@wonsukchoi/crondex 0.5.0 → 0.7.0

package/jobs/construction/inspection-deadline-reminder.yaml

@@ -0,0 +1,31 @@
+id: inspection-deadline-reminder
+version: 1
+name: Inspection Deadline Reminder
+description: >
+  Warns you before a scheduled inspection date, so the site is actually
+  ready. Use this if an inspector has ever shown up to a site that wasn't
+  prepped because the date snuck up on the crew.
+category: construction
+tags: [construction, inspection, scheduling]
+schedule: "0 7 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  awk -F, -v today="$today" -v warn={{warn_days}} '
+    NR>1 {
+      cmd="date -d \"" $2 "\" +%s 2>/dev/null || date -jf \"%Y-%m-%d\" \"" $2 "\" +%s";
+      cmd | getline insp_ts; close(cmd);
+      days_left = int((insp_ts - today) / 86400);
+      if (days_left <= warn && days_left >= 0) print "WARNING: " $1 " inspection in " days_left " days (" $2 ")";
+    }
+  ' {{inspections_csv}}
+variables:
+  inspections_csv:
+    default: "inspections.csv"
+    description: "CSV with header row, columns: site_name,inspection_date(YYYY-MM-DD)."
+  warn_days:
+    default: 3
+    description: Days before the inspection to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Keep inspections.csv updated as inspections get scheduled with the local authority.

package/jobs/construction/permit-expiry-check.yaml

@@ -0,0 +1,31 @@
+id: permit-expiry-check
+version: 1
+name: Building Permit Expiry Check
+description: >
+  Warns you before a building permit expires so work doesn't get caught
+  without valid coverage. Use this if a permit has ever lapsed mid-project
+  and forced a costly re-inspection or re-application.
+category: construction
+tags: [construction, permits, compliance]
+schedule: "0 8 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  awk -F, -v today="$today" -v warn={{warn_days}} '
+    NR>1 {
+      cmd="date -d \"" $2 "\" +%s 2>/dev/null || date -jf \"%Y-%m-%d\" \"" $2 "\" +%s";
+      cmd | getline exp_ts; close(cmd);
+      days_left = int((exp_ts - today) / 86400);
+      if (days_left <= warn) print "WARNING: permit \"" $1 "\" expires in " days_left " days (" $2 ")";
+    }
+  ' {{permits_csv}}
+variables:
+  permits_csv:
+    default: "permits.csv"
+    description: "CSV with header row, columns: permit_name,expiry_date(YYYY-MM-DD)."
+  warn_days:
+    default: 30
+    description: Days before expiry to start warning.
+compatible_agents: [generic, claude, codex]
+notes: Keep permits.csv updated per project/site — one row per active permit.

package/jobs/content/canonical-tag-check.yaml

@@ -0,0 +1,25 @@
+id: canonical-tag-check
+version: 1
+name: Canonical Tag Check
+description: >
+  Checks a list of pages for missing or self-conflicting canonical tags.
+  Use this if a templating bug has ever pointed every page's canonical at
+  the homepage (or nowhere at all) without anyone noticing.
+category: content
+tags: [seo, canonical, content]
+schedule: "0 7 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  while IFS= read -r url; do
+    [ -z "$url" ] && continue;
+    canonical=$(curl -s "$url" | grep -o '<link[^>]*rel=["'"'"']canonical["'"'"'][^>]*>' | grep -o 'href=["'"'"'][^"'"'"']*' | sed 's/href=["'"'"']//');
+    if [ -z "$canonical" ]; then echo "MISSING canonical: $url";
+    elif [ "$canonical" != "$url" ]; then echo "MISMATCH: $url -> $canonical"; fi;
+  done < {{url_list_file}}
+variables:
+  url_list_file:
+    default: "urls.txt"
+    description: Path to a file with one URL per line to check.
+compatible_agents: [generic, claude, codex]
+notes: Flags any canonical that doesn't exactly match the page URL — cross-check mismatches manually since some (e.g. tracking params stripped) are intentional.

