fleet-routine — References¶

External background for the mechanisms this repo uses or plans to use. Grouped by the pattern, with a pointer to where in this repo it's applied.

Windows Task Scheduler — S4U logon¶

Task Scheduler Schema — LogonType — the S4U value: "Indicates that the Local Security Authority (LSA) logon session... The task runs whether or not the user is logged on." This is the exact setting WindowsProbeTask.Register requests (TaskLogonType.S4U).
Task Scheduler Security and Access Rights — background on how the "run whether user is logged on or not" checkbox differs from a normal interactive logon and from a service account.
ITaskDefinition / RegisterTaskDefinition — the underlying COM API. fleet-routine uses the TaskScheduler NuGet package (v2.12.2, Microsoft.Win32.TaskScheduler namespace) as a managed wrapper over this COM surface — see WindowsProbeTask.cs.
Why S4U and not "Run only when user is logged on" or SYSTEM: covered in depth in docs/FLT-104-gate0-auth-smoke-spec.md §1 and §3 — SYSTEM loads a different profile with no access to any harness's OAuth token store; S4U is the only logon type that both survives reboot/logoff and loads Andrew's actual profile.

Non-interactive S4U auth — learn more¶

The core risk this whole project defends against: a scheduled task that silently runs under the wrong security context and can never reach the credentials a CLI tool needs.

Service Accounts vs. Scheduled Tasks (Microsoft Learn) — schtasks documentation covering the /RL, /RU, /IT (interactive token) flags that map to the same principal/RunLevel/logon-type concerns Validate() in WindowsProbeTask.cs checks programmatically.
DPAPI (Data Protection API) overview — why a credential encrypted under one user's DPAPI master key can't be decrypted under a different logon context; this is the mechanism behind FailureClass.DPAPI_DECRYPT_FAILED.

HMAC / nonce canaries — learn more¶

Gate 0's canary isn't cryptographic (no HMAC — a random nonce with contains matching is sufficient here because the threat model is "did a stale result or a help banner accidentally look like a pass," not "can an adversary forge a token"). For the general pattern and where a stronger primitive would be warranted:

RFC 2104 — HMAC — the standard construction for message-authentication codes; relevant if a future gate needs to prove a result wasn't tampered with in transit, not just that it's fresh.
OWASP — Insecure Randomness — why Canary.CreateToken() uses System.Security.Cryptography.RandomNumberGenerator rather than System.Random: the nonce doesn't need to be secret, but a predictable nonce would defeat the anti-staleness property (an attacker or a race could pre-compute the next value).

The harness CLIs this repo probes¶

Claude Code CLI docs — claude -p (print mode, non-interactive), --tools allowlisting.
OpenAI Codex CLI — codex exec non-interactive mode; the stdin-hang trap this repo works around (codex exec blocks forever on an unclosed stdin) is a known CLI behavior, not a bug in this repo — see the fleet-wide codex-exec-stdin-hang note.
Gemini via agy (Antigravity CLI) — internal fleet tooling, not a public product; agy -p mirrors the same non-interactive/print-mode pattern as the others.
Grok CLI (grok --prompt-file) — the 32KB argv ceiling this repo routes around by always using a file argument for the prompt, never a shell argument.
Ollama API reference — /api/tags, /api/generate with stream:false; the endpoints OllamaProbe calls.
Odysseus — internal fleet local-inference server exposing an OpenAI-compatible /v1/models / /v1/chat/completions surface on 127.0.0.1:7000; the endpoints OdysseusProbe calls.

cron / scheduling background¶

POSIX cron(1) — the scheduling model this project draws its "cron-scheduled routine" vocabulary from, even though the actual trigger mechanism is Windows Task Scheduler, not cron itself.
Claude's own scheduled tasks (/schedule, cloud routines) — the closest existing product analog for what a "routine" is meant to feel like from a user's perspective; fleet-routine generalizes the same idea across all 6 harnesses instead of one.

fleet-harness (FLT-1) — the Python/LangGraph orchestration engine this project delegates execution to. See that repo's own docs for adapter selection and routing.
fleet-dispatch — the existing LAN command-dispatch listener whose run-as-user task config doctor's S4U registration is modeled on (repair-fleet-listener.ps1), though fleet-dispatch itself uses Interactive logon + logon-trigger, not S4U.
usage-governor — the fire-time budget check the DESIGNED runner (FLT-105) will query, fail-closed.