[object Object]

← back to Dw Yolo Loop

canary promotion harness (c34): stage 5 new canaries as install-ready launchd packages

e3d61c1ce687ddd400edba173ed37a9dff62ffe0 · 2026-06-16 13:35:33 -0700 · Steve Abrams

Inventory found this run's read-only canaries are loose one-offs (no plist) while
15 prior-gen com.steve.* canaries are wired. promote-canary.sh generates, per
canary, a plist + heartbeat-writing run wrapper + dw-canary-watchdog manifest row
+ INSTALL.txt — staged only, never bootstrapped (Steve-gated). Staged 5 shippable:
handle-freshness (daily), tls-expiry/robots-sitemap/metafield-coverage/alt-text
(weekly). Heartbeat stamp convention matches the meta-watchdog (stamp>artifact).
Correction: dw-backup-canary/restore-rehearsal/meta-watchdog ARE loaded (council
claimed otherwise).

Files touched

Diff

commit e3d61c1ce687ddd400edba173ed37a9dff62ffe0
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Jun 16 13:35:33 2026 -0700

    canary promotion harness (c34): stage 5 new canaries as install-ready launchd packages
    
    Inventory found this run's read-only canaries are loose one-offs (no plist) while
    15 prior-gen com.steve.* canaries are wired. promote-canary.sh generates, per
    canary, a plist + heartbeat-writing run wrapper + dw-canary-watchdog manifest row
    + INSTALL.txt — staged only, never bootstrapped (Steve-gated). Staged 5 shippable:
    handle-freshness (daily), tls-expiry/robots-sitemap/metafield-coverage/alt-text
    (weekly). Heartbeat stamp convention matches the meta-watchdog (stamp>artifact).
    Correction: dw-backup-canary/restore-rehearsal/meta-watchdog ARE loaded (council
    claimed otherwise).
---
 .../staged-launchd/alt-text-coverage/INSTALL.txt   |  4 ++
 .../com.steve.alt-text-coverage.plist              | 10 ++++
 .../alt-text-coverage/manifest-row.json            |  9 +++
 .../alt-text-coverage/run-alt-text-coverage.sh     |  7 +++
 .../staged-launchd/handle-freshness/INSTALL.txt    |  4 ++
 .../com.steve.handle-freshness.plist               | 10 ++++
 .../handle-freshness/manifest-row.json             |  9 +++
 .../handle-freshness/run-handle-freshness.sh       |  7 +++
 .../staged-launchd/metafield-coverage/INSTALL.txt  |  4 ++
 .../com.steve.metafield-coverage.plist             | 10 ++++
 .../metafield-coverage/manifest-row.json           |  9 +++
 .../metafield-coverage/run-metafield-coverage.sh   |  7 +++
 scripts/staged-launchd/promote-canary.sh           | 69 ++++++++++++++++++++++
 scripts/staged-launchd/robots-sitemap/INSTALL.txt  |  4 ++
 .../robots-sitemap/com.steve.robots-sitemap.plist  | 10 ++++
 .../robots-sitemap/manifest-row.json               |  9 +++
 .../robots-sitemap/run-robots-sitemap.sh           |  7 +++
 scripts/staged-launchd/tls-expiry/INSTALL.txt      |  4 ++
 .../tls-expiry/com.steve.tls-expiry.plist          | 10 ++++
 .../staged-launchd/tls-expiry/manifest-row.json    |  9 +++
 .../staged-launchd/tls-expiry/run-tls-expiry.sh    |  7 +++
 21 files changed, 219 insertions(+)

