@wonsukchoi/crondex 0.3.0 → 0.5.0

package/jobs/content/robots-txt-check.yaml

@@ -0,0 +1,30 @@
+id: robots-txt-check
+version: 1
+name: Robots.txt Blanket-Block Check
+description: >
+  Checks that your robots.txt hasn't accidentally blocked every
+  crawler from your entire site. Use this if a robots.txt edit has
+  ever accidentally tanked your search traffic.
+category: content
+tags: [seo, robots, crawlability]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  url={{robots_url}};
+  body=$(curl -sL --max-time 10 "$url");
+  [ -z "$body" ] && { echo "ERROR: could not fetch $url"; exit 1; };
+  if echo "$body" | grep -qiE "^Disallow:[[:space:]]*/[[:space:]]*$"; then
+    echo "WARNING: $url has a blanket 'Disallow: /' — this blocks all crawlers from the whole site.";
+    exit 1;
+  else
+    echo "OK: no blanket disallow-all rule found in $url";
+  fi
+variables:
+  robots_url:
+    default: "https://example.com/robots.txt"
+    description: Full URL to your site's robots.txt.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Only checks for the "block everything" footgun, not full
+  robots.txt correctness.

package/jobs/content/rss-feed-validate.yaml

@@ -0,0 +1,32 @@
+id: rss-feed-validate
+version: 1
+name: RSS Feed Validation
+description: >
+  Checks your RSS/Atom feed is valid XML and shows the most recent
+  item's publish date. Use this if you've ever shipped a broken feed
+  and only found out when a reader's app stopped updating.
+category: content
+tags: [rss, feed, content]
+schedule: "0 8 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  url={{feed_url}};
+  xml=$(curl -sL --max-time 10 "$url");
+  [ -z "$xml" ] && { echo "ERROR: could not fetch $url"; exit 1; };
+  if command -v xmllint >/dev/null 2>&1; then
+    echo "$xml" | xmllint --noout - 2>&1 && echo "OK: valid XML" || { echo "INVALID XML"; exit 1; };
+  else
+    echo "xmllint not installed, skipping strict XML validation";
+  fi;
+  pubdate=$(echo "$xml" | grep -oE "<pubDate>[^<]+</pubDate>" | head -n1 | sed 's/<[^>]*>//g');
+  echo "Most recent item pubDate: ${pubdate:-unknown}"
+variables:
+  feed_url:
+    default: "https://example.com/feed.xml"
+    description: URL of the RSS/Atom feed to check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Only reports the latest pubDate for you to eyeball —
+  doesn't flag "stale" automatically since feed cadences vary too much
+  for one threshold. Install `xmllint` (libxml2) for strict validation.

package/jobs/content/seo-meta-check.yaml

@@ -0,0 +1,32 @@
+id: seo-meta-check
+version: 1
+name: SEO Meta Tag Check
+description: >
+  Checks a list of pages for missing title, meta description, and
+  Open Graph tags. Use this if pages have ever shipped without basic
+  SEO/social-preview tags because nobody double-checked.
+category: content
+tags: [seo, content, meta-tags]
+schedule: "0 7 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{urls_file}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  while IFS= read -r url; do
+    [ -z "$url" ] && continue;
+    html=$(curl -sL --max-time 10 "$url");
+    missing="";
+    echo "$html" | grep -qi "<title>" || missing="$missing title";
+    echo "$html" | grep -qi 'name="description"' || missing="$missing meta-description";
+    echo "$html" | grep -qi 'property="og:title"' || missing="$missing og:title";
+    if [ -n "$missing" ]; then echo "MISSING on $url:$missing"; else echo "OK: $url"; fi
+  done < "$file"
+variables:
+  urls_file:
+    default: "./pages.txt"
+    description: Plain text file with one page URL per line to check.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Basic presence check only (does the tag exist), not content
+  quality — pair with a fuller SEO audit for anything deeper.

