@wonsukchoi/crondex 0.2.0 → 0.4.0

package/jobs/content/rss-feed-validate.yaml

@@ -0,0 +1,32 @@
+id: rss-feed-validate
+version: 1
+name: RSS Feed Validation
+description: >
+  Checks your RSS/Atom feed is valid XML and shows the most recent
+  item's publish date. Use this if you've ever shipped a broken feed
+  and only found out when a reader's app stopped updating.
+category: content
+tags: [rss, feed, content]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  url={{feed_url}};
+  xml=$(curl -sL --max-time 10 "$url");
+  [ -z "$xml" ] && { echo "ERROR: could not fetch $url"; exit 1; };
+  if command -v xmllint >/dev/null 2>&1; then
+    echo "$xml" | xmllint --noout - 2>&1 && echo "OK: valid XML" || { echo "INVALID XML"; exit 1; };
+  else
+    echo "xmllint not installed, skipping strict XML validation";
+  fi;
+  pubdate=$(echo "$xml" | grep -oE "<pubDate>[^<]+</pubDate>" | head -n1 | sed 's/<[^>]*>//g');
+  echo "Most recent item pubDate: ${pubdate:-unknown}"
+variables:
+  feed_url:
+    default: "https://example.com/feed.xml"
+    description: URL of the RSS/Atom feed to check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Only reports the latest pubDate for you to eyeball —
+  doesn't flag "stale" automatically since feed cadences vary too much
+  for one threshold. Install `xmllint` (libxml2) for strict validation.

package/jobs/content/seo-meta-check.yaml

@@ -0,0 +1,32 @@
+id: seo-meta-check
+version: 1
+name: SEO Meta Tag Check
+description: >
+  Checks a list of pages for missing title, meta description, and
+  Open Graph tags. Use this if pages have ever shipped without basic
+  SEO/social-preview tags because nobody double-checked.
+category: content
+tags: [seo, content, meta-tags]
+schedule: "0 7 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{urls_file}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  while IFS= read -r url; do
+    [ -z "$url" ] && continue;
+    html=$(curl -sL --max-time 10 "$url");
+    missing="";
+    echo "$html" | grep -qi "<title>" || missing="$missing title";
+    echo "$html" | grep -qi 'name="description"' || missing="$missing meta-description";
+    echo "$html" | grep -qi 'property="og:title"' || missing="$missing og:title";
+    if [ -n "$missing" ]; then echo "MISSING on $url:$missing"; else echo "OK: $url"; fi
+  done < "$file"
+variables:
+  urls_file:
+    default: "./pages.txt"
+    description: Plain text file with one page URL per line to check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Basic presence check only (does the tag exist), not content
+  quality — pair with a fuller SEO audit for anything deeper.

package/jobs/devops/api-rate-limit-check.yaml

@@ -0,0 +1,31 @@
+id: api-rate-limit-check
+version: 1
+name: API Rate Limit Check
+description: >
+  Checks how many API requests you have left before hitting a rate
+  limit. Use this if you've ever gotten a 429 in production because
+  nobody was watching the remaining quota.
+category: devops
+tags: [api, rate-limit, monitoring]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  url={{api_url}};
+  headers=$(curl -sI --max-time 10 "$url");
+  remaining=$(echo "$headers" | grep -i "^x-ratelimit-remaining:" | awk '{print $2}' | tr -d '\r');
+  if [ -z "$remaining" ]; then echo "no rate-limit headers found on $url (nothing to check, or a different header convention)"; exit 0;
+  elif [ "$remaining" -le {{warn_threshold}} ]; then echo "WARNING: $url has only $remaining requests remaining"; exit 1;
+  else echo "OK: $url has $remaining requests remaining"; fi
+variables:
+  api_url:
+    default: "https://api.example.com/status"
+    description: An endpoint on the API you want to watch — any request that returns rate-limit headers works.
+  warn_threshold:
+    default: 50
+    description: Warn if remaining requests drops to this or below.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Assumes the standard `X-RateLimit-Remaining` response header — adjust
+  the grep pattern if your API uses a different convention
+  (e.g. `RateLimit-Remaining`, a custom header).

