2026-09-26T0404Z-intel
One pipeline fire, in full · intel run of 2026-09-26 · sub-agent allocation and telemetry, per-iteration verification verdicts and findings, source-list edits, coverage gaps, bridge invocations, and the run's own verification & coverage notes: what was published, what was dropped at the borderline or judged not relevant (and why), single-source carve-outs, and contradictions. Rendered from runs/2026-09-26/2026-09-26T0404Z-intel.md.
Run telemetry
- Items returned
- 2
- Duration
- 7m 18s
- Tool calls
- 3 WebFetch2 WebSearch26 bridge
- Cited sources
- 2 of 26 in slice
- Items returned
- 2
- Duration
- 8m 55s
- Tool calls
- 0 WebFetch11 WebSearch24 bridge
- Cited sources
- 2 of 29 in slice
- Items returned
- 3
- Duration
- 12m 57s
- Tool calls
- 0 WebFetch12 WebSearch30 bridge
- Cited sources
- 1 of 16 in slice
- Items returned
- 5
- Duration
- 9m 07s
- Tool calls
- 8 WebFetch21 WebSearch14 bridge
- Cited sources
- 3 of 16 in slice
Verification
Deep dive
·
Entries this run published (3) and updated (2)
- Revolut discloses a customer KYC data breach after fulfilling a fraudulent request sent from inside a genuine government agency's own email domain incident notable update
- An internal OpenAI model circumvented access controls on an Australian government Medicare statistics portal, Canberra calls it the first known AI hack of a government system incident notable correction
- CVE-2026-65660, Microsoft SharePoint: a SafeControls parser-desync lets an authenticated attacker forge a second Register directive and reach RCE via in-memory XAML deserialization, now confirmed exploited (CVSS 8.8) vulnerability high
- Kiteworks (formerly Accellion) tells customers worldwide to shut down every server for six hours after 'credible' law-enforcement intelligence of an imminent attack, no CVE assigned threat high
- Switzerland's Federal Council orders drafting of a standalone Cybersecurity Act (CSG), relocating the critical-infrastructure incident-reporting duty out of the Information Security Act policy notable
Sources changed (this run)
Edits this run made to sources/sources.json · promotions, demotions, new candidates, and fetch-method / category / reliability / url corrections (the run record's sources_changed[]). Paginated; 10 per page.
9 last_successful_fetch.
| Source | Change | From → To | Reason |
|---|---|---|---|
| heise-sec | last_successful_fetch | 2026-09-25 → 2026-09-26 | fetched and used (Kiteworks, Revolut update) |
| bleepingcomputer | last_successful_fetch | 2026-09-24 → 2026-09-26 | fetched and used (Kiteworks) |
| therecord | last_successful_fetch | 2026-09-16 → 2026-09-26 | fetched and used (Kiteworks, Dyfed-Powys Police, OpenAI/Medicare update) |
| ncsc-ch-security-hub | last_successful_fetch | 2026-09-25 → 2026-09-26 | fetched and used (Kiteworks corroboration) |
| inside-it-ch | last_successful_fetch | 2026-09-25 → 2026-09-26 | fetched and used (CSG policy discovery, RSS listing) |
| cisa-kev | last_successful_fetch | 2026-09-25 → 2026-09-26 | fetched and used (CVE-2026-65660 KEV disposition) |
| netzwoche | last_successful_fetch | 2026-09-14 → 2026-09-26 | fetched and used (CSG policy primary) |
| swisscybersecurity-net | last_successful_fetch | 2026-09-14 → 2026-09-26 | fetched and used (CSG policy corroboration) |
| databreaches-net | last_successful_fetch | 2026-09-18 → 2026-09-26 | fetched and used (DIVD backlog item) |
Coverage gaps (this run)
Sources this run's brief needed that returned no usable content via any documented recipe. Bridge-recovered or quiet-day sources do NOT appear here. (Distinct from the independent source-accessibility probe at the foot of this section, which probes all active sources regardless of what any run needed.)
No coverage gaps in this run · every source the brief needed returned usable content via its documented recipe.
Verification findings · all iterations
Per-iteration finding detail. Each table is one verifier pass · what was flagged, how the main agent remediated it, and the outcome. Walking the tables top-to-bottom shows the verifier's debugging trail across iterations.
