Skip to content

Commit ae362cd

Browse files
FlowmemoryAIFlowmemoryAI
committed
Add Windows alert schedule automation
1 parent 5aa92d0 commit ae362cd

15 files changed

Lines changed: 978 additions & 12 deletions

‎docs/OPERATIONS/FLOWCHAIN_OWNER_OPERATED_PUBLIC_RPC.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ The repository now provides:
1111
- `npm run flowchain:service:monitor` for repeated live service sampling that proves height progression over an operator-selected window.
1212
- `npm run flowchain:ops:snapshot` for one no-secret operator report that classifies critical incidents, public-readiness blockers, and incident commands.
1313
- `npm run flowchain:ops:incident-drill` for a synthetic no-values incident drill that proves node-down, control-plane-down, stale-state, stalled-height, and no-secret failures are classified as critical while owner-input blockers stay non-critical.
14+
- `npm run flowchain:ops:alerts:install:windows` and `npm run flowchain:ops:alerts:install:validate` for a no-secret Windows Scheduled Task install/status/uninstall path for recurring local alert refresh.
1415
- `npm run flowchain:service:stop` and `npm run flowchain:service:restart`, which preserve runtime state.
1516
- `npm run flowchain:public-rpc:check` for endpoint, TLS, CORS, rate-limit, health, discovery, readiness, state, and response-hygiene checks.
1617
- `npm run flowchain:public-rpc:edge-template` for a no-values Nginx public-edge template that proxies this chain's private RPC origin through owner TLS and rate limiting.

‎docs/agent-runs/live-product-infra-rpc/ALERT_INSTALL_VALIDATION.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# FlowChain Alert Install Validation
2+
3+
Generated: 2026-05-17T10:27:22.7634651Z
4+
Status: passed
5+
6+
This validation proves the scheduled alert refresh path is planned, no-secret, non-mutating in plan mode, and refreshes local alert evidence without external delivery.
7+
8+
## Checks
9+
10+
- installScriptExists: True
11+
- alertsScriptExists: True
12+
- packageScriptsPresent: True
13+
- planCommandPassed: True
14+
- planDidNotMutate: True
15+
- schedulerCmdletsAvailable: True
16+
- scheduledTaskActionSupportsWorkingDirectory: True
17+
- scheduledTaskTriggerSupportsRepetition: True
18+
- actionUsesAlertsScript: True
19+
- actionUsesRepoWorkingDirectory: True
20+
- hasAllowBlocked: True
21+
- hasReportPath: True
22+
- hasMarkdownPath: True
23+
- hasOpsSnapshotPath: True
24+
- noExternalDelivery: True
25+
- commandsPresent: True
26+
- scheduledCommandKeepsBlockedAlertsVisible: True
27+
- scheduledCommandDoesNotDisableRefresh: True
28+
- envValuesPrintedFalse: True
29+
- noSecrets: True
30+
- broadcastsFalse: True
31+
32+
## Commands
33+
34+
- plan: npm run flowchain:ops:alerts:install:windows -- -Action Plan
35+
- install: npm run flowchain:ops:alerts:install:windows -- -Action Install
36+
- status: npm run flowchain:ops:alerts:install:windows -- -Action Status
37+
- uninstall: npm run flowchain:ops:alerts:install:windows -- -Action Uninstall
38+
- validate: npm run flowchain:ops:alerts:install:validate

‎docs/agent-runs/live-product-infra-rpc/ARCHITECTURE_AUDIT.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# FlowChain Architecture Audit
22

3-
Generated: 2026-05-17T10:20:17.2181046Z
3+
Generated: 2026-05-17T10:27:20.0419597Z
44
Status: blocked
55
Blocked only on known external owner inputs: True
66