package/jobs/content/hreflang-audit.yaml

@@ -0,0 +1,25 @@
+id: hreflang-audit
+version: 1
+name: Hreflang Audit
+description: >
+  Checks a page's hreflang tags for missing reciprocal links or obviously
+  wrong language/region codes. Use this if a hreflang mistake has ever
+  quietly sent the wrong country's visitors to the wrong language version.
+category: content
+tags: [seo, hreflang, international]
+schedule: "0 7 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  tags=$(curl -s {{page_url}} | grep -o '<link[^>]*rel=["'"'"']alternate["'"'"'][^>]*hreflang=["'"'"'][^"'"'"']*["'"'"'][^>]*>');
+  if [ -z "$tags" ]; then echo "WARNING: no hreflang tags found on {{page_url}}"; exit 1; fi;
+  echo "$tags" | grep -o 'hreflang=["'"'"'][^"'"'"']*' | sed 's/hreflang=["'"'"']//' | while read -r code; do
+    echo "$code" | grep -qE '^[a-z]{2}(-[A-Z]{2})?$|^x-default$' || echo "WARNING: suspicious hreflang code \"$code\" on {{page_url}}";
+  done;
+  echo "OK: found $(echo "$tags" | wc -l | tr -d ' ') hreflang tag(s) — verify reciprocal links manually"
+variables:
+  page_url:
+    default: "https://example.com"
+    description: URL of the page to check.
+compatible_agents: [generic, claude, codex]
+notes: Flags malformed language/region codes and missing tags on this page only — checking reciprocal hreflang links across the whole site needs crawling every listed URL, which this job doesn't do.

package/jobs/content/image-alt-text-audit.yaml

@@ -0,0 +1,21 @@
+id: image-alt-text-audit
+version: 1
+name: Image Alt Text Audit
+description: >
+  Checks a page for images missing alt text. Use this if images have ever
+  shipped without alt text because nobody double-checked before merging.
+category: content
+tags: [seo, accessibility, images]
+schedule: "0 7 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  count=$(curl -s {{page_url}} | grep -o '<img[^>]*>' | grep -cv 'alt=');
+  if [ "$count" -gt 0 ]; then echo "WARNING: $count image(s) missing alt text on {{page_url}}"; exit 1;
+  else echo "OK: all images on {{page_url}} have alt text"; fi
+variables:
+  page_url:
+    default: "https://example.com"
+    description: URL of the page to check.
+compatible_agents: [generic, claude, codex]
+notes: Flags images with no alt attribute at all — doesn't judge whether existing alt text is actually descriptive.

package/jobs/content/page-speed-regression-watch.yaml

@@ -0,0 +1,26 @@
+id: page-speed-regression-watch
+version: 1
+name: Page Speed Regression Watch
+description: >
+  Checks a page's load time against a baseline and flags a real
+  regression. Use this if a page has ever gotten slowly, silently slower
+  release after release until it was a real problem.
+category: content
+tags: [performance, seo, monitoring]
+schedule: "0 6 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  time_total=$(curl -s -o /dev/null -w '%{time_total}' {{page_url}});
+  if awk "BEGIN{exit !($time_total > {{threshold_seconds}})}"; then
+    echo "WARNING: {{page_url}} took ${time_total}s to load (threshold {{threshold_seconds}}s)"; exit 1;
+  else echo "OK: {{page_url}} loaded in ${time_total}s"; fi
+variables:
+  page_url:
+    default: "https://example.com"
+    description: URL of the page to check.
+  threshold_seconds:
+    default: 3
+    description: Load time in seconds beyond which to warn.
+compatible_agents: [generic, claude, codex]
+notes: Measures raw TTFB-through-download time via curl, not real browser rendering — use a synthetic monitoring tool for full Core Web Vitals.

