PR 30805 real-dev verification, 2026-11-04, Linux Boat VM
Browser: repo Playwright 1.60.0 + /usr/bin/google-chrome
Provider: Codex gpt-6.1-sol through the local proxy, real app turns
Workspace: real git repository added using the app, fresh isolated server state

Before: github/main 9e85538535
Prompt: three OVH credentials copied as three lines, quickest private handoff.
Observed: one request_secret card labelled "OVH credentials (three lines)".
Browser input: INPUT; attempted 3 lines, retained 1 line.
Original PR head 3bad363c63: same bundled-card failure.

After: 73ee8b91cc4e2d37a67bc84e9c3643575356f718
Same prompt: 3 request_secret calls, delivery=file, separate labelled cards.
Clicked Save securely on each with task-only random values.
Agent then executed uv run --no-project --offline python, reading the three
returned paths with pathlib and reporting counts and stat.S_IMODE only.
Exit 0:
{"nonempty_values":3,"distinct_paths":3,"permission_modes":["0600","0600","0600"]}
No value printed and no external credential service contacted.

Neighbor: one backup API token -> one private card.
Empty Save securely disabled; Enter saved the value.
Agent shell: test -s <returned private file>; output: nonempty; exit 0.
Neighbor: deployment API token -> clicked Decline.
Card: Declined. Agent stopped without asking again or running a command.
Pending cards after decline: 0.

Blacksmith:
vp run check:changed 7f17f515389505a26fe2963e61905cc5d7417963
PASS format, lint, knip, GraphQL, typecheck (3 packages), 414 tests (3 files).
API-replay eval unavailable on worker: missing /home/runner/.codex/config.toml.