package/jobs/devops/db-backup-verify.yaml

@@ -0,0 +1,37 @@
+id: db-backup-verify
+version: 1
+name: Database Backup Restore Verification
+description: >
+  Actually restores your latest database backup to a throwaway database
+  and checks it's queryable. Use this if `backup-reminder` isn't enough —
+  a backup file existing doesn't mean it's actually restorable.
+category: devops
+tags: [database, backup, postgres]
+schedule: "0 5 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  dump={{dump_path}}; scratch_db={{scratch_db_name}};
+  [ -f "$dump" ] || { echo "ERROR: $dump not found"; exit 1; };
+  command -v pg_restore >/dev/null 2>&1 || { echo "ERROR: pg_restore not installed"; exit 1; };
+  dropdb --if-exists "$scratch_db" 2>/dev/null;
+  createdb "$scratch_db" || { echo "ERROR: could not create scratch db $scratch_db"; exit 1; };
+  pg_restore -d "$scratch_db" "$dump" >/dev/null 2>&1;
+  count=$(psql -d "$scratch_db" -tAc "SELECT count(*) FROM {{checkpoint_table}}" 2>/dev/null);
+  dropdb --if-exists "$scratch_db" 2>/dev/null;
+  if [ -z "$count" ]; then echo "FAILED: restore or query failed on $dump"; exit 1;
+  else echo "OK: restored $dump, $checkpoint_table has $count rows"; fi
+variables:
+  dump_path:
+    default: "./backups/latest.dump"
+    description: Path to the pg_dump/pg_restore-format backup file.
+  scratch_db_name:
+    default: "backup_verify_scratch"
+    description: Throwaway database name used for the test restore (created and dropped each run).
+  checkpoint_table:
+    default: "users"
+    description: A table expected to have rows — used to confirm the restore actually worked.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Postgres-specific (pg_restore/psql/createdb/dropdb) — adapt the command
+  for other database engines. Needs CREATE/DROP DATABASE privileges.

package/jobs/devops/dns-record-check.yaml

@@ -0,0 +1,32 @@
+id: dns-record-check
+version: 1
+name: DNS Record Drift Check
+description: >
+  Checks that a DNS record still resolves to the value you expect, and
+  flags drift. Use this if you've ever had DNS quietly change (an
+  expired record, a misconfigured provider) and only found out when
+  something broke.
+category: devops
+tags: [dns, monitoring, drift]
+schedule: "0 */6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  domain={{domain}}; type={{record_type}}; expected="{{expected_value}}";
+  command -v dig >/dev/null 2>&1 || { echo "ERROR: dig not installed"; exit 1; };
+  actual=$(dig +short "$domain" "$type" | tr '\n' ' ' | sed 's/ *$//');
+  if [ -z "$actual" ]; then echo "ERROR: no $type record found for $domain"; exit 1;
+  elif echo "$actual" | grep -qF "$expected"; then echo "OK: $domain $type matches expected ($actual)";
+  else echo "DRIFT: $domain $type is '$actual', expected to contain '$expected'"; exit 1; fi
+variables:
+  domain:
+    default: "example.com"
+    description: Domain to check.
+  record_type:
+    default: "A"
+    description: DNS record type (A, CNAME, TXT, MX, etc).
+  expected_value:
+    default: "93.184.216.34"
+    description: Value the record should contain — replace with your actual expected record.
+compatible_agents: [generic, claude, codex]
+notes: Zero-token, deterministic. Requires `dig` (part of dnsutils/bind-tools).

