fix(bridgetracker): redact error URLs + gate bridgeservicefinder auto-registration

[arnaubennassar]

🔄 Changes Summary

• bug: proxy: redact URL from reported errors #1845: The bridge tracker / aggkit-proxy binary was echoing raw backend error strings (URLs, host:port, bare IPs — sometimes with API keys in the path) into client-facing fields (ErrorStep.Description, ErrorData.Message, CertificateData.Error, the activity endpoint's errors/warnings[].message, and proxy's own JSON error body). All of these are now redacted before they leave the process, with a defensive MarshalJSON layer as a last line of defense.
• feat: proxy / bridgeservicefinder: Add config flag to control automatic registration of newly discovered networks in bridgeservicefinder #1855: bridgeservicefinder used to serve any network discovered after Start immediately, so half-configured rollups could be used prematurely. A new AutoRegisterNewNetworks flag (default true = today's behavior) lets operators freeze the served set at Start; networks discovered afterwards are recorded as pending instead, until a restart or an explicit config change.

⚠️ Breaking Changes

• No behavior change at default settings for either issue.
• 🔌 API/CLI: bridgeservicefinder.Finder gains a PendingNetworks() []PendingNetwork method — a compile-time breaking change for any out-of-repo implementer of the interface. Accepted as won't-fix by design (reviewed in S17 finding L16): all in-repo implementers (proxy, tracker, autoclaim, and test doubles) were updated.
• types.HealthResponse gains an optional pending_networks field (json:"pending_networks,omitempty"), so it is backwards compatible for existing clients.
• The new AutoRegisterNewNetworks config key defaults to true, i.e. today's behavior, for both the proxy binary and the main aggkit binary's AutoClaim.BridgeServiceFinder.

📋 Config Updates

[BridgeServiceFinder]
AutoRegisterNewNetworks = true

[AutoClaim.BridgeServiceFinder]
AutoRegisterNewNetworks = true

✅ Testing

• 🤖 Automatic:
  • Unit tests: common, bridgetracker/... (including domain, api, sources, types), bridgeservicefinder, proxy/..., autoclaim/....
  • Two new e2e tests, run in a new dedicated CI matrix group proxy-tracker-stateful (anvil-2chains env) so they don't share a stack/state with the default bridge group:
    • TestProxyTrackerRedactsURLs (bug: proxy: redact URL from reported errors #1845) — rewrites a network's RPCURLs/BridgeURLs to unresolvable .invalid hostnames, restarts aggkit-proxy-001, and asserts every client-facing error string is redacted while still showing the redaction placeholder (proving a URL-bearing failure path actually ran).
    • TestProxyAutoRegisterNewNetworks (feat: proxy / bridgeservicefinder: Add config flag to control automatic registration of newly discovered networks in bridgeservicefinder #1855) — runs a second aggkit-proxy-002 instance with AutoRegisterNewNetworks = false alongside aggkit-proxy-001 (left at the true default), attaches a new rollup on L1, and asserts -001 serves it live while -002 returns 404 and lists it under /health's pending_networks until restarted.
  • Negative controls were verified during development: with redaction stubbed out, the tracker leaked a real .invalid URL and the redaction test failed as expected; with the flag flipped to true on aggkit-proxy-002, it served the new network live and the auto-register test failed as expected — confirming both tests actually exercise the behavior they claim to.
• 🖱️ Manual: none beyond the above; go build ./... and golangci-lint run --timeout 5m ./... both clean on this branch.

🐞 Issues

• Closes bug: proxy: redact URL from reported errors #1845
• Closes feat: proxy / bridgeservicefinder: Add config flag to control automatic registration of newly discovered networks in bridgeservicefinder #1855

🔗 Related PRs

• None.

📝 Notes

• Design decisions validated with the user during planning:
  • AutoRegisterNewNetworks = false freezes the served network set at Start; a network discovered afterwards is recorded as pending (Finder.PendingNetworks(), surfaced on GET /health as pending_networks) rather than served.
  • Activation of a pending network happens only by restarting the process (so the Start enumeration re-runs) or by adding the network explicitly to BridgeURLs/RPCURLs in config.
  • There is intentionally no admin/activation REST endpoint and no allowlist config — activation is restart- or config-driven only.
  • Log lines are deliberately not redacted; operators still need the real endpoint to debug. Only client-facing API/WS fields are redacted.
  • IgnoreNetworkIDs takes precedence over AutoRegisterNewNetworks — an ignored network is never served or reported pending regardless of the flag.
• Out of scope, called out as explicit follow-ups: no dev-ui changes (its static network list can still drift from the backend) and no kurtosis-cdk changes.

