Cross-checked internal/privacy against the batch companion-app report over
project/rma. Fixes for the dominant false-positive classes:
- Real-TLD gate (tld.go): FQDN/e-mail must end in a curated TLD or a
pseudo-TLD with a >=3-char label; two-letter file/code suffixes
(.sh .so .md .id .service ...) are a hard denylist. Kills "0.linux"
(45996 hits), "mountall.sh", "libc.so", "@odata.id",
"serial-getty@ttyAMA0.service".
- Clean-token boundary + Title-case reject: "auth.backend.gssapi.store-creds",
"OS.It" are code, not hosts.
- Kernel ring-buffer ("[ 8.07][ T1] ...") and Go stack-trace lines skipped.
- resolv domain/search values must contain a dot ("domain 53" -> out).
- IPv4: skip comment lines, version/spec lines (X.Org, IEEE Std, l0fw_ver),
"0."/"1."/".0" quads; allowlist Yandex resolvers + RFC3849 2001:db8::/32.
- fru_location: drop all-digit / serial-like / field-name-echo values.
- Drop the hostname rule (zero real hits, only "bmc-state-manager" noise).
- domain category: high -> low, medium at 3+ labels. Real customer signal
now comes from resolv/nsupdate/ad_ldap/mgmt, which the corpus confirms
catches every actual customer (netwell.local, tcsbank.ru).
- Allowlist smartmontools.org, openib.org, apache.org, freebsd.org,
golang.org, ipxe.org, nvidia.com and other FOSS/vendor infra; skip
LOGPile's own raw_export.json / parser_fields.json / collect.log members.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