package/jobs/devops/api-rate-limit-check.yaml

@@ -0,0 +1,31 @@
+id: api-rate-limit-check
+version: 1
+name: API Rate Limit Check
+description: >
+  Checks how many API requests you have left before hitting a rate
+  limit. Use this if you've ever gotten a 429 in production because
+  nobody was watching the remaining quota.
+category: devops
+tags: [api, rate-limit, monitoring]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  url={{api_url}};
+  headers=$(curl -sI --max-time 10 "$url");
+  remaining=$(echo "$headers" | grep -i "^x-ratelimit-remaining:" | awk '{print $2}' | tr -d '\r');
+  if [ -z "$remaining" ]; then echo "no rate-limit headers found on $url (nothing to check, or a different header convention)"; exit 0;
+  elif [ "$remaining" -le {{warn_threshold}} ]; then echo "WARNING: $url has only $remaining requests remaining"; exit 1;
+  else echo "OK: $url has $remaining requests remaining"; fi
+variables:
+  api_url:
+    default: "https://api.example.com/status"
+    description: An endpoint on the API you want to watch — any request that returns rate-limit headers works.
+  warn_threshold:
+    default: 50
+    description: Warn if remaining requests drops to this or below.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Assumes the standard `X-RateLimit-Remaining` response header — adjust
+  the grep pattern if your API uses a different convention
+  (e.g. `RateLimit-Remaining`, a custom header).

package/jobs/devops/dns-record-check.yaml

@@ -0,0 +1,32 @@
+id: dns-record-check
+version: 1
+name: DNS Record Drift Check
+description: >
+  Checks that a DNS record still resolves to the value you expect, and
+  flags drift. Use this if you've ever had DNS quietly change (an
+  expired record, a misconfigured provider) and only found out when
+  something broke.
+category: devops
+tags: [dns, monitoring, drift]
+schedule: "0 */6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  domain={{domain}}; type={{record_type}}; expected="{{expected_value}}";
+  command -v dig >/dev/null 2>&1 || { echo "ERROR: dig not installed"; exit 1; };
+  actual=$(dig +short "$domain" "$type" | tr '\n' ' ' | sed 's/ *$//');
+  if [ -z "$actual" ]; then echo "ERROR: no $type record found for $domain"; exit 1;
+  elif echo "$actual" | grep -qF "$expected"; then echo "OK: $domain $type matches expected ($actual)";
+  else echo "DRIFT: $domain $type is '$actual', expected to contain '$expected'"; exit 1; fi
+variables:
+  domain:
+    default: "example.com"
+    description: Domain to check.
+  record_type:
+    default: "A"
+    description: DNS record type (A, CNAME, TXT, MX, etc).
+  expected_value:
+    default: "93.184.216.34"
+    description: Value the record should contain — replace with your actual expected record.
+compatible_agents: [generic, claude, codex]
+notes: Zero-token, deterministic. Requires `dig` (part of dnsutils/bind-tools).

package/jobs/devops/queue-depth-check.yaml

@@ -0,0 +1,35 @@
+id: queue-depth-check
+version: 1
+name: Queue Depth Check
+description: >
+  Checks how backed up a job queue is and warns if it crosses a
+  threshold. Use this if a stuck worker has ever let a queue silently
+  balloon until someone noticed customers weren't getting emails.
+category: devops
+tags: [queue, redis, monitoring]
+schedule: "*/10 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v redis-cli >/dev/null 2>&1 || { echo "ERROR: redis-cli not installed"; exit 1; };
+  depth=$(redis-cli -h {{redis_host}} -p {{redis_port}} llen {{queue_key}} 2>/dev/null);
+  if [ -z "$depth" ]; then echo "ERROR: could not read queue depth for {{queue_key}}"; exit 1;
+  elif [ "$depth" -ge {{threshold}} ]; then echo "WARNING: queue {{queue_key}} depth is $depth (threshold {{threshold}})"; exit 1;
+  else echo "OK: queue {{queue_key}} depth is $depth"; fi
+variables:
+  redis_host:
+    default: "localhost"
+    description: Redis host.
+  redis_port:
+    default: 6379
+    description: Redis port.
+  queue_key:
+    default: "jobs:pending"
+    description: Redis list key backing the queue.
+  threshold:
+    default: 1000
+    description: Warn if the queue depth reaches this many items.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Redis list-backed queues only (uses LLEN). Adapt the depth-check
+  command for RabbitMQ, SQS, or other queue systems.

