Joseph Doherty
2ad7213046
The cross-version matrix (#782) used a 55-char 'otua_matrix_' key, which stayed under SDK 2's 64-byte RsaEncryptedSecret threshold and hid #880. It now uses the ApiKeySecret.Generate shape (65 chars, random per run, never recorded). Every Shared leg adds production-length-API-key-wrong-secret-reaches-key-check, which must get BadIdentityTokenRejected rather than a format failure. SDK 2 clients also add sdk2-default-RsaEncryptedSecret-control, the negative control: the SDK's default handler must be refused with BadIdentityTokenInvalid by a 1.x server and admitted by an SDK 2 server. The runner passes the server SDK version from ready.json. Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi