prose-contracts/cron-prompts-review.md

# Cron Prompts Review — All 10 Scheduled Contracts

Generated: 2026-07-13 20:59:18 ET

---

## hermes-key-enforcement

**Category:** compliance | **Domain:** hermes-agent | **Owner:** abiba | **Schedule:** 0 6 * * *

```
Contract Enforcement: hermes-key-enforcement

Category: compliance
Domain: hermes-agent
Owner: abiba
Schedule: Daily compliance scan at 6am ET

This is a compliance contract. Verify that the contract enforces the required standards and policies. Report any violations found.

Steps:
1. Load contract from prose-contracts/main (file: hermes-key-enforcement.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/hermes-key-enforcement/

Postconditions to verify:
[
  {
    "check": "no plaintext API keys in config",
    "verify": "grep -rc 'api_key: sk-' /root/.hermes/config.yaml",
    "expect": "0 matches"
  },
  {
    "check": "api_key_env used for harness/litellm providers",
    "verify": "grep -c 'api_key_env.*LITELLM_API_KEY' /root/.hermes/config.yaml",
    "expect": "count > 0"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify abiba → action: relay_alert
- CRITICAL: notify abiba, mumuni → action: relay_alert + pause
- FATAL: notify abiba, mumuni, kwame → action: relay_alert + pause + human_required

Circuit Breaker:
- Max retries: 3 per 60.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/hermes-key-enforcement/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=hermes-key-enforcement, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```

---

## hermes-config-template

**Category:** compliance | **Domain:** hermes-agent | **Owner:** abiba | **Schedule:** 0 4 * * 1

```
Contract Enforcement: hermes-config-template

Category: compliance
Domain: hermes-agent
Owner: abiba
Schedule: Weekly config drift check Monday at 4am ET

This is a compliance contract. Verify that the contract enforces the required standards and policies. Report any violations found.

Steps:
1. Load contract from prose-contracts/main (file: hermes-config-template.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/hermes-config-template/

Postconditions to verify:
[
  {
    "check": "agent config template_version matches template file",
    "verify": "grep -q 'template_version' /root/.hermes/config.yaml && diff <(grep 'template_version' /root/.hermes/config.yaml | cut -d: -f2 | xargs) <(grep 'template_version' /root/prose-contracts/hermes-config-template.prose.md | cut -d: -f2 | xargs) && echo match || echo mismatch",
    "expect": "match"
  },
  {
    "check": "config file is valid YAML",
    "verify": "python3 -c 'import yaml; yaml.safe_load(open(\"/root/.hermes/config.yaml\"))' && echo valid || echo invalid",
    "expect": "valid"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify abiba → action: relay_alert
- CRITICAL: notify abiba, mumuni → action: relay_alert
- FATAL: notify abiba, mumuni, kwame → action: relay_alert + human_required

Circuit Breaker:
- Max retries: 3 per 60.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/hermes-config-template/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=hermes-config-template, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```

---

## hermes-agent-baseline

**Category:** compliance | **Domain:** hermes-agent | **Owner:** abiba | **Schedule:** 0 5 * * 1

```
Contract Enforcement: hermes-agent-baseline

Category: compliance
Domain: hermes-agent
Owner: abiba
Schedule: Weekly baseline verification Monday at 5am ET

This is a compliance contract. Verify that the contract enforces the required standards and policies. Report any violations found.

Steps:
1. Load contract from prose-contracts/main (file: hermes-agent-baseline.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/hermes-agent-baseline/

Postconditions to verify:
[
  {
    "check": "Hermes agent process running",
    "verify": "pgrep -f 'hermes' > /dev/null && echo running || echo stopped",
    "expect": "running"
  },
  {
    "check": "agent config file exists and valid YAML",
    "verify": "test -f /root/.hermes/config.yaml && python3 -c 'import yaml; yaml.safe_load(open(\"/root/.hermes/config.yaml\"))' && echo valid || echo invalid",
    "expect": "valid"
  },
  {
    "check": "no uncommitted changes in hermes directory",
    "verify": "cd /root/.hermes && git status --porcelain | wc -l",
    "expect": "0"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify abiba → action: relay_alert
- CRITICAL: notify abiba, mumuni → action: relay_alert
- FATAL: notify abiba, mumuni, kwame → action: relay_alert + human_required

Circuit Breaker:
- Max retries: 3 per 60.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/hermes-agent-baseline/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=hermes-agent-baseline, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```

---

## proxmox-monitor

**Category:** monitoring | **Domain:** proxmox | **Owner:** abiba | **Schedule:** */15 * * * *

```
Contract Enforcement: proxmox-monitor

Category: monitoring
Domain: proxmox
Owner: abiba
Schedule: Every 15 minutes

This is a monitoring contract. Execute the monitoring checks defined in the contract. Report any deviations from expected state.