package/jobs/finance/invoice-overdue-check.yaml

@@ -0,0 +1,32 @@
+id: invoice-overdue-check
+version: 1
+name: Invoice Overdue Check
+description: >
+  Flags invoices that are past due and still unpaid. Use this if you
+  freelance or run a small business and invoices have ever slipped
+  through the cracks.
+category: finance
+tags: [invoices, accounts-receivable, finance]
+schedule: "0 9 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{invoices_file}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r id client amount due paid; do
+    [ "$paid" = "yes" ] && continue;
+    due_epoch=$(date -j -f %Y-%m-%d "$due" +%s 2>/dev/null || date -d "$due" +%s);
+    days=$(( (today-due_epoch)/86400 ));
+    if [ "$days" -gt 0 ]; then echo "OVERDUE: invoice $id ($client, \$$amount) — $days day(s) past due ($due)"; fi
+  done
+variables:
+  invoices_file:
+    default: "./invoices.csv"
+    description: >
+      CSV with header "invoice_id,client,amount,due_date,paid"
+      (due_date is YYYY-MM-DD, paid is yes/no).
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain invoices.csv yourself (mark paid=yes once
+  settled) — this doesn't connect to any billing/accounting system.

package/jobs/finance/tax-deadline-reminder.yaml

@@ -0,0 +1,33 @@
+id: tax-deadline-reminder
+version: 1
+name: Tax Deadline Reminder
+description: >
+  Warns you ahead of upcoming tax deadlines you've listed. Use this if
+  quarterly estimated payments or annual filing dates have ever snuck
+  up on you.
+category: finance
+tags: [tax, deadlines, finance]
+schedule: "0 9 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{deadlines_file}}; warn={{warn_days}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r label due; do
+    [ -z "$due" ] && continue;
+    due_epoch=$(date -j -f %Y-%m-%d "$due" +%s 2>/dev/null || date -d "$due" +%s);
+    days=$(( (due_epoch-today)/86400 ));
+    if [ "$days" -ge 0 ] && [ "$days" -le "$warn" ]; then echo "REMINDER: $label due in $days day(s) ($due)"; fi
+  done
+variables:
+  deadlines_file:
+    default: "./tax-deadlines.csv"
+    description: CSV with header "label,date" (date is YYYY-MM-DD), one deadline per row.
+  warn_days:
+    default: 14
+    description: Start warning this many days before a deadline.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain tax-deadlines.csv yourself with your actual
+  jurisdiction's dates — this job doesn't know tax law or deadlines on its own.

