APEX token secret moved from the source literal to configuration (Apex:JwtSecret / Apex__JwtSecret;
a random per-process key when unset). HR scenarios that compose the APEX URL, re-run 22 October 2026:

run_all.py ../scenarios/hr ../scenarios/hr/hr.map.yaml ../../docs/artifacts/hr-target/golden <out> --three \
    --waivers ../scenarios/hr/waivers.yaml --only console-apex,employees-apex      (no secret configured)
console-apex                     39         1      3      0        0       0  yes
employees-apex                  656         4     10      0        0       0  yes
clean (no defect, no harness entry, three runs identical): 2/2
All six diff.txt files byte-identical to docs/artifacts/hr-target/<scenario>/diff.txt.

The same two scenarios with a generated Apex__JwtSecret: clean 2/2, diff.txt byte-identical.
console-apex with Apex__JwtSecret=testkey-123: the token's HS256 signature verifies with that key.