Register agent tasks behind use_agent_identity by adrian-openai · Pull Request #17387 · openai/codex

adrian-openai · 2026-04-10T22:51:49Z

Summary

Stack PR3 for feature-gated agent identity support.

This PR adds per-thread agent task registration behind features.use_agent_identity. Tasks are minted on the first real user turn and cached in thread runtime state for later turns.

Stack

PR1: Add use_agent_identity feature flag #17385 - add features.use_agent_identity
PR2: Register agent identities behind use_agent_identity #17386 - register agent identities when enabled
PR3: Register agent tasks behind use_agent_identity #17387 - this PR, original task registration slice
PR3.1: Persist and prewarm agent tasks per thread #17978 - persist and prewarm registered tasks per thread
PR4: [codex] Use AgentAssertion downstream behind use_agent_identity #17980 - use AgentAssertion downstream when enabled

Validation

Covered as part of the local stack validation pass:

just fmt
cargo test -p codex-core --lib agent_identity
cargo test -p codex-core --lib agent_assertion
cargo test -p codex-core --lib websocket_agent_task
cargo test -p codex-api api_bridge
cargo build -p codex-cli --bin codex

Notes

The full local app-server E2E path is still being debugged after PR creation. The current branch stack is directionally ready for review while that follow-up continues.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f089f4a53

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-10T23:00:42Z

+            if let Some(agent_task) = state.agent_task() {
+                debug!(
+                    agent_runtime_id = %agent_task.agent_runtime_id,
+                    task_id = %agent_task.task_id,
+                    "reusing cached agent task"
+                );
+                return Ok(Some(agent_task));


Revalidate cached agent task against current auth binding

ensure_agent_task_registered returns a cached agent_task without checking whether auth/workspace binding changed. After re-auth or workspace switch, turns can keep using a task minted for the old binding because register_task() (the only path that recomputes current_binding) is skipped. This can cause authorization failures or cross-account credential reuse.

Useful? React with 👍 / 👎.

efrazer-oai

I don't think we need this auth_binding concept with our auth.json changes. Can do smth like below:

match auth { CodexAuth::ChatgptAuthTokens(tokens) => { if let Some(agent_identity) = tokens.registered_agent_identity() { // preregistered path register_task_with_agent_identity(agent_identity).await } else if let Some(access_token) = tokens.authorization_bearer_token() { // human bootstrap path bootstrap_and_register_task(access_token, tokens.workspace_id()).await } else { Ok(None) } } _ => Ok(None), }

We shouldn't exist in a state where the agent workspace_id doesn't match up with the user workspace_id

efrazer-oai

Session lifecycle

In the status quo, we fully persist session details on disk. With this change, we're creating an ephemeral 'task' in memory associated with a session. This is a bit off for a few reasons I think:

It means if we turn off codex and start working on the same session later, it shows up as two different 'tasks' which seems like undesirable backend state.
It means we add latency to every initial turn in order to make this HTTP call to create the task (idt it'd be too severe, but latency is a huge focus and we try to make most interactions go through websockets; if we can avoid i would).
There are some API calls we make that are not session scoped, and some that are session scoped but aren't in the path where we create agent_task. If we're in a regime where there's no user token (i.e. programmatic codex), i believe these will just fail -- would need to make it robust to those.

I wonder if there's a cleaner implementation that loses some fidelity but just creates it on start?

Or if we can pass the session id itself as the task id?

efrazer-oai · 2026-04-14T01:36:23Z

@codex review

chatgpt-codex-connector · 2026-04-14T01:40:24Z

Codex Review: Didn't find any major issues. Keep them coming!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

nicksteele-oai · 2026-04-15T03:17:59Z

@@ -0,0 +1,15 @@
+# PR 17387 Agent Task Persistence Assumption


File should probably be rm'd from commit

Weird that notes are actually making it into the PR. I'll remove that.

nicksteele-oai · 2026-04-15T03:35:24Z

Should there be a way to allow users to soft fail after registration fails even when features.use_agent_identity is enabled? Calling shutdown if registration fails, even by accident, might result in some grotty UX. For instance, shutdown calls abort_all_tasks(TurnAbortReason::Interrupted), which iiuc will abort all active session tasks even if they're unrelated to this session.

This is a fair point. Probably worth a better UX here, where there's an error for this thread, but doesn't necessarily stop all other threads.

nicksteele-oai · 2026-04-15T04:07:53Z

@@ -6391,6 +6373,11 @@ pub(crate) async fn run_turn(
        }))
        .await;
    }
+    if let Err(error) = sess.ensure_agent_task_registered().await {
+        warn!(error = %error, "agent task registration failed");
+        sess.fail_agent_identity_registration(error).await;


Could we treat task registration fails as a turn error that can be retried and let the next turn attempt registration again instead of ending the session?

I'm not sure if I'm following - how will that turn be completed without a task? Do you mean that this 'turn error' just returns control back to the user who can try again in case it is a transient error? I think that seems reasonable!

Yep the latter! The turn shouldn't be completed but also shouldn't cause a hard fail, and the user should be able to attempt a retry

nicksteele-oai · 2026-04-15T04:10:22Z

The other thing we might want to consider is have some progress loader/event so if this event hangs the user has some indicator that it's still doing the registration

nicksteele-oai · 2026-04-15T04:11:45Z

Most of my comments (other than the shutdown invocation) are pretty minor, otherwise looking in good shape!

