client-1pass decided 25 Oct 2026 14:17 UTCsample mode

Trace cycle_mvo2bil0

examples/traces/cycle_mvo2bil0.jsonl, 993 events from 25 Oct 2026 16:49 UTC to 25 Oct 2026 16:51 UTC. All traces

About this page

Every free-text field passes the redactor as the trace did when it was written, and a ticket's URL reads as its number.

993 events
Time (UTC)AgentActionStatusSummary
16:49:12.842vaultobserveokvault: run run-576e5a1e0ae32b39 committed to client-1/cloudflare at a1a22f1d148f: 58 file(s), 0 added, 1 modified, 0 removed; vault_copy 58 row(s) written of 58cloudflare.dns run run-576e5a1e0ae32b39
16:49:12.979cycletriageokcollect:cloudflare: dns run-576e5a1e0ae32b39 58/58 complete (6 zones, 58 records), audit run-ab19eb70735c2463 1145/1145 complete; vault committed a1a22f1d148f (58 files, 0 added, 1 modified, 0 removed; vault_copy 58 written)cycle client-1 [1/9] collect:cloudflare
16:49:15.725host-a6a917.linuxobserveok184996 bytes, exit 0ssh -o BatchMode=yes -o ConnectTimeout=15 word-1ef544-vps bash -s
16:49:15.777host-a6a917.linuxobserveokword-1ef544-vps -> host-aa516a: complete, expected 24 observed 24, 761 observations, 46 server blocks, 5 assets, 8 snapshots, 82 backup items
16:49:16.249vaultobserveokvault: run run-a8590cdc5428b8d4 committed to client-1/host-aa516a at 8fbbd7c2abaa: 32 file(s), 0 added, 0 modified, 0 removed; vault_copy 32 row(s) written of 32linux.nginx run run-a8590cdc5428b8d4
16:49:16.250cycletriageokcollect:linux word-1ef544-vps: host-aa516a run run-a8590cdc5428b8d4 24/24 complete, 761 observation(s) written of 761, 46 server blocks, 82 backup items; vault committed 8fbbd7c2abaa (32 files, 0 added, 0 modified, 0 removed; vault_copy 32 written)cycle client-1 [2/9] collect:linux word-1ef544-vps
16:49:19.224host-a6a917.linuxobserveok88979 bytes, exit 0ssh -o BatchMode=yes -o ConnectTimeout=15 word-51eb89-vps bash -s
16:49:19.240host-a6a917.linuxobserveokword-51eb89-vps -> host-4b4dc1: complete, expected 14 observed 14, 301 observations, 30 server blocks, 2 assets, 8 snapshots, 73 backup items
16:49:19.626vaultobserveokvault: run run-aed985591cd03b16 committed to client-1/host-4b4dc1 at 43aec8e4090b: 22 file(s), 0 added, 0 modified, 0 removed; vault_copy 22 row(s) written of 22linux.nginx run run-aed985591cd03b16
16:49:19.626cycletriageokcollect:linux word-51eb89-vps: host-4b4dc1 run run-aed985591cd03b16 14/14 complete, 301 observation(s) written of 301, 30 server blocks, 73 backup items; vault committed 43aec8e4090b (22 files, 0 added, 0 modified, 0 removed; vault_copy 22 written)cycle client-1 [3/9] collect:linux word-51eb89-vps
16:49:27.717cycletriageokprobe: run run-203b488a21557488 117/117 complete, 39 name(s); http 29 ok, 10 fail; dns 35 ok, 4 fail; tls 32 ok, 7 fail; 117 probe row(s) writtencycle client-1 [4/9] probe
16:49:30.516cycletriageokvalidate:copies: 3 repositories at their heads, 3 of them this cycle's commits; copy_validation 112 row(s) written of 112 (cf-schema ok 41, cf-schema ok_with_gaps 17, nginx-t ok_with_gaps 54); 0 repositories not validatedcycle client-1 [5/9] validatehost word-1ef544-vps @8fbbd7c2 (run run-a8590cdc5428b8d4, 32 files, 0 links): nginx-t ok_with_gaps, 1 round, 16 gaps: /etc/letsencrypt/live/host-18efce.ai/fullchain.pem, /etc/letsencrypt/live/host-18efce.ai/privkey.pem, /etc/letsencrypt/live/host-492568.ai/fullchain.pem, /etc/letsencrypt/live/host-492568.ai/privkey.pem, /etc/letsencrypt/live/host-503b27.ai/fullchain.pem, /etc/letsencrypt/live/host
16:49:30.637loopqueryok106 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM DRIFT.collection_run ORDER BY started_at, run_id
16:49:30.727observerqueryok106 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM DRIFT.collection_run ORDER BY started_at, run_id
16:49:30.829deciderqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
16:49:31.007deciderqueryok24 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM host-cc7cb1.dispositio
16:49:31.107deciderqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
16:49:31.250deciderqueryok7 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM host-cc7cb1.dispositio
16:49:31.426observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f9470e2f5f175899
16:49:31.426observercheckokcloudflare.dns: 58/58 completerun_complete run-f9470e2f5f175899
16:49:31.590observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-507c9939230e60a4
16:49:31.590observercheckokcloudflare.audit: 728/728 completerun_complete run-507c9939230e60a4
16:49:31.762observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-67f4d6923cb4838d
16:49:31.762observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-67f4d6923cb4838d
16:49:31.928observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-15638d43819ba756
16:49:31.928observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-15638d43819ba756
16:49:32.095observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b69af94952dccb36
16:49:32.095observercheckokcloudflare.dns: 58/58 completerun_complete run-b69af94952dccb36
16:49:32.259observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9a3335b91e5ef3c3
16:49:32.259observercheckokcloudflare.audit: 797/797 completerun_complete run-9a3335b91e5ef3c3
16:49:32.436observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-071329fedf5f073f
16:49:32.437observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-071329fedf5f073f
16:49:32.622observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4592b852a04812f7
16:49:32.622observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-4592b852a04812f7
16:49:32.826observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e9f519d6a5af0fd0
16:49:32.827observercheckokprobe: 111/111 completerun_complete run-e9f519d6a5af0fd0
16:49:32.994observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-de1564466df1d59b
16:49:32.995observercheckokcloudflare.dns: 58/58 completerun_complete run-de1564466df1d59b
16:49:33.161observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-91f4abd4904e22a6
16:49:33.161observercheckokcloudflare.audit: 818/818 completerun_complete run-91f4abd4904e22a6
16:49:33.327observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-81adedc1cc778bd5
16:49:33.327observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-81adedc1cc778bd5
16:49:33.491observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ace5f05819e5b28e
16:49:33.491observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ace5f05819e5b28e
16:49:33.655observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b247c87d34f38d71
16:49:33.655observercheckokprobe: 111/111 completerun_complete run-b247c87d34f38d71
16:49:33.819observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-59ffd380cfc7cda5
16:49:33.820observercheckokcloudflare.dns: 58/58 completerun_complete run-59ffd380cfc7cda5
16:49:33.983observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-527d9eb092475404
16:49:33.984observercheckokcloudflare.audit: 839/839 completerun_complete run-527d9eb092475404
16:49:34.150observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-400375137e2bae7b
16:49:34.150observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-400375137e2bae7b
16:49:34.314observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-647f878a4f5605f7
16:49:34.315observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-647f878a4f5605f7
16:49:34.483observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-30f5647b8b9c5dff
16:49:34.484observercheckokprobe: 111/111 completerun_complete run-30f5647b8b9c5dff
16:49:34.647observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-8c5af1ac22c54514
16:49:34.647observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-8c5af1ac22c54514
16:49:34.816observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-43c8ccb3704ad21c
16:49:34.816observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-43c8ccb3704ad21c
16:49:34.981observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9e232bb5e1ebdb81
16:49:34.982observercheckokcloudflare.dns: 58/58 completerun_complete run-9e232bb5e1ebdb81
16:49:35.146observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-bbf110bf21466ecc
16:49:35.146observercheckokcloudflare.audit: 860/860 completerun_complete run-bbf110bf21466ecc
16:49:35.310observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-49fc76bf3b823051
16:49:35.310observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-49fc76bf3b823051
16:49:35.484observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ea10fdeb1eae1a46
16:49:35.484observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ea10fdeb1eae1a46
16:49:35.654observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e839e796556a54c3
16:49:35.654observercheckokprobe: 111/111 completerun_complete run-e839e796556a54c3
16:49:35.842observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-74140124db03c3f5
16:49:35.842observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-74140124db03c3f5
16:49:36.008observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-afe5a89ee42acbc2
16:49:36.009observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-afe5a89ee42acbc2
16:49:36.172observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-90bdfa86df88a639
16:49:36.172observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-90bdfa86df88a639
16:49:36.338observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-33b1aa9a8f89d3c8
16:49:36.338observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-33b1aa9a8f89d3c8
16:49:36.503observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ce4dc382bcffa4bb
16:49:36.503observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-ce4dc382bcffa4bb
16:49:36.666observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1f4d84ed6359ff18
16:49:36.666observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-1f4d84ed6359ff18
16:49:36.832observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-463c7c0ce537bd16
16:49:36.832observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-463c7c0ce537bd16
16:49:36.995observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f97423f25dc75884
16:49:36.996observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f97423f25dc75884
16:49:37.163observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-6b65e048bb60fc24
16:49:37.163observercheckokcloudflare.dns: 58/58 completerun_complete run-6b65e048bb60fc24
16:49:37.329observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f6b79eeae02db225
16:49:37.330observercheckokcloudflare.audit: 888/888 completerun_complete run-f6b79eeae02db225
16:49:37.500observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f6c7da2a579e2141
16:49:37.501observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f6c7da2a579e2141
16:49:37.670observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-258ffc0f34ffab51
16:49:37.670observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-258ffc0f34ffab51
16:49:37.837observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-446db683143ec580
16:49:37.837observercheckokprobe: 111/111 completerun_complete run-446db683143ec580
16:49:38.003observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e476cc64252f6715
16:49:38.003observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-e476cc64252f6715
16:49:38.170observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-d1fcc061e5c34158
16:49:38.171observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-d1fcc061e5c34158
16:49:38.337observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-2c3fc585f404b90f
16:49:38.337observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-2c3fc585f404b90f
16:49:38.510observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-396c20fb165306ed
16:49:38.510observercheckokprobe: 6/6 completerun_complete run-396c20fb165306ed
16:49:38.676observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-0f5afdbf81b5b05a
16:49:38.676observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-0f5afdbf81b5b05a
16:49:38.865observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f509f49299848d43
16:49:38.865observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f509f49299848d43
16:49:39.032observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-41e44e7c818c214d
16:49:39.032observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-41e44e7c818c214d
