Automation Catalog

Last audited: 2026-05-23

This catalog inventories the automation surfaces currently present on Aegis. It includes active schedulers, dormant-but-enabled queues, restart-managed services, trigger-based agents, and third-party wrappers that can run work without a human sitting at an interactive shell.

Use this page with Current Automation. That page is the short operational snapshot; this page is the detailed registry.

Legend

Field	Meaning
Status	active, enabled, dormant, stale, or system as observed during the audit.
Trigger	Cron, interval, systemd, Docker restart, webhook/event, daemon loop, or manual/service start.
Side effects	Writes, external calls, messages, spending, or operational changes.
Billing risk	Whether this can spend money or consume the Claude programmatic credit pool.
Disable posture	Whether it looks safe to stop, pause, or needs review first.

Executive Inventory

Surface	Count	Status	Primary risk
User crontab	13 executable entries	active	Duplicate market/memory work, plaintext Discord token, noisy profile poll log.
User systemd services	3 custom units	mixed	claude-gateway is active and Agent SDK-backed; aegis-market is enabled but inactive while manual market processes run.
System timers	15 OS timers	system	Mostly package/log maintenance; low Aegis-specific risk.
Docker services	10 running containers	active	Restart-managed services can hide inner schedulers; Hermes and Aegis scheduler contain their own automation.
Aegis APScheduler jobs	45 active job IDs in code path	active	Revenue/acquisition/proactive jobs can create external actions; anomaly/monitoring can create alert noise.
Market scheduler module	7 jobs	running via old manual processes, not main scheduler	Duplicate with cron and inactive systemd unit.
Hermes cron jobs	4 enabled jobs	active	Daily external messages and browser/product checks.
Database scheduled_tasks	562 rows, 561 enabled overdue	stale/dormant	No active worker found; stale enabled backlog could stampede if a worker is introduced.
Claude Agent SDK surfaces	5+ code paths	mostly dormant	Will draw from Anthropic programmatic credit after 2026-06-15 if invoked.
Happy-Coder daemon	1 daemon plus many old child sessions	active/stale	Third-party Claude wrapper; large growing logs; possible programmatic billing surface if it starts/resumes work.

Host Crontab

These entries run as the agent user. Secrets are redacted.

ID	Schedule	Command / path	Side effects	Logs	Risk	Disable posture
cron-market-news	0 21 * * *	scripts/market_collect_news.py --days 3	Pulls market news/sentiment data.	market-news.log	API/data-provider usage.	Keep if market stack is still desired.
cron-memory-consolidation	0 2 * * *	aegis.memory.consolidation.run_maintenance_consolidation()	Processes memory/consolidation data in PostgreSQL/FalkorDB.	memory-consolidation.log	Possible LLM use if extraction paths activate; duplicates scheduler memory consolidation.	Review ownership; likely keep only one memory consolidation path.
cron-market-weekly	0 3 * * 0	scripts/market_weekly_fundamentals.py	Weekly fundamentals refresh.	market-weekly.log	Market API usage.	Keep if market stack is active.
cron-feed-health	0 */4 * * *	scripts/check_feed_health.py --no-alert	Checks feed health without alerting.	feed-health.log	Low.	Safe to keep; no-alert mode.
cron-market-sat	0 6 * * 6	scripts/market_daily_update.py	Saturday market update.	market-daily.log	Market API usage.	Check overlap with weekday update and market scheduler.
cron-balance-check	0 * * * *	scripts/check_balances.py	Checks balances hourly.	balance-check.log	Financial/account API reads.	Keep if wallet monitoring matters.
cron-profile-channel	*/10 * * * *	scripts/poll_profile_channel.py with DISCORD_BOT_TOKEN=<redacted>	Polls Discord for profile analysis requests; invokes Claude Agent SDK only when profiles are queued.	profile-channel.log	High when triggered: Claude programmatic credit/API, Twitter MCP, Discord webhook. Token stored in crontab.	Move token to env/secret store; add budget guard; consider pausing if unused.
cron-market-screening	30 0,6,12,18 * * *	scripts/market_daily_update.py --screening-only	Four-times-daily screening.	market-screening.log	Market API usage.	Check overlap with market module market_screening.
cron-market-weekday-close	30 22 * * 1-5	scripts/market_daily_update.py	Weekday evening market update.	market-daily.log	Market API usage.	Keep or fold into one market owner.
cron-clawk-feed	*/5 * * * *	/home/agent/scripts/poll_clawk_feed.py	Polls/cross-posts Clawk feed.	clawk-crosspost.log	External posting/read risk.	Keep only if Clawk bridge is still used.
cron-ideas-channel	*/5 * * * *	scripts/poll_ideas_channel.py	Polls ideas channel.	ideas-channel.log	External message ingestion/action risk.	Review recent usefulness.
cron-clawk-crawl	0 * * * *	/home/agent/scripts/crawl_clawk_graph.py	Hourly Clawk graph crawl.	clawk-crawl.log	External crawl/storage.	Keep if graph is useful.
cron-transcript-digestion	30 3 * * *	scripts/ingest_transcripts.py --after <3 days ago>	Ingests transcripts into knowledge graph/memory.	transcript-digestion.log	FalkorDB/Postgres writes; possible LLM/transcript processing depending code path.	Keep, but watch runtime and duplicate ingestion.