🤖 Generated with Claude Code

[arnaubennassar]

Merged `develop` into this branch (`9ae85dd1`, pulling in the new SQLite-backed activity/tracker cache from #1822/#1852) and pushed the resolution plus two follow-up fixes:

• Redaction extended to the new SQLite activity store. The merge re-introduced the same class of raw-error leak issue bug: proxy: redact URL from reported errors #1845 fixed: `sqliteActivityStore.refresh`'s two `entry.Errors["claim"]`/`["readiness"]` write sites now go through `aggkitcommon.RedactError`, and `decodeWarnings`/`activityBridgeRow.entry()` now redact on read too (idempotent) — write-time redaction covers new rows going forward, read-time redaction additionally covers any row a pre-fix build already wrote to disk, so an upgrade doesn't serve a raw backend URL from a legacy row into memory even before the defensive `MarshalJSON` layer gets to it. Added a round-trip test for `last_warnings` mirroring the existing claim/readiness ones.
• Tracker API revision bumped to 5. `HealthResponse` gained the optional `pending_networks` field without bumping `CurrentAPIRevision`, contradicting the constant's own documented rule. Bumped to 5 with a revision-history entry.
• Known coverage gap: the redaction e2e (`TestProxyTrackerRedactsURLs`) only covers the tx-tracking endpoint. The activity endpoint and the new SQLite-backed activity store are exercised by unit tests only, since `DBPath` is unset (SQLite off) in every e2e env. Not fixing here — wiring a DB path into an e2e env is scope growth for this PR.

`go build`/`go vet`/`golangci-lint` clean, unit suite green, both e2e tests (`TestProxyTrackerRedactsURLs`, `TestProxyAutoRegisterNewNetworks`) pass against `anvil-2chains`.

🤖 Generated with Claude Code

[arnaubennassar]

@claude

[claude]

Claude finished @arnaubennassar's task in 6m 43s —— View job

---

Review: fix(bridgetracker): redact error URLs + gate bridgeservicefinder auto-registration

• Gather context (diff vs origin/develop)
• Review redaction layer (common/redact.go + all call sites)
• Review bridgeservicefinder auto-register gating
• Review tests / config / docs / e2e infra
• Post review + summary template

---

🚀 What's New

Two independent, well-scoped hardening changes to the bridge tracker / aggkit-proxy stack:

1. Error redaction (bug: proxy: redact URL from reported errors #1845). New common/redact.go exposes RedactSensitive / RedactError / RedactSensitiveSlice: a pure, idempotent, 10-rule regex pipeline that replaces scheme-bearing URLs, host:port, IPv4/IPv6 literals and anchored DNS names with <redacted-url> / <redacted-host>. It is applied at three layers: at construction (resolve_steps.go, resolve_bridge_tx.go, sources/activity.go:warnf, both activity stores, every api/*_command.go + websocket.go error path, proxy/service.go:97), on the SQLite read path (decodeWarnings, activityBridgeRow.entry()) so rows written by a pre-fix build are cleaned on upgrade, and defensively in MarshalJSON (ErrorData, ErrorStep, CertificateData, ActivityItem, ActivityWarningItem). Logs are deliberately left unredacted.
2. Auto-registration gating (feat: proxy / bridgeservicefinder: Add config flag to control automatic registration of newly discovered networks in bridgeservicefinder #1855). bridgeservicefinder.Config.AutoRegisterNewNetworks (TOML default true) freezes the served network set at Start when set to false. All three post-Start install paths (discoverRollup, applyUpdate, refreshFromChain) record a PendingNetwork instead, logged once at Warn and surfaced on GET /tracker/v1/health as pending_networks (CurrentAPIRevision 4 → 5). IgnoreNetworkIDs correctly takes precedence — I verified ignored networks never enter addrToNetworkID, so applyUpdate/refreshFromChain are unreachable for them, and discoverRollup's ignore check sits before the new gate.

Plus two e2e tests in a new dedicated proxy-tracker-stateful CI matrix group, a second aggkit-proxy-002 compose service, regenerated swagger, and thorough doc updates.