@@ -23,7 +23,7 @@ Blocked only on known external owner inputs: True
2323
| Layer | Requirement | Status | Evidence |
2424
| --- | --- | --- | --- |
2525
| L1 runtime | The block-producing node and service lifecycle are separated from RPC, run in live profile, and expose fresh state evidence. | passed | serviceStatus=passed, liveProfile=True, maxBlocks=0, nodeRunning=True, controlPlaneRunning=True, latestHeight=52644, finalizedHeight=52644 |
26-
| Operations | Operations has explicit status, monitor, ops snapshot, alert rules, incident drills, and emergency controls that classify incidents separately from owner-input blockers. | passed | monitorStatus=passed, samples=2, heightAdvanced=True, supervisorValidation=passed, supervisorRestartAttempts=1, opsSnapshot=blocked, criticalCount=0, alertRules=passed, criticalRules=5, blockedRules=5, unmappedAlerts=0, incidentDrill=passed, incidentCases=8, incidentFailed=0 |
26+
| Operations | Operations has explicit status, monitor, ops snapshot, scheduled alert refresh, alert rules, incident drills, and emergency controls that classify incidents separately from owner-input blockers. | passed | monitorStatus=passed, samples=2, heightAdvanced=True, supervisorValidation=passed, supervisorRestartAttempts=1, opsSnapshot=blocked, criticalCount=0, alertRules=passed, alertInstall=passed, alertInstallFailedChecks=0, criticalRules=5, blockedRules=5, unmappedAlerts=0, incidentDrill=passed, incidentCases=8, incidentFailed=0 |
2727
| Operations | Owner-host service lifecycle includes a no-secret Windows Scheduled Task install, status, and uninstall path for reboot-persistent live supervisor autorecovery. | passed | installValidation=passed, failedChecks=0, planDidNotMutate=True, liveProfileDefault=True, schedulerCmdlets=True |
2828
| RPC/API | The control-plane API has explicit health/discovery/readiness/CORS/rate-limit validation and abuse rejection before it can be exposed publicly. | passed | validationStatus=passed, corsAllowed=True, corsRejected=True, endpointChecks=True, rateLimitProbe=True, rateLimitRejected=True, rateLimitRetryAfter=True, responseHygiene=True, abuseStatus=passed, abusePassed=True, abuseMissingChecks=0 |
2929
| Public edge | External RPC exposure is a distinct owner-operated edge with TLS, allowed origins, rate limits, endpoint checks, and response hygiene. | blocked | publicRpcStatus=blocked, publicRpcReady=False |

‎docs/agent-runs/live-product-infra-rpc/PUBLIC_DEPLOYMENT_CONTRACT.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# FlowChain Public Deployment Contract
22

