client-1pass decided 25 Oct 2026 14:17 UTCsample mode

Trace console_sample_mvpjzh0d

logs/console_sample_mvpjzh0d.jsonl, 594 events from 26 Oct 2026 17:51 UTC to 26 Oct 2026 17:51 UTC. All traces

About this page

Every free-text field passes the redactor as the trace did when it was written, and a ticket's URL reads as its number.

594 events
Time (UTC)AgentActionStatusSummary
17:51:24.638looptriageokpass decided at 2026-10-25T14:17:53.416Zconsole pass client-1
17:51:24.642loopqueryok80 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM collection_run ORDER BY started_at, run_id
17:51:24.645observerqueryok80 rowsSELECT run_id, tenant_id, surface, host, started_at, finished_at, expected_count, observed_count, status FROM collection_run ORDER BY started_at, run_id
17:51:24.807deciderqueryok28 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
17:51:24.807deciderqueryok23 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM disposition d WH
17:51:24.807deciderqueryok28 rowsSELECT rule_id, tenant_id, surface, object_glob, setting_glob, criticality, lock, on_drift, on_no_copy, hold_max_hours, alert, psa_priority, version, aut
17:51:24.807deciderqueryok7 rowsSELECT d.disposition_id, d.surface, d.host, d.object_id, d.setting_path, d.value_hash, d.rule_id, d.expires_at, d.decided_at, d.finding_id FROM disposition d WH
17:51:24.808observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.tenant_id = 'client-1' AND (c.obse
17:51:24.808observerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.tenant_id = 'lab-1' AND (c.observe
17:51:24.808observercheckokcloudflare.dns: 58/58 completerun_complete run-f9470e2f5f175899
17:51:24.808observercheckokcloudflare.audit: 728/728 completerun_complete run-507c9939230e60a4
17:51:24.808observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-67f4d6923cb4838d
17:51:24.808observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-15638d43819ba756
17:51:24.808observercheckokcloudflare.dns: 58/58 completerun_complete run-b69af94952dccb36
17:51:24.808observercheckokcloudflare.audit: 797/797 completerun_complete run-9a3335b91e5ef3c3
17:51:24.808observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-071329fedf5f073f
17:51:24.808observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-4592b852a04812f7
17:51:24.808observercheckokprobe: 111/111 completerun_complete run-e9f519d6a5af0fd0
17:51:24.808observercheckokcloudflare.dns: 58/58 completerun_complete run-de1564466df1d59b
17:51:24.808observercheckokcloudflare.audit: 818/818 completerun_complete run-91f4abd4904e22a6
17:51:24.808observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-81adedc1cc778bd5
17:51:24.808observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ace5f05819e5b28e
17:51:24.809observercheckokprobe: 111/111 completerun_complete run-b247c87d34f38d71
17:51:24.809observercheckokcloudflare.dns: 58/58 completerun_complete run-59ffd380cfc7cda5
17:51:24.809observercheckokcloudflare.audit: 839/839 completerun_complete run-527d9eb092475404
17:51:24.809observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-400375137e2bae7b
17:51:24.809observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-647f878a4f5605f7
17:51:24.809observercheckokprobe: 111/111 completerun_complete run-30f5647b8b9c5dff
17:51:24.809observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-8c5af1ac22c54514
17:51:24.809observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-43c8ccb3704ad21c
17:51:24.809observercheckokcloudflare.dns: 58/58 completerun_complete run-9e232bb5e1ebdb81
17:51:24.809observercheckokcloudflare.audit: 860/860 completerun_complete run-bbf110bf21466ecc
17:51:24.809observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-49fc76bf3b823051
17:51:24.809observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ea10fdeb1eae1a46
17:51:24.809observercheckokprobe: 111/111 completerun_complete run-e839e796556a54c3
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-74140124db03c3f5
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-afe5a89ee42acbc2
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-90bdfa86df88a639
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-33b1aa9a8f89d3c8
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-ce4dc382bcffa4bb
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-1f4d84ed6359ff18
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-463c7c0ce537bd16
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f97423f25dc75884
17:51:24.809observercheckokcloudflare.dns: 58/58 completerun_complete run-6b65e048bb60fc24
17:51:24.809observercheckokcloudflare.audit: 888/888 completerun_complete run-f6b79eeae02db225
17:51:24.809observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f6c7da2a579e2141
17:51:24.809observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-258ffc0f34ffab51
17:51:24.809observercheckokprobe: 111/111 completerun_complete run-446db683143ec580
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-e476cc64252f6715
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-d1fcc061e5c34158
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-2c3fc585f404b90f
17:51:24.809observercheckokprobe: 6/6 completerun_complete run-396c20fb165306ed
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-0f5afdbf81b5b05a
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-f509f49299848d43
17:51:24.809observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-41e44e7c818c214d
17:51:24.810observercheckokhost-0cbc18.verify: 2/2 completerun_complete run-588dc39d3f984621
17:51:24.810observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-b78229c438b759eb
17:51:24.810observercheckokhost-0cbc18.verify: 2/2 completerun_complete run-5307a4b4884f8f8d
17:51:24.810observercheckoklinux.nginx host-951abf: 2/2 completerun_complete run-71776a91583187d1
17:51:24.810observercheckokcloudflare.dns: 58/58 completerun_complete run-643ca3aadc62f002
17:51:24.810observercheckokcloudflare.audit: 909/909 completerun_complete run-3fcba77d90340f5d
17:51:24.810observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-b094ed4249e79faf
17:51:24.810observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-028e1c06567f1445
17:51:24.810observercheckokprobe: 111/111 completerun_complete run-af82fe9cd0f12826
17:51:24.810observercheckokcloudflare.dns: 58/58 completerun_complete run-63bc01583b366b8d
17:51:24.811observercheckokcloudflare.audit: 930/930 completerun_complete run-8b02f9aad70df0c9
17:51:24.811observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-c52288c22d5992fd
17:51:24.811observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-df60a03b49bbda47
17:51:24.811observercheckokprobe: 111/111 completerun_complete run-f79e58d09c04c8d7
17:51:24.811observercheckokcloudflare.dns: 58/58 completerun_complete run-93f3f163d3d8a95d
17:51:24.811observercheckokcloudflare.audit: 951/951 completerun_complete run-f9954452442b0cd1
17:51:24.811observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-2a11f407cfdce7b6
17:51:24.811observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-d594486e164c4097
17:51:24.811observercheckokprobe: 111/111 completerun_complete run-84b6426b9763f7f1
17:51:24.811observercheckokcloudflare.dns: 58/58 completerun_complete run-199d9e1bdc86bf4d
17:51:24.811observercheckokcloudflare.audit: 972/972 completerun_complete run-cf8eb79048a18bc9
17:51:24.811observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-439d1fb53664c597
17:51:24.811observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-209d57362e152a70
17:51:24.811observercheckokprobe: 111/111 completerun_complete run-02925c58440a149c
17:51:24.811observercheckokcloudflare.dns: 58/58 completerun_complete run-480602f60ca854c6
17:51:24.811observercheckokcloudflare.audit: 993/993 completerun_complete run-f98b965de7012d0b
17:51:24.811observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-573b3e958d5799a2
17:51:24.811observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-ee1c61b44a6d6e01
17:51:24.811observercheckokprobe: 111/111 completerun_complete run-20f146f855acc7b9
17:51:24.811observercheckokcloudflare.dns: 58/58 completerun_complete run-9d48791b00433777
17:51:24.811observercheckokcloudflare.audit: 1014/1014 completerun_complete run-77ae40d31854071c
