client-1pass decided 25 Oct 2026 14:17 UTCsample mode

Trace console_sample_mvpfonrk

logs/console_sample_mvpfonrk.jsonl, 594 events from 26 Oct 2026 15:51 UTC to 26 Oct 2026 15:51 UTC. All traces

About this page

Every free-text field passes the redactor as the trace did when it was written, and a ticket's URL reads as its number.

594 events
Time (UTC)AgentActionStatusSummary
15:51:01.714looptriageokpass decided at 2026-10-25T14:17:53.416Zconsole pass client-1
15:51:01.717loopqueryok80 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM collection_run ORDER BY started_at, run_id
15:51:01.721observerqueryok80 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM collection_run ORDER BY started_at, run_id
15:51:01.880deciderqueryok28 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
15:51:01.880deciderqueryok23 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM disposition d WH
15:51:01.880deciderqueryok28 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
15:51:01.880deciderqueryok7 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM disposition d WH
15:51:01.881observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.tenant_id = 'client-1' AND (c.obse
15:51:01.881observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.tenant_id = 'lab-1' AND (c.observe
15:51:01.881observercheckokcloudflare.dns: 58/58 completerun_complete run-f9470e2f5f175899
15:51:01.881observercheckokcloudflare.audit: 728/728 completerun_complete run-507c9939230e60a4
15:51:01.881observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-67f4d6923cb4838d
15:51:01.881observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-15638d43819ba756
15:51:01.881observercheckokcloudflare.dns: 58/58 completerun_complete run-b69af94952dccb36
15:51:01.881observercheckokcloudflare.audit: 797/797 completerun_complete run-9a3335b91e5ef3c3
15:51:01.881observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-071329fedf5f073f
15:51:01.881observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-4592b852a04812f7
15:51:01.881observercheckokprobe: 111/111 completerun_complete run-e9f519d6a5af0fd0
15:51:01.881observercheckokcloudflare.dns: 58/58 completerun_complete run-de1564466df1d59b
15:51:01.881observercheckokcloudflare.audit: 818/818 completerun_complete run-91f4abd4904e22a6
15:51:01.882observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-81adedc1cc778bd5
15:51:01.882observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ace5f05819e5b28e
15:51:01.882observercheckokprobe: 111/111 completerun_complete run-b247c87d34f38d71
15:51:01.882observercheckokcloudflare.dns: 58/58 completerun_complete run-59ffd380cfc7cda5
15:51:01.882observercheckokcloudflare.audit: 839/839 completerun_complete run-527d9eb092475404
15:51:01.882observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-400375137e2bae7b
15:51:01.882observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-647f878a4f5605f7
15:51:01.882observercheckokprobe: 111/111 completerun_complete run-30f5647b8b9c5dff
15:51:01.882observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-8c5af1ac22c54514
15:51:01.882observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-43c8ccb3704ad21c
15:51:01.882observercheckokcloudflare.dns: 58/58 completerun_complete run-9e232bb5e1ebdb81
15:51:01.882observercheckokcloudflare.audit: 860/860 completerun_complete run-bbf110bf21466ecc
15:51:01.882observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-49fc76bf3b823051
15:51:01.882observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ea10fdeb1eae1a46
15:51:01.882observercheckokprobe: 111/111 completerun_complete run-e839e796556a54c3
15:51:01.882observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-74140124db03c3f5
15:51:01.882observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-afe5a89ee42acbc2
15:51:01.882observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-90bdfa86df88a639
15:51:01.882observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-33b1aa9a8f89d3c8
15:51:01.882observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-ce4dc382bcffa4bb
15:51:01.882observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-1f4d84ed6359ff18
15:51:01.882observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-463c7c0ce537bd16
15:51:01.882observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f97423f25dc75884
15:51:01.882observercheckokcloudflare.dns: 58/58 completerun_complete run-6b65e048bb60fc24
15:51:01.882observercheckokcloudflare.audit: 888/888 completerun_complete run-f6b79eeae02db225
15:51:01.882observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f6c7da2a579e2141
15:51:01.882observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-258ffc0f34ffab51
15:51:01.882observercheckokprobe: 111/111 completerun_complete run-446db683143ec580
15:51:01.883observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-e476cc64252f6715
15:51:01.883observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-d1fcc061e5c34158
15:51:01.883observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-2c3fc585f404b90f
15:51:01.883observercheckokprobe: 6/6 completerun_complete run-396c20fb165306ed
15:51:01.883observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-0f5afdbf81b5b05a
15:51:01.883observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f509f49299848d43
15:51:01.883observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-41e44e7c818c214d
15:51:01.883observercheckokhost-7ba343.verify: 2/2 completerun_complete run-588dc39d3f984621
15:51:01.883observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-b78229c438b759eb
15:51:01.883observercheckokhost-7ba343.verify: 2/2 completerun_complete run-5307a4b4884f8f8d
15:51:01.883observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-71776a91583187d1
15:51:01.883observercheckokcloudflare.dns: 58/58 completerun_complete run-643ca3aadc62f002
15:51:01.884observercheckokcloudflare.audit: 909/909 completerun_complete run-3fcba77d90340f5d
15:51:01.884observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-b094ed4249e79faf
15:51:01.884observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-028e1c06567f1445
15:51:01.884observercheckokprobe: 111/111 completerun_complete run-af82fe9cd0f12826
15:51:01.884observercheckokcloudflare.dns: 58/58 completerun_complete run-63bc01583b366b8d
15:51:01.884observercheckokcloudflare.audit: 930/930 completerun_complete run-8b02f9aad70df0c9
15:51:01.884observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-c52288c22d5992fd
15:51:01.884observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-df60a03b49bbda47
15:51:01.884observercheckokprobe: 111/111 completerun_complete run-f79e58d09c04c8d7
15:51:01.884observercheckokcloudflare.dns: 58/58 completerun_complete run-93f3f163d3d8a95d
15:51:01.884observercheckokcloudflare.audit: 951/951 completerun_complete run-f9954452442b0cd1
15:51:01.884observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-2a11f407cfdce7b6
15:51:01.884observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-d594486e164c4097
15:51:01.884observercheckokprobe: 111/111 completerun_complete run-84b6426b9763f7f1
15:51:01.884observercheckokcloudflare.dns: 58/58 completerun_complete run-199d9e1bdc86bf4d
15:51:01.884observercheckokcloudflare.audit: 972/972 completerun_complete run-cf8eb79048a18bc9
15:51:01.884observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-439d1fb53664c597
15:51:01.884observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-209d57362e152a70
15:51:01.884observercheckokprobe: 111/111 completerun_complete run-02925c58440a149c
15:51:01.884observercheckokcloudflare.dns: 58/58 completerun_complete run-480602f60ca854c6
15:51:01.884observercheckokcloudflare.audit: 993/993 completerun_complete run-f98b965de7012d0b
15:51:01.884observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-573b3e958d5799a2
15:51:01.884observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ee1c61b44a6d6e01
15:51:01.884observercheckokprobe: 111/111 completerun_complete run-20f146f855acc7b9
15:51:01.884observercheckokcloudflare.dns: 58/58 completerun_complete run-9d48791b00433777
15:51:01.884observercheckokcloudflare.audit: 1014/1014 completerun_complete run-77ae40d31854071c
15:51:01.884observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f74b40064e093f2c
15:51:01.884observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-28ad36002e466ed5
15:51:01.884observercheckokprobe: 111/111 completerun_complete run-7a3ff25f0476b93f
15:51:01.886observerchecknot_checkedaudit log withheld for lab-1: no cloudflare.audit run for this tenantaudit_event lab-1actor_attributed, previous_value_recoverable, referent_unchanged, record_reverted are rejected for every finding of this tenant this pass
15:51:02.175observerqueryok5000 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
15:51:02.176observerqueryok5000 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
15:51:02.176observerqueryok3808 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
15:51:02.176observerqueryok368 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
15:51:02.193observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.194observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.194observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.194observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.194observerqueryok150 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.194observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.194observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.195observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.195observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.195observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.195observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.195observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
15:51:02.327observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-f9470e2f5f175899)run-67f4d6923cb4838dmodel: none
15:51:02.385observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-f9470e2f5f175899)run-15638d43819ba756model: none
15:51:02.475observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-b69af94952dccb36)run-071329fedf5f073fmodel: none
15:51:02.505observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-b69af94952dccb36)run-4592b852a04812f7model: none
15:51:02.598observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-de1564466df1d59b)run-81adedc1cc778bd5model: none
15:51:02.624observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-de1564466df1d59b)run-ace5f05819e5b28emodel: none
15:51:02.729observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-400375137e2bae7bmodel: none
15:51:02.785observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-647f878a4f5605f7model: none
15:51:02.852observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-8c5af1ac22c54514model: none
15:51:02.891observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-43c8ccb3704ad21cmodel: none
15:51:02.983observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-49fc76bf3b823051model: none
15:51:03.024observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-ea10fdeb1eae1a46model: none
