client-1pass decided 25 Oct 2026 14:17 UTCsample mode

Trace cycle_mvo5600q

examples/traces/cycle_mvo5600q.jsonl, 1,056 events from 25 Oct 2026 18:08 UTC to 25 Oct 2026 18:16 UTC. All traces

About this page

Every free-text field passes the redactor as the trace did when it was written, and a ticket's URL reads as its number.

1,056 events
Time (UTC)AgentActionStatusSummary
18:08:54.094vaultobserveokvault: run run-86289be2f697386b committed to client-1/cloudflare at 211ce3c0fe8d: 58 file(s), 0 added, 0 modified, 0 removed; vault_copy 58 row(s) written of 58cloudflare.dns run run-86289be2f697386b
18:08:54.199cycletriageokcollect:cloudflare: dns run-86289be2f697386b 58/58 complete (6 zones, 58 records), audit run-d5aea29cb37980f2 1320/1320 complete; vault committed 211ce3c0fe8d (58 files, 0 added, 0 modified, 0 removed; vault_copy 58 written)cycle client-1 [1/9] collect:cloudflare
18:08:56.884host-a6a917.linuxobserveok184996 bytes, exit 0ssh -o BatchMode=yes -o ConnectTimeout=15 word-1ef544-vps bash -s
18:08:56.938host-a6a917.linuxobserveokword-1ef544-vps -> host-aa516a: complete, expected 24 observed 24, 761 observations, 46 server blocks, 5 assets, 8 snapshots, 82 backup items
18:08:57.409vaultobserveokvault: run run-70db877af660dc82 committed to client-1/host-aa516a at 5b2cb59ec3bf: 32 file(s), 0 added, 0 modified, 0 removed; vault_copy 32 row(s) written of 32linux.nginx run run-70db877af660dc82
18:08:57.409cycletriageokcollect:linux word-1ef544-vps: host-aa516a run run-70db877af660dc82 24/24 complete, 761 observation(s) written of 761, 46 server blocks, 82 backup items; vault committed 5b2cb59ec3bf (32 files, 0 added, 0 modified, 0 removed; vault_copy 32 written)cycle client-1 [2/9] collect:linux word-1ef544-vps
18:09:00.053host-a6a917.linuxobserveok89047 bytes, exit 0ssh -o BatchMode=yes -o ConnectTimeout=15 word-51eb89-vps bash -s
18:09:00.070host-a6a917.linuxobserveokword-51eb89-vps -> host-4b4dc1: complete, expected 14 observed 14, 301 observations, 30 server blocks, 2 assets, 8 snapshots, 73 backup items
18:09:00.532vaultobserveokvault: run run-143dd416ad5fff95 committed to client-1/host-4b4dc1 at 8d57deb0b3da: 22 file(s), 0 added, 1 modified, 0 removed; vault_copy 22 row(s) written of 22linux.nginx run run-143dd416ad5fff95
18:09:00.532cycletriageokcollect:linux word-51eb89-vps: host-4b4dc1 run run-143dd416ad5fff95 14/14 complete, 301 observation(s) written of 301, 30 server blocks, 73 backup items; vault committed 8d57deb0b3da (22 files, 0 added, 1 modified, 0 removed; vault_copy 22 written)cycle client-1 [3/9] collect:linux word-51eb89-vps
18:09:11.282cycletriageokprobe: run run-80feccb18eb0b84a 117/117 complete, 39 name(s); http 28 ok, 11 fail; dns 36 ok, 3 fail; tls 32 ok, 7 fail; 117 probe row(s) writtencycle client-1 [4/9] probe
18:09:14.331cycletriageokvalidate:copies: 3 repositories at their heads, 3 of them this cycle's commits; copy_validation 112 row(s) written of 112 (cf-schema ok 42, cf-schema ok_with_gaps 16, nginx-t ok_with_gaps 54); 0 repositories not validatedcycle client-1 [5/9] validatehost word-1ef544-vps @5b2cb59e (run run-70db877af660dc82, 32 files, 0 links): nginx-t ok_with_gaps, 1 round, 16 gaps: /etc/letsencrypt/live/host-18efce.ai/fullchain.pem, /etc/letsencrypt/live/host-18efce.ai/privkey.pem, /etc/letsencrypt/live/host-492568.ai/fullchain.pem, /etc/letsencrypt/live/host-492568.ai/privkey.pem, /etc/letsencrypt/live/host-503b27.ai/fullchain.pem, /etc/letsencrypt/live/host
18:09:14.464loopqueryok120 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM DRIFT.collection_run ORDER BY started_at, run_id
18:09:14.571observerqueryok120 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM DRIFT.collection_run ORDER BY started_at, run_id
18:09:14.691deciderqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
18:09:14.902deciderqueryok26 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM host-cc7cb1.dispositio
18:09:15.014deciderqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
18:09:15.172deciderqueryok7 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM host-cc7cb1.dispositio
18:09:15.372observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f9470e2f5f175899
18:09:15.373observercheckokcloudflare.dns: 58/58 completerun_complete run-f9470e2f5f175899
18:09:15.560observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-507c9939230e60a4
18:09:15.561observercheckokcloudflare.audit: 728/728 completerun_complete run-507c9939230e60a4
18:09:15.750observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-67f4d6923cb4838d
18:09:15.750observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-67f4d6923cb4838d
18:09:15.937observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-15638d43819ba756
18:09:15.937observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-15638d43819ba756
18:09:16.119observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b69af94952dccb36
18:09:16.120observercheckokcloudflare.dns: 58/58 completerun_complete run-b69af94952dccb36
18:09:16.309observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9a3335b91e5ef3c3
18:09:16.310observercheckokcloudflare.audit: 797/797 completerun_complete run-9a3335b91e5ef3c3
18:09:16.500observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-071329fedf5f073f
18:09:16.500observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-071329fedf5f073f
18:09:16.685observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4592b852a04812f7
18:09:16.685observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-4592b852a04812f7
18:09:16.880observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e9f519d6a5af0fd0
18:09:16.880observercheckokprobe: 111/111 completerun_complete run-e9f519d6a5af0fd0
18:09:17.105observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-de1564466df1d59b
18:09:17.106observercheckokcloudflare.dns: 58/58 completerun_complete run-de1564466df1d59b
18:09:17.288observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-91f4abd4904e22a6
18:09:17.289observercheckokcloudflare.audit: 818/818 completerun_complete run-91f4abd4904e22a6
18:09:17.470observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-81adedc1cc778bd5
18:09:17.470observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-81adedc1cc778bd5
18:09:17.651observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ace5f05819e5b28e
18:09:17.651observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ace5f05819e5b28e
18:09:17.830observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b247c87d34f38d71
18:09:17.830observercheckokprobe: 111/111 completerun_complete run-b247c87d34f38d71
18:09:18.013observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-59ffd380cfc7cda5
18:09:18.014observercheckokcloudflare.dns: 58/58 completerun_complete run-59ffd380cfc7cda5
18:09:18.201observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-527d9eb092475404
18:09:18.201observercheckokcloudflare.audit: 839/839 completerun_complete run-527d9eb092475404
18:09:18.384observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-400375137e2bae7b
18:09:18.384observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-400375137e2bae7b
18:09:18.571observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-647f878a4f5605f7
18:09:18.571observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-647f878a4f5605f7
18:09:18.791observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-30f5647b8b9c5dff
18:09:18.791observercheckokprobe: 111/111 completerun_complete run-30f5647b8b9c5dff
18:09:18.981observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-8c5af1ac22c54514
18:09:18.981observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-8c5af1ac22c54514
18:09:19.162observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-43c8ccb3704ad21c
18:09:19.162observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-43c8ccb3704ad21c
18:09:19.341observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9e232bb5e1ebdb81
18:09:19.341observercheckokcloudflare.dns: 58/58 completerun_complete run-9e232bb5e1ebdb81
18:09:19.547observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-bbf110bf21466ecc
18:09:19.547observercheckokcloudflare.audit: 860/860 completerun_complete run-bbf110bf21466ecc
18:09:19.757observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-49fc76bf3b823051
18:09:19.757observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-49fc76bf3b823051
18:09:19.944observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ea10fdeb1eae1a46
18:09:19.944observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ea10fdeb1eae1a46
18:09:20.130observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e839e796556a54c3
18:09:20.130observercheckokprobe: 111/111 completerun_complete run-e839e796556a54c3
18:09:20.327observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-74140124db03c3f5
18:09:20.327observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-74140124db03c3f5
18:09:20.515observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-afe5a89ee42acbc2
18:09:20.516observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-afe5a89ee42acbc2
18:09:20.764observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-90bdfa86df88a639
18:09:20.765observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-90bdfa86df88a639
18:09:20.956observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-33b1aa9a8f89d3c8
18:09:20.956observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-33b1aa9a8f89d3c8
18:09:21.147observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ce4dc382bcffa4bb
18:09:21.147observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-ce4dc382bcffa4bb
18:09:21.332observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1f4d84ed6359ff18
18:09:21.333observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-1f4d84ed6359ff18
18:09:21.515observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-463c7c0ce537bd16
18:09:21.515observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-463c7c0ce537bd16
18:09:21.697observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f97423f25dc75884
18:09:21.697observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f97423f25dc75884
18:09:21.877observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-6b65e048bb60fc24
18:09:21.877observercheckokcloudflare.dns: 58/58 completerun_complete run-6b65e048bb60fc24
18:09:22.055observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f6b79eeae02db225
18:09:22.055observercheckokcloudflare.audit: 888/888 completerun_complete run-f6b79eeae02db225
18:09:22.235observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f6c7da2a579e2141
18:09:22.235observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f6c7da2a579e2141
18:09:22.412observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-258ffc0f34ffab51
18:09:22.412observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-258ffc0f34ffab51
18:09:22.589observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-446db683143ec580
18:09:22.589observercheckokprobe: 111/111 completerun_complete run-446db683143ec580
18:09:22.774observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e476cc64252f6715
18:09:22.774observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-e476cc64252f6715
18:09:22.953observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-d1fcc061e5c34158
18:09:22.953observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-d1fcc061e5c34158
18:09:23.132observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-2c3fc585f404b90f
18:09:23.133observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-2c3fc585f404b90f
18:09:23.314observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-396c20fb165306ed
18:09:23.315observercheckokprobe: 6/6 completerun_complete run-396c20fb165306ed
18:09:23.495observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-0f5afdbf81b5b05a
18:09:23.495observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-0f5afdbf81b5b05a
18:09:23.678observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f509f49299848d43
18:09:23.678observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f509f49299848d43
18:09:23.865observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-41e44e7c818c214d
18:09:23.865observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-41e44e7c818c214d
18:09:24.042observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-588dc39d3f984621
18:09:24.042observercheckokhost-a08b07.verify: 2/2 completerun_complete run-588dc39d3f984621
18:09:24.242observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b78229c438b759eb
18:09:24.242observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-b78229c438b759eb
18:09:24.441observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-5307a4b4884f8f8d
18:09:24.441observercheckokhost-a08b07.verify: 2/2 completerun_complete run-5307a4b4884f8f8d
18:09:24.624observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-71776a91583187d1
18:09:24.624observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-71776a91583187d1
18:09:24.818observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-643ca3aadc62f002
18:09:24.819observercheckokcloudflare.dns: 58/58 completerun_complete run-643ca3aadc62f002
18:09:25.004observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-3fcba77d90340f5d
18:09:25.005observercheckokcloudflare.audit: 909/909 completerun_complete run-3fcba77d90340f5d
18:09:25.193observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b094ed4249e79faf
18:09:25.193observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-b094ed4249e79faf
18:09:25.382observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-028e1c06567f1445
18:09:25.383observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-028e1c06567f1445
18:09:25.564observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-af82fe9cd0f12826
18:09:25.564observercheckokprobe: 111/111 completerun_complete run-af82fe9cd0f12826
