# Proof fixture matrix for PR 17031

Scope: [#17031](https://git.cafe/pingdotgg/t3code/pulls/17031), original ehfreema/lct3 fix/execute-html-render-inline. Full 16-file diff inspected locally. Before is merge-base [977a188](https://git.cafe/pingdotgg/t3code/commit/977a18823cf8e067476193e29947e2d3950a25f2); after is [34fcb08](https://git.cafe/pingdotgg/t3code/commit/34fcb08ce3146c0b6424d676b1d05ec8b49014c4). Capture agent must verify these exact revisions, rather than using moving origin/main. This document specifies evidence; no runtime/provider/browser verification was performed by this auditor.

## Provenance and isolation

Use isolated, disposable application homes, never ~/.t3/userdata or its live assets. Seed only artificial fixture data. Keep before and after inputs, HTML, viewport, theme, provider versions/settings and completion state identical; record any unavoidable variation. Do not transplant after-normalized provider rows into before and call it real before provider proof. Real proof requires the actual provider process and MCP invocation through T3, persisted dynamic-tool row, and resulting stored HTML attachment. Record sanitized provider/model/version, code revision, thread/item IDs, raw tool name/input/output shape and attachment ID. Remove credentials, cookies and pairing URLs from published evidence.

Julius accepts wrapped execute output as fully trusted. Do not report that trust decision as a defect. Ownership checks here concern execute source-thread attachment matching and cleanup, not a new trust policy.

## Minimal matrix

| ID / evidence class | Fixture and path | Required before/after result and evidence |
| --- | --- | --- |
| R1 REAL provider, mandatory | Actual OpenCode with Code Mode enabled invokes execute; script calls discovered T3 html_render with a self-contained responsive page and returns the wrapped result containing htmlRender. Use a visible unique marker OPENCode-EXECUTE, title, theme-aware panel, increment button and status text. | Preserve actual execute call and persisted output. Before: published page exists but inline recognition is missing on the affected path; capture observed behavior, never manufacture failure. After: exactly one usable inline page above final reply after completed turn. Reopen/reload thread and verify persistence. No direct html_render call or manually inserted execute row can substitute. |
| R2 REAL provider, mandatory | Actual Grok ACP agent calls T3 html_render with equivalent page marked GROK-ACP. Retain actual ACP tool_call/update rawInput, title, metadata and rawOutput. | Before/after actual behavior plus head inline page and interaction. Show identity extraction and normalization from the shape actually emitted (e.g. snake_case identity / annotated title and MCP OkayOutput string). If actual version emits another shape, state that and cover changed shapes in U2; do not claim live coverage of unseen variants. At least one actual ACP agent is mandatory. |
| U1 UNIT plus optional APP REPLAY | execute outputs both wrapped {htmlRender:ref} and bare ref; MCP text arrays, ACP content wrappers and bare text blocks; completed vs running/failed calls. | Focused shared htmlRender/toolOutput and web session-logic tests. Bare reference must have valid thread-UUID-html ID. Own source thread accepted; foreign, prefix-only, absent thread context, malformed/non-html IDs and isError rejected. If injected into app, label APP REPLAY, never real OpenCode. Ordinary direct html_render remains a positive control. Preserve outer metadata when text is not a standalone text block. |
| U2 UNIT / ACP MOCK REPLAY | Grok OkayOutput string unwrap, nonstring unchanged; nested child tool completion with child source context; CodeBuddy qualified rawInput.toolName, Devin inferenceToolName, Grok snake_case and annotated file title; ToolSearch rawInput.toolName='html_render' negative identity. | Run runtimeModel and AcpAdapterV2 focused tests. Mock child uses real adapter path but remains synthetic (existing child fixture is Devin-shaped with Grok-style output, not a live Grok child). Child page projects to child; correct child source ownership survives merged/inherited timeline. ToolSearch must not become T3 html_render or display a page. Real Grok parent alone does not prove nested live Grok output. |
| U3 UNIT / APP REPLAY ownership | Rows displayed in parent/inherited timeline: child-owned execute page, parent-owned ID incorrectly attached to child row, foreign ID. | Web session-logic and mobile threadActivity focused tests: only sourceThreadId-owned execute page appears. Optional real-app replay shows correct child/inherited page and missing foreign page, explicitly labeled. Do not check ownership against the current viewing thread. |
| S1 SERVER integration / APP REPLAY lifecycle | Persist own execute wrapped AND bare references, foreign reference, failed reference and unrelated upload/MCP App positive control in disposable threads. Exercise SQL-backed getThreadAttachmentIds, guest render service, actual thread deletion. | Before/after transcript: own bare -html reference is selected by SQL after; wrapped and bare own attachments collected; foreign/failed not collected; MCP App unchanged. Guest own execute page served after; foreign reference unavailable. Delete owner thread: own render files removed, foreign thread files survive and remain usable. In-memory replay alone cannot prove the changed SQL LIKE filter; filesystem existence and SQL-backed service evidence required. No production deletion. |
| V1 REAL APP guest surface | Share disposable R1/R2 page through actual guest page, or replay a source item if guest permissions prevent provider flow (label provenance). | Before/after guest view loads appropriate page with correct title/theme and no unavailable error after. Cover wrapped and bare server selection via S1; do not multiply provider runs unnecessarily. Guest endpoint serving and guest UI need evidence, not just a helper test. |
| M1 NATIVE or explicit fallback | Boot available emulator and load same isolated server/thread. | If it boots: before/after native inline render, theme, button/scroll and reopen proof. If it cannot boot: save exact boot command/error and explicit 'native HTML WebView rendering, interaction and theme unverified'; run apps/mobile/src/lib/threadActivity.test.ts on both revisions. A 390px web browser is not native mobile proof. Do not invent a boot failure or silently omit mobile. |

