# Proof audit pass 1 — issue 15023

Read-only proof planning; no implementation review, tests, server/browser launch, or capture performed.

Scope: [issue #15023](https://git.cafe/pingdotgg/t3code/issues/15023), [existing PR #21574](https://git.cafe/pingdotgg/t3code/pull/21574). Audited LOCAL replacement [ba908f2d58](https://git.cafe/pingdotgg/t3code/commit/ba908f2d582e96e6e92e152b8c235faea0c27adc), merge base [bb7783e295](https://git.cafe/pingdotgg/t3code/commit/bb7783e295506ad423f527ed28a019836e331e8c), origin/main...ba908f2d58. Worktree /home/ubuntu/wt/issue-15023, branch fix/issue-15023, clean when inspected. Existing PR has a different head; its historical proof is not proof of this replacement.

## Visual fixture matrix: empty (0 rows)

| Changed render path | Fixture/data state | Interaction | Capture or recording | Minimum viewport/theme |
|---|---|---|---|---|

The server-only exception applies. Only RepositoryIdentityResolver.ts and its test change. No component, CSS, render branch, client contract, animation, or interaction handler changes. Existing clients receive different repository identity data, but no changed rendering is introduced. No screenshots, recordings, viewport variants, or theme variants are required. Viewport/theme: N/A. Time-dependent cache transitions require ordered runtime output, not video. A web/desktop/mobile/relay screenshot cross-product would not prove this resolver selection rule.

## Affected caller/data coverage (not visual fixture rows)

| Path or consumer | Affected? | Observable consequence and minimum proof |
|---|---|---|
| ProjectEnrichmentService -> ProjectService project shells; CLI project composition | Yes, server data | Added project exposes selected canonicalKey, locator, displayName, provider, owner/name and origin through real server shell response. |
| ThreadPullRequestService discovery/backfill, fresh pre-link revalidation | Yes, server identity comparison | Existing fork PR repositoryKey matches selected project; persisted thread PR association uses fork selector. Prefer an existing disposable PR; no creation needed. |
| PullRequestService project list/requireProject; list/detail/summary and actions using selected repository | Yes, server routing | Project-filtered list reads fork; hostless fork PR detail succeeds; foreign repository still rejected. Verify routing without merge/close/update mutations. |
| ws clone completion and publish completion explicit refresh | Yes, shared resolver | Same refresh contract; focused service coverage suffices, no need to clone/publish a hosted repository for this local selection fix. |
| Server provider refinement layer | Yes, downstream identity refinement | Real server output must retain fork selection after refinement, rather than testing only an isolated resolver instance. |
| Web PR project filter/assignment, shared project grouping, mobile project selection, add-project clone targets | Data affected; rendering unchanged | Correct canonicalKey and locator/origin feed existing consumers. Check serialized identity; no new visual variants. |
| Desktop shell, remote/relay/tunnel transport, provider agent adapters, MCP/scheduled entry points | No direct code/contract changes | Server-owned identity applies for all clients/entry points using these services. No claim of separately executed platform/connection tests. |

## Branch fixture inventory

All rows below concern the changed server selection path. Transcript means textual request/result and ordered transitions; capture/recording and viewports/themes are N/A throughout.

