# Pass 2 final evidence matrix — SUFFICIENT

PR [#24576](https://github.com/pingdotgg/t3code/pull/24576). This status supersedes the A-real/O-real UNPROVEN status in pass 1 below, only for the requested one-real-turn-per-row-per-SHA scope.

| Row | Final status | Evidence |
| --- | --- | --- |
| Prior 22 fixture rows | Preserved historical result; not rerun | Original matrix reproduced verbatim below |
| A-real | PROVEN | Real OpenCode 1.18.18 ACP, paired pinned turns; full source-equal prompt arrays, matched end_turn and completed T3 results |
| O-real | PROVEN | Real native OpenCode 2.0.28, paired successful MCP/entry PUTs and prompt POSTs, matched sessions and completed T3 results; independently reproduced head row |

Coverage now totals 24 named rows, with historical 22-row evidence plus two real-path rows. Extra live negative/cache/slash/mode/compaction/reinjection controls proposed in pass 1 remain UNEXECUTED and are not part of this sufficiency claim. No all-provider claim. No fallback execution or model-obedience claim. See accompanying pass 2 report and reproduction proof for audit details and limits.

[Real capture archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bfc37e6c32fb6ce3/ev-24576-real-evidence.tar.gz)

---

# Historical pass 1 matrix, preserved verbatim

# Read-only proof audit pass 1 extension — A-real / O-real

PR [#24576](https://github.com/pingdotgg/t3code/pull/24576). Audited only `/home/ubuntu/wt/pr-24576`; scratch only `/tmp/ev-24576-audit-r1`. Diff base is merge-base(origin/main, head), [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b); head [13e24a9d91](https://github.com/pingdotgg/t3code/commit/13e24a9d913e9bf072a2d00a72bdb65ee12f4af7).

**Verdict: source expectations confirmed; A-real and O-real remain UNPROVEN.** No real provider or v2 caller capture was executed in this audit. The original matrix below is preserved as historical evidence, not independently rerun or revalidated. Its “22 rows sufficient” and “no further capture required” statements do not satisfy the newly requested real-path coverage. New scope totals 24 named rows; A-real requires an explicit provider/transport selection, with per-provider subcaptures if claiming all four.

## Extended matrix

| Row | Before / after expectations | Required capture proof | Current status |
| --- | --- | --- | --- |
| A-real | Actual attached ACP `session/prompt`: before CORE + Codex example + ACP fallback; after CORE + ACP fallback, no Codex example. Before discovery launcher full but delegation bare; after both launcher commands full. Detached: mode/runtime only both revisions. | Paired pinned runs through at least one real installed Grok/Cursor/OpenCode/Pi **ACP** executable and production ACP adapter/runtime; record executable/version, provider instance/model/transport, sanitized MCP attached state and exact full outgoing JSON-RPC text blocks. Capture first ordinary prompt, subsequent unchanged prompt, native slash then ordinary prompt, mode/tool-state reinjection and successful compaction reinjection. Tie each request/response to session and completion; show acceptance by real process, not an acp-test mock or helper-only string. If claiming all four providers, repeat per real ACP provider; native Cursor/OpenCode paths do not count. | REQUIRED, not captured. Existing AC rows are real adapter + mock subprocess. |
| O-real | Actual native OpenCode **v2** instruction entry: before runtime + CORE + Codex example + ACP fallback; after runtime + CORE only, no Codex example/fallback. Off/external/failed MCP add: runtime only both revisions. | Execute production v2 `prepareTurn` caller and capture actual `client.session.instructions.entry.put` arguments (`sessionID`, `key`, full `value`), plus MCP add result and turn submission/completion. Paired baseline/head attached success; no-MCP/external/failed-add controls; repeat unchanged turn proves no duplicate put, then attached→off proves overwrite removes orchestration. Use real v2 client/server boundary for real-provider claim; a spy/fake SDK proves caller execution only and must be labeled as such. No v1 `promptAsync` substitution or hand-assembled join. | REQUIRED, not captured. Existing OC2 rows are helper output + inspected caller only. |

Both rows need complete machine-readable captures and decoded transcripts, exact revision/full SHA, commands/runtime/dependency/provider versions, deterministic input, per-case assertions and artifact hashes. Capture only scratch sandbox state; redact credentials/authorization headers, preserve instruction text. A screenshot, model's paraphrase, source inspection, fake executable argv check or fixture-helper result alone is insufficient. No delegated work need be launched to prove delivery of instructions. A fallback-execution claim separately requires actual capabilities-call success and, only when authorized, a real delegate result with task ID; the existing fake argv check proves shell construction only.

