[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CBJSH3NQCZQ0GME38GFFKQ":3,"skill-same:01M6CBJSH3NQCZQ0GME38GFFKQ":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":59,"ownerHtmlUrl":60,"ownerBlogUrl":61,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M6CBJSH3NQCZQ0GME38GFFKQ","confighub-source-truth",null,"Use when the user wants a STRATEGY-TYPED, PILOT-ACCEPTANCE-SHAPED VERDICT about whether ConfigHub \u002F controller \u002F runtime agree under a declared delivery strategy — the `compare source-truth` workflow with the explicit `--strategy \u003Cname>` requirement. Natural phrasing: \"give me a source-truth verdict for deploy\u002Fapi\", \"verify under git-argo strategy that ConfigHub matches the cluster\", \"run the source-truth contract for upstream Pilot acceptance\", \"compare source-truth confighub-oci-flux strategy across the namespace\", \"produce strategy-relative correctness evidence\", \"show me where the strategy declaration is being violated\". Composes `compare source-truth --strategy \u003Cs>` + the source-truth evidence contract + (optionally) `receipt verify --strategy \u003Cs>` for a fingerprinted version. Requires CONNECTED MODE. Do NOT load for: a single-resource live drift question without a declared strategy (use investigate-drift), a triage (use triage-unhealthy-workload), or a fleet-wide audit that doesn't need strategy framing (use audit-fleet-conformance). cub-scout NEVER infers a strategy — this skill enforces that boundary.","confighub\u002Fcub-scout","confighub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206140369?v=4","01M6CBJBWD33AFNG4VXMJHSRXD","ConfigHub Inc","01M6CBJC0K0F8CJVFWGRSR0KYC",14,"MIT","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fconfighub-source-truth\u002FSKILL.md",[],[19,20,9,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"source","confighub source truth","use","when","mode","unit","app","get","drift","show","scout compare","evidence","never","version","oci","strategy","view","question","changeset","explain","Bash","show me","api","controller","produce","acceptance","auth","workflow","2026-11-10 10:12:30",false,"---\nname: confighub-source-truth\ndescription: 'Use when the user wants a STRATEGY-TYPED, PILOT-ACCEPTANCE-SHAPED VERDICT about whether ConfigHub \u002F controller \u002F runtime agree under a declared delivery strategy — the `compare source-truth` workflow with the explicit `--strategy \u003Cname>` requirement. Natural phrasing: \"give me a source-truth verdict for deploy\u002Fapi\", \"verify under git-argo strategy that ConfigHub matches the cluster\", \"run the source-truth contract for upstream Pilot acceptance\", \"compare source-truth confighub-oci-flux strategy across the namespace\", \"produce strategy-relative correctness evidence\", \"show me where the strategy declaration is being violated\". Composes `compare source-truth --strategy \u003Cs>` + the source-truth evidence contract + (optionally) `receipt verify --strategy \u003Cs>` for a fingerprinted version. Requires CONNECTED MODE. Do NOT load for: a single-resource live drift question without a declared strategy (use investigate-drift), a triage (use triage-unhealthy-workload), or a fleet-wide audit that doesn''t need strategy framing (use audit-fleet-conformance). cub-scout NEVER infers a strategy — this skill enforces that boundary.'\nphase: cross-cutting\nallowed-tools: Bash(.\u002Fcub-scout compare source-truth *) Bash(cub-scout compare source-truth *) Bash(cub scout compare source-truth *) Bash(.\u002Fcub-scout compare three-way *) Bash(cub-scout compare three-way *) Bash(cub scout compare three-way *) Bash(.\u002Fcub-scout receipt verify *) Bash(cub-scout receipt verify *) Bash(cub scout receipt verify *) Bash(.\u002Fcub-scout receipt show *) Bash(cub-scout receipt show *) Bash(cub scout receipt show *) Bash(.\u002Fcub-scout receipt list *) Bash(cub-scout receipt list *) Bash(cub scout receipt list *) Bash(.\u002Fcub-scout explain *) Bash(cub-scout explain *) Bash(cub scout explain *) Bash(.\u002Fcub-scout trace *) Bash(cub-scout trace *) Bash(cub scout trace *) Bash(.\u002Fcub-scout status) Bash(cub-scout status) Bash(cub scout status) Bash(kubectl get *) Bash(cub space list *) Bash(cub unit get *) Bash(cub unit list *) Bash(cub link get *) Bash(cub link list *) Bash(cub view get *) Bash(cub view list *) Bash(cub unit-event list *) Bash(cub resource list *) Bash(cub release list *) Bash(cub changeset list *) Bash(cub auth status) Bash(argocd app get *) Bash(flux get *)\n---\n\n# confighub-source-truth\n\nThe strategy-typed source-truth loop. The operator (or an acceptance kernel like Pilot) wants a **deterministic verdict** about whether ConfigHub \u002F controller \u002F runtime agree under a **declared delivery strategy**. cub-scout never infers the strategy — the user passes it; the verdict is then strategy-relative.\n\nComposes `compare source-truth --strategy \u003Cs>` + the source-truth evidence contract + optionally `receipt verify --strategy \u003Cs>` (to persist the verdict as a fingerprinted artifact).\n\nRequires **connected mode** (`cub auth login`).\n\n## When to use\n\nExplicit phrasings:\n\n- \"Give me a source-truth verdict for deploy\u002Fapi\"\n- \"Verify under `git-argo` strategy that ConfigHub matches the cluster\"\n- \"Run the source-truth contract for upstream Pilot acceptance\"\n- \"Compare source-truth `confighub-oci-flux` strategy across the namespace\"\n- \"Produce strategy-relative correctness evidence\"\n- \"Show me where the strategy declaration is being violated\"\n- \"Did the controller pull from the declared source?