16:49:39.195observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-588dc39d3f984621
16:49:39.195observercheckokhost-a08b07.verify: 2/2 completerun_complete run-588dc39d3f984621
16:49:39.360observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b78229c438b759eb
16:49:39.360observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-b78229c438b759eb
16:49:39.523observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-5307a4b4884f8f8d
16:49:39.524observercheckokhost-a08b07.verify: 2/2 completerun_complete run-5307a4b4884f8f8d
16:49:39.688observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-71776a91583187d1
16:49:39.688observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-71776a91583187d1
16:49:39.850observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-643ca3aadc62f002
16:49:39.851observercheckokcloudflare.dns: 58/58 completerun_complete run-643ca3aadc62f002
16:49:40.015observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-3fcba77d90340f5d
16:49:40.016observercheckokcloudflare.audit: 909/909 completerun_complete run-3fcba77d90340f5d
16:49:40.179observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b094ed4249e79faf
16:49:40.179observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-b094ed4249e79faf
16:49:40.346observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-028e1c06567f1445
16:49:40.346observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-028e1c06567f1445
16:49:40.515observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-af82fe9cd0f12826
16:49:40.516observercheckokprobe: 111/111 completerun_complete run-af82fe9cd0f12826
16:49:40.680observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-63bc01583b366b8d
16:49:40.681observercheckokcloudflare.dns: 58/58 completerun_complete run-63bc01583b366b8d
16:49:40.853observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-8b02f9aad70df0c9
16:49:40.853observercheckokcloudflare.audit: 930/930 completerun_complete run-8b02f9aad70df0c9
16:49:41.018observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-c52288c22d5992fd
16:49:41.019observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-c52288c22d5992fd
16:49:41.184observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-df60a03b49bbda47
16:49:41.184observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-df60a03b49bbda47
16:49:41.350observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f79e58d09c04c8d7
16:49:41.350observercheckokprobe: 111/111 completerun_complete run-f79e58d09c04c8d7
16:49:41.525observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-93f3f163d3d8a95d
16:49:41.525observercheckokcloudflare.dns: 58/58 completerun_complete run-93f3f163d3d8a95d
16:49:41.690observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f9954452442b0cd1
16:49:41.690observercheckokcloudflare.audit: 951/951 completerun_complete run-f9954452442b0cd1
16:49:41.868observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-2a11f407cfdce7b6
16:49:41.869observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-2a11f407cfdce7b6
16:49:42.048observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-d594486e164c4097
16:49:42.048observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-d594486e164c4097
16:49:42.211observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-84b6426b9763f7f1
16:49:42.211observercheckokprobe: 111/111 completerun_complete run-84b6426b9763f7f1
16:49:42.380observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-199d9e1bdc86bf4d
16:49:42.380observercheckokcloudflare.dns: 58/58 completerun_complete run-199d9e1bdc86bf4d
16:49:42.551observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-cf8eb79048a18bc9
16:49:42.551observercheckokcloudflare.audit: 972/972 completerun_complete run-cf8eb79048a18bc9
16:49:42.730observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-439d1fb53664c597
16:49:42.730observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-439d1fb53664c597
16:49:42.898observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-209d57362e152a70
16:49:42.898observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-209d57362e152a70
16:49:43.064observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-02925c58440a149c
16:49:43.064observercheckokprobe: 111/111 completerun_complete run-02925c58440a149c
16:49:43.229observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-480602f60ca854c6
16:49:43.229observercheckokcloudflare.dns: 58/58 completerun_complete run-480602f60ca854c6
16:49:43.395observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f98b965de7012d0b
16:49:43.395observercheckokcloudflare.audit: 993/993 completerun_complete run-f98b965de7012d0b
16:49:43.560observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-573b3e958d5799a2
16:49:43.561observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-573b3e958d5799a2
16:49:43.726observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ee1c61b44a6d6e01
16:49:43.727observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ee1c61b44a6d6e01
16:49:43.893observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-20f146f855acc7b9
16:49:43.893observercheckokprobe: 111/111 completerun_complete run-20f146f855acc7b9
16:49:44.060observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9d48791b00433777
16:49:44.060observercheckokcloudflare.dns: 58/58 completerun_complete run-9d48791b00433777
16:49:44.227observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-77ae40d31854071c
16:49:44.227observercheckokcloudflare.audit: 1014/1014 completerun_complete run-77ae40d31854071c
16:49:44.393observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f74b40064e093f2c
16:49:44.393observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f74b40064e093f2c
16:49:44.560observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-28ad36002e466ed5
16:49:44.560observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-28ad36002e466ed5
16:49:44.741observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7a3ff25f0476b93f
16:49:44.742observercheckokprobe: 111/111 completerun_complete run-7a3ff25f0476b93f
16:49:44.919observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-01c5106777ec2426
16:49:44.919observercheckokcloudflare.dns: 58/58 completerun_complete run-01c5106777ec2426
16:49:45.097observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1d846f0834ec0803
16:49:45.097observercheckokcloudflare.audit: 1036/1036 completerun_complete run-1d846f0834ec0803
16:49:45.263observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-22c36b45028d6029
16:49:45.263observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-22c36b45028d6029
16:49:45.428observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-951d5140591a7f6a
16:49:45.429observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-951d5140591a7f6a
16:49:45.592observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4f41e1f662be63b5
16:49:45.592observercheckokprobe: 111/111 completerun_complete run-4f41e1f662be63b5
16:49:45.760observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-fab71c1a5a8fc015
16:49:45.760observercheckokcloudflare.dns: 58/58 completerun_complete run-fab71c1a5a8fc015
16:49:45.936observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b19145b1ac6e00d5
16:49:45.936observercheckokcloudflare.audit: 1058/1058 completerun_complete run-b19145b1ac6e00d5
16:49:46.100observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1f949ba3c2557d42
16:49:46.101observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-1f949ba3c2557d42
16:49:46.265observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-53c7e1dc36402eca
16:49:46.265observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-53c7e1dc36402eca
16:49:46.432observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-519f93197de9adf6
16:49:46.432observercheckokprobe: 111/111 completerun_complete run-519f93197de9adf6
16:49:46.597observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e1e626eaa8ec20aa
16:49:46.597observercheckokprobe: 117/117 completerun_complete run-e1e626eaa8ec20aa
16:49:46.764observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-0b0dc83717dd3728
16:49:46.764observercheckokcloudflare.dns: 58/58 completerun_complete run-0b0dc83717dd3728
16:49:46.928observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-af44e31de1d0bb30
16:49:46.929observercheckokcloudflare.audit: 1101/1101 completerun_complete run-af44e31de1d0bb30
16:49:47.093observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-6c2480894f434d74
16:49:47.093observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-6c2480894f434d74
16:49:47.260observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-35ba6c1a2a987888
16:49:47.260observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-35ba6c1a2a987888
16:49:47.427observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7bbe33a8f55a93ed
16:49:47.427observercheckokprobe: 117/117 completerun_complete run-7bbe33a8f55a93ed
16:49:47.596observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-68748435ad32367d
16:49:47.596observercheckokcloudflare.dns: 58/58 completerun_complete run-68748435ad32367d
16:49:47.771observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-942258c89036d5e1
16:49:47.772observercheckokcloudflare.audit: 1123/1123 completerun_complete run-942258c89036d5e1
16:49:47.939observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f7edc3b61bde5ce9
16:49:47.939observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f7edc3b61bde5ce9
16:49:48.113observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-17d6a69fb3eb142b
16:49:48.113observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-17d6a69fb3eb142b
16:49:48.289observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7aa0cb559102ba32
16:49:48.289observercheckokprobe: 117/117 completerun_complete run-7aa0cb559102ba32
16:49:48.464observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-576e5a1e0ae32b39
16:49:48.464observercheckokcloudflare.dns: 58/58 completerun_complete run-576e5a1e0ae32b39
16:49:48.626observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ab19eb70735c2463
16:49:48.626observercheckokcloudflare.audit: 1145/1145 completerun_complete run-ab19eb70735c2463
16:49:48.789observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:49:48.789observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-a8590cdc5428b8d4
16:49:48.953observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:49:48.954observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-aed985591cd03b16
16:49:49.117observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-203b488a21557488
16:49:49.117observercheckokprobe: 117/117 completerun_complete run-203b488a21557488
16:49:49.117observerchecknot_checkedaudit log withheld for lab-1: no cloudflare.audit run for this tenantaudit_event lab-1actor_attributed, previous_value_recoverable, referent_unchanged, record_reverted are rejected for every finding of this tenant this pass
16:49:49.238observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:49.426observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:49.468observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-f9470e2f5f175899)run-67f4d6923cb4838dmodel: none
16:49:49.573observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:49.738observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:49.752observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-f9470e2f5f175899)run-15638d43819ba756model: none
16:49:49.862observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:50.036observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:50.072observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-b69af94952dccb36)run-071329fedf5f073fmodel: none
16:49:50.182observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:50.363observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:50.382observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-b69af94952dccb36)run-4592b852a04812f7model: none
16:49:50.499observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:50.683observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:50.733observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-de1564466df1d59b)run-81adedc1cc778bd5model: none
