How FFC Automation Works

M365 job reads FFC-tenant status; waits on m365-prod approval

—

`dry_run` (default true); exo jobs act on FFC tenant — `skip_m365=true` for external-tenant charities

waits on m365-prod and wpmudev-prod approvals (WHMCS job ungated)

`dry_run` (default true); issue-label trig

`dry_run` (default true); `mail_provider` default `from-registry`; UNLISTED domains have mail untouched; a listed domain is on EXACTLY ONE provider (enforcing REMOVES the other's MX/CNAME/SRV); MOVING providers needs `confirm_mail_change` = the domain name

—

—

—

—

`dry_run` (default true)

high blast radius; serialized

`mode` (default `check`); register needs `mode=execute-register` + `confirm_domain`

never charges; but `cloudflare-tokens-from-kv` runs with **`scope: write`** → loads `wr-all-*` CF tokens, so **not auto-approvable** (#915)

—

`dry-run` vs `execute`

—

`dry_run` (default true)

`dry_run` (default true); serialized

`dry_run` (default true); serialized

read-only DoH/HTTPS probes; go/no-go for 120

`dry_run` (default true); preview job always runs read-only; idempotent (existing member = no change)

read-only RDAP + offline analysis; classifies foreign-registrar domains for the eNom/WHMCS inbound path

`dry_run` (default true); preview job always runs read-only; serialized per zone; `purge_everything` refetches the whole zone from origin — prefer explicit `urls`

read-only; reports whether 4xx/5xx can be edge-cached; `fail_on_finding` (default false) turns warn-level findings into a non-zero exit

read-only; walks every HTTP hop manually (never follows redirects) and reads DNS, dynamic-redirect rulesets and legacy Page Rules; prints to the job log, never an artifact, so an egress-restricted caller can read it

ungated read lane; artifacts are export catalogs

ungated read lane; artifacts are export catalogs

ungated read lane; artifacts are export catalogs

`dry_run` (default true); idempotent

one-way GitHub→WHMCS

one-way GitHub→WHMCS

`dry_run` (default true); live reply needs admin username

—

summary masks PII

summary masks PII

`dry_run` (default true); one order at a time

`dry_run` (default true); idempotent

output is a draft; serialized

aggregate counts only — no PII in artifact or summary

aggregate counts + product names only (no PII)

aggregate counts only (no PII)

throttled per-client loop; vocabulary-matched values only (no PII)

aggregate summary; artifact carries org-domain gap lists only

single-client projection; personal contact fields always masked

aggregate counts only (no PII)

GetClientsProducts sweep; personal contact fields masked; **ungated** — `whmcs-secrets-from-kv` with `scope: read` on the `READ_ALL_FFC_AZURE_*` (ffc-admin-kv-reader) identity → `read-all-ffc-whmcs-*` (#920; was ✅ `whmcs-prod` on the writer identity, held under #915)

dry_run default true; $0 AddOrder of pid 39 onto registrar-domain clients; idempotent

dry_run default true; creates/populates domain records (registrar None) from CF facts

dry_run default true; $0 AddOrder of pid 40 onto FFC-EX GitHub-Pages-site clients; idempotent

report-only; GETs charity-supplied URLs; never accepts/cancels an order

report + reconcile-report read-only; approve accepts ONLY listed $0 orderids; reconcile cancels ONLY listed orderids + emails those clients a re-file email (email-first, no cancel-all)

mode=verify (read-only) vs deploy; hooks input is basename-validated

read-only external APIs; masks PII; recommends only (never clears — clearing is via gated 211); scaffold inert until the FraudLabs Pro key + fraudlabspro-prod-read env are provisioned; daily weekday schedule upserts one rolling GitHub tracking issue (issues:write, ambient token) that self-closes when the Fraud queue clears

`dry_run` (default true); copies one client's product custom-field answers into their Custom Client Fields via UpdateClient; idempotent + non-destructive (existing values preserved unless `overwrite=true`); name map in `config/whmcs-client-field-populate-map.json` — verify the unmapped list on dry-run before live

`dry_run` (default true); one record + one field per dispatch; strict per-target allowlist of writable fields; refuses to replace a different existing value without `force`; reports `previousValue`

`mode` (default `dry-run`) previews AddOrder and writes nothing; `execute` places a real order; pid fixed by `order_type` (41 transfer / 39 register); underlying script skips when the client already has a non-terminated service for the product unless `allow_duplicate`; `no_email` defaults true so a first live run cannot surprise a charity; price forced to 0