15:51:03.027observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-74140124db03c3f5model: none
15:51:03.029observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-afe5a89ee42acbc2model: none
15:51:03.032observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-90bdfa86df88a639model: none
15:51:03.035observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-33b1aa9a8f89d3c8model: none
15:51:03.038observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-ce4dc382bcffa4bbmodel: none
15:51:03.041observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-1f4d84ed6359ff18model: none
15:51:03.044observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-463c7c0ce537bd16model: none
15:51:03.046observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f97423f25dc75884model: none
15:51:03.145observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-6b65e048bb60fc24)run-f6c7da2a579e2141model: none
15:51:03.292observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-6b65e048bb60fc24)run-258ffc0f34ffab51model: none
15:51:03.296observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-e476cc64252f6715model: none
15:51:03.300observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-d1fcc061e5c34158model: none
15:51:03.303observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-2c3fc585f404b90fmodel: none
15:51:03.307observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-0f5afdbf81b5b05amodel: none
15:51:03.311observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f509f49299848d43model: none
15:51:03.314observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-41e44e7c818c214dmodel: none
15:51:03.317observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-b78229c438b759ebmodel: none
15:51:03.320observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-71776a91583187d1model: none
15:51:03.448observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-643ca3aadc62f002)run-b094ed4249e79fafmodel: none
15:51:03.507observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-643ca3aadc62f002)run-028e1c06567f1445model: none
15:51:03.634observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-63bc01583b366b8d)run-c52288c22d5992fdmodel: none
15:51:03.699observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-63bc01583b366b8d)run-df60a03b49bbda47model: none
15:51:03.837observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-2a11f407cfdce7b6model: none
15:51:03.905observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-d594486e164c4097model: none
15:51:04.064observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-439d1fb53664c597model: none
15:51:04.137observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-209d57362e152a70model: none
15:51:04.318observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-480602f60ca854c6)run-573b3e958d5799a2model: none
15:51:04.394observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-480602f60ca854c6)run-ee1c61b44a6d6e01model: none
15:51:04.589observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9d48791b00433777)run-f74b40064e093f2cmodel: none
15:51:04.665observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9d48791b00433777)run-28ad36002e466ed5model: none
15:51:04.687detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM observation
15:51:04.687detectordetectoklinux.nginx host-aa516a: 0 setting(s) point at a name resolving outside the inventoryhero run-f74b40064e093f2c x run-9d48791b00433777model: none
15:51:04.687detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM observation
15:51:04.687detectordetectoklinux.nginx host-4b4dc1: 0 setting(s) point at a name resolving outside the inventoryhero run-28ad36002e466ed5 x run-9d48791b00433777model: none
15:51:05.249detectordetectnot_checkedno DNS run of this pass for this tenant; the hero query has nothing to joinlinux.nginx host-951abf
15:51:05.249detectorqueryok1 rowsSELECT c.zone, c.name AS proxied_name, c.record_id AS proxied_record_id, a.name AS target_name, a.type AS target_type, a.content AS target_content, a.rec
15:51:05.249detectordetectokcloudflare.dns: 1 proxied CNAME(s) alias a direct address recordproxy_split run-9d48791b00433777model: none
15:51:05.249detectordetectokproxy_split: host-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it points atproxied record bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none
15:51:05.249detectorqueryok1 rowsSELECT MIN(occurred_at) AS first_at, MAX(occurred_at) AS last_at, COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1'
15:51:05.285checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
15:51:05.285checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
15:51:05.285checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b682
15:51:05.285checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:44.528Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:44.528Z.
15:51:05.285checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.285checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
15:51:05.285checkerqueryok3 rowsSELECT 'dns_record' AS evidence, a.record_id AS resource_id, a.content AS old_value, b.content AS new_value, b.observed_at AS seen_at FROM dns_record a JOIN dns
15:51:05.285checkercheckfailedreferent_unchanged: fails (3 rows)referent_unchanged {"tenant_id":"client-1","name":"host-524b42.quest","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:44.528Z"}host-524b42.quest changed between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:44.528Z (3 pieces of evidence).
