# Read-only proof audit, pass 1 — issue 19821

## Scope and verdict

Explicit comparison: base `8acbefefc51b4d281dcd04108c82baa1ab902b0e` → head `e7417481e5a2a2f130551092f05e1aced2072b08`. Checkout HEAD matches; working tree clean at inspection. No moving origin/main used. All four changed files and their entire diff reviewed. No checkout edits, tests, browser capture, server launch, forge commands/posts, or subagents in this pass. Artifact written outside checkout and uploaded as requested.

**Visual fixture matrix: EMPTY (0 rows).** This is a server/provider guidance fix, with no changed client render path, layout, animation, navigation, or interaction implementation. Agent-produced conversation text can change, but the renderer does not. A screenshot or recording would not prove instruction routing or retained conversation context. Required proof is a red regression test, green focused checks, and runtime transcript. No MCP hard stop is imposed by this audit.

## Visual matrix

| Affected visual fixture | Changed render path | Still / recording | Seed method |
| --- | --- | --- | --- |

Zero body rows intentionally. Do not invent web/desktop/mobile visual fixtures for a server-only guidance change.

## Complete diff coverage and nonvisual fixture matrix

These are behavioral/source fixtures, not rows in the visual matrix. All capture modes are text/source/test output; no stills or recordings required.

| File / affected path | Affected? | Fixture and expected result | Seed method | Evidence / status |
| --- | --- | --- | --- | --- |
| `apps/server/src/mcp/toolkits/orchestrator/tools.ts`: `delegate_task` description | Yes | Distinguish independent review (new delegation, task ID, request ID) from a follow-up needing the same child's conversation (`t3_thread_send` to childThreadId). | Read tool description; expose toolkit in normal MCP-enabled agent session. | Full diff inspected. Guidance now agrees with existing thread-send description. |
| `packages/provider-core/src/server/orchestrationInstructions.ts`: shared injected sections | Yes | Independent reviews remain fresh delegations; same-conversation follow-ups explicitly permitted. | Fresh MCP-enabled provider session loading head instructions; do not reuse stale injected guidance. | Full diff inspected; Codex after transcript exercises this distinction. |
| `apps/server/src/mcp/toolkits/orchestrator/tools.test.ts` | Yes | Shared injection, delegate description, and existing thread-send description all state both branches; obsolete broad review-round wording absent. | Test-only commit `23673c96f8` over explicit base for red; head for green. No runtime data seed. | Red commit inspected; its positive assertions fail against baseline injection/delegate wording. Head adds obsolete-wording assertion. Red execution and 18 green tests reported by requester; execution logs not supplied or independently rerun. |
| `docs/orchestration-v2/orchestrator-mcp-server.md` | Yes | Document independent reviews versus same-conversation follow-ups; follow-up creates a fresh task in same thread, original task stays completed. | Source review only. | Full diff inspected; agrees with existing thread-send contract. |
| `t3_thread_send` description / task routing implementation | No implementation change; compatibility affected | Same childThreadId across rounds; fresh task IDs; original result retained. | Round 1 delegate, then two thread sends after completion. | Description unchanged and covered by regression. Runtime transcript reports three distinct task IDs and one shared childThreadId. Original-result immutability is described but not independently inspected in this pass. |
| Codex injected additional-context sections | Yes, through shared text | Complete revised guidance delivered, authored order retained, every entry within UTF-8 byte cap. | Existing `CodexDeveloperInstructions.test.ts` fixture combinations (two runtime models × seven tool-availability cases), plus section ordering. | Tests inspected; byte-cap success reported by requester, execution log not supplied. Codex runtime after supplied. |
| Claude shared injection; Cursor first-run prompt; OpenCode system prompt; ACP instruction wrapper; Pi MCP extension | Yes, through shared text consumers | Revised distinction reaches providers through existing injection paths. | Fresh MCP-enabled sessions; same three-round synthetic probe if runtime expansion is needed. ACP wrapper requires first injection or instruction-state change. | Consumer references inspected. Before transcript includes Claude; no head Claude/other-provider runtime transcript supplied. No provider-specific implementation changed. |
| Web, Electron desktop, React Native mobile; Settings, palette, keybindings | No render/entry-point change | None. | None. | No client file in four-file diff. No visual fixture or UI capture needed. |
| Local / remote / relay / tunnel / multi-environment | No transport or contract change | Existing transport should deliver identical guidance. | Existing isolated runtime suffices for this text-only change; no new connection seed. | No wire schema, transport, permission, reverse-state, or persistence changes. No dedicated connection-mode proof required. |