User Systemd Units

No user-level systemd timers were present.

Unit	Status	Trigger	Command	Side effects	Billing risk	Disable posture
claude-gateway.service	active/running, enabled	systemd service	/home/agent/services/claude-gateway/run.sh serving FastAPI on 127.0.0.1:8787	Runs Claude Agent SDK jobs/queries, writes ~/.claude-gateway/requests and ~/.claude-gateway/jobs.	High if called after 2026-06-15: Agent SDK programmatic usage. Last recorded gateway jobs were January 2026.	Safe to stop if unused; otherwise require budget/turn limits and request retention cleanup.
claude-session-worker.service	disabled/dead	systemd service if enabled	scripts/claude_session_worker.py	Executes queued WhatsApp/Discord Claude sessions, can use bypassPermissions.	High if re-enabled: Agent SDK programmatic usage.	Leave disabled unless deliberately reactivated with guardrails.
aegis-market.service	enabled but inactive/dead	systemd service if started	python -m aegis.market	Market data scheduler process.	Market API usage; no direct Claude billing found.	Clean up: either make systemd own market automation or disable the unit.

System Timers

These are OS/package maintenance timers, not Aegis product automations.

Timer	Purpose	Aegis concern
sysstat-collect.timer, sysstat-summary.timer	System activity collection and summary.	Low; useful diagnostics.
dpkg-db-backup.timer	Package database backup.	Low.
logrotate.timer	Rotates logs.	Keep; especially useful given Happy/profile log growth.
apt-daily.timer, apt-daily-upgrade.timer	Package update checks/upgrades.	Low/medium; can contend for apt locks.
man-db.timer, motd-news.timer, e2scrub_all.timer, systemd-tmpfiles-clean.timer	Standard maintenance.	Low.
Disabled/no-next-run timers	fstrim, snapd.snap-repair, systemd-sysupdate*, ua-timer.	Low.

Docker Services

All listed containers were running during the audit.

Container	Restart policy	Role / command	Automation inside	Risk
aegis-scheduler	unless-stopped	python -c 'from aegis.scheduler import scheduler; scheduler.start(); ...'	Main APScheduler automation catalogued below.	High operational impact.
aegis-dashboard	unless-stopped	Aegis FastAPI dashboard.	Webhook/event handlers, async task routes, task UI.	Trigger-based actions; review exposed routes separately.
aegis-docs	unless-stopped	MkDocs Material dev server.	Hot-reloads docs from repo bind mount.	Low.
aegis-playwright	unless-stopped	Screenshot API.	Used by monitor/visual health jobs.	Browser automation and screenshots.
falkordb	unless-stopped	Graph database.	Persistence service, no scheduler observed.	Data store.
traefik	unless-stopped	Reverse proxy and ACME.	Watches Docker/file config; renews certs.	Public routing/TLS.
hermes-agent	unless-stopped	Hermes agent gateway.	Contains Hermes cron jobs listed below.	External messaging and model usage depending Hermes config.
hermes-webui	unless-stopped	Hermes UI.	UI/service surface.	Trigger-based.
open-notebook	always	Supervisord single-container notebook stack.	Internal supervisor-managed services.	Product/service surface, not audited deeply here.
serene_wright	no	nousresearch/hermes-agent:latest setup	Setup container still running.	Suspicious/stale; review whether it should be removed.

Aegis Scheduler Jobs

Active in aegis-scheduler via aegis/scheduler.py and module setup functions.