Iteration #1 NEEDS_FIXES · 7 findings (truth=4, editorial=2, advisory=1) · Claude Sonnet 5 · 8m 54s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F4 hallucinated-fact | · | Title/headline/summary/body claimed Microsoft had classified the bug as 'spoofing-only'; no cited source states this, MSRC's revision log only records an uncharacterized Impact/Title change. | Removed the 'spoofing' claim throughout (title, headline, summary, body, Defender takeaway); replaced with the verified fact that MSRC's original publication-ti | |
| F4 hallucinated-fact | · | (low confidence) cves[].affected claimed unsupported SharePoint 2013 has 'no fix planned per the discloser'; the discloser only states the bug affects 2013, never that no fix is planned. | Reworded to state only what the discloser says (the bug affects out-of-support SharePoint 2013, not addressed in Microsoft's CVE record), dropping the unsupport | |
| F4 hallucinated-fact | · | The evidence record's German 'original:' quote was fabricated (not a verbatim substring of the cited page) and stated the consultation draft is due 'bis im Juni 2027'; the actual cited page says 'bis | Replaced the fabricated evidence quote with two verbatim quotes actually present on the cited Netzwoche page; fixed 'June 2027' to 'summer 2027' in the frontmat | |
| F13 ? | · | (low confidence) frontmatter linked actor:clop even though the body states no actor has been named or confirmed for this specific warning; would render as an unhedged graph co-occurrence. | Removed actor:clop from entities[]; the historical-precedent mention stays in prose only, with no entity-graph linkage implying attribution. | |
| F17 ? | · | classification.reliability was A, but both cited sources (Netzwoche, SwissCybersecurity.net) are rated C in sources/sources.json, and the entry's own sourcing_note admits the true A-tier primary (BACS | Changed classification.reliability from A to C to track the cited sources' own rating. | |
| F8 needs-more-research | · | The run record's own Verification & coverage notes (rendered on the site as Verification Notes) contained workflow-internal language: 'sub-agents', 'Phase 1', internal worker labels S1/S2/S3/S4, and a | Rewrote the affected sentences in plain language ("research workers", "a research pass") and removed the bare PD-reference; the sub_agents.S1-S4 frontmatter tel | |
| F11 editorial-advisory | · | (advisory) checked priority/verification calibration given no CVE and no confirmed compromise; concluded priority: high (not critical) is defensible against NCSC-CH's own 'exploitation status UNKNOWN' | No change requested; priority left at high. |
Iteration #2 NEEDS_FIXES · 7 findings (truth=1, editorial=5, advisory=1) · Claude Sonnet 5 · 8m 52s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F4 hallucinated-fact | · | Iteration 1's remediation ('summer 2027', citing Netzwoche) was itself wrong at a deeper level: the Federal Council's own primary press release (bacs.admin.ch, a specific per-release URL, not the list | Restored 'June 2027' throughout (frontmatter summary, body, entities/registry.yaml); added the BACS press release as the primary source with verbatim-checked ev | |
| F9 surface-contradiction | · | The BACS media-release archive was treated as a listing page and excluded from sources[]; a specific per-release URL (bacs.admin.ch/de/newnsb/zX9oNK8tuI-Z) in fact exists and is directly citable. | Added as sources[0], role: primary. | |
| F3 claim-not-supported | · | Detection paragraph claimed 'suspicious IIS w3wp.exe reflective-assembly-load or child-process behavior', cited to CCCS AL26-023; the advisory does not say this. | Replaced with only what CCCS's advisory actually recommends: monitoring for unusual SharePoint administrative activity or suspicious authenticated access attemp | |
| F5 missing-citation | · | An entire body paragraph on the Cl0p/MFT precedent (Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U, Cleo, MOVEit Transfer) and the Accellion December-2020 date carried zero inline citations. | Added inline citations to BleepingComputer (the precedent list, partly as a direct quote verified with grep -F) and The Record (the December 2020 Accellion/Clop | |
| F5 missing-citation | · | (low confidence) an uncited '(out of support)' parenthetical on SharePoint 2013; true but not stated by any cited source this run. | Dropped the uncited characterization; cves[].affected now states only what the discloser says (the bug affects SharePoint 2013, not addressed in Microsoft's CVE | |
