Add operational reliability skills and repo hardening

README.md

@@ -1,14 +1,14 @@
 # openclaw-superpowers
 
-**53 ready-to-use skills that make your AI agent autonomous, self-healing, and self-improving.**
+**60 ready-to-use skills that make your AI agent autonomous, self-healing, and self-improving.**
 
-[![Skills](https://img.shields.io/badge/skills-53-blue)](#skills-included)
+[![Skills](https://img.shields.io/badge/skills-60-blue)](#skills-included)
 [![Security](https://img.shields.io/badge/security_skills-6-green)](#security--guardrails)
-[![Cron](https://img.shields.io/badge/cron_scheduled-20-orange)](#openclaw-native-37-skills)
-[![Scripts](https://img.shields.io/badge/companion_scripts-37-purple)](#companion-scripts)
+[![Cron](https://img.shields.io/badge/cron_scheduled-23-orange)](#openclaw-native-44-skills)
+[![Scripts](https://img.shields.io/badge/companion_scripts-44-purple)](#companion-scripts)
 [![License: MIT](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)
 
-A plug-and-play skill library for [OpenClaw](https://github.com/openclaw/openclaw) — the open-source AI agent runtime. Gives your agent structured thinking, security guardrails, persistent memory, cron scheduling, runtime verification, self-recovery, and the ability to write its own new skills during conversation.
+A plug-and-play skill library for [OpenClaw](https://github.com/openclaw/openclaw) — the open-source AI agent runtime. Gives your agent structured thinking, security guardrails, persistent memory, cron scheduling, deployment preflight, runtime verification, auth lifecycle tracking, self-recovery, and the ability to write its own new skills during conversation.
 
 Built for developers who want their AI agent to run autonomously 24/7, not just respond to prompts in a chat window.
 
@@ -20,13 +20,18 @@ Built for developers who want their AI agent to run autonomously 24/7, not just
 
 Most AI agent frameworks give you a chatbot that forgets everything between sessions. OpenClaw is different — it runs persistently, handles multi-hour tasks, and has native cron scheduling. But out of the box, it doesn't know *how* to use those capabilities well.
 
-**openclaw-superpowers bridges that gap.** Install 53 skills in one command, and your agent immediately knows how to:
+**openclaw-superpowers bridges that gap.** Install 60 skills in one command, and your agent immediately knows how to:
 
 - **Think before it acts** — brainstorming, planning, and systematic debugging skills prevent the "dive in and break things" failure mode
 - **Protect itself** — 6 security skills detect prompt injection, block dangerous actions, audit installed code, and scan for leaked credentials
-- **Run unattended** — 20 cron-scheduled skills handle memory cleanup, health checks, budget tracking, and community monitoring while you sleep
+- **Run unattended** — 23 cron-scheduled skills handle memory cleanup, health checks, budget tracking, and community monitoring while you sleep
+- **Keep MCP auth alive** — auth lifecycle tracking catches missing env vars, expiring tokens, and undefined refresh paths before a healthy server turns unusable
+- **Prove delivery** — cron execution proofs distinguish "the job fired" from "the user actually got the output"
+- **Scale delegation safely** — subagent capability auditing catches missing spawn tools, unsafe depth settings, and bloated fleet definitions before they burn time and tokens
+- **Rollback cleanly** — upgrade rollback snapshots preserve configs and restore instructions before runtime changes become irreversible
+- **Deploy safely** — deployment preflight catches missing mounts, missing bootstrap files, and public gateway exposure before the runtime starts drifting
 - **Verify itself** — runtime verification catches missing cron registrations, stale state, dependency drift, and install layout mistakes before they silently break automation
-- **Recover from failures** — self-recovery, loop-breaking, and task handoff skills keep long-running work alive across crashes and restarts
+- **Recover from failures** — self-recovery, loop-breaking, task handoff, and reset recovery keep long-running work alive across crashes and routine session resets
 - **Never forget** — DAG-based memory compaction, integrity checking, context scoring, and SQLite session persistence ensure the agent preserves critical information even in month-long conversations
 - **Improve itself** — the agent can write new skills during normal conversation using `create-skill`, encoding your preferences as permanent behaviors
 
@@ -82,7 +87,7 @@ Methodology skills that work in any AI agent runtime. Adapted from [obra/superpo
 | `skill-conflict-detector` | Detects name shadowing and description-overlap conflicts between installed skills | `detect.py` |
 | `skill-portability-checker` | Validates OS/binary dependencies in companion scripts; catches non-portable calls | `check.py` |
 
-### OpenClaw-Native (37 skills)
+### OpenClaw-Native (44 skills)
 
 Skills that require OpenClaw's persistent runtime — cron scheduling, session state, or long-running execution. These are the skills that make a 24/7 autonomous agent actually work reliably.
 
