Triage the collector failures

Objectives

Overnight, eight evidence collectors reported. The morning summary is green because the orchestrator only counts non-zero exit codes.

Raise the collectors whose evidence should not be trusted this morning. Leave the ones that are fine.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

P-1  okta-admins: wrote 0 bytes, exit code 0, previous day's file left in place and re-stamped with today's date.
P-2  aws-config: 4,102 records, checksum recorded, manifest written.
P-3  github-approvals: partial page fetch, stopped at page 3 of 9, exit code 0.
P-4  gcp-iam: completed, took 40 minutes instead of the usual 6.
P-5  jira-tickets: completed, 1,204 records, one field renamed upstream so a column is now null throughout.
P-6  hris-leavers: wrote to the evidence bucket with no run id and no checksum.
P-7  scanner-findings: completed, checksum recorded, manifest written.
P-8  crowdstrike: completed, record count 3% below yesterday.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the fixture as a population, not a list

   Trust in a pipeline comes from three properties: the run happened, the output is complete, and the artefact can be tied to that run. Test each collector against all three.

2. Step 2

   Decide what actually qualifies

   Four collectors break one of those properties: a re-stamped stale file, a truncated fetch, an untraceable write and a silently nulled column.

   The right findings are raised

3. Step 3

   Resist the loud lines

   Duration and a 3% count drift are operational signals worth watching, not evidence defects. Do not spend the reviewer's attention on them.

   Benign lines are left out

4. Step 4

   Grade the exposure, not the wording

   Rank fabrication first: stale data presented as today's is affirmatively false evidence, not missing evidence.

   Truncation is next because the population is wrong and looks complete; then untraceable output; then the nulled column, which is at least discoverable in the data.

   Severity matches the actual exposure

5. Step 5

   Rank so the first line is the one you act on

   Lead with the artefact most likely to be relied on while being wrong.

   Ranked worst first

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.