# Issue 17601 — proof audit pass 1 / evidence capture matrix

Read-only source audit: `/home/ubuntu/wt/issue-17601`, branch `fix/issue-17601`, head `2c4e7e7376894082cdf033c4b5ffafeff12e15ec`, base `2c8bdf6177`. No PR. No browser, server, capture, tests, or repository edits performed in this audit.

## Scope and fixture derivation

Complete diff paths:
- `packages/provider-acp-registry/src/server/auth.ts`: decorate discovered methods AND reinitialized methods used to execute login.
- `packages/provider-acp-registry/src/server/minimaxCodeAcp.ts`: replace the specific terminal method `minimax-code-login` with Global first (`:global`, appended `--region global`) and Mainland China second (original ID, appended `--region cn`). Other methods retain order. Existing terminal region arguments suppress decoration.
- `packages/provider-acp-registry/src/server/auth.test.ts`: new integration harness case asserts both IDs/order and explicit Global terminal arguments. Does not by itself prove all compatibility rows below.

Callers traced: `ProviderAuthenticationSection` is shared by `ProviderWizardAuthenticationStep` (AddProviderInstanceDialog authentication stage) and `ProviderSettingsPanel` editor. `ProviderSetupSection` also calls it but is Antigravity-specific, so is not an additional MiniMax surface. Native `SettingsProviderAccountsRouteScreen` has its own method chooser. Shared `providerAuthFlow` selects explicit method, then configured `authMethodId`, then first discovered method. Thus a fresh config's Provider default becomes Global; a saved original ID intentionally remains Mainland China. Web picker appears only with >1 method; mobile Sign in opens a chooser only with >1 method.

## Capture prerequisites and safety

Parent owns the running app at `http://localhost:6855`, backend port 14895, isolated worktree `.t3`. Reuse it; do not start another server/browser. Existing unauthenticated MiniMax instance is the primary fixture: ready/installed/enabled ACP registry agent `minimax-code`, managed account unauthed, provider-management permission, no saved `authMethodId` for default-selection proof. Use a disposable new MiniMax instance through the wizard only for wizard rows; cancel any active flow before the next run. Do not overwrite the existing fixture or live `~/.t3` data. A `.t3` database alone does not guarantee provider CLI credentials are isolated: do not complete login or sign out a real account. No actual credentials are needed to prove destination selection.

Routes: S = `http://localhost:6855/settings/providers?instanceId=<existing MiniMax instance ID>` (select its environment; optional `environmentId` search parameter). W = same `/settings/providers` → Add provider → MiniMax Code → prepare/identity steps → authentication stage. M = native Settings → select same environment → Provider accounts; native linking segment `provider-accounts` under the environment settings stack, not a claimed web URL. External Global endpoint is `https://agent.minimax.io/login`; capture only origin/path or redact ALL query values, especially `callback_state`, in terminal, address bar, video frames, transcripts and metadata. Mainland destination must be observed and reported rather than inferred from a label.

## Named row table

Widths are CSS px; use 1440×900 and 390×844 (390 web is responsive web, not native-mobile evidence). L/D = light/dark. Each required recording is short and includes settled endpoint state; retain an extracted still when useful. Before/after must be labeled with base/head; a verbal report is not a before image.

| Row | Affected status / condition | Evidence | Minimum viewport/theme | Data / seeding recipe | Route and action / acceptance |
|---|---|---|---|---|---|
| S0 Settings region picker | Directly affected: formerly one method/no picker, now Provider default + Global + Mainland China | Recording (open/select interaction), with before/after settled stills | All four: 1440 L, 1440 D, 390 L, 390 D | Existing unauthed ready MiniMax; no active auth; no saved method override | S: open Sign-in method, show both full option names/order, choose each then Provider default. Check clipping, wrapping, popup within viewport, legibility and reachable Sign in. Before shows original single-method state. |
| W0 Wizard region picker | Directly affected shared picker in a distinct modal layout | Recording, before/after stills | All four widths/themes | Add disposable MiniMax instance via normal wizard; stop at authentication; use isolated state only | W: discover methods, open chooser, select Global and Mainland. Check dialog scroll/footer, labels and controls at 390; Skip for now is available when idle. No extra auth execution needed here because it uses same section/service as S. |
| S1 Default Global journey | Directly affected behavior: fresh Provider default now selects first Global method | Recording REQUIRED (click → starting/waiting → terminal/link → external destination → return/cancel) | 1440 L only; pair with S3 at 390 D | Existing unauthed instance; verify config has no `authMethodId`; reset picker to Provider default; cancel prior flow | S: Sign in without explicit selection. Confirm terminal is usable, Global login destination `agent.minimax.io/login`, no false Signed in; cancel and confirm retry/chooser returns. Parent reports this after-result already verified; locate its evidence or capture only missing proof. |
| S2 Explicit Global | Directly affected added method | Recording REQUIRED, may be a labeled segment of S1 recording | 1440 L only | Same fixture, select Global, no active flow | S: select Global → Sign in → same Global endpoint → cancel. Confirms explicit added ID works independently of default. Safe server transcript may substitute duplicate external tab imagery, but preserve click/wait/cancel in video. |
| S3 Explicit Mainland China | Directly affected label/arguments; preserved original ID | Recording REQUIRED | 390 D only | Same fixture, select Mainland China; cancel prior flow | S: Sign in → terminal/link → observe Mainland destination → cancel/retry. Compare with parent-reported before default Mainland destination. Assert intentional Mainland selection remains possible, buttons/terminal do not overflow responsive layout. |
| W1 Wizard active/cancel | Affected flow exercised in distinct wizard container | Recording REQUIRED; append to one W0 clip | 390 D only | Disposable wizard instance, Global selected | W: Sign in → waiting terminal → Cancel. Skip for now disabled during active flow and available afterward; no stranded modal. Do not finish external authentication. |
| M0 Native method chooser | Directly affected separate native UI: Sign in now opens choices rather than immediately starting sole method | Recording REQUIRED if native verification available; pending here | Native ~390 width, L/D; 1440 not applicable | Native client paired to parent's isolated environment, ready unauthed MiniMax and provider-management scope | M: Sign in → both choices → dismiss chooser → reopen → Global → waiting → cancel; second segment Mainland → waiting → cancel. Confirm labels/scroll/touch targets. Cannot substitute 390 web screenshot. |
| D0 macOS Electron handoff | Affected shared web UI plus OS external-open behavior | Recording REQUIRED if available; pending here | macOS desktop 1440, L/D picker stills; one flow video | macOS desktop connected to isolated environment with same fixture | Desktop Settings/W wizard share web UI; run default Global → external browser → cancel. Linux browser evidence cannot prove macOS shell/IPC external-open. |
| U0 Unchanged auth states | Indirect shared rendering; no new visual design | No new exhaustive screenshot suite; observe discovery/start/wait/cancel during rows above | Covered by S/W recordings | Same fixtures | Signed-in account/change-account/sign-out, generic failure/retry, permission-denied, disconnected environment, no methods, missing installation and non-MiniMax providers retain existing UI. Do not seed real credentials or manufacture every generic state for this adapter change. Server tests cover unchanged failure paths. |

