PR #23313 real-dev verification, 2026-10-28
main: 36aea583bb (github/main)
PR: dcea23d66cd4833f381e6518578c0c7bef620471
Codex CLI: 0.164.0; model: gpt-6.1-sol; browser: /usr/bin/google-chrome via repo Playwright
Each checkout: timeout 600 vp i; background setsid nohup timeout ... vp run dev
main ports: 16733/8693; PR ports: 13773/5733; separate empty .t3 state; only one dev server at a time.
Project /home/user/credential-check was added through the client; all turns submitted through the composer.
Failure produced by real Codex using Settings > Providers > Codex > Launch arguments:
-c 'model_providers.cliproxyapi.env_key="client_secret=FAKE-client-secret-23313 refresh_token=FAKE-refresh-token-23313 token=FAKE-bare-token-23313 max_tokens=4096"'
This deliberately names a missing environment variable. No stub, replay, wrapper, or injected provider event.

main:
  persisted turn-item.updated: Missing environment variable: `client_secret=FAKE-client-secret-23313 refresh_token=FAKE-refresh-token-23313 token=[REDACTED] max_tokens=4096`.
  projection failure items: 1
pr:
  persisted turn-item.updated: Missing environment variable: `client_secret=[REDACTED] refresh_token=[REDACTED] token=[REDACTED] max_tokens=4096`.
  persisted turn-item.updated: Missing environment variable: `clientSecret: [REDACTED] X-Auth-Token: [REDACTED] {"client_secret":"[REDACTED]"} max_tokens=4096`.
  projection failure items: 2
PR orchestration_events rows containing FAKE-: 0
PR orchestration_v2_projection_turn_items rows containing FAKE-: 0
PR orchestration_v2_projection_provider_turns rows containing FAKE-: 0
PR orchestration_v2_projection_runs rows containing FAKE-: 0

Normal README-read turns completed on main and PR with the real local proxy.
After restoring launch arguments and restarting, a follow-up in the failed PR thread completed and returned README text.
Browser reload and server restart retained the redacted failure.
blacksmith-check run --id <task-box> "vp test run packages/provider-core/src/server/failure.test.ts"
Result: 1 file passed, 11 tests passed.
No source changes or commits made.
Observation: changing launch arguments with an existing main Codex session stalled a subsequent turn; restarting the task server allowed the failure to complete. All provider waits stayed below 10 minutes.
Not verified: native desktop/mobile, macOS/Windows, other providers, relay/tunnel, actual OAuth service rejection, failure-code redaction through a live provider (covered by existing unit test).