SmartMon Autonomous Elite Guard™

A reference implementation & public prior-art disclosure of the branded offline-resilient enforcement agent used across the SmartMon RT/RW Net & ISP management ecosystem.

First publicly documented: August 2026, by Inti Smart Karya — original author of SmartMon. This repository exists as a timestamped, open reference disclosure. See § Why We're Open-Sourcing This.

Related disclosure: see also SmartMon Dynamic Quarantine Routing™ — a separate SmartMon mechanism (how a quarantined customer is redirected), published as its own standalone repository. This repository is about a different mechanism: how enforcement keeps running even when SmartMon's own cloud server is unreachable.

This repository contains a reference RouterOS (.rsc) script (elite-guard-reference.rsc) illustrating the pattern behind SmartMon Autonomous Elite Guard™ — the enforcement agent SmartMon runs directly on the customer's MikroTik router, so that expiry enforcement keeps working even if the router temporarily loses its connection to SmartMon's cloud backend.

It is published standalone and open-source, deliberately separated from SmartMon's proprietary cloud/SaaS core. What you get here is the pattern: a self-contained, cloud-independent scheduler-driven agent. What you don't get here is SmartMon's actual production tag format, its multi-service coverage (Hotspot + PPPoE + Simple Queue in one pass), its fleet rollout/versioning system, or its companion housekeeping agent — those stay inside the full SmartMon product. See § What's Not In This Repo.

Most billing/management platforms enforce expiry by having a central server periodically call out to each router (via API, webhook, or a remote script push) to check and act on expired accounts. That works fine — until it doesn't:

• Internet/VPN drop between the router and the management server — a common, everyday occurrence for small ISPs on unstable backbone links — silently pauses all enforcement. Expired customers keep browsing for free until connectivity is restored.
• A busy or temporarily-down central server can't reach thousands of routers on schedule, creating enforcement backlogs that are hard to reason about ("did router #482 actually get checked today?").
• Every enforcement action depends on round-trip network reliability, multiplying the number of moving parts that can fail silently.

This isn't a hypothetical edge case for RT/RW Net operators running on modest, sometimes-flaky infrastructure — it's a routine Tuesday.

Instead of a central server reaching out to check each router, SmartMon writes the expiry information locally, once, in advance — and lets a small agent running on the router itself, on its own local scheduler, do the checking and enforcement entirely offline. No outbound call is needed at check-time. As long as the router is powered on with a working clock, enforcement keeps running — completely independent of whether SmartMon's cloud is reachable at that exact moment.

1. Write-once, local tag — When SmartMon grants or renews access, it writes a compact expiry tag directly into the relevant router object (in this reference excerpt, a Hotspot user's comment field).
2. Local scheduler — A RouterOS /system scheduler entry runs the agent script on a fixed interval (e.g. every few minutes), entirely on-device.
3. Self-contained check — The agent reads the router's own clock and compares it against the locally-stored tag — no external call involved.
4. Local enforcement — If expired, the agent takes action immediately and locally (quarantine the account, drop its active session), and logs the action to the router's own log.
5. Resilience — Because every step above only needs the router itself, enforcement survives internet outages, VPN drops, or a temporarily unreachable SmartMon server. Sync catches up later; enforcement never waited for it.

See elite-guard-reference.rsc — an annotated educational excerpt covering the Hotspot enforcement path with a simple, human-readable tag format (EXP=YYYY-MM-DD;MODE=x;). It intentionally omits SmartMon's actual production tag encoding, its PPPoE/Simple-Queue coverage, and its fleet deployment tooling.

# --- excerpt — full file: elite-guard-reference.rsc ---

:foreach u in=[/ip hotspot user find where disabled=no and profile!="Isolir"] do={
    :local uComment [/ip hotspot user get $u comment]
    :if ([:typeof [:find $uComment "EXP="]] != "nil") do={
        # ...parse EXP=YYYY-MM-DD;MODE=x; and compare against [/system clock get date]...
        # ...if expired: quarantine or remove locally, no server call needed...
    }
}

⚠️ This is a starting point, not a drop-in production script. Test in a lab/staging router before touching a live customer base.

• SmartMon's actual production tag format — a compact, undocumented encoding, not reproduced here.
• Multi-service coverage — the production agent also enforces PPPoE secrets and Simple Queue (static-IP/bandwidth) targets in the same pass.
• Fleet deployment & versioning — how the agent is safely installed, updated, and cleaned up across thousands of routers from a central admin panel.
• The companion housekeeping agent that clears stale unauthenticated sessions and DHCP leases on its own schedule.
• Any billing, tenant, or credential logic — this agent only ever reads a tag it already has locally; it never touches a database or an API key.

If you're evaluating this script because you liked what it does, that's exactly the point — SmartMon is the productized, fully managed version of this idea.

Like our Dynamic Quarantine Routing disclosure, this script is inherently client-side: it lives on hardware the customer owns and administers, in plaintext, readable by anyone with router access. Rather than rely on obscurity for something that was never actually secret, Inti Smart Karya is publishing the underlying pattern deliberately, under an explicit name and license, with a public timestamp — a prior-art disclosure.

To be precise about what's being claimed: scheduler-driven local scripts on RouterOS are a known general capability, not something SmartMon invented. What we're documenting and claiming authorship of is this specific, named, offline-resilience-first design — an enforcement agent deliberately architected around zero cloud dependency at check-time — as SmartMon Autonomous Elite Guard™, first publicly documented and integrated by SmartMon for the Indonesian RT/RW Net & ISP market.

Licensed under the Apache License 2.0 — chosen for its explicit patent grant and defensive termination clause, consistent with the prior-art purpose of this disclosure. Attribution to Inti Smart Karya / SmartMon in derivative works is required and appreciated.

SmartMon is an Enterprise SaaS platform for ISPs and RT/RW Net operators, built by Inti Smart Karya. Full product: smartmon.my.id

Developed & disclosed by Maulana Ishak — Founder, CTO & Lead Security Auditor, Inti Smart Karya.

© 2026 Inti Smart Karya. This disclosure is provided for interoperability, education, and prior-art documentation purposes.