# Proof audit pass 1 — server maintenance resolver

PR [#22745](https://git.cafe/pingdotgg/t3code/pulls/22745) ([GitHub mirror](https://github.com/pingdotgg/t3code/pull/22745)). Branch `fix/issue-22741`.
Compared exact baseline [618761a2d6](https://github.com/pingdotgg/t3code/commit/618761a2d6d615b2c0a07e5de4d82384a583f717) with head [afe4563c43](https://github.com/pingdotgg/t3code/commit/afe4563c43aca935dc302b4daf241d03401ecb71).
Read-only audit of the complete two-file diff in `/home/ubuntu/wt/issue-22741`; no server/browser start, no native machine access, no forge comments or repository edits.

## Findings

No blocking proof-plan defect found. Matrix is ready for pass 2. This is not an assertion that after-proof is complete. Supplied review-round verdicts and lint/typecheck results are lead-reported, not independently reproduced here. Independently reran `vp test run packages/provider-core/src/server/maintenanceResolver.test.ts`: **60 passed**, head verified above. These fixtures are executable shell models, not actual Vite+ dispatch or an actual package upgrade.

[Corrected before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/82eb5e0fabe8d045/issue-22741-baseline.txt) and [exact before RPC](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1a7e87fe044e3ada/issue-22741-before-rpc.json) were read: baseline selects `vp i -g @opencode/cli`, installs the unused managed 2.1.2, and continues to detect delegated 2.1.1 with `unchanged` result. They name the baseline SHA and isolated server ports. After evidence remains with the lead.

Statuses: PASS = independently executed scoped tests; BEFORE = supplied runtime read and verified; PENDING = required primary after runtime; GAP = branch not directly exercised by current added fixtures; UNVERIFIED = native platform not exercised; REVIEWED = source/caller scope only. All rows affected unless explicitly described as regression guards. GAP rows are disclosed fixture-level coverage limits, not mandatory additional real-server runs.

