[Slokh]

Follow-up to #55 for pnpm earn access remove's discovery of policy-sharing neighbours.

• A record that names another genesis of the selected chain no longer excludes a neighbour on its own. The neighbour is skipped only when its recorded EarnShare has no code on the selected chain, read through the live client. Otherwise, or when liveness can't be read, the removal stops and names it.
• A neighbour with only deployment.pending.json is first bound to its authored profile through the pending intent hash (loadEarnProfileForRead). It stops the removal when it targets this chain and policy, or when that binding fails, so an edited profile can no longer hide it. Pending deployments on other chains or policies don't block.
• Neighbour failure messages keep only each URL's origin, so RPC paths and query tokens from underlying errors aren't printed. The full error stays in cause.
• docs/earn/modules/access.md is updated to match.

Tests: cli.test.ts adds the genesis cases (no code: skipped, code: refused, no client: refused), pending neighbours on this and another policy, a pending deployment whose profile was edited, and URL redaction. pnpm check, pnpm check:types and pnpm --filter @tempoxyz/contracts test --run (771 passed) pass locally.

[tempoxyz-bot]

✅ Cyclops Security Review: safe to merge

✅ Reviewed 884a411 (latest) · Coverage: full · no open findings · report
ℹ️ Not verifiable from the source alone (needs running code or deployed state): The repository dependency installation was absent, so the project test suite was not executed. Isolated redactor checks ran on Node v24.22.1 rather than the repository's declared Node >=22.23.4 <23 ru

#	Severity	Finding	Introduced	Status
1	⚪ Informational	Parenthesized RPC URLs bypass path and query redaction	4345296	✅ Fixed in f1e510c
2	⚪ Informational	redactUrls trailing-punctuation regex takes quadratic time on long tokens	f1e510c	✅ Fixed in 884a411
3	⚪ Informational	Access CLI redactUrls partially rewrites credential URLs, defeating userinfo masking	a503798	✅ Fixed in 884a411

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Beyond the inline finding, I checked two other things and ruled both out. The new doc line "credentials without a URL there are refused" matches code that already exists in siblingEnvironment (cli.ts:252-262), so the doc is consistent with the implementation. Dropping the genesis-mismatch continue after the strict load is also safe: recordTarget only lets a same-genesis or malformed record reach that load, and the load rejects malformed ones.

Extended reasoning...

I checked that the documented refusal of credentials without a URL is real code (it predates this diff), and that removing the post-load genesis check cannot let an other-genesis record get past discovery.

[claude]

No new blocking issues. 1 optional suggestion (a nit or a note on pre-existing code) was found and not posted. Nothing in this review needs a push before merging.

Still open from earlier reviews (1):

• Unresolved: 1 minor or pre-existing.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[claude]

Code review found no issues

No high-confidence issues detected in this change.