Skip to content

feat(auth): attest cross-module X.509 transport capabilities - #2471

Merged
jbeckwith-oai merged 6 commits into
mainfrom
codex/x509-02-capability-boundary
Aug 25, 2026
Merged

jbeckwith-oai merged 6 commits into
mainfrom
codex/x509-02-capability-boundary

Conversation

@jbeckwith-oai

Copy link
Copy Markdown
Contributor

Summary

Part 2 of 5; based on codex/x509-01-token-exchange.

  • Introduce a frozen, genuinely private X.509 transport capability with one canonical registry shared across CommonJS and ESM consumers.
  • Keep Undici optional and Node-only; preserve extensible legacy workload-identity types and reject forged, proxy-wrapped, or unregistered transports.
  • Teach the generated Jest suite to resolve and transform the single private .cts state module without broadening package exports or losing its canonical identity.
  • Close all package-export aliases for the capability registrar, registry, and canonical state, including installed-artifact CJS/ESM negative checks.

Verification

  • 112 focused transport, issuer, and conformance regressions; repeated on Node 22.22.0.
  • pnpm lint, pnpm exec tsc --noEmit, pnpm build, generated Jest smoke tests, and packed npm artifact/export checks on Node 22.
  • Two independent security/code-review rounds; fixed the discovered private-registrar exposure before submission.

Next: codex/x509-03-client-integration.

@jbeckwith-oai
jbeckwith-oai requested a review from a team as a code owner August 25, 2026 19:27
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 25, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-08-25T21:43:06.075374Z 8963a41 New commits
🔒 Security Review ✅ Completed 2026-08-25T21:43:09.051218Z 8963a41 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2f7f4cc7de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@HAYDEN-OAI HAYDEN-OAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed the frozen capability attestation, shared CJS/ESM registry identity, scoped transport callbacks, optional Undici isolation, and private package-export boundaries. No additional blocking issues; the existing source-mode resolver comment captures the remaining follow-up.

@jbeckwith-oai
jbeckwith-oai force-pushed the codex/x509-02-capability-boundary branch from 2f7f4cc to cbeb6a7 Compare August 25, 2026 20:53
Base automatically changed from codex/x509-01-token-exchange to main August 25, 2026 21:03
@jbeckwith-oai
jbeckwith-oai force-pushed the codex/x509-02-capability-boundary branch from 90f888f to 71f47ec Compare August 25, 2026 21:17
@openai-sdks

openai-sdks Bot commented Aug 25, 2026 •

Copy link
Copy Markdown
Contributor

OkTest Summary

✅ 237/237 SDK tests passed in 9.777s for Node SDK PR #2471.

Test results — 42 files
Test Result Time
tests/chat-completions-complex-body.test.ts ✅ Passed 143ms
tests/chat-completions-create.test.ts ✅ Passed 177ms
tests/chat-completions-stream.test.ts ✅ Passed 117ms
tests/files-content-binary.test.ts ✅ Passed 133ms
tests/files-create-multipart.test.ts ✅ Passed 171ms
tests/files-list-pagination.test.ts ✅ Passed 160ms
tests/initialize-config.test.ts ✅ Passed 133ms
tests/instance-isolation.test.ts ✅ Passed 90ms
tests/models-list.test.ts ✅ Passed 117ms
tests/responses-background-lifecycle.test.ts ✅ Passed 164ms
tests/responses-body-method-errors.test.ts ✅ Passed 259ms
tests/responses-cancel-timeout.test.ts ✅ Passed 192ms
tests/responses-cancel.test.ts ✅ Passed 272ms
tests/responses-compact-retries.test.ts ✅ Passed 233ms
tests/responses-compact.test.ts ✅ Passed 189ms
tests/responses-create-advanced-stream.test.ts ✅ Passed 104ms
tests/responses-create-advanced.test.ts ✅ Passed 158ms
tests/responses-create-disconnect.test.ts ✅ Passed 1.18s
tests/responses-create-errors.test.ts ✅ Passed 264ms
tests/responses-create-malformed-api-responses.test.ts ✅ Passed 111ms
tests/responses-create-retries.test.ts ✅ Passed 306ms
tests/responses-create-stream-failures.test.ts ✅ Passed 189ms
tests/responses-create-stream-timeout.test.ts ✅ Passed 2.155s
tests/responses-create-stream-wire.test.ts ✅ Passed 2.303s
tests/responses-create-stream.test.ts ✅ Passed 102ms
tests/responses-create-terminal-states.test.ts ✅ Passed 213ms
tests/responses-create-timeout.test.ts ✅ Passed 187ms
tests/responses-create.test.ts ✅ Passed 178ms
tests/responses-delete.test.ts ✅ Passed 157ms
tests/responses-input-items-errors.test.ts ✅ Passed 147ms
tests/responses-input-items-list.test.ts ✅ Passed 180ms
tests/responses-input-items-options.test.ts ✅ Passed 86ms
tests/responses-input-tokens-count-timeout.test.ts ✅ Passed 206ms
tests/responses-input-tokens-count.test.ts ✅ Passed 252ms
tests/responses-malformed-inputs.test.ts ✅ Passed 1.948s
tests/responses-not-found-errors.test.ts ✅ Passed 215ms
tests/responses-parse.test.ts ✅ Passed 182ms
tests/responses-retrieve-retries.test.ts ✅ Passed 203ms
tests/responses-retrieve.test.ts ✅ Passed 187ms
tests/responses-stored-method-errors.test.ts ✅ Passed 555ms
tests/retry-behavior.test.ts ✅ Passed 3.098s
tests/sdk-error-shape.test.ts ✅ Passed 267ms

