# Proof audit pass 1 for [#32950](https://git.cafe/pingdotgg/t3code/pull/32950)

## Findings

**One changed behavioral branch lacks a before/after runtime transcript: E7, managed npx/uvx executables found through a relative provider PATH entry.** The existing report expressly says E7 was not captured. Its registry fixture has a nonempty executable override, so it takes the override branch and never reaches `ensureGlobalPackage` or the changed `anchorToProcessCwd(installed.executablePath)` call. Local relative-command captures exercise a different call site. The E7 unit test injects executable resolution and asserts the returned path; it does not launch the resolved agent through the real server.

The [earlier fixture matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/16753aba18378783/evidence-matrix.md) explicitly accepted that unit test and called an E7 runtime capture optional. Thus this is **a gap against this pass's requested before/after runtime coverage**, not a contradiction of that earlier agreement or an identified implementation defect. If that earlier unit-only exception is intended to carry forward, all of its required POSIX runtime rows are satisfied, and no additional required capture is missing. This audit keeps that distinction visible instead of labeling the unit test a runtime transcript.

The raw evidence supports R1–R8 and E5, including actual repeated snapshot probes not separately excerpted in the report. All observed background processes move from H/1,666 watches to B/1; project thread and management processes remain P/5. Both watch counters agree. Both thread projections contain a completed run and the expected synthetic assistant reply. Terminal login has a distinct PTY PID and subsequent verification PID. All 34 agent spawns across both transcripts execute the same uploaded stub SHA-256, and their parent PIDs belong to the recorded source servers. No RPC error event occurs.

Native Windows rows are `cannot-verify windows`, as required by the brief. No Windows execution or Linux-to-Windows equivalence is claimed. Unchanged absolute-path and binary-install controls have no separate transcript; they are distinguished from E7's independent changed resolution branch below.

## Scope and provenance

Requested checkout: `/home/user/wt/pr-32950`; audited immutable local head [cb3c2692f5](https://git.cafe/pingdotgg/t3code/commit/cb3c2692f5340a2b9d960204a7d192dc726b4037). The local `origin/main` merge-base is [fa2f4ff2a2](https://git.cafe/pingdotgg/t3code/commit/fa2f4ff2a2bac5ac92e07749f6b83b0003d642a0). GitCafe currently reports pushed head [3a89d68c6f](https://git.cafe/pingdotgg/t3code/commit/3a89d68c6fccd84a3a26d3b866ade2b22ff65c43); the requested local head adds the user-docs clarification.

The [evidence report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9164ab9c6e91228f/evidence-report.md) records before [ca796d5211](https://git.cafe/pingdotgg/t3code/commit/ca796d52119592de771d8ccfa955d70dba84d11e) and after [db9f0faa91](https://git.cafe/pingdotgg/t3code/commit/db9f0faa91e4cfdd62af3ace9c2d42ffae517340). I independently compared the two changed production files: their captured after versions are byte-identical to the requested local head. The entire ACP Registry server directory is unchanged between the captured before revision and the current merge-base. These captures therefore remain relevant to this diff; no freshness-only recapture is requested.

Changed production sites:

- [driver.ts](https://git.cafe/pingdotgg/t3code/blob/cb3c2692f5340a2b9d960204a7d192dc726b4037/packages/provider-acp-registry/src/server/driver.ts#L515): create persistent B; feed it into the status-probe closure at line 613 and auth controller at line 806. Directory creation failures map to `ProviderDriverError` before driver construction completes; no permission-denied runtime fixture exists.
- [AcpRegistrySupport.ts](https://git.cafe/pingdotgg/t3code/blob/cb3c2692f5340a2b9d960204a7d192dc726b4037/packages/provider-acp-registry/src/server/AcpRegistrySupport.ts#L1705): POSIX absolute commands remain unchanged; relative commands receive the process-cwd prefix without lexical normalization; Windows uses `win32.resolve`. The helper is applied to local commands at line 1856, registry overrides at line 1886, and npx/uvx package executables at line 1897. Unoverridden binary installation is unchanged.

Reviewed the full changed source/test/docs diff and the auth, probe, management, adapter, shared executable resolver and WebSocket callers. No server or worktree was created, no checkout file was written, and no push or comment was made. No tests were rerun: this pass audits existing runtime proof. Files written by this auditor are confined to the allocated scratch directory.

