PR 29580 real environment verification
Main: github/main 30084f0018
PR: e64dde9b2fe440a80d975bb3cef5d302850835ac
Linux, Chrome via repository Playwright, real Codex gpt-6.1-sol through local proxy.
Project and repository created through app. All data changes made by real provider turns.
No mocks, fixtures, demo data or changes to PR source.
A transparent Codex launcher recorded stdin and forwarded it unchanged to the installed Codex CLI.

MAIN: clicked Commit in web client with Repository conventions style.
Captured provider input:
Recent commit subjects from this repository:
No signature
docs: explain signature verification
Initial commit
Result: signed b1b0e2d docs: describe pull request summaries

PR: clicked Commit with identical staged README patch and same initial history.
Captured provider input:
Recent commit subjects from this repository:
docs: explain signature verification
Initial commit
Result: signed 676d246 docs: describe pull request summaries
Working tree clean. gpgsig SSH SIGNATURE present.

MAIN: running server git.runStackedAction create_pr, local tracking branches, no remote.
Captured provider input:
Commits:
0a7d23b No signature
docs: clarify signed history

PR: same RPC, same commit and range.
Captured provider input:
Commits:
0a7d23b docs: clarify signed history
Real Codex response:
{"title":"docs: clarify signed history","body":"## Summary\n- Document that signed history remains readable.\n\n## Testing\n- Not run (documentation-only change)."}
Server progress: Generating change request content -> Creating change request.
Publishing failed as expected: No unknown source control provider is registered.
No external PR created or modified by these generation calls.

NEIGHBOR: configured allowedSignersFile through a real app Codex turn.
git log --oneline -1:
0a7d23b Good "git" signature for verification@example.com with ED25519 key SHA256:I67yy65J+ZeAopzNGMVTIx4oIgltZIWT23B/sRxrL5w
docs: clarify signed history
Repeated PR generation: provider prompt byte-identical to PR result above, no signature text.

NEIGHBOR: web Git action options -> Commit, supplied subject and body.
git log --no-show-signature -1 --format="%h %s%n%b":
a2c0026 docs: preserve manual commit messages
Keep the caller-provided body unchanged.
Working tree clean; signed commit; no new text generation invocation.

Blacksmith focused existing regression tests:
vp test run apps/server/src/git/GitManager.test.ts apps/server/src/vcs/GitVcsDriverCore.test.ts -t "keeps signature output out of recent commit subjects|reads range patches from source without textconv or signature output"
2 files passed, 2 tests passed, 338 filtered out.
GitCafe reported 31 successful checks, 0 failing, 0 pending for e64dde9.

Not verified: actual hosted PR publication, native desktop/mobile, macOS/Windows, other providers, remote relay/tunnel.