# Proof audit, pass 1 — repository context for PR media Target: [#21631](https://git.cafe/pingdotgg/t3code/pull/21631) ([GitHub mirror](https://github.com/pingdotgg/t3code/pull/21631)). Reviewed branch `batch-07-pr-media/context`, head [597f1aea](https://git.cafe/pingdotgg/t3code/commit/597f1aea6191d434ad23877e0e94121b7858382e), against supplied merge-base [15707a84](https://git.cafe/pingdotgg/t3code/commit/15707a84b03e27bb257d60e027812ebf94bbda25). Local HEAD and clean status matched. Upper stack work is excluded. All examples below are synthetic. ## Findings 1. **No spec contradiction found in the inspected paths.** The new repository value reaches the resource schema, signed claims, and resolved media asset. Web takes it from `detail.repository`; mobile takes it from `params.repository` through `pullRequestTarget`, deliberately independent of the checkout. The existing fetch response still calls `fetchMedia({url, headers})`; this layer cannot demonstrate repository-specific authentication, private EMU access, or SSO recovery. Those are not acceptance rows for this PR. 2. **A still cannot establish the change.** Mandatory evidence is the actual client-generated `assets.createUrl` input, the issued capability, and a signature-verified `resolveAsset` result retaining repository. Merely base64-decoding a token is insufficient. Also retain an omitted-field request and an old-shaped signed capability. A matched before/after still only establishes stable appearance. 3. **Existing tests are useful but partial proof.** The new server test exercises schema decode → issue → resolve without WebSocket transport. The web test mocks `useAssetUrlState` as Loading and observes resources; it neither signs nor displays successful media. The mobile test checks two gallery resources. None is a real end-to-end capture, and no tests or captures were run in this pass. 4. **Offline source data must be labelled.** There is no supported RPC to insert arbitrary fake PR detail. A local project alone does not produce synthetic GitHub PR detail. GitHub reads use the HTTP/GraphQL client, so a fake `gh pr view` executable is insufficient. Use a source-control/query boundary harness for the panel, with the real renderer and real asset hooks connected to an isolated dev server; label it **synthetic PR-detail harness + live asset RPC**. For successful display, serve synthetic media at the browser's outgoing asset-GET boundary, or inject a fake source-control driver in a server harness. Label the mocked boundary explicitly. Do not claim real private GitHub access. 5. **Mobile propagation is mandatory; native visual evidence is optional here.** Mobile changes code separate from web and changes the full-screen video thumbnail/presentation identity. Require mobile wrapper/hook/helper transcripts (M1–M6). There is no new native layout or platform branch, so a simulator screenshot is not in the minimum set. If a native visual/interaction pass is added, it must use a pooled Android emulator or iOS simulator, with `test-t3-mobile`/`device-pool`; do not present DOM/native-stub harness recordings as native evidence. ## Fixture data and axes Use a synthetic environment `fixture-environment`, project `fixture-project`, checkout `/synthetic/personal-fork` whose synthetic repository identity is `fixture-user/personal-fork`, and PR repository **B** = `fixture-org/media-upstream`. For repository switching use **C** = `fixture-other/media-upstream`. PR number 42, fixed timestamps, viewer/author `fixture-user`. Disable mutations or make them no-ops in the harness. Do not use real credentials, projects, or private content. Synthetic media identifiers (they are inputs to URL recognition; do not rely on upstream bytes): - **I**: [GitHub blob PNG](https://github.com/fixture-org/media-upstream/blob/main/shot.png), normalizes to [raw PNG](https://raw.githubusercontent.com/fixture-org/media-upstream/main/shot.png). - **J**: [legacy upload image](https://github.com/fixture-org/media-upstream/assets/123/fixture-image). - **V**: [extensionless uploaded video](https://github.com/user-attachments/assets/fixture-video). - **Q**: [raw MP4](https://raw.githubusercontent.com/fixture-org/media-upstream/main/clip.mp4). - **D**: direct non-host media on `https://media.example.test/shot.png` / `clip.mp4`, intercepted to synthetic bytes. - **I-dark/I-light**: raw GitHub PNGs differing only in basename, used by a theme-selected HTML picture. Prepare valid synthetic PNGs at 240×100 and 100×180 and a short MP4 with a visible fixed test pattern. For dimensions use HTML `img` authored width/height and markdown images, a long alt/caption, and a linked image. Use 0, 1, and 2+ media, including a duplicate image URL. GitHub uploads without extensions are classified as video when bare, but remain images when authored as markdown images; exercise both, without requiring the remote URL to exist. The repository string itself is never rendered and introduces no length, count, width, or theme branch. Repository B equal to checkout versus different from checkout is the same visual fixture; the different case is required for propagation proof. Missing/null context and omitted/empty optional value are separate logical controls. A 512-character repository is a schema boundary, not a screenshot fixture. GitHub is currently the only built-in definition supplying `mediaUrl`, so other forge