package/jobs/devops/license-compliance-check.yaml

@@ -0,0 +1,31 @@
+id: license-compliance-check
+version: 1
+name: Dependency License Compliance Check
+description: >
+  Scans your dependencies for licenses you've flagged as risky (like GPL
+  or AGPL). Use this if you've ever shipped something and only later
+  found out a dependency's license doesn't play well with your product.
+category: devops
+tags: [license, compliance, dependencies]
+schedule: "0 8 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{repo_path}} &&
+  if [ -f package.json ]; then
+    npx --yes license-checker --summary --excludePrivatePackages 2>/dev/null | grep -iE "{{flagged_licenses}}" && echo "^ flagged licenses found above" || echo "OK: no flagged licenses found";
+  else
+    echo "no package.json found — this job only supports npm/Node projects currently";
+  fi
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to check.
+  flagged_licenses:
+    default: "GPL|AGPL"
+    description: Regex alternation of license names to flag.
+compatible_agents: [generic, claude, codex]
+notes: >
+  npm/Node projects only (uses `npx license-checker`, downloads on first
+  run). For other ecosystems, swap in the equivalent tool
+  (pip-licenses, cargo-license, etc.) and adjust the command.

package/jobs/devops/orphaned-branch-cleanup.yaml

@@ -0,0 +1,28 @@
+id: orphaned-branch-cleanup
+version: 1
+name: Orphaned Branch Cleanup
+description: >
+  Lists remote branches already merged into main that nobody's deleted
+  yet. Use this if your branch list has become a graveyard nobody wants
+  to clean up.
+category: devops
+tags: [git, cleanup, branches]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{repo_path}} && git fetch --prune >/dev/null 2>&1;
+  merged=$(git branch -r --merged {{base_branch}} | grep -v -E "(\*|{{base_branch}}$)" | sed 's#origin/##');
+  if [ -z "$merged" ]; then echo "OK: no merged branches to clean up";
+  else echo "Merged into {{base_branch}}, safe to delete:"; echo "$merged"; fi
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to check.
+  base_branch:
+    default: "main"
+    description: Branch to check merges against.
+compatible_agents: [generic, claude, codex]
+notes: >
+  List-only by design — never deletes anything. Review the list, then
+  `git push origin --delete <branch>` yourself for ones you actually want gone.

package/jobs/devops/queue-depth-check.yaml

@@ -0,0 +1,35 @@
+id: queue-depth-check
+version: 1
+name: Queue Depth Check
+description: >
+  Checks how backed up a job queue is and warns if it crosses a
+  threshold. Use this if a stuck worker has ever let a queue silently
+  balloon until someone noticed customers weren't getting emails.
+category: devops
+tags: [queue, redis, monitoring]
+schedule: "*/10 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v redis-cli >/dev/null 2>&1 || { echo "ERROR: redis-cli not installed"; exit 1; };
+  depth=$(redis-cli -h {{redis_host}} -p {{redis_port}} llen {{queue_key}} 2>/dev/null);
+  if [ -z "$depth" ]; then echo "ERROR: could not read queue depth for {{queue_key}}"; exit 1;
+  elif [ "$depth" -ge {{threshold}} ]; then echo "WARNING: queue {{queue_key}} depth is $depth (threshold {{threshold}})"; exit 1;
+  else echo "OK: queue {{queue_key}} depth is $depth"; fi
+variables:
+  redis_host:
+    default: "localhost"
+    description: Redis host.
+  redis_port:
+    default: 6379
+    description: Redis port.
+  queue_key:
+    default: "jobs:pending"
+    description: Redis list key backing the queue.
+  threshold:
+    default: 1000
+    description: Warn if the queue depth reaches this many items.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Redis list-backed queues only (uses LLEN). Adapt the depth-check
+  command for RabbitMQ, SQS, or other queue systems.