package/jobs/content/sitemap-freshness-check.yaml

@@ -0,0 +1,31 @@
+id: sitemap-freshness-check
+version: 1
+name: Sitemap Freshness Check
+description: >
+  Checks that your sitemap.xml was actually regenerated recently and isn't
+  quietly stuck on an old snapshot. Use this if your sitemap is generated
+  by a build step that's ever silently failed or skipped.
+category: content
+tags: [seo, sitemap, freshness]
+schedule: "0 7 * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  lastmod=$(curl -s {{sitemap_url}} | grep -o '<lastmod>[^<]*' | sed 's/<lastmod>//' | sort -r | head -n1);
+  if [ -z "$lastmod" ]; then echo "WARNING: could not find any <lastmod> entries in {{sitemap_url}}"; exit 1;
+  else
+    lastmod_ts=$(date -d "$lastmod" +%s 2>/dev/null || date -jf "%Y-%m-%d" "${lastmod%%T*}" +%s 2>/dev/null);
+    now_ts=$(date +%s);
+    age_days=$(( (now_ts - lastmod_ts) / 86400 ));
+    if [ "$age_days" -ge "{{max_age_days}}" ]; then echo "WARNING: newest sitemap entry is $age_days days old"; exit 1;
+    else echo "OK: newest sitemap entry is $age_days days old"; fi
+  fi
+variables:
+  sitemap_url:
+    default: "https://example.com/sitemap.xml"
+    description: URL of the sitemap to check.
+  max_age_days:
+    default: 14
+    description: Days since the newest lastmod entry before it's flagged stale.
+compatible_agents: [generic, claude, codex]
+notes: Assumes at least one <lastmod> tag exists in the sitemap; sitemap index files with nested sitemaps aren't followed.

package/jobs/content/stale-post-audit.yaml

@@ -0,0 +1,28 @@
+id: stale-post-audit
+version: 1
+name: Stale Post Audit
+description: >
+  Flags published posts that haven't been touched in a long time, as
+  candidates for a refresh. Use this if old content quietly rots (dead
+  screenshots, outdated advice) while still ranking and getting traffic.
+category: content
+tags: [content, seo, maintenance]
+schedule: "0 8 1 * *"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Review posts/pages under {{content_dir}}.
+  1. For each, find the last modified date (git log or frontmatter date).
+  2. Flag any not updated in more than {{stale_months}} months.
+  3. For the flagged ones, note anything obviously outdated (broken
+     screenshots, version numbers, dead links) if visible in the content.
+  4. Report the list ranked oldest-first.
+variables:
+  content_dir:
+    default: "content/posts"
+    description: Directory containing published content.
+  stale_months:
+    default: 12
+    description: Months since last update before a post is flagged.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — "last modified" via git log is easy in shell, but judging what's outdated needs an agent reading the content.

package/jobs/creator/content-calendar-gap-check.yaml

@@ -0,0 +1,31 @@
+id: content-calendar-gap-check
+version: 1
+name: Content Calendar Gap Check
+description: >
+  Checks that you have something scheduled to post in the next few days.
+  Use this if your publishing cadence has ever quietly broken because
+  nothing was queued and nobody noticed until the gap already showed.
+category: creator
+tags: [content, calendar, publishing]
+schedule: "0 9 * * 1,4"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  cutoff=$(( today + {{lookahead_days}} * 86400 ));
+  next_ts=$(awk -F, 'NR>1 {
+      cmd="date -d \"" $1 "\" +%s 2>/dev/null || date -jf \"%Y-%m-%d\" \"" $1 "\" +%s";
+      cmd | getline ts; close(cmd);
+      if (ts >= "'"$today"'") { print ts; exit }
+    }' {{schedule_csv}});
+  if [ -z "$next_ts" ] || [ "$next_ts" -gt "$cutoff" ]; then echo "WARNING: no post scheduled in the next {{lookahead_days}} days"; exit 1;
+  else echo "OK: next post is scheduled within {{lookahead_days}} days"; fi
+variables:
+  schedule_csv:
+    default: "content-calendar.csv"
+    description: "CSV with header row, columns: publish_date(YYYY-MM-DD),title,platform."
+  lookahead_days:
+    default: 3
+    description: Days ahead that must have at least one scheduled post.
+compatible_agents: [generic, claude, codex]
+notes: Reads a plain CSV export of your content calendar — point schedule_csv at wherever your planning tool exports to.

