daemon-health: auto-detect belt strictness from the loaded root plist — accepted-down (lenient PASS) while it calls brew bash, auto-flip to strict belt-and-suspenders (one belt down = WARN) the moment Option B swaps it to the signed launcher. Makes the single sudo installer finish the root-belt promotion end-to-end, no manual flag flip (TK-10547)

672d698c6069914fbaf1f324160c98ab3945b691 · 2026-08-15 11:25:10 -0700 · Steve Abrams

Files touched

M scripts/daemon-health.sh

Diff

commit 672d698c6069914fbaf1f324160c98ab3945b691
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat Aug 15 11:25:10 2026 -0700

    daemon-health: auto-detect belt strictness from the loaded root plist — accepted-down (lenient PASS) while it calls brew bash, auto-flip to strict belt-and-suspenders (one belt down = WARN) the moment Option B swaps it to the signed launcher. Makes the single sudo installer finish the root-belt promotion end-to-end, no manual flag flip (TK-10547)
---
 scripts/daemon-health.sh | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/scripts/daemon-health.sh b/scripts/daemon-health.sh
index 0b1a18f..29b70c6 100755
--- a/scripts/daemon-health.sh
+++ b/scripts/daemon-health.sh
@@ -18,12 +18,16 @@ set -uo pipefail
 
 ALERT=0; [ "${1:-}" = "--alert" ] && ALERT=1
 STALE_WARN_H="${STALE_WARN_H:-30}"   # a nightly 03:45 job's Henry dump older than this = missed run
-# Steve ACCEPTED single-belt operation (8/15, TK-10547): the root belt (Option B) is a durability
-# nice-to-have blocked on a flaky system-domain FDA grant to the ad-hoc-signed nas-backup-sh; the
-# USER belt is the accepted primary. So ONE belt down = PASS (data safe), not WARN. The real-danger
-# cases stay LOUD FAIL: BOTH belts down, or Henry missing/stale. Flip REQUIRE_BOTH_BELTS=1 to restore
-# strict degraded-redundancy WARNs (e.g. once the root belt is fixed and you want both enforced).
-REQUIRE_BOTH_BELTS="${REQUIRE_BOTH_BELTS:-0}"
+# Strictness AUTO-DETECTS from the loaded root LaunchDaemon (Steve 8/15, TK-10547 — root-belt finish):
+# while the daemon still calls /opt/homebrew/bin/bash the root belt is accepted-down pending FDA, so
+# ONE belt down = PASS (data safe via the user belt). The moment Option B's installer swaps the loaded
+# plist to the stable signed launcher /usr/local/bin/nas-backup-sh, BOTH belts are expected up and we
+# flip to STRICT: one belt down = WARN (degraded redundancy, loud). BOTH down / Henry stale = FAIL
+# always. This means the single `sudo install-optionB-launcher.sh` finishes everything — no manual
+# flag flip, and no premature WARN before the install. Env REQUIRE_BOTH_BELTS=1|0 overrides.
+_rp=/Library/LaunchDaemons/com.steve.nas-dwdump-mirror-root.plist
+if /usr/libexec/PlistBuddy -c 'Print :ProgramArguments:0' "$_rp" 2>/dev/null | grep -q '/usr/local/bin/nas-backup-sh'; then _autoboth=1; else _autoboth=0; fi
+REQUIRE_BOTH_BELTS="${REQUIRE_BOTH_BELTS:-$_autoboth}"
 HERE="$(cd "$(dirname "$0")" && pwd)"; DATA="$HERE/../data"; mkdir -p "$DATA"
 OUT="$DATA/daemon-health-latest.json"
 now=$(date +%s)

← 4228153 pull-dw-dump: retry remote-dump SSH discovery on transient f · back to Nas Setup · daemon-health: fix jq --argjson crash on '(never exited)' — 9fc2571 →