M365 job waits on m365-prod approval

waits on m365-prod approval

read-oriented toolbox; waits on m365-prod approval

—

`dry_run` (default true); also gated by m365-prod approval

PII masked; dispatch-only; org mailboxes only; waits on m365-prod approval

values never printed; placeholder/stale flags only

daily two-signal credential health check: expiry/enabled for every vault secret from the attribute listing (values never read), plus a read-only liveness probe (`GET /user`, Cloudflare `GET /zones`) for the four `read-all-*` credentials that can verify themselves — the library refuses a `wr-all-*` probe target before anything is read, so write-scope material is expiry-monitored without ever being fetched; a probe that cannot be evaluated is reported as unverifiable, never as passing; values never printed or persisted; rolling issue upsert/close; ungated by design (a credential monitor must not wait on a human)

PII masked; the published `docs/data/ffc-zeffy-campaigns.json` is title/url/status only (no financials); `deliver` opens a reviewable data PR via CBM_TOKEN; loads `wr-all-ffc-zeffy-api-key` (default `write`) **and** `wr-all-cbm-github-pat` → **not auto-approvable** (#915; on the ✅ list 2026-07-23 → 2026-07-29)

PII masked; never `-IncludePii`

PII masked; never `-IncludePii`

read-only; fails closed; reusable via `workflow_call`

delivers JSON to ffcadmin via PR (reads on `read-all-cbm-ffc-copilot-mcp-github-pat`, push + PR on the 2-repo `wr-all-cbm-datasync-github-pat`, both from KV; ungated lane #834, writer ruling #848); PII-safe aggregates. Same PR also syncs the workflow catalog and the Agentic OS status feed (`agentic-os-status.json`, generated by `scripts/generate-agentic-os-status.py`, REST-only)

dry_run default true; seeds GA4/Clarity/Meta; delegates POC access

read-only exports; live-version JSON artifacts (90d)

dry_run default true; one property per charity; idempotent by stream defaultUri

read-only; enumerates GTM containers, GA4 properties/streams and Search Console sites, cross-checks them against each site's SERVED HTML, and ranks traffic. Reports "no data" distinctly from "no traffic" so an unmeasured site never sorts as unpopular. Weekly Mon 07:23 + dispatch

waits on wpmudev-prod approval

`repo` chained behind `dns` approval

ungated preflight (repo must exist; refuses live sites and sibling-domain repos unless `force=true`); opens a draft PR (never pushes); serialized

dispatches read-only exports 201/108/601 (601 waits on its own wpmudev-prod gate); regenerates `sites-list/` CSV+JSON; opens a data PR (never pushes to `main`); weekly Mon 08:00Z + dispatch; serialized concurrency group; loads `wr-all-cbm-ffc-copilot-mcp-github-pat` → **held on credential scope**, not on a taxonomy gap (#915)

opens a draft PR (never pushes); `dry_run` (default true); idempotent

read-only capture of a public site; `mode=inspect` default (probe only), `capture` writes only the run artifact; politeness delay default 250ms; serialized per domain; offline `--self-test` gates the logic before any live request

`resolve` and `convert` are ungated and read-only; `mode=convert` default performs the whole conversion — capture, integrate, Next.js build, self-containment gate — and writes nothing, so it needs no approval; only `deliver` is gated and only `deliver` writes. `target_repo` is a required, separately-validated bare repo name (never derived from `domain`), so a capture of one site cannot be delivered to a repo nobody named. Forms are replaced with a `mailto:` block before the artifact is made, and `deliver` re-checks for a surviving `<form>` before committing — a static export has no form backend, so a surviving form would accept a visitor's message and drop it. `deliver` consumes the artifact the gate passed rather than re-capturing, so the charity's server is read once. Offline `--self-test` of every script the workflow runs gates every live request.

dispatch-only; creates an FFC-EX repo from a template (no dry_run — gate is the only stop); duplicate-repo warning text in inputs; visibility/Pages options set at creation

report only; `read-all-cbm-ffc-copilot-mcp-github-pat` from KV over OIDC; ungated lane (#834) so the daily audit is never cancelled waiting at a gate

⚠️ `dry_run` defaults to **false**

report only (environment reviewer config)