media are direct-URL controls, not extra credentialed host fixtures. Viewport cells: - **WD** = web 1440×1000, dark; PR panel content width about 640 px. - **WL** = identical web geometry, light. - **WN** = web 900×1000, light; explicitly constrain PR content to 320 px if the app's panel width does not naturally do so. Label a constrained component capture as harness. - **DT** = Electron at WD, same web renderer. No separate Electron visual change; W11 covers the shell-specific path only if desired. - **MH** = mobile logic/DOM-native-stub harness, no native viewport claim; theme/platform are mocked inputs only. An optional real device pass uses its recorded actual phone size, dark, on one pooled device. iOS/Android rendering differences are pre-existing and do not multiply required resource transcripts. ## Complete path inventory and reduction ### Web/desktop `PullRequestDetailPanel` has two production callers: `PullRequestsPage` (the `/pull-requests` page, `context=page`, `tabOnPage`) and `chat/RightPanelSurfaceContent` (thread right-panel surface, `context=page|thread`). The latter gates unsupported/unknown server capability before mounting. Panel detail absent/error/loading has no markdown provider; available or cached detail supplies its repository even while refreshing. Summary, Guide, Timeline, and Code are separately mounted tabs and remain mounted but invisible after switching. Activity loading/error gates Timeline rendering. These gates are represented by W0, W4–W7, and W10. Every production `PullRequestMarkdown` caller: - `PullRequestSummaryTab`: description and conversation bodies (via `PullRequestCommentBody`). Description empty state bypasses markdown; editing swaps to editor. - `PullRequestCommentBody`: clipped at 240 px, overflow fade/toggle, focus expands, Show full comment / Show less. Empty/short/long and image below fold reduce to W0/W4. - `PullRequestTimelineTab.TimelineBody`: markdown bodies only; plain text timeline messages bypass it. Conversation folding/loading/pagination only change when a shared renderer mounts (W5). - `PullRequestReviewAnnotation`: rendered inline review comments; editing swaps to editor; load more comments mounts further bodies (W5/W6). - `PullRequestMarkdownEditor`: Write textarea versus Preview; Preview empty shows Nothing to preview; nonempty mounts markdown, for description/comment/review editing. Saving and permission state disable controls, without changing repository propagation (W6). - `guide/GuideProse`: formatted summary/attention/note/question paths; `plain=true` or missing GuideProseContext returns raw text and does not mount markdown. Callers are GuideStop, GuideNotes, and GuideExcerpt; their plain captions/file notes do not request assets (W7). `PullRequestMarkdown` splits empty/text/image/video/unknown segments. Markdown segments and standalone image attachments enter `ChatMarkdown`. Recognized host video attachments (bare URL, markdown link, or standalone HTML video/source) enter the private `PullRequestHostVideo`, whose only caller is this component. Non-host video enters the direct MediaVideoPlayer. Unknown attachments render an external-link card. **The current splitter never emits `media=unknown`; that card is harness-only.** Fences, indented code, malformed/unclosed HTML video remain markdown and must not trigger a host-video resource merely because their text contains a URL. `ChatMarkdown`'s changed image branch requires all of `sourceControlMedia`, cwd, environment, direct source, and a recognized host URL. It carries the repository to `ChatMarkdownAssetImage`, including an image-syntax video. Theme-selected picture source, authored width/height, image alt/title, standalone versus inline, link nesting, source fragment, and image/video kind affect the existing renderer or media UI; W1–W3 cover them. Context-reference chips, audio, file-link chips, non-host direct media, workspace/host-file images, and unavailable fallback use earlier/other branches and receive no new field (W9). All other production `ChatMarkdown` callers leave `sourceControlMedia` false/absent, so one representative negative control is sufficient, with caller audit for the remainder: `composerContextPresentation`; `chat/WorkflowOpeningBlock`; `chat/TimelineWorkEntryRow` (2 sites); `chat/V2ItemInspector`; `chat/ProposedPlanCard` (2); `chat/TimelineAssistantRows`; `chat/TimelineWorkGroupRows` (2); `chat/TimelineUserMessageRow.UserMessageMarkdown`; `chat/UserMessageContextChips` (2); `chat/ComposerPendingUserInputPanel`; `files/FileMarkdownPreview`; `files/NotebookPreview`; `files/AttachmentFilePreview`. Their unrelated markdown/table/code/streaming branches have no new input or condition and do not require a full retest of those components. Asset states: Loading gives null media source; Success gives signed URL; Failure falls back to fetchUrl on web. The underlying image/video can still fail loading and expose retry/unavailable controls. Image expansion/gallery, media actions, video playback/pause/fullscreen, retry, visibility, and capability refresh are interaction/time sequences, therefore recordings (W8, W10) where executed. A hosted video and image-syntax video are distinct producers despite similar playback UI. ### Mobile `PullRequestMarkdownRepository` has three production wrapper callers: `PullRequestRouteScreen`, `PullRequestDiscussionScreen`, and `guide/PullRequestGuideStopScreen` (same file exports guide content). It derives media environment/cwd from target project, repository from target input; missing project/workspace gives null media location even if changeRequest metadata is present. Provider/url affects autolinking and hard line breaks, not media repository. See M1/M5. Every production mobile `PullRequestMarkdown` caller: `PullRequestDescription`; `PullRequestTimeline` review/comment row; `PullRequestDiscussionScreen` comment; `PullRequestGuideScreen` stop summary, attention note, file note, question; `guide/ReviewGuideExcerpt` caption; `guide/GuideOutline` first-stop summary. Guide prose explicitly opts out of host hard line breaks. All inherit the owning wrapper. These render through `PullRequestMarkdownContent` + `MarkdownImage` or the standalone `PullRequestMedia` path. `usePullRequestMediaUrl` callers: the private MarkdownImage, `PullRequestMedia`, and `PullRequestImageAttachment`. All now use one `pullRequestMediaSource`. Recognized host + location returns environment/resource, optional truthy repository included; missing location or unrecognized URL returns direct URI. Loading/Failure gives null URI for a resource; Failure sets unavailable. Success uses signed URI. Refresh closes over the same resource. `PullRequestMedia` callers are markdown standalone segments (normal) and `PullRequestDescription` non-image attachment strip (compact). Image branch opens a FilePreviewModal/gallery. Video and unknown branches render a 176×112 compact tile or normal inline player; compact tap opens VideoPreviewModal, normal player renews via resolvePlaybackUri. Visible context comes from the RouteScreen's active tab; hidden media defers thumbnails/playback. Caption truthiness falls back to URL basename then Attachment. `PullRequestImageAttachment` has one caller, description strip, with 176 px image tile, one-line caption, supplied gallery. See M2/M3. Description layout: empty placeholder; body measured ≤240 px versus >240 collapsed/expanded/faded, platform-specific fade color; no attachments versus horizontal mixed strip with long truncated captions. Timeline comment long means >450 characters OR >8 lines; initial displayed text is sliced to 1200 characters and clipped to 240 px, full gallery uses original body. Short, long, and expanded reduce to M6. Underlying native text, theme, and platform-specific chrome are unchanged; resource traces, not a new native layout matrix, are required. `mediaVideoThumbnailKey` callers are `ThreadMarkdownVideo`, `VideoPreviewModal.MediaPreviewModal`, and `previewPresentation.videoPreviewKey` (presentation identity). Only github-media gains `repository ?? ""`; same env/cwd/url under B and C must differ, absent repository remains valid. URI, attachment, media-file, draft-workspace-file, and local-preview keys are unaffected controls. **Inline PR MediaVideoPlayer still uses `thumbnailKey={props.url}`; do not incorrectly demand repository in that unchanged inline key.** The changed key concerns resource-backed previews/ThreadMarkdownVideo/presentation. See M4. ### Contract/server `AssetResource` keeps wire tag `github-media`. Repository is optional, trimmed nonempty ≤512 characters when present. `AssetClaimsSchema` permits absent repository, and issueAssetUrl places the decoded resource's repository inside signed version-1 claims while still normalizing URL. resolveAsset verifies signature and expiry before returning `kind=source-control-media` plus repository/cwd/url/expiresAt. WebSocket assets.createUrl passes the resource directly to minting without checking that cwd exists. HTTP asset route resolves the token and delegates unchanged to sourceControlMediaResponse. See S1–S4. ## Fixture matrix Status is **planned/capturable**, not captured. Affected means this diff changes the carried resource/claim/identity; **control** means an unchanged branch that bounds the change. Minimum identifies mandatory evidence; other rows are inventoried controls or may be combined with the mandatory sequence. `recording` includes a chronological harness event log for nonvisual rows; no still substitutes for an interaction/time sequence. All harness evidence must identify its substituted boundaries. | ID / named fixture | Data and branch / visible combination | Diff effect | Minimum capture cell and format | Seed / driver and status | |---|---|---|---|---| | W0 — no rendered media | Panel capability unknown/unsupported; detail pending with no data; terminal error/no detail; then loaded empty/whitespace or text-only body; no comments/attachments | Control: no resource should mint | No extra minimum still; if transition is exercised: **recording** | App capability/detail RPC results; synthetic query-boundary harness for deterministic states. **Planned, harness-capable** | | W1 — settled image body | Detail repo B, checkout fork; markdown I and J; standalone bare PNG; duplicate I; one wide and one tall image, short + long alt; text around them | Affected: every recognized image resource has B and normalized URL; appearance stable | **WD before + after still mandatory**; include image's live RPC in S1 | `/pull-requests` selected PR or thread surface; stub detail in harness, real asset hook; intercept asset GET with fixed PNG. **Planned, harness required offline** | | W2 — settled videos, both producers | B; bare V, standalone linked Q, HTML `