2026-09-27T1308Z-audit

Verification & coverage notes

Quality audit over 2026-09-20T13:08:12Z to 2026-09-27T13:08:37Z (168 h), anchored on the previous audit record. Full report: docs/audits/2026-09-27-quality-audit.md.

Soundness. Four retrospective truth passes covered all 54 entries in the window (36 new, 18 carrying a changelog record from it), each re-verified against freshly fetched primaries. 46 of 54 clean. Two factual errors, six imprecisions, no hallucinated source, no broken link, no IOC, no unrated entry. Batch D additionally re-checked all ten entries the previous audit corrected or improved: 10 of 10 fixes held, and both defects it surfaced were pre-existing errors that fire never touched.

Completeness. Three independent re-sweeps returned 27 items the week's fires had not published: 18 research-blog publications, 5 vulnerability items and 4 incident items. One was published as a new entry, one shipped as a changelog record on an existing entry, and eight coverage-backlog rows carry the rest with per-row gating notes and publish conditions. The KEV sweep was clean: 10 additions in the window, 10 of 10 already covered, kev-window.txt written by all seven fires.

Systemic. The v4.11 rotation fix worked and stopped one step short of the cause. Consecutive-fire slice overlap fell to 8 % on S3 and the four previously-starved research publishers were all swept, but the underlying ranking never advanced, so slices cycled with period 3: lag-3 overlap measured 82 to 92 % across all four domains, and 64 of 115 research sources were allocated to no fire at all. Fixed in v4.12 by ranking on a rotation cursor that an attempt advances, derived from run records rather than a new source field; simulated at 112 of 115 reached in seven fires with zero consecutive overlap. Separately, the store-wide YAML-portability check was extended to run records, which surfaced one record of 196 unreadable by any standards-compliant parser since May.

Operational. ncsc-ch-focus and ncsc-ch-incidents were both pinned to a reader pool with zero live keys and both fail their health probe on that pin; fetch_source.py extract reads both in full through trafilatura-direct, so both are re-pinned to bridge. ncsc-ch-incidents is genuinely dark, last contributing 2026-09-14. ncsc-ch-focus is not: the 2026-09-23 fire read it and published 2026-09-23/ncsc-ch-google-recovery-oauth-app-password-persistence from it, so the bad pin was masked by the fetch ladder working around it. Only fetch_method and the notes changed on either record; last_successful_fetch and the quiet counters stay as the fires left them, since this fire probed the transport rather than using either page for an entry. Reader-pool state noted as context only, per the standing rule that a dead pool is a normal condition rather than an incident.

Watch items: six resolved (verifier-loop convergence, rotation-fix effectiveness, the NCSC.ch pages, Boston Scientific, the KEV artefact, content-driven verifier blocking), seven still open, four new.

Warning sweep: four new acknowledgment rows, all settled history on immutable run records, including the previous audit's own unconfirmed-CLEAN fail-open, which that audit explicitly deferred to this one. All 33 existing rows still silence a live warning; none pruned. Ledger now 37 rows.

Calibration: not due (September's pass is in the 2026-09-06 report); continuity figures recorded in the report.

Essential-coverage: not applicable to an audit fire; the re-sweeps' source slices and per-publisher reachability are recorded in work/2026-09-27T1308Z-audit/gap-G1.yaml, gap-G2.yaml and gap-G3.yaml.

Coverage gaps: G2 did not separately drill cert-at, cert-fr avis-recent, or thirteen rotation sources, having prioritised the mandatory watch-item re-checks; inside-it-ch 429'd again; the Dyfed-Powys force statement page and one franceinfo article 403'd on every transport and were substituted with outlets quoting them directly. G3 found trellix, kela-cyber and esentire listings unreachable or empty by every transport tried, and paradigm-shift-research genuinely empty in-window; recipe work is operator recommendation 2. G1 did not attempt github-advisory (the egress proxy blocks github.com at session level) and had no package-specific lead to justify an OSV query.

Verification outcome. Eight iterations, the hard cap, ending on NEEDS_FIXES with one residual. The chain ran CLEAN, then NEEDS_FIXES at 4, 4, 5, 2, 2, 3 and 1 findings; iteration 1's CLEAN went unconfirmed because iteration 2 refused it and was right to, finding two wrong numbers in the audit report and three duplicated coverage-backlog rows. The entries themselves have been clean since iteration 2: every finding from iteration 3 onward was in the report's or this record's own bookkeeping, and the recurring failure mode was a self-referential number or narrative claim that the run's own artefacts contradicted. Iteration 8 re-derived essentially every such number from scratch and found them exact, settled both of iteration 7's disputed declines in favour of the declines, and stated that it would publish this output as it stands. The single residual is its own low-confidence F14, which was remediated before commit: the wording is narrowed, so the residual is recorded rather than outstanding. What iteration 8 said it would still check at a ninth pass, and which therefore did not get an independent read: the full 112-distinct-technique-id claim across all 54 window entries (it spot-checked the 13 vulnerability entries), the truth-pass and coverage-sweep YAML artefacts against this report's defect and gap tables (it re-verified the corrections against their primary sources directly instead), the Oracle, IBM MQ, Langflow and Adobe citations on the five new backlog rows, and the per-fire iteration-count and priority-calibration continuity figures. The next audit should treat those four as unverified claims of this fire.

Verification counters. Each iteration's truth / editorial / advisory counts are normalised by F-code using the verifier definition's own mapping, truth = F1 to F4 plus F13 to F15, editorial = F5 to F10 plus F12 and F16 to F18, advisory = F11, rather than transcribed from each pass's own severity call. Independent passes label the same code differently, and iterations 3 and 5 each flagged an un-normalised block; normalising once makes the chain readable across iterations. Every block still sums to the length of its own findings list, which is what the gate enforces.

ATT&CK pin: tools/attack_data.py --check reports local v19.2 equal to upstream latest v19.2. No drift.