[hhff]

What

• dashboard/index.html: an owner-action question that asks for secrets now has the note box every other card has, with a Reply button that sends the note as the answer and posts nothing. Can't right now sends Can't right now: <note> when a note is written. Drafts persist through redraws like other notes.

Why

The owner was asked to mint a production token, but the right move was to use a token already in the project's credentials, and the card had no way to say so: only Post and a fixed "Can't right now".

Authority

A Reply is an ordinary owner answer through the existing answer action. It is same-origin and Host-checked like every dashboard POST, and it posts no value anywhere. The supervisor reads it like any answer that isn't the recommendation, and it authorizes nothing by itself.

Checked

• A fixture dashboard rendered in headless Chrome: secret box, note box, then Post / Reply / Can't right now.
• A Reply through /api/answer recorded the note as the answer (channel: dashboard), with secrets_posted: [].

Migration

None. Restart the dashboard after the sync.

🤖 Generated with Claude Code

[hhff]

Review (upstream loop, author's own PR):

• Authority: a Reply is an ordinary owner answer through the existing answer action (same-origin, Host-checked). It posts no value and authorizes nothing by itself.
• Checked in headless Chrome: the card renders the secret box, then the note box, then Post / Reply / Can't right now. A Reply via /api/answer recorded the note (channel: dashboard, secrets_posted: []).
• Tests: CI 18/20/22/24 green. Local Node 24.14.1 47/47, 20.19.6 47/47. Local Node 18.20.4 failed only the two dashboard tests, with 'fetch failed' on the first request after a slow CLI step. That's the macOS + Node 18 failure that predates this PR: Node 18's fetch reuses an idle keep-alive socket just as the server's 5 s keepAliveTimeout closes it. The fix (a server keepAliveTimeout longer than any client's) is its own PR.