demosdk web2/DAHR: startProxy silently anchors an attestation of a 401 when the credential is passed via options.headers.Authorization instead of options.authorization

[norgejbb-byte]

Observed. In demos.web2.createDahr().startProxy({ url, method, options }) (demosdk 4.0.16), the origin credential must be passed as options.authorization = <RAW token> — the node prepends Bearer itself. Two natural alternatives fail, and fail silently:

• options.headers.Authorization = "Bearer " + token — accepted by the type, but the header value never reaches the origin; the origin sees the credential as literal undefined.
• options.authorization = "Bearer " + token — the node prepends Bearer again, so the origin sees a double-prefixed credential.

The finding is the silence. In every one of these cases DAHR still returns a valid responseHash and still anchors a txHash. A caller that does not assert on the origin HTTP status will anchor a cryptographically valid attestation of a 401 error body — evidence that looks correct and verifies, but attests an auth failure.

Four-variant matrix (origin status):

credential channel	origin
options.authorization = raw token	200 (correct)
options.authorization = "Bearer " + token	401 (double-prefixed)
options.headers.Authorization = "Bearer " + token	401 (value dropped)
both (headers + authorization = raw)	200

The two 401s are distinguishable by the origin's error: one reports the credential value as literal undefined (the header value never arrived), the other reports it double-prefixed (Bearer prepended twice). (Provider name and account details omitted.)

Expected. Either options.headers.Authorization reaches the origin, or the SDK rejects it with a clear error; and the raw-token channel is documented.

Evidence. Verified by execution in an earlier auth-matrix control run (not persisted to my later run artifacts): the matrix above, run against a real HTTPS origin through DAHR on Demos testnet.

Suggested repair. Make options.headers.Authorization reach the origin, or reject it explicitly; document options.authorization as the raw-token credential channel. Separately, any DACS settlement handler building evidence from a DAHR fetch should assert the origin status before anchoring — noted here because the silent success is what makes the trap dangerous.

Filed here per the demosdk-issues-go-to-this-repo convention (cf. #968). Found while building a pay-ap2 rail on Demos testnet.