Record browser login dev validation and remaining checks by hulk-linus[bot] · Pull Request #707 · nansen-ai/nansen-cli

hulk-linus · 2026-09-24T08:54:09Z

The docs now record the September 25 dev refresh/revocation pass, the earlier automatic-renewal evidence and the zero-credit waiver. Both original and refreshed access tokens were rejected after retirement while an independent session stayed usable beyond the cache window. Only documentation changed.

Merged as cbac6e21aaf5fb69b1ca1346470f20c61423b603 by hulk-linus[bot], after Codier approval of 5a8f8bd61ad8c485ece31e2209bed11ed894a49a. Local checks: 4,275 tests passed, nine skipped, lint passed. PR CI passed Node20/22/24, lint, CodeQL, Aikido and pr-reviewer; publish/ClawHub skipped.

Independent Factory Droid / Anthropic Sonnet 5 review approved these docs and the narrow direct-refresh/revocation result. It did not approve full dev completion. Remaining checks include the current-deployment normal renewal/persisted Keychain/logout sequence, concurrent renewal, MCP-image qualification and database-restart/retention-age behavior. These gaps are recorded on API-503. Production, publication and broader platform acceptance remain held.

AI execution metadata

Writer/coordinator: OpenAI Codex, GPT-6 family. Exact runtime variant, reasoning override and token totals are not exposed here. Scope: documentation and validation orchestration, shared with API-503.
Independent reviewer: Factory Droid; underlying provider Anthropic; exact model claude-sonnet-5, high reasoning. Runtime model verified for session 01b124b7-30c4-40a5-a0a5-e1dfd0b82f4d. Separate checkout, read-only review; Codier posts the review.
September 25 runtime usage below is reported separately for each invocation. No total is inferred because thinking/output overlap and cache counter accounting are not established.
reviewer.jsonl: 15 input, 573741 cache-read input, 125729 cache-creation input, 25557 output, 7149 thinking tokens.
clarification.jsonl: 24 input, 1149884 cache-read input, 268933 cache-creation input, 46667 output, 13751 thinking tokens.
Earlier Opus 5 review applied to fd1432c and remains historical. Its telemetry and review are retained in the prior PR body and linked review history; it is not the reviewer for this update.

nansen-pr-reviewer · 2026-09-24T08:54:40Z

pr-reviewer Summary for #5a8f8bd

📝 1 finding

Review completed. Please address the findings below.

Findings by Severity

Severity	Count
🟡 Medium	1

Review effort: 1/5 (Trivial)

Summary

This is a documentation-only PR that updates docs/browser-login.md, adds docs/releases/api503-dev-validation-20260925.md, and extends docs/releases/api508-evidence.json with September 24–25 validation evidence. No runtime code, release gates, or production settings are touched. The documentation is carefully scoped, consistently flags what was not tested, and correctly carries forward its "NOT_READY" / publication-hold status.

Findings

`docs/releases/api508-evidence.json` — medium

SHA-256 digest format inconsistency

The September 23 historical record (historicalUnpublishedCandidate20260923) stores its digest as a 63-character hex string:

"sha256": "[REDACTED_HIGH_ENTROPY]"

The new September 24 archive entry (currentUnpublishedCandidate) records its digest as a 64-character hex string:

"sha256": "[REDACTED_HIGH_ENTROPY]"

A SHA-256 digest is always 64 hex characters (256 bits). The historical entry is almost certainly a transcription error — a leading zero was dropped, giving 769… instead of the correct 0769…. However the new entry is used repeatedly across several fields in the same JSON (currentDevValidation20260924, currentDevValidation20260925), so if the new value is correct the inconsistency is purely in the old record; if both leading digits were dropped the new entry is also wrong.

Recommended fix: Verify both digests against the original tarballs (sha256sum nansen-cli-1.46.0.tgz for each) and correct whichever entry is wrong. A stale or truncated digest in a security/evidence document undermines its value as a verification anchor.

Token usage: 94 input, 1,457 output, 89,250 cache read, 34,121 cache write | Usage Guide

New pushes are reviewed automatically with a 10-minute cooldown between reviews. To request a review at any time, comment @nansen-pr-reviewer re-review.

nansen-pr-reviewer

Auto-approved

This PR was automatically approved because:

It contains only documentation changes

If you have any concerns, please request a manual review.

nansen-pr-reviewer

Auto-approved

This PR was automatically approved because:

It contains only documentation changes

If you have any concerns, please request a manual review.

Codier

Approved for the documentation change at fd1432cee9d3a9067db302cf6ae51393ef7bad32.

Independent reviewer: Factory Droid, Anthropic claude-opus-5, high reasoning, session cd5b922c-4d00-44df-8506-ab9c26c3ed10. The final review confirms that the unsupported Keychain claim and stale merge instruction are fixed, historical results are separated from the current artifact, and no documentation blockers remain.

CI is green on Node 20, 22 and 24. This approval does not certify complete dev validation or authorize publication. The current-deployment refresh/revocation measurement remains open; the recorded native and isolated outage checks retain their stated limits. Keep CLI publication and production promotion on hold.

aikido-pr-checks · 2026-09-24T09:10:56Z

  "source": {
-    "api508Head": null,
-    "api508HeadNote": "Fill from reviewed PR head; this document cannot hash its own containing commit.",
+    "api508Head": "a5f452935dafc91775ed7e0c4b81473c93ea7846",


Exposed secret in docs/releases/api508-evidence.json - low severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More Info}

aikido-pr-checks · 2026-09-24T09:10:57Z

+    "api": {
+      "event": "result",
+      "success": true,
+      "api_commit": "3e4d972bd0f735ef052c282379a93b3f2e7dfaa5",


Exposed secret in docs/releases/api508-evidence.json - low severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More Info}

aikido-pr-checks · 2026-09-24T09:10:58Z

+      ]
+    },
+    "environment": "Disposable PostgreSQL 16 and Redis 7 in an isolated dev test pod; synthetic issuer and workload-token provider. Shared dev service databases were not changed.",
+    "authserviceSource": "cfc1403e81bc2104cc7aaf0389a463f374f81c46",


Exposed secret in docs/releases/api508-evidence.json - low severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More Info}

nansen-pr-reviewer

Auto-approved

This PR was automatically approved because:

It contains only documentation changes

If you have any concerns, please request a manual review.

nansen-pr-reviewer

Auto-approved

This PR was automatically approved because:

It contains only documentation changes

If you have any concerns, please request a manual review.

