# PASS1 revised final proof audit

Audited checkout: `/home/ubuntu/wt/issue-7568`; exact head `78d05b9e0c0315303ba1985742e284a6d734f762`, base `d53873b6a4`. Read-only source audit: no checkout edits, tests, captures, servers, commits or forge commands. This /tmp artifact and its requested upload are the only writes. No runtime success is asserted.

## Scope and disposition

Complete five-file diff: AddEnvironmentDialog.tsx; onboarding.ts and onboarding.test.ts; resolver.ts and resolver.test.ts. No CSS, layout, new controls, provider adapters, server contract or SSH engine changes.

| Changed producer | Actual downstream footprint | Proof allocation |
|---|---|---|
| prepareSshRegistration saves input.target and derives connectionId from its tuple instead of resolved bootstrap | registration/profile/credential association; route address deduplication; desktop EnvironmentRow subtitle; shared connectionRouteLabel and connectionRouteAddress → web EnvironmentRoutesList and mobile EnvironmentRoutesSection; remoteOpen reads target | R1 persistence/identity; V1/V2 labels. Static audit for existing remoteOpen and unsupported clients; no unrelated app inventory |
| SSH resolver removes prepared-profile write and routing-consent revocation | every SSH reconnect gets original saved target; credential refresh and authorization remain; route key/labels remain stable rather than adopting resolved endpoint | R1 repeated reconnect; focused regression assertions for profile object and consent; existing explicit profiles remain explicit by source |
| suggestion handler parses alias plus current username/port fields instead of resolveSshHost + autofill | click, Combobox selection, shortcut selection share handler; manual submit already uses same parser; both Add environment and Add SSH route share dialog | R2/R3; V1/V2 recordings, keyboard path once |

## Minimum visual matrix — recordings required, status PENDING

Every cell requires clearly labeled Before (real Electron old bundle/base) and After (Electron exact audited head). Four cells per row, eight paired row/cells total; two rows can be chapters of the same recording in each cell. 390 means CSS viewport width in Electron, not a claim of mobile SSH support. Heights can be matched sensible values (e.g. 900/844). No need to replay all network cases in every cell; show representative selection and resulting labels in each cell and link the one decisive runtime transcript.

| Affected row / recorded content | 1440 light | 1440 dark | 390 light | 390 dark |
|---|---|---|---|---|
| V1 Add environment → SSH: typed alias + typed username + empty port → connect → saved single-route environment subtitle → reconnect state. Show alias/typed user retained, inferred port absent from saved-label text after fix. | Before/After recording pending | Before/After recording pending | Before/After recording pending | Before/After recording pending |
| V2 Add SSH route to existing environment: suggestion list → select alias with blank overrides → saved route label/address and active-route subtitle. Include a second fresh selection with typed override fields to show they survive selection. Use long alias in this row. | Before/After recording pending | Before/After recording pending | Before/After recording pending | Before/After recording pending |

Selection minimum across the set: pointer selection in one recording; supported keyboard selection (highlight/Enter or configured numbered shortcut) in another, with path named. Both enter the same changed handler; no need to multiply each input method across four cells. Show the typed fields immediately before selection, so inferred defaults cannot be mistaken for intentional overrides. A static frame alone cannot prove selection behavior; frames may supplement recordings. Multi-route label omits port by existing formatter design; single-route subtitle includes only explicit port. Do not demand layout redesign or screenshots of unrelated screens.

Baseline is reportedly already running as a real Electron old bundle; this audit did not inspect it. Preserve its fixture state and label recording with actual build/base identity. After evidence remains pending. Never use the head bundle for the Before side or silently re-use a previously pinned profile for the fresh After case.

## Exact minimum runtime cases — run once in real Electron, PENDING

| Case | Inputs/actions | Required evidence / pass criterion |
|---|---|---|
| R1 Original typed-alias bug, TWO port changes | Fresh alias audit-devbox; type username fixture-user, leave port empty. Config Port 24568. Register/connect, end fixture-owned connection, change to 24569, reconnect, end connection, change to 24570, reconnect again. Same remote fixture environment/data throughout. | Before reproduces stale port at first change. After succeeds at all three ports. At registration AND after each reconnect, inspect isolated saved target `{alias:audit-devbox,hostname:audit-devbox,username:fixture-user,port:null}`, stable connectionId/credential association and environmentId. Record effective SSH resolution/argv and successful connection milestones at each port. No stale explicit -p24568 on changed-port attempts. Show no duplicate route created solely by reconnect. This proves resolver cannot re-pin after first successful reconnect. |
| R2 Discovered alias, config defaults remain live | Fresh separate client snapshot/route; discovered alias selected with BOTH override fields blank. Initially config User fixture-user, Port 24568. Connect, then change config Port to 24569 (and User to second allowed fixture account if available), reconnect. | Saved target remains alias/alias/null/null before and after; resolved endpoint follows changed config. Capture selection and lack of inferred autofill, effective target/argv, stable identity and successful reconnect. Port change is mandatory; User change can be combined here rather than adding a separate HostName/User runtime campaign. |
| R3 Typed overrides survive discovered selection | Fresh routes, select discovered alias with (a) username only, (b) port only, (c) both typed. Config defaults deliberately differ from typed values; configured endpoints/accounts must accept the intended combinations. Reconnect after changing config defaults. Can reuse R1 as username-only precedence proof if same deliberate differing config user was seeded. | Saved target contains exactly typed fields, null for unspecified fields. Effective SSH username/port honors typed fields while unspecified field follows config. Both explicit fields remain fixed across config change. All three combinations are needed for independent null precedence; don't substitute blank/blank R2 for one. Record failures meaningfully if fixture lacks second account; do not claim username precedence from equal values. |

Do not multiply R1–R3 by four visual cells. Use one sanitized runtime transcript with timestamps/step markers linked to recordings. Show isolated persisted tuples/IDs and effective resolution, not merely a green status indicator. No tokens, pairing codes, private keys or real customer data in public evidence.

## Seed recipe for capturer (specification; not executed)

1. Use independent temporary T3 home/client userData snapshots for base and head, never live userdata. Use controlled SSH config/account(s) and a disposable remote fixture environment with stable environmentId. Reuse its remote data across port changes; ensure port changes actually retire the previous listener so stale-port success is impossible. Change only fixture-owned resources.
2. Seed `Host audit-devbox`, `HostName 127.0.0.1` (or controlled reachable fixture endpoint), `User fixture-user`, `Port 24568`, fixture-only key. Add a long alias `audit-development-box-with-a-long-alias-7568` with equivalent settings for V2. Provision second permitted account for deliberately different config/typed username cases when feasible. Keep credentials out of uploads.
3. Start V1 fresh, type alias and explicit username, empty port. For V2 seed one existing environment with another route to the SAME environment, then add the long-alias SSH route through the Add route dialog. Keep labels and route count matched between base/head snapshots. Do not seed the head's new alias route as an old resolved profile.
4. Inspect profile store immediately after registration and after reconnects; note input tuple, connectionId, credential lookup success and environmentId. Bootstrap may be resolved; it must not replace saved intent. Retain route grant if seeded, but no separate PR feature session is necessary.
5. Capture V1/V2 in four viewport/theme cells; perform R1/R2/R3 once at any convenient cell. Retain successful connection and SSH resolution evidence separately from visual readability proof.

## Focused existing tests/static audit — no extra end-to-end matrix

Tests below were inspected, NOT run in this audit; require lead's actual focused result before calling them green.

| Concern | Available proof / limitation | Runtime expansion? |
|---|---|---|
| Initial saved intent | New onboarding test makes bootstrap resolved but expects profile.target equal input with explicit username/null port. Source computes connectionId with sshTargetKey(input.target). Test does not directly assert divergent-input connectionId or real store persistence. | R1 inspects ID and persisted target; no extra UI case |
| Repeated prepare + consent | New resolver test calls prepare twice with differing resolved ports; expects both inputs equal enteredTarget, same saved profile object, retained read-write grant. It replaces obsolete resolver rewrite/revoke tests. | R1 covers actual transport. Test supplies mocked prepare, not real SSH proof |
| Saved bearer reuse/refresh | Existing resolver test “offers the saved SSH token on each connect and saves the one it gets back”; authorization and expectedEnvironmentId arguments remain unchanged. | Static + focused tests, no separate token lifecycle recording |
| Old explicit profiles | Resolver passes profile.target unchanged, no migration; registration changes only new registrations. Explicit old user/port remain pinned. | Static sufficient; don't promise old profiles are repaired |
| Environment mismatch/compatibility | Existing onboarding tests reject different machine and incompatible server; resolver retains environment/profile identity checks and expectedEnvironmentId in prepare/authorize. These tests do not alone prove every SSH engine guard. | Unchanged guard source audit + relevant existing focused tests, no extra controlled hostile environment |
| Remote state key and cleanup | packages/ssh/src/command.ts remoteStateKey and tunnel.ts unchanged; command.test.ts stable-state-key case and tunnel.test.ts shutdown-before-replacement cases exist. Key still depends on resolved tuple; do NOT claim it stays identical across port changes. | R1 uses genuine disconnect/reconnect; no separate active-tunnel config mutation/orphan stress campaign required by this diff |
| Discovery/parser boundary | packages/ssh config tests cover discovery/Includes; web desktopSshHosts tests cover host state. Changed handler uses existing parser, preserving field precedence by source. ConnectionsSettings.logic.test.ts does NOT test parseManualDesktopSshTarget; do not cite it as override coverage. | R2/R3 are necessary; no handler behavior test was added in five-file diff |
| Route dedup/labels | routes.ts uses input tuple for SSH address identity; label uses saved user/hostname; address uses alias. Existing routes tests principally cover other route kinds, not complete new SSH label tuple matrix. | V1/V2 + R1 identity, no whole route management inventory |
| Ordinary web/mobile | web gateway without desktopBridge and mobile gateway reject provision/prepare as unsupported. Mobile shared route-label consumers exist, but no new supported SSH execution path. | Static audit sufficient; no separate web/mobile SSH provisioning captures |
| Providers/MCP/scheduler/tunnel modes | No provider, transport, contract, service API or scheduler diff. Existing SSH gateway remains desktop-owned. | No provider or remote-mode feature inventory |

## Earlier objections: resolved vs retained (FRICTION)

- RESOLVED in source: first reconnect overwrites alias intent with resolved port/user. Resolver no longer constructs or persists preparedProfile.
- RESOLVED in source: discovered selection supplies resolved defaults as intentional overrides. Handler now parses selected alias plus current typed fields and does not resolve/autofill them.
- RESOLVED in focused test design: registration-only proof omitted repeated prepare and consent. New resolver regression explicitly exercises two prepares and saved intent/consent. Actual test execution is not supplied by this audit.
- RETAINED: source correctness and mocked regressions are insufficient to declare the reported Electron bug fixed. R1 two successive changed-port reconnects and R2 discovery reconnect remain required, After pending.
- RETAINED: zero JSX/style diff is insufficient for zero visual coverage; persisted target changes existing label data. V1/V2 four cells remain required recordings, not a full application screen inventory.
- RETAINED: new onboarding assertion omits direct connectionId assertion; new handler lacks focused selection test. R1 persisted-ID inspection and R2/R3 real interactions close proof gaps without asking for unrelated tests.
- RETAINED with narrowed scope: earlier old-profile/identity/guard/disconnect objections are addressed by unchanged source and focused existing coverage plus R1 reconnect observations; no demand for separate R5–R11 full-system runs. No evidence here establishes active-tunnel mutation cleanup beyond existing implementation/tests.
- FRICTION: this pass intentionally cannot certify captures, runtime transcripts, test execution or baseline provenance. Before is reported running, After pending. Final proof acceptance remains conditional on that evidence, not a source-audit failure.