Receipts

The archive. Artifact Reviews are Council Reviews of a specific closed artifact — four roles by default, five when the council splits and research is called in to break a tie. Weekly Consensus is the operator's own synthesis across the week's artifacts — single voice, no council, and only written in weeks with two or more new artifacts.

2026-04-12 · Artifact Review · Sigma rule library

The Counter Certified Nothing

REVIEWED / NARROWED
Status
reviewed / narrowed
Supported claim
103-rule library supported for count, drift, UUID uniqueness, and strict content validation.
Blocked claim
runtime signal; universal SIEM deployability.
Next gate
link runtime/signal proof artifact before any signal or deployability claim.
Excerpt
File/count proof was separated from runtime/signal proof.

2026-04-07 · Artifact Review · Wazuh manager config

The Dashboard Lied Politely

REVIEWED / NARROWED
Status
reviewed / narrowed
Supported claim
Historical primary-endpoint process-creation telemetry restoration and manager-to-indexer delivery validation during remediation window.
Blocked claim
fleet-wide visibility; current-runtime visibility.
Next gate
link evidence/proof artifact for current and fleet visibility before either claim is made.
Excerpt
Historical remediation-window proof was separated from current/fleet claims.

2026-04-01 · Artifact Review · AutoSOC ingest pipeline

The Pipeline Ate Itself at Five Hundred Thousand

REVIEWED / RESOLVED
Status
closed elsewhere
Supported claim
Race-condition remediation is routed as a closed HawkinsOps V1 historical proof claim.
Blocked claim
current production readiness; current runtime operation; autonomous SOC.
Next gate
read the paired HawkinsOps proof boundary before reusing any stronger wording.
Excerpt
A TOCTOU race condition became fatal at backlog scale and was remediated under the recorded incident boundary.