17:51:24.811observercheckoklinux.nginx host-aa516a: 24/24 completerun_complete run-f74b40064e093f2c
17:51:24.811observercheckoklinux.nginx host-4b4dc1: 14/14 completerun_complete run-28ad36002e466ed5
17:51:24.811observercheckokprobe: 111/111 completerun_complete run-7a3ff25f0476b93f
17:51:24.819observerchecknot_checkedaudit log withheld for lab-1: no cloudflare.audit run for this tenantaudit_event lab-1actor_attributed, previous_value_recoverable, referent_unchanged, record_reverted are rejected for every finding of this tenant this pass
17:51:25.051observerqueryok5000 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:51:25.051observerqueryok5000 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:51:25.051observerqueryok3808 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:51:25.051observerqueryok368 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:51:25.068observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.069observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.069observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.069observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.069observerqueryok150 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.069observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.070observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.070observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.070observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.070observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.070observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.070observerqueryok75 rowsSELECT o.run_id, o.obs_id, d.record_id, d.content, d.observed_at FROM observation o JOIN dns_record d ON d.tenant_id = o.tenant_id AND d.name = o.refers_to_id A
17:51:25.156observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-f9470e2f5f175899)run-67f4d6923cb4838dmodel: none
17:51:25.180observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-f9470e2f5f175899)run-15638d43819ba756model: none
17:51:25.356observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-b69af94952dccb36)run-071329fedf5f073fmodel: none
17:51:25.386observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-b69af94952dccb36)run-4592b852a04812f7model: none
17:51:25.527observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-de1564466df1d59b)run-81adedc1cc778bd5model: none
17:51:25.573observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-de1564466df1d59b)run-ace5f05819e5b28emodel: none
17:51:25.651observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-400375137e2bae7bmodel: none
17:51:25.682observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-59ffd380cfc7cda5)run-647f878a4f5605f7model: none
17:51:25.762observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-8c5af1ac22c54514model: none
17:51:25.795observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-43c8ccb3704ad21cmodel: none
17:51:25.885observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-49fc76bf3b823051model: none
17:51:25.929observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9e232bb5e1ebdb81)run-ea10fdeb1eae1a46model: none
17:51:25.932observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-74140124db03c3f5model: none
17:51:25.935observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-afe5a89ee42acbc2model: none
17:51:25.937observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-90bdfa86df88a639model: none
17:51:25.940observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-33b1aa9a8f89d3c8model: none
17:51:25.943observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-ce4dc382bcffa4bbmodel: none
17:51:25.946observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-1f4d84ed6359ff18model: none
17:51:25.948observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-463c7c0ce537bd16model: none
17:51:25.951observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f97423f25dc75884model: none
17:51:26.056observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-6b65e048bb60fc24)run-f6c7da2a579e2141model: none
17:51:26.099observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-6b65e048bb60fc24)run-258ffc0f34ffab51model: none
17:51:26.102observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-e476cc64252f6715model: none
17:51:26.105observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-d1fcc061e5c34158model: none
17:51:26.118observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-2c3fc585f404b90fmodel: none
17:51:26.124observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-0f5afdbf81b5b05amodel: none
17:51:26.129observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-f509f49299848d43model: none
17:51:26.134observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-41e44e7c818c214dmodel: none
17:51:26.138observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-b78229c438b759ebmodel: none
17:51:26.144observerobserveok23 observations recorded, 0 with a resolved referent (no DNS run of this pass passed the gate)run-71776a91583187d1model: none
17:51:26.271observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-643ca3aadc62f002)run-b094ed4249e79fafmodel: none
17:51:26.327observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-643ca3aadc62f002)run-028e1c06567f1445model: none
17:51:26.462observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-63bc01583b366b8d)run-c52288c22d5992fdmodel: none
17:51:26.634observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-63bc01583b366b8d)run-df60a03b49bbda47model: none
17:51:26.786observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-2a11f407cfdce7b6model: none
17:51:26.852observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-93f3f163d3d8a95d)run-d594486e164c4097model: none
17:51:27.004observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-439d1fb53664c597model: none
17:51:27.073observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-199d9e1bdc86bf4d)run-209d57362e152a70model: none
17:51:27.238observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-480602f60ca854c6)run-573b3e958d5799a2model: none
17:51:27.308observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-480602f60ca854c6)run-ee1c61b44a6d6e01model: none
17:51:27.486observerobserveok761 observations recorded, 50 with a resolved referent (DNS run run-9d48791b00433777)run-f74b40064e093f2cmodel: none
17:51:27.563observerobserveok301 observations recorded, 25 with a resolved referent (DNS run run-9d48791b00433777)run-28ad36002e466ed5model: none
17:51:27.580detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM observation
17:51:27.580detectordetectoklinux.nginx host-aa516a: 0 setting(s) point at a name resolving outside the inventoryhero run-f74b40064e093f2c x run-9d48791b00433777model: none
17:51:27.581detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.refers_to_id AS upstream_name, d.content AS resolves_to, d.observed_at AS dns_observed_at FROM observation
17:51:27.581detectordetectoklinux.nginx host-4b4dc1: 0 setting(s) point at a name resolving outside the inventoryhero run-28ad36002e466ed5 x run-9d48791b00433777model: none
17:51:28.161detectordetectnot_checkedno DNS run of this pass for this tenant; the hero query has nothing to joinlinux.nginx host-951abf
17:51:28.161detectorqueryok1 rowsSELECT c.zone, c.name AS proxied_name, c.record_id AS proxied_record_id, a.name AS target_name, a.type AS target_type, a.content AS target_content, a.rec
17:51:28.161detectordetectokcloudflare.dns: 1 proxied CNAME(s) alias a direct address recordproxy_split run-9d48791b00433777model: none
17:51:28.161detectordetectokproxy_split: host-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it points atproxied record bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none
17:51:28.162detectorqueryok1 rowsSELECT MIN(occurred_at) AS first_at, MAX(occurred_at) AS last_at, COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1'
17:51:28.193checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
17:51:28.193checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
17:51:28.193checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b682
17:51:28.193checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:44.528Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:44.528Z.