GITHUB_TOKEN read-only; JSON artifact

dispatch-only; creates FFC-EX-\<domain\> for every domain in a list under ONE approval instead of one-per-domain (720 stays the single-repo path); ungated preflight refuses per-domain on name collision or sibling-domain match before the gate is spent; no CNAME input and never touches DNS; `dry_run` default true

quarterly reminder issues; rotations stay human/gated

cancels runs left waiting >N days at a gate; never approves; dispatch dry-run supported

weekly org inventory (feeds smoke-protected waves); PR-only + auto-merge; reads on `read-all-cbm-ffc-copilot-mcp-github-pat`, PR on the 2-repo `wr-all-cbm-datasync-github-pat`, both from KV over OIDC on the ungated lane (#834, writer ruling #848)

ungated preflight (live archive requires a matching successful dry-run within 48h; fails fast on missing/already-archived; warns on recent push/Pages/open-issue references); archive-only (reversible, never deletes); `dry_run` default true; typed `confirm_repo`; org-locked + denylist

syncs `claimed` label from linked PRs (pull_request event, GITHUB_TOKEN) + daily sweep reconciling this repo's claims against every open PR in the org — one `search/issues` read, writes only this repo's issues (ambient GITHUB_TOKEN — CBM_TOKEN is gated-env-only and empty on schedule); releases when no open PR in any repo still references the issue, or after 48h idle for a hand-labeled claim; no external API, ungated; sweep `dry_run` via dispatch

weekly SHA-256 byte-identity audit of `post-deploy-smoke.yml` across the fleet vs canonical (FFC-IN-FFC_Single_Page_Template@main); rolling issue upsert/close on divergence; GITHUB_TOKEN (public reads + own-repo issue), no external API, ungated

weekly "monitor the monitors" REST sweep (backlog + data-pipeline signals) posted as a new comment on #719 with week-over-week trends (baseline read from the prior comment's hidden data block); the Conductor-silence verdict (#1215) additionally drives an assigned rolling issue, because #719 is read by the component the alarm is about (#1269); JSON artifact; GITHUB_TOKEN (own-repo issue/Actions reads + one comment + one rolling issue), no external API, ungated

**polls** every scheduled hub workflow — and, since #1296, `Security Audit` in the four core satellite repos, whose scheduled workflows had no alerting at all — twice hourly (`schedule` + `workflow_dispatch`; the `workflow_run` event has never fired in this repo — #843) and upserts one rolling issue per watched workflow (marker keyed by workflow name, so only that workflow's own green run closes it); absorbs the retired 732 Google lane (502/504); reports `cancelled`/`timed_out` as well as `failure`, latest completed default-branch run only; does **not** alert on a declined/expired approval gate (no job `failure` + ≥1 job `cancelled` ⇒ logged via `core.notice`, not an alert) — an unreadable job list still alerts, and a watched name matching no workflow fails the run loudly, as does a repo whose workflow list cannot be read (a sweep that has gone blind is never reported as a clean one); the run summary prints `repos/watched/checked/failing/...` so an empty result is distinguishable from a sweep that read nothing, `MAX_NEW_ALERTS_PER_RUN` bounds a first sweep, and a `dry_run` dispatch input rehearses the sweep without writing an issue; ambient GITHUB_TOKEN, no external API, ungated by design (must not be blocked by the gate it watches)

weekly coverage audit of dependency-vulnerability detection across the FFC-EX fleet (a repo counts as covered only with BOTH `security-audit.yml` and an `audit:high` script) PLUS a lockfile-resolution check — real `npm ci --dry-run` per Node repo, since a lockfile that exists but does not resolve makes the nightly audit scan nothing (#889, ledger L06); rolling issue upsert/close on any gap; reports only — never bumps a dependency or writes to a fleet repo; GITHUB_TOKEN (public reads + own-repo issue), npm registry read-only, ungated

closes the gap 741 measures: opens one PR per uncovered FFC-EX repo adding BOTH halves of the audit pair (`security-audit.yml` + the `audit:high` script) in a single commit, never a `partial`; cron staggered deterministically by repo name across 06:00–06:59, skipping the crowded `:17`; `dry_run` (default true) runs the ungated `plan` job only, so a preview needs no approval; never pushes a target's default branch and never bumps a dependency (#822 owns remediation); repos with no `package-lock.json` are reported, not wired

weekly audit of the security headers each FFC-delivered site ACTUALLY SERVES (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, CSP), measured by fetching the live response and never by looking for a file in a repo — `public/_headers` is inert on this stack, so a source-file check reports coverage that does not exist (#884); scope is every domain in an FFC Cloudflare zone (derived column, not the curated host category); report-only CSP does not count as a CSP and a `<meta>` tag satisfies nothing; rolling issue upsert/close on any gap; plain HTTPS GETs to public sites, no credentials, no external API, GITHUB_TOKEN for the issue only, ungated

