The call scoreboard

How grading works. Right means the called behavior showed up inside the window, backed by named public reporting. Wrong means the window closed without it. Partial means the direction held but the scope or timing didn't. Calls marked rolling describe ongoing activity and get reviewed on a fixed date instead of a single yes/no. Issue #1 shipped 2026-06-08, so the first grades post in late June.

What shows here. Issue #1 is the free public sample, so its calls appear in full. Calls from subscriber issues are listed by a short reference only, a product name or a TTP, enough to check the grade against the claim; the full call and its reasoning stay in the subscriber archive.

Live tracking: the open calls, as of 2026-08-24. Interim signal, not verdicts; each call still grades when its window closes.

Tracking toward Right (the called event is already on the public record): Cisco SD-WAN CVE-2026-20245 (vendor-confirmed config-push), LiteLLM CVE-2026-42271 (KEV, chained RCE), the SharePoint cluster (CVE-2026-50522 exploited 2026-07-20), Metabase GHSA-vwf4-m7j8-wcjf (Framework and Tally both disclosed theft), the keyv and cacheable npm takeover (Sigstore provenance minted on poisoned source, confirmed by Socket, Microsoft and Wiz), UNC6671 help-desk vishing into funds (Bloomberg and Reuters named 4 firms), Unit 42 token jacking (published research, resale economy documented), and the Cl0p PTC Windchill campaign, where the group named more than 40 organizations on 2026-08-12 and ReliaQuest published the custom implant on 08-18.

Monitoring (slow-burn or event-conditioned, no decisive in-window signal yet): nation-state edge and telecom pre-positioning (Issue #1 and #2), hacktivist DDoS, the frontier-AI KYC bypass economy, the remaining Issue #5 calls (PolinRider, Armored Likho, satcom ICS, Node.js disclosure reform), the JADEPUFFER follow-on, the Issue #8 AI-safety and cloud-native C2 calls, and the Issue #9 set, which mostly closes in September. Sixteen windows shut on 2026-08-24 and are graded below: 3 Right, 6 Partial, 7 Wrong. The pattern in the failures matters more than the tally. Eight of the 16 failed because the evidence that would have proved the call was already public before the window opened, which is the same window-design defect that produced the named-victim misses in the last round. 7-02 and 3-04 are the clearest cases, both written after the exploitation had already reached the federal catalog. Issue #12 changes the shape of its first 4 calls in response: each resolves on a dated forward event rather than on a named victim inside a short window. Issue #12 adds 10 new calls, listed in full below. Issue #11, published 2026-08-17, graded nothing and carried Issue #10's board forward unverified, which is why these 16 windows were still open. Its own 10 calls are listed below and none of them closes before 2026-10-16.

Issue #11 was written and published outside the usual pipeline and uses a different template: a call, a timeframe, an explicit falsification test, and a basis, with High, Medium and Low bands and no PIR lines. The theme shown in the PIR field below is taken from each call's own subject. Band, window and close date are as published. This issue graded no prior calls.