17:51:28.194checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.194checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
17:51:28.194checkerqueryok3 rowsSELECT 'dns_record' AS evidence, a.record_id AS resource_id, a.content AS old_value, b.content AS new_value, b.observed_at AS seen_at FROM dns_record a JOIN dns
17:51:28.194checkercheckfailedreferent_unchanged: fails (3 rows)referent_unchanged {"tenant_id":"client-1","name":"host-524b42.quest","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:44.528Z"}host-524b42.quest changed between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:44.528Z (3 pieces of evidence).
17:51:28.194deciderqueryok111 rowsSELECT probe_id, run_id, kind, target, expected, observed, status, latency_ms, observed_at FROM probe WHERE tenant_id = 'client-1' AND run_id = 'run-7a3ff25f047
17:51:28.196deciderdecideokESCALATE: hold under rule rule-8e75e1d767980665 expired 2026-10-25T03:21:06.870Z; the finding standsproxy_split proxied in bce1ca2bb7caa2de9b6823d5f6ecd3f2model: none; policy: rule-8e75e1d767980665 (cloudflare.dns * proxied v2: critical, lock 1, on_drift rollback, on_no_copy investigate_ticket, hold 4 h); the checks alone say ESCALATE; production answering (3 probes of its names ok in run-7a3ff25f0476b93f); prior HOLD since 2026-10-25T01:45:33.962Z until 2026-10-25T03:21:06.870Z
17:51:28.196deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.202deciderqueryok2 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.202deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b6823d5f6ecd3f2' AND action <> 'view' AND occurred_at < '
17:51:28.232decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
17:51:28.233judgejudgeskippedhost-524b42.quest is proxied and aliases host-4c795e.quest, whose A record is direct to ip-6fb86d: the origin the proxy hides is published on the name it pointsmodel: none (sample)
17:51:28.233detectorqueryskippedshared read: run once this pass, where detector first askedreused audit_span client-1
17:51:28.233detectorqueryok10 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
17:51:28.233detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
17:51:28.233detectordetectoklinux.nginx host-aa516a: 10 proxied name(s) served by a block that trusts no real_ip range, 1 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-f74b40064e093f2c x run-9d48791b00433777model: none
17:51:28.233detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
17:51:28.233checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.233checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.234checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.234checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.234checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc
17:51:28.234checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.234checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.234checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
17:51:28.234decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.234deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.234deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.234deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.234deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc11f85b45bc4' AND action <> 'view' AND occurred_at < '
17:51:28.336decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 109 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
17:51:28.336judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:443].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is averdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.336detectordetectokproxied_without_real_ip: host-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none
17:51:28.336checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.336checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.336checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.336checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.336checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '82de28f7baf86a005babc
17:51:28.336checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}2 audit events with a named actor touched 82de28f7baf86a005babc11f85b45bc4 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.336checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.336checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"82de28f7baf86a005babc11f85b45bc4"}The audit log records the state 82de28f7baf86a005babc11f85b45bc4 had before its latest change.
17:51:28.336decidertriageokexception mem-7 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516alesson mem-7 on host-18efce.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:15.742Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.336deciderdecideokADOPT: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-7 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.336deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|82de28f7baf86a005babc11f85b45bc4|proxied
17:51:28.337decidertriageokproxied=true since 2026-07-07T18:01:30.530Z: 109 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 82de28f7baf86a005babc11f85b45bc4first event of the current state: evt-9a25828cab362ecc (update); a change into this state is on record; model: none
17:51:28.337judgejudgeskippedhost-18efce.ai is proxied through Cloudflare to ip-6b6bba, and server[host-18efce.ai:80].real_ip in /etc/nginx/conf.d/word-005ed8-prod.conf on host-aa516a is abverdict cannot move: accepted exception mem-7 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.337detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
17:51:28.337checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.337checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.337checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.337checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.337checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029b20da8
17:51:28.337checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.337checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.337checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
17:51:28.337decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.337deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.338deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.338deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.338decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 803592cea544029b20da8b45e5045f41model: none
17:51:28.338judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-27618a.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.338detectordetectokproxied_without_real_ip: host-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
17:51:28.338checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.338checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.338checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.338checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.338checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '803592cea544029b20da8
17:51:28.338checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 803592cea544029b20da8b45e5045f41 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.338checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.338checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"803592cea544029b20da8b45e5045f41"}The audit log does not record what 803592cea544029b20da8b45e5045f41 was before its latest change.
17:51:28.338decidertriageokexception mem-9 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-9 on host-27618a.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:20.437Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.338deciderdecideokADOPT: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-9 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.338deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|803592cea544029b20da8b45e5045f41|proxied
17:51:28.339decidertriagenot_checkedexposure not dated: the audit log holds no event on 803592cea544029b20da8b45e5045f41 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 803592cea544029b20da8b45e5045f41model: none
17:51:28.339judgejudgeskippedhost-27618a.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-9 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.339detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
17:51:28.339checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.339checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.339checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.339checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.339checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc4cb209
17:51:28.339checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.339checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.339checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
17:51:28.339decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.339deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.339deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.339deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.339decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
17:51:28.340judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:443].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.340detectordetectokproxied_without_real_ip: host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none
17:51:28.340checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.340checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.340checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.340checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.340checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'cf2be0e75e70bfc4cb209
17:51:28.340checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed cf2be0e75e70bfc4cb2096d542f82617 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.340checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.340checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"cf2be0e75e70bfc4cb2096d542f82617"}The audit log does not record what cf2be0e75e70bfc4cb2096d542f82617 was before its latest change.