18:09:25.748observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-63bc01583b366b8d
18:09:25.748observercheckokcloudflare.dns: 58/58 completerun_complete run-63bc01583b366b8d
18:09:25.932observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-8b02f9aad70df0c9
18:09:25.932observercheckokcloudflare.audit: 930/930 completerun_complete run-8b02f9aad70df0c9
18:09:26.121observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-c52288c22d5992fd
18:09:26.121observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-c52288c22d5992fd
18:09:26.312observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-df60a03b49bbda47
18:09:26.313observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-df60a03b49bbda47
18:09:26.502observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f79e58d09c04c8d7
18:09:26.503observercheckokprobe: 111/111 completerun_complete run-f79e58d09c04c8d7
18:09:26.709observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-93f3f163d3d8a95d
18:09:26.709observercheckokcloudflare.dns: 58/58 completerun_complete run-93f3f163d3d8a95d
18:09:26.899observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f9954452442b0cd1
18:09:26.899observercheckokcloudflare.audit: 951/951 completerun_complete run-f9954452442b0cd1
18:09:27.085observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-2a11f407cfdce7b6
18:09:27.086observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-2a11f407cfdce7b6
18:09:27.272observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-d594486e164c4097
18:09:27.272observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-d594486e164c4097
18:09:27.460observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-84b6426b9763f7f1
18:09:27.460observercheckokprobe: 111/111 completerun_complete run-84b6426b9763f7f1
18:09:27.654observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-199d9e1bdc86bf4d
18:09:27.654observercheckokcloudflare.dns: 58/58 completerun_complete run-199d9e1bdc86bf4d
18:09:27.841observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-cf8eb79048a18bc9
18:09:27.841observercheckokcloudflare.audit: 972/972 completerun_complete run-cf8eb79048a18bc9
18:09:28.050observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-439d1fb53664c597
18:09:28.050observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-439d1fb53664c597
18:09:28.254observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-209d57362e152a70
18:09:28.254observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-209d57362e152a70
18:09:28.447observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-02925c58440a149c
18:09:28.448observercheckokprobe: 111/111 completerun_complete run-02925c58440a149c
18:09:28.643observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-480602f60ca854c6
18:09:28.643observercheckokcloudflare.dns: 58/58 completerun_complete run-480602f60ca854c6
18:09:28.841observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f98b965de7012d0b
18:09:28.841observercheckokcloudflare.audit: 993/993 completerun_complete run-f98b965de7012d0b
18:09:29.043observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-573b3e958d5799a2
18:09:29.044observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-573b3e958d5799a2
18:09:29.232observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ee1c61b44a6d6e01
18:09:29.233observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ee1c61b44a6d6e01
18:09:29.420observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-20f146f855acc7b9
18:09:29.420observercheckokprobe: 111/111 completerun_complete run-20f146f855acc7b9
18:09:29.626observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9d48791b00433777
18:09:29.626observercheckokcloudflare.dns: 58/58 completerun_complete run-9d48791b00433777
18:09:29.839observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-77ae40d31854071c
18:09:29.839observercheckokcloudflare.audit: 1014/1014 completerun_complete run-77ae40d31854071c
18:09:30.040observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f74b40064e093f2c
18:09:30.040observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f74b40064e093f2c
18:09:30.229observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-28ad36002e466ed5
18:09:30.229observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-28ad36002e466ed5
18:09:30.410observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7a3ff25f0476b93f
18:09:30.411observercheckokprobe: 111/111 completerun_complete run-7a3ff25f0476b93f
18:09:30.594observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-01c5106777ec2426
18:09:30.594observercheckokcloudflare.dns: 58/58 completerun_complete run-01c5106777ec2426
18:09:30.784observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1d846f0834ec0803
18:09:30.784observercheckokcloudflare.audit: 1036/1036 completerun_complete run-1d846f0834ec0803
18:09:30.967observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-22c36b45028d6029
18:09:30.967observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-22c36b45028d6029
18:09:31.151observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-951d5140591a7f6a
18:09:31.151observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-951d5140591a7f6a
18:09:31.335observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4f41e1f662be63b5
18:09:31.335observercheckokprobe: 111/111 completerun_complete run-4f41e1f662be63b5
18:09:31.529observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-fab71c1a5a8fc015
18:09:31.530observercheckokcloudflare.dns: 58/58 completerun_complete run-fab71c1a5a8fc015
18:09:31.711observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b19145b1ac6e00d5
18:09:31.711observercheckokcloudflare.audit: 1058/1058 completerun_complete run-b19145b1ac6e00d5
18:09:31.926observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1f949ba3c2557d42
18:09:31.926observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-1f949ba3c2557d42
18:09:32.108observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-53c7e1dc36402eca
18:09:32.108observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-53c7e1dc36402eca
18:09:32.290observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-519f93197de9adf6
18:09:32.290observercheckokprobe: 111/111 completerun_complete run-519f93197de9adf6
18:09:32.472observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e1e626eaa8ec20aa
18:09:32.472observercheckokprobe: 117/117 completerun_complete run-e1e626eaa8ec20aa
18:09:32.658observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-0b0dc83717dd3728
18:09:32.658observercheckokcloudflare.dns: 58/58 completerun_complete run-0b0dc83717dd3728
18:09:32.841observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-af44e31de1d0bb30
18:09:32.841observercheckokcloudflare.audit: 1101/1101 completerun_complete run-af44e31de1d0bb30
18:09:33.024observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-6c2480894f434d74
18:09:33.024observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-6c2480894f434d74
18:09:33.204observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-35ba6c1a2a987888
18:09:33.205observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-35ba6c1a2a987888
18:09:33.385observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7bbe33a8f55a93ed
18:09:33.385observercheckokprobe: 117/117 completerun_complete run-7bbe33a8f55a93ed
18:09:33.570observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-68748435ad32367d
18:09:33.570observercheckokcloudflare.dns: 58/58 completerun_complete run-68748435ad32367d
18:09:33.763observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-942258c89036d5e1
18:09:33.763observercheckokcloudflare.audit: 1123/1123 completerun_complete run-942258c89036d5e1
18:09:33.948observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f7edc3b61bde5ce9
18:09:33.948observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f7edc3b61bde5ce9
18:09:34.133observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-17d6a69fb3eb142b
18:09:34.133observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-17d6a69fb3eb142b
18:09:34.319observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7aa0cb559102ba32
18:09:34.319observercheckokprobe: 117/117 completerun_complete run-7aa0cb559102ba32
18:09:34.506observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-576e5a1e0ae32b39
18:09:34.506observercheckokcloudflare.dns: 58/58 completerun_complete run-576e5a1e0ae32b39
18:09:34.694observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ab19eb70735c2463
18:09:34.694observercheckokcloudflare.audit: 1145/1145 completerun_complete run-ab19eb70735c2463
18:09:34.878observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
18:09:34.878observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-a8590cdc5428b8d4
18:09:35.063observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
18:09:35.063observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-aed985591cd03b16
18:09:35.263observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-203b488a21557488
18:09:35.263observercheckokprobe: 117/117 completerun_complete run-203b488a21557488
18:09:35.444observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-dd0be9f42b22be6a
18:09:35.444observercheckokhost-a08b07.verify: 1/1 completerun_complete run-dd0be9f42b22be6a
18:09:35.662observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4df8de37577a757f
18:09:35.662observercheckokcloudflare.dns: 58/58 completerun_complete run-4df8de37577a757f
18:09:35.847observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-99e455e8735204a5
18:09:35.847observercheckokcloudflare.audit: 1298/1298 completerun_complete run-99e455e8735204a5
18:09:36.029observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9a81c991cb2d1715
18:09:36.029observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-9a81c991cb2d1715
18:09:36.212observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-80d1bd20c023687b
18:09:36.212observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-80d1bd20c023687b
18:09:36.397observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-06a10d3c1445bc07
18:09:36.398observercheckokprobe: 117/117 completerun_complete run-06a10d3c1445bc07
18:09:36.581observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-c3fa0e510b88329c
18:09:36.581observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-c3fa0e510b88329c
18:09:36.761observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b54250291cf98f3d
18:09:36.762observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-b54250291cf98f3d
18:09:36.945observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-971bbcf3bbe0b721
18:09:36.945observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-971bbcf3bbe0b721
18:09:37.125observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-86289be2f697386b
18:09:37.125observercheckokcloudflare.dns: 58/58 completerun_complete run-86289be2f697386b
18:09:37.317observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-d5aea29cb37980f2
18:09:37.318observercheckokcloudflare.audit: 1320/1320 completerun_complete run-d5aea29cb37980f2
18:09:37.497observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:09:37.497observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-70db877af660dc82
18:09:37.683observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:09:37.683observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-143dd416ad5fff95
18:09:37.868observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-80feccb18eb0b84a
18:09:37.868observercheckokprobe: 117/117 completerun_complete run-80feccb18eb0b84a
18:09:37.868observerchecknot_checkedaudit log withheld for lab-1: no cloudflare.audit run for this tenantaudit_event lab-1actor_attributed, previous_value_recoverable, referent_unchanged, record_reverted are rejected for every finding of this tenant this pass
18:09:38.003observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:38.233observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:38.279observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-f9470e2f5f175899)run-67f4d6923cb4838dmodel: none
18:09:38.394observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:38.586observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:38.601observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-f9470e2f5f175899)run-15638d43819ba756model: none
18:09:38.738observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:38.940observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:38.986observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-b69af94952dccb36)run-071329fedf5f073fmodel: none
18:09:39.111observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:39.306observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:39.326observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-b69af94952dccb36)run-4592b852a04812f7model: none
18:09:39.459observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:39.643observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:39.694observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-de1564466df1d59b)run-81adedc1cc778bd5model: none
18:09:39.810observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:39.994observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:40.018observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-de1564466df1d59b)run-ace5f05819e5b28emodel: none
18:09:40.145observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:40.335observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:40.394observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-400375137e2bae7bmodel: none
18:09:40.514observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:40.694observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:40.723observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-647f878a4f5605f7model: none
18:09:40.848observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:41.031observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:41.101observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-8c5af1ac22c54514model: none
18:09:41.216observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:41.401observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:41.436observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-43c8ccb3704ad21cmodel: none
18:09:41.556observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:41.743observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:41.836observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-49fc76bf3b823051model: none
18:09:41.949observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:42.142observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:42.184observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-ea10fdeb1eae1a46model: none
18:09:42.303observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:42.306observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-74140124db03c3f5model: none
18:09:42.438observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:42.442observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-afe5a89ee42acbc2model: none
18:09:42.578observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:42.583observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-90bdfa86df88a639model: none
18:09:42.703observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:42.707observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-33b1aa9a8f89d3c8model: none
18:09:42.820observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:42.824observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-ce4dc382bcffa4bbmodel: none
18:09:42.932observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:42.936observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-1f4d84ed6359ff18model: none
18:09:43.049observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:43.052observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-463c7c0ce537bd16model: none
18:09:43.163observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:43.166observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f97423f25dc75884model: none
18:09:43.299observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:43.493observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:43.594observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-6b65e048bb60fc24)run-f6c7da2a579e2141model: none
18:09:43.713observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:43.904observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:43.950observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-6b65e048bb60fc24)run-258ffc0f34ffab51model: none
18:09:44.065observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:44.069observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-e476cc64252f6715model: none
18:09:44.182observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:44.185observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-d1fcc061e5c34158model: none
18:09:44.322observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:44.329observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-2c3fc585f404b90fmodel: none
18:09:44.448observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:44.453observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-0f5afdbf81b5b05amodel: none
18:09:44.576observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:44.582observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f509f49299848d43model: none
18:09:44.707observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:44.712observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-41e44e7c818c214dmodel: none
18:09:44.828observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:44.833observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-b78229c438b759ebmodel: none
18:09:44.945observerqueryok23 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:44.952observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-71776a91583187d1model: none
18:09:45.079observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:45.279observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:45.415observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-643ca3aadc62f002)run-b094ed4249e79fafmodel: none
18:09:45.541observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:45.729observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:45.787observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-643ca3aadc62f002)run-028e1c06567f1445model: none
18:09:45.913observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:46.105observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:46.254observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-63bc01583b366b8d)run-c52288c22d5992fdmodel: none
18:09:46.384observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:46.584observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:46.665observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-63bc01583b366b8d)run-df60a03b49bbda47model: none
18:09:46.825observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:47.015observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:47.174observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-2a11f407cfdce7b6model: none
18:09:47.308observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:47.501observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:47.568observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-d594486e164c4097model: none
18:09:47.695observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:47.878observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:48.021observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-439d1fb53664c597model: none
18:09:48.133observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:48.318observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:48.382observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-209d57362e152a70model: none
18:09:48.504observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:48.689observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:48.846observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-480602f60ca854c6)run-573b3e958d5799a2model: none
18:09:48.959observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:49.143observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:49.214observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-480602f60ca854c6)run-ee1c61b44a6d6e01model: none
18:09:49.348observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:49.540observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:49.708observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9d48791b00433777)run-f74b40064e093f2cmodel: none
18:09:49.843observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:50.045observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:50.118observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9d48791b00433777)run-28ad36002e466ed5model: none
18:09:50.244observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:50.450observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:50.643observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-01c5106777ec2426)run-22c36b45028d6029model: none
18:09:50.769observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:50.967observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:51.057observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-01c5106777ec2426)run-951d5140591a7f6amodel: none
18:09:51.176observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:51.363observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:51.561observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-fab71c1a5a8fc015)run-1f949ba3c2557d42model: none
18:09:51.674observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:51.856observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:51.943observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-fab71c1a5a8fc015)run-53c7e1dc36402ecamodel: none
18:09:52.065observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:52.248observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:52.497observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-0b0dc83717dd3728)run-6c2480894f434d74model: none
18:09:52.611observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:52.794observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:52.896observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-0b0dc83717dd3728)run-35ba6c1a2a987888model: none
18:09:53.020observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:53.201observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:53.457observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-68748435ad32367d)run-f7edc3b61bde5ce9model: none
18:09:53.579observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:53.775observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:53.892observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-68748435ad32367d)run-17d6a69fb3eb142bmodel: none
18:09:54.017observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:54.202observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:54.469observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-576e5a1e0ae32b39)run-a8590cdc5428b8d4model: none
18:09:54.588observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:54.781observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:54.893observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-576e5a1e0ae32b39)run-aed985591cd03b16model: none
18:09:55.022observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:55.214observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:55.494observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-4df8de37577a757f)run-9a81c991cb2d1715model: none
18:09:55.611observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:55.846observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:55.971observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-4df8de37577a757f)run-80d1bd20c023687bmodel: none
18:09:56.087observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:56.274observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:56.401observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-86289be2f697386b)run-c3fa0e510b88329cmodel: none
18:09:56.517observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:56.703observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:56.832observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-86289be2f697386b)run-b54250291cf98f3dmodel: none
18:09:56.946observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:57.125observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:57.252observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-86289be2f697386b)run-971bbcf3bbe0b721model: none
18:09:57.377observerqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:57.560observerqueryok50 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:57.870observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-86289be2f697386b)run-70db877af660dc82model: none
18:09:57.982observerqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:09:58.159observerqueryok25 rowsSELECT o.obs_id, d.record_id, d.content, d.observed_at FROM DRIFT.observation o JOIN DRIFT.dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id
18:09:58.290observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-86289be2f697386b)run-143dd416ad5fff95model: none
18:09:58.581detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM host-90e35a.observ
18:09:58.581detectordetectoklinux.nginx host-aa516a: 0 setting(s) point at a name resolving outside the inventoryhero run-70db877af660dc82 x run-86289be2f697386bmodel: none
18:09:58.842detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM host-90e35a.observ
18:09:58.843detectordetectoklinux.nginx host-4b4dc1: 0 setting(s) point at a name resolving outside the inventoryhero run-143dd416ad5fff95 x run-86289be2f697386bmodel: none
18:09:58.843detectordetectnot_checkedno DNS run of this pass for this tenant; the hero query has nothing to joinlinux.nginx host-951abf
18:09:59.029detectorqueryok1 rowsSELECT c.zone, c.name AS proxied_name, c.record_id AS proxied_record_id, a.name AS target_name, a.type AS target_type, a.content AS target_content, a.rec
18:09:59.029detectordetectokcloudflare.dns: 1 proxied CNAME(s) alias a direct address recordproxy_split run-86289be2f697386bmodel: none
18:09:59.029detectordetectokproxy_split: host-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it points atproxied record bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none
18:09:59.147detectorqueryok1 rowsSELECT MIN(occurred_at) AS first_at, MAX(occurred_at) AS last_at, COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1'
18:09:59.363checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-86289be2f697386b
18:09:59.363checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-86289be2f697386b"}Run run-86289be2f697386b collected everything it set out to collect.
18:09:59.490checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2d
18:09:59.491checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:48.799Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:48.799Z.
18:09:59.779checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:09:59.779checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
18:10:00.127checkerqueryok3 rowsSELECT 'dns_record' AS evidence, a.record_id AS resource_id, a.content AS old_value, b.content AS new_value, b.observed_at AS seen_at FROM DRIFT.dns_record a JO
18:10:00.127checkercheckfailedreferent_unchanged: fails (3 rows)referent_unchanged {"tenant_id":"client-1","name":"host-524b42.quest","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:48.799Z"}host-524b42.quest changed between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:48.799Z (3 pieces of evidence).