diff --git a/scripts/staged-launchd/alt-text-coverage/INSTALL.txt b/scripts/staged-launchd/alt-text-coverage/INSTALL.txt
new file mode 100644
index 0000000..e4dfa9a
--- /dev/null
+++ b/scripts/staged-launchd/alt-text-coverage/INSTALL.txt
@@ -0,0 +1,4 @@
+# Steve-gated install for com.steve.alt-text-coverage:
+cp "/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/alt-text-coverage/com.steve.alt-text-coverage.plist" ~/Library/LaunchAgents/
+launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.steve.alt-text-coverage.plist
+# then add manifest-row.json into ~/Projects/dw-canary-watchdog/manifest.json (canaries[])
diff --git a/scripts/staged-launchd/alt-text-coverage/com.steve.alt-text-coverage.plist b/scripts/staged-launchd/alt-text-coverage/com.steve.alt-text-coverage.plist
new file mode 100644
index 0000000..4e81bc0
--- /dev/null
+++ b/scripts/staged-launchd/alt-text-coverage/com.steve.alt-text-coverage.plist
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.steve.alt-text-coverage</string>
+  <key>ProgramArguments</key><array><string>/bin/sh</string><string>/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/alt-text-coverage/run-alt-text-coverage.sh</string></array>
+  <key>StartInterval</key><integer>604800</integer>
+  <key>RunAtLoad</key><false/>
+  <key>StandardOutPath</key><string>/tmp/alt-text-coverage.log</string>
+  <key>StandardErrorPath</key><string>/tmp/alt-text-coverage.log</string>
+</dict></plist>
diff --git a/scripts/staged-launchd/alt-text-coverage/manifest-row.json b/scripts/staged-launchd/alt-text-coverage/manifest-row.json
new file mode 100644
index 0000000..23659f1
--- /dev/null
+++ b/scripts/staged-launchd/alt-text-coverage/manifest-row.json
@@ -0,0 +1,9 @@
+{
+  "label": "alt-text-coverage",
+  "cadence": "every 604800s (StartInterval)",
+  "stamp": "~/.claude/heartbeats/alt-text-coverage.stamp",
+  "artifact": "~/.claude/heartbeats/alt-text-coverage.stamp",
+  "launchd_log": "/tmp/alt-text-coverage.log",
+  "warn_after": 700000,
+  "fail_after": 1300000
+}
diff --git a/scripts/staged-launchd/alt-text-coverage/run-alt-text-coverage.sh b/scripts/staged-launchd/alt-text-coverage/run-alt-text-coverage.sh
new file mode 100755
index 0000000..a790820
--- /dev/null
+++ b/scripts/staged-launchd/alt-text-coverage/run-alt-text-coverage.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# auto-generated by promote-canary.sh — runs alt-text-coverage then writes its heartbeat stamp
+mkdir -p "$HOME/.claude/heartbeats"
+"/usr/local/bin/node" "/Users/stevestudio2/Projects/designerwallcoverings/scripts/alt-text-coverage/alt-text-coverage-audit.mjs"; rc=$?
+# rc 0=PASS, 2=FAIL-verdict — both mean the canary actually executed → stamp it
+if [ $rc -eq 0 ] || [ $rc -eq 2 ]; then date -u +%Y-%m-%dT%H:%M:%SZ > "$HOME/.claude/heartbeats/alt-text-coverage.stamp"; fi
+exit $rc
diff --git a/scripts/staged-launchd/handle-freshness/INSTALL.txt b/scripts/staged-launchd/handle-freshness/INSTALL.txt
new file mode 100644
index 0000000..e333f57
--- /dev/null
+++ b/scripts/staged-launchd/handle-freshness/INSTALL.txt
@@ -0,0 +1,4 @@
+# Steve-gated install for com.steve.handle-freshness:
+cp "/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/handle-freshness/com.steve.handle-freshness.plist" ~/Library/LaunchAgents/
+launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.steve.handle-freshness.plist
+# then add manifest-row.json into ~/Projects/dw-canary-watchdog/manifest.json (canaries[])
