Live test 2026-08-14: a granted gmail.users.messages.send was answered by the proxy with 401 {"error":"escalation_required","operationId":"gmail.users.messages.send","sensitivity":"irreversible"} — correct per the sensitivity ladder (send/delete/merge always step up even with a standing grant). The 401 carries an AAuth-Requirement header with the full per-call proposal (built by aauth-proxy buildEscalationChallenge: operation, path, query, body digest as hash+excerpt).
@aauth/fetch prints the error body and exits — it does not follow the per-call leg (present the proposal to the PS, await the person's approval of THIS call, retry with the per-call credential). The proxy side is fully covered by its component suite (proposal → approval → retry, parameter enforcement, non-replay); the wallet side verifies per-call fields. The CLI is the only party that does not speak it.
Related: dickhardt/AAuth#92 (202 deferred pattern for per-call).
🤖 Generated with Claude Code
https://claude.ai/code/session_01TQ2FCHHAnuJWF5TJB3838S
Live test 2026-08-14: a granted
gmail.users.messages.sendwas answered by the proxy with 401{"error":"escalation_required","operationId":"gmail.users.messages.send","sensitivity":"irreversible"}— correct per the sensitivity ladder (send/delete/merge always step up even with a standing grant). The 401 carries anAAuth-Requirementheader with the full per-call proposal (built by aauth-proxybuildEscalationChallenge: operation, path, query, body digest as hash+excerpt).@aauth/fetchprints the error body and exits — it does not follow the per-call leg (present the proposal to the PS, await the person's approval of THIS call, retry with the per-call credential). The proxy side is fully covered by its component suite (proposal → approval → retry, parameter enforcement, non-replay); the wallet side verifies per-call fields. The CLI is the only party that does not speak it.Related: dickhardt/AAuth#92 (202 deferred pattern for per-call).
🤖 Generated with Claude Code
https://claude.ai/code/session_01TQ2FCHHAnuJWF5TJB3838S