Job ID	Cadence	Module/path	Side effects	Risk / notes
health_check	every 5 minutes	aegis.scheduler	PostgreSQL health state.	Low.
docker_health_check	every 5 minutes	aegis.infra.docker_monitor	Container health checks, remediation policy.	Medium; can restart containers if policy triggers.
email_check	every 30 minutes	aegis.email.scheduled	Email check records/status.	Medium; actual fetch depends MCP/tool availability.
monitor_check_due	every 15 minutes	aegis.monitor.scheduler	Runs due website monitors.	Medium; browser/network work.
monitor_check_scheduled	every 6 hours at :05	aegis.monitor.scheduler	Scheduled website monitor sweep.	Medium.
visual_health_check	every 4 hours at :30	aegis.monitor.scheduler	Screenshots/vision dashboard checks.	Medium; may use vision/model path.
anomaly_metrics_collection	every 1 minute	aegis.infra.anomaly.scheduler	Container metric collection.	Low after tuning.
anomaly_detection	every 5 minutes	aegis.infra.anomaly.scheduler	Alert creation on significant anomalies.	Medium; tuned 2026-05-23 to reduce spam.
anomaly_baseline_update	every 6 hours	aegis.infra.anomaly.scheduler	Refreshes baselines.	Low.
anomaly_metrics_cleanup	daily 03:00	aegis.infra.anomaly.scheduler	Deletes old metrics.	Low.
discord_task_poll	every 60 seconds	aegis.discord.scheduler	Polls Discord task channel.	Medium/high if commands can trigger actions.
discord_command_poll	every 30 seconds	aegis.discord.scheduler	Polls command-center.	Medium/high.
proactive_pattern_learning	every 6 hours	aegis.proactive.scheduler	Learns patterns.	Medium; possible LLM/db writes.
proactive_opportunity_detection	every 30 minutes	aegis.proactive.scheduler	Detects opportunities.	Medium.
proactive_suggestion_delivery	every 15 minutes	aegis.proactive.scheduler	Delivers queued suggestions.	External messaging risk.
proactive_feedback_processing	daily 03:00	aegis.proactive.scheduler	Processes feedback.	Low/medium.
proactive_queue_cleanup	every 4 hours	aegis.proactive.scheduler	Queue cleanup.	Low.
proactive_meeting_prep	every 30 minutes	aegis.proactive.scheduler	Auto-generates meeting prep.	Calendar/email/LLM risk.
proactive_email_drafts	every 30 minutes	aegis.proactive.scheduler	Draft response automation.	Email/LLM risk; review before broad use.
proactive_calendar_cleanup	daily 04:00	aegis.proactive.scheduler	Clears old calendar events.	Data deletion risk.
orchestration_health_check	every 2 minutes	aegis.orchestration.scheduler	Agent health checks.	Low/medium.
orchestration_resource_rebalance	every 5 minutes	aegis.orchestration.scheduler	Rebalance orchestration resources.	Medium.
orchestration_stale_cleanup	hourly	aegis.orchestration.scheduler	Cleans stale orchestration records.	Low/medium.
orchestration_metrics_collection	every 15 minutes	aegis.orchestration.scheduler	Metrics collection.	Low.
revenue_demand_cycle	every 30 minutes	aegis.revenue.scheduler	Demand detection.	Medium/high; prior audit found suspicious demand-signal volume.
revenue_generation_cycle	every 2 hours	aegis.revenue.scheduler	Product generation.	High if it creates/listings/content.
revenue_listing_cycle	hourly	aegis.revenue.scheduler	Listing update.	High if connected to public product surfaces.
revenue_fulfillment_cycle	every 15 minutes	aegis.revenue.scheduler	Order fulfillment.	High; customer-facing.
revenue_support_cycle	every 15 minutes	aegis.revenue.scheduler	Support processing.	High; customer-facing.
knowledge_sync	every 4 hours	aegis.memory.scheduler	Knowledge graph sync.	DB/FalkorDB writes.
knowledge_sync_critical	every 30 minutes	aegis.memory.scheduler	Critical memory sync.	DB/FalkorDB writes.
knowledge_sync_daily	daily 04:00	aegis.memory.scheduler	Full daily sync.	DB/FalkorDB writes.
memory_consolidation	daily 02:00	aegis.memory.scheduler	Memory consolidation.	Duplicates host cron memory consolidation.
scout_full_scan	00:15, 06:15, 12:15, 18:15	aegis.scout.scheduler	Full opportunity scan.	External scan/network/model risk.
scout_trends_scan	every 2 hours 06:30-22:30	aegis.scout.scheduler	Quick trend scan.	Medium.
news_breaking	every 30 minutes	aegis.news.scheduler	Breaking news ingestion.	Network/API usage.
news_full_aggregation	every 4 hours at :10	aegis.news.scheduler	Full news aggregation.	Network/API/model risk.
news_regional_digest	08:00 and 18:00	aegis.news.scheduler	Regional digest.	Messaging/model risk.
acquisition_reply_check	every 15 minutes	aegis.acquisition.scheduler	Checks acquisition replies.	High; customer/public interaction.
acquisition_closing	hourly at :45	aegis.acquisition.scheduler	Attempts closing conversations.	High; can post payment-link style replies. Review safeguards.
acquisition_learning	every 6 hours at :30	aegis.acquisition.scheduler	Learning pipeline.	Medium.
acquisition_cleanup	daily 05:00	aegis.acquisition.scheduler	Queue cleanup.	Low/medium.
morning_status	daily 06:00	aegis.scheduler	Records morning status.	Low.
evening_summary	daily 22:00	aegis.scheduler	Generates daily digest.	Medium if model-backed.
memory_cleanup	daily 00:30	aegis.scheduler	Deletes old low-importance memory.	Data deletion risk.

