viyatb-oai

Add attributed exec process lifecycle telemetry (#42373) ## Why Exec-server process and network-policy events need stable attribution to the launching tool call and executor without recording process payloads. ## What changed - Add optional `ExecMetadata` to `ExecParams` and propagate the thread and tool call IDs from unified exec. - Emit bounded OpenTelemetry events for process start, spawn failure, sandbox denial, and exit. Correlate them with the launch trace and registry-issued executor identity while excluding arguments, paths, environment values, output, and error text. - Preserve launch attribution across long-running processes and reconnects, and attach the same metadata to network-policy audit events. - Keep the protocol backward compatible when metadata is omitted, and prevent invalid trace headers from inheriting an unrelated active span. ## Testing Add coverage for metadata serialization and propagation, lifecycle event fields, trace relationships, reconnect behavior, spawn failures, sandbox denials, and network-policy attribution. GitOrigin-RevId: 7aa480a7289c73cb95e2c124c35500bb6f0d5084

Enforce automatic review for managed models (#37511) ## What changed - Add the managed `auto_review.required_on_models` requirement, unioning model slugs across requirement layers and exposing the result through `configRequirements/read`. - Force listed models to use `on-request` approvals with the `auto_review` reviewer. Downgrade Full Access to workspace-write when starting a protected session, and reject incompatible runtime overrides or use when automatic review is disabled. - Preserve these protections across thread starts, resumes, forks, model changes, turn overrides, MCP approvals, and TUI session attachment. ## Testing - Add coverage for layered model requirements and exact provider-alias matching. - Add app-server tests for protected thread lifecycle operations, unsafe setting overrides, legacy thread upgrades, disabled automatic review, and requirements API output. GitOrigin-RevId: c4b1d52c3b5b75e86880725412b8f0812e0dfcd9

exec-server: default remote transport to Noise (#26245) ## Why The transport in [openai/codex#26242](https://github.com/openai/codex/pull/26242) needs to be used by every remote orchestrator-to-executor connection before JSON-RPC traffic starts. ## Changes - Generates one executor Noise identity when remote exec-server starts and registers its public key. - Creates a harness identity for each physical remote environment connection. - Fetches a fresh registry bundle before connecting and validates the authenticated harness key before completing the executor handshake. - Multiplexes encrypted logical streams over the existing executor WebSocket. - Adds bounded stream, handshake-failure, and reassembly state. - Adds safe lifecycle diagnostics without logging keys, authorizations, plaintext, or ciphertext. - Covers reconnects, replay rejection, validation failure, framing limits, and encrypted JSON-RPC tool traffic. ## Stack 1. [openai/codex#26242](https://github.com/openai/codex/pull/26242): Noise channel and relay transport 2. **[openai/codex#26245](https://github.com/openai/codex/pull/26245)**: remote registration and runtime activation ## Verification - `just test -p codex-exec-server` - `just fix -p codex-exec-server` - `just bazel-lock-check` - `cargo shear` --------- Co-authored-by: Codex <noreply@openai.com>

exec-server: add Noise relay transport (#26242) ## Why Rendezvous forwards traffic between the orchestrator and exec-server. The endpoints need to authenticate each other and encrypt that traffic without trusting Rendezvous with plaintext or endpoint keys. ## Changes - Adds a hybrid Noise IK channel through Clatter using X25519, ML-KEM-768, AES-256-GCM, and SHA-256. - Binds each handshake to `environment_id`, `executor_registration_id`, and `stream_id`. - Pins the registry-provided executor key and carries the harness authorization inside the encrypted handshake. - Orders relay frames before consuming Noise nonces and fragments large JSON-RPC messages into bounded records. - Bounds handshake payloads, frames, streams, and message reassembly. Runtime activation is in [openai/codex#26245](https://github.com/openai/codex/pull/26245). ## Stack 1. **[openai/codex#26242](https://github.com/openai/codex/pull/26242)**: Noise channel and relay transport 2. [openai/codex#26245](https://github.com/openai/codex/pull/26245): remote registration and runtime activation ## Verification - `just test -p codex-exec-server` - Oversized initiator payload regression coverage - `just fix -p codex-exec-server` - `just bazel-lock-check` - `cargo shear` --------- Co-authored-by: Codex <noreply@openai.com>

