# Final exact-head PASS2 proof audit

No blocking proof findings. All four required runtime rows are sufficient for the authorized server-only provider → CLI/stub subprocess → watch evaluator → formatted-message scope. This is evidence sufficiency, not certification of live Azure or durable agent wake delivery.

Replacement [#24568](https://github.com/pingdotgg/t3code/pull/24568), original [#18759](https://github.com/pingdotgg/t3code/pull/18759). Independently inspected `/home/ubuntu/wt/pr-18759`, branch `takeover/pr-18759`, at AFTER [e13265440a](https://github.com/pingdotgg/t3code/commit/e13265440a44b51116f9c3427b50c3d0e2c3ca1e). BEFORE [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b). Contributor provenance [da81b1d76d](https://github.com/AugusDogus/t3code/commit/da81b1d76d071cd52150c590d55ef4ae945b2054), branch `fix/azure-pr-watch-checks-18728`, is not the baseline. GitCafe read-only metadata independently reports replacement head and observed base at these exact SHAs. The current PR body still has initial evidence-in-progress text; its pending final-proof update is not treated as missing capture.

| Required row | Status | Inspected and independently rebuilt behavior |
| --- | --- | --- |
| R1 lifecycle | SUFFICIENT | Events 1–6, head A: running → rejected → duplicate rejected → queued → approved → duplicate approved. BEFORE has no checks/news. AFTER emits one failure and one required pass. Pending resets remembered failure; duplicate observations emit no message. Actual checks, next watch, text and notification payloads inspected. |
| R2 pagination/mixed gate | SUFFICIENT | Events 7–10. Actual subprocess argv reads skip0 then100 despite 100 non-build rows on page1. Policy IDs12/13 retain distinct identities despite equal labels. AFTER emits failure, required pass count2 while optional14 runs, then owed optional completion count3 and no duplicate. BEFORE reads no policies and reports no check news. |
| R3 fail closed/preview | SUFFICIENT | Events 11–25. Passing page1 plus object/invalid JSON/malformed row/overflow page2 fails the whole AFTER detail read, skips evaluation and retains in-memory watch. Same-failure recovery stays silent; genuine pending rerun permits new failure. Full-detail denial actually invokes the failing policy subprocess. AFTER preview calls only show and returns seven fields; show errors propagate. BEFORE fallback preview succeeds through show/iterations/changes. |
| R4 head/no checks | SUFFICIENT | Events26–31 and fallback32–34. Latest iteration C wins stale trial A; pending resets remembered pass and C approval reports once. Same-head empty/all-filtered policies preserve prior pass; never-seen checks at logical+16min create no timeout message with actual Azure capabilities. Empty/failed iterations and absent location retain populated checks, with unavailable head as expected. |

Supporting matrix D1–D4, C1–C3, P1–P3 and W1–W5 are supported by actual runtime output, decoder/pagination assertions, focused tests and source trace at the declared levels. C4 is supported within its explicit exception: real generic/auth/not-found/missing-executable behavior, existing typed-rate-limit coverage, and source inspection; production-host classification and running reactor pause remain unverified. No required runtime row depends on claiming those integrations executed.

## Independent reproduction

Downloaded the public [bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6594af388c1f5073/proof-bundle.tar.gz), extracted under `/tmp/to-18759-final-pass2-audit/pr-18759-proof`, and verified all **58** SHA256 index entries. Verified both revisions' declared production-source hashes directly against git objects. Read the matrix, index, transcript, source trace, actual runtime/argv/test logs, deterministic fixture generator, executable stub, replay and rebuild script. Inspected the five-file exact base/head diff and relevant service/reactor/process-helper code. The affected CLI delta since the prior audit is the named `Effect.fn` span.

Ran the downloaded, unmodified driver:

```sh
python3 /tmp/to-18759-final-pass2-audit/pr-18759-proof/rebuild-proof.py --repo /home/ubuntu/wt/pr-18759 --out /tmp/to-18759-final-pass2-rebuilt
```

It freshly exported both exact commits outside the checkout, linked only installed dependencies, regenerated fixtures, and ran the production provider, PR CLI, Azure CLI and evaluator/formatter. `TestSourceControlHost.layerWithRealGit` really spawns the executable `az` stub; it does not mock execute responses. The stub routes by argv and rejects unexpected commands, with no real az or network fallback. The driver strips ambient provider/Azure credentials. All eight commands returned expected exits.