## Exact changed orchestration text

CORE means the complete unchanged task/delegation, scheduler/secret/thread-link, workspace, generic bounded discovery, visuals and model-options sections. Assert full CORE against pinned source, not just the heading. Mode, browser, runtime and user text remain intact on their respective paths.

### Before: shared discovery section (present in attached ACP and native v2)

```text
Tool names may include a harness-normalized MCP prefix, such as `mcp__t3_code__delegate_task`; the semantics are the same. Some harnesses attach optional MCP servers lazily: if an initial tool-catalog scan does not show T3 tools, do not conclude that cross-provider delegation is unavailable. Make one bounded direct attempt using the known T3 tool name on the next tool step. In Codex code mode, for example, call `tools.mcp__t3_code__orchestrator_capabilities({})` before reporting that the capability is absent. Keep polling/wait loops bounded, do not duplicate active work, and use stable `clientRequestId` values when retrying tools that accept them.

ACP fallback: some ACP agents accept the injected MCP server but fail to expose its tools. When the T3 tools are absent and `T3_ACP_MCP_NODE` is present, call the same tools through the terminal: `ELECTRON_RUN_AS_NODE=1 "$T3_ACP_MCP_NODE" ${T3_ACP_MCP_ENTRYPOINT:+"$T3_ACP_MCP_ENTRYPOINT"} acp-mcp-call orchestrator_capabilities '{}'` (`T3_ACP_MCP_ENTRYPOINT` is unset when T3 runs as a standalone executable). Delegate with `acp-mcp-call delegate_task '{"task":"...","target":{"providerInstanceId":"...","model":"..."},"mode":"async","clientRequestId":"..."}'`. This is the supported T3 transport fallback, not an ordinary shell-based substitute for delegation.
```

### After: shared discovery section (present in attached ACP and native v2)

```text
Tool names may include a harness-normalized MCP prefix; the semantics are the same. Some harnesses attach optional MCP servers lazily: if an initial tool-catalog scan does not show T3 tools, do not conclude that cross-provider delegation is unavailable. Make one bounded direct attempt using the known T3 tool name on the next tool step. Keep polling/wait loops bounded, do not duplicate active work, and use stable `clientRequestId` values when retrying tools that accept them.
```

### After: ACP-only fallback paragraph (present in attached ACP; absent in native v2)

```text
ACP fallback: some ACP agents accept the injected MCP server but fail to expose its tools. When the T3 tools are absent and `T3_ACP_MCP_NODE` is present, call the same tools through the terminal: `ELECTRON_RUN_AS_NODE=1 "$T3_ACP_MCP_NODE" ${T3_ACP_MCP_ENTRYPOINT:+"$T3_ACP_MCP_ENTRYPOINT"} acp-mcp-call orchestrator_capabilities '{}'` (`T3_ACP_MCP_ENTRYPOINT` is unset when T3 runs as a standalone executable). Delegate with `ELECTRON_RUN_AS_NODE=1 "$T3_ACP_MCP_NODE" ${T3_ACP_MCP_ENTRYPOINT:+"$T3_ACP_MCP_ENTRYPOINT"} acp-mcp-call delegate_task '{"task":"...","target":{"providerInstanceId":"...","model":"..."},"mode":"async","clientRequestId":"..."}'`. This is the supported T3 transport fallback, not an ordinary shell-based substitute for delegation.
```

### After: Codex-only application context (absent in both A-real and O-real)

```text
In Codex code mode, if the T3 tools are not listed, call `tools.mcp__t3_code__orchestrator_capabilities({})` before reporting that the capability is absent.
```

The old exact Codex example `In Codex code mode, for example, call ` followed by `tools.mcp__t3_code__orchestrator_capabilities({})` is present before in both attached paths and absent after. Native v2 after must exclude `ACP fallback:`, `acp-mcp-call` and `T3_ACP_MCP_NODE`; attached ACP after must retain them. Detached/off payloads exclude orchestration in both revisions; ACP unchanged/slash requests bypass reinjection while prior session context persists.