🐛 Bug Fixes

• Client-facing error strings no longer leak backend URLs / host:port / bare IPs (potentially with API keys in the path) via ErrorStep.Description, ErrorData.Message, CertificateData.Error, the activity endpoint's errors / warnings[].message, or the proxy's own JSON error body.
• bridgeservicefinder no longer unconditionally serves half-configured rollups discovered after Start.
• CurrentAPIRevision bumped to 5, fixing the revision-rule violation the merge from develop would otherwise have left.

📋 Config Updates

[BridgeServiceFinder]
AutoRegisterNewNetworks = true   # default; false freezes the served set at Start

[AutoClaim.BridgeServiceFinder]
AutoRegisterNewNetworks = true   # default

⚠️ Breaking Changes

• bridgeservicefinder.Finder gains PendingNetworks() []PendingNetwork — compile-time break for any out-of-repo implementer. All in-repo implementers/test doubles updated.
• types.HealthResponse gains pending_networks (omitempty) — wire-compatible; api_revision 4 → 5.
• No runtime behavior change at default settings.

---

Overall

This is careful, high-quality work. The layered redaction (construct → persist-read → marshal) is the right shape, the gating is correctly ordered relative to IgnoreNetworkIDs, and the e2e tests include genuine positive assertions plus documented negative controls. Findings below are all non-blocking; the first two are the ones I'd most like to see addressed.

⚠️ I could not run go build / go test / golangci-lint in this environment (command approval denied), so everything below is from static reading of the diff. The author reports all three clean.

---

🟡 Suggested

1. AutoRegisterNewNetworks's Go zero value is the opposite of its documented default — bridgeservicefinder/config.go:105

The default lives only in the two embedded TOML blobs; applyConfigDefaults (bridgeservicefinder.go:155) cannot distinguish "false" from "unset" for a bool. The code comment acknowledges this, which is good, but a comment is a weak guard for a footgun where the failure mode is silent: any future in-Go Config{...} literal — a new binary, an embedder, a benchmark, a test helper — freezes network discovery with no error and no log, and the symptom (a rollup attached later is never served) surfaces hours away from the cause.

Two robust fixes, either of which removes the hazard entirely:

• Invert the field: FreezeNetworkSetAtStart bool (TOML false). Zero value then equals the documented default, and applyConfigDefaults never needs to know about it.
• Or make it *bool and resolve it in applyConfigDefaults alongside the other defaults, so there is exactly one place the default is expressed.

I'd lean towards inverting — it also reads better at the call site (if l.freezeNetworkSet { … record pending … }).

Fix this →

2. aggkit-proxy-002 starts in every anvil-2chains matrix group — test/e2e/envs/anvil-2chains/docker-compose.yml:198

The new service has no profiles: key (no env in this repo uses one), so it is brought up by ensureDockerComposeRunning for the bridge, backward-forward-let and every other anvil-2chains group too — an extra container, an extra L1 event poller, an extra agglayer client and an extra host port binding in jobs that never touch it. Adding profiles: ["proxy-tracker-stateful"] and setting COMPOSE_PROFILES=proxy-tracker-stateful for that one matrix entry confines it to where it's needed.

Fix this →

3. aggkit-proxy-noautoreg.toml is a 114-line byte-copy differing in one line

"Do not otherwise diverge this file; keep the two in sync" is the only thing preventing drift, and drift here produces a silently wrong test (e.g. a stale RollupManagerAddr would make TestProxyAutoRegisterNewNetworks fail for an unrelated reason). --cfg is a cli.StringSliceFlag (proxy/cmd/main.go:15) and LoadFiles merges files in order with later wins (proxy/config/config.go:118-126), so this can collapse to:

volumes:
  - ./config/aggkit-proxy/aggkit-proxy.toml:/etc/aggkit-proxy/config.toml:ro
  - ./config/aggkit-proxy/noautoreg-override.toml:/etc/aggkit-proxy/override.toml:ro
command: ["run", "--cfg=/etc/aggkit-proxy/config.toml", "--cfg=/etc/aggkit-proxy/override.toml", "--components=proxy,tracker"]

with a 3-line override file. ⚠️ Caveat worth weighing: that couples -002 to TestProxyTrackerRedactsURLs's in-place rewrite of aggkit-proxy.toml (both tests run in the same group). Since -002 is only restarted inside the autoregister test, and Go runs proxy_autoregister_test.go before proxy_tracker_redaction_test.go, this is currently benign — but it's real coupling, so the duplicate may be the deliberate cheaper trade. Your call; flagging so it's a decision rather than an accident.

