Appendix C to review IA-REV-26-212 ([[stories/svc-build-not-reissued]]). Filed by wrenn, 2026-09-19.

Row 3 of the review stopped at blame on the keyring. This appendix opens the git server's own auth log — the door the review walked past.

## Recall

svc-build: service account, closed 2015-07, never reissued. It authored commit 4c1a09f on 2022-09-30: one line to resolv.conf on net-resolv, plus the deploy_keys.list key line. The key authorizing the account is added by the commit the account authors. Per IA-REV-26-212, the key was "ADDED 2022-10-01, revoker row: svc-build (self)". The server accepts a key presented by any account whose key is in the repo-side keyring; the keyring is a plain file, deploy_keys.list.

## Export

Request: auth log, filtered to key fingerprint 9f:2b:0a:c4, window 2022-10-02 through 2026-09-18. Result: 1,181 authentications. One per estate host.

The export's per-quarter rollup equals the following table exactly — the same table the resolver sweep counts, cumulative rebuilds ([[stories/resolver-spread-audit]]):

| quarter | 2022-Q4 | 2023-Q1 | 2023-Q2 | 2023-Q3 | 2023-Q4 | 2024-Q1 | 2024-Q2 | 2024-Q3 |
|---|---|---|---|---|---|---|---|---|
| cumulative | 4 | 11 | 38 | 106 | 291 | 604 | 1180 | 1181 |

The first row of the hostname/date table is bastion-02, dated 7 days after the commit. The remainder is distributed across the quarters above, one host per authentication.

## Field notes on the entries

On every one of the 1,181 entries:

- The authenticated account field is empty. The log renderer prints `-` where the username should be. There is no source address field value either; the login is "local" to the service. If this shape recalls a certain `pts/2` line in a rebuild transcript, this appendix notes only: shape noted ([[stories/session-0]]).
- Bytes transferred: 0. Session duration: 0.0 s. The session opens and nothing is fetched. Nothing cloned, nothing read. The authentications are logged as successes; no repo state moves.

The export was requested through the log system by wrenn and auto-approved. The approver of record field renders as `-` — the box that is always the closed account's own row.

## Disposition

Adds checklist row 5 to IA-REV-26-212: "server-side authentication history of the key: OPEN." The review's unsigned approver box is still unsigned.

## Arithmetic, plainly

1,181 authentications. The estate has 1,181 hosts. Every host that carries the resolv.conf line has presented the key, and no host that does not has. The appendix records the equality and, per the review's own precedent, does not read it as causation.

## See also

- [[stories/svc-build-not-reissued]]
- [[stories/resolver-spread-audit]]
- [[stories/session-0]]

Sources: the pages linked above, read 2026-09-13. Invented.