package/jobs/creator/engagement-drop-watch.yaml

@@ -0,0 +1,36 @@
+id: engagement-drop-watch
+version: 1
+name: Engagement Drop Watch
+description: >
+  Compares recent post engagement to your baseline and flags a real drop.
+  Use this if you've ever kept posting into a falling algorithm curve for
+  weeks before noticing the numbers were down.
+category: creator
+tags: [content, engagement, social]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Check engagement (likes, comments, shares, views — whatever the
+  platform reports) for posts on {{platform_hint}} over the last
+  {{recent_days}} days.
+  1. Compare average engagement rate to the prior {{baseline_days}}-day
+     baseline.
+  2. Flag a drop of {{drop_threshold_pct}}% or more.
+  3. If flagged, note anything that changed around the drop (posting time,
+     format, frequency) if it's visible from the data.
+variables:
+  platform_hint:
+    default: "your primary platform (YouTube, Instagram, TikTok, etc.)"
+    description: Which platform's analytics to check.
+  recent_days:
+    default: 7
+    description: Recent window to evaluate.
+  baseline_days:
+    default: 30
+    description: Prior window used as the baseline for comparison.
+  drop_threshold_pct:
+    default: 25
+    description: Percent drop in engagement rate that counts as a real decline.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — platform analytics APIs vary widely and most need OAuth the agent may not have configured.

package/jobs/devops/cdn-cache-purge-reminder.yaml

@@ -0,0 +1,27 @@
+id: cdn-cache-purge-reminder
+version: 1
+name: CDN Cache Purge Reminder
+description: >
+  Reminds you to purge the CDN cache after a deploy, and can trigger it
+  directly if you give it credentials. Use this if you've ever shipped a
+  fix and then spent an hour confused why users still saw the old version.
+category: devops
+tags: [cdn, cache, deploy]
+schedule: "*/30 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  if [ -z "{{deploy_marker_file}}" ] || [ ! -f "{{deploy_marker_file}}" ]; then echo "OK: no pending deploy marker found"; exit 0; fi;
+  echo "REMINDER: deploy marker found at {{deploy_marker_file}} — purge CDN cache for {{cdn_zone}} if not already done, then remove the marker.";
+variables:
+  deploy_marker_file:
+    default: ".deploy-pending"
+    description: Path to a marker file your deploy script touches; job reminds until it's removed.
+  cdn_zone:
+    default: "your CDN zone/distribution"
+    description: Name of the CDN zone, for the reminder text.
+compatible_agents: [generic, claude, codex]
+notes: >
+  Deliberately doesn't call any CDN API directly since providers differ
+  widely (Cloudflare, Fastly, CloudFront) — have your deploy script touch
+  the marker file, and remove it once cache is purged.

package/jobs/devops/ci-build-time-regression-watch.yaml

@@ -0,0 +1,35 @@
+id: ci-build-time-regression-watch
+version: 1
+name: CI Build Time Regression Watch
+description: >
+  Compares recent CI build durations to a baseline and flags a real
+  slowdown. Use this if build times have ever crept up gradually until a
+  30-second CI run became a 15-minute one.
+category: devops
+tags: [ci, performance, build-time]
+schedule: "0 9 * * 1-5"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Check recent CI run durations for {{repo_hint}} over the last
+  {{recent_runs}} runs on the main branch.
+  1. Compute the average duration and compare to the average of the prior
+     {{baseline_runs}} runs.
+  2. Flag a regression of {{threshold_pct}}% or more.
+  3. If flagged, note which stage/job grew the most, if that breakdown is
+     available.
+variables:
+  repo_hint:
+    default: "this repo's CI (GitHub Actions, CircleCI, etc.)"
+    description: Which repo and CI provider to check.
+  recent_runs:
+    default: 10
+    description: Number of recent runs to average for the current period.
+  baseline_runs:
+    default: 30
+    description: Number of prior runs to use as the baseline.
+  threshold_pct:
+    default: 30
+    description: Percent increase in average duration that counts as a regression.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — CI provider APIs vary, and per-stage timing breakdowns need provider-specific parsing.