## Summary Stack PR 2 of 4 for feature-gated agent identity support. This PR adds agent identity registration behind `features.use_agent_identity`. It keeps the app-server protocol unchanged and starts registration after ChatGPT auth exists rather than requiring a client restart. ## Stack - PR1: #17385 - add `features.use_agent_identity` - PR2: #17386 - this PR - PR3: #17387 - register agent tasks when enabled - PR4: #17388 - use `AgentAssertion` downstream when enabled ## Validation Covered as part of the local stack validation pass: - `just fmt` - `cargo test -p codex-core --lib agent_identity` - `cargo test -p codex-core --lib agent_assertion` - `cargo test -p codex-core --lib websocket_agent_task` - `cargo test -p codex-api api_bridge` - `cargo build -p codex-cli --bin codex` ## Notes The full local app-server E2E path is still being debugged after PR creation. The current branch stack is directionally ready for review while that follow-up continues.

adrian-openai requested a review from nicksteele-oai April 10, 2026 22:51

This was referenced Apr 10, 2026

Use AgentAssertion downstream behind use_agent_identity #17388

Merged

Add use_agent_identity feature flag #17385

Merged

Register agent identities behind use_agent_identity #17386

Merged

adrian-openai marked this pull request as ready for review April 10, 2026 22:56

adrian-openai requested review from efrazer-oai and shijie-oai April 10, 2026 22:56

chatgpt-codex-connector bot reviewed Apr 10, 2026

View reviewed changes

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-agent branch from cd2ed35 to 7587c88 Compare April 10, 2026 23:49

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch from 5f089f4 to f530190 Compare April 10, 2026 23:53

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-agent branch from 7587c88 to 0913111 Compare April 11, 2026 00:17

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch 2 times, most recently from b6ea8a1 to fd5337b Compare April 11, 2026 00:34

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-agent branch from 6687bb9 to fb82a31 Compare April 11, 2026 01:02

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch from d25b68d to 321c151 Compare April 11, 2026 01:02

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-agent branch from fb82a31 to bbeb95e Compare April 11, 2026 01:17

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch from 321c151 to 56cda90 Compare April 11, 2026 01:17

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-agent branch from bbeb95e to 5735241 Compare April 11, 2026 06:43

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch 2 times, most recently from 3cbb522 to c1c3c37 Compare April 11, 2026 16:53

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-agent branch from 5735241 to 458a631 Compare April 11, 2026 16:53

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch 3 times, most recently from fa9d205 to c66f085 Compare April 13, 2026 22:05

efrazer-oai reviewed Apr 14, 2026

View reviewed changes

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch 2 times, most recently from 1176180 to e0cef11 Compare April 15, 2026 01:48

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-agent branch from 616d25c to 2fb2fc2 Compare April 15, 2026 02:15

nicksteele-oai reviewed Apr 15, 2026

View reviewed changes

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch from 0e37c8f to 49f5037 Compare April 15, 2026 09:35

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-agent branch from 5c0a4ec to 9b2c16f Compare April 15, 2026 14:55

Base automatically changed from dev/adrian/codex/agent-identity-register-agent to main April 15, 2026 17:08

adrian-openai requested review from efrazer-oai and nicksteele-oai April 15, 2026 17:09

adrian-openai added 7 commits April 15, 2026 10:10

Register agent tasks behind use_agent_identity

eb05513

Use canonical agent task registration URL

679322a

Register agent tasks behind use_agent_identity

22e31ae

Align agent task registration auth

87ec127

Fix agent identity task rebase

765b7f1

Update Bazel lockfile for agent identity task deps

001c728

Revalidate cached agent identity tasks

a2740c5

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch from 09bfb36 to 4ec295b Compare April 15, 2026 18:08

adrian-openai added 5 commits April 15, 2026 11:38

Use ChatGPT base URL for agent task registration

40c2560

Fix agent task registration clippy

c44aca2

Fix agent task biscuit target method

1acd71b

Annotate agent task test binding argument

f94b628

Make agent task registration failure retryable

84e7fb9

adrian-openai force-pushed the dev/adrian/codex/agent-identity-register-task branch from 4ec295b to 84e7fb9 Compare April 15, 2026 19:02

adrian-openai mentioned this pull request Apr 15, 2026

[codex] Use AgentAssertion downstream behind use_agent_identity #17980

Open

		@@ -0,0 +1,15 @@
		# PR 17387 Agent Task Persistence Assumption

Conversation

adrian-openai commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Stack

Validation

Notes

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

efrazer-oai left a comment

Choose a reason for hiding this comment

Uh oh!

efrazer-oai left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Session lifecycle

Uh oh!

efrazer-oai commented Apr 14, 2026

Uh oh!

chatgpt-codex-connector bot commented Apr 14, 2026

Uh oh!

nicksteele-oai Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adrian-openai Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

nicksteele-oai Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

adrian-openai Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

nicksteele-oai Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

adrian-openai Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

nicksteele-oai Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

nicksteele-oai Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

nicksteele-oai commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

adrian-openai commented Apr 10, 2026 •

edited

Loading

efrazer-oai left a comment •

edited

Loading

nicksteele-oai Apr 15, 2026 •

edited

Loading