# Pass 2 evidence audit — SUFFICIENT

PR [#24576](https://github.com/pingdotgg/t3code/pull/24576). Evidence audit only, in `/home/ubuntu/wt/pr-24576`; scratch `/tmp/ev-24576-audit-r2`. No source changes, checkout, PR updates, CI watch, browser, or live T3 userdata access.

Baseline [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b); head [13e24a9d91](https://github.com/pingdotgg/t3code/commit/13e24a9d913e9bf072a2d00a72bdb65ee12f4af7). Current HEAD and merge-base match these pins; worktree clean. Public production.diff equals the complete pinned git diff; manifest hashes pass. Historical capture provenance is supported by per-SHA scripts, transcripts, settings snapshots, process ledger and source text; it is not a cryptographic attestation of running process code.

- **A-real: PROVEN.** One real OpenCode 1.18.18 ACP turn at each SHA, via T3 acpRegistry/local-command production adapter. Complete first prompt block equals the entire production ACP wrapper generated from each pinned source, not a keyword subset. Ordered decoded text agrees with JSON. Session IDs and JSON-RPC request/response IDs match; provider returns end_turn and T3 reports completed with EV24576_ACP_OK. Before includes CORE, Codex example and ACP paragraph; after retains CORE and ACP, removes Codex example, and has the full executable launcher on delegate_task. The tee forwards bytes and spawns the real CLI; no fabricated response path. Grok was unavailable due to auth mismatch; this proves OpenCode ACP only.
- **O-real: PROVEN.** One native OpenCode 2.0.28 owned-server turn at each SHA. Production prepareTurn performs MCP PUT 204, instruction-entry PUT 204 and prompt POST 200. The exact full CORE from each pinned source is the instruction value suffix, after runtime text. Instruction and prompt session IDs agree, prompt response session ID agrees, and MCP identity matches T3 thread. T3 completes with EV24576_OC2_OK. Before includes Codex and ACP text; after excludes both. Fetch observation calls the original fetch against the real local v2 server; no fake SDK or v1 promptAsync substitute.

All four JSON and decoded text transcripts were read and structurally checked in full. All four supplied public transcript URLs were fetched with curl and compared byte-for-byte with local artifacts. urllib initially received HTTP 403; curl successfully fetched identical content. Assertions and delivered diffs agree with pinned source. Installed executables independently report 1.18.18 and v2.0.28.

**Independent reproduction: PASS.** Read supplied setup, server, row, tee, preload, export and stop scripts first. Adapted copies only under audit scratch: isolated home/log/ledger paths, preserving the existing real native binary. Started production `vp run dev --no-seed --home-dir /tmp/ev-24576-audit-r2/home/13e24a9d913e9bf072a2d00a72bdb65ee12f4af7`, registered the worktree project there, ran supplied row O through the actual server/provider. Exactly one successful MCP PUT, entry PUT and prompt POST; full delivered value byte-identical to captured head value; completed EV24576_OC2_OK. Reproduction JSON includes requests, completion and cleanup. Shutdown also observed an MCP DELETE aborted as the owned server stopped; this is outside the successful turn and makes no removal-control claim. Supervisor PID 2682700; 32 tracked PID/start-time identities stopped, no TERM or KILL survivors. Original capture ledger was not overwritten.

**Secret scan: PASS.** Privately collected actual credential values from inherited secret-bearing environment variables and existing OpenCode/Grok config, then compared against every public capture file and sanitized reproduction proof. Values were never printed. Authorization/MCP config omitted. This is a known-value scan, not a guarantee against arbitrary unknown secrets. Only sanitized proof/checks/report/matrix are uploaded; private server logs, copied configs and databases stay in retained scratch.

**Limits.** This satisfies ONE real attached turn per row per SHA, plus one independent head native reproduction. No additional live unchanged-turn cache, MCP off/external/failed-add, detached, slash/mode transition, compaction or reinjection controls were run. Existing 22-row fixture matrix remains historical evidence and was not rerun in pass 2. No successful Grok/Cursor/Pi ACP claim, fallback command execution, child delegation execution or behavioral compliance claim. Completion and transport acceptance prove delivered instructions, not future model obedience. No recapture needed for the requested scope; broader claims require their own live captures.

Capture archive: [complete real evidence](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bfc37e6c32fb6ce3/ev-24576-real-evidence.tar.gz). Reproduction procedure: [capture README](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6ba209be13aaa46f/README.md).

Audited through Codex harness, gpt-6.1-sol. Uploads use the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md). Scratch retained for parent cleanup.