feat(auth): add caller-attested X.509 transport capability - #2428
feat(auth): add caller-attested X.509 transport capability#2428jbeckwith-oai wants to merge 2 commits into
Conversation
Castiron custom code✅ No new custom-code files detected. 34 mixed files remain; 0 existing customizations changed. Compared 34 existing customizations unchanged
A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32321890281 --repo openai/openai-node \
--name castiron-custom-code-32321890281-1 --dir /tmp/castiron-custom-code-32321890281-1
git apply --stat /tmp/castiron-custom-code-32321890281-1/custom-code.patch
cat /tmp/castiron-custom-code-32321890281-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin a0d68cc53125c2cb82eab31271b8984b8d65d4b2 acab1ae910dfd724a6f3471cbe7e2b500155ced0
python3 scripts/castiron/custom_code_report.py report \
--base a0d68cc53125c2cb82eab31271b8984b8d65d4b2 \
--head acab1ae910dfd724a6f3471cbe7e2b500155ced0 --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-acab1ae910df
cat /tmp/castiron-custom-code-acab1ae910df/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2ffa2c910
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
1db8103 to
acab1ae
Compare
jbeckwith-oai
changed the title
1 participant
Summary
openai/auth/x509-transportentrypoint for one explicitly caller-attested Node.js UndiciAgentorProxyAgent.This is PR 2 of 5, following #2417. Certificate stability, safe proxy TLS separation, and fresh-dispatcher rotation are application attestations—not claims that transport identity cryptographically proves certificate selection. OAuth exchange, OpenAI client integration, credential caching, and lifecycle policy remain explicitly out of scope.
Verification
pnpm install --frozen-lockfile --ignore-scriptspnpm lintpnpm exec tsc --noEmitpnpm buildnode --experimental-strip-types scripts/test-packed-package.ts— CommonJS, ESM, TypeScript 4.9/current, browser-safe source navigation, and optional Undici absent/presentenv NODE_USE_ENV_PROXY=0 CI=1 ./scripts/test --testNamePattern='^(?!.*(?:pre-opened readable original inode|original held inode)).*$'— 4,064 handwritten tests passed; two pre-existing Linux-only inode cases skipped on macOS; 559 generated tests and 12 snapshots passeda3ac2b08-df37-44b8-9ba1-e105c884df5e— complete changed-source coverage, zero findings