
#[prost(uint32, tag = "2")]
|
|
pub segment_index: u32,
|
|
#[prost(uint32, tag = "3")]
|
|
pub segment_count: u32,
|
|
#[prost(bytes = "vec", tag = "4")]
|
|
pub payload: ::prost::alloc::vec::Vec<u8>,
|
|
}
|
|
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
|
|
pub struct RelayAck {}
|
|
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
|
|
pub struct RelayResume {
|
|
#[prost(uint32, tag = "1")]
|
|
pub next_seq: u32,
|
|
}
|
|
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
|
|
pub struct RelayReset {
|
|
#[prost(string, tag = "1")]
|
|
pub reason: ::prost::alloc::string::String,
|
|
}
|
|
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
|
|
pub struct RelayHeartbeat {}
|
|
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
|
|
pub struct RelayHandshake {
|
|
#[prost(bytes = "vec", tag = "1")]
|
|
pub payload: ::prost::alloc::vec::Vec<u8>,
|
|
}
|