# Proof audit pass 1 — guidance alignment

Scope: takeover [#20053](https://git.cafe/pingdotgg/t3code/pulls/20053), mirrored [#20053](https://github.com/pingdotgg/t3code/pull/20053). Original proposal [c754d31](https://github.com/Lenoridev/t3code/commit/c754d312d7c99a4ad9fb2a62a10b3cdf395b5ef3) is context only. Audit compares merge-base [eea9895](https://github.com/pingdotgg/t3code/commit/eea989536849e5b5049987ee24318b5a77326542) to replacement [c3eda49](https://github.com/pingdotgg/t3code/commit/c3eda496803eaedb003c5f01e9c7905209325e13), checkout `/home/ubuntu/wt/pr-20053`, branch `takeover/pr-20053`.

Status: deterministic before/after helper transcripts and focused red/green tests executed on 2026-10-24. BEFORE production text fails exactly two routing assertions (21 pass); AFTER passes all 23 tests. This proves guidance emission, not live agent behavior. Complete diff: five files, 43 insertions / 10 deletions. Three production/documentation text surfaces and two regression-test additions. No handler, schema, lifecycle or transport change. No blocker found in the proposed text alignment.

## Fixture matrix

Every positive instruction output below must show BOTH independent rounds → fresh `delegate_task` (full brief/context, own taskId and distinct retry-stable clientRequestId) AND same-child conversation → `t3_thread_send` with childThreadId. No row requires spawning an agent.

| ID | Output / callers | Inputs and conditional combinations | Expected proof and limitation |
|---|---|---|---|
| S1 | Shared `T3_CODE_ORCHESTRATION_SECTIONS[0]`; joined `T3_CODE_ORCHESTRATION_INSTRUCTIONS` | Always-exported section and joined string | BEFORE blanket prohibition; AFTER qualified independent review plus affirmative same-child route. Obsolete backing-storage restriction removed. Sections 2–5 byte-identical. Capture once, reused for downstream paths. |
| S2 | Codex `buildCodexAdditionalContext`, called by `CodexAdapterV2` | hasT3Mcp=true; model=gpt-6.1-sol; browser/device availability four boolean pairs; Default/Plan use same additional-context builder | Render `t3_code_orchestration_01` plus section key order and UTF-8 byte counts (each ≤4000). All four availability combinations give identical orchestration entries; browser/device guidance is separate. New focused test checks this output, not just source. |
| S3 | Codex adapter exclusion | hasT3Mcp=false; either interaction mode | Adapter omits T3 context. Direct builder defaults to enabled and is NOT evidence for this exclusion: source gate inspection suffices. No live Codex call. |
| S4 | Claude `ClaudeAdapterV2` query options systemPrompt.append | mcpServers undefined vs defined (including empty object) | Undefined omits orchestration; defined appends shared joined string after runtime instructions. Gate is definedness, not server count. Source trace plus S1 transcript; no SDK/provider launch. |
| S5 | Cursor first-run user wrapper | runOrdinal=1/2 × hasT3Mcp=true/false | Only (1,true) wraps prompt in orchestration/user_request tags; other three return original prompt. Render four helper outputs. Attachment/skill text rewriting does not alter shared instructions. |
| S6 | ACP adapter user prompt injection (configured ACP drivers share path) | Default/Plan × hasT3Mcp true/false × previous state absent/equal/changed | First state or changed mode/tool state injects mode instructions, with orchestration only if MCP true. Equal state returns prompt verbatim. Capture representative initial Default+MCP, Plan+MCP, disabled, equal, mode-change, MCP false→true, true→false. State matrix evaluated exhaustively by helper (see procedure). |
| S7 | ACP bypass and reinjection | leading whitespace slash command; prior state equal with compaction marker | Slash command bypasses injection regardless of state. Adapter drops previousState on compaction, so helper injects again; source trace plus initial-state helper output sufficient. No compaction runtime claim. |
| S8 | OpenCode legacy and v2 system prompt | t3OrchestrationSystemPrompt(true/false) | True returns shared joined string, false undefined. Both adapters call same helper; render once and cite both call sites. Other system-prompt pieces unchanged. |
| S9 | Pi generated `PI_T3_MCP_EXTENSION_SOURCE`, before_agent_start | endpoint/token both present vs either missing; sections object with forceSystemPrompt undefined vs missing sections or forced full prompt | Source embeds shared trimmed string via JSON.stringify. With credentials missing extension returns before registering hook. Enabled hook assigns sections.t3_code_orchestration when section API usable; otherwise appends to event.systemPrompt. Decode generated literal and show both positive assembly forms; source trace covers gate. Do not use real credentials or launch Pi. |
| T1 | MCP OrchestratorToolkit delegate_task description → McpHttpServer registration → tools/list; ACP stdio forwards same response | enabled registered tool; independent-round and same-child language in SAME description | BEFORE overbroad instruction; AFTER both routes. Full string identical between toolkit and tools/list description. New test only reads toolkit metadata, NOT tools/list transport: minimum transcript must label a source-rendered tools/list projection honestly, or use optional isolated transport fixture below. |
| T2 | Unchanged t3_thread_send description in same toolkit/list | same metadata projection as T1 | Before/after byte-identical reference: independent rounds fresh delegate_task; same-child childThreadId; completed task stays completed/result immutable, follow-up creates fresh task; running steer may join current task; auto/queue/steer/restart and idempotency unchanged. Do not execute those modes for this text-only PR. |
| D1 | docs/orchestration-v2/orchestrator-mcp-server.md delegation paragraph | independent vs same-child, follow-up after completion | BEFORE broad review-round ban/no session-follow-up wording; AFTER qualified independent round and documented existing same-child follow-up semantics. Extract exact paragraph on both SHAs. Documentation is source Markdown; no browser render needed. |
| X1 | Tests added in McpHttpServer.test.ts and CodexDeveloperInstructions.test.ts | replacement assertions applied to base source; same assertions on replacement | Two focused cases fail on base because base guidance lacks new routing language; pass on replacement. Record commands, SHA, exit status. Existing suite rerun on replacement if practical, not repo-wide. No runtime behavior test required for unchanged handlers. |
| N1 | Web/desktop/mobile UI; Settings/palette/keybindings; viewport/theme/accessibility/motion | N/A | No changed UI or interaction. NO screenshots, video, browser, device, dev server or theme matrix. |
| N2 | Local/remote/tunnel; provider/model selections; native delegation/options; permission modes | N/A as runtime combinations | Text invariant across these dimensions; no wire/authorization/runtime changes. ACP and provider injection gates above are the relevant distinctions. No live model-behavior claims. |