18:10:00.240deciderqueryok117 rowsSELECT probe_id, run_id, kind, target, expected, observed, status, latency_ms, observed_at FROM host-f16622.probe WHERE tenant_id = 'client-1' AND run_id = 'run-80fec
18:10:00.240deciderdecideokESCALATE: hold under rule rule-8e75e1d767980665 expired 2026-10-25T03:21:06.870Z; the finding standsproxy_split proxied in bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none; policy: rule-8e75e1d767980665 (cloudflare.dns * proxied v2: critical, lock 1, on_drift rollback, on_no_copy investigate_ticket, hold 4 h); the checks alone say ESCALATE; production answering (3 probes of its names ok in run-80feccb18eb0b84a); prior HOLD since 2026-10-25T01:45:33.962Z until 2026-10-25T03:21:06.870Z
18:10:00.347deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:00.498deciderqueryok2 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:00.596deciderqueryok1 rowsSELECT COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b6823d5f6ecd3f2' AND action <> 'view' AND occurred_
18:10:00.597decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T18:08:48.799Z, still so in DNS run run-86289be2f697386bexposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
18:10:00.597judgejudgeskippedhost-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it pointsmodel: none (sample)
18:10:01.114detectorqueryok10 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
18:10:01.484detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
18:10:01.485detectordetectoklinux.nginx host-aa516a: 10 proxied name(s) served by a block that trusts no real_ip range, 1 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-70db877af660dc82 x run-86289be2f697386bmodel: none
18:10:01.485detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
18:10:01.676checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:01.676checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:01.772checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:01.772checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:01.878checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a0
18:10:01.879checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:02.106checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:02.106checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
18:10:02.107decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:02.107deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:02.215deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:02.370deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:02.469deciderqueryok1 rowsSELECT COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc11f85b45bc4' AND action <> 'view' AND occurred_
18:10:02.470decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 110 day(s) to 2026-10-25T18:08:48.799Z, still so in DNS run run-86289be2f697386bexposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
18:10:02.470judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is averdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:02.470detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
18:10:02.695checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:02.696checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:02.791checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:02.792checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:02.889checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a0
18:10:02.889checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:03.100checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:03.100checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
18:10:03.101decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:03.101deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:03.101decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 110 day(s) to 2026-10-25T18:08:48.799Z, still so in DNS run run-86289be2f697386bexposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
18:10:03.101judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is abverdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:03.102detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
18:10:03.286checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:03.287checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:03.375checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:03.376checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:03.470checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029
18:10:03.470checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:03.636checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:03.636checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
18:10:03.636decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:03.637deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:03.731deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:03.867deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:03.867decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure 803592cea544029b20da8b45e5045f41model: none
18:10:03.867judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:03.868detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
18:10:04.045checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:04.045checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:04.130checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:04.130checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:04.224checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029
18:10:04.224checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:04.388checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:04.388checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
18:10:04.388decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:04.388deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:04.389decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure 803592cea544029b20da8b45e5045f41model: none
18:10:04.389judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:04.389detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
18:10:04.577checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:04.577checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:04.665checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:04.666checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:04.761checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc
18:10:04.761checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:04.967checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:04.967checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
18:10:04.967decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:04.967deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:05.065deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:05.194deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:05.195decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
18:10:05.195judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:05.195detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
18:10:05.381checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:05.381checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:05.473checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:05.473checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:05.568checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc
18:10:05.568checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:05.727checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:05.728checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
18:10:05.728decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:05.728deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:05.728decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
18:10:05.728judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:05.728detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
18:10:05.908checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:05.908checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:05.996checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:05.996checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:06.093checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537f
18:10:06.093checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:06.258checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:06.258checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
18:10:06.258decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:06.258deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:06.355deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:06.486deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:06.486decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
18:10:06.487judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:06.487detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
18:10:06.672checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:06.673checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:06.765checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:06.765checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:06.863checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537f
18:10:06.863checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:07.026checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:07.027checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
18:10:07.027decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:07.027deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:07.027decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
18:10:07.027judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:07.027detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
18:10:07.207checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:07.207checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:07.295checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:07.295checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:07.400checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28
18:10:07.400checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:07.581checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:07.582checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
18:10:07.582decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:07.582deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:07.698deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:07.833deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:07.833decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
18:10:07.834judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:07.834detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
18:10:08.025checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:08.025checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:08.115checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:08.115checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:08.210checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28
18:10:08.210checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:08.376checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:08.377checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
18:10:08.377decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:08.377deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:08.377decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
18:10:08.377judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:08.377detectordetectokproxied_without_real_ip: *.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.conf is absent): every name under the wildcard sees Cloudflare's addresses as its visitorshttp.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none
18:10:08.564checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:10:08.564checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-70db877af660dc82"}Run run-70db877af660dc82 collected everything it set out to collect.
18:10:08.654checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:08.654checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:08.751checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c922e6966d55b15
18:10:08.751checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed c922e6966d55b15bd96b5e8ea932b715 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:08.915checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:08.915checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715"}The audit log does not record what c922e6966d55b15bd96b5e8ea932b715 was before its latest change.
18:10:08.915decidertriageokexception mem-19 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516alesson mem-19 on *.host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:43.955Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:08.916deciderdecideokADOPT: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-19 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
18:10:09.012deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:09.143deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:09.143decidertriagenot_checkedexposure not dated: the audit log holds no event on c922e6966d55b15bd96b5e8ea932b715 that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure c922e6966d55b15bd96b5e8ea932b715model: none
18:10:09.143judgejudgeskipped*.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.confverdict cannot move: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:09.695detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM DRIFT.dns_record d LEFT J
18:10:09.695detectordetectoklinux.nginx host-aa516a: 1 record(s) land here with no enabled server block naming themorphan_record run-70db877af660dc82 x run-86289be2f697386bmodel: none
18:10:09.695detectordetectokorphan_record: host-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default serverrecord c8b1963847dafe3548b1a4b93f520c0amodel: none
18:10:09.889checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-86289be2f697386b
18:10:09.889checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-86289be2f697386b"}Run run-86289be2f697386b collected everything it set out to collect.
18:10:09.978checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
18:10:09.979checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
18:10:10.075checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c8b1963847dafe3
18:10:10.076checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:08:56.886Z"}No audit event names who changed c8b1963847dafe3548b1a4b93f520c0a between 2026-03-20T01:29:03.000Z and 2026-10-25T18:08:56.886Z.
18:10:10.243checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:10.243checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a"}The audit log does not record what c8b1963847dafe3548b1a4b93f520c0a was before its latest change.
18:10:10.243deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T17:14:28.178Z under rule rule-b8d9962485c3ced4orphan_record name in c8b1963847dafe3548b1a4b93f520c0a on host-aa516amodel: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (2 failing probes in run-80feccb18eb0b84a: http host-3fef97.club, tls host-3fef97.club); prior HOLD since 2026-10-25T17:14:28.178Z until 2026-10-27T23:21:06.870Z
18:10:10.340deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:10.479deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6b6bba' AND e.old_val
18:10:10.479decidertriagenot_checkedexposure not dated: the audit log holds no event on c8b1963847dafe3548b1a4b93f520c0a that sets content=ip-6b6bba with no later different body up to 2026-10-25T18:08:48.799Zexposure c8b1963847dafe3548b1a4b93f520c0amodel: none
18:10:10.480judgejudgeskippedhost-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
18:10:10.980detectorqueryok0 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM host-46425a.observa
18:10:10.980detectordetectoklinux.nginx host-aa516a: 0 server_name(s) with no record and no covering wildcardorphan_vhost run-70db877af660dc82 x run-86289be2f697386bmodel: none
18:10:11.485detectorqueryok9 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
18:10:11.865detectorqueryok0 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
18:10:11.865detectordetectoklinux.nginx host-4b4dc1: 9 proxied name(s) served by a block that trusts no real_ip range, 0 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-143dd416ad5fff95 x run-86289be2f697386bmodel: none
18:10:11.865detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
18:10:12.062checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:12.062checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:12.162checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:12.163checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:12.270checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6
18:10:12.270checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:12.458checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:12.458checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
18:10:12.458decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:12.458deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:12.572deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:12.761deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:12.761decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
18:10:12.761judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:12.761detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
18:10:12.943checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:12.943checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:13.031checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:13.032checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:13.127checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6
18:10:13.127checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:13.298checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:13.299checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
18:10:13.299decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:13.299deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:13.299decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
18:10:13.299judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:13.299detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
18:10:13.485checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:13.486checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:13.575checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:13.575checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:13.676checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2d
18:10:13.676checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:13.913checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:13.913checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
18:10:13.913decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:13.913deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:13.914decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T18:08:48.799Z, still so in DNS run run-86289be2f697386bexposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
18:10:13.914judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:13.914detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
18:10:14.100checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:14.100checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:14.190checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:14.190checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:14.288checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2d
18:10:14.288checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:14.502checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:14.503checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
18:10:14.503decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:14.503deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:14.504decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T18:08:48.799Z, still so in DNS run run-86289be2f697386bexposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
18:10:14.504judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:14.504detectordetectokproxied_without_real_ip: host-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
18:10:14.698checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:14.699checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:14.790checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:14.791checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:14.905checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b43f276dea49e4d
18:10:14.905checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}No audit event names who changed b43f276dea49e4dd9c2271e5a084e37e between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:15.096checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:15.096checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e"}The audit log does not record what b43f276dea49e4dd9c2271e5a084e37e was before its latest change.
