Pluto fly-solo-kill execution brief (bs-mqpzo3ly470 / EVO-26) — execute on next Elazar-launched team session, do NOT act between sessions. (A) COMMONS/DOC: delete fly-solo/autonomy doctrine + flip log-review=work-order to report-only-Elazar-decides + add Agent-Boundary PM-never-spawns-hands-brief. Pluto-repo files (pluto-commons.md, pm-pluto-role.md) = Pluto coder; shared evolutiva-commons/evolutiva-pm-commons deletes route via bin-whey-cc (whey-canonical, mem shared-commons-edit-routing), NOT Pluto coder. (B) PROBE NOISE (Pluto app code, coder): port venus X-Audit-Probe demotion + internal-probe UA marker so scanner/probe traffic self-classifies to security/info and emits NO page_not_found warn row (source = not-found.tsx capture, mem pluto-notfound-capture-redirect-overfire); + downstream expected-signal allowlist: /wp-* & CMS-scanner paths, apple-touch-icon* 404s, pm-triage NOTIFY probe, gate-correct login-unknown, mobile fetch-abort. (C) RAIL RE-POINT (nw-owned venus daemons = Elazar-launched nw edit, NOT Pluto coder): applog-listen/pull@pluto + pluto-pm-triage-listen.service (EVO-32) -> REAL-severity DM Elazar only, everything else log/queue row no PM DM. (D) DEFERRED per decision pt7: headless sendWelcomeEmail(userId) path (the Agustina exhibit) - policy stands, conversion not scheduled yet.

Sub-tickets

Activity

• wi-cli-venus created · 2026-06-23
• wi-cli-venus assigned · 7w ago
  pm-pluto-cc
• wi-cli-venus assigned · 5w ago
  coder-pluto-cc
• coder-pluto-cc note · 1w ago
  Cross-project finding (coder-venus-cc's VENUS-327 PTD, relayed via pmmaster-evolutiva-cc 2026-10-04): a static-extension 404 (.txt/.json/.png) can arrive with NO x-pathname if the proxy strips the header before any writer runs — any benign-asset-pattern list member with a static extension (robots.txt, sitemap.xml, favicon.png) is then dead code in prod; only extensionless members can ever produce a benign-asset row. NOT yet verified against Pluto's own proxy.ts/catch-all — Pluto's [...notFoundPath] catch-all takes requestedPath from its OWN route params (not x-pathname) specifically to survive matcher-excluded routes, per not-found-capture.ts's PLUTO-180 comment, so this class of defect may already be closed here by that design — needs confirming whether Next's catch-all segment actually matches dotted-extension paths at all (platform static-file routing may intercept them before Next/the catch-all ever sees them) before porting any Block B-2 pattern work in this ticket. Logged for whoever executes this ticket; not actioned now per its own do-not-act-between-sessions gate.
• support-evolutiva-cc note · 1w ago
  Witness evidence for item (B), the downstream expected-signal allowlist for /wp-* and CMS-scanner paths. One sweep on pluto at 2026-10-06 10:12:18-19Z hit at least three paths and TWO of them paged this lane: /feed warn/navigation id 5b757f8d-feca-4d55-867f-37152a4bfa78 @10:12:18.935557, /readme.html warn/navigation id c7765730-4e33-4ed1-b09b-09ec0cc277e0 @10:12:19.401807, and /wp-json @10:12:19.776134 which was correctly silenced at info/malicious. Same sweep, 0.84s end to end, two of three leaked. Disposition of the two that leaked, and they are NOT the same case: /feed is a DOCUMENTED deliberate hold-out and I am not proposing to filter it. MARS-585 Block Q (pm-mars-cc binding gate, adopted from pluto) lists /feed among the ambiguous bare words left pageable on purpose - app-plausible, and holding them out is what preserves the dead-internal-link signal. It has 2 rows lifetime (2026-07-28 and today). The Elazar count>1 filter-gap rule does not override an explicit adjudicated boundary; reversing one needs its own adjudication. /readme.html is a WordPress version-disclosure fingerprint, not a bare word, and belongs to the family item (B) already covers: /license.txt is the same shape, 1 row 2026-09-19, also unfiltered. Both are exact-path artifacts no Evolutiva app serves. Pluto has no /feed or /readme route template and nothing matching in public/ - checked against the live tree. I am NOT acting on it: this row is explicitly do-NOT-act-between-sessions pending an Elazar-launched team session, and MARS-585 binds any new block to being executed over the FULL admitted 404 route set rather than an observed-shapes sample. Recording the witnesses so whoever executes that gate has them. Separately filed from this row: PLUTO-777, the benign-platform suppression that was never dropping rows.