Call sites inspected: provider-core orchestrationInstructions.ts; server CodexDeveloperInstructions.ts; orchestration-v2/Adapters/{CodexAdapterV2,ClaudeAdapterV2}.ts; provider-cursor/server/adapter.ts; provider-acp/server/adapter.ts; provider-opencode/server/{adapter,v2/adapter}.ts; provider-pi/server/mcpExtensionSource.ts; mcp/toolkits/orchestrator/tools.ts; McpHttpServer.ts. Muse has no direct import of this changed instruction module; do not invent a separate changed surface for it. Named ACP products use the shared ACP adapter rather than needing separate identical captures.

## Exact extraction / rendering reproduction (executed; see evidence index)

All artifacts are beneath `/tmp/to-20053`. No checkout, dev server, browser, agent execution, or live state access occurred. Rendering uses immutable Git objects. Test execution temporarily replaced exactly the two changed production TypeScript files with BEFORE versions; `finally` restored their original bytes before GREEN. Working-tree status was clean after completion. A text transcript is the rendered artifact here.

1. For each label/SHA pair below, read files using `git -C /home/ubuntu/wt/pr-20053 show "$sha:$path"`. Label transcript headings BEFORE/AFTER with the full SHA. Record `git diff --name-status "$before" "$after"` as scope inventory. Use the two SHAs above, not the original fork head.
2. Make a standalone Node `.mjs` harness outside the worktree. For the shared module, use `node:module.stripTypeScriptTypes(source, {mode:'strip'})`, then import a base64 data URL of that JavaScript. Its only import is type-only and disappears; this executes actual exported builders without provider processes or repository writes. Node with stripTypeScriptTypes support is required. No regex interpretation of template escape sequences.
3. Load CodexDeveloperInstructions.ts at the SAME SHA similarly: replace the runtimeInstructions import specifier with a data URL of stripped runtimeInstructions.ts from that SHA, and replace the orchestrationInstructions import specifier with the shared-module data URL. Type-only imports disappear. Import the stripped result and call actual buildCodexAdditionalContext({model:'gpt-6.1-sol'}, {browser,device}) for all four availability pairs. Emit only orchestration keys/values and byte counts. Assert identical entries across pairs; ≤4000 bytes per entry. This avoids package aliases resolving the opposite revision.
4. On the shared module call `t3OrchestrationPromptForFirstRun({prompt:'AUDIT_REQUEST',runOrdinal,hasT3Mcp})` for runOrdinal 1/2 and both booleans; call `t3OrchestrationSystemPrompt` for both booleans. Serialize undefined explicitly as `<undefined>`. For ACP, enumerate modes default/plan × booleans, previousState absent or each of four possible states, and prompts AUDIT_REQUEST and ` /audit`. Call t3AcpPromptWithInstructions for each tuple; print representative nonduplicate outputs plus a complete input→injected/not-injected table. Preserve XML tags/newlines in the transcript.
5. Claude output is the shared joined string behind the inspected definedness gate; print the orchestration suffix and three gate labels (undefined omitted, {} included, populated included). This is deterministic assembly/source evidence, not a Claude SDK execution. For Pi, replace its one shared import with the same data URL, strip/import generated-source module, extract the `const ORCHESTRATION_INSTRUCTIONS = <JSON string>;` line, JSON.parse the literal and assert equality to shared trimmed string. Print section assignment and fallback systemPrompt=`AUDIT_SYSTEM\n\n` + decoded string. Cite the before_agent_start source branches and credential early return rather than claiming to have executed a Pi extension.
