Generalize known-benign 404 suppression (extends PLUTO-182/184 template, app-side classifier per Elazar bs-mqoruy0m32e). All currently page at warn; reclassify at the write path (not-found-classify.ts / not-found-log.ts) so the row persists at info and never enters the warn page path. Candidates: (1) phantom redirect over-fire PLUTO-165/169 residue: empty requestedPath + classifiedReason=genuine-bad-route -> info (~1.9/day); (2) /apple-touch-icon.png + -precomposed.png iOS/Safari auto-requests -> WELLKNOWN_BENIGN_RE -> info/navigation (~1.3/day); (3) /robots.txt -> WELLKNOWN_BENIGN_RE -> info (~0.5/day; optionally serve real robots.txt separate); (4) credential-JSON scanner burst ~15 variants currently mis-tagged navigation NOT security (gcp/firebase/secrets/config/service-account .json, /api/env, /actuator/env) -> extend SCANNER_PATH_RE -> info/malicious (these are 182-class probes that slipped the regex); (5) /practicas/<non-uuid-slug> malformed -> non-UUID on UUID route -> info/malicious (~0.3/day). INVESTIGATE-FIRST sub-point: anonymous-no-referer-unknown old-schema warn rows (~0.9/day) -> suppress ONLY if all pre-date PLUTO-169 deploy; if any post-date, find the un-upgraded code path. ~7/day of ~14/day page_not_found warn volume.

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-22
• wi-cli-venus blocked · 2026-06-22
  GATED by bs-mqoruy0m32e decision (2026-06-22): live-app suppress-list implementation waits on generalpm's AMENDED fleet error-alerting standard + per-app COPY doctrine. Placement principle ratified (app-side classifier writes non-alerting severity; appEvents severity = pager SSOT). Pluto's credential-JSON-regex candidate (#4) feeds fleet finding C (wide scanner surface); unblock when generalpm publishes the amended standard. venus (demo) pilots first.
• wi-cli-venus commented · 2026-06-22
  Mapped to evolutiva-error-alerting-standard v1.3 §7 (generalpm). Pluto = conform-WI, per-app COPY doctrine, gated on venus pilot results (implement against runtime-exercised proof). Coverage: (C) wide credential regex app-side→category=security = local candidate #4 (gcp/firebase/aws/*secret*/*credential*/.json/api-env/actuator/php-admin) — broadens PLUTO-182 SCANNER_PATH_RE. (B) burst-dedup app-side: collapse (UA+session+errorClass) <60s → 1 alert+count N; NEVER blanket-suppress a client-error class (preserves crash-loop signal) — applies to /informes clientError (PLUTO-188 stays paging, just dedup'd). (A) self-probe RAIL drop: stamp evolutiva-internal-probe/<tool> UA on Pluto internal probe traffic (audit PTD curls, /api/app-version checks, force-tests) so the rail drops the alert (keep logging action=self-probe); UA we control, NOT IP allowlist. Plus local page_not_found reclassify-to-info candidates 1(phantom redirect),2(apple-touch-icon),3(robots.txt),5(non-uuid-slug). Unblock when venus posts pilot proof.
• wi-cli-venus commented · 2026-06-22
  §7-A emitter mapping (standard v1.3, amended): UA contract = evolutiva-internal-probe/<tool> (fixed fleet string). Pluto probe emitters → mostly PATH (ii) ad-hoc agent curls (need the per-app probe-wrapper injecting -A evolutiva-internal-probe/<tool>): audit's PTD live-version checks (cache-busted /api/app-version) + audit force-test probes (the /zzz-genuine-* + PLUTO182-*/P184-* 404 probes that currently self-page). PATH (i) standing probe script: Pluto has no standing version-curl/force-test cron that I'm aware of (applog daemons query the DB, they don't curl the site) — verify during impl; if any standing curl exists, set the UA in-script (one durable edit). Wrapper is per-app COPY (venus pilots the convention+wrapper first). Rail-drop keys on the UA regardless of path. Still gated on venus pilot proof before Pluto touches code.
• wi-cli-venus commented · 2026-06-22
  PARTIAL UNBLOCK 2026-06-22 (generalpm decision, venus EVO-28 pilot runtime-proven: UA-stamped→log-only no-page c48ffdfe / no-UA→pages db99f882). EVO-28 self-probe slice CLEARS now; EVO-27 burst-dedup + C credential-regex slices STAY blocked until venus posts those proofs. Pluto EVO-28 = 3 pieces: (1) DB trigger migration adds userAgent to applog NOTIFY payload [DISPATCHED to db-pluto-cc, PREPARE-ONLY → audit-pluto pre-apply review of the .sql → apply only after PASS; Pluto=LIVE, NO direct-apply latitude per generalpm DDL gate]; (2) rail enqueue() drops on userAgent.startsWith('evolutiva-internal-probe/'), FAILS-OPEN on null — LANE TBD (applog rail code, confirm owner before dispatch); (3) per-app probe-curl.sh wrapper stamps UA=evolutiva-internal-probe/pluto-ptd (COPY from venus, path ii) — covers audit PTD live-version curls + force-test 404 probes. Sequencing: (1) lands first (rail can't key on UA until it's in the payload), then (2), then (3).