package/jobs/growth/cart-abandonment-followup.yaml

@@ -0,0 +1,46 @@
+id: cart-abandonment-followup
+version: 1
+name: Cart Abandonment Follow-up
+description: >
+  Finds abandoned shopping carts old enough to follow up on, and can
+  draft the follow-up email for you. Use this if abandoned-cart
+  recovery is something you know you should do but never get to.
+category: growth
+tags: [growth, ecommerce, cart-recovery]
+schedule: "0 10 * * *"
+timezone: "UTC"
+runner: hybrid
+command: >
+  file={{carts_file}}; wait_hours={{wait_hours}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  now=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r id email items abandoned followed; do
+    [ "$followed" = "yes" ] && continue;
+    a_epoch=$(date -d "$abandoned" +%s 2>/dev/null || date -j -f "%Y-%m-%d %H:%M" "$abandoned" +%s 2>/dev/null);
+    hours=$(( (now-a_epoch)/3600 ));
+    if [ "$hours" -ge "$wait_hours" ]; then echo "ABANDONED: cart $id ($email) - items: $items - ${hours}h ago"; fi
+  done
+prompt: |
+  Look at carts abandoned more than {{wait_hours}} hours ago in
+  {{carts_file}} (CSV: cart_id,customer_email,items,abandoned_at,followed_up).
+  For each one not yet followed up:
+  1. Draft a short, friendly follow-up email offering help or a gentle
+     nudge to complete checkout.
+  2. Keep it under 100 words, no hard-sell tone.
+script_note: >
+  `command` lists which carts are abandoned and old enough to follow up
+  on, zero tokens. `prompt` actually drafts the follow-up email copy for
+  each one.
+variables:
+  carts_file:
+    default: "./abandoned-carts.csv"
+    description: >
+      CSV with header "cart_id,customer_email,items,abandoned_at,followed_up"
+      (abandoned_at is "YYYY-MM-DD HH:MM", followed_up is yes/no).
+  wait_hours:
+    default: 24
+    description: Wait this many hours after abandonment before flagging for follow-up.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: >
+  You maintain abandoned-carts.csv yourself (or export it from your store
+  platform) — mark followed_up=yes after sending.

package/jobs/growth/review-request-nudge.yaml

@@ -0,0 +1,35 @@
+id: review-request-nudge
+version: 1
+name: Review Request Nudge
+description: >
+  Flags customers who bought a while ago and haven't been asked for a
+  review yet. Use this if review requests only happen when someone
+  remembers to send them.
+category: growth
+tags: [growth, reviews, ecommerce]
+schedule: "0 9 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  file={{orders_file}}; wait_days={{wait_days}};
+  [ -f "$file" ] || { echo "ERROR: $file not found"; exit 1; };
+  today=$(date +%s);
+  tail -n +2 "$file" | while IFS=, read -r id customer purchased requested; do
+    [ "$requested" = "yes" ] && continue;
+    p_epoch=$(date -j -f %Y-%m-%d "$purchased" +%s 2>/dev/null || date -d "$purchased" +%s);
+    days=$(( (today-p_epoch)/86400 ));
+    if [ "$days" -ge "$wait_days" ]; then echo "SEND REVIEW REQUEST: order $id ($customer), purchased $days day(s) ago"; fi
+  done
+variables:
+  orders_file:
+    default: "./orders.csv"
+    description: >
+      CSV with header "order_id,customer,purchase_date,review_requested"
+      (purchase_date is YYYY-MM-DD, review_requested is yes/no).
+  wait_days:
+    default: 7
+    description: Wait this many days after purchase before flagging for a review request.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain orders.csv yourself (mark review_requested=yes
+  after sending) — doesn't integrate with any store platform directly.

package/jobs/home/hvac-filter-reminder.yaml

@@ -0,0 +1,29 @@
+id: hvac-filter-reminder
+version: 1
+name: HVAC Filter Change Reminder
+description: >
+  Reminds you to change your HVAC filter based on how long it's been.
+  Use this if you've ever found a filter so clogged you forgot it was
+  ever white.
+category: home
+tags: [home, hvac, maintenance]
+schedule: "0 9 1 * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  last={{last_changed_date}}; interval={{interval_months}};
+  last_epoch=$(date -j -f %Y-%m-%d "$last" +%s 2>/dev/null || date -d "$last" +%s);
+  today_epoch=$(date +%s);
+  days_since=$(( (today_epoch-last_epoch)/86400 ));
+  interval_days=$(( interval * 30 ));
+  if [ "$days_since" -ge "$interval_days" ]; then echo "REMINDER: HVAC filter last changed $days_since day(s) ago (every ${interval} months) — change it.";
+  else echo "OK: filter changed $days_since day(s) ago, due again around day $interval_days."; fi
+variables:
+  last_changed_date:
+    default: "2026-01-01"
+    description: Date (YYYY-MM-DD) you last changed the filter — update this yourself.
+  interval_months:
+    default: 3
+    description: How often to change the filter, in months.
+compatible_agents: [generic, claude, codex]
+notes: Zero-token. You update last_changed_date yourself each time you actually change it.

