# Proof audit pass 1 — GitLab clone default

Review-only evidence plan, before captures. No browser/server/capture was started by this reviewer. Every runtime capture below is PENDING unless explicitly marked source/test. Worktree `/home/ubuntu/wt/pr-13351` was clean. Scope: [#13351](https://git.cafe/pingdotgg/t3code/pulls/13351), replacement [589c61891b](https://git.cafe/pingdotgg/t3code/commit/589c61891b4d781cb14e0243e3e666370b994245), mergebase [3cc31ed27c](https://git.cafe/pingdotgg/t3code/commit/3cc31ed27c). Forge still reports original fork head [96a893d](https://github.com/Mnigos/t3code/commit/96a893d2f04aabe3b8baf07e961e02a5e4d9a1a2); do not confuse that with the local replacement reviewed here.

## Complete diff and callers

Two files: GitLab shared definition changes `defaultCloneTransport` SSH → HTTPS plus explanatory comment; client-runtime projects test adds GitLab HTTPS/nested-group fixture and Bitbucket SSH control. No new render components, CSS, contracts, server behavior, permissions, or provider-agent adapters.

`packages/client-runtime/src/operations/projects.ts:114` selects repository.url for HTTPS, sshUrl otherwise. Runtime callers are exactly web `CommandPalette.tsx:1948` and mobile `AddProjectScreen.tsx:803`. Both choose after provider lookup and carry remoteUrl unchanged to tracked-clone or legacy blocking-clone dispatch. GitLab adapter `GitLabCli.ts:351` supplies web_url (no .git required) as url and ssh_url_to_repo as sshUrl. Do not substitute a hand-written .git fixture for the actual lookup value.

The other definition consumer, defaultHostCloneUrl at projects.ts:100, uses registry default GitHub, so owner/repository shorthand stays GitHub HTTPS. Explicit URL source calls normalizePastedCloneUrl and bypasses provider default. Web/mobile prompt links hardcode GitHub HTTPS and bypass this helper. Server SourceControlRepositoryService selectRemoteUrl:194 selects SSH for auto, HTTPS for https, SSH for ssh; unchanged and independent of client definition.

## Minimal capture setup

Capture agent must use a real app with a fresh T3 home `/tmp/ev-13351`, explicit `--home-dir /tmp/ev-13351`, `--no-seed`, and `T3CODE_DEV_SEED=0`. Never start against or seed from `~/.t3/userdata`. Keep clone destinations beneath the evidence home and use distinct before/after destination names; no cleanup of live state. Do not expose reusable dev auth, pairing tokens, credentials, private repositories, or host config in published evidence.

Use one desktop viewport 1280×900, one dark theme for both revisions. No responsive or theme-dependent rendering changed; duplicating light/narrow captures would add no transport proof. If iOS is exercised, use one normal phone viewport/theme; iOS is explicitly permitted unverified by dispatcher; Android is bonus. Desktop shares web rendering; no separate Electron capture required. Local web execution is required; remote/relay/tunnel use the same URL payload and need source trace, not a duplicate network deployment.

User authorizes headed Chromium + Xvfb + ffmpeg for the capture agent; never T3 preview recorder. Capture interactions as short recordings, with readable start/input, clone progress, and terminal outcome. Supplement recordings with exact redacted RPC remoteUrl or captured Git invocation and post-success `git remote get-url origin`. The web confirmation description shows repository.url on BOTH revisions, so that label alone does not prove transport! A successful HTTPS fallback also changes what a final remote can prove about the first attempt. Upload scratch capture scripts and provenance as artifacts, never commit them.

