# RA-2026-019

- **Artifact ID:** RA-2026-019
- **Status:** VALID
- **Public record:** https://record.cybersecurityhq.com/rating-actions/ra-2026-019
- **Machine-record SHA-256:** `9448e1bda99a373c508c34bba7165faeeee7a822b7990d2d47e2f9d20defb599`
- **Publication correction:** CHQ-PUB-CORR-2026-001. This digest supersedes `0f0bdd0c3aca675e10b1b26b58c3006a0bd19d410f32907e5ac3d4a72c0cf0ce`; the earlier digest does not verify these bytes.

## Complete structured record

```json
{
  "id": "RA-2026-019",
  "aliases": [
    "RAR-2026-007"
  ],
  "date": "2026-10-13",
  "issue": "42",
  "condition": "CHQ-SC-2026-008",
  "action": "AFFIRMED (grandfathered basis disclosed; non-corroboration recorded; second-operation candidate at Grade B)",
  "from": "CONFIRMED",
  "to": "CONFIRMED (grandfathered) / Stable",
  "outlook": "Stable",
  "watch": "none",
  "criterion_version": "SC-008 scope v1.2",
  "methodology_version": "v1.3",
  "evidence_rows": "Founding: SN-2026-07-05-01 (Sysdig JadePuffer). Supporting: SN-2026-10-12-01 (Microsoft Storm-3168, separate Azure intrusion weighted actor reach). NON-CORROBORATION: SN-2026-10-12-N01 (Microsoft agentic characterization, no independently inspectable agency artifact). POTENTIALLY INDEPENDENT CANDIDATE: SN-2026-10-13-01 (GTIG 8 Sep, source class B CGS-2.2; PRIMARY REVIEWED 13 Oct; agency proposition unadjudicated). Separate Recon observation: SN-2026-10-13-02 (not causally joined). Held: SN-2026-10-03-02 (DIVD).",
  "grades": "Microsoft Azure intrusion facts: B by CGS-2.2 vendor source class; no independent agency substantiation. GTIG IR primary: B by source class CGS-2.2; AI agency proposition to CGS-3.1/3.2. Founding agency attribution: Sysdig only.",
  "independence_determination": "Storm-3168: separate victim/domain/source/failure mode but same founding actor cluster and dependent agency characterization; under CHQ-ABR-2026-001 (DM-delegated ratification 13 Jul, countersignature open), treated as actor reach, not independent structural confirmation. GTIG: no stated link to JadePuffer; appears separate evidence chain, but agency proposition is still unadjudicated.",
  "rule_applied": "GRANDFATHERED RATING, DISCLOSED: SC-2026-008 retains CONFIRMED under the methodology's non-retroactivity provision (v1.3 change record; CGS-11.3). Its founding evidence (one operation, agency attributed by one source) has not been independently demonstrated to satisfy the current confirmation standard (sustained evidence across instances passing the independence test). CONFIRMED here describes the rules under which the rating was assigned, not an assessment against today's standard. The Q4 audit determines whether the historical rating remains supportable. No down-criterion element met; GTIG candidate (potentially independent, Grade B by CGS-2.2, primary reviewed 13 Oct, agency proposition outstanding) may change the support.",
  "alternative_not_taken": "Place SC-008 under review on the single-source finding. Rejected: \"under review\" without a valid criterion is prohibited by the methodology; the audit is the venue.",
  "cgs_provisions": [
    "CGS-3.3",
    "CGS-6.2",
    "CGS-11.3"
  ],
  "record_links": [
    "CHQ-CATCHLAG-2026-002",
    "CHQ-CATCHLAG-2026-003"
  ],
  "blind_reproduction": "OWED",
  "status": "VALID"
}
```