\"\n\nImplicit intents:\n\n- The user is operating in the **architectural triad** (cub-scout evidence ↔ ConfigHub authority ↔ Pilot judge); Pilot needs strategy-typed input\n- The user has a **declared expectation** about the delivery chain (`Git→Argo`, `ConfigHub→OCI→Flux`, etc.) and wants to check it\n- The user is gating CI \u002F promotion on conformance with the declared strategy\n- The user wants the **proof gaps** surfaced explicitly (the `omissions[]`-style contract is the whole point)\n\n## Do not load for\n\n- Single-resource live drift WITHOUT a declared strategy — [`investigate-drift`](..\u002Finvestigate-drift\u002FSKILL.md)\n- Triage of a broken workload — [`triage-unhealthy-workload`](..\u002Ftriage-unhealthy-workload\u002FSKILL.md)\n- Fleet-wide audit when strategy framing isn't needed — [`audit-fleet-conformance`](..\u002Faudit-fleet-conformance\u002FSKILL.md) (which itself can compose `compare source-truth` per resource, but the broader-scope skill is the right entry point)\n- Incident-evidence capture after the fact — [`operator-incident-evidence`](..\u002Foperator-incident-evidence\u002FSKILL.md)\n- Authoring source-truth strategies. The strategy enumeration is fixed (see below); proposing new ones is a `cub-scout\u002F#393`-class issue.\n\n## The nine strategies\n\ncub-scout's source-truth contract enumerates **nine strategies** (Phase 1 + Phase 2 from `#393` and `#418`). The user MUST pick one:\n\n| Strategy | Delivery chain | Controller |\n|----------|---------------|-----------|\n| `confighub-oci-argo` | ConfigHub authors a Unit → renders to OCI → Argo CD reads OCI → cluster | Argo |\n| `confighub-oci-flux` | Same authoring → Flux Kustomization reads OCI → cluster | Flux |\n| `git-argo` | Git → Argo CD → cluster (vanilla GitOps) | Argo |\n| `git-flux` | Git → Flux → cluster | Flux |\n| `helm-argo` | Helm chart → Argo as Helm renderer → cluster | Argo |\n| `helm-flux` | Helm chart → Flux helm-controller → cluster | Flux |\n| `kustomize-flux` | Kustomize base → Flux kustomize-controller → cluster | Flux |\n| `oci-argo` | OCI artifact (non-ConfigHub) → Argo → cluster | Argo |\n| `oci-flux` | OCI artifact (non-ConfigHub) → Flux → cluster | Flux |\n\nEach strategy declares **expected surfaces** (which of ConfigHub \u002F controller \u002F runtime is required), **expected controller kind** (Argo vs Flux — never silently fall back), and **strategy-implied authority** (which surface is canonical for the comparison).\n\nPick by what's deployed, not by what's convenient. If the user can't name the strategy, the right answer is **ASK** (the contract's fourth status), not a guess.\n\n## The four statuses + five verdicts\n\ncub-scout's source-truth contract emits two separate axes:\n\n**Status** (cub-scout's evidence-quality verdict):\n\n| Status | Meaning |\n|--------|---------|\n| `PASS` | All required surfaces present, all required equalities hold, no proof gaps. Pilot may accept. |\n| `WATCH` | Mostly present and consistent, but at least one soft signal warrants confirmation. |\n| `BLOCK` | A hard rule fails (strategy mismatch, controller-source resolution failure). Must not accept. |\n| `ASK` | cub-scout cannot classify deterministically. Used when strategy is unknown or surfaces fundamentally cannot be compared. |\n\n**Verdict** (cross-surface agreement, separate from status):\n\n| Verdict | Meaning |\n|---------|---------|\n| `AGREED` | The three surfaces line up under the declared strategy |\n| `MISMATCH` | At least one surface diverges from the strategy-implied authority |\n| `INCOMPLETE` | One or more surfaces missing required proof |\n| `BLOCKED` | cub-scout could not fetch one of the surfaces in read-only mode |\n| `UNKNOWN` | cub-scout has no opinion (used in ASK) |\n\nStatus and verdict ARE separate — a verdict can be `MISMATCH` while status is `BLOCK` (strategy violation) OR `WATCH` (soft mismatch with proof gaps). See `pkg\u002Fagent\u002Fsource_truth.go` for the closed enums.\n\n## The loop\n\n1. **Confirm connected mode.** `cub-scout status` must report connected; source-truth is meaningless without all three surfaces.\n2. **Declare the strategy.** The user MUST pass `--strategy \u003Cname>`. If they don't know, the answer is ASK + UNKNOWN.\n3. **Invoke per resource.** `cub-scout compare source-truth \u003Ckind>\u002F\u003Cname> -n \u003Cns> --strategy \u003Cs> --format json`.\n4. **Read the structured evidence.** Status + verdict + outlier + proof_gaps[] + safe_next_action + the three surfaces verbatim. See [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md).\n5. **Optionally persist as a receipt.** `cub-scout receipt verify \u003Ckind>\u002F\u003Cname> -n \u003Cns> --strategy \u003Cs> --save` produces a fingerprinted, immutable version Pilot or the audit log can attach to a decision. See [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md).\n\n## Step-by-step\n\n### Step 1 — confirm mode\n\n```bash\n$ cub-scout status --json\n{\n  \"mode\": \"connected\",\n  \"cluster_name\": \"default\",\n  \"context\": \"prod-use2\",\n  \"confighub_reads\": true\n}\n```\n\n`confighub_reads` is the answer: it is the verdict of the same gate `compare source-truth` itself uses. If it is `false`, refuse to claim a source-truth verdict and give the user `confighub_reads_reason` verbatim — it names the cause (an expired session, `cub` not installed, or ConfigHub reads turned off), and only one of those is fixed by `cub auth login`. Do not read the `ConfigHub:` mode line as the pre-flight: it describes `hub.confighub.com` and can say `● Connected` while every connected command refuses, or `○ Offline` against a self-hosted ConfigHub whose reads work. (Against v2.12.0 or earlier, which has no `confighub_reads` field, the mode line is all there is.)