16:49:50.846observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:51.020observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:51.045observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-de1564466df1d59b)run-ace5f05819e5b28emodel: none
16:49:51.172observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:51.367observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:51.427observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-400375137e2bae7bmodel: none
16:49:51.531observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:51.696observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:51.724observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-647f878a4f5605f7model: none
16:49:51.835observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:52.001observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:52.069observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-8c5af1ac22c54514model: none
16:49:52.174observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:52.341observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:52.373observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-43c8ccb3704ad21cmodel: none
16:49:52.487observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:52.666observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:52.759observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-49fc76bf3b823051model: none
16:49:52.866observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:53.034observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:53.072observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-ea10fdeb1eae1a46model: none
16:49:53.174observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:53.177observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-74140124db03c3f5model: none
16:49:53.278observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:53.281observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-afe5a89ee42acbc2model: none
16:49:53.380observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:53.383observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-90bdfa86df88a639model: none
16:49:53.482observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:53.486observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-33b1aa9a8f89d3c8model: none
16:49:53.585observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:53.588observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-ce4dc382bcffa4bbmodel: none
16:49:53.689observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:53.692observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-1f4d84ed6359ff18model: none
16:49:53.792observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:53.795observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-463c7c0ce537bd16model: none
16:49:53.895observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:53.898observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f97423f25dc75884model: none
16:49:54.019observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:54.193observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:54.288observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-6b65e048bb60fc24)run-f6c7da2a579e2141model: none
16:49:54.398observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:54.563observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:54.608observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-6b65e048bb60fc24)run-258ffc0f34ffab51model: none
16:49:54.713observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:54.717observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-e476cc64252f6715model: none
16:49:54.817observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:54.821observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-d1fcc061e5c34158model: none
16:49:54.921observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:54.925observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-2c3fc585f404b90fmodel: none
16:49:55.025observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:55.028observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-0f5afdbf81b5b05amodel: none
16:49:55.128observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:55.131observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f509f49299848d43model: none
16:49:55.230observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:55.234observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-41e44e7c818c214dmodel: none
16:49:55.333observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:55.337observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-b78229c438b759ebmodel: none
16:49:55.435observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:55.439observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-71776a91583187d1model: none
16:49:55.547observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:55.740observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:55.848observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-643ca3aadc62f002)run-b094ed4249e79fafmodel: none
16:49:55.957observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:56.123observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:56.171observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-643ca3aadc62f002)run-028e1c06567f1445model: none
16:49:56.285observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:56.453observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:56.569observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-63bc01583b366b8d)run-c52288c22d5992fdmodel: none
16:49:56.674observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:56.841observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:56.893observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-63bc01583b366b8d)run-df60a03b49bbda47model: none
16:49:57.003observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:57.169observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:57.296observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-2a11f407cfdce7b6model: none
16:49:57.402observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:57.569observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:57.626observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-d594486e164c4097model: none
16:49:57.745observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:57.913observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:58.049observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-439d1fb53664c597model: none
16:49:58.153observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:58.322observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:58.384observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-209d57362e152a70model: none
16:49:58.503observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:58.677observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:58.835observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-480602f60ca854c6)run-573b3e958d5799a2model: none
16:49:58.947observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:59.120observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:59.190observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-480602f60ca854c6)run-ee1c61b44a6d6e01model: none
16:49:59.308observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:59.481observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:59.641observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9d48791b00433777)run-f74b40064e093f2cmodel: none
16:49:59.745observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:49:59.913observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:49:59.984observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9d48791b00433777)run-28ad36002e466ed5model: none
16:50:00.099observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:00.265observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:00.441observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-01c5106777ec2426)run-22c36b45028d6029model: none
16:50:00.544observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:00.710observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:00.787observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-01c5106777ec2426)run-951d5140591a7f6amodel: none
16:50:00.897observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:01.081observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:01.284observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-fab71c1a5a8fc015)run-1f949ba3c2557d42model: none
16:50:01.393observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:01.571observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:01.656observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-fab71c1a5a8fc015)run-53c7e1dc36402ecamodel: none
16:50:01.778observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:01.965observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:02.242observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-0b0dc83717dd3728)run-6c2480894f434d74model: none
16:50:02.352observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:02.517observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:02.619observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-0b0dc83717dd3728)run-35ba6c1a2a987888model: none
16:50:02.734observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:02.919observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:03.199observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-68748435ad32367d)run-f7edc3b61bde5ce9model: none
16:50:03.310observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:03.479observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:03.583observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-68748435ad32367d)run-17d6a69fb3eb142bmodel: none
16:50:03.694observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:03.863observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:04.134observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-576e5a1e0ae32b39)run-a8590cdc5428b8d4model: none
16:50:04.240observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:04.408observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
16:50:04.522observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-576e5a1e0ae32b39)run-aed985591cd03b16model: none
16:50:04.819detectorqueryok2 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM host-90e35a.observ
16:50:04.819detectordetectoklinux.nginx host-aa516a: 2 setting(s) point at a name resolving outside the inventoryhero run-a8590cdc5428b8d4 x run-576e5a1e0ae32b39model: none
16:50:04.823detectordetectokfound_but_different: server[host-492568.ai:443].server_name[host-492568.ai] in /etc/nginx/conf.d/host-492568.ai.conf on host-aa516a is byte-identical since 2026-10-25T16:32:53.265Z; host-492568.ai resolved to ip-6b6bba then and to 192.0.2.10 now, an address not in the inventoryserver[host-492568.ai:443].server_name[host-492568.ai] in /etc/nginx/conf.d/host-492568.ai.conf on host-aa516afingerprint ip-6b6bba -> 192.0.2.10; bytes unchanged (model: none)
16:50:05.006checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:05.007checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:05.208checkerqueryok1 rowsSELECT d.record_id, d.name, d.type, d.content, d.observed_at FROM DRIFT.dns_record d LEFT JOIN DRIFT.inventory_asset i ON i.tenant_id = d.tenant_id AND i.addres
16:50:05.208checkercheckfaileddns_target_in_inventory: fails (1 rows)dns_target_in_inventory {"tenant_id":"client-1","name":"host-492568.ai","dns_run_id":"run-576e5a1e0ae32b39"}host-492568.ai resolves to 1 address the inventory does not know.
16:50:05.341checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '9ee8076d949534e
16:50:05.342checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"9ee8076d949534eb9ceef147017db541","since":"2026-10-25T16:32:53.265Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed 9ee8076d949534eb9ceef147017db541 between 2026-10-25T16:32:53.265Z and 2026-10-25T16:49:15.728Z.
16:50:05.470checkerqueryok1 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'r
16:50:05.470checkercheckfailedother_settings_reference: fails (1 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-492568.ai","run_id":"run-a8590cdc5428b8d4","object_id":"/etc/nginx/conf.d/host-492568.ai.conf","setting_path":"server[host-492568.1 other setting in run run-a8590cdc5428b8d4 also point at host-492568.ai.
