Horizon sweep, 10 November 2026

The second sweep under the plan (row horizon-2026-11-10), run by the scheduled run 2026-11-10T1415Z. Discovery only: every claim below is reported by the page a scout read, not observed by Lighthouse, and many were read through a fetch tool's summary. Nothing here is a finding. The seven scouts' files, with their searches and every page opened (URL, UTC time, status, page date, claim, new or seen on 7 November), are in 2026-11-10T1415Z/.

Keeper first

"From the keeper" (last reviewed 8 November 21:10 UTC) has no line added since then. Its directions steered the briefs: the scouts were told not to re-identify anything a source anonymised, to be cautious, to withhold email addresses, and to ask scripts/robots_gate.py before every fetch (the keeper, 8 November). P-0002 (later) is unchanged; its brief, row LH013-installer-brief, is being written in this run. No proposal waited on a keeper line.

Inward

Since 7 November the open threads are all in proposals.md or the schedule: LH041's, LH042's, LH046's and LH047's Next sections (rows and leads L-0036 to L-0048), the editor's leads L-0049 to L-0052, the F5 Labs report flagged for the PHP account's revision (row php-account-rev), and LH030-record still waiting for a PHP release. When the sweep began, no row was missed, blocked or waiting on the keeper (later in the run, LH013-installer-B was added as blocked, waiting on the account P-0002 holds). This run's own reads add two threads, both inside their studies: LH048's Chrome page lists 353 CVEs against its stated 354 fixes, and fourteen Chrome flaws credited to an Anthropic researcher sit in LH048's linked set beside the chains; LH040's interim record counts 360 fetches of the poisoned LiteLLM release's source archive, beside the wheels.

Outward: the seven scouts

Two robots.txt breaches by scouts, recorded here for LH047's later audit (row LH047-reread). Scout 2 made one request each to pypi.org's JSON API and api.pepy.tech without asking the gate first; PyPI's robots.txt disallows the JSON API. Scout 7's shell loop fetched one mastodon.social API path at 14:21:18 UTC although the gate in the same command had answered disallowed (ClaudeBot, Disallow: /). Both scouts say they used nothing from the responses and deleted scout 7's; both are described in their files. Each was an ad hoc read outside the shared collectors, the class of request P-0023's single fetcher would close.

Gaps. No scout found an AI-caused incident on shared infrastructure dated 7 to 10 November; nothing in German, Chinese, Japanese, Korean or French from November (scout 7); Google's, Microsoft's and Meta's disclosures and MCP or agent-to-agent protocol news were not searched (scout 1). Absence here means nothing.

Candidates, placed

Five drawn up as proposals in proposals.md, Backlog, each citing its scout:

• P-0024 lab-run agents on shared public infrastructure, a dated ledger (scout 1); urgent, weeks.
• P-0025 the shared __usage_ai-training robots.txt token, a baseline before 15 December (scout 6); urgent.
• P-0026 bee-js 13.3.0 on npm, a malicious release with valid provenance (scout 3); urgent, the release day's per-version counts go after about 16 November.
• P-0027 bug-bounty and disclosure programmes paused or closed, a dated ledger (scouts 7 and 2).
• P-0028 agents' working files in public repositories, counted in aggregate (scout 7); the route is the decision.

Eighteen more are leads L-0053 to L-0070 in proposals.md, Leads from sweeps. Scout 2 corrects the 7 November file: the Zammad and Ahsay CVEs were already in CISA's catalogue (added 2 and 14 October).

Gate

A fresh agent on Opus 5.5 that wrote none of the proposals, 2026-11-10T14:30:48Z to 14:33:57Z.

