# PASS2 final proof audit

VERDICT: **SUFFICIENT — all 22 rows**, within the authorized server instruction-text boundaries. No insufficient rows or unresolved evidence objections.

Audited replacement [#24576](https://github.com/pingdotgg/t3code/pull/24576), replacing original [#16482](https://git.cafe/pingdotgg/t3code/pulls/16482). Read-only checkout `/home/ubuntu/wt/pr-16482`, branch `fix/takeover-16482`, exact final [13e24a9d913e9bf072a2d00a72bdb65ee12f4af7](https://github.com/pingdotgg/t3code/commit/13e24a9d913e9bf072a2d00a72bdb65ee12f4af7), baseline [3cc31ed27c8956b36cee35a50509fb7c6869592b](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b). Clean at entry and exit; final HEAD rechecked. No edits, commits, pushes, comments, watches, app servers, browser, recordings, UI, live models or live userdata access. Required thread PR registration succeeded; linked PR is not watched. CI/review status was not queried.

Evidence audited: [updated index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dad2791f3aea8244/index.md), [catalog](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e5af4e5db4ff1061/catalog.md), [22-row matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/65228eaf42411351/matrix.md), local final-links.json and verification.json, all eight complete transcripts, both ACP JSON captures, full rendered/source/refresh diffs, caller proof, test/capture logs and public driver source. Seventeen publicly downloaded transcript/JSON/diff/caller/textual/launcher artifacts matched local bytes. All 33 reported snapshot source hashes matched the exact git objects. Both source diffs matched `git diff` byte for byte; the complete rendered diff regenerated exactly from all eight transcripts. Repeated representations were inspected through their exhaustive unique changed lines and full-byte regeneration/reproduction, rather than treating repeated text as distinct changes.

## All row statuses

| Row | Verdict | Evidence boundary and observed behavior |
| --- | --- | --- |
| CL-ATTACHED | SUFFICIENT | `before-claude.txt`, `after-claude.txt`: real `makeClaudeQueryOptions.systemPrompt.append`; CORE retained, CODEX/ACP removed after. |
| CL-RESUME | SUFFICIENT | Same builder drivers: resume=true append asserted byte-identical to resume=false; PASS marker in both Claude transcripts. |
| CL-DETACHED | SUFFICIENT | Claude transcript: mcpServers omitted, runtime only, no orchestration. |
| CX-ATTACHED | SUFFICIENT | Codex transcripts: real `buildCodexTurnStartParams`, default gpt-6.1-sol, hasT3Mcp=true; CORE+CODEX retained, ACP removed. New application key `t3_code_tool_discovery`, 156 UTF-8 bytes. |
| CX-PLAN | SUFFICIENT | Codex transcript: plan collaborationMode and developer instructions retained, same provider-scoped context; builder assertion. |
| CX-TOOLS | SUFFICIENT | Codex transcripts: browser/device both false versus both true; Unicode custom model metadata; every value asserted <=4000 UTF-8 bytes. Existing cap test also run both sides. |
| CX-DETACHED | SUFFICIENT | Codex turn builder with hasT3Mcp=false, no appContext; additionalContext and collaborationMode absent. |
| AC-FIRST | SUFFICIENT | ACP sequence A request 3: actual outgoing prompt after two native slash commands; default mode/browser/CORE/ACP; CODEX removed after. |
| AC-DETACHED | SUFFICIENT | ACP sequence D request 1: actual first detached prompt, mode wrapper only plus separate runtime block. |
| AC-UNCHANGED | SUFFICIENT | ACP sequence A requests 4 and 6; exact raw first text block, no instruction wrapper; independent runtime block retained. Finalize script asserts no wrapper. |
| AC-MODE | SUFFICIENT | ACP sequence A default -> plan -> default at requests 3,5,7; all correctly wrapped; original adapter test checks native mode-setting calls. |
| AC-MCP-CHANGE | SUFFICIENT | ACP sequence D absent -> attached -> absent -> unchanged; dynamic McpProviderSessions set/clear, actual outgoing prompts and focused assertions. |
| AC-SLASH | SUFFICIENT | ACP sequence A requests 1,2, sequence B request 3, sequence C requests 2,4,5; exact command, one text block; subsequent ordinary prompt still injects. |
| AC-COMPACT | SUFFICIENT | ACP sequence B: mock protocol compaction at prompt ordinals 2,4, including during reinjection; next ordinary prompts reinject, following prompt raw. |
| AC-NATIVE-COMPACT | SUFFICIENT | ACP sequence C: failed compact ordinal2 leaves following prompt raw; successful compact then slash preserves marker for ordinary reinjection. |
| CU-FIRST | SUFFICIENT | Shared-consumer transcript `CU-FIRST`: production helper output, first run MCP attached; CORE retained, CODEX/ACP removed. |
| CU-LATER-OFF | SUFFICIENT | Shared transcript: runOrdinal=2 attached, and first run detached, both raw user prompt assertions. |
| CU-COMPRESS | SUFFICIENT | `adapter-controls-before.log`, `adapter-controls-after.log`: existing Cursor adapter test confirms outgoing `/compress`; early-return caller in caller proof. |
| OC1-ATTACHED | SUFFICIENT | Shared transcript includes helper output AND actual fake-SDK promptAsync system string; owned connection+MCP; one mcp.add; runtime+CORE retained, CODEX/ACP removed. |
| OC1-EXTERNAL-OFF | SUFFICIENT | Shared transcript actual SDK boundary: external+MCP and owned without MCP, runtime only, zero mcp.add calls; focused assertions. |
| OC2-ATTACHED | SUFFICIENT | Shared transcript `OC2-ATTACHED`: production helper and runtime builder output in v2 join order; inspected entry.put caller; CORE+runtime retained, CODEX/ACP removed. SDK boundary unexecuted. |
| OC2-OFF-UNCHANGED | SUFFICIENT | Shared transcript runtime-only helper output when unavailable; failed-add and duplicate-put branches caller-inspected in `caller-proof.txt`, not executed. |

