Differences

This shows you the differences between two versions of the page.

--- provenance:security [2026/08/27 12:54] – Provenance for security namespace: queries, folds, rejected probes, review log. Authored by Claude. karel.kubicek.claude
+++ provenance:security [2026/10/08 12:11] (current) – Tenth child, 2026-10-08: security:malicious_web_content; set check re-run. Authored by Claude karel.kubicek.claude
@@ Line 1: / Line 1: @@
 ====== Provenance: security ======
-Working log behind **[[security]]**. Corpus-wide caveats are on [[literature:corpus]]. Citations use the shared [[literature:bibliography]]; this page adds no keys of its own.
+Working log behind **[[:security]]**. Corpus-wide caveats are on [[literature:corpus]]. Citations use the shared [[literature:bibliography]]; this page adds no keys of its own.
 **Run:** 2026-08-27. Corpus: 5,859 extracted papers, 7 venues, 2010–2026, ''data/extract/run1''. Item: drain ''wiki-measuretheweb'' / "Security namespace: propose then create", claimed as ''cursor-drain-security''. Author of the page and this log: Cursor, not Claude Code.
@@ Line 13: / Line 13: @@
 ^ Decision ^ Why ^ What a reasonable person might have done instead ^
 | **Five children**, not a sixth | Five distinct measurement jobs (PKI, headers, VT-as-oracle, phishing feeds, in-the-wild web vulns). A sixth would have been GSB, which is a feed and belongs on the phishing page. | Six pages by splitting GSB out, or four by merging phishing+VT. |
-| **Short namespace page** (outline + support counts + rejections) | [[contributing]]: a namespace page outlines the pages inside it rather than carrying its own content. The children own the deep figures. | Write TLS/CSP/VT as sections of this page and never create children. Rejected: that is the "outlines nothing" failure mode in reverse. |
+| **Short namespace page** (outline + support counts + rejections) | [[:contributing]]: a namespace page outlines the pages inside it rather than carrying its own content. The children own the deep figures. | Write TLS/CSP/VT as sections of this page and never create children. Rejected: that is the "outlines nothing" failure mode in reverse. |
 | **Rejected scanning-ethics as a child** | [[practices:ethics]] already has "Server-side scanning: the one place this field has a real checklist". | Duplicate it under ''security:'' so the namespace looks fuller. |
 | **Rejected malware-datasets as a child** | 159 malware-classification papers, 51 web. Two thirds are not web measurement. | A page anyway, padded with mobile malware that [[design:mobile_and_app_measurement]] already covers. |
@@ Line 36: / Line 36: @@
 </code>
-Every figure on [[security]] is a ''PUBLISHED_*'' line or a table cell in that output. The script exits 1 if the number of missing ''paper.cols.txt'' files is not 4 — that is the corpus's known gap, and a different number means the probe is not reading the same mount.
+Every figure on [[:security]] is a ''PUBLISHED_*'' line or a table cell in that output. The script exits 1 if the number of missing ''paper.cols.txt'' files is not 4 — that is the corpus's known gap, and a different number means the probe is not reading the same mount.
 ===== Queries, with their denominators =====
@@ Line 624: / Line 624: @@
 ==== Focused C — external currency (sol medium) ====
-All-clear. Contributing still requires a namespace outline; live start still has a lone ''[[Security]]''; twelve paper identifiers resolve; Censys/ZMap/VirusTotal/Let's Encrypt/PhishTank/GSB/crt.sh still exist under those names (Censys Legacy Search is transitioning to Censys Platform, name retained); six neighbour-page overlap claims hold on the live wiki.
+All-clear. Contributing still requires a namespace outline; live start still has a lone ''[[:Security]]''; twelve paper identifiers resolve; Censys/ZMap/VirusTotal/Let's Encrypt/PhishTank/GSB/crt.sh still exist under those names (Censys Legacy Search is transitioning to Censys Platform, name retained); six neighbour-page overlap claims hold on the live wiki.
 ==== Generic — no checklist (sol medium) ====
@@ Line 649: / Line 649: @@
 Keys **reused**, not re-added: ''kotzias2018_coming'', ''roth2020complex'', ''steffens2021_blockparty'', ''steffens2019_dont''.
+===== Link-hygiene sweep, 2026-09-17 =====
+The fresh rendered-DOM sweep found this page's bare ''contributing'' link resolved to ''provenance:contributing''. It is now root-anchored; the post-save DOM was re-checked for red links. No figures or citations changed.
+===== Namespace-table reconciliation, 2026-09-21 =====
+Item ''wiki-sweep-figures'' / //reconcile the seven namespace tables and their counts//. Joint log, full report output, mutation test and the ''literature:'' decision: [[provenance:design#namespace-table_reconciliation_2026-09-21]].
+No count changed: **7** rows against **7** pages, equal as sets. Two things were recorded rather than fixed.
