Scanner-probe 404 classifier — adopt PLUTO-453 canonical infra/cloud/backup/profiler probe family (docker/azure/gcloud cred dotdirs, cloud-cred JSON, .ya?ml, .tf(state|vars), .sql(.gz), profiler/heapdump/threaddump/configprops, archives .zip/.tgz/.tar.gz, whole-path dump|trace|logfile). 07:32 UTC sweep paged 87x Dockerfile/k8s/docker-compose + 87x backup.tar.gz — NOT envfile so canonical C misses them, warn-page. Demote-only to silent security/info forceSync-retain. MUST re-prove anchor discipline on Mars manifest: cred dotdirs stay (^|/) any-segment; bare-ext yaml/sql/tf/zip/tar.gz safe ONLY if public/+handlers serve zero such files (confirm); .json STAYS filename-anchored (442 ban). Cross-fleet: PLUTO-453 live canonical, VENUS folds in. Reversible.

Sub-tickets

Questions

Activity

• wi-cli-venus created · 7w ago
• wi-cli-venus completed · 7w ago
  Adopted PLUTO-453 canonical scanner-family extension (8-alt: docker/azure/gcloud/config/credentials cred-dotdirs, cloud-cred JSON filename-anchored, .ya?ml, .tf(state|vars), .sql(.gz), profiler/heapdump/threaddump/configprops, .zip/.tgz/.tar.gz, bare dump|trace|logfile). Shipped 78ae7c9/v2.22.18, audit PASS (31/31 match, 19/19 traps, 0/63 collisions, deploy verified). Anchor discipline held: bare-ext safe (public/ serves only png/webp/sw.js), .json stays filename-anchored. Demote-only to silent security/info, ambiguous still defaults error. Bare /Dockerfile residual tracked separately (awaits Pluto canonical alt).