package/jobs/home/plant-watering-reminder.yaml

@@ -0,0 +1,30 @@
+id: plant-watering-reminder
+version: 1
+name: Plant Watering Reminder
+description: >
+  Reminds you to water a specific plant once it's due. Use this if
+  you've ever lost a plant to "I'll water it tomorrow."
+category: home
+tags: [home, plants, reminder]
+schedule: "0 9 * * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  last={{last_watered_date}}; interval={{water_interval_days}};
+  last_epoch=$(date -j -f %Y-%m-%d "$last" +%s 2>/dev/null || date -d "$last" +%s);
+  today_epoch=$(date +%s);
+  days_since=$(( (today_epoch-last_epoch)/86400 ));
+  if [ "$days_since" -ge "$interval" ]; then echo "REMINDER: water {{plant_name}} ($days_since day(s) since last watering, every $interval day(s)).";
+  else echo "OK: {{plant_name}} watered $days_since day(s) ago, next due in $(( interval - days_since )) day(s)."; fi
+variables:
+  plant_name:
+    default: "your plant"
+    description: Which plant this reminder is for.
+  water_interval_days:
+    default: 7
+    description: How often to water it, in days.
+  last_watered_date:
+    default: "2026-01-01"
+    description: Date (YYYY-MM-DD) you last watered it — update this yourself.
+compatible_agents: [generic, claude, codex]
+notes: Zero-token. One job per plant — copy it and adjust plant_name/interval for each.

package/jobs/home/smoke-detector-battery-check.yaml

@@ -0,0 +1,29 @@
+id: smoke-detector-battery-check
+version: 1
+name: Smoke Detector Battery Check Reminder
+description: >
+  Reminds you to test/replace smoke detector batteries on a schedule.
+  Use this if the only time you think about smoke detectors is when one
+  starts chirping at 3am.
+category: home
+tags: [home, safety, maintenance]
+schedule: "0 9 1 * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  last={{last_tested_date}}; interval={{interval_months}};
+  last_epoch=$(date -j -f %Y-%m-%d "$last" +%s 2>/dev/null || date -d "$last" +%s);
+  today_epoch=$(date +%s);
+  days_since=$(( (today_epoch-last_epoch)/86400 ));
+  interval_days=$(( interval * 30 ));
+  if [ "$days_since" -ge "$interval_days" ]; then echo "REMINDER: smoke detectors last tested $days_since day(s) ago (every ${interval} months) — test/replace batteries.";
+  else echo "OK: tested $days_since day(s) ago, due again around day $interval_days."; fi
+variables:
+  last_tested_date:
+    default: "2026-01-01"
+    description: Date (YYYY-MM-DD) you last tested/changed batteries — update this yourself.
+  interval_months:
+    default: 6
+    description: How often to test, in months.
+compatible_agents: [generic, claude, codex]
+notes: Zero-token. You update last_tested_date yourself each time you actually test.

package/jobs/security/certificate-transparency-watch.yaml

@@ -0,0 +1,31 @@
+id: certificate-transparency-watch
+version: 1
+name: Certificate Transparency Watch
+description: >
+  Checks public Certificate Transparency logs for new TLS certs issued
+  for your domain and flags any you didn't expect. Use this if you want
+  an early warning for someone issuing a cert for your domain without
+  your knowledge (a common precursor to phishing/MITM setups).
+category: security
+tags: [security, tls, certificate-transparency]
+schedule: "0 */12 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  domain={{domain}}; state={{state_file}};
+  current=$(curl -s "https://crt.sh/?q=${domain}&output=json" | grep -o '"id":[0-9]*' | sort -u);
+  if [ ! -f "$state" ]; then echo "$current" > "$state"; echo "no baseline found — saved current cert IDs as the baseline ($(echo "$current" | wc -l | tr -d ' ') certs)"; exit 0; fi;
+  new=$(comm -13 <(sort "$state") <(echo "$current" | sort));
+  if [ -n "$new" ]; then echo "NEW CERT(S) issued for $domain since last check:"; echo "$new"; echo "$current" > "$state";
+  else echo "OK: no new certs for $domain since last check"; fi
+variables:
+  domain:
+    default: "example.com"
+    description: Domain to watch in Certificate Transparency logs.
+  state_file:
+    default: "./.ct-watch-state"
+    description: File this job uses to remember which cert IDs it's already seen.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Uses the public crt.sh API (rate limits may apply).
+  Requires bash (process substitution).