\n\n### Step 2 — pick the strategy\n\nMatch the actual delivery chain. Look at:\n\n- Workload labels (`argocd.argoproj.io\u002Finstance` → Argo; `kustomize.toolkit.fluxcd.io\u002Fname` → Flux Kustomization; `helm.toolkit.fluxcd.io\u002Fname` → Flux HelmRelease)\n- Argo Application spec (`spec.source.repoURL` — git URL vs OCI URL vs Helm chart URL)\n- Flux Kustomization spec (`spec.sourceRef.kind` — `GitRepository` vs `OCIRepository` vs `HelmRepository` vs `Bucket`)\n- ConfigHub linkage (`confighub.com\u002FUnitSlug` label, plus the unit's render target)\n\n`cub-scout explain \u003Ckind>\u002F\u003Cname>` surfaces all these in one read. From there, picking the strategy is mechanical:\n\n| You see... | Strategy is... |\n|-----------|----------------|\n| Argo + git source | `git-argo` |\n| Argo + OCI source (ConfigHub-rendered) | `confighub-oci-argo` |\n| Argo + OCI source (non-ConfigHub) | `oci-argo` |\n| Argo + Helm source | `helm-argo` |\n| Flux Kustomization + GitRepository | `git-flux` |\n| Flux Kustomization + OCIRepository | `confighub-oci-flux` (if ConfigHub-managed) or `oci-flux` |\n| Flux Kustomization (any source) | `kustomize-flux` (if specifically the kustomize rendering) |\n| Flux HelmRelease | `helm-flux` |\n\n### Step 3 — invoke\n\n```bash\n$ cub-scout compare source-truth deploy\u002Fapi -n prod --strategy git-argo --format json\n{\n  \"declared_strategy\": \"Git -> Argo -> Kubernetes\",\n  \"status\": \"PASS\",\n  \"source_truth\": \"AGREED\",\n  \"outlier\": \"unknown\",\n  \"surfaces\": {\n    \"confighub\": {\n      \"space\": \"payments\",\n      \"unit\": \"payments-api\",\n      \"revision\": \"42\",\n      \"url\": \"https:\u002F\u002Fhub.confighub.com\u002Fp\u002Fpayments\u002Fu\u002Fpayments-api\"\n    },\n    \"controller\": {\n      \"kind\": \"Argo\",\n      \"source\": \"https:\u002F\u002Fgithub.com\u002Forg\u002Fplatform-config\",\n      \"revision_or_digest\": \"abc123def456\",\n      \"health\": \"Synced\",\n      \"multi_source\": false\n    },\n    \"runtime\": {\n      \"resource\": \"Deployment\u002Fapi in prod\",\n      \"field\": \"spec.template.spec.containers[0].image\",\n      \"value\": \"ghcr.io\u002Forg\u002Fapi:v2.3.0\",\n      \"health\": \"Ready\"\n    }\n  },\n  \"proof_gaps\": [],\n  \"safe_next_action\": \"\"\n}\n```\n\nThe empty `proof_gaps[]` is the headline. `status: PASS`, `source_truth: AGREED`, all three surfaces present. Pilot accepts.\n\n### Step 4 — when the verdict is not PASS\n\n```bash\n$ cub-scout compare source-truth deploy\u002Fapi -n prod --strategy git-argo --format json\n{\n  \"declared_strategy\": \"Git -> Argo -> Kubernetes\",\n  \"status\": \"BLOCK\",\n  \"source_truth\": \"MISMATCH\",\n  \"outlier\": \"controller\",\n  ...\n  \"proof_gaps\": [],\n  \"safe_next_action\": \"Argo is tracking a different revision than the controller-resolved git anchor; investigate the divergence before any apply.\"\n}\n```\n\n`status: BLOCK` + `outlier: controller` = the controller is the surface diverging from the strategy-implied authority. The `safe_next_action` field names the next read-only step (never a mutation).\n\n### Step 5 — persist as a receipt (optional)\n\nFor Pilot acceptance kernels or audit trails:\n\n```bash\n$ cub-scout receipt verify deploy\u002Fapi -n prod --strategy git-argo --save\nsaved: \u002Fhome\u002Fuser\u002F.local\u002Fshare\u002Fcub-scout\u002Freceipts\u002F2026-05-22T10-30-00Z__source-truth-pass__Deployment-api__abc123.receipt.json\n```\n\nThe receipt wraps the source-truth evidence (verbatim) in an in-toto Statement v1 envelope with a SHA-256 fingerprint. Strategy mismatch between the caller and the evidence body is itself a BLOCK + `OmissionStrategyMismatch` — see [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md).\n\nReceipts are **immutable**. Same scope + same fingerprint at the same instant → same canonical filename → \"already saved\" warning (file unchanged).\n\n## Strategy-relative correctness\n\nThis is the contract's central rule: **identical observations get opposite verdicts under different declared strategies**.\n\nExample: an Argo CD Application reading from a git URL.\n\n- Under `--strategy git-argo`: PASS \u002F AGREED. Argo reads Git; Git is the declared source; cluster matches Git. All good.\n- Under `--strategy confighub-oci-argo`: BLOCK \u002F MISMATCH (outlier: controller). The strategy declares Argo should be reading from a ConfigHub-rendered OCI artifact — not Git. Argo is the outlier.\n\nSame Argo, same git, same cluster, opposite verdict. Strategy declaration changes the question.\n\nLock that in your head: cub-scout doesn't grade the deployment — cub-scout grades it **against the declared strategy**. This is why `--strategy` is mandatory.\n\n## Proof gaps\n\nEven on PASS \u002F WATCH outcomes, `proof_gaps[]` lists the things cub-scout couldn't fully verify:\n\n- `controller.revision_or_digest` — controller didn't expose its revision\u002Fdigest\n- `confighub.unit_revision` — unit didn't have a revision number (rare; ConfigHub usually populates)\n- `runtime.helm_chart_anchor` — Helm chart version not extractable from runtime (Phase 2 strategies; the chart-version extractor isn't fully wired — see #409)\n- `controller.multi_source` — Argo `spec.sources[]` has len > 1; cub-scout uses index 0, can't verify equality across sources\n\nProof gaps are **not failures**. They're explicit non-claims (the same pattern as receipt omissions). Pilot reads them and decides whether to accept the verdict given the named gaps.\n\n## Tool boundary\n\n- **Allowed:** `compare source-truth`, `compare three-way` (for the broader DRY\u002FWET\u002FLIVE context); `receipt verify --strategy --save`, `receipt show \u002F list \u002F validate`; `explain`, `trace`, `status`; `cub \u003Centity> get \u002F list` for the entities named in allowed-tools; `cub auth status`; `argocd app get`, `flux get`.\n- **Not allowed:** any mutation. `cub * create\u002Fupdate\u002Fdelete`, `argocd app sync`, `flux reconcile`, `kubectl apply\u002Fedit\u002Fpatch\u002Fdelete`, `cub-scout demo \u002F import apply`. The verdict is evidence; remediation is the user's call (or Pilot's downstream).