Generalize known-benign 404 suppression (extends PLUTO-182/184 template, app-side classifier per Elazar bs-mqoruy0m32e). All currently page at warn; reclassify at the write path (not-found-classify.ts / not-found-log.ts) so the row persists at info and never enters the warn page path. Candidates: (1) phantom redirect over-fire PLUTO-165/169 residue: empty requestedPath + classifiedReason=genuine-bad-route -> info (~1.9/day); (2) /apple-touch-icon.png + -precomposed.png iOS/Safari auto-requests -> WELLKNOWN_BENIGN_RE -> info/navigation (~1.3/day); (3) /robots.txt -> WELLKNOWN_BENIGN_RE -> info (~0.5/day; optionally serve real robots.txt separate); (4) credential-JSON scanner burst ~15 variants currently mis-tagged navigation NOT security (gcp/firebase/secrets/config/service-account .json, /api/env, /actuator/env) -> extend SCANNER_PATH_RE -> info/malicious (these are 182-class probes that slipped the regex); (5) /practicas/<non-uuid-slug> malformed -> non-UUID on UUID route -> info/malicious (~0.3/day). INVESTIGATE-FIRST sub-point: anonymous-no-referer-unknown old-schema warn rows (~0.9/day) -> suppress ONLY if all pre-date PLUTO-169 deploy; if any post-date, find the un-upgraded code path. ~7/day of ~14/day page_not_found warn volume.

Sub-tickets

Activity

• wi-cli-venus created · 2026-06-22
• wi-cli-venus blocked · 2026-06-22
  GATED by bs-mqoruy0m32e decision (2026-06-22): live-app suppress-list implementation waits on generalpm's AMENDED fleet error-alerting standard + per-app COPY doctrine. Placement principle ratified (app-side classifier writes non-alerting severity; appEvents severity = pager SSOT). Pluto's credential-JSON-regex candidate (#4) feeds fleet finding C (wide scanner surface); unblock when generalpm publishes the amended standard. venus (demo) pilots first.
• wi-cli-venus commented · 2026-06-22
  Mapped to evolutiva-error-alerting-standard v1.3 §7 (generalpm). Pluto = conform-WI, per-app COPY doctrine, gated on venus pilot results (implement against runtime-exercised proof). Coverage: (C) wide credential regex app-side→category=security = local candidate #4 (gcp/firebase/aws/*secret*/*credential*/.json/api-env/actuator/php-admin) — broadens PLUTO-182 SCANNER_PATH_RE. (B) burst-dedup app-side: collapse (UA+session+errorClass) <60s → 1 alert+count N; NEVER blanket-suppress a client-error class (preserves crash-loop signal) — applies to /informes clientError (PLUTO-188 stays paging, just dedup'd). (A) self-probe RAIL drop: stamp evolutiva-internal-probe/<tool> UA on Pluto internal probe traffic (audit PTD curls, /api/app-version checks, force-tests) so the rail drops the alert (keep logging action=self-probe); UA we control, NOT IP allowlist. Plus local page_not_found reclassify-to-info candidates 1(phantom redirect),2(apple-touch-icon),3(robots.txt),5(non-uuid-slug). Unblock when venus posts pilot proof.
• wi-cli-venus commented · 2026-06-22
  §7-A emitter mapping (standard v1.3, amended): UA contract = evolutiva-internal-probe/<tool> (fixed fleet string). Pluto probe emitters → mostly PATH (ii) ad-hoc agent curls (need the per-app probe-wrapper injecting -A evolutiva-internal-probe/<tool>): audit's PTD live-version checks (cache-busted /api/app-version) + audit force-test probes (the /zzz-genuine-* + PLUTO182-*/P184-* 404 probes that currently self-page). PATH (i) standing probe script: Pluto has no standing version-curl/force-test cron that I'm aware of (applog daemons query the DB, they don't curl the site) — verify during impl; if any standing curl exists, set the UA in-script (one durable edit). Wrapper is per-app COPY (venus pilots the convention+wrapper first). Rail-drop keys on the UA regardless of path. Still gated on venus pilot proof before Pluto touches code.
