Finding / codex
2026-10-24-codex-local-aws-masking-and-signing-configuration-are-still-main-only
Local AWS masking and signing configuration are still main-only. The main-only patch exposes AWS signing actions in configuration and supplies local managed commands and snapshots with masked credentials. It requires credential_masking, rejects overlapping real/placeholder pairs and multiple signing actions per hook, and sets the proxy CA bundle when needed. Alpha.1 contains the signing primitive but not this wiring.
Channel: main-unreleased. Half: capability. Date: 2026-10-23.
Operator consequence: Wait for a containing release before planning native local AWS secret isolation. Test actual environment/snapshot delivery and signing together; generic stable masking and preview proxy signing are insufficient receipts for the combined path.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-codex-local-aws-masking-and-signing-configuration-are-still-main-only
Source links
Primary links, including exact changelog lines when available.