verification: github PR pingdotgg/t3code#25291
main: 32ecd71726 (github/main at verification)
pr head: ce4a27e101bca153208ceb90005cf9876fc71640

Both checkouts installed with vp i and ran vp run dev in the background.
Main stopped before PR server started. Separate .t3 homes, no seeded data.
Playwright + /usr/bin/google-chrome created a project pointing to a real
repository (/home/user/webhook-verification) and created the webhook task
through Settings > Scheduled Tasks > New task in each running app.
Task: head-probe-verification; workspace: project checkout;
provider: Codex; model: gpt-6.1-sol.
Prompt: Reply with exactly WEBHOOK_VERIFIED. Do not use tools or change files.

Webhook URL tokens omitted from this transcript.

MAIN server 16733, web 8693
$ curl --max-time 20 -sS -I "$MAIN_WEBHOOK_URL"
HTTP/1.1 202 Accepted
Vary: Accept-Encoding, Origin
x-t3-hook-outcome: accepted
content-type: application/json
content-length: 62
access-control-allow-credentials: true
date: Fri, 30 Oct 2026 09:41:13 GMT
connection: close

Observed in app: delivery marked Ran, method HEAD; task succeeded.
Opened its real Codex thread: assistant replied WEBHOOK_VERIFIED.

PR server 13773, web 5733
$ curl --max-time 20 -sS -I "$PR_WEBHOOK_URL"
HTTP/1.1 405 Method Not Allowed
Vary: Accept-Encoding, Origin
allow: GET, POST, PUT, PATCH
x-t3-hook-outcome: method_not_allowed
content-type: application/json
content-length: 30
access-control-allow-credentials: true
date: Fri, 30 Oct 2026 09:45:11 GMT
connection: close

Observed in app: No requests yet; no new thread. Repeated HEAD also 405.

$ curl --max-time 20 -sS -D - "$PR_WEBHOOK_URL"
HTTP/1.1 202 Accepted
Vary: Accept-Encoding, Origin
x-t3-hook-outcome: accepted
content-type: application/json
content-length: 62
access-control-allow-credentials: true
date: Fri, 30 Oct 2026 09:46:31 GMT
connection: close

{"deliveryId":"delivery:17603b4f-0d03-4cfe-b0a0-e4de07ca44ad"}
Observed in app: GET delivery marked Ran; task succeeded.
Opened its real Codex thread: assistant replied WEBHOOK_VERIFIED.

$ curl --max-time 20 -sS -X POST -H "Content-Type: application/json" -d "{\"probe\":\"neighbor-post\"}" -D - "$PR_WEBHOOK_URL"
HTTP/1.1 202 Accepted
Vary: Accept-Encoding, Origin
x-t3-hook-outcome: accepted
content-type: application/json
content-length: 62
access-control-allow-credentials: true
date: Fri, 30 Oct 2026 09:47:04 GMT
connection: close

{"deliveryId":"delivery:ec3235c8-10aa-4130-889a-03be398eda1b"}
Observed in app: POST delivery marked Ran; JSON body retained; task succeeded.
Opened its separate Codex thread: assistant replied WEBHOOK_VERIFIED.
Delivery list contains only GET and POST, no HEAD.

$ curl --max-time 20 -sS -X POST -D - "${PR_WEBHOOK_URL}-invalid"
HTTP/1.1 404 Not Found
Vary: Accept-Encoding, Origin
x-t3-hook-outcome: not_found
content-type: application/json
content-length: 26
access-control-allow-credentials: true
date: Fri, 30 Oct 2026 09:47:04 GMT
connection: close

{"error":"hook_not_found"}
No extra delivery or thread from the invalid token.

Blacksmith: vp test run apps/server/src/scheduledTasks/webhookRoute.test.ts
1 test file passed; 6 tests passed.
Existing head CI: 28 successful, 0 failing, 0 pending at inspection.
No source changes or pushes were needed.

Not verified: relay/T3 Connect, external LAN/Tailscale ingress, PUT/PATCH,
HMAC signatures, native desktop/iOS/Android, other providers. This pass
exercised the actual direct HTTP handler and Linux web client with Codex.
Video is edited to remove navigation/loading gaps; it is not a timing benchmark.