# Proof audit pass 2 — GitLab clone default

Evidence is sufficient for the requested scope. No new code defect found. This is an evidence verdict on the replacement revision, not approval of the original fork's checks or of an unbuilt merged revision.

Reviewed [#13351](https://git.cafe/pingdotgg/t3code/pulls/13351) in `/home/ubuntu/wt/pr-13351` only. Replacement HEAD [589c61891b](https://git.cafe/pingdotgg/t3code/commit/589c61891b4d781cb14e0243e3e666370b994245), full `589c61891b4d781cb14e0243e3e666370b994245`; mergebase [3cc31ed27c](https://git.cafe/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b), full `3cc31ed27c8956b36cee35a50509fb7c6869592b`. Forge reads used cafe only. Forge still reports original fork [96a893d2f0](https://github.com/Mnigos/t3code/commit/96a893d2f04aabe3b8baf07e961e02a5e4d9a1a2), so its 28 successful checks and old description's 18-test claim are not replacement-head validation. I independently ran the current focused file: seven tests passed.

## Code and provenance

Complete replacement diff: two files, 19 insertions and one deletion. GitLab's shared definition changes SSH to HTTPS with a credential-helper explanation; existing project-operation tests add a nested GitLab web_url case and a Bitbucket SSH control. No components, CSS, layouts, permissions, contracts, server logic or dependencies change.

I traced `getDefaultCloneUrl` through web CommandPalette and native AddProjectScreen, actual GitLab `web_url` normalization, tracked and legacy dispatch, pasted-URL bypass, provider definitions, and server protocol/fallback selection. Provider-selected GitLab uses repository.url verbatim. Explicit pasted SCP/ssh:// URLs stay unchanged; other forges' defaults stay unchanged. The unchanged server auto path still selects SSH for direct service calls; explicit protocol:ssh disables HTTPS fallback. This client-default change does not promise to alter direct MCP/service protocol:auto. HTTPS preference also selects self-hosted HTTP web_url verbatim; it does not enforce or upgrade schemes. G4 discloses this accurately.

I checked all seven provenance blob comparisons against advanced main [76da264a0c](https://git.cafe/pingdotgg/t3code/commit/76da264a0ccaeff5fa88bcb5cfada1be6ae320c4): they match. That commit changes native highlighting and related build files; the documented clone runtime paths are unchanged. No merge was built or claimed. Current definition SHA256 is `325a12e85150d0d4337dc02ea509a47c59eaaf6a3b65fb2955cb3974e2285c59`. BEFORE is transparently a replacement checkout with only the definition restored to mergebase; the other changed file is tests. It is runtime-equivalent for this narrow diff, not a literal full checkout of the base commit.

## Required rows

| Row | Visual and transport finding | Result |
| --- | --- | --- |
| G1 | Real GitLab lookup, destination, tracked clone and repository identity on both sides. BEFORE submits SCP SSH, receives genuine publickey rejection, then HTTPS fallback exits 0. AFTER submits exact lookup web_url without .git, clones over HTTPS directly and exits 0. | Sufficient |
| G2 | Same genuine flow proves initial rejection/fallback before and absence of an SSH attempt after. Baseline overall success is retained, not described as total failure. Temporary official altssh:443/no-identity fixture is disclosed. | Sufficient |
| C1 | Real GitHub lookup and successful clone both sides; RPC and Git argv remain HTTPS. All three primary pairs are exact. | Sufficient |
| C2 | Pasted GitLab SSH is submitted unchanged both sides. Before rejects SSH then succeeds over HTTPS. After rejects SSH then encounters real DNS failure in fallback. Failed UI is preserved. Separate real Retry shows failure, cloning, then success toast; trace exits 0. | Sufficient for explicit URL preservation; authenticated SSH success is unverified |

G1's original BEFORE recording visibly ends at stale master/+1232/-1411 metadata. It is not acceptable as a matched settled outcome. The index explicitly identifies this and supplies corrected stills plus separate BEFORE/AFTER settled recordings. I inspected those recordings: they load the same draft and settle to main/+0/-0 with repository identity. Reusing the same project/draft while swapping the real cloned directory under stopped servers is a disclosed presentation control, not a second independent project-creation test. Actual clone proof records the same `d10a6ca646fa07f9e67a6490c4a8f0e43216bfcf`, main, clean on both sides. The original real cloning interactions and traces remain the transport proof.

