PR #23782 real dev environment verification
main: ce9e016406 (github/main)
PR: df3986420440ca217d584e2b9661e47a571d64dc
Linux; repo Playwright 1.60; /usr/bin/google-chrome; isolated T3 home; one dev server at a time.
vp i; setsid nohup timeout ... vp run dev (main then PR)
Created repo project and threads through the web UI; selected Codex gpt-6.1-sol.
Actual provider turn called orchestrator_capabilities and returned MCP_PROVIDER_OK on main and PR.
OAuth client: real registration -> browser read-only approval -> loopback callback -> PKCE token exchange (201 -> approval -> 200).

Observed HTTP/MCP outcomes (no mocks):
                                      main       PR
OAuth Bearer initialize/tools-list     200/200    200/200
OAuth bearer initialize               401        200 (tools/list 200)
OAuth bEaReR initialize               401        200 (tools/list 200)
Real provider Bearer initialize                   200 (tools/list 200)
Real provider bearer initialize                   200 (tools/list 200)
Real provider bEaReR initialize                   200 (tools/list 200)
Ordinary session HTTP Bearer           auth=true  auth=true
Ordinary session HTTP bearer/bEaReR     auth=false auth=true
WS Bearer upgrade                     101        101
WS bearer/bEaReR upgrade               401        101
MCP token at /api/auth/session         auth=false auth=false
Missing/Basic/empty/altered MCP token  401        401
OAuth real project-list via bEaReR                200, success=true
OAuth read-only thread rename                    capability_denied, no change
OAuth after UI revocation (all 3 schemes)         401
PR rejection reasons: missing_authorization_header, unsupported_scheme, missing_bearer_token, unknown_or_expired_token.
No OAuth/provider credential appeared in response headers/body or server logs.

blacksmith-check: vp run check:changed 955e2bfbb5c092c54ad795c8d379fec99702a6b5
PASS format, lint, knip, GraphQL validation, 3 package typechecks, 61 tests in 4 existing files.
CI observed: 29 successful, 0 failing, 0 pending.
No source changes or pushes needed.
Not exercised: native desktop/mobile, remote relay/T3 Connect, ChatGPT external connector, other providers, long-duration expiration.