## Source boundary checked

Production ACP caller: `packages/provider-acp/src/server/adapter.ts`, `t3AcpPromptWithInstructions` before runtime `prompt`; real Grok delegates to `makeAcpAdapterV2`. Native v2 caller: `packages/provider-opencode/src/server/v2/adapter.ts`, `prepareTurn`; `mcpAvailable` depends on successful MCP add, runtime precedes orchestration with two-newline join, `entry.put` occurs only when instructions differ. Production callers are unchanged by this five-file diff. This audit used pinned git objects for the diff and exact changed text; no code edits, servers, live-state access, PR modification or CI watching.

---

# Original downloaded matrix (verbatim)

# Validated matrix refresh

[index.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dad2791f3aea8244/index.md)

[catalog.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e5af4e5db4ff1061/catalog.md)

Original refreshed matrix reproduced below; latest artifacts and independently rerun results are in the linked index.

# PASS1 refreshed proof matrix — server orchestration instruction text

**PASS for the requested proof audit.** Replacement [#24576](https://github.com/pingdotgg/t3code/pull/24576), taking over original [#16482](https://git.cafe/pingdotgg/t3code/pulls/16482) ([GitHub mirror](https://github.com/pingdotgg/t3code/pull/16482)). Original contributor: [Gigioxx/t3code](https://github.com/Gigioxx/t3code), branch `provider-scoped-orchestration-instructions`, commit [d2b235d](https://github.com/Gigioxx/t3code/commit/d2b235d).

Audited only `/home/ubuntu/wt/pr-16482`, branch `fix/takeover-16482`. Exact baseline [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b); exact final head [13e24a9d91](https://github.com/pingdotgg/t3code/commit/13e24a9d913e9bf072a2d00a72bdb65ee12f4af7). Worktree was clean at entry and exit. Scope is instruction text and its existing server injection paths; this is not a CI/merge-readiness verdict.

[Download refreshed transcripts, logs, assertions, source diffs and reproducible driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5565ab888b362046/to-16482-pass1-evidence.tar.gz). Archive includes SHA256SUMS. Local matrix: `/tmp/to-16482-pass1/to-16482-proof-matrix-pass1.md`. Local evidence archive: `/tmp/to-16482-pass1/to-16482-pass1-evidence.tar.gz`.

## Acceptance and refreshed coverage

The same **22 rows** remain sufficient. No new provider, client, UI, model, browser, screenshot, or simulator surface is introduced by the launcher correction. CORE means common task/delegation, scheduling, workspace, bounded-discovery and model-options instructions. CODEX means the exact code-mode discovery call; ACP means the terminal fallback paragraph.

After: Claude/Cursor/native OpenCode retain CORE and exclude CODEX/ACP. Codex retains CORE+CODEX and excludes ACP. ACP retains CORE+ACP and excludes CODEX. Detached controls remain without orchestration. Existing mode/browser/device/runtime/user-message contracts remain intact.

Relative to the prior evidence head [31445e0c41](https://github.com/pingdotgg/t3code/commit/31445e0c41aa3e0d491b93c432ce0e79dfc295b0), exactly two files differ: the ACP fallback text gains the full executable prefix for `delegate_task`, and the existing `assertReinjectedInstructions` helper asserts it. `to-16482-refresh-delta.diff` preserves that complete delta. Of the 18 tracked production/test/caller/harness files in the prior lineage check, 16 are identical and these two have the expected change.

**Changed launcher coverage stays within AC-FIRST, AC-MODE, AC-MCP-CHANGE, AC-COMPACT and AC-NATIVE-COMPACT.** All nine captured attached wrapped requests at the final head assert this exact prefix: `ELECTRON_RUN_AS_NODE=1 "$T3_ACP_MCP_NODE" ${T3_ACP_MCP_ENTRYPOINT:+"$T3_ACP_MCP_ENTRYPOINT"} acp-mcp-call delegate_task`. Baseline lacks it. Slash and unchanged ordinary requests still bypass wrapping; detached requests never acquire the fallback.

