# Proof audit, pass 1

[#32374](https://git.cafe/pingdotgg/t3code/pull/32374), branch `fix/issue-32360`, head [049b1e8](https://github.com/pingdotgg/t3code/commit/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e), against merge-base [80e6261](https://github.com/pingdotgg/t3code/commit/80e62619f5c01d84579bcf70ea6d566712007412). PR metadata, complete two-file diff, relevant callers, existing tests, comments, and reviews were read. The supplied checkout was clean and its HEAD and merge-base matched the brief. This pass derives fixtures; it does not execute tests or create captures. Existing test pass/fail counts are PR-body claims, not fresh audit results.

## Findings

1. **Missing requested proof, not a demonstrated implementation defect:** the body’s displayed before-fix transcript uses a shell simulation, not either revision of the real driver. The after-fix real-driver result is a prose summary with no executable driver harness or per-fixture output. Thus no row has a complete, revision-identified, paired real-driver transcript under this audit’s capture definition. The simulation adequately illustrates the root data-loss mechanism; the new regression tests adequately target capture-tree inclusion at root and untracked-only subdirectory. Neither supplies the requested real-driver before/after restore proof.
2. **Minimum paired capture set: F01, F02, F04.** These exercise the changed empty-prefix shortcut, ordinary nonempty-prefix probe, and fallback prefix decoding. Fold nested paths, spaces, whitespace-only ignore input, and an alternate ignore source into F04. Other rows are focused compatibility controls; they do not each need another paired runtime capture. Existing behavior tests can carry the ordinary ignored-project, unborn, index-preservation, restore, and recovery controls. No screenshots or browser/provider runs are needed.
3. **Keep the compatibility claim precise:** the existing newline test executes the resolver fallback at a repository root on current Git. It does not exercise old Git itself, a nonempty/newline `--show-prefix` value, or the fallback’s unknown-HEAD arm. The body’s claim of fallback-path coverage is valid for the shared branch, but must not be read as old-Git verification. The body explicitly discloses that old Git and native Windows/macOS were not checked.

## Affected call paths

- [RunExecutionService](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/orchestration-v2/RunExecutionService.ts#L941) calls `CheckpointServiceV2.captureBaseline` before starting a provider turn. Existing refs and side chats bypass capture; genuinely unsupported ignored workspaces are swallowed as before.
- The `checkpoint.capture` outbox effect in [EffectWorker](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/orchestration-v2/EffectWorker.ts#L480) calls [RunFinalizationService.finalize](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/orchestration-v2/RunFinalizationService.ts#L56), then [CheckpointCaptureService.execute](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/orchestration-v2/CheckpointCaptureService.ts#L123), then `CheckpointServiceV2.capture`. Completed and stopped-run checkpointing share this path; side chats/forceMissing bypass it. Genuine unsupported capture maps to missing; other capture failures map to error.
- Both methods in [CheckpointService](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/orchestration-v2/CheckpointService.ts#L253) call [CheckpointStore.captureCheckpoint](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/checkpointing/CheckpointStore.ts#L93), which resolves the Git driver and calls `checkpoints.captureCheckpoint`. Its private `resolveCaptureRepository` has exactly that caller. The changed workspace probe is the only production call to this driver’s `filterIgnoredPaths`; the exported filter’s implementation and other contract-test uses do not change.
- [CheckpointRollbackService](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/orchestration-v2/CheckpointRollbackService.ts#L292) calls `CheckpointServiceV2.restore`, then `CheckpointStore.restoreCheckpoint`, then the same driver’s restore method. Restore is unchanged but consumes the newly corrected tree. A direct driver harness reaches the necessary production implementation without exercising provider rollback or any client.
- Web, desktop, mobile, agent tools, and scheduled work converge on these server checkpoint paths; there are no changed client contracts, provider adapters, RPCs, or render paths. No separate surface/provider capture is justified.

## Conditional branch census

Source: [resolver](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/vcs/GitVcsDriver.ts#L862), [workspace probe and ignored-workspace handling](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/vcs/GitVcsDriver.ts#L1137), [restore](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/vcs/GitVcsDriver.ts#L1334).

- Combined `rev-parse`: exit 0 means HEAD exists and expects five split lines including the final empty line; exit 1 means unborn HEAD and expects four. Unexpected line count, missing terminator, or an exit other than 0/1 selects fallback. F01/F02/F06 cover fast-path shapes; F04/F05/F07 cover fallback shapes.
- Fallback first resolves common-dir (absolute directly; relative against physical cwd, with cwd fallback if realPath fails). It then separately reads prefix and strips exactly the output’s final LF, preserving name whitespace/newlines. A known HEAD result is reused; otherwise `hasHeadCommit` is called. Common-dir failure occurs before the new prefix command; prefix failure propagates before a scratch index is created. F04/F05/F07/F15/F16/F17 cover these arms.
- Empty prefix skips `check-ignore`. A nonempty prefix becomes `../` plus its final directory component, with no trailing slash. NUL-delimited filter output yields either one surviving input (not ignored) or none (ignored); exit 0/1 is accepted, other exits fail. F01–F04/F08–F14/F17 cover these choices. The filter’s empty-input and chunk-loop branches are unchanged and cannot be reached differently by this single-path call.
- An ignored workspace reads staged additions: empty output skips seeding, nonempty output seeds scratch index. No cached workspace paths gives `VcsUnsupportedOperationError`; cached paths permit `add -u`. A nonignored workspace uses `add -A`, so regular per-file ignore rules still apply. F10–F14 cover these decisions. Unborn HEAD skips HEAD-index seeding and omits the checkpoint commit’s parent (F06).
- The scratch-index reuse, sparse/flagged-index handling, embedded-repository recovery, durable writes, publication, and cleanup algorithms are unchanged. Correcting a false ignored result can expose the existing `add -A` recovery path; F18 covers its meaningful control. Failure cleanup and real-index preservation remain shared assertions. Expanding every unrelated sparse/index/fsync branch into another proof fixture would not scale to this change.

## Capture protocol

`D` means a scratch script importing the selected revision’s `GitVcsDriver.makeVcsDriverShape`, using the real Node/Effect/VcsProcess layers as in the existing tests, and awaiting `driver.checkpoints.captureCheckpoint` and `restoreCheckpoint({ fallbackToHead: false })`. Git creates fixtures and inspects refs/blobs; it must not replace capture or restore. `G` means a synthetic Git-only diagnostic comparing the old `.` and new parent-relative probes with `git add -A` using a scratch index; it is supporting evidence, not a capture. `T` means an existing focused behavior test in [GitVcsDriver.test.ts](https://github.com/pingdotgg/t3code/blob/049b1e8e9cdb888d0090c1f5240f9ae027f8b68e/apps/server/src/vcs/GitVcsDriver.test.ts).

For each minimum row, run D on independently initialized identical synthetic fixtures at the base and head. Record revision, Git version/platform, cwd as a JSON string, exact ignore bytes/source, HEAD state, capture result/ref, NUL-safe checkpoint paths, `notes.md` blob/content, real-index equality during capture, then deterministic filesystem edits standing in for an agent, restore result, restored bytes, and whether the post-snapshot file remains. No paid provider turn is necessary. Keep ignore sources stable across restore. Prefer committed `.gitignore` in the root fixture so deleting an untracked ignore file is not a confounder. Preserve a modified out-of-workspace sibling in subdirectory fixtures.

For F02/F04’s untracked-only workspace, base capture is expected to reject. Record the error and absence of a ref; a complete before restore cannot exist for that state. Do not fabricate a capture or restore HEAD. The head must complete capture → edit → restore. If a full before cycle is desired, the same script can add a committed workspace sentinel: base is then expected to capture without `notes.md` and restore deletes it. This is an optional variant, not a substitute for the untracked-only rejection result.

All scenarios are deterministic and need no elapsed-time or interactive evidence; **none is `recording`**. An ordered runtime transcript suffices. The transcript must say when a branch is induced by a process shim rather than exercised with an actual old Git binary.

## Fixture matrix

“Changed” means the diff is expected to correct a result; “control” means touched mechanics must preserve the result. “Test-covered” refers to inspected test source and the body’s reported runs. “Partial” never means a paired capture exists. Status distinguishes required missing captures from supplemental diagnostic gaps.

