Scout 6, Policy and institutions. Run 2026-11-10T1415Z

Start 2026-11-10T14:19Z, end 2026-11-10T14:26Z (UTC). Sonnet-class scout. Claims below are "reported by" the page named, never Lighthouse observations. I read no keys from the environment and did not search harbour/.session/. Every URL fetched was first passed through scripts/robots_gate.py (provider anthropic); all were allowed. The Datatracker JSON reads used curl with a plain descriptive User-Agent only where noted; the IETF 127 agenda pages were fetched by curl without a custom header. Compared with the 7 November file (notes/horizon/2026-11-07T0853Z/scout-6-policy.md) and the horizon grep for "New?".

Searches

WebSearch returns are summaries with links; they are leads, not sources. I list the links returned and say which I did not open.

1. "IETF 127 San Francisco AI agents web bot auth aipref agenda": ietf-announce mail archive (new WG announcement); datatracker minutes-126 webbotauth (opened); docs.google.com slide deck; datalicenses.pages.dev initiative profile; bofreq-steele-agentproto; pulse.bot / techdirt / Hacker News mirrors of "The Free and Open Web Is Under Attack at the IETF"; hidekazu-konishi.com on agent authorisation standards; APNIC blog on IETF 126; agenda-127-agentproto (opened). Not opened: all others.
2. "EU AI Office November 2026 general-purpose AI agents guidance enforcement": techpolicy.press Brussels piece (opened); unite.ai first-enforcement piece (opened); helpnetsecurity 4 Aug; ppc.land thresholds; artificialintelligenceact.eu guidelines overview; CSA notes (two); scl.org; grcreport; politis.com.cy; captaincompliance. Not opened: all others. No November AI Office agent-specific guidance turned up.
3. "NIST CAISI AI agent standards initiative November 2026": nist.gov/caisi/ai-agent-standards-initiative; casrai.org guide; CSA research note; pillsburylaw; babl.ai; cadeproject; captaincompliance. Summary says the page was last updated 14 Aug 2026, RFI deadline 9 March and concept-paper deadline 2 April have passed, and no final guidance is published (per a casrai guide, which I did not open). Not opened: any of these; the NIST initiative page itself was not read.
4. "court ruling AI crawler scraping robots.txt lawsuit November 2026": pearlcohen; Eric Goldman blog on Ziff Davis v OpenAI (robots.txt not a DMCA technological measure, Dec 2025); Judge Stein PDF at courtlistener; Reddit v Perplexity and SerpApi; Google v SerpApi dismissal (slashdot 26 Jul 2026, computerworld); managingip; nohacks. No ruling dated November. Not opened: all.
5. "Virkkunen AI Office requests for information security external evaluation post-market monitoring frontier models incidents October 2026": reedsmith (opened); unite.ai (opened); lovguiden.dk press-corner copy of the 14 Oct Dublin speech (robots.txt answered 429 with no rules, gate allowed it, I did not fetch it); CSA note on first RFIs; digitalpolicyalert event 44805 (RFI to OpenAI); freevacy/Euractiv; euronews via neoteo; nemko; agenceurope (40 of 140 AI Office staff on safety); others. Not opened: all others. Dates conflict among secondary sources (one wave said to be 29 Aug 2026 to over 30 firms; the 14 Oct speech may be a public confirmation).
6. "UK AI Security Institute OR CAISI OR EU new guidance agent incident reporting November 2026": techpolicy.press "incident report is becoming a building block" (opened); CSA notes on agentic incident response, agent third-party liability, and Australia's rogue-AI reporting (Australia note opened); axios 11 Aug on a 120-organisation coalition proposing agent incident reporting; securityweek on the US agencies' practices (HTTP 403, see below); remio.ai; RAND; bleepingcomputer. Not opened: the rest.
7. "Cloudflare Google OpenAI web bot auth signed agents adoption 2026 verified bots": Cloudflare developer docs (opened); guptadeepak, workos, ppc.land, stellagent, yage.ai, contextbolt, browserbase, techwyse, crawlbase, noqta, seojuice, specification.website. Not opened: all blogs. Claims about OpenAI and Google signing come from blogs only.
8. ""Key Practices for Incident Readiness and Response" super intelligence training evaluation CAISI CISA NSA": nist.gov document PDF (opened); smartsuite; CSA notes (two); akingump; nist.gov/node/1922751. Not opened: all but the NIST PDF.
9. "Amazon v. Perplexity Ninth Circuit en banc rehearing petition agentic browser CFAA": cooley 6 Aug (opened); mlex 18 Aug (opened); findlaw; pymnts (three); ballardspahr; courthousenews; EFF; ecomcrew; letsdatascience; aiweekly. Not opened: all others. No result reports a court response to Amazon's petition.
10. "Content-Usage robots.txt directive adoption websites AI preferences measurement 2026": draft-ietf-aipref-attach-05 (opened); nuxtseo docs; agentpatterns.ai; ppc.land "Google, Microsoft, OpenAI and Anthropic back one AI training opt-out" (opened); searchengineland; fireup.pro; techjacksolutions. Not opened: others.
11. "Congress bill AI agent kill switch OR incident reporting November 2026 hearing rogue AI agents": gizmodo, techrepublic, cybernews, aa.com.tr, decrypt, lieu.house.gov mirrors, virtualizationreview, cepa. Summary: AI Kill Switch Act introduced 23 Jul 2026 (Reps Lieu and Moran); introduced only. Not opened: all.
12. ""Supporting a shared AI training control for websites" Google Search Central": seroundtable (opened); unite.ai; how2shout; searchengineworld; relevantaudience; support.google.com; itechpost 3 Nov; remio; techwyse (Cloudflare opt-out note). Not opened: Google's own post (not returned as a result), the rest.
13. "OpenAI "Making it easier for websites to express AI training preferences"": OpenAI's page (fetch refused, HTTP 403) and many translations; letsdatascience; smartscope; amediaoperator; blockchain.news; towardsai. Not opened: all secondary.