View OkTest run #32902304569

SDK merge (99feee42716a) · head (8963a4165e2a) · base (9dd86484d9d5) · OkTest (2b1bdfd25e98)

@github-actions

github-actions Bot commented Aug 25, 2026 •

Copy link
Copy Markdown
Contributor

Castiron custom code

✅ No new custom-code files detected.

32 mixed files remain; 0 existing customizations changed.

Compared 9dd86484d9d5 → 8963a4165e2a. Generated baselines verified.

32 existing customizations unchanged
  • api.md
  • scripts/castiron/README.md
  • scripts/castiron/custom_code_report.py
  • scripts/castiron/test_custom_code_report.py
  • src/client.ts
  • src/resources/audio/transcriptions.ts
  • src/resources/audio/translations.ts
  • src/resources/beta/assistants.ts
  • src/resources/beta/beta.ts
  • src/resources/beta/index.ts
  • src/resources/beta/responses/internal-base.ts
  • src/resources/beta/responses/responses.ts
  • src/resources/beta/threads/index.ts
  • src/resources/beta/threads/runs/index.ts
  • src/resources/beta/threads/runs/runs.ts
  • src/resources/beta/threads/threads.ts
  • src/resources/chat/completions/completions.ts
  • src/resources/chat/completions/index.ts
  • src/resources/conversations/index.ts
  • src/resources/embeddings.ts
  • src/resources/files.ts
  • src/resources/fine-tuning/checkpoints/permissions.ts
  • src/resources/images.ts
  • src/resources/responses/internal-base.ts
  • src/resources/responses/responses.ts
  • src/resources/skills/skills.ts
  • src/resources/skills/versions/versions.ts
  • src/resources/vector-stores/file-batches.ts
  • src/resources/vector-stores/files.ts
  • src/resources/webhooks/index.ts
  • src/resources/webhooks/webhooks.ts
  • tests/lib/data-residency.test.ts

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 32902342574 --repo openai/openai-node \
  --name castiron-custom-code-32902342574-1 --dir /tmp/castiron-custom-code-32902342574-1
git apply --stat /tmp/castiron-custom-code-32902342574-1/custom-code.patch
cat /tmp/castiron-custom-code-32902342574-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 9dd86484d9d5a2212ea8ec472fad6f76c747ba14 8963a4165e2a34c77a2f5b4c7e2a1c26c770bd40
python3 scripts/castiron/custom_code_report.py report \
  --base 9dd86484d9d5a2212ea8ec472fad6f76c747ba14 \
  --head 8963a4165e2a34c77a2f5b4c7e2a1c26c770bd40 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-8963a4165e2a
cat /tmp/castiron-custom-code-8963a4165e2a/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 71f47ecd1f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e43f30aa01

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/auth/types.ts Resolved
@jbeckwith-oai
jbeckwith-oai added this pull request to the merge queue Aug 25, 2026
Merged via the queue into main with commit c6769fa Aug 25, 2026
35 checks passed
@jbeckwith-oai
jbeckwith-oai deleted the codex/x509-02-capability-boundary branch August 25, 2026 22:59
@openai-sdks openai-sdks Bot mentioned this pull request Aug 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants