# PR 22246 real environment verification

2026-10-28, disposable Linux Boat VM. Codex gpt-6.1-sol through T3 Code.

- main: github/main 07f7f97609, separate /home/user/main worktree, vp i.
- original PR: b2fa1fc5766931aa794d1751be4ec05009ba2085, vp i.
- repaired PR: d015e9c1f42b555ab489ba34d6b095a605bf881d.
- Only one background dev server at a time. Main ports 16733/8693; PR ports 13773/5733. Fresh isolated dev state; no database fixtures or seed data.
- Playwright from repo dependencies drove /usr/bin/google-chrome. Added the real alias-verification Git repository through Add project > Local folder. Created the thread and submitted actual Codex GPT-6.1-Sol turns through the composer. Turns completed and ran real git commands, including after a dev-server restart.

## Actual Git configuration

```
$ git remote -v
origin git@github.com-work:pingdotgg/t3code.git (fetch)
origin git@github.com-work:pingdotgg/t3code.git (push)
$ git config --get remote.origin.gh-resolved
base
```

## Main reproduces the failure

On the authenticated web client WebSocket, send the normal Effect RPC envelope for:

```
git.resolvePullRequest {"cwd":"/home/user/alias-verification","reference":"22246"}
=> SourceControlProviderError (github, getChangeRequest)
   No GitHub credential for github.com-work: run `gh auth login --hostname github.com-work`.
```

A number is intentional: a full URL would bypass checkout repository resolution.

## Original PR partially works

```
git.resolvePullRequest same payload
=> number 22246, state open
   title fix(github): read github.com-<name> SSH aliases through github.com
   url https://github.com/pingdotgg/t3code/pull/22246
```

But pullRequests.list on the actual project reports host github.com-work, configured=false, and a project read error. The web PR list says "Could not load pull requests" and requests GitHub authentication. This was reproduced on b2fa1fc before repair.

## Repair and final runtime verification

Added GitHubSourceControlProvider.resolveRemoteWebHost, returning the existing transport-aware gitHubApiHostForRemote result. This lets PullRequestService route SSH aliases through github.com without changing credential policy, repository identity, or transports.

After restarting the background server at d015e9c1f4:

```
git.resolvePullRequest same payload
=> Success: PR 22246, github.com/pingdotgg/t3code

pullRequests.list {
  "state":"open", "projectId":"faa6d2a6-402a-4735-8060-e1faa7c1bd35",
  "query":"22246", "limit":5
}
=> Success
   providers: github.com, github, configured=true, projectCount=1
   entries include #22246 on github.com, pingdotgg/t3code
   errors: []
```

The real UI loaded the project PR list. Typed 22246 into Search pull requests and clicked this PR. Its real description, branches, file counts and workflow approval state rendered. Captured an 8.24-second recording, inspected its frames and checked uploaded playback to completion and seeking in the T3 browser.

## Nearby runtime cases

Each case used a fresh real Git checkout to avoid cached provider contexts. All calls used numeric reference 22246 against the running server.

- git@github.com:pingdotgg/t3code.git: success, PR 22246.
- ssh://git@github.com-work:22/pingdotgg/t3code.git: success, PR 22246.
- Marked alias origin plus different https://github.com/octocat/Hello-World.git upstream: success, PR 22246 from pingdotgg/t3code.
- https://github.com-work/pingdotgg/t3code.git: fails requesting github.com-work credentials, stays off github.com.
- git@github.com-evil.example:pingdotgg/t3code.git: fails requesting its own host credentials, stays off github.com.
- git@github-work:pingdotgg/t3code.git: provider detection rejects it as unknown before the resolver. Restarted main and reproduced the identical unknown-provider error there too, confirming a pre-existing limitation outside this fix.

## Checks

Extended existing provider tests; no new test files.

Before repair, Blacksmith SSH alias checks failed all 3 cases because resolveRemoteWebHost was absent. After repair, the resolver/provider files passed all 51 tests.

Blacksmith vp run check:changed passed format, lint, both knip checks, GraphQL generation, typechecks for 10 affected packages/dependents and both test files (51 tests). The worker initially lacked ancestry; fetched history and used origin/main=071239804e375078dd3fae3b14704b4def57e048, the main commit already merged into this PR. Four paths checked. No checks ran locally.

## Limits

Native desktop/iOS/Android, macOS/Windows, relay/tunnel connections, SSH network authentication/fetch/push and remote write operations were not exercised. GitHub API reads were real and authenticated. Full GitHub CI has not passed on repaired head; metadata checks passed, previous full CI was action_required and the app requires workflow approval. No workflow approved or bot invoked. No merge, close, rebase, force-push or task-driven label changes.