| ID | Affected branch / fixture | Expected oracle | Proof allocation |
|---|---|---|---|
| B1 | One eligible origin marked base, distinct upstream | Fork canonicalKey and actual origin locator; no redundant origin metadata | Mandatory real server before/after; new regression test |
| B2 | Single OWNER/REPO mark, mixed-case repository, matching fetch remote with nonstandard name | Normalized target key, locator names actual matching remote; distinct origin retained when present | Mandatory real server after; new regression test |
| B3 | OWNER/REPO mark has no matching fetch remote | Existing upstream-first fallback; never synthesize an unfetchable locator | Mandatory runtime transition; new regression test |
| B4 | Multiple eligible marks | Existing fallback, even if one mark is base | Mandatory runtime transition; new regression test |
| B5 | No marks; config query exits 1 | Upstream, else origin, else lexical eligible remote; empty eligible set gives null | Runtime removal plus focused baseline tests for fallback variants |
| B6 | Malformed/empty mark or mark on absent/local-only remote | Ignore unusable mark; preserve eligible-fetch filtering | Focused branch evidence; not established by the two new tests alone |
| B7 | Config invocation fails/nonzero; remote invocation fails/nonzero | Config failure falls back; remote failure yields null | Focused process-runner evidence if claiming error-path coverage; no UI proof |
| B8 | Refresh vs cached resolution after set/change/remove mark | Cached read may retain old identity; explicit refresh observes new selection; server enrichment can have its own cache | Mandatory ordered server transcript; no sleeps or TTL waiting |
| B9 | Bare checkout and nested workspace, fetch vs push URLs, local remotes | New config read uses same root/bare/env treatment; locator remains eligible fetch URL | Existing focused baseline tests plus one bare marked fixture if claiming marked-bare support |

## Minimum real server runtime plan

1. Use an isolated real app server at replacement commit (primary implementer performs this; this audit does not launch one). Record exact SHA, server command/home, Git fixture remotes/config, and endpoint/RPC requests and responses. Redact credentials; do not publish auth headers or pairing URLs. A standalone Effect/resolver script does not replace real server proof.
2. B1: reuse the before fixture, add/read project via supported server entry point, fetch /api/orchestration/shell with protocol 2. Show canonicalKey github.com/juliusmarminge/t3code and locator origin, versus upstream in supplied before transcript. Also read project-filtered PR list and one existing fork PR detail using a hostless reference; show fork routing and no wrong-project rejection. If no accessible existing PR, explicitly retain that integration limit.
3. B2: choose a marked parent fetched by a real nonstandard remote. Read refreshed server identity, showing target canonicalKey plus that exact locator; retain distinct origin. B3: change target to a nonexistent remote repository and explicitly refresh; show fallback. B4: add a second eligible mark and refresh; show fallback. B5/B8: clear marks, read/refresh as appropriate, then set base again and show recovery. Use explicit milestones/refresh calls, not sleeps. An enrichment-only refresh may not invalidate the resolver cache: record the actual supported refresh/restart path used.
4. Thread linking: use existing disposable project/thread and existing fork PR to exercise server discovery or explicit supported linking; record returned/persisted association and matching repository selector. Do not create/merge/close/update hosted PRs merely for proof. If unavailable, say identity/list/detail proof is complete but discovery/link persistence remains unverified.
5. Preserve red test output on base with the added regression and green output at replacement SHA. Implementer reports red test and 113 focused tests passing; this audit did not execute or independently verify those results. Attach exact commands, test filenames/counts, SHA and exit status rather than treating the reported count as runtime proof.

## Existing evidence and current verdict

[Real app before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0475d42dc4429164/runtime-before.txt) was read. It records a real dev server/browser at the stated base, origin base mark, upstream PRs in project filter, and shell HTTP 200 with upstream canonicalKey/locator. It establishes the before failure. It is a narrative transcript containing the shell payload, not a complete raw request log, and contains no after run. The reported red and 113 green tests are accepted as implementer reports only. Proof is pending a matching real server after transcript; no visual evidence is missing.

## FRICTION

- No execution blocker for this planning pass; requested artifact uploaded from /tmp, outside the repository.
- Current authorization forbids capture and starting browser/server; therefore runtime cases above are a plan, not actions taken by this auditor.
- Missing evidence: replacement-head real server after transcript, exact red/green logs, and (unless supplied later) real fork PR discovery/link persistence.
- Existing PR head differs from local replacement. Bind all new evidence to ba908f2d58; do not reuse old PR validation as current-head proof.
- B6/B7 and marked-bare coverage are evidence limits, not implementation findings. No implementation verdict offered.