package/jobs/devops/error-rate-spike-watch.yaml

@@ -0,0 +1,43 @@
+id: error-rate-spike-watch
+version: 1
+name: Error Rate Spike Watch
+description: >
+  Checks your error tracker's recent error count against a threshold and
+  flags a spike. Use this if a bad deploy has ever quietly spiked errors
+  for hours before anyone noticed.
+category: devops
+tags: [errors, monitoring, alerting]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: hybrid
+command: >
+  if [ -n "$SENTRY_AUTH_TOKEN" ] && [ -n "{{sentry_project}}" ]; then
+    count=$(curl -s -H "Authorization: Bearer $SENTRY_AUTH_TOKEN" "https://sentry.io/api/0/projects/{{sentry_org}}/{{sentry_project}}/events/?statsPeriod=15m" | grep -o '"id"' | wc -l | tr -d ' ');
+    if [ "$count" -ge "{{threshold}}" ]; then echo "WARNING: $count errors in last 15m (threshold {{threshold}})"; exit 1;
+    else echo "OK: $count errors in last 15m"; fi
+  else
+    echo "SENTRY_AUTH_TOKEN or sentry_project not set — use agent-prompt mode instead";
+  fi
+prompt: |
+  Check the error tracker (Sentry, Rollbar, Bugsnag, or whatever this
+  project uses) for {{sentry_project}} over the last 15 minutes.
+  1. Compare current error volume to the typical rate for this time of day.
+  2. If it's spiking (well above {{threshold}} events, or a clear anomaly
+     vs. baseline), alert with the top offending error and when it started.
+  3. If normal, report the count in one line.
+script_note: >
+  `command` only supports Sentry's REST API with a raw event count
+  threshold. `prompt` works with any error tracker and can reason about
+  baseline vs. anomaly instead of a flat threshold.
+variables:
+  sentry_org:
+    default: "your-org"
+    description: Sentry organization slug.
+  sentry_project:
+    default: "your-project"
+    description: Sentry project slug.
+  threshold:
+    default: 50
+    description: Error count in the window that counts as a spike.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: Script mode needs SENTRY_AUTH_TOKEN in the environment; scoped read access to project events is enough.

package/jobs/devops/feature-flag-staleness-audit.yaml

@@ -0,0 +1,30 @@
+id: feature-flag-staleness-audit
+version: 1
+name: Feature Flag Staleness Audit
+description: >
+  Flags feature flags that have been at 100% (or 0%) rollout for a long
+  time and never cleaned up. Use this if your flag list has become a
+  graveyard of decisions nobody removed the scaffolding for.
+category: devops
+tags: [feature-flags, cleanup, tech-debt]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Audit feature flags in {{flag_provider_hint}} (or the flags config file
+  in this repo if flags are managed in code).
+  1. List flags that have been fully rolled out (100%) or fully killed (0%)
+     for more than {{stale_days}} days.
+  2. For each, note whether the flag and its dead branch are still
+     referenced in code.
+  3. Report the list, ranked by how long they've been stale, as candidates
+     for removal.
+variables:
+  flag_provider_hint:
+    default: "LaunchDarkly"
+    description: Name of the feature flag system/provider in use (e.g. LaunchDarkly, Unleash, in-repo config).
+  stale_days:
+    default: 60
+    description: Days at a terminal rollout state before a flag counts as stale.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — flag providers have wildly different APIs, and "still referenced in code" needs a code-aware agent.

package/jobs/devops/k8s-pod-restart-watch.yaml

@@ -0,0 +1,26 @@
+id: k8s-pod-restart-watch
+version: 1
+name: Kubernetes Pod Restart Watch
+description: >
+  Checks for pods with a high restart count and flags them. Use this if a
+  crash-looping pod has ever burned through hours before anyone noticed
+  it wasn't actually staying up.
+category: devops
+tags: [kubernetes, pods, monitoring]
+schedule: "*/15 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  command -v kubectl >/dev/null 2>&1 || { echo "ERROR: kubectl not installed"; exit 1; };
+  kubectl get pods -n {{namespace}} --no-headers 2>/dev/null | awk -v threshold={{threshold}} '
+    { restarts=$4+0; if (restarts >= threshold) print "WARNING: pod " $1 " has " restarts " restarts" }
+  '
+variables:
+  namespace:
+    default: "default"
+    description: Kubernetes namespace to check.
+  threshold:
+    default: 5
+    description: Restart count that triggers a warning.
+compatible_agents: [generic, claude, codex]
+notes: Requires kubectl configured with a context pointing at the cluster; emits nothing if no pod is over threshold.

