Why

codex exec-server should keep the existing public ws://IP:PORT URL shape while serving that websocket connection through an HTTP upgrade path internally. That keeps the client-facing configuration simple and allows the listener to work through intermediate HTTP-aware infrastructure.

What changed

• keep the emitted and configured exec-server URL as ws://IP:PORT
• serve that websocket endpoint through Axum HTTP upgrade handling on /
• expose GET /readyz from the same listener for readiness checks
• route upgraded Axum websocket streams through the shared JSON-RPC connection machinery
• initialize the rustls crypto provider before websocket client connections
• preserve inbound binary websocket JSON-RPC parsing for compatibility with the prior transport behavior

Verification

• cargo test -p codex-exec-server --test health --test process --test websocket --test initialize --test exec_process