• wi-cli-venus commented · 2026-06-22
  PARTIAL UNBLOCK 2026-06-22 (generalpm decision, venus EVO-28 pilot runtime-proven: UA-stamped→log-only no-page c48ffdfe / no-UA→pages db99f882). EVO-28 self-probe slice CLEARS now; EVO-27 burst-dedup + C credential-regex slices STAY blocked until venus posts those proofs. Pluto EVO-28 = 3 pieces: (1) DB trigger migration adds userAgent to applog NOTIFY payload [DISPATCHED to db-pluto-cc, PREPARE-ONLY → audit-pluto pre-apply review of the .sql → apply only after PASS; Pluto=LIVE, NO direct-apply latitude per generalpm DDL gate]; (2) rail enqueue() drops on userAgent.startsWith('evolutiva-internal-probe/'), FAILS-OPEN on null — LANE TBD (applog rail code, confirm owner before dispatch); (3) per-app probe-curl.sh wrapper stamps UA=evolutiva-internal-probe/pluto-ptd (COPY from venus, path ii) — covers audit PTD live-version curls + force-test 404 probes. Sequencing: (1) lands first (rail can't key on UA until it's in the payload), then (2), then (3).
• wi-cli-venus commented · 2026-06-22
  EVO-28 migration (20260622060151_evo28_applog_notify_add_useragent.sql) audit PASS 03:03 — byte-level diff vs live EVO-16 fn confirms sole additive key userAgent=left(COALESCE(NEW.userAgent,''),300); column text/nullable verified, camelCase quoting exact, trigger trg_applog_err binding preserved (CREATE OR REPLACE), NOTIFY <8KB, fail-open on null, idempotent, no archive sentinel (NOTIFY trigger not archive). PM go-ahead given to db: apply via DATABASE_URL_DIRECT → db:export → push (with path-confirm supabase/migrations vs db/migrations/applied + shared-tree git-status gate). Push is app-behavior-neutral (DB trigger + repo record; self-probe DROP needs piece 2 rail-enqueue). audit owns post-push PTD on the SHA. Pieces remaining: (2) rail enqueue UA-drop [lane TBD], (3) probe-curl.sh wrapper.
• wi-cli-venus commented · 2026-06-22
  EVO-28 piece 1 APPLIED+PUSHED — db SHA ebb593b / v1.76.6. Migration applied via direct DSN + verified live (pg_get_functiondef shows userAgent key in payload). Path confirmed: supabase/migrations/ IS Pluto's config-as-code convention (db/migrations/applied/ is legacy numbered pattern) — file correctly placed. Shared-tree git-status pre-push clean (only migration + db:export artifacts staged, no coder dirty files). audit running PTD on ebb593b. Remaining: piece 2 rail enqueue UA-drop [lane TBD — resolve shared-daemon vs Pluto-repo with venus], piece 3 probe-curl.sh wrapper [coder, queued].
• wi-cli-venus commented · 2026-06-22
  EVO-28 piece-1 PASS:ebb593b (audit) — v1.76.6: build READY, 0 runtime error/fatal in post-deploy window, cache-busted version 1.76.6 + alias-target deploymentId match (dpl_6ksN...), live pg_get_functiondef('fn_notify_applog_err') has_ua_key=t. DB-side userAgent-in-NOTIFY-payload DONE+LIVE. RAIL LANE RESOLVED: piece 2 (applog-listen enqueue drop on userAgent.startsWith('evolutiva-internal-probe/'), fails-open on null) = applog-pluto-cc's lane (NOT coder) per audit's coverage note. Piece 3 (probe-curl.sh wrapper, UA=evolutiva-internal-probe/pluto-ptd) = coder, queued. Self-probe DROP behavior does NOT take effect until piece 2 ships (piece 1 only adds the field). PLUTO-187 stays OPEN: pieces 2+3 + EVO-27/C slices (still blocked on venus proofs).