package/jobs/finance/invoice-overdue-check.yaml

@@ -0,0 +1,32 @@
+id: invoice-overdue-check
+version: 1
+name: Invoice Overdue Check
+description: >
+  Flags invoices that are past due and still unpaid. Use this if you
+  freelance or run a small business and invoices have ever slipped
+  through the cracks.
+category: finance
+tags: [invoices, accounts-receivable, finance]
+schedule: "0 9 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{invoices_file}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r id client amount due paid; do
+    [ "$paid" = "yes" ] && continue;
+    due_epoch=$(date -j -f %Y-%m-%d "$due" +%s 2>/dev/null || date -d "$due" +%s);
+    days=$(( (today-due_epoch)/86400 ));
+    if [ "$days" -gt 0 ]; then echo "OVERDUE: invoice $id ($client, \$$amount) — $days day(s) past due ($due)"; fi
+  done
+variables:
+  invoices_file:
+    default: "./invoices.csv"
+    description: >
+      CSV with header "invoice_id,client,amount,due_date,paid"
+      (due_date is YYYY-MM-DD, paid is yes/no).
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain invoices.csv yourself (mark paid=yes once
+  settled) — this doesn't connect to any billing/accounting system.

package/jobs/finance/saas-seat-audit.yaml

@@ -0,0 +1,35 @@
+id: saas-seat-audit
+version: 1
+name: Team SaaS Seat Audit
+description: >
+  Flags team SaaS seats (Slack, Notion, GitHub, etc.) nobody's actually
+  used in a while. Use this if you suspect you're paying for seats of
+  people who left or tools nobody opens anymore.
+category: finance
+tags: [saas, seats, team, budget]
+schedule: "0 9 1 * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{seats_file}}; unused_days={{unused_days}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r tool owner cost last_active; do
+    last_epoch=$(date -j -f %Y-%m-%d "$last_active" +%s 2>/dev/null || date -d "$last_active" +%s);
+    days=$(( (today-last_epoch)/86400 ));
+    if [ "$days" -gt "$unused_days" ]; then echo "UNUSED SEAT: $tool - $owner (\$$cost/mo) - inactive $days days"; fi
+  done
+variables:
+  seats_file:
+    default: "./saas-seats.csv"
+    description: >
+      CSV with header "tool,seat_owner,monthly_cost,last_active_date"
+      (YYYY-MM-DD), one seat per row.
+  unused_days:
+    default: 30
+    description: Flag a seat if it hasn't been active in this many days.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token, deterministic. You maintain saas-seats.csv yourself (or
+  export last-active data from your SSO/IdP if it tracks that) — this job
+  only reads what's in the file, doesn't pull from any SaaS API.

package/jobs/finance/tax-deadline-reminder.yaml

@@ -0,0 +1,33 @@
+id: tax-deadline-reminder
+version: 1
+name: Tax Deadline Reminder
+description: >
+  Warns you ahead of upcoming tax deadlines you've listed. Use this if
+  quarterly estimated payments or annual filing dates have ever snuck
+  up on you.
+category: finance
+tags: [tax, deadlines, finance]
+schedule: "0 9 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{deadlines_file}}; warn={{warn_days}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r label due; do
+    [ -z "$due" ] && continue;
+    due_epoch=$(date -j -f %Y-%m-%d "$due" +%s 2>/dev/null || date -d "$due" +%s);
+    days=$(( (due_epoch-today)/86400 ));
+    if [ "$days" -ge 0 ] && [ "$days" -le "$warn" ]; then echo "REMINDER: $label due in $days day(s) ($due)"; fi
+  done
+variables:
+  deadlines_file:
+    default: "./tax-deadlines.csv"
+    description: CSV with header "label,date" (date is YYYY-MM-DD), one deadline per row.
+  warn_days:
+    default: 14
+    description: Start warning this many days before a deadline.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain tax-deadlines.csv yourself with your actual
+  jurisdiction's dates — this job doesn't know tax law or deadlines on its own.

