Agent-ready workflow · recon

Archive to Live Route Reconciliation

Turn Wayback, Common Crawl, and public urlscan artifacts into a source-linked route delta, then promote only currently reachable in-scope behavior.

waybackcommon-crawlurlscanhistorical-urlssurface-delta
Stable IDworkflow:archive-to-live-route-reconciliationSource record dateHuman reviewNot recordedProvenanceCurated workflow graph

Enter with artifacts, leave with evidence.

Use when
  • archive-only endpoint
  • old JavaScript route
  • renamed API
  • historical parameter
  • post-migration review
Prerequisites
  • dated scope snapshot
  • public archive use allowed
  • low-rate live verification budget
MCP retrieval

Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.

01

Snapshot each archive source

Cache bounded Wayback CDX, Common Crawl CDXJ, and public urlscan search results with exact query, index, filters, and retrieval time.

Inputs
  • approved roots
  • query manifest
Outputs
  • immutable source snapshots
  • retrieval manifest
Evidence gate
Every historical row retains source, source timestamp, original URL, and raw snapshot reference.
Negative control
A known off-root or excluded name is rejected during normalization.
Stop condition
Do not submit private targets as public scans or query outside approved roots.
02

Cluster route families

Normalize host case and fragments, then group paths, parameters, extensions, scripts, and operation nouns without losing original values.

Inputs
  • source snapshots
Outputs
  • route families
  • parameter vocabulary
  • script inventory
Evidence gate
Every normalized member links back to at least one exact source row.
Negative control
Third-party and shared-service URLs remain separate from target-owned candidates.
Stop condition
Do not replay archived request bodies, tokens, or personal data.
03

Compare current behavior

Probe only current in-scope candidate URLs at a bounded rate and retain status, redirect, content type, body length, title, and timestamp.

Inputs
  • prioritized candidate URLs
  • current known route
  • random nonexistent route
Outputs
  • current response ledger
  • archive-to-live state labels
Evidence gate
A promoted URL has a current response plus both known-route and nonexistent-route controls.
Negative control
Uniform CDN, wildcard, soft-404, and redirect behavior is identified before a route is called reachable.
Stop condition
No state-changing methods, archived POST bodies, or broad replay.
04

Promote a falsifiable lead

Rank independent-source agreement, route sensitivity, current behavior, and safe test cost, then assign one discriminator.

Inputs
  • route delta
  • control results
Outputs
  • evidence-backed lead
  • decay date
  • next discriminator
Evidence gate
The lead separates historical fact, current observation, inference, and untested security claim.
Negative control
Archive-only and dead routes remain historical notes rather than active leads.
Stop condition
Stop when current behavior cannot distinguish the candidate from the control.

Continue with the right depth.

References