3-
Generated: 2026-05-17T10:20:17.1551020Z
3+
Generated: 2026-05-17T10:27:19.8631144Z
44
Status: blocked
55
Deployment ready: False
66
Packet shareable: False
@@ -31,6 +31,7 @@ This file records deployment gates, commands, and env names only. It must not co
3131
| The owner host has a no-secret Windows install, status, and uninstall path for registering the live supervisor as a reboot-persistent scheduled task. | passed | serviceInstallValidation=passed, planDidNotMutate=True, liveProfileDefault=True, commandsPresent=True |
3232
| Owner deployment has a no-secret ops snapshot that separates critical incidents from expected owner-input blockers and lists incident commands. | passed | opsSnapshot=blocked, criticalCount=0, blockedCount=5 |
3333
| Owner deployment has a no-secret alert rule manifest that maps every current ops finding to operator commands without committing delivery credentials. | passed | alertRules=passed, criticalRules=5, blockedRules=5, unmappedCurrentFindingCodes=0 |
34+
| The owner host has a no-secret Windows install, status, and uninstall path for recurring ops snapshot and alert-rule refresh without committed external delivery credentials. | passed | alertInstallValidation=passed, planDidNotMutate=True, hasAllowBlocked=True, noExternalDelivery=True |
3435
| The owner deployment contract validates the required public RPC, tester write gateway, backup, and Base 8453 input names without values. | blocked | ownerInputsStatus=blocked, ownerInputReady=False |
3536
| The local public RPC abuse harness proves CORS rejection, media-type rejection, malformed JSON handling, batch/body caps, notification handling, rate limiting, and no-secret response summaries. | passed | abuseStatus=passed, abuseReady=True, missingChecks=0 |
3637
| The owner TLS edge must pass endpoint, CORS, rate-limit, readiness, and response-hygiene checks before sharing. | blocked | publicRpcStatus=blocked, publicRpcReady=False, validationStatus=passed, validationPassed=True, abuseStatus=passed, abusePassed=True |
@@ -51,6 +52,8 @@ This file records deployment gates, commands, and env names only. It must not co
5152
- npm run flowchain:service:install:windows -- -Action Plan
5253
- npm run flowchain:ops:snapshot -- -AllowBlocked
5354
- npm run flowchain:ops:alerts -- -AllowBlocked
55+
- npm run flowchain:ops:alerts:install:validate
56+
- npm run flowchain:ops:alerts:install:windows -- -Action Plan
5457
- npm run flowchain:owner:onboarding
5558
- npm run flowchain:owner-env:template
5659
- npm run flowchain:owner-inputs
@@ -79,6 +82,8 @@ This file records deployment gates, commands, and env names only. It must not co
7982
- npm run flowchain:service:install:windows -- -Action Uninstall
8083
- npm run flowchain:backup:install:windows -- -Action Status
8184
- npm run flowchain:backup:install:windows -- -Action Uninstall
85+
- npm run flowchain:ops:alerts:install:windows -- -Action Status
86+
- npm run flowchain:ops:alerts:install:windows -- -Action Uninstall
8287
- npm run flowchain:service:stop
8388
- npm run flowchain:service:restart -- -LiveProfile
8489
- npm run flowchain:emergency:stop-local

‎docs/agent-runs/live-product-infra-rpc/WINDOWS_ALERT_INSTALL.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# FlowChain Windows Alert Install
2+
3+
Generated: 2026-05-17T10:27:22.2983575Z
4+
Status: passed
5+
Action: Plan
6+
Task: \FlowChainOpsAlerts
7+
8+
This runbook registers a Windows Scheduled Task that refreshes the no-secret ops snapshot and alert rules on a fixed interval. It writes local reports only and does not store external delivery credentials.
9+
10+
## Commands
11+
12+
- Plan: npm run flowchain:ops:alerts:install:windows -- -Action Plan
13+
- Validate: npm run flowchain:ops:alerts:install:validate
14+
- Install: npm run flowchain:ops:alerts:install:windows -- -Action Install
15+
- Status: npm run flowchain:ops:alerts:install:windows -- -Action Status
16+
- Uninstall: npm run flowchain:ops:alerts:install:windows -- -Action Uninstall
17+
- Alerts: npm run flowchain:ops:alerts -- -AllowBlocked
18+
19+
## Scheduled Task Action
20+
21+
- Execute: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`
22+
- Working directory: `E:/FlowMemory/flowmemory-live-infra-rpc`
23+
- Alerts script: `E:\FlowMemory\flowmemory-live-infra-rpc\infra\scripts\flowchain-ops-alerts.ps1`
24+
- Interval minutes: 15
25+
- Owner env file injected: False
26+
27+
## Status
28+
29+
- Task existed before: False
30+
- Task exists after: False
31+
- Scheduler cmdlets available: True
32+
- WorkingDirectory supported: True
33+
- Repetition supported: True