15:51:05.286deciderqueryok111 rowsSELECT probe_id, run_id, kind, target, expected, observed, status, latency_ms, observed_at FROM probe WHERE tenant_id = 'client-1' AND run_id = 'run-7a3ff25f047
15:51:05.287deciderdecideokESCALATE: hold under rule rule-8e75e1d767980665 expired 2026-10-25T03:21:06.870Z; the finding standsproxy_split proxied in bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none; policy: rule-8e75e1d767980665 (cloudflare.dns * proxied v2: critical, lock 1, on_drift rollback, on_no_copy investigate_ticket, hold 4 h); the checks alone say ESCALATE; production answering (3 probes of its names ok in run-7a3ff25f0476b93f); prior HOLD since 2026-10-25T01:45:33.962Z until 2026-10-25T03:21:06.870Z
15:51:05.287deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.292deciderqueryok2 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.293deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b6823d5f6ecd3f2' AND action <> 'view' AND occurred_at < '
15:51:05.310decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
15:51:05.310judgejudgeskippedhost-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it pointsmodel: none (sample)
15:51:05.311detectorqueryskippedshared read: run once this pass, where detector first askedreused audit_span client-1
15:51:05.311detectorqueryok10 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
15:51:05.311detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
15:51:05.311detectordetectoklinux.nginx host-aa516a: 10 proxied name(s) served by a block that trusts no real_ip range, 1 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-f74b40064e093f2c x run-9d48791b00433777model: none
15:51:05.311detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
15:51:05.311checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.311checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.311checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.311checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.311checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc
15:51:05.311checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.311checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.312checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
15:51:05.312decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.312deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.312deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.312deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.312deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc11f85b45bc4' AND action <> 'view' AND occurred_at < '
15:51:05.435decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 109 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
15:51:05.435judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is averdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.435detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
15:51:05.435checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.435checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.435checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.436checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.436checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc
15:51:05.436checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.436checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.436checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
15:51:05.436decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.436deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.436deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|82de28f7baf86a005babc11f85b45bc4|proxied
15:51:05.436decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 109 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
15:51:05.436judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is abverdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.436detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
15:51:05.437checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.437checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.437checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.437checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.437checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029b20da8
15:51:05.437checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.437checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.437checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
15:51:05.437decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.437deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.437deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.437deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.437decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 803592cea544029b20da8b45e5045f41model: none
15:51:05.437judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.437detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
15:51:05.437checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.438checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.438checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.438checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.438checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029b20da8
15:51:05.438checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.438checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.438checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
15:51:05.438decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.438deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.438deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|803592cea544029b20da8b45e5045f41|proxied
15:51:05.438decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 803592cea544029b20da8b45e5045f41model: none
15:51:05.438judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.438detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
15:51:05.438checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.438checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.438checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.439checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.439checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc4cb209
15:51:05.439checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.439checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.439checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
15:51:05.439decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.439deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.439deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.439deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.439decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
15:51:05.439judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.440detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
15:51:05.440checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.440checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.440checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.440checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.440checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc4cb209
15:51:05.440checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.440checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.440checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
15:51:05.440decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.440deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.440deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|cf2be0e75e70bfc4cb2096d542f82617|proxied
15:51:05.440decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
15:51:05.440judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.441detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
15:51:05.441checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.441checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.441checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.441checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.441checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537ffee079
15:51:05.441checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.441checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.441checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
15:51:05.441decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.441deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.441deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.441deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.441decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
15:51:05.442judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.442detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
15:51:05.442checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.442checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.442checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.442checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.442checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537ffee079
15:51:05.442checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.442checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.442checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
15:51:05.442decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.442deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.442deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|09f042ef748537ffee079ebc3ef8ac2d|proxied
15:51:05.442decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
15:51:05.442judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.443detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
15:51:05.443checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.443checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.443checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.443checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.443checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28069f16
15:51:05.443checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.443checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.443checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
15:51:05.443decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.443deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.443deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.443deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.443decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
15:51:05.443judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.443detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
15:51:05.444checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.444checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.444checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.444checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.444checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28069f16
15:51:05.444checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.444checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.444checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
15:51:05.444decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.444deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.444deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|54e2f4da0f26c28069f163917d3dc611|proxied
15:51:05.444decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
15:51:05.444judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.444detectordetectokproxied_without_real_ip: *.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.conf is absent): every name under the wildcard sees Cloudflare's addresses as its visitorshttp.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none
15:51:05.445checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
15:51:05.445checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
15:51:05.445checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.445checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.445checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c922e6966d55b15bd96b5
15:51:05.445checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed c922e6966d55b15bd96b5e8ea932b715 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.445checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.445checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715"}The audit log does not record what c922e6966d55b15bd96b5e8ea932b715 was before its latest change.