4. bridgetracker (config) → bridgetracker/api → bridgeservicefinder layering — bridgetracker/config.go:281

Declaring PendingNetworksLister in bridgetracker/api and returning []bridgeservicefinder.PendingNetwork makes the config package depend on the api package, and drags the whole finder (plus its go-ethereum contract bindings) into the dependency graph of every importer of bridgetracker. health_command.go's own comment says the goal was "keeping bridgetracker/types free of any dependency on bridgeservicefinder" — but the interface could just live in bridgetracker/types returning []types.PendingNetwork, with proxy/cmd/run.go supplying a tiny adapter over finder. That inverts the dependency the intended way and keeps bridgetracker/config.go importing only types.

5. Residual redaction gap: portless, scheme-less hostnames

Rules 5/7/8 all require a port, and bare hostnames are only redacted in three anchored contexts (lookup X, no such host: X, certificate is valid for X, not Y). That's a deliberate and correct trade against false positives — but it means an error like failed to reach bridge-svc.internal.acme.com or connection refused by aggkit-002 still leaks the endpoint. The URL-with-API-key case #1845 calls out is scheme-bearing so it is covered, and the MarshalJSON layer doesn't help here (it runs the same rules). Worth stating this residual explicitly in RedactSensitive's doc comment (common/redact.go:66-70) so a future reader doesn't assume the function is exhaustive.

🟢 Optional

6. Three doc comments are truncated mid-sentence — bridgetracker/api/activity_command.go:92, :126, bridgetracker/types/status.go:25

All three end with …this is the last line of defense for any caller that does not — the sentence stops there (copy-pasted). Also activity_command.go:88-89 reads …from every Errors value defensively — domain.ActivityEntry. / // Errors is already redacted…, where the line break lands inside the qualified name.

7. Per-marshal cost of RedactSensitive — common/redact.go:71

Ten regex passes run on every ErrorData / ErrorStep / CertificateData / ActivityItem marshal, including the WS update hot path and activity responses that can carry many items each with an Errors map — and in the overwhelmingly common case the string contains nothing to redact. A cheap pre-filter would short-circuit that. Note it can't be the obvious strings.ContainsAny(s, ":.["): rule 6 matches a dotless, colonless lookup myhost, so the guard would need || strings.Contains(s, "lookup") (placeholders themselves contain none of :.[ nor lookup, so idempotency survives either way). Given the strings are short this is likely not worth the added subtlety — raising it only so the trade is conscious. Similarly redactActivityErrors (activity_command.go:99) allocates a fresh map on every marshal even when nothing changes.

8. Health example in the docs is stale — docs/bridgetracker/API.md:410

The example body still shows "api_revision": 2 (now 5) and carries no pending_networks illustration, even though the field table right above it documents both. Since this PR is what bumps the revision and adds the field, it's the natural moment to refresh it.

9. e2e: impersonation is never stopped — test/e2e/proxy_autoregister_test.go:257

anvil_impersonateAccount, the 100 ETH anvil_setBalance and the _ADD_EXISTING_ROLLUP_ROLE grant all persist for the rest of the group. That's fine and intentional given the dedicated matrix group, but a t.Cleanup calling anvil_stopImpersonatingAccount costs nothing and makes local re-runs against a warm stack less surprising.

10. e2e: the redaction test rewrites a git-tracked file — test/e2e/proxy_tracker_redaction_test.go:128

RestartAggkitProxyWithConfig (test/e2e/envs/loader.go:868) mutates test/e2e/envs/anvil-2chains/config/aggkit-proxy/aggkit-proxy.toml in the working tree. The t.Cleanup restore is correct and the comment at :134 already handles the failed-restore case — but not a hard kill (CI job timeout, SIGKILL, ^C), which leaves the checked-in config pointed at .invalid hosts and the repo dirty. Not worth restructuring; a one-line note in the helper's doc comment would be enough to save the next person the debugging.

