terra
TERRA-264
MARS-790 step 4: terra scanner-tier block Y for the SonicWall-style /access/api/v1/system/ping probe
Done normal
ctcoder-terra-cc
MARS-790 step 4: add scanner-tier block Y /^\/access\/api\/v1\/system\/ping(?:$|[?#])/ to src/lib/not-found-tier.ts, exact-anchored, no trailing $ after the group. Terra has ZERO rows for this path so there is no positive control here; the 3 hits are pluto x2, mars x1. /access, /access/api, /access/api/v1/system, /pingx and /ping/x pinned as real misses because terra's access-issue surfaces (/solicitar-acceso, /sin-acceso, /administrar/pedidos-de-acceso) are real. Verify by the route's appEvents count staying FLAT after deploy; do NOT curl the path, which writes the row.
Activity
-
terra-264-blockY-pushed-1ff7758 | Pushed 1ff7758 (ed6fc34..1ff7758, origin/main). src/lib/not-found-tier.ts block Y added exact-anchored, byte-identical to pluto not-found-classify.ts:376, read in that file. Tests 4/4, tsc clean, route-template walk 0 collisions vs terra's 25 routes. GAP, measured by coder-enamel-cc and matching my own read: stripPath() runs before the regex in BOTH tierForNotFound and isScannerProbePath, so the (?:$|[?#]) tail alternative is UNREACHABLE through the public API - a trailing-$ mutant still matches ping, ping?x=1 and ping#f, so the three pinned positives are NOT regression cover for the shape support flagged. pingx and /access are real controls (false under both good and mutant). Closing the gap needs SCANNER_PROBE_RE exported and asserted directly, which is a five-repo change nobody has authorised - candidate MARS-790 step 5. Verification is the route's appEvents count staying FLAT after deploy; do NOT curl the path. Deploy not yet confirmed: terra was 0.31.86/ed6fc34 at last reading.
-
terra-264-live-dpl8pZqvWM8 | Code live in production: /api/health at 2026-10-02T20:03:36Z reports commitSha 1ff77587a4d5bf3b96fccdd5839866e45b9ccf99, deploymentId dpl_8pZqvWM8ihBnw3QpoRuWRzNVU7kX, version 0.31.86 (version did NOT bump, so the deploymentId+sha pair is the only oracle - the prior reading was ed6fc34). dbOk true, mailOk true. COVERAGE: this states the fix is deployed at THIS deployment, nothing about any future one. What is NOT yet exercised: the behavioural verification is the route's appEvents count staying FLAT, which needs a later reading and cannot be forced, because curling the path writes the row the change exists to suppress. Terra has zero rows for this path historically, so there is no positive control here either way - the absence after deploy will look identical to the absence before it. The honest statement is that the classifier is live and collision-proven locally, not that a probe was observed suppressed.
-
completed
task
2w ago by coder-terra-cc
2w ago
2026-10-02 20:03