client-1pass decided 25 Oct 2026 14:17 UTCsample mode

Trace console_sample_mvpizli5

logs/console_sample_mvpizli5.jsonl, 594 events from 26 Oct 2026 17:23 UTC to 26 Oct 2026 17:23 UTC. All traces

About this page

Every free-text field passes the redactor as the trace did when it was written, and a ticket's URL reads as its number.

594 events
Time (UTC)AgentActionStatusSummary
17:23:30.846looptriageokpass decided at 2026-10-25T14:17:53.416Zconsole pass client-1
17:23:30.850loopqueryok80 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM collection_run ORDER BY started_at, run_id
17:23:30.859observerqueryok80 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM collection_run ORDER BY started_at, run_id
17:23:31.011deciderqueryok28 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
17:23:31.011deciderqueryok23 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM disposition d WH
17:23:31.011deciderqueryok28 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
17:23:31.011deciderqueryok7 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM disposition d WH
17:23:31.012observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.tenant_id = 'client-1' AND (c.obse
17:23:31.012observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.tenant_id = 'lab-1' AND (c.observe
17:23:31.012observercheckokcloudflare.dns: 58/58 completerun_complete run-f9470e2f5f175899
17:23:31.012observercheckokcloudflare.audit: 728/728 completerun_complete run-507c9939230e60a4
17:23:31.012observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-67f4d6923cb4838d
17:23:31.013observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-15638d43819ba756
17:23:31.013observercheckokcloudflare.dns: 58/58 completerun_complete run-b69af94952dccb36
17:23:31.013observercheckokcloudflare.audit: 797/797 completerun_complete run-9a3335b91e5ef3c3
17:23:31.013observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-071329fedf5f073f
17:23:31.013observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-4592b852a04812f7
17:23:31.013observercheckokprobe: 111/111 completerun_complete run-e9f519d6a5af0fd0
17:23:31.013observercheckokcloudflare.dns: 58/58 completerun_complete run-de1564466df1d59b
17:23:31.013observercheckokcloudflare.audit: 818/818 completerun_complete run-91f4abd4904e22a6
17:23:31.013observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-81adedc1cc778bd5
17:23:31.013observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ace5f05819e5b28e
17:23:31.013observercheckokprobe: 111/111 completerun_complete run-b247c87d34f38d71
17:23:31.013observercheckokcloudflare.dns: 58/58 completerun_complete run-59ffd380cfc7cda5
17:23:31.013observercheckokcloudflare.audit: 839/839 completerun_complete run-527d9eb092475404
17:23:31.013observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-400375137e2bae7b
17:23:31.013observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-647f878a4f5605f7
17:23:31.013observercheckokprobe: 111/111 completerun_complete run-30f5647b8b9c5dff
17:23:31.013observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-8c5af1ac22c54514
17:23:31.013observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-43c8ccb3704ad21c
17:23:31.013observercheckokcloudflare.dns: 58/58 completerun_complete run-9e232bb5e1ebdb81
17:23:31.013observercheckokcloudflare.audit: 860/860 completerun_complete run-bbf110bf21466ecc
17:23:31.013observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-49fc76bf3b823051
17:23:31.013observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ea10fdeb1eae1a46
17:23:31.013observercheckokprobe: 111/111 completerun_complete run-e839e796556a54c3
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-74140124db03c3f5
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-afe5a89ee42acbc2
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-90bdfa86df88a639
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-33b1aa9a8f89d3c8
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-ce4dc382bcffa4bb
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-1f4d84ed6359ff18
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-463c7c0ce537bd16
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f97423f25dc75884
17:23:31.014observercheckokcloudflare.dns: 58/58 completerun_complete run-6b65e048bb60fc24
17:23:31.014observercheckokcloudflare.audit: 888/888 completerun_complete run-f6b79eeae02db225
17:23:31.014observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f6c7da2a579e2141
17:23:31.014observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-258ffc0f34ffab51
17:23:31.014observercheckokprobe: 111/111 completerun_complete run-446db683143ec580
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-e476cc64252f6715
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-d1fcc061e5c34158
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-2c3fc585f404b90f
17:23:31.014observercheckokprobe: 6/6 completerun_complete run-396c20fb165306ed
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-0f5afdbf81b5b05a
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f509f49299848d43
17:23:31.014observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-41e44e7c818c214d
17:23:31.014observercheckokhost-d0ab88.verify: 2/2 completerun_complete run-588dc39d3f984621
17:23:31.015observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-b78229c438b759eb
17:23:31.015observercheckokhost-d0ab88.verify: 2/2 completerun_complete run-5307a4b4884f8f8d