Steps:
1. Load contract from prose-contracts/main (file: proxmox-monitor.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/proxmox-monitor/

Postconditions to verify:
[
  {
    "check": "all Proxmox nodes reachable",
    "verify": "curl -sf http://192.168.68.10:8006/api2/json/status | jq '.status'",
    "expect": "healthy"
  },
  {
    "check": "no VMs in crashed state",
    "verify": "pvesh get /nodes -output-format=json | jq '.[] | select(.status==\"Crashed\")'",
    "expect": "empty"
  },
  {
    "check": "backups running on schedule",
    "verify": "pbs-info --check",
    "expect": "last_backup < 24h ago"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify abiba, mumuni → action: relay_alert
- CRITICAL: notify abiba, mumuni → action: relay_alert + trigger_remediation
- FATAL: notify abiba, mumuni, kwame → action: relay_alert + pause + human_required

Circuit Breaker:
- Max retries: 3 per 60.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/proxmox-monitor/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=proxmox-monitor, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```

---

## gpu-monitor

**Category:** monitoring | **Domain:** gpu | **Owner:** abiba | **Schedule:** */15 * * * *

```
Contract Enforcement: gpu-monitor

Category: monitoring
Domain: gpu
Owner: abiba
Schedule: Every 15 minutes — polls all GPU subsystems

This is a monitoring contract. Execute the monitoring checks defined in the contract. Report any deviations from expected state.

Steps:
1. Load contract from prose-contracts/main (file: gpu-monitor.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/gpu-monitor/

Postconditions to verify:
[
  {
    "check": "GPU metrics accessible",
    "verify": "curl -sf http://localhost:9100/gpu-data",
    "expect": "200 OK, populated data"
  },
  {
    "check": "dashboard serving",
    "verify": "curl -sf http://localhost:9100/gpu-fleet.html",
    "expect": "200 OK, HTML returned"
  },
  {
    "check": "health endpoint responsive",
    "verify": "curl -sf http://localhost:9100/health",
    "expect": "200 OK"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify abiba, mumuni → action: relay_alert
- CRITICAL: notify abiba, mumuni → action: relay_alert + trigger_remediation
- FATAL: notify abiba, mumuni, kwame → action: relay_alert + pause + human_required

Circuit Breaker:
- Max retries: 3 per 60.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/gpu-monitor/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=gpu-monitor, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```

---

## infrastructure-monitoring

**Category:** monitoring | **Domain:** infrastructure | **Owner:** abiba | **Schedule:** */30 * * * *

```
Contract Enforcement: infrastructure-monitoring

Category: monitoring
Domain: infrastructure
Owner: abiba
Schedule: Every 30 minutes

This is a monitoring contract. Execute the monitoring checks defined in the contract. Report any deviations from expected state.

Steps:
1. Load contract from prose-contracts/main (file: infrastructure-monitoring.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/infrastructure-monitoring/

Postconditions to verify:
[
  {
    "check": "Proxmox API reachable",
    "verify": "curl -sf http://192.168.68.10:8006/api2/json",
    "expect": "200 OK"
  },
  {
    "check": "Zulip API reachable",
    "verify": "curl -sf https://chat.sysloggh.net/api/v1/me",
    "expect": "200 OK"
  },
  {
    "check": "LiteLLM proxy reachable",
    "verify": "curl -sf http://192.168.68.116/litellm/v1/models",
    "expect": "200 OK"
  },
  {
    "check": "Gitea API reachable",
    "verify": "curl -sf https://git.sysloggh.net/api/v1/version",
    "expect": "200 OK"
  },
  {
    "check": "SearXNG reachable",
    "verify": "curl -sf http://192.168.68.17:8080",
    "expect": "200 OK"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify abiba, mumuni → action: relay_alert
- CRITICAL: notify abiba, mumuni → action: relay_alert + trigger_remediation
- FATAL: notify abiba, mumuni, kwame → action: relay_alert + pause + human_required

Circuit Breaker:
- Max retries: 3 per 60.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/infrastructure-monitoring/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=infrastructure-monitoring, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```

---

## zulip-health

**Category:** monitoring | **Domain:** zulip | **Owner:** abiba | **Schedule:** */15 * * * *

```
Contract Enforcement: zulip-health

Category: monitoring
Domain: zulip
Owner: abiba
Schedule: Every 15 minutes — monitors all Zulip-connected agents

This is a monitoring contract. Execute the monitoring checks defined in the contract. Report any deviations from expected state.

Steps:
1. Load contract from prose-contracts/main (file: zulip-health.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/zulip-health/

Postconditions to verify:
[
  {
    "check": "bot registration active",
    "verify": "curl -sf https://chat.sysloggh.net/api/v1/me | jq '.user_id'",
    "expect": "bot_id present"
  },
  {
    "check": "DM delivery working",
    "verify": "curl -sf https://chat.sysloggh.net/api/v1/users/me/is-online",
    "expect": "online: true"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify abiba, mumuni → action: relay_alert
- CRITICAL: notify abiba, mumuni → action: relay_alert + trigger_remediation
- FATAL: notify abiba, mumuni, kwame → action: relay_alert + pause + human_required

Circuit Breaker:
- Max retries: 3 per 60.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/zulip-health/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=zulip-health, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```

---

## litellm-health

**Category:** monitoring | **Domain:** litellm | **Owner:** abiba | **Schedule:** */10 * * * *