package/jobs/learning/course-progress-checkin.yaml

@@ -0,0 +1,37 @@
+id: course-progress-checkin
+version: 1
+name: Course Progress Check-in
+description: >
+  Compares your current chapter/lesson against a target date and tells
+  you if you're on track or falling behind. Use this if you've ever
+  signed up for a course and quietly stopped halfway through.
+category: learning
+tags: [learning, goals, progress]
+schedule: "0 9 * * 1"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  current={{current_chapter}}; target={{target_chapter}}; target_date={{target_date}};
+  today_epoch=$(date +%s);
+  target_epoch=$(date -j -f %Y-%m-%d "$target_date" +%s 2>/dev/null || date -d "$target_date" +%s);
+  days_left=$(( (target_epoch-today_epoch)/86400 ));
+  chapters_left=$(( target - current ));
+  if [ "$chapters_left" -le 0 ]; then echo "OK: at or past target chapter $target already.";
+  elif [ "$days_left" -le 0 ]; then echo "OVERDUE: target date was $target_date, still $chapters_left chapter(s) to go.";
+  elif [ "$chapters_left" -gt "$days_left" ]; then echo "BEHIND: $chapters_left chapter(s) left, only $days_left day(s) until $target_date.";
+  else echo "ON TRACK: $chapters_left chapter(s) left, $days_left day(s) until $target_date."; fi
+variables:
+  current_chapter:
+    default: 1
+    description: Chapter/lesson number you're currently on — update this yourself as you progress.
+  target_chapter:
+    default: 10
+    description: Chapter/lesson number you want to finish by target_date.
+  target_date:
+    default: "2026-12-31"
+    description: Date (YYYY-MM-DD) you want to hit target_chapter by.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. "Behind/on track" is a rough linear heuristic (chapters-left
+  vs. days-left), not a real study-pace model. You update current_chapter
+  yourself as you go.

package/jobs/learning/daily-flashcard-review.yaml

@@ -0,0 +1,29 @@
+id: daily-flashcard-review
+version: 1
+name: Daily Flashcard Review
+description: >
+  Lists which flashcards are due for review today from a simple deck
+  file. Use this if you're learning something with spaced repetition but
+  don't want a whole separate app for it.
+category: learning
+tags: [learning, flashcards, spaced-repetition]
+schedule: "0 8 * * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  deck={{deck_path}};
+  [ -f "$deck" ] || { echo "ERROR: $deck not found"; exit 1; };
+  today=$(date +%F);
+  due=$(awk -F, -v today="$today" 'NR>1 && $3<=today {print $1" -> "$2" (due "$3")"}' "$deck");
+  if [ -z "$due" ]; then echo "No cards due today.";
+  else echo "Cards due today:"; echo "$due"; fi
+variables:
+  deck_path:
+    default: "./flashcards.csv"
+    description: CSV with header "front,back,next_review_date" (YYYY-MM-DD).
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain flashcards.csv and update each card's
+  next_review_date yourself after reviewing — this is simple date-based
+  scheduling, not full SM-2 spaced repetition. This job only tells you
+  what's due, it doesn't reschedule cards for you.

package/jobs/learning/reading-list-nudge.yaml

@@ -0,0 +1,25 @@
+id: reading-list-nudge
+version: 1
+name: Reading List Nudge
+description: >
+  Reminds you what's next on your reading list. Use this if you save
+  articles/books to "read later" and later never comes.
+category: learning
+tags: [learning, reading, reminder]
+schedule: "0 9 * * 6"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  file={{reading_list_path}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  next=$(head -n 1 "$file");
+  if [ -z "$next" ]; then echo "Reading list is empty — nice work.";
+  else echo "Next up: $next"; fi
+variables:
+  reading_list_path:
+    default: "./reading-list.txt"
+    description: Plain text file, one item per line — the top line is treated as "next."
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Suggests the top line only — remove an item from
+  reading-list.txt yourself once you've read it, or reorder to reprioritize.