17:23:31.015observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-71776a91583187d1
17:23:31.015observercheckokcloudflare.dns: 58/58 completerun_complete run-643ca3aadc62f002
17:23:31.015observercheckokcloudflare.audit: 909/909 completerun_complete run-3fcba77d90340f5d
17:23:31.015observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-b094ed4249e79faf
17:23:31.015observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-028e1c06567f1445
17:23:31.015observercheckokprobe: 111/111 completerun_complete run-af82fe9cd0f12826
17:23:31.015observercheckokcloudflare.dns: 58/58 completerun_complete run-63bc01583b366b8d
17:23:31.015observercheckokcloudflare.audit: 930/930 completerun_complete run-8b02f9aad70df0c9
17:23:31.015observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-c52288c22d5992fd
17:23:31.015observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-df60a03b49bbda47
17:23:31.015observercheckokprobe: 111/111 completerun_complete run-f79e58d09c04c8d7
17:23:31.015observercheckokcloudflare.dns: 58/58 completerun_complete run-93f3f163d3d8a95d
17:23:31.015observercheckokcloudflare.audit: 951/951 completerun_complete run-f9954452442b0cd1
17:23:31.015observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-2a11f407cfdce7b6
17:23:31.015observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-d594486e164c4097
17:23:31.015observercheckokprobe: 111/111 completerun_complete run-84b6426b9763f7f1
17:23:31.015observercheckokcloudflare.dns: 58/58 completerun_complete run-199d9e1bdc86bf4d
17:23:31.015observercheckokcloudflare.audit: 972/972 completerun_complete run-cf8eb79048a18bc9
17:23:31.016observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-439d1fb53664c597
17:23:31.016observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-209d57362e152a70
17:23:31.016observercheckokprobe: 111/111 completerun_complete run-02925c58440a149c
17:23:31.016observercheckokcloudflare.dns: 58/58 completerun_complete run-480602f60ca854c6
17:23:31.016observercheckokcloudflare.audit: 993/993 completerun_complete run-f98b965de7012d0b
17:23:31.016observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-573b3e958d5799a2
17:23:31.016observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ee1c61b44a6d6e01
17:23:31.016observercheckokprobe: 111/111 completerun_complete run-20f146f855acc7b9
17:23:31.016observercheckokcloudflare.dns: 58/58 completerun_complete run-9d48791b00433777
17:23:31.016observercheckokcloudflare.audit: 1014/1014 completerun_complete run-77ae40d31854071c
17:23:31.016observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f74b40064e093f2c
17:23:31.016observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-28ad36002e466ed5
17:23:31.016observercheckokprobe: 111/111 completerun_complete run-7a3ff25f0476b93f
17:23:31.018observerchecknot_checkedaudit log withheld for lab-1: no cloudflare.audit run for this tenantaudit_event lab-1actor_attributed, previous_value_recoverable, referent_unchanged, record_reverted are rejected for every finding of this tenant this pass
17:23:31.257observerqueryok5000 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:23:31.257observerqueryok5000 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:23:31.257observerqueryok3808 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:23:31.257observerqueryok368 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:23:31.275observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.275observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.275observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.276observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.276observerqueryok150 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.276observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.276observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.276observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.276observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.277observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.277observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.277observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:23:31.405observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-f9470e2f5f175899)run-67f4d6923cb4838dmodel: none
17:23:31.468observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-f9470e2f5f175899)run-15638d43819ba756model: none
17:23:31.526observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-b69af94952dccb36)run-071329fedf5f073fmodel: none
17:23:31.578observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-b69af94952dccb36)run-4592b852a04812f7model: none
17:23:31.671observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-de1564466df1d59b)run-81adedc1cc778bd5model: none
17:23:31.694observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-de1564466df1d59b)run-ace5f05819e5b28emodel: none
17:23:31.788observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-400375137e2bae7bmodel: none
17:23:31.817observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-647f878a4f5605f7model: none
17:23:31.903observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-8c5af1ac22c54514model: none
17:23:31.937observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-43c8ccb3704ad21cmodel: none
17:23:32.030observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-49fc76bf3b823051model: none
17:23:32.079observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-ea10fdeb1eae1a46model: none
