{ "schema": "xcom-agi-state/v1", "board": "XCOM EVIDENCE", "identity": "XCOM.DEV — An Evidence-Bound, Agent-Native AGI Estate", "generated_at": "2026-11-02 10:13:49", "source": "estate state projection (allow-list) · tools/agi-state-publish.py", "degraded": false, "values": { "hosts": 3, "datastores_live": 75, "datastores_bytes": 120071443253, "mcp_servers": 52, "docker_containers": 55, "docker_images": 77, "docker_volumes": 50, "domains": 49, "domain_records": 123, "connections": 191, "ingested_datasets": 320, "ingested_bytes": 201146764587, "services_total": 1675, "hp_requests": 1114044, "hp_events": 283981, "hp_credentials": 17097, "hp_sessions": 99, "hp_uploads": 529, "hp_payloads": 92, "hp_sensors": 3, "hp_saved_bytes": 12357684194, "agents_total": 66, "agents_active": 50, "agents_retired": 6, "agents_crew": 7, "agents_instances": 134, "agents_xcom": 56, "agents_vscode": 10, "chains_total": 64, "chains_frozen": 14, "chains_opid": 3, "chains_war": 23, "chains_recon": 8, "chains_orchestrator": 4, "chains_helper": 25, "models_total": 126, "models_cloud": 82, "models_local": 44, "models_local_bytes": 217512117895, "models_approved": 17, "model_lanes_ok": 3, "docs_total": 402, "docs_registered": 204, "docs_chapters": 17, "corpus_rows": 1213310, "corpus_events": 1199648, "corpus_confidence": 0.432, "corpus_classes": 9, "corpus_opid_pct": 100.0, "strike_sessions": 7953.0, "strike_events": 146328.0, "strike_mitre": 143577.0, "strike_runs": 12, "strike_registry": 3, "hp_live_events": 146307, "hp_live_sensors": 10, "hp_ai_leaks": 118, "hp_edge_requests": 12243, "hp_lag_hours": 0.0, "knowledge_declared": 185, "knowledge_have": 41, "knowledge_coverage_pct": 58.3, "knowledge_chunks": 419025, "knowledge_chars": 917774897, "knowledge_missing": 26, "memory_rows": 14062, "memory_24h": 769, "memory_categories": 17, "memory_lessons": 116, "memory_reasoning": 127, "memory_semantic_indexed": 100, "memory_semantic_eligible": 116, "forum_topics": 90612, "forum_posts": 90243, "forum_categories": 49, "forum_coverage_pct": 99.5, "rf_plc_spectral": 3717287, "rf_mesh_events": 55179, "rf_ble": 66739, "rf_semantic_chunks": 9640, "rf_sigmf": 2, "alerts_unack": 2, "payloads_total": 92, "docker_age_s": 729, "mitre_top6_total": 143233 }, "corpus": { "synthetic": 14797.0, "real": 96472.0, "self_traffic": 1102041.0, "by_class": { "self:home-isp-v4": 921220.0, "self:home-isp-v6-7b03": 120869.0, "real": 96472.0, "self": 22423.0, "self:mullvad-egress-v6": 19385.0, "synthetic": 14297.0, "self:mullvad-egress-v4": 9579.0, "self:home-isp-v6-7b08": 8565.0, "synthetic-loop": 500.0 } }, "mitre_top": [ { "technique": "T1595", "n": 102864.0 }, { "technique": "T1190", "n": 15895.0 }, { "technique": "T1105", "n": 13131.0 }, { "technique": "T1552", "n": 7284.0 }, { "technique": "T1110", "n": 2698.0 }, { "technique": "T1592", "n": 936.0 }, { "technique": "T1083", "n": 672.0 }, { "technique": "T1071", "n": 43.0 } ], "lanes": [ { "host": "m1", "ok": true, "models": 75, "approved": 3 }, { "host": "laptop", "ok": true, "models": 21, "approved": 4 }, { "host": "omen", "ok": true, "models": 30, "approved": 10 } ], "policy": { "verdict": "DRIFT", "rules": [ { "rule": "no-mounts", "ok": true, "violations": 0 }, { "rule": "mcp-registry", "ok": false, "violations": 