# YMRTECH VPN - monthly no-log audit - September 2026

**Host:** `public`  
**State:** month-to-date  
**Status:** INCOMPLETE  
**Generated:** 2026-09-19T09:29:31Z  
**Report version:** 1

## Result

| | |
|---|---|
| Days with a signed report | 2 of 19 expected |
| Days missing (no report published) | 17 |
| Daily signatures checked / verified | 2 / 2 |
| Violations and unverifiable reports | 0 |

Days with no published report (coverage gaps — neither a pass nor a violation): 2026-09-01, 2026-09-02, 2026-09-03, 2026-09-04, 2026-09-05, 2026-09-06, 2026-09-07, 2026-09-08, 2026-09-09, 2026-09-10, 2026-09-11, 2026-09-12, 2026-09-13, 2026-09-14, 2026-09-15, 2026-09-16, 2026-09-17

## Checks

| Check | Days passed | Days failed | What it asserts |
|---|---|---|---|
| `adguard:wg2-standby:buffer` | 2 | 0 | the resolver's query log and statistics are OFF (re-applied on every run), a persisted query log is purged, and a real query plus a unique canary name provably wrote nothing |
| `adguard:wg2-standby:no-querylog-file` | 2 | 0 | the resolver's query log and statistics are OFF (re-applied on every run), a persisted query log is purged, and a real query plus a unique canary name provably wrote nothing |
| `adguard:wg2-standby:querylog_config` | 2 | 0 | the resolver's query log and statistics are OFF (re-applied on every run), a persisted query log is purged, and a real query plus a unique canary name provably wrote nothing |
| `adguard:wg2-standby:stats_config` | 2 | 0 | the resolver's query log and statistics are OFF (re-applied on every run), a persisted query log is purged, and a real query plus a unique canary name provably wrote nothing |
| `journal:no-client-tier-address` | 2 | 0 | the shipped system journal contains no client-tier address from the VPN tunnel ranges |
| `nolog:clientsv-nolog-standby` | 2 | 0 | the behavioural no-log unit is active and its journal holds the line that means a live lookup was sent and left no log |
| `unbound:/etc/unbound/unbound.conf` | 2 | 0 | the effective unbound configuration contains no log-queries directive |

No invariant was violated in this period, and every daily report's signature verified.

## What was running

Each distinct `system_generation` seen in the month, i.e. the deployed configuration the checks ran against:

| System generation | First seen | Last seen |
|---|---|---|
| `/nix/store/9xmj5kfcdk07h3182zpssqri3hbcxvcs-nixos-system-public-26.11.20260909.7b66dac` | 2026-09-18 | 2026-09-18 |
| `/nix/store/j0gyn6q1d2la1miafw0zvypvdlfa9n10-nixos-system-public-26.11.20260909.7b66dac` | 2026-09-19 | 2026-09-19 |

## Retention declared by the configuration

| Data | Retention |
|---|---|
| adguard-querylog | disabled (no querylog.json, no retrievable tier entries) |
| journald | 14d (local; public's journal is NOT shipped off-host) |

## Verify this report

```sh
curl -O https://ymrtech.com/logging-audit/logging-audit.allowed_signers
curl -O https://ymrtech.com/logging-audit/monthly/2026-09.json
curl -O https://ymrtech.com/logging-audit/monthly/2026-09.json.sig
ssh-keygen -Y verify -f logging-audit.allowed_signers -I logging-audit@public -n logging-audit -s 2026-09.json.sig < 2026-09.json
```

Every daily report can be checked the same way, and the raw machine-readable report for this month is `monthly/2026-09.json`.

- Every figure above comes from the dated daily reports in history/ ; this summary is derived from them, not a replacement for them.
- Fetch monthly/2026-09.json and monthly/2026-09.json.sig from this host together with logging-audit.allowed_signers, then run the verify command in signing_key.verify from the directory that holds them.
- Each day listed in coverage can be re-checked the same way against history/public-<date>.json(.sig).
- The daily report itself records which checks ran and what each observed, so a reader can audit the auditor.

Signing key: `256 SHA256:NkQoFKJH/tiH+K+8fICk3nCukwo35G+P4BdZDVnA/vU logging-audit@public (ED25519)`

## Notes

- state=month-to-date means the month is still running: it is rewritten on every run and its hash WILL change. state=final means the month is closed and the report is frozen - its hash must not change again.
- days_missing are coverage gaps (no report was published that day), not passes and not violations; a gap is stated rather than filled in.
- check_failures are periods during which an invariant was VIOLATED. A failing daily report is still written and signed before the audit unit fails, so a violation cannot be hidden by the failure itself.
- retention values are DECLARED from the configuration, recorded here so a change to them shows up as a diff.
- The audit runs on the hosts it audits. A reader who does not trust the host should treat it as self-reported evidence whose value comes from being signed, dated, published, and reproducible from published configuration - not from an independent third party.