- scanner.run now persists exposure_state/detail/capabilities for scanned
assets (previously only the index was written).
- Backfill runs a bounded worker pool (16) so it verifies reachable assets
without saturating the DB pool; DB_MAX_CONNS raised for the live test.
- CNAME enrichment queue is now a bounded random sample instead of a FIFO.
The FIFO filled with the first N hostnames seen at startup and dropped the
rest, so CNAME discovery only ever saw stale hostnames; random replacement
gives representative coverage at bounded memory (same fix as the prober).
Verified live:
- all four known-public resources scan + index (DO, AWS s3-<region>, GCS,
Azure container path), 38-1000 objects each.
- backfill of every CT-discovered 'reachable' asset (725) and 'auth_required'
(12) completed with 0 listable: those are MRAP/non-bucket 400s and
list-denied buckets, confirming the checks are actually running.
StasonJatham
171c9b37eb