# Fresh post-main-merge proof audit, pass 2

## Findings

No blocking evidence gap within accepted service-classification rows O1–O6. The current artifact set supports suppressing password fallback for the tested OpenSSH agent signing failures while preserving the original command error. It supports fallback eligibility for the negative controls. It does not establish actual desktop/macOS behavior.

Sensitive-auth routing remains **NEEDS_JULIUS**. That routing does not block PR creation under the supplied task scope; this audit grants no merge approval. This is a fresh proof audit after the required main merge, not another implementation-review round.

## Scope and exact revisions

- Base: [4040867bb4](https://git.cafe/pingdotgg/t3code/commit/4040867bb46a90a8f41c687d7b454b5ece97a34f), full SHA `4040867bb46a90a8f41c687d7b454b5ece97a34f`.
- Head: [fa4f43f61f](https://git.cafe/pingdotgg/t3code/commit/fa4f43f61f279921eb7b9803c01f812d0d779efa), full SHA `fa4f43f61f279921eb7b9803c01f812d0d779efa`.
- Checkout: `/home/ubuntu/wt/issue-23413`; exact HEAD verified and worktree clean before and after inspection. Head is a merge with the specified base as its second parent.
- Complete base-to-head diff inspected: `packages/ssh/src/auth.ts` adds four lines; `packages/ssh/src/tunnel.test.ts` adds 96 lines. No other changes, no deletions, no Set/parser rewrite. Existing fallback regex unchanged. `auth.test.ts` unchanged.
- Published `final-diff.patch` equals the current explicit-base git diff byte for byte.

Read project AGENTS.md, ghdrop SKILL.md, original proof matrix, prior pass-2 report, current evidence index, fixture scripts, completed red/green logs, assertions log and runtime records. Prior reports inform the accepted scope; their old revision verdict is not substituted for current evidence.

## O1–O6 results

| Row | Current evidence and independent assessment | Status |
| --- | --- | --- |
| O1 | `before-O1.log` / `after-O1.log`: agent refuses signing on password-enabled host. Two separate ensureEnvironment calls per revision. Baseline: two actual prompt invocations and cancellation errors. Final: zero prompts, two SshCommandError failures, exit 255, exact original stderr. | PASS, real manager/OpenSSH with protocol-agent fixture |
| O2 | `before-O2.log` / `after-O2.log`: agent disconnects during signing on password-enabled host. Same two-to-zero prompt change; diagnostic is communication with agent failed. Both final failures preserve type, exit 255 and stderr including CRLF. | PASS, same runtime scope |
| O3 | `before-O3.log` / `after-O3.log`: refusal on publickey-only host. Same two-to-zero result; publickey-only denial verified. Signing diagnostic, rather than method-list membership, distinguishes this from O5. Both final errors preserved exactly. | PASS, same runtime scope |
| O4 | Final test table supplies identity-fetch failure before offering a key plus password-enabled denial; expects one prompt. Completed baseline has only the three signing failures; final has all 16 tests passing. | PASS, mocked manager fallback-eligibility control |
| O5 | Standalone publickey denial without signing diagnostic expects one prompt and passes on both revisions. Prior raw encrypted-disk-key transcript shows BatchMode=yes exit 255, then BatchMode=no askpass/publickey authentication and harmless printf AUTHENTICATED exit 0. | PASS within bounded control scope; successful manager passphrase retry unverified |
| O6 | Separate ordinary password and keyboard-interactive denial cases each expect one prompt and pass on both revisions. | PASS, mocked manager fallback-eligibility controls; successful login unverified |

The prompt service is available and returns null on invocation. The runtime attempts are two separate calls on one manager, not lock/unlock/reconnect cycles. Local sshd and OpenSSH are real; the agent is a protocol fixture advertising an accepted ED25519 key and refusing or disconnecting on signing. This is not real 1Password or Secretive behavior.

## Independent parsing and publication validation

Independently parsed all twelve ATTEMPT JSON records rather than accepting assertions.log as proof. For all six runs checked exact revision/header modes, attempt numbering, actual prompt-line counts and reported totals, two accepted keys, two signing requests, command exit 255, expected diagnostic and method list, and successful fixture wrapper exit. Parsed original command stderr literals separately from ATTEMPT JSON. Each final returned stderr encodes identically to its command failure and corresponding baseline failure; each final failure is SshCommandError with exit 255. All checks passed.

