frameworkagent-fleet-2026-08-12 · v11099:cowork-audit-architect2026-08-12served from databaseAll documents

Scheduled agent fleet — registry & value contract (2026-08-12)

JBNX scheduled agent fleet — registry & value contract

Owner: Joey Nguyen (CEO, JBNX LLC) Created: 2026-08-12 Authority: subordinate to https://hi.jbnx.io (re-fetch every run; it versions). Ground truth for: the agent-fleet-audit meta-agent, which reads this file every morning at 06:00 and grades every other agent against the value contract in §3.

Every agent in this fleet is read-only. They produce findings and recommendations. None of them modify code, workflows, schemas, DNS, or grants. Changes go through the normal claim → PR → chat-approve path with a human.

1. Why this fleet exists

Audits that only happen when someone remembers to ask for them do not happen. The fleet puts a fixed, cheap, recurring floor under code quality, UX, data, infrastructure, security, and spend — and then audits itself so the floor never becomes a tax.

The failure mode this design is built against is agent sprawl: a pile of scheduled jobs that each burn tokens, mostly report "nothing changed," and nobody dares delete because nobody knows which ones are earning. §3 is the answer to that.

2. The fleet

Times are local. Weekly agents work one item on rotation per run — never the whole estate — to keep per-run cost bounded and predictable.

Agent	Cadence	Budget (in/out)	Job
`agent-fleet-audit`	Daily 06:00	50k / 8k	Grades every scheduled agent on cost, efficiency, effectiveness, ROI. Issues KEEP / TUNE / MERGE / KILL. Reports to chat + portal.

Daily

Agent	Cadence	Budget	Job
`uptime-alert-sweep`	Daily 06:20	15k / 3k	Reads `agent_ops.site_checks` and surfaces failures. Closes the known-open "monitoring records but never notifies" gap. Deliberately tiny.
`soc2-daily-evidence-sweep` (existing)	Weekdays 07:04	—	SOC 2 evidence: control runs, advisors, deploys, directive integrity.

Weekly

Agent	Cadence	Budget	Job
`cost-spend-audit`	Mon 06:40	40k / 6k	LLM token spend by engine/model/slug, vendor cost, billing integrity, unbilled or orphaned work sessions.
`code-improvement-review`	Mon 07:30	45k / 8k	One repo on rotation. Tech debt, complexity, duplication, dead code, structural improvement.
`soc2-weekly-control-health` (existing)	Mon 08:08	—	Evidence completeness and control scorecard.
`ux-audit`	Tue 07:30	45k / 8k	One user-facing surface on rotation. Flows, WCAG 2.1 AA, copy, mobile, empty/error states.
`code-audit`	Wed 07:30	45k / 8k	One repo on rotation. Correctness, error handling, test coverage, dependency freshness and supply chain.
`attack-surface-audit`	Wed 15:00	40k / 6k	External view: exposed endpoints, auth boundaries, secret leakage, headers, CORS. Black-box, complements the SOC 2 white-box review.
`database-audit`	Thu 07:30	45k / 8k	One Supabase project on rotation. RLS, grants, advisors, indexes, slow queries, migration lineage.
`github-audit`	Fri 07:30	40k / 6k	Branch protection, Actions health and cost, Dependabot/gitleaks alerts, stale branches and PRs, deploy-lane drift.
`soc2-weekly-project-review` (existing)	Fri 15:07	—	Deep white-box security review, one project on rotation.

Monthly / quarterly

Agent	Cadence	Budget	Job
`soc2-monthly-evidence-export` (existing)	1st 06:00	—	Evidence export + integrity, beats 90-day Actions retention.
`soc2-monthly-access-review` (existing)	1st 09:00	—	Access review across all vendors and agent seats.
`docs-directive-audit`	5th 09:00	35k / 6k	Directive version consistency across all four endpoints, portal doc drift, stale runbooks and skills.
`soc2-quarterly-vendor-risk-review` (existing)	Quarterly	—	Vendor/subservice risk, risk register, CEO program memo.

Rotation registers live at D:\gh\compliance\agents\rotation\<agent>.json. Each agent reads its register, takes the least-recently-audited item, and writes the date back. If the register is missing, the agent creates it from the scope list in its own prompt.

3. The value contract — how an agent earns its place

The meta-auditor grades each agent on four axes every morning. An agent that fails the same axis three runs in a row gets a recommendation the CEO can act on in one word.

1. Cost. What did it actually spend? Pulled from record-usage rows for the agent's slug. An agent with no usage rows is either not running or not recording — both defects.

2. Efficiency. Cost per finding, and cost against its declared budget above. Signals of waste: re-reading large context files every run when a diff would do, re-pasting the directive instead of boot, deploy-verification loops, whole-estate sweeps where a rotation would serve, output far longer than a human will read.