17:23:32.082observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-74140124db03c3f5model: none
17:23:32.084observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-afe5a89ee42acbc2model: none
17:23:32.090observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-90bdfa86df88a639model: none
17:23:32.092observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-33b1aa9a8f89d3c8model: none
17:23:32.095observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-ce4dc382bcffa4bbmodel: none
17:23:32.098observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-1f4d84ed6359ff18model: none
17:23:32.100observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-463c7c0ce537bd16model: none
17:23:32.103observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f97423f25dc75884model: none
17:23:32.202observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-6b65e048bb60fc24)run-f6c7da2a579e2141model: none
17:23:32.284observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-6b65e048bb60fc24)run-258ffc0f34ffab51model: none
17:23:32.288observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-e476cc64252f6715model: none
17:23:32.356observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-d1fcc061e5c34158model: none
17:23:32.360observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-2c3fc585f404b90fmodel: none
17:23:32.363observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-0f5afdbf81b5b05amodel: none
17:23:32.366observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f509f49299848d43model: none
17:23:32.370observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-41e44e7c818c214dmodel: none
17:23:32.373observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-b78229c438b759ebmodel: none
17:23:32.376observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-71776a91583187d1model: none
17:23:32.500observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-643ca3aadc62f002)run-b094ed4249e79fafmodel: none
17:23:32.556observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-643ca3aadc62f002)run-028e1c06567f1445model: none
17:23:32.689observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-63bc01583b366b8d)run-c52288c22d5992fdmodel: none
17:23:32.763observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-63bc01583b366b8d)run-df60a03b49bbda47model: none
17:23:32.935observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-2a11f407cfdce7b6model: none
17:23:33.008observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-d594486e164c4097model: none
17:23:33.211observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-439d1fb53664c597model: none
17:23:33.296observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-209d57362e152a70model: none
17:23:33.490observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-480602f60ca854c6)run-573b3e958d5799a2model: none
17:23:33.572observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-480602f60ca854c6)run-ee1c61b44a6d6e01model: none
17:23:33.803observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9d48791b00433777)run-f74b40064e093f2cmodel: none
17:23:33.900observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9d48791b00433777)run-28ad36002e466ed5model: none
17:23:33.924detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM observation
17:23:33.924detectordetectoklinux.nginx host-aa516a: 0 setting(s) point at a name resolving outside the inventoryhero run-f74b40064e093f2c x run-9d48791b00433777model: none
17:23:33.924detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM observation
17:23:33.924detectordetectoklinux.nginx host-4b4dc1: 0 setting(s) point at a name resolving outside the inventoryhero run-28ad36002e466ed5 x run-9d48791b00433777model: none
17:23:34.592detectordetectnot_checkedno DNS run of this pass for this tenant; the hero query has nothing to joinlinux.nginx host-951abf
17:23:34.592detectorqueryok1 rowsSELECT c.zone, c.name AS proxied_name, c.record_id AS proxied_record_id, a.name AS target_name, a.type AS target_type, a.content AS target_content, a.rec
17:23:34.592detectordetectokcloudflare.dns: 1 proxied CNAME(s) alias a direct address recordproxy_split run-9d48791b00433777model: none
17:23:34.592detectordetectokproxy_split: host-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it points atproxied record bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none
17:23:34.593detectorqueryok1 rowsSELECT MIN(occurred_at) AS first_at, MAX(occurred_at) AS last_at, COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1'
17:23:34.622checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
17:23:34.622checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
17:23:34.622checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b682
17:23:34.622checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:44.528Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:44.528Z.
17:23:34.623checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.623checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
17:23:34.623checkerqueryok3 rowsSELECT 'dns_record' AS evidence, a.record_id AS resource_id, a.content AS old_value, b.content AS new_value, b.observed_at AS seen_at FROM dns_record a JOIN dns
17:23:34.623checkercheckfailedreferent_unchanged: fails (3 rows)referent_unchanged {"tenant_id":"client-1","name":"host-524b42.quest","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:44.528Z"}host-524b42.quest changed between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:44.528Z (3 pieces of evidence).
