# Proof audit pass 1 — issue #5817

Issue: [#5817](https://git.cafe/pingdotgg/t3code/issues/5817). No PR exists in this brief.
Scope: complete diff from [3b95e78](https://git.cafe/pingdotgg/t3code/commit/3b95e7831b11b17627dff16843bc087bfca397ec) to [51cf491](https://git.cafe/pingdotgg/t3code/commit/51cf491624be9461b77412c3e30dbe91a33d93e2), two files: CodexHomeLayout.ts and its test. HEAD verified. Read-only audit; no server, browser, tests, repository edits, comments, push, or nested agents performed.

## Applicable proof

The explicit server-only exception applies. No render code, component, route, style, client contract, or interaction changed. Existing provider availability UI exposes a server result; that does not create a changed render path. Required visual fixture matrix is EMPTY (zero screenshot or recording rows). Existing baseline UI images are supplemental, not a reason to demand new client captures. Web, desktop, mobile, local, remote, and relay consume the same unchanged server result; no per-client visual sweep is required for this diff.

| Changed render path | Caller | Conditions | Interaction | Required capture |
| --- | --- | --- | --- | --- |

## Server fixture matrix (nonvisual)

| ID | Changed condition / fixture | Caller or trigger | Required observable result | Proof / status at pass 1 | Recording |
| --- | --- | --- | --- | --- | --- |
| S1 | Both homes acquire .tmp/runtime.lock, installation_id, queue_1.sqlite, goals_1.sqlite, future_state_42.sqlite after initial setup | materialize, create entries, materialize again | Success; both homes' original bytes retained; future name proves no fixed filename allowlist | New committed regression fixture; red baseline .tmp conflict inspected; lead baseline runtime .tmp conflict inspected; green and after runtime pending | No: nonvisual sequence; transcript and test |
| S2 | Regular queue base exists in each home, without unrelated .tmp masking it | Provider-driver creation on real server | No queue entry conflict; provider instance initializes; shadow base stays local and shared base unchanged | Separate baseline runtime queue conflict inspected; new tests cover queue bytes; matching after runtime pending | No: transcript |
| S3 | Base logs_2.sqlite already linked; regular WAL and SHM exist in both homes | Repeat materialization; provider-driver creation | Preserve base link and each sidecar's topology/bytes; no entry conflict | New committed regression fixture; red baseline sidecar conflict inspected; baseline runtime sidecar conflict inspected; matching green/after pending | No: test and transcript |
| S4 | Shadow-local queue base, shared WAL/SHM; orphan shared WAL without shared base | materialization | Leave local base; do not introduce shared sidecar links; orphan stays unlinked | New committed fixture; green pending in this audit | No |
| S5 | -journal suffix and sidecar-only local member | Same family classification branch as WAL/SHM | Same family-preservation rule; no unsafe new links | Code inspection only; no explicit -journal test observed. Focused extra fixture useful, not additional UI evidence | No |
| S6 | Required shared config / known directories conflict with real shadow entry | Materialization | Continue to fail clearly instead of silently making required shared state local | Existing config conflict fixture; known directories use same required-name condition | No |
| S7 | Replaceable .sqlite-maintenance.lock or mcp-oauth-locks | Materialization | Continue replacing local locks with shared links | Existing focused fixtures | No |
| S8 | Private auth/cache; excluded log/memories/tmp/.DS_Store | Materialization | Preserve private auth and local files; remove cache symlink; shared sessions/config stay linked | Existing focused fixtures; unchanged policy | No |
| S9 | No local family member; missing/correct/wrong shared links | Materialization | Existing link creation/retargeting remains; sidecars require a shared base | Existing setup fixture plus code inspection; no new capture | No |
| S10 | Direct mode / same path / filesystem failure | Early return or setup/scan | Direct unchanged; equal paths rejected; new shadow-directory/readLink errors remain typed with actual path | Existing same-path fixture; new directory scan errors inspected, no explicit injected-failure test observed | No |

## Caller inventory and scope

Three production callers invoke the changed materializer: CodexDriver.create maps failure to ProviderDriverError; createCodexAdapterV2 maps it to ProviderAdapterDriverCreateError before building the adapter; makeCodexManagedRuntime.resolve maps it to ProviderSetupError(operation runtime) after acquiring runtime/auth. The committed helper fixtures cover shared behavior for all three. The actual-server transcript exercises driver construction; it does not by itself establish successful adapter session launch or authenticated managed runtime. Do not claim those were exercised. A Codex agent turn is unnecessary to prove filesystem materialization and provider construction; require it only if the final claim expands to successful end-to-end turns.

Other consumers (terminal Manager, AgentSessionScanner, codexUsage, CodexManagedHome) call the unchanged resolver, not this materializer. No new proof required there. Other provider adapters are unaffected. No RPC schema, permissions, reverse state, or transport behavior changed.

## Minimum acceptance evidence

1. Red baseline report plus green run of `vp test run src/provider/Drivers/CodexHomeLayout.test.ts` from apps/server at the audited head, with environment, command, totals, and skip status. Committed tests are reproducible fixtures; do not commit PR-only notes/assets.
2. Before/after actual-server transcript for the same three lead-created fixtures S1/S2/S3. Include exact revision, startup command, isolated home, fixture topology, and instance identity. After must positively show each instance initialized/available (not merely grep for absence of errors), and demonstrate preserved bytes/topology and repeat setup where claimed. Existing combined baseline captures three distinct failure messages.
3. No required screenshot or recording. Any optional UI proof must be labelled supplemental. Any future changed timing/interaction render row would require a recording; none exists here.

Inspected baseline: [runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2652d89c0c97c7fd/before-runtime.txt). Local red report: /tmp/issue5817-evidence/red-tests.txt. This is a summarized report, not raw full test output. It records 2 failed / 8 passed on baseline using an earlier test commit; the second test was later narrowed from reconciliation to preserving topology. Its baseline conflict still establishes the same failure, but final green proof must use the current committed fixture. No independently checked after evidence was available at pass 1; proof acceptance remains pending that evidence.

## Friction

- runbook: /home/ubuntu/t3code-ops/docs/EVIDENCE.md absent; initial targeted rg search across /home/ubuntu found no EVIDENCE.md. Broader location search outcome reported separately if found. No unobserved runbook requirements invented.
- brief: runtime after evidence explicitly underway; this pass defines requirements, not final proof approval.
- tool / infra / forge / policy / model / other: none encountered affecting this audit.