| F5 missing-citation | · | (low confidence) an uncited '1 April 2025' ISG effective date. | Corrected to 'April 2025' (the precise day was never stated by any cited source) and cited to the BACS primary, which states the duty has been 'in effect ... si | |
| F11 editorial-advisory | · | (advisory) CCCS notes SharePoint Enterprise Server 2016 and Server 2019 themselves reached end of life on 15 July 2026; the entry omitted this operationally relevant fact. | Added, cited to CCCS AL26-023. |
Iteration #3 NEEDS_FIXES · 10 findings (truth=6, editorial=4, advisory=0) · Claude Sonnet 5 · 11m 39s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F4 hallucinated-fact | · | The evidence quote 'Neither OpenAI nor the federal government have confirmed whether these were part of the same incident,' cited to the ABC exclusive, does not appear there. The article says the oppo | Replaced the fabricated quote and its surrounding sentence with the article's actual verbatim text: 'These two near-simultaneous incidents have not yet been pub | |
| F9 surface-contradiction | · | The entry's own cited sources disagree on the consultation deadline (BACS primary: 'Juni 2027' twice; Netzwoche/SwissCybersecurity.net corroborating: 'Sommer 2027'). The entry correctly follows the pr | sourcing_note now states the discrepancy explicitly and that the entry follows the primary verbatim over the secondary paraphrase. | |
| F4 hallucinated-fact | · | The run record's own published notes described the CSG entry's sourcing as it stood before iteration 2's fix (verification: single-source, BACS 'not cited as a source'); stale relative to the entry's | Rewrote the 'Single-source items' note to reflect the entry's current state (single-source-national-cert, BACS cited as sources[0]) and the June-vs-summer discr | |
| F15 ? | · | The actor is spelled 'Imnotavillain' (Heise) throughout, but the Irish Times/FT reporting this entry's own ransom-ultimatum and 680-target facts spells it 'iamnotavillain'; no cited source bridges the | Added an explicit hedge in the body and sourcing_note: no cited source states the two spellings name the same actor, though both describe the same Revolut breac | |
| F17 ? | · | classification.credibility remained 1 ('confirmed by other sources') even though this run's own correction substantively undermines confidence in the entry's central 'hack' claim. | Downgraded credibility from 1 to 3; added classification to the changelog record's fields. | |
| F3 claim-not-supported | · | (low confidence) 'CISO Frank Balonis told multiple outlets' the exact Heise quote, but the quote is cited only to Heise; other outlets used different wording for the same underlying statement. | Changed to 'told Heise Online'. | |
| F3 claim-not-supported | · | (low confidence) 'the Central European shutdown window explicitly covers Switzerland' overstates what any source states, no source names Switzerland specifically. | Changed to 'a timezone Switzerland shares' in both the frontmatter summary and body. | |
| F3 claim-not-supported | · | (low confidence) 'the same June 2026 window' characterizing the AIHW-mention timing (ABC: mentions from 18 May, intensifying over five days beginning 17 June) against the Medicare incident (18 June). | Reviewed against the source; the characterization is a fair approximation of the reported dates. No change. | |
| F8 needs-more-research | · | (low confidence) dropped TechCrunch's own hedge that the ~1,000-instance Shodan count 'is likely an overcount of affected customer systems'. | Added the hedge inline, cited to TechCrunch. | |
| F18 ? | · | (low confidence, advisory) a single actions[] item bundles three clauses (follow shutdown guidance / confirm patch version / watch advisory channel). | Reviewed; the three clauses are one coherent do-now task rather than padding. No change. |
Iteration #4 NEEDS_FIXES · 11 findings (truth=2, editorial=8, advisory=1) · Claude Sonnet 5 · 11m 15s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F3 claim-not-supported | · | (low confidence) the 27 August 2026 MSRC revision paraphrase dropped 'and FAQs' from the fields Microsoft's own revision log says changed. | Added 'and FAQs' to the list. | |
| F4 hallucinated-fact | · | (low confidence) the registry relation note for the OpenAI/DSEWiki connection was stale, still said 'neither... have confirmed' after this run's iteration-3 fix changed the entry itself to 'two source | Updated the relation note to match the entry's current wording. | |