## Evidence key

- **BT** = [before-runtime.ndjson](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5ccb4ab4c0e580d3/before-runtime.ndjson).
- **AT** = [after-runtime.ndjson](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2f881045ab63594c/after-runtime.ndjson).
- Line numbers below are one-based NDJSON lines, not source-code lines.
- H = synthetic server process cwd, containing 1,666 directories; P = synthetic project cwd, containing five directories; B = the appropriate fresh base's `userdata/acp-registry/background-cwd`.
- **Affected: yes** means a changed behavior or relocated spawn. **No-op** means changed code executes but that fixture's resolved absolute value is preserved. **Control** means the path itself is unchanged, though shared resolver anchoring can still apply.
- A shared factory is one runtime fixture; the matrix does not require a Cartesian product of every executable spelling and every caller.

## Row matrix

| Row / named fixture | Diff affects this row? | Paths, branches and callers collapsed into this fixture | Covered by existing evidence: yes/no, which file | Audit result |
| --- | --- | --- | --- | --- |
| R1a — startup probe and auth discovery | Yes: both cwd substitutions | Probe initializes and creates its test session; discovery initializes without creating a session. Both process cwd values must be B after. | **Yes — BT/AT L4–16**, report R1; distinct `t3-code-provider-test` and `t3-code-provider-auth` client names. | H/1,666 before; B/1 after. Probe session cwd matches process cwd. |
| R1b — repeated snapshot enrichment and method refresh | Yes: same captured cwd closures | Auth changes invalidate enrichment and refresh the snapshot; explicit refresh and TTL expiry reuse these factories. | **Yes — BT L43–50, L82–85; AT L43–50, L83–88** show new probe PIDs after auth changes. Auth discovery also repeats. | Repeated probes retain H before/B after and corresponding watch counts. A separate explicit-refresh RPC and 15-minute clock expiry were not executed; source shows no alternative cwd branch. |
| R2 — sign-in initialization, agent-managed auth and verification | Yes: auth controller cwd | `provider.auth.start` initializes the auth runtime, sends `authenticate`, then verifies with `session/new` in that same PID. Legacy env-var auth skips authenticate and shares this runtime/cwd. Terminal auth's preliminary ACP initialization shares this factory too. | **Yes — BT/AT L18–37**, report R2; preliminary terminal initialization L53–55. | Real-server agent sign-in succeeds on both sides; H/1,666 becomes B/1. Env-var auth was not separately selected; no separate cwd factory exists. |
| R3 — terminal login | Yes: auth controller cwd reaches PTY | Separate `PtyAdapter.spawn`, combining resolved args and terminal-method args. | **Yes — BT/AT L57–59**, report R3. | Actual PTY child receives both login flags, H/1,666 becomes B/1, and login exits 0. |
| R4 — post-terminal verification | Yes: auth controller cwd | Fresh ACP runtime after PTY exit, initialization and verification session. | **Yes — BT/AT L62–68**, report R4. | PID differs from PTY child; process/session cwd H becomes B; auth succeeds. |
| R5 — ordinary auth logout | Yes: auth controller cwd | `provider.auth.logout`; ordinary `server.logoutAcpRegistry` also routes through the controller. | **Yes — BT/AT L69–76**, report R5. | Fresh auth child sends `auth/logout`, receives success, RPC reports Signed out; H/1,666 becomes B/1. |
| R6 — directory creation and restart persistence | Yes: new recursive mkdir and persistent location | First startup creates B; stop/restart reuses it. Code does not clear files an arbitrary agent writes there. | **Yes — BT/AT L3, L143–161**, report R6. | Before B is absent; after B exists and is empty after stop, before restart and after second stop. Restart probes still run B/1. Error-mapping on failed mkdir is source-only, not an observed failure run. |
| R7 — project thread session and turn | Control: caller cwd preserved; shared resolve affects relative executable | Adapter resolves with `input.cwd`; runtime and session retain project P. | **Yes — BT/AT L94–140**, report R7. | Real RPC-created thread: process/session cwd=P, both counters=5, prompt returns end_turn, persisted run=completed. |
| R8 — session/provider management and fallback logout | Control: caller cwd preserved; shared resolve affects relative executable | List/delete sessions, list/set/disable providers and internal logout use the shared management runtime. WS project operations pass P; legacy logout fallback passes configured server cwd. | **Yes for shared factory — BT/AT L80–92**, report R8, via listSessions. | Management process/session cwd=P with five watches and valid empty list. Other methods were not individually invoked; their unchanged forwarding was inspected. Ordinary logout is R5, not this fallback. |
| E1 — local absolute command and bare name resolving absolute | No-op in anchoring; background cwd relocation covered by R1 | Local source: direct absolute executable or absolute executable returned from provider PATH. | **No separate transcript**; local absolute/bare-name unit controls in `AcpRegistrySupport.test.ts`; shared spawn proof R1. | Absolute executable value is unchanged; no independent changed behavioral branch to capture. |
