Authenticate eval_claims_pipeline + add request timeout#31
Open
DarrenZal wants to merge 1 commit into
Open
Conversation
The harness predates the claims auth overhaul: it sent no Authorization header, so every write step (create/attest/verify/anchor) now 401s. Also had no socket timeout, so a slow/hung single-worker backend could make it hold connections open indefinitely (a contributor to pool starvation). - add `Authorization: Bearer $KOI_CLAIMS_SERVICE_TOKEN` to _req() (matches the service-token auth on /claims write endpoints) - explicit urlopen timeout=50s (just under asyncpg command_timeout=60) - fail fast in main() with a clear message if the token is unset (no silent 401s) Pure additive; no behavior change when token is set + backend healthy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
scripts/eval_claims_pipeline.pypredates the claims auth overhaul. It sends noAuthorizationheader, so every write step (create / attest / verify / anchor) now returns 401 against the live service — the harness is currently unusable. It also had no socket timeout, so a slow/hung single-worker backend could make it hold connections open indefinitely (a contributor to asyncpg pool starvation).What
_req()addsAuthorization: Bearer $KOI_CLAIMS_SERVICE_TOKEN(matchesmake_service_token_authon the/claimswrite endpoints)urlopen(..., timeout=50)— just under asyncpgcommand_timeout=60, so the asyncpg timeout is the wall and the socket timeout is a clean fallbackmain()with a clear message if the token is unset (no silent mid-pipeline 401s)Pure additive; no behavior change when the token is set and the backend is healthy.
py_compileclean.Note
Running the harness still hits the live single-worker service — run serialized,
--runs 1, ideally--skip-anchorfor off-chain checks, and not during peak / near a restart.🤖 Generated with Claude Code