diff --git a/scripts/staged-launchd/handle-freshness/com.steve.handle-freshness.plist b/scripts/staged-launchd/handle-freshness/com.steve.handle-freshness.plist
new file mode 100644
index 0000000..1db78c1
--- /dev/null
+++ b/scripts/staged-launchd/handle-freshness/com.steve.handle-freshness.plist
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.steve.handle-freshness</string>
+  <key>ProgramArguments</key><array><string>/bin/sh</string><string>/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/handle-freshness/run-handle-freshness.sh</string></array>
+  <key>StartInterval</key><integer>86400</integer>
+  <key>RunAtLoad</key><false/>
+  <key>StandardOutPath</key><string>/tmp/handle-freshness.log</string>
+  <key>StandardErrorPath</key><string>/tmp/handle-freshness.log</string>
+</dict></plist>
diff --git a/scripts/staged-launchd/handle-freshness/manifest-row.json b/scripts/staged-launchd/handle-freshness/manifest-row.json
new file mode 100644
index 0000000..49e902d
--- /dev/null
+++ b/scripts/staged-launchd/handle-freshness/manifest-row.json
@@ -0,0 +1,9 @@
+{
+  "label": "handle-freshness",
+  "cadence": "every 86400s (StartInterval)",
+  "stamp": "~/.claude/heartbeats/handle-freshness.stamp",
+  "artifact": "~/.claude/heartbeats/handle-freshness.stamp",
+  "launchd_log": "/tmp/handle-freshness.log",
+  "warn_after": 100000,
+  "fail_after": 130000
+}
diff --git a/scripts/staged-launchd/handle-freshness/run-handle-freshness.sh b/scripts/staged-launchd/handle-freshness/run-handle-freshness.sh
new file mode 100755
index 0000000..5c59ea3
--- /dev/null
+++ b/scripts/staged-launchd/handle-freshness/run-handle-freshness.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# auto-generated by promote-canary.sh — runs handle-freshness then writes its heartbeat stamp
+mkdir -p "$HOME/.claude/heartbeats"
+"/usr/local/bin/node" "/Users/stevestudio2/Projects/designerwallcoverings/scripts/handle-freshness/handle-freshness-canary.mjs"; rc=$?
+# rc 0=PASS, 2=FAIL-verdict — both mean the canary actually executed → stamp it
+if [ $rc -eq 0 ] || [ $rc -eq 2 ]; then date -u +%Y-%m-%dT%H:%M:%SZ > "$HOME/.claude/heartbeats/handle-freshness.stamp"; fi
+exit $rc
diff --git a/scripts/staged-launchd/metafield-coverage/INSTALL.txt b/scripts/staged-launchd/metafield-coverage/INSTALL.txt
new file mode 100644
index 0000000..bbd13b0
--- /dev/null
+++ b/scripts/staged-launchd/metafield-coverage/INSTALL.txt
@@ -0,0 +1,4 @@
+# Steve-gated install for com.steve.metafield-coverage:
+cp "/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/metafield-coverage/com.steve.metafield-coverage.plist" ~/Library/LaunchAgents/
+launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.steve.metafield-coverage.plist
+# then add manifest-row.json into ~/Projects/dw-canary-watchdog/manifest.json (canaries[])
diff --git a/scripts/staged-launchd/metafield-coverage/com.steve.metafield-coverage.plist b/scripts/staged-launchd/metafield-coverage/com.steve.metafield-coverage.plist
new file mode 100644
index 0000000..383c682
--- /dev/null
+++ b/scripts/staged-launchd/metafield-coverage/com.steve.metafield-coverage.plist
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.steve.metafield-coverage</string>
+  <key>ProgramArguments</key><array><string>/bin/sh</string><string>/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/metafield-coverage/run-metafield-coverage.sh</string></array>
+  <key>StartInterval</key><integer>604800</integer>
+  <key>RunAtLoad</key><false/>