package/jobs/devops/log-forwarding-health-check.yaml

@@ -0,0 +1,32 @@
+id: log-forwarding-health-check
+version: 1
+name: Log Forwarding Health Check
+description: >
+  Checks that logs are still actually arriving at your log aggregator.
+  Use this if a log shipper has ever silently died and nobody found out
+  until they needed logs that were never collected.
+category: devops
+tags: [logging, monitoring, observability]
+schedule: "*/30 * * * *"
+timezone: "UTC"
+runner: shell
+command: >
+  last_ts=$(curl -s -H "Authorization: Bearer {{log_api_token}}" "{{log_query_api_url}}" | grep -o '"timestamp":"[^"]*"' | sort -r | head -n1 | cut -d'"' -f4);
+  if [ -z "$last_ts" ]; then echo "WARNING: no recent log entries found via {{log_query_api_url}}"; exit 1; fi;
+  last_epoch=$(date -d "$last_ts" +%s 2>/dev/null);
+  now_epoch=$(date +%s);
+  minutes_since=$(( (now_epoch - last_epoch) / 60 ));
+  if [ "$minutes_since" -ge "{{max_gap_minutes}}" ]; then echo "WARNING: no new logs in $minutes_since minutes (last at $last_ts)"; exit 1;
+  else echo "OK: most recent log entry $minutes_since minutes ago"; fi
+variables:
+  log_query_api_url:
+    default: "https://api.example-logs.com/query?limit=1&sort=desc"
+    description: Log aggregator API endpoint returning at least the most recent entry's timestamp.
+  log_api_token:
+    default: "your-api-token"
+    description: API token for the log aggregator.
+  max_gap_minutes:
+    default: 15
+    description: Minutes without a new log entry before it's flagged.
+compatible_agents: [generic, claude, codex]
+notes: Generic REST pattern — point log_query_api_url at your aggregator's (Datadog, Splunk, ELK) most-recent-entry query; adjust field names to match its response shape.

package/jobs/devops/staging-prod-config-diff.yaml

@@ -0,0 +1,32 @@
+id: staging-prod-config-diff
+version: 1
+name: Staging vs Production Config Diff
+description: >
+  Diffs environment variable keys between staging and production and
+  flags mismatches. Use this if staging and prod have ever quietly
+  drifted apart until a deploy broke only in one of them.
+category: devops
+tags: [config, environments, drift]
+schedule: "0 8 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  staging_keys=$(cut -d= -f1 {{staging_env_file}} | grep -v '^#' | sort);
+  prod_keys=$(cut -d= -f1 {{prod_env_file}} | grep -v '^#' | sort);
+  only_staging=$(comm -23 <(echo "$staging_keys") <(echo "$prod_keys"));
+  only_prod=$(comm -13 <(echo "$staging_keys") <(echo "$prod_keys"));
+  if [ -n "$only_staging" ] || [ -n "$only_prod" ]; then
+    echo "DRIFT DETECTED:";
+    [ -n "$only_staging" ] && echo "only in staging: $only_staging";
+    [ -n "$only_prod" ] && echo "only in prod: $only_prod";
+    exit 1;
+  else echo "OK: staging and prod env keys match"; fi
+variables:
+  staging_env_file:
+    default: ".env.staging"
+    description: Path to the staging environment file (keys only compared, not values).
+  prod_env_file:
+    default: ".env.production"
+    description: Path to the production environment file.
+compatible_agents: [generic, claude, codex]
+notes: Compares key names only, never values, so secrets are never read or logged.

package/jobs/devops/terraform-drift-check.yaml

@@ -0,0 +1,24 @@
+id: terraform-drift-check
+version: 1
+name: Terraform Drift Check
+description: >
+  Runs a Terraform plan and flags it if there's drift between your state
+  and actual infrastructure. Use this if you've ever had someone click
+  around in a cloud console and quietly break parity with your IaC.
+category: devops
+tags: [terraform, infrastructure, drift]
+schedule: "0 7 * * 1-5"
+timezone: "UTC"
+runner: shell
+command: >
+  cd {{terraform_dir}} && terraform plan -detailed-exitcode -no-color -input=false > /tmp/tf-plan.out 2>&1;
+  code=$?;
+  if [ "$code" -eq 2 ]; then echo "DRIFT DETECTED in {{terraform_dir}}:"; tail -n 40 /tmp/tf-plan.out; exit 1;
+  elif [ "$code" -eq 0 ]; then echo "OK: no drift in {{terraform_dir}}";
+  else echo "ERROR: terraform plan failed"; tail -n 40 /tmp/tf-plan.out; exit 1; fi
+variables:
+  terraform_dir:
+    default: "."
+    description: Path to the Terraform root module to check.
+compatible_agents: [generic, claude, codex]
+notes: Requires terraform CLI and valid provider credentials already configured in the environment.

