feat: add run task identity primitives by adrian-openai · Pull Request #19047 · openai/codex

adrian-openai · 2026-04-22T22:24:35Z

Stack

This is PR 1 of the simplified HAI single-run-task stack:

#19047 Agent Identity assertion and task-registration primitives, including the shared run-task helper used by existing Agent Identity JWT auth.
#19049 Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted Agent Identity runtime auth and its single run task.
#19051 Run-scoped provider auth that uses one backend-owned task id for first-party inference and compaction requests.

#19054 collapsed out of the active stack because the simplified design no longer needs a separate background/control-plane task helper.

Summary

The simplified POC shape is one backend-owned task per Agent Identity run. This PR makes the first layer match that final shape directly instead of introducing task targets, caller-owned external task refs, or intermediate wrappers that later PRs would need to undo.

What changed:

keeps the AgentAssertion wire payload as agent_runtime_id, task_id, timestamp, and signature
exposes register_agent_task as the single task-registration helper for both existing Agent Identity JWT auth and the ChatGPT-registration path added later in the stack
makes task registration send only the signed registration timestamp; the backend owns the returned opaque task id
removes the unused target/task-kind/external-task-ref surfaces from codex-agent-identity
keeps Agent Identity JWT JWKS lookup separate from agent/task registration URL derivation
updates Agent Identity JWT auth to register one run task during auth construction and share that task across cloned auth handles

This PR intentionally does not enable ChatGPT-derived Agent Identity. That opt-in and config gate are added in the next PR.

Testing

just test -p codex-agent-identity

nicksteele-oai

This looks fine to me

tigrantsat-openai

Let's ensure full set of features + launching internally before enabling into codex.

Zemnmez · 2026-06-10T23:27:46Z

-
-pub fn agent_identity_jwks_url(chatgpt_base_url: &str) -> String {
-    let trimmed = chatgpt_base_url.trim_end_matches('/');
+pub fn agent_identity_jwks_url(agent_identity_jwt_base_url: &str) -> String {


i think in future this should be the standard issuer derivation (i.e. https://[agent_id].something.something/.well-known) so this doesn't have to be so specific

Zemnmez · 2026-06-10T23:28:32Z

+        task_id: task_id.to_string(),
        timestamp: timestamp.clone(),
-        signature: sign_agent_assertion_payload(key, target.task_id, &timestamp)?,
+        signature: sign_agent_assertion_payload(key, task_id, &timestamp)?,


In future let's remove the signature collision via JSON.stringify([ field_1, field_2, field_3 ]) or something to that effect.

Zemnmez · 2026-06-10T23:30:20Z

+) -> String {
+    agent_identity_authapi_url(
+        agent_identity_authapi_base_url,
+        &format!("/v1/agent/{agent_runtime_id}/task/register"),


the agent_runtime_id needs to be escaped, clamped or have other URL parts stripped

Zemnmez · 2026-06-10T23:34:26Z

-    ))
+fn agent_identity_authapi_url(agent_identity_authapi_base_url: &str, api_path: &str) -> String {
+    let base_url = normalize_agent_identity_authapi_base_url(agent_identity_authapi_base_url);
+    format!("{base_url}{api_path}")


would be great to do this via a proper URL construction rather than a naiive string concatenation

Zemnmez · 2026-06-10T23:36:28Z

+
+pub fn agent_identity_authapi_base_url_from_chatgpt_base_url(chatgpt_base_url: &str) -> String {
+    let mut base_url = chatgpt_base_url.trim_end_matches('/').to_string();
+    for suffix in [


this seems very brittle but is probably fine for v0

Zemnmez · 2026-06-10T23:39:13Z

+            break;
+        }
+    }
+    if matches!(


perhaps we can build all these mappings statically? so there's no ambiguity at runtime?

This was referenced Apr 22, 2026

obsolete: hidden background agent auth provider #19054

Merged

feat: use run agent task auth for inference #19051

Open

feat: opt ChatGPT auth into agent identity #19049

Open

efrazer-oai force-pushed the dev/efrazer/agent-identity-env-jwt branch from c588673 to c74a2f3 Compare April 22, 2026 23:57

