# Proof audit pass 2: PR #23326 (GitCafe 23316), head b528fd6a84, before 8d3b061121

Independent and adversarial. I made no commits, pushes, forge writes, or tracked-file edits, and started no servers (I did not rerun the RPC). `T3CODE_*` was unset in every shell.

## Integrity checks
- Driver sha256 matches the expected prefixes: make-fixtures c424361e, probe 7edb43e1, count-stats df112230, rpc-refresh 8d7e512f.
- All 12 uploaded files in `cap/logs/uploads.md` were downloaded to `pass2/dl/` and are byte-identical (`cmp`) to the local transcript, drivers and logs.
- Every raw JSONL line carries a full SHA from `git -C <wt> rev-parse HEAD`: b528fd6a841c85080490f6bbd47bdfd0dd721f8b after and 8d3b061121fe65669d5d43d011b48cd3027a4108 before. The stack traces in server-after.log and server-before.log point into `~/wt/pr-23326` and `cap/wt-before` respectively.
- probe.mjs and count-stats.mjs import `<wt>/packages/provider-cursor/src/server/skills.ts` by absolute path, not a copy. In my rerun the loaded file's `git hash-object` equals `HEAD:skills.ts` in both worktrees (head 635245c2…, before 3b5aa6aa…). Both are clean and different (head has `MAX_SKILL_SCAN_STATS = 100_000`).
- Isolated HOME: the scan gets `environment = { HOME: fakeHome }` and never sees process HOME. rpc-refresh.mjs sets `env.HOME = fakeHome` and strips `T3CODE_*` before spawning the server, with a separate T3 home per SHA.
- The fixture contents match their specs: R1 11,000 files; R2 9,995/9,996/9,997; R4 10,001 dirs; R5 100,500 files; R7 `locked` (now 755, chmod 000 during the run per transcript only).

## Row table

| row | evidence artifact | sha ok | verdict |
|---|---|---|---|
| R1 (bug), entry point | entry-before/after.jsonl, count-stats.jsonl; **pass-2 rerun** rerun-probe.jsonl, rerun-count-stats.jsonl; green-tests-b528.txt (7/7 at b528) | yes | Covered. Before: discover [a-large], probe scan-budget-exhausted, 10,003 stats. After: [a-large, b-small], success, 11,009 stats. Reproduced exactly. |
| R1 via R10 (server RPC at head) | rpc-after.jsonl (snapshot published, a-large+b-small) + rpc-before.jsonl (no snapshot) + server-before.log:301 (ProviderDriverError ← CursorSkillsProbeError scan-budget-exhausted) | yes | Covered (not rerun by me) |
| R2 (old edge) | entry-before/after.jsonl rows R2-9995/9996/9997 | yes | Covered. Before: 9,995 success, 9,996 fails with both found, 9,997 b-small missing, exactly as pass-1 predicted. After: all success. |
| R3 | subsumed by R1 / R2-9997 | yes | Covered (by subsumption) |
| R4 (dir cap) | entry-after.jsonl R4 exhausted; count-stats.jsonl 20,004 stats / 10,001 readDir; rpc-after.jsonl R4 no snapshot + server-after.log:48 | yes | Covered. The directory cap still bounds after the change. |
| R5 (stats cap, timing) | entry-*.jsonl (2 runs each), count-stats.jsonl (after = exactly 100,000 stats); **pass-2 rerun** | yes | Covered. Rerun: after 100,000 stats, probe 4,984 ms (count-stats 7,724 ms). Before: 10,003 stats, 663 ms (859 ms). About 6–9× slower worst-case failure, as predicted. |
| R7 (EACCES) | entry-before/after.jsonl R7 filesystem-error, [a-large,b-small] discovered | yes | Covered, with the caveat below. chmod 000 is asserted only in the transcript command list. A 7 ms filesystem-error with both skills found is consistent with that, and it is the same before and after. |
| R10 failure path at head | rpc-after.jsonl R5/R4 `workspaceSnapshotPublished:false`, RPC Success; server-after.log:33 and :48 `provider registry refresh failed; preserving cached providers` wrapping CursorSkillsProbeError(scan-budget-exhausted) at skills.ts:291 | yes | Covered |
| R6a/R8 | unit tests in green-tests-b528.txt | yes | Covered (unit) |
| R6b/R6c/R6d/R9/R11/R12 | none (optional per pass-1) | n/a | Not required |

## Pass-2 reruns (fresh fixtures from make-fixtures.mjs in pass2/fx, fresh empty HOME in pass2/fakehome; it held only 1 inode after the runs)

| row | before 8d3b061121 | after b528fd6a84 | recorded (pass-1 capture) |
|---|---|---|---|
| R1 probe | discover [a-large]; scan-budget-exhausted; 537 ms | [a-large, b-small] success; 786 ms | same outcomes; 993 / 1,042 ms |
| R1 count-stats | 10,003 stat / 3 readDir / 4 realPath, 653 ms | 11,009 / 4 / 12, 879 ms | identical counts; 847 / 1,751 ms |
| R5 probe | scan-budget-exhausted; 663 ms | scan-budget-exhausted; 4,984 ms | same; 999,866 / 6,504,5,987 ms |
| R5 count-stats | 10,003 / 3 / 4, 859 ms | **100,000** / 3 / 4, 7,724 ms | identical counts; 1,201 / 8,244 ms |

Focused unit test at head: `vp test run packages/provider-cursor/src/server/skills.test.ts`. HEAD b528fd6a84, 1 file, 7/7 passed, exit 0 (green-tests-b528.txt).

## Caveats
- The capture's `fakehome` was not empty during the server runs. The server's Codex probe installed `~/.codex/skills/.system/*` (5 SKILL.md files, still present), and they appear in the after R1 RPC snapshot. The entry-point runs predate that, and my reruns used a fresh empty HOME. Outcomes are unaffected.
- Timings are single runs (R5 twice in the capture, once here) on a shared machine with a warm page cache. Treat them as order-of-magnitude only. The worst-case R5 failure is about 5–8 s after vs about 0.7–1 s before. That is a real but bounded worst-case regression, and the PR should acknowledge it.
- R7's chmod 000 state rests on the transcript's command list. No raw artifact records the permissions at run time.
- Cursor reports `status:"error"` (unauthenticated CLI) in the RPC runs. The skill scan and snapshot publication do not depend on it.
- 8d3b061121 is not an ancestor of the head (the branch sits on defb7e6e6b). `provider-cursor` differs only by a `package.json` script line, so it is a valid before.
- I did not rerun the R10 RPC (no servers per brief). It rests on the pass-1 capture's raw logs, whose SHAs, paths and upload copies I verified.

VERDICT: SUFFICIENT