agent-delivery-canarylisted

# Agent delivery canary and mutual liveness Built 2026-09-04 across both of Will's agent hosts after he asked *"how have olu and chuka been running? things have been quiet thankfully"* — and the check found one MCP server broken for two days and, earlier the same week, a Home Assistant auth failure standing 2.5 days and an MCP server that had **never once connected**. None of it had produced a single alert. The lesson that shaped everything here: **things WERE watching and could not surface what they saw.** Monitoring existed, ran on schedule, and was structurally incapable of reporting these faults. Adding more of the same monitoring would have changed nothing. ## The four defects that make agent monitoring silently useless Check any existing agent monitor against these before adding to it. 1. **Transition-only alerting.** Firing on `today > 0 && prev == 0` means anything already broken when the baseline was taken can *never* trigger. A fault present on day 0 is invisible forever. This is the single highest-value thing to fix, and it is extremely common because "only alert on change" sounds like good hygiene. 2. **Nobody consumes the self-reported signal.** The agent logged `NEEDS_ATTENTION` every two hours for a real fault. Detection worked perfectly; no pipeline read it. 3. **Config status mistaken for runtime status.** `hermes mcp list` showed a server `✓ enabled` while it was parked and unusable. "Enabled" is a statement about a config file. 4. **Coun