My triage agent watches 6 apps while I sleep

Every Sunday at 06:00 UTC, a scheduled loop opens six production apps, checks uptime, scans for secret placeholders, verifies no .env is tracked — then appends a signed entry to an audit log and updates a machine-readable metrics.json. First run: 100% live, 0 placeholders, guard pass, 16 seconds.

1. Read-only by construction. The loop's only write targets are its own log files. It cannot deploy, cannot merge, cannot touch your data. The blast radius of a bug is one JSON line.

2. Findings, not fixes. Like a structural inspector, it reports cracks; it never pours concrete. Every entry carries a timestamp, severity inputs, and a human decision slot. I approve; it never does.

3. Proof clients can re-run. The same script runs on your machine with node scripts/audit.mjs — dry by default, --write only when you say so. Green is demonstrated, not declared. Start with the free check.