17:23:34.623deciderqueryok111 rowsSELECT probe_id, run_id, kind, target, expected, observed, status, latency_ms, observed_at FROM probe WHERE tenant_id = 'client-1' AND run_id = 'run-7a3ff25f047
17:23:34.624deciderdecideokESCALATE: hold under rule rule-8e75e1d767980665 expired 2026-10-25T03:21:06.870Z; the finding standsproxy_split proxied in bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none; policy: rule-8e75e1d767980665 (cloudflare.dns * proxied v2: critical, lock 1, on_drift rollback, on_no_copy investigate_ticket, hold 4 h); the checks alone say ESCALATE; production answering (3 probes of its names ok in run-7a3ff25f0476b93f); prior HOLD since 2026-10-25T01:45:33.962Z until 2026-10-25T03:21:06.870Z
17:23:34.624deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.658deciderqueryok2 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.658deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b6823d5f6ecd3f2' AND action <> 'view' AND occurred_at < '
17:23:34.675decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
17:23:34.676judgejudgeskippedhost-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it pointsmodel: none (sample)
17:23:34.676detectorqueryskippedshared read: run once this pass, where detector first askedreused audit_span client-1
17:23:34.676detectorqueryok10 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
17:23:34.676detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
17:23:34.676detectordetectoklinux.nginx host-aa516a: 10 proxied name(s) served by a block that trusts no real_ip range, 1 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-f74b40064e093f2c x run-9d48791b00433777model: none
17:23:34.676detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
17:23:34.676checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.677checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.677checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.677checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.677checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc
17:23:34.677checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.677checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.677checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
17:23:34.677decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.677deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.677deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.677deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.677deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc11f85b45bc4' AND action <> 'view' AND occurred_at < '
17:23:34.783decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 109 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
17:23:34.783judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is averdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.783detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
17:23:34.783checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.783checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.784checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.784checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.784checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc
17:23:34.784checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.784checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.784checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
17:23:34.784decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.784deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.784deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|82de28f7baf86a005babc11f85b45bc4|proxied
17:23:34.784decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 109 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
17:23:34.784judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is abverdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.785detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
17:23:34.785checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.785checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.785checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.785checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.785checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029b20da8
17:23:34.785checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.785checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.785checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
17:23:34.785decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.785deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.785deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.785deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.785decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 803592cea544029b20da8b45e5045f41model: none
17:23:34.785judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.785detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
17:23:34.786checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.786checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.786checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.786checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.786checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029b20da8
17:23:34.786checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.786checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.786checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
17:23:34.786decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.786deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.786deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|803592cea544029b20da8b45e5045f41|proxied
17:23:34.786decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 803592cea544029b20da8b45e5045f41model: none
17:23:34.786judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.786detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
17:23:34.786checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.786checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.787checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.787checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.787checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc4cb209
17:23:34.787checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.787checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.787checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
17:23:34.787decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.787deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.787deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.787deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.787decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
17:23:34.787judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.787detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
17:23:34.787checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.787checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.787checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.787checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.788checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc4cb209
17:23:34.788checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.788checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.788checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
17:23:34.788decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.788deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.788deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|cf2be0e75e70bfc4cb2096d542f82617|proxied
17:23:34.788decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
17:23:34.788judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.788detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
17:23:34.788checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.788checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.788checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.788checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.788checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537ffee079
17:23:34.788checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.789checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.789checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
17:23:34.789decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.789deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.789deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.789deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.789decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
17:23:34.789judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.789detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
17:23:34.789checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.789checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.789checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.789checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.789checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537ffee079
17:23:34.789checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.789checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.789checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
17:23:34.790decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.790deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.790deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|09f042ef748537ffee079ebc3ef8ac2d|proxied
17:23:34.790decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
17:23:34.790judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.790detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
17:23:34.790checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.790checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.790checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.790checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.790checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28069f16
17:23:34.790checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.790checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.790checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
17:23:34.791decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.791deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.791deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.791deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.791decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
17:23:34.791judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.791detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
17:23:34.791checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.791checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.791checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.791checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.791checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28069f16
17:23:34.791checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.791checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.791checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
17:23:34.792decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.792deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.792deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|54e2f4da0f26c28069f163917d3dc611|proxied
17:23:34.792decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
17:23:34.792judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.792detectordetectokproxied_without_real_ip: *.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.conf is absent): every name under the wildcard sees Cloudflare's addresses as its visitorshttp.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none
17:23:34.792checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:23:34.792checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:23:34.792checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.792checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.792checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c922e6966d55b15bd96b5
17:23:34.792checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed c922e6966d55b15bd96b5e8ea932b715 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.792checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.793checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715"}The audit log does not record what c922e6966d55b15bd96b5e8ea932b715 was before its latest change.