C2 retry returns to the existing server thread; it is not a matched final-project screenshot. I inspected early retry frames at 0, 0.3, 0.7, 1, 1.5 and 2.5 seconds, plus later success/default-thread frames. The disclosure matches what is shown. The failed after outcome has not been replaced by a fabricated successful frame.

## Visual inspection and numerical verification

I downloaded every index-linked artifact with curl and checked all 88 manifest entries: no hash mismatches. Python urllib initially returned 403; curl succeeded, so this was not missing public evidence. Inspected all 18 primary screenshots individually, the extra after-C2-failure image, all three sheets, all 18 original t0/t16 diffs in labelled grids, all nine new amplified t0 diffs individually, and the historical inspection sheets. I extracted and inspected six timed frames from every one of the 15 delivered recordings: six raw interactions, six captioned supplements, two corrected settled recordings, and C2 Retry. This was visual inspection of actual pixels, not just an inventory check.

Recordings inspected: before/after-G1-G2.mp4; before/after-C1.mp4; before/after-C2.mp4; annotated-before/after-G1-G2.mp4; annotated-before/after-C1.mp4; annotated-before/after-C2.mp4; before/after-G1-G2-settled.mp4; after-C2-retry.mp4.

I independently recomputed every raw difference image and all nine published amplified differences from the primary pixels. All match their formulas, without masking: raw RGB abs delta with max-channel threshold >0 or >16; amplified t0 is min(abs delta ×32,255). New amplified links and script were downloaded and verified separately because the original manifest predates them.

| Pair | t0 changed pixels | t16 changed pixels | Maximum channel delta |
| --- | ---: | ---: | ---: |
| G1/G2 input, confirmation, corrected outcome | 0 each | 0 each | 0 |
| C1 input, confirmation, outcome | 0 each | 0 each | 0 |
| C2 input | 1,427 | 0 | 9 |
| C2 confirmation | 0 | 0 | 0 |
| C2 outcome | 88,850 | 36,209 | 235 |

C2 input differences are confined to the blurred background branch label, x1003..1090/y223..248. Amplification makes that small difference visible. C2 outcome differences visibly include failed-clone banner, changed heading, composer position and Git status controls; these are disclosed fixture/network outcome differences, not UI changes caused by this one-line definition patch. No zero-diff outcome claim is made for C2.

Narration is written text and supplemental trace captions, not spoken audio. Captions preserve actual submitted URLs and real Git events, with approximate timing explicitly disclosed. Some rejection/exit events last less than a video frame in the timeline and are not readable as standalone captions; the raw timestamped trace and index provide that detail. The readable SSH URL plus fallback/success summary and full trace support G2; do not present the supplemental overlay as a substitute for the trace.

## Independent fresh reconstruction

Used the downloaded capture.cjs and bootstrap-browser.cjs unmodified, matching fixture-seed.json's G1/G2 source/input and browser settings. Actual app ran from the exact replacement HEAD under fresh `/tmp/ev-13351-audit-home-pass2`, explicit --home-dir, --no-seed and T3CODE_DEV_SEED=0. No live userdata was read or seeded. Chromium 148.0.7778.96 / Playwright 1.60, headed Xvfb, ffmpeg x11grab, 1280×900 DPR1 dark/reduced motion, same fixed browser date and system font stack. Temporary Git trace wrapper executes /usr/bin/git unchanged. The new private paired state was created locally and is not published. The independent home/display necessarily differ to isolate this run.

