post-deploy-env-diff

Files (1)

• SKILL.md

SKILL.md (first lines)

# Post-Deploy Env-Diff Gate

When a task changes a default in the repo's checked-in environment template
(`.env.example`, `config.sample.yaml`, equivalent) AND deploys to a host
where the live config lives on disk outside the repo, the deploy pipeline
typically does NOT overwrite the on-host file. The repo's new default
becomes documentation; the on-host value continues to carry the old default.

This gate runs at `/dr-archive` time and asserts the on-host config has
been updated to match the deploy. It does NOT auto-edit — the operator
still owns the toggle action.

## Trigger

Load this skill when the closing task touched any of:

- Repo-side env templates (`.env.example`, `config.sample.*`).
- Default-value comments in env templates.
- Toggle wiring that branches on an env variable whose default was just
  changed.

…AND the task involved a deploy to a host with a persistent on-host config
file (any service that reads its config from disk at boot or on signal).

## Procedure

1. Build the diff of the touched env template lines from the merge-base
   to the current head.
2. For each line of the form `KEY=value` whose default value changed:
    a. Determine the on-host config file path from the deploy script /
       systemd unit (typically `WorkingDirectory/.env` or a sibling).
    b. Read the on-host file (`ssh <host> grep "^KEY=" <path>`).
    c. Compare the on-host value to the new template default.
3. For each KEY where the on-host value still carries the old default:
    - Surface the drift in the archive document § Operator Handoff.
    - Block the «all V-AC met» framing in the human summary until the
      operator either flips the on-host value or accepts the drift
      explicitly with a rationale ≥ 50 characters.

## Output line in the archive doc

For each drifted KEY:

```
KEY=<new-default> in repo template; <host>:<path> still carries
KEY=<old-default>. Operator action: edit <path>, change KEY=<new-default>,
restart <service>. Pipeline does not auto-flip.
```

## When to skip

- Task is repo-only (no deploy touches the host).
- The on-host config file is generated by the deploy pipeline from the
  template (deploy script copies template → host on every run).
- Default changed only for non-deployable surfaces (test fixtures,
  developer-local-only keys).

## Why

The class «production ran on the previous default for N hours after a
deploy advertised a new default» has shipped silently when no step in
the pipeline diffs deploy intent against deploy state. The fix is a
read-only probe at archive time — operator authorises the actual flip,
the gate just refuses to call the archive «done» while drift exists.

From Arcanada-one/datarim, MIT.

More from Arcanada-one/datarim