# Issue 23710 verification

Existing fix: https://github.com/pingdotgg/t3code/pull/23792
PR head: f00806e3ad8a2bbb7ababbb41ff445b2539f235c
Verified applied to current main: a46f80ee28d9b498bb8b407c8b60bd4e93bbe2e3
Environment: Linux x86_64 fs-01, real isolated T3 server, HTTP POST /mcp initialize, localhost:14541. No browser or external ChatGPT connector was used. Visual fixture matrix: empty (server-only change).

## Runtime observations

Lead ran current-main dev:server and Python urllib POST requests with dummy credentials. All returned 401 invalid_mcp_credential. In request order, the server warning reasons were:

| Authorization | Main reason | Full PR patch on main reason |
|---|---|---|
| Bearer dummy | unknown_or_expired_token | unknown_or_expired_token |
| bearer dummy | missing_bearer_token | unknown_or_expired_token |
| bEaReR dummy | missing_bearer_token | unknown_or_expired_token |
| absent | missing_bearer_token | missing_authorization_header |
| Basic dummy | missing_bearer_token | unsupported_authorization_scheme |
| empty bearer | missing_bearer_token | missing_bearer_token |

The after run was independently performed by the proof agent with T3CODE_DEV_SEED=0 vp run dev:server. It used dummy-token in place of dummy. This transcript records observations, not a claim of successful real-account OAuth. Successful provider and OAuth credential paths are covered by tests.

## Regression proof

Applied only existing PR test changes to main; ran in apps/server:

vp test run src/auth/McpOAuth.test.ts src/mcp/McpHttpServer.test.ts

Result: 2 failed, 24 passed. Existing OAuth sign-in test failed with ServerAuthMissingCredentialError from parseBearerToken returning null. Existing MCP credential admission test failed with expected 401 to be 200 in the lowercase/mixed-case scheme loop. These failures establish the reported protocol defect.

Applied full existing PR patch to main; ran in apps/server:

vp test run src/auth/McpOAuth.test.ts src/mcp/McpHttpServer.test.ts src/auth/EnvironmentAuth.test.ts

Result: 42 passed, 3 files passed. Targeted vp lint on the four changed files and apps/server vp run typecheck both returned exit code 0.

## Independent review

GPT-6.1 Sol and Claude Opus 5.5 independently reviewed the diff. Neither found a concrete defect or missing test. Both returned NEEDS_JULIUS because the shared auth parser and MCP authentication are sensitive surfaces. No merge authorized or performed.

## Limits

External ChatGPT connector, managed tunnel, and macOS desktop were not exercised. The report itself does not establish whether ChatGPT omitted a header or used a different scheme. This patch fixes the independently reproduced parsing and diagnostic bugs.

Verified by GPT-6.1 Sol in Codex and delegated Claude Opus 5.5 in T3 Code.