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch from 3254ce5 to 0324e8a Compare April 23, 2026 01:02

adrian-openai changed the title ~~feat: add agent task identity primitives~~ feat: add agent identity primitives and opt-in flag Apr 23, 2026

github-actions Bot mentioned this pull request Apr 23, 2026

📊 AI CLI 工具社区动态日报 2026-04-23 gsscsd/big_model_radar#230

Open

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch from 0324e8a to 2685c9e Compare April 23, 2026 03:55

adrian-openai marked this pull request as ready for review April 23, 2026 04:27

adrian-openai requested a review from a team as a code owner April 23, 2026 04:27

adrian-openai requested review from efrazer-oai and pakrym-oai April 23, 2026 16:43

adrian-openai marked this pull request as draft April 24, 2026 00:05

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch from 2685c9e to 55dced3 Compare April 24, 2026 02:57

adrian-openai changed the title ~~feat: add agent identity primitives and opt-in flag~~ feat: add external task refs and opt-in flag Apr 24, 2026

adrian-openai marked this pull request as ready for review April 24, 2026 06:07

adrian-openai requested review from efrazer-oai, nicksteele-oai and pakrym-oai and removed request for efrazer-oai and pakrym-oai April 24, 2026 06:08

nicksteele-oai approved these changes Apr 24, 2026

View reviewed changes

efrazer-oai force-pushed the dev/efrazer/agent-identity-env-jwt branch 3 times, most recently from 8d2470f to c5d5e7c Compare April 25, 2026 01:45

github-actions Bot mentioned this pull request Apr 25, 2026

📊 AI CLI Tools Digest 2026-04-25 borq168/radar-forge#16

Open

Base automatically changed from dev/efrazer/agent-identity-env-jwt to main April 26, 2026 19:49

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch 2 times, most recently from baf2618 to 110e2a4 Compare May 11, 2026 19:04

tigrantsat-openai reviewed May 11, 2026

View reviewed changes

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch 2 times, most recently from 0e79c01 to 03963fc Compare May 18, 2026 20:40

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch from 03963fc to 8810088 Compare May 26, 2026 19:00

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch from 8810088 to ef4a89f Compare June 3, 2026 02:07

github-actions Bot mentioned this pull request Jun 3, 2026

📊 AI CLI 工具社区动态日报 2026-06-03 litang9/big_model_radar#6

Open

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch 4 times, most recently from 1d62ce5 to f220d79 Compare June 9, 2026 21:01

adrian-openai commented Jun 9, 2026

View reviewed changes

Comment thread codex-rs/agent-identity/src/lib.rs Outdated

adrian-openai commented Jun 9, 2026

View reviewed changes

Comment thread codex-rs/agent-identity/src/lib.rs Outdated

adrian-openai commented Jun 9, 2026

View reviewed changes

Comment thread codex-rs/agent-identity/src/lib.rs Outdated

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch 2 times, most recently from 134085f to d13cbcc Compare June 9, 2026 23:38

adrian-openai changed the title ~~feat: add external task refs and opt-in flag~~ feat: add run task identity primitives Jun 9, 2026

adrian-openai commented Jun 10, 2026

View reviewed changes

Comment thread codex-rs/agent-identity/src/lib.rs

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch 3 times, most recently from 7026cbc to d7289e0 Compare June 10, 2026 03:16

github-actions Bot mentioned this pull request Jun 10, 2026

📊 AI CLI 工具社区动态日报 2026-06-10 litang9/big_model_radar#41

Open

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch 3 times, most recently from 2b9ca9a to 7f15c05 Compare June 10, 2026 06:05

adrian-openai requested review from Zemnmez and ithilgore June 10, 2026 21:12

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch from 7f15c05 to 796f8f0 Compare June 10, 2026 21:32

Zemnmez approved these changes Jun 10, 2026

View reviewed changes

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch from 796f8f0 to d7994fd Compare June 11, 2026 00:54

feat: add agent run task identity primitives

bcf4294

adrian-openai force-pushed the dev/adrian/codex/hai-task-primitives branch from d7994fd to bcf4294 Compare June 11, 2026 04:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add run task identity primitives#19047

feat: add run task identity primitives#19047
adrian-openai wants to merge 1 commit into
mainfrom
dev/adrian/codex/hai-task-primitives

adrian-openai commented Apr 22, 2026 •

edited

Loading

Uh oh!

nicksteele-oai left a comment

Uh oh!

tigrantsat-openai left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Zemnmez Jun 10, 2026

Uh oh!

Zemnmez Jun 10, 2026

Uh oh!

Zemnmez Jun 10, 2026

Uh oh!

Zemnmez Jun 10, 2026

Uh oh!

Zemnmez Jun 10, 2026

Uh oh!

Zemnmez Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

adrian-openai commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Stack

Summary

Testing

Uh oh!

nicksteele-oai left a comment

Choose a reason for hiding this comment

Uh oh!

tigrantsat-openai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Zemnmez Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

Zemnmez Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

Zemnmez Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

Zemnmez Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

Zemnmez Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

Zemnmez Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

adrian-openai commented Apr 22, 2026 •

edited

Loading