16:50:05.580deciderqueryok117 rowsSELECT probe_id, run_id, kind, target, expected, observed, status, latency_ms, observed_at FROM host-f16622.probe WHERE tenant_id = 'client-1' AND run_id = 'run-203b4
16:50:05.581deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this found_but_different finding until 2026-10-28T16:49:30.637Zfound_but_different server[host-492568.ai:443].server_name[host-492568.ai] in /etc/nginx/conf.d/host-492568.ai.conf on host-aa516amodel: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-203b488a21557488: dns host-492568.ai)
16:50:05.690deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:05.839deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '192.0.2.10' AND e.old_va
16:50:05.839decidertriagenot_checkedexposure not dated: the audit log holds no event on 9ee8076d949534eb9ceef147017db541 that sets content=192.0.2.10 with no later different body up to 2026-10-25T16:49:07.289Zexposure 9ee8076d949534eb9ceef147017db541model: none
16:50:05.839judgejudgeskippedserver[host-492568.ai:443].server_name[host-492568.ai] in /etc/nginx/conf.d/host-492568.ai.conf on host-aa516a is byte-identical since 2026-10-25T16:32:53.265Z;model: none (sample)
16:50:05.842detectordetectokfound_but_different: server[host-492568.ai:80].server_name[host-492568.ai] in /etc/nginx/conf.d/host-492568.ai.conf on host-aa516a is byte-identical since 2026-10-25T16:32:53.265Z; host-492568.ai resolved to ip-6b6bba then and to 192.0.2.10 now, an address not in the inventoryserver[host-492568.ai:80].server_name[host-492568.ai] in /etc/nginx/conf.d/host-492568.ai.conf on host-aa516afingerprint ip-6b6bba -> 192.0.2.10; bytes unchanged (model: none)
16:50:06.033checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:06.033checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:06.208checkerqueryok1 rowsSELECT d.record_id, d.name, d.type, d.content, d.observed_at FROM DRIFT.dns_record d LEFT JOIN DRIFT.inventory_asset i ON i.tenant_id = d.tenant_id AND i.addres
16:50:06.208checkercheckfaileddns_target_in_inventory: fails (1 rows)dns_target_in_inventory {"tenant_id":"client-1","name":"host-492568.ai","dns_run_id":"run-576e5a1e0ae32b39"}host-492568.ai resolves to 1 address the inventory does not know.
16:50:06.305checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '9ee8076d949534e
16:50:06.306checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"9ee8076d949534eb9ceef147017db541","since":"2026-10-25T16:32:53.265Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed 9ee8076d949534eb9ceef147017db541 between 2026-10-25T16:32:53.265Z and 2026-10-25T16:49:15.728Z.
16:50:06.418checkerqueryok1 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'r
16:50:06.418checkercheckfailedother_settings_reference: fails (1 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-492568.ai","run_id":"run-a8590cdc5428b8d4","object_id":"/etc/nginx/conf.d/host-492568.ai.conf","setting_path":"server[host-492568.1 other setting in run run-a8590cdc5428b8d4 also point at host-492568.ai.
16:50:06.418deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this found_but_different finding until 2026-10-28T16:49:30.637Zfound_but_different server[host-492568.ai:80].server_name[host-492568.ai] in /etc/nginx/conf.d/host-492568.ai.conf on host-aa516amodel: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-203b488a21557488: dns host-492568.ai)
16:50:06.419decidertriagenot_checkedexposure not dated: the audit log holds no event on 9ee8076d949534eb9ceef147017db541 that sets content=192.0.2.10 with no later different body up to 2026-10-25T16:49:07.289Zexposure 9ee8076d949534eb9ceef147017db541model: none
16:50:06.419judgejudgeskippedserver[host-492568.ai:80].server_name[host-492568.ai] in /etc/nginx/conf.d/host-492568.ai.conf on host-aa516a is byte-identical since 2026-10-25T16:32:53.265Z; model: none (sample)
16:50:06.692detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM host-90e35a.observ
16:50:06.692detectordetectoklinux.nginx host-4b4dc1: 0 setting(s) point at a name resolving outside the inventoryhero run-aed985591cd03b16 x run-576e5a1e0ae32b39model: none
16:50:06.693detectordetectnot_checkedno DNS run of this pass for this tenant; the hero query has nothing to joinlinux.nginx host-951abf
16:50:06.887detectorqueryok1 rowsSELECT c.zone, c.name AS proxied_name, c.record_id AS proxied_record_id, a.name AS target_name, a.type AS target_type, a.content AS target_content, a.rec
16:50:06.887detectordetectokcloudflare.dns: 1 proxied CNAME(s) alias a direct address recordproxy_split run-576e5a1e0ae32b39model: none
16:50:06.887detectordetectokproxy_split: host-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it points atproxied record bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none
16:50:06.992detectorqueryok1 rowsSELECT MIN(occurred_at) AS first_at, MAX(occurred_at) AS last_at, COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1'
16:50:07.175checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-576e5a1e0ae32b39
16:50:07.175checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-576e5a1e0ae32b39"}Run run-576e5a1e0ae32b39 collected everything it set out to collect.
16:50:07.279checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2d
16:50:07.279checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:07.289Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:07.289Z.
16:50:07.529checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:07.530checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
16:50:07.840checkerqueryok3 rowsSELECT 'dns_record' AS evidence, a.record_id AS resource_id, a.content AS old_value, b.content AS new_value, b.observed_at AS seen_at FROM DRIFT.dns_record a JO
16:50:07.840checkercheckfailedreferent_unchanged: fails (3 rows)referent_unchanged {"tenant_id":"client-1","name":"host-524b42.quest","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:07.289Z"}host-524b42.quest changed between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:07.289Z (3 pieces of evidence).
16:50:07.840deciderdecideokESCALATE: hold under rule rule-8e75e1d767980665 expired 2026-10-25T03:21:06.870Z; the finding standsproxy_split proxied in bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none; policy: rule-8e75e1d767980665 (cloudflare.dns * proxied v2: critical, lock 1, on_drift rollback, on_no_copy investigate_ticket, hold 4 h); the checks alone say ESCALATE; production answering (3 probes of its names ok in run-203b488a21557488); prior HOLD since 2026-10-25T01:45:33.962Z until 2026-10-25T03:21:06.870Z
16:50:07.957deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:08.121deciderqueryok2 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:08.234deciderqueryok1 rowsSELECT COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b6823d5f6ecd3f2' AND action <> 'view' AND occurred_
16:50:08.234decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T16:49:07.289Z, still so in DNS run run-576e5a1e0ae32b39exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
16:50:08.235judgejudgeskippedhost-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it pointsmodel: none (sample)
16:50:08.731detectorqueryok10 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
16:50:09.096detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
16:50:09.097detectordetectoklinux.nginx host-aa516a: 10 proxied name(s) served by a block that trusts no real_ip range, 1 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-a8590cdc5428b8d4 x run-576e5a1e0ae32b39model: none
16:50:09.097detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
16:50:09.297checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:09.297checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:09.404checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:09.405checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:09.511checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a0
16:50:09.511checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:09.779checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:09.779checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
16:50:09.780decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:09.780deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:09.891deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:10.041deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:10.143deciderqueryok1 rowsSELECT COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc11f85b45bc4' AND action <> 'view' AND occurred_
16:50:10.144decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 109 day(s) to 2026-10-25T16:49:07.289Z, still so in DNS run run-576e5a1e0ae32b39exposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
16:50:10.144judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is averdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:10.144detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
16:50:10.329checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:10.329checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:10.418checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:10.418checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:10.520checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a0
16:50:10.520checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:10.724checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:10.724checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
16:50:10.725decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:10.725deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:10.725decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 109 day(s) to 2026-10-25T16:49:07.289Z, still so in DNS run run-576e5a1e0ae32b39exposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
16:50:10.725judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is abverdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:10.726detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
16:50:10.907checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:10.907checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:10.997checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:10.997checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:11.098checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029
16:50:11.098checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:11.265checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:11.265checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
16:50:11.266decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:11.266deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:11.368deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:11.506deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:11.506decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure 803592cea544029b20da8b45e5045f41model: none
16:50:11.506judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:11.506detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
16:50:11.720checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:11.721checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:11.812checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:11.812checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:11.909checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029
16:50:11.910checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:12.074checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:12.074checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
16:50:12.074decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:12.074deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:12.074decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure 803592cea544029b20da8b45e5045f41model: none
16:50:12.075judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:12.075detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
16:50:12.258checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:12.258checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:12.345checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:12.346checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:12.443checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc
16:50:12.443checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:12.608checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:12.609checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
16:50:12.609decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:12.609deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:12.705deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:12.839deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:12.839decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
16:50:12.839judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:12.839detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
16:50:13.031checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:13.031checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:13.122checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:13.123checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:13.220checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc
16:50:13.220checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:13.388checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:13.388checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
16:50:13.388decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:13.388deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:13.388decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
16:50:13.389judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:13.389detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
16:50:13.575checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:13.576checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:13.665checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:13.665checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:13.761checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537f
16:50:13.761checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:13.932checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:13.932checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
16:50:13.933decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:13.933deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:14.028deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:14.173deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:14.173decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
16:50:14.173judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:14.174detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
16:50:14.374checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:14.375checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:14.465checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:14.465checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:14.564checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537f
16:50:14.564checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:14.732checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:14.732checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
16:50:14.733decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:14.733deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:14.733decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
16:50:14.733judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:14.733detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
16:50:14.917checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:14.918checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:15.006checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:15.007checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:15.104checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28
16:50:15.105checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:15.266checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:15.266checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
16:50:15.266decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:15.266deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:15.362deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:15.493deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:15.493decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
16:50:15.494judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:15.494detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
16:50:15.676checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:15.676checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:15.769checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:15.769checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:15.865checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28
16:50:15.865checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:16.025checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:16.026checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
16:50:16.026decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:16.026deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:16.026decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
16:50:16.026judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:16.026detectordetectokproxied_without_real_ip: *.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.conf is absent): every name under the wildcard sees Cloudflare's addresses as its visitorshttp.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none
16:50:16.207checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:50:16.207checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-a8590cdc5428b8d4"}Run run-a8590cdc5428b8d4 collected everything it set out to collect.
