# YMRTECH VPN - monthly no-log audit - October 2026

**Host:** `public`  
**State:** month-to-date  
**Status:** CLEAN  
**Generated:** 2026-10-09T09:40:54Z  
**Report version:** 1

## Result

| | |
|---|---|
| Days with a signed report | 9 of 9 expected |
| Days missing (no report published) | 0 |
| Daily signatures checked / verified | 9 / 9 |
| Violations and unverifiable reports | 0 |

## Checks

| Check | Days passed | Days failed | What it asserts |
|---|---|---|---|
| `adguard:wg2-standby:buffer` | 9 | 0 | the resolver's query log and statistics are OFF (re-applied on every run), a persisted query log is purged, and a real query plus a unique canary name provably wrote nothing |
| `adguard:wg2-standby:no-querylog-file` | 9 | 0 | the resolver's query log and statistics are OFF (re-applied on every run), a persisted query log is purged, and a real query plus a unique canary name provably wrote nothing |
| `adguard:wg2-standby:querylog_config` | 9 | 0 | the resolver's query log and statistics are OFF (re-applied on every run), a persisted query log is purged, and a real query plus a unique canary name provably wrote nothing |
| `adguard:wg2-standby:stats_config` | 9 | 0 | the resolver's query log and statistics are OFF (re-applied on every run), a persisted query log is purged, and a real query plus a unique canary name provably wrote nothing |
| `journal:no-client-tier-address` | 9 | 0 | the shipped system journal contains no client-tier address from the VPN tunnel ranges |
| `nolog:clientsv-nolog-standby` | 9 | 0 | the behavioural no-log unit was re-run and succeeded (a live lookup was sent and left no log) |
| `unbound:/etc/unbound/unbound.conf` | 9 | 0 | the effective unbound configuration contains no log-queries directive |

No invariant was violated in this period, and every daily report's signature verified.

## What was running

Each distinct `system_generation` seen in the month, i.e. the deployed configuration the checks ran against:

| System generation | First seen | Last seen |
|---|---|---|
| `/nix/store/4ibjzxdc6vkdbf3wadp9s1naznvlrbv5-nixos-system-public-26.11.20260909.7b66dac` | 2026-10-09 | 2026-10-09 |
| `/nix/store/9vi66mjnby0gn2my9gpy453bzn854wrq-nixos-system-public-26.11.20260909.7b66dac` | 2026-10-07 | 2026-10-07 |
| `/nix/store/d0dbc0m95283kkibj7i3d31pfm7mfqq3-nixos-system-public-26.11.20260909.7b66dac` | 2026-10-04 | 2026-10-04 |
| `/nix/store/gzxvwq1bdqkgnxbpdllcm60zp1pb6dkl-nixos-system-public-26.11.20260909.7b66dac` | 2026-10-08 | 2026-10-08 |
| `/nix/store/qcbgvficwsyavczfd87zi90qsz6xnr3i-nixos-system-public-26.11.20260909.7b66dac` | 2026-10-01 | 2026-10-01 |
| `/nix/store/qf68llbmqj7sr6rwyd15mxg40d019x13-nixos-system-public-26.11.20260909.7b66dac` | 2026-10-05 | 2026-10-05 |
| `/nix/store/vk6x63zwn31zsvm6vk0khfwdywazr7kn-nixos-system-public-26.11.20260909.7b66dac` | 2026-10-03 | 2026-10-03 |
| `/nix/store/x5yxrif6saihvwka9hb2gv63dxld5cdk-nixos-system-public-26.11.20260909.7b66dac` | 2026-10-02 | 2026-10-02 |
| `/nix/store/yix171xlsr4jzavdc6ckxk51h139rhh4-nixos-system-public-26.11.20260909.7b66dac` | 2026-10-06 | 2026-10-06 |

## Retention declared by the configuration

| Data | Retention |
|---|---|
| adguard-querylog | disabled (no querylog.json, no retrievable tier entries) |
| journald | 30d local ceiling (a maximum, not an achieved window: size-bounded, ~18d at the measured rate), AND 14d in VictoriaLogs on mail (shipped off-host since 2026-09-22, WP4) |

## Verify this report

```sh
curl -O https://ymrtech.com/logging-audit/logging-audit.allowed_signers
curl -O https://ymrtech.com/logging-audit/monthly/2026-10.json
curl -O https://ymrtech.com/logging-audit/monthly/2026-10.json.sig
ssh-keygen -Y verify -f logging-audit.allowed_signers -I logging-audit@public -n logging-audit -s 2026-10.json.sig < 2026-10.json
```

Every daily report can be checked the same way, and the raw machine-readable report for this month is `monthly/2026-10.json`.

- Every figure above comes from the dated daily reports in history/ ; this summary is derived from them, not a replacement for them.
- Fetch monthly/2026-10.json and monthly/2026-10.json.sig from this host together with logging-audit.allowed_signers, then run the verify command in signing_key.verify from the directory that holds them.
- Each day listed in coverage can be re-checked the same way against history/public-<date>.json(.sig).
- The daily report itself records which checks ran and what each observed, so a reader can audit the auditor.

Signing key: `256 SHA256:NkQoFKJH/tiH+K+8fICk3nCukwo35G+P4BdZDVnA/vU logging-audit@public (ED25519)`

## Notes

- state=month-to-date means the month is still running: it is rewritten on every run and its hash WILL change. state=final means the month is closed and the report is frozen - its hash must not change again.
- days_missing are coverage gaps (no report was published that day), not passes and not violations; a gap is stated rather than filled in.
- check_failures are periods during which an invariant was VIOLATED. A failing daily report is still written and signed before the audit unit fails, so a violation cannot be hidden by the failure itself.
- retention values are DECLARED from the configuration, recorded here so a change to them shows up as a diff.
- The audit runs on the hosts it audits. A reader who does not trust the host should treat it as self-reported evidence whose value comes from being signed, dated, published, and reproducible from published configuration - not from an independent third party.