Vault phase 2 walkthrough

Okay, this is the vault after the phase two switch-over. The personal side is still locked on the device, and nothing on this screen leaves the Mac.

Here's the agent credentials tab. When I flip "agents can use", the tool catalog injects it at call time. The pod never sees the secret itself.

Watch the audit line fill in as the worker calls GitHub. Every use is logged with the run id, so you can trace it back from the file it produced.