ghostroute_ct_alerts
Returns the durable, deduplicated ledger of CT equivocation events the
GhostRoute witness worker detects and pushes — a tree_size_rewind (an
append-only log shrank), a root_fork (one tree_size witnessed with two
different Merkle roots = a split-view log), or an sth_signature_invalid
(a log's latest Signed Tree Head failed signature verification). Where
/v1/ghostroute/witness shows live computed health, this is the immutable
first-detection log: each entry's detected_at is when TunnelMind first
raised the alarm. A healthy CT ecosystem returns an empty feed — any row
here is a serious trust event.
Use this tool when:
You want a chronological record of CT trust violations, not live state.
You're polling for new equivocation events (check
summary.last_detected_at).
Inputs:
limit(query, optional): max recent alerts, 1–200, default 50.
Returns:
summary:total,undelivered,rewinds,forks,bad_signatures,last_detected_at.alerts[]: eachkind,severity,log_url,log_operator,from_tree_size,to_tree_size,distinct_roots,event_observed_at,detected_at,delivered.
Latency:
Typical <200ms (KV-cached 1m).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |