feat(security-review): schedule Plane-1 checker coordinator nightly (+ role-skip) #36

Merged

amoussa1229 merged 1 commit from chore/schedule-plane1-checkers into main

2026-06-22 23:05:03 +00:00

Author	SHA1	Message	Date
Adam Moussa	912828b6b7	feat(security-review): schedule the Plane-1 checker coordinator nightly + role-skip - checker_coordinator.sh: add COORDINATOR_SKIP_ROLES env (comma-separated) to drop roles whose credentials are not provisioned from the registry entirely (never canaried/run/ALARMed). Fail-safe: empty/unset = run all. - systemd: sea-haven-checkers.{service,timer} run the coordinator nightly at ~03:30 UTC (90 min after the secrev sweep so they don't contend on $MIRROR_DIR / the Claude pool). The unit sets COORDINATOR_SKIP_ROLES=aws-posture,confluence-doc (aws-posture needs IAM Roles Anywhere; confluence-doc needs the confluence-bot token — both intentionally unprovisioned). Deployed + enabled on the box (deploy-before-merge): canary 4/4 with the skip, timer scheduled for 2026-06-23 03:35 UTC.	2026-06-22 19:03:22 -04:00

Author

SHA1

Message

Date

Adam Moussa

912828b6b7

feat(security-review): schedule the Plane-1 checker coordinator nightly + role-skip

- checker_coordinator.sh: add COORDINATOR_SKIP_ROLES env (comma-separated) to drop
  roles whose credentials are not provisioned from the registry entirely (never
  canaried/run/ALARMed). Fail-safe: empty/unset = run all.
- systemd: sea-haven-checkers.{service,timer} run the coordinator nightly at ~03:30
  UTC (90 min after the secrev sweep so they don't contend on $MIRROR_DIR / the
  Claude pool). The unit sets COORDINATOR_SKIP_ROLES=aws-posture,confluence-doc
  (aws-posture needs IAM Roles Anywhere; confluence-doc needs the confluence-bot
  token — both intentionally unprovisioned).

Deployed + enabled on the box (deploy-before-merge): canary 4/4 with the skip,
timer scheduled for 2026-06-23 03:35 UTC.

2026-06-22 19:03:22 -04:00