Audit run — 2026-08-02

Weekly quality audit over the window 2026-07-26T13:08:25Z → 2026-08-02T13:09:58Z (~168 h), anchored on the previous audit record. Scope: 71 published entries (60 operational + 11 W30 weekly strategic, of which 9 were the previous audit's own recoveries) across 10 run records. Full report: docs/audits/2026-08-02-weekly-quality-audit.md.

Verification & coverage notes

Soundness — 58 of 71 entries verified clean (81.7 %), against 56 % last window, on a genuine 2:2 Opus/Sonnet split and with the per-citation adjacency sweep applied exhaustively rather than as a sample. 162 primary and authority URLs fetched across the four passes. Three factual errors and ten imprecisions; six defects reach a machine surface.

The previous window's dominant defect class is materially reduced. Attribution defects — a true fact cited to a source that does not carry it — ran at 11 in 57 entries last window. This window they run at 4 in 71, and the two Opus batches covering 40 operational entries found none at all. Both surviving instances sit in the weekly strategic set.

Three factual errors, all corrected by new update entries rather than in-place edits. An inverted account of the Searchlight Cyber GPT5.6 experiment (an original pre-auth discovery reported as a rediscovery of an already-patched chain, a framing the store contradicted three days earlier in its own WP2Shell entry); a fabricated quotation attributed to Unit 42 that also dropped 11 confirmed compromises from the campaign's impact count; and a Joomla wave entry that records a constrained anonymous file-write as remote code execution and credits a disclosure to a research team whose own page says it did not make it. The first two are published as corrections here; the third is documented, because the field it corrupts is not inside the enumerated repair class and the audit declined to widen that class on its own authority — see the report's recommendation 3.

Two in-place repairs, both inside the logged immutability-exception class (wrong ATT&CK id, the 2026-07-11 precedent): 2026-07-26/ifage-geneva-dragonforce-data-published-student-records and 2026-07-31/exfilsquad-uk-department-for-education-pnld-breach each carried a technique id no cited source supports, and each retains a supported mapping after removal. Logged in .claude/memory/entry-immutability-exceptions.md.

Completeness — three genuine gaps recovered, one confirmed but unpublishable, several correctly-droppable. The re-sweeps re-researched the window independently: G1 across KEV, national CERTs and vendor PSIRTs, G2 across incidents and regulators with the watch-item re-checks, G3 across 36 research publishers. The recoveries are SP Page Builder for Joomla, Adobe Campaign Classic, and the Phoenix Contact CHARX charging controllers. All three in-window CISA KEV additions were independently re-enumerated and each was already covered — the KEV discipline shipped last week holds with no counter-example.

One confirmed gap could not be published and is recorded as such. Gladinet CentreStack carries six new CVEs including a hardcoded cryptographic key that forges domain-admin tokens, on a product whose identical bug class was mass-exploited in 2025 — a strong candidate on mechanics alone. Its per-CVE authority is a set of GitHub advisories, and github.com is egress-blocked for direct fetches while the reader returned only page chrome. The coordinating national-CERT document confirms the identifiers and the fixed release but carries neither the scores nor the mechanism, and the mechanism is the whole reason the item clears the bar. Publishing it would have meant transcribing a score from a research agent's summary rather than from the record that owns it, so it was not published. Carried as a watch item.

The SP Page Builder recovery is deliberately a new entry rather than an update, and the gate flags the shared Joomla-extension-wave tag for exactly the right reason, so it is worth answering in full. It shares that tag with the 2026-07-26 Balbooa Gridbox entry and the 2026-08-01 Aimy Captcha entry, but it is a different product from a different vendor with its own four identifiers, its own affected estate and its own fixed release, and neither existing entry tells a defender running SP Page Builder anything actionable. Treating each disclosure in this stream as a delta on the last one is precisely the failure this audit root-caused and fixed in v3.30: the consolidation rule is about a campaign recurring, not about independent per-product disclosures arriving from one publisher.

Correctly-droppable borderlines, documented so the completeness judgement is auditable: Progress MOVEit Transfer 2026.0.3 (four flaws, top score 7.5, the auth-enforcement one adjacent-network and high-complexity, no exploitation — two national CERTs escalating is a CERT's own risk framing, not exploitation evidence, and the 2026-07-31 fire's own drop reasoning stands); Apache Traffic Server's 38-CVE batch (unauthenticated scores are high but there is no exploitation, no public exploit, and no named mechanic forcing a timeline ahead of the patch cycle); the Xen Project's ten advisories (guest-to-host preconditions, routine XSA cadence, scoring not yet published at release); and CrowdStrike's Astaroth WhatsApp Web spambot (Brazil and LATAM victimology, carried only for a transferable trusted-platform-automation technique).

Watch items answered. The unconfirmed French leak-site wave remains uncorroborated after a full re-research — no Interior Ministry, ANSSI/CERT-FR or named-SDIS statement and no high-reliability journalism — and is closed on continued silence. Zscaler's TELESHIM Part 2 has not published and carries forward. The IFAGE and ANCPI stories have no in-window delta. No duplicate registry key was created from a Google unified cryptonym; the one that appeared was added as an alias on the existing actor record, which is the correct handling.

Machinery. No runaway runs (longest 2.69 h against a ~3 h threshold). Publish follow-through 10 of 10. Gap-derived windows self-healed across the one off-cadence gap with a 24 h floor throughout and no record-less day. The verifier rotation held perfectly in every fire — no same-model consecutive pair anywhere in the window. Four of nine fires reached a genuine two-model confirmed clean verdict, one published on the fail-open at the iteration cap, and four published with low residuals.

Two systemic findings drove prompt changes, and one drove none. The backup weekly fire of 2026-07-27 stood down correctly as a duplicate week — but only discovered the primary at the pre-push sync, after composing nine entries and running eight verification iterations, because the duplicate-week check runs at preflight only. A stream of Joomla-extension disclosures from one research publisher has now produced a recovered miss in three consecutive audits, because the consolidation rule written for long-running campaign activity was being applied to independent per-product vulnerability disclosures. Both are fixed in v3.30. The third finding — that the editorial half of the verification gate produced one priority-calibration and one action-item finding across roughly forty fires while both underlying metrics moved — is reported with instrumentation rather than a rule change, because this audit's own calibration review found no mis-prioritised entry to point at.

Reader pool. Seven live keys, 70 M tokens, refilled by the operator at 09:37–09:51Z today. The pool was exhausted for the 04:09Z fire, which is the third refill cycle in fifteen days; the standing recommendation is unchanged and resized in the report.