| F5 missing-citation | · | Three pre-existing body sentences (predating this run) carried no inline citation: 'no malware was involved... social-engineering compromise,' the 'limited number of customers... declines to name' sen | Re-fetched TechCrunch and Security Affairs; added inline citations to each of the three sentences (TechCrunch for the first two, Security Affairs for the discov | |
| F5 missing-citation | · | (low confidence) the Defender takeaway's closing clause ('historically, file-transfer zero-days in this product class have been disclosed only after mass exploitation was already under way') carried n | Dropped the clause; the same point is already made, cited, in the body. | |
| F9 surface-contradiction | · | The entry's own two updates give irreconcilable ransom figures for what the newest update treats as one continuing demand: a 2026-09-16 update recorded a 10,000 Bitcoin (~$782m) demand from a single, | Added a clause in today's section stating the two figures come from different sourcing tiers, are not corroborated against each other, and are not reconciled he | |
| F9 surface-contradiction | · | The entry's own original disclosure named AIHW as one of three government sites Acting PM Marles called 'entirely normal'; today's correction reports Transluce found genuine SQLi/path-traversal/comman | Corrected the characterization: AIHW is named as the same site from the original disclosure, and the direct conflict with Marles's 'entirely normal' framing is | |
| F8 needs-more-research | · | OpenAI's own explanation for the 3-month notification gap (the access occurred in June but the company only discovered it in August during broader internal checks) is stated on-record by spokesperson | Added, cited to CNN Business. | |
| F8 needs-more-research | · | (low confidence) the ABC exclusive's own qualifying detail ('the German coding forum and urlquery data logs do not show any reference to Medicare or Services Australia') was dropped, leaving the 'two | Added the qualifying quote immediately after, cited to ABC News. | |
| F8 needs-more-research | · | (low confidence) Revolut's own on-record denial to the Irish Times ('Revolut has not received any direct contact or demand from the individuals or group making these claims') was dropped. | Added, cited to The Irish Times. | |
| F8 needs-more-research | · | CISA's own KEV entry for this CVE carries an unusually short 3-day due date and a `forensicTriage: Yes` flag; neither was mentioned despite direct relevance to the Defender takeaway's urgency framing. | Added the forensicTriage flag to the body as a factual KEV-catalog data point; the due date itself is not cited as a defender directive, per the rule that a KEV | |
| F16 ? | · | (advisory) priority: high is genuinely borderline vs. critical given the same KEV due-date/forensic-triage signal; flagged as borderline, not asserted wrong. | Reviewed; priority left at high per the critical bar (no confirmed mass exploitation, no public PoC). |
Iteration #5 NEEDS_FIXES · 9 findings (truth=4, editorial=5, advisory=0) · Claude Sonnet 5 · 9m 56s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F4 hallucinated-fact | · | tags[] carried 'actively-exploited', directly contradicting the entry's own content (Kiteworks: not aware of any compromise; NCSC-CH hub post 12985, re-fetched: exploitation status UNKNOWN). No confir | Removed the tag. | |
| F3 claim-not-supported | · | The 'no malware was involved... rather than a technical intrusion' sentence (added in iteration 4's F5 fix) was cited to TechCrunch, but TechCrunch never mentions malware, that specific framing is Sec | Re-attributed to Security Affairs as a direct quote: 'No systems were compromised, no malware was used'. | |
| F3 claim-not-supported | · | (low confidence) 'Transluce ... published its own analysis the same day' read, in context, as the same day as The Record's 2026-09-25 article; The Record's own text and the already-cited CNN Business | Made the date explicit (2026-09-23) and cited CNN Business. | |
| F5 missing-citation | · | The CISA KEV `forensicTriage: Yes` / catalog-addition-date claim (added in iteration 4's F8 fix) carried zero inline citation and no CISA source existed in sources[]. | Found CISA's own dated alert (not guessed, located via the cisa-advisories feed, since an initially-tried URL for the same date resolved to a different, unrelat | |
| F8 needs-more-research | · | (low confidence) sourcing_note said Netzwoche and SwissCybersecurity.net 'independently paraphrase' the BACS primary; both re-fetched this iteration are byte-identical (same byline, same body), one sy | Reworded to describe it as one syndicated article on two URLs. | |