14 }, { "rule": "secrets-hygiene", "ok": true, "violations": 0 }, { "rule": "secrets-source-m1", "ok": true, "violations": 0 }, { "rule": "host-role-map", "ok": true, "violations": 0 } ], "findings": 14 }, "docker_fresh": true, "freshness": { "fleet": null, "docker": null, "datastores": null, "domains": null, "connections": null, "honeypot": null, "ingestion": null, "services": null, "knowledge": null, "mcp": null, "policy": null, "tailscale": null, "memory": null, "changelog": null, "forum": null, "agents": null, "chains": null, "models": null, "reconstruct": null, "strikes": null, "docs": null, "rf": null }, "verified": { "status": "ok", "measured_at": "2026-11-02 12:00:01", "source": "ClickHouse on OMEN (honeypot.* + xcom_rf.*) — query published verbatim", "query": "SELECT 'measured' AS kind, toString(now()) AS a, '' AS b, '' AS c\nUNION ALL\nSELECT 'strike_totals', toString(count()), toString(uniqExact(run_id)), '' FROM honeypot.strike_runs\nUNION ALL\nSELECT 'strike_class', attack_class, toString(count()), toString(uniqExact(run_id)) FROM honeypot.strike_runs GROUP BY attack_class\nUNION ALL\nSELECT 'strike_outcome', outcome, toString(count()), toString(max(elapsed_ms)) FROM honeypot.strike_runs GROUP BY outcome\nUNION ALL\nSELECT 'strike_window', toString(min(fired_at)), toString(max(fired_at)), toString(uniqExact(path)) FROM honeypot.strike_runs\nUNION ALL\nSELECT 'rf', 'plc_measurements', toString(count()), '' FROM xcom_rf.plc_measurements\nUNION ALL\nSELECT 'rf', 'ble_observations', toString(count()), '' FROM xcom_rf.ble_observations\nUNION ALL\nSELECT 'rf', 'plc_spectral_v2', toString(count()), '' FROM xcom_rf.plc_spectral_v2\nUNION ALL\nSELECT 'rf', 'mesh_events', toString(count()), '' FROM xcom_rf.mesh_events\nUNION ALL\nSELECT 'rf', 'sigmf_captures', toString(count()), '' FROM xcom_rf.sigmf_captures\nUNION ALL\nSELECT 'rf', 'semantic_chunks', toString(count()), '' FROM xcom_rf.semantic_chunks\nUNION ALL\nSELECT 'rf', 'corpus_sources', toString(count()), '' FROM xcom_rf.corpus_sources_v2 FINAL\nUNION ALL\nSELECT 'rf', 'corpus_documents', toString(count()), '' FROM xcom_rf.corpus_documents_v2 FINAL\nUNION ALL\nSELECT 'rf', 'corpus_chunks', toString(count()), '' FROM xcom_rf.corpus_chunks_v2 FINAL\nUNION ALL\nSELECT 'rf', 'protocol_hypotheses', toString(count()), '' FROM xcom_rf.protocol_hypotheses\nUNION ALL\nSELECT 'rf', 'security_findings', toString(count()), '' FROM xcom_rf.security_findings\nUNION ALL\nSELECT 'rf', 'captures', toString(count()), toString(uniqExact(operation_id)) FROM xcom_research.rf_captures\nUNION ALL\nSELECT 'rf', 'capture_bytes', toString(sum(bytes)), '' FROM xcom_research.rf_captures\nUNION ALL\nSELECT 'rf', 'runs', toString(count()), toString(uniqExact(operation_id)) FROM xcom_research.rf_runs\nUNION ALL\nSELECT 'rf', 'runs_active', toString(countIf(mode != 'passive')), '' FROM xcom_research.rf_runs\nUNION ALL\nSELECT 'rf', 'experiments', toString(count()), toString(countIf(lab_authorized)) FROM xcom_rf.experiment_results\nUNION ALL\nSELECT 'rf', 'ble_sniff_channel', toString(min(sniffed_channel)), toString(count(DISTINCT sniffed_channel)) FROM xcom_rf.ble_observations\nUNION ALL\nSELECT 'rf', 'ble_dbm_measured', toString(count(rssi_dbm)), '' FROM