C1 — real Android app; captured 2026-10-28 UTC
Head APK; root A absent. Direct actual backend http://100.122.65.41:15734, route 1 of 1, no TLS or HTTP redirect. First upgrade at 00:47:51.563 is mobile. Second localhost upgrade at 00:47:58.208 belongs to the explicitly labeled seed driver, not mobile; it renames the project to Cleartext, then app reads the new title.

Redaction: no query strings, headers, tokens, pairing codes or message payloads. TLS errors are observed at the server after the client aborts trust validation. Method/path/status retained; WS generations are proxy-local identifiers. Canary RPC responses contain synthetic data only.

{"time": "2026-10-28T00:47:49.087Z", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:49.439Z", "method": "POST", "path": "/oauth/token", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:50.643Z", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:51.178Z", "method": "POST", "path": "/api/auth/websocket-ticket/rpc", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:51.413Z", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:51.546Z", "method": "GET", "path": "/api/auth/session", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:51.563Z", "method": "GET", "path": "/ws", "status": 101, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:51.660Z", "method": "GET", "path": "/api/auth/session", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:51.909Z", "method": "GET", "path": "/api/auth/session", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:51.935Z", "method": "GET", "path": "/api/orchestration/shell", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:53.014Z", "method": "GET", "path": "/api/orchestration/shell", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:58.179Z", "method": "POST", "path": "/oauth/token", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:58.197Z", "method": "POST", "path": "/api/auth/websocket-ticket/rpc", "status": 200, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:58.208Z", "method": "GET", "path": "/ws", "status": 101, "port": 15734, "source": "backend-direct"}
{"time": "2026-10-28T00:47:58.250Z", "operation": "rename", "result": {"_tag": "Exit", "requestId": "0ef607c2-af38-4a9f-940b-171ed53e7aec", "exit": {"_tag": "Success", "value": {"id": "android-ca-proof", "title": "Android CA proof — Cleartext", "workspaceRoot": "/tmp/lead-25730-r1/evidence/synthetic-project", "repositoryIdentity": null, "faviconPath": null, "projectIcon": null, "defaultModelSelection": null, "defaultThreadEnvMode": null, "autoPull": false, "scripts": [], "createdAt": "2026-10-28T00:26:23.590Z", "updatedAt": "2026-10-28T00:47:58.235Z", "deletedAt": null}}}, "source": "authenticated-localhost-seed-driver"}