Reading a published artifact used to fail outright when the environment's network allowlist blocked the artifact content host. Token-bearing (non-public) reads are now retried through the session gateway before giving up. The retry needs gate tengu_cobalt_plinth_sorrel, whose built-in fallback is true, so it is active absent server config.
- Public, tokenless artifacts are explicitly not relayed.
- Relay attempts and refusals are recorded, along with a per-host decline window so a failing relay is not hammered.
- When the relay cannot serve the read either, the failure says so rather than repeating the egress-blocked message.
artifact reads through the session gateway are not enabled for this session, or the artifact service no longer serves this version, asset_egress_relayed
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
tengu_cobalt_plinth_sorrel On for this account, and not off by defaultThe flag server returned on for the one account this site reads, and nothing in this release compiles it off by default. The compiled default is shown below, and says which it is when we cannot read one: a fifth of gates compile in a string or a number rather than on or off, and most published releases have no gate table behind them at all. No client can see what the server returns for your account.
This account: on · anonymous baseline: on · compiled default in v2.1.236: on
Read once, for one account on one subscription tier, against v2.1.236. It isn't a statement about your account. What a flag value here can and cannot tell you
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.