Clarify encrypted inter-agent messages in multi-agent v2

What version of Codex CLI is running?

codex-cli 0.153.4

What subscription do you have?

PRO and PLUS

Which model were you using?

astra

What platform is your computer?

Darwin 25.6.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

Ghostty

Codex doctor report

not required

What issue are you seeing?

While using Codex multi-agent v2 with Astra subagents, I see send_message calls targeting /root whose message argument contains an opaque gAAAA… payload, alongside normal plaintext messages and tool calls.

The client source marks v2 message parameters with .with_encrypted() and forwards the returned payload as EncryptedContent, without local decryption.

Please document:

• What these encrypted messages contain and why they are encrypted.
• Where encryption/decryption occurs and whether plaintext is available to users for auditing.
• How this processing relates to DPAs that some companies like mine have signed with OpenAI
• Whether older OpenAI models and third-party providers can participate in these conversations, and how plaintext interoperability is supported.

This makes agent communication difficult to audit and leaves mixed-model compatibility unclear. An explicit explanation of the design and its guarantees would help.

What steps can reproduce the bug?

See main description.

What is the expected behavior?

Transparency.

Additional information

No response

Start with the Codex CLI client source involved in multi-agent v2, especially send_message parameters, with_encrypted(), and EncryptedContent. Reproduce the described mixed plaintext and opaque payloads if needed, then trace the encryption and decryption boundaries. Done means documentation answers what is encrypted, where plaintext is available, how DPA questions apply, and how older or third-party models interoperate.