← back to Domain Sniper

ct-source-certspotter: mark both adapters STALLED with reactivate-when

d315f313df63ec3455e723ebd17268131cd46528 · 2026-05-12 18:27:28 -0700 · steve

Neither cert-spotter adapter is consumed by any current watcher — all
shipped watchers (watch-ct, brand-typo-watcher, dashboard) now talk
directly to CT logs via ct-source-ctlog. Both files preserved (not
deleted) because their emit-payload shape matches what the watchers
already consume, so reactivation when a paid CERTSPOTTER_API_KEY
lands is a one-env-var change with no refactor.

Added top-of-file STATUS / REACTIVATE WHEN blocks so anyone reading
sees the current dead-codepath status before assuming they work.

Files touched

• M ct-source-certspotter-brands.js
• M ct-source-certspotter.js

Diff

commit d315f313df63ec3455e723ebd17268131cd46528
Author: steve <steve@designerwallcoverings.com>
Date:   Tue May 12 18:27:28 2026 -0700

    ct-source-certspotter: mark both adapters STALLED with reactivate-when
    
    Neither cert-spotter adapter is consumed by any current watcher — all
    shipped watchers (watch-ct, brand-typo-watcher, dashboard) now talk
    directly to CT logs via ct-source-ctlog. Both files preserved (not
    deleted) because their emit-payload shape matches what the watchers
    already consume, so reactivation when a paid CERTSPOTTER_API_KEY
    lands is a one-env-var change with no refactor.
    
    Added top-of-file STATUS / REACTIVATE WHEN blocks so anyone reading
    sees the current dead-codepath status before assuming they work.
---
 ct-source-certspotter-brands.js | 15 ++++++++++++++-
 ct-source-certspotter.js        | 19 +++++++++++++++++--
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/ct-source-certspotter-brands.js b/ct-source-certspotter-brands.js
index 7d14465..3682e2f 100644
--- a/ct-source-certspotter-brands.js
+++ b/ct-source-certspotter-brands.js
@@ -1,4 +1,17 @@
-// ct-source-certspotter-brands.js — per-brand polling wrapper around the
+// ct-source-certspotter-brands.js
+//
+// STATUS (2026-05-13): STALLED. Not consumed by any current watcher.
+//   - Free tier returns HTTP 403 not_allowed_by_plan when domain= is a bare
+//     brand stem (callr, butlr). Only fully-qualified domain names are
+//     accepted, which defeats typo-squat defense (we don't know the squat's
+//     full FQDN in advance).
+//   - All shipped watchers moved to ct-source-ctlog (direct RFC-6962 polling).
+//
+// REACTIVATE WHEN: Steve provisions a paid CERTSPOTTER_API_KEY via the secrets
+// skill. Per-FQDN polling becomes useful in paid mode for known-target domains
+// (e.g. monitoring exact brand FQDNs after registration).
+//
+// Original purpose: per-brand polling wrapper around the
 // Cert Spotter free tier. Cycles through Steve's brand keywords, hitting
 // /v1/issuances?domain=<kw> for each. Emits the same cert_update events as
 // ct-source-certspotter.js so existing watchers (brand-typo-watcher, etc.)
diff --git a/ct-source-certspotter.js b/ct-source-certspotter.js
index 38b7e98..87475de 100644
--- a/ct-source-certspotter.js
+++ b/ct-source-certspotter.js
@@ -1,5 +1,20 @@
-// ct-source-certspotter.js — Cert Spotter REST fallback for when
-// certstream.calidog.io is dead. Polls https://api.certspotter.com/v1/issuances
+// ct-source-certspotter.js
+//
+// STATUS (2026-05-13): STALLED. Not consumed by any current watcher.
+//   - Free anonymous tier returns HTTP 400 (requires domain= per request).
+//   - Free per-brand mode lives in ct-source-certspotter-brands.js (also stalled).
+//   - All shipped watchers (watch-ct, brand-typo-watcher, dashboard) moved to
+//     ct-source-ctlog (direct RFC-6962 CT-log polling, no middleman). See README
+//     section "Known issues — public CT-log infrastructure is fragile".
+//
+// REACTIVATE WHEN: Steve provisions a paid CERTSPOTTER_API_KEY via the secrets
+// skill. The adapter is intentionally preserved (not deleted) because its
+// emit-payload shape matches what the watchers already consume — so the only
+// changes needed on reactivation are: set the env var, swap CT_SOURCE=certspotter
+// in the consuming watcher, and remove this STALLED note. No code refactor.
+//
+// Original purpose: Cert Spotter REST fallback for when certstream.calidog.io
+// is dead. Polls https://api.certspotter.com/v1/issuances
 // and emits 'certificate_update' events with the same payload shape consumers
 // of CertStream already expect:
 //   { message_type:'certificate_update',

← 02d8f7f watch-ct: migrate to ct-source-ctlog (6-log fan-out, default  ·  back to Domain Sniper  ·  register: refuse re-registration of domains in data/owned.js ed0c01f →