model validate: transport-reachable preflight sends unresolved vault CEL expression as credential