github/main 7c22e24e3f; PR head 7876bd4b4d9a8efff3798acaefd84369af4e00a3
installed with vp i; one background dev server at a time; isolated state
HTTP driver: node /tmp/dpop.mjs <origin> <label> <private-pairing-file>
real /oauth/token exchange, ES256 proofs, access-token hashes, fresh jti per request
HTTP auth/session intentionally returns status 200 even when authenticated:false

main token exchange 200 DPoP
main DPoP session 200 {"authenticated":true,"sessionMethod":"dpop-access-token"}
main DPoP invalid 401 challenge DPoP
main dpop session 200 {"authenticated":false}
main dpop invalid 401 challenge null
main dPoP session 200 {"authenticated":false}
main dPoP invalid 401 challenge null
main replay 0 200 {"authenticated":true,"sessionMethod":"dpop-access-token"}
main replay 1 200 {"authenticated":false}
main missing proof 200 {"authenticated":false}

pr token exchange 200 DPoP
pr DPoP session 200 {"authenticated":true,"sessionMethod":"dpop-access-token"}
pr DPoP invalid 401 challenge DPoP
pr dpop session 200 {"authenticated":true,"sessionMethod":"dpop-access-token"}
pr dpop invalid 401 challenge DPoP
pr dPoP session 200 {"authenticated":true,"sessionMethod":"dpop-access-token"}
pr dPoP invalid 401 challenge DPoP
pr replay 0 200 {"authenticated":true,"sessionMethod":"dpop-access-token"}
pr replay 1 200 {"authenticated":false}
pr missing proof 200 {"authenticated":false}
pr DPoP RPC ticket 200
pr DPoP WS connected
pr dpop RPC ticket 200
pr dpop WS connected
pr dPoP RPC ticket 200
pr dPoP WS connected

web: Playwright 1.60.0 + /usr/bin/google-chrome. Added real /home/user/main git checkout through Add project > Local folder. Codex gpt-6.1-sol returned DPOP_CLIENT_OK and DPOP_FOLLOWUP_OK in two real turns. Follow-up recovered from proxy retries in 29s. Both messages survived reload.