Issue 21236 CLI/server runtime evidence
UTC: 2026-10-22T02:28:23.786Z
revision: 10cd74a5737fe0093d7cbca1c54e6a07ff556cac
base: 8acbefefc51b4d281dcd04108c82baa1ab902b0e
branch: fix/issue-21236
environment: {"node":"v24.21.0","os":"Linux","release":"6.1.102","arch":"x64","cwd":"/home/ubuntu/wt/issue-21236"}
existing lead server: {"pid":1337968,"origin":"http://127.0.0.1:14530","startedAt":"2026-10-22T02:16:22.285Z"}
server process command: /usr/local/nvm/versions/node/v24.21.0/bin/node src/bin.ts 
server cwd: /home/ubuntu/wt/issue-21236/apps/server
commands: node apps/server/src/bin.ts auth session issue --json --label <fixture> --subject issue-21236-evidence --base-dir <home> (token output kept private); auth session list --json --base-dir <home>; auth session revoke <fixture-id> --base-dir <home>
1 PASS actual WebSocket readyState=1; HTTP={"sessionId":"1df8b848-6a9f-4e06-97f4-49146e1c85be","connected":true} CLI={"sessionId":"1df8b848-6a9f-4e06-97f4-49146e1c85be","connected":true} exit=0
6a PASS success temporary auth-cli session: {"session_id":"dd310c6a-b811-450e-8471-160300c890e7","subject":"auth-cli","revoked_at":"2026-10-22T02:28:35.349Z"} absent from active CLI output
6a PASS captured temporary bearer replay after success: HTTP 401 (bearer never logged)
2 PASS awaited WebSocket close then authoritative HTTP disconnected response (no sleeps; responses=1): HTTP={"sessionId":"1df8b848-6a9f-4e06-97f4-49146e1c85be","connected":false} CLI={"sessionId":"1df8b848-6a9f-4e06-97f4-49146e1c85be","connected":false} exit=0
3 PASS isolated home no runtime, retained issued session: {"sessionId":"3a6011ae-cde3-4bbf-9f7b-7c41a8c887bb","connected":false} exit=0
4 PASS stale runtime dead PID=2147483647: {"sessionId":"3a6011ae-cde3-4bbf-9f7b-7c41a8c887bb","connected":false} exit=0
5 PASS live PID=1346644 unreachable origin=http://127.0.0.1:1 exit=1 stdout empty; stderr=Could not ask the T3 Code server at http://127.0.0.1:1 which sessions are connected.
6b PASS failure temporary auth-cli session: {"session_id":"c4b8916f-e113-4d2f-aa38-c1730af03f3c","subject":"auth-cli","revoked_at":"2026-10-22T02:29:00.609Z"}
6b PASS failed temporary credential absent from subsequent active list; offline fixture session retained
6b replay limitation: unreachable fixture origin has no auth service. Supplemental 6c below resolves failure-path bearer replay using the lead auth service.
Visual audit matrix EMPTY: CLI/server only; no browser/images/video. No app server started or stopped. No repository modifications.
cleanup runtime fixture: revoked
cleanup isolated home and private captured bearer: removed

Supplemental failure-path bearer replay (same revision):
6c supplemental failure-path replay: CLI fetch preload captures bearer privately and redirects only outgoing request to unreachable http://127.0.0.1:1; runtime file/server unchanged. Uses worktree DB and its real auth service to make replay meaningful.
command: EVIDENCE_FORCE_UNREACHABLE=1 EVIDENCE_CAPTURE=<private-file> node --import /tmp/21236-capture-fetch.mjs apps/server/src/bin.ts auth session list --json --base-dir .t3
CLI exit=1 stdout empty; revoked auth-cli row={"session_id":"4bbb6042-aac8-4e26-a4e4-699f5c105135","subject":"auth-cli","revoked_at":"2026-10-22T02:29:19.613Z"}
6c PASS failure temporary bearer replay against original lead auth service: HTTP 401 (bearer never logged)
cleanup supplemental private captured bearer: removed

Capture commands: node /tmp/21236-final-evidence.mjs; node /tmp/21236-failure-replay.mjs
Sanitization: output restricted to fixture IDs, connectivity, CLI exit/error, revocation timestamps, revision and environment. No tokens, tickets, startup links, customer/session content, or secrets included. Before transcript separately projected to ID/connectivity.
Final git status --short: empty; HEAD unchanged 10cd74a5737fe0093d7cbca1c54e6a07ff556cac.
FRICTION: none outstanding across six requested rows; transient stale keep-alive capture failure resolved by fresh HTTP connections.