canary-symbiontlisted

# Canary Symbiont: Cross-Plane Sentinel ## The problem External schedulers fail SILENTLY. A billing block or load-shedding on the scheduler plane stops every cron while the UI keeps showing the workflows as "active". From inside that plane there is no error to catch: the failure mode IS the absence of execution. The host system cannot sense its own silence. ## The pattern (four legs, all required) 1. **Different plane.** The sentinel runs on infrastructure independent of what it watches (e.g. a serverless worker on cloud B watching scheduler cloud A). Shared fate = no sentinel. 2. **Asymmetric sensing.** It checks the one signal the host cannot feel: "completed runs in the last 26h" via the watched platform's API, with a least-privilege read-only token. Zero runs in a window that should always have runs = the silent death. 3. **One-directional alert.** On silence it emails the operator once, with the probable cause and the direct fix link (e.g. the billing page). It does not retry-storm, it does not try to heal. 4. **Fail-open isolation.** Every canary error (missing token, API 4xx/5xx, mail failure) logs and returns; it never throws into the host work it rides on. The host degrades to "merely unwatched", never broken. Host it inside an existing daily tick rather than its own cron: one more scheduled surface is one more thing that can silently die. ## Activation gotchas (each one lived) - **Fine-grained PAT 403.** The step humans miss is the permission: repo selection