Row 22 is sufficient for the explicitly authorized helper-plus-caller boundary: final v2 caller computes `wanted` from session availability and external ownership; `mcpAvailable` starts false, failed add maps to false, helper receives that value, and `entry.put` occurs only when rendered instructions differ. Caller is unchanged between baseline and final. Failed-add and duplicate-put/cache branches were inspected, not runtime-executed. Row 21 likewise does not claim a v2 SDK execution. Cursor first/later/off is helper coverage; `/compress` is existing adapter coverage. ACP is the real adapter plus AcpSessionRuntime over the acp-test mock subprocess, not a real Grok/ACP CLI or model. OpenCode v1 uses the real adapter with fake SDK calls.

## Every textual difference accounted for

1. Shared normalized-prefix paragraph removes the generic backtick-quoted `mcp__t3_code__delegate_task` example; normalized-prefix guidance itself remains.
2. Shared text removes the original Codex-specific discovery sentence. Codex receives a new application entry `t3_code_tool_discovery` with the revised sentence, preserving the exact `tools.mcp__t3_code__orchestrator_capabilities({})` call; it is 156 UTF-8 bytes. Shared section 04 changes from 1653 to 812 bytes.
3. ACP fallback leaves shared instructions and becomes attached-ACP-only text. In ACP it moves after common visuals and model-options guidance, rather than remaining before those paragraphs.
4. ACP fallback is **not byte-identical**: the delegation command gains the same full executable/environment/optional-entrypoint prefix as discovery. Discovery command, JSON payload, standalone-entrypoint explanation and remaining fallback prose are unchanged.
5. Rendered JSON framing, key insertion and byte-count metadata reflect those changes; SHA header changes are capture metadata. No additional instruction-text changes were found. Runtime, mode, browser/device, user text and wrapper contracts retain their existing behavior.

Relative to the previous evidence head, source changes are exactly the full delegation launcher and its four-line strengthened existing assertion, in two files. Across all 24 ACP outgoing requests per revision, nine attached wrapper blocks change; every other ACP block is byte-identical. Slash commands stay one exact raw block; ordinary raw requests retain a distinct runtime block; detached controls omit orchestration. No provider-neutral fallback leakage remains in the affected captured outputs.

