[Linux][Remote Control] WebSocket repeatedly returns HTTP 503 upstream connection termination

What happened?

Codex Remote Control is enabled on a Linux host, but it cannot establish the Remote Control WebSocket connection. codex remote-control start --json consistently reports:

Error: Remote control is enabled on <HOSTNAME> but the connection is errored.

The Remote Control transport logs show repeated Connecting -> Errored transitions because the WebSocket endpoint returns HTTP 503 Service Unavailable:

websocket_url=wss://chatgpt.com/backend-api/wham/remote/control/server
error=failed to connect app-server remote control websocket:
HTTP error: 503 Service Unavailable
cf-ray: <REDACTED>-ATH
body: upstream connect error or disconnect/reset before headers.
reset reason: connection termination
error_kind=Other
has_enrollment=true
server_id=Some("<REDACTED>")
environment_id=Some("<REDACTED>")

This repeats indefinitely with exponential reconnect backoff up to 30s.

This appears distinct from #41121, where the Remote Control WebSocket is reached but authentication returns HTTP 403. Here, enrollment exists and the failure is an upstream 503 before the WebSocket handshake completes.

Environment

• Fedora 44.0.0, x86_64
• Codex CLI: 0.153.4
• Managed Codex: 0.153.4
• app-server: 0.153.4
• app-server daemon: running in persistent mode
• Auth mode: ChatGPT
• No proxy environment variables
• Remote Control enrollment already exists and is reused

codex doctor --all --ascii --no-color reports:

[ok] state        databases healthy
[ok] auth         auth is configured
[ok] app-server   running (persistent mode)
[ok] network      no proxy env vars
[!!] websocket    Responses WebSocket failed; HTTPS fallback may still work
    endpoint                 wss://chatgpt.com/backend-api/<redacted>
    DNS                      2 IPv4, 2 IPv6, first IPv4
    handshake transport error http 503 Service Unavailable:
      upstream connect error or disconnect/reset before headers.
      reset reason: connection termination
[ok] reachability active provider endpoints are reachable over HTTP

The separate Codex Responses WebSocket (wss://chatgpt.com/backend-api/codex/responses) is also returning the same class of HTTP 503 upstream error at the same time, while HTTPS reachability remains healthy.

Steps to reproduce

1. Have Remote Control already enabled/enrolled on the host.
2. Run:

codex remote-control stop
codex remote-control start

3. Observe:

Error: Remote control is enabled on <HOSTNAME> but the connection is errored.

4. Restart the persistent app-server daemon:

codex app-server daemon restart
sleep 3
codex app-server daemon version
codex remote-control start --json

5. The daemon restarts successfully and all component versions match, but Remote Control still reports connection is errored.

6. codex remote-control pair --json succeeds and returns a pairing code/environment ID, indicating that pairing RPC functionality is available.

7. Inspecting the Remote Control transport logs shows repeated HTTP 503 responses from:

wss://chatgpt.com/backend-api/wham/remote/control/server

with Cloudflare traffic terminating at the ATH POP and body:

upstream connect error or disconnect/reset before headers. reset reason: connection termination

Expected behavior

The enrolled app-server should establish the Remote Control WebSocket and become available for remote control.

Actual behavior

The Remote Control WebSocket repeatedly returns HTTP 503 and transitions from Connecting to Errored. Restarting the app-server daemon does not recover it.

Additional notes

• Enrollment is present (has_enrollment=true) and persisted enrollment is reused.
• Server token refresh is attempted normally.
• No 401, 403, or 409 is observed.
• State databases pass integrity checks.
• CLI, managed Codex, and app-server are all exactly 0.153.4.
• HTTPS provider endpoints remain reachable.
• Account ID, installation ID, server ID, environment ID, hostname, and full Cloudflare Ray IDs are intentionally redacted.

Start with codex remote-control start --json, codex doctor --all --ascii --no-color, and the Remote Control transport logs for wss://chatgpt.com/backend-api/wham/remote/control/server. Compare the repeated 503 behavior with the Responses WebSocket failure and successful HTTPS reachability. Done means the enrolled app-server establishes the Remote Control WebSocket instead of repeatedly entering the errored state.