The master catalog of all systemd user-space timers running on the OpenClaw VPS. 56 timers are active (probed 2026-05-03); 62 timer unit files exist on disk. Read this hub before adding, modifying, or disabling any timer — it documents ownership, schedule, failure state, and governance gate compliance. The main agent owns ~80% of cron scheduling (bottleneck — see §Bottleneck). Two timers activate failing services every run. One governance-critical timer (security-audit-funnel.timer) has missed its last Monday run.
Quick reference
Field
Value
Canonical file
n/a — no CRON-REGISTRY.md exists; this hub IS the registry
FLAG 1: security-audit-funnel.timer — missed Monday run (G-GOVERNANCE-LOG-FRESHNESS + WAF risk)
Last fired: Mon 2026-04-27 13:00:19 UTC
Next due: Mon 2026-05-04 13:00:00 UTC
Gap: 7 days — missed Mon 2026-04-28 and Mon 2026-05-05 was not yet due at probe time
Schedule: Mondays 06:00 America/Los_Angeles (= 13:00 UTC)
Per CLAUDE.md §Webhook Endpoint Governance: “If this alert fires, open the registry + fix drift before proceeding with other work.” The timer itself is waiting (not failed) — but the service it activates (security-audit-funnel.service) has not run since 2026-04-27. DocuSign WAF IP allowlist staleness risk: CLAUDE.md §5 says allowlist expires conceptually every 90 days; security-audit-funnel checks this. If the service has an issue, WAF drift goes undetected.
Action required: Run node workspace/scripts/security-audit-funnel.js --dry-run manually before next deploy. Cross-link: docusign.
FLAG 2: investorlift-cookie-refresh.service — recurring failures (G-FAILED-SERVICE-MTTR candidate)
Timer: investorlift-cookie-refresh.timer (every 12h, active/waiting)
Service: investorlift-cookie-refresh.service (inactive/dead after each run)
Root cause: Playwright on VPS gets 403 from IL CloudFront WAF
("Page loaded (status: 403)" / "Login failed: Could not find email input field")
Last failure: 2026-05-03 13:00:22 UTC
Pattern: fails EVERY run — not intermittent
This is a known architectural conflict: IL cookie refresh via Playwright MUST run on the AWS Mac Ultra (ec2-user@100.123.248.46), NOT on the VPS. The VPS IP is CloudFront-blocked. The investorlift-cookie-refresh.service uses Playwright on VPS — wrong host. Per CLAUDE.md §InvestorLift Scraping: “Never attempt to run Playwright on the VPS for IL scraping.” Cross-link: investorlift, aws.
Action required: The AWS Mac Ultra is currently impaired (since 2026-05-02 22:15 UTC). Once Mac is restored, migrate investorlift-cookie-refresh.service to SSH→Mac pattern per il-folder-photos.js proven pattern. Per G-FAILED-SERVICE-MTTR: fix, disable, or archive within 24h of persistent-failed state.
Failure log excerpt:
May 03 13:00:16 node[876570]: Page loaded (status: 403)
May 03 13:00:21 node[876570]: Login failed: Could not find email input field
May 03 13:00:22 systemd: Failed to start investorlift-cookie-refresh.service
FLAG 3: perplexity-daily-summary.service — Python TypeError (G-FAILED-SERVICE-MTTR candidate)
Timer: perplexity-daily-summary.timer (daily 16:00 UTC, active/waiting)
Service: perplexity-daily-summary.service (inactive/dead after each run)
Root cause: TypeError: unsupported operand type(s) for +: 'int' and 'NoneType'
in daily_summary.py line 57: sum(r.get("estimated_cost_usd", 0.0) for r in records)
The .get() returns None when field is missing — 0.0 default doesn't fire when key exists with None value
Last failure: 2026-05-03 16:00:09 UTC (also failed 2026-05-02 16:00:44 UTC)
Pattern: fails EVERY run — not intermittent
Fix is a one-liner: change r.get("estimated_cost_usd", 0.0) to r.get("estimated_cost_usd") or 0.0 in /home/opsadmin/.openclaw/tools/perplexity-cookie-session/daily_summary.py line 57. No deploy needed — service reads Python script directly. Per G-FAILED-SERVICE-MTTR: must fix within 24h.
Failure log excerpt:
May 03 16:00:09 python3[925460]: TypeError: unsupported operand type(s) for +: 'int' and 'NoneType'
May 03 16:00:09 systemd: Failed to start perplexity-daily-summary.service
⚠️ Main agent cron bottleneck (~80% of timers)
The main agent is the de-facto scheduler for most cron jobs on the platform. Out of 56 active timers, approximately 44-47 are owned by or route through the main agent. This creates a single point of failure for platform-wide automation. If main agent’s LLM routing or workspace is degraded, the following cadences break:
Failure mode: timer fires → service fails → Discord ops is NOT alerted if the Discord alert service is itself failing. Current state: perplexity-daily-summary failure is silent. Always run systemctl --user list-units --state=failed after any system change.
Success criteria: systemctl --user list-units --state=failed returns 0 failed units; security-audit-funnel.timer LAST col is within 7 days; both FLAG 2 and FLAG 3 services exit cleanly
P0 (G-FAILED-SERVICE-MTTR): Fix perplexity-daily-summary.service — one-liner fix in daily_summary.py line 57: r.get("estimated_cost_usd") or 0.0. Henry auth required per action gate.
P0 (G-FAILED-SERVICE-MTTR): Migrate investorlift-cookie-refresh.service to SSH→Mac Ultra pattern. Blocked: Mac Ultra currently impaired (since 2026-05-02 22:15 UTC). Resume next session.
P0: Run node workspace/scripts/security-audit-funnel.js --dry-run manually — last automated run was 2026-04-27 (7 days stale, missed Monday). DocuSign WAF staleness unverified.
P1: 6 timer unit files on disk but NOT in active list-timers output — identify which 6 and why they’re inactive (disabled? failed to load?)
P1: main agent ~80% cron bottleneck — OSIL Phase 4+ target: distribute high-frequency timers to _summary as second scheduler node
P2: No cron-registry CHANGELOG or infra_config_changes row for any timer addition. Phase 2 weekly-index-audit.timer (OSIL) will enforce governance log freshness.
P2: openclaw-gateway-restart.timer fires every Monday 11:00 UTC — confirm this is intentional scheduled maintenance vs legacy artifact
P3: coordinate-plans-heartbeat.timer fires daily — what does it coordinate? No plan confirms this is still needed post-fragmentation-fix Phase D.
62 timer unit files on disk; 62 active in systemctl --user list-timers (probed 2026-05-04). 10 hub pages authored in W4-S8. Remaining 52 pending Wave 5+.
Recent activity
2026-05-04: W4-S8 added Full timer catalog section (62 timers, 13 categories); 10 hub pages created in wiki/cron/
2026-05-03: hub created (W2-S5); live probes run (56 timers listed, 62 unit files); 3 critical flags raised; top-10 priority list authored
2026-04-27: security-audit-funnel.timer last successful run (per journalctl)