package/jobs/education/assignment-grading-backlog-check.yaml

@@ -0,0 +1,23 @@
+id: assignment-grading-backlog-check
+version: 1
+name: Assignment Grading Backlog Check
+description: >
+  Checks how many submitted assignments are still ungraded and flags it if
+  the backlog is growing. Use this if grading has ever piled up for weeks
+  until students started asking where their grades were.
+category: education
+tags: [education, grading, backlog]
+schedule: "0 8 * * 1-5"
+timezone: "UTC"
+runner: shell
+command: >
+  psql "{{database_url}}" -t -c "select course, count(*) from submissions where graded_at is null and submitted_at < now() - interval '{{stale_days}} days' group by course;"
+variables:
+  database_url:
+    default: "postgres://user:pass@host:5432/db"
+    description: Connection string for the LMS/gradebook database.
+  stale_days:
+    default: 3
+    description: Days a submission can sit ungraded before it's counted in the backlog.
+compatible_agents: [generic, claude, codex]
+notes: Assumes a `submissions` table with `graded_at` and `submitted_at` — adjust the query for your LMS's schema or export.

package/jobs/education/attendance-anomaly-check.yaml

@@ -0,0 +1,33 @@
+id: attendance-anomaly-check
+version: 1
+name: Attendance Anomaly Check
+description: >
+  Flags students whose attendance has dropped sharply, before it becomes a
+  pattern nobody caught early. Use this if a student's attendance has ever
+  quietly fallen off and only got noticed at report-card time.
+category: education
+tags: [education, attendance, students]
+schedule: "0 8 * * 1"
+timezone: "UTC"
+runner: agent-prompt
+prompt: |
+  Review attendance records from {{sis_hint}} for the last
+  {{recent_weeks}} weeks.
+  1. Compare each student's recent attendance rate to their prior
+     baseline for the term.
+  2. Flag students with a drop of {{drop_threshold_pct}} percentage
+     points or more.
+  3. Report flagged students with their recent and baseline rates, so
+     follow-up (counselor, parent contact) can be prioritized.
+variables:
+  sis_hint:
+    default: "your student information system"
+    description: Where attendance data lives.
+  recent_weeks:
+    default: 2
+    description: Recent window to evaluate.
+  drop_threshold_pct:
+    default: 20
+    description: Percentage-point drop in attendance rate that counts as an anomaly.
+compatible_agents: [claude, codex, hermes, openclaw, generic]
+notes: No generic script mode — SIS platforms vary widely and most need OAuth or export access the agent may not have configured.

package/jobs/events/rsvp-followup-reminder.yaml

@@ -0,0 +1,30 @@
+id: rsvp-followup-reminder
+version: 1
+name: RSVP Follow-up Reminder
+description: >
+  Flags invitees who haven't RSVP'd as the event date gets close. Use this
+  if you've ever had to guess headcount because half the guest list never
+  replied and nobody chased them.
+category: events
+tags: [events, rsvp, planning]
+schedule: "0 9 * * 1"
+timezone: "UTC"
+runner: shell
+command: >
+  today=$(date +%s);
+  event_ts=$(date -d "{{event_date}}" +%s 2>/dev/null || date -jf "%Y-%m-%d" "{{event_date}}" +%s);
+  days_left=$(( (event_ts - today) / 86400 ));
+  if [ "$days_left" -gt "{{warn_days}}" ]; then echo "OK: event is $days_left days out, no follow-up needed yet"; exit 0; fi;
+  awk -F, 'NR>1 && $2 == "pending" {print "PENDING RSVP: " $1}' {{guest_list_csv}}
+variables:
+  event_date:
+    default: "2026-12-01"
+    description: Date of the event (YYYY-MM-DD).
+  warn_days:
+    default: 14
+    description: Days before the event to start flagging pending RSVPs.
+  guest_list_csv:
+    default: "guest-list.csv"
+    description: "CSV with header row, columns: name,rsvp_status(pending/yes/no)."
+compatible_agents: [generic, claude, codex]
+notes: Keep guest-list.csv updated as RSVPs come in, or export it from your invite tool before each run.