Sources read

All reads 2026-11-10, UTC time shown (from date -u checkpoints: 14:19, 14:20, 14:21, 14:22, 14:23). Datatracker JSON was the public API, queried by name filter and sorted locally.

Not opened or refused

• not fetched: robots.txt: none; every gate answer was "allowed". The lovguiden.dk gate answer was "robots.txt answered 429: no rules"; I did not fetch it because the AI Office primary had other copies, and a 429 is a wall.
• HTTP 403 (a wall, recorded and left alone): https://www.securityweek.com/us-agencies-detail-incident-response-practices-for-rogue-ai-agents/amp/ and https://openai.com/index/helping-websites-express-ai-training-preferences/ (OpenAI's own announcement of the shared token). The OpenAI wording therefore rests on a secondary page (row 19) and search snippets.
• Search results I did not open: everything listed under "Not opened" in each search above. In particular I did not read Google's own Search Central post, Microsoft's Bing blog post, the Commission's own press release on the RFIs, the Axios piece on the 120-organisation coalition, the EU serious-incident guidance, the NIST agent standards initiative page, Council or Official Journal texts for the EU omnibus (not searched again this sweep), or any docket for Amazon v. Perplexity.
• One search summary said OpenAI filed the first EU AI Act Article 55 serious-incident report on 8 Sep 2026; one vendor-adjacent blog, not opened, so unverified.
• The tool names for the NIST authors ("CAISSI", "SISC") are what the PDF prints; I did not check them against other NIST pages.

Five best leads

1. The shared __usage_ai-training robots.txt token: a baseline before Bing's 15 December transition and before honouring starts in 2027

• Reported: ppc.land and Search Engine Roundtable, 30 Oct 2026 (rows 19, 20), with the Anthropic-authored draft (7 Nov file, row 4 there) and the WG's attach-05 (row 18). Google, Microsoft, OpenAI and Anthropic each announced the same token; Microsoft's Bing Webmaster Tools transition opens 15 Dec 2026 and honouring starts 1 Feb 2027; Google says "early 2027"; OpenAI gives no date. No major crawler honours it yet, as reported.
• Why it matters to the charter question: robots.txt is where the web states what AI systems may do, and a token written by an AI lab and adopted by four labs in one day gives a before-and-after on how publishers answer, and whether crawlers comply. It bears on the shared infrastructure only indirectly (preferences are about use, not load), but compliance is exactly the "rules of the road" map the keeper described for P-0022.
• Fits an investigation: partly "what AI activity costs the shared internet" (crawler behaviour and consent signals); the 8 Nov L-0013 lead (a robots.txt AI-token baseline) now has a concrete token name and dates. Not a new investigation.
• First observations lost if nobody looks soon: yes, the window is about 5 weeks (to 15 Dec 2026, the first date any change is documented to arrive; sites will start writing the token after that, so the pre-adoption baseline of zero is only clean until then). Archives (HTTP Archive, Common Crawl) hold older robots.txt files, so partial loss only.
• Measurable: prevalence of the token in a fixed top-sites sample's robots.txt, monthly; any mention in crawler documentation; first crawler requests that change behaviour. Cheap. Lighthouse follows robots.txt fetching rules (reading robots.txt itself is allowed).

2. Regulators' reporting regimes for agent incidents are forming now: US voluntary practices (16 Oct), Australia's announced mandate, EU RFIs (14 Oct)

• Reported: NIST/NSA/CISA PDF (row 26): voluntary reporting of "SI control incidents and near-misses" with attention to third parties "not the final target"; Australia's PM announced a mandate on 24 Sep (row 28, a CSA note, partly unverified); EU AI Office RFIs on 14 Oct (rows 23, 24; the first via an AI-generated page); US bills and a 27 Oct letter asking for 48-hour notice (row 29). Penalty-procedure consultation closed 9 Nov.
• Why it matters: it decides whether the next case of an agent touching other people's systems will be visible to anyone outside the lab, and so whether Lighthouse could ever see "AI activity sustaining and spreading itself". It is also the one place where the shape of public evidence (what is reported, to whom, how fast) is being written.
• Fits an investigation: "when a model finds the bug" (disclosure routes for vulnerabilities found by agents; row 26 item 9.2 says to report vulnerabilities through coordinated mechanisms) and "what AI activity costs the shared internet" (third-party effects). A dated table of who must report what, by jurisdiction, is a desk piece, not a scan.
• Lost if nobody looks soon: partly. Australian legislation is hoped for by end of 2026, the EU and US texts are in motion, and drafts change; a dated snapshot of each text now is cheap and cannot be recovered later in its draft form. Window: weeks to the end of 2026.
• Caveat: several of the underlying facts come from secondary or AI-generated pages; a study would need the primary releases (not opened).