\n\n## Pilot integration\n\ncub-scout's source-truth contract is the canonical input for **Pilot**, the architectural-triad acceptance judge tracked alongside cub-scout in `#444`. Pilot reads source-truth evidence + receipts and produces verdicts that gate CD \u002F promotion \u002F rollback \u002F compliance.\n\n- cub-scout = evidence (this skill produces it)\n- ConfigHub = authority (where the unit \u002F Link \u002F target lives)\n- Pilot = judge (decides accept \u002F wait \u002F block)\n\nFor agent workflows wiring Pilot to cub-scout, see [`scout-mcp`](..\u002Fscout-mcp\u002FSKILL.md) (Pilot can call `compare_source_truth` as an MCP tool) and the `pilot-*` skill set (planned in `#444`).\n\n## References\n\n- [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md) — verb-group skill for the four Compare verbs\n- [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md) — receipts as fingerprinted evidence\n- [`scout-govern`](..\u002Fscout-govern\u002FSKILL.md) — connected-mode trust surface\n- [`audit-fleet-conformance`](..\u002Faudit-fleet-conformance\u002FSKILL.md) — fleet-wide composition over per-resource source-truth\n- Source-truth contract: `#393` (parent), `#418` (Phase 2 enum expansion), `#395` (producer fixtures)\n- Read-only triad: `#410`, `#428`\n- Code: `pkg\u002Fagent\u002Fsource_truth.go`, `pkg\u002Fagent\u002Fsource_truth_logic.go` (`Derive`)\n- Examples: [`examples\u002Fconnect-and-compare\u002F`](..\u002F..\u002Fexamples\u002Fconnect-and-compare\u002F)\n\n## Constraints\n\n- **Strategy is always declared, never inferred.** This is the single most important contract rule. If the user doesn't know the strategy, the right answer is ASK + UNKNOWN, not a guess.\n- Connected mode is required. Standalone source-truth verdicts are meaningless (no ConfigHub surface to read).\n- The strategy enum is **closed** at 9 entries. New strategies require a `#393`-class issue and a code change. Don't claim cub-scout supports an unlisted strategy.\n- `helm-flux` \u002F `helm-argo` produce `runtime.helm_chart_anchor` proof gaps because the runtime extractor isn't fully wired. Surface the gap explicitly; don't pretend the verdict is comprehensive.\n- `confighub-oci-*` strategies also have an unshipped equality (ConfigHub doesn't yet expose a rendered digest per unit revision). The status field is correct; the per-field digest equality lands once the ConfigHub-side field exists.\n","# confighub-source-truth\n\nThe strategy-typed source-truth loop. The operator (or an acceptance kernel like Pilot) wants a **deterministic verdict** about whether ConfigHub \u002F controller \u002F runtime agree under a **declared delivery strategy**. cub-scout never infers the strategy — the user passes it; the verdict is then strategy-relative.\n\nComposes `compare source-truth --strategy \u003Cs>` + the source-truth evidence contract + optionally `receipt verify --strategy \u003Cs>` (to persist the verdict as a fingerprinted artifact).\n\nRequires **connected mode** (`cub auth login`).\n\n## When to use\n\nExplicit phrasings:\n\n- \"Give me a source-truth verdict for deploy\u002Fapi\"\n- \"Verify under `git-argo` strategy that ConfigHub matches the cluster\"\n- \"Run the source-truth contract for upstream Pilot acceptance\"\n- \"Compare source-truth `confighub-oci-flux` strategy across the namespace\"\n- \"Produce strategy-relative correctness evidence\"\n- \"Show me where the strategy declaration is being violated\"\n- \"Did the controller pull from the declared source?\"\n\nImplicit intents:\n\n- The user is operating in the **architectural triad** (cub-scout evidence ↔ ConfigHub authority ↔ Pilot judge); Pilot needs strategy-typed input\n- The user has a **declared expectation** about the delivery chain (`Git→Argo`, `ConfigHub→OCI→Flux`, etc.) and wants to check it\n- The user is gating CI \u002F promotion on conformance with the declared strategy\n- The user wants the **proof gaps** surfaced explicitly (the `omissions[]`-style contract is the whole point)\n\n## Do not load for\n\n- Single-resource live drift WITHOUT a declared strategy — [`investigate-drift`](..\u002Finvestigate-drift\u002FSKILL.md)\n- Triage of a broken workload — [`triage-unhealthy-workload`](..\u002Ftriage-unhealthy-workload\u002FSKILL.md)\n- Fleet-wide audit when strategy framing isn't needed — [`audit-fleet-conformance`](..\u002Faudit-fleet-conformance\u002FSKILL.md) (which itself can compose `compare source-truth` per resource, but the broader-scope skill is the right entry point)\n- Incident-evidence capture after the fact — [`operator-incident-evidence`](..\u002Foperator-incident-evidence\u002FSKILL.md)\n- Authoring source-truth strategies. The strategy enumeration is fixed (see below); proposing new ones is a `cub-scout\u002F#393`-class issue.\n\n## The nine strategies\n\ncub-scout's source-truth contract enumerates **nine strategies** (Phase 1 + Phase 2 from `#393` and `#418`). The user MUST pick one:\n\n| Strategy | Delivery chain | Controller |\n|----------|---------------|-----------|\n| `confighub-oci-argo` | ConfigHub authors a Unit → renders to OCI → Argo CD reads OCI → cluster | Argo |\n| `confighub-oci-flux` | Same authoring → Flux Kustomization reads OCI → cluster | Flux |\n| `git-argo` | Git → Argo CD → cluster (vanilla GitOps) | Argo |\n| `git-flux` | Git → Flux → cluster | Flux |\n| `helm-argo` | Helm chart → Argo as Helm renderer → cluster | Argo |\n| `helm-flux` | Helm chart → Flux helm-controller → cluster | Flux |\n| `kustomize-flux` | Kustomize base → Flux kustomize-controller → cluster | Flux |\n| `oci-argo` | OCI artifact (non-ConfigHub) → Argo → cluster | Argo |\n| `oci-flux` | OCI artifact (non-ConfigHub) → Flux → cluster | Flux |\n\nEach strategy declares **expected surfaces** (which of ConfigHub \u002F controller \u002F runtime is required), **expected controller kind** (Argo vs Flux — never silently fall back), and **strategy-implied authority** (which surface is canonical for the comparison).