# Proof audit pass 2

Issue: [#5817](https://git.cafe/pingdotgg/t3code/issues/5817). No PR supplied or created. Read-only proof audit; no repository edits, server/browser launch, test rerun, comments, push, merge, or nested agents.

## Findings first

No blocking proof defect or contradictory scoped implementation claim found. The runtime evidence demonstrates removal of the materialization failure and successful provider-driver construction in the captured startup context. Each named fixture's provider cache positively reaches installed/enabled CLI detection and the expected unauthenticated error. It does **not** demonstrate authenticated availability. The pass-1 requirement phrased as “initialized/available” is satisfied only as initialized construction, not authenticated availability.

Two evidence-packaging corrections remain for the eventual PR description, without requiring additional runtime work:

- The linked index still says typecheck is pending. The supplied current server typecheck completed with exit 0 according to the lead's 08:17 confirmation; inspected `/tmp/issue5817-evidence/typecheck.txt` has 310 suggestion diagnostics and zero `error TS` diagnostics. The log does not itself print a process exit marker, so exit 0 attribution remains the lead's confirmation. Do not carry the pending claim forward.
- The worktree advanced during this audit to [282a92e](https://git.cafe/pingdotgg/t3code/commit/282a92e160ff140945a2e63ef289537e44f77946), a merge of origin/main. This audit is pinned to the requested [c3fd754](https://git.cafe/pingdotgg/t3code/commit/c3fd7542373b59bc457b5493edf7cbc711fec361) against [3b95e78](https://git.cafe/pingdotgg/t3code/commit/3b95e7831b11b17627dff16843bc087bfca397ec). Both affected files are byte-identical in the merge head; unrelated imported changes are outside this audit. Do not describe the whole merged tree's diff against the old baseline as only two files.

## Revision and evidence checks

Requested-head diff contains only `apps/server/src/provider/Drivers/CodexHomeLayout.ts` and its test. Comparing runtime capture head [51cf491](https://git.cafe/pingdotgg/t3code/commit/51cf491624be9461b77412c3e30dbe91a33d93e2) to the requested head shows only the test comment correcting the SQLite Windows VFS wording. Implementation source blob is identical at all three heads: `26facd9fb7d4331b6797ce16067fda7ad46a940b`. Requested-head and merge-head test blob is `25b51fde78d06437e32e56ad673bcf86e5ecb123`.

Fetched and read every linked runtime/red/green artifact, the pass-1 matrix, and the index. All six public files matched their supplied local copies byte-for-byte:

- [Baseline runtime](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2652d89c0c97c7fd/before-runtime.txt): revision, environment and startup command; separately names `.tmp`, queue base, and logs SHM conflicts for the three fixture instances.
- [After runtime](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6dd38b9058277c4f/after-runtime-sanitized.txt): same fixture context at the implementation head, startup command/time/ports and isolated home; all three named caches, successful materializer/driver spans, stopped-server queue sentinels and sidecar topology.
- [Red report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fc8aa22bd19f92bf/red-tests.txt): summarized 2 failed / 8 passed baseline report, not full raw runner output. Earlier fixture revision is disclosed. Both failures occur during materialization before the subsequently narrowed assertions; valid evidence of the same regression, supplemented by baseline actual runtime.
- [Earlier green output](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5a71f052c57126b1/green-tests.txt): 11/11 passed, 5.35 seconds, no skips reported; command/revision attribution comes from the lead/index.
- [Pass-1 matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/300af90ea33159b9/issue5817-proof-audit-pass1.md) and [evidence index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0d8f7c3b8253332e/issue5817-evidence-index.md): read in full, including their stated limits.

Final supplied rerun `/tmp/issue5817-evidence/green-final-head.txt` is complete: 1 file passed, 11 tests passed, start 08:18:09, duration 2.17 seconds, no skips reported. Requested-head attribution is supplied by the brief/lead; runner output alone does not embed a SHA or full invocation. Its test source is identical to the merge-head source observed during this audit. No redundant test run was needed. Inspected final lint output contains only the Vite+ invocation note and no diagnostics; its exit status is not independently recorded in that file.

