{
  "schemaVersion": 2,
  "date": "2026.07.25",
  "publishedAt": "2026-07-25T07:12:14-07:00",
  "timeZone": "America/Los_Angeles",
  "title": "Automatic Daylab runner identified after Telegram run alerts",
  "publicationStatus": "Published",
  "executiveSummary": [
    "The overnight scheduler is disabled and no Hiro-related Windows Scheduled Task is currently registered, but an independent Daylab process was still running continuously.",
    "The process began at 5:36 PM Pacific on July 24 and was configured to execute a proposal-only self-improvement evaluation every 30 minutes, which explains the new run activity.",
    "Telegram notification delivery remains enabled through a lifecycle marker left from an earlier server session, so Daylab can attempt to send run summaries even though the separately managed Telegram bot process is no longer alive."
  ],
  "workstreams": [
    {
      "title": "Scheduler and process audit",
      "status": "Diagnosed",
      "details": [
        "The checked-in nightly schedule has enabled set to false, and a live Scheduled Task query returned no matching Hiro, Nightly, Qwen, or Telegram task.",
        "The Daylab PID file identified a live Python process started at 5:36 PM Pacific on July 24.",
        "Its checked-in launcher starts hiro.lab.daylab with a 30-minute interval and a 20-minute per-cycle time limit; that loop is independent of the nightly schedule switch."
      ]
    },
    {
      "title": "Run and notification evidence",
      "status": "Diagnosed",
      "details": [
        "Daylab output recorded completed self-improvement cycles at 6:39 AM and 7:08 AM Pacific on July 25, and the evaluation ledger was updated at 1:07 AM during this session's audit window.",
        "The Telegram-notifications lifecycle marker remains present from a prior server startup, while the PID recorded for the managed Telegram bot is stale and no longer identifies a running process.",
        "A recent Daylab log shows a Telegram send attempt. One recorded attempt failed because Telegram rejected malformed Markdown, so delivery is not guaranteed for every cycle."
      ]
    },
    {
      "title": "Containment decision",
      "status": "Pending user authorization",
      "details": [
        "This session diagnosed the source and did not terminate the live Daylab process or alter notification state without explicit authorization.",
        "Stopping Daylab through its checked-in launcher would end the recurring evaluation process and remove its PID file. Stopping the Telegram lifecycle would also disable further notifications and mark the service as intentionally stopped."
      ]
    }
  ],
  "decisions": [
    "Treat the Daylab loop as a separate automatic runner rather than evidence that the disabled nightly schedule was ignored.",
    "Do not stop or modify a live Hiro process during a diagnostic-only request without confirmation.",
    "Record the process and log evidence without publishing tokens, chat identifiers, message contents, or other private operational data."
  ],
  "validation": [
    {
      "check": "Nightly schedule configuration",
      "status": "passed",
      "result": "The checked-in schedule file was inspected and has enabled set to false."
    },
    {
      "check": "Windows Scheduled Task audit",
      "status": "passed",
      "result": "A live query found no matching Hiro-related scheduled task."
    },
    {
      "check": "Live Daylab process and output",
      "status": "passed",
      "result": "The PID file resolved to a running Python process, and its output confirms recurrent completed cycles."
    },
    {
      "check": "Journal test and frontend production build",
      "status": "not run",
      "result": "These checks are required before publication and will be run after the source entry is generated."
    }
  ],
  "currentState": [
    "The nightly scheduler remains disabled.",
    "A separate Daylab automatic loop remains active and will continue its 30-minute cadence until explicitly stopped or it exits.",
    "Telegram notification gating remains enabled by a lifecycle marker, allowing active Hiro code to attempt direct Telegram sends."
  ],
  "limitations": [
    "The audit could not attribute the original Daylab launch to a specific interactive shell because the process-parent query was denied by the local process-information permission boundary.",
    "This audit does not prove delivery of every Telegram message; it proves that the active process is capable of attempting sends and that at least one recent send attempt was logged."
  ],
  "nextSteps": [
    "On approval, stop the Daylab loop using its managed launcher and verify that its process and PID file are gone.",
    "On approval, disable the Telegram lifecycle marker and verify that subsequent notification attempts are skipped.",
    "Add an explicit operator-facing status view or unified shutdown command so the independent Daylab loop and the nightly scheduler cannot be mistaken for one another."
  ],
  "disclosureNote": "This public entry omits Telegram credentials, recipient identifiers, message text, exact process command lines, and other private operational data."
}