3. Effectiveness. Did it find anything real? Findings are counted as:

Actioned — a human or agent changed something because of it. Full credit.
Open, valid — real, not yet fixed. Full credit.
Noise — duplicate of a known-open item, restated from a prior run, or a

false positive. Negative credit. A long run of clean reports is not automatically failure — for uptime-alert-sweep, silence is the product. Effectiveness is judged against what the agent is for.

4. ROI. Cost versus the cost of the thing it prevents or the time it saves. Stated in dollars, using $0.01/credit and recorded token spend. An agent whose annual run cost exceeds the plausible cost of the incident it prevents is a KILL candidate.

Verdicts:

KEEP — earning its spend.
TUNE — worth keeping, with a named, specific change (narrow scope, cut cadence, drop

a context file, cap output).

MERGE — overlaps another agent enough that one run should do both. Names the pair.
KILL — three consecutive runs of no valid findings and no preventive value, or cost

exceeding value. Must state what coverage is lost.

Verdicts are recommendations. Only the CEO disables or deletes an agent.

4. Known overlaps, declared up front

Declared here so the meta-auditor grades them as intentional rather than rediscovering them monthly:

attack-surface-audit (black-box, external) vs soc2-weekly-project-review

(white-box, source and schema). Same subject, opposite vantage. Keep both only while the black-box view keeps finding things the white-box view structurally cannot.

code-improvement-review (maintainability) vs code-audit (correctness and supply

chain). Same repos, different lens, different weekdays. First MERGE candidate if either runs thin.

github-audit deploy-lane checks vs soc2-daily-evidence-sweep Actions checks. The

daily is pass/fail evidence; the weekly is configuration and hygiene.

cost-spend-audit billing integrity vs the work_sessions_resolve_project trigger

installed 2026-08-12. The trigger prevents orphans; the audit verifies the trigger is still doing so.

5. House rules every agent inherits

Re-fetch https://hi.jbnx.io live at the start of every run. Follow its loop.
Claim the slug, boot for the brief, work, record usage, status with a

customer-readable --done, release. One claim, one billable session, no duplicates. Claim a live portfolio slug, not a repo directory name — see D:\gh\compliance\agents\SLUG-MAP.md. A wrong slug fails with P0001 and the whole run is then unclaimed and unbilled.

Print the usage line and the token-health band. Silent $0 is a defect.
Read-only. Findings and recommendations only — never edit code, schema, grants, DNS,

or workflows.

Findings use stable IDs in the D:\gh\fedm8-scan\AUDIT.md format: ID, evidence,

impact, fix direction, acceptance test.

Check §6 of the jbnx-security-posture skill and the known-open table before

reporting something as new. Restating a known-open item is noise, and the meta-auditor counts it against the agent.

Stay inside the token budget. If the scope will not fit, narrow it, say so, and note

what was skipped — do not silently overrun.

Publish to the portal: POST /api/1099/document for the report, status for the

handover. Never rewrite portal HTML.

Report to chat in BLUF form. Short. A clean run is a few lines.

Repo → portal slug map

Verified live 2026-08-12 against GET https://projects.jbnx.io/api/1099/board.

Scheduled agents must claim a live portfolio slug, not a repo directory name. Claiming a name that isn't a slug fails with P0001 — No live project matches <name>, and the agent's whole run is then unclaimed and unbilled, which the directive treats as a defect.

Re-verify this map before trusting it — board is the source of truth, this file is a convenience:

curl -s https://projects.jbnx.io/api/1099/board | grep -o '"slug":"[^"]*"' | sort -u

Live slugs (14 as of 2026-08-12)

Repo under `D:\gh`	Claim this slug
`fedm8`, `fedm8-scan`	`fedm8`
`nodedough`	`nodedough`
`cipherdeck-apps`	`cipherdeck-apps`
`cipherdeck`, `cipherdeck-shopify`	`lp-cipherdeck`
`jbnx.io` (the projects-portal monorepo)	`projects-portal`
`ai-portal`	`ai-jbnx`
`mkt.jbnx.io`	`mkt-jbnx`
`tensuite`	`lp-tensuite`
`demo`	`demo`
— (jbnx.io marketing landing page)	`lp-jbnx`

Non-project slugs: full-stack (architecture), ceo-desk (CEO reporting), fedm8-llc (company setup), automation (agent fleet, tooling, scheduled work).

Repos with no slug of their own

jbnx-bill, claude-ops, nguy.in, mockups, scytherdeck.

Work on these claims automation. If any of them becomes a customer-billable product, create the portfolio project and the billing.projects row and the customer assignment in the same session — a work session on a slug missing from billing.projects is invisible to the customer, which the directive rates the same defect class as silent $0 usage.

Which slug each scheduled agent claims

Agent	Slug
`agent-fleet-audit`, `uptime-alert-sweep`, `github-audit`, `attack-surface-audit`, `cost-spend-audit`	`automation`
`docs-directive-audit`	`projects-portal`
`code-improvement-review`, `code-audit`, `ux-audit`, `database-audit`	whichever slug matches the rotation item, per the table above