Reload OTEL client certificates during long-running Codex sessions

What variant of Codex are you using?

CLI / app-server

What feature would you like to see?

Problem

Long-running Codex sessions can outlive short-lived client certificates used for OTLP export. An external service can renew the certificate and key at the same configured paths, but replacing those files does not update the identity already loaded into an exporter client.

This forces integrations to restart Codex, maintain custom reload patches, or run a local TLS proxy just to refresh telemetry credentials.

Requested behavior

Reload the client certificate and private key from the existing OTEL TLS paths while Codex remains running.

• Subsequent TLS handshakes should use the renewed identity without restarting Codex or resetting telemetry providers.
• Handle file replacement and separate certificate/key updates. An unreadable, incomplete, or invalid replacement must not replace the last successfully loaded identity or disable authentication.
• Recover when a valid replacement becomes available. Preserve in-flight exports and existing endpoint, header, timeout, and privacy settings.

OTLP/HTTP logs, traces, and metrics are the primary use case. Consistent gRPC behavior would also be useful, but can be a follow-up if it needs a separate implementation.

Scope

This is certificate consumption, not certificate renewal. Issuance, renewal scheduling, and CA rotation can stay out of scope. The existing certificate/key path settings should be sufficient; no general configuration-reload framework is needed.

Additional information

Source-reviewed against public main at 7498521d288b9b3b96ffba4eedf089d8d6e06a84 (2026-09-18):

• Client identity loading: https://github.com/openai/codex/blob/7498521d288b9b3b96ffba4eedf089d8d6e06a84/codex-rs/otel/src/otlp.rs#L121-L133
• Exporter client construction: https://github.com/openai/codex/blob/7498521d288b9b3b96ffba4eedf089d8d6e06a84/codex-rs/otel/src/provider.rs#L489-L496

Suggested validation (not run):

1. Start one Codex session with identity A and verify OTLP export.
2. Replace the configured files with identity B and force a fresh TLS connection; verify the collector observes B from the same session.
3. Verify export after A expires.
4. Exercise incomplete/invalid replacements, then restore valid material and verify recovery without an authentication downgrade.

Start with client identity loading in codex-rs/otel/src/otlp.rs lines 121-133 and exporter construction in codex-rs/otel/src/provider.rs lines 489-496. Validate a long-running session by replacing identity A with B and forcing a fresh TLS connection, then exercise invalid and incomplete replacements. Done means valid replacements are adopted without restart, invalid ones preserve the last working identity, and export recovers when valid files return.