# Proof audit pass 1 — GitCafe stale checks

Scope: [#24406](https://git.cafe/pingdotgg/t3code/pulls/24406), mirrored as [#24406](https://github.com/pingdotgg/t3code/pull/24406). Read-only inspection of `/home/ubuntu/wt/pr-24406`, clean HEAD `f78d4efb83406ee495171e1252d176384a5aa582`; complete four-file diff against mergebase `6e792117436662208bf2b6eb71ee8d0d88817e43`. No repo edits, server, browser, comments, push, or watch. Dispatcher reports 49 passing tests, both regressions failing on main, and two round-2 MERGE reviews; those results are supplied evidence, not independently rerun in this pass.

## Fixture matrix derived from the complete diff

Each ordered run is a decoded GitCafe item with decimal string `id`, provider, githubApp, name, status, conclusion, summary and detailsUrl. Unless stated otherwise use one provider/app/name, completed runs, null metadata and a fully read listing (`next:null`). For provider cases assert both returned check rows and `checksState` (including property omission). Vary only the dimensions below; UI widths/themes/clients are equivalent because this change is server-only with no visible surface per dispatcher.

| ID | Minimal input / interaction | Required result | Existing proof / bounded gap |
| --- | --- | --- | --- |
| R1 | Same check: older failure `99`, newer success `100`; repeat in reverse response order. Also older cancelled → newer success. Status counts still report one failure. | Only newest success retained; complete-detail state passing. Before: stale row retained and aggregate failing. | Added JSON test covers failure→success with 99/100; added adapter test covers reverse order with real-shaped IDs and stale counts. Cancelled→success is same replacement path but needs runtime transcript representative of incident. |
| R2 | Older success `100`, newest failure `101`, either order. | Keep failure; failing aggregate. | JSON test covers replacement; aggregate failure precedence not directly asserted by new test. |
| R3 | Older failure → newer queued/in_progress; and older failure → newer action_required. | Newest row pending/action-required; aggregate pending even if stale counts failing. | New aggregate branches lack direct assertions. Queued/in_progress are equivalent after mapping. |
| R4 | Same name, app A failure and app B success; separately same app/name but different provider. Different names remain independent. | Both rows survive; any failure makes aggregate failing. | App separation tested. Provider separation follows new key but unasserted. Different-name mapping covered by adjusted existing fixture (Build/Lint). |
| R5 | Same key with `status:2` failure and `status:1` success; missing/null/nondecimal ID variants; mixed ordered and unorderable records. | Unorderable rows all retained; failure never hidden. Numeric row cannot suppress unorderable row. | `status:` pair tested. Missing IDs already used by mapping fixture; mixed ordered/unorderable not directly asserted. Missing/null are equivalent absence; nondecimal IDs are equivalent unordered values. |
| R6 | Decimal IDs beyond JS safe integer precision; equal decimal IDs with conflicting results; optional provider/app omitted versus null. | BigInt comparison chooses true larger ID. Equal IDs keep first encountered row (implementation behavior; API should not give conflicting duplicate IDs). Null/absent identity fields group together. | BigInt and normalized keys inspected, not directly tested. Equal-ID conflict is a bounded upstream assumption, not promised ordering. |
| A1 | Complete list has failure/cancelled plus pending/success; then pending/action-required plus success. | failing wins; otherwise pending wins. | New `checksStateOf` policy; existing mapping tests do not prove aggregation. Collapse failure/cancelled and pending/action-required as policy classes, retaining one assertion per member if expanded into a driver. |
| A2 | Complete list success with neutral/skipped; empty list; only neutral/skipped. Supply contradictory nonzero status counts to prove source selection. | success-containing list passing; empty or neutral/skipped-only omits state. Counts ignored for complete listing. | Success case proved by new adapter test; empty and neutral-only state policy unasserted. Verify intentional omission rather than assume neutral means passing. |
| P1 | Two pages: newest success on one page, older failure on another, final cursor null. | Collapse across page boundaries; passing state from all gathered rows. | Real readPages accumulates before normalization; cross-page completion unasserted. |
| P2 | Cursor stays non-null at ten-page limit, visible rows look passing, server counts failing. Also repeated cursor or empty page with non-null cursor. | Returned rows normalized, aggregate uses status counts and remains failing. | Ten-page case asserted in added adapter test. Other termination modes share same `next !== null` selector, so collapse into one extra representative if desired. |
| P3 | Truncated listing with counts: total 0; nonzero total with failing+pending; pending only; neither. | Respectively omit state, failing, pending, passing. | Failing fallback tested; other branches unchanged from base but selected by new completeness logic. One parameterized fallback table suffices. |
| P4 | Pull headOid null, with same four counts combinations as P3. | No commit-checks request; empty rows; count-based state as P3. | Existing no-head fixtures exercise reads but do not assert check state. Relevant because `checks === null` explicitly selects fallback. Reuse P3 table; one no-head trace proves routing. |

Non-goals: provider adapters other than GitCafe, wire contracts, mergeability, permissions, reviewers, labels, line statistics, and entry points were not changed. They need no separate visual/client matrix. Network/decode errors remain failures rather than being converted to successful empty lists; no new recovery branch was introduced.

