404 classifier scanner-probe gap: external vuln-scanner paths nested under a legit segment (/app/.git/config 29x paged 2026-06-29, /informes/.env, /<seg>/wp-login.php, .php) inherit own-route via top-segment fallback -> alert. Fix: pre-filter denylist demoting dotfiles (except .well-known), .php[0-9]*, token set (wp-admin/wp-login/xmlrpc/phpmyadmin/cgi-bin/vendor/actuator/.aws/.git) to a SILENT info/security tier (force-retain 365d, ZERO page) BEFORE the top-segment fallback. Denylist must match ANY path segment (nesting), not root-anchored. Adopt Pluto's proven SCANNER_PROBE_RE as reference (PLUTO-442/446/450). Cross-fleet defect (venus VENUS-80, pluto PLUTO-450). Reversible; ambiguity still defaults to error per 404-is-error.

Sub-tickets

Questions

Activity

• wi-cli-venus created · 7w ago
• wi-cli-venus note · 7w ago
  Investigation: Mars's SCANNER_PATH_RE already matches nested /app/.git/config (not root-anchored) - Pluto's PLUTO-450 anchor fix is a no-op here. Real Mars gap = TIER: scanner shapes emit level='warn', and rail trigger mig013 fires on level in {error,fatal,warn} -> the 29x page. Fix = pre-filter (before reason logic) demoting scanner shapes to level='info'/category='security'/no-alert; info is below rail's warn floor (zero page), logger persists all levels (forensic retain). Mars has NO appEvents purge -> 365d-retain satisfied by default, no column needed. Will adopt canonical post-450 SCANNER_PROBE_RE for token breadth (Mars misses actuator/.php[0-9]*/.dev.vars). Awaiting canonical regex + PM scope confirm.
• wi-cli-venus commented · 7w ago
  Scope refined post-investigation (coder-mars-cc 2026-06-29): Mars's SCANNER_PATH_RE ALREADY matches nested (free \.git\b) — Pluto's PLUTO-450 anchor fix is a NO-OP for Mars. Real Mars gap is TIER not match: scanner shapes return level:'warn' which clears the mig013 rail floor (error/fatal/warn) -> the 29x page. FIX: pre-filter BEFORE reason/referer logic demoting (a) scanner shapes -> level:'info' category:'security', (b) benign platform probes (well-known + apple-touch icon misses, incl MARS-338 missing sizes) -> level:'info' benign category; add 'info' to NotFoundTier.level union; adopt canonical post-450 SCANNER_PROBE_RE for coverage breadth (Mars misses actuator/.php[0-9]*/.dev.vars/wp-content). NO 365d retention column (no purge job exists; info persists already) — only guard: any future purge must exempt category='security'. #6 apple-touch benign-probe folded in (was adjacent).
• wi-cli-venus commit · 7w ago
  09cf9f1 v2.22.15 - canonical post-450 SCANNER_PROBE_RE pre-filter; scanner shapes->info/security (retained-silent, below rail mig013 warn-floor), benign apple-touch+well-known->persist:false drop. Zero collision across 62 routes; wp-json/gravitysmtp live vectors confirmed silent. audit GREEN pre-push; PTD pending.
• wi-cli-venus completed · 7w ago
  Scanner-shape 404 pre-filter: canonical SCANNER_PROBE_RE demotes bot/scanner probes (.git/.env/.aws/wp-*/wp-json/.php[0-9]*/cgi-bin/vendor/actuator) to info/security retained-silent (below mig013 warn-floor=zero page); benign platform probes (.well-known/apple-touch) explicit-skip; any-segment anchoring; genuine-ambiguous stays error. Mars bug was TIER not anchor. 09cf9f1/v2.22.15, audit PASS. Cross-fleet w/ PLUTO-450 + VENUS-80.
• wi-cli-venus completed · 7w ago
  Shipped 09cf9f1 v2.22.15. Canonical post-450 SCANNER_PROBE_RE pre-filter: scanner shapes->info/security (retained-silent, below rail mig013 warn-floor, zero page), benign apple-touch+well-known->persist:false drop. Audit PASS:09cf9f1 (deploy READY, alias bound, live version==2.22.15, runtime clean). BEFORE-state empirically reproduced (wp-json + 33 nested .git/config prefixes all warn->each paged mig013 = the 29x defect). AFTER-row pending next live sweep (not blocking; verified structurally by source + node match-set + identical pre-state shapes now routing to info). Mars-specific: no info-gate so forceSync moot, benign dropped via explicit persist:false skip; category='security' kept.
• wi-cli-venus audit-finding · 7w ago
  REOPEN: post-READY warn rows on a scanner path = fix gap. applog: 5 new warn 404s @/wp-json/gravitysmtp/v1/tests/mock-data at 04:10 UTC, ~12min AFTER deploy READY 03:57:50 (audit confirmed zero post-READY rows at 04:05, so genuinely new). Fix NOT demoting /wp-json/* to info/security despite coder match-test. Suspect: pre-filter wired into page-404 classifier but /wp-json is API-shaped, logged via a different sink that never runs the pre-filter (cf MARS-162 /api catch-all gap). Coder+audit tracing which sink writes these rows; demotion must apply at that sink/shared chokepoint.
• wi-cli-venus statusChanged · 7w ago
  reopen - fix gap on /wp-json sink
• wi-cli-venus statusChanged · 7w ago
  status=inProgress
• wi-cli-venus completed · 7w ago
  Re-confirmed PASS after reopen: the '5 new warn 404s @04:10' had NO backing appEvents row (audit query: max createdAt across entire table = 03:53:30 UTC pre-deploy; zero INSERTs since READY 03:57:50, any sink/shape). Both rail paths key on appEvents INSERT -> alerts were the daemon REPLAYING the stale pre-deploy 03:53:30 batch on post-deploy listener reconnect (applog-listen stale-process class), not new traffic. MARS-340 app fix intact but unexercised (no genuine sweep since deploy). Daemon-replay = alert-rail maintainer surface, not this WI -> raised separately. 09cf9f1/v2.22.15.
• wi-cli-venus statusChanged · 7w ago
  REOPEN (coverage gap, real sweep): genuine post-deploy scanner sweep 17 warns @06:22 UTC = credential-envfile probes (/sendgrid.env, /env.bak, /.sendgrid.env, /app/sendgrid.env, +9). Canonical SCANNER_PROBE_RE .env alt is segment-anchored (^|/)\.env — matches /.env + /foo/.env but NOT suffixed (sendgrid.env) or prefixed (env.bak) credential files -> stay warn -> page. Extend regex to cover the envfile family (suffixed *.env, prefixed env.bak/env.*, bare .env), anchored to filename to avoid route collision. Same chokepoint. Cross-fleet gap (pluto/venus share).
• wi-cli-venus completed · 7w ago
  Scanner-probe 404 classifier: envfile-family coverage gap closed + fleet-canonical C adopted (/(^|\/)(?:[\w.~-]*\.env|env)(?:$|[./~0-9_-])/ ) catching bare /env, *.env suffix, env.<ext> backups. Shipped 24a3bbe/v2.22.17, audit PASS, all 3 apps (Pluto/Mars/Venus) converged on C. Scanner shapes demote to info/security (zero-page); genuine 404s stay error.