17:51:28.340decidertriageokexception mem-12 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516alesson mem-12 on host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:27.447Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.340deciderdecideokADOPT: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-12 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.340deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|cf2be0e75e70bfc4cb2096d542f82617|proxied
17:51:28.340decidertriagenot_checkedexposure not dated: the audit log holds no event on cf2be0e75e70bfc4cb2096d542f82617 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure cf2be0e75e70bfc4cb2096d542f82617model: none
17:51:28.340judgejudgeskippedhost-503b27.ai is proxied through Cloudflare to ip-6b6bba, and server[host-503b27.ai:80].real_ip in /etc/nginx/conf.d/host-503b27.ai.conf on host-aa516a is abseverdict cannot move: accepted exception mem-12 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.341detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
17:51:28.341checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.341checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.341checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.341checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.341checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537ffee079
17:51:28.341checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.341checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.341checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
17:51:28.341decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.341deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.341deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.341deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.341decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
17:51:28.341judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.341detectordetectokproxied_without_real_ip: host-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
17:51:28.342checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.342checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.342checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.342checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.342checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '09f042ef748537ffee079
17:51:28.342checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 09f042ef748537ffee079ebc3ef8ac2d between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.342checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.342checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"09f042ef748537ffee079ebc3ef8ac2d"}The audit log does not record what 09f042ef748537ffee079ebc3ef8ac2d was before its latest change.
17:51:28.342decidertriageokexception mem-2 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-2 on host-d39933.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:03.992Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.342deciderdecideokADOPT: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-2 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.342deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|09f042ef748537ffee079ebc3ef8ac2d|proxied
17:51:28.342decidertriagenot_checkedexposure not dated: the audit log holds no event on 09f042ef748537ffee079ebc3ef8ac2d that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 09f042ef748537ffee079ebc3ef8ac2dmodel: none
17:51:28.342judgejudgeskippedhost-d39933.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-2 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.343detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
17:51:28.343checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.343checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.343checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.343checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.343checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28069f16
17:51:28.343checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.343checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.343checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
17:51:28.343decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.343deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.343deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.343deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.343decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
17:51:28.343judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:443].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa51verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.343detectordetectokproxied_without_real_ip: host-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516a is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none
17:51:28.344checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.344checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.344checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.344checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.344checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '54e2f4da0f26c28069f16
17:51:28.344checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed 54e2f4da0f26c28069f163917d3dc611 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.344checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.344checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"54e2f4da0f26c28069f163917d3dc611"}The audit log does not record what 54e2f4da0f26c28069f163917d3dc611 was before its latest change.
17:51:28.344decidertriageokexception mem-5 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516alesson mem-5 on host-e49c58.cloud (proxied_without_real_ip), recorded 2026-10-25T14:17:11.052Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.344deciderdecideokADOPT: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-5 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.344deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|54e2f4da0f26c28069f163917d3dc611|proxied
17:51:28.344decidertriagenot_checkedexposure not dated: the audit log holds no event on 54e2f4da0f26c28069f163917d3dc611 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 54e2f4da0f26c28069f163917d3dc611model: none
17:51:28.344judgejudgeskippedhost-e49c58.cloud is proxied through Cloudflare to ip-6b6bba, and server[host-e49c58.cloud:80].real_ip in /etc/nginx/conf.d/host-e49c58.cloud.conf on host-aa516verdict cannot move: accepted exception mem-5 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.344detectordetectokproxied_without_real_ip: *.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.conf is absent): every name under the wildcard sees Cloudflare's addresses as its visitorshttp.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none
17:51:28.345checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-f74b40064e093f2c' AN
17:51:28.345checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-f74b40064e093f2c"}Run run-f74b40064e093f2c collected everything it set out to collect.
17:51:28.345checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.345checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.345checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c922e6966d55b15bd96b5
17:51:28.345checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed c922e6966d55b15bd96b5e8ea932b715 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.345checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.345checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c922e6966d55b15bd96b5e8ea932b715"}The audit log does not record what c922e6966d55b15bd96b5e8ea932b715 was before its latest change.
17:51:28.345decidertriageokexception mem-19 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516alesson mem-19 on *.host-503b27.ai (proxied_without_real_ip), recorded 2026-10-25T14:17:43.955Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.345deciderdecideokADOPT: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip http.real_ip in /etc/nginx/nginx.conf on host-aa516amodel: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-19 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
17:51:28.345deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.345deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.345decidertriagenot_checkedexposure not dated: the audit log holds no event on c922e6966d55b15bd96b5e8ea932b715 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure c922e6966d55b15bd96b5e8ea932b715model: none
17:51:28.345judgejudgeskipped*.host-503b27.ai is proxied through Cloudflare to ip-6b6bba, and no server block on host-aa516a trusts a Cloudflare range (http.real_ip in /etc/nginx/nginx.confverdict cannot move: accepted exception mem-19 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.345detectorqueryok1 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM dns_record d LEFT JOIN dn
17:51:28.345detectordetectoklinux.nginx host-aa516a: 1 record(s) land here with no enabled server block naming themorphan_record run-f74b40064e093f2c x run-9d48791b00433777model: none
17:51:28.345detectordetectokorphan_record: host-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default serverrecord c8b1963847dafe3548b1a4b93f520c0amodel: none
17:51:28.346checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
17:51:28.346checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
17:51:28.346checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6b6bba' ORDER BY asset_id
17:51:28.346checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6b6bba"}ip-6b6bba is in the inventory (1 asset).
17:51:28.346checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'c8b1963847dafe3548b1a
17:51:28.346checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:52.585Z"}No audit event names who changed c8b1963847dafe3548b1a4b93f520c0a between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:52.585Z.
17:51:28.346checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.346checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"c8b1963847dafe3548b1a4b93f520c0a"}The audit log does not record what c8b1963847dafe3548b1a4b93f520c0a was before its latest change.
