Intake exam — Ghostshell
Intake exam (MEASURED — every finding carries its evidence)
0 critical 28 warning 15 info
exam at 2026-11-09 00:00:07 UTC ·
target(s): ghostshell_v3, (agent host env)
Findings
| Severity | Scanner | Finding | Advice | Evidence |
|---|---|---|---|---|
| warning | exposure | SSL off while listening on '*' | Enable SSL or bind to localhost / a private interface only. | {
"listen_addresses": "*",
"port": "5432",
"ssl": "off",
"target_db": "ghostshell_v3"
} |
| warning | privilege | active connection as superuser 'ghostshell' | Point the application at a least-privilege role instead. | {
"is_scanner_role": false,
"target_db": "ghostshell_v3",
"usename": "ghostshell"
} |
| warning | workflow | v3_heal_audit: 'docker:zombie_containers' → 'healed' 101× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 101,
"result": "healed",
"table": "v3_heal_audit",
"target": "docker:zombie_containers",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-alertmanager' heal success 38% over 7d (139 events) | The feature's self-healing is not sticking — investigate the root cause, not the healer (the flap IS the signal). | {
"events": 139,
"failure": 86,
"feature": "ghostshell-alertmanager",
"slo": 0.9,
"success": 53,
"success_rate": 0.381,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-alertmanager' → 'escalated' 86× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 86,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-alertmanager",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-alertmanager' → 'healed' 53× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 53,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-alertmanager",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-cadvisor' heal success 24% over 7d (221 events) | The feature's self-healing is not sticking — investigate the root cause, not the healer (the flap IS the signal). | {
"events": 221,
"failure": 167,
"feature": "ghostshell-cadvisor",
"slo": 0.9,
"success": 54,
"success_rate": 0.244,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-cadvisor' → 'escalated' 167× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 167,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-cadvisor",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-cadvisor' → 'healed' 54× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 54,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-cadvisor",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-luks-exporter' heal success 47% over 7d (114 events) | The feature's self-healing is not sticking — investigate the root cause, not the healer (the flap IS the signal). | {
"events": 114,
"failure": 60,
"feature": "ghostshell-luks-exporter",
"slo": 0.9,
"success": 54,
"success_rate": 0.474,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-luks-exporter' → 'escalated' 60× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 60,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-luks-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-luks-exporter' → 'healed' 54× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 54,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-luks-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-node-exporter' heal success 24% over 7d (226 events) | The feature's self-healing is not sticking — investigate the root cause, not the healer (the flap IS the signal). | {
"events": 226,
"failure": 171,
"feature": "ghostshell-node-exporter",
"slo": 0.9,
"success": 55,
"success_rate": 0.243,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-node-exporter' → 'escalated' 171× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 171,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-node-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-node-exporter' → 'healed' 55× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 55,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-node-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-postgres-exporter' heal success 41% over 7d (128 events) | The feature's self-healing is not sticking — investigate the root cause, not the healer (the flap IS the signal). | {
"events": 128,
"failure": 75,
"feature": "ghostshell-postgres-exporter",
"slo": 0.9,
"success": 53,
"success_rate": 0.414,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-postgres-exporter' → 'escalated' 75× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 75,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-postgres-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-postgres-exporter' → 'healed' 53× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 53,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-postgres-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-prometheus' heal success 32% over 7d (235 events) | The feature's self-healing is not sticking — investigate the root cause, not the healer (the flap IS the signal). | {
"events": 235,
"failure": 159,
"feature": "ghostshell-prometheus",
"slo": 0.9,
"success": 76,
"success_rate": 0.323,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-prometheus' → 'escalated' 159× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 159,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-prometheus",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-prometheus' → 'healed' 76× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 76,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-prometheus",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-redis-exporter' heal success 24% over 7d (234 events) | The feature's self-healing is not sticking — investigate the root cause, not the healer (the flap IS the signal). | {