15:51:05.445decidertriageokexception mem-19 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516alesson mem-19 on *.host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:43.955Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.445deciderdecideokADOPT: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-19 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
15:51:05.445deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.445deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.445decidertriagenot_checkedexposure not dated: the audit log holds no event on c922e6966d55b15bd96b5e8ea932b715 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure c922e6966d55b15bd96b5e8ea932b715model: none
15:51:05.445judgejudgeskipped*.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.confverdict cannot move: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.446detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM dns_record d LEFT JOIN dn
15:51:05.446detectordetectoklinux.nginx host-aa516a: 1 record(s) land here with no enabled server block naming themorphan_record run-f74b40064e093f2c x run-9d48791b00433777model: none
15:51:05.446detectordetectokorphan_record: host-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default serverrecord c8b1963847dafe3548b1a4b93f520c0amodel: none
15:51:05.446checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
15:51:05.446checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
15:51:05.446checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
15:51:05.446checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
15:51:05.446checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c8b1963847dafe3548b1a
15:51:05.446checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed c8b1963847dafe3548b1a4b93f520c0a between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
15:51:05.446checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.446checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a"}The audit log does not record what c8b1963847dafe3548b1a4b93f520c0a was before its latest change.
15:51:05.446deciderqueryskippedshared read: run once this pass, where decider first askedreused probe run-7a3ff25f0476b93f
15:51:05.446deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T13:54:08.785Z under rule rule-b8d9962485c3ced4orphan_record name in c8b1963847dafe3548b1a4b93f520c0a on host-aa516amodel: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (2 failing probes in run-7a3ff25f0476b93f: http host-3fef97.club, tls host-3fef97.club); prior HOLD since 2026-10-25T13:54:08.785Z until 2026-10-27T23:21:06.870Z
15:51:05.446deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.446deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6b6bba' AND e.old_val
15:51:05.446decidertriagenot_checkedexposure not dated: the audit log holds no event on c8b1963847dafe3548b1a4b93f520c0a that sets content=ip-6b6bba with no later different body up to 2026-10-25T13:53:44.528Zexposure c8b1963847dafe3548b1a4b93f520c0amodel: none
15:51:05.446judgejudgeskippedhost-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
15:51:05.447detectorqueryok0 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM observation n
15:51:05.447detectordetectoklinux.nginx host-aa516a: 0 server_name(s) with no record and no covering wildcardorphan_vhost run-f74b40064e093f2c x run-9d48791b00433777model: none
15:51:05.447detectorqueryskippedshared read: run once this pass, where detector first askedreused audit_span client-1
15:51:05.447detectorqueryok9 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
15:51:05.447detectorqueryok0 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
15:51:05.447detectordetectoklinux.nginx host-4b4dc1: 9 proxied name(s) served by a block that trusts no real_ip range, 0 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-28ad36002e466ed5 x run-9d48791b00433777model: none
15:51:05.447detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
15:51:05.447checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.447checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.447checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.447checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.447checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6a2b742
15:51:05.447checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.447checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.447checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
15:51:05.447decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.447deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.447deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.448deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.448decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
15:51:05.448judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.448detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
15:51:05.448checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.448checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.448checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.448checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.448checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6a2b742
15:51:05.448checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.448checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.448checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
15:51:05.448decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.448deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.449deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|b2d893895ed0af6a2b742958571cff7b|proxied
15:51:05.449decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
15:51:05.449judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.449detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
15:51:05.449checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.449checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.449checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.449checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.449checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b682
15:51:05.449checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.449checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.449checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
15:51:05.449decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.449deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.450deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|bce1ca2bb7caa2de9b6823d5f6ecd3f2|proxied
15:51:05.450decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
15:51:05.450judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.450detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
15:51:05.450checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.450checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.450checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.450checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.450checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b682
15:51:05.450checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.450checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.450checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
15:51:05.450decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.451deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.451deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|bce1ca2bb7caa2de9b6823d5f6ecd3f2|proxied
15:51:05.451decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
15:51:05.451judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.451detectordetectokproxied_without_real_ip: host-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
15:51:05.451checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.451checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.451checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.451checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.451checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b43f276dea49e4dd9c227
15:51:05.451checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b43f276dea49e4dd9c2271e5a084e37e between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.451checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.451checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e"}The audit log does not record what b43f276dea49e4dd9c2271e5a084e37e was before its latest change.