package/jobs/productivity/focus-block-reminder.yaml

@@ -0,0 +1,25 @@
+id: focus-block-reminder
+version: 1
+name: Focus Block Reminder
+description: >
+  Nudges you to start a deep-work block at set times. Use this if your
+  day fills up with reactive work and real focus time only happens by
+  accident.
+category: productivity
+tags: [focus, productivity, deep-work]
+schedule: "0 9,14 * * 1-5"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  echo "Focus block: {{block_minutes}} minutes on \"{{focus_task}}\" starting now. Silence notifications."
+variables:
+  focus_task:
+    default: "deep work"
+    description: What to focus on for this block.
+  block_minutes:
+    default: 50
+    description: Length of the focus block in minutes.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Purely a nudge — doesn't block notifications/apps itself;
+  pair with your OS's focus/DND mode if you want it enforced.

package/jobs/security/failed-login-watch.yaml

@@ -0,0 +1,37 @@
+id: failed-login-watch
+version: 1
+name: Failed Login Watch
+description: >
+  Watches an auth log for a burst of failed login attempts and alerts if
+  it crosses a threshold. Use this if you run a server exposed to SSH and
+  want an early warning for brute-force attempts.
+category: security
+tags: [security, auth, monitoring]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  log={{auth_log_path}}; state={{state_file}}; threshold={{fail_threshold}};
+  [ -f "$log" ] || { echo "ERROR: $log not found"; exit 1; };
+  total=$(grep -c "Failed password" "$log");
+  last=$(cat "$state" 2>/dev/null || echo 0);
+  new=$(( total - last ));
+  [ "$new" -lt 0 ] && new=0;
+  echo "$total" > "$state";
+  if [ "$new" -ge "$threshold" ]; then echo "WARNING: $new new failed login attempt(s) since last check (threshold $threshold)"; exit 1;
+  else echo "OK: $new new failed login attempt(s) since last check"; fi
+variables:
+  auth_log_path:
+    default: "/var/log/auth.log"
+    description: Path to the auth log to watch (Linux-style).
+  state_file:
+    default: "./.failed-login-watch-state"
+    description: File this job uses to remember the last count seen, so it only alerts on new failures.
+  fail_threshold:
+    default: 5
+    description: Alert if this many new failed attempts appear since the last check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Linux-oriented (/var/log/auth.log). On macOS, use
+  `log show --predicate 'eventMessage contains "authentication failure"'`
+  instead and adapt the command — this one won't work there as-is.

package/jobs/security/firewall-rule-diff.yaml

@@ -0,0 +1,30 @@
+id: firewall-rule-diff
+version: 1
+name: Firewall Rule Diff
+description: >
+  Diffs your current firewall rules against a saved baseline and flags
+  any drift. Use this if a firewall rule has ever changed without
+  anyone remembering who did it or why.
+category: security
+tags: [security, firewall, drift]
+schedule: "0 6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  baseline={{baseline_path}};
+  if command -v ufw >/dev/null 2>&1; then current=$(sudo ufw status verbose 2>/dev/null);
+  elif command -v iptables >/dev/null 2>&1; then current=$(sudo iptables -S 2>/dev/null);
+  else echo "ERROR: no supported firewall tool found (ufw/iptables)"; exit 1; fi;
+  if [ ! -f "$baseline" ]; then echo "$current" > "$baseline"; echo "no baseline found — saved current rules as the new baseline"; exit 0; fi;
+  if diff -q <(echo "$current") "$baseline" >/dev/null 2>&1; then echo "OK: firewall rules match baseline";
+  else echo "DRIFT: firewall rules differ from baseline:"; diff <(echo "$current") "$baseline"; exit 1; fi
+variables:
+  baseline_path:
+    default: "./firewall-baseline.txt"
+    description: File storing the known-good firewall rule snapshot.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Requires sudo access to read ufw/iptables rules (configure passwordless
+  sudo for this specific read-only command if running unattended). First
+  run saves the baseline; later runs diff against it. Requires bash
+  (process substitution).