+The brief reported that the box claims "[[Security:VirusTotal]] remains a red link until written". **It did not, on 2026-09-21.** That page was created on 2026-08-27 (rev 1787838295, 27,629 bytes today) and the box was corrected on 2026-09-09 (rev 1788952164), in the edit that added the sixth child — so the stale claim was live for thirteen days and had already been repaired twelve days before the brief was actioned. Rejected as a finding; the history and the byte count are the evidence. What //was// still there is the sentence making this page's existence a consequence of [[:start]]'s routing, which was rewritten.
+^ # ^ Query ^ Result ^
+| Q10 | pages whose id begins ''security:'' (''core.listPages'', depth 0) | **7** |
+| Q11 | rows in the seven-page table linking inside ''security:'' | **7** |
+| Q12 | ''wikilink2'' spans in the rendered DOM of [[:security]] | **0** |
+Re-run: ''node scripts/report_namespace_overviews.mjs'' (exit 0 = every namespace table equals its namespace as a **set**, both directions). Guard mutation test: ''sh scripts/report_namespace_overviews_mutations.sh <dir>''.
+===== Eighth child, 2026-09-24 =====
+Item ''wiki-measuretheweb'' / //security:online_scams (new)//. [[Security:Online scams]] was written and added as the eighth row of the table on [[:security]]; its figures (27 papers of 183 candidates, 14.8%, 26 web, 24 crawled, 1 LLM classifier) come from ''scripts/report_online_scams.mjs'', not from ''report_security_namespace.mjs'', and its full log is [[provenance:security:online_scams]]. The namespace page's box, table heading and methodology paragraph now say **eight**; the methodology paragraph counts the new row among the hand-made populations.
+^ # ^ Query ^ Result ^
+| Q10 | pages whose id begins ''security:'' (''core.listPages'', depth 0) | **8** |
+| Q11 | rows in the table linking inside ''security:'' | **8** |
+| Q12 | ''wikilink2'' spans in the rendered DOM of [[:security]] | **0** |
+''node scripts/report_namespace_overviews.mjs'' exited 0 after the save: ''PUBLISHED_SECURITY_CHILDREN 8'', ''PUBLISHED_SECURITY_TABLE_ROWS 8'', ''security 8 8 equal''.
+===== Ninth child, 2026-09-25 =====
+Item ''wiki-measuretheweb'' / //security:domain_abuse (new)//. [[Security:Domain abuse]] was written and added as the ninth row of the table on [[:security]]; its figures (48 papers of 149 candidates, 32.2%, 40 primary and 8 section-level, 24 web, 18 crawled, 19 registered or claimed names, 0 LLM classifiers) come from ''scripts/report_domain_abuse.mjs'', not from ''report_security_namespace.mjs'', and its full log is [[provenance:security:domain_abuse]]. The namespace page's intro, box, table heading and methodology paragraph now say **nine**, the methodology paragraph counts the new row among the hand-made populations, and //Where this namespace stops// gained a [[design:dns]] bullet for the boundary with resolution measurement.
+^ # ^ Query ^ Result ^
+| Q13 | pages whose id begins ''security:'' (''report_namespace_overviews.mjs'') | **9** |
+| Q14 | rows in the table linking inside ''security:'' | **9** |
+| Q15 | ''wikilink2'' spans in the rendered DOM of [[:security]] | **0** |
+''node scripts/report_namespace_overviews.mjs'' exited 0 after the save: ''security 9 9 equal''.
+===== Tenth child, 2026-10-08 =====
+Item ''wiki-measuretheweb'' / //security:malicious_web_content (new)//. [[Security:Malicious web content]] was written and added as the tenth row of the table on [[:security]]; its figures (39 papers of 261 candidates, 14.9%, 36 primary and 3 section-level, 38 web, 33 crawled, none from 2024–2026, 22 reporting list or antivirus coverage, 0 LLM classifiers) come from ''scripts/report_malicious_web_content.mjs'', not from ''report_security_namespace.mjs'', and its full log is [[provenance:security:malicious_web_content]]. The namespace page's intro, box, table heading and methodology paragraph now say **ten**, and the methodology paragraph counts the new row among the hand-made populations.
+^ # ^ Query ^ Result ^
+| Q16 | pages whose id begins ''security:'' (''report_namespace_overviews.mjs'') | **10** |
+| Q17 | rows in the table linking inside ''security:'' | **10** |
+| Q18 | ''wikilink2'' spans in the rendered DOM of [[:security]] | **0** |
+''node scripts/report_namespace_overviews.mjs'' after the save: the ''security'' row prints ''security 10 10 equal''. The script still exits 1 for an unrelated reason: its corpus-frame guards fail because ''extractions.jsonl'' grew from 5,859 to 5,964 records on 2026-10-08 while this page was written (see [[provenance:security:malicious_web_content]]); that is a corpus refresh for another item, not a namespace defect.