\n\nPick by what's deployed, not by what's convenient. If the user can't name the strategy, the right answer is **ASK** (the contract's fourth status), not a guess.\n\n## The four statuses + five verdicts\n\ncub-scout's source-truth contract emits two separate axes:\n\n**Status** (cub-scout's evidence-quality verdict):\n\n| Status | Meaning |\n|--------|---------|\n| `PASS` | All required surfaces present, all required equalities hold, no proof gaps. Pilot may accept. |\n| `WATCH` | Mostly present and consistent, but at least one soft signal warrants confirmation. |\n| `BLOCK` | A hard rule fails (strategy mismatch, controller-source resolution failure). Must not accept. |\n| `ASK` | cub-scout cannot classify deterministically. Used when strategy is unknown or surfaces fundamentally cannot be compared. |\n\n**Verdict** (cross-surface agreement, separate from status):\n\n| Verdict | Meaning |\n|---------|---------|\n| `AGREED` | The three surfaces line up under the declared strategy |\n| `MISMATCH` | At least one surface diverges from the strategy-implied authority |\n| `INCOMPLETE` | One or more surfaces missing required proof |\n| `BLOCKED` | cub-scout could not fetch one of the surfaces in read-only mode |\n| `UNKNOWN` | cub-scout has no opinion (used in ASK) |\n\nStatus and verdict ARE separate — a verdict can be `MISMATCH` while status is `BLOCK` (strategy violation) OR `WATCH` (soft mismatch with proof gaps). See `pkg\u002Fagent\u002Fsource_truth.go` for the closed enums.\n\n## The loop\n\n1. **Confirm connected mode.** `cub-scout status` must report connected; source-truth is meaningless without all three surfaces.\n2. **Declare the strategy.** The user MUST pass `--strategy \u003Cname>`. If they don't know, the answer is ASK + UNKNOWN.\n3. **Invoke per resource.** `cub-scout compare source-truth \u003Ckind>\u002F\u003Cname> -n \u003Cns> --strategy \u003Cs> --format json`.\n4. **Read the structured evidence.** Status + verdict + outlier + proof_gaps[] + safe_next_action + the three surfaces verbatim. See [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md).\n5. **Optionally persist as a receipt.** `cub-scout receipt verify \u003Ckind>\u002F\u003Cname> -n \u003Cns> --strategy \u003Cs> --save` produces a fingerprinted, immutable version Pilot or the audit log can attach to a decision. See [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md).\n\n## Step-by-step\n\n### Step 1 — confirm mode\n\n```bash\n$ cub-scout status --json\n{\n  \"mode\": \"connected\",\n  \"cluster_name\": \"default\",\n  \"context\": \"prod-use2\",\n  \"confighub_reads\": true\n}\n```\n\n`confighub_reads` is the answer: it is the verdict of the same gate `compare source-truth` itself uses. If it is `false`, refuse to claim a source-truth verdict and give the user `confighub_reads_reason` verbatim — it names the cause (an expired session, `cub` not installed, or ConfigHub reads turned off), and only one of those is fixed by `cub auth login`. Do not read the `ConfigHub:` mode line as the pre-flight: it describes `hub.confighub.com` and can say `● Connected` while every connected command refuses, or `○ Offline` against a self-hosted ConfigHub whose reads work. (Against v2.12.0 or earlier, which has no `confighub_reads` field, the mode line is all there is.)\n\n### Step 2 — pick the strategy\n\nMatch the actual delivery chain. Look at:\n\n- Workload labels (`argocd.argoproj.io\u002Finstance` → Argo; `kustomize.toolkit.fluxcd.io\u002Fname` → Flux Kustomization; `helm.toolkit.fluxcd.io\u002Fname` → Flux HelmRelease)\n- Argo Application spec (`spec.source.repoURL` — git URL vs OCI URL vs Helm chart URL)\n- Flux Kustomization spec (`spec.sourceRef.kind` — `GitRepository` vs `OCIRepository` vs `HelmRepository` vs `Bucket`)\n- ConfigHub linkage (`confighub.com\u002FUnitSlug` label, plus the unit's render target)\n\n`cub-scout explain \u003Ckind>\u002F\u003Cname>` surfaces all these in one read. From there, picking the strategy is mechanical:\n\n| You see... | Strategy is... |\n|-----------|----------------|\n| Argo + git source | `git-argo` |\n| Argo + OCI source (ConfigHub-rendered) | `confighub-oci-argo` |\n| Argo + OCI source (non-ConfigHub) | `oci-argo` |\n| Argo + Helm source | `helm-argo` |\n| Flux Kustomization + GitRepository | `git-flux` |\n| Flux Kustomization + OCIRepository | `confighub-oci-flux` (if ConfigHub-managed) or `oci-flux` |\n| Flux Kustomization (any source) | `kustomize-flux` (if specifically the kustomize rendering) |\n| Flux HelmRelease | `helm-flux` |\n\n### Step 3 — invoke\n\n```bash\n$ cub-scout compare source-truth deploy\u002Fapi -n prod --strategy git-argo --format json\n{\n  \"declared_strategy\": \"Git -> Argo -> Kubernetes\",\n  \"status\": \"PASS\",\n  \"source_truth\": \"AGREED\",\n  \"outlier\": \"unknown\",\n  \"surfaces\": {\n    \"confighub\": {\n      \"space\": \"payments\",\n      \"unit\": \"payments-api\",\n      \"revision\": \"42\",\n      \"url\": \"https:\u002F\u002Fhub.confighub.com\u002Fp\u002Fpayments\u002Fu\u002Fpayments-api\"\n    },\n    \"controller\": {\n      \"kind\": \"Argo\",\n      \"source\": \"https:\u002F\u002Fgithub.com\u002Forg\u002Fplatform-config\",\n      \"revision_or_digest\": \"abc123def456\",\n      \"health\": \"Synced\",\n      \"multi_source\": false\n    },\n    \"runtime\": {\n      \"resource\": \"Deployment\u002Fapi in prod\",\n      \"field\": \"spec.template.spec.containers[0].image\",\n      \"value\": \"ghcr.io\u002Forg\u002Fapi:v2.3.0\",\n      \"health\": \"Ready\"\n    }\n  },\n  \"proof_gaps\": [],\n  \"safe_next_action\": \"\"\n}\n```\n\nThe empty `proof_gaps[]` is the headline. `status: PASS`, `source_truth: AGREED`, all three surfaces present. Pilot accepts.