Sunbelt Computer Software

PL/B Language Development and Support

exec-server: add Noise relay transport by viyatb-oai · Pull Request #26242 · openai/codex · GitHub

exec-server: add Noise relay transport#26242

Merged

viyatb-oai merged 49 commits into

mainfrom

codex/viyatb/noise-relay-state

Jun 15, 2026

viyatb-oai commented Jun 3, 2026 •

edited

Loading

Collaborator

Why

Rendezvous forwards traffic between the orchestrator and exec-server. The endpoints need to authenticate each other and encrypt that traffic without trusting Rendezvous with plaintext or endpoint keys.

Changes

Adds a hybrid Noise IK channel through Clatter using X25519, ML-KEM-768, AES-256-GCM, and SHA-256.
Binds each handshake to environment_id, executor_registration_id, and stream_id.
Pins the registry-provided executor key and carries the harness authorization inside the encrypted handshake.
Orders relay frames before consuming Noise nonces and fragments large JSON-RPC messages into bounded records.
Bounds handshake payloads, frames, streams, and message reassembly.

Runtime activation is in openai/codex#26245.

Stack

openai/codex#26242: Noise channel and relay transport
openai/codex#26245: remote registration and runtime activation

Verification

just test -p codex-exec-server
Oversized initiator payload regression coverage
just fix -p codex-exec-server
just bazel-lock-check
cargo shear

This was referenced Jun 3, 2026

exec-server: add Noise channel foundation #26239

Closed

exec-server: Noise relay wire #26241

Closed

exec-server: Noise relay codec tests #26243

Merged

exec-server: Noise provider API #26240

Merged

exec-server: Noise relay E2E #26244

Closed

exec-server: default remote transport to Noise #26245

Merged

exec-server: Noise executor transport #26247

Closed

exec-server: Noise runtime tests #26246

Closed

viyatb-oai force-pushed the codex/viyatb/noise-relay-wire branch from ec4dff7 to d06fd3c Compare

June 3, 2026 20:45

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch 2 times, most recently from 0d9f9a0 to f7c6737 Compare

June 4, 2026 00:41

viyatb-oai force-pushed the codex/viyatb/noise-relay-wire branch from d06fd3c to d293187 Compare

June 4, 2026 00:41

viyatb-oai mentioned this pull request

exec-server: Noise remote opt-in #26273

Closed

viyatb-oai changed the title ~~exec-server: Noise relay state~~ exec-server: Noise relay transport

jmillican-oai reviewed

View reviewed changes

codex-rs/exec-server/src/noise_channel.rs

viyatb-oai added 2 commits

June 9, 2026 15:17


          feat: add Noise channel foundation

df0bd43

Co-authored-by: Codex noreply@openai.com


          refactor: keep Noise foundation independently usable

fd62a24

Co-authored-by: Codex noreply@openai.com

viyatb-oai force-pushed the codex/viyatb/noise-relay-wire branch from d293187 to a7ef55a Compare

June 9, 2026 22:21

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from f7c6737 to 491c3a6 Compare

June 9, 2026 22:21


          fix: use BLAKE3 intrinsics for Windows Bazel

1ec9593

Co-authored-by: Codex noreply@openai.com

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from 491c3a6 to 2488836 Compare

June 9, 2026 23:20

viyatb-oai force-pushed the codex/viyatb/noise-relay-wire branch from a7ef55a to 657fe01 Compare

June 9, 2026 23:20

viyatb-oai changed the title ~~exec-server: Noise relay transport~~ exec-server: add Noise relay transport

viyatb-oai changed the base branch from codex/viyatb/noise-relay-wire to codex/viyatb/noise-channel-foundation

June 10, 2026 09:04


          refactor(exec-server): validate Noise keys at use

29b362f

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from fa5ddce to e9ec60c Compare

June 10, 2026 16:35


          fix(exec-server): keep Noise foundation self-contained

5bd2787

Co-authored-by: Codex noreply@openai.com

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from e9ec60c to 1c45005 Compare