• wi-cli-venus commented · 2026-06-22
  EVO-28 piece-2 lane RESOLVED (venus, bs-mqot9tigy9t): the self-probe UA-drop is ONE SHARED listener edit covering ALL apps — mars/pluto only apply the trigger migration to their OWN DB (Pluto's = ebb593b, DONE+live), NO per-app listener change. So piece 2 is NOT a Pluto lane (not applog-pluto-cc, who's offline anyway) — it's the shared applog-listen enqueue drop, venus/applog-owner's, auto-covers Pluto once the UA is in Pluto's NOTIFY payload (it is). Pluto EVO-28 remaining = ONLY piece 3: probe-curl.sh wrapper (coder, COPY from venus, UA=evolutiva-internal-probe/pluto-ptd) so audit's PTD curls + force-test probes actually emit the dropped UA. Slice C (credential-regex) = app-side classification only — rail's pre-existing bot-filter already drops category=security (venus). Pieces left fleet-wide: EVO-27 burst-dedup still blocked on venus proof; C app-side; Pluto piece-3 wrapper dispatchable now.
• wi-cli-venus commented · 2026-06-22
  EVO-28 listener-drop re-verify needed (per pm-venus-cc 2026-06-22 03:21, MARS-173 rail incident): templated applog-listen@* (incl pluto) ran STALE code started 06-21 07:36Z — before EVO-28/EVO-27 landed → UA-drop not loaded. nw-venus restarted all four ~06:19Z, now on 1cf07dc. Pluto migration piece (PASS:ebb593b) UNAFFECTED. Action: when piece 3 (probe-curl.sh wrapper, UA=evolutiva-internal-probe/pluto-ptd) is built+run, fire the probe AGAINST the restarted listener and confirm action='self-probe' / no-page / no-DM. Pluto had no independent e2e drop-proof yet (piece 3 held for venus COPY template), so this folds into piece-3 acceptance — not a regression of shipped work.
• wi-cli-venus commented · 2026-06-22
  UNBLOCK (pm-venus-cc 2026-06-22 03:22): piece 3 is NOT gated on a venus template — §7-A COPY doctrine = each app builds its OWN probe-curl.sh. Thin per-app wrapper: 'exec curl -A "evolutiva-internal-probe/pluto-ptd" "$@"' (only the UA prefix 'evolutiva-internal-probe/' is the shared contract). POST-COMPACT FIRST ACTION: dispatch coder to write pluto's probe-curl.sh wrapper, then fire the post-restart probe against the restarted listener (1cf07dc) to confirm action='self-probe' / no-page / no-DM = EVO-28 e2e drop proof. No external dependency remains.
• wi-cli-venus commented · 2026-06-22
  2026-06-22 ~04:16 DISPATCHED piece-3 to coder-pluto-cc by DM (coder parked-but-DM-reachable): (1) build pluto's own thin probe-curl.sh (exec curl -A evolutiva-internal-probe/pluto-ptd $@; coder picks repo path, not PATH-protected sh dir); (2) fire e2e drop proof against RESTARTED listener 1cf07dc (first valid check post MARS-173 stale-listener restart) — confirm UA-match drop, no page, no DM. Reversible ops, fly-solo, no Elazar gate. Awaiting coder result/SHA.
• wi-cli-venus commented · 2026-06-22
  EVO-28 self-probe slice COMPLETE + live-proven (2026-06-22). piece-3 PASS:2ed27bb (v1.76.7, audit): build READY, 0 runtime err in window, cache-busted /api/app-version=1.76.7 + alias deploymentId match, diff = exactly 2 files (package.json + new scripts/probe-curl.sh). e2e DROP PROOF (coder, against RESTARTED listener 1cf07dc): 2 novel-404 probes via probe-curl.sh (UA evolutiva-internal-probe/pluto-ptd) → both logged action='self-probe' log-only (ids 89d6feca/ef48423e), ZERO operator page, ZERO hub DM. EVO-28 self-probe drop now end-to-end confirmed on Pluto (piece-1 payload + piece-3 wrapper + restarted shared listener). WI STAYS BLOCKED: remaining suppress-list slices (page_not_found reclassify candidates 1/2/3/5 + credential-regex #4) still gated on generalpm's amended fleet error-alerting standard (bs-mqoruy0m32e) + venus burst-dedup pilot. Only the self-probe slice cleared.
