# sea-haven-secrev.service — Path B nightly security sweep (sh-secrev VM, user adam).
#
# Install (on the VM, as root):
#   sudo cp sea-haven-secrev.service /etc/systemd/system/
#   sudo cp sea-haven-secrev.timer   /etc/systemd/system/
#   sudo systemctl daemon-reload
#   sudo systemctl enable --now sea-haven-secrev.timer   # timer drives the run; do NOT enable the .service
#   systemctl list-timers sea-haven-secrev.timer         # confirm next run
#   sudo systemctl start sea-haven-secrev.service        # optional: run once now to smoke-test
#   journalctl -u sea-haven-secrev.service -e            # logs (also under ~/sweep-reports/<date>/)
#
# Secrets come from the EnvironmentFiles (the leading '-' = optional, no failure if absent):
#   ~/secrev.env            -> CLAUDE_CODE_OAUTH_TOKEN (required by run_headless.py),
#                              GH_TOKEN (read-only fine-grained PAT — REQUIRED for org auto-discovery),
#                              SLACK_WEBHOOK_URL
#   ~/orchestrator/.env     -> OPENAI_API_KEY etc. (only needed if ENABLE_XMODEL_HOOK=1)
#
# GH_TOKEN must be a fine-grained PAT scoped to the Sea-Haven-Industries org with READ-ONLY
# Contents (and Metadata) permission — nothing else. It enumerates repos and clones them into
# ~/repo-mirrors. Never give this unattended box a write-capable token.

[Unit]
Description=Sea Haven Path B nightly security sweep
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=adam
WorkingDirectory=/home/adam/orchestrator
EnvironmentFile=-/home/adam/secrev.env
EnvironmentFile=-/home/adam/orchestrator/.env
# Tune ceilings/targets here without editing the script (uncomment to override defaults):
# Environment=TOTAL_BUDGET_USD=120
# Environment=PER_TARGET_BUDGET_USD=12
# Environment=CANARY_FLOOR=10
# Environment=MAX_CYCLE_NIGHTS=4
# Environment=MAX_AGENTIC_PER_NIGHT=0
# Environment=GH_ORG=Sea-Haven-Industries
# Environment=MIRROR_DIR=/home/adam/repo-mirrors
# Environment=ENABLE_XMODEL_HOOK=0
ExecStart=/home/adam/orchestrator/security-review/nightly_sweep.sh
# Two-tier sweep (scanners over every repo + a budget-bounded agentic rotation) runs for hours;
# 6h ceiling bounds a hang without killing a healthy long night. Spend is capped by TOTAL_BUDGET_USD.
TimeoutStartSec=21600
Nice=10

[Install]
WantedBy=multi-user.target