0:00

Okay, this is the vault after the phase two switch-over. The personal side is still locked on the device, and nothing on this screen leaves the Mac.

0:41

Here's the agent credentials tab. When I flip "agents can use", the tool catalog injects it at call time. The pod never sees the secret itself.

1:52

Watch the audit line fill in as the worker calls GitHub. Every use is logged with the run id, so you can trace it back from the file it produced.

2:30

The org vault is folder based. View, use-by-agents, edit, manage. Same four levels as shared folders in Files, on purpose.

3:14

One thing I still don't like: the unlock prompt fires twice when two desktops are joined. That's the bug I'm filing after this.