## Required proof set and supplied coverage

1. **Red regression against explicit old source.** Test-only commit `23673c96f8` is present and follows explicit base. Its assertions distinguish the contradictory old wording from the desired policy. Requester reports red execution. Attach exact command, source SHA, failure output and exit code if a self-contained executable proof bundle is required; this audit did not receive them.
2. **Green focused tests at head.** Requester reports 18 tests green plus byte-cap checks. Source confirms targeted guidance regression and meaningful byte-cap/order coverage exist. Preserve exact commands, head SHA and results; this pass did not rerun tests or independently verify counts.
3. **Before runtime transcript.** [Actual before MCP transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b532b8d0f3933a0a/19821-runtime-before.md) fetched and read. Codex and Claude both follow old broad guidance by using fresh delegations. Codex includes marker in supplied context; Claude cannot recall marker omitted from its fresh-child prompt. This demonstrates the guidance conflict, not a source-pinned baseline experiment: transcript explicitly says running build was not mapped to base.
4. **After runtime transcript.** [Actual after web-dev transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7a2d25b7de4eb00f/19821-runtime-after.md) fetched and read. It declares head source and isolated state, reports actual Codex gpt-6.1-sol/options [], delegate in round 1, thread-send in rounds 2/3, one shared childThreadId and three distinct task IDs. Replies are READY; APRICOT19821; an accurate account of round 2. Round 2 prompt omits marker. All three runs completed. It is rendered text with agent-reported calls/IDs, not a raw structured MCP trace; sufficient behavioral transcript for this guidance fix, with that provenance limit stated.
5. **Review.** Two isolated MERGE verdicts reported by requester. Reviewer artifacts were not supplied, so not independently audited. They supplement rather than replace regression/runtime proof.

## Gaps and disposition

- Exact baseline attribution is missing for the before live service. Do not describe the runtime pair as a controlled same-build A/B at explicit base/head. The explicit-base red test supplies source-level regression attribution; the actual-before transcript supplies observational context. A new baseline runtime run is optional stronger evidence, not a browser/video requirement or automatic MCP hard stop.
- Red/green/byte-cap execution logs and reviewer reports are reported inputs, not independently verified artifacts here. Link them for a fully self-contained evidence packet.
- Head runtime behavior demonstrated for Codex only. Claude and other shared-text consumers remain source-covered, not runtime-proven. Additional provider runs are optional scope expansion for this shared guidance change unless broader runtime claims are made.
- After run encountered watcher restart from test-created `.vite-temp` files, then resumed and completed. Acknowledge this interruption; do not claim an uninterrupted run. It does not invalidate the documented completed continuation sequence.
- No visual evidence gap. No missing still, recording, real-data database seed, client entry-point run, or remote-mode capture follows from this diff.

## FRICTION

- **brief:** Original broad “review round” wording conflated independent review with same-conversation follow-up; revised scope resolves it. No MCP hard stop in revised brief.
- **runbook:** Server-only proof should use an EMPTY visual matrix plus red test/runtime transcript, rather than forced UI screenshots. Baseline runtime provenance and exact test logs should travel with evidence.
- **infra:** Supplied after run hit a dev watcher restart caused by `.vite-temp` test files and recovered. No infrastructure exercised by this audit.
- **policy:** Before injected higher-priority guidance prohibited requested child-thread continuation; changed guidance narrows the prohibition to independent reviews.
- **tool:** No blocking tool failure in this pass. Existing thread-send description already supports fresh tasks in the same conversation.
- **forge:** No forge interaction performed or required; only authorized ghdrop artifact upload.
- **model:** Before model choices followed the conflicting instructions; after Codex follows the revised distinction. No model defect established.
- **other:** Supplied transcripts are human-readable summaries/rendered text, not raw tool event exports; retain this distinction in proof claims.