# Proof audit pass 1 — publish protocol takeover

Read-only planning audit for [#18717](https://git.cafe/pingdotgg/t3code/pulls/18717), also [#18717](https://github.com/pingdotgg/t3code/pull/18717).

Scope: `/home/ubuntu/wt/pr-18717` only. Reviewed complete five-file takeover diff from [7fd2e09e38](https://github.com/pingdotgg/t3code/commit/7fd2e09e38) to [9456cd2a68](https://github.com/pingdotgg/t3code/commit/9456cd2a687586d9e9fcc827c33303bc2dad649f). Server repository service, optional core provider capability, GitHub adapter, and their two test files are affected. No UI changes or UI proof requirements. All evidence below is PLANNED, not captured or passed. No tests or servers were run in pass 1.

Use fixture URLs H = `https://github.com/proof-owner/proof-repo.git`, S = `git@github.com:proof-owner/proof-repo.git`. These are inert returned fixture strings, never real repositories. Before means mergebase; after means takeover head. Tests may use their existing octocat fixture equivalents.

| ID | Affected path / fixture | Before expectation | After expectation | Required proof / current source coverage |
| --- | --- | --- | --- | --- |
| P1 | Publish, auto; real gh config `git_protocol: ssh` | S | S | Actual dev-server RPC runtime transcript, both revisions; scoped service tests cover mocked preference. |
| P2 | Publish, auto; real gh config `git_protocol: https` | S | H | Actual dev-server RPC runtime transcript, both revisions; decisive behavior change. Scoped service tests cover mocked preference. |
| P3 | Publish, auto; fresh real GH_CONFIG_DIR with no git_protocol configured | S | H, provided real gh successfully reports its HTTPS default | Actual dev-server RPC runtime transcript, both revisions. Record real gh version, argv, exit status, stdout. An empty mocked output is NOT proof of unset-config behavior. |
| P4 | Publish, omitted protocol; preferred SSH / HTTPS | S / S | S / H | Scoped service tests already enumerate both omitted cases; run them. Distinguishes omitted from literal auto. Runtime repetition unnecessary after P1–P3 plus these tests. |
| P5 | Publish, explicit ssh with CLI preference https; explicit https with CLI preference ssh | S / H | S / H | Scoped service tests enumerate both. Also prove preferredCloneProtocol is not invoked for explicit protocols (current assertions check result only). Test proof sufficient. |
| P6 | Publish, auto; provider has no optional capability; separately capability returns null | S | S | Scoped service test covers missing capability, not explicit null. Focused null-case proof still needed. No cross-provider runtime sweep required; other providers inherit absence behavior. |
| G1 | GitHub preference, URL on ghe.test; config reports ssh / https | Capability absent | Host-specific SSH / HTTPS | Scoped adapter tests assert exact `gh config get -h ghe.test git_protocol`. Test proof sufficient; fixture must distinguish host override from global setting. |
| G2 | GitHub preference, successful empty or other non-ssh output | Capability absent | HTTPS | Existing adapter test covers empty successful output; arbitrary non-ssh output is a small additional test if claiming parity for all values. Not a substitute for P3. |
| G3 | GitHub CLI spawn error, timeout or nonzero command failure; auto publish | S | Adapter catches process failure to null; service selects S | Focused adapter failure test plus service null test. Existing new tests do not cover the failure branch. Test one representative typed process failure; scoped VcsProcess tests establish nonzero rejection. No real network or missing credentials needed. |
| C1 | Provider-backed prepareClone, auto / omitted with HTTPS preference | S | H | Scoped service prepareClone test covers explicit auto HTTPS and real temporary destination parent. Add omitted variant or cite shared resolver P4 with explicit coverage limitation. Test proof sufficient; no actual network clone required. |
| C2 | Provider-backed clone, explicit ssh / https against opposite preference | S / H | S / H | Focused prepareClone tests should assert URL and preference lookup bypass. Direct URL-only clone is unchanged: its supplied URL must remain untouched. One guard test for that branch is sufficient. |
| C3 | Clone selected SSH, auto, rejected SSH authentication; explicit ssh control | Auto retries HTTPS; explicit ssh does not | Same behavior | Existing clone retry/no-retry tests exercise direct URLs. Run them; add one provider-backed auto-SSH selection-to-retry case if asserting integration of the newly selected URL with fallback. Stub Git execution. |

## Minimum execution proof

Run only the two scoped files through the repository's `vp test run` configuration: `apps/server/src/sourceControl/SourceControlRepositoryService.test.ts` and `packages/source-control-github/src/server/GitHubSourceControlProvider.test.ts`. Save command, tested SHA, counts and exit status. Missing rows above are gaps, not fabricated passing tests. Targeted typechecks should cover server, source-control-core and source-control-github when the implementation owner performs validation. No repo-wide checks.

