exec-server: expose environment registry payloads (#28651)

## Why

Services that proxy the exec-server environment registry endpoints need
to deserialize and forward the same Noise registration and harness-key
validation payloads. Those wire models currently live as private,
serialize-only structs in `exec-server`, which forces consumers to
duplicate the contract.

## What changed

- Add owned serde models for registration and harness-key validation
requests and responses.
- Use those models in the existing exec-server registry client.
- Re-export the models from `codex-exec-server` and `codex-core-api`.
- Keep the harness authorization request free of a derived `Debug`
implementation so it is not accidentally logged.

## Testing

- Focused exec-server registration and harness-key validation tests: 2
passed.
- `cargo check -p codex-core-api`

The full `codex-exec-server` suite compiled and ran 254 tests: 222
passed, while 32 existing filesystem sandbox tests could not run under
the nested macOS sandbox (`sandbox_apply: Operation not permitted`).

Co-authored-by: Codex <noreply@openai.com>

codex-rs/core-api/src/lib.rs

@@ -48,6 +48,10 @@ pub use codex_core::resolve_installation_id;
 pub use codex_core::skills::SkillsService;
 pub use codex_core::thread_store_from_config;
 pub use codex_exec_server::EnvironmentManager;
+pub use codex_exec_server::EnvironmentRegistryHarnessKeyValidationRequest;
+pub use codex_exec_server::EnvironmentRegistryHarnessKeyValidationResponse;
+pub use codex_exec_server::EnvironmentRegistryRegistrationRequest;
+pub use codex_exec_server::EnvironmentRegistryRegistrationResponse;
 pub use codex_exec_server::ExecServerError;
 pub use codex_exec_server::ExecServerRuntimePaths;
 pub use codex_exec_server::NoiseChannelIdentity;

codex-rs/exec-server/src/environment_registry.rs

@@ -0,0 +1,34 @@
+use serde::Deserialize;
+use serde::Serialize;
+
+use crate::NoiseChannelPublicKey;
+
+/// Request body for registering an executor with the environment registry.
+#[derive(Clone, Deserialize, Eq, PartialEq, Serialize)]
+pub struct EnvironmentRegistryRegistrationRequest {
+    pub security_profile: String,
+    pub executor_public_key: NoiseChannelPublicKey,
+}
+
+/// Environment registry response returned after executor registration.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct EnvironmentRegistryRegistrationResponse {
+    pub environment_id: String,
+    pub url: String,
+    pub security_profile: String,
+    pub executor_registration_id: String,
+}
+
+/// Request body for authorizing a harness key with the environment registry.
+#[derive(Clone, Deserialize, Eq, PartialEq, Serialize)]
+pub struct EnvironmentRegistryHarnessKeyValidationRequest {
+    pub executor_registration_id: String,
+    pub harness_public_key: NoiseChannelPublicKey,
+    pub harness_key_authorization: String,
+}
+
+/// Environment registry response returned after harness key validation.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct EnvironmentRegistryHarnessKeyValidationResponse {
+    pub valid: bool,
+}

codex-rs/exec-server/src/lib.rs

@@ -4,6 +4,7 @@ mod client_transport;
 mod connection;
 mod environment;
 mod environment_provider;
+mod environment_registry;
 mod environment_toml;
 mod file_read;
 mod fs_helper;
@@ -56,6 +57,10 @@ pub use environment::REMOTE_ENVIRONMENT_ID;
 pub use environment_provider::DefaultEnvironmentProvider;
 pub use environment_provider::EnvironmentProvider;
 pub use environment_provider::EnvironmentProviderFuture;
+pub use environment_registry::EnvironmentRegistryHarnessKeyValidationRequest;
+pub use environment_registry::EnvironmentRegistryHarnessKeyValidationResponse;
+pub use environment_registry::EnvironmentRegistryRegistrationRequest;
+pub use environment_registry::EnvironmentRegistryRegistrationResponse;
 pub use fs_helper::CODEX_FS_HELPER_ARG1;
 pub use fs_helper_main::main as run_fs_helper_main;
 pub use local_file_system::LOCAL_FS;

codex-rs/exec-server/src/remote.rs

@@ -3,7 +3,6 @@ use std::time::Duration;
 use codex_api::SharedAuthProvider;
 use reqwest::StatusCode;
 use serde::Deserialize;
-use serde::Serialize;
 use tokio::time::sleep;
 use tokio_tungstenite::connect_async_with_config;
 use tracing::debug;
@@ -12,6 +11,10 @@ use tracing::warn;
 
 use codex_utils_rustls_provider::ensure_rustls_crypto_provider;
 
+use crate::EnvironmentRegistryHarnessKeyValidationRequest;
+use crate::EnvironmentRegistryHarnessKeyValidationResponse;
+use crate::EnvironmentRegistryRegistrationRequest;
+use crate::EnvironmentRegistryRegistrationResponse;
 use crate::ExecServerError;
 use crate::ExecServerRuntimePaths;
 use crate::NoiseChannelIdentity;
@@ -67,8 +70,8 @@ impl EnvironmentRegistryClient {
             ))
             .headers(self.auth_provider.to_auth_headers())
             .json(&EnvironmentRegistryRegistrationRequest {
-                security_profile: NOISE_RELAY_SECURITY_PROFILE,
-                executor_public_key,
+                security_profile: NOISE_RELAY_SECURITY_PROFILE.to_string(),
+                executor_public_key: executor_public_key.clone(),
             })
             .send()
             .await?;
@@ -120,32 +123,6 @@ impl EnvironmentRegistryClient {
     }
 }
 
-#[derive(Serialize)]
-struct EnvironmentRegistryRegistrationRequest<'a> {
-    security_profile: &'static str,
-    executor_public_key: &'a NoiseChannelPublicKey,
-}
-
-#[derive(Debug, Clone, Eq, PartialEq, Deserialize)]
-struct EnvironmentRegistryRegistrationResponse {
-    environment_id: String,
-    url: String,
-    security_profile: String,
-    executor_registration_id: String,
-}
-
-#[derive(Serialize)]
-struct EnvironmentRegistryHarnessKeyValidationRequest<'a> {
-    executor_registration_id: &'a str,
-    harness_public_key: &'a NoiseChannelPublicKey,
-    harness_key_authorization: &'a str,
-}
-
-#[derive(Deserialize)]
-struct EnvironmentRegistryHarnessKeyValidationResponse {
-    valid: bool,
-}
-
 #[derive(Clone)]
 struct RegistryHarnessKeyValidator {
     client: EnvironmentRegistryClient,
@@ -172,9 +149,9 @@ impl HarnessKeyValidator for RegistryHarnessKeyValidator {
             ))
             .headers(self.client.auth_provider.to_auth_headers())
             .json(&EnvironmentRegistryHarnessKeyValidationRequest {
-                executor_registration_id: &self.executor_registration_id,
-                harness_public_key,
-                harness_key_authorization: authorization,
+                executor_registration_id: self.executor_registration_id.clone(),
+                harness_public_key: harness_public_key.clone(),
+                harness_key_authorization: authorization.to_string(),
             })
             .send()
             .await?;