+  <key>StandardOutPath</key><string>/tmp/metafield-coverage.log</string>
+  <key>StandardErrorPath</key><string>/tmp/metafield-coverage.log</string>
+</dict></plist>
diff --git a/scripts/staged-launchd/metafield-coverage/manifest-row.json b/scripts/staged-launchd/metafield-coverage/manifest-row.json
new file mode 100644
index 0000000..c8e1bfd
--- /dev/null
+++ b/scripts/staged-launchd/metafield-coverage/manifest-row.json
@@ -0,0 +1,9 @@
+{
+  "label": "metafield-coverage",
+  "cadence": "every 604800s (StartInterval)",
+  "stamp": "~/.claude/heartbeats/metafield-coverage.stamp",
+  "artifact": "~/.claude/heartbeats/metafield-coverage.stamp",
+  "launchd_log": "/tmp/metafield-coverage.log",
+  "warn_after": 700000,
+  "fail_after": 1300000
+}
diff --git a/scripts/staged-launchd/metafield-coverage/run-metafield-coverage.sh b/scripts/staged-launchd/metafield-coverage/run-metafield-coverage.sh
new file mode 100755
index 0000000..f1f976a
--- /dev/null
+++ b/scripts/staged-launchd/metafield-coverage/run-metafield-coverage.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# auto-generated by promote-canary.sh — runs metafield-coverage then writes its heartbeat stamp
+mkdir -p "$HOME/.claude/heartbeats"
+"/usr/local/bin/node" "/Users/stevestudio2/Projects/designerwallcoverings/scripts/metafield-coverage/metafield-coverage-audit.mjs"; rc=$?
+# rc 0=PASS, 2=FAIL-verdict — both mean the canary actually executed → stamp it
+if [ $rc -eq 0 ] || [ $rc -eq 2 ]; then date -u +%Y-%m-%dT%H:%M:%SZ > "$HOME/.claude/heartbeats/metafield-coverage.stamp"; fi
+exit $rc
diff --git a/scripts/staged-launchd/promote-canary.sh b/scripts/staged-launchd/promote-canary.sh
new file mode 100644
index 0000000..26d1877
--- /dev/null
+++ b/scripts/staged-launchd/promote-canary.sh
@@ -0,0 +1,69 @@
+#!/bin/sh
+# promote-canary (c34) — turn one of this run's loose read-only canary scripts
+# into an install-ready package: a launchd plist + a heartbeat-writing run
+# wrapper + a manifest.json row for the dw-canary-watchdog. GENERATES ONLY into
+# scripts/staged-launchd/<label>/ — it NEVER bootstraps/installs (Steve-gated).
+#
+# Why: this run built ~8 one-off canaries that ran once and would otherwise rot —
+# the exact silent-death pattern (a dead, unwatched check) that hid the 12-day
+# pg_dump backup gap. Promotion makes each canary scheduled AND heartbeat-watched
+# by the already-loaded dw-canary-meta-watchdog.
+#
+# Heartbeat convention (from dw-canary-watchdog/manifest.json, DTD-C 2026-06-15):
+#   stamp ~/.claude/heartbeats/<label>.stamp  (authoritative)  >  data/latest.json mtime
+#
+# Usage: sh promote-canary.sh <label> <abs-script.mjs> <interval_seconds> [warn_after] [fail_after]
+set -e
+LABEL="$1"; SCRIPT="$2"; INTERVAL="$3"; WARN="${4:-$((INTERVAL*2))}"; FAIL="${5:-$((INTERVAL*3))}"
+[ -z "$LABEL" ] || [ -z "$SCRIPT" ] || [ -z "$INTERVAL" ] && { echo "usage: promote-canary.sh <label> <script.mjs> <interval_s> [warn] [fail]"; exit 2; }
+BASE="/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/$LABEL"
+mkdir -p "$BASE"
+NODE="$(command -v node || echo /usr/local/bin/node)"
+
+# 1) run wrapper — runs the canary, then stamps the heartbeat on exit 0/2 (PASS/FAIL both = "it ran")
+cat > "$BASE/run-$LABEL.sh" <<WRAP
+#!/bin/sh
+# auto-generated by promote-canary.sh — runs $LABEL then writes its heartbeat stamp
+mkdir -p "\$HOME/.claude/heartbeats"
+"$NODE" "$SCRIPT"; rc=\$?
+# rc 0=PASS, 2=FAIL-verdict — both mean the canary actually executed → stamp it