daily OUTCOME check on the published Agentic OS status feed in `FFC-IN-ffcadmin.org` (`agentic-os-status.json`, both the `public/data/` and `src/data/` copies), asserting how old the timestamp the public page actually serves is — the three existing mechanisms are all PROCESS checks (#921 watches whether 502 succeeds, #908 watches PRs stuck behind `main`, #771 watches drift between the two copies) and every one of them was green while the page sat three days stale (#977); stale after 36h, so one missed daily tick does not report; a path that is missing, unreadable, or carries an absent/empty/non-ISO/future `generated_at` is a finding and never a pass, and a registered path the run produced no observation for is reported rather than skipped; rolling issue upsert/close; **deliberately holds no Key Vault credential** — ambient GITHUB_TOKEN only, since a monitor depending on the credential whose death it reveals goes dark when it is needed; ungated

daily audit of the public Agentic OS board (org project #9) against the real backlog, running `scripts/audit-agentic-os-board.py` — which #968 shipped and nothing invoked, making it assurance only when a human remembered (#969); the board has NO auto-add so every card and Status is placed by hand and the audit is the compensating control, which on a manual process has to be automatic or it inherits the same failure mode; reports the three sets (missing from board / no Status / closed-or-merged but not `Done`) to the Conductor Log and is SILENT when clean, following 734; a run that could not read one of its two sides is reported as INCOMPLETE and never as clean, since the script exits 1 for both findings and enumeration failure and the exit code alone cannot tell them apart; read-only against GitHub (adds no card, sets no Status, closes nothing), Key Vault PAT on the reader identity for the org-level ProjectsV2 read the ambient token cannot do, ambient GITHUB_TOKEN for the issue comment, ungated

dispatch-only follow-up to 732: enables Pages (build_type=workflow, GitHub-default URL only, no CNAME/DNS) and dispatches deploy.yml on EXISTING FFC-EX-\<domain\> repos under ONE approval; 732 can only set Pages at creation time and its own preflight skips a domain whose repo already exists, so this is the only automated path to turn Pages on afterward; ungated preflight skips a domain with no matching repo or no deploy.yml on the default branch, without failing the rest of the batch; idempotent Pages-enable (GET before POST, never touches an already-configured — possibly custom-domain — repo); `dry_run` default true

two-hourly OUTCOME check on whether the Conductor — the locally-run routine that is the only actor with promotion and merge authority — is still working; it went quiet mid-run on 2026-09-14 for ~5 days and nothing noticed, because all 17 monitoring workflows (730-746) watch things that happen INSIDE Actions and the Conductor's only GitHub footprint is its comments on the Conductor Log (#719), so its absence is invisible to the fleet by construction (#1339); four signals reported BY NAME with measured values and never averaged — `conductor-silence` (age of the newest `Run N — START / END` comment, warn 6h / alert 12h against an observed ~3h cadence), `merge-silence` (age of the newest merged `agentic-os` PR, the independent second signal, warn 24h / alert 48h), `open-pr-cap` (count vs the worker cap of 3, CONTEXT ONLY — the pile stood at 4 all through the healthy window, so a level-triggered rule reports every ordinary day) and `pr-growth` (strict monotonic growth across 3 consecutive runs, which is the shape a stalled supervisor actually makes); an unreadable log, an empty comment page, a START/END pattern that matches nothing (ledger L215) or an absent/empty/non-ISO/future timestamp is a finding and never "alive"; history carried forward in the rolling issue body; rolling issue upsert/close; **deliberately holds no Key Vault credential and no environment** — ambient GITHUB_TOKEN only, since a liveness check must not be blocked by a gate only the absent supervisor can approve, nor die with a PAT it might need to report; ungated

proves 701's provisioning yields a site that passes its OWN CI on either template: for every template (Footer-Only, Single Page) x sample charity (`tests/fixtures/sample-charities.json`, all fictional) it clones the template's default branch, applies the charity through 701's real parse script and `scripts/Apply-WebsiteReactTemplate.ps1`, then runs that template's format/lint/unit/site-config/drift/build checks; the drift check is what catches Free For Charity's identity left under a charity's name; runs on PRs touching the provisioning path, weekly, and on demand; public template clones and a local build only, no credentials, no writes, ungated

read-only IRS-status lookup; public org data only

read-only profile search; public org data only