package/jobs/security/open-port-check.yaml

@@ -0,0 +1,36 @@
+id: open-port-check
+version: 1
+name: Expected Open Ports Check
+description: >
+  Checks that the ports you expect to be open on a host actually are, and
+  flags any that aren't. Use this if a service has ever silently stopped
+  listening and you found out from a user instead of a monitor.
+category: security
+tags: [security, network, ports]
+schedule: "0 */4 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  host={{host}}; fail=0;
+  for p in $(echo "{{expected_open_ports}}" | tr ',' ' '); do
+    if command -v nc >/dev/null 2>&1; then
+      nc -z -w2 "$host" "$p" 2>/dev/null && echo "OK: $host:$p open" || { echo "MISSING: $host:$p expected open but isn't"; fail=1; };
+    else
+      (echo > /dev/tcp/$host/$p) 2>/dev/null && echo "OK: $host:$p open" || { echo "MISSING: $host:$p expected open but isn't"; fail=1; };
+    fi
+  done;
+  exit $fail
+variables:
+  host:
+    default: "localhost"
+    description: Host to check.
+  expected_open_ports:
+    default: "22,80,443"
+    description: Comma-separated list of ports that should be open.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Checks only the ports you list — not a full port scan. Use
+  nmap for broader unexpected-open-port discovery. The nc branch (used on
+  virtually every system) is the tested path; the /dev/tcp fallback only
+  matters if nc is missing and requires bash specifically — it won't work
+  under dash/POSIX sh.

package/jobs/security/secrets-scan.yaml

@@ -0,0 +1,28 @@
+id: secrets-scan
+version: 1
+name: Committed Secrets Scan
+description: >
+  Scans a repo for accidentally committed API keys, tokens, and private
+  keys. Use this if you want a safety net for the "oops, committed a key"
+  mistake everyone makes eventually.
+category: security
+tags: [security, secrets, scanning]
+schedule: "0 3 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{repo_path}} &&
+  if command -v gitleaks >/dev/null 2>&1; then
+    gitleaks detect --source . --no-git -v;
+  else
+    echo "gitleaks not installed, falling back to basic pattern matching";
+    grep -rnE "(AKIA[0-9A-Z]{16}|-----BEGIN (RSA|EC|DSA|OPENSSH) PRIVATE KEY-----|api[_-]?key['\"]?[[:space:]]*[:=][[:space:]]*['\"][A-Za-z0-9_-]{16,})" --exclude-dir=.git --exclude-dir=node_modules . || echo "no matches found";
+  fi
+variables:
+  repo_path:
+    default: "."
+    description: Path to the repo to scan.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Prefers `gitleaks` if installed (far more accurate); the
+  fallback regex is best-effort and will miss many patterns or false-positive.

package/jobs/security/sudo-usage-audit.yaml

@@ -0,0 +1,35 @@
+id: sudo-usage-audit
+version: 1
+name: Sudo Usage Audit
+description: >
+  Reports new sudo commands run since the last check. Use this if you
+  want to notice unexpected privilege escalation on a shared or
+  internet-facing server.
+category: security
+tags: [security, sudo, audit]
+schedule: "0 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  log={{auth_log_path}}; state={{state_file}};
+  [ -f "$log" ] || { echo "ERROR: $log not found"; exit 1; };
+  total=$(grep -c "sudo:.*COMMAND=" "$log");
+  last=$(cat "$state" 2>/dev/null || echo 0);
+  new=$(( total - last ));
+  [ "$new" -lt 0 ] && new=0;
+  echo "$total" > "$state";
+  if [ "$new" -gt 0 ]; then
+    echo "New sudo commands since last check ($new):";
+    grep "sudo:.*COMMAND=" "$log" | tail -n "$new";
+  else echo "OK: no new sudo usage since last check"; fi
+variables:
+  auth_log_path:
+    default: "/var/log/auth.log"
+    description: Path to the auth log (Linux-style).
+  state_file:
+    default: "./.sudo-audit-state"
+    description: File this job uses to remember the last count seen, so it only reports new entries.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Linux-oriented (/var/log/auth.log with sudo entries). On macOS use
+  `log show --predicate 'process == "sudo"'` instead and adapt the command.