Conversation
…file set, stack and diagram counts - row 'more sensors' listed honeypot-citrix / honeypot-cisco-asa / honeypot-rdp, but the directories are honeypot-citrix-honeypot, honeypot-cisco-asa-honeypot and honeypot-rdp-honeypot, so the row's own 'arcane/home/honeypot-<name>/compose.yml' pattern did not resolve - the three worker stacks in the next row were all retired by #1649 and run as Rust WORKER_LOOPS now; the row still described them as live writers - 'the only profile is geoip-update' omitted the threat-intel maintenance job, the four ["legacy"] rollback definitions and ghosts' ["test"] client - '20 split home stacks' -> 26, the roster deploy-profiles/full.txt names - ARCHITECTURE.md '6 diagrams' -> 4, its actual mermaid block count
… exempt list docs/archive/ has no directory and no tracked files, but the map listed it twice (as a subdirectory, and as a dated record tree). The reachability script does exempt docs/design-lab/ -- kept as a near-duplicate of branding/design-lab/ -- and the map's description of that gate omitted it. Reachability result is unchanged: 85 reachable, 35 exempt.
…ter, endlessh PROXY - the investigation-UI table still named the deleted Go 'dashboard' container on :8090. The live view is dashboard-next, container :8080, published on home 19090/19092 and bridged from VPS 8090/8092 - Elasticsearch is limits.memory 12G with ES_JAVA_OPTS -Xms6g -Xmx6g, not 8 GiB / 4 GiB; dashboard-next gets 2 CPUs, not 1 - the TANNER container list omitted tanner_docker and listed snare_clone as one of this stack's services; it is a honeypot-init one-shot (hp-snare-clone) writing the snare-pages volume. The seven tanner_local services are now listed - endlessh parses PROXY_PROTOCOL=1 behind its :pp 2022 rule but was missing from the list of sensors that recover the real attacker IP that way
The 'Service-specific decoys' section states its purpose as backfilling rows so every running sensor traces back to a decision, but honeypot-sonicwall-sma (#3033, CVE-2026-83548 / CVE-2026-83549) had no row anywhere in the file. Every other one of the 20 sensor stacks does. All other claims verified against compose and the source: wordpot's directory is gone, the 2026-08-27 retirement date matches, conpot's six personas, and #233/#242 as cited in community-threat-intel-sharing.md.
…and payload-dedupe logging claims
…e and the design-lab harness pointer
…mples at the Rust tier
…N_DAYS=21, not the code fallback
…o service, date the retention decision
…orter comparison
… open Both were already marked Done in the doc's own Follow-up scope section; the section bodies and the applicability matrix were never updated to match. - item 9: llm-analysis severity is wired into the Rust alert sink as llm_flagged_alerts (worker.rs:1277), not browse-only via /llm-analysis - item 5: hp-autoheal no longer bind-mounts /var/run/docker.sock. #592 moved it onto hp-docker-socket-proxy, which holds the socket :ro scoped to CONTAINERS/IMAGES/POST on a private network. The residual is that CONTAINERS=1 stays daemon-wide, which is now what the text says - the docker.sock grep aside claimed 'absent' from the dashboard compose, but that file does contain one mount (services-adapter's) -- made explicit so someone re-running the grep is not surprised ROADMAP.md: verified, no drift. No 'next' profile survives anywhere, CAPE is authored but absent from the manifest while GHOSTS is present, sandbox/cape has the Packer file and spool worker it claims, reporter/ sits under honeypot-utilities, and llm-worker's selftest exists.
…and the unported sidecar default
…-coverage claim true - 'The reporter container' still promised a /metrics Prometheus endpoint for Grafana. metrics.go explicitly rejects that shape and writeMetricsLoop overwrites dataDir/metrics.json instead; the status banner 100 lines down already said so, so the doc contradicted itself - 'Every .go file has a matching _test.go' does not hold by filename: categorize.go is covered from event_test.go, and main.go/report.go from dryrun_test.go. Every function is still exercised, so the substance stands Every other claim verified against the tree: /data/reported.db, the reporter volumes, all thirteen .go files in the diagram, no .py, and the metrics.json/AUDIT_BLOCKLISTDE/GREYNOISE_ENABLED env contracts.
…drifted line ref - evaluate_detectors.py runs seven check_* functions (appended at lines 404-411), not six - the 2026-09-03 audit had no dated banner, so its live-host measurements (245.8 GB, 13.18 GB reclaimable, a '45+ hours up' buildkit container) read as current. Added one pointing at the same do-not-mirror principle security-fixes.md already states, and at the open issues #2915/#2904 - its install-homeserver.sh:431-500 pointer no longer lands on the builder-GC discussion; the reasoning is at 392-397 and the JSON block at 463-465 Everything else verified: all four quality.yml scripts now use 'docker rm -fv', rex86-eval is tracked but absent from the manifest and is the only such directory under arcane/home/, and the daemon.json gc values match exactly.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Owner
Author
|
Closing in favour of #3398, which is already open and auto-merging. This branch came from an orphaned agent run that was killed mid-flight; nothing further should land from it. |
This was referenced Sep 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round 2 of the #3399 docs reconciliation, map slice — 13 files. Follows
#3398 (43 files, round 1).
Gates — all five green on this branch
Findings worth reviewing
docs/ip-reporting-plan.md— both mermaid diagrams were fiction. Thefile-tree diagram drew a Python reporter (
reporter.py/sources.py/apis.py/dedup.py/metrics.py) and the node label saidreporter (Python).None of it exists; the real thing is 13 Go files plus
writeMetricsLoop.Redrawn. The sketch also had
BLOCKLISTDE_SENDER/_API_KEYwrong (as_EMAIL/_PASSWORD) and a:9101Prometheus port that is not wired.Both diagrams passed the parse gate while being entirely wrong — parse
validity is not factual accuracy.
docs/llm-worker/README.mdnever named the deployed entry point. Themanifest points at
docker-compose.captured-data-deploy.yml.docs/community-threat-intel-sharing.mdcalled #153 "still open". It isclosed and implemented (
greynoise.gobehindGREYNOISE_ENABLED).docs/agent-intrusion-threat-model.mdclaimed its method verified"against Go/Python source" — the Go tier was deleted five days before the
doc's own status date.
docs/dionaea-bistreams-retention.md— retention prune was described aspending; it went live 2026-09-09, now 18 days ago.
docs/security-fixes.md— dated banner; every path it names confirmed deleted.Verified-no-drift (recorded, not silently skipped)
DECEPTION-EXTENSIONS.md(all 21 locations),ml-worker-evaluation.md,container-writable-layer-audit-2026-09-03.md.New issue raised
#3403 — the manual IP-block export sidecar is fetching a URL that returns an
unauthenticated 200 with zero bytes, so operator IP blocks silently never
reach portbridge. Found here, measured against the live host, and filed
separately rather than folded into a docs PR.
Two things for the maintainer
branding/design-lab/design-notes.mdcontains a real attacker IP(
85.14.245.1).docs/design-lab/is a redacted copy of it (→203.0.113.1),but the redaction buys nothing while the original sits in the same public
repository, and
check-public-leaks.pydoes not flag it. Not touched —outside the assigned list, and it is a judgement call, not a doc error.
ml-worker-evaluation.mdorders its status entries 08-25, 09-25, 09-05,09-25. Content is self-labelled as superseding so I left the ordering alone
rather than restyle.