---

What I checked and found correct

• Redaction idempotency holds for every rule: <redacted-url> / <redacted-host> contain no ://, no dotted quad, no […:…], and rules 6/8/9/10 all require their capture group to start with [A-Za-z0-9], which < is not (rule 6 additionally includes </> in its token class, as its comment claims).
• IgnoreNetworkIDs precedence — verified end to end: buildInitialCache (bridgeservicefinder.go:261) skips ignored networks before resolveNetwork populates addrToNetworkID, and discoverRollup's ignore check (listener.go:475) precedes the new gate, so applyUpdate / refreshFromChain are structurally unreachable for an ignored network and can never record one as pending. The PR description's claim is accurate.
• refreshFromChain is only reached from processLog (listener.go:326), never from buildInitialCache — so the new !exists && !autoRegister gate cannot break startup enumeration.
• The listener and the finder share one *cache (bridgeservicefinder.go:214), so PendingNetworks() observes what the listener records; pendingList copies under RLock and PendingNetwork is all value types, so no aliasing escapes.
• No leak via the reverse proxy: ErrorHandler (proxy/service.go:130-135) already writes a static {"error":"bridge service unreachable"} and only the log line carries the URL.
• All NewAPI / bridgetracker.New call sites updated (one each); PendingNetworksLister is assigned from a bridgeservicefinder.Finder interface value in proxy/cmd/run.go:244, so the nil-interface check in healthCommand.Execute behaves correctly.
• lll violations in the new e2e files (e.g. proxy_autoregister_test.go:179) are excluded by .golangci.yml's path: (_test\.go|^test/.*) rule.
• Swagger regenerated consistently — bridgetracker/api/docs/bridgetracker_swagger.json and docs/assets/swagger/bridge_tracker/swagger.json share a SHA.
• Env-var override path covered — the new CDK_PROXY_BRIDGESERVICEFINDER_AUTOREGISTERNEWNETWORKS test in proxy/config/config_test.go:79 is a good addition; it pins the one path most likely to regress when the default moves.
  · branch fix/proxy-redact-errors-autoregister-flag

[joanestebanr]

Redacting logs makes more sense at the API layer rather than in the internal objects. As the PR states, URLs/tokens are redacted only at the API level, not in logs. This comment applies to all redacted logs, not just sqlite, but all of them:

“Log lines are deliberately not redacted; operators still need the real endpoint to debug. Only client-facing API/WS fields are redacted.”

[arnaubennassar]

Agreed, done. Construction-site redaction is removed from every internal/domain object and the activity store (12 call sites); the tracker's internal objects now hold the raw error string in memory, identical to what gets logged. Redaction happens exactly once, at the API/wire layer: the five types.*.MarshalJSON implementations (ErrorStep, ErrorData, CertificateData, ActivityItem, ActivityWarningItem), the ErrorData literals inside bridgetracker/api (load-bearing, not redundant — wsSendError passes errData.Message to wsClose as a bare WebSocket close-frame reason that never reaches ErrorData.MarshalJSON), and proxy/service.go's gin.H error map (also load-bearing: gin.H has no marshaler to fall back on). Commit d536926.

No field lost wire coverage: ErrorStep reaches clients via api.TrackingData.Error and api.BridgeStepPath.Error (both *types.ErrorStep, so MarshalJSON is in the pointer's method set for either), and domain.ActivityEntry.Errors/domain.ActivityWarning.Message reach a client only through newActivityItems/newActivityWarningItems. A row written by a pre-fix build is no longer rewritten on read — it's served raw in memory like any other row, with the wire layer as the single place that redacts, the same as everything else. docs/bridgetracker.md now states this placement explicitly.

[joanestebanr]

Same comment related to start_date or uptime

[arnaubennassar]

Same answer as on the swagger comment: added start_date, not uptime (an absolute instant keeps the response byte-identical between calls and is directly comparable with pending_networks[].first_seen). See the reply on #1862 (comment) for the full reasoning. This file (docs/assets/swagger/bridge_tracker/swagger.json) is regenerated byte-identical to bridgetracker/api/docs/bridgetracker_swagger.json. Commit fddacac.

[arnaubennassar]

Review round follow-up

Pushed 4 commits addressing all 5 open review threads:

• 77d9cd0f — R3 + R4 (bridgeservicefinder): the AutoRegisterNewNetworks=false early return for an already-served network no longer skips registering/watching its contract (only the pending-record write is skipped now), and a SourceConfig cache entry is now terminal on the discovery path too, mirroring applyUpdate. Also fixes a data race the required -race run caught in the new R4 regression test (no lock/unlock pair existed after the addrToNetworkID write on the guard-triggering path); both write sites now take cache.mu.
• d536926f — R1: redaction moved out of internal/domain objects entirely, into the API/wire layer (five MarshalJSON implementations, the ErrorData literals in bridgetracker/api, and proxy/service.go's gin.H). No field lost wire coverage.
• fddacac0 — R2: added start_date (not uptime) to the tracker health response, folded into the existing unshipped API revision 5.
• e810bbf0 — cleanup of 32 code comments across 9 files that cited an internal planning file's section numbers (no review thread for this one, flagging it here for visibility).

