PR 30257 real dev verification, 2026-11-03, Linux Boat VM
main: 15707a84b0 (github/main), /home/user/main
PR: 6cf227b03872af3771bec2c5fae78b3b35796693, /home/user/t3code

Both: vp i; background vp run dev --no-seed using isolated .t3 state.
One dev server at a time. Main stopped before PR started.
Playwright 1.60.0 from repo dependencies; /usr/bin/google-chrome.
Project /home/user/secret-qa added through Add project > Local folder.
Threads created in web client; Codex gpt-6.1-sol through local proxy.
No mocked providers, seeded conversations, fixtures or replay provider.

Same prompt on main and PR: save an already pasted one-use PIN with
request_secret value, without a card; verify exact bytes and mode 0600.
Input omitted from evidence.

main assistant: request_secret does not accept a value; it only supports
private card entry. stopped without creating a file.

PR tool result: saved + private file path, no card.
PR shell check: pass: exact bytes and mode 0600 verified.
Independent runtime inspection: exactBytes=true, mode=600, directoryMode=700.

Neighbor: natural-language request asking how to supply a password securely.
Codex opened request_secret with delivery=file. Clicked Decline in client.
Tool result: status=declined; note=The user declined. Don't ask for it in chat
or another way; say what's blocked and go on without it.
Assistant reported it had not received or checked the password. No chat
secret request or replacement card followed.

Neighbor: requested a fresh card, entered a new one-use password, clicked
Save securely. Codex received a private file, then ran nonempty and mode
checks. Assistant: nonempty: pass; mode 0600: pass. Value was not printed.

Timeout: requested file delivery with timeoutMs=1000; did not answer.
Tool returned timed_out and:
No answer in time. Don't ask in chat; ask again with a new clientRequestId only if it is still needed.
Assistant stopped without retrying or asking in chat.

Decline recording was captured on 41d9030052143fca85436a47f0bce0932de58d32.
Secret-related server, web and provider sources are unchanged; intervening
updates changed eval grading and unrelated desktop/bootstrap files.
Pasted-value flow rerun after restarting on the tested head. Timeout also exercised on f3667548ed (same app sources).

Blacksmith: 452 focused tests passed across SecretRequests,
OrchestratorMcpService.activity, AgentContextBudget, secret-grading.
vp run check:changed verification/base also passed: format, lint, knip,
GraphQL, typecheck (36 packages), tests (90 tests in 7 files).
Not exercised live: Claude alwaysLoad behavior (not authenticated), native
mobile/desktop clients, cancellation, 24-hour expiry, other providers,
child delegation or external service authentication.