services-audit-cron

Services-audit cron loop wiring

The Phase 3 services-audit loop runs empirica services-audit on a biweekly cadence, captures novelty between runs, and notifies the operator when something new is running.

This skill is a thin wrapper over /loop-cron — same self-scheduling template, with services-audit plugged in as the body.

When to Use

Register the canonical biweekly services-audit cron when:

• You've just shipped Phase 1 + Phase 2 of the scanner (one-shot scan + auditor skill) and want the audit to run unattended on a schedule
• You want novelty notifications (new processes, new listening ports, new MCP servers) without remembering to scan manually
• You want a durable audit trail in ~/.empirica/scan_history_<project_id>.jsonl

If you only want a one-shot audit, run empirica services-audit directly — no loop needed.

Cron Prompt Template

When invoking /loop in cron mode, prepend these CLI lines to your task prompt. The body itself is one command — the rest is registry wiring.

At start (idempotent — safe to call every fire):
  empirica loop register --name services-audit --kind cron \
    --cron "0 6 1,15 * *" \
    --description "Biweekly AI services audit (scan + diff + notify on novelty)" \
    --backoff none

Check pause — exit silently AND don't schedule next fire if paused:
  PAUSED=$(empirica loop status services-audit --output json | jq -r .paused)
  if [ "$PAUSED" = "true" ]; then
    empirica loop heartbeat services-audit --status ok --result paused \
      --message "skipped, paused"
    exit 0   # CRITICAL: exit without scheduling next; loop is genuinely off
  fi

Run the audit body — single command, returns structured JSON.
The .result field is shaped to feed straight into heartbeat:
  AUDIT=$(empirica services-audit --output json)
  RESULT=$(echo "$AUDIT" | jq -r .result)              # found | empty | fail
  SCAN_ID=$(echo "$AUDIT" | jq -r .scan_id)
  PROC_NEW=$(echo "$AUDIT" | jq -r '.novelty.processes_added | length')
  PORT_NEW=$(echo "$AUDIT" | jq -r '.novelty.listeners_added | length')
  SUMMARY="scan ${SCAN_ID:0:8} → $RESULT (+$PROC_NEW procs, +$PORT_NEW listeners)"

  empirica loop heartbeat services-audit --status ok --result $RESULT \
    --message "$SUMMARY"

Schedule + install the next fire:
  NEXT_CRON=$(empirica loop schedule-next services-audit --output json | jq -r .cron_one_shot)
  # CronCreate(cron=$NEXT_CRON, recurring=false, prompt='<this whole template again>')

  # Heartbeat back the scheduler-returned job_id so pause can cancel:
  empirica loop heartbeat services-audit --status ok --result $RESULT \
    --next-scheduled-job-id "$JOB_ID" --scheduler-kind cron-create

On failure (collect_snapshot threw, scan dir unwritable, etc.):
  empirica loop heartbeat services-audit --status fail --result fail \
    --message "{error message}"