+if [ \$rc -eq 0 ] || [ \$rc -eq 2 ]; then date -u +%Y-%m-%dT%H:%M:%SZ > "\$HOME/.claude/heartbeats/$LABEL.stamp"; fi
+exit \$rc
+WRAP
+chmod +x "$BASE/run-$LABEL.sh"
+
+# 2) launchd plist (interval-based)
+cat > "$BASE/com.steve.$LABEL.plist" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.steve.$LABEL</string>
+  <key>ProgramArguments</key><array><string>/bin/sh</string><string>$BASE/run-$LABEL.sh</string></array>
+  <key>StartInterval</key><integer>$INTERVAL</integer>
+  <key>RunAtLoad</key><false/>
+  <key>StandardOutPath</key><string>/tmp/$LABEL.log</string>
+  <key>StandardErrorPath</key><string>/tmp/$LABEL.log</string>
+</dict></plist>
+PLIST
+
+# 3) manifest.json row to add to ~/Projects/dw-canary-watchdog/manifest.json
+cat > "$BASE/manifest-row.json" <<ROW
+{
+  "label": "$LABEL",
+  "cadence": "every ${INTERVAL}s (StartInterval)",
+  "stamp": "~/.claude/heartbeats/$LABEL.stamp",
+  "artifact": "~/.claude/heartbeats/$LABEL.stamp",
+  "launchd_log": "/tmp/$LABEL.log",
+  "warn_after": $WARN,
+  "fail_after": $FAIL
+}
+ROW
+
+# 4) the Steve-gated install one-liner
+cat > "$BASE/INSTALL.txt" <<INST
+# Steve-gated install for com.steve.$LABEL:
+cp "$BASE/com.steve.$LABEL.plist" ~/Library/LaunchAgents/
+launchctl bootstrap gui/\$(id -u) ~/Library/LaunchAgents/com.steve.$LABEL.plist
+# then add manifest-row.json into ~/Projects/dw-canary-watchdog/manifest.json (canaries[])
+INST
+echo "staged: $BASE  (plist + run wrapper + manifest row + INSTALL.txt)"
diff --git a/scripts/staged-launchd/robots-sitemap/INSTALL.txt b/scripts/staged-launchd/robots-sitemap/INSTALL.txt
new file mode 100644
index 0000000..42dd25e
--- /dev/null
+++ b/scripts/staged-launchd/robots-sitemap/INSTALL.txt
@@ -0,0 +1,4 @@
+# Steve-gated install for com.steve.robots-sitemap:
+cp "/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/robots-sitemap/com.steve.robots-sitemap.plist" ~/Library/LaunchAgents/
+launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.steve.robots-sitemap.plist
+# then add manifest-row.json into ~/Projects/dw-canary-watchdog/manifest.json (canaries[])
diff --git a/scripts/staged-launchd/robots-sitemap/com.steve.robots-sitemap.plist b/scripts/staged-launchd/robots-sitemap/com.steve.robots-sitemap.plist
new file mode 100644
index 0000000..731825e
--- /dev/null
+++ b/scripts/staged-launchd/robots-sitemap/com.steve.robots-sitemap.plist
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.steve.robots-sitemap</string>
+  <key>ProgramArguments</key><array><string>/bin/sh</string><string>/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/robots-sitemap/run-robots-sitemap.sh</string></array>
+  <key>StartInterval</key><integer>604800</integer>
+  <key>RunAtLoad</key><false/>
+  <key>StandardOutPath</key><string>/tmp/robots-sitemap.log</string>
+  <key>StandardErrorPath</key><string>/tmp/robots-sitemap.log</string>
+</dict></plist>
diff --git a/scripts/staged-launchd/robots-sitemap/manifest-row.json b/scripts/staged-launchd/robots-sitemap/manifest-row.json
new file mode 100644
index 0000000..36819ce
--- /dev/null
+++ b/scripts/staged-launchd/robots-sitemap/manifest-row.json
@@ -0,0 +1,9 @@
+{
+  "label": "robots-sitemap",
+  "cadence": "every 604800s (StartInterval)",
+  "stamp": "~/.claude/heartbeats/robots-sitemap.stamp",
+  "artifact": "~/.claude/heartbeats/robots-sitemap.stamp",
+  "launchd_log": "/tmp/robots-sitemap.log",
+  "warn_after": 700000,
+  "fail_after": 1300000
+}
diff --git a/scripts/staged-launchd/robots-sitemap/run-robots-sitemap.sh b/scripts/staged-launchd/robots-sitemap/run-robots-sitemap.sh