## Fixture matrix

| ID / named fixture | Changed branch, caller or interaction | Data/config and safe seed | Minimum proof / expected observation | Status |
|---|---|---|---|---|
| R1 — real delegated OpenCode 2 | Main regression; maintenance advisory → fresh update → post-update health/version | Lead-owned isolated dev server 16016/web7976; Vite+ 0.3.0 shim, `system_first`; PATH shim then `~/.opencode/bin`; wrapper execs separate disposable npm prefix initially @opencode/cli 2.1.1. Reuse isolated provider record; no threads or live DB needed. | Baseline and head SHA-labelled transcripts; before command `vp i -g @opencode/cli`, actual delegated 2.1.1 remains. Head must show resolver command `<wrapper> upgrade`, run that chosen update through server, capture terminal/RPC output and final update state, same PATH `opencode --version` plus direct prefix version now 2.1.2 (or explicitly recorded current compatible target), and refreshed server detection agrees. Manager success alone is insufficient. | BEFORE verified; after PENDING |
| F1 — XDG delegated | Stable 0.x guard passes; no legacy current; absolute XDG_CONFIG_HOME; PATH external wrapper selected | Temporary `.local/share/vite-plus/0.3.0/bin/vp` with symlink shim; `.config/vite-plus/config.json`; external `.opencode/bin` wrapper → separate executable | Added xdg/system_first/external fixture: initial 2.1.1, native executable + `upgrade`, `opencode-native`, executes delegated sentinel. Real package update belongs to R1. | PASS |
| F2 — legacy delegated | Legacy `.vite-plus/current` stat succeeds, chooses legacy config | Temp legacy home with current symlink and system_first config | Added legacy fixture chooses same delegated update as F1. Linux filesystem model, not native Mac evidence. | PASS |
| F3 — explicit VP_HOME | Absolute VP_HOME takes precedence over layout selection | Added override fixture sets VP_HOME to temp recognized XDG-style install root | Delegated update selected. Fixture does **not** prove arbitrary custom-named VP_HOME roots: initial shim recognizer still only matches known layout names. | PASS for recognized root; arbitrary root outside demonstrated scope |
| F4 — managed configuration | shimMode not system_first | Same stable 0.3.0 fixture, `{"shimMode":"managed"}` and external tool present | Retains `vp i -g @opencode/cli`, vite-plus-global lock. | PASS |
| F5 — malformed / omitted mode | Decode failure or optional missing shimMode | Config malformed JSON and `{}` | Both retain managed update. Wrong-type JSON value is same conservative decode branch, not separately exercised. | PASS; wrong-type variant GAP |
| F6 — external absent | Exhaust PATH without usable external command | Only shim directory on PATH, system_first | Managed fallback; no delegated command. | PASS |
| F7 — newer/unknown Vite+ | Resolved version directory fails stable 0.x regex | Legacy fixtures with real version directories `1.3.0`, `unknown`, stale system_first config, external tool | Both retain managed updater; no PATH delegation. | PASS |
| F8 — other version/target shapes | basename must be vp/vp.exe, parent bin; only /^0\.\d+\.\d+$/ | Fixture-only: 0.x prerelease, malformed version, renamed executable, non-bin real target; future major | Conservative context unchanged. Existing 1.3.0/unknown cover gate outcome, not each operand. | GAP; source-reviewed |
| F9 — bypass and missing executable | Common entrypoint now invokes helper for all resolvers; non-Vite early return, absent binary/resolution/realpath guards | Existing temporary npm/native/project installs and missing binary fixtures; no DB | Core suite confirms normal npm/native ownership and missing command manual behavior; missing realpath and empty option branches not separately established by new fixtures. | PASS regression set; some guards source-only |
| F10 — configuration failures/size | Config stat error→Infinity; >64 KiB stat; read failure→empty; >64 KiB string guard | Fixture-only: missing/unreadable config; oversized file; injected stat/read mismatch to reach second guard | All must retain managed context without throwing; threshold exactly 64 KiB not rejected by size alone. Added malformed config does not cover I/O or size guards. | GAP |
| F11 — environment precedence | Host environment merged with context env; HOME→USERPROFILE→service home; absolute VP_HOME; legacy precedence; XDG absolute/default | Fixture-only isolated HostProcess services; conflicting host/context values; unset HOME; relative VP_HOME/XDG; both legacy and XDG config with opposite modes | Select intended config; relative overrides ignored. Current fixtures establish HOME, absolute VP_HOME, absolute XDG individually, not every precedence/fallback. | PASS partial; remaining GAP |
| F12 — PATH spelling and directory quoting | Context PATH/Path/path before merged environment variants; quoted/empty entries; platform delimiter | Fixture-only PATH variants, quoted directory with spaces, empty entries, inherited PATH; two competing external tools | Choose first eligible external command, preserving original context env for downstream resolver. Current tests exercise ordinary context PATH only. | PASS ordinary; variants GAP |
| F13 — PATH rejection and identity | Candidate missing; Vite shim candidate skipped; realpath failure or same real vp skipped; first valid returned; exhausted search retains context | F1 includes own Vite shim then valid external. Additional temp alternate symlink to same vp, dangling/invalid candidate, second external | No recursive self-selection; continue to next valid target; no arbitrary probe execution. | PASS own-shim skip and valid selection; identity/error/multiple-target variants GAP |
| F14 — delegated ownership handoff | Replaces resolved+real paths only, then existing resolver chooses native/npm/bun/pnpm/mise/brew/manual | Native wrapper covered in F1; other ownership layouts fixture-only using existing core ownership helpers; custom project node_modules path | Existing core suite verifies owned-manager and manual policies separately. Combination of delegation with each downstream manager not directly asserted. | PASS native composition + ownership regression suite; other compositions GAP |
| C1 — affected provider callers | Shared call sites: OpenCode, Codex, Claude, Grok, Pi, Muse; binaryPath + merged instance environment | Source inspect caller options; fixture-only common resolver sufficient for branch selection. OpenCode generation v1 uses opencode-ai, v2 @opencode/cli | No changed driver APIs. OpenCode generation tests in provider-opencode driver.test.ts are optional focused corroboration, not rerun in this audit. Cursor/Antigravity have no direct call to this helper in searched source. | REVIEWED; only OpenCode model runtime requested |
| I1 — cached advisory vs fresh execution | Existing one-hour resolver cache, fresh lookup on update, lock identity change rejection | Existing core cache fixtures; lead server health refresh after loading head. Do not reuse old baseline advisory as proof of head command | Core cache fresh/interrupted fixtures pass. R1 must expose head-selected command and completed post-update state. Runner already refuses changed lock until refresh. | PASS core cache; R1 after PENDING |
| I2 — targeted installs and updater failures | Existing pinning supports owned manager lock keys; native upgrade cannot pin; runner verifies/fails/unchanged | Existing core pinning/advisory tests; runner test file available for focused extension only | Native delegated update may change canInstallVersion to false; do not require targeted native install. Core pinning tests pass; server RPC should represent capabilities accurately. No need to manufacture unrelated failure run. | PASS core; runner not rerun |
| P1 — macOS arm64 native remote layout | POSIX config/path logic plus native Vite+ realpath/layout | Lead-owned native machine, disposable provider prefix/config only; record arch, resolved shim and real vp version, HOME/VP_HOME/config location | Must not infer native layout from Linux temp legacy fixture or path-only Darwin ownership fixture. Native real layout result remains explicitly unverified here. | UNVERIFIED; lead owns native layout |
| P2 — Windows | APPDATA vs home/AppData/Roaming; USERPROFILE; semicolon; quoted dirs; .cmd/.exe/.bat stripping; vp.exe; PATHEXT and realpath | Native Windows fixture or mocked HostProcess+Windows Path/filesystem; no current native environment | New 9 fixtures explicitly skip Windows. Existing Windows ownership fixtures call downstream resolver directly and do not establish new helper behavior. Need platform tests before claiming Windows verified. | UNVERIFIED |
| S1 — surfaces / connection modes | Server-only; unchanged web/desktop/mobile rendering, contracts and transport; environment-local resolution | Same server RPC output serves local and remote clients; no visual seed or theme/viewport matrix | Runtime transcript and scoped tests replace pixel captures per lead instruction. No component, render-path, UI entry-point, wire-schema, reverse-state or continuous-animation changes in full diff. No browser start requested. | REVIEWED; pixel evidence N/A |

