{"version":"2.1.236","anchor":"blocked-artifact-reads-retry-through-the-session-gateway","canonical_anchor":"blocked-artifact-reads-retry-through-the-session-gateway","heading":"Blocked artifact reads retry through the session gateway","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236\/e\/blocked-artifact-reads-retry-through-the-session-gateway","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236","markdown":"### Blocked artifact reads retry through the session gateway\n\nArtifact reads blocked by your network allowlist now retry through the session gateway instead of failing.\n\n**What**\n\nReading a published artifact used to fail outright when the environment's network allowlist blocked the artifact content host. Token-bearing (non-public) reads are now retried through the session gateway before giving up. The retry needs gate `tengu_cobalt_plinth_sorrel`, whose built-in fallback is true, so it is active absent server config.\n\n**Details**\n\n- Public, tokenless artifacts are explicitly not relayed.\n- Relay attempts and refusals are recorded, along with a per-host decline window so a failing relay is not hammered.\n- When the relay cannot serve the read either, the failure says so rather than repeating the egress-blocked message.\n\n**Evidence**\n\n`artifact reads through the session gateway are not enabled for this session, or the artifact service no longer serves this version`, `asset_egress_relayed`\n\n- Flag `tengu_cobalt_plinth_sorrel`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.236; this account: on, anonymous baseline: on, compiled default: on)\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}