package/jobs/security/firewall-rule-diff.yaml

@@ -0,0 +1,30 @@
+id: firewall-rule-diff
+version: 1
+name: Firewall Rule Diff
+description: >
+  Diffs your current firewall rules against a saved baseline and flags
+  any drift. Use this if a firewall rule has ever changed without
+  anyone remembering who did it or why.
+category: security
+tags: [security, firewall, drift]
+schedule: "0 6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  baseline={{baseline_path}};
+  if command -v ufw >/dev/null 2>&1; then current=$(sudo ufw status verbose 2>/dev/null);
+  elif command -v iptables >/dev/null 2>&1; then current=$(sudo iptables -S 2>/dev/null);
+  else echo "ERROR: no supported firewall tool found (ufw/iptables)"; exit 1; fi;
+  if [ ! -f "$baseline" ]; then echo "$current" > "$baseline"; echo "no baseline found — saved current rules as the new baseline"; exit 0; fi;
+  if diff -q <(echo "$current") "$baseline" >/dev/null 2>&1; then echo "OK: firewall rules match baseline";
+  else echo "DRIFT: firewall rules differ from baseline:"; diff <(echo "$current") "$baseline"; exit 1; fi
+variables:
+  baseline_path:
+    default: "./firewall-baseline.txt"
+    description: File storing the known-good firewall rule snapshot.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Requires sudo access to read ufw/iptables rules (configure passwordless
+  sudo for this specific read-only command if running unattended). First
+  run saves the baseline; later runs diff against it. Requires bash
+  (process substitution).

package/jobs/security/sudo-usage-audit.yaml

@@ -0,0 +1,35 @@
+id: sudo-usage-audit
+version: 1
+name: Sudo Usage Audit
+description: >
+  Reports new sudo commands run since the last check. Use this if you
+  want to notice unexpected privilege escalation on a shared or
+  internet-facing server.
+category: security
+tags: [security, sudo, audit]
+schedule: "0 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  log={{auth_log_path}}; state={{state_file}};
+  [ -f "$log" ] || { echo "ERROR: $log not found"; exit 1; };
+  total=$(grep -c "sudo:.*COMMAND=" "$log");
+  last=$(cat "$state" 2>/dev/null || echo 0);
+  new=$(( total - last ));
+  [ "$new" -lt 0 ] && new=0;
+  echo "$total" > "$state";
+  if [ "$new" -gt 0 ]; then
+    echo "New sudo commands since last check ($new):";
+    grep "sudo:.*COMMAND=" "$log" | tail -n "$new";
+  else echo "OK: no new sudo usage since last check"; fi
+variables:
+  auth_log_path:
+    default: "/var/log/auth.log"
+    description: Path to the auth log (Linux-style).
+  state_file:
+    default: "./.sudo-audit-state"
+    description: File this job uses to remember the last count seen, so it only reports new entries.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Linux-oriented (/var/log/auth.log with sudo entries). On macOS use
+  `log show --predicate 'process == "sudo"'` instead and adapt the command.

