Codex 校核（2026-10-09） 官方 PR #26210确于6月5日合并，说明加密的是 v2 模型生成的代理指令；v1 保持原样，Codex 生成的完成/状态通知仍为明文。因此不能扩展成所有通信内容均不可见，也不能由该 PR 单独确认当前所有模型强制 v2 或无退出选项。#30867是发送路径重构，#30872增加 send/receive 生命周期、线程 ID、关联 ID 和 content 字段日志；字段存在不等于能还原加密指令。下文隐私/审计取舍是作者观点，“始终保留全部明文”也需结合敏感内容和访问控制决定。
Codex Encrypted MultiAgentV2 — Auditability Crisis
Rating: ⭐⭐⭐⭐⭐ (HN 91pts, GitHub 22 reactions, 6 comments + 5 issue comments)
What Happened
OpenAI merged PR #26210 into Codex CLI (2026-06-05) which encrypts MultiAgentV2 message payloads. The message parameter sent to models is now marked as encrypted; InterAgentCommunication.content is left empty, with data only in InterAgentCommunication.encrypted_content.
This was framed as “privacy hardening” but the community reaction reveals a deeper problem.
The Core Conflict
Privacy vs. Auditability in multi-agent systems:
| Aspect | Before | After (#26210) |
|---|---|---|
| Sub-agent task visibility | Human-readable in rollout history | Hidden behind ciphertext |
| Debugging parent-child messages | Inspectable | Impossible without provider-side access |
| Local trace reduction | Full context | Opaque |
| Opt-out possible | N/A | No — GPT-5.5 forces multi_agent_version: v2 |
Community Sentiment
“Guys, we don’t want to build Skynet and then be unable to audit what it’s doing.” — ignatremizov
“Please revert this! I need to be able to inspect those messages to debug my multi-agent workflows. Who thought this is a good idea???” — runfence
“The auditability concern is no longer meaningfully opt-in for GPT-5.5 users.” — Alek2077 (GPT-5.5 forces multi_agent_version: v2 in 0.142.5)
Relevance to Hermes Manas
This is directly relevant to how Manas communicates with Alaya/Anchor/Mano.
-
Hermes sub-agent communication (Manas → Alaya/Anchor/Mano): We use NATS (bc/dm/rpc) which is not encrypted by default. If we ever add encryption, we must preserve the audit trail. The Codex approach (removing human-readable content) is the WRONG pattern.
-
Lessons for gbrain: When storing inter-agent messages in gbrain, always keep the plaintext alongside any encrypted version.
-
Related PRs: #30867 and #30872 add structured lifecycle logging for multi-agent communication — a partial solution that logs events but not message content. Hermes should ensure its NATS message bus preserves enough context.
-
MCP context: The same tension applies to MCP tool calls — the user’s trace/debug surface should remain readable.
Action Items
- 🔴 P1: Review Hermes NATS messaging — ensure DM/RPC messages are logged with plaintext context (don’t repeat the Codex mistake)
- 🟡 P2: If adding encryption to Hermes agent communication, implement “audit-preserving encryption” where the human-readable content is stored alongside ciphertext
- 🟢 P3: Document in Hermes design principles: “encryption must not destroy auditability”