xcom_bluetooth.ble_observation\nUNION ALL\nSELECT 'rf_band', toString(freq_mhz), toString(sample_rate_mhz), toString(duration_s) FROM xcom_research.rf_captures ORDER BY ts DESC LIMIT 1\nUNION ALL\nSELECT 'rf_quality', toString(round(max(clip_frac),4)), toString(round(max(duty_frac),4)), toString(round(min(duty_frac),4)) FROM xcom_research.rf_captures\nUNION ALL\nSELECT 'rf_finding', finding_id, source_key, '' FROM xcom_rf.security_findings ORDER BY created_at DESC LIMIT 1\nUNION ALL\nSELECT 'rf_hyp', mechanism, toString(round(confidence,2)), hypothesis_id FROM xcom_rf.protocol_hypotheses\nUNION ALL\nSELECT 'ble_shape', toString(uniqExact(access_address)), toString(uniqExact(sniffed_channel)), toString(dateDiff('second', min(observed_at), max(observed_at))) FROM xcom_rf.ble_observations\nUNION ALL\nSELECT 'ble_src', toString(uniqExact(source_key)), toString(uniqExact(sniffer)), toString(max(observed_at)) FROM xcom_rf.ble_observations\nUNION ALL\nSELECT 'ble_age', toString(round(dateDiff('minute', max(observed_at), now()))), '', '' FROM xcom_rf.ble_observations\nUNION ALL\nSELECT 'plc_shape', toString(uniqExact(section_from)), toString(uniqExact(loc)), toString(round(avg(tx_active_share),4)) FROM xcom_rf.plc_spectral_v2\nUNION ALL\nSELECT 'plc_window', toString(min(captured_at)), toString(max(captured_at)), '' FROM xcom_rf.plc_spectral_v2\nUNION ALL\nSELECT 'mesh_shape', toString(uniqExact(node_key)), toString(uniqExact(channel)), toString(countIf(duplicate_of != '')) FROM xcom_rf.mesh_events\nUNION ALL\nSELECT 'mesh_rssi', toString(round(avg(rssi),2)), toString(min(rssi)), toString(max(rssi)) FROM xcom_rf.mesh_events\nUNION ALL\nSELECT 'mesh_window', toString(min(observed_at)), toString(max(observed_at)), toString(dateDiff('second', min(observed_at), max(observed_at))) FROM xcom_rf.mesh_events\nUNION ALL\nSELECT 'sigmf_shape', toString(uniqExact(capture_id)), toString(count()), toString(countIf(synthetic)) FROM xcom_rf.sigmf_captures\nUNION ALL\nSELECT 'sigmf_freq', toString(max(frequency_hz)), toString(max(sample_rate)), toString(max(num_samples)) FROM xcom_rf.sigmf_captures\nUNION ALL\nSELECT 'sigmf_window', toString(min(datatype)), toString(max(observed_at)), '' FROM xcom_rf.sigmf_captures\nUNION ALL\nSELECT 'rfcap_state', toString(count()), toString(countIf(state = 'VERIFIED')), toString(countIf(state != 'VERIFIED')) FROM xcom_research.rf_captures\nUNION ALL\nSELECT 'rfcap_verified_quality', toString(round(max(clip_frac),6)), toString(round(max(duty_frac),4)), toString(round(min(duty_frac),4)) FROM xcom_research.rf_captures WHERE state = 'VERIFIED'\nUNION ALL\nSELECT 'rfcap_window', toString(min(ts)), toString(max(ts)), '' FROM xcom_research.rf_captures\nUNION ALL\nSELECT 'plc_seg', toString(section_from), toString(round(avg(tx_active_share),4)), toString(count()) FROM xcom_rf.plc_spectral_v2 GROUP BY section_from ORDER BY section_from\nUNION ALL\nSELECT 'plc_segloc', toString(section_from), toString(loc), '' FROM xcom_rf.plc_spectral_v2 GROUP BY section_from, loc ORDER BY section_from\nUNION ALL\nSELECT 'mitre_top6', mitre_technique, toString(count()), '' FROM honeypot.hp_events WHERE mitre_technique != '' GROUP BY mitre_technique ORDER BY count() DESC LIMIT 6\nFORMAT