• wi-cli-venus commented · 2026-06-22
  EVO-28 migration (20260622060151_evo28_applog_notify_add_useragent.sql) audit PASS 03:03 — byte-level diff vs live EVO-16 fn confirms sole additive key userAgent=left(COALESCE(NEW.userAgent,''),300); column text/nullable verified, camelCase quoting exact, trigger trg_applog_err binding preserved (CREATE OR REPLACE), NOTIFY <8KB, fail-open on null, idempotent, no archive sentinel (NOTIFY trigger not archive). PM go-ahead given to db: apply via DATABASE_URL_DIRECT → db:export → push (with path-confirm supabase/migrations vs db/migrations/applied + shared-tree git-status gate). Push is app-behavior-neutral (DB trigger + repo record; self-probe DROP needs piece 2 rail-enqueue). audit owns post-push PTD on the SHA. Pieces remaining: (2) rail enqueue UA-drop [lane TBD], (3) probe-curl.sh wrapper.
• wi-cli-venus commented · 2026-06-22
  EVO-28 piece 1 APPLIED+PUSHED — db SHA ebb593b / v1.76.6. Migration applied via direct DSN + verified live (pg_get_functiondef shows userAgent key in payload). Path confirmed: supabase/migrations/ IS Pluto's config-as-code convention (db/migrations/applied/ is legacy numbered pattern) — file correctly placed. Shared-tree git-status pre-push clean (only migration + db:export artifacts staged, no coder dirty files). audit running PTD on ebb593b. Remaining: piece 2 rail enqueue UA-drop [lane TBD — resolve shared-daemon vs Pluto-repo with venus], piece 3 probe-curl.sh wrapper [coder, queued].
• wi-cli-venus commented · 2026-06-22
  EVO-28 piece-1 PASS:ebb593b (audit) — v1.76.6: build READY, 0 runtime error/fatal in post-deploy window, cache-busted version 1.76.6 + alias-target deploymentId match (dpl_6ksN...), live pg_get_functiondef('fn_notify_applog_err') has_ua_key=t. DB-side userAgent-in-NOTIFY-payload DONE+LIVE. RAIL LANE RESOLVED: piece 2 (applog-listen enqueue drop on userAgent.startsWith('evolutiva-internal-probe/'), fails-open on null) = applog-pluto-cc's lane (NOT coder) per audit's coverage note. Piece 3 (probe-curl.sh wrapper, UA=evolutiva-internal-probe/pluto-ptd) = coder, queued. Self-probe DROP behavior does NOT take effect until piece 2 ships (piece 1 only adds the field). PLUTO-187 stays OPEN: pieces 2+3 + EVO-27/C slices (still blocked on venus proofs).
• wi-cli-venus commented · 2026-06-22
  EVO-28 piece-2 lane RESOLVED (venus, bs-mqot9tigy9t): the self-probe UA-drop is ONE SHARED listener edit covering ALL apps — mars/pluto only apply the trigger migration to their OWN DB (Pluto's = ebb593b, DONE+live), NO per-app listener change. So piece 2 is NOT a Pluto lane (not applog-pluto-cc, who's offline anyway) — it's the shared applog-listen enqueue drop, venus/applog-owner's, auto-covers Pluto once the UA is in Pluto's NOTIFY payload (it is). Pluto EVO-28 remaining = ONLY piece 3: probe-curl.sh wrapper (coder, COPY from venus, UA=evolutiva-internal-probe/pluto-ptd) so audit's PTD curls + force-test probes actually emit the dropped UA. Slice C (credential-regex) = app-side classification only — rail's pre-existing bot-filter already drops category=security (venus). Pieces left fleet-wide: EVO-27 burst-dedup still blocked on venus proof; C app-side; Pluto piece-3 wrapper dispatchable now.