18:10:15.096decidertriageokexception mem-11 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-11 on host-525a57.com (proxied_without_real_ip), recorded 2026-10-25T14:17:25.100Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:15.096deciderdecideokADOPT: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-11 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:15.194deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:15.325deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:15.325decidertriagenot_checkedexposure not dated: the audit log holds no event on b43f276dea49e4dd9c2271e5a084e37e that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure b43f276dea49e4dd9c2271e5a084e37emodel: none
18:10:15.326judgejudgeskippedhost-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:15.326detectordetectokproxied_without_real_ip: host-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
18:10:15.506checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:15.507checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:15.594checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:15.594checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:15.690checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b5e781103f2acd7
18:10:15.691checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}No audit event names who changed b5e781103f2acd7d15886934269551c1 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:15.853checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:15.853checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1"}The audit log does not record what b5e781103f2acd7d15886934269551c1 was before its latest change.
18:10:15.854decidertriageokexception mem-10 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-10 on host-5c38db.com (proxied_without_real_ip), recorded 2026-10-25T14:17:22.803Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:15.854deciderdecideokADOPT: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-10 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:15.950deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:16.080deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:16.081decidertriagenot_checkedexposure not dated: the audit log holds no event on b5e781103f2acd7d15886934269551c1 that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure b5e781103f2acd7d15886934269551c1model: none
18:10:16.081judgejudgeskippedhost-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:16.081detectordetectokproxied_without_real_ip: host-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none
18:10:16.263checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:16.263checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:16.352checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:16.352checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:16.447checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '893f8252d3d2b23
18:10:16.447checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}No audit event names who changed 893f8252d3d2b233459c1f10f5143d13 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:16.607checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:16.607checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13"}The audit log does not record what 893f8252d3d2b233459c1f10f5143d13 was before its latest change.
18:10:16.607decidertriageokexception mem-6 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1lesson mem-6 on host-62f7a4.com (proxied_without_real_ip), recorded 2026-10-25T14:17:13.404Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:16.608deciderdecideokADOPT: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-6 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:16.703deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:16.834deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:16.834decidertriagenot_checkedexposure not dated: the audit log holds no event on 893f8252d3d2b233459c1f10f5143d13 that sets proxied=true with no later different body up to 2026-10-25T18:08:48.799Zexposure 893f8252d3d2b233459c1f10f5143d13model: none
18:10:16.834judgejudgeskippedhost-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1verdict cannot move: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:16.835detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
18:10:17.017checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:17.017checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:17.103checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:17.103checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:17.197checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee
18:10:17.198checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:17.410checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:17.410checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
18:10:17.410decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:17.410deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:17.521deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:17.671deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
18:10:17.771deciderqueryok1 rowsSELECT COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668f5f435a4ae1' AND action <> 'view' AND occurred_
18:10:17.772decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T18:08:48.799Z, still so in DNS run run-86289be2f697386bexposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
18:10:17.772judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:17.772detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
18:10:17.952checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:17.952checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:18.040checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:18.040checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:18.134checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee
18:10:18.135checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:18.338checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:18.338checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
18:10:18.338decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:18.338deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
18:10:18.339decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T18:08:48.799Z, still so in DNS run run-86289be2f697386bexposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
18:10:18.339judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:18.880detectorqueryok2 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM DRIFT.dns_record d LEFT J
18:10:18.880detectordetectoklinux.nginx host-4b4dc1: 2 record(s) land here with no enabled server block naming themorphan_record run-143dd416ad5fff95 x run-86289be2f697386bmodel: none
18:10:18.881detectordetectokorphan_record: host-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord b0a17a719bd2118a535a763379ab7ba9model: none
18:10:19.076checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-86289be2f697386b
18:10:19.076checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-86289be2f697386b"}Run run-86289be2f697386b collected everything it set out to collect.
18:10:19.185checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:19.186checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:19.309checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b0a17a719bd2118
18:10:19.309checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}No audit event names who changed b0a17a719bd2118a535a763379ab7ba9 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:19.480checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:19.480checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9"}The audit log does not record what b0a17a719bd2118a535a763379ab7ba9 was before its latest change.
18:10:19.480deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T17:14:28.178Z under rule rule-b8d9962485c3ced4orphan_record name in b0a17a719bd2118a535a763379ab7ba9 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-80feccb18eb0b84a: http host-50b116.com); prior HOLD since 2026-10-25T17:14:28.178Z until 2026-10-27T23:21:06.870Z
18:10:19.590deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:19.738deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
18:10:19.738decidertriagenot_checkedexposure not dated: the audit log holds no event on b0a17a719bd2118a535a763379ab7ba9 that sets content=ip-6fb86d with no later different body up to 2026-10-25T18:08:48.799Zexposure b0a17a719bd2118a535a763379ab7ba9model: none
18:10:19.738judgejudgeskippedhost-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
18:10:19.738detectordetectokorphan_record: host-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord 25a23b5c40a3de0ea11b6054a7b54d07model: none
18:10:19.934checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-86289be2f697386b
18:10:19.934checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-86289be2f697386b"}Run run-86289be2f697386b collected everything it set out to collect.
18:10:20.036checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM DRIFT.inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
18:10:20.036checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
18:10:20.154checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0
18:10:20.154checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T18:09:00.054Z"}1 audit event with a named actor touched 25a23b5c40a3de0ea11b6054a7b54d07 between 2026-03-20T01:29:03.000Z and 2026-10-25T18:09:00.054Z.
18:10:20.381checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM DRIFT.audit_event e WHERE e.ten
18:10:20.381checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07"}The audit log does not record what 25a23b5c40a3de0ea11b6054a7b54d07 was before its latest change.
18:10:20.382deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T17:14:28.178Z under rule rule-b8d9962485c3ced4orphan_record name in 25a23b5c40a3de0ea11b6054a7b54d07 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-80feccb18eb0b84a: http host-c10fff.com); prior HOLD since 2026-10-25T17:14:28.178Z until 2026-10-27T23:21:06.870Z
18:10:20.477deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' AND r
18:10:20.626deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
18:10:20.722deciderqueryok1 rowsSELECT COUNT(*) AS n FROM DRIFT.audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0ea11b6054a7b54d07' AND action <> 'view' AND occurred_
18:10:20.723decidertriageokcontent=ip-6fb86d since 2026-07-06T18:46:40.994Z: at least 110 day(s) to 2026-10-25T18:08:48.799Z, still so in DNS run run-86289be2f697386bexposure 25a23b5c40a3de0ea11b6054a7b54d07first event of the current state: evt-48d6696c1de70593 (update); no earlier body on record sets another content state, so the state may predate the log; model: none
18:10:20.723judgejudgeskippedhost-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
18:10:21.231detectorqueryok3 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM host-46425a.observa
18:10:21.232detectordetectoklinux.nginx host-4b4dc1: 3 server_name(s) with no record and no covering wildcardorphan_vhost run-143dd416ad5fff95 x run-86289be2f697386bmodel: none
18:10:21.232detectordetectokorphan_vhost: host-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none
18:10:21.426checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:21.426checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:21.546checkerqueryok0 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'r
18:10:21.546checkercheckokother_settings_reference: holds (0 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-085e02.com","run_id":"run-143dd416ad5fff95","object_id":"/etc/nginx/sites-available/host-085e02.com","setting_path":"server[host-0No other setting in run run-143dd416ad5fff95 points at host-085e02.com.
18:10:21.641checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM DRIFT.backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:2
18:10:21.641checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
18:10:21.641decidertriageokexception mem-8 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1lesson mem-8 on host-085e02.com (orphan_vhost), recorded 2026-10-25T14:17:18.089Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:21.641deciderdecideokADOPT: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTorphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-8 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
18:10:21.642judgejudgeskippedhost-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collecteverdict cannot move: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:21.642detectordetectokorphan_vhost: host-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
18:10:21.825checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:21.825checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:21.941checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'r
18:10:21.942checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-89f6e7.com","run_id":"run-143dd416ad5fff95","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-143dd416ad5fff95 also point at host-89f6e7.com.
18:10:22.028checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM DRIFT.backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:2
18:10:22.028checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
18:10:22.028decidertriageokexception mem-4 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-4 on host-89f6e7.com (orphan_vhost), recorded 2026-10-25T14:17:08.716Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:22.029deciderdecideokADOPT: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-4 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
18:10:22.029judgejudgeskippedhost-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:22.029detectordetectokorphan_vhost: host-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
18:10:22.225checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:22.225checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:22.346checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'r
18:10:22.346checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-9ac4f1.com","run_id":"run-143dd416ad5fff95","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-143dd416ad5fff95 also point at host-9ac4f1.com.
18:10:22.435checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM DRIFT.backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:2
18:10:22.436checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
18:10:22.436decidertriageokexception mem-16 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-16 on host-9ac4f1.com (orphan_vhost), recorded 2026-10-25T14:17:36.809Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
18:10:22.436deciderdecideokADOPT: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-16 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
18:10:22.436judgejudgeskippedhost-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
18:10:22.814detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
18:10:22.814detectordetectoklinux.nginx host-aa516a: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-70db877af660dc82model: none
18:10:23.205detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a
18:10:23.206detectordetectoklinux.nginx host-aa516a: 0 approved setting(s) whose object the run lacksapproved_missing run-70db877af660dc82model: none
18:10:23.519detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM DRIFT.
18:10:23.519detectordetectoklinux.nginx host-aa516a: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-70db877af660dc82model: none
18:10:23.791detectorqueryok1 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
18:10:23.792detectordetectoklinux.nginx host-4b4dc1: 1 setting(s) drifted from their latest approvaldrift_vs_approved run-143dd416ad5fff95model: none
18:10:23.792detectordetectokdrift_vs_approved: file in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is 644c5f4af269, and its latest approval, 2026-10-25T18:08:29.101Z by operator, is c14c75198c71: the live value drifted from the approved onefile in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
18:10:23.977checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:23.977checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:24.202checkerqueryok0 rowsSELECT o.obs_id, o.value_hash, a.approval_id, a.approved_at, a.approved_by FROM DRIFT.observation o JOIN DRIFT.approved_setting a ON a.tenant_id = o.tenant_id A
18:10:24.202checkercheckfailedsetting_matches_approved: fails (0 rows)setting_matches_approved {"tenant_id":"client-1","host":"host-4b4dc1","object_id":"/etc/nginx/sites-available/host-525a57.com","setting_path":"file","run_id":"run-143dd416ad5fff95"}/etc/nginx/sites-available/host-525a57.com file on host-4b4dc1 matches no approved value.
