2026-09-06T1308Z-audit

Verification & coverage notes

Quality audit over the 167.9 h since 2026-08-30T1312Z-audit, covering seven intel fires and 51 entries (37 published new, 14 carrying a changelog record inside the window). Full report: docs/audits/2026-09-06-quality-audit.md.

Soundness: 40 of 51 entries verified clean against freshly fetched primaries. Two factual errors, both in structured version data and both confirmed by the main agent against the authority before correction. WatchGuard: four of five CVE records omitted a second affected band (Fireware OS 2026.3 up to 2026.3.1) and its fix, so an appliance on a 2026.3.x build read as out of scope. HPE Aruba: CVE-2026-73749's 10.18 range was inverted, listing 10.18.0001 as the first affected build where HPE's own CVE record makes it the last. Nine further imprecisions, of which four took an improvement record and five are documented in the report without one.

A third defect class the truth passes did not look for and the main agent found: cves[].epss has never had defined units. docs/pipeline.md and prompts/entry-template.md carried the field as epss: null with no range and no source, and the store holds both conventions at once. ENISA's EUVD renders EPSS as a percentage (its API returns 0.71 where FIRST.org returns 0.00710, confirmed directly this fire) and FIRST.org returns the probability, so entries transcribed whichever their source showed. Two 100x-wrong values were published inside this window, and the second is the instructive one: on 2026-09-01 the verifier's iteration 1 set the correct FIRST.org probability and iteration 2 reverted it, reasoning that "the store's convention is a percentage number (confirmed by a pre-existing entry with epss: 1.37, impossible as a raw 0-1 probability)". A wrong legacy value taught a later verifier the wrong convention and it overrode a correct fix. Five entries corrected, the units defined normatively, and a cve-epss range check shipped.

Completeness: two recovered entries, both genuine blind spots. Chaotic Eclipse's unpatched local privilege escalations in CrowdStrike Falcon and Avast, with public working exploit code and no vendor fix, went unpublished for three days despite Truesec carrying it in a swept standard-tier feed. Dell's DSA-2026-382, a 105-CVE bundle whose top flaw replays one unauthenticated request indefinitely into ADMIN tokens with no workaround, went unpublished for six days. Everything else the three re-sweeps surfaced either matched published coverage or is documented as correctly droppable or backlogged.

KEV sweep, the v4.8 fix, took. All ten in-window CISA KEV additions were already covered by store entries; zero misses, against two recovered by the previous audit. The forensic half did not take: no fire wrote the work/<run-id>/kev-window.txt artefact the prompt specifies, though six of seven disclosed the sweep in prose.

The window's dominant systemic finding is verifier-loop convergence. No fire reached a confirmed CLEAN, against 2 of 30 over the preceding month; mean iterations rose to 7.6 against roughly 4.5 two windows ago; and the loop consumed 60 to 79 % of every fire's wall clock, which is the entire cause of the five runaway-duration warnings this fire acknowledged. The findings are mostly real rather than churn: 16 % of post-iteration-1 findings concern a previous iteration's own remediation, so 84 % are fresh. What that leaves unaddressed is a structural gap the report names: every one of the seven fires published under decision rule 5, whose final-iteration remediations no pass ever verified.

Coverage gaps this fire. G3 reached its cap with eight publisher listings unswept, and found four feed recipes returning nothing usable (Volexity, Proofpoint's Threat Insight blog, Aqua Nautilus, and SocRadar partially). G1 could not read ssd-disclosure (CAPTCHA on every transport). Eight essential-tier sources are green in state/source_health.json but contributed no cited content across all seven fires; two of them are the Swiss national authority's own pages, which the report flags for a recipe spot-check rather than treating as settled.

Priority calibration (monthly duty, owned by this fire). The 59.0 % high share the previous audit recorded did not persist: this window is 51.4 % of operational entries, September to date is 44.4 %, and the F16 signal is symmetric (two flags that a high was generous, two that one was under-calibrated). No calibration edit shipped.

Watchlist: not applicable; this deployment configures no product or supplier watchlist.

Coverage gaps: ssd-disclosure (CAPTCHA on every transport, no substitute); volexity, proofpoint, aqua-nautilus feed recipes returning no in-window items; eight G3 publisher listings unswept at the 45-min cap.

Essential-coverage: missed=none this fire (the audit does not run the full essential sweep; the per-fire misses over the window are reviewed in the report).