‎docs/agent-runs/live-product-infra-rpc/alert-install-validation-report.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema": "flowchain.alert_install_validation_report.v0",
3+
"generatedAt": "2026-05-17T10:27:22.7634651Z",
4+
"status": "passed",
5+
"taskName": "FlowChainOpsAlerts",
6+
"checks": {
7+
"installScriptExists": true,
8+
"alertsScriptExists": true,
9+
"packageScriptsPresent": true,
10+
"planCommandPassed": true,
11+
"planDidNotMutate": true,
12+
"schedulerCmdletsAvailable": true,
13+
"scheduledTaskActionSupportsWorkingDirectory": true,
14+
"scheduledTaskTriggerSupportsRepetition": true,
15+
"actionUsesAlertsScript": true,
16+
"actionUsesRepoWorkingDirectory": true,
17+
"hasAllowBlocked": true,
18+
"hasReportPath": true,
19+
"hasMarkdownPath": true,
20+
"hasOpsSnapshotPath": true,
21+
"noExternalDelivery": true,
22+
"commandsPresent": true,
23+
"scheduledCommandKeepsBlockedAlertsVisible": true,
24+
"scheduledCommandDoesNotDisableRefresh": true,
25+
"envValuesPrintedFalse": true,
26+
"noSecrets": true,
27+
"broadcastsFalse": true
28+
},
29+
"failedChecks": [
30+
31+
],
32+
"missingPackageScripts": [
33+
34+
],
35+
"planReportPath": "E:\\FlowMemory\\flowmemory-live-infra-rpc\\docs\\agent-runs\\live-product-infra-rpc\\alert-install-windows-report.json",
36+
"planMarkdownPath": "E:\\FlowMemory\\flowmemory-live-infra-rpc\\docs\\agent-runs\\live-product-infra-rpc\\WINDOWS_ALERT_INSTALL.md",
37+
"childProcessResults": [
38+
{
39+
"name": "alert-install-plan",
40+
"exitCode": 0,
41+
"timedOut": false,
42+
"stdoutPath": "E:\\FlowMemory\\flowmemory-live-infra-rpc\\devnet\\local\\tmp\\alert-install-validation\\20260517052718967-7984-e0c60cfb.stdout.log",
43+
"stderrPath": "E:\\FlowMemory\\flowmemory-live-infra-rpc\\devnet\\local\\tmp\\alert-install-validation\\20260517052718967-7984-e0c60cfb.stderr.log"
44+
}
45+
],
46+
"commands": {
47+
"plan": "npm run flowchain:ops:alerts:install:windows -- -Action Plan",
48+
"install": "npm run flowchain:ops:alerts:install:windows -- -Action Install",
49+
"status": "npm run flowchain:ops:alerts:install:windows -- -Action Status",
50+
"uninstall": "npm run flowchain:ops:alerts:install:windows -- -Action Uninstall",
51+
"validate": "npm run flowchain:ops:alerts:install:validate"
52+
},
53+
"envValuesPrinted": false,
54+
"noSecrets": true,
55+
"broadcasts": false
56+
}

