Repository navigation
Detector issue sweep: #41 / #42 / #43 — decisions, status, and what unblocks each #55
Description
Tracking issue for the three defects filed against the two detectors when the daily audit landed (PR #40) and deliberately not fixed there. One place to read: what each one asks, what was decided, what is done, and what is missing.
Plan of record, with the reasoning and the evidence table: docs/plan-2026-09-25-detector-issues.adoc (this branch).
| issue | asks | decision | status |
|---|---|---|---|
| #43 | login_surface prefix-tests the probe host but fetches the final URL — a guard asking a different question than its consumer |
judge the host of the URL about to be fetched, read once by host_of_url() through the same parser the walk used to build the --resolve pin |
done, PR #54 |
| #42 | login_surface needs an approved-login-host policy or it goes permanently red the day a legitimate cPanel service exists |
exact-hostname list (approved-login-hosts.txt), empty by default; approved + form = the service working; unapproved + form = the finding; approved + no form = not a finding (decided, not defaulted); a suffix or pattern is refused with exit 2 rather than interpreted |
done, PR #54 |
| #41 | a multi-tenant suffix (github.io / pages.dev / workers.dev) on the allow-list proves no ownership |
replace the three shared suffixes with an org-scoped GitHub suffix, an account-scoped Workers suffix, and one exact host <project>.pages.dev line per Pages project |
blocked on data, see below |
What #41 needs before it can be done honestly
Not design — two data items that this repository does not carry and that cannot be derived from it:
- the Pages project hostnames the estate actually serves (
<project>.pages.dev). Project names carry no ownership marker, so the exact names are the only proof of ownership available without a token.domains.csvhas apages_projectcolumn, which gives a starting point. - the account's workers.dev subdomain — one string; once known,
suffix <account>.workers.devis ownership-bound, because only that account can serve names under it.
github.io is the easy one: suffix hyperpolymath.github.io is ownership-bound by the namespace itself.
Why it is not being shipped blind: the failure direction for #41 is noise on a live estate. Without the inventory, legitimate Pages/Workers targets are reported as findings every day, and an audit that is red for a known-good reason is an audit nobody reads — the failure #42 exists to prevent. dns-origins is already red until ALLOWED_ORIGIN_IPS is populated (documented in allowed-origins.txt), so #41 is best taken in the same pass over the zone list.
Rule being applied
The owner's, from PR #40: dormant ⇒ an issue with acceptance criteria; live-on-merge ⇒ fix it now. All three were dormant when filed; #42 and #43 become live the moment a legitimate cPanel service name exists or any estate hostname redirects into one, and this estate has 33 reseller cPanel accounts, so that is a when.
Evidence for the closed pair: 113 controls in scripts/test-edge-redirect-check.sh (was 90), both directions of #43 and all three cases of #42 covered, two reversions of the fix shipping in the suite with their kills asserted by name, ten further mutants run by hand (nine killed at the exact control written for them, one recorded non-kill), and the real 138-hostname sweep replayed hermetically against the pre-change script with identical hostname rows.
Not measured anywhere yet: the live 138-hostname run, which is #43's final acceptance box and can only be produced by the edge job on the default branch.
Activity