18:10:24.530checkerqueryok2 rowsSELECT a.approval_id, a.object_id, a.setting_path, a.approved_at, a.approved_by, s.snapshot_id AS latest_snapshot_id, s.taken_at AS latest_backup_at,
18:10:24.531checkercheckfailedrestore_would_regress: fails (2 rows)restore_would_regress {"tenant_id":"client-1","host":"host-4b4dc1"}Restoring host-4b4dc1 from its latest backup would regress 2 approved settings approved after that backup was taken.
18:10:24.671checkerqueryok0 rowsSELECT s.snapshot_id, s.kind, s.taken_at, b.value_hash FROM DRIFT.backup_snapshot s JOIN DRIFT.backup_item b ON b.snapshot_id = s.snapshot_id WHERE s.tenant_id
18:10:24.672checkercheckfailedchange_in_last_backup: fails (0 rows)change_in_last_backup {"tenant_id":"client-1","host":"host-4b4dc1","object_id":"/etc/nginx/sites-available/host-525a57.com","setting_path":"file","value_hash":"sha256:644c5f4af2696fa5d930afb81ea40752dThe latest backup of host-4b4dc1 holds no copy of /etc/nginx/sites-available/host-525a57.com file at 644c5f4af269, so a restore from it sets another value or none.
18:10:25.005deciderqueryok1 rowsSELECT v.copy_id, v.run_id, v.git_commit, v.blob_sha256, v.taken_at, o.value_hash, c.validation_id, c.validator, c.result, c.missing_dependencies, c.vali
18:10:25.005deciderdecideokFIX: live value drifted from approved c14c75198c71 with no valid copy (1 copy in the vault, latest validation unvalidated) and production affected (1 failing probe in run-80feccb18eb0b84a: http host-22b64a.com), so rule rule-6c41a25a00c404c8 investigates, fixes where allowed, documents and opens a ticketdrift_vs_approved file in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: rule-6c41a25a00c404c8 (linux.nginx /etc/nginx/sites-available/* file v2: critical, lock 1, on_drift rollback, on_no_copy investigate_ticket, hold 24 h); the checks alone say ESCALATE; production affected (1 failing probe in run-80feccb18eb0b84a: http host-22b64a.com); approved c14c75198c71, 1 copy row(s), no valid copy
18:10:25.005judgejudgeskippedfile in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is 644c5f4af269, and its latest approval, 2026-10-25T18:08:29.101Z by operator, is c14c75198c7model: none (sample)
18:10:25.300detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a
18:10:25.300detectordetectoklinux.nginx host-4b4dc1: 0 approved setting(s) whose object the run lacksapproved_missing run-143dd416ad5fff95model: none
18:10:25.633detectorqueryok1 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM DRIFT.
18:10:25.634detectordetectoklinux.nginx host-4b4dc1: 1 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-143dd416ad5fff95model: none
18:10:25.634detectordetectokchanged_since_backup: /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is 644c5f4af269 and its copy in the host's newest backup (snap-038fceed7aa05c02, taken 2026-10-25T03:40:05.995Z) is 77c0bfaa68ff: the live file and the backup copy differfile in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
18:10:25.847checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:10:25.847checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-143dd416ad5fff95"}Run run-143dd416ad5fff95 collected everything it set out to collect.
18:10:25.946checkerqueryok1 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM DRIFT.backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-10-25T03:4
18:10:25.946checkercheckokbackup_recent: holds (1 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-10-25T03:40:05.995Z"}host-4b4dc1 has 1 backup snapshot taken since 2026-10-25T03:40:05.995Z.
18:10:26.083checkerqueryok0 rowsSELECT s.snapshot_id, s.kind, s.taken_at, b.value_hash FROM DRIFT.backup_snapshot s JOIN DRIFT.backup_item b ON b.snapshot_id = s.snapshot_id WHERE s.tenant_id
18:10:26.083checkercheckfailedchange_in_last_backup: fails (0 rows)change_in_last_backup {"tenant_id":"client-1","host":"host-4b4dc1","object_id":"/etc/nginx/sites-available/host-525a57.com","setting_path":"file","value_hash":"sha256:644c5f4af2696fa5d930afb81ea40752dThe latest backup of host-4b4dc1 holds no copy of /etc/nginx/sites-available/host-525a57.com file at 644c5f4af269, so a restore from it sets another value or none.
18:10:26.312checkerqueryok0 rowsSELECT o.obs_id, o.value_hash, a.approval_id, a.approved_at, a.approved_by FROM DRIFT.observation o JOIN DRIFT.approved_setting a ON a.tenant_id = o.tenant_id A
18:10:26.312checkercheckfailedsetting_matches_approved: fails (0 rows)setting_matches_approved {"tenant_id":"client-1","host":"host-4b4dc1","object_id":"/etc/nginx/sites-available/host-525a57.com","setting_path":"file","run_id":"run-143dd416ad5fff95"}/etc/nginx/sites-available/host-525a57.com file on host-4b4dc1 matches no approved value.
18:10:26.312deciderdecideokHOLD: rule rule-6c41a25a00c404c8 restores a setting to its approved value; this changed_since_backup finding concerns the setting's relation to another setting while its own value stands, so it is held until 2026-10-26T18:09:14.465Zchanged_since_backup file in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: rule-6c41a25a00c404c8 (linux.nginx /etc/nginx/sites-available/* file v2: critical, lock 1, on_drift rollback, on_no_copy investigate_ticket, hold 24 h); the checks alone say ESCALATE; production affected (1 failing probe in run-80feccb18eb0b84a: http host-22b64a.com)
18:10:26.313judgejudgeskipped/etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is 644c5f4af269 and its copy in the host's newest backup (snap-038fceed7aa05c02, taken 2026-10-25T03:4model: none (sample)
18:10:26.580detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
18:10:26.581detectordetectoklinux.nginx host-951abf: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-71776a91583187d1model: none
18:10:26.871detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a
18:10:26.872detectordetectoklinux.nginx host-951abf: 0 approved setting(s) whose object the run lacksapproved_missing run-71776a91583187d1model: none
18:10:27.156detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM DRIFT.
18:10:27.157detectordetectoklinux.nginx host-951abf: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-71776a91583187d1model: none
18:10:27.440detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
18:10:27.440detectordetectokcloudflare.dns: 0 record field(s) drifted from their latest approvaldrift_vs_approved run-86289be2f697386bmodel: none
18:10:27.797detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a
18:10:27.797detectordetectokcloudflare.dns: 0 approved setting(s) whose object the run lacksapproved_missing run-86289be2f697386bmodel: none
18:10:27.965deciderqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a WHERE a.tenant_id
18:10:28.085deciderqueryok290 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:10:28.241deciderqueryok4 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a WHERE a.tenant_id
18:10:28.256decidertriageokearly_stop 0, checks_skipped 0, checks_gated 0, withdrawn_judge 23stop rulemodel: none
18:10:28.257decidertriageoklessons 23, exceptions applied 23, lapsed 0memorylocal store; recall by exact scope key, never by similarity; model: none
18:10:28.257decidertriageoklocked settings without an approved value: 0policy52 policy rule(s) read; verbs ADOPT 23, HOLD 4, ESCALATE 1, FIX 1; decided by policy 6, operator 23, default 0; probe run(s) run-e9f519d6a5af0fd0, run-b247c87d34f38d71, run-30f5647b8b9c5dff, run-e839e796556a54c3, run-446db683143ec580, run-396c20fb165306ed, run-af82fe9cd0f12826, run-f79e58d09c04c8d7, run-84b6426b9763f7f1, run-02925c58440a149c, run-20f146f855acc7b9, run-7a3ff25f0476b93f, run-4f41e1f
18:10:28.383loopqueryok539 rowsSELECT disposition_id, tenant_id, surface, host, object_id, setting_path, value_hash, verb, reason, expires_at, decided_by, rule_id, finding_id, run_id,
18:10:28.385looptriageokPASS: tenant client-1, decided at 2026-10-25T18:09:14.465Z: 101 collection run(s) of the tenant, 0 failed the DQ gate (none), 22511 observations in the World Model, 29 finding(s) (changed_since_backup 1, drift_vs_approved 1, orphan_record 3, orphan_vhost 3, proxied_without_real_ip 20, proxy_split 1); verbs: ADOPT 23, HOLD 4, ESCALATE 1, FIX 1; decided by operator 23, policy 6; judge skipped (model: none); memory: 23 lesson(s), 23 exception(s) applied, 0 lapsed; policy rules 52, locked settings without an approved value 0; ledger: 29 disposition(s) and 231 referent fingerprint(s) written, 0 finding(s) on rows an earlier pass wrotepass client-1model: none
18:10:28.387cycletriageokPASS: tenant client-1, decided at 2026-10-25T18:09:14.465Z: 101 collection run(s) of the tenant, 0 failed the DQ gate (none), 22511 observations in the World Model, 29 finding(s) (changed_since_backup 1, drift_vs_approved 1, orphan_record 3, orphan_vhost 3, proxied_without_real_ip 20, proxy_split 1); verbs: ADOPT 23, HOLD 4, ESCALATE 1, FIX 1; decided by operator 23, policy 6; judge skipped (model: none); memory: 23 lesson(s), 23 exception(s) applied, 0 lapsed; policy rules 52, locked settings without an approved value 0; ledger: 29 disposition(s) and 231 referent fingerprint(s) written, 0 finding(s) on rows an earlier pass wrotecycle client-1 [6/9] pass
18:10:28.500actorqueryok539 rowsSELECT disposition_id, tenant_id, surface, host, object_id, setting_path, value_hash, verb, reason, expires_at, decided_by, rule_id, finding_id, run_id,
18:10:28.615actorqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
18:10:28.729actorqueryok2 rowsSELECT action_id, tenant_id, kind, target, before_hash, after_hash, vault_commit, verification, receipts, status, reason, record, started_at, finished_at, dispo
18:10:49.562actormodel_callokattempt 1 of 2
18:10:49.604actorcheckokrequest_id match, prompt_preview match, app matchcustody rcpt_req_9jmhddr1 under app drift-agent-client-1custody holds: request_id match, prompt_preview match, app match (drift-agent-client-1), cache miss
18:10:49.604actorcheckoklightning requested, lightning servedreceipt rcpt_req_9jmhddr1 openrouter/nvidia/nemotron-3.5-lightning (lightning), signature verified, custody holds
18:10:49.772actorqueryok0 rowsSELECT s.snapshot_id, s.kind, s.taken_at, b.value_hash FROM DRIFT.backup_snapshot s JOIN DRIFT.backup_item b ON b.snapshot_id = s.snapshot_id WHERE s.tenant_id
18:10:50.002actorqueryok0 rowsSELECT o.obs_id, o.value_hash, a.approval_id, a.approved_at, a.approved_by FROM DRIFT.observation o JOIN DRIFT.approved_setting a ON a.tenant_id = o.tenant_id A
18:10:50.351actorqueryok2 rowsSELECT a.approval_id, a.object_id, a.setting_path, a.approved_at, a.approved_by, s.snapshot_id AS latest_snapshot_id, s.taken_at AS latest_backup_at,
18:10:50.472actorqueryok0 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM DRIFT.backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-10-25T18:0
18:13:50.483judgemodel_callfailedattempt 1 of 2timeout after 180 s
18:16:22.342judgemodel_callokattempt 2 of 2
18:16:22.645judgecheckokrequest_id match, prompt_preview match, app matchcustody rcpt_req_no31rwfn under app drift-agent-client-1custody holds: request_id match, prompt_preview match, app match (drift-agent-client-1), cache miss
18:16:22.645judgecheckokultra requested, ultra servedreceipt rcpt_req_no31rwfn openrouter/nvidia/nemotron-3-ultra-550b-a55b:free (ultra), signature verified, custody holds
18:16:22.646judgehypothesiseokSELECT 1 AS dummy FROM (SELECT 1) AS d LEFT JOIN (SELECT * FROM {{t:approved_setting}} WHERE tenant_id='client-1' AND surface='linux.nginx' AND host='host-4b4dcfile in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is 644c5f4af269, and its latest approval, 2026-10-25T18:08:29.101Z by operator, is c14c75198c7The query returns a row if there is no approval, the latest approval differs in timestamp/operator/hash prefix, or the approved hash matches the live hash, any of which would falsify the claim that the live value drifted from a specific approved value.
