# PR #27840 evidence matrix (lead-scoped from proof-audit pass 1)

Pass-1 matrix: https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d1bc351c341b0b59/matrix.md

Scope note: the diff changes one server value: GitLab discovery's `auth.status` for a given glab config. No
client code changed, so web, desktop and mobile render whatever status the server returns. Downstream
consumers (publish chooser, add project, new project, mobile) read that same value and their code did not
change. One downstream consumer (add project) is captured to show that the availability now follows the status.
The remaining pass-1 rows (F02, F05, F09-F11, native mobile, timeout and stall harnesses) were dropped because
they render unchanged client code from the same value. A stalled or timed-out `--all` retry is not captured, and no test in the PR exercises it. The code returns the first, signed-out answer when the retry fails (the `unknownAuth` catch maps a timeout to `unknown`, which the retry branch ignores).

Before = merge-base c6ef3b46eb (main), After = head e9312167e2. Real glab binaries, a private scratch
GLAB_CONFIG_DIR per fixture, server started with that env. Same config on both sides.

| Row | Fixture | glab | Surface / route | Captures | Expected Before → After | Affected |
|---|---|---|---|---|---|---|
| R1 | Two hosts: self-hosted host (unreachable or bad token) set as glab default host = signed out; gitlab.com signed in (julius54) | 1.124 | Settings → Source control (`/settings/source-control`), GitLab row | Stills: 1440 light, 1440 dark, 390 light, 390 dark | Not authenticated → Authenticated (account shown) | yes |
| R2 | Same config as R1 | 1.124 | Add project dialog, GitLab source | Still 1440 dark | GitLab source disabled / setup required → enabled | yes |
| R3 | All hosts signed out (self-hosted default with bad token only, or both hosts with bad tokens) | 1.124 | Settings → Source control | Still 1440 dark | Not authenticated → Not authenticated (no false sign-in). Settings does not render `auth.detail` for this state, so the server's discovery result (status + detail) is captured as a JSON transcript per side | control |
| R4 | Old glab, all hosts signed out: `--all` is rejected | 1.53 or 1.78 (genuine release binary) | Settings → Source control | Still 1440 dark + `glab --version` and `glab auth status --all` transcript | Same sign-out row before and after; server discovery-result JSON per side shows the same `auth.status`/`auth.detail` (the retry's unsupported-flag error does not replace it) | control |
| R5 | Old glab, R1's two-host config | 1.53 or 1.78 | Settings → Source control | Still 1440 dark | Same before and after (old glab already lists every host) | control |
| R6 | argv log via a glab wrapper on the server's PATH that logs argv, then execs the real glab: (a) R1 config (b) config whose current host is signed in | 1.124 | server argv log (text) | Transcript per side | (a) after: `auth status` then `auth status --all`; before: `auth status` only. (b) after: `auth status` only, no `--all` | yes |

No interaction or timing rows: each state is a settled discovery result after page load (or after Rescan).