Actual RPC projectClone.start sent `https://gitlab.com/gitlab-org/project-templates/express`. Real Git started 23:43:45.968 UTC and exited 0 at 23:43:47.278 UTC. There was exactly one clone attempt, no SSH. Actual origin is the exact HTTPS web_url; clone HEAD is `d10a6ca646fa07f9e67a6490c4a8f0e43216bfcf`, branch main, status empty.

The independently rebuilt affected input capture differs from the delivered HEAD input by **681/1,152,000 pixels (0.0591%) at t0, zero at t16, maximum channel delta 2**, bounded x200..245/y104..132 around the blurred sidebar age label. The input, lookup and controls match. This is an unmasked whole-image comparison, not a cropped zero-diff claim.

The fresh confirmation differs by 2,387 pixels at t0 /1,561 at t16 because its isolated destination path is different. The first fresh outcome differs by 10,480/9,665 and shows stale master metadata despite actual main; it is retained as such and is not passed off as a matched settled result. Attempts to reopen a settled outcome did not complete: direct navigation redirected to the default thread, and the final attempt encountered connection refused after the dev-runner exited 143. Therefore I claim independent reconstruction of the affected input plus genuine successful HTTPS clone, not an independently matched settled-outcome capture. This does not replace or invalidate the supplied corrected settled pair.

Re-ran helper-fixtures.mjs at HEAD: G3 custom port/subgroups selected verbatim; G4 HTTP selected verbatim; six other providers and three pasted URL forms unchanged, GitHub shorthand unchanged. BEFORE helper transcript agrees with the base definition/source. No checkout edits were used to rerun BEFORE.


## Independent audit artifacts

![Independent rebuilt GitLab input](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c86cb6ce03b66fa2/after-G1-G2-input.png)

[reproduction-input-diff32.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1b1a006a9fd3034b/reproduction-input-diff32.png)

[after-G1-G2.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/faa4a2c144062183/after-G1-G2.mp4)

[git-trace.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/112f4e460589ba16/git-trace.jsonl)

[auditor-diff-metrics.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c3ac6f134ffe2c92/auditor-diff-metrics.json)

[reproduction-diff-metrics.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f87d287a31c27840/reproduction-diff-metrics.json)

## Remaining limits and cleanup

P1 tracked web clone is live exercised, including supplied Retry. P2 old blocking server, remaining E1 launchers/gates, direct S1 service protocols and remote/relay/tunnel remain source-only. Native iOS/Android are explicitly unverified as permitted. No private-repository credentials, authenticated SSH success, Electron shell or multi-environment runtime are claimed. Typecheck success was reported by the dispatcher, not rerun by this auditor.

No repository edits, pushes, reviews/comments, merges or watches. Scratch artifacts stayed under /tmp; no scripts committed. No cookie, database, token or private server log uploaded. Final git status is clean and exact HEAD/definition hash unchanged. The spawned capture browser/ffmpeg exited; both retained Xvfb sessions exited; audit ports 7684/15724 are closed. The dev-runner session returned 143; its cause is unknown and not attributed to the patch. Thread PR registration is present and watching=false.

## FRICTION

category | issue | prevention
--- | --- | ---
Capture state | Pixel stability accepted stale branch metadata, reproduced independently | Assert actual clone SHA/branch/status and corresponding UI state; retain correction disclosure
Narration | Millisecond rejection captions can be shorter than a frame | Keep timestamped trace authoritative; add a readable summary rather than claiming every event is visible
Infrastructure | urllib artifact fetch 403; curl worked | Verify with a second ordinary download client before calling an artifact missing
Reproduction | Direct draft navigation redirected; later server exited before supplemental settling | Load app state before draft navigation; keep owned runtime alive through final assertions, report unsuccessful captures explicitly
Network | C2 DNS failure changes terminal UI | Preserve failure plus real retry trace; do not substitute unmatched recovery as a paired screenshot
Privacy | Pairing state needed locally | Publish only sanitized seed/driver and selected public traces, never cookie/DB/token

VERDICT: SUFFICIENT