mirror of
https://github.com/openai/codex.git
synced 2026-11-14 21:40:39 +00:00
viyatb-oaiandCodex
428cd44154
## Why Rendezvous forwards traffic between the orchestrator and exec-server. The endpoints need to authenticate each other and encrypt that traffic without trusting Rendezvous with plaintext or endpoint keys. ## Changes - Adds a hybrid Noise IK channel through Clatter using X25519, ML-KEM-768, AES-256-GCM, and SHA-256. - Binds each handshake to `environment_id`, `executor_registration_id`, and `stream_id`. - Pins the registry-provided executor key and carries the harness authorization inside the encrypted handshake. - Orders relay frames before consuming Noise nonces and fragments large JSON-RPC messages into bounded records. - Bounds handshake payloads, frames, streams, and message reassembly. Runtime activation is in [openai/codex#26245](https://github.com/openai/codex/pull/26245). ## Stack 1. **[openai/codex#26242](https://github.com/openai/codex/pull/26242)**: Noise channel and relay transport 2. [openai/codex#26245](https://github.com/openai/codex/pull/26245): remote registration and runtime activation ## Verification - `just test -p codex-exec-server` - Oversized initiator payload regression coverage - `just fix -p codex-exec-server` - `just bazel-lock-check` - `cargo shear` --------- Co-authored-by: Codex <noreply@openai.com>
43 lines
677 B
Protocol Buffer
43 lines
677 B
Protocol Buffer
syntax = "proto3";
|
|
|
|
package codex.exec_server.relay.v1;
|
|
|
|
message RelayMessageFrame {
|
|
uint32 version = 1;
|
|
string stream_id = 2;
|
|
uint32 ack = 3;
|
|
uint32 ack_bits = 4;
|
|
|
|
oneof body {
|
|
RelayData data = 5;
|
|
RelayAck ack_frame = 6;
|
|
RelayResume resume = 7;
|
|
RelayReset reset = 8;
|
|
RelayHeartbeat heartbeat = 9;
|
|
RelayHandshake handshake = 10;
|
|
}
|
|
}
|
|
|
|
message RelayData {
|
|
uint32 seq = 1;
|
|
uint32 segment_index = 2;
|
|
uint32 segment_count = 3;
|
|
bytes payload = 4;
|
|
}
|
|
|
|
message RelayAck {}
|
|
|
|
message RelayResume {
|
|
uint32 next_seq = 1;
|
|
}
|
|
|
|
message RelayReset {
|
|
string reason = 1;
|
|
}
|
|
|
|
message RelayHeartbeat {}
|
|
|
|
message RelayHandshake {
|
|
bytes payload = 1;
|
|
}
|