15:51:05.452decidertriageokexception mem-11 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-11 on host-525a57.com (proxied_without_real_ip), recorded 2026-10-25T14:17:25.100Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.452deciderdecideokADOPT: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-11 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.452deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.452deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.452decidertriagenot_checkedexposure not dated: the audit log holds no event on b43f276dea49e4dd9c2271e5a084e37e that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b43f276dea49e4dd9c2271e5a084e37emodel: none
15:51:05.452judgejudgeskippedhost-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.452detectordetectokproxied_without_real_ip: host-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
15:51:05.452checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.452checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.452checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.452checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.452checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b5e781103f2acd7d15886
15:51:05.452checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b5e781103f2acd7d15886934269551c1 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.452checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.452checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1"}The audit log does not record what b5e781103f2acd7d15886934269551c1 was before its latest change.
15:51:05.452decidertriageokexception mem-10 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-10 on host-5c38db.com (proxied_without_real_ip), recorded 2026-10-25T14:17:22.803Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.453deciderdecideokADOPT: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-10 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.453deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.453deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.453decidertriagenot_checkedexposure not dated: the audit log holds no event on b5e781103f2acd7d15886934269551c1 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b5e781103f2acd7d15886934269551c1model: none
15:51:05.453judgejudgeskippedhost-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.453detectordetectokproxied_without_real_ip: host-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none
15:51:05.453checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.453checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.453checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.453checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.453checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '893f8252d3d2b233459c1
15:51:05.453checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed 893f8252d3d2b233459c1f10f5143d13 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.453checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.453checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13"}The audit log does not record what 893f8252d3d2b233459c1f10f5143d13 was before its latest change.
15:51:05.454decidertriageokexception mem-6 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1lesson mem-6 on host-62f7a4.com (proxied_without_real_ip), recorded 2026-10-25T14:17:13.404Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.454deciderdecideokADOPT: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-6 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.454deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.454deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.454decidertriagenot_checkedexposure not dated: the audit log holds no event on 893f8252d3d2b233459c1f10f5143d13 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 893f8252d3d2b233459c1f10f5143d13model: none
15:51:05.454judgejudgeskippedhost-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1verdict cannot move: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.454detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
15:51:05.454checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.454checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.454checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.454checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.454checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668
15:51:05.454checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.454checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.454checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
15:51:05.455decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.455deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.455deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.455deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
15:51:05.455deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668f5f435a4ae1' AND action <> 'view' AND occurred_at < '
15:51:05.455decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
15:51:05.455judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.455detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
15:51:05.455checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.455checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.455checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.455checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.456checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668
15:51:05.456checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.456checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.456checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
15:51:05.456decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.456deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
15:51:05.456deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|4c6d209470c71ee2c4668f5f435a4ae1|proxied
15:51:05.456decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
15:51:05.456judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.456detectorqueryok2 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM dns_record d LEFT JOIN dn
15:51:05.456detectordetectoklinux.nginx host-4b4dc1: 2 record(s) land here with no enabled server block naming themorphan_record run-28ad36002e466ed5 x run-9d48791b00433777model: none
15:51:05.456detectordetectokorphan_record: host-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord b0a17a719bd2118a535a763379ab7ba9model: none
15:51:05.456checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
15:51:05.457checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
15:51:05.457checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.457checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.457checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b0a17a719bd2118a535a7
15:51:05.457checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b0a17a719bd2118a535a763379ab7ba9 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.457checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.457checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9"}The audit log does not record what b0a17a719bd2118a535a763379ab7ba9 was before its latest change.
15:51:05.457deciderqueryskippedshared read: run once this pass, where decider first askedreused probe run-7a3ff25f0476b93f
15:51:05.457deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T13:54:08.785Z under rule rule-b8d9962485c3ced4orphan_record name in b0a17a719bd2118a535a763379ab7ba9 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-7a3ff25f0476b93f: http host-50b116.com); prior HOLD since 2026-10-25T13:54:08.785Z until 2026-10-27T23:21:06.870Z
15:51:05.457deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.457deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
15:51:05.457decidertriagenot_checkedexposure not dated: the audit log holds no event on b0a17a719bd2118a535a763379ab7ba9 that sets content=ip-6fb86d with no later different body up to 2026-10-25T13:53:44.528Zexposure b0a17a719bd2118a535a763379ab7ba9model: none
15:51:05.457judgejudgeskippedhost-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
15:51:05.457detectordetectokorphan_record: host-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord 25a23b5c40a3de0ea11b6054a7b54d07model: none
15:51:05.457checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
15:51:05.457checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
15:51:05.457checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
15:51:05.457checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
15:51:05.457checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0ea11b6
15:51:05.457checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}1 audit event with a named actor touched 25a23b5c40a3de0ea11b6054a7b54d07 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
15:51:05.458checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
15:51:05.458checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07"}The audit log does not record what 25a23b5c40a3de0ea11b6054a7b54d07 was before its latest change.
