July 2026 audit findings — tracking

[BaumerCrypto]

Full audit performed 2026-07-03 covering all 7 scripts + docs. This issue tracks remediation.

P1 — Fix soon

• P1-1: Alert spam. avalon_temp_monitor.sh fired health-check alerts on every 5-min poll while a condition persisted. Fixed in f1584ec with per-condition state gating (transition + hourly re-alert while down) and ✅ recovery messages.
• P1-2: Softoff dead-end. After emergency softoff, recovery branch will try workmode,set,1 on a miner in standby. Not observed in production (softoff has never fired). Deferred until softon path is built.
• P1-3: Silent Discord failures. All webhook curl calls hardened with --max-time 10 + HTTP status logging. Fixed across 5 scripts: avalon_temp_monitor.sh (f1584ec), monitor_btc_stack.sh (5e02ab9), daily_mining_summary.sh (6890fbd), daily_btc_fleet_summary.sh (3a987a8), daily_dgb_summary.sh (81f273b).

P2 — Correctness, portability, user traps

• P2-4: daily_dgb_summary.sh labels fleet shares "Shares (NerdQaxe3)" but sums both miners. Fix label + doc.
• P2-5: AxeOS bestDiff/bestSessionDiff became numeric on API in v1.0.35. Older firmware returns suffixed strings. Add firmware floor to poller docs.
• P2-6: socat -t is inactivity-after-EOF, not connect timeout. Add connect-timeout=5 in Canaan paths.
• P2-7: Fleet summaries hardcode 2-3 miner slots in jq payload while docs claim dynamic pickup. Fix doc now, dynamic later.
• P2-8: Verify .stratum.pools[0].connected field path.

P3 — Polish

• Refresh stale Project knowledge copies of two summaries.
• Fix grep -c … || echo 0 double-line quirk.
• Remove dead MIN_VALID code from fleet summaries.
• Add head -1 and -?[0-9]+ to Avalon getters (negative-temp defensive).
• Derive footer rate from POWER_RATE instead of hardcoding "15.476¢/kWh".
• Publish full log rotation commands in README (currently ...).
• Move GSS_API_POOL to top config block in daily_mining_summary.sh.
• Align daily_mining_summary.sh on jq -n for JSON.
• Standardize placeholder vs. real IP convention.
• Clarify fleet "Peak/Low" semantics (sum of per-miner extremes, not simultaneous).

Enhancements (post-remediation, separate scope)

• Dead-man's switch via healthchecks.io.
• "Expected offline" miner flag mirroring GSSM disable.
• Block-found announcer via GSS API polling.
• Shared mining_common.sh library.
• shellcheck GitHub Action.
• Weekly rollup embed.

[BaumerCrypto]

Eco-hold feature shipped alongside — separate scope from audit, no issue #2 opened (small feature, direct commit sufficient).