@@ -108,6 +113,12 @@ Skills that require OpenClaw's persistent runtime — cron scheduling, session s
 | `channel-context-bridge` | Writes a context card at session end for seamless channel switching | — | `bridge.py` |
 | `skill-doctor` | Diagnoses silent skill discovery failures — YAML errors, path violations, schema mismatches | — | `doctor.py` |
 | `installed-skill-auditor` | Weekly post-install audit of all skills for injection, credentials, and drift | Mondays 9am | `audit.py` |
+| `deployment-preflight` | Validates deployment safety before install, upgrade, or unattended use — workspace visibility, persistent mounts, gateway exposure, and runtime paths | — | `check.py` |
+| `session-reset-recovery` | Checkpoints active work before the overnight reset window and restores a concise resume brief after restart | daily 3:45am | `recover.py` |
+| `cron-execution-prover` | Wraps scheduled workflows with proof records — start, finish, evidence, and stale-run detection | — | `prove.py` |
+| `message-delivery-verifier` | Tracks outbound notification delivery across channels so sent, acknowledged, failed, and stale messages are explicit | every 15 min | `verify.py` |
+| `subagent-capability-auditor` | Audits subagent configuration for spawn depth, tool exposure, and fleet shape before multi-agent work begins | — | `audit.py` |
+| `upgrade-rollback-manager` | Snapshots config and state before upgrades and writes rollback instructions tied to the previous runtime version | — | `manage.py` |
 | `skill-loadout-manager` | Named skill profiles to manage active skill sets and prevent system prompt bloat | — | `loadout.py` |
 | `skill-compatibility-checker` | Checks installed skills against the current OpenClaw version for feature compatibility | — | `check.py` |
 | `runtime-verification-dashboard` | Verifies cron registration, state freshness, install layout, and dependency readiness across the live runtime; can dry-run or apply safe remediations | every 6h | `check.py` |
@@ -117,6 +128,7 @@ Skills that require OpenClaw's persistent runtime — cron scheduling, session s
 | `config-encryption-auditor` | Scans config directories for plaintext API keys, tokens, and world-readable permissions | Sundays 9am | `audit.py` |
 | `tool-description-optimizer` | Scores skill descriptions for trigger quality — clarity, specificity, keyword density — and suggests rewrites | — | `optimize.py` |
 | `mcp-health-checker` | Monitors MCP server connections for health, latency, and availability; detects stale connections | every 6h | `check.py` |
+| `mcp-auth-lifecycle-manager` | Tracks MCP auth expiry, missing env vars, refresh commands, and interactive-login risk before credentials silently age out | every 6h | `manage.py` |
 | `memory-dag-compactor` | Builds hierarchical summary DAGs from MEMORY.md with depth-aware prompts (d0 leaf → d3+ durable) | daily 11pm | `compact.py` |
 | `large-file-interceptor` | Detects oversized files, generates structural exploration summaries, stores compact references | — | `intercept.py` |
 | `context-assembly-scorer` | Scores how well current context represents full conversation; detects blind spots | every 4h | `score.py` |
@@ -155,12 +167,15 @@ Six skills form a defense-in-depth security layer for autonomous agents:
 
 | Feature | openclaw-superpowers | obra/superpowers | Custom prompts |
 |---|---|---|---|
-| Skills included | **53** | 8 | 0 |
+| Skills included | **60** | 8 | 0 |
 | Self-modifying (agent writes new skills) | Yes | No | No |
-| Cron scheduling | **20 scheduled skills** | No | No |
+| Cron scheduling | **23 scheduled skills** | No | No |
 | Persistent state across sessions | **YAML state schemas** | No | No |
 | Security guardrails | **6 defense-in-depth skills** | No | No |
-| Companion scripts with CLI | **37 scripts** | No | No |
+| Companion scripts with CLI | **44 scripts** | No | No |
+| MCP auth lifecycle tracking | Yes | No | No |
+| Upgrade rollback planning | Yes | No | No |
+| Deployment preflight / Docker safety | Yes | No | No |
 | Memory graph / knowledge graph | Yes | No | No |
 | SQLite session persistence + FTS5 search | Yes | No | No |
 | Sub-agent recall with token-budgeted grants | Yes | No | No |
@@ -185,7 +200,7 @@ Six skills form a defense-in-depth security layer for autonomous agents:
 │   │   │   ├── SKILL.md
 │   │   │   └── TEMPLATE.md
 │   │   └── ...
-│   ├── openclaw-native/         # 37 persistent-runtime skills
+│   ├── openclaw-native/         # 44 persistent-runtime skills
 │   │   ├── memory-graph-builder/
 │   │   │   ├── SKILL.md             # Skill definition + YAML frontmatter
 │   │   │   ├── STATE_SCHEMA.yaml    # State shape (committed, versioned)
@@ -208,7 +223,7 @@ Six skills form a defense-in-depth security layer for autonomous agents:
 
