feat(staged): backup-freshness + secrets-env-backup LaunchAgents + INSTALL (Steve-gated install)

ceef3acc8dce5253171c0355b88e5db58350542b · 2026-06-15 23:43:13 -0700 · Steve Abrams

Council Ops#2/#3. Staged not installed (launchd persistence needs explicit OK). backup-freshness is read-only (CNCP card on stale backup); secrets-env-backup uploads gpg AES256 ciphertext only, gated on a passphrase. INSTALL.md has the review+install steps.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Files touched

A scripts/staged-launchd/INSTALL.md
A scripts/staged-launchd/com.steve.backup-freshness.plist
A scripts/staged-launchd/com.steve.secrets-env-backup.plist

Diff

commit ceef3acc8dce5253171c0355b88e5db58350542b
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jun 15 23:43:13 2026 -0700

    feat(staged): backup-freshness + secrets-env-backup LaunchAgents + INSTALL (Steve-gated install)
    
    Council Ops#2/#3. Staged not installed (launchd persistence needs explicit OK). backup-freshness is read-only (CNCP card on stale backup); secrets-env-backup uploads gpg AES256 ciphertext only, gated on a passphrase. INSTALL.md has the review+install steps.
    
    Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/staged-launchd/INSTALL.md                  | 39 ++++++++++++++++++++++
 .../com.steve.backup-freshness.plist               | 36 ++++++++++++++++++++
 .../com.steve.secrets-env-backup.plist             | 38 +++++++++++++++++++++
 3 files changed, 113 insertions(+)

diff --git a/scripts/staged-launchd/INSTALL.md b/scripts/staged-launchd/INSTALL.md
new file mode 100644
index 0000000..c0a0c47
--- /dev/null
+++ b/scripts/staged-launchd/INSTALL.md
@@ -0,0 +1,39 @@
+# Staged LaunchAgents — review + install (Steve-gated)
+
+Built during the 2026-06-15 overnight yolo run (council Ops#2 + Ops#3). NOT installed —
+creating launchd persistence requires your explicit OK (CLAUDE.md). Both are reversible.
+
+## 1. backup-freshness (read-only monitor — SAFE, recommended)
+Daily 07:15 run of `~/Projects/backup-freshness-checker/check-backups.sh`. Read-only:
+detects stale/0-byte/missing dw_unified + secrets backups and posts a CNCP parking-lot
+card. No writes, no sends. This is the belt-and-suspenders that would have caught the
+12-day 0-byte dw_unified gap (Jun 3→15).
+
+```sh
+cp scripts/staged-launchd/com.steve.backup-freshness.plist ~/Library/LaunchAgents/
+launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.steve.backup-freshness.plist
+launchctl kickstart -k gui/$(id -u)/com.steve.backup-freshness   # run once now
+```
+
+## 2. secrets-env-backup (uploads a secret — GATED, needs a passphrase first)
+Daily 03:30 encrypted off-box backup of `~/Projects/secrets-manager/.env`. Uploads gpg
+AES256 **ciphertext only** to `gdrive:secrets-backup/`. Plaintext never leaves the box.
+
+**Before installing, set a passphrase** (one-time), then test a dry-run + a real run:
+```sh
+printf '%s' 'YOUR-STRONG-PASSPHRASE' > ~/.config/secrets-backup.pass && chmod 600 ~/.config/secrets-backup.pass
+bash ~/Projects/secrets-manager/scripts/backup-env.sh            # dry-run
+bash ~/Projects/secrets-manager/scripts/backup-env.sh --apply    # real encrypt+upload (verify in gdrive:secrets-backup/)
+```
+Then install the daily job:
+```sh
+cp scripts/staged-launchd/com.steve.secrets-env-backup.plist ~/Library/LaunchAgents/
+launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.steve.secrets-env-backup.plist
+```
+Keep the passphrase somewhere you can recover it (a password manager) — without it the
+remote ciphertext is unrecoverable.
+
+## Uninstall either
+```sh
+launchctl bootout gui/$(id -u)/<label> && rm ~/Library/LaunchAgents/<label>.plist
+```
diff --git a/scripts/staged-launchd/com.steve.backup-freshness.plist b/scripts/staged-launchd/com.steve.backup-freshness.plist
new file mode 100644
index 0000000..7754809
--- /dev/null
+++ b/scripts/staged-launchd/com.steve.backup-freshness.plist
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- STAGED — not installed. Defensive backup-gap monitor (read-only; posts a CNCP
+     parking-lot card on stale/0-byte/missing backup). Would have caught the 12-day
+     0-byte dw_unified gap (Jun 3->15). Install: see scripts/staged-launchd/INSTALL.md -->
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.steve.backup-freshness</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>/Users/stevestudio2/Projects/backup-freshness-checker/check-backups.sh</string>
+    </array>
+    <key>StartCalendarInterval</key>
+    <dict>
+        <key>Hour</key>
+        <integer>7</integer>
+        <key>Minute</key>
+        <integer>15</integer>
+    </dict>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>HOME</key>
+        <string>/Users/stevestudio2</string>
+        <key>PATH</key>
+        <string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin</string>
+    </dict>
+    <key>StandardOutPath</key>
+    <string>/tmp/backup-freshness.out.log</string>
+    <key>StandardErrorPath</key>
+    <string>/tmp/backup-freshness.err.log</string>
+</dict>
+</plist>
diff --git a/scripts/staged-launchd/com.steve.secrets-env-backup.plist b/scripts/staged-launchd/com.steve.secrets-env-backup.plist
new file mode 100644
index 0000000..a21589c
--- /dev/null
+++ b/scripts/staged-launchd/com.steve.secrets-env-backup.plist
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- STAGED — not installed. Daily encrypted off-box backup of the canonical secret
+     master (~/Projects/secrets-manager/.env). Uploads gpg AES256 CIPHERTEXT only to
+     gdrive:secrets-backup/. GATED: needs a passphrase set first AND your OK (a secret
+     leaving the box). Install: see scripts/staged-launchd/INSTALL.md -->
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.steve.secrets-env-backup</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>/Users/stevestudio2/Projects/secrets-manager/scripts/backup-env.sh</string>
+        <string>--apply</string>
+    </array>
+    <key>StartCalendarInterval</key>
+    <dict>
+        <key>Hour</key>
+        <integer>3</integer>
+        <key>Minute</key>
+        <integer>30</integer>
+    </dict>
+    <key>RunAtLoad</key>
+    <false/>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>HOME</key>
+        <string>/Users/stevestudio2</string>
+        <key>PATH</key>
+        <string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin</string>
+    </dict>
+    <key>StandardOutPath</key>
+    <string>/tmp/secrets-env-backup.out.log</string>
+    <key>StandardErrorPath</key>
+    <string>/tmp/secrets-env-backup.err.log</string>
+</dict>
+</plist>

← d6bb2f3 Add blocked-vendor cost-coverage ledger (2026-06-15): 7 vend · back to Dw Yolo Loop · Contract-scope auditor: read-only dw_unified canary for vend 540e242 →