‎docs/agent-runs/live-product-infra-rpc/alert-install-windows-report.json‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
{
2+
"schema": "flowchain.alert_install_windows_report.v0",
3+
"generatedAt": "2026-05-17T10:27:22.2983575Z",
4+
"status": "passed",
5+
"action": "Plan",
6+
"plannedOnly": true,
7+
"taskMutationPerformed": false,
8+
"taskRegistered": false,
9+
"taskRemoved": false,
10+
"taskName": "FlowChainOpsAlerts",
11+
"taskPath": "\\",
12+
"intervalMinutes": 15,
13+
"taskBefore": {
14+
"exists": false,
15+
"schedulerAvailable": true,
16+
"taskName": "FlowChainOpsAlerts",
17+
"taskPath": "\\",
18+
"state": "",
19+
"lastRunTime": "",
20+
"nextRunTime": "",
21+
"lastTaskResult": "",
22+
"queryError": ""
23+
},
24+
"taskAfter": {
25+
"exists": false,
26+
"schedulerAvailable": true,
27+
"taskName": "FlowChainOpsAlerts",
28+
"taskPath": "\\",
29+
"state": "",
30+
"lastRunTime": "",
31+
"nextRunTime": "",
32+
"lastTaskResult": "",
33+
"queryError": ""
34+
},
35+
"schedulerCmdlets": [
36+
{
37+
"name": "Get-ScheduledTask",
38+
"available": true
39+
},
40+
{
41+
"name": "Get-ScheduledTaskInfo",
42+
"available": true
43+
},
44+
{
45+
"name": "New-ScheduledTaskAction",
46+
"available": true
47+
},
48+
{
49+
"name": "New-ScheduledTaskTrigger",
50+
"available": true
51+
},
52+
{
53+
"name": "New-ScheduledTaskSettingsSet",
54+
"available": true
55+
},
56+
{
57+
"name": "Register-ScheduledTask",
58+
"available": true
59+
},
60+
{
61+
"name": "Unregister-ScheduledTask",
62+
"available": true
63+
}
64+
],
65+
"scheduledTask": {
66+
"trigger": "Interval",
67+
"intervalMinutes": 15,
68+
"execute": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
69+
"arguments": "-NoProfile -ExecutionPolicy Bypass -File E:\\FlowMemory\\flowmemory-live-infra-rpc\\infra\\scripts\\flowchain-ops-alerts.ps1 -AllowBlocked -ReportPath docs/agent-runs/live-product-infra-rpc/scheduled-ops-alert-rules-report.json -MarkdownPath docs/agent-runs/live-product-infra-rpc/SCHEDULED_OPS_ALERT_RULES.md -OpsSnapshotPath docs/agent-runs/live-product-infra-rpc/scheduled-ops-snapshot-report.json",
70+
"workingDirectory": "E:/FlowMemory/flowmemory-live-infra-rpc",
71+
"alertsScript": "E:\\FlowMemory\\flowmemory-live-infra-rpc\\infra\\scripts\\flowchain-ops-alerts.ps1",
72+
"ownerEnvFileConfigured": false,
73+
"sendsExternalNotifications": false
74+
},
75+
"alerts": {
76+
"reportPath": "docs/agent-runs/live-product-infra-rpc/scheduled-ops-alert-rules-report.json",
77+
"markdownPath": "docs/agent-runs/live-product-infra-rpc/SCHEDULED_OPS_ALERT_RULES.md",
78+
"opsSnapshotPath": "docs/agent-runs/live-product-infra-rpc/scheduled-ops-snapshot-report.json"
79+
},
80+
"commands": {
81+
"plan": "npm run flowchain:ops:alerts:install:windows -- -Action Plan",
82+
"validate": "npm run flowchain:ops:alerts:install:validate",
83+
"install": "npm run flowchain:ops:alerts:install:windows -- -Action Install",
84+
"status": "npm run flowchain:ops:alerts:install:windows -- -Action Status",
85+
"uninstall": "npm run flowchain:ops:alerts:install:windows -- -Action Uninstall",
86+
"alerts": "npm run flowchain:ops:alerts -- -AllowBlocked"
87+
},
88+
"checks": {
89+
"alertsScriptExists": true,
90+
"schedulerCmdletsAvailable": true,
91+
"scheduledTaskActionSupportsWorkingDirectory": true,
92+
"scheduledTaskTriggerSupportsRepetition": true,
93+
"actionUsesAlertsScript": true,
94+
"actionUsesRepoWorkingDirectory": true,
95+
"hasAllowBlocked": true,
96+
"hasReportPath": true,
97+
"hasMarkdownPath": true,
98+
"hasOpsSnapshotPath": true,
99+
"intervalMinutesValid": true,
100+
"noExternalDelivery": true,
101+
"installStatusUninstallCommandsPresent": true,
102+
"planDoesNotMutate": true,
103+
"envValuesPrintedFalse": true,
104+
"noSecrets": true
105+
},
106+
"actionErrorRedacted": "",
107+
"envValuesPrinted": false,
108+
"noSecrets": true,
109+
"broadcasts": false
110+
}

0 commit comments

Comments
 (0)