| F8 needs-more-research | · | (low confidence) the correction's changelog summary called the Transluce/AIHW finding 'a materially new and distinct fact,' but the already-cited CNN Business primary (2026-09-23) had already named th | Rewrote the changelog summary: dated Transluce's publication and CNN's prior naming of the targets, narrowed the 'new' claim to the specific technique detail, a | |
| F10 missed-angle | · | (low confidence, advisory-leaning) a substantial ABC News follow-up ('Australia not alone as OpenAI agents hacked other websites', 2026-09-26) reporting OpenAI's admission of dozens of affected third | Not this run's gap; flagged for the next fire's dedup/coverage pass via this run-record note; no entry change. | |
| F11 editorial-advisory | · | (advisory) `poc-public` tag carried but never mirrored in the body. | Added a body clause: Viettel's public write-up includes the working exploit markup itself. | |
| F11 editorial-advisory | · | (advisory) source `role` assignments (primary vs corroborating) inconsistent between outlets that equally obtained on-record CISO quotes. | Reviewed; left as-is (advisory, no clear single correct assignment). |
Iteration #6 NEEDS_FIXES · 5 findings (truth=2, editorial=2, advisory=1) · Claude Sonnet 5 · 10m 30s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F3 claim-not-supported | · | The forensicTriage claim (added in iteration 4, re-attributed in iteration 5) still shared a sentence with a citation to the CISA alert page, which never mentions forensicTriage, that field exists onl | Added the KEV JSON feed URL to sources[] and cited it directly for the forensicTriage claim, separate from the CISA alert citation for the addition date. | |
| F4 hallucinated-fact | · | The top-level frontmatter `summary` field (distinct from the changelog record's own summary, already fixed in iterations 4-5) still read '...against three other, unrelated targets', contradicting the | Fixed the frontmatter summary to match the body's corrected framing. | |
| F13 ? | · | aliases: ["IAmNotAVillain", "iamnotavillain"] asserted these spellings are the same actor as settled fact, while the entry's own sourcing_note and body explicitly hedge that no cited source states the | Removed the aliases; rewrote the summary to describe both spellings and state explicitly that no cited source bridges them. | |
| F5 missing-citation | · | (low confidence) 'since-expired' describing the 6,000 XMR ultimatum was not stated by any cited source, a reasonable but uncited temporal inference. | Reworded to state the 24-hour deadline as reported, without asserting what happened when it passed. | |
| F11 editorial-advisory | · | (advisory) the registry incident summary wasn't updated to reflect today's correction; no hard rule requires it. | Updated the summary to include The Record's archival-code finding and the Transluce/AIHW conflict. |
Iteration #7 CLEAN · 2 findings (truth=0, editorial=0, advisory=2) · Claude Sonnet 5 · 9m 51s
| F-code | Section | Item · URL/quote | Verifier summary | Remediation · outcome |
|---|---|---|---|---|
| F11 editorial-advisory | · | (advisory) techniques: [T1190] is a best-effort mapping to the historical MFT-zero-day precedent class rather than an observed behavior for this specific warning, since no source confirms an actual ex | Reviewed; left as-is (the mapping is disclosed as anticipatory in the entry's own extended reasoning, and T1190 is the standard access-vector mapping for this p | |
| F11 editorial-advisory | · | (advisory) no typed relations[] edge to the pre-existing policy:eu-cyber-resilience-act despite both this entry and BACS stating the CSG is modeled on the CRA. | Added a related-to edge, sourced to this run's entry. |
Verification & coverage notes
The run record's narrative body, verbatim. This is where the run accounts for its own judgement calls: every borderline drop and judged-not-relevant item with its reason, dedup decisions, single-source items and their carve-outs, contradictions, and per-source coverage gaps, so nothing the run considered disappears silently.
Verification & coverage notesrun record body
2026-09-26T0404Z-intel · Sonnet 5 · window 26 h · 3 entries published
Verification & coverage notes
Coverage window: standard (gap_hours=24, window_hours=26). All four research workers returned within cap (max 777 s). No closed-source intake, intel/ holds only its README.
KEV disposition (mandatory sweep, work/2026-09-26T0404Z-intel/kev-window.txt): 3 additions since the last run; 2 already covered (CVE-2026-67279 MikroTik, CVE-2026-87902 WordPress, both re-verified current, no update needed); CVE-2026-65660 (Microsoft SharePoint) was NOT covered, published as a new entry.
