# Proof audit pass 2 — final revision evidence

PR [#18597](https://git.cafe/pingdotgg/t3code/pulls/18597), [#18597 on GitHub](https://github.com/pingdotgg/t3code/pull/18597). Read-only proof audit for local `takeover/18597-ssh-options`, not an approval of the still-published contributor head.

Final before [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b); final after [5281c8bbe7](https://github.com/pingdotgg/t3code/commit/5281c8bbe7fb17e69f71976b469e0b4b698aa6f1). The final head has the supplied final base as its second parent. Contributor `jjaroztegi/t3code`, `fix/ssh-env-remotecommand` remains at [220710e41a](https://github.com/jjaroztegi/t3code/commit/220710e41acbc9fe3d86edba4421010550bc3f7e). Clean worktree and exact final HEAD checked before seeding and after checks. Final diff contains only `packages/ssh/src/command.ts` and `command.test.ts`; no committed scratch, fixture keys, or evidence assets.

Both revision-binding methods pass. Seven complete modules/callers are byte-identical from old before [909e4c9482](https://github.com/pingdotgg/t3code/commit/909e4c948278afc2b3e1e665075fb1755a13f894) to final base, and from old after [3d9178e02c](https://github.com/pingdotgg/t3code/commit/3d9178e02ca1da0521bc6c27a31e17d835f6d0b7) to final head: command.ts, auth.ts, errors.ts, tunnel.ts, SshDeviceHost.ts, localSshDeviceHost.ts, and DesktopSshEnvironment.ts. All 14 SHA256 comparisons are published. Independently, the entire matrix was freshly replayed from final git-object snapshots.

Downloaded and read the full public transcript (111 lines including all 12 complete ssh -G outputs) and all 24 results objects, comparing each execution to the matrix and driver. Public standalone transcript, results, README, runtime.py, seed.py, checks.py, and matrix match their bundle/local bytes. The bundle contains all runnable scripts and no keys. The published runtime.py was reused byte-for-byte; only explicit SHAs changed in copies of seed.py/checks.py under audit2. Node imports the complete production command.ts and its adjacent production auth.ts/errors.ts, and invokes exported baseSshArgs for every runtime command. No hand-built replacement for the changed arguments.

## Fresh runtime matrix

Each row has a before and after execution. “Echo” means response bytes exactly equal the 65,806-byte binary request, including every byte value, NUL and 0xff; SHA256 `316a9b745c2422b26959ea97470f85fcc6a9e65a370126c0b46d51d14c355672`. “Script OK” means exit 0, exact `SCRIPT_OK_NO_TTY\n`, and both stdin/stdout checked as non-terminal. RemoteCommand means the fixture alias specifies a command; TTY means `RequestTTY force`.

| Path | Alias | Classification | Final base | Final head |
|---|---|---|---|---|
| Piped script | RemoteCommand | Affected | Exit 255, command collision | Script OK |
| Piped script | TTY | Affected | Exit 42, TTY_PRESENT and terminal echo/CRLF | Script OK |
| Piped script | Both | Affected | Exit 255, command collision masks TTY | Script OK |
| Piped script | Neither | Compatibility control | Script OK | Script OK |
| Desktop -n -N forward | RemoteCommand | Compatibility control | Echo | Echo |
| Desktop -n -N forward | TTY | Compatibility control | Echo | Echo |
| Desktop -n -N forward | Both | Compatibility control | Echo | Echo |
| Desktop -n -N forward | Neither | Compatibility control | Echo | Echo |
| Device -T / held-stdin cat forward | RemoteCommand | Affected | Exit 255, command collision, no transfer | Echo |
| Device -T / held-stdin cat forward | TTY | Compatibility control | Echo, existing -T suppresses TTY | Echo |
| Device -T / held-stdin cat forward | Both | Affected | Exit 255, command collision, no transfer | Echo |
| Device -T / held-stdin cat forward | Neither | Compatibility control | Echo | Echo |

All 24 fresh raw result objects equal the prior published objects, including failure exits/stdout/stderr and classifications: before 7 successes + 5 expected regression failures, after 12 successes. Exactly 14 successful binary echoes in each transcript. No missing or contradicted row. Initial connection-refused retries are readiness attempts, not the outcome of a successful row. Ephemeral ports/config paths changed as expected; no pixel comparison applies.