Market Scheduler Module

aegis/market/scheduler.py defines these jobs, but current main aegis/scheduler.py does not register them. During the audit, python -m aegis.market was running from old Claude shell snapshots, while aegis-market.service was enabled but inactive.

Job ID	Cadence	Side effects	Notes
market_priority_quotes	every minute during Mon-Fri 14:00-21:59 UTC	Priority quotes.	Potentially high data-provider churn.
market_core_equity_quotes	every 5 minutes during Mon-Fri 14:00-21:59 UTC	Equity quotes.	Duplicates some cron market work.
market_core_crypto_quotes	every 5 minutes	Crypto quotes.	Always-on market data.
market_screening	00:30, 06:30, 12:30, 18:30	Market screening.	Overlaps cron-market-screening.
market_morning_digest	daily 07:00	Market digest.	Messaging/model risk depends implementation.
market_evening_digest	daily 21:00	Market digest.	Overlaps cron-market-news.
market_alert_checks	every 5 minutes	Alert checks.	External alerting risk.

Recommendation: make one owner authoritative: cron, systemd service, or Aegis scheduler. Right now ownership is muddy.

Hermes Cron Jobs

Stored inside hermes-agent at /opt/data/cron/jobs.json.

Job	Schedule	Delivery	Last status	Side effects	Risk
Morning Email Check	0 8 * * *	Telegram	ok on 2026-05-23	Reads email via himalaya, posts digest.	Email/privacy + external messaging.
Daily Product Health Check	30 8 * * *	Discord	ok on 2026-05-23	Browser checks of product sites, screenshots, Discord report.	Browser/model usage depending Hermes implementation.
Daily Status Sync	45 8 * * *	Discord	ok on 2026-05-23	Posts daily status summary.	External messaging.
Weekly Tokscale Cost Report	0 9 * * 1	Telegram	ok on 2026-05-18	Runs tokscale-report.sh, posts cost report.	Low/medium; useful billing visibility.

Database Scheduled Tasks

The scheduled_tasks table is a product/API scheduling table, not an observed running scheduler.

Metric	Value
Total rows	562
Enabled rows	561
Enabled future rows	0
Enabled overdue rows	561
Disabled rows	1

Breakdown:

Enabled	Recurrence	Task type	Count	Next-run range
true	daily	custom	253	2026-01-13 to 2026-01-31
true	once	custom	120	2025-12-30 to 2026-01-30
true	once	email_digest	101	2025-12-30 to 2026-01-30
true	hourly	custom	84	2025-12-30 to 2026-01-31
true	daily	webhook	3	2025-12-31
false	once	custom	1	2025-12-30

No active worker was found that processes scheduled_tasks. The risk is a future worker suddenly discovering 561 enabled overdue tasks. Treat this as stale data until proven otherwise.

Recommendation: disable or archive all overdue test rows before any task-runner is introduced.

Claude / Anthropic Programmatic Surfaces

These are the surfaces affected by Anthropic's 2026-06-15 programmatic usage credit split if they run through Claude subscription/OAuth rather than a separate API account.

