Standalone reproduction using the official Windows x64 Codex app-server, synthetic external-auth JWTs, and a local HTTPS/SSE or WSS Responses stub. No real account credentials or model responses are needed. Each case has a separate home, configuration and SQLite directory. The temporary CA is trusted only by the spawned process, not installed in the system store.
The provider accepts a request as A, sends response.created, and holds the response open. The client then applies B with account/login/start. The active turn fails with Fatal error: application network permission was revoked before the provider releases its response. The next turn completes under B. The script checks actual provider credentials as well as RPC notifications.
Save all five gist files into a new test directory. Run these commands there in PowerShell with Node.js, npm, aria2c, tar and Git for Windows installed. The OpenSSL commands generate test-only keys local