morning-briefing

name	morning-briefing
description	Generate a concise daily infrastructure briefing. Covers: service health, resource usage, security events, overnight incidents, and cost tracking. Designed for Telegram/chat delivery.
tools	["system_health","service_status","journal_logs","shell_exec","memory_recall","event_log","teach_patterns","teach_context"]
activation	manual

Morning Briefing Skill

Generate a daily server briefing. Run this as part of the morning heartbeat.

Briefing Template

Gather data, then compose a message in this format:

Good morning. Here's your infrastructure report:

[SERVICE STATUS]
List each critical service with a status emoji:
  green = running and healthy
  yellow = running but degraded
  red = down or failing

[RESOURCE USAGE]
CPU average overnight, current memory, disk usage per mount.
Flag anything above threshold.

[OVERNIGHT EVENTS]
Summarize what happened while the user was asleep.
Include: auto-remediations, config changes, unusual activity.
Reference audit ledger entries.

[SECURITY]
Failed SSH attempts (count + notable IPs).
Any firewall blocks.
Port scan detection.
New or unexpected processes.

[COST]
Estimated daily server cost.
API call costs if tracked.

[SUMMARY]
One-line assessment: "All quiet" or "One incident overnight, resolved."

Data Collection

Run these in sequence:

1. System health overview

   system_health()
   

2. Critical services check

   service_status({ service: "agentd" })
   service_status({ service: "osmoda-gateway" })
   service_status({ service: "sshd" })
   service_status({ service: "nginx" })  -- if configured
   

3. Overnight errors (last 12 hours)

   journal_logs({ priority: "err", since: "12 hours ago", lines: 50 })
   

4. Security events

   journal_logs({ unit: "sshd", since: "12 hours ago", lines: 30 })
   shell_exec({ command: "journalctl -u sshd --since '12 hours ago' | grep 'Failed password\\|Invalid user' | wc -l" })
   

5. Audit log overnight activity

   event_log({ limit: 20 })
   

6. Memory — overnight context

   memory_recall({ query: "overnight incidents errors fixes", timeframe: "24h" })
   

7. teachd patterns — check for overnight trends and anomalies detected between conversations

   teach_patterns({ min_confidence: 0.5 })
   teach_context({ context: "overnight incidents failures resource trends" })
   

   Include any detected patterns in the briefing under [OVERNIGHT EVENTS].

8. NixOS generation

   shell_exec({ command: "nixos-rebuild list-generations | tail -5" })
   

Delivery Style

• Be concise — this is scanned on a phone
• Use emojis sparingly but effectively for status
• Lead with the worst news if there is any
• If everything is fine, say so in one line — don't pad
• Include specific numbers — "CPU avg 12%" not "CPU was low"
• Reference audit entries by number for traceability

Example Output

Good morning. Infrastructure report for Feb 20:

Services: agentd, osmoda-gateway, sshd, nginx — all running
Resources: CPU avg 11% overnight | RAM 4.1/7.6 GB | Disk 38%

Overnight: Quiet night. No incidents.
  - PostgreSQL connections peaked at 72/100 at 02:41 (normal range)
  - 1 NixOS garbage collection freed 2.3 GB (auto, audit #51)

Security: 7 failed SSH attempts from 3 IPs
  - 185.220.101.33 (Tor exit, 4 attempts) — already blocked
  - 2 other IPs, single attempts each — noise

Cost: ~$0.33/day (Hetzner CX22)

All systems nominal. Have a good day.