17:23:34.793decidertriageokexception mem-19 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516alesson mem-19 on *.host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:43.955Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.793deciderdecideokADOPT: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-19 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
17:23:34.793deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.793deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.793decidertriagenot_checkedexposure not dated: the audit log holds no event on c922e6966d55b15bd96b5e8ea932b715 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure c922e6966d55b15bd96b5e8ea932b715model: none
17:23:34.793judgejudgeskipped*.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.confverdict cannot move: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.793detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM dns_record d LEFT JOIN dn
17:23:34.793detectordetectoklinux.nginx host-aa516a: 1 record(s) land here with no enabled server block naming themorphan_record run-f74b40064e093f2c x run-9d48791b00433777model: none
17:23:34.793detectordetectokorphan_record: host-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default serverrecord c8b1963847dafe3548b1a4b93f520c0amodel: none
17:23:34.793checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
17:23:34.793checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
17:23:34.793checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:23:34.793checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:23:34.793checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c8b1963847dafe3548b1a
17:23:34.793checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed c8b1963847dafe3548b1a4b93f520c0a between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:23:34.794checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.794checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a"}The audit log does not record what c8b1963847dafe3548b1a4b93f520c0a was before its latest change.
17:23:34.794deciderqueryskippedshared read: run once this pass, where decider first askedreused probe run-7a3ff25f0476b93f
17:23:34.794deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T13:54:08.785Z under rule rule-b8d9962485c3ced4orphan_record name in c8b1963847dafe3548b1a4b93f520c0a on host-aa516amodel: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (2 failing probes in run-7a3ff25f0476b93f: http host-3fef97.club, tls host-3fef97.club); prior HOLD since 2026-10-25T13:54:08.785Z until 2026-10-27T23:21:06.870Z
17:23:34.794deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.794deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6b6bba' AND e.old_val
17:23:34.794decidertriagenot_checkedexposure not dated: the audit log holds no event on c8b1963847dafe3548b1a4b93f520c0a that sets content=ip-6b6bba with no later different body up to 2026-10-25T13:53:44.528Zexposure c8b1963847dafe3548b1a4b93f520c0amodel: none
17:23:34.794judgejudgeskippedhost-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
17:23:34.794detectorqueryok0 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM observation n
17:23:34.794detectordetectoklinux.nginx host-aa516a: 0 server_name(s) with no record and no covering wildcardorphan_vhost run-f74b40064e093f2c x run-9d48791b00433777model: none
17:23:34.794detectorqueryskippedshared read: run once this pass, where detector first askedreused audit_span client-1
17:23:34.794detectorqueryok9 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
17:23:34.794detectorqueryok0 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
17:23:34.794detectordetectoklinux.nginx host-4b4dc1: 9 proxied name(s) served by a block that trusts no real_ip range, 0 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-28ad36002e466ed5 x run-9d48791b00433777model: none
17:23:34.794detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
17:23:34.794checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.795checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.795checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.795checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.795checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6a2b742
17:23:34.795checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.795checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.795checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
17:23:34.795decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.795deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.795deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.795deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.795decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
17:23:34.795judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.795detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
17:23:34.796checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.796checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.796checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.796checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.796checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6a2b742
17:23:34.796checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.796checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.796checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
17:23:34.796decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.796deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.796deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|b2d893895ed0af6a2b742958571cff7b|proxied
17:23:34.796decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
17:23:34.796judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.796detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
17:23:34.796checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.796checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.797checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.797checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.797checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b682
17:23:34.797checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.797checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.797checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
17:23:34.797decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.797deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.797deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|bce1ca2bb7caa2de9b6823d5f6ecd3f2|proxied
17:23:34.797decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
17:23:34.797judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.797detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
17:23:34.798checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.798checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.798checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.798checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.798checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b682
17:23:34.798checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.798checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.798checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
17:23:34.798decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.798deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.798deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|bce1ca2bb7caa2de9b6823d5f6ecd3f2|proxied
17:23:34.798decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
17:23:34.799judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.799detectordetectokproxied_without_real_ip: host-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
17:23:34.799checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.799checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.799checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.799checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.799checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b43f276dea49e4dd9c227
17:23:34.799checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b43f276dea49e4dd9c2271e5a084e37e between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.799checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.799checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e"}The audit log does not record what b43f276dea49e4dd9c2271e5a084e37e was before its latest change.
