`scripts/staged-launchd/INSTALL.md`

40 lines
# Staged LaunchAgents — review + install (Steve-gated)

Built during the 2026-06-15 overnight yolo run (council Ops#2 + Ops#3). NOT installed —
creating launchd persistence requires your explicit OK (CLAUDE.md). Both are reversible.

## 1. backup-freshness (read-only monitor — SAFE, recommended)
Daily 07:15 run of `~/Projects/backup-freshness-checker/check-backups.sh`. Read-only:
detects stale/0-byte/missing dw_unified + secrets backups and posts a CNCP parking-lot
card. No writes, no sends. This is the belt-and-suspenders that would have caught the
12-day 0-byte dw_unified gap (Jun 3→15).

```sh
cp scripts/staged-launchd/com.steve.backup-freshness.plist ~/Library/LaunchAgents/
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.steve.backup-freshness.plist
launchctl kickstart -k gui/$(id -u)/com.steve.backup-freshness   # run once now
```

## 2. secrets-env-backup (uploads a secret — GATED, needs a passphrase first)
Daily 03:30 encrypted off-box backup of `~/Projects/secrets-manager/.env`. Uploads gpg
AES256 **ciphertext only** to `gdrive:secrets-backup/`. Plaintext never leaves the box.

**Before installing, set a passphrase** (one-time), then test a dry-run + a real run:
```sh
printf '%s' 'YOUR-STRONG-PASSPHRASE' > ~/.config/secrets-backup.pass && chmod 600 ~/.config/secrets-backup.pass
bash ~/Projects/secrets-manager/scripts/backup-env.sh            # dry-run
bash ~/Projects/secrets-manager/scripts/backup-env.sh --apply    # real encrypt+upload (verify in gdrive:secrets-backup/)
```
Then install the daily job:
```sh
cp scripts/staged-launchd/com.steve.secrets-env-backup.plist ~/Library/LaunchAgents/
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.steve.secrets-env-backup.plist
```
Keep the passphrase somewhere you can recover it (a password manager) — without it the
remote ciphertext is unrecoverable.

## Uninstall either
```sh
launchctl bootout gui/$(id -u)/<label> && rm ~/Library/LaunchAgents/<label>.plist
```