## Caller coverage and claim limits

- [command.ts](https://github.com/pingdotgg/t3code/blob/5281c8bbe7fb17e69f71976b469e0b4b698aa6f1/packages/ssh/src/command.ts#L208) places the changed production builder before caller arguments. Marker stdin substitutes for the real payload to isolate explicit-command collision and terminal handling.
- [tunnel.ts](https://github.com/pingdotgg/t3code/blob/5281c8bbe7fb17e69f71976b469e0b4b698aa6f1/packages/ssh/src/tunnel.ts#L889) launch, line 950 pairing, line 1002 stop, and line 1023 diagnostics all use runSshCommand with explicit sh commands and piped scripts. They share the demonstrated SSH boundary; their actual scripts/login-shell setup and state changes are not exercised.
- [SshDeviceHost.ts](https://github.com/pingdotgg/t3code/blob/5281c8bbe7fb17e69f71976b469e0b4b698aa6f1/apps/server/src/device/SshDeviceHost.ts#L65) bootstrap and line 174 command execution use the same shared builder. Real node bootstrap/install and working-directory/environment setup are not exercised.
- [tunnel.ts](https://github.com/pingdotgg/t3code/blob/5281c8bbe7fb17e69f71976b469e0b4b698aa6f1/packages/ssh/src/tunnel.ts#L1150) desktop forward and [SshDeviceHost.ts](https://github.com/pingdotgg/t3code/blob/5281c8bbe7fb17e69f71976b469e0b4b698aa6f1/apps/server/src/device/SshDeviceHost.ts#L256) device forward have suffix arguments matching the harness. The device fixture tests one -L endpoint; optional daemon forwarding uses the same transport. Existing -T accounts for the force-only device compatibility result; -N accounts for desktop controls on this OpenSSH version.
- [command.ts](https://github.com/pingdotgg/t3code/blob/5281c8bbe7fb17e69f71976b469e0b4b698aa6f1/packages/ssh/src/command.ts#L336) resolution and [localSshDeviceHost.ts](https://github.com/pingdotgg/t3code/blob/5281c8bbe7fb17e69f71976b469e0b4b698aa6f1/apps/server/src/device/localSshDeviceHost.ts#L21) classification use ssh -G. Runtime verifies hostname/user/port remain correct; focused tests cover local-host classification. [DesktopSshEnvironment.ts](https://github.com/pingdotgg/t3code/blob/5281c8bbe7fb17e69f71976b469e0b4b698aa6f1/apps/desktop/src/ssh/DesktopSshEnvironment.ts#L129) routes desktop operations through the shared manager. Repository-wide TS search found these three production builder call sites and listed shared-command callers.

This is real OpenSSH subprocess/sshd/HTTP evidence at the production argument boundary. It does not invoke the full Effect tunnel lifecycle, UI, install/pair/stop implementation, optional second forward, EOF-driven shutdown, Windows/macOS SSH, password prompting, ProxyJump, multiplexing, or actual remote/relay integration. The driver terminates forwards after verifying bytes. Independent configuration preservation is demonstrated by unchanged config bytes and independent ssh -G resolution, not a separate interactive shell. No false full-app lifecycle claim is made. No UI evidence required for this server-only spec.

## Isolation, cleanup, and checks

Fresh local sshd listened only on 127.0.0.1 port 57841, with temporary -F client config, temporary server config, throwaway client/host keys, /dev/null known-host files, disabled password/keyboard-interactive authentication, and PAM for this host's locked account. No real hosts, ~/.ssh, live T3 data, or account settings were used. Config SHA256 stayed `0e95851894d84359cb0adba0ac9af4ec4ef1ae83b7359b296a3f6a55f8a58ff8`. All aliases retain original RemoteCommand and/or forced TTY in independent ssh -G. Final-head T3 argv resolves remotecommand absent and requesttty false. Keys removed, listener independently confirmed closed; forwarding children terminated/reaped, HTTP server closed, driver exited 0.

Fresh exact-final-tree checks: 15 command/tunnel tests pass, 4 device tests pass, SSH package typecheck exit 0 (two informational existing Effect suggestions), changed-file lint exit 0, diff --check passes. No repo-wide checks. Logs and complete replay instructions are in the new bundle.

GitCafe metadata still identifies the contributor head; its eight successful checks are not evidence for the local replacement. No merge-readiness claim about that published head. No source edits, pushes, comments, or watches; all scratch and copied exports stay in /tmp/to-18597/audit2. The PR was registered with this thread as required by the app.

## Refreshed evidence

- [results.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/96355f859199bc02/results.json)
- [runtime-transcript.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b2236ba38d04bd74/runtime-transcript.txt)
- [README.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c4146f49e98be27c/README.md)
- [ssh-evidence-audit2.tar.gz](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e0a6bb30bf0f0de8/ssh-evidence-audit2.tar.gz)
- [revision-binding.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b26b7d31f83f7d64/revision-binding.txt)

Audit: GPT-6.1 Sol through the Codex harness in T3 Code. No subagents.

FRICTION network | Python urllib default User-Agent received HTTP 403 from file-drop | use curl with an accepted User-Agent for public artifact downloads.

VERDICT: SUFFICIENT