## Minimum before/after runtime evidence

A short text transcript replaces time-interaction recordings under the dispatcher's explicit server-only exception. No UI capture needed. Minimum useful artifact:

1. Exact base and candidate SHAs, command, exit code, test names, and output showing both added regressions fail on base and pass on candidate, plus candidate focused suite summary. Existing reported 49 passes are not a substitute for attaching the output.
2. Sanitized GitCafe response fixture for one PR: `GET /repos/<owner>/<repo>/pulls/<n>` with its head, `/status` with stale failing counts, and `GET /repos/<owner>/<repo>/commits/<head>/checks` containing an old cancelled (or incident-shaped failure) and newer passing rerun, including IDs/provider/app/name and final cursor. Capture every checks page if paginated. Keep fixture fixed between base and candidate.
3. Run that exact fixture through the real `GitCafePullRequestProvider.make` → `getChangeRequest` on both versions, printing compact JSON `{checks:[{name,status}],checksState}`. Expected before: old cancelled/failure plus success, state failing. Expected after: only latest success, state passing. Label these as expected until actual output is captured.
4. One negative control through the candidate: newer failure must remain failing; one incomplete-list control must remain failing via counts. Compact rows in the same transcript suffice. No recording, sleeps, live rerun, or server required.

### Reproduce through the real adapter

Use the existing `fakeGitCafe` HTTP boundary and `detailWith` pattern in `GitCafePullRequestProvider.test.ts`: it supplies real GitCafeApi/credentials layers and substitutes only HttpClient; it calls the production provider, not a copy of the dedup algorithm. Put a standalone fixture/driver in a disposable external harness or another explicitly authorized writable checkout; do not add it to this read-only worktree. Replay the captured GET response bodies, call `GitCafePullRequestProvider.make` and `getChangeRequest({cwd,host,repository,number})`, and emit only sanitized result JSON. Provide pull, status, checks, reviewers, labels and changes routes as in the existing fixture (changes can be empty). For truncated control return incrementing non-null `next` for ten pages. For no-head return null headOid and assert no checks endpoint access.

Run focused suites in a writable harness/checkouts with the root Vite configuration, e.g. `vp test run packages/source-control-gitcafe/src/server/gitCafePullRequestJson.test.ts packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.test.ts`. To demonstrate base failure, apply only the added regression tests to a disposable base checkout; running unmodified base tests cannot demonstrate the new regression. Do not mutate the audited worktree. For a live read-only adapter run instead, supply normal production host/credential/HTTP layers and invoke the same provider method against the captured PR; a CLI checks JSON alone proves upstream input, not adapter output. Never print tokens. No forge CLI was needed for this audit.

The actual sanitized fixture/driver and runtime transcript must be uploaded separately from this matrix. This pass creates neither simulated runtime output nor a claim that live adapter reproduction occurred.

## Bounded proof gaps

The complete diff is covered by the matrix. Existing new tests prove the principal rerun regression and conservative truncation policy. Remaining useful proof is a real adapter before/after transcript, explicit aggregate policy assertions (pending/action-required/cancelled/empty/neutral-only), and fallback/no-head checks; provider identity, cross-page ordering and very large IDs are small boundary checks. These are evidence gaps, not independently demonstrated bugs. Equal-ID conflicting results remain an upstream data assumption. This audit did not re-review bot state or rerun tests, per read-only proof scope.

FRICTION category|happened|prevention
Evidence provenance|49 passing tests and base failures were supplied, with no transcript inspected in this pass|Attach exact focused test output and sanitized real-adapter replay separately; keep expected and observed output labeled.
Scope|Read-only worktree prevents creating fixture tests there|Use an external disposable harness or authorized writable checkout; upload driver separately.

Verdict: PASS1 matrix complete; runtime proof remains bounded to the artifacts specified above. No independent merge verdict is issued by this proof-only audit.