```
Contract Enforcement: litellm-health

Category: monitoring
Domain: litellm
Owner: abiba
Schedule: Every 10 minutes — LiteLLM proxy health

This is a monitoring contract. Execute the monitoring checks defined in the contract. Report any deviations from expected state.

Steps:
1. Load contract from prose-contracts/main (file: litellm-health.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/litellm-health/

Postconditions to verify:
[
  {
    "check": "LiteLLM proxy reachable",
    "verify": "curl -sf http://192.168.68.116/litellm/v1/models",
    "expect": "200 OK, models returned"
  },
  {
    "check": "router deprecated, nginx routes work",
    "verify": "curl -sf https://litellm.sysloggh.net/v1/models",
    "expect": "200 OK (via nginx)"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify abiba, mumuni → action: relay_alert
- CRITICAL: notify abiba, mumuni → action: relay_alert + trigger_remediation
- FATAL: notify abiba, mumuni, kwame → action: relay_alert + pause + human_required

Circuit Breaker:
- Max retries: 3 per 60.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/litellm-health/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=litellm-health, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```

---

## memory-audit-maintenance

**Category:** maintenance | **Domain:** memory | **Owner:** mumuni | **Schedule:** 0 3 * * *

```
Contract Enforcement: memory-audit-maintenance

Category: maintenance
Domain: memory
Owner: mumuni
Schedule: Daily at 3am ET

This is a maintenance contract. Execute the maintenance tasks defined in the contract. Report any issues found.

Steps:
1. Load contract from prose-contracts/main (file: memory-audit-maintenance.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/memory-audit-maintenance/

Postconditions to verify:
[
  {
    "check": "memory files below 80% capacity",
    "verify": "wc -l ~/.hermes/memories/*.md",
    "expect": "total lines < threshold"
  },
  {
    "check": "no stale entries",
    "verify": "grep -r 'STALE' ~/.hermes/memories/",
    "expect": "0 matches"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify mumuni → action: relay_alert
- CRITICAL: notify mumuni, abiba → action: relay_alert
- FATAL: notify mumuni, abiba, kwame → action: relay_alert + human_required

Circuit Breaker:
- Max retries: 3 per 60.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/memory-audit-maintenance/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=memory-audit-maintenance, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```

---

## infrastructure-update

**Category:** maintenance | **Domain:** infrastructure | **Owner:** abiba | **Schedule:** 0 2 * * 0

```
Contract Enforcement: infrastructure-update

Category: maintenance
Domain: infrastructure
Owner: abiba
Schedule: Weekly system updates Sunday at 2am ET

This is a maintenance contract. Execute the maintenance tasks defined in the contract. Report any issues found.

Steps:
1. Load contract from prose-contracts/main (file: infrastructure-update.prose.md)
2. Verify prerequisites (connectivity, tools, deps)
3. Execute contract per SOP
4. Run postconditions from contract registry
5. Generate receipt with status (pass/fail/escalated)
6. If any postcondition fails, escalate per contract escalation tiers
7. Log to ~/.hermes/runs/infrastructure-update/

Postconditions to verify:
[
  {
    "check": "all services running after update",
    "verify": "systemctl list-units --state=running",
    "expect": "all critical services"
  }
]

Escalation Tiers:
- INFO: notify nobody → action: log_to_receipt
- WARNING: notify abiba → action: relay_alert
- CRITICAL: notify abiba, mumuni → action: relay_alert
- FATAL: notify abiba, mumuni, kwame → action: relay_alert + human_required

Circuit Breaker:
- Max retries: 1 per 120.0min window
- On trip: escalate_to_fatal

Receipt format: JSON with contract, run_id, timestamp, agent, status, actions_taken, postconditions, drift_alerts, evidence_path
Receipt storage: ~/.hermes/runs/infrastructure-update/receipt-{timestamp}.json
Graph node: Create RA-H OS node for receipt with metadata: type=receipt, contract=infrastructure-update, status=<status>

If the contract has no postconditions defined (e.g., reference/pattern contracts), log that it was loaded and skip execution.

IMPORTANT: If the contract file does not exist in prose-contracts/main, report failure and do NOT hallucinate forward.
```


---
*End of review*