An AI Audit Needs to Correct Its Own Findings
My AI team and I updated five Python dependencies and withdrew a backup warning caused by a restricted filesystem view. The audit needed correction as well as remediation.
Today I worked with my AI team on an audit of my Hermes setup. We found dependencies that needed updating, but we also had to correct a finding in the audit itself.
The initial report said two Nextcloud backup and health-check scripts were missing. That would have been a real problem if it were true. It wasn't.
A visibility limit became a false alarm
The assistant was inspecting a restricted filesystem view. The scripts were not visible there, and that absence had been treated as evidence that they did not exist on the host.
Host-side checks showed that both scripts existed, were executable, and had active timers with successful service results. We withdrew the missing-script finding. No repair to those scripts was needed.
That correction matters because an audit can create work as well as identify it. Acting on the original finding would have meant trying to fix something the evidence no longer showed was broken.
The host checks did not prove that a backup could be restored. They answered the narrower question about the scripts and timers. Recovery testing remains a separate piece of work.
Fix the confirmed problem, not the whole system
The dependency findings were different. The audit confirmed affected installed versions, and we applied five targeted Python security pins. The recorded production regression run passed 205 tests. A fresh scan of 136 components returned zero known advisory findings within that scan's scope.
The gateway and dashboard were also checked after installation. This was a bounded dependency update, not a claim that every package, integration or security risk had been reviewed and cleared. Separate npm findings and a full restoration rehearsal were still open.
Today's useful result was therefore two-sided: we fixed a confirmed problem and removed an unsupported one from the report. Working with AI on maintenance means checking the diagnosis as carefully as the proposed fix.
Evidence note: this account follows today's work journal and the audit closeout. The test and scan results are recorded there; they are not a whole-system security certification.