17:51:28.346deciderqueryskippedshared read: run once this pass, where decider first askedreused probe run-7a3ff25f0476b93f
17:51:28.346deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T13:54:08.785Z under rule rule-b8d9962485c3ced4orphan_record name in c8b1963847dafe3548b1a4b93f520c0a on host-aa516amodel: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (2 failing probes in run-7a3ff25f0476b93f: http host-3fef97.club, tls host-3fef97.club); prior HOLD since 2026-10-25T13:54:08.785Z until 2026-10-27T23:21:06.870Z
17:51:28.346deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.346deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6b6bba' AND e.old_val
17:51:28.346decidertriagenot_checkedexposure not dated: the audit log holds no event on c8b1963847dafe3548b1a4b93f520c0a that sets content=ip-6b6bba with no later different body up to 2026-10-25T13:53:44.528Zexposure c8b1963847dafe3548b1a4b93f520c0amodel: none
17:51:28.346judgejudgeskippedhost-3fef97.club (A, direct) lands on ip-6b6bba, host-aa516a, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
17:51:28.346detectorqueryok0 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM observation n
17:51:28.347detectordetectoklinux.nginx host-aa516a: 0 server_name(s) with no record and no covering wildcardorphan_vhost run-f74b40064e093f2c x run-9d48791b00433777model: none
17:51:28.347detectorqueryskippedshared read: run once this pass, where detector first askedreused audit_span client-1
17:51:28.347detectorqueryok9 rowsSELECT d.record_id, d.zone, d.name, d.type, COALESCE(t.content, d.content) AS origin, n.host, r.obs_id, r.object_id, r.setting_path, r.value_hash, r.valu
17:51:28.347detectorqueryok0 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content AS origin, i.host, h.obs_id, h.object_id, h.setting_path, h.value_hash, h.value_redacted, h.observe
17:51:28.347detectordetectoklinux.nginx host-4b4dc1: 9 proxied name(s) served by a block that trusts no real_ip range, 0 proxied wildcard(s) landing where nothing doesproxied_without_real_ip run-28ad36002e466ed5 x run-9d48791b00433777model: none
17:51:28.347detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
17:51:28.347checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.347checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.347checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.347checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.347checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6a2b742
17:51:28.347checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.347checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.347checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
17:51:28.347decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.347deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.347deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.347deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.348decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
17:51:28.348judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-22b64a.com:443].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.348detectordetectokproxied_without_real_ip: host-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
17:51:28.348checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.348checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.348checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.348checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.348checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b2d893895ed0af6a2b742
17:51:28.348checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b2d893895ed0af6a2b742958571cff7b between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.348checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.348checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b2d893895ed0af6a2b742958571cff7b"}The audit log does not record what b2d893895ed0af6a2b742958571cff7b was before its latest change.
17:51:28.348decidertriageokexception mem-17 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-17 on host-22b64a.com (proxied_without_real_ip), recorded 2026-10-25T14:17:39.227Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.348deciderdecideokADOPT: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-17 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.348deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|b2d893895ed0af6a2b742958571cff7b|proxied
17:51:28.348decidertriagenot_checkedexposure not dated: the audit log holds no event on b2d893895ed0af6a2b742958571cff7b that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b2d893895ed0af6a2b742958571cff7bmodel: none
17:51:28.348judgejudgeskippedhost-22b64a.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-17 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.349detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
17:51:28.349checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.349checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.349checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.349checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.349checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b682
17:51:28.349checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.349checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.349checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
17:51:28.349decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.349deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.349deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|bce1ca2bb7caa2de9b6823d5f6ecd3f2|proxied
17:51:28.350decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
17:51:28.350judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:443].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.350detectordetectokproxied_without_real_ip: host-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none
17:51:28.350checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.350checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.350checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.350checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.350checkerqueryok2 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'bce1ca2bb7caa2de9b682
17:51:28.350checkercheckokactor_attributed: holds (2 rows)actor_attributed {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}2 audit events with a named actor touched bce1ca2bb7caa2de9b6823d5f6ecd3f2 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.350checkerqueryok1 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.350checkercheckokprevious_value_recoverable: holds (1 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"bce1ca2bb7caa2de9b6823d5f6ecd3f2"}The audit log records the state bce1ca2bb7caa2de9b6823d5f6ecd3f2 had before its latest change.
17:51:28.350decidertriageokexception mem-3 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1lesson mem-3 on host-524b42.quest (proxied_without_real_ip), recorded 2026-10-25T14:17:06.362Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.350deciderdecideokADOPT: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTproxied_without_real_ip server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-3 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.350deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|bce1ca2bb7caa2de9b6823d5f6ecd3f2|proxied
17:51:28.351decidertriageokproxied=true since 2026-04-16T21:12:47.270Z: 191 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure bce1ca2bb7caa2de9b6823d5f6ecd3f2first event of the current state: evt-05fa48325110cdcb (update); a change into this state is on record; model: none
17:51:28.351judgejudgeskippedhost-524b42.quest is proxied through Cloudflare to ip-6fb86d, and server[host-4c795e.quest:80].real_ip in /etc/nginx/sites-available/host-4c795e.quest on host-4verdict cannot move: accepted exception mem-3 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.351detectordetectokproxied_without_real_ip: host-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
17:51:28.351checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.351checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.351checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.351checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.351checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b43f276dea49e4dd9c227
17:51:28.351checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b43f276dea49e4dd9c2271e5a084e37e between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.351checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.351checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b43f276dea49e4dd9c2271e5a084e37e"}The audit log does not record what b43f276dea49e4dd9c2271e5a084e37e was before its latest change.
17:51:28.351decidertriageokexception mem-11 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-11 on host-525a57.com (proxied_without_real_ip), recorded 2026-10-25T14:17:25.100Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.351deciderdecideokADOPT: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-11 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.352deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.352deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.352decidertriagenot_checkedexposure not dated: the audit log holds no event on b43f276dea49e4dd9c2271e5a084e37e that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b43f276dea49e4dd9c2271e5a084e37emodel: none
17:51:28.352judgejudgeskippedhost-525a57.com is proxied through Cloudflare to ip-6fb86d, and server[host-525a57.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-11 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.352detectordetectokproxied_without_real_ip: host-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none
17:51:28.352checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.352checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.352checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.352checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.352checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b5e781103f2acd7d15886
17:51:28.352checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b5e781103f2acd7d15886934269551c1 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.352checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.352checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b5e781103f2acd7d15886934269551c1"}The audit log does not record what b5e781103f2acd7d15886934269551c1 was before its latest change.
17:51:28.352decidertriageokexception mem-10 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1lesson mem-10 on host-5c38db.com (proxied_without_real_ip), recorded 2026-10-25T14:17:22.803Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.352deciderdecideokADOPT: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-10 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.352deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.352deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.353decidertriagenot_checkedexposure not dated: the audit log holds no event on b5e781103f2acd7d15886934269551c1 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure b5e781103f2acd7d15886934269551c1model: none
17:51:28.353judgejudgeskippedhost-5c38db.com is proxied through Cloudflare to ip-6fb86d, and server[host-5c38db.com:80].real_ip in /etc/nginx/sites-available/host-525a57.com on host-4b4dc1 verdict cannot move: accepted exception mem-10 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.353detectordetectokproxied_without_real_ip: host-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none
17:51:28.353checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.353checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.353checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.353checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.353checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '893f8252d3d2b233459c1
17:51:28.353checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed 893f8252d3d2b233459c1f10f5143d13 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.353checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.353checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"893f8252d3d2b233459c1f10f5143d13"}The audit log does not record what 893f8252d3d2b233459c1f10f5143d13 was before its latest change.