new file mode 100755
index 0000000..cd64071
--- /dev/null
+++ b/scripts/staged-launchd/robots-sitemap/run-robots-sitemap.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# auto-generated by promote-canary.sh — runs robots-sitemap then writes its heartbeat stamp
+mkdir -p "$HOME/.claude/heartbeats"
+"/usr/local/bin/node" "/Users/stevestudio2/Projects/designerwallcoverings/scripts/robots-sitemap/robots-sitemap-canary.mjs"; rc=$?
+# rc 0=PASS, 2=FAIL-verdict — both mean the canary actually executed → stamp it
+if [ $rc -eq 0 ] || [ $rc -eq 2 ]; then date -u +%Y-%m-%dT%H:%M:%SZ > "$HOME/.claude/heartbeats/robots-sitemap.stamp"; fi
+exit $rc
diff --git a/scripts/staged-launchd/tls-expiry/INSTALL.txt b/scripts/staged-launchd/tls-expiry/INSTALL.txt
new file mode 100644
index 0000000..113ce6b
--- /dev/null
+++ b/scripts/staged-launchd/tls-expiry/INSTALL.txt
@@ -0,0 +1,4 @@
+# Steve-gated install for com.steve.tls-expiry:
+cp "/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/tls-expiry/com.steve.tls-expiry.plist" ~/Library/LaunchAgents/
+launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.steve.tls-expiry.plist
+# then add manifest-row.json into ~/Projects/dw-canary-watchdog/manifest.json (canaries[])
diff --git a/scripts/staged-launchd/tls-expiry/com.steve.tls-expiry.plist b/scripts/staged-launchd/tls-expiry/com.steve.tls-expiry.plist
new file mode 100644
index 0000000..9942e96
--- /dev/null
+++ b/scripts/staged-launchd/tls-expiry/com.steve.tls-expiry.plist
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.steve.tls-expiry</string>
+  <key>ProgramArguments</key><array><string>/bin/sh</string><string>/Users/stevestudio2/Projects/designerwallcoverings/scripts/staged-launchd/tls-expiry/run-tls-expiry.sh</string></array>
+  <key>StartInterval</key><integer>604800</integer>
+  <key>RunAtLoad</key><false/>
+  <key>StandardOutPath</key><string>/tmp/tls-expiry.log</string>
+  <key>StandardErrorPath</key><string>/tmp/tls-expiry.log</string>
+</dict></plist>
diff --git a/scripts/staged-launchd/tls-expiry/manifest-row.json b/scripts/staged-launchd/tls-expiry/manifest-row.json
new file mode 100644
index 0000000..581fb8c
--- /dev/null
+++ b/scripts/staged-launchd/tls-expiry/manifest-row.json
@@ -0,0 +1,9 @@
+{
+  "label": "tls-expiry",
+  "cadence": "every 604800s (StartInterval)",
+  "stamp": "~/.claude/heartbeats/tls-expiry.stamp",
+  "artifact": "~/.claude/heartbeats/tls-expiry.stamp",
+  "launchd_log": "/tmp/tls-expiry.log",
+  "warn_after": 700000,
+  "fail_after": 1300000
+}
diff --git a/scripts/staged-launchd/tls-expiry/run-tls-expiry.sh b/scripts/staged-launchd/tls-expiry/run-tls-expiry.sh
new file mode 100755
index 0000000..1d899cc
--- /dev/null
+++ b/scripts/staged-launchd/tls-expiry/run-tls-expiry.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# auto-generated by promote-canary.sh — runs tls-expiry then writes its heartbeat stamp
+mkdir -p "$HOME/.claude/heartbeats"
+"/usr/local/bin/node" "/Users/stevestudio2/Projects/designerwallcoverings/scripts/tls-expiry/tls-expiry-canary.mjs"; rc=$?
+# rc 0=PASS, 2=FAIL-verdict — both mean the canary actually executed → stamp it
+if [ $rc -eq 0 ] || [ $rc -eq 2 ]; then date -u +%Y-%m-%dT%H:%M:%SZ > "$HOME/.claude/heartbeats/tls-expiry.stamp"; fi
+exit $rc

← 150b6a1 specs pattern-crosswalk probe (c33): PARTIAL feasibility + s  ·  back to Dw Yolo Loop  ·  sitemap emergence sizing (c35): philipperomano fully generat f72b052 →