mvn appengine:stage - standard environment - where does the automagical app.yaml come from?

Question

I am using mvn and appengine-maven-plugin to stage and deploy my app engine standard project for java 8. This works locally, but the deployed project stopped working, and if I look at target/appengine-staging/app.yaml there are some mystery non-working routes in there, and the standard /.* route is gone.

Where can I find some information about what is generating app.yaml and what it is referencing to build these handlers? They look similar to some real routes, but don't exactly match.

mvn appengine:stage -DskipTests -Dspring.profiles.active=development
# ./target/appengine-staging/app.yaml contains bad handlers

My apppengine-web.xml

<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
  <threadsafe>true</threadsafe>
  <sessions-enabled>true</sessions-enabled>
  <runtime>java8</runtime>
  <instance-class>B1</instance-class>
  <basic-scaling>
    <max-instances>1</max-instances>
    <idle-timeout>10m</idle-timeout>
  </basic-scaling>
  <env-variables>
    <env-var name="SPRING_PROFILES_ACTIVE" value="development" />
  </env-variables>
</appengine-web-app>

My web.xml

<web-app xmlns="http://java.sun.com/xml/ns/javaee" version="2.5">
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>tasks</web-resource-name>
            <url-pattern>/**/delete_handler</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>admin</role-name>
        </auth-constraint>
    </security-constraint>
</web-app>

WebSecurityConfigurerAdapter

@Configuration
@EnableWebSecurity
public class ApplicationSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(WebSecurity web) throws Exception {
        web
          .ignoring()
            .antMatchers("/**/health")
            .antMatchers("/**/delete_handler")
            ;
      }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
        .authorizeRequests()
            .antMatchers("/**/health").permitAll()
            .antMatchers("/**/delete_handler").permitAll()
            .antMatchers("/_ah/*").permitAll()
            .anyRequest().authenticated()
            .and().httpBasic();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
         // snip
    }

}

Generated non-working app.yaml

runtime: java8
instance_class: B1
basic_scaling:
  max_instances: 1
  idle_timeout: 10m
inbound_services:
- warmup
derived_file_type:
- java_precompiled
threadsafe: True
auto_id_policy: default
env_variables:
  'SPRING_PROFILES_ACTIVE': 'development'
api_version: '1.0'
handlers:
- url: /
  script: unused
  login: optional
  secure: optional
- url: /_ah/.*.*.*/delete_handler
  script: unused
  login: admin
  secure: optional
- url: /.*/
  script: unused
  login: optional
  secure: optional
- url: /_ah/.*
  script: unused
  login: optional
  secure: optional

skip_files: app.yaml