TSV", "strike": { "status": "ok", "measured_at": "2026-11-02 12:00:01", "source": "honeypot.strike_runs — query published verbatim (verified block)", "requests": 12, "distinct_runs": 1, "first_fired": "2026-10-19 17:41:09.098", "last_fired": "2026-10-19 17:41:09.098", "distinct_paths": 11, "by_class": { "secret_files": 6, "wp_exploit": 4, "panel_probe": 2 }, "by_outcome": { "timeout": { "requests": 12, "max_elapsed_ms": 5087 } }, "mitre_top6_total": 143233, "mitre_top6": [ { "technique": "T1595", "n": 103196 }, { "technique": "T1190", "n": 15955 }, { "technique": "T1105", "n": 13141 }, { "technique": "T1552", "n": 7291 }, { "technique": "T1110", "n": 2711 }, { "technique": "T1592", "n": 939 } ] }, "rf": { "corpus_sources": 58, "semantic_chunks": 9640, "sigmf_captures": 2, "corpus_documents": 4277, "protocol_hypotheses": 2, "security_findings": 2, "captures": 4, "capture_bytes": 48000016, "runs": 5, "runs_active": 0, "experiments": 1, "ble_sniff_channel": 22, "plc_measurements": 7194, "ble_observations": 66739, "ble_dbm_measured": 100, "mesh_events": 55179, "plc_spectral_v2": 3717287, "corpus_chunks": 9277 }, "spectrum": { "captures": 4, "capture_ops": 4, "capture_bytes": 48000016, "runs": 5, "runs_active": 0, "band_mhz": "433.92", "sample_rate_mhz": "4", "duration_s": "2", "clip_frac_max": "0", "duty_frac_max": "0.1961", "duty_frac_min": "0.15", "ble_sniff_channel": 22, "ble_channel_count": 1 }, "dbm_measured": 100, "hypotheses": 2, "findings": 2, "finding_id": "fin-pd-plc-channel-degradation#infinity-link", "finding_source": "plc_mv_cable_diag", "experiments": 1, "experiments_authorized": 0, "hyp_rows": [ { "mechanism": "side-channel-coupling", "confidence": 0.25, "id": "hyp-rf-honeypot-correlation" }, { "mechanism": "PLC", "confidence": 0.9, "id": "hyp-pd-generates-plc-throughput-drop" } ], "rf_lanes": { "ble": { "query": "SELECT count(), uniqExact(access_address), dateDiff('second', min(observed_at), max(observed_at)), max(observed_at) FROM xcom_rf.ble_observations", "stage": "live", "stage_note": "link-layer", "source_table": "xcom_rf.ble_observations", "measured_at": "2026-10-29 12:16:12", "frames": 66739, "devices": 18, "channels": 1, "window_s": 24, "age_min": 5744, "sources": 1, "sniffers": 2 }, "plc": { "query": "SELECT count(), uniqExact(section_from), min(captured_at), max(captured_at) FROM xcom_rf.plc_spectral_v2", "topology_query": "SELECT section_from, loc, round(avg(tx_active_share),4), count() FROM xcom_rf.plc_spectral_v2 GROUP BY section_from, loc ORDER BY section_from", "segments": [ { "s": "00", "loc": "loc01", "tx": 0.0651, "n": 63692 }, { "s": "01", "loc": "loc01", "tx": 0.1164, "n": 63694 }, { "s": "02", "loc": "loc01", "tx": 0.0551, "n": 63694 }, { "s": "03", "loc": "loc01", "tx": 0.0697, "n": 63694 }, { "s": "04", "loc": "loc01", "tx": 0.308, "n": 127392 }, { "s": "05", "loc": "loc01", "tx": 0.0395, "n": 112501 }, { "s": "06", "loc": "loc02", "tx": 0.0389, "n": 47351 }, { "s": "07", "loc": "loc02", "tx": 0.0795, "n": 47351 }, { "s": "08", "loc": "loc02", "tx": 0.0106, "n": 47351 }, { "s": "09", "loc": "loc02", "tx": 0.0089, "n": 47351 }, { "s": "10", "loc": "loc02", "tx": 0.2224, "n": 47351 }, { "s": "11", "loc": "loc02", "tx": 0.1743, "n": 47351 }, { "s": "12", "loc": "loc02", "tx": 