Minimum sensible web capture package: eight short picker clips (S0 and W0 × four width/theme combinations); extend S0 1440 L with S1/S2 and S0 390 D with S3; extend W0 390 D with W1. This gives every changed layout width/theme coverage without multiplying auth journeys by all four combinations. Extract eight after stills and matching before stills where the parent can safely reuse prior/base captures. If base wizard capture is unavailable, explicitly mark missing; never run base against head's running server or imply the head screenshot is before. External provider pages are third-party UI and do not need four theme/viewport permutations. Native/macOS rows remain separate availability gaps.

## Server-only matrix — tests or redacted runtime transcripts, never screenshots

| Row | Invariant / fixture | Required proof and current status |
|---|---|---|
| B0 Global discovery/start | Raw terminal `minimax-code-login`, args `[login]` | New auth harness asserts IDs `[minimax-code-login:global, minimax-code-login]` and spawn `[--acp, login, --region, global]`. Parent reports 56 auth tests passing; not rerun here. |
| B1 Mainland preserved ID | Explicit original method ID; separately config `authMethodId: minimax-code-login` with no explicit selection | Assert spawn ends `login --region cn` for both; original saved ID stays valid. Source supports this; new test does not assert either execution. Mark verified only with focused test or safe runtime transcript. |
| B2 Default precedence | No override vs saved original vs saved Global; explicit selection opposite saved override | No override → Global first; saved original → cn; saved Global → global; explicit wins. `providerAuthFlow` source establishes precedence; default runtime parent report confirms only fresh default. |
| B3 Guard/pass-through | undefined/empty methods; absent matching ID; matching nonterminal; any terminal already contains `--region` | Source leaves input untouched; test/transcript if needed. This is not a screenshot fixture. Future upstream explicit-region methods must not duplicate or get mutated. |
| B4 Method preservation | Additional unrelated methods before/after target; method args/env/description; absent args | Source clones target, preserves unrelated order/properties, appends flags. Target lacking `login` args does NOT invent `login`; record as actual contract, not guaranteed executable upstream input. |
| B5 Runtime lifecycle | PTY unavailable, cancel, terminal exit failure, verification failure/success | Terminal methods filtered without PTY; execute decorated method again after initialize; cancel stops terminal; no success before reconnect verification. Use existing focused auth tests/runtime transcript. Full login success not required to prove region destination and must not be claimed from reaching login. |
| B6 Scope of heuristic | Another ACP agent advertising identical `minimax-code-login` terminal ID | Decoration is ID-based, not settings.agentId-gated. Include in review context as implementation scope; no new provider UI matrix needed. |

## Availability and evidence status

This audit performed source inspection only. No screenshot/recording artifacts exist from this pass. Parent-supplied observations: after default Sign in reaches `agent.minimax.io/login`; before reaches Mainland URL; 56 auth tests pass. These are reported observations, not independently reproduced proof here. macOS desktop cannot be verified in this Linux worktree pass. Native mobile availability was not probed because browser/server/device work was explicitly excluded; M0 is pending/unverified, not asserted unavailable or passed. Remote/relay/tunnel and multi-environment execution were not run; region selection is server-owned and clients pass method IDs, with no connection transport changes, so no full connection-mode permutation is warranted.

## FRICTION — category | happened | avoid

- Discovery | Initial filename glob assumed a ProviderSetupWizard file and mobile src/app directory; neither exists | Follow rg callers: AddProviderInstanceDialog → ProviderWizardAuthenticationStep; mobile navigation is Stack.tsx.
- Evidence ownership | Parent owns the running server/browser; read-only audit cannot produce before/after or native evidence | Hand this matrix to parent; reuse current isolated fixture and existing capture session, with clear pending rows.
- Redaction | Login URLs/terminal output can expose callback_state even without entering credentials | Redact query values at source or offline in every frame/transcript before public upload; never upload raw state/database/logs.