Replies with full detail are on each thread. Verification: make lint, go build/go vet, full unit suite with -race (green except pre-existing environmental failures in claimsync and l2gersync, both unrelated to this PR — port 8545 contention from an unrelated running stack, and confirmed to pass in isolation), make build-docker, and the anvil-2chains e2e runs for TestProxyTrackerRedactsURLs, TestProxyAutoRegisterNewNetworks, TestJustBridge, TestBridgeL2ToL2, and TestBridgeTrackerL1ToL2 — all PASS.

[arnaubennassar]

Merged develop again (fe5add42 → 967858d2, #1864)

develop moved a second time while this round of review was in flight, so the branch carries a
second merge commit (4a123cc9) rather than a rebase — the branch is pushed, and a rebase would
need a force-push.

What the merge required

• One hard conflict, docs/bridgetracker/API.md, resolved as a union: the ErrorStep section
  keeps feat(bridgetracker): step start_date/end_date from on-chain facts, not now #1864's three-kinds-of-information intro, the error_type 3/"warning" rows and the
  retry_count note, and keeps this PR's redaction sentence on the description row — extended
  to name the warning case, since a warning's text travels that same field.
• Two signature adaptations in tests this PR added against the pre-feat(bridgetracker): step start_date/end_date from on-chain facts, not now #1864 API, neither changing
  what they assert: ResolveBridgeTx gained a resolvers map (the test exercises the
  FindBridge-error path, where PendingPath — its only consumer — is never reached, so it
  passes nil), and UpdateStep gained a trailing StepResolver (the four subtests added here
  are all error paths, so they pass nil, same as feat(bridgetracker): step start_date/end_date from on-chain facts, not now #1864's own subtests do).
• bridgetracker/domain/resolve_steps.go is byte-identical to develop again: the multi-line
  wrap of idxError, left over from the construction-site redaction that
  fix(bridgetracker): redact error URLs + gate bridgeservicefinder auto-registration #1862 (comment) had us remove, is folded
  back to upstream's single line.
• Swagger regenerated with the pinned swag and found semantically identical to the textual
  merge, so the merge result was kept: the only committed diff is the genuine change from each
  side (StepErrorWarning and the error description text from feat(bridgetracker): step start_date/end_date from on-chain facts, not now #1864, start_date and
  pending_networks from here) rather than swag's nondeterministic time.Duration enum block.

Redaction re-checked by hand, in both directions. ErrorStep, ErrorData and
CertificateData's MarshalJSON all survive the merge. #1864's new client-facing text
(GERData.L2InjectionUnresolvedReason → InjectedGERResult.L2InjectionWarning → the step's own
ErrorStep with ErrorType StepErrorWarning) reaches the wire only through
ErrorStep.MarshalJSON, and findL2InjectionBlockBackwards builds it as hand-written sanitized
text, deliberately never err.Error() — so there is no new unredacted path to cover.

Two neutral observations for whoever reviews the merged diff

1. feat(bridgetracker): step start_date/end_date from on-chain facts, not now #1864 changed the per-step start_date/end_date semantics on the wire without bumping
   CurrentAPIRevision (still 4 there). After the merge, revision 5 — introduced by this PR —
   therefore has a history bullet describing only this PR's two additions, not that change.
   Flagging it so nobody reads the bullet as exhaustive for revision 5; whether it warrants a bump
   is feat(bridgetracker): step start_date/end_date from on-chain facts, not now #1864's call, not something changed here.
2. The start_date name now appears twice in the tracker API, on different objects: feat(bridgetracker): step start_date/end_date from on-chain facts, not now #1864's is
   per bridge step (all_steps[].start_date), this PR's is per instance on /health.
   Incidental name overlap only — not a duplicated field.

Verification on the merged tree: make lint 0 issues; go build ./... and go vet ./...
clean; go test -race -count=1 over everything but ./test/e2e → 94 packages ok, with only the
pre-existing claimsync failures this PR has reported throughout (host port 8545 held by an
unrelated local stack). E2E on anvil-2chains after make build-docker:
TestProxyAutoRegisterNewNetworks, TestProxyTrackerRedactsURLs, TestJustBridge,
TestBridgeL2ToL2, TestBridgeTrackerL1ToL2 — all PASS, no skips.

🤖 Generated with Claude Code