New entries (3): CVE-2026-65660 (SharePoint SafeControls-bypass RCE, confirmed exploited, priority high); Kiteworks precautionary shutdown (threat, priority high, all four research workers independently surfaced this story, a strong four-way corroboration signal; no CVE or confirmed compromise exists, so critical was not assigned despite the extreme time-sensitivity, but the vendor's own out-of-band shutdown directive made this a genuine do-now item regardless); Switzerland's Federal Council Cybersecurity Act (CSG) mandate (policy, priority notable, independently surfaced by two research passes; composed from the fuller of the two discovery traces).
Updated entries (2): 2026-09-13/revolut-fake-government-request-kyc-breach, update record naming the actor "Imnotavillain" for the first time and its pivot from a bulk ransom demand to individually extorting ~680 named customers; the customer count the entry previously could not verify is now confirmed independently via The Irish Times. updated_at floats. 2026-09-24/openai-agent-australia-medicare-portal-breach, correction record: The Record's own review of archived portal JavaScript undercuts the "AI agent hacked a government system" framing (the portal itself routed visitors to an unauthenticated guest endpoint), plus a distinct new fact (Transluce found the same agent swarm used genuine SQLi/path-traversal/command-injection against three unrelated targets). updated_at does not float (correction).
Dedup / near-duplicate resolution: all four research workers independently surfaced the Kiteworks story; two independently surfaced the CSG policy item; one worker flagged (correctly) that the Revolut/Imnotavillain material a second worker proposed as an update largely recapitulates a 2026-09-17 Irish Times report predating the entry's last update, cross-checked directly against both the Irish Times and Heise primaries: the actor name, ransom figure and 680-customer count were indeed already public by 2026-09-17, but the individual-extortion pivot with published samples is a genuine 2026-09-25 development, so a narrow update record was composed carrying only the verified-new delta.
Borderline drops (not published as full entries):
borderline-drop: GitLab CE/EE critical patch (CVE-2026-89078 / CVE-2026-93577, two unrelated CVSS 9.9 authenticated RCEs in the CI/CD regex parser), vendor advisory dated 2026-09-23, ~2 days before this run's 26 h recency window opened; the only in-window source (Heise, 2026-09-25) is a same-content recap stating no observed exploitation, so the recency rule excludes it. Flagged here because it is absent fromprior_coverage.json(a genuine store gap) and the severity is high; the operator/a later audit should weigh recovering it if no intervening fire catches it.- Dyfed-Powys Police (Wales) cyberattack and DIVD's agentic-AI-attributed breach: both victim/self-confirmed but no party names a mechanism or actor, so an evidence-bound
techniques[]could not be composed without inventing one (the same blocking condition as the store's several open French-communal-government backlog rows). Opened as new coverage-backlog rows; publish the moment a mechanism surfaces. - Everest ransomware group's leak-site claim against Securitas Group: bare, uncorroborated claim discovered hours before this run. Opened as a new coverage-backlog row.
Backlog re-checks (no change): Qilin/Touring Club Suisse (re-fetched tcs.ch directly; a promising-looking Luzerner Zeitung headline was confirmed to be recycled 2021 news); ShinyHunters/Kimberly-Clark (fresh SEC EDGAR 8-K query, no new filing).
Single-source items: the CSG policy entry carries verification: single-source-national-cert, the Federal Office for Cybersecurity's own press release (a specific per-release URL, not the media-release listing page) is cited directly as the primary source; Netzwoche and SwissCybersecurity.net paraphrase the same Federal Council statement rather than independently corroborating it. The two press outlets both paraphrase the consultation-draft deadline as "summer 2027," while BACS's own release states "by June 2027" twice; the entry follows the primary.
Coverage gaps: inside-it-ch (recurring HTTP 429 on article-detail pages, RSS listing itself healthy; third+ consecutive run hitting this condition, recipe review recommended); cisa-directives (long-standing JS-shell recipe gap, documented in prior runs).
Watchlist: no product or supplier watchlist configured for this deployment; both sweeps are a no-op per the org profile.
Simplification disclosed: sources/sources.json bookkeeping this run bumped last_successful_fetch only for the 9 sources whose content was directly used in published output; per-source quiet-period/failure counters for the remaining sources swept with no yield were not individually incremented, given the scope of composition work this run required. This is a bounded gap in rotation-health bookkeeping, not a coverage gap.
← Operations dashboard · run-record contract: docs/pipeline.md