• wi-cli-venus commented · 2026-06-22
  Noise-kill sub-path UNBLOCKED (pm-pluto-cc 2026-06-22): /robots.txt page_not_found (candidate #3) is recurring as live warn noise (applog digest ×2+ in the quiet window). The 'serve a real robots.txt separate' option noted in #3 is INDEPENDENT of the gated classifier suppress-list (bs-mqoruy0m32e) — serving app/robots.ts (Next.js, disallow-all; correct posture for an authenticated internal clinical app) eliminates the 404 entirely, so page_not_found never fires for /robots.txt regardless of the classifier. Tiny reversible coder task, no Elazar gate. QUEUED for coder post-compact (coder parked to /compact 08:30). Does NOT unblock the rest of PLUTO-187 (candidates 1/2/4/5 still gated on the amended fleet standard) — this is just carving the one self-contained noise-killer out of the blocked bundle.
• wi-cli-venus note · 2026-08-02
  2026-08-02 applog: 2 new benign-scanner-probe candidates, both correctly 404 (gate-correct, not user-facing): /crusader-404-probe and /_ignition/health-check (Laravel Ignition RCE-scanner probe, common internet background noise), currently classified navigation/page_not_found warn instead of security/malicious info. Single occurrence each so far — add to SCANNER_PATH_RE candidate list, evidence-gate before implementing per existing PLUTO-187 discipline.
• wi-cli-venus note · 2026-08-02
  2026-08-02 23:05 UTC: same 2 probe paths recur (/_ignition/health-check then /crusader-404-probe, 0.4s apart) — 2nd occurrence in ~11h, same pairing/order as the 11:30 UTC hit. Pattern reads as one scanner client sweeping both paths per run. Still gate-correct 404, still below evidence-gate threshold for implementing, but recurrence is now 2/2 identical pairing — worth revisiting threshold if a 3rd hit lands.
• wi-cli-venus unblocked · 7w ago
  Superseded by shipped work + zero live residue. Every candidate in the title now exists in src/lib/not-found-classify.ts: WELLKNOWN_BENIGN_RE (apple-touch-icon/robots), ICON_PROBE_RE, SCANNER_PROBE_RE incl. credential-JSON alts + archive exts + /cmd_sco (PLUTO-712), UUID_RE non-uuid-on-uuid-route, NO_ROUTE_BY_DESIGN_RE (favicon.png/sitemap.xml, PLUTO-653 afe9b74). Measured 2026-08-22 via db-pluto-cc on appEvents 30d: 1443 404 rows, 86 warn; the title's classes P1/P2/P6/P7/P8 = 0 warn rows, credential-JSON P5 28/28 info. The only 'post-deploy warn for already-down-tiered path' candidates were /sitemap.xml + /favicon.png at 2026-07-30 12:59:24-25 UTC, which is 10 min BEFORE afe9b74 (13:09:16Z) — no regression. generalpm gate moot: the app-side classifier doctrine it waited on is what shipped. Coverage: appEvents 30d window only.
• wi-cli-venus completed · 6w ago
  BACKFILL written 2026-09-02 by coder-basquetwi-cc, authorized by the owning lane. Historical repair for the bug fixed in 526f6b0: closing a BLOCKED row directly to a closed status wrote only the 'unblocked' event and never the terminal one, and the close reason landed on that unblock event. The row was always correctly closed (closedAt stamped, questions closed, status correct); only the ledger was wrong, and its last word read 'unblocked' - which reads as still-open to anyone reconciling by event rather than by status. THIS EVENT IS NOT CONTEMPORANEOUS: its timestamp is the repair's write time, not the real close time, which is in closedAt. The original close reason has been left where the bug put it, on the unblock event, deliberately - it is the only artifact showing the bug's shape.