15:51:05.458deciderqueryskippedshared read: run once this pass, where decider first askedreused probe run-7a3ff25f0476b93f
15:51:05.458deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T13:54:08.785Z under rule rule-b8d9962485c3ced4orphan_record name in 25a23b5c40a3de0ea11b6054a7b54d07 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-7a3ff25f0476b93f: http host-c10fff.com); prior HOLD since 2026-10-25T13:54:08.785Z until 2026-10-27T23:21:06.870Z
15:51:05.458deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
15:51:05.458deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
15:51:05.458deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0ea11b6054a7b54d07' AND action <> 'view' AND occurred_at < '
15:51:05.458decidertriageokcontent=ip-6fb86d since 2026-07-06T18:46:40.994Z: at least 110 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 25a23b5c40a3de0ea11b6054a7b54d07first event of the current state: evt-48d6696c1de70593 (update); no earlier body on record sets another content state, so the state may predate the log; model: none
15:51:05.458judgejudgeskippedhost-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
15:51:05.458detectorqueryok3 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM observation n
15:51:05.458detectordetectoklinux.nginx host-4b4dc1: 3 server_name(s) with no record and no covering wildcardorphan_vhost run-28ad36002e466ed5 x run-9d48791b00433777model: none
15:51:05.458detectordetectokorphan_vhost: host-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none
15:51:05.458checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.458checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.459checkerqueryok0 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-28a
15:51:05.459checkercheckokother_settings_reference: holds (0 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-085e02.com","run_id":"run-28ad36002e466ed5","object_id":"/etc/nginx/sites-available/host-085e02.com","setting_path":"server[host-0No other setting in run run-28ad36002e466ed5 points at host-085e02.com.
15:51:05.459checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:29:03.0
15:51:05.459checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
15:51:05.459decidertriageokexception mem-8 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1lesson mem-8 on host-085e02.com (orphan_vhost), recorded 2026-10-25T14:17:18.089Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.459deciderdecideokADOPT: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTorphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-8 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
15:51:05.459judgejudgeskippedhost-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collecteverdict cannot move: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.459detectordetectokorphan_vhost: host-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
15:51:05.459checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.459checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.459checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-28a
15:51:05.459checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-89f6e7.com","run_id":"run-28ad36002e466ed5","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-28ad36002e466ed5 also point at host-89f6e7.com.
15:51:05.459checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:29:03.0
15:51:05.459checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
15:51:05.459decidertriageokexception mem-4 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-4 on host-89f6e7.com (orphan_vhost), recorded 2026-10-25T14:17:08.716Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.459deciderdecideokADOPT: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-4 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
15:51:05.460judgejudgeskippedhost-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.460detectordetectokorphan_vhost: host-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
15:51:05.460checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
15:51:05.460checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
15:51:05.460checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-28a
15:51:05.460checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-9ac4f1.com","run_id":"run-28ad36002e466ed5","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-28ad36002e466ed5 also point at host-9ac4f1.com.