 Skills marked with a script ship a small executable alongside their `SKILL.md`:
 
-- **36 Python scripts** (`run.py`, `audit.py`, `check.py`, `guard.py`, `bridge.py`, `onboard.py`, `sync.py`, `doctor.py`, `loadout.py`, `governor.py`, `detect.py`, `test.py`, `radar.py`, `graph.py`, `optimize.py`, `compact.py`, `intercept.py`, `score.py`, `integrity.py`, `persist.py`, `recall.py`) — run directly to manipulate state, generate reports, or trigger actions. Install `PyYAML` for any helper that reads or writes skill state.
+- **43 Python scripts** (`audit.py`, `bridge.py`, `check.py`, `compact.py`, `detect.py`, `doctor.py`, `governor.py`, `graph.py`, `guard.py`, `integrity.py`, `intercept.py`, `loadout.py`, `manage.py`, `onboard.py`, `optimize.py`, `persist.py`, `prove.py`, `radar.py`, `recall.py`, `recover.py`, `run.py`, `score.py`, `sync.py`, `test.py`, `verify.py`) — run directly to manipulate state, generate reports, or trigger actions. Install `PyYAML` for any helper that reads or writes skill state.
 - **`vet.sh`** — Pure bash scanner; runs on any system with grep.
 - Every script supports `--help` and `--format json`. Dry-run mode available on scripts that make changes.
 - See the `example-state.yaml` in each skill directory for sample state and a commented walkthrough of cron behaviour.
@@ -220,9 +235,30 @@ Skills marked with a script ship a small executable alongside their `SKILL.md`:
 **Solo developer with a persistent AI agent**
 > Install superpowers, and your agent handles memory cleanup, security audits, and daily briefings on autopilot. You focus on building; the agent maintains itself.
 
+**Anyone bitten by the overnight reset**
+> Use `session-reset-recovery` to checkpoint active work before the routine reset window and recover with a concise "here is what changed, here is what to do next" brief after restart.
+
+**Teams depending on scheduled delivery**
+> Use `cron-execution-prover` around cron workflows that write files or send notifications, so "started" and "delivered" are no longer treated as the same thing.
+
+**Anyone shipping notifications to real humans**
+> Use `message-delivery-verifier` for the last mile. It tells you whether a Telegram or Slack-style notification was only queued, actually sent, acknowledged, failed, or left stale.
+
+**Anyone moving from one agent to a fleet**
+> Run `subagent-capability-auditor` before trusting subagents in production. It catches missing spawn capability, risky delegation depth, and flat fleets that will be painful to operate.
+
+**Anyone upgrading frequently**
+> Use `upgrade-rollback-manager` before changing the runtime version so you have preserved config, a version fingerprint, and a rollback plan if the new release behaves badly.
+
+**Anyone relying on MCP servers with expiring auth**
+> Use `mcp-auth-lifecycle-manager` to record expiry windows, refresh commands, and headless-login risk so MCP tools do not fail halfway through unattended work.
+
 **Team running multiple OpenClaw agents**
 > Use `multi-agent-coordinator` for fleet health checks, `skill-loadout-manager` to keep system prompts lean per agent role, and `heartbeat-governor` to prevent runaway cron costs.
 
+**Self-hosted or Docker deployment**
+> Run `deployment-preflight` before the first rollout or after compose changes to catch missing mounts, missing bootstrap files, and public gateway exposure. Follow it with `runtime-verification-dashboard` once the runtime is live.
+
 **Open-source maintainer**
 > `community-skill-radar` scans Reddit for pain points automatically. `skill-vetting` catches malicious community contributions before they're installed. `installed-skill-auditor` detects post-install tampering.
 

