The iOS and desktop app jobs saved their stopped test backend (server keys and databases) as a public artifact, so that the Claude job could restart it with the same addresses: anyone signed in to GitHub could download it for a day and act as the test directory or relay while the Claude job ran.
backend-state.sh now packs it as CMS AuthEnvelopedData (AES-256-GCM, RSA-OAEP key transport) to the committed backend-state.crt; the Claude job decrypts it with the environment secret BACKEND_STATE_KEY, given only to that step, so the backend it restarts and the Claude session don't inherit it. Without the secret the Claude job stops at that step, before the Claude session.
spacedandy-agents-simplex