Harden network approval cancellation and concurrency (#35267) ## What changed - Scope pending network approvals to a turn and execution while still coalescing duplicate requests within one execution. - Fail abandoned approval owners closed, cancel denied executions, resolve any waiting requests, and cancel in-flight Guardian reviews when their owner is dropped. - Serialize session policy updates with approval caches so concurrent allow and deny decisions cannot leave enforcement and cached decisions inconsistent. - Give user approval requests and permission hooks unique per-execution identifiers. ## Testing - Cover approval deduplication boundaries, abandoned-owner cleanup, cancellation outcomes, replacement requests, and Guardian cancellation events. GitOrigin-RevId: 11e184dd1c70294a99581b6ff0d4b6607d9ea1d9

Enable exec-server network policy callbacks (#34770) ## What changed - Let `exec-server` issue JSON-RPC requests to its client and correlate responses, with bounded concurrency, timeouts, and connection cleanup. - When `request_policy_decisions` is enabled, forward proxy policy requests with the process ID and network destination, then apply the client's allow, deny, or ask decision. - Fail closed for invalid inputs, unavailable or malformed responses, timeouts, process shutdown, and disconnects. Keep callbacks active while inherited process streams keep the proxy alive. ## Testing - Cover response correlation, request limits, timeouts, disconnect cleanup, validation boundaries, decision forwarding, and process lifecycle behavior. GitOrigin-RevId: 60e658102c50036589ca9de844760a8bffaa53b0

Launch managed network proxies on remote executors (#33906) ## Why Remote executions need managed-network proxy listeners in the executor so their loopback proxy addresses are reachable by the launched process. ## What changed - Add a capability-gated exec-server protocol field for executor-local proxy launch configuration, including network policy, audit metadata, and execution attribution. - Start the proxy while preparing a remote process, replace inherited proxy environment variables with its local addresses, and derive the sandbox context from its listeners. - Keep the proxy alive until inherited output streams close, then shut it down. - Reject unsupported remote settings such as MITM and credential injection. ## Testing - Cover configuration round trips and rejection of unsupported settings. - Verify executor-local startup, blocked-domain enforcement, protocol compatibility, and proxy lifetime through process closure. GitOrigin-RevId: c984f54e3e600aa9ebcbf8cf4574046e2c199d11

Record normalized sandbox violation events (#36207) ## Why Filesystem denials and managed-network blocks did not share a structured event shape, requiring downstream consumers to rediscover enforcement paths and parse backend-specific output. See https://github.com/openai/codex/pull/17573. ## What changed - Add normalized filesystem and network violation types in `codex-sandboxing` and emit them through a shared tracing seam. - Classify filesystem denials by backend and reason, retaining an optional path and bounded output snippet, and preserve managed-network block context. - Report the sandbox type through exec-server responses so unified exec can classify remote denials without guessing; omitted values remain compatible with older peers. - Record violations from exec, apply-patch, shell-escalation, unified-exec, and managed-network enforcement paths without changing denial behavior. ## Testing - Cover filesystem classification, path extraction, `SIGSYS`, network event conversion, protocol compatibility, and remote sandbox-type propagation. GitOrigin-RevId: d673173b4fa6bdf0a24421194a8a61c81fab9c96

[codex] Preserve reviewer when resuming threads (#30278) ## Why A thread resumed without an explicit reviewer could pick up the reviewer from the current config instead of preserving the reviewer already in use by the thread. After an app restart, this meant a thread running with auto review could silently switch back to user review, and the next turn could continue under the wrong reviewer. ## What changed Persist the effective reviewer with each turn and restore the latest persisted value when the thread resumes. If the resume request explicitly provides a reviewer, that value still takes precedence. ## Test plan - Added a regression test that starts a thread with auto review, records a turn, restarts with user review in config, resumes without an override, and verifies that auto review is preserved. - `just test -p codex-protocol` - `just test -p codex-state` - `just test -p codex-rollout` - `just test -p codex-app-server thread_resume_preserves_persisted_approvals_reviewer` - Clippy for the affected crates

Forward executor network policy decisions for auditing (#38670) ## What changed - Add a best-effort `network/policyDecision` notification for final domain and non-domain policy decisions made by executor-local proxies. - Validate notifications against the active process on the controller and emit audit events with controller-trusted session and execution metadata. - Reserve outbound RPC capacity so audit notifications cannot block control messages, and expose valid `chatgpt-account-id` header values for audit attribution. ## Testing - Cover notification serialization, proxy decision capture, executor-to-controller delivery, trusted metadata handling, and reserved RPC capacity. GitOrigin-RevId: a39f96a6b3d9401c03d54eaef5b9a6d3fe0da78b