## Exact capture acceptance criteria

1. For R1 and R2, capture the WHOLE application viewport on both revisions at CSS widths 1440 and 390, each light and dark: minimum 16 settled PNGs (2 providers × 2 revisions × 2 widths × 2 themes). Use identical fixed viewport heights per width, recorded in manifest (recommended 900 at 1440 and 844 at 390), device scale 1. Include application chrome, thread context, final reply/tool context and inline page; do not crop to iframe or replace with standalone HTML screenshots. If one viewport cannot show all context, add a second contextual frame without replacing the whole-surface frame.
2. V1 guest has its own changed server consumer: minimum 8 settled whole-viewport PNGs (2 revisions × 2 widths × 2 themes) using one representative execute fixture. R1/R2 captures may share a thread only if both provider identities remain independently evidenced; otherwise use separate threads. Capture file names identify row, revision, width, theme and state. Explicitly label Before and After in evidence index.
3. Settled means provider turn completed, attachment load resolved, fonts loaded and frame height stable across consecutive observations; no loading placeholder, transient theme, ongoing scroll or mid-transition frame. Verify marker/title, readable content, no horizontal overflow at 390 and no duplicate inline page. Record observed before behavior even if it differs from expected failure.
4. Every interaction row (R1, R2, V1 and M1 if native boots) needs before/after recordings. For browser interactions use headed Chromium on Xvfb and ffmpeg x11grab, not screenshot slideshows or fabricated playback. Supplied environment reports full browser available:false; headed Chromium is at /home/ubuntu/.cache/ms-playwright/chromium-1223 and Xvfb is available. Capture agent should retain the unavailable report and actual fallback command/version. Auditor launches no browsers or servers.
5. Browser recording minimum: show whole app and fixture marker; click page increment button and show 0→1; open full screen where supported, interact, close and show inline page still usable; toggle light/dark and show settled theme; reopen/reload thread and show page persists. At 390 demonstrate vertical scroll without horizontal clipping. If before has no page, record attempted equivalent navigation and absent inline result; mark button/fullscreen steps unavailable before rather than faking them. One continuous recording per fixture/revision may cover widths/themes if transitions and final viewport sizes are documented. Guest uses only controls actually supported there. Native uses platform recording, explicitly distinguished from required browser x11grab evidence.
6. Evidence manifest links each PNG/video/transcript/test result to matrix ID, exact SHA, provenance (REAL PROVIDER, UNIT, ACP MOCK REPLAY, APP REPLAY or SERVER INTEGRATION), viewport/theme and outcome. Videos must be playable with readable interaction result. Attach sanitized raw provider invocation/output excerpts and actual persisted row/attachment association for R1/R2. Screenshots alone do not establish actual provider use.
7. Focused test transcripts include exact commands, revision, exit status and assertions/failures for shared htmlRender/toolOutput, provider-acp runtimeModel, AcpAdapterV2, web session-logic, mobile threadActivity and attachment/guest/projection lifecycle where exercised. Before may lack new tests: report that, or run an external temporary harness against each revision and disclose it; never edit the source under audit or imply missing tests passed. Existing attachmentStore tests cover direct render, not all execute/deletion/SQL cases; mark S1 unverified if no genuine integration transcript is obtained.
8. Acceptance requires both mandatory REAL provider rows, the 16 main + 8 guest settled frames, interaction recordings, ownership/deletion transcript and native evidence or the explicit boot-failure/test fallback. Missing rows are UNVERIFIED with concrete reason, never inferred green from unit tests. Desktop shell, relay/tunnel, additional ACP providers and a live nested Grok child are not established by web/Grok-parent evidence; explicitly state those limits. No new UI controls, contracts or entry points are introduced by this diff, so settings/palette/keybinding expansion is unnecessary.

## Audit status

Planning only. Full diff read; no tests executed, no provider calls, no server/browser/emulator launches, no source edits, no live data access and no forge mutations. The sole intended external write is publishing this requested matrix via ghdrop. Capture agent executes the matrix; a separate fresh pass2 audit must inspect the resulting evidence and distinguish missing proof from product defects.