16:50:16.295checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:16.295checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:16.394checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c922e6966d55b15
16:50:16.394checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed c922e6966d55b15bd96b5e8ea932b715 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:16.568checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:16.568checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715"}The audit log does not record what c922e6966d55b15bd96b5e8ea932b715 was before its latest change.
16:50:16.568decidertriageokexception mem-19 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516alesson mem-19 on *.host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:43.955Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:16.568deciderdecideokADOPT: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-19 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
16:50:16.668deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:16.829deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:16.829decidertriagenot_checkedexposure not dated: the audit log holds no event on c922e6966d55b15bd96b5e8ea932b715 that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure c922e6966d55b15bd96b5e8ea932b715model: none
16:50:16.829judgejudgeskipped*.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.confverdict cannot move: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:17.318detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM DRIFT.dns_record d LEFT J
16:50:17.318detectordetectoklinux.nginx host-aa516a: 1 record(s) land here with no enabled server block naming themorphan_record run-a8590cdc5428b8d4 x run-576e5a1e0ae32b39model: none
16:50:17.318detectordetectokorphan_record: host-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default serverrecord c8b1963847dafe3548b1a4b93f520c0amodel: none
16:50:17.504checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-576e5a1e0ae32b39
16:50:17.504checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-576e5a1e0ae32b39"}Run run-576e5a1e0ae32b39 collected everything it set out to collect.
16:50:17.590checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
16:50:17.590checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
16:50:17.686checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c8b1963847dafe3
16:50:17.686checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:15.728Z"}No audit event names who changed c8b1963847dafe3548b1a4b93f520c0a between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:15.728Z.
16:50:17.849checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:17.850checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a"}The audit log does not record what c8b1963847dafe3548b1a4b93f520c0a was before its latest change.
16:50:17.850deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T16:33:08.086Z under rule rule-b8d9962485c3ced4orphan_record name in c8b1963847dafe3548b1a4b93f520c0a on host-aa516amodel: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (2 failing probes in run-203b488a21557488: tls host-3fef97.club, http host-3fef97.club); prior HOLD since 2026-10-25T16:33:08.086Z until 2026-10-27T23:21:06.870Z
16:50:17.946deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:18.099deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6b6bba' AND e.old_val
16:50:18.099decidertriagenot_checkedexposure not dated: the audit log holds no event on c8b1963847dafe3548b1a4b93f520c0a that sets content=ip-6b6bba with no later different body up to 2026-10-25T16:49:07.289Zexposure c8b1963847dafe3548b1a4b93f520c0amodel: none
16:50:18.099judgejudgeskippedhost-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
16:50:18.560detectorqueryok0 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM host-46425a.observa
16:50:18.560detectordetectoklinux.nginx host-aa516a: 0 server_name(s) with no record and no covering wildcardorphan_vhost run-a8590cdc5428b8d4 x run-576e5a1e0ae32b39model: none
16:50:19.122detectorqueryok9 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
16:50:19.458detectorqueryok0 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
16:50:19.458detectordetectoklinux.nginx host-4b4dc1: 9 proxied name(s) served by a block that trusts no real_ip range, 0 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-aed985591cd03b16 x run-576e5a1e0ae32b39model: none
16:50:19.459detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
16:50:19.650checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:19.650checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:19.750checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:19.750checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:19.857checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6
16:50:19.857checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:20.041checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:20.041checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
16:50:20.041decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:20.041deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:20.148deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:20.305deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:20.305decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
16:50:20.305judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:20.306detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
16:50:20.489checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:20.490checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:20.593checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:20.593checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:20.723checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6
16:50:20.724checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:20.897checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:20.897checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
16:50:20.897decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:20.898deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:20.898decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
16:50:20.898judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:20.898detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
16:50:21.089checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:21.089checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:21.178checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:21.179checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:21.283checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2d
16:50:21.283checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:21.531checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:21.531checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
16:50:21.531decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:21.532deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:21.532decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T16:49:07.289Z, still so in DNS run run-576e5a1e0ae32b39exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
16:50:21.532judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:21.533detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
16:50:21.719checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:21.719checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:21.810checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:21.811checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:21.914checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2d
16:50:21.914checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:22.124checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:22.124checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
16:50:22.125decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:22.125deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:22.125decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T16:49:07.289Z, still so in DNS run run-576e5a1e0ae32b39exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
16:50:22.125judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:22.125detectordetectokproxied_without_real_ip: host-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
16:50:22.328checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:22.329checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:22.419checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:22.420checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:22.517checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b43f276dea49e4d
16:50:22.517checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}No audit event names who changed b43f276dea49e4dd9c2271e5a084e37e between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:22.738checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:22.738checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e"}The audit log does not record what b43f276dea49e4dd9c2271e5a084e37e was before its latest change.
16:50:22.739decidertriageokexception mem-11 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-11 on host-525a57.com (proxied_without_real_ip), recorded 2026-10-25T14:17:25.100Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:22.739deciderdecideokADOPT: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-11 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:22.843deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:22.980deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:22.980decidertriagenot_checkedexposure not dated: the audit log holds no event on b43f276dea49e4dd9c2271e5a084e37e that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure b43f276dea49e4dd9c2271e5a084e37emodel: none
16:50:22.980judgejudgeskippedhost-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:22.980detectordetectokproxied_without_real_ip: host-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
16:50:23.181checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:23.181checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:23.276checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:23.276checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:23.375checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b5e781103f2acd7
16:50:23.375checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}No audit event names who changed b5e781103f2acd7d15886934269551c1 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:23.537checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:23.538checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1"}The audit log does not record what b5e781103f2acd7d15886934269551c1 was before its latest change.
16:50:23.538decidertriageokexception mem-10 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-10 on host-5c38db.com (proxied_without_real_ip), recorded 2026-10-25T14:17:22.803Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:23.538deciderdecideokADOPT: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-10 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:23.635deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:23.767deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:23.767decidertriagenot_checkedexposure not dated: the audit log holds no event on b5e781103f2acd7d15886934269551c1 that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure b5e781103f2acd7d15886934269551c1model: none
16:50:23.767judgejudgeskippedhost-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:23.768detectordetectokproxied_without_real_ip: host-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none
16:50:23.959checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:23.960checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:24.053checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:24.053checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:24.156checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '893f8252d3d2b23
16:50:24.156checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}No audit event names who changed 893f8252d3d2b233459c1f10f5143d13 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:24.326checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:24.327checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13"}The audit log does not record what 893f8252d3d2b233459c1f10f5143d13 was before its latest change.
16:50:24.327decidertriageokexception mem-6 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1lesson mem-6 on host-62f7a4.com (proxied_without_real_ip), recorded 2026-10-25T14:17:13.404Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:24.327deciderdecideokADOPT: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-6 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:24.426deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:24.561deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:24.561decidertriagenot_checkedexposure not dated: the audit log holds no event on 893f8252d3d2b233459c1f10f5143d13 that sets proxied=true with no later different body up to 2026-10-25T16:49:07.289Zexposure 893f8252d3d2b233459c1f10f5143d13model: none
16:50:24.562judgejudgeskippedhost-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1verdict cannot move: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:24.562detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
16:50:24.755checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:24.755checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:24.847checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:24.847checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:24.944checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee
16:50:24.944checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:25.172checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:25.173checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
16:50:25.173decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:25.173deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:25.287deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:25.422deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
16:50:25.525deciderqueryok1 rowsSELECT COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668f5f435a4ae1' AND action <> 'view' AND occurred_
16:50:25.525decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T16:49:07.289Z, still so in DNS run run-576e5a1e0ae32b39exposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
16:50:25.526judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:25.526detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
16:50:25.709checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:25.710checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:25.797checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:25.798checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:25.896checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee
16:50:25.897checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:26.105checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:26.106checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
16:50:26.106decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:26.106deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
16:50:26.107decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T16:49:07.289Z, still so in DNS run run-576e5a1e0ae32b39exposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
16:50:26.107judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:26.623detectorqueryok2 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM DRIFT.dns_record d LEFT J
16:50:26.623detectordetectoklinux.nginx host-4b4dc1: 2 record(s) land here with no enabled server block naming themorphan_record run-aed985591cd03b16 x run-576e5a1e0ae32b39model: none
16:50:26.624detectordetectokorphan_record: host-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord b0a17a719bd2118a535a763379ab7ba9model: none
16:50:26.843checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-576e5a1e0ae32b39
16:50:26.844checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-576e5a1e0ae32b39"}Run run-576e5a1e0ae32b39 collected everything it set out to collect.
16:50:26.932checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:26.932checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:27.028checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b0a17a719bd2118
16:50:27.028checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}No audit event names who changed b0a17a719bd2118a535a763379ab7ba9 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:27.191checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:27.191checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9"}The audit log does not record what b0a17a719bd2118a535a763379ab7ba9 was before its latest change.