• wi-cli-venus commented · 2026-06-22
  EVO-28 listener-drop re-verify needed (per pm-venus-cc 2026-06-22 03:21, MARS-173 rail incident): templated applog-listen@* (incl pluto) ran STALE code started 06-21 07:36Z — before EVO-28/EVO-27 landed → UA-drop not loaded. nw-venus restarted all four ~06:19Z, now on 1cf07dc. Pluto migration piece (PASS:ebb593b) UNAFFECTED. Action: when piece 3 (probe-curl.sh wrapper, UA=evolutiva-internal-probe/pluto-ptd) is built+run, fire the probe AGAINST the restarted listener and confirm action='self-probe' / no-page / no-DM. Pluto had no independent e2e drop-proof yet (piece 3 held for venus COPY template), so this folds into piece-3 acceptance — not a regression of shipped work.
• wi-cli-venus commented · 2026-06-22
  UNBLOCK (pm-venus-cc 2026-06-22 03:22): piece 3 is NOT gated on a venus template — §7-A COPY doctrine = each app builds its OWN probe-curl.sh. Thin per-app wrapper: 'exec curl -A "evolutiva-internal-probe/pluto-ptd" "$@"' (only the UA prefix 'evolutiva-internal-probe/' is the shared contract). POST-COMPACT FIRST ACTION: dispatch coder to write pluto's probe-curl.sh wrapper, then fire the post-restart probe against the restarted listener (1cf07dc) to confirm action='self-probe' / no-page / no-DM = EVO-28 e2e drop proof. No external dependency remains.
• wi-cli-venus commented · 2026-06-22
  2026-06-22 ~04:16 DISPATCHED piece-3 to coder-pluto-cc by DM (coder parked-but-DM-reachable): (1) build pluto's own thin probe-curl.sh (exec curl -A evolutiva-internal-probe/pluto-ptd $@; coder picks repo path, not PATH-protected sh dir); (2) fire e2e drop proof against RESTARTED listener 1cf07dc (first valid check post MARS-173 stale-listener restart) — confirm UA-match drop, no page, no DM. Reversible ops, fly-solo, no Elazar gate. Awaiting coder result/SHA.
• wi-cli-venus commented · 2026-06-22
  EVO-28 self-probe slice COMPLETE + live-proven (2026-06-22). piece-3 PASS:2ed27bb (v1.76.7, audit): build READY, 0 runtime err in window, cache-busted /api/app-version=1.76.7 + alias deploymentId match, diff = exactly 2 files (package.json + new scripts/probe-curl.sh). e2e DROP PROOF (coder, against RESTARTED listener 1cf07dc): 2 novel-404 probes via probe-curl.sh (UA evolutiva-internal-probe/pluto-ptd) → both logged action='self-probe' log-only (ids 89d6feca/ef48423e), ZERO operator page, ZERO hub DM. EVO-28 self-probe drop now end-to-end confirmed on Pluto (piece-1 payload + piece-3 wrapper + restarted shared listener). WI STAYS BLOCKED: remaining suppress-list slices (page_not_found reclassify candidates 1/2/3/5 + credential-regex #4) still gated on generalpm's amended fleet error-alerting standard (bs-mqoruy0m32e) + venus burst-dedup pilot. Only the self-probe slice cleared.
• wi-cli-venus commented · 2026-06-22
  Noise-kill sub-path UNBLOCKED (pm-pluto-cc 2026-06-22): /robots.txt page_not_found (candidate #3) is recurring as live warn noise (applog digest ×2+ in the quiet window). The 'serve a real robots.txt separate' option noted in #3 is INDEPENDENT of the gated classifier suppress-list (bs-mqoruy0m32e) — serving app/robots.ts (Next.js, disallow-all; correct posture for an authenticated internal clinical app) eliminates the 404 entirely, so page_not_found never fires for /robots.txt regardless of the classifier. Tiny reversible coder task, no Elazar gate. QUEUED for coder post-compact (coder parked to /compact 08:30). Does NOT unblock the rest of PLUTO-187 (candidates 1/2/4/5 still gated on the amended fleet standard) — this is just carving the one self-contained noise-killer out of the blocked bundle.
• wi-cli-venus note · 2w ago
  2026-08-02 applog: 2 new benign-scanner-probe candidates, both correctly 404 (gate-correct, not user-facing): /crusader-404-probe and /_ignition/health-check (Laravel Ignition RCE-scanner probe, common internet background noise), currently classified navigation/page_not_found warn instead of security/malicious info. Single occurrence each so far — add to SCANNER_PATH_RE candidate list, evidence-gate before implementing per existing PLUTO-187 discipline.
• wi-cli-venus note · 2w ago
  2026-08-02 23:05 UTC: same 2 probe paths recur (/_ignition/health-check then /crusader-404-probe, 0.4s apart) — 2nd occurrence in ~11h, same pairing/order as the 11:30 UTC hit. Pattern reads as one scanner client sweeping both paths per run. Still gate-correct 404, still below evidence-gate threshold for implementing, but recurrence is now 2/2 identical pairing — worth revisiting threshold if a 3rd hit lands.