Best possible solution:

Close this PR and keep review focused on #96661, which addresses the same bug at the CLI preflight boundary with positive real behavior proof.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: queued replies request agent-runtime targets that include model-provider credentials, and current main only skips the gateway RPC for gateway credential exec refs. I did not run a live gateway reply turn in this read-only review.

Is this the best way to solve the issue?

No for this branch: the superseding CLI preflight approach is safer because it avoids the expected failing RPC before crossing the gateway protocol boundary, while this PR changes runtime secrets.resolve partial-success semantics.

Security review:

Security review cleared: No concrete security or supply-chain defect was found; the credential-routing behavior change is captured as compatibility/auth-provider merge risk.

AGENTS.md: found and applied where relevant.

What I checked:

• Current reply path: Queued replies call resolveCommandSecretRefsViaGateway with getAgentRuntimeCommandSecretTargetIds(), and those targets include model-provider credential paths such as models.providers.*.apiKey. (src/auto-reply/reply/agent-runner-utils.ts:77, 448b7c75b669)
• Current gateway behavior: Current main still only skips the gateway RPC for gateway credential exec refs, otherwise calls secrets.resolve and falls back locally after gateway failure. (src/cli/command-secret-gateway.ts:938, 448b7c75b669)
• Protocol compatibility surface: The secrets.resolve response schema has assignments, diagnostics, and inactive paths, but no explicit unresolved-target field; changing unresolved exec targets into success-with-missing-assignments relies on CLI re-analysis rather than the protocol contract. (packages/gateway-protocol/src/schema/secrets.ts:49, 448b7c75b669)
• This PR diff: The PR adds a runtime-side branch that treats unresolved exec SecretRef paths as non-fatal and returns the assignments already proven from the active snapshot. (src/secrets/runtime-command-secrets.ts:602, 15d448772b01)
• Superseding PR viability: fix(gateway): skip secrets.resolve when target SecretRefs use exec providers #96661 is open, mergeable, clean, labeled proof: sufficient, and targets the same linked bug with CLI preflight skip behavior plus real dist-bundle proof in the PR body. (d82e2f071c20)
• Superseding PR diff: The replacement PR changes the CLI command-secret gateway preflight to collect active exec target paths and skip the gateway RPC before the protocol boundary, preserving inactive-target and no-local-exec safeguards. (src/cli/command-secret-gateway.ts:979, d82e2f071c20)

Likely related people:

• joshavant: History shows broad SecretRef coverage and read-only command SecretRef hardening commits in the command-secret and target-registry area. (role: SecretRef feature-history contributor; confidence: high; commits: 806803b7efe2, a2cb81199e22, da34f81ce237; files: src/cli/command-secret-gateway.ts, src/secrets/target-registry-data.ts, src/cli/command-secret-targets.ts)
• Peter Steinberger: Recent history on src/cli/command-secret-gateway.ts includes several command-secret gateway and lower-reader refactors near this boundary. (role: recent command-secret contributor; confidence: medium; commits: 6a052ca4b827, 1a3f141215e2, 978a0a720e9b; files: src/cli/command-secret-gateway.ts)
• Vincent Koc: File history shows gateway and runtime seam refactors that affect the same command-secret and runtime snapshot boundary. (role: adjacent gateway/runtime contributor; confidence: medium; commits: 0f7d9c957093, 74e7b8d47b18, 3e4de956c068; files: src/cli/command-secret-gateway.ts, src/secrets/runtime-command-secrets.ts)

Codex review notes: model internal, reasoning high; reviewed against 448b7c75b669.