16:50:27.191deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T16:33:08.086Z under rule rule-b8d9962485c3ced4orphan_record name in b0a17a719bd2118a535a763379ab7ba9 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-203b488a21557488: http host-50b116.com); prior HOLD since 2026-10-25T16:33:08.086Z until 2026-10-27T23:21:06.870Z
16:50:27.298deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:27.440deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
16:50:27.440decidertriagenot_checkedexposure not dated: the audit log holds no event on b0a17a719bd2118a535a763379ab7ba9 that sets content=ip-6fb86d with no later different body up to 2026-10-25T16:49:07.289Zexposure b0a17a719bd2118a535a763379ab7ba9model: none
16:50:27.440judgejudgeskippedhost-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
16:50:27.441detectordetectokorphan_record: host-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord 25a23b5c40a3de0ea11b6054a7b54d07model: none
16:50:27.620checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-576e5a1e0ae32b39
16:50:27.620checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-576e5a1e0ae32b39"}Run run-576e5a1e0ae32b39 collected everything it set out to collect.
16:50:27.707checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
16:50:27.707checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
16:50:27.807checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0
16:50:27.807checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T16:49:19.225Z"}1 audit event with a named actor touched 25a23b5c40a3de0ea11b6054a7b54d07 between 2026-03-20T01:29:03.000Z and 2026-10-25T16:49:19.225Z.
16:50:28.015checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:28.015checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07"}The audit log does not record what 25a23b5c40a3de0ea11b6054a7b54d07 was before its latest change.
16:50:28.015deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T16:33:08.086Z under rule rule-b8d9962485c3ced4orphan_record name in 25a23b5c40a3de0ea11b6054a7b54d07 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-203b488a21557488: http host-c10fff.com); prior HOLD since 2026-10-25T16:33:08.086Z until 2026-10-27T23:21:06.870Z
16:50:28.111deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' AND r
16:50:28.246deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
16:50:28.342deciderqueryok1 rowsSELECT COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0ea11b6054a7b54d07' AND action <> 'view' AND occurred_
16:50:28.343decidertriageokcontent=ip-6fb86d since 2026-07-06T18:46:40.994Z: at least 110 day(s) to 2026-10-25T16:49:07.289Z, still so in DNS run run-576e5a1e0ae32b39exposure 25a23b5c40a3de0ea11b6054a7b54d07first event of the current state: evt-48d6696c1de70593 (update); no earlier body on record sets another content state, so the state may predate the log; model: none
16:50:28.343judgejudgeskippedhost-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
16:50:28.838detectorqueryok3 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM host-46425a.observa
16:50:28.838detectordetectoklinux.nginx host-4b4dc1: 3 server_name(s) with no record and no covering wildcardorphan_vhost run-aed985591cd03b16 x run-576e5a1e0ae32b39model: none
16:50:28.838detectordetectokorphan_vhost: host-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none
16:50:29.033checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:29.033checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:29.149checkerqueryok0 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'r
16:50:29.149checkercheckokother_settings_reference: holds (0 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-085e02.com","run_id":"run-aed985591cd03b16","object_id":"/etc/nginx/sites-available/host-085e02.com","setting_path":"server[host-0No other setting in run run-aed985591cd03b16 points at host-085e02.com.
16:50:29.246checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM DRIFT.backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:2
16:50:29.247checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
16:50:29.247decidertriageokexception mem-8 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1lesson mem-8 on host-085e02.com (orphan_vhost), recorded 2026-10-25T14:17:18.089Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:29.247deciderdecideokADOPT: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTorphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-8 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
16:50:29.247judgejudgeskippedhost-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collecteverdict cannot move: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:29.248detectordetectokorphan_vhost: host-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
16:50:29.430checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:29.431checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:29.542checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'r
16:50:29.542checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-89f6e7.com","run_id":"run-aed985591cd03b16","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-aed985591cd03b16 also point at host-89f6e7.com.
16:50:29.627checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM DRIFT.backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:2
16:50:29.627checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
16:50:29.627decidertriageokexception mem-4 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-4 on host-89f6e7.com (orphan_vhost), recorded 2026-10-25T14:17:08.716Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:29.627deciderdecideokADOPT: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-4 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
16:50:29.627judgejudgeskippedhost-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:29.628detectordetectokorphan_vhost: host-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
16:50:29.812checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:50:29.812checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-aed985591cd03b16"}Run run-aed985591cd03b16 collected everything it set out to collect.
16:50:29.924checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'r
16:50:29.924checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-9ac4f1.com","run_id":"run-aed985591cd03b16","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-aed985591cd03b16 also point at host-9ac4f1.com.
16:50:30.011checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM DRIFT.backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:2
16:50:30.011checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
16:50:30.011decidertriageokexception mem-16 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-16 on host-9ac4f1.com (orphan_vhost), recorded 2026-10-25T14:17:36.809Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
16:50:30.011deciderdecideokADOPT: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-16 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
16:50:30.012judgejudgeskippedhost-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
16:50:30.375detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
16:50:30.375detectordetectoklinux.nginx host-aa516a: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-a8590cdc5428b8d4model: none
16:50:30.716detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a
16:50:30.717detectordetectoklinux.nginx host-aa516a: 0 approved setting(s) whose object the run lacksapproved_missing run-a8590cdc5428b8d4model: none
16:50:31.141detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM DRIFT.
16:50:31.141detectordetectoklinux.nginx host-aa516a: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-a8590cdc5428b8d4model: none
16:50:31.481detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
16:50:31.482detectordetectoklinux.nginx host-4b4dc1: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-aed985591cd03b16model: none
16:50:31.768detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a
16:50:31.768detectordetectoklinux.nginx host-4b4dc1: 0 approved setting(s) whose object the run lacksapproved_missing run-aed985591cd03b16model: none
16:50:32.051detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM DRIFT.
16:50:32.051detectordetectoklinux.nginx host-4b4dc1: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-aed985591cd03b16model: none
16:50:32.320detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
16:50:32.320detectordetectoklinux.nginx host-951abf: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-71776a91583187d1model: none
16:50:32.640detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a
16:50:32.640detectordetectoklinux.nginx host-951abf: 0 approved setting(s) whose object the run lacksapproved_missing run-71776a91583187d1model: none
16:50:32.924detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM DRIFT.
16:50:32.924detectordetectoklinux.nginx host-951abf: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-71776a91583187d1model: none
16:50:33.197detectorqueryok1 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
16:50:33.198detectordetectokcloudflare.dns: 1 record field(s) drifted from their latest approvaldrift_vs_approved run-576e5a1e0ae32b39model: none
16:50:33.331detectorqueryok290 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:33.332detectordetectokdrift_vs_approved: content of record 9ee8076d949534eb9ceef147017db541 (host-492568.ai) is 192.0.2.10 (8faef4a3401b), and its latest approval, 2026-10-24T19:57:48.545Z by operator, is 9291bd740240: the live value drifted from the approved onecontent of record 9ee8076d949534eb9ceef147017db541model: none
16:50:33.528checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-576e5a1e0ae32b39
16:50:33.528checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-576e5a1e0ae32b39"}Run run-576e5a1e0ae32b39 collected everything it set out to collect.
16:50:33.637checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '9ee8076d949534e
16:50:33.637checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"9ee8076d949534eb9ceef147017db541","since":"2026-10-24T19:57:48.545Z","until":"2026-10-25T16:49:07.289Z"}No audit event names who changed 9ee8076d949534eb9ceef147017db541 between 2026-10-24T19:57:48.545Z and 2026-10-25T16:49:07.289Z.
16:50:33.915checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
16:50:33.916checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"9ee8076d949534eb9ceef147017db541"}The audit log does not record what 9ee8076d949534eb9ceef147017db541 was before its latest change.
