Differences

This shows you the differences between two versions of the page.

--- provenance:security:virustotal [2026/08/27 13:44] – Provenance log for security:virustotal. Authored by Claude karel.kubicek.claude
+++ provenance:security:virustotal [2026/09/17 08:14] (current) – Qualify root Security link; Authored by Claude karel.kubicek.claude
@@ Line 5: / Line 5: @@
 **Run:** 2026-08-27. Corpus: 5,859 extracted papers, 7 venues, 2010–2026, ''data/extract/run1''. Item: drain ''wiki-measuretheweb'' / "security:virustotal (new)", claimed as ''cursor-drain-virustotal'', store id 222, run 60. Author of the page and this log: Cursor, not Claude Code. Reviews: three focused passes then one generic, all on **GPT 5.6 Luna medium** (''gpt-5.6-luna-medium''), the sitting's requested substitute for the spec's sonnet/fable split.
-**Creating, not extending.** ''?do=export_raw'' on ''security:virustotal'' returned the HTML error page (not an existence test by byte count). ''dw.mjs pages'' does not list ''provenance:''. Neighbour [[security]] already linked the red child. Overlap judgement: write the promised child rather than widen [[design:website_classification]] — that page owns topic ''categories''; this one owns the maliciousness oracle.
+**Creating, not extending.** ''?do=export_raw'' on ''security:virustotal'' returned the HTML error page (not an existence test by byte count). ''dw.mjs pages'' does not list ''provenance:''. Neighbour [[:security]] already linked the red child. Overlap judgement: write the promised child rather than widen [[design:website_classification]] — that page owns topic ''categories''; this one owns the maliciousness oracle.
 No ''~~DISCUSSION~~'' on this provenance page. Comments belong on the content page.
@@ Line 28: / Line 28: @@
 Exits 1 if missing ''paper.cols.txt'' is not 4, if ''STUDIES_VT'' and the title/slug sweep disagree, or if ''API_TIER'' and the tight API-tier sweep disagree. A printed ''FAILURE'' with exit 0 is forbidden.
-''python3 pages/vt_label.py --demo'' is the published script. Its output is quoted in a %%<code>%% block; ''external_checks_virustotal.sh'' asserts equality.
+''python3 pages/vt_label.py %%--demo%%'' is the published script. Its output is quoted in a %%<code>%% block; ''external_checks_virustotal.sh'' asserts equality.
 ===== Queries =====
@@ Line 103: / Line 103: @@
 ===== Published script =====
-''pages/vt_label.py''. Stdlib. ''--demo'' fixture is internally consistent (2 malicious of 4 engines). Requires the v3 ''data.attributes'' wrapper; missing ''last_analysis_stats'' is a ''KeyError''. Undocumented stats keys are a ''ValueError''. File objects must include the three extra stats keys and they count toward ''total''. Domain and IP objects have no ''first_submission_date''. Advertised flags: a JSON path, ''--demo'', ''--threshold N'' with ''N >= 1''. Giving both or neither, or ''N < 1'', exits 2.
+''pages/vt_label.py''. Stdlib. ''%%--demo%%'' fixture is internally consistent (2 malicious of 4 engines). Requires the v3 ''data.attributes'' wrapper; missing ''last_analysis_stats'' is a ''KeyError''. Undocumented stats keys are a ''ValueError''. File objects must include the three extra stats keys and they count toward ''total''. Domain and IP objects have no ''first_submission_date''. Advertised flags: a JSON path, ''%%--demo%%'', ''%%--threshold%% N'' with ''N >= 1''. Giving both or neither, or ''N < 1'', exits 2.
 ===== Bibliography keys added =====
@@ Line 514: / Line 514: @@
 | 1 | Published script documented only file/URL/domain and always required ''first_submission_date''; IP objects have no such field. | **Accepted.** Script now accepts ''file'' / ''url'' / ''domain'' / ''ip_address''. File and URL print ''first_submission_date''; domain and IP omit the line. Unsupported types ''ValueError''. |
 | 2 | ''try/except KeyError: pass'' around optional file stats. | **Accepted.** File objects **require** ''confirmed-timeout'' / ''failure'' / ''type-unsupported'' (direct access). URL/domain/IP objects do not print those keys. |
-| 3 | ''--threshold 0'' and negatives labelled every object malicious. | **Accepted.** ''N < 1'' exits 2. |
+| 3 | ''%%--threshold%% 0'' and negatives labelled every object malicious. | **Accepted.** ''N < 1'' exits 2. |
 | 4 | When majority equals 1, 2, 4 or 10, that row was relabelled "majority" and the ''t=N'' row vanished. | **Accepted.** ''t'' = 1, 2, 4, 10 always print; majority is a separate row. Demo output unchanged (majority = 3). |
 | 5 | Schema sentence cited only URL and file docs for all four object types. | **Accepted.** Domain and IP object docs linked; per-engine categories on those objects match URL (four, no ''timeout''). |
@@ Line 520: / Line 520: @@
 The page otherwise answered its question. Provenance focused-review log was honest; this section is the generic pass (no ''GENERIC_REVIEW'' placeholder). Re-run after those five edits: no leftover defects.
+===== Markup sweep, 2026-09-17 =====
+Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.
+===== Link-hygiene sweep, 2026-09-17 =====
+The fresh rendered-DOM sweep found this page's bare ''security'' link resolved to ''provenance:security:security''. It is now root-anchored; the post-save DOM was re-checked for red links. No figures or citations changed.