## Independent public-driver reproduction

Downloaded the [public driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e933c505a1df70d0/to-16482-refresh-driver.tar.gz), inspected its setup/instrumentation/builders/finalizer/run/cap/launcher scripts, and ran the entire driver against pinned git archives in `/tmp/to-16482-finalaudit-independent-*`. Only scratch names were remapped from `to-16482` to `to-16482-finalaudit-independent`; production source, inputs, SHA selection, test selectors and assertions were unchanged. Installed dependency symlinks are read-only inputs. No existing evidence files were overwritten.

**All ten transcript/capture files matched exact bytes, without normalization.** Full rendered diff, production diff, caller proof and blob proof also matched exact bytes. Fresh logs and transformed public driver are in the [independent proof bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/567456c92d838da3/independent-proof.tar.gz).

| Reproduced file | Bytes | SHA-256 | Comparison |
| --- | ---: | --- | --- |
| before-claude.txt | 11851 | `22faee32e0f5d788cd04c87e83dad4b17b79522e18ecbde9166cca77abfbe949` | exact |
| before-codex.txt | 84826 | `e268866608c7098d274d9242c877b9468d63216e9347c6b206b74ede86cd9664` | exact |
| before-acp.txt | 127326 | `4c872f2e164ceb23329f3e594c2dba9731e3d2691a32a7e9b4f647b52fd13b73` | exact |
| before-acp.json | 131260 | `71bd772be64cad087f34fbabba230773a037e839794d6b99a57f923f19ec2c2b` | exact |
| before-shared-consumers.txt | 44899 | `62faf3267d6c70a2c5cccaefc2521a6eaac74e72ad545d7556df5f7b38f06d43` | exact |
| after-claude.txt | 11010 | `fb7d0d6e31bd909cc1991f75b8ba606b3beccf4642bc685e72ab5e4ee694fde1` | exact |
| after-codex.txt | 81130 | `514bf48de6bc1a28a36911e48dbbea62b24bb91ef9e456b25cb4485310b9e0b6` | exact |
| after-acp.txt | 126570 | `4b4bf7373f045e39f0dd075a133eaff3330e998e7268bcd0d2589d8b264016a6` | exact |
| after-acp.json | 130540 | `8895bc44656e0737816ddbbbc8766c634e6102afe9a4d3ffb4c79ac1c186bfbf` | exact |
| after-shared-consumers.txt | 41535 | `600bffc7e8c0d8e8027662f90da778cb880e6f35b5d74e86a93d5811e32559d8` | exact |

Fresh regression results: baseline **4 expected failures / 3 passes / 267 skipped**, final **7 passes / 267 skipped**. Baseline failures are Claude scoping, Codex scoping and the two reinjection assertions requiring the corrected launcher. Baseline capture intentionally omits only the new launcher assertion; the regression run retains the unmodified final tests. On both revisions: builder capture 1 pass; ACP capture 4 passes; OpenCode v1 SDK controls 3 passes; Codex/Cursor controls 3 passes; byte-cap checks 2 passes. The previous 274-focused-test and Pi-298 reports and two MERGE reviews are background, not recertified full-suite or review claims here.

Shell verification independently extracted both discovery and delegation commands from the final rendered ACP transcript. Four checks passed: both commands with entrypoint unset and with a path containing spaces; the fake executable path also contains spaces. Exact argument order, optional argument presence, one intact JSON argument and `ELECTRON_RUN_AS_NODE=1` were checked. This is shell expansion/argv proof only, not real ACP transport execution.

## FRICTION

Python urllib downloads returned HTTP 403; curl succeeded on the same public artifacts and all seventeen comparisons passed. Public driver's absolute scratch paths required the documented prefix-only remap to avoid overwriting prior artifacts. No test failure beyond the four intentional baseline failures, no unexplained byte mismatch, and no source edits. Node runtime captured by Vite+ is v26.12.1; shell Node differences do not affect exact reproduced output. Matrix's embedded PASS1 narrative links its older archive, but its opening latest-index/catalog links resolve to refreshed evidence; this audit used the latest artifacts and exact final head.

Performed through Codex harness, gpt-6.1-sol. Uploaded using the ghdrop skill with `ghdrop upload -m`.

**VERDICT: SUFFICIENT — 22/22 rows.**