2026-11-01T1312Z-audit

Scope and outcome

Scheduled weekly audit of 2026-10-25T13:08Z to 2026-11-01T13:12Z (anchor: the 2026-10-25 audit, the last with re-sweeps). Fifty-four entries with activity from the week's seven intel fires were truth-checked whole in six passes: 30 clean, 22 with imprecisions, 2 with factual errors. The re-sweeps found no gap that needed a new entry; six developments on covered findings were added as records. Twenty-four entries carry one record each from this fire (7 updates, 13 corrections, 4 improvements; 7 internal). Report: docs/audits/2026-11-01-quality-audit.md.

Verification & coverage notes

• Claims: an open partial claim from cleanup wave 05 (2026-10-21T1147Z-audit, partial 2026-10-21T11:47:42Z wave=05) still stands on main; the scheduled audit ignores a partial claim (Phase 0 step 2), and it is more than 48 h old.
• Budget: 13 of 20 spawns (six truth passes, G1 to G3, four verifier passes), 6,885,964 sub-agent tokens: 4,748,994 before the verifier loop and 2,136,970 in it (work/2026-11-01T1312Z-audit/budget.tsv).
• Verification: four passes over this fire's changed claims, the run record and the report. Iterations 1 and 2 returned NEEDS_FIXES (7 and 3 truth findings), all remediated; iteration 3 returned CLEAN; iteration 4, the confirmation pass over all 242 claims, found no truth defect and two editorial ones (two cves[].affected strings not brought in line with this fire's own fixed-build additions), both applied. Decision rule 5 (truth plus editorial at most 2, no F1 or F4) publishes on that early exit; the residual is 2, the two editorial findings, which were applied after the pass and are unverified by a further pass. The pre-existing advisories left for the next truth pass are the Dream citation dates on the CVE-2026-46300 entry.
• Truth passes: 54 entries in six batches, 1,651 ledger claims, every claim answered (12 unreadable in TA, mostly NetScaler's Tech Zone post that returns 403 on every transport). Verdicts: 30 clean, 22 imprecision, 2 factual error.
• Records: 24 entries carry one record each (7 update, 13 correction, 4 improvement; 7 internal). The six re-sweep developments are records on covered entries; no new entry was needed.
• KEV: ten additions since 2026-10-25, all covered (work/2026-11-01T1312Z-audit/kev-window.txt); no COVERED-STALE or RANSOMWARE row.
• Backlog: ARX Group SA held to 2026-11-07; G2 found no victim, client or press confirmation.
• borderline-drop: Adobe Campaign Classic APSB26-162 as a new entry: published instead as an update on the 2026-10-02 entry, whose fixed build it supersedes.
• borderline-drop: ESET APT Activity Report Q2-Q3 2026, Talos VOLTA and NIK C2, Check Point Yoba, Elastic wesp.sys, Symantec AI relays, Group-IB MadApe, Microsoft's DPRK AI staging, Kaspersky cloud isolation, the MEP letter on ad-delivered spyware, Apple's notification wave, Zimperium's Coruna and DarkSword counts (G3): no constituency decision.
• borderline-drop: Contact Form 7 6.2.4, Sophos UTM CVE-2026-118633, TeamViewer TV-2026-1011, the Drupal contrib wave of 2026-10-28, Splunk, Mitel, Jenkins, EPICS, Adobe Connect, LXD, Thales Sentinel, Teltonika, vsftpd, TightVNC, WolfVision, Grafana, the Synology SA-26:15 and Fortinet FG-IR-26-187 notices for the covered Brotli flaw (G1): unexploited, regular cycle, no constituency exposure, or a vendor notice that adds no decision to the covered entry.
• borderline-drop: Sophos UTM CVE-2026-118633 (Sophos advisory 2026-10-28, pre-auth root RCE, all versions, end of life, manual patch): no exploitation or proof of concept reported, it needs the email proxy with scanning enabled and minutes of sustained racing (not a single-request path), EPSS 0.006, and the product is end of life with a manual patch as the only fix; verifier iteration 1 raised it as a missed angle (F10, low confidence) and the audit keeps the drop, to be reopened on an exploitation report.
• borderline-drop: Camping.Care supplier-side statement (a Dutch campsite's notice of 2026-10-23, G2): it predates the window and adds only that the platform operator told campsites data was presumably taken, which the covered entry's incident framing already carries.
• borderline-drop: SolNet, SIHF, SoftwareOne, Leipzig University, Fehmarnbelt FLC, Verrières-en-Forez, the Federal Council alerting dispatch, the e-evidence transitional rule, the Geneva e-voting step, the BACS week-43 WhatsApp wave, EFK report on ZEMIS (G2): below the incident floor or no defender consequence.
• Declined truth-pass findings, with reasons in the report: Adobe Commerce Events for CVE-2026-48356, the MDaemon KEV ransomware flag (WinRAR vector), the WS_FTP CVE-2026-90867 mitigation (CVE record API only), the Gridbox high (low-confidence F16), T1611 on CVE-2026-46300, Publica's early volume statement.
• Source health: sans-isc content scope set; ico-uk (timeouts), ssd-disclosure (transient) and connectwise-trust-center (flapping) investigated and left as they are; no webfetch-only record.
• Reader pool (context): 6 of 10 jina keys live, balance about 46.8 M; G3 saw extract fall through to the reader seven times on Dark Reading.
• ATT&CK pin: up to date (local v20.0 == upstream v20.0).
• Tool change: tools/check_run.py now appends every run-scope gate output to work/<run-id>/gate.log; exercised on this fire's gate runs.
• Coverage gaps: sygnia (blocked on every transport), cyberscoop and technadu feeds (10 items, 2026-10-25 to 10-27 not listed), F5 K000163821 and the per-product Broadcom advisories (JS shell or login), apa-ots (feed about 3 h deep), risikomonitor.ch (no DNS from the container).