Independently verified all **32 paired full-detail observations** have identical scenario/event, selected fixture state and logical time. Fresh fixture manifest, replay, generator and executable stub match the downloaded versions byte for byte. Rebuilt production changes match exact git objects; ported regression tests affect only the external BEFORE export.

| Normalized delivered vs rebuilt output | Records delivered/rebuilt | Changed records |
| --- | --- | --- |
| BEFORE runtime | 111 / 111 | 0 |
| AFTER runtime | 184 / 184 | 0 |
| BEFORE argv | 96 / 96 | 0 |
| AFTER argv | 141 / 141 | 0 |

Only the absolute proof root was normalized to `<PROOF_ROOT>`. No times, errors, checks, states, messages, assertion records, command ordering or argv were omitted. Runtime and argv delta: **zero**. Pixel delta: N/A, server-only. Comparison code `/tmp/to-18759-final-pass2-audit/check.py`; result `/tmp/to-18759-final-pass2-rebuilt/normalized-comparison.json`; full fresh logs and command manifest in that rebuilt directory.

## Counts and claims

- Independently reproduced requested four suites: **81 BEFORE / 84 AFTER passed**. Additional existing Azure CLI suite: **7 each**, giving **88 BEFORE / 91 AFTER**.
- Exactly three new filtered regressions: **3 failed +33 skipped BEFORE**, exit1; **3 passed +33 skipped AFTER**, exit0. Preview's BEFORE failure is the absent optional method; actual runtime fallback preview still succeeds. The prior wider port's fourth queue-alignment failure is disclosed fixture incompatibility, excluded from the three-regression claim, and not rerun or represented as a product failure.
- Runtime summaries and individual assertion records agree: **73 external assertions BEFORE /140 AFTER**, with **96/141** stub subprocess calls. These are external proof assertions, not committed tests or 140 separate end-to-end scenarios. No evidence files are committed.
- Matrix remains an inherited capture specification; execution claims come from logs and reproducible output. The final index/transcript accurately disclose synthetic inputs and integration limits. Initial PR evidence wording is pending replacement as stated in the brief.

## Limits and scope

**live Azure DevOps not exercised.** Fixtures are explicitly synthetic sanitized JSON derived from repository test shapes, not live recordings. No correlated build-result recording exists; context/build IDs are synthetic ignored metadata. Actual Azure service pagination, permissions, CLI configuration/detection and project scoping are unverified.

The replay carries watch state in memory and skips evaluation on errors itself. The matching production reactor error branch is source-inspected, not executed. Persisted watch state, record/enqueue, scheduling, notification delivery and agent startup/wake are unverified and unclaimed.

The real-process test helper lacks production generic error classification, retries, concurrency limits and timeouts. Synthetic429 therefore correctly returns `failed` in replay. Typed-rate-limit preservation is covered by the existing Azure CLI suite; provider mapping and reactor early return are source-inspected only. No production rate-limit runtime claim is accepted.

Only five server/package paths differ against the stated final baseline. No UI renderer, client contract or capability changed. Web/desktop/mobile and transport modes gain no new UI path; no screenshot/browser/server was required or used. Preview selection and full-detail propagation were traced through existing service callers; full cache/service runtime is not claimed.

Read-only checkout remained clean. No code edits, ref changes, push, comments, watches, application server/browser, or live database access. Required app-owned PR registration/listing was performed; no forge content was changed. This delegated audit did not monitor CI.

FRICTION: infra — disclosed approved helper limitation for production rate-limit classification. No new rebuild friction. tool|brief|runbook|forge|policy|model|other: none.

Audit used [pr-audit skill](/home/ubuntu/.codex/skills/pr-audit/SKILL.md), read-only GitCafe skills, and [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md) for the explicitly requested public upload. Model/harness: GPT-6.1 Sol / Codex in T3 Code.

VERDICT: SUFFICIENT