The dispatcher explicitly accepts server evidence in place of UI captures: scoped tests PLUS P1–P3 before/after runtime transcripts. No screenshots, browser launch, desktop or mobile exercise is required. All clients share the unchanged server RPC; no provider harness turn is required. There are no new contracts, permissions, reverse-state operations, or transport changes.

## Safe runtime capture plan (later authorized capture task)

1. Keep source checkout unchanged. Create all harness material outside it. Use `/tmp/ev-18717` as the explicitly selected fresh T3 home for each sequential revision run; archive each run into separate scratch evidence directories before recreating a fresh home. Do not overwrite a pre-existing directory without checking ownership and contents. Do not seed, migrate, copy, inspect, or mount the live `~/.t3` directory. Set `T3CODE_DEV_SEED=0` AND pass `--no-seed --home-dir /tmp/ev-18717` to the dev runner; use server-only mode where supported, no share/browser. Read the actual bound port from startup output. Do not set VITE_HTTP_URL or VITE_WS_URL.
2. Launch with an allowlisted environment and a fresh scratch HOME, XDG_CONFIG_HOME, XDG_STATE_HOME, XDG_CACHE_HOME, GH_CONFIG_DIR, and Git global config. Exclude ambient provider tokens, GH_TOKEN/GITHUB_TOKEN, T3 credentials, `.env` loading and existing keychain credentials; give only synthetic local test credentials if an adapter fixture needs them. Verify any dev-runner dotenv behavior before launch. Keep auth tokens and startup pairing links out of public transcripts. Use only a temporary local workspace under scratch, never the source checkout as publish cwd. A local empty git repository is acceptable; never create a forge repository.
3. A gh executable shim alone is NOT a safe creation boundary: current createRepository uses GitHub REST, including viewer lookup before POST. Install an explicit test-only module/layer boundary in the actual dev-server process (e.g. external loader) that replaces provider createRepository with deterministic H/S metadata and records the intercepted invocation. Keep the production GitHub preferredCloneProtocol method, SourceControlHost.process.run, real gh config command, service resolver, and server WebSocket handler intact. Fail closed for all external HTTP and unapproved subprocess effects. Do not claim a standalone Effect service harness is a dev-server capture.
4. Intercept git.ensureRemote to record the resolved URL and intentionally stop with a recognizable evidence sentinel before any push, remote mutation or network operation. Invoke the actual authenticated `sourceControlPublishRepository` RPC using the declared contract. Transcript must connect request id, protocol, creation stub, real gh invocation and captured ensureRemote URL. An intentional RPC error after the recorded URL is acceptable; label it clearly. This proves resolved URL selection only, not successful repository creation or push. The base run must use the same stub boundaries, not a hard-coded before result.
5. Keep real `/usr/bin/gh` for P1–P3. Use separate temporary GH_CONFIG_DIRs: write synthetic ssh and https settings using the real CLI; leave the unset directory genuinely unconfigured. Record sanitized effective settings and `gh --version`; do not handcraft stdout or replace config get. Each fixture must be applied to the server subprocess environment (restart per fixture if needed), not merely the RPC client's shell. External loader must not alter protocol selection.
6. Before and after must run actual respective source revisions. Do not reset, checkout, or modify this read-only worktree. A later owner can supply an audited external module loader overlay of mergebase sources, or request authorization for a separate isolated base checkout. Record source/module hashes and the overlay manifest; if no credible base server can be run within constraints, leave before evidence blocked. Do not use the supplied original fork SHA as the before baseline without resolving its provenance.
7. Retain only launch PIDs and stop only those processes; never kill by pattern. Capture startup home/seed confirmation, revision identity, fixture identity, real gh results and selected URL. Publish only a sanitized transcript, excluding environment dumps, auth URLs/tokens and personal data. All runtime work remains pending after this audit.

## FRICTION

- Supplied original [9ae2a8ddc76](https://github.com/Mnigos/t3code/commit/9ae2a8ddc76bdf4b01b73ac365a7573d2b2753a1) is locally a merge commit titled `Merge remote-tracking branch 'origin/main' into takeover/18717`, not a directly identifiable original feature delta. Comparing it directly to the current mergebase includes unrelated historical changes; the five-file current takeover diff is the audited scope. Original-PR provenance remains unresolved.
- Creation precedes URL resolution and is REST-backed. A PATH-only gh stub would not prevent real repository creation. A fail-closed external server fixture boundary is required and is not implemented or validated here.
- Safe before capture requires a base-source server while preserving the current checkout. No server or overlay was prepared during this read-only pass.
- Existing tests are plausible source coverage, not execution evidence; process-failure/null and explicit-lookup-bypass assertions remain gaps.

Pass 2 should audit actual evidence against this matrix. This document is a proof plan, not a sign-off.