plist-drift-detector

plist-drift-detector

Why this exists

The existing launchd-drift-recovery watches 4 hard-coded labels. Audit on 2026-05-07 found 16 loaded-only and 12 source-only labels of drift across the broader fleet. Either class can hide a real bug (a service registered out-of-band; a service quietly removed from the loadout). This skill reconciles them and alerts only when the drift set changes — stable drift is logged but quiet.

How to run

bash skills/plist-drift-detector/run.sh             # default — alert on change
bash skills/plist-drift-detector/run.sh --dry-run   # no Telegram, no state writes
bash skills/plist-drift-detector/run.sh --baseline  # write current drift as baseline (use after intentional changes)
bash skills/plist-drift-detector/run.sh --synthetic # synthetic test: artificially injects a missing plist into the comparison

Pipeline

1. List loaded labels matching the daily-ai prefix set (ai.openclaw.*, ai.hermes.*, ai.dailyaiagents.*, com.dailyai.*, com.dailyaiagents.*, com.dai.*).
2. List source plists in config/launchd/*.plist (excluding DEAD-* archived plists).
3. Compute set differences:
   • loaded_only — running but no source-of-truth (suspicious — out-of-band installation)
   • source_only — checked into source but not loaded (suspicious — should be running)
4. Read previous run's state from data/plist-drift/state.json. Compare today's drift set hash to yesterday's.
5. If hash changed AND we are not in cooldown (last alert >6h ago), Telegram-alert with diff. Otherwise silent.
6. Always update state file with current drift snapshot + ts.

Status codes

STATUS=GREEN — no drift STATUS=YELLOW drift=N hash=... — drift exists; same as last run; silent STATUS=ALERT drift=N changed_from=... — drift changed; Telegram sent

State

data/plist-drift/state.json:

{
  "ts": "2026-05-07T17:41Z",
  "loaded_only": ["..."],
  "source_only": ["..."],
  "hash": "sha256(loaded_only|source_only)",
  "last_alert_ts": "2026-05-07T17:41Z"
}