package/jobs/team/1on1-prep-reminder.yaml

@@ -0,0 +1,26 @@
+id: 1on1-prep-reminder
+version: 1
+name: 1:1 Prep Reminder
+description: >
+  Nudges you to prep talking points before a recurring 1:1 and shows
+  your last notes. Use this if you've ever walked into a 1:1 with
+  nothing prepared and just winged it.
+category: team
+tags: [1on1, meetings, team]
+schedule: "0 9 * * 3"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  echo "1:1 with {{person_name}} coming up. Jot down talking points.";
+  if [ -f "{{notes_file}}" ]; then echo "--- last notes ---"; tail -n 10 "{{notes_file}}"; fi
+variables:
+  person_name:
+    default: "your manager"
+    description: Who the 1:1 is with.
+  notes_file:
+    default: "./1on1-notes.txt"
+    description: Plain text file you append notes/action items to after each 1:1.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Adjust the schedule to match your actual 1:1 day/time —
+  the default (Wednesday morning) is just a placeholder.

package/jobs/team/pto-balance-check.yaml

@@ -0,0 +1,33 @@
+id: pto-balance-check
+version: 1
+name: PTO Balance Check
+description: >
+  Warns you before unused PTO expires or resets. Use this if you've
+  ever lost vacation days because you forgot they don't roll over.
+category: team
+tags: [pto, vacation, team]
+schedule: "0 9 1 * *"
+timezone: "America/Los_Angeles"
+runner: shell
+command: >
+  today_epoch=$(date +%s);
+  expiry_epoch=$(date -j -f %Y-%m-%d "{{expiry_date}}" +%s 2>/dev/null || date -d "{{expiry_date}}" +%s);
+  days_left=$(( (expiry_epoch-today_epoch)/86400 ));
+  if [ "$days_left" -lt 0 ]; then echo "note: expiry date has passed — update expiry_date for the next period.";
+  elif [ "$days_left" -le {{warn_days_before_expiry}} ] && [ {{pto_balance_hours}} -gt 0 ]; then
+    echo "REMINDER: {{pto_balance_hours}}h PTO expires in $days_left day(s) (on {{expiry_date}}) — use it or lose it.";
+  else echo "OK: {{pto_balance_hours}}h PTO, $days_left day(s) until expiry."; fi
+variables:
+  pto_balance_hours:
+    default: 40
+    description: Your current unused PTO balance, in hours — update this yourself as it changes.
+  expiry_date:
+    default: "2026-12-31"
+    description: Date (YYYY-MM-DD) this PTO expires or resets.
+  warn_days_before_expiry:
+    default: 30
+    description: Start warning this many days before expiry.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. You maintain pto_balance_hours and expiry_date yourself —
+  this doesn't pull from any HR system.

package/jobs/travel/flight-checkin-reminder.yaml

@@ -0,0 +1,31 @@
+id: flight-checkin-reminder
+version: 1
+name: Flight Check-in Reminder
+description: >
+  Reminds you when online check-in opens for an upcoming flight. Use
+  this if you've ever missed the good seats because check-in opened
+  while you were asleep.
+category: travel
+tags: [travel, flight, reminder]
+schedule: "0 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  flight="{{flight_datetime}}"; hours_before={{checkin_hours_before}};
+  flight_epoch=$(date -j -f "%Y-%m-%d %H:%M" "$flight" +%s 2>/dev/null || date -d "$flight" +%s);
+  now_epoch=$(date +%s);
+  hours_left=$(( (flight_epoch-now_epoch)/3600 ));
+  if [ "$hours_left" -le 0 ]; then echo "note: flight time has passed — update flight_datetime for your next trip.";
+  elif [ "$hours_left" -le "$hours_before" ]; then echo "REMINDER: check in for your flight — departs in ${hours_left}h ($flight).";
+  else echo "OK: ${hours_left}h until flight ($flight), check-in opens around ${hours_before}h before departure."; fi
+variables:
+  flight_datetime:
+    default: "2026-12-31 08:00"
+    description: Flight departure date and time ("YYYY-MM-DD HH:MM", local to the schedule's timezone).
+  checkin_hours_before:
+    default: 24
+    description: How many hours before departure check-in typically opens for your airline.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Zero-token. Runs hourly since it's a time-sensitive window — update
+  flight_datetime for each new trip.