A detector whose only clearing path is a human flag accumulates permanent noise
brain-distill · confidence high · status active
tags: fim monitor alert-fatigue cron file-integrity baseline
Observed 2026-10-04 06:05-06:20 AEDT on Zappo (macbook-pro-3).
The hourly file-integrity monitor (~/.hermes/cron/jobs.json job fc4cd071b735, script
fim_audit_report.py, four runs a day, plus the launchd twin com.dwayne.clawd-fim-check,
hourly) appends one line per run to ~/clawd/memory/fim_audit.log. In the retained log the
counts are 4732 FIM OK lines and 470 FIM ALERT lines. Every alert block names the same
file: MODIFIED: /Users/dwayne/.openclaw/workspace/SOUL.md. There is no other alert target in
the whole file. The stored baseline ~/clawd/memory/fim_hashes.json carries the same sha256
407fb267... that SOUL.md has now, and SOUL.md has not changed since 2026-08-31 21:34, so the
monitored file is quiescent and the alert burst has stopped.
The trap is in ~/clawd/scripts/fim_check.py. On a detected change it prints Baseline NOT updated. Run with --accept to acknowledge these changes. It rewrites the stored hash only
when called with --accept. No caller passes that flag. grep -rn fim_check.py over
~/.hermes/scripts, ~/clawd/scripts and ~/Library/LaunchAgents shows only check
callers: the launchd plist, zappo_fim_check_hourly.sh, pro_fim_check_hourly.sh and the
report wrapper fim_audit_report.py. In consequence the log holds 467 Baseline NOT updated
lines against three historical Baseline updated (changes accepted) lines, and the condition
cannot clear itself.
Rule: a detector whose only clearing path is a human flag accumulates permanent noise from every legitimate edit it is meant to observe. Before trusting a monitor's alert history, confirm that an automated or approval-gated path exists that can clear the condition. If none exists, the alert count measures edits, not incidents, and a standing alert must be read as a known state rather than a live fault.
Sources: ~/.hermes/cron/jobs.json (job fc4cd071b735), ~/clawd/scripts/fim_check.py,
~/.hermes/scripts/fim_audit_report.py, ~/Library/LaunchAgents/com.dwayne.clawd-fim-check.plist,
~/clawd/memory/fim_audit.log, ~/clawd/memory/fim_hashes.json, read 2026-10-04 06:05-06:20 AEDT.
Sources:
/Users/dwayne/clawd/scripts/fim_check.py · /Users/dwayne/.hermes/scripts/fim_audit_report.py · /Users/dwayne/Library/LaunchAgents/com.dwayne.clawd-fim-check.plist · /Users/dwayne/clawd/memory/fim_audit.log · /Users/dwayne/clawd/memory/fim_hashes.json · /Users/dwayne/.hermes/cron/jobs.json