## Fixture matrix — all rows

| ID | Class / surface | Fixture and branches/interactions | Before → after expectation | Capture kind / status |
|---|---|---|---|---|
| G1 | Affected / actual web | Add Project → GitLab repository; real public small GitLab repo; provider available/authenticated; no usable registered SSH key; lookup → destination → Clone | Initial SSH URL → exact HTTPS web_url returned by GitLab; after real clone succeeds | BEFORE/AFTER recordings + redacted RPC/Git trace + successful origin; PENDING REQUIRED |
| G2 | Affected / web failure and fallback | Same repo; show initial SSH rejection with no key, then actual final state | Baseline may retry HTTPS and succeed; after starts HTTPS directly | In G1 recordings show first attempt and fallback/error. PENDING REQUIRED; do not claim overall baseline failure if it succeeds |
| C1 | Control / actual web | GitHub provider → small public repo → clone to unique destination on both revisions | HTTPS remains HTTPS; success remains success | BEFORE/AFTER recordings + exact remote URL; PENDING REQUIRED |
| C2 | Control / explicit SSH web | Git URL source with explicit `git@gitlab.com:group/repo.git` (also source-check ssh:// form); submit destination | Pasted SSH survives normalization on both revisions; no HTTPS-default rewriting | BEFORE/AFTER interaction recording + submitted URL/Git argv; PENDING REQUIRED. Without key, show honest failure/fallback, not SSH success |
| C3 | Control / explicit HTTPS web | Git URL source with real GitLab HTTPS URL, trim whitespace | Exact trimmed URL passes unchanged on both revisions | Source/test assertion sufficient; optional combine into C2 recording; source verified |
| G3 | Affected / nested and self-hosted GitLab HTTPS | Provider lookup returns https://gitlab.example.test:8443/group/subgroup/project and custom-port SSH URL | Select complete HTTPS URL verbatim, preserving port/subgroups | Focused helper fixture/transcript; no fake UI claimed as real hosted clone; nested group covered in changed test, custom-host runtime PENDING |
| G4 | Affected / self-hosted HTTP edge | Lookup url http://gitlab.example.test:8080/group/project; sshUrl custom port | SSH → HTTP verbatim, despite definition name https | Source verified; focused transcript desirable. Explicitly disclose HTTP selection; no credential disclosure claim |
| C4 | Control / other forges | GitHub and Forgejo default HTTPS; Bitbucket, GitCafe, Azure DevOps, unknown default SSH | Existing defaults unchanged | Definition/source audit verified; GitHub/Forgejo/Bitbucket existing/added focused tests; no six-forge browser expansion |
| P1 | Affected / web clone tracking | capability projectCloneTracking=true → startProjectClone with chosen remoteUrl; pending → success or error; retry/cancel if needed to recover fixture | Transport changes; existing progress/failure/project creation remains | G1 recording covers integrated branch. Source verified; runtime PENDING |
| P2 | Affected / older server web | capability absent/false → cloneRepository, then handleAddProject on success; failure toast on error | Same chosen transport carried to blocking clone | Source verified; no second live older server needed for one-line tweak; runtime not exercised |
| E1 | Control / entry points and gates | Sidebar new project, legacy sidebar, empty-project hero, PR-list empty state, draft hero, palette action/keybinding converge on CommandPalette; environment selection; provider unavailable/unauthenticated opens Settings setup guidance | Same common picker; no new clone path. Disconnected/permission-denied/blank/lookup error blocks before clone | Source verified; G1 exercise one visible entry and keyboard or button submit. No duplicated recordings per launcher |
| M1 | Affected / mobile iOS | AddProjectSource → AddProjectRepository → AddProjectDestination; GitLab helper; displayed remoteUrl; tracked and legacy branches | HTTPS flows through navigation to either RPC; success/error presentation unchanged | One iOS recording if available; explicitly UNVERIFIED PER DISPATCHER, not blocker for this pass |
| M2 | Affected / Android | Same shared operations and React Native flow | Same as iOS | BONUS recording; UNVERIFIED |
| S1 | Control / server, MCP, scheduled service path | Direct provider/repository clone with protocol auto, https, ssh; explicit remoteUrl; tracked clone delegates service | auto remains SSH; explicit https/ssh honored. Client fix does not change direct service default | Source verified; focused service tests useful; no UI claim. Explicit protocol:ssh prevents fallback |
| S2 | Control / shorthand, prompt links, publish | owner/repo shorthand routes GitHub HTTPS; web/mobile prompt links hardcode GitHub; publish browser links still use repository.url | Unchanged; no GitLab transport selector involved | Source verified / existing shorthand tests; no capture needed |

## Conditional branches and acceptance

Provider selection vs Git URL; ready vs missing/unauthenticated provider; connected vs unavailable environment; empty vs valid repository; lookup success/failure and stale-result cancellation; confirm vs repository step; clone permission grants; valid vs unsupported/relative path; tracked vs legacy server; clone success/failure/fallback/cancel/retry. Only selected URL changes. Capture the G1 success/error transition and C2 explicit URL interaction; source trace the unchanged guards rather than multiplying screenshots. No new settings/palette/keybinding behavior or reverse-state control is introduced.

Baseline SourceControlRepositoryService already retries SSH authentication_failed or host_key_unverified via HTTPS unless protocol is explicitly ssh. Therefore the brief’s “SSH fails before” must mean observed first SSH attempt failure; total baseline failure is not guaranteed. A recording of an eventual baseline HTTPS success must not be hidden. If a baseline SSH attempt instead times out or is unreachable, label the real environmental failure, not “no SSH key”.

Merge-readiness proof remains OPEN until G1/G2/C1/C2 recordings and actual URL traces exist. No screenshot/recording was collected in this review pass. No claim of private-repository auth, native-mobile success, remote connectivity, or credential security follows from helper tests. Existing self-hosted HTTP behavior is an exposed policy edge, not demonstrated credential leakage; retain exact URL scheme in evidence.

## FRICTION

category | issue | prevention
--- | --- | ---
Evidence | Web confirmation renders browser URL even when baseline sends SSH | Record submitted remoteUrl or Git argv alongside actual UI
Baseline | Existing HTTPS fallback can make the before clone succeed | Capture first attempt and terminal outcome; never manufacture before failure
Provenance | Forge original head differs from replacement local head | Stamp each capture with exact revision and test destination
Isolation | Default dev startup can seed real data | Explicit home, --no-seed, T3CODE_DEV_SEED=0; never live userdata
Transport | HTTPS preference selects self-hosted HTTP web_url verbatim | Include G4 and disclose scheme; do not assert scheme enforcement
Artifacts | Scratch scripts may contain auth or become repo files | Keep under /tmp, inspect/redact, upload separately, never commit

## Executed verification

`vp test run packages/client-runtime/src/operations/projects.test.ts` at replacement head: 1 file, 7 tests passed. Complete diff and repository-wide helper/definition caller searches inspected. No code edits, pushes, comments, merges, watches, live clones, or browser captures performed. This matrix is the requested pre-capture handoff, not a final evidence approval.