6. For tool descriptions, use source at each SHA. Locate `const DelegateTaskTool = Tool.make("delegate_task", {` and `const ThreadSendTool = Tool.make("t3_thread_send", {`. From each block extract the immediately following description JSON string with `description:\s*("(?:\\.|[^"\\])*")`; decode with JSON.parse. Print each name and full decoded description in a JSON object `{jsonrpc:'2.0',id:1,result:{tools:[{name,description},...]}}`, headed **SOURCE-RENDERED tools/list DESCRIPTION PROJECTION — not a transport invocation; schemas/other metadata omitted**. This is exact decoded description text, not source escaped text. Assert unchanged t3_thread_send and altered delegate_task. The registration code forwards Tool.getDescription without content rewriting; inspect it at both SHAs. If actual tools/list serialization is required, use an isolated in-process MCP fixture through McpServer.registerToolkit + mock handlers/dependencies and request tools/list; store the real response separately and compare its two descriptions with this extraction. Do not label the projection as an actual HTTP/stdio exchange.
7. Extract docs paragraph precisely: start at line beginning `Each ` containing `delegated review round`, stop immediately before `Delegation requires an active parent run`. Emit Markdown text under BEFORE/AFTER. No doc renderer/browser required.
8. Make a short human transcript retaining changed shared section, changed delegate_task review sentences, unchanged t3_thread_send reference, and changed doc paragraph; keep complete helper outputs separately to prevent excerpting away contradictory guidance. Assertions must confirm all positive outputs contain BOTH routes and lack the old prohibitions. Byte-compare all untouched shared sections. Record SHA and exact harness invocation `node /tmp/to-20053/render.mjs > /tmp/to-20053/rendered-before-after.txt`.

## Minimum test/capture plan

- Executed low-copy alternative authorized by dispatcher: `/tmp/to-20053/tests.mjs` runs both complete focused test files with AFTER assertions, first with exactly the two BEFORE production-text files restored, then with the original AFTER files restored. It owns both replacements in one sequential process and restores in `finally`. No other agent mutates sources. All other sources are AFTER throughout; this is a controlled production-string regression experiment, not a full BEFORE checkout test.
- Exact command: `vp test run apps/server/src/provider/CodexDeveloperInstructions.test.ts apps/server/src/mcp/McpHttpServer.test.ts`. RED exit 1: exactly two routing assertions fail / 21 pass; GREEN exit 0: 23 pass. Saved stdout/stderr and statuses in `red.log`, `green.log`, `tests-summary.log`. No dependency snapshots or full repository copies needed.
- Produce one paired text transcript via steps 1–8. This is sufficient for dispatcher text-only evidence, with tools/list projection clearly labeled. If reviewer requires literal tools/list protocol proof, add the isolated in-process fixture from step 6, not a browser or real agent invocation. Shared provider wrappers can remain one transcript with compact presence/absence tables.
- Upload eventual logs/transcript with ghdrop; redact environment/config/credentials. This pass uploads the refreshed matrix, reproducible harnesses, source excerpts, short/full text transcripts, red/green logs and index. No UI captures were applicable or taken.

Proof boundary: asserts emitted guidance alignment and deterministic inclusion/exclusion. It does not prove a model follows guidance, review independence, retained conversational memory, or task lifecycle correctness. Existing t3_thread_send semantics are the reference, not a newly implemented behavior.

## Executed coverage

S1–S9, T1–T2, D1 and X1 are covered by text output, exhaustive helper checks, inspected source gates and red/green tests as specified. N1/N2 remain explicitly not applicable runtime dimensions. See evidence-index.md for per-row mapping and proof limitations.

FRICTION
category: minor tooling/plan adjustment
- Used the dispatcher-authorized two-file temporary restoration instead of copying 28k repository files. Restoration verified byte-for-byte and clean status.
- Node v26.12.1 emits its standard experimental stripTypeScriptTypes warning; rendering completed successfully.
- Initial inspection corrected the provider-core path to src/server and Effect MCP source path to effect/src/ai. No impact on proof or tracked source.