17:23:34.799decidertriageokexception mem-11 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-11 on host-525a57.com (proxied_without_real_ip), recorded 2026-10-25T14:17:25.100Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.799deciderdecideokADOPT: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-11 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.799deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.799deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.799decidertriagenot_checkedexposure not dated: the audit log holds no event on b43f276dea49e4dd9c2271e5a084e37e that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b43f276dea49e4dd9c2271e5a084e37emodel: none
17:23:34.799judgejudgeskippedhost-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.800detectordetectokproxied_without_real_ip: host-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
17:23:34.800checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.800checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.800checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.800checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.800checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b5e781103f2acd7d15886
17:23:34.800checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b5e781103f2acd7d15886934269551c1 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.800checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.800checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1"}The audit log does not record what b5e781103f2acd7d15886934269551c1 was before its latest change.
17:23:34.800decidertriageokexception mem-10 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-10 on host-5c38db.com (proxied_without_real_ip), recorded 2026-10-25T14:17:22.803Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.800deciderdecideokADOPT: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-10 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.800deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.800deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.800decidertriagenot_checkedexposure not dated: the audit log holds no event on b5e781103f2acd7d15886934269551c1 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b5e781103f2acd7d15886934269551c1model: none
17:23:34.800judgejudgeskippedhost-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.801detectordetectokproxied_without_real_ip: host-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none
17:23:34.801checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.801checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.801checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.801checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.801checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '893f8252d3d2b233459c1
17:23:34.801checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed 893f8252d3d2b233459c1f10f5143d13 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.801checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.801checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13"}The audit log does not record what 893f8252d3d2b233459c1f10f5143d13 was before its latest change.
17:23:34.801decidertriageokexception mem-6 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1lesson mem-6 on host-62f7a4.com (proxied_without_real_ip), recorded 2026-10-25T14:17:13.404Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.801deciderdecideokADOPT: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-6 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.801deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.801deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.801decidertriagenot_checkedexposure not dated: the audit log holds no event on 893f8252d3d2b233459c1f10f5143d13 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 893f8252d3d2b233459c1f10f5143d13model: none
17:23:34.802judgejudgeskippedhost-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1verdict cannot move: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.802detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
17:23:34.802checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.802checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.802checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.802checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.802checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668
17:23:34.803checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.803checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.803checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
17:23:34.803decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.803deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.803deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.803deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:23:34.803deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668f5f435a4ae1' AND action <> 'view' AND occurred_at < '
17:23:34.803decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
17:23:34.803judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.803detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
17:23:34.803checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.804checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.804checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.804checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.804checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668
17:23:34.804checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.804checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.804checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
17:23:34.804decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.804deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:23:34.804deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|4c6d209470c71ee2c4668f5f435a4ae1|proxied
17:23:34.804decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
17:23:34.804judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.804detectorqueryok2 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM dns_record d LEFT JOIN dn
17:23:34.804detectordetectoklinux.nginx host-4b4dc1: 2 record(s) land here with no enabled server block naming themorphan_record run-28ad36002e466ed5 x run-9d48791b00433777model: none
17:23:34.805detectordetectokorphan_record: host-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord b0a17a719bd2118a535a763379ab7ba9model: none
17:23:34.805checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
17:23:34.805checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
17:23:34.805checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.805checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.805checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b0a17a719bd2118a535a7
17:23:34.805checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b0a17a719bd2118a535a763379ab7ba9 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.805checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.805checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9"}The audit log does not record what b0a17a719bd2118a535a763379ab7ba9 was before its latest change.
17:23:34.805deciderqueryskippedshared read: run once this pass, where decider first askedreused probe run-7a3ff25f0476b93f
17:23:34.805deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T13:54:08.785Z under rule rule-b8d9962485c3ced4orphan_record name in b0a17a719bd2118a535a763379ab7ba9 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-7a3ff25f0476b93f: http host-50b116.com); prior HOLD since 2026-10-25T13:54:08.785Z until 2026-10-27T23:21:06.870Z
17:23:34.805deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.805deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
17:23:34.805decidertriagenot_checkedexposure not dated: the audit log holds no event on b0a17a719bd2118a535a763379ab7ba9 that sets content=ip-6fb86d with no later different body up to 2026-10-25T13:53:44.528Zexposure b0a17a719bd2118a535a763379ab7ba9model: none
17:23:34.805judgejudgeskippedhost-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
17:23:34.805detectordetectokorphan_record: host-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord 25a23b5c40a3de0ea11b6054a7b54d07model: none
17:23:34.805checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
17:23:34.805checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
17:23:34.805checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:23:34.806checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:23:34.806checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0ea11b6
17:23:34.806checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}1 audit event with a named actor touched 25a23b5c40a3de0ea11b6054a7b54d07 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:23:34.806checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:23:34.806checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07"}The audit log does not record what 25a23b5c40a3de0ea11b6054a7b54d07 was before its latest change.
