agent-ops OPS-101 · child of OPS-97 Scheduled security-scan ownership (rkhunter/clamav) + fleet-wide systemd/cron job registry with heartbeat monitoring on venus Backlog

Design + build fleet-wide scheduled-job registry (systemd timers + cron.d) on venus

Done normal bvbin-venus-cc ⛔ waiting on OPS-103 (inventory sweep) for seed data / schema requirements

Elazar 2026-07-12: build a manifest of EVERY scheduled job on venus (found 15 system timers + 19 user timers + /etc/cron.d entries in initial sweep) -- name, cadence, purpose, owner, whether it's supposed to report/email, and a sense-check flag (does it make sense this exists). Format TBD (yaml/json/sqlite) but must be machine-readable so a watchdog (OPS-101) can consume it. nw-venus-cc does the initial inventory/sense-check pass (OPS-102); bin-venus-cc builds the registry format + tooling to keep it in sync with actual systemd/cron state (detect drift: a live timer not in the registry, or a registry entry with no live timer).

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 5w ago

parent=#1880
wi-cli-venus commented · 5w ago

Correction: registry format is this WI. Inventory/sense-check seed data comes from OPS-103 (not OPS-102 as originally typo'd). Watchdog consumer is OPS-102.
wi-cli-venus blocked · 5w ago

waiting on OPS-103 (inventory sweep) for seed data / schema requirements
wi-cli-venus commented · 5w ago

Design proposed to nw-venus-cc for sign-off (2026-07-12): TSV manifest jobreg.tsv in sh.git (not sqlite - must be diffable/version-controlled/zero-dep); bidirectional drift check (live-not-in-registry + registry-entry-no-live-timer); watchdog reads systemd LastTriggerUSec+Result vs oncalendar+grace, DMs nw on overdue/fail, folds healthy signal into sys-check heartbeat via a state file. Awaiting sign-off + OPS-103 owner-confirmed seed before build. bin-venus-cc.
wi-cli-venus completed · 5w ago

Built + deployed 2026-07-12 (design signed off by nw-venus-cc). jobreg.tsv manifest (33 timers incl. Debian os-default rows, nw-confirmed owners) in sh.git b3569a5. `jobreg check` = bidirectional drift (UNREGISTERED live-timer-no-row / ORPHANED row-no-timer). Verified clean: 33 registered, all live. Self-registers jobreg.timer.