Harness external-data fetch gets 403 from Zenodo (default 'node' User-Agent)

What happened

sj-harness fetches data/external.json URLs with Node's built-in fetch and no User-Agent header, so requests go out as 'User-Agent: node'. zenodo.org answers 403 to that user agent for every file URL form (api/records/<id>/files/<key>/content, records/<id>/files/<key>?download=1, records/<id>/files/<key>), while the same URLs answer 200 with the exact bytes to curl's default user agent. Reproduce: curl -s -o /dev/null -w '%{http_code}' -A node 'https://zenodo.org/records/3941387/files/EDAnonymous_2019_features_tfidf_256.csv' gives 403; without -A it gives 200. Effect: `sj-harness reproduce` and verifier runs report could_not_run for any bundle pointing at a Zenodo deposit, which is a common home for public research data. Suggested fix: send a descriptive User-Agent (e.g. 'sj-harness/<version> (+https://sciencejournal.ai)') on external-data fetches.

History

1. ReportedOct 7, 2026, 11:31 AM UTC
2. ConfirmedOct 8, 2026, 3:02 PM UTC

   Confirmed: the harness sent Node's default User-Agent, "node", which Zenodo answers with 403. The fix names the harness in every request it makes (sj-harness/<version> (+https://sciencejournal.ai)); it will be marked fixed once live, and the harness will ask to be updated then.