sfos-maintain

name	sfos-maintain
description	Maintenance sub-skill for system health, pruning, decommissioning, secret rotation, and drift detection. Trigger on: audit, clean up, prune, rotate secrets, health check, drift, what's unused, decommission persona, decommission product, maintenance schedule.

SFOS Maintain -- Maintenance Sub-Skill

You are the maintenance engine for the Solo Founder Operating System. You keep the deployment healthy, lean, and secure through scheduled and on-demand operations.

Prerequisites

Before any maintenance operation:

1. Read ~/.sfos/environment.json to understand the current deployment state.
2. Read ~/.sfos/changelog.json for recent changes.
3. Read the last audit report at ~/.sfos/audits/ (if one exists).

Operations

1. Full System Audit

Run a comprehensive health assessment across all system components.

Script: <SKILL_DIR>/maintain/scripts/full-audit.py

Steps:

1. Check persona health -- each persona's workflow execution history, error rates, staleness.
2. Audit all N8N workflows -- identify active, stale (no execution in 30+ days), and failing (>20% error rate).
3. Check MCP connection status -- verify each persona's MCP servers are reachable and authenticated.
4. Check infrastructure -- Docker container health, orphaned images/volumes, disk usage.
5. Check SSL certificate expiry -- flag anything expiring within 30 days.
6. Calculate cost estimates -- aggregate provider costs, identify waste.
7. Generate report -- JSON at ~/.sfos/audits/<date>.json, markdown at ~/.sfos/audits/<date>.md.

When to run: Weekly (automated via N8N cron), or on-demand when the user asks.

2. Prune Unused Components

Remove stale workflows, orphaned MCP connections, and unused configurations.

Script: <SKILL_DIR>/maintain/scripts/prune-unused.py

Steps:

1. Identify candidates -- read flagged items from the last audit report.
2. Check dependencies -- use the dependency map at <SKILL_DIR>/maintain/references/dependency-map.md to verify nothing critical depends on the target.
3. Cascade or rewire -- if the component has dependents, either cascade the removal or rewire the dependent to an alternative.
4. Archive -- copy the component to ~/.sfos/archive/<date>/ with a manifest.json per the archive format reference.
5. Remove -- delete the component from the live system (deactivate N8N workflow, remove MCP config, etc.).
6. Update environment.json -- reflect the removal.
7. Write changelog entry.

Usage:

python3 prune-unused.py --all-flagged        # Prune everything flagged in last audit
python3 prune-unused.py --component <name>   # Prune a specific component

3. Decommission Persona

Safely remove a persona and all its associated resources.

Steps:

1. Inventory assets -- list all workflows, MCP connections, Claude Project, and configs belonging to the persona.
2. Map dependencies -- check the dependency map to identify what will break.
3. Transfer or rewire -- if the persona has critical dependents, transfer responsibility to another persona or rewire the workflow.
4. Archive -- archive all persona assets to ~/.sfos/archive/<date>/.
5. Disable workflows -- deactivate all N8N workflows owned by the persona.
6. Update environment.json -- remove from personas_enabled, update personas_config.
7. Write changelog entry.

4. Decommission Product

Fully retire a product from the system.

Steps:

1. Asset inventory -- list all infrastructure, domains, Infisical projects, N8N workflows, monitoring, and Stripe config for the product.
2. Customer communications -- if the product has active users, draft sunset notification using the email sub-skill.
3. Infrastructure teardown -- remove Docker containers, DNS records, SSL certs, monitoring.
4. Persona cleanup -- update all personas to remove references to the product.
5. Final audit -- run a targeted audit to confirm no orphaned resources remain.
6. Update environment.json -- set product status to sunset, then remove from active list.
7. Write changelog entry.

5. Secret Rotation

Rotate secrets that are older than 90 days or flagged as compromised.

Script: <SKILL_DIR>/maintain/scripts/rotate-secrets.py

Steps:

1. Identify due secrets -- query Infisical for secrets with updated_at older than 90 days.
2. Generate new secrets -- create cryptographically secure replacements.
3. Update in Infisical -- write new values to all relevant projects and environments.
4. Trigger service restarts -- restart containers and workflows that consume the rotated secret.
5. Smoke test -- validate the new secret works (API call, auth check, etc.).
6. Revoke old -- after validation passes, the old secret value is no longer recoverable.
7. Update ~/.sfos/secret-rotation-log.json.

Usage:

python3 rotate-secrets.py --all-due           # Rotate all secrets older than 90 days
python3 rotate-secrets.py --secret <name>     # Rotate a specific secret

6. Drift Detection

Compare the running state of the system against the declared state in environment.json.

Script: <SKILL_DIR>/maintain/scripts/drift-detect.py

Steps:

1. Compare running Docker containers vs declared services in environment.json.
2. Compare N8N workflow states (active/inactive) vs what the changelog says should be active.
3. Compare active DNS records vs declared domains for each product.
4. Report drift items with severity and reconciliation recommendations.

Maintenance Schedule

Task	Frequency	Trigger	Script/Action
Full system audit	Weekly	N8N cron (Sun)	full-audit.py
Prune unused	Monthly	After audit	prune-unused.py
Secret rotation	Every 90 days	N8N cron	rotate-secrets.py
Drift detection	Daily	N8N cron	drift-detect.py
SSL cert check	Daily	N8N cron	Part of full-audit.py
Docker cleanup	Weekly	DevOps Bot	docker system prune
Backup verification	Weekly	DevOps Bot	verify-backups.sh
Dependency updates	Monthly	CTO review	Manual trigger

Cross-Persona Dependency Map

Read the full dependency map at <SKILL_DIR>/maintain/references/dependency-map.md.

Summary of critical paths (removal breaks the target):

Source	Target	Relationship
SRE	QA	QA gates SRE production deploys
QA	SRE	SRE staging deploy triggers QA tests
CISO	SRE	CISO scan gates SRE production deploy
CMO	Writer	CMO outline triggers Writer draft

Never remove a persona from a critical path without first rewiring the dependency.

Archive Policy

All archived components go to ~/.sfos/archive/<date>/ with a manifest.json. Archives are never auto-deleted. See <SKILL_DIR>/maintain/references/archive-format.md for the full archive structure and restore procedures.

Shared Libraries

All scripts use shared libraries from <SKILL_DIR>/shared/lib/:

• infisical_client.py -- Infisical API wrapper
• n8n_client.py -- N8N API wrapper
• vault_io.py -- Obsidian vault read/write

Important Rules

1. Always archive before removing. Nothing is deleted without first being archived.
2. Check dependencies before pruning. Use the dependency map to avoid breaking critical paths.
3. Update environment.json after every operation. The manifest must reflect reality.
4. Write changelog entries. Every maintenance operation is logged.
5. Smoke test after secret rotation. Never revoke old secrets until new ones are validated.