17:51:28.353decidertriageokexception mem-6 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1lesson mem-6 on host-62f7a4.com (proxied_without_real_ip), recorded 2026-10-25T14:17:13.404Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.353deciderdecideokADOPT: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-6 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.353deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.353deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.353decidertriagenot_checkedexposure not dated: the audit log holds no event on 893f8252d3d2b233459c1f10f5143d13 that sets proxied=true with no later different body up to 2026-10-25T13:53:44.528Zexposure 893f8252d3d2b233459c1f10f5143d13model: none
17:51:28.353judgejudgeskippedhost-62f7a4.com is proxied through Cloudflare to ip-6fb86d, and server[host-62f7a4.com:443].real_ip in /etc/nginx/sites-available/host-62f7a4.com on host-4b4dc1verdict cannot move: accepted exception mem-6 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.354detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
17:51:28.354checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.354checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.354checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.354checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.354checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668
17:51:28.354checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.354checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.354checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
17:51:28.354decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.354deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.354deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.354deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> '%"proxied":true%' AND e.
17:51:28.354deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668f5f435a4ae1' AND action <> 'view' AND occurred_at < '
17:51:28.354decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
17:51:28.355judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:443].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.355detectordetectokproxied_without_real_ip: host-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 is absent: the block that serves it sees Cloudflare's addresses as its visitorsserver[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none
17:51:28.355checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.355checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.355checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.355checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.355checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '4c6d209470c71ee2c4668
17:51:28.355checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}1 audit event with a named actor touched 4c6d209470c71ee2c4668f5f435a4ae1 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.355checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.355checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"4c6d209470c71ee2c4668f5f435a4ae1"}The audit log does not record what 4c6d209470c71ee2c4668f5f435a4ae1 was before its latest change.
17:51:28.355decidertriageokexception mem-1 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory proxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1lesson mem-1 on host-f324df.com (proxied_without_real_ip), recorded 2026-10-25T14:17:01.545Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.355deciderdecideokADOPT: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEproxied_without_real_ip server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-1 applied; policy: rule-66810b66396a3b15 governs the setting, the exception decides
17:51:28.355deciderqueryskippedshared read: run once this pass, where decider first askedreused exposure client-1|run-9d48791b00433777|4c6d209470c71ee2c4668f5f435a4ae1|proxied
17:51:28.356decidertriageokproxied=true since 2026-07-02T21:48:52.906Z: at least 114 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 4c6d209470c71ee2c4668f5f435a4ae1first event of the current state: evt-8ea874274576b03c (update); no earlier body on record sets another proxied state, so the state may predate the log; model: none
17:51:28.356judgejudgeskippedhost-f324df.com is proxied through Cloudflare to ip-6fb86d, and server[host-f324df.com:80].real_ip in /etc/nginx/sites-available/host-f324df.com on host-4b4dc1 verdict cannot move: accepted exception mem-1 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.356detectorqueryok2 rowsSELECT d.record_id, d.zone, d.name, d.type, d.content, COALESCE(t.content, d.content) AS origin, d.proxied, i.host, d.observed_at FROM dns_record d LEFT JOIN dn
17:51:28.356detectordetectoklinux.nginx host-4b4dc1: 2 record(s) land here with no enabled server block naming themorphan_record run-28ad36002e466ed5 x run-9d48791b00433777model: none
17:51:28.356detectordetectokorphan_record: host-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord b0a17a719bd2118a535a763379ab7ba9model: none
17:51:28.356checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
17:51:28.356checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
17:51:28.356checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.356checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.356checkerqueryok0 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = 'b0a17a719bd2118a535a7
17:51:28.356checkercheckfailedactor_attributed: fails (0 rows)actor_attributed {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}No audit event names who changed b0a17a719bd2118a535a763379ab7ba9 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.356checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.356checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"b0a17a719bd2118a535a763379ab7ba9"}The audit log does not record what b0a17a719bd2118a535a763379ab7ba9 was before its latest change.
17:51:28.356deciderqueryskippedshared read: run once this pass, where decider first askedreused probe run-7a3ff25f0476b93f
17:51:28.356deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T13:54:08.785Z under rule rule-b8d9962485c3ced4orphan_record name in b0a17a719bd2118a535a763379ab7ba9 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-7a3ff25f0476b93f: http host-50b116.com); prior HOLD since 2026-10-25T13:54:08.785Z until 2026-10-27T23:21:06.870Z
17:51:28.357deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.357deciderqueryok0 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
17:51:28.357decidertriagenot_checkedexposure not dated: the audit log holds no event on b0a17a719bd2118a535a763379ab7ba9 that sets content=ip-6fb86d with no later different body up to 2026-10-25T13:53:44.528Zexposure b0a17a719bd2118a535a763379ab7ba9model: none
17:51:28.357judgejudgeskippedhost-50b116.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
17:51:28.357detectordetectokorphan_record: host-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default serverrecord 25a23b5c40a3de0ea11b6054a7b54d07model: none
17:51:28.357checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-9d48791b00433777' AN
17:51:28.357checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-9d48791b00433777"}Run run-9d48791b00433777 collected everything it set out to collect.
17:51:28.357checkerqueryok1 rowsSELECT asset_id, host, address, kind, source, observed_at FROM inventory_asset WHERE tenant_id = 'client-1' AND address = 'ip-6fb86d' ORDER BY asset_id
17:51:28.357checkercheckokhost_in_inventory: holds (1 rows)host_in_inventory {"tenant_id":"client-1","address":"ip-6fb86d"}ip-6fb86d is in the inventory (1 asset).
17:51:28.357checkerqueryok1 rowsSELECT event_id, source, actor, action, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0ea11b6
17:51:28.357checkercheckokactor_attributed: holds (1 rows)actor_attributed {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07","since":"2026-03-20T01:29:03.000Z","until":"2026-10-25T13:53:56.023Z"}1 audit event with a named actor touched 25a23b5c40a3de0ea11b6054a7b54d07 between 2026-03-20T01:29:03.000Z and 2026-10-25T13:53:56.023Z.
17:51:28.357checkerqueryok0 rowsSELECT e.event_id, e.source, e.action, e.old_value AS previous_value, e.occurred_at AS recorded_at, 'old_value' AS evidence FROM audit_event e WHERE e.tenant_id
17:51:28.357checkercheckfailedprevious_value_recoverable: fails (0 rows)previous_value_recoverable {"tenant_id":"client-1","resource_id":"25a23b5c40a3de0ea11b6054a7b54d07"}The audit log does not record what 25a23b5c40a3de0ea11b6054a7b54d07 was before its latest change.