"events": 234,
"failure": 179,
"feature": "ghostshell-redis-exporter",
"slo": 0.9,
"success": 55,
"success_rate": 0.235,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-redis-exporter' → 'escalated' 179× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 179,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-redis-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-redis-exporter' → 'healed' 55× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 55,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-redis-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-searxng' heal success 25% over 7d (244 events) | The feature's self-healing is not sticking — investigate the root cause, not the healer (the flap IS the signal). | {
"events": 244,
"failure": 183,
"feature": "ghostshell-searxng",
"slo": 0.9,
"success": 61,
"success_rate": 0.25,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-searxng' → 'escalated' 183× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 183,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-searxng",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-searxng' → 'healed' 61× in 7d | A retry storm — the underlying fault is not being fixed. | {
"count_7d": 61,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-searxng",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 305 non-terminal row(s) older than 3d | Investigate the stuck work — it will not finish by itself. | {
"non_terminal": [
"monitored",
"pending",
"running",
"queued",
"stuck"
],
"older_than_days": 3,
"stuck_rows": 305,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.idx_routine_executions_routine_id: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.idx_routine_executions_routine_id",
"index_bytes": 1138688,
"table": "public.routine_executions",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.idx_routine_executions_status: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.idx_routine_executions_status",
"index_bytes": 1130496,
"table": "public.routine_executions",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.idx_routine_executions_task_id: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.idx_routine_executions_task_id",
"index_bytes": 6234112,
"table": "public.routine_executions",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_llm_billing_agent_created: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_llm_billing_agent_created",
"index_bytes": 1196032,
"table": "public.llm_billing",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_llm_billing_model_created: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_llm_billing_model_created",
"index_bytes": 1875968,
"table": "public.llm_billing",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_llm_billing_prompt_hash: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_llm_billing_prompt_hash",
"index_bytes": 1155072,
"table": "public.llm_billing",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_llm_billing_user_model: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_llm_billing_user_model",
"index_bytes": 2179072,
"table": "public.llm_billing",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_patrol_log_type_created: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_patrol_log_type_created",
"index_bytes": 51240960,
"table": "public.patrol_log",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_task_events_actor: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_task_events_actor",
"index_bytes": 1032192,
"table": "public.task_events",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_task_events_failure_category: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_task_events_failure_category",
"index_bytes": 1024000,
"table": "public.task_events",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_task_events_task_timestamp: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_task_events_task_timestamp",
"index_bytes": 4997120,
"table": "public.task_events",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_tasks_created: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_tasks_created",
"index_bytes": 3620864,
"table": "public.tasks",
"target_db": "ghostshell_v3"
} |
| info | anatomy | public.ix_tasks_status_priority: 0 scans (unused index) | Drop candidate — verify no reporting workload needs it first. | {
"idx_scan": 0,
"index": "public.ix_tasks_status_priority",
"index_bytes": 1204224,
"table": "public.tasks",
"target_db": "ghostshell_v3"
} |
| info | config_drift | connections 23/200 in use (12%) | Connection headroom measured as adequate. | {
"current_connections": 23,
"max_connections": 200,
"target_db": "ghostshell_v3",
"used_pct": 11.5
} |
| info | privilege | 1 superuser role(s) | Each one is an unrestricted account — keep the count minimal. | {
"superusers": [
"ghostshell"
],
"target_db": "ghostshell_v3"
} |
Feature health (per-feature SLOs — heal-success rate, bar 90% over 7d)
| Feature | Source table | Heal success | Measured events | Window |
|---|---|---|---|---|
| ghostshell-searxng | v3_heal_audit | 25% | 61 ok / 183 failed (244 events) | 7d |
| ghostshell-redis-exporter | v3_heal_audit | 24% | 55 ok / 179 failed (234 events) | 7d |
| ghostshell-node-exporter | v3_heal_audit | 24% | 55 ok / 171 failed (226 events) | 7d |
| ghostshell-cadvisor | v3_heal_audit | 24% | 54 ok / 167 failed (221 events) | 7d |
| ghostshell-prometheus | v3_heal_audit | 32% | 76 ok / 159 failed (235 events) | 7d |
