2026-09-20T1308Z-audit

Verification and coverage notes

Weekly quality audit over 2026-09-13T13:07Z to 2026-09-20T13:08Z. Full report: docs/audits/2026-09-20-quality-audit.md.

Soundness. 35 entries in scope, 22 verified clean, 5 factual errors, 8 imprecisions. All four truth passes returned, the first window in three with no blocked verifier spawn; the 2026-09-09 Windows entry that killed seven spawns across the two previous fires was isolated in a batch of one and verified without incident. The headline number is not comparable to the previous window's 42 of 50: this audit asked every pass to re-check status and fixed as of today rather than as of publication, and to treat citation adjacency as its own defect class, and three of the five errors are those two shapes.

The costliest error is a superseded remediation. 2026-08-04/cve-2026-20079-cisco-secure-fmc-auth-bypass-root-hotfix named per-train hot fixes for an exploited CVSS 10.0 authentication bypass; Cisco replaced them with the September hardening releases in revision 2.6 on 2026-09-16, in the same advisory that this entry's own 2026-09-18 update was reading for two sibling CVEs. Two of the five errors share that cause, a changelog record written against its own delta without re-reading the rest of the page it was already on.

Three findings were checked and declined with the rebuttal recorded in the report: a T1213 mapping on the Swiss Bitcoin Pay incident, a T1553 mapping on DDRop, and the national-authority carve-out on the AEPD entry.

Completeness. The three re-sweeps returned eight items the six fires never surfaced. One is published here: Oracle's September 2026 Critical Security Patch Update, six unauthenticated CVSS 10.0 flaws across WebLogic Server, Access Manager, Forms, Internet Directory, Platform Security for Java and Hyperion Financial Management, released 2026-09-15 and relayed by NCSC-NL on 2026-09-16 at priority Hoog. No run record in the window mentions Oracle at all, as an entry or as a drop.

Seven further verified items are on state/coverage_backlog.md with sources, discovery traces and per-row gating notes, and their research is committed under work/2026-09-20T1308Z-audit/. The cut is the wall-clock watchdog, applied in the prompt's stated priority order: the truth passes and the re-sweeps both completed, the systemic review completed, and publication was limited to the one recovered item whose absence would be a blind spot on the critical or high signal. Publishing eight entries would have put the fire past its budget with the report and record unwritten.

The KEV channel is clean for the third consecutive window: seven in-window additions, every one covered, and all six fires wrote the kev-window.txt artefact that fourteen fires across the two previous windows never produced.

Systemic. The window's largest finding is that the source rotation had stopped rotating. last_successful_fetch moves only when a source is fetched and used, so a source swept every fire that yields nothing keeps its stale date and stays pinned to the head of a stable oldest-first ranking. Six consecutive fires drew an almost identical S3 slice of roughly fourteen sources out of 111, and talos, sentinellabs and kaspersky-securelist were allocated to no fire all week. Five of the six research publications the re-sweep recovered came from publishers no sub-agent was ever given.

Three enforcement surfaces were found narrower than the rules they enforce: the reader-text check never looked at the body, its PD-number half was never implemented, and the blocked-source list covered the CVE databases' web pages but not their APIs (12 entries carried 21 such records, five of them primary). Verifier per-iteration counters do not reconcile with their own findings lists on 118 of 748 iterations store-wide, and two published records report zero residuals on a NEEDS_FIXES final iteration that carries a finding. All four are fixed in this commit; all four fixes are run-scope or version-gated so the store-wide scan stays at zero.

One fire of six reached a confirmed CLEAN, breaking a two-window streak of zero, so the carried watch item's redesign trigger did not fire. No fire tripped the runaway-duration threshold for the second consecutive window. All seven records carry publish_status: ok.

Warning sweep. One new acknowledgment (2026-09-14/gtg-27005-ai-drone-swarm-weapons-engineering, research-kind empty techniques[], the fourth row of a reviewed class); all 32 existing rows re-checked and none pruned; ledger now 33. check_run.py --all ends 0 fail with 33 acknowledged, and site/build.py emits no self-check warnings. One warning stays open by design: this fire's own verification-confirmation fail-open, a telemetry fact about this run that cannot be cleared without falsifying the record, and one a run is never permitted to acknowledge for itself.

Coverage gaps: none in the audit's own sweep. G1 reached roughly 14 of its 58 slice sources within its budget after the Cisco bundle and Oracle investigations, which is recorded as an audit coverage limitation rather than a pipeline finding.