Remediation is a proof obligation
Absence of a failure is meaningful only if its relevant check completed. Inaccessible hosts, missing samples and truncated logs retain old issues as Unverified. Stable identity hashes the system, check and normalized failure signature, avoiding a new issue for every timestamp or repeated log entry. Lifecycle transitions are deterministic and never delegated to a model.
Bounded evidence
Scanning arbitrary logs can expose credentials or amplify attacker-controlled instructions. The scanner executes only fixed metric and log queries, retains counts and approved classifications, and never executes log content. AI receives deterministic findings rather than raw logs. Suggested causes are hypotheses and must reference the supplied evidence IDs.
Recovery limits
Encrypted backups protect stored history but still require the separately retained backup key. Detailed evidence expires; summaries remain. Offline or uninstrumented services cannot be made observable by a daily job alone, so coverage explicitly records those gaps. Scheduled execution can be delayed by GitHub, and a local-host outage prevents the local inspection process from running. Cloud remains an independent evidence source.
Coverage verification
Initial deployment verified 60 Cloud dashboard definitions and six additional portal dashboards. The first inspection recorded 81 checks, including explicit gaps; later inspections also read every configured Cloud rule. Coverage counts are runtime evidence, not permanent constants. The original Raspberry Pi had no running application containers at discovery. Antenna Observatory and Skyglow were removed from the active fleet at the owner’s request on 2026-09-13. Historical reports remain intact. Mookie was retired from the fleet on September 20, 2026.