0.2009, "n": 47351 }, { "s": "13", "loc": "loc02", "tx": 0.1902, "n": 47351 }, { "s": "14", "loc": "loc02", "tx": 0.0614, "n": 47351 }, { "s": "15", "loc": "loc02", "tx": 0.1043, "n": 47351 }, { "s": "16", "loc": "loc03", "tx": 0.3059, "n": 234947 }, { "s": "17", "loc": "loc03", "tx": 0.1761, "n": 123397 }, { "s": "18", "loc": "loc03", "tx": 0.0947, "n": 61679 }, { "s": "19", "loc": "loc03", "tx": 0.1557, "n": 177149 }, { "s": "20", "loc": "loc03", "tx": 0.1061, "n": 123364 }, { "s": "21", "loc": "loc03", "tx": 0.0896, "n": 185052 }, { "s": "22", "loc": "loc03", "tx": 0.0148, "n": 115472 }, { "s": "23", "loc": "loc03", "tx": 0.1397, "n": 177159 }, { "s": "24", "loc": "loc03", "tx": 0.1682, "n": 115474 }, { "s": "25", "loc": "loc03", "tx": 0.0755, "n": 123370 }, { "s": "26", "loc": "loc03", "tx": 0.1214, "n": 177159 }, { "s": "27", "loc": "loc03", "tx": 0.1241, "n": 115476 }, { "s": "28", "loc": "loc01", "tx": 0.1614, "n": 118046 }, { "s": "29", "loc": "loc01", "tx": 0.0819, "n": 127379 }, { "s": "30", "loc": "loc01", "tx": 0.0222, "n": 127380 }, { "s": "31", "loc": "loc03", "tx": 0.381, "n": 99562 }, { "s": "32", "loc": "loc03", "tx": 0.257, "n": 99564 }, { "s": "33", "loc": "loc03", "tx": 0.2525, "n": 99564 }, { "s": "34", "loc": "loc03", "tx": 0.2699, "n": 99259 }, { "s": "35", "loc": "loc03", "tx": 0.2721, "n": 99544 }, { "s": "36", "loc": "loc03", "tx": 0.0739, "n": 99662 }, { "s": "37", "loc": "loc03", "tx": 0.1605, "n": 49452 } ], "stage": "corpus", "stage_note": "historische dataset", "source_table": "xcom_rf.plc_spectral_v2", "measured_at": "2019-02-05 09:30:00.000", "rows": 3717287, "sections": 38, "locations": 3, "tx_active_share_avg": 0.1487, "window_first": "2017-04-12 13:00:00.000", "window_last": "2019-02-05 09:30:00.000" }, "mesh": { "stage": "live", "stage_note": "rssi gemeten", "source_table": "xcom_rf.mesh_events", "measured_at": "2026-10-29 12:26:55", "rows": 55179, "nodes": 27, "channels": 2, "duplicates": 17342, "rssi_avg": -93.87, "rssi_min": -111, "rssi_max": 0, "window_s": 208 }, "sigmf": { "stage": "pilot", "stage_note": "synthetisch", "source_table": "xcom_rf.sigmf_captures", "measured_at": "2026-10-29 12:18:21", "captures": 1, "rows": 2, "synthetic_rows": 2, "frequency_hz": 10000, "sample_rate_hz": 250000, "num_samples": 48000, "datatype": "cf32_le" }, "captures": { "stage": "live", "stage_note": "433,92 MHz", "source_table": "xcom_research.rf_captures", "measured_at": "2026-10-29 18:53:21", "rows": 4, "verified": 3, "partial": 1, "clip_frac_max_verified": 0, "duty_frac_max_verified": 0.1961, "duty_frac_min_verified": 0.1597, "window_first": "2026-10-29 18:25:14", "window_last": "2026-10-29 18:53:21" } } }, "null_means": "not measured — never rendered as zero", "_notes": { "hosts": "physical/virtual hosts in the estate", "datastores_live": "live datastores indexed", "datastores_bytes": "live datastore footprint (bytes)", "mcp_servers": "MCP endpoints registered and probed", "docker_containers": "docker containers observed", "docker_images": "docker images present", "docker_volumes": "docker volumes retained", "domains": "domains under management", "domain_records": "DNS records observed", "connections": "datastore connection edges mapped", "ingested_datasets": "ingested