Skip to content

docs(spike): source of the batchexecute at token (#1221) - #1231

Merged
ffroliva merged 3 commits into
developfrom
docs/1221-at-token-source
Nov 10, 2026
Merged

ffroliva merged 3 commits into
developfrom
docs/1221-at-token-source

Conversation

@ffroliva

Copy link
Copy Markdown
Owner

Closes #1221
Part of #1229

Assessment (read-only, before the spike): a spike question, not a bug report. No CLI or MCP surface changes. It is verifiable end to end here: $0, a headed browser on denon82, reads only.

Verdict (against the reading pre-registered in the script docstring)

  • Found, and reachable without a browser. The page's at is the SNlM0e in the document it loads, one value per load. All 29 calls match: 28 the preceding document's, 1 the page loaded at client entry. No cookie, other response or runtime-only key is the source.
  • A cookie-only httpx GET gets a working value from the same shell. nzlxg answers 200, and a browser-minted at also works from httpx. Controls: junk at 400, empty at 400, no cookies 401.
  • The docs: Flow batchexecute RPC id table, checked against the served JavaScript #1219 07:30 "SNlM0e absent" shell was the signed-out shell. It measured 39,716 inline bytes, within today's anonymous range (39,752–39,798) and not the signed-in range (42,503–42,813; WIZ keys 52 vs 47). The token did not move; the cookie jar was not accepted at that moment. A direct reader should treat "no SNlM0e" as "session not accepted" and fall back to the browser.

Not measured

docs/FLOW_WIRE_RPCS.md is not on develop yet (PR #1219), so there is no row update here. The doc gives the row text to add once #1219 lands.

Also carries 9f356c9d (cherry-picked from the open PR #1215, a test-only CI tz fix) so CI can go green.

Gates (local)

  • The four doc gates, check_council_memory, generate_plugin_skills --check, ruff check / ruff format --check src tests, and pyright src (0 errors): all green.
  • pytest -n 8 --dist worksteal: 6063 passed, 1 failed. The failure is test_built_distributions_contain_sql_migrations, the known load flake; it passes when run alone.
  • After the last edit: the doc gates, ruff on the script, and tests/scripts (404 passed) were re-run.

The page sends the SNlM0e of the document it loaded (28/29 calls, one value
per load); a cookie-only httpx GET gets a working value from the same shell
(nzlxg 200; junk/empty at 400, no cookies 401). The SNlM0e-absent shell seen
by #1219 did not reproduce in two runs, so its source stays unmeasured; the
WIZ key set (52 signed-in vs 47 anonymous) is recorded as the discriminator.

Part of #1229.
…ne database

Ubuntu 24.04's tzdata 2026e moves backward links (Atlantic/Faeroe, Portugal,
Eire, Iceland, Poland) into tzdata-legacy, which the CI runners do not install.
ZoneInfo then refuses the alias, consent_region() fails closed, and the
Atlantic/Faeroe row (expected False) went red on every PR, develop included;
the three legacy rows expecting True passed for the wrong reason.

The mapping test now stubs the zone lookup, so every row checks the
name-to-region mapping on any machine. A separate test pins the fail-closed
behaviour for an alias the installed zone database cannot load.

(cherry picked from commit 9f356c9)
Run 3 adds an entry-time WIZ snapshot (explains the 1/29 call: the page loaded
during client entry), the body/query split, and inline_bytes. #1219's 07:30
cookie-arm shell (39,716 B) sits in today's anonymous range (39,752-39,798 B),
not the signed-in one (42,503-42,813 B): the jar was not accepted, the token
did not move.
@coderabbitai

coderabbitai Bot commented Nov 10, 2026

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 21 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: a151872e-7ca7-4557-8aa4-68912508c9f5
Commits

Reviewing files that changed from the base of the PR and between ca069fc and 60a89e6.

Files selected for processing: 3

  • docs/superpowers/spikes/2026-11-10-at-token-source.md
  • scripts/dev/spike_at_token_source.py
  • tests/test_telemetry_notice.py
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Spike: where does the page get its at token when SNlM0e is missing from the HTML?

1 participant