What it actually does.

The parts

There are five pieces and keeping them separate matters more than it looks.

• The listener takes alerts pushed from the network controller and writes them down. It never fixes anything, so it can't get stuck.
• The poller asks the network how it's doing, every minute, no matter what. This is the one I trust.
• The engine is the only part allowed to act. It decides, does the thing, checks it worked, and writes down what happened.
• The publisher sends a summary somewhere I can see, and a heartbeat so something outside knows it's alive.
• The daily sweep is a once-a-day inventory. New devices, firmware changes, anything that drifted.

The listener is fast but I can't trust it. The poller is slower but it can't lie by being quiet, because if it stops, the timestamp stops moving and I can see that. So the poller is the one that's allowed to trigger a fix.

What it's allowed to do

Two things. That's it.

• An access point goes offline, so restart it. If that doesn't work, cut power to its switch port and bring it back.
• A camera goes offline, same idea with its port.

Everything else it tells me about and does nothing. Both of those undo themselves, both recover on their own, and neither one changes any settings. That last part is the rule I'd keep if I kept only one.

If an action could change a setting, it doesn't belong in something that runs without you.

There's a third one I wrote and never turned on. It reconnects a client with a bad address. I couldn't find a way to be sure it was the right call, so it sits there switched off. That's fine. Not every idea has to ship.

What done looks like

Not "it runs". I thought it was done a few times before it was. Done is:

1. Every safety check has been made to trigger on purpose, at least once. Some of mine turned out to do nothing at all.
2. Both ways of noticing a problem have been tested against a real fault, not a pretend one.
3. Something outside the agent says whether the agent is alive, and I've seen that thing go red.
4. There's a way to stop it that doesn't involve deleting anything.
5. It writes down what it did, when, to what, and how it knows it worked.

What it cost

The code is a little under two thousand lines, with a lot of comments explaining why each check is there. The code was the easy part. Almost all the time went into checking, and then into finding out that five of my safety checks had never worked.