datasets", "ingested_bytes": "ingested volume (bytes)", "services_total": "host services inventoried", "hp_requests": "honeypot requests captured", "hp_events": "honeypot events stored", "hp_credentials": "credential pairs captured", "hp_sessions": "distinct attacker sessions", "hp_uploads": "payload uploads captured", "hp_payloads": "payloads preserved as artefacts", "hp_sensors": "honeypot sensors live", "hp_saved_bytes": "capture store (bytes)", "agents_total": "agents declared", "agents_active": "agents active", "agents_retired": "agents retired", "agents_crew": "crew SPECs", "agents_instances": "invocable agent surfaces", "agents_xcom": "XCOM agents", "agents_vscode": "VS Code chat agents", "chains_total": "attack/recon chains in the arsenal", "chains_frozen": "chains frozen by policy", "chains_opid": "chains emitting operation_id", "chains_war": "war chains", "chains_recon": "recon chains", "chains_orchestrator": "orchestrators", "chains_helper": "helpers", "models_total": "model tags across the lanes", "models_cloud": "cloud model tags", "models_local": "local model tags", "models_local_bytes": "local model weights (bytes)", "models_approved": "roster-approved agent models", "model_lanes_ok": "live model lanes", "docs_total": "authored markdown documents", "docs_registered": "docs registered in the digest", "docs_chapters": "documentation chapters", "corpus_rows": "reconstructed command rows", "corpus_events": "unique reconstructed events", "corpus_confidence": "mean reconstruction confidence", "corpus_classes": "data classes present", "corpus_opid_pct": "synthetic operation_id coverage %", "strike_sessions": "honeypot sessions in the strike corpus", "strike_events": "honeypot events in the strike corpus", "strike_mitre": "strike events carrying a technique", "strike_runs": "recorded strike runs", "strike_registry": "registered attack chains", "hp_live_events": "live (non-archive) events", "hp_live_sensors": "sensors emitting live", "hp_ai_leaks": "AI/LLM exposure strings captured", "hp_edge_requests": "edge requests logged", "hp_lag_hours": "live-ingest lag (hours)", "knowledge_declared": "knowledge sources declared", "knowledge_have": "knowledge sources present", "knowledge_coverage_pct": "declared coverage %", "knowledge_chunks": "retrieval chunks", "knowledge_chars": "indexed characters", "knowledge_missing": "declared sources missing", "memory_rows": "memory events stored", "memory_24h": "memory events last 24h", "memory_categories": "memory categories", "memory_lessons": "lessons learned", "memory_reasoning": "reasoning traces", "memory_semantic_indexed": "lessons in the semantic index", "memory_semantic_eligible": "lessons eligible for semantic indexing", "forum_topics": "forum topics held", "forum_posts": "forum posts held", "forum_categories": "forum categories", "forum_coverage_pct": "forum ingest coverage %", "rf_plc_spectral": "PLC spectral measurements", "rf_mesh_events": "mesh (BLE/802.15.4) events", "rf_ble": "BLE observations", "rf_semantic_chunks": "RF semantic chunks", "rf_sigmf": "SigMF captures preserved", "alerts_unack": "unacknowledged honeypot alerts", "payloads_total": "preserved payload artefacts", "docker_age_s": "docker collection age (seconds)" } }