Clean feature with strong test coverage (16+ new test cases, ~2:1 test-to-code ratio). The conditional secret blocks, lifecycle bypass via SkipSecretRequirements, and the non-owner privacy boundary are all well designed. The integration test that creates a workspace, deletes the secret, then verifies start fails while stop/delete succeed is the anchor of the whole change.

One P2, six P3, one P4, three Nits.

The P2 is a contract violation: autostart runs under a subject that lacks user_secret:read, so the enforcement this PR promises ("enforces missing required secrets during workspace start") silently degrades for every auto-started workspace. Five reviewers independently traced the same call chain. The fix is one line in subjectAutostart's site permissions.

The SecretRequirementDoesNotBlockStopOrDelete test is "a genuine full-stack test. Real gem." (Bisky)

Design note: non-owner admin builds (CLI/API, no WebSocket preview) silently skip secret validation. This is deliberate (privacy boundary: admin can't read target user's secrets), but CLI callers get zero indication validation was skipped. If the workspace fails at terraform time, the error is opaque. This needs a human decision on whether to surface a warning in the build response for admin callers.

coderd/dynamicparameters/render.go:311

Nit [DEREM-14] The old code had a TODO about surfacing preview parser logs:

// Do not emit parser logs to coderd output logs.
// TODO: Returning this logs in the output would benefit the caller.

Behavior is unchanged (preview@v1.0.9 nil-defaults to discard), but the comment documented a deliberate design choice and a known improvement opportunity. Four reviewers noted the loss of context. (Gon, Mafuuu, Ryosuke, Razor)

🤖

🤖 This review was automatically generated with Coder Agents.