Codier

Approved for the documentation-only merge at 5a8f8bd61ad8c485ece31e2209bed11ed894a49a after independent Factory Droid / Anthropic claude-sonnet-5, high-reasoning review in a separate checkout.

The reviewer checked the new result against the retained evidence and verified its hash. The docs accurately record 200/200/200 before retirement and repeated 401/401/200 afterward, with tokens still unexpired, including the later cache-window check and cleanup. They preserve the direct-refresh scope, older automatic-renewal evidence, zero-credit waiver and operational/platform limits. No actionable documentation changes requested.

Current-head CI passed Node20/22/24, lint, CodeQL, Aikido and pr-reviewer. Publication and ClawHub jobs were skipped. Local checks: 4,275 tests passed, nine skipped; lint passed.

This approval covers the evidence documents. The combined dev-acceptance classification is undergoing a bounded follow-up, so this is not full API-503/508 completion or production/publication sign-off. Those holds remain unchanged.

Codier

Final combined-evidence assessment for 5a8f8bd: documentation approval stands. The independent Factory/Anthropic Sonnet 5 review accepts the direct-refresh/revocation and isolation result, including copied Bearer-token rejection, but does not sign off full dev validation.

Remaining checks: current-deployment normal renewal with persisted/re-read rotated credentials and actual logout, concurrent renewal, actual MCP runtime qualification, and database-restart/retention-age behavior. Earlier source-equivalent renewal evidence and isolated outage results remain valid within their recorded scope. The zero-credit live check is waived, not passed.

API-503 has the detailed next-check plan. Production and publication remain held. No additional documentation defect was found; these gaps are not a request to revert this documentation merge.

docs: record browser login dev validation and remaining checks

3cda720

nansen-pr-reviewer Bot previously approved these changes Sep 24, 2026

View reviewed changes

docs: clarify historical renewal coverage and publication hold

fd1432c

hulk-linus Bot dismissed nansen-pr-reviewer[bot]’s stale review via fd1432c September 24, 2026 09:00

nansen-pr-reviewer Bot approved these changes Sep 24, 2026

View reviewed changes

hulk-linus Bot marked this pull request as ready for review September 24, 2026 09:10

Codier previously approved these changes Sep 24, 2026

View reviewed changes

aikido-pr-checks Bot reviewed Sep 24, 2026

View reviewed changes

nansen-pr-reviewer Bot previously approved these changes Sep 24, 2026

View reviewed changes

docs: record dev session revocation validation

5a8f8bd

hulk-linus Bot dismissed stale reviews from nansen-pr-reviewer[bot] and Codier via 5a8f8bd September 25, 2026 01:33

nansen-pr-reviewer Bot approved these changes Sep 25, 2026

View reviewed changes

Codier approved these changes Sep 25, 2026

View reviewed changes

hulk-linus Bot merged commit cbac6e2 into main Sep 25, 2026
13 checks passed

hulk-linus Bot deleted the hulk/api-508-dev-validation-evidence branch September 25, 2026 01:41

Codier reviewed Sep 25, 2026

View reviewed changes

Navigation Menu

Repository navigation

Record browser login dev validation and remaining checks - #707

Record browser login dev validation and remaining checks#707
hulk-linus[bot] merged 3 commits into
mainfrom
hulk/api-508-dev-validation-evidence

hulk-linus Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

nansen-pr-reviewer Bot commented Sep 24, 2026 •

edited

Loading

`docs/releases/api508-evidence.json` — medium

Uh oh!

nansen-pr-reviewer Bot left a comment

Uh oh!

nansen-pr-reviewer Bot left a comment

Uh oh!

Codier left a comment

Uh oh!

aikido-pr-checks Bot Sep 24, 2026

Uh oh!

aikido-pr-checks Bot Sep 24, 2026

Uh oh!

aikido-pr-checks Bot Sep 24, 2026

Uh oh!

nansen-pr-reviewer Bot left a comment

Uh oh!

nansen-pr-reviewer Bot left a comment

Uh oh!

Codier left a comment

Uh oh!

Uh oh!

Codier left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hulk-linus Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI execution metadata

Uh oh!

nansen-pr-reviewer Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

pr-reviewer Summary for #5a8f8bd

Findings by Severity

Summary

docs/releases/api508-evidence.json — medium

Uh oh!

nansen-pr-reviewer Bot left a comment

Choose a reason for hiding this comment

Uh oh!

nansen-pr-reviewer Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Codier left a comment

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Sep 24, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Sep 24, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Sep 24, 2026

Choose a reason for hiding this comment

Uh oh!

nansen-pr-reviewer Bot left a comment

Choose a reason for hiding this comment

Uh oh!

nansen-pr-reviewer Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Codier left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Codier left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

hulk-linus Bot commented Sep 24, 2026 •

edited

Loading

nansen-pr-reviewer Bot commented Sep 24, 2026 •

edited

Loading

`docs/releases/api508-evidence.json` — medium