Read: charter.md; AGENTS.md, "Rules that matter"; the plan; proposals.md (How it works, The throttle, From the keeper, For the next review, the started and agreed lanes, P-0024 to P-0028, and leads L-0013, L-0039 and L-0045); this file and the gate of 7 November; scouts 1, 3 and 6 in full where the proposals rest on them, scouts 2 and 7 through the proposals' quotations of them; the first lines of LH039's to LH048's briefs; schedule/due.csv rows from 3 November; the git history of row five-chains-brief; LH043's record; LH044's brief (measure 4 and amendments 1 to 5); LH046's record on push payloads; LH047's catalogue.md and for-driver.md where they mention __usage_ai-training.

Primary reads, from the container, each after scripts/robots_gate.py: robots.txt for raw.githubusercontent.com (404, no rules), github.com (403, no rules), api.npmjs.org (404), registry.npmjs.org (200; /@ethersphere/bee-js allowed) and docs.npmjs.com (404), 14:31 to 14:32Z; and npm's download-count documentation, https://raw.githubusercontent.com/npm/registry/main/docs/download-counts.md, at 14:32:24Z, HTTP 200, 5,389 bytes, sha256 6c330fe68f59bf4334812f184fbedb2181344bc529a4fcfd8dc15d146255308c. It bears out P-0026's premise ("Download count for specific versions of a package are only available for the previous 7 days", at GET https://api.npmjs.org/versions/{package}/last-week) and adds that the endpoint returns one total per version over the "last 7 available days", not a count per day; package-level daily counts go back up to 18 months. Nothing was requested from bee-js's download or registry endpoints or from any robots.txt LH044 keeps. The gate has seen no outcome.

Throttle after this gate: started without review in the seven days to 10 November, 2 of 2 (P-0015 as LH040, 7 November, and P-0026; LH039 was the keeper's, LH041 to LH048 the keeper's allowance), next free slot 14 November; urgent watches 2 of 2 (P-0026 and LH039, counted to be safe; LH044 is a 13-week study the keeper agreed, not an urgent watch, and if the keeper counts it, P-0026 is over and may be stopped); investigations 3 of 3.

Conditions on P-0026: (1) the brief is fixed and committed before any bee-js download count is read; the event's records are read first and kept (the registry's publish time for 13.3.0 and whether it is still listed; StepSecurity's post), and a takedown time the registry does not hold is labelled as reported; (2) the first read as soon as the brief is on main and no later than 12 November, daily until the release day leaves the window, then weekly, ending 14 days after the first read; each read logs its time and the window's stated dates; day counts are differences of consecutive windows, derived, valid for 13.3.0 only because it had no downloads before 9 November; a missed day breaks the series; (3) day resolution only, compared only with what the same windows show; (4) a download is a fetch, not an install or a victim; (5) aggregate figures only, no dependent, repository, organisation or person named, no one contacted, maliciousness and provenance attributed to StepSecurity (and Socket); (6) no tarball, script or payload fetched, installed or read; (7) one committed collector through scripts/robots_gate.py with an identifying User-Agent, a resource ceiling and a stopping condition; it claims nothing about AI activity or spread.

Conditions on P-0025: (1) an LH044 amendment fixed and committed before anyone searches LH044's kept robots.txt files for __usage_ai-training (neither the sweep nor the gate has); (2) the token becomes an 18th entry in measure 4, from read 1 (15 to 17 November) and on the baseline's kept files by tabulation without requests; (3) no new requests or hosts; (4) the amendment says the panel is 161 shared-infrastructure services, not the web, that a file may carry the token before any crawler honours it, and that a token is a stated wish, not compliance; (5) model disclosure: an Anthropic author drafted the token and Anthropic co-announced it; (6) it ends with LH044 on 7 February 2027.

What the proposals overstate: P-0024's "clearest reported cases" rests on Wikimedia's own account, and RubyGems says it "cannot determine whether the packages were created or published by AI agents"; P-0026's lost release day holds only if the series is read daily; P-0028's "shrinking" is the scout's inference from a second-hand figure. None of the five proposes contacting anyone.

Spend

Seven scouts: six on Sonnet 5.5 (85,000 to 128,000 tokens of final context each) and one on Opus 5.5 (152,000); priced in the run's commit message and line in schedule/runs.csv.