client-1 · executive report

the last 7 days 20 Oct 2026 to 26 Oct 2026 18:21 UTC

At a glance

Settings watched1,352

in 116 objects of the latest passing runs

Coverage101 of 116

objects with an approval of record, 87%

Copies with a valid restore112 of 112

42 ok · 70 with gaps · 0 fail

Drift events27

findings first raised in the period; 27 findings with a decision in it

Change to detection-

none of the period's 1 cause carries the time of the change

Actions0

done 0 · unverified 0 · failed 0 · refused 0 · not judged 0

Findings and actions

Findings per day by verb

Each finding with a decision that day, by its last verb of the day.

ESCALATE
HOLD
ADOPT

Day (UTC)	ESCALATE	HOLD	ADOPT	Total
24 Oct 2026	0	27	0	27
25 Oct 2026	1	3	23	27

The other 5 days of the period count 0.

Actions per day by kind and status

Each action the Actor recorded that day, by kind and status.

Every day of the period counts 0 actions.

Probes and approvals

Failing probes per day

Each name that failed a probe of a kind at least once that day, by kind.

dns
http
tls

Day (UTC)	dns	http	tls	Total	Names probed
24 Oct 2026	3	10	7	20	111
25 Oct 2026	3	10	7	20	111

The other 5 days of the period count 0.

Approvals over time

Settings with an approval of record at the end of each day.

Settings with an approval

Day (UTC)	Approvals recorded	Settings with an approval
24 Oct 2026	333	333
26 Oct 2026	0	333

The other 5 days of the period record no approval; the line holds the day before's value.

Incidents of the period1

HOLDESCALATEName and its www treated differently by the proxy

DNS record host-524b42.quest (proxied) · zone host-4c795e.quest

Cause: No record of who changed it: the audit log window of 18 h holds 0 events for the record.
The agent: The agent changed nothing: an escalation goes to a technician.
Ticket: #2 incident, P1, open

decided 24 Oct 2026 23:21 UTC to 25 Oct 2026 14:17 UTC · fnd-b4a40091cdb4f906

Sources and DQ gates

Source	Runs in the period	Pass the gate	Latest run	DQ gate
DNS records every zone's records, each field as the provider returns it	12	12	58 of 58, 25 Oct 2026 13:53 UTC	passes
Provider audit log who changed which record and when	12	12	1,014 of 1,014, 25 Oct 2026 13:53 UTC	passes
nginx on host-4b4dc1 each vhost file and setting, read over SSH	13	13	14 of 14, 25 Oct 2026 13:53 UTC	passes
nginx on host-aa516a each vhost file and setting, read over SSH	13	13	24 of 24, 25 Oct 2026 13:53 UTC	passes
Probes from outside the http, dns and tls answers of every served name	11	11	111 of 111, 25 Oct 2026 13:54 UTC	passes

DQ rules over the period

holds run_complete on collection: 61 of 61 collection runs started in the period pass: the run read every object it set out to read
holds copy_validated on copy: 112 of 112 vault copies at the heads validated: 42 ok, 70 ok with gaps, 0 fail
holds action_verified on action: 0 of 0 actions of the period hold it: every completed write carries a verification probe
holds cause_evidenced on cause: 1 of 1 cause of the period name their evidence or read unknown
holds exception_in_force on adoption: 23 of 23 ADOPTs under an accepted exception in the period join a lesson in force
not read dns_inventory_current on dns_live: the rule reads the Cloudflare DNS API live through Zetaris, and the recorded bundle holds no live read

Receipts

Receipts verified384 of 384

Ed25519 signatures in eval/results/2026-10-25T23-34-17Z, 6 receipts withheld, 0 mismatches; 390 of 390 Nemotron calls record a verified signature

Ultra alone vs the checks with Ultra as the falsifier

6, 5, 6 of 9items labelled no that Ultra alone (C4) reads as yes, runs 1, 2 and 3
0, 0, 0 of 9items labelled no that the checks with Ultra as the falsifier (C3) read as yes, runs 1, 2 and 3
9, 8, 8 of 10planted false claims struck by C3, runs 1, 2 and 3

From eval/results/2026-10-25T23-34-17Z, the dev set.

The actions of client-1 in the period name 0 receipt ids.