# Proof audit pass 2

VERDICT: **SUFFICIENT** for the scoped server-only workspace-container fix. No blocking missing proof identified. This is evidence sufficiency, not full CI or merge approval.

Reviewed [551834b264](https://git.cafe/pingdotgg/t3code/commit/551834b264) against [ed9b7ca9c5](https://git.cafe/pingdotgg/t3code/commit/ed9b7ca9c5), for [#8164](https://git.cafe/pingdotgg/t3code/issues/8164). The checkout has advanced to merge commit [6d24221862](https://git.cafe/pingdotgg/t3code/commit/6d24221862640c89cfa8c4b7725e804b424fee9f); all five scoped changed files are identical to requested head. Unrelated merge changes are outside this audit. Working tree was clean.

Proof classification: server-only; visual matrix `[]`. No render changes in the requested diff; no pixel rebuild applies. Existing interim rejection captures and the supplied baseline transcript corroborate the issue, but are not final-SHA visual verification. No browser or server was started, screenshots fetched, tests run, or worktree files edited.

Evidence inspected directly:

- `green.log`: actual Vitest output, one test file passed, **14/14 tests passed**, start 04:34:15. Supersedes index.md's stale missing-green and failed-attempt notes. The log itself omits command and source SHA: report this provenance limit rather than claiming independently reproduced final-SHA execution.
- `red.log`: **13 passed / 1 failed**, start 04:34:01. Failure is the interim implementation wrongly rejecting the internal `.metadata` separate-gitdir primary checkout with an external linked worktree. It supplies a meaningful red-to-green compatibility regression, not original-baseline red for B1/B2.
- `red-test-result.txt`: recovered delegate report of original red-test commit 901d078624, including invocation; B1 unexpectedly returns a project. It is reported output, not a raw rerun log, and the first failure prevents independent B2 baseline-red proof.
- `before-runtime.txt`: supplied descriptive baseline reproduction for both configurations, with raw Git observations for false. Label as supplied baseline evidence, not independently repeated runtime verification.
- `bench.log`: three observations, linear parser 0.012–0.108 ms. It supports a small measured cost on those inputs only; absent invocation/input generator/revision, it does not establish scaling or a general performance guarantee.

Service coverage and source proof:

- The real-Git regression executes B1/B2 rejection (explicit core.bare=true/false), checks no project at either rejected root, and accepts L1/L2 individual develop checkouts. A single test contains all cases; its green result means the entire sequence completed.
- The final compatibility fixture accepts a primary checkout with internal separate gitdir `.metadata` after registering an external linked worktree. This directly resolves pass 1's concrete S2 concern. It does not separately create a project for that external linked checkout or cover every N1/S1 permutation; those are unnecessary repetitions for this narrow predicate, not a reproduced compatibility defect.
- Source rejects only an internal gitdir with a registered worktree inside the submitted root. Ordinary `.git` directories, external gitdirs and the tested linked checkout paths bypass rejection as intended.
- Create validates before commit; workspace-changing update calls the same validator before commit, including title changes in that command. Thus a validation failure cannot commit a project mutation. Update rejection/preservation is source-traced, not directly exercised by the new regression. Same-root/title-only legacy updates remain allowed. New-root bootstrap delegates to create; existing-root bootstrap returns the existing project. No claim of retroactive repair.

Transport coverage versus behavior:

- WS maps the typed error to `ProjectMutationError` with the request commandId and actionable service message. HTTP classifies it as invalid_request/invalid_command via the existing invalid-request helper. MCP create and update map it to `OrchestratorMcpFailure`, invalid_request, with the service message. These paths were traced in source through their shared service calls.
- There are **no new executed transport tests** proving serialization, HTTP status or end-to-end response delivery. This is missing transport-test coverage, not unproven branch selection or a discovered mapping bug: the explicit new tag branches establish the mapping behavior by inspection. Do not claim transport runtime verification from the service run.
- HTTP intentionally retains generic invalid-command wording. A claim that every transport returns individual-worktree guidance would be false; WS and MCP preserve it. This does not block the scoped fix.
- Web/desktop/mobile and remote callers share server validation; provider adapters and presentation are unchanged. No client rendering or remote runtime verification is claimed.

`git diff --check ed9b7ca9c5 551834b264` passed. No new proof work is required for this narrowly scoped acceptance decision. Dedicated update/transport tests would strengthen regression coverage if broader runtime guarantees are requested, but are not blockers inferred from their absence.

## FRICTION

| category | problem | prevention |
| --- | --- | --- |
| Evidence freshness | index assembled after logs existed still says red/green missing | Audit actual logs; treat index as an assembly snapshot |
| Red provenance | red.log is compatibility red, recovered report is original defect red | Name the failure and provenance separately |
| Revision binding | logs omit exact source SHA; checkout moved after requested head | Save command/SHA with future runs; compare scoped files before attributing evidence |
| Boundary coverage | absent transport tests can be mistaken for unknown mapping logic | Separate source-established mappings from unexecuted serialization/runtime proof |
| Visual scope | unchanged error presentation invites redundant pixel work | Keep visual matrix empty and label interim screenshots accurately |