16:50:34.289deciderqueryok15 rowsSELECT v.copy_id, v.run_id, v.git_commit, v.blob_sha256, v.taken_at, o.value_hash, c.validation_id, c.validator, c.result, c.missing_dependencies, c.vali
16:50:34.290deciderdecideokROLLBACK: live value drifted from approved 9291bd740240; vault commit 5ef406fc holds the approved copy, validated ok with 0 gaps, so rule rule-a3f26f34efab2ebb rolls it back to that copydrift_vs_approved content in 9ee8076d949534eb9ceef147017db541model: none; policy: rule-a3f26f34efab2ebb (cloudflare.dns * content v2: critical, lock 1, on_drift rollback, on_no_copy investigate_ticket, hold 4 h); the checks alone say ESCALATE; production affected (1 failing probe in run-203b488a21557488: dns host-492568.ai); approved 9291bd740240, 15 copy row(s), valid copy copy-a6efef4072c48751 at 5ef406fc
16:50:34.290judgejudgeskippedcontent of record 9ee8076d949534eb9ceef147017db541 (host-492568.ai) is 192.0.2.10 (8faef4a3401b), and its latest approval, 2026-10-24T19:57:48.545Z by operator,model: none (sample)
16:50:34.631detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a
16:50:34.631detectordetectokcloudflare.dns: 0 approved setting(s) whose object the run lacksapproved_missing run-576e5a1e0ae32b39model: none
16:50:34.814deciderqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a WHERE a.tenant_id
16:50:35.002deciderqueryok4 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a WHERE a.tenant_id
16:50:35.025decidertriageokearly_stop 0, checks_skipped 0, checks_gated 0, withdrawn_judge 23stop rulemodel: none
16:50:35.026decidertriageoklessons 23, exceptions applied 23, lapsed 0memorylocal store; recall by exact scope key, never by similarity; model: none
16:50:35.026decidertriageoklocked settings without an approved value: 0policy52 policy rule(s) read; verbs ADOPT 23, HOLD 5, ESCALATE 1, ROLLBACK 1; decided by policy 7, operator 23, default 0; probe run(s) run-e9f519d6a5af0fd0, run-b247c87d34f38d71, run-30f5647b8b9c5dff, run-e839e796556a54c3, run-446db683143ec580, run-396c20fb165306ed, run-af82fe9cd0f12826, run-f79e58d09c04c8d7, run-84b6426b9763f7f1, run-02925c58440a149c, run-20f146f855acc7b9, run-7a3ff25f0476b93f, run-4f
16:50:35.202loopqueryok483 rowsSELECT disposition_id, tenant_id, surface, host, object_id, setting_path, value_hash, verb, reason, expires_at, decided_by, rule_id, finding_id, run_id,
16:50:35.204looptriageokPASS: tenant client-1, decided at 2026-10-25T16:49:30.637Z: 87 collection run(s) of the tenant, 0 failed the DQ gate (none), 19484 observations in the World Model, 30 finding(s) (drift_vs_approved 1, found_but_different 2, orphan_record 3, orphan_vhost 3, proxied_without_real_ip 20, proxy_split 1); verbs: ADOPT 23, HOLD 5, ESCALATE 1, ROLLBACK 1; decided by operator 23, policy 7; judge skipped (model: none); memory: 23 lesson(s), 23 exception(s) applied, 0 lapsed; policy rules 52, locked settings without an approved value 0; ledger: 30 disposition(s) and 105 referent fingerprint(s) written, 0 finding(s) on rows an earlier pass wrotepass client-1model: none
16:50:35.205cycletriageokPASS: tenant client-1, decided at 2026-10-25T16:49:30.637Z: 87 collection run(s) of the tenant, 0 failed the DQ gate (none), 19484 observations in the World Model, 30 finding(s) (drift_vs_approved 1, found_but_different 2, orphan_record 3, orphan_vhost 3, proxied_without_real_ip 20, proxy_split 1); verbs: ADOPT 23, HOLD 5, ESCALATE 1, ROLLBACK 1; decided by operator 23, policy 7; judge skipped (model: none); memory: 23 lesson(s), 23 exception(s) applied, 0 lapsed; policy rules 52, locked settings without an approved value 0; ledger: 30 disposition(s) and 105 referent fingerprint(s) written, 0 finding(s) on rows an earlier pass wrotecycle client-1 [6/9] pass
16:50:35.325actorqueryok483 rowsSELECT disposition_id, tenant_id, surface, host, object_id, setting_path, value_hash, verb, reason, expires_at, decided_by, rule_id, finding_id, run_id,
16:50:35.451actorqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
16:50:35.572actorqueryok1 rowsSELECT action_id, tenant_id, kind, target, before_hash, after_hash, vault_commit, verification, receipts, status, reason, record, started_at, finished_at, dispo
16:50:35.729actorqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a WHERE a.tenant_id
16:50:36.034actorqueryok15 rowsSELECT v.copy_id, v.run_id, v.git_commit, v.blob_sha256, v.taken_at, o.value_hash, c.validation_id, c.validator, c.result, c.missing_dependencies, c.vali
16:50:36.346actorqueryok290 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:38.962actorreviseokdone: reverted to the approved copy at vault commit 5ef406fc; the record read back equals the copy field by fieldrevert_record cloudflare.dns 9ee8076d949534eb9ceef147017db541 contentvault commit 5ef406fc holds record 9ee8076d949534eb9ceef147017db541 (host-492568.ai, A, ttl 1, proxied false); before: content 8faef4a3401b on record 9ee8076d949534eb9ceef147017db541; PATCH record 9ee8076d949534eb9ceef147017db541 in zone host-503b27.ai: answered; read back: type, name, content, ttl, proxied equal the copy; content 9291bd740240; probe probe-752b94048aec7be5: dns host-492568.ai ok (
16:50:38.966cycletriageokact: applied: 1 action (rollback_file 0, revert_record 1, investigate 0, fix 0): done 1, unverified 0, failed 0, refused 0, not_judged 0; 0 already recorded; 1 action rows written; scope 30 disposition(s) of 3 run(s) (ROLLBACK 1, ADOPT 23, HOLD 5, ESCALATE 1), ledger 464 of the tenantcycle client-1 [7/9] act
16:50:39.072psaqueryok107 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM DRIFT.collection_run ORDER BY started_at, run_id
16:50:39.178psaqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
16:50:39.290psaqueryok483 rowsSELECT disposition_id, tenant_id, surface, host, object_id, setting_path, value_hash, verb, reason, expires_at, decided_by, rule_id, finding_id, run_id,
16:50:39.537psaqueryok2 rowsSELECT a.action_id, a.tenant_id, a.kind, a.target, a.before_hash, a.after_hash, a.vault_commit, a.verification, a.receipts, a.status, a.reason, a.record,
16:50:39.657psaqueryok2 rowsSELECT ticket_id, tenant_id, psa, external_id, url, type, priority, status, action_id, finding_id, created_at, updated_at FROM host-fa579b.ticket WHERE tenant_id = 'c
16:50:39.789psaqueryok117 rowsSELECT probe_id, run_id, kind, target, expected, observed, status, latency_ms, observed_at FROM host-f16622.probe WHERE tenant_id = 'client-1' AND run_id = 'run-203b4
16:50:39.910psaqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:40.013psaqueryok58 rowsSELECT record_id, zone FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-576e5a1e0ae32b39' ORDER BY record_id, zone
16:50:40.125psaqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
16:50:40.128psatriageskippedskip fnd-493e06fa1896b40d: HOLD found_but_different: HOLD opens an incident on alert always; rule rule-b8d9962485c3ced4 alerts neverskipmodel: none
16:50:40.128psatriageskippedskip fnd-0a8bc053185074a1: HOLD found_but_different: HOLD opens an incident on alert always; rule rule-b8d9962485c3ced4 alerts neverskipmodel: none
16:50:40.128psatriageskippedskip fnd-b4a40091cdb4f906: ticket tkt-17f72648b5b7ccc8 (#2) is current: ESCALATE, no new actionskipmodel: none
16:50:40.129psatriageskippedskip fnd-45d5f3f4a2eb0b2e: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.129psatriageskippedskip fnd-9bfe1da7d028260c: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.129psatriageskippedskip fnd-a08488f45ff63140: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.129psatriageskippedskip fnd-5bd1b4c03ee72c7a: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.129psatriageskippedskip fnd-dfe22fa267b51c91: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.129psatriageskippedskip fnd-8a843610aeb1b709: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.129psatriageskippedskip fnd-05b163bfda4c027f: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.129psatriageskippedskip fnd-f3bcb9860c5a0b3d: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.130psatriageskippedskip fnd-8fc350e6aa5840d1: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.130psatriageskippedskip fnd-385949946c990113: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.130psatriageskippedskip fnd-b91b1690878eaf0e: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.130psatriageskippedskip fnd-d62857e241af66e2: HOLD orphan_record: HOLD opens an incident on alert always; rule rule-b8d9962485c3ced4 alerts neverskipmodel: none
16:50:40.130psatriageskippedskip fnd-d5622dbd2bf43e3e: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.130psatriageskippedskip fnd-b0472de6319451c4: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.130psatriageskippedskip fnd-2f1b5857f0426b68: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.130psatriageskippedskip fnd-b3ea13c119d7b589: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.130psatriageskippedskip fnd-770d13f327d54d12: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.131psatriageskippedskip fnd-7548fb2a2e3cdca4: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.131psatriageskippedskip fnd-4503aff67c556c58: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.131psatriageskippedskip fnd-de3c5e8ebdc2d209: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.131psatriageskippedskip fnd-028260c299ff1cb0: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
16:50:40.131psatriageskippedskip fnd-58b251b5fce8fbff: HOLD orphan_record: HOLD opens an incident on alert always; rule rule-b8d9962485c3ced4 alerts neverskipmodel: none
16:50:40.132psatriageskippedskip fnd-8fc67ccb1e4eebfa: HOLD orphan_record: HOLD opens an incident on alert always; rule rule-b8d9962485c3ced4 alerts neverskipmodel: none
16:50:40.132psatriageskippedskip fnd-51038b9539a0174a: ADOPT orphan_vhost: ADOPT opens no ticketskipmodel: none
16:50:40.132psatriageskippedskip fnd-3661fcc541693ada: ADOPT orphan_vhost: ADOPT opens no ticketskipmodel: none
16:50:40.132psatriageskippedskip fnd-add52203af12de8a: ADOPT orphan_vhost: ADOPT opens no ticketskipmodel: none
16:50:43.283psatriageokcreated and closed #6 (a pseudonymised URL) create change P1 tkt-ef6406130d85ec40 (new row) for fnd-b170e6629e934723: ROLLBACK drift_vs_approved: host-492568.ai on host-503b27.ai; then close with a comment (ROLLBACK opens a change because rule rule-a3f26f34efab2ebb alerts always)create tkt-ef6406130d85ec40model: none
16:50:45.058psatriageokclosed #5: close tkt-0a121ea8f4fa072f #5 for fnd-d2e1aa9697e6fab7: finding fnd-d2e1aa9697e6fab7 is resolved in the pass over run-203b488a21557488, run-576e5a1e0ae32b39, run-a8590cdc5428b8d4, run-ab19eb70735c2463, run-aed985591cd03b16, run-dd0be9f42b22be6a; action act-658b57a39364a8ee's write stands, unverifiedclose tkt-0a121ea8f4fa072fmodel: none
16:50:45.058psatriageokTICKETS: tenant client-1, 30 finding(s), 464 disposition(s) and 2 action(s) in the ledger, 2 ticket row(s) before; plan: create 1, comment 0, close 1, skip 29; created 0, commented 0, closed 2, synced 0, refused 0, failed 0tickets client-1model: none
16:50:45.059cycletriageokTICKETS: tenant client-1, 30 finding(s), 464 disposition(s) and 2 action(s) in the ledger, 2 ticket row(s) before; plan: create 1, comment 0, close 1, skip 29; created 0, commented 0, closed 2, synced 0, refused 0, failed 0cycle client-1 [8/9] tickets
