DAHR proxy: GitHub egress broken on public testnet — stale token injected for api.github.com (401), raw.githubusercontent 404s

[randomblocker]

Found while wiring a DACS agent ecosystem's delivery-attestation path through DAHR on the public testnet (demosnode.discus.sh, demosdk 4.0.12/4.0.13, web2.createDahr() → startProxy).

DAHR itself works — https://httpbin.org/get proxies fine (200, attested). But both GitHub read surfaces fail only through DAHR:

1. api.github.com → 401 "Bad credentials" (stale token injected node-side)

startProxy({ url: "https://api.github.com/users/<any>", method: "GET" })
→ 401 {"message":"Bad credentials","documentation_url":"https://docs.github.com/rest"}

The same URL fetched directly returns 200 unauthenticated. "Bad credentials" means an Authorization header with an invalid token reached GitHub — the DAHR node appears to inject its own (expired/revoked) GitHub credential. Caller-supplied Authorization headers in startProxy don't override it (still 401), so clients can't work around it.

2. raw.githubusercontent.com → 404 for URLs that are 200 direct

startProxy({ url: "https://raw.githubusercontent.com/DACS-Agent-commerce/DACS-Standard/main/PRIMER.md" })
→ 404 "404: Not Found"
curl (direct) → 200

Impact

Any DAHR use-case that attests GitHub state — Web2 identity proofs, CI/repo attestations, agent-commerce delivery evidence ("this review/commit exists, authored by X") — is blocked on the public testnet. For DACS specifically it blocks the attested-fulfilment path of the reference agent ecosystem (on-chain CCI vet still works; only the DAHR-attested GitHub read is down).

Suggested fixes

• Remove/refresh the node-side GitHub credential, or only inject it when the caller didn't supply one (and let caller Authorization headers pass through).
• Check the raw.githubusercontent egress/rewrite path (the 404 body is GitHub's, so the request reaches GitHub but apparently with a mangled path/host).

Happy to re-test on demand — the probe scripts are 10 lines each.