15:51:05.460checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:29:03.0
15:51:05.460checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
15:51:05.460decidertriageokexception mem-16 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-16 on host-9ac4f1.com (orphan_vhost), recorded 2026-10-25T14:17:36.809Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
15:51:05.460deciderdecideokADOPT: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-16 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
15:51:05.460judgejudgeskippedhost-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
15:51:05.460detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
15:51:05.461detectordetectoklinux.nginx host-aa516a: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-f74b40064e093f2cmodel: none
15:51:05.461detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
15:51:05.461detectordetectoklinux.nginx host-aa516a: 0 approved setting(s) whose object the run lacksapproved_missing run-f74b40064e093f2cmodel: none
15:51:05.461detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM observ
15:51:05.461detectordetectoklinux.nginx host-aa516a: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-f74b40064e093f2cmodel: none
15:51:05.461detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
15:51:05.461detectordetectoklinux.nginx host-4b4dc1: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-28ad36002e466ed5model: none
15:51:05.461detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
15:51:05.461detectordetectoklinux.nginx host-4b4dc1: 0 approved setting(s) whose object the run lacksapproved_missing run-28ad36002e466ed5model: none
15:51:05.461detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM observ
15:51:05.461detectordetectoklinux.nginx host-4b4dc1: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-28ad36002e466ed5model: none
15:51:05.461detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
15:51:05.461detectordetectoklinux.nginx host-951abf: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-71776a91583187d1model: none
15:51:05.461detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
15:51:05.461detectordetectoklinux.nginx host-951abf: 0 approved setting(s) whose object the run lacksapproved_missing run-71776a91583187d1model: none
15:51:05.462detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM observ
15:51:05.462detectordetectoklinux.nginx host-951abf: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-71776a91583187d1model: none
15:51:05.462detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
15:51:05.462detectordetectokcloudflare.dns: 0 record field(s) drifted from their latest approvaldrift_vs_approved run-9d48791b00433777model: none
15:51:05.462detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
15:51:05.462detectordetectokcloudflare.dns: 0 approved setting(s) whose object the run lacksapproved_missing run-9d48791b00433777model: none
15:51:05.462detectordetectskippedm365.dns: no Microsoft 365 run for client-1, lab-1: the mail records Microsoft 365 requires are not compared (npm run collect:m365 reads them live)m365.dnsmodel: none
15:51:05.502deciderqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE a.tenant_id = 'cl
15:51:05.502deciderqueryok290 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
15:51:05.518deciderqueryok4 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE a.tenant_id = 'la
15:51:05.519decidertriageokearly_stop 0, checks_skipped 0, checks_gated 0, withdrawn_judge 23stop rulemodel: none
15:51:05.520decidertriageoklessons 23, exceptions applied 23, lapsed 0memorylocal store; recall by exact scope key, never by similarity; model: none
15:51:05.520decidertriageoklocked settings without an approved value: 0policy56 policy rule(s) read; verbs ADOPT 23, HOLD 3, ESCALATE 1; decided by policy 4, operator 23, default 0; probe run(s) run-e9f519d6a5af0fd0, run-b247c87d34f38d71, run-30f5647b8b9c5dff, run-e839e796556a54c3, run-446db683143ec580, run-396c20fb165306ed, run-af82fe9cd0f12826, run-f79e58d09c04c8d7, run-84b6426b9763f7f1, run-02925c58440a149c, run-20f146f855acc7b9, run-7a3ff25f0476b93f; ledger: 27 disposi
15:51:05.522loopqueryok370 rowsSELECT disposition_id, tenant_id, surface, host, object_id, setting_path, value_hash, verb, reason, expires_at, decided_by, rule_id, finding_id, run_id,
15:51:05.524looptriageokPASS: tenant client-1, decided at 2026-10-25T14:17:53.416Z: 61 collection run(s) of the tenant, 0 failed the DQ gate (none), 14174 observations in the World Model, 27 finding(s) (orphan_record 3, orphan_vhost 3, proxied_without_real_ip 20, proxy_split 1); verbs: ADOPT 23, HOLD 3, ESCALATE 1; decided by operator 23, policy 4; judge skipped (model: none); memory: 23 lesson(s), 23 exception(s) applied, 0 lapsed; policy rules 56, locked settings without an approved value 0; ledger: 27 disposition(s) and 0 referent fingerprint(s) written, 0 finding(s) on rows an earlier pass wrotepass client-1model: none
15:51:05.582explainerqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE a.tenant_id = 'cl
15:51:05.584explainerqueryok259 rowsSELECT event_id, tenant_id, source, actor, action, resource_type, resource_id, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' A
15:51:05.585explainerqueryok0 rowsSELECT action_id, tenant_id, kind, target, before_hash, after_hash, vault_commit, verification, receipts, status, reason, record, started_at, finished_at, dispo
15:51:05.590explainerqueryok1 rowsSELECT obs_id, value_redacted, observed_at FROM observation WHERE tenant_id = 'client-1' AND surface = 'cloudflare.dns' AND object_id = 'bce1ca2bb7caa2de9b6823d
15:51:05.591explainerexplainnot_checkedunknown: No record of who changed it: the audit log window of 18 h holds 0 events for the record.explain fnd-b4a40091cdb4f906 ESCALATE proxy_split cloudflare.dns bce1ca2bb7caa2de9b6823d5f6ecd3f2 proxiedwindow 2026-10-24T19:57:48.545Z to 2026-10-25T14:17:53.416Z; 0 journal and 203 cloudflare row(s) in the window, 0 write(s) to the file, 0 event(s) for the record, 0 action(s) in the ledger; evidence none; diff none; model: none
15:51:05.591explainerexplainokexplain: 1 cause(s) (unknown 1); finding_cause 1 writtenexplain client-10 journal and 259 cloudflare row(s) since 2026-10-24T17:57:48.545Z, 0 action(s); no error; model: none