17:51:28.357deciderqueryskippedshared read: run once this pass, where decider first askedreused probe run-7a3ff25f0476b93f
17:51:28.357deciderdecideokHOLD: rule rule-b8d9962485c3ced4 (normal) holds this orphan_record finding until 2026-10-27T23:21:06.870Z; held since 2026-10-25T13:54:08.785Z under rule rule-b8d9962485c3ced4orphan_record name in 25a23b5c40a3de0ea11b6054a7b54d07 on host-4b4dc1model: none; policy: rule-b8d9962485c3ced4 (* ** ** v2: normal, lock 0, on_drift hold, on_no_copy ticket, hold 72 h); the checks alone say ESCALATE; production affected (1 failing probe in run-7a3ff25f0476b93f: http host-c10fff.com); prior HOLD since 2026-10-25T13:54:08.785Z until 2026-10-27T23:21:06.870Z
17:51:28.357deciderqueryok1 rowsSELECT record_id, run_id, name, type, content, proxied, observed_at FROM dns_record WHERE tenant_id = 'client-1' AND run_id = 'run-9d48791b00433777' AND record_
17:51:28.357deciderqueryok1 rowsSELECT e.event_id, e.action, e.actor, e.occurred_at, CASE WHEN e.old_value IS NOT NULL AND e.old_value <> '' AND e.old_value <> 'ip-6fb86d' AND e.old_val
17:51:28.357deciderqueryok1 rowsSELECT COUNT(*) AS n FROM audit_event WHERE tenant_id = 'client-1' AND resource_id = '25a23b5c40a3de0ea11b6054a7b54d07' AND action <> 'view' AND occurred_at < '
17:51:28.358decidertriageokcontent=ip-6fb86d since 2026-07-06T18:46:40.994Z: at least 110 day(s) to 2026-10-25T13:53:44.528Z, still so in DNS run run-9d48791b00433777exposure 25a23b5c40a3de0ea11b6054a7b54d07first event of the current state: evt-48d6696c1de70593 (update); no earlier body on record sets another content state, so the state may predate the log; model: none
17:51:28.358judgejudgeskippedhost-c10fff.com (A, proxied) lands on ip-6fb86d, host-4b4dc1, where no enabled server block names it: requests for it reach the default servermodel: none (sample)
17:51:28.358detectorqueryok3 rowsSELECT n.obs_id, n.host, n.object_id, n.setting_path, n.refers_to_id AS server_name, e.value_redacted AS enabled, n.value_hash, n.observed_at FROM observation n
17:51:28.358detectordetectoklinux.nginx host-4b4dc1: 3 server_name(s) with no record and no covering wildcardorphan_vhost run-28ad36002e466ed5 x run-9d48791b00433777model: none
17:51:28.358detectordetectokorphan_vhost: host-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none
17:51:28.358checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.358checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.358checkerqueryok0 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-28a
17:51:28.358checkercheckokother_settings_reference: holds (0 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-085e02.com","run_id":"run-28ad36002e466ed5","object_id":"/etc/nginx/sites-available/host-085e02.com","setting_path":"server[host-0No other setting in run run-28ad36002e466ed5 points at host-085e02.com.
17:51:28.358checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:29:03.0
17:51:28.358checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
17:51:28.358decidertriageokexception mem-8 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1lesson mem-8 on host-085e02.com (orphan_vhost), recorded 2026-10-25T14:17:18.089Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.358deciderdecideokADOPT: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ADOPTorphan_vhost server[host-085e02.com:443].server_name[host-085e02.com] in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-8 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
17:51:28.358judgejudgeskippedhost-085e02.com is a server_name in /etc/nginx/sites-available/host-085e02.com on host-4b4dc1 (on disk, not enabled) with no record of that name in the collecteverdict cannot move: accepted exception mem-8 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.359detectordetectokorphan_vhost: host-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
17:51:28.359checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.359checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.359checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-28a
17:51:28.359checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-89f6e7.com","run_id":"run-28ad36002e466ed5","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-28ad36002e466ed5 also point at host-89f6e7.com.
17:51:28.359checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:29:03.0
17:51:28.359checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
17:51:28.359decidertriageokexception mem-4 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-4 on host-89f6e7.com (orphan_vhost), recorded 2026-10-25T14:17:08.716Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.359deciderdecideokADOPT: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-89f6e7.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-4 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
17:51:28.359judgejudgeskippedhost-89f6e7.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-4 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.359detectordetectokorphan_vhost: host-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and no wildcard covering its zoneserver[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none
17:51:28.359checkerqueryok0 rowsSELECT c.run_id, c.tenant_id, c.surface, c.host, c.expected_count, c.observed_count, c.status FROM collection_run c WHERE c.run_id = 'run-28ad36002e466ed5' AN
17:51:28.359checkercheckokrun_complete: holds (0 rows)run_complete {"run_id":"run-28ad36002e466ed5"}Run run-28ad36002e466ed5 collected everything it set out to collect.
17:51:28.359checkerqueryok3 rowsSELECT o.host, o.surface, o.object_id, o.setting_path, o.refers_to_type, o.observed_at FROM observation o WHERE o.tenant_id = 'client-1' AND o.run_id = 'run-28a
17:51:28.359checkercheckfailedother_settings_reference: fails (3 rows)other_settings_reference {"tenant_id":"client-1","refers_to_id":"host-9ac4f1.com","run_id":"run-28ad36002e466ed5","object_id":"/etc/nginx/sites-available/host-9ac4f1.com","setting_path":"server[host-93 other settings in run run-28ad36002e466ed5 also point at host-9ac4f1.com.
17:51:28.359checkerqueryok10 rowsSELECT snapshot_id, kind, taken_at, source_ref FROM backup_snapshot WHERE tenant_id = 'client-1' AND host = 'host-4b4dc1' AND taken_at >= '2026-03-20T01:29:03.0
17:51:28.359checkercheckokbackup_recent: holds (10 rows)backup_recent {"tenant_id":"client-1","host":"host-4b4dc1","since":"2026-03-20T01:29:03.000Z"}host-4b4dc1 has 10 backup snapshots taken since 2026-03-20T01:29:03.000Z.