\n\n### Step 4 — when the verdict is not PASS\n\n```bash\n$ cub-scout compare source-truth deploy\u002Fapi -n prod --strategy git-argo --format json\n{\n  \"declared_strategy\": \"Git -> Argo -> Kubernetes\",\n  \"status\": \"BLOCK\",\n  \"source_truth\": \"MISMATCH\",\n  \"outlier\": \"controller\",\n  ...\n  \"proof_gaps\": [],\n  \"safe_next_action\": \"Argo is tracking a different revision than the controller-resolved git anchor; investigate the divergence before any apply.\"\n}\n```\n\n`status: BLOCK` + `outlier: controller` = the controller is the surface diverging from the strategy-implied authority. The `safe_next_action` field names the next read-only step (never a mutation).\n\n### Step 5 — persist as a receipt (optional)\n\nFor Pilot acceptance kernels or audit trails:\n\n```bash\n$ cub-scout receipt verify deploy\u002Fapi -n prod --strategy git-argo --save\nsaved: \u002Fhome\u002Fuser\u002F.local\u002Fshare\u002Fcub-scout\u002Freceipts\u002F2026-05-22T10-30-00Z__source-truth-pass__Deployment-api__abc123.receipt.json\n```\n\nThe receipt wraps the source-truth evidence (verbatim) in an in-toto Statement v1 envelope with a SHA-256 fingerprint. Strategy mismatch between the caller and the evidence body is itself a BLOCK + `OmissionStrategyMismatch` — see [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md).\n\nReceipts are **immutable**. Same scope + same fingerprint at the same instant → same canonical filename → \"already saved\" warning (file unchanged).\n\n## Strategy-relative correctness\n\nThis is the contract's central rule: **identical observations get opposite verdicts under different declared strategies**.\n\nExample: an Argo CD Application reading from a git URL.\n\n- Under `--strategy git-argo`: PASS \u002F AGREED. Argo reads Git; Git is the declared source; cluster matches Git. All good.\n- Under `--strategy confighub-oci-argo`: BLOCK \u002F MISMATCH (outlier: controller). The strategy declares Argo should be reading from a ConfigHub-rendered OCI artifact — not Git. Argo is the outlier.\n\nSame Argo, same git, same cluster, opposite verdict. Strategy declaration changes the question.\n\nLock that in your head: cub-scout doesn't grade the deployment — cub-scout grades it **against the declared strategy**. This is why `--strategy` is mandatory.\n\n## Proof gaps\n\nEven on PASS \u002F WATCH outcomes, `proof_gaps[]` lists the things cub-scout couldn't fully verify:\n\n- `controller.revision_or_digest` — controller didn't expose its revision\u002Fdigest\n- `confighub.unit_revision` — unit didn't have a revision number (rare; ConfigHub usually populates)\n- `runtime.helm_chart_anchor` — Helm chart version not extractable from runtime (Phase 2 strategies; the chart-version extractor isn't fully wired — see #409)\n- `controller.multi_source` — Argo `spec.sources[]` has len > 1; cub-scout uses index 0, can't verify equality across sources\n\nProof gaps are **not failures**. They're explicit non-claims (the same pattern as receipt omissions). Pilot reads them and decides whether to accept the verdict given the named gaps.\n\n## Tool boundary\n\n- **Allowed:** `compare source-truth`, `compare three-way` (for the broader DRY\u002FWET\u002FLIVE context); `receipt verify --strategy --save`, `receipt show \u002F list \u002F validate`; `explain`, `trace`, `status`; `cub \u003Centity> get \u002F list` for the entities named in allowed-tools; `cub auth status`; `argocd app get`, `flux get`.\n- **Not allowed:** any mutation. `cub * create\u002Fupdate\u002Fdelete`, `argocd app sync`, `flux reconcile`, `kubectl apply\u002Fedit\u002Fpatch\u002Fdelete`, `cub-scout demo \u002F import apply`. The verdict is evidence; remediation is the user's call (or Pilot's downstream).\n\n## Pilot integration\n\ncub-scout's source-truth contract is the canonical input for **Pilot**, the architectural-triad acceptance judge tracked alongside cub-scout in `#444`. Pilot reads source-truth evidence + receipts and produces verdicts that gate CD \u002F promotion \u002F rollback \u002F compliance.\n\n- cub-scout = evidence (this skill produces it)\n- ConfigHub = authority (where the unit \u002F Link \u002F target lives)\n- Pilot = judge (decides accept \u002F wait \u002F block)\n\nFor agent workflows wiring Pilot to cub-scout, see [`scout-mcp`](..\u002Fscout-mcp\u002FSKILL.md) (Pilot can call `compare_source_truth` as an MCP tool) and the `pilot-*` skill set (planned in `#444`).\n\n## References\n\n- [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md) — verb-group skill for the four Compare verbs\n- [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md) — receipts as fingerprinted evidence\n- [`scout-govern`](..\u002Fscout-govern\u002FSKILL.md) — connected-mode trust surface\n- [`audit-fleet-conformance`](..\u002Faudit-fleet-conformance\u002FSKILL.md) — fleet-wide composition over per-resource source-truth\n- Source-truth contract: `#393` (parent), `#418` (Phase 2 enum expansion), `#395` (producer fixtures)\n- Read-only triad: `#410`, `#428`\n- Code: `pkg\u002Fagent\u002Fsource_truth.go`, `pkg\u002Fagent\u002Fsource_truth_logic.go` (`Derive`)\n- Examples: [`examples\u002Fconnect-and-compare\u002F`](..\u002F..\u002Fexamples\u002Fconnect-and-compare\u002F)\n\n## Constraints\n\n- **Strategy is always declared, never inferred.** This is the single most important contract rule. If the user doesn't know the strategy, the right answer is ASK + UNKNOWN, not a guess.\n- Connected mode is required. Standalone source-truth verdicts are meaningless (no ConfigHub surface to read).\n- The strategy enum is **closed** at 9 entries. New strategies require a `#393`-class issue and a code change. Don't claim cub-scout supports an unlisted strategy.