June 10, 2026 16:47


          fix(exec-server): retain Clatter byte array trait

3088d8f

Co-authored-by: Codex noreply@openai.com

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from 1c45005 to 592f3d2 Compare

June 10, 2026 16:51

viyatb-oai and others added 2 commits

June 11, 2026 19:52


          refactor: group Noise harness connection arguments

Co-authored-by: Codex noreply@openai.com


          chore(exec-server): finish Noise dependency update

bbd64c3

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai force-pushed the codex/viyatb/noise-relay-state branch from 2dc2270 to bbd64c3 Compare

June 12, 2026 02:57

viyatb-oai changed the base branch from codex/viyatb/noise-channel-foundation to main

June 12, 2026 02:57

viyatb-oai and others added 2 commits

June 11, 2026 20:16


          refactor(exec-server): preserve transport naming

63376d6

Co-authored-by: Codex <noreply@openai.com>


          docs(exec-server): clarify plain transport naming

faf5a6e

Co-authored-by: Codex noreply@openai.com

github-actions Bot mentioned this pull request

📊 AI CLI 工具社区动态日报 2026-06-12 jasonalang/big_model_radar#76

Open

viyatb-oai and others added 12 commits

June 11, 2026 21:05


          chore: merge main into Noise relay

9bd7e9e

Co-authored-by: Codex noreply@openai.com


          refactor(exec-server): defer nonce state to Clatter

fb051b7

Co-authored-by: Codex noreply@openai.com


          Merge branch 'codex/viyatb/noise-channel-foundation' into codex/viyat…

56c4fbe

…b/noise-relay-state


          refactor(exec-server): simplify Noise reconnect state

0fa9f53

Co-authored-by: Codex noreply@openai.com


          refactor(exec-server): trim Noise identity surface

2e43748

Co-authored-by: Codex noreply@openai.com


          Merge branch 'codex/viyatb/noise-channel-foundation' into codex/viyat…

3a42371

…b/noise-relay-state


          refactor(exec-server): inline Noise public key construction

0ec082d

Co-authored-by: Codex noreply@openai.com


          Merge branch 'codex/viyatb/noise-channel-foundation' into codex/viyat…

ddb682f

…b/noise-relay-state

# Conflicts:
#	codex-rs/exec-server/src/noise_channel.rs


          refactor(exec-server): trim Noise relay plumbing

eb10e5c

Co-authored-by: Codex noreply@openai.com


          refactor(exec-server): simplify noise integration

6c6ea8d

Co-authored-by: Codex noreply@openai.com


          fix(exec-server): preserve rendezvous connection API

75858fb

Co-authored-by: Codex noreply@openai.com


          fix(exec-server): bound Noise handshake payload

a1e2958

Co-authored-by: Codex <noreply@openai.com>

viyatb-oai marked this pull request as ready for review

June 12, 2026 17:43

viyatb-oai requested a review from apanasenko-oai

June 12, 2026 17:43

viyatb-oai commented Jun 12, 2026

Collaborator Author

chatgpt-codex-connector Bot commented Jun 12, 2026

Contributor

apanasenko-oai approved these changes

View reviewed changes

codex-rs/exec-server/src/noise_relay/harness.rs Outdated

codex-rs/exec-server/src/noise_relay/harness.rs

codex-rs/exec-server/src/noise_relay/harness.rs Outdated

codex-rs/exec-server/src/noise_relay/harness.rs

viyatb-oai added 3 commits

June 15, 2026 13:32


          Merge remote-tracking branch 'origin/main' into codex/viyatb/noise-re…

19b5169

…lay-state


          fix(exec-server): log Noise relay write failures

60d0968

Co-authored-by: Codex noreply@openai.com


          fix(exec-server): clarify Noise relay diagnostics

d887e21

Co-authored-by: Codex noreply@openai.com

viyatb-oai merged commit 428cd44 into main

45 checks passed

viyatb-oai deleted the codex/viyatb/noise-relay-state branch

June 15, 2026 23:39

github-actions Bot locked and limited conversation to collaborators

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet