SKILL.md- the skill, written out in plain English

criteria:
  - name: checkurl_execution
    kind: deterministic
    check: "The log file 'state/log/pending-eval.ndjson' contains a record for 'checkUrl()' execution with a successful outcome."
  - name: checkssl_execution
    kind: deterministic
    check: "The log file 'state/log/pending-eval.ndjson' contains a record for 'checkSsl()' execution with a successful outcome."
  - name: checkallprojects_execution
    kind: deterministic
    check: "The log file 'state/log/pending-eval.ndjson' contains a record for 'checkAllProjects()' execution with a successful outcome."
  - name: log_entry_freshness
    kind: deterministic
    check: "The timestamp in 'state/log/pending-eval.ndjson' for the skill execution is recent and corresponds to the current run."

AGENTS.md- what the AI loads when this skill comes up

api.ts- the code it can call

#!/usr/bin/env npx tsx
/**
 * snappy-maintenance/api.ts -- Project health checks across all Snappy infrastructure.
 *
 * HTTP health probes, SSL expiry checks, and bulk project sweeps.
 *
 * Usage:
 *   npx tsx api.ts check https://total-crm.fly.dev/health
 *   npx tsx api.ts ssl total-crm.fly.dev
 *   npx tsx api.ts all
 *
 * Or import as module:
 *   import { checkUrl, checkSsl, checkAllProjects } from "./maintenance.ts";
 */

import { execSync } from "child_process";
import { env } from "./env.ts";
import { realpathSync } from "fs";

// KERNEL A4 EXCEPTION (non-DB skill referencing Xano URL):
// `xano-main` is an HTTP uptime probe target, not a Xano data call. It lives
// in the same list as fly.dev and cloudflare URLs and is fetched via plain
// `fetch()` in `checkUrl`. snappy-maintenance does not read or write Xano data
// anywhere — it only pings the `/me` endpoint to confirm the instance is up.
// Not a violation.
const KNOWN_PROJECTS: Record<string, string> = {
  "total-crm": "https://total-crm.fly.dev/health",
  "skills-gateway": "https://skills.snappy.ai/.well-known/skills/index.json",
  "snappy-website": "https://snappy.ai",
  "xano-main": "https://xnwv-v1z6-dvnr.n7c.xano.io/api:e6emygx3/me",
  "box-server": "http://10.0.0.199:8080/health",
};

/** Check a URL and return status, ok flag, and latency. */
export async function checkUrl(url: string): Promise<{ url: string; status: number; ok: boolean; latencyMs: number; error?: string }> {
  const start = Date.now();
  try {
    const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });
    return {
      url,
      status: res.status,
      ok: res.ok,
      latencyMs: Date.now() - start,
    };
  } catch (e: any) {
    return {
      url,
      status: 0,
      ok: false,
      latencyMs: Date.now() - start,
      error: e.message,
    };
  }
}

/** Check SSL certificate expiry for a domain. Returns days until expiry. */
export function checkSsl(domain: string): { domain: string; expiresIn: number; expiry: string; ok: boolean } {
  try {
    const raw = execSync(
      `echo | openssl s_client -servername ${domain} -connect ${domain}:443 2>/dev/null | openssl x509 -noout -enddate`,
      { encoding: "utf-8", timeout: 10_000 }
    ).trim();
    // Format: notAfter=Mar 15 12:00:00 2027 GMT
    const dateStr = raw.replace("notAfter=", "");
    const expiry = new Date(dateStr);
    const daysLeft = Math.floor((expiry.getTime() - Date.now()) / 86_400_000);
    return { domain, expiresIn: daysLeft, expiry: expiry.toISOString().slice(0, 10), ok: daysLeft > 14 };
  } catch (e: any) {
    return { domain, expiresIn: -1, expiry: "unknown", ok: false };
  }
}

/** Run health checks against all known project URLs. */
export async function checkAllProjects(): Promise<Record<string, { status: number; ok: boolean; latencyMs: number; error?: string }>> {
  const results: Record<string, { status: number; ok: boolean; latencyMs: number; error?: string }> = {};
  const checks = Object.entries(KNOWN_PROJECTS).map(async ([name, url]) => {
    const r = await checkUrl(url);
    results[name] = { status: r.status, ok: r.ok, latencyMs: r.latencyMs, error: r.error };
  });
  await Promise.all(checks);
  return results;
}

// --- CLI ---

if ((() => { try { return import.meta.url === `file://${realpathSync(process.argv[1])}`; } catch { return false; } })()) {
  (async () => {
    const [, , cmd, ...args] = process.argv;

    switch (cmd) {
      case "check": {
        const [url] = args;
        if (!url) { console.error("Usage: api.ts check <url>"); process.exit(1); }
        const result = await checkUrl(url);
        console.log(JSON.stringify(result, null, 2));
        break;
      }
      case "ssl": {
        const [domain] = args;
        if (!domain) { console.error("Usage: api.ts ssl <domain>"); process.exit(1); }
        console.log(JSON.stringify(checkSsl(domain), null, 2));
        break;
      }
      case "all": {
        const results = await checkAllProjects();
        for (const [name, r] of Object.entries(results)) {
          const icon = r.ok ? "OK" : "FAIL";
          console.log(`${icon}\t${name}\t${r.status}\t${r.latencyMs}ms${r.error ? "\t" + r.error : ""}`);
        }
        break;
      }
      default:
        console.log("Usage: npx tsx api.ts [check|ssl|all] ...");
    }
  })();
}

scripts- helper scripts it can run

prose-only skill - 1 inline code block live in SKILL.md above (no state/bin/ sidecar yet).

how we check it- the checks, plus the last 10 runs

no recent runs logged - the eval contract is declared but nothing has been graded yet