| E2 — local relative commandPath and relative resolver output | Yes: local anchor call | Direct relative executable; a bare name found via relative provider PATH also returns a relative executable into this same local anchor. | **Yes for relative local executable — BT/AT L5–16**, plus uploaded before/after local settings. | Actual configured value is `../bin/stub-acp-agent.mjs`; successful child executes the identical stub from B after. A bare-name/relative-PATH spelling is not separately captured. |
| E3 — POSIX symlink followed by `..` | Yes: prefixing must preserve traversal; same local anchor as E2 | Relative `link/../agent` must keep components rather than normalize toward a decoy. Absolute forms remain unchanged. | **No transcript**; focused relative-symlink source test reads the selected target; R1/E2 exercise the common prefix-and-spawn path. | No separate runtime branch: POSIX helper concatenates components unchanged. Do not claim a target/decoy runtime capture exists. |
| E4 — registry absolute override | No-op in anchor; registry args/env branch shared with E5 | Override executable replaces advertised launcher while preserving registry distribution args/env. | **No separate absolute-override transcript**; unit control and E5's integrated registry override. | Already absolute value unchanged. |
| E5 — registry relative override | Yes: distinct override anchor call | Source=registry, relative commandPath; compatible npx distribution contributes args/env but package installation is bypassed. | **Yes — BT L162–180; AT L162–180**, report E5 and uploaded registry settings/fixture. | Successful background agent in B/1 after; expected script identity, distribution flag and environment marker retained. Cached index digest unchanged. |
| E6 — managed npx/uvx executable already absolute | No-op in package anchor | Managed package receipt/discovery yields an absolute executable; npx/uvx share the final anchor call. | **No runtime transcript**; package-resolution/install unit controls only. | Absolute input unchanged; do not call E5 a package-install capture. Package-manager subprocess cwd is unchanged by this PR. |
| E7 — managed npx/uvx executable found through relative PATH | **Yes: independent package anchor call** | No command override; package discovery falls back to a relative provider PATH entry, then returns the anchored executable for spawn in B or P. | **No — report explicitly omits E7**; existing test injects `SpawnExecutableResolution` for uvx and checks output, without launching. | **Missing requested runtime proof.** Neither local command nor registry override capture executes this changed package branch. One representative npx or uvx fixture suffices for their shared final anchor; no real package download is necessary. |
| E8 — binary distribution without override | Binary resolution/install unchanged; driver-owned cwd relocation shared with R1 | Install/reuse managed binary, return cached executable; do not substitute commandPath and call it binary installation. | **No binary-distribution runtime transcript**; existing install/cache validation unit controls. | Unchanged binary branch; R1 proves common driver-owned spawn routing. |
| W1 — Windows cwd, PTY, restart, thread/management routing | Yes for background spawns; controls for project routing | Native counterparts of R1–R8. | **No — cannot-verify windows.** | Linux watcher and PTY transcripts are not native Windows proof. |
| W2 — Windows executable forms | Yes: win32.resolve in all three anchor call sites | Absolute drive/UNC, ordinary relative, drive-relative `C:tools\agent.exe`, root-relative `\tools\agent.exe`; local bare PATH results, registry override and package results. Existing local `.cmd`/`.bat` rejection is unchanged. | **No — cannot-verify windows.** Simulated drive-relative string test is not execution evidence. | No native validated-target vs executed-target identity proof. |
| W3 — Windows reparse/symlink then `..` | Yes: Windows lexical normalization | Target/decoy identity across validation and CreateProcess, unlike POSIX path concatenation. | **No — cannot-verify windows.** | Neither POSIX symlink test nor Linux simulated drive paths establishes native behavior. |

## Minimal missing capture

For E7, use the same real source-server before/after method with a synthetic npx or uvx manager and synthetic ACP executable. Use registry source with **no executable override**, and arrange that the preferred managed bin does not contain the exposed executable while a relative provider PATH entry does. Record the settings/PATH and resolved executable identity, actual agent process cwd, initialization/probe success and both source revisions. For background startup, before may successfully launch from H and after must successfully launch the identical executable from B; that pair proves the previously unexercised package branch survives the cwd move. If also exercising a project session in P, record the old relative lookup failure or wrong target before and the intended target after, rather than assuming startup itself must fail before. The existing unit test remains useful complementary proof. No live package installation is required.

FRICTION:
tool | Web open returned Internal Error for the report; Python urllib received HTTP 403 for artifact downloads. curl downloaded all artifacts successfully. | Use curl for these file-drop artifacts.
brief | The prior matrix expressly waived an E7 runtime capture, while this complete brief asks for before/after coverage of every affected branch. | State whether the earlier E7 unit-only exception carries forward; this report exposes the gap without treating it as a code defect.

VERDICT: INSUFFICIENT E7