| ID / named fixture | Data and affected behavior | Production method / expected result | Existing evidence and status / minimum capture |
| --- | --- | --- | --- |
| F01 Root CRLF | Committed HEAD, cwd=root; root `.gitignore` bytes `a.txt\r\n\r\nb.txt\r\n`; preexisting untracked `notes.md`. Changed: empty-prefix skip selects `-A` instead of erroneous `-u`. | D: capture, change tracked content and notes, create `later.txt`, restore. Base loses notes; head restores original notes and removes later file. | New root regression test covers tree inclusion. Body’s simulation adequately illustrates loss; after real-driver prose is partial. **MISSING paired capture; required C1.** |
| F02 Subdirectory CRLF | Same root ignore bytes and HEAD; cwd=`sub`, no tracked files inside it; notes exists only there. Changed: nonempty prefix probe avoids false ignored/empty-tracked rejection. | D: base must report unsupported/no ref; head completes cycle, restores notes and removes later file. Outside sibling stays modified. | New subdirectory regression test covers successful capture/tree; body has only after summary. **MISSING paired capture/error transcript; required C2.** |
| F03 Nested / spaces | cwd=`outer/sub` and `outer/white space`; same blank ignore fixture. Changed path normalization must use basename relative to actual cwd, not append the whole prefix. | D or G with JSON/NUL-safe names; new probe agrees with staging. Can fold depth/spaces into F04. | Body claims after driver runs for nested and spaces paths; no before output. **PARTIAL; covered by C3, no separate capture.** |
| F04 Newline prefix | cwd=`outer space/line \nbreak `, notes untracked; isolated `core.excludesFile` containing a spaces-only line. Changed: multiline prefix forces fallback, single terminal LF removal preserves the real newline/trailing space, NUL probe survives. | D: log prefix/fallback commands and escaped paths, base rejection/no ref, head successful capture/edit/restore; compare outside sibling and original notes bytes. | Body’s newline after summary lacks fixture bytes/commands. Existing newline test uses repo-root cwd, not newline prefix. **MISSING paired capture; required C3.** |
| F05 Newline metadata path | Repository root’s absolute name contains LF; cwd=root, ordinary ignore data, committed HEAD. Control: fallback because common-dir/index contain LF, then empty prefix skips probe. | T already checks capture, real-index equality and scratch cleanup. D optional; cycle should preserve notes on both revisions. | Existing newline-root test and reported suite are adequate capture controls, not a restore transcript. **TEST-COVERED; no additional minimum capture.** |
| F06 Unborn HEAD | Newly initialized repo; root and subdirectory cwd, with an outside staged path for subdir. Control: exit 1/four-line fast parse; no HEAD read-tree/parent, restore unstages workspace only. | T’s committed/unborn command and parent assertions plus unborn restore root/nested case. Blank-ignore variant is optional, not a full cross-product requirement. | Existing tests exercise both root capture and nested restore. No explicit body runtime row. **TEST-COVERED; no additional minimum capture.** |
| F07 Old Git / malformed combined result | Git <2.31 echoes unknown `--path-format`; root and nonempty prefix; known vs unknown HEAD status. Missing final LF/unexpected line count also enters fallback. Control: extra prefix lookup, undefined indexPath, HEAD recheck only when unknown. | D with real old Git if available; otherwise transparent VcsProcess response shim plus real Git for remaining commands. Verify commands/result/ref. Shim cannot certify old-Git compatibility. | Body explicitly says old Git untested. Newline test covers only shared fallback with known committed HEAD/root. **DIAGNOSTIC GAP; no separate minimum capture; do not claim native old-Git proof.** |
| F08 Ignore sources / whitespace | Ancestor `.gitignore` (root or intermediate), `.git/info/exclude`, isolated `core.excludesFile`; blank CRLF versus spaces-only line. Root/sub represent skip/probe behavior. Changed: empty patterns must not classify workspace ignored. | G table using exact source bytes, same synthetic notes, isolated Git config, scratch staging; D representatives are F01/F02/F04. Avoid duplicating every source × cwd combination. | Body claims reviewer Git matrix, but gives no cases/output. **CLAIMED ONLY supplemental diagnostic; sources represented across C1–C3 except info/exclude.** |
| F09 LF / no-ignore control | Root and subdir; no ignore file or LF-only blank lines plus ordinary filename rules. Control: probe change must not alter normal untracked inclusion. | G, or D as paired LF control beside C1; both revisions retain notes and exclude ordinary ignored files. | Body’s LF simulation adequately demonstrates simulated control; existing capture/restore tests cover normal driver behavior. **CONTROL-COVERED; optional transcript control.** |
| F10 Truly ignored, no tracked paths | cwd=`sub` with `sub/`, or nested cwd with ignored ancestor `outer/`; no committed/staged workspace files. Control: ignored=true, no additions, empty tracked query, unsupported/no ref. | T for basic ignored project; G variants for parent and anchored rules. Cannot produce a successful cycle by design; log rejection and absence of ref. | Existing ignored-project test verifies error/no ref/index unchanged. Body’s broad matrix claim lacks rule-specific output. **TEST-COVERED basic; parent diagnostic CLAIMED ONLY; no minimum capture.** |