Surface	Status	Trigger	Code path	Billing risk	Notes
Claude gateway	active service, idle by records	HTTP /v1/query, /v1/jobs on localhost	/home/agent/services/claude-gateway	High when called.	Last recorded jobs were January 2026; keep stopped unless needed.
Profile channel poller	active cron, mostly idle	Discord profile queue	/home/agent/scripts/poll_profile_channel.py	High when a profile is queued.	Asks SDK to analyze up to 500 tweets.
Claude session worker	disabled	systemd if enabled	scripts/claude_session_worker.py	High.	Uses Agent SDK and can use bypassPermissions.
Aegis Haiku client	installed code path	Any query_haiku or prefer_haiku=True call	aegis/llm/haiku.py, aegis/llm/__init__.py	Medium/high if active.	Current May metering showed no llm_tokens; historical Jan/Apr usage was real.
Dashboard profile analyzer	trigger route	Dashboard/Discord profile analysis route	aegis/dashboard/routes/discord_profile_analyzer.py	High if route invoked.	Agent SDK model sonnet.
GLM Agent client	installed code path	GLM with use_agent=True	aegis/llm/glm.py	Anthropic subscriber-credit risk is lower if Z.ai env/base URL is used; still Agent SDK machinery.	Prefer direct GLM HTTP for production automation.

Historical Claude session-token logs suggest programmatic-equivalent cost would have been roughly: January $196, February $6, April $87, May near $0 observed. This is enough to exceed Pro credits and sometimes Max 5x credits if old workloads resume.

Happy-Coder / Claude Code Wrapper

Surface	Status	Trigger	Side effects	Risk	Disable posture
Happy daemon	active since 2026-01-25	happy-coder daemon start-sync	Maintains remote/mobile Claude sessions; open local daemon state.	Third-party Claude Code wrapper; could create programmatic/agentic Claude usage if sessions resume.	Stop if not actively used.
Happy Claude sessions	many old happy-coder ... claude --started-by daemon processes plus Claude child processes	daemon/session resume	Claude Code sessions; logs under ~/.happy/logs.	Billing and operational risk if active; significant memory/log usage.	Strong cleanup candidate.
Large Happy log	active log file around 870 MB	stuck scanner loop	Repeatedly checks missing Claude session JSONL.	Disk/log noise; maybe no token spend, but daemon still live.	Stop daemon and rotate/delete after review.
claude --claude-in-chrome-mcp	active process	Chrome/MCP integration	Browser/Claude bridge.	Unknown; likely interactive/tooling surface.	Stop if no current browser session depends on it.

Trigger-Based Aegis Surfaces

These are not time schedulers, but they are automation entrypoints that can trigger work.

Surface	Trigger	Risk
Discord task and command pollers	Scheduler polls every 60s/30s.	Can dispatch commands/actions from Discord.
Telegram command handlers	Incoming Telegram messages.	Can read calendars, memory, services, etc. depending command.
WhatsApp/Vonage routes	Incoming messages/webhooks.	Can create Claude sessions if worker is enabled.
Dashboard async tasks/routes	HTTP routes.	Can queue background work from web UI/API.
Revenue/acquisition routes and schedulers	Scheduler plus API/event state.	Public/customer-facing automation; review safeguards.
Monitor visual/browser checks	Scheduler.	Browser automation and screenshots; possible model use.
Open Notebook/Hermes product checks	Hermes cron and web UI.	Product monitoring, screenshots, external messages.

Current Cleanup Priorities

Priority	Item	Why
P0	Stop or explicitly bless Happy-Coder daemon/sessions.	It is active, stale, log-heavy, and a third-party Claude wrapper.
P0	Add a hard budget/turn guard to claude-gateway and profile analysis.	These are the clearest Anthropic programmatic billing surfaces.
P0	Archive/disable stale scheduled_tasks rows.	561 enabled overdue tasks could stampede if a worker appears.
P1	Choose one market automation owner.	Cron, stale manual processes, and inactive systemd all overlap.
P1	Remove plaintext Discord token from crontab.	Secret hygiene.
P1	Decide whether cron or Aegis scheduler owns memory consolidation.	Duplicate daily work at 02:00.
P2	Add per-surface owner labels.	Makes future audits faster: owner, purpose, last-known-good, disable command.
P2	Add log rotation for profile-channel and Happy logs.	Existing logs are noisy and one Happy log is very large.

Suggested Disable Commands

Do not run these blindly; they are listed here so cleanup is deliberate.

# Stop Claude gateway if unused
systemctl --user stop claude-gateway.service
systemctl --user disable claude-gateway.service

# Keep Claude session worker disabled
systemctl --user disable --now claude-session-worker.service

# Stop stale market service if deciding cron owns market automation
systemctl --user disable --now aegis-market.service

# Inspect then stop Happy-Coder daemon/sessions
ps -eo pid,ppid,stat,lstart,cmd | grep -Ei 'happy-coder| claude$'
# Then stop through happy CLI if available, or terminate selected stale PIDs deliberately.

# Disable stale database scheduled tasks after backup/review
# UPDATE scheduled_tasks SET enabled = false WHERE enabled = true AND next_run < NOW();