\n- `helm-flux` \u002F `helm-argo` produce `runtime.helm_chart_anchor` proof gaps because the runtime extractor isn't fully wired. Surface the gap explicitly; don't pretend the verdict is comprehensive.\n- `confighub-oci-*` strategies also have an unshipped equality (ConfigHub doesn't yet expose a rendered digest per unit revision). The status field is correct; the per-field digest equality lands once the ConfigHub-side field exists.\n",{"name":5,"phase":52,"description":7,"allowed-tools":53},"cross-cutting","Bash(.\u002Fcub-scout compare source-truth *) Bash(cub-scout compare source-truth *) Bash(cub scout compare source-truth *) Bash(.\u002Fcub-scout compare three-way *) Bash(cub-scout compare three-way *) Bash(cub scout compare three-way *) Bash(.\u002Fcub-scout receipt verify *) Bash(cub-scout receipt verify *) Bash(cub scout receipt verify *) Bash(.\u002Fcub-scout receipt show *) Bash(cub-scout receipt show *) Bash(cub scout receipt show *) Bash(.\u002Fcub-scout receipt list *) Bash(cub-scout receipt list *) Bash(cub scout receipt list *) Bash(.\u002Fcub-scout explain *) Bash(cub-scout explain *) Bash(cub scout explain *) Bash(.\u002Fcub-scout trace *) Bash(cub-scout trace *) Bash(cub scout trace *) Bash(.\u002Fcub-scout status) Bash(cub-scout status) Bash(cub scout status) Bash(kubectl get *) Bash(cub space list *) Bash(cub unit get *) Bash(cub unit list *) Bash(cub link get *) Bash(cub link list *) Bash(cub view get *) Bash(cub view list *) Bash(cub unit-event list *) Bash(cub resource list *) Bash(cub release list *) Bash(cub changeset list *) Bash(cub auth status) Bash(argocd app get *) Bash(flux get *)","main","261862e7ec5e5c93ce377ccfd6b583f5ac03c95c","skills\u002Fconfighub-source-truth",1,"https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout","https:\u002F\u002Fconfighub.com","https:\u002F\u002Fgithub.com\u002Fconfighub","http:\u002F\u002Fwww.confighub.com","Public repo for ConfigHub","2026-11-14 03:24:15",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add confighub\u002Fcub-scout --skill confighub-source-truth",{"tool":70,"command":71},"bunx","bunx skills add confighub\u002Fcub-scout --skill confighub-source-truth",{"tool":73,"command":74},"pnpm","pnpm dlx skills add confighub\u002Fcub-scout --skill confighub-source-truth","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fconfighub-source-truth\u002FSKILL.md",true,[],[79,109,127,146,171,193],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":90,"publishedAt":47},"01M6CBPQHTK7YGVZD3MMH1328H","triage-unhealthy-workload","Use when the user is responding to a broken Kubernetes workload UNDER TIME PRESSURE — pager-going-off, CI-red, \"prod is down\" framing. Natural phrasing: \"deploy\u002Fapi is CrashLoopBackOff, what now?\", \"the rollout is stuck, help\", \"this pod won't start\", \"pager fired on payments\", \"everything is red in argocd\", \"what should I check first?\", \"give me a triage plan for this workload\". Composes doctor → explain → trace into a tight ~30-second loop the operator can run in a pager-acknowledged context. Do NOT load for: a planned investigation without urgency (use scout-diagnose directly), a drift question (use investigate-drift), or anything mutating (cub-scout never mutates — route to kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Ftriage-unhealthy-workload\u002FSKILL.md",[85],{"categoryNo":86,"categoryName":87,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[91,92,93,94,95,96,97,98,99,41,39,100,38,101,102,36,21,103,31,104,105,27,106,107,26,108,22],"triage","workload","triage unhealthy workload","kubernetes","diagnose","doctor","logs","ci","payments","loop","check","broken","rollout","cub scout","route","map","time","now",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":47},"01M6CBPKYVREY83CQYNFW6BVD0","scout-verify","Use when the user wants a TYPED, FINGERPRINTED, IMMUTABLE evidence artifact about a Kubernetes resource — the Verify verb group of cub-scout (the receipt capability shipped in #446). Natural phrasing: \"produce a receipt that this is in compliance\", \"give me an attestation that the cluster matches Git\", \"I need a verifiable record for the audit trail\", \"build a receipt verifying no manual edits since deploy\", \"verify deploy\u002Fapi against source-truth and save the artifact\", \"validate this receipt has not been tampered with\", \"show me what receipts we have\", \"is this receipt tampered with?\", \"attach evidence to my CI gate\". Load whenever intent is receipt \u002F attestation \u002F evidence-artifact \u002F tamper-evident-record \u002F verified-record \u002F audit-trail \u002F postmortem-evidence \u002F acceptance-judge-input. Do NOT load for: a live comparison without a persisted artifact (use scout-compare), interpreting a single field's provenance (use scout-attribute), or actually applying a fix (cub-scout never mutates — route to cub \u002F argocd \u002F kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-verify\u002FSKILL.md",[115],{"categoryNo":86,"categoryName":87,"taxonomyType":88,"taxonomyTypeDesc":89},[117,118,119,94,44,43,98,120,121,41,40,39,122,37,123,35,124,21,31,30,104,28,105,125,26,25,24,126,22],"verify","scout verify","scout","attestation","provenance","postmortem","argocd","fix","me","managed",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":47},"01M6CBPF8WZBM7F9X096WT8PJD","scout-observe","Use when the user wants to SEE what is running in a Kubernetes cluster, who owns it, and how it is structured — the read-only Observe verb group of cub-scout. Natural phrasing: \"what is running in my cluster?\", \"give me a map of resources\", \"who owns this Deployment?\", \"trace this back to its source\", \"show me the ownership tree\", \"scan this cluster for risk\", \"dump the cluster as JSON\", \"stream cluster events\", \"run cub-scout as a bot\", \"what is the connection status?