# Slice 3 Manual Verification

Run one step at a time against `http://localhost:3000/`. Use a disposable project or avoid saving changes to an existing project. Do not use real credentials; use the example values below.

## Step 1 — Secret lifecycle and browser exposure

1. Open **Actions & Bindings** and locate **Secrets**.
2. Create a Bearer token secret named `Manual Bearer` with token `manual-bearer-value`.
3. Confirm the saved record shows only its name, authentication type, opaque ID, and lifecycle controls—not the token.
4. Confirm the token input was masked while entering it and cleared after creation.
5. Click **Replace value**, enter `manual-bearer-replaced`, and confirm the old or new token is not displayed afterward.

Expected: credential entry is masked, create/replace succeeds, and stored values are never redisplayed.

## Step 2 — Compatible selection and canonical isolation

1. Create one secret for each remaining mode using disposable values: Basic, API-key header, and API-key query.
2. Edit a REST action and select each authentication mode in turn.
3. Confirm **Stored secret** offers only secrets matching the selected mode.
4. Select `Manual Bearer` for Bearer mode.
5. Inspect canonical JSON and confirm the action contains `authenticationType: "bearerToken"` and an opaque `secretReferenceId` only.
6. Confirm canonical JSON contains none of the usernames, passwords, tokens, API-key names, or API-key values entered above.

Expected: guided choices are type-compatible and canonical state contains only the opaque reference.

## Step 3 — Execution and redaction

1. Configure the referenced action as `GET https://httpbingo.org/anything`.
2. Use **Test Action** or Preview execution.
3. Confirm HTTP 200.
4. Inspect the response and confirm the reflected Authorization value is `[REDACTED]`, with neither Bearer token value present.
5. Repeat proportionally with API-key header and query secrets. Confirm reflected values and the query-bearing reflected URL contain `[REDACTED]`.

Expected: all credential modes execute server-side and no stored value returns to the browser.

## Step 4 — Failure safety and deletion protection

1. With an action still referencing `Manual Bearer`, try deleting that secret.
2. Confirm deletion is blocked and names the referencing action.
3. Change the action to Anonymous, which clears the secret reference.
4. Delete `Manual Bearer` and confirm it disappears.
5. Delete all other disposable secrets.
6. Select a protected mode without a secret and confirm the diagnostic requests a server-side secret reference; execution must fail clearly rather than execute anonymously.

Expected: referenced deletion is blocked, unreferenced deletion succeeds, missing credentials fail safely, and no protected action silently executes anonymously.

## Completion gate

Record each step as PASS or FAIL with observed behavior. Do not save disposable secret references into a valued project. If all four steps pass, reconcile final Slice 3 evidence and request explicit Slice 3 sign-off.