`launcher-check.json` additionally executes the command extracted from the rendered ACP transcript against a fake executable. Both optional-entrypoint states pass: unset (standalone form), and set to a path with spaces. It verifies `ELECTRON_RUN_AS_NODE=1`, the complete argument order and one intact JSON argument. It does not launch a real ACP CLI or model.

## Same 22 fixture rows, captured again at the final head

Artifacts named below are `/tmp/to-16482-*` locally and basenames in the archive. Each before/after transcript header contains the exact full SHA, synthetic input and builder/adapter boundary.

| Matrix row | Evidence and result |
| --- | --- |
| CL-ATTACHED | `before-claude.txt`, `after-claude.txt`: real `makeClaudeQueryOptions.systemPrompt.append`; CORE retained, CODEX/ACP removed after. |
| CL-RESUME | Same builder drivers: resume=true append asserted byte-identical to resume=false; PASS marker in both Claude transcripts. |
| CL-DETACHED | Claude transcript: mcpServers omitted, runtime only, no orchestration. |
| CX-ATTACHED | Codex transcripts: real `buildCodexTurnStartParams`, default gpt-6.1-sol, hasT3Mcp=true; CORE+CODEX retained, ACP removed. New application key `t3_code_tool_discovery`, 156 UTF-8 bytes. |
| CX-PLAN | Codex transcript: plan collaborationMode and developer instructions retained, same provider-scoped context; builder assertion. |
| CX-TOOLS | Codex transcripts: browser/device both false versus both true; Unicode custom model metadata; every value asserted <=4000 UTF-8 bytes. Existing cap test also run both sides. |
| CX-DETACHED | Codex turn builder with hasT3Mcp=false, no appContext; additionalContext and collaborationMode absent. |
| AC-FIRST | ACP sequence A request 3: actual outgoing prompt after two native slash commands; default mode/browser/CORE/ACP; CODEX removed after. |
| AC-DETACHED | ACP sequence D request 1: actual first detached prompt, mode wrapper only plus separate runtime block. |
| AC-UNCHANGED | ACP sequence A requests 4 and 6; exact raw first text block, no instruction wrapper; independent runtime block retained. Finalize script asserts no wrapper. |
| AC-MODE | ACP sequence A default -> plan -> default at requests 3,5,7; all correctly wrapped; original adapter test checks native mode-setting calls. |
| AC-MCP-CHANGE | ACP sequence D absent -> attached -> absent -> unchanged; dynamic McpProviderSessions set/clear, actual outgoing prompts and focused assertions. |
| AC-SLASH | ACP sequence A requests 1,2, sequence B request 3, sequence C requests 2,4,5; exact command, one text block; subsequent ordinary prompt still injects. |
| AC-COMPACT | ACP sequence B: mock protocol compaction at prompt ordinals 2,4, including during reinjection; next ordinary prompts reinject, following prompt raw. |
| AC-NATIVE-COMPACT | ACP sequence C: failed compact ordinal2 leaves following prompt raw; successful compact then slash preserves marker for ordinary reinjection. |
| CU-FIRST | Shared-consumer transcript `CU-FIRST`: production helper output, first run MCP attached; CORE retained, CODEX/ACP removed. |
| CU-LATER-OFF | Shared transcript: runOrdinal=2 attached, and first run detached, both raw user prompt assertions. |
| CU-COMPRESS | `adapter-controls-before.log`, `adapter-controls-after.log`: existing Cursor adapter test confirms outgoing `/compress`; early-return caller in caller proof. |
| OC1-ATTACHED | Shared transcript includes helper output AND actual fake-SDK promptAsync system string; owned connection+MCP; one mcp.add; runtime+CORE retained, CODEX/ACP removed. |
| OC1-EXTERNAL-OFF | Shared transcript actual SDK boundary: external+MCP and owned without MCP, runtime only, zero mcp.add calls; focused assertions. |
| OC2-ATTACHED | Shared transcript `OC2-ATTACHED`: production helper and runtime builder output in v2 join order; inspected entry.put caller; CORE+runtime retained, CODEX/ACP removed. SDK boundary unexecuted. |
| OC2-OFF-UNCHANGED | Shared transcript runtime-only helper output when unavailable; failed-add and duplicate-put branches caller-inspected in `caller-proof.txt`, not executed. |


ACP `.json` files preserve exact outgoing text-block arrays; `.txt` files decode complete text. “Raw” ordinary requests retain their separate runtime-metadata block. Slash commands remain exactly one text block.

