[markstuart-oai]

A bare workload-identity or Bedrock client could attempt a beta Realtime handshake without applying its configured authentication. Reject those unsupported profiles locally before credential refresh or connection, and enforce the documented X.509 WebSocket exclusion.

Preserve explicit Authorization settings for other clients, including default and connection headers, case-insensitive overrides, and removal with omit. Document this compatibility boundary without adding provider token exchange or signing.

Validation:

• Before the change: 8 refusal cases failed and 16 explicit-header compatibility cases passed.
• After the change: all 24 profile tests passed.
• All 74 focused tests passed, including existing beta Azure and redirect controls; the same 74 passed against a locally built, non-editable wheel.
• Ruff formatting, lint, and diff checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T04:42:26.996045Z	a78f9cd	PR opened
🔒 Security Review	✅ Completed 2026-10-31T04:43:20.697623Z	a78f9cd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[jbeckwith-oai]

Reviewed exact commit 2669ef6. The sync/async beta preflight rejects unsupported implicit provider credentials before connection setup, keeps X.509 blocked, and preserves caller-owned authorization and case-insensitive omission/override behavior. Coordinator and independent static review found no actionable issues. Hosted checks are successful or explicitly skipped. No candidate code or tests executed.