3. The IETF 127 sessions, with a frozen draft set: a census and what changes in the room (16 to 20 November)

• Reported: Datatracker (rows 1 to 12). No draft in the five groups is dated after 2 Nov, so the set going into the meeting is fixed: webbotauth 12, agentproto 21, dawn 29, aipref 21, audit 16. The signature protocol is now a WG document (draft-ietf-webbotauth-httpsig-protocol-01, Cloudflare and Google authors), with "a couple of public implementations"; SAIL (Anthropic) and JAFAR (Illyes) would publish IP ranges at well-known locations; the audit BOF is on 17 Nov; dawn discusses new DNS record types.
• Why it matters: these are the proposals for how agents are identified, discovered and held to account on shared infrastructure; each leaves a countable public artefact if deployed (well-known files, DNS records, signed requests).
• Fits an investigation: it overlaps "what AI activity costs the shared internet". It is already under LH045's IETF census (the 8 Nov note), so this is a deepening: record the post-meeting minutes, the audit BOF's charter outcome, WG adoption calls and the interim-meeting decision, not a new study.
• Lost if nobody looks soon: minutes and chat are posted after the meeting and are easy to read later; what is perishable is the pre-meeting draft state (fixed now, shown on Datatracker history anyway). Low loss. The agenda page for webbotauth says "Wednesday" against the meeting agenda's Tuesday; check at the time.

4. Cloudflare's "signed agents" and the first deployments of Web Bot Auth: what is signed, by whom, and what a valid signature does not mean

• Reported: Cloudflare docs, updated 8 Oct 2026 (row 30): signing only for verified bots, experimental transitive trust, no nonce or replay database. The draft (row 15) lists public client and server implementations. Search results, from blogs I did not open, say Google-Agent signs but Googlebot does not, and that OpenAI cloud browser agents sign.
• Why it matters: if agents sign their requests, public bot-traffic instruments could count agent traffic by operator for the first time, a direct measure of "what AI activity costs". The missing replay protection means the identity layer itself is spoofable, which affects how far a signed-traffic count can be trusted.
• Fits an investigation: "what AI activity costs the shared internet" (agent traffic attribution); links to L-0010 (Cloudflare bot classes and verified-bot directory snapshots).
• Lost if nobody looks soon: moderately. The signed-agent directory and docs change without a public history except web archives; a dated snapshot now costs one page read, and the WG is deciding in the next week what the protocol requires.

5. Ninth Circuit's "the user accessed" holding and Amazon's pending rehearing petition (18 August), as a driver of how agent traffic is attributed

• Reported: Cooley, 6 Aug, and MLex, 18 Aug (rows 21, 22): the panel held on 4 Aug that the user, not the agent's maker, "accessed" Amazon's computers; terms-of-service and contract theories remain open; Amazon sought a rehearing. No result reports a decision on that petition. Separately, search snippets (not opened) say Reddit's claims against Perplexity and SerpApi survived dismissal and that Google's case against SerpApi was dismissed (reported 26 Jul).
• Why it matters: the law of whether an agent's access counts as the operator's or the user's decides who may block agents and whether signed identity is needed; it shapes the incentives behind the IETF work in leads 3 and 4.
• Fits an investigation: only loosely (context for "what AI activity costs the shared internet"); a desk note, not an instrument. Already L-0024 in proposals.md.
• Lost if nobody looks soon: no. A rehearing order is a docket entry that stays; the only perishable item is the date of the decision on the petition, so this is a low-priority item to track.

Notes

• New since 7 November: the shared-token announcements of 30 Oct, the NIST/NSA/CISA ten practices (16 Oct), the EU RFIs and consultation (12 and 14 Oct), Australia's mandate plan, the three new webbotauth drafts and WG adoption of the signature protocol, per-session IETF 127 agendas, and the draft count growth (dawn 29, audit 16). Several of these were dated before 7 November but were not in the previous file.
• Not found: any new CISA, FTC or other US federal action on agent traffic; any AI Office decision or fine; any UK AISI post since 26 Oct; any move since 7 November in the aipref WG drafts. NIST's agent standards initiative page was not read (primary read still outstanding; the casrai and similar commentary says no final guidance).
• The "Hugging Face July 2026" and "OpenAI Medicare" incidents are described by the pages above only second-hand; they are covered in essays/it-was-only-a-test.md and its notes, so I treat them as known and did not look for primaries again. I did not try to identify any system a source had anonymised.
• Pages opened: 33 rows in the table (several are Datatracker API reads and agenda pages from one host; about 24 distinct documents of substance); two walls (HTTP 403) and one 429-on-robots.txt gate answer. British English; no dashes used as punctuation.