## Minimum refresh requirements — satisfied

1. Six mandatory paired fixtures: Claude attached/detached, Codex attached/detached, ACP first attached/detached. Full outputs are in `to-16482-before/after-claude.txt`, `-codex.txt`, and `-acp.txt` (the slash denotes the two separate filenames).
2. Paired ACP sequences for unchanged prompts, mode transitions, slash preservation, protocol compaction and native compaction, plus dynamic MCP changes: four scenarios, **24 actual outgoing session/prompt requests per revision**.
3. Paired shared-consumer transcripts for Cursor first/later/off, OpenCode v1 attached/external/off and OpenCode v2 helper text. V1 also captures the actual fake-SDK system prompt. Distinct v1/v2 caller proof is preserved.
4. The final launcher prefix is asserted across all nine captured wrapped attached ACP requests, with shell argv checks for both optional-entrypoint forms. The existing production regression helper asserts the prefix after reinjection.
5. Final tests against baseline production: **4 expected failures, 3 passes**. Failures are Claude/Codex scoping and two ACP reinjection tests requiring the full launcher. Final tests against head production: **7 passes**. For baseline capture only, the newly added launcher assertion is omitted from the copied instrumentation test so baseline requests can be captured; the unmodified regression run retains it. Production snapshots are unmodified.
6. Both revisions: builder capture **1 pass**, ACP capture **4 passes**, OpenCode v1 SDK controls **3 passes**, existing Codex/Cursor adapter controls **3 passes**, dedicated byte-cap tests **2 passes**. Every generated Codex context value is at most 4000 UTF-8 bytes; discovery remains 156 bytes.

No further capture is required for this refresh under the expressly permitted boundaries. `to-16482-rendered.diff` contains the complete rendered differences; `to-16482-production.diff` contains the complete five-file baseline-to-head diff. Their contents were generated from pinned source, not copied from prose.

## Reproduction and boundaries

Extract the archive to `/tmp`, then run `TO_16482_REPO=/home/ubuntu/wt/pr-16482 bash /tmp/to-16482-run.sh`. The driver archives exact git objects into scratch snapshots, links installed dependency directories, and creates exact/wildcard workspace package aliases into each corresponding snapshot. It copies final regression tests over baseline test files, leaving baseline production intact. Capture instrumentation is scratch-only. No checkout, app server, paid provider or model is started.

Vitest v5.0.5 via Vite+, Effect v4.0.5; test runtime **Node v26.12.1 Linux x64** (the shell's standalone `node` reports v24.22.1; Vite+ runs tests with v26.12.1, recorded by the builder transcripts). ACP is the real adapter/AcpSessionRuntime JSON-RPC boundary against the existing **acp-test mock subprocess**. Grok wiring is caller-inspected; no live Grok process is claimed. Selected tests use protocol queues, Deferred milestones and terminal events, without added sleeps or polling.

## FRICTION / limits

- The downloaded driver was pinned to the prior head and expected full blob equivalence. It was updated to the exact final head and the two documented launcher deltas; no source editing was needed.
- Initial scratch instrumentation had a Python quoting error before tests started. Corrected the scratch script, then all capture/test stages completed. An early shell check read the not-yet-decoded ACP JSON text and rejected escaped quotes; it was rerun successfully on the finalized decoded transcript.
- Native OpenCode v2 remains explicitly **production helper output plus inspected caller**, not an executed v2 SDK boundary. Failed MCP add and duplicate-put cache behavior are unchanged and caller-inspected. This is the previously allowed boundary, not a new missing requirement.
- Cursor first/later/off uses the permitted production helper; `/compress` uses its existing adapter test. ACP is acp-test at the real protocol boundary, not native OpenCode or live Grok.
- Server-only text: no UI captures, browser/computer use, desktop/mobile multiplication, live model sessions, live state access, production edits, push, PR creation/comment, or watching. Scratch is confined to `/tmp/to-16482-*`. PR registration only was performed as required by the harness.

Audit performed through the Codex harness, gpt-6.1-sol, using the [pr-audit skill](/home/ubuntu/.codex/skills/pr-audit/SKILL.md) and uploaded with the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md).