| F11 Ignored, committed paths | Commit `sub/committed.txt`, then ignore `sub/`, edit it and add untracked secret. Control: no staged additions, tracked nonempty, `-u`, retain working edit and omit secret. | T’s committed-only row. D optional: later edit/restore restores tracked content and leaves ignored secret alone. | Existing test checks exact checkpoint tree/content and index equality; body reports it passing. **TEST-COVERED; no minimum capture.** |
| F12 Ignored, staged-only / mixed | Stage workspace additions before installing `sub/` ignore; optionally committed path too. Control: seed additions, nonempty tracked query, `-u`; unstaged working bytes retained, new secret omitted. | T’s staged-only and mixed rows cover nonempty seed branch. D optional; do not restore real workspace index during audit. | Existing table verifies both input forms, exact tree/blobs and original index equality. **TEST-COVERED; no minimum capture.** |
| F13 Negated allowed sibling | Root rules `*`, `!.gitignore`, `!file.txt`, `!keep/`, `!keep/**`; cwd=`keep`, ignored sibling with secret. Control: nonignored branch despite broad ignores. | T for allowed sibling; G for additional nested negations/precedence. `keep/new.txt` included, ignored sibling absent. | Existing ignored-project test verifies allowed ref and rejected ignored ref. Broader negation matrix only claimed. **TEST-COVERED representative; no minimum capture.** |
| F14 Contents-only wildcard boundary | Rule `p/**`; compare cwd=`p` (directory itself allowed; untracked descendants ignored) and cwd=`p/sub` (ignored). Control: slashless directory decision must agree with Git, without treating ignored children as an ignored root directory. | G probe/staging table; D optional with tracked sentinel to distinguish capture behavior. Parent may publish a tree without new children; child without tracked paths rejects. | Body names `p/**` and claims agreement but has no per-case data. **CLAIMED ONLY supplemental diagnostic; no minimum capture.** |
| F15 Root with real excludes | cwd=root, committed tracked file, rule `*` or `/`; notes genuinely ignored. Control: root is never itself ignored; skipping check must still let Git omit ignored new files and capture tracked edits. | G or D control: distinguish expected omission from F01’s erroneous omission; preserve ignored file through restore. | Existing ordinary per-file ignore tests cover filtering, not this exact root-skip fixture. **SUPPLEMENTAL GAP; no minimum capture.** |
| F16 Physical cwd / linked worktree | Symlink alias into nested directory with an outer decoy repo; separately Git-linked worktree whose common dir/index differ. Control: prefix describes actual worktree; scratch index uses correct common dir, original index untouched. | T’s symlink case for physical cwd. D/G optional linked-worktree control with isolated synthetic repo; same prefix semantics. | Symlink behavior test exists; linked-worktree capture not identified in the body. **TEST-COVERED symlink / linked-worktree supplemental GAP; no minimum capture.** |
| F17 Failure boundaries | Nonrepo cwd; induced failure of new separate prefix lookup; subdir `check-ignore` exit >1; combined result whose HEAD cannot be trusted. Control: common-dir error wins for nonrepo, prefix/probe errors propagate, no ref/temporary-index leak; unknown HEAD is rechecked. | T for nonrepo; D with transparent response/error injection for new lookup/filter failures and unknown HEAD branch. Successful full cycle is impossible for injected fatal errors. | Existing nonrepo test checks original operation/exit128. No targeted prefix-failure/unknown-HEAD evidence in body. **TEST-COVERED nonrepo / supplemental GAP for injection branches; no minimum capture.** |
| F18 Existing staging/recovery paths | Root with notes, tracked working edit, committed embedded repo and untracked embedded repo without HEAD; optional blank ignore line. Changed false ignored result now reaches ordinary `-A` and its existing recovery. Sparse/flagged-index modes remain unchanged. | T existing embedded-repo behavior checks notes/tree, skipped unborn nested repo, original index and restore. Use existing sparse/index controls instead of another axis explosion. | Existing recovery and index behavior tests plus reported suite are appropriate controls; no blank-ignore combination transcript. **TEST-COVERED representative; no minimum capture.** |

The two new regression cases are correctly at the lowest production layer: they assert checkpoint contents, not private command spelling. They do not assert restore. The changed command-sequence expectations are compatibility/performance checks, not substitutes for behavioral proof. The script printed in the PR body is expressly a simulation; it is suitable supporting evidence and cannot fulfill D.

Pass coverage: complete diff and affected call graph; resolver/ignore/staging decisions; requested workspace shapes, source types, true-ignore states, unborn/fallback paths; existing test evidence versus PR-body claims; minimal capture plan. No worktree changes, tests, provider turns, servers, captures, or PR writes were performed. Only this scratch directory was written; no second worktree was necessary. No implementation blocker is asserted from this proof-only pass.

FRICTION: none

VERDICT: INSUFFICIENT F01, F02, F04 (missing revision-paired real-driver transcripts; expected base capture rejection is valid evidence for F02/F04)