| ghostshell-alertmanager | v3_heal_audit | 38% | 53 ok / 86 failed (139 events) | 7d |
| ghostshell-postgres-exporter | v3_heal_audit | 41% | 53 ok / 75 failed (128 events) | 7d |
| ghostshell-luks-exporter | v3_heal_audit | 47% | 54 ok / 60 failed (114 events) | 7d |
| service:postgres | v3_heal_audit | 0% | 0 ok / 14 failed (14 events) | 7d |
| service:redis | v3_heal_audit | 0% | 0 ok / 14 failed (14 events) | 7d |
| probe:postgres_pool | v3_heal_audit | 0% | 0 ok / 5 failed (5 events) | 7d |
| probe:nats_stream | v3_heal_audit | 0% | 0 ok / 4 failed (4 events) | 7d |
| service:chromadb | v3_heal_audit | 0% | 0 ok / 1 failed (1 events) | 7d |
| probe:telegram_liveness | v3_heal_audit | n/a | 0 ok / 0 failed (0 events) | 7d |
| ghostshell-dashboard | v3_heal_audit | 100% | 2 ok / 0 failed (2 events) | 7d |
| docker:zombie_containers | v3_heal_audit | 100% | 101 ok / 0 failed (101 events) | 7d |
| docker:unhealthy_ghostshell-luks-exporter | v3_heal_audit | 100% | 2 ok / 0 failed (2 events) | 7d |
| ghostshell-chromadb | v3_heal_audit | 100% | 2 ok / 0 failed (2 events) | 7d |
| docker:stale_containers | v3_heal_audit | n/a | 0 ok / 0 failed (0 events) | 7d |
Changes since last exam
| Severity | Scanner | New finding | Evidence |
|---|---|---|---|
| warning | workflow | v3_heal_audit: 'docker:zombie_containers' → 'healed' 101× in 7d | {
"count_7d": 101,
"result": "healed",
"table": "v3_heal_audit",
"target": "docker:zombie_containers",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-alertmanager' → 'escalated' 86× in 7d | {
"count_7d": 86,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-alertmanager",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-alertmanager' → 'healed' 53× in 7d | {
"count_7d": 53,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-alertmanager",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-cadvisor' heal success 24% over 7d (221 events) | {
"events": 221,
"failure": 167,
"feature": "ghostshell-cadvisor",
"slo": 0.9,
"success": 54,
"success_rate": 0.244,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-cadvisor' → 'escalated' 167× in 7d | {
"count_7d": 167,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-cadvisor",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-cadvisor' → 'healed' 54× in 7d | {
"count_7d": 54,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-cadvisor",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-luks-exporter' heal success 47% over 7d (114 events) | {
"events": 114,
"failure": 60,
"feature": "ghostshell-luks-exporter",
"slo": 0.9,
"success": 54,
"success_rate": 0.474,
"table": "v3_heal_audit",
"target_db": "ghostshell_v3",
"window_days": 7
} |
| warning | workflow | v3_heal_audit: 'ghostshell-luks-exporter' → 'escalated' 60× in 7d | {
"count_7d": 60,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-luks-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-luks-exporter' → 'healed' 54× in 7d | {
"count_7d": 54,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-luks-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-node-exporter' → 'escalated' 171× in 7d | {
"count_7d": 171,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-node-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-node-exporter' → 'healed' 55× in 7d | {
"count_7d": 55,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-node-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-postgres-exporter' → 'escalated' 75× in 7d | {
"count_7d": 75,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-postgres-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-postgres-exporter' → 'healed' 53× in 7d | {
"count_7d": 53,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-postgres-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-prometheus' → 'escalated' 159× in 7d | {
"count_7d": 159,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-prometheus",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-prometheus' → 'healed' 76× in 7d | {
"count_7d": 76,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-prometheus",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-redis-exporter' → 'escalated' 179× in 7d | {
"count_7d": 179,
"result": "escalated",
"table": "v3_heal_audit",
"target": "ghostshell-redis-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-redis-exporter' → 'healed' 55× in 7d | {
"count_7d": 55,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-redis-exporter",
"target_db": "ghostshell_v3"
} |
| warning | workflow | v3_heal_audit: 'ghostshell-searxng' → 'healed' 61× in 7d | {
"count_7d": 61,
"result": "healed",
"table": "v3_heal_audit",
"target": "ghostshell-searxng",
"target_db": "ghostshell_v3"
} |
Measured trends
- config_drift|connections #/# in use (#%) — current_connections: 19.0 → 23.0 (up 4.0)
- config_drift|connections #/# in use (#%) — used_pct: 9.5 → 11.5 (up 2.0)
- workflow|v#_heal_audit: # non-terminal row(s) older than #d — stuck_rows: 291.0 → 305.0 (up 14.0)
- anatomy|public.ix_task_events_task_timestamp: # scans (unused index) — index_bytes: 4988928.0 → 4997120.0 (up 8192.0)
- anatomy|public.ix_patrol_log_type_created: # scans (unused index) — index_bytes: 48300032.0 → 51240960.0 (up 2940928.0)
- workflow|v#_heal_audit: 'ghostshell-searxng' → 'escalated' #× in #d — count_7d: 116.0 → 183.0 (up 67.0)
Skipped (data source absent — never fabricated)
- query (ghostshell_v3): pg_stat_statements not installed on the target
- exposure (ghostshell_v3): pg_hba_file_rules unreadable with this role