A job is a file
Every job is a Markdown file in the runner's repository: a header of keys, and for an agent job the brief the session gets. There are 33 of them, 11 agent jobs and 22 script jobs. The keys say what kind of job it is, whether it runs an agent or a plain command, when it runs, the check that decides whether it is needed, its limits, and whether it may land by itself. A file that breaks a rule, such as a script job that asks to land, is refused when it is read.
--- id: suites-green-toolkit kind: fix mode: agent schedule: nightly precheck: cmd-bot/dispatcher/tools/verify/verify-all.sh check: cmd-bot/dispatcher/tools/verify/verify-all.sh max_minutes: 90 land: yes --- The nightly check of this repository failed on main (the command is the job's `check`; the runner ran it in a fresh lane from main and it was red). Find the cause first: run the check, read the failure, read the code it points at.
A job runs on the machine its file names, or on both. A once-job runs a single time, and it can wait for a date with not_before. A job that says autoqueue: true queues itself, once, the first night its file is on the main branch.
Keeping suites green
Six jobs, one per repository, watch the test suites of claude-global-context, 1-llm, Tacit, tool-kit, 0-libraries and this repository. Each repository's suite runs on one machine only, so a red suite never gets two fixing sessions.
Their briefs say the same thing. Find the cause first: run the check, read the failure, read the code it points at. If the failure is real, fix it test-first: a failing test that pins the defect, then the smallest change that makes it pass, then the whole check green. If it is not a code defect, such as a flaky test, a missing tool or the network, change nothing, say why, and end blocked. tool-kit's brief adds that a step that timed out once and passes on a rerun is a flake, to report and not to fix.
Fixes from a backlog
Five once-jobs take single tasks from the backlogs of tool-kit and 0-libraries, each with its own limits of time and dollars: test suites that inherit variables they do not own, a test file that makes no assertions and still passes, a command-line check that lets a bare -- through, and a setup check that misses git's own config file under the XDG folder. Two of them name another job's branch with the key base:, because they are follow-ups of its task: a lane starts from that branch while it exists and is not yet merged, and from main otherwise.
Housekeeping, every night
- Repository cleanup removes the worktrees and lane branches whose work is already on the default branch, locally and on the remote. Merged means the content is there: the branch is an ancestor of the default branch, or merging it would add nothing, so squash and rebase merges count. A branch whose change was later reverted counts as stale, not merged, which is the safe side. Untracked and ignored files are copied aside before a worktree goes, a local branch is deleted only if it has not moved, and a remote one only by a delete under a lease, which refuses a branch that moved. Nothing that is not merged is removed: an old one is only listed for me.
- Self-pull fast-forwards the checkouts of claude-global-context and this repository, each only when it is on its default branch, has no tracked change, and no session works in it. claude-global-context's rules reach every session, so a stale checkout means stale rules.
- The secret scrubber finds secrets in Claude Code's transcripts and shell histories and redacts them in place. The tool runs dry by default. The nightly job applies, and its file says to queue it only after a first apply by hand, with its report read. It never prints, logs or writes a secret value, and it keeps no backup, because a backup would be a second copy of the secrets. It leaves alone the folder Claude Code's rewind restores files from, where a redaction would land in a real file, and it skips a shell's history while a shell that writes it is running.
- Units health reports failed user units, the last result of every timer, and the errors of the watched units in the last 24 hours, in one line when all is well.
- Peer status gives one line on the other machine: its last brief, and its checkouts against the remote.
Watching
Two weekly jobs only look. One asks whether the free cloud models that commit-push tries are still listed, and names a dead one for removal. The other counts npm audit findings in Tacit and flags only high or critical ones: a dependency bump stays my decision.
Once-jobs that measure
Some once-jobs measure a change instead of making one. Most of them queue themselves, and some wait for a date first. One observes how my lane sessions of the last 30 days went, and, if that says it is needed, a bench replays three landed lanes in four configurations, capped at $20 a night and $35 in all. Another tests whether free cloud models handle medium tasks as well as the Claude tier that does them today, on the same input. A local-agent probe runs only while the local model server is free, and the third night that tests nothing ends in the verdict "untestable". Three more measure the week after a change. This page claims none of their results.
A recording becomes a note
A screen recording is transcribed on the machine with a local Whisper model through 1-llm, summarised through the local-first ladder, and added to my notes vault's inbox. The note holds the summary and the paths, and the transcript stays beside the recording. A path unit does this as soon as a recording is finished, and a nightly job catches any it missed.
The remaining seven feed the weekly reviews and a weekly usage report: the efficiency review and its nightly collector, the automation finder and its extractor, the transcript learnings and the prompt miner. The reviews have a page of their own.