## Row statuses: minimum proof

| Row | Status | Accepted proof and limits |
| --- | --- | --- |
| S1 | SUFFICIENT | Committed test first materializes, creates `.tmp/runtime.lock`, installation_id, queue/goals and future_state_42.sqlite in both homes, then materializes again and asserts retained original text. Baseline actual runtime fails on `.tmp`; after cache identifies `codex-shadow` and reaches expected auth failure. The full synthetic filename list and repeated setup are controlled-test evidence, not separately established by the actual-runtime transcript. |
| S2 | SUFFICIENT | Separate baseline queue conflict, after named `codex-queue` cache, successful startup construction spans, and stopped-server distinct regular 8192-byte queue bases with `shared`/`shadow` sentinel rows. No runtime byte-identity assertion. |
| S3 | SUFFICIENT | Baseline SHM conflict; controlled linked-base fixture asserts base link target and exact original regular WAL/SHM contents in both homes after repeat setup. Actual runtime retains base link and regular sidecars and identifies `codex-sidecars` cache. Existing mixed topology is preserved, never claimed recovered or merged. |
| S4 | SUFFICIENT | Committed fixture verifies local queue base remains readable and shared WAL/SHM plus orphan WAL are not linked into shadow. Source family scan handles a regular sidecar without a local base by blocking new family links as well. The latter subcase is inspection proof, not a separate executed fixture. |
| S5 | SUFFICIENT — inspection | `-journal`, `-wal`, and `-shm` are classified by the same suffix branch. All return the family base name; the same local-family and absent-shared-base guards apply. No explicit rollback-journal fixture or platform execution claimed. No new defect warranted another test. |
| S6 | SUFFICIENT | Existing config conflict fixture passes; source required-name set includes known shared directories and config.toml, so the new family bypass cannot silently localize them. Replaceable lock exception is deliberate. |
| S7 | SUFFICIENT | Existing maintenance-lock and MCP OAuth lock fixtures pass. Both names remain exempt from preservation bypass and reach the existing replacement behavior. |
| S8 | SUFFICIENT | Existing auth/cache, runtime-directory and repeated Finder-metadata fixtures pass; private and excluded-name policy is unchanged. No new claim of exhaustive private-auth error-path execution. |
| S9 | SUFFICIENT — tests + inspection | Setup fixture proves new shared links; repeated setup proves reuse. Existing ensureSymlink retarget logic is unchanged and remains reachable when no local family member exists. Orphan shared sidecars are blocked by the new base-presence guard. No separate wrong-link runtime capture claimed. |
| S10 | SUFFICIENT — tests + inspection | Same-path rejection fixture passes. Direct-mode early return is unchanged. New scan calls use the existing typed readLink error mapper; readDirectory wrapper records the actual directory path. No injected filesystem-failure test or cross-platform execution claimed. |

## Claim boundaries and surfaces

Controlled fixtures assert preserved text bytes after materialization; the actual Codex process legitimately changes SQLite files. The historical runtime hash changes contradict a full-runtime byte-identity claim, but do not contradict the narrower preserved queue sentinel and topology claims. The after transcript explicitly disclaims full byte identity and split-WAL recovery. Existing mixed base/sidecar state remains mixed; this change does not introduce a recovery algorithm.

The success spans contain parent/child span IDs but no instanceId attributes. They establish successful materialization/driver construction in the captured startup, while fixture identity comes from the three named cache records and lead capture context. Do not label any individual span as independently correlated to a specific fixture.

Inspected all three materializer callers: CodexDriver.create, createCodexAdapterV2, and managed-runtime resolve. Shared helper tests cover the changed filesystem policy. Runtime evidence exercises driver construction, not authenticated adapter session launch or managed-runtime execution. No Codex turn, Windows/macOS run, or per-client/remote/relay execution established.

Explicit server-only exception applies: required visual matrix is EMPTY, 0/0. No render, style, interaction, RPC contract, permission, reverse-state or transport change exists in the pinned diff. Web, desktop and mobile consume the unchanged server result; other provider adapters are unaffected. Pixel rebuilds, screenshots and recordings are inapplicable, and none were requested or launched for this pass.

## FRICTION

- brief: worktree head advanced to a merge while audit was starting; scope pinned to supplied head and affected-file blob identity checked. Index's pending typecheck statement is stale; corrected above.
- tool: Python's default urllib user-agent received HTTP 403 on the artifact host; a standard browser user-agent fetched all six files successfully. No browser automation used.
- runbook: pass 1 reported missing EVIDENCE.md; no additional unavailable runbook requirements inferred or invented.
- infra: no new failures during this pass; prior restart interruption remains historical context only.
- forge: GitCafe issue read succeeded using cafe after checking origin; no forge writes.
- policy: server-only exception honored; no browser/server or nested-agent work.
- model: none.
- other: exit-code attribution and trace-correlation limitations explicitly recorded above.

VERDICT: SUFFICIENT