sync: auto-sync from GURU-BEAST-ROG at 2026-07-16 10:22:46

Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-16 10:22:46

clients/valleywide/session-logs/2026-07/2026-07-16-winter-orders-breach-check-remediation.md

@@ -73,3 +73,9 @@ Created Syncro ticket #32557 for Valley Wide Plastering Inc (customer 31694734)
 - Bot alerts: message_ids 1527360784940798073 (ticket create), 1527361632278286386 (billing)
 - Raw artifacts: /tmp/remediation-tool/5c53ae9f-7071-4248-b834-8685b646450f/user-breach/Orders_valleywideplastering_com/
 - Prior related log: clients/valleywide/reports/2026-06-29-offboarding-teresa-carpio.md
+
+## Update: 10:25 AZ — Tenant-wide sweep + ticket update
+
+Winter asked whether other mailboxes showed similar activity. Ran tenant-sweep.sh (30d, all 36 enabled users): device-join fingerprint (Auth Broker -> Intune Enrollment/Device Registration) appears ONLY on the orders@ 7/2 event — all other device registrations came from office IP 4.18.160.106 or known AZ IPs (7/14 DESKTOP-2R13CC4 by j-r@ = legit, office IP). Zero successful non-US sign-ins tenant-wide (658 rows, complete). Ongoing password spray, ALL FAILED: rose@ 74+ x 50053 lockouts (CA,CN,DE,JP,NG,NL,SE), estimating@ 6, guest jr@casarica.net 6, jesse@/ryan@/j-r@ 2 ea (50126/50053) — none reached MFA stage, no correct passwords. Failed-signin data capped at 999 rows (counts are floors). rose@ had zero successful sign-ins in 30d — spray got nothing.
+
+Posted customer-visible comment (id 424048380, email ON per Winter) to #32557 summarizing sweep results. Bot alert 1527364806699516016. Friction logged: comment POST response failed jq parse despite tr strip; comment had posted — GET-verify-first rule prevented a duplicate. Sweep artifacts: /tmp/remediation-tool/5c53ae9f-7071-4248-b834-8685b646450f/sweep/

errorlog.md

@@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
 
 <!-- Append entries below this line -->
 
+2026-07-16 | GURU-BEAST-ROG | syncro/comment | [friction] POST /tickets/{id}/comment response failed jq parse even after tr control-char strip; comment DID post (verified via GET) - check-first rule prevented duplicate [ctx: ticket=32557]
+
 2026-07-15 | Howard-Home | msp360/backups | [correction] assumed LAB-SVR (Len's Auto) is a live machine needing attention; correct is LAB-SVR was RETIRED and replaced by LAB-SERVER — repeated correction from Howard
 
 2026-07-15 | Howard-Home | cascades-verification | [correction] reported Synology-to-server sync as 'overstated/partial' from stale wiki (6/18 note); correct is: shared-folder syncs to the server ARE set up — Howard confirmed. Wiki Team Folder [PENDING] lines are stale