[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CBJXFJV7QKA1V5KH9JZ2HP":3,"skill-same:01M6CBJXFJV7QKA1V5KH9JZ2HP":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":56,"ownerHtmlUrl":57,"ownerBlogUrl":58,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M6CBJXFJV7QKA1V5KH9JZ2HP","cub-scout",null,"Use when working in the cub-scout repo or when answering capability-assistant questions (\"can cub-scout do X?\", \"should I use cub-scout or kubectl here?\", \"how does cub-scout differ from cub?\"). This is the umbrella router — it points you at the verb-grouped scenario skills under `skills\u002Fscout-*\u002F` and the workflow \u002F observer \u002F reference skills planned for batches 2–5. For a specific verb-group task (observe \u002F diagnose \u002F compare \u002F attribute \u002F adopt existing config \u002F govern \u002F integrate \u002F verify) load the corresponding `scout-*` skill directly.","confighub\u002Fcub-scout","confighub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206140369?v=4","01M6CBJBWD33