Filter the log by the header, and say a hand probe has to carry it by ptr727 · Pull Request #81 · ptr727/Blog

ptr727 · 2026-08-09T16:35:44Z

The outward pass still told a reader to separate our traffic from real visitors by user agent — the exact coincidence X-Blog-Check was added to replace.

That key is not a rule. The CI runner's curl and the VPS host's curl are byte-identical at 8.5.0, so only the client address separates them, and the CI half rotates every run.

What changed

The header is the mechanism now, and its value carries provenance, so a run is identifiable rather than merely excludable:

jq 'select(.["request_X-Blog-Check"] == null)'

The gap worth recording: check-live-urls.sh sends it on every request and a bare curl sends nothing, so an interactive probe lands in the visitor set unless whoever runs it passes -H "X-Blog-Check: proxmox/<what>". The host side measured two untagged probes against 3,100 tagged ones in the 2026-08-09 deploy window — small, and exactly the noise the filter exists to remove. Both were mine.

The user-agent method stays, scoped to what it can still read: the days logged before the field existed.

One structural note

Kept as sub-bullets under the first filter rather than as four more bold paragraphs. The section opens "The outward pass is four filters", and a reader has to be able to count them — four peer-looking bold leads would have made that number unverifiable at a glance without actually being wrong.

The outward pass told a reader to separate our traffic from real visitors by user agent, which is the coincidence X-Blog-Check was added to replace: the CI runner's curl and the host's own curl are byte-identical, so only the client address separates them and the CI half rotates every run. The header is the mechanism now, and its value carries provenance, so a run is identifiable rather than merely excludable. The gap worth recording is that check-live-urls.sh sends it and a bare curl does not, so an interactive probe lands in the visitor set unless whoever runs it passes -H. Two untagged probes turned up against 3,100 tagged ones in the 2026-08-09 deploy window, measured on the host side. The user-agent method stays, scoped to what it can still read: the days logged before the field existed. Kept as sub-bullets under the first filter rather than as four more bold paragraphs, because the section opens by saying it is four filters and a reader has to be able to count them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Updates the operational guidance for parsing the edge log’s “outward pass” so synthetic traffic is excluded using the X-Blog-Check header (with provenance in the value) instead of relying primarily on user agent coincidence, and documents how to handle manual probes in that model.

Changes:

Replaces the “filter by user agent” primary method with a header-based jq filter (request_X-Blog-Check).
Documents provenance/value semantics for X-Blog-Check, including how to tag interactive/manual probes.
Retains user-agent-based guidance for dates before the header existed in logs.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

The examples were angle-bracket placeholders, and the tag is validated: exactly one slash, letters, digits, dot, underscore, hyphen. Pasting one of those literally is refused, so the section now shows values that work and says the shape is enforced rather than conventional. The larger omission is that the filter depends on something this repository does not own. `request_X-Blog-Check` appears only because the edge is configured to log that header, so an absent field means either an untagged request or a capture that stopped, and the log alone does not distinguish them. Reading a day of absence as a day of real traffic is the wrong answer that shape produces. Both found by review, which is also the general form the host side named: before believing a negative, establish that the check could have produced a positive. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

OPERATIONS.md:274

The curl example uses proxmox/<what>, but this section also states the tag shape is restricted to letters/digits plus ._- with exactly one / (and the repo enforces that in check-live-urls.sh). Showing an angle-bracket placeholder inside a copy/pasteable curl -H command is likely to be taken literally and it doesn’t match the documented/validated shape. Prefer an example value that actually conforms (e.g. proxmox/manual or proxmox/media-dev) and describe how to choose an appropriate id.

- **A hand probe carries it only because whoever runs it adds it.** `check-live-urls.sh` sends it on every request and a bare `curl` sends nothing, so an interactive probe passes `-H "X-Blog-Check: proxmox/<what>"`, naming the purpose rather than the host. Two untagged probes turned up against 3,100 tagged ones in the 2026-08-09 deploy window.

The prose examples were corrected and the curl one-liner was not, which is the one a reader actually copies. It now carries proxmox/media-dev. ENVIRONMENT.md keeps its angle brackets deliberately. There they describe the enforced grammar and the value the script derives under Actions, neither of which anyone types, and the settable example beside them is already a real one. Found by Copilot review on #81, as a suppressed comment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ptr727 · 2026-08-09T16:45:31Z

Fixed in 8558458, and the miss is a neat one: I corrected the prose examples last round and left the placeholder inside the curl -H — the one thing on the page that is actually meant to be copied.