## Minimum collection set and handoff

1. Scoped resolver suite above is sufficient minimum automated set for this diff's main matrix: 60/60 passed. Lead-reported lint/typecheck pass remains attributed to lead. Do not run repo-wide checks. `packages/provider-opencode/src/server/driver.test.ts`, `apps/server/src/provider/providerMaintenanceRunner.test.ts`, and `packages/shared/src/shell.test.ts` are optional focused extensions if after runtime reveals a generation, execution or PATH discrepancy; existing tests in them do not automatically cover new helper combinations.
2. Required real-runtime set is R1 before+after, with exact SHAs and actual chosen install version. Lead owns running server; this audit neither starts nor changes it. Seed only disposable install/config/provider data in isolated state; do not modify live T3 userdata or credentials. An empty conversation database is adequate here because no conversation/render behavior is under test; one configured provider is necessary.
3. Keep P1/P2 explicitly unverified until evidence arrives. The remaining GAP variants are fixture-only limits; they do not force native/browser/server runs for every branch. Do not call shell sentinel output proof of an actual package update.
4. Publish only sanitized selected command, version and relevant update state. Remove auth headers/tokens, settings secrets, unrelated provider/project data. This document contains no credentials or customer data.

## Friction

- evidence|Baseline artifacts were already corrected and provided, avoiding wrong-baseline attribution; after proof is still pending.|Label both artifacts with full SHA, platform, effective config/PATH and completed RPC outcome.
- coverage|Added fixtures execute simulated dispatch/update sentinels; several conservative and Windows branches lack direct coverage.|Separate PASS, GAP and native UNVERIFIED; require R1 actual installed-version check rather than treating sentinel success as runtime proof.
- tooling|T3 PR linking rejected the /pull/ URL form; repository+number+host successfully linked the GitCafe PR.|Use structured host/repository/number for GitCafe links. No forge state was changed.

VERDICT: SUFFICIENT