17:51:28.360decidertriageokexception mem-16 accepted by technician until 2026-11-30T00:00:00.000Z: ADOPTmemory orphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1lesson mem-16 on host-9ac4f1.com (orphan_vhost), recorded 2026-10-25T14:17:36.809Z: Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.; model: none
17:51:28.360deciderdecideokADOPT: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z (Personal estate, known and intentional: proxied names without real_ip and the leftover records are not a production risk.); the checks alone would say ESCALATEorphan_vhost server[host-9ac4f1.com:443].server_name[host-9ac4f1.com] in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1model: none; policy: every check holds -> ADOPT candidate, any fails or unbound -> ESCALATE, HOLD needs a judge; exception: mem-16 applied; policy: rule-b8d9962485c3ced4 governs the setting, the exception decides
17:51:28.360judgejudgeskippedhost-9ac4f1.com is a server_name in /etc/nginx/sites-available/host-9ac4f1.com on host-4b4dc1 (enabled) with no record of that name in the collected zones and nverdict cannot move: accepted exception mem-16 holds until 2026-11-30T00:00:00.000Z; the technician's acceptance, not a judge, settles it
17:51:28.360detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
17:51:28.360detectordetectoklinux.nginx host-aa516a: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-f74b40064e093f2cmodel: none
17:51:28.360detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
17:51:28.360detectordetectoklinux.nginx host-aa516a: 0 approved setting(s) whose object the run lacksapproved_missing run-f74b40064e093f2cmodel: none
17:51:28.360detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM observ
17:51:28.360detectordetectoklinux.nginx host-aa516a: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-f74b40064e093f2cmodel: none
17:51:28.360detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
17:51:28.360detectordetectoklinux.nginx host-4b4dc1: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-28ad36002e466ed5model: none
17:51:28.360detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
17:51:28.360detectordetectoklinux.nginx host-4b4dc1: 0 approved setting(s) whose object the run lacksapproved_missing run-28ad36002e466ed5model: none
17:51:28.360detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM observ
17:51:28.360detectordetectoklinux.nginx host-4b4dc1: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-28ad36002e466ed5model: none
17:51:28.360detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
17:51:28.360detectordetectoklinux.nginx host-951abf: 0 setting(s) drifted from their latest approvaldrift_vs_approved run-71776a91583187d1model: none
17:51:28.360detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
17:51:28.361detectordetectoklinux.nginx host-951abf: 0 approved setting(s) whose object the run lacksapproved_missing run-71776a91583187d1model: none
17:51:28.361detectorqueryok0 rowsSELECT o.host, o.object_id, o.setting_path, o.value_hash, COALESCE(b.value_hash, '') AS backup_hash, s.snapshot_id, s.taken_at, o.observed_at FROM observ
17:51:28.361detectordetectoklinux.nginx host-951abf: 0 file(s) the host's newest backup lacks or holds with other byteschanged_since_backup run-71776a91583187d1model: none
17:51:28.361detectorqueryok0 rowsSELECT o.surface, o.host, o.object_id, o.setting_path, o.value_hash, o.value_redacted, a.value_hash AS approved_hash, a.approved_at, a.approved_by, o.ref
17:51:28.361detectordetectokcloudflare.dns: 0 record field(s) drifted from their latest approvaldrift_vs_approved run-9d48791b00433777model: none
17:51:28.361detectorqueryok0 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash AS approved_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE
17:51:28.361detectordetectokcloudflare.dns: 0 approved setting(s) whose object the run lacksapproved_missing run-9d48791b00433777model: none
17:51:28.361detectordetectskippedm365.dns: no Microsoft 365 run for client-1, lab-1: the mail records Microsoft 365 requires are not compared (npm run collect:m365 reads them live)m365.dnsmodel: none
17:51:28.396deciderqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE a.tenant_id = 'cl
17:51:28.397deciderqueryok290 rowsSELECT obs_id, run_id, tenant_id, surface, host, object_id, setting_path, value_hash, value_redacted, refers_to_type, refers_to_id, observed_at, source,
17:51:28.426deciderqueryok4 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE a.tenant_id = 'la
17:51:28.428decidertriageokearly_stop 0, checks_skipped 0, checks_gated 0, withdrawn_judge 23stop rulemodel: none
17:51:28.428decidertriageoklessons 23, exceptions applied 23, lapsed 0memorylocal store; recall by exact scope key, never by similarity; model: none
17:51:28.428decidertriageoklocked settings without an approved value: 0policy56 policy rule(s) read; verbs ADOPT 23, HOLD 3, ESCALATE 1; decided by policy 4, operator 23, default 0; probe run(s) run-e9f519d6a5af0fd0, run-b247c87d34f38d71, run-30f5647b8b9c5dff, run-e839e796556a54c3, run-446db683143ec580, run-396c20fb165306ed, run-af82fe9cd0f12826, run-f79e58d09c04c8d7, run-84b6426b9763f7f1, run-02925c58440a149c, run-20f146f855acc7b9, run-7a3ff25f0476b93f; ledger: 27 disposi
17:51:28.430loopqueryok370 rowsSELECT disposition_id, tenant_id, surface, host, object_id, setting_path, value_hash, verb, reason, expires_at, decided_by, rule_id, finding_id, run_id,
17:51:28.432looptriageokPASS: tenant client-1, decided at 2026-10-25T14:17:53.416Z: 61 collection run(s) of the tenant, 0 failed the DQ gate (none), 14174 observations in the World Model, 27 finding(s) (orphan_record 3, orphan_vhost 3, proxied_without_real_ip 20, proxy_split 1); verbs: ADOPT 23, HOLD 3, ESCALATE 1; decided by operator 23, policy 4; judge skipped (model: none); memory: 23 lesson(s), 23 exception(s) applied, 0 lapsed; policy rules 56, locked settings without an approved value 0; ledger: 27 disposition(s) and 0 referent fingerprint(s) written, 0 finding(s) on rows an earlier pass wrotepass client-1model: none
17:51:28.459explainerqueryok333 rowsSELECT a.approval_id, a.surface, a.host, a.object_id, a.setting_path, a.value_hash, a.approved_at, a.approved_by FROM approved_setting a WHERE a.tenant_id = 'cl
17:51:28.461explainerqueryok259 rowsSELECT event_id, tenant_id, source, actor, action, resource_type, resource_id, old_value, new_value, occurred_at FROM audit_event WHERE tenant_id = 'client-1' A
17:51:28.462explainerqueryok0 rowsSELECT action_id, tenant_id, kind, target, before_hash, after_hash, vault_commit, verification, receipts, status, reason, record, started_at, finished_at, dispo
17:51:28.466explainerqueryok1 rowsSELECT obs_id, value_redacted, observed_at FROM observation WHERE tenant_id = 'client-1' AND surface = 'cloudflare.dns' AND object_id = 'bce1ca2bb7caa2de9b6823d
17:51:28.468explainerexplainnot_checkedunknown: No record of who changed it: the audit log window of 18 h holds 0 events for the record.explain fnd-b4a40091cdb4f906 ESCALATE proxy_split cloudflare.dns bce1ca2bb7caa2de9b6823d5f6ecd3f2 proxiedwindow 2026-10-24T19:57:48.545Z to 2026-10-25T14:17:53.416Z; 0 journal and 203 cloudflare row(s) in the window, 0 write(s) to the file, 0 event(s) for the record, 0 action(s) in the ledger; evidence none; diff none; model: none
17:51:28.468explainerexplainokexplain: 1 cause(s) (unknown 1); finding_cause 1 writtenexplain client-10 journal and 259 cloudflare row(s) since 2026-10-24T17:57:48.545Z, 0 action(s); no error; model: none