18:16:22.876judgequeryok0 rowsSELECT 1 AS dummy FROM (SELECT 1) AS d LEFT JOIN (SELECT * FROM DRIFT.approved_setting WHERE tenant_id='client-1' AND surface='linux.nginx' AND host='host-4b4dc
18:16:22.877judgejudgeokstands: the refuting SELECT returned no rowsfile in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is 644c5f4af269, and its latest approval, 2026-10-25T18:08:29.101Z by operator, is c14c75198c7The query returns a row if there is no approval, the latest approval differs in timestamp/operator/hash prefix, or the approved hash matches the live hash, any of which would falsify the claim that the live value drifted from a specific approved value.
18:16:23.015actorqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:16:23.141actorqueryok120 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM DRIFT.collection_run ORDER BY started_at, run_id
18:16:23.362actorqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-80feccb18eb0b84a
18:16:23.476actorqueryok117 rowsSELECT probe_id, run_id, kind, target, expected, observed, status, latency_ms, observed_at FROM host-f16622.probe WHERE tenant_id = 'client-1' AND run_id = 'run-80fec
18:16:23.477actorcheckokdone: investigated: 4 checks ran (0 hold, 4 fail); the judge's verdict counted: standsinvestigate linux.nginx host-4b4dc1 /etc/nginx/sites-available/host-525a57.com filefinding fnd-d235ecff843daff1 (drift_vs_approved): file in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is 644c5f4af269, and its latest approval, 2026-10-25T18:08:29.101Z by operator, is c14c75198c71: the live value drifted from the approved one; Lightning selection (receipt rcpt_req_9jmhddr1, openrouter/nvidia/nemotron-3.5-lightning, cache miss, route openrouter/nvidia/nemotron-3.5-li
18:16:23.490actorescalateskippedrefused: no fix is allowed without a valid copy; investigated and ticketedfix linux.nginx host-4b4dc1 /etc/nginx/sites-available/host-525a57.com file
18:16:23.493cycletriageokact: applied: 2 actions (rollback_file 0, revert_record 0, investigate 1, fix 1): done 1, unverified 0, failed 0, refused 1, not_judged 0; 0 already recorded; 2 action rows written; scope 29 disposition(s) of 3 run(s) (HOLD 4, ADOPT 23, ESCALATE 1, FIX 1), ledger 520 of the tenantcycle client-1 [7/9] act
18:16:23.594psaqueryok120 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM DRIFT.collection_run ORDER BY started_at, run_id
18:16:23.715psaqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
18:16:23.839psaqueryok539 rowsSELECT disposition_id, tenant_id, surface, host, object_id, setting_path, value_hash, verb, reason, expires_at, decided_by, rule_id, finding_id, run_id,
18:16:24.154psaqueryok4 rowsSELECT a.action_id, a.tenant_id, a.kind, a.target, a.before_hash, a.after_hash, a.vault_commit, a.verification, a.receipts, a.status, a.reason, a.record,
18:16:24.283psaqueryok3 rowsSELECT ticket_id, tenant_id, psa, external_id, url, type, priority, status, action_id, finding_id, created_at, updated_at FROM host-fa579b.ticket WHERE tenant_id = 'c
18:16:24.395psaqueryok117 rowsSELECT probe_id, run_id, kind, target, expected, observed, status, latency_ms, observed_at FROM host-f16622.probe WHERE tenant_id = 'client-1' AND run_id = 'run-80fec
18:16:24.514psaqueryok58 rowsSELECT record_id, zone FROM DRIFT.dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-86289be2f697386b' ORDER BY record_id, zone
18:16:24.660psaqueryok761 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:16:24.808psaqueryok301 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
18:16:24.813psatriageskippedskip fnd-b4a40091cdb4f906: ticket tkt-17f72648b5b7ccc8 (#2) is current: ESCALATE, no new actionskipmodel: none
18:16:24.813psatriageskippedskip fnd-45d5f3f4a2eb0b2e: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.814psatriageskippedskip fnd-9bfe1da7d028260c: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.814psatriageskippedskip fnd-a08488f45ff63140: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.814psatriageskippedskip fnd-5bd1b4c03ee72c7a: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.814psatriageskippedskip fnd-dfe22fa267b51c91: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.814psatriageskippedskip fnd-8a843610aeb1b709: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.815psatriageskippedskip fnd-05b163bfda4c027f: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.815psatriageskippedskip fnd-f3bcb9860c5a0b3d: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.815psatriageskippedskip fnd-8fc350e6aa5840d1: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.815psatriageskippedskip fnd-385949946c990113: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.815psatriageskippedskip fnd-b91b1690878eaf0e: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.816psatriageskippedskip fnd-d62857e241af66e2: HOLD orphan_record: HOLD opens an incident on alert always; rule rule-b8d9962485c3ced4 alerts neverskipmodel: none
18:16:24.816psatriageskippedskip fnd-d5622dbd2bf43e3e: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.816psatriageskippedskip fnd-b0472de6319451c4: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.816psatriageskippedskip fnd-2f1b5857f0426b68: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.816psatriageskippedskip fnd-b3ea13c119d7b589: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.816psatriageskippedskip fnd-770d13f327d54d12: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.816psatriageskippedskip fnd-7548fb2a2e3cdca4: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.817psatriageskippedskip fnd-4503aff67c556c58: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.817psatriageskippedskip fnd-de3c5e8ebdc2d209: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.817psatriageskippedskip fnd-028260c299ff1cb0: ADOPT proxied_without_real_ip: ADOPT opens no ticketskipmodel: none
18:16:24.817psatriageskippedskip fnd-58b251b5fce8fbff: HOLD orphan_record: HOLD opens an incident on alert always; rule rule-b8d9962485c3ced4 alerts neverskipmodel: none
18:16:24.817psatriageskippedskip fnd-8fc67ccb1e4eebfa: HOLD orphan_record: HOLD opens an incident on alert always; rule rule-b8d9962485c3ced4 alerts neverskipmodel: none
18:16:24.817psatriageskippedskip fnd-51038b9539a0174a: ADOPT orphan_vhost: ADOPT opens no ticketskipmodel: none
18:16:24.818psatriageskippedskip fnd-3661fcc541693ada: ADOPT orphan_vhost: ADOPT opens no ticketskipmodel: none
18:16:24.818psatriageskippedskip fnd-add52203af12de8a: ADOPT orphan_vhost: ADOPT opens no ticketskipmodel: none
18:16:26.612psatriageokcreated #7 (a pseudonymised URL) create incident P1 tkt-ff7942ddf3d4b4bb (new row) for fnd-d235ecff843daff1: FIX drift_vs_approved: /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 (FIX opens an incident; rule rule-6c41a25a00c404c8 alerts on_fix)create tkt-ff7942ddf3d4b4bbmodel: none
18:16:26.613psatriageskippedskip fnd-ac7e08b8363ae75e: HOLD changed_since_backup: HOLD opens an incident on alert always; rule rule-6c41a25a00c404c8 alerts on_fixskipmodel: none
18:16:26.613psatriageokTICKETS: tenant client-1, 29 finding(s), 520 disposition(s) and 4 action(s) in the ledger, 3 ticket row(s) before; plan: create 1, comment 0, close 0, skip 28; created 1, commented 0, closed 0, synced 0, refused 0, failed 0tickets client-1model: none
18:16:26.614cycletriageokTICKETS: tenant client-1, 29 finding(s), 520 disposition(s) and 4 action(s) in the ledger, 3 ticket row(s) before; plan: create 1, comment 0, close 0, skip 28; created 1, commented 0, closed 0, synced 0, refused 0, failed 0cycle client-1 [8/9] tickets
18:16:26.724documenterqueryok120 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM DRIFT.collection_run ORDER BY started_at, run_id
18:16:26.976documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f9470e2f5f175899
18:16:27.181documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-507c9939230e60a4
18:16:27.401documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-67f4d6923cb4838d
18:16:27.660documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-15638d43819ba756
18:16:27.913documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b69af94952dccb36
18:16:28.134documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9a3335b91e5ef3c3
18:16:28.340documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-071329fedf5f073f
18:16:28.548documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4592b852a04812f7
18:16:28.753documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e9f519d6a5af0fd0
18:16:28.965documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-de1564466df1d59b
18:16:29.171documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-91f4abd4904e22a6
18:16:29.376documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-81adedc1cc778bd5
18:16:29.585documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ace5f05819e5b28e
18:16:29.788documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b247c87d34f38d71
18:16:29.990documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-59ffd380cfc7cda5
18:16:30.187documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-527d9eb092475404
18:16:30.415documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-400375137e2bae7b
18:16:30.629documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-647f878a4f5605f7
18:16:30.848documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-30f5647b8b9c5dff
18:16:31.048documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-8c5af1ac22c54514
18:16:31.260documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-43c8ccb3704ad21c
18:16:31.510documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9e232bb5e1ebdb81
18:16:31.716documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-bbf110bf21466ecc
18:16:31.924documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-49fc76bf3b823051
18:16:32.127documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ea10fdeb1eae1a46
18:16:32.324documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e839e796556a54c3
18:16:32.525documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-6b65e048bb60fc24
18:16:32.719documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f6b79eeae02db225