\", \"is this cluster healthy?\". Load when intent is observe \u002F inventory \u002F map \u002F show \u002F list \u002F trace \u002F scan \u002F dump \u002F stream \u002F bot \u002F health-check over a Kubernetes cluster. Do NOT load for: explaining WHY something is broken (use scout-diagnose), comparing cluster state to intended state (use scout-compare), provenance of individual field values (use scout-attribute), or any action that mutates the cluster (cub-scout never mutates — route to cub or kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-observe\u002FSKILL.md",[],[134,135,119,136,94,95,137,96,97,138,121,139,40,39,102,21,32,31,140,141,104,28,142,143,106,26,144,145,22],"observe","scout observe","bot","deployment","risk","inventory","only","hooks","back","health-check","resources","meaning",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":155,"publishedAt":47},"01M6CBPBM5J9PX4H8CE628AY5X","scout-mcp","Use when the user wants to expose cub-scout to an AI agent over MCP, wants a deterministic AI-ready snapshot of cluster context, or wants cub-scout running as a read-only event bot — the Integrate verb group. Natural phrasing: \"start the MCP server\", \"expose cub-scout to Claude \u002F Codex \u002F my agent\", \"give me an AI-ready context pack of this cluster\", \"set up the MCP gateway\", \"what MCP tools does cub-scout expose?\", \"run cub-scout as a bot\", \"produce JSON context for an LLM to reason about this cluster\". Load whenever intent is mcp \u002F mcp-gateway \u002F mcp-serve \u002F context-pack \u002F bot \u002F agent-context \u002F ai-snapshot \u002F llm-context \u002F model-context-protocol. Do NOT load for: actually running a non-integrate verb (those are scout-observe \u002F scout-diagnose \u002F scout-compare \u002F scout-attribute \u002F scout-ingest \u002F scout-govern \u002F scout-verify), or `cub` MCP integration (that's a separate tool surface).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-mcp\u002FSKILL.md",[152],{"categoryNo":153,"categoryName":154,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000023","Skill与智能体开发",[156,157,119,136,158,159,45,160,161,162,163,164,39,165,37,166,167,140,168,169,134,26,24,170,22],"MCP","scout mcp","mcp server","ai agent","config","run","release","server","SET","model","read","snapshot","ready","up","agent-context",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":47},"01M6CBP7D72G704FWGRXNB6F9T","scout-ingest","Use when the user wants to ADOPT existing Kubernetes \u002F GitOps workload structure into ConfigHub after observing the live cluster — the adoption\u002Fimport verb group of cub-scout. Natural phrasing: \"discover workloads in this cluster and propose ConfigHub units\", \"show me the import proposal before I apply\", \"import this Argo Application set\", \"bring my Flux Kustomizations into ConfigHub\", \"preview what would land in ConfigHub if I imported this repo\", \"parse my git repo as a ConfigHub import bundle\", \"import a cluster aggregator\", \"what would --git-path produce for this repo?\". Load whenever intent is adopt \u002F import \u002F ingest \u002F preview \u002F propose \u002F parse-repo \u002F discovery \u002F aggregator \u002F bring-into-confighub \u002F what-would-confighub-see. Do NOT load for: questions about who changed a resource, whether it was edited by hand or drifted (use scout-attribute or investigate-drift); reading an exported `kubectl get -o yaml` dump to answer a question about the cluster (that is not an import); basic live-cluster inventory (use scout-observe), troubleshooting (use scout-diagnose), comparing live state to ConfigHub (use scout-compare), or the actual write to ConfigHub via `cub variant upload` (that is `cub`, not cub-scout — route to cub skills). Important: `cub-scout import apply` IS the mutating write into ConfigHub — this skill teaches the read-only preview path and explicitly refuses to invoke `import apply` itself.","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-ingest\u002FSKILL.md",[],[178,179,119,94,95,162,180,43,181,164,139,182,40,39,37,183,36,166,184,35,21,140,134,104,28,185,186,187,188,25,24,189,190,191,192],"ingest","scout ingest","state","adoption","discovery","repo","write","structure","aggregator","adopt","argo","reading","exported","invoke","parse",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":199,"publishedAt":47},"01M6CBP32CYJT8DJSGNCRWXQTM","scout-govern","Use when the user wants to consume CONNECTED ConfigHub governance signals from cub-scout — the Govern verb group. Natural phrasing: \"show me the ChangeSet history for this unit\", \"what is the blast radius if I change this unit?\", \"which clusters in my fleet are outliers?\", \"show me yesterday's connected summary\", \"render this view across the fleet\", \"audit who changed this\", \"where did the last apply come from?\", \"list ConfigHub bundles I have\", \"show me the catalog of past snapshots\". Load whenever intent is history \u002F impact \u002F blast-radius \u002F fleet-outliers \u002F summary \u002F view \u002F audit \u002F bundle \u002F catalog \u002F connected-context. Do NOT load for: live cluster comparison (use scout-compare), receipts (use scout-verify), inventory of running pods (use scout-observe), or any mutation via cub. Most of this skill requires `cub auth login` — say so upfront.","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-govern\u002FSKILL.md",[],[200,119,201,45,202,203,204,139,117,40,39,205,37,35,206,21,207,208,209,134,104,28,210,26,211,212,24,213,214,215,216,22],"scout govern","change","governance","blast radius","audit","history","catalog","diff","say","snapshots","project","mutation","impact","render","blast-radius","which","inspect"]