16:50:45.163documenterqueryok107 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM DRIFT.collection_run ORDER BY started_at, run_id
16:50:45.359documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f9470e2f5f175899
16:50:45.545documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-507c9939230e60a4
16:50:45.735documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-67f4d6923cb4838d
16:50:45.917documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-15638d43819ba756
16:50:46.097documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b69af94952dccb36
16:50:46.277documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9a3335b91e5ef3c3
16:50:46.457documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-071329fedf5f073f
16:50:46.643documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4592b852a04812f7
16:50:46.830documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e9f519d6a5af0fd0
16:50:47.016documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-de1564466df1d59b
16:50:47.209documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-91f4abd4904e22a6
16:50:47.395documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-81adedc1cc778bd5
16:50:47.591documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ace5f05819e5b28e
16:50:47.796documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b247c87d34f38d71
16:50:47.975documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-59ffd380cfc7cda5
16:50:48.154documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-527d9eb092475404
16:50:48.336documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-400375137e2bae7b
16:50:48.541documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-647f878a4f5605f7
16:50:48.718documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-30f5647b8b9c5dff
16:50:48.900documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-8c5af1ac22c54514
16:50:49.076documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-43c8ccb3704ad21c
16:50:49.252documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9e232bb5e1ebdb81
16:50:49.428documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-bbf110bf21466ecc
16:50:49.598documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-49fc76bf3b823051
16:50:49.764documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ea10fdeb1eae1a46
16:50:49.934documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e839e796556a54c3
16:50:50.105documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-6b65e048bb60fc24
16:50:50.270documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f6b79eeae02db225
16:50:50.434documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f6c7da2a579e2141
16:50:50.604documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-258ffc0f34ffab51
16:50:50.771documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-446db683143ec580
16:50:50.952documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-643ca3aadc62f002
16:50:51.137documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-3fcba77d90340f5d
16:50:51.307documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b094ed4249e79faf
16:50:51.476documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-028e1c06567f1445
16:50:51.643documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-af82fe9cd0f12826
16:50:51.811documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-63bc01583b366b8d
16:50:51.982documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-8b02f9aad70df0c9
16:50:52.154documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-c52288c22d5992fd
16:50:52.337documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-df60a03b49bbda47
16:50:52.517documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f79e58d09c04c8d7
16:50:52.695documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-93f3f163d3d8a95d
16:50:52.869documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f9954452442b0cd1
16:50:53.041documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-2a11f407cfdce7b6
16:50:53.205documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-d594486e164c4097
16:50:53.373documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-84b6426b9763f7f1
16:50:53.544documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-199d9e1bdc86bf4d
16:50:53.736documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-cf8eb79048a18bc9
16:50:53.923documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-439d1fb53664c597
16:50:54.094documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-209d57362e152a70
16:50:54.277documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-02925c58440a149c
16:50:54.460documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-480602f60ca854c6
16:50:54.623documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f98b965de7012d0b
16:50:54.791documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-573b3e958d5799a2
16:50:54.960documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ee1c61b44a6d6e01
16:50:55.137documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-20f146f855acc7b9
16:50:55.307documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9d48791b00433777
16:50:55.475documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-77ae40d31854071c
16:50:55.642documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f74b40064e093f2c
16:50:55.808documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-28ad36002e466ed5
16:50:55.976documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7a3ff25f0476b93f
16:50:56.152documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-01c5106777ec2426
16:50:56.324documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1d846f0834ec0803
16:50:56.502documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-22c36b45028d6029
16:50:56.678documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-951d5140591a7f6a
16:50:56.851documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4f41e1f662be63b5
16:50:57.021documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-fab71c1a5a8fc015
16:50:57.201documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b19145b1ac6e00d5
16:50:57.399documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1f949ba3c2557d42
16:50:57.608documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-53c7e1dc36402eca
16:50:57.817documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-519f93197de9adf6
16:50:58.009documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e1e626eaa8ec20aa
16:50:58.204documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-0b0dc83717dd3728
16:50:58.386documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-af44e31de1d0bb30
16:50:58.585documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-6c2480894f434d74
16:50:58.773documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-35ba6c1a2a987888
16:50:58.954documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7bbe33a8f55a93ed
16:50:59.141documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-68748435ad32367d
16:50:59.329documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-942258c89036d5e1
16:50:59.518documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f7edc3b61bde5ce9
16:50:59.708documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-17d6a69fb3eb142b
16:50:59.893documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7aa0cb559102ba32
16:51:00.081documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-576e5a1e0ae32b39
16:51:00.270documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ab19eb70735c2463
16:51:00.443documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
16:51:00.612documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
16:51:00.786documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-203b488a21557488
16:51:00.954documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-dd0be9f42b22be6a
16:51:01.133documenterqueryok6 rowsSELECT zone, COUNT(*) AS records, SUM(CASE WHEN proxied = 1 THEN 1 ELSE 0 END) AS proxied, SUM(CASE WHEN proxied = 1 THEN 0 ELSE 1 END) AS direct FROM DRIFT.dns
16:51:01.242documenterqueryok1 rowsSELECT COUNT(DISTINCT object_id) AS objects, COUNT(*) AS settings FROM DRIFT.observation WHERE run_id = 'run-576e5a1e0ae32b39'
16:51:01.339documenterqueryok1 rowsSELECT COUNT(DISTINCT object_id) AS objects, COUNT(*) AS settings FROM DRIFT.observation WHERE run_id = 'run-aed985591cd03b16'
16:51:01.435documenterqueryok1 rowsSELECT COUNT(DISTINCT object_id) AS objects, COUNT(*) AS settings FROM DRIFT.observation WHERE run_id = 'run-a8590cdc5428b8d4'
16:51:01.537documenterqueryok1 rowsSELECT SUM(CASE WHEN observed_at < '2026-10-25T16:49:19.225Z' THEN 0 ELSE 1 END) AS latest, SUM(CASE WHEN observed_at < '2026-10-25T16:49:19.225Z' THEN 1 ELSE 0
16:51:01.623documenterqueryok1 rowsSELECT SUM(CASE WHEN observed_at < '2026-10-25T16:49:15.728Z' THEN 0 ELSE 1 END) AS latest, SUM(CASE WHEN observed_at < '2026-10-25T16:49:15.728Z' THEN 1 ELSE 0
16:51:01.948documenterqueryok112 rowsSELECT v.copy_id, v.surface, v.host, z.zone, v.object_id, v.run_id, v.git_commit, v.taken_at, c.validation_id, c.validator, c.result, c.missing_dependenc
16:51:02.107documenterqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a WHERE a.tenant_id
16:51:02.216documenterqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
16:51:02.439documenterqueryok0 rowsSELECT o.obs_id, o.surface, o.host, o.object_id, o.setting_path FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-576e5a1e0ae32b39'
16:51:02.665documenterqueryok284 rowsSELECT o.obs_id, o.surface, o.host, o.object_id, o.setting_path FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-aed985591cd03b16'
16:51:02.870documenterqueryok735 rowsSELECT o.obs_id, o.surface, o.host, o.object_id, o.setting_path FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-a8590cdc5428b8d4'
16:51:03.022documenterqueryok5 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.verb, d.reason, d.expires_at, d.decided_by, d.rule_id, d.finding
16:51:03.151documenterqueryok12 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.verb, d.reason, d.expires_at, d.decided_by, d.rule_id, d.finding
16:51:03.307documenterqueryok13 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.verb, d.reason, d.expires_at, d.decided_by, d.rule_id, d.finding
16:51:03.418documenterqueryok2 rowsSELECT kind, status, COUNT(*) AS n FROM host-ab06bc.action WHERE tenant_id = 'client-1' GROUP BY kind, status ORDER BY kind, status
16:51:03.522documenterqueryok3 rowsSELECT ticket_id, psa, external_id, url, type, priority, status, action_id, finding_id, updated_at FROM host-fa579b.ticket WHERE tenant_id = 'client-1' ORDER BY type,
16:51:03.614documenterqueryok6 rowsSELECT kind, status, COUNT(*) AS n FROM host-f16622.probe WHERE tenant_id = 'client-1' AND run_id = 'run-203b488a21557488' GROUP BY kind, status ORDER BY kind, status
16:51:03.711documenterqueryok21 rowsSELECT kind, target, probe_id FROM host-f16622.probe WHERE tenant_id = 'client-1' AND run_id = 'run-203b488a21557488' AND status = 'fail' ORDER BY kind, target, probe
16:51:03.712cycletriageokdocument: document.md written for client-1, 197 lines, 30 finding(s) open, 108 queries; deny-list probe 0 of 29 label(s); decided at 2026-10-25T16:49:30.637Zcycle client-1 [9/9] document
16:51:03.712cycletriageokCYCLE: tenant client-1, applied (act carries out its plan): 9 step(s): ok 9, skipped 0, failed 0, not run 0; completed; 116.4 scycle client-1