Keep the cycle that found something, past the quiet one after it #24

2026-09-03T11:31:42-07:00

dejima-agent commented

2026-09-03 11:31:42 -07:00

Summary generated by LLM agent

Reported from a live host: alerts arriving every half hour, and dejima-guard report showing no changes against the baseline. Which reads as the alert having been imaginary.

last-report is overwritten every cycle, so a clean cycle erases the evidence of the alert before it. Anything that alternates hits this every time, and a flapping line alternates by definition, so the case where the evidence matters most is the case where it is least likely to still be there.

The last cycle that found something is now kept beside the last cycle. report still shows the most recent, and says when an older finding is still available:

no changes against the baseline

That was a clean cycle. The most recent one that found something is
still here, from 2026-09-03T17:44:02Z:
  dejima-guard report --finding

Only when the two differ. After an alerting cycle they are the same file, and pointing at what somebody is already reading is noise.

This is a diagnosis gap rather than the fault itself: dejima-devbox-hardener PR 28 is the cause of the alerts that prompted it. It is worth having regardless, since the next intermittent fault will hide the same way.

Tested: 119 passing, up from 115. Three of the four new tests fail against main.

**Summary generated by LLM agent** Reported from a live host: alerts arriving every half hour, and `dejima-guard report` showing `no changes against the baseline`. Which reads as the alert having been imaginary. `last-report` is overwritten every cycle, so a clean cycle erases the evidence of the alert before it. Anything that alternates hits this every time, and a flapping line alternates by definition, so the case where the evidence matters most is the case where it is least likely to still be there. The last cycle that **found** something is now kept beside the last cycle. `report` still shows the most recent, and says when an older finding is still available: ``` no changes against the baseline That was a clean cycle. The most recent one that found something is still here, from 2026-09-03T17:44:02Z: dejima-guard report --finding ``` Only when the two differ. After an alerting cycle they are the same file, and pointing at what somebody is already reading is noise. This is a diagnosis gap rather than the fault itself: dejima-devbox-hardener PR 28 is the cause of the alerts that prompted it. It is worth having regardless, since the next intermittent fault will hide the same way. Tested: 119 passing, up from 115. Three of the four new tests fail against `main`.

dejima-agent added 1 commit 2026-09-03 11:31:42 -07:00

Keep the cycle that found something, past the quiet one after it f86a6b5c75

last-report is overwritten every cycle, so a clean cycle erases the evidence of
the alert before it. Reported from a live host: alerts arriving every half hour,
and `report` showing "no changes against the baseline" - which reads as the
alert having been imaginary rather than as the report having been replaced.

Anything that alternates hits this every time, and a flapping line alternates by
definition, so the case where the evidence matters most is the case where it is
least likely to still be there.

The last cycle that found something is kept beside the last cycle. `report`
still shows the most recent, and says when an older finding is still available
rather than leaving the operator to wonder - but only when the two differ, since
after an alerting cycle they are the same file and pointing at it would be
noise.

branderson approved these changes 2026-09-03 11:46:32 -07:00

branderson merged commit 051c096c0d into main

2026-09-03 11:47:18 -07:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dejima/dejima-guard#24