17:23:34.806deciderqueryskippedshared read: run once this pass, where decider first askedreused probe run-7a3ff25f0476b93f
17:23:34.806deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T13:54:08.785Z under rule rule-b8d9962485c3ced4orphan_record name in 25a23b5c40a3de0ea11b6054a7b54d07 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-7a3ff25f0476b93f: http host-c10fff.com); prior HOLD since 2026-10-25T13:54:08.785Z until 2026-10-27T23:21:06.870Z
17:23:34.806deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:23:34.806deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
17:23:34.806deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0ea11b6054a7b54d07' AND action <> 'view' AND occurred_at < '
17:23:34.806decidertriageokcontent=ip-6fb86d since 2026-07-06T18:46:40.994Z: at least 110 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 25a23b5c40a3de0ea11b6054a7b54d07first event of the current state: evt-48d6696c1de70593 (update); no earlier body on record sets another content state, so the state may predate the log; model: none
17:23:34.806judgejudgeskippedhost-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
17:23:34.806detectorqueryok3 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM observation n
17:23:34.806detectordetectoklinux.nginx host-4b4dc1: 3 server_name(s) with no record and no covering wildcardorphan_vhost run-28ad36002e466ed5 x run-9d48791b00433777model: none
17:23:34.806detectordetectokorphan_vhost: host-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none
17:23:34.807checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.807checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.807checkerqueryok0 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-28a
17:23:34.807checkercheckokother_settings_reference: holds (0 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-085e02.com","run_id":"run-28ad36002e466ed5","object_id":"/etc/nginx/sites-available/host-085e02.com","setting_path":"server[host-0No other setting in run run-28ad36002e466ed5 points at host-085e02.com.
17:23:34.807checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:29:03.0
17:23:34.807checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
17:23:34.807decidertriageokexception mem-8 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1lesson mem-8 on host-085e02.com (orphan_vhost), recorded 2026-10-25T14:17:18.089Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.807deciderdecideokADOPT: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTorphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-8 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
17:23:34.807judgejudgeskippedhost-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collecteverdict cannot move: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.807detectordetectokorphan_vhost: host-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
17:23:34.807checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.807checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.807checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-28a
17:23:34.807checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-89f6e7.com","run_id":"run-28ad36002e466ed5","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-28ad36002e466ed5 also point at host-89f6e7.com.
17:23:34.807checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:29:03.0
17:23:34.807checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
17:23:34.808decidertriageokexception mem-4 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-4 on host-89f6e7.com (orphan_vhost), recorded 2026-10-25T14:17:08.716Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.808deciderdecideokADOPT: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-4 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
17:23:34.808judgejudgeskippedhost-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.808detectordetectokorphan_vhost: host-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
17:23:34.808checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:23:34.808checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:23:34.808checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-28a
17:23:34.808checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-9ac4f1.com","run_id":"run-28ad36002e466ed5","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-28ad36002e466ed5 also point at host-9ac4f1.com.