-H "X-Blog-Check: proxmox/media-dev"

Naming the purpose of the probe rather than the host, in the same character set as any other tag.

ENVIRONMENT.md keeps its angle brackets deliberately, which is worth stating rather than leaving as an inconsistency for someone to trip over later. There, <source>/<id> describes the enforced grammar and github/<run-id>-<attempt> describes the value the script derives under Actions. Nobody types either, and the settable example beside them is already a real one (proxmox/media-dev).

The line I am drawing: a described grammar keeps its placeholders, a copy-pasteable command does not. Swept both files and the shell script; that curl was the only place on the wrong side of it.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

OPERATIONS.md:270

This paragraph says "every synthetic request" carries X-Blog-Check, but the section later notes a hand curl probe sends no header unless the user adds -H .... Tightening the wording here avoids implying that all synthetic traffic is automatically tagged.

The mechanism is the `X-Blog-Check` request header, which every synthetic request announces itself with, so `jq 'select(.["request_X-Blog-Check"] == null)'` is the whole filter. Its value is a source and an id rather than a boolean, so a run is identifiable rather than merely excludable, and real values look like `github/31322640628-1` from CI, `vps/smoke` from the host side, and `proxmox/media-dev` from here. The shape is enforced by `check-live-urls.sh`, which takes exactly one `/` and only letters, digits, `.`, `_`, `-`, so a placeholder written with angle brackets is a description rather than something to paste.

The lead said every synthetic request announces itself, and the bullet below it said a hand curl sends nothing unless someone adds the header. The section contradicted itself in the direction that flatters the filter, which is the direction that produces a wrong answer nobody checks. It now says the scripted checks send it on every request they make, and that the filter is only as complete as the tagging is. Found by Copilot review on #81, as a suppressed comment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ptr727 · 2026-08-09T16:49:20Z

Fixed. Right, and the section was contradicting itself: the lead claimed every synthetic request announces itself, and the bullet immediately below said a hand curl sends nothing unless someone adds the header.

It contradicted itself in the direction that flatters the filter — which is the direction that produces a wrong answer nobody goes looking for, since an over-complete-sounding filter just makes the visitor set look clean.

Now:

which the scripted checks send on every request they make … It is only as complete as the tagging is, which is the first bullet below.

That is three findings on this PR and all three are the same defect: a claim stronger than the thing it describes. Placeholders that would not validate, a filter with an unstated precondition, and now a completeness claim the next paragraph refutes. Consistent enough to be worth naming rather than fixing one at a time.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

OPERATIONS.md:274

The sentence “naming the purpose of the probe rather than the host” is ambiguous/misleading given the enforced <source>/<id> shape: the proxmox portion is explicitly the source (origin), while the purpose is carried in the <id> half (e.g. media-dev). Clarifying this avoids readers thinking the whole value should be “purpose-only” or that proxmox is meant to be a purpose label.

- **A hand probe carries it only because whoever runs it adds it.** `check-live-urls.sh` sends it on every request and a bare `curl` sends nothing, so an interactive probe passes `-H "X-Blog-Check: proxmox/media-dev"`, naming the purpose of the probe rather than the host, in the same character set as any other tag. Two untagged probes turned up against 3,100 tagged ones in the 2026-08-09 deploy window.

"Naming the purpose rather than the host" implied the whole value is a purpose label, when proxmox is the source half and only the id half is free. A reader following that would have written something like media-dev/probe, inverting the grammar the section just described. Found by Copilot review on #81, as a suppressed comment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ptr727 · 2026-08-09T16:53:20Z

Fixed. Correct — proxmoxis the source half, and my wording said the value should name "the purpose rather than the host", which inverts the grammar the same paragraph had just defined. A reader following it would plausibly have written media-dev/probe.

Now:

The source half stays proxmox, which is where the probe came from, and the id half is where the purpose goes.

Fourth finding, same defect class as the other three: text that describes something other than what it describes. This one is the sharpest version, because the sentence contradicted a rule stated two lines above it.

Copilot