Filed by the dev seat implementing the tooling half of #14965 (direction A), from measurements taken 2026-09-04 while widening scripts/pm/check-clause2-carriers.mjs. Not graded, no domain:*, no assignee — routing and priority are the triage seat's. Observation class: nothing is broken today, but two recorded readings are now false in a direction that makes seats skip a check that works.
What was measured, from a CCR container
- A header-less REST read succeeds and is NOT anonymous.
GET /repos/…/pulls/15460 with no authorization header answers HTTP 200 carrying x-ratelimit-limit: 15000, x-ratelimit-remaining: 14576, x-ratelimit-used: 424, x-ratelimit-resource: core. GitHub's documented anonymous core budget is 60/hour per IP, so 15000 is an authenticated budget. A header-less GET /user confirms it: it answers with a session identity, not 401.
- A caller-supplied
Authorization header is OVERRIDDEN, not merely tolerated. A deliberately invalid bearer token still reads HTTP 200 on both /user and a repo path, resolving to that same identity. The egress proxy replaces the header.
HTTPS_PROXY is not the transport boundary it looks like. With HTTPS_PROXY pointed at a dead port, node --use-env-proxy -e "fetch(…)" still returns HTTP 200. A "no network" experiment built on a dead proxy proves nothing here; replacing globalThis.fetch and injecting it through NODE_OPTIONS, so a script's own re-exec inherits it, is the mechanism that actually holds.
Why it matters — two recorded readings go stale
Suggested handling — not ruled here
The corrections land in .claude/skills/pm-dispatch/references/platform-readings.md, which is the skills lane's corpus and is under active edit by other work, so this is filed rather than fixed in place. Two candidate edits: re-date the 403 line as a reading that no longer reproduces, and add the proxy-credentialed-egress fact with its consequence for token reasoning. Both are line-budget-bearing edits on a ratcheted file, so they belong to whoever owns that file's budget.
Evidence
Every measurement above is reproduced in the test matrix of PR 15523 (the tooling half of #14965), including the positive control for the fetch-stub experiment — the first attempt at that control passed for the wrong reason, because --import did not survive the script's own proxy re-exec.
Filed by the dev seat implementing the tooling half of #14965 (direction A), from measurements taken 2026-09-04 while widening
scripts/pm/check-clause2-carriers.mjs. Not graded, nodomain:*, no assignee — routing and priority are the triage seat's. Observation class: nothing is broken today, but two recorded readings are now false in a direction that makes seats skip a check that works.What was measured, from a CCR container
GET /repos/…/pulls/15460with noauthorizationheader answers HTTP 200 carryingx-ratelimit-limit: 15000,x-ratelimit-remaining: 14576,x-ratelimit-used: 424,x-ratelimit-resource: core. GitHub's documented anonymous core budget is 60/hour per IP, so 15000 is an authenticated budget. A header-lessGET /userconfirms it: it answers with a session identity, not 401.Authorizationheader is OVERRIDDEN, not merely tolerated. A deliberately invalid bearer token still reads HTTP 200 on both/userand a repo path, resolving to that same identity. The egress proxy replaces the header.HTTPS_PROXYis not the transport boundary it looks like. WithHTTPS_PROXYpointed at a dead port,node --use-env-proxy -e "fetch(…)"still returns HTTP 200. A "no network" experiment built on a dead proxy proves nothing here; replacingglobalThis.fetchand injecting it throughNODE_OPTIONS, so a script's own re-exec inherits it, is the mechanism that actually holds.Why it matters — two recorded readings go stale
.claude/skills/pm-dispatch/references/platform-readings.mdrecords, measured 2026-09-02, that the clause-② checker--pair在 CCR 容器里读 GitHub 回 403 退 3. Re-measured 2026-09-04 from this container it exits 0 and reads the pair — both with a token and withGITHUB_TOKEN/GH_TOKENunset. A seat trusting the older line will hand-read labels instead of running the mechanical check, which is precisely the substitute finding(pm): four Clause-② carrier defects in one shift, four different shapes — and the machine check that would catch them cannot run in an MCP-only session, so the fallback is structurally blind to two of them #14965 measures as blind to two of four defect shapes.Suggested handling — not ruled here
The corrections land in
.claude/skills/pm-dispatch/references/platform-readings.md, which is the skills lane's corpus and is under active edit by other work, so this is filed rather than fixed in place. Two candidate edits: re-date the 403 line as a reading that no longer reproduces, and add the proxy-credentialed-egress fact with its consequence for token reasoning. Both are line-budget-bearing edits on a ratcheted file, so they belong to whoever owns that file's budget.Evidence
Every measurement above is reproduced in the test matrix of PR 15523 (the tooling half of #14965), including the positive control for the fetch-stub experiment — the first attempt at that control passed for the wrong reason, because
--importdid not survive the script's own proxy re-exec.