skills/openclaw-native/cron-execution-prover/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: cron-execution-prover
+version: "1.0"
+category: openclaw-native
+description: Wraps scheduled workflows with proof records — start, finish, evidence, and stale-run detection — so cron jobs can be trusted instead of merely assumed.
+stateful: true
+---
+
+# Cron Execution Prover
+
+## What it does
+
+Cron jobs often "kind of run": the task starts, some work happens, but the final side effect never lands. Cron Execution Prover gives scheduled workflows a durable proof trail so you can tell the difference between a completed run and an abandoned one.
+
+## When to invoke
+
+- Around any cron-driven workflow that writes files, sends messages, or produces deliverables
+- When scheduled jobs seem to run but users still do not receive the expected output
+- When debugging stuck or half-finished cron chains
+
+## Proof model
+
+Every cron run gets a ledger entry:
+
+- `expected_at`
+- `started_at`
+- `finished_at`
+- `status`
+- `evidence`
+- `notes`
+
+If a run never finishes, the prover can surface it as stale.
+
+## How to use
+
+```bash
+python3 prove.py --expect morning-briefing --expected-at "2026-03-30T07:00:00"
+python3 prove.py --start morning-briefing --run-id mb-20260330-0700
+python3 prove.py --finish morning-briefing --run-id mb-20260330-0700 --evidence "telegram:msg-8812"
+python3 prove.py --fail morning-briefing --run-id mb-20260330-0700 --notes "Telegram send timed out"
+python3 prove.py --stale
+python3 prove.py --report
+python3 prove.py --format json
+```
+
+## Operating rule
+
+For important cron workflows:
+
+1. Create or infer an expected run record
+2. Mark the run started
+3. Record proof of side effects on completion
+4. Mark failures explicitly
+5. Review stale runs before assuming the schedule is healthy
+
+## Difference from runtime-verification-dashboard
+
+`runtime-verification-dashboard` verifies whether cron skills are registered and whether state is fresh.
+
+`cron-execution-prover` verifies whether specific scheduled runs actually produced the expected outcome.
+
+## State
+
+State file: `~/.openclaw/skill-state/cron-execution-prover/state.yaml`
+
+Fields: `runs`, `stale_runs`, `last_report_at`, `report_history`.

skills/openclaw-native/cron-execution-prover/STATE_SCHEMA.yaml

@@ -0,0 +1,31 @@
+version: "1.0"
+description: Cron proof ledger, stale-run detection, and reporting history.
+fields:
+  runs:
+    type: list
+    items:
+      skill:        { type: string }
+      run_id:       { type: string }
+      expected_at:  { type: datetime }
+      started_at:   { type: datetime }
+      finished_at:  { type: datetime }
+      status:       { type: enum, values: [expected, in_progress, succeeded, failed, stale] }
+      evidence:     { type: list, items: { type: string } }
+      notes:        { type: string }
+  stale_runs:
+    type: list
+    items:
+      skill:       { type: string }
+      run_id:      { type: string }
+      expected_at: { type: datetime }
+      age_minutes: { type: integer }
+  last_report_at:
+    type: datetime
+  report_history:
+    type: list
+    description: Rolling history of report summaries (last 12)
+    items:
+      reported_at:      { type: datetime }
+      total_runs:       { type: integer }
+      stale_run_count:  { type: integer }
+      failed_run_count: { type: integer }

skills/openclaw-native/cron-execution-prover/example-state.yaml

@@ -0,0 +1,41 @@
+# Example runtime state for cron-execution-prover
+runs:
+  - skill: "morning-briefing"
+    run_id: "mb-20260330-0700"
+    expected_at: "2026-03-30T07:00:00"
+    started_at: "2026-03-30T07:00:02"
+    finished_at: "2026-03-30T07:00:18"
+    status: succeeded
+    evidence:
+      - "telegram:msg-8812"
+      - "state:morning-briefing:last_briefing_date=2026-03-30"
+    notes: "Delivered successfully."
+  - skill: "community-skill-radar"
+    run_id: "csr-20260330-0900"
+    expected_at: "2026-03-30T09:00:00"
+    started_at: "2026-03-30T09:00:10"
+    finished_at: ""
+    status: stale
+    evidence:
+      - "reddit-fetch-started"
+    notes: "Started, but PROPOSALS.md was never written."
+stale_runs:
+  - skill: "community-skill-radar"
+    run_id: "csr-20260330-0900"
+    expected_at: "2026-03-30T09:00:00"
+    age_minutes: 94
+last_report_at: "2026-03-30T10:34:00"
+report_history:
+  - reported_at: "2026-03-30T10:34:00"
+    total_runs: 2
+    stale_run_count: 1
+    failed_run_count: 0
+# ── Walkthrough ──────────────────────────────────────────────────────────────
+# python3 prove.py --stale
+#
+#   Cron Execution Prover
+#   ───────────────────────────────────────────────────────
+#     2 tracked runs | 1 stale | 0 failed
+#
+#     STALE community-skill-radar (csr-20260330-0900)
+#       Started, but PROPOSALS.md was never written.