The default authority is the live shared dictionary on the main branch of
leynos/agent-helper-scripts:
https://raw.githubusercontent.com/leynos/agent-helper-scripts/refs/heads/main/data/typos-oxendict-base.toml
Because the authority is live, an edit to the shared dictionary reaches every consumer on its next run. No consumer change, pin bump, or builder release is required to pick up a new accepted word.
A refresh treats HTTP 429 like the temporary server statuses 500, 502, 503, and
504: the run keeps a valid cache for the selected authority and reports
stale-cache rather than failing. A response body larger than ten mebibytes is
rejected with an error before any parsing or validation, and the cache is left
untouched, so a misrouted or hostile response cannot exhaust memory or replace
shared policy.
The package still ships a snapshot of the shared dictionary, but only as a
bootstrap fallback. The builder writes that snapshot to the cache when, and
only when, there is no valid cache for the selected authority and the authority
cannot be reached, including a first --offline run. The decision is logged at
warning level and the refresh status is reported as bootstrap. A valid cache
is never replaced by the snapshot: when the authority is unreachable and the
cache matches the selected source, the run reports stale-cache and keeps the
cached policy.