diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 6d7e1de..7169c9f 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -17,9 +17,9 @@ jobs:
       BLOXWAP_E2E: '1'
       # This wallet and Privy app belong to disposable company CI, never users.
       BLOXWAP_TEST_ACCOUNT_ONLY: '1'
-      BLOXWAP_TEST_MASTER_KEY: ${{ secrets.BLOXWAP_TEST_MASTER_KEY }}
-      BLOXWAP_PRIVY_APP_ID: ${{ secrets.BLOXWAP_PRIVY_APP_ID }}
-      BLOXWAP_PRIVY_APP_SECRET: ${{ secrets.BLOXWAP_PRIVY_APP_SECRET }}
+      BLOXWAP_TEST_MASTER_KEY: ${{ secrets.AGENT_CLI_TEST_MASTER_KEY }}
+      BLOXWAP_PRIVY_APP_ID: ${{ secrets.AGENT_CLI_PRIVY_APP_ID }}
+      BLOXWAP_PRIVY_APP_SECRET: ${{ secrets.AGENT_CLI_PRIVY_APP_SECRET }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
diff --git a/docs/PROGRESS.md b/docs/PROGRESS.md
index 7fb74cd..a290644 100644
--- a/docs/PROGRESS.md
+++ b/docs/PROGRESS.md
@@ -82,5 +82,7 @@ This is release preparation; public npm installation is still pending.
 separate disposable CI signer, with fifteen evidence-checked stages, correlated
 events and interrupted-rotation cleanup. Runner shutdown is confirmed before
 journal export. Build, lint, typecheck, 229 offline CLI tests, docs checks and the
-static docs build pass. The `testnet` environment still needs QA configuration;
-no credentialed lifecycle or independent coding-agent session is claimed.
+static docs build pass. Nightly CI maps `AGENT_CLI_TEST_MASTER_KEY`, `AGENT_CLI_PRIVY_APP_ID` and
+`AGENT_CLI_PRIVY_APP_SECRET` from the `testnet` environment onto the harness
+`BLOXWAP_*` variables. Live journals and the independent coding-agent session
+are still not claimed.
diff --git a/docs/testnet.md b/docs/testnet.md
index e108546..3c630a6 100644
--- a/docs/testnet.md
+++ b/docs/testnet.md
@@ -70,11 +70,13 @@ disposable company test wallet and company QA Privy app:
 
 | Secret | Purpose |
 | --- | --- |
-| `BLOXWAP_TEST_MASTER_KEY` | CI-only signer for the disposable testnet account |
-| `BLOXWAP_PRIVY_APP_ID` | Dedicated test Privy app ID |
-| `BLOXWAP_PRIVY_APP_SECRET` | Dedicated test Privy app secret |
+| `AGENT_CLI_TEST_MASTER_KEY` | CI-only signer for the disposable testnet account |
+| `AGENT_CLI_PRIVY_APP_ID` | Dedicated test Privy app ID |
+| `AGENT_CLI_PRIVY_APP_SECRET` | Dedicated test Privy app secret |
 
-This mode requires `CI=true` or `CI=1`, both explicit test flags, and no external
+The workflow maps those GitHub secrets onto `BLOXWAP_TEST_MASTER_KEY`,
+`BLOXWAP_PRIVY_APP_ID` and `BLOXWAP_PRIVY_APP_SECRET` for the harness. This mode
+requires `CI=true` or `CI=1`, both explicit test flags, and no external
 signer variables. Its key is removed from CLI child process environments. It is
 not a production CLI key-import feature. Missing secrets fail the nightly job.