18:16:32.917documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f6c7da2a579e2141
18:16:33.118documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-258ffc0f34ffab51
18:16:33.315documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-446db683143ec580
18:16:33.510documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-643ca3aadc62f002
18:16:33.703documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-3fcba77d90340f5d
18:16:33.923documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b094ed4249e79faf
18:16:34.131documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-028e1c06567f1445
18:16:34.341documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-af82fe9cd0f12826
18:16:34.549documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-63bc01583b366b8d
18:16:34.775documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-8b02f9aad70df0c9
18:16:34.992documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-c52288c22d5992fd
18:16:35.286documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-df60a03b49bbda47
18:16:35.570documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f79e58d09c04c8d7
18:16:35.799documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-93f3f163d3d8a95d
18:16:36.017documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f9954452442b0cd1
18:16:36.242documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-2a11f407cfdce7b6
18:16:36.458documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-d594486e164c4097
18:16:36.662documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-84b6426b9763f7f1
18:16:36.881documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-199d9e1bdc86bf4d
18:16:37.103documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-cf8eb79048a18bc9
18:16:37.321documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-439d1fb53664c597
18:16:37.534documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-209d57362e152a70
18:16:37.746documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-02925c58440a149c
18:16:37.961documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-480602f60ca854c6
18:16:38.179documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f98b965de7012d0b
18:16:38.389documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-573b3e958d5799a2
18:16:38.602documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ee1c61b44a6d6e01
18:16:38.832documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-20f146f855acc7b9
18:16:39.057documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9d48791b00433777
18:16:39.270documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-77ae40d31854071c
18:16:39.517documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f74b40064e093f2c
18:16:39.769documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-28ad36002e466ed5
18:16:40.064documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7a3ff25f0476b93f
18:16:40.287documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-01c5106777ec2426
18:16:40.509documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1d846f0834ec0803
18:16:40.738documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-22c36b45028d6029
18:16:40.950documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-951d5140591a7f6a
18:16:41.162documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4f41e1f662be63b5
18:16:41.392documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-fab71c1a5a8fc015
18:16:41.629documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b19145b1ac6e00d5
18:16:41.854documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-1f949ba3c2557d42
18:16:42.070documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-53c7e1dc36402eca
18:16:42.286documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-519f93197de9adf6
18:16:42.505documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-e1e626eaa8ec20aa
18:16:42.719documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-0b0dc83717dd3728
18:16:42.968documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-af44e31de1d0bb30
18:16:43.186documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-6c2480894f434d74
18:16:43.390documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-35ba6c1a2a987888
18:16:43.594documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7bbe33a8f55a93ed
18:16:43.810documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-68748435ad32367d
18:16:44.044documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-942258c89036d5e1
18:16:44.269documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-f7edc3b61bde5ce9
18:16:44.548documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-17d6a69fb3eb142b
18:16:44.795documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-7aa0cb559102ba32
18:16:45.010documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-576e5a1e0ae32b39
18:16:45.209documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-ab19eb70735c2463
18:16:45.402documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-a8590cdc5428b8d4
18:16:45.597documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-aed985591cd03b16
18:16:45.790documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-203b488a21557488
18:16:45.984documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-dd0be9f42b22be6a
18:16:46.182documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-4df8de37577a757f
18:16:46.378documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-99e455e8735204a5
18:16:46.573documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-9a81c991cb2d1715
18:16:46.781documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-80d1bd20c023687b
18:16:46.977documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-06a10d3c1445bc07
18:16:47.174documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-c3fa0e510b88329c
18:16:47.369documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-b54250291cf98f3d
18:16:47.561documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-971bbcf3bbe0b721
18:16:47.761documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-86289be2f697386b
18:16:47.962documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-d5aea29cb37980f2
18:16:48.174documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-70db877af660dc82
18:16:48.385documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-143dd416ad5fff95
18:16:48.607documenterqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM DRIFT.collection_run c WHERE c.run_id = 'run-80feccb18eb0b84a
18:16:48.795documenterqueryok6 rowsSELECT zone, COUNT(*) AS records, SUM(CASE WHEN proxied = 1 THEN 1 ELSE 0 END) AS proxied, SUM(CASE WHEN proxied = 1 THEN 0 ELSE 1 END) AS direct FROM DRIFT.dns
18:16:48.916documenterqueryok1 rowsSELECT COUNT(DISTINCT object_id) AS objects, COUNT(*) AS settings FROM DRIFT.observation WHERE run_id = 'run-86289be2f697386b'
18:16:49.031documenterqueryok1 rowsSELECT COUNT(DISTINCT object_id) AS objects, COUNT(*) AS settings FROM DRIFT.observation WHERE run_id = 'run-143dd416ad5fff95'
18:16:49.145documenterqueryok1 rowsSELECT COUNT(DISTINCT object_id) AS objects, COUNT(*) AS settings FROM DRIFT.observation WHERE run_id = 'run-70db877af660dc82'
18:16:49.266documenterqueryok1 rowsSELECT SUM(CASE WHEN observed_at < '2026-10-25T18:09:00.054Z' THEN 0 ELSE 1 END) AS latest, SUM(CASE WHEN observed_at < '2026-10-25T18:09:00.054Z' THEN 1 ELSE 0
18:16:49.376documenterqueryok1 rowsSELECT SUM(CASE WHEN observed_at < '2026-10-25T18:08:56.886Z' THEN 0 ELSE 1 END) AS latest, SUM(CASE WHEN observed_at < '2026-10-25T18:08:56.886Z' THEN 1 ELSE 0
18:16:49.808documenterqueryok112 rowsSELECT v.copy_id, v.surface, v.host, z.zone, v.object_id, v.run_id, v.git_commit, v.taken_at, c.validation_id, c.validator, c.result, c.missing_dependenc
18:16:50.012documenterqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM DRIFT.approved_setting a WHERE a.tenant_id
18:16:50.134documenterqueryok26 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
18:16:50.421documenterqueryok0 rowsSELECT o.obs_id, o.surface, o.host, o.object_id, o.setting_path FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-86289be2f697386b'
18:16:50.656documenterqueryok284 rowsSELECT o.obs_id, o.surface, o.host, o.object_id, o.setting_path FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-143dd416ad5fff95'
18:16:50.894documenterqueryok735 rowsSELECT o.obs_id, o.surface, o.host, o.object_id, o.setting_path FROM DRIFT.observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-70db877af660dc82'
18:16:51.074documenterqueryok4 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.verb, d.reason, d.expires_at, d.decided_by, d.rule_id, d.finding
18:16:51.249documenterqueryok14 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.verb, d.reason, d.expires_at, d.decided_by, d.rule_id, d.finding
18:16:51.400documenterqueryok11 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.verb, d.reason, d.expires_at, d.decided_by, d.rule_id, d.finding
18:16:51.527documenterqueryok4 rowsSELECT kind, status, COUNT(*) AS n FROM host-ab06bc.action WHERE tenant_id = 'client-1' GROUP BY kind, status ORDER BY kind, status
18:16:51.651documenterqueryok4 rowsSELECT ticket_id, psa, external_id, url, type, priority, status, action_id, finding_id, updated_at FROM host-fa579b.ticket WHERE tenant_id = 'client-1' ORDER BY type,
18:16:51.757documenterqueryok6 rowsSELECT kind, status, COUNT(*) AS n FROM host-f16622.probe WHERE tenant_id = 'client-1' AND run_id = 'run-80feccb18eb0b84a' GROUP BY kind, status ORDER BY kind, status
18:16:51.872documenterqueryok21 rowsSELECT kind, target, probe_id FROM host-f16622.probe WHERE tenant_id = 'client-1' AND run_id = 'run-80feccb18eb0b84a' AND status = 'fail' ORDER BY kind, target, probe
18:16:51.874cycletriageokdocument: document.md written for client-1, 199 lines, 29 finding(s) open, 121 queries; deny-list probe 0 of 29 label(s); decided at 2026-10-25T18:09:14.465Zcycle client-1 [9/9] document
18:16:51.875cycletriageokCYCLE: tenant client-1, applied (act carries out its plan): 9 step(s): ok 9, skipped 0, failed 0, not run 0; completed; 483.1 scycle client-1