Read run.py: local sshd, bounded readiness check, real manager probe, captured PID termination in finally. Probes are identical after normalizing only their absolute production import roots. Runtime modes: O1 yes/refuse, O2 yes/disconnect, O3 no/refuse. Each runtime log ends with sshd signal-15 termination and wrapper exit 0. Readiness accounts for the pre-auth connection-close noise. Port 44231 currently has no listener.

Downloaded the [current evidence index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3305954d9e6aa199/issue-23413-evidence-index.md) and all 18 artifacts in its Published files section using curl. All 19 responses match their local counterparts byte for byte, including all six runtime logs, completed red/green tests, assertions, scripts, patch, prior raw passphrase transcript, and incomplete capture. No publication mismatch or stale-revision runtime artifact found.

Runtime headers record Linux 6.1.102 x86_64/glibc 2.39, OpenSSH_9.6p1 Ubuntu-3ubuntu13.19/OpenSSL 3.0.13, Node v26.12.1 and pnpm 12.14.0, captured 2026-10-22 UTC. Header SHA provenance is supported by the supplied index and probe roots. The historical disposable base checkout has been removed, so its actual execution state cannot be independently reconstructed here. SHA fields in refresh scripts are constants rather than live git assertions; this limits historical attestation but does not contradict the supplied exact-revision capture record. No new execution was needed within this evidence audit.

## Red/green and checks

Completed logs use `vp test run packages/ssh/src/auth.test.ts packages/ssh/src/tunnel.test.ts` and stamp exact base production/final fixture or exact final production/final fixture. Baseline: precisely three signing cases fail because actual prompt count is 1 instead of expected 0; 13 pass, exit 1. Final: both files and all 16 tests pass, exit 0. Four negative-control cases therefore pass in both. Fixture source verifies what these aggregate results cover.

The earlier `red-tests-incomplete-host-load.log` ends after the runner banner, without test results or an exit result. It is an incomplete capture, not a code/test failure. refresh.py has an external 180-second wrapper limit; refresh-tests.py uses 900 seconds. The completed replacement logs are the evidence assessed. No test timeout or code alteration is needed to explain this distinction.

The task brief reports parent-required `vp run check:changed` passed at this head: format, lint, knip, typecheck for four packages and 16 tests; knip took 925 seconds under VM load. That broader-check result is attributed to the parent brief, not independently certified by these published focused-test artifacts. No expensive checks or tests rerun by this audit.

## Claim boundaries and surfaces

Accepted visual matrix stays empty for this service-classification change. Pixel comparisons, recordings, independent UI rebuilds and server restarts are N/A to the accepted rows. No renderer, prompt component, IPC contract, Settings/chat/palette entry point, web/mobile layout or provider adapter changes occur in the diff.

Caller inspection confirms handleSshAuthFailure returns the original error before requesting a prompt when classification is false; DesktopSshEnvironment supplies the desktop prompt service. Runtime evidence proves invocation behavior at that service boundary, not Electron dialog absence or displayed-error presentation.

Explicitly unverified: actual macOS/OpenSSH; Electron IPC/dialog presentation; 1Password/Secretive lock → failure → unlock → retry; Windows; successful manager-mediated passphrase submission and remote launch. Raw encrypted-key success is prior, revision-independent raw SSH evidence only. No automatic unlock, broad all-agent-error suppression, or platform-success claim is accepted.

## Safety and FRICTION

No implementation edits, commits, pushes, comments, merge, PR creation, forge CLI calls, servers or browser sessions performed. Only the authorized scratch audit report and its public upload were written. No live T3 state accessed or secrets/keys uploaded. Worktree remains clean.

- BLOCKING: none within accepted O1–O6 service scope.
- RESOLVED: post-merge provenance refreshed; exact current diff and publications checked. The incomplete wrapper-limited test capture is superseded by completed red/green logs, not classified as a code failure.
- LIMITS: historical base state is evidence-backed, not independently rerun; full check:changed status is parent-reported. Platform/GUI/manager-success gaps remain explicit.
- ROUTING: NEEDS_JULIUS remains separate from proof sufficiency and does not block PR creation under the supplied scope.

VERDICT: SUFFICIENT O1–O6 within accepted service-classification scope.