17:23:34.808checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:29:03.0
17:23:34.808checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
17:23:34.808decidertriageokexception mem-16 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-16 on host-9ac4f1.com (orphan_vhost), recorded 2026-10-25T14:17:36.809Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:23:34.808deciderdecideokADOPT: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-16 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
17:23:34.808judgejudgeskippedhost-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:23:34.808detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
17:23:34.808detectordetectoklinux.nginx host-aa516a: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-f74b40064e093f2cmodel: none
17:23:34.809detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
17:23:34.809detectordetectoklinux.nginx host-aa516a: 0 approved setting(s) whose object the run lacksapproved_missing run-f74b40064e093f2cmodel: none
17:23:34.809detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM observ
17:23:34.809detectordetectoklinux.nginx host-aa516a: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-f74b40064e093f2cmodel: none
17:23:34.809detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
17:23:34.809detectordetectoklinux.nginx host-4b4dc1: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-28ad36002e466ed5model: none
17:23:34.809detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
17:23:34.809detectordetectoklinux.nginx host-4b4dc1: 0 approved setting(s) whose object the run lacksapproved_missing run-28ad36002e466ed5model: none
17:23:34.809detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM observ
17:23:34.809detectordetectoklinux.nginx host-4b4dc1: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-28ad36002e466ed5model: none
17:23:34.809detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
17:23:34.809detectordetectoklinux.nginx host-951abf: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-71776a91583187d1model: none
17:23:34.809detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
17:23:34.809detectordetectoklinux.nginx host-951abf: 0 approved setting(s) whose object the run lacksapproved_missing run-71776a91583187d1model: none
17:23:34.809detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM observ
17:23:34.809detectordetectoklinux.nginx host-951abf: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-71776a91583187d1model: none
17:23:34.809detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
17:23:34.809detectordetectokcloudflare.dns: 0 record field(s) drifted from their latest approvaldrift_vs_approved run-9d48791b00433777model: none
17:23:34.809detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
17:23:34.810detectordetectokcloudflare.dns: 0 approved setting(s) whose object the run lacksapproved_missing run-9d48791b00433777model: none
17:23:34.810detectordetectskippedm365.dns: no Microsoft 365 run for client-1, lab-1: the mail records Microsoft 365 requires are not compared (npm run collect:m365 reads them live)m365.dnsmodel: none
17:23:34.847deciderqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE a.tenant_id = 'cl
17:23:34.847deciderqueryok290 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:23:34.868deciderqueryok4 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE a.tenant_id = 'la
17:23:34.869decidertriageokearly_stop 0, checks_skipped 0, checks_gated 0, withdrawn_judge 23stop rulemodel: none
17:23:34.869decidertriageoklessons 23, exceptions applied 23, lapsed 0memorylocal store; recall by exact scope key, never by similarity; model: none
17:23:34.869decidertriageoklocked settings without an approved value: 0policy56 policy rule(s) read; verbs ADOPT 23, HOLD 3, ESCALATE 1; decided by policy 4, operator 23, default 0; probe run(s) run-e9f519d6a5af0fd0, run-b247c87d34f38d71, run-30f5647b8b9c5dff, run-e839e796556a54c3, run-446db683143ec580, run-396c20fb165306ed, run-af82fe9cd0f12826, run-f79e58d09c04c8d7, run-84b6426b9763f7f1, run-02925c58440a149c, run-20f146f855acc7b9, run-7a3ff25f0476b93f; ledger: 27 disposi
17:23:34.871loopqueryok370 rowsSELECT disposition_id, tenant_id, surface, host, object_id, setting_path, value_hash, verb, reason, expires_at, decided_by, rule_id, finding_id, run_id,
17:23:34.873looptriageokPASS: tenant client-1, decided at 2026-10-25T14:17:53.416Z: 61 collection run(s) of the tenant, 0 failed the DQ gate (none), 14174 observations in the World Model, 27 finding(s) (orphan_record 3, orphan_vhost 3, proxied_without_real_ip 20, proxy_split 1); verbs: ADOPT 23, HOLD 3, ESCALATE 1; decided by operator 23, policy 4; judge skipped (model: none); memory: 23 lesson(s), 23 exception(s) applied, 0 lapsed; policy rules 56, locked settings without an approved value 0; ledger: 27 disposition(s) and 0 referent fingerprint(s) written, 0 finding(s) on rows an earlier pass wrotepass client-1model: none
17:23:34.902explainerqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE a.tenant_id = 'cl
17:23:34.904explainerqueryok259 rowsSELECT event_id, tenant_id, source, actor, action, resource_type, resource_id, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' A
17:23:34.906explainerqueryok0 rowsSELECT action_id, tenant_id, kind, target, before_hash, after_hash, vault_commit, verification, receipts, status, reason, record, started_at, finished_at, dispo
17:23:34.910explainerqueryok1 rowsSELECT obs_id, value_redacted, observed_at FROM observation WHERE tenant_id = 'client-1' AND surface = 'cloudflare.dns' AND object_id = 'bce1ca2bb7caa2de9b6823d
17:23:34.912explainerexplainnot_checkedunknown: No record of who changed it: the audit log window of 18 h holds 0 events for the record.explain fnd-b4a40091cdb4f906 ESCALATE proxy_split cloudflare.dns bce1ca2bb7caa2de9b6823d5f6ecd3f2 proxiedwindow 2026-10-24T19:57:48.545Z to 2026-10-25T14:17:53.416Z; 0 journal and 203 cloudflare row(s) in the window, 0 write(s) to the file, 0 event(s) for the record, 0 action(s) in the ledger; evidence none; diff none; model: none
17:23:34.912explainerexplainokexplain: 1 cause(s) (unknown 1); finding_cause 1 writtenexplain client-10 journal and 259 cloudflare row(s) since 2026-10-24T17:57:48.545Z, 0 action(s); no error; model: none