# Clone credential failure evidence

Surface: real web development app, Chromium, 1280 × 800 CSS pixels, dark theme.
Both checkouts use their own fresh application database with T3CODE_DEV_SEED=0. No live database or provider turn is used. Pair the counterpart server through Settings → Environments to make two environments available.

The host-fixture.mjs preload gives each process a synthetic environment name through EVIDENCE_HOST_LABEL. The target is named Clone sandbox. The second environment is a saved counterpart server. It is not used to run the clone.

The private-repository.py fixture runs a real HTTPS endpoint on localhost:18443 and answers Git's requests with HTTP 401 and a Basic-auth challenge. It does not implement an accessible repository. Generate a disposable localhost certificate and key beside the script before starting it. No certificate or private key is uploaded.

Start the app with NODE_OPTIONS=--import=<host-fixture.mjs>, EVIDENCE_HOST_LABEL='Clone sandbox', GIT_CONFIG_GLOBAL=/dev/null, GIT_CONFIG_NOSYSTEM=1, GIT_TERMINAL_PROMPT=0, GIT_SSL_NO_VERIFY=1 and T3CODE_DEV_SEED=0. The TLS override is confined to this disposable self-signed local fixture.

Steps on both commits:
1. Add project → select the local Clone sandbox environment → Git URL.
2. Enter https://localhost:18443/team/private-project.git and advance to destination confirmation.
3. Inspect the repository summary.
4. Enter a disposable destination ending in clone-output inside the evidence scratch directory. Use a new run subdirectory when repeating.
5. Submit Clone / Create & Clone.
6. Wait for Failed to clone clone-output and open its Show details button.

Base: confirmation has no environment line; error details contain only Git's fatal username diagnostic.
Head: confirmation says Clones on Clone sandbox; details explain environment Git credentials versus Settings tokens, followed by the same Git diagnostic.

Recordings cover the interaction. Black rectangles redact unrelated runtime identifiers, environment metadata and the destination input. The repository summary, clone button and credential explanation are preserved. Stills are matching crops from the live app after two full screenshots at least 500 ms apart matched pixel-for-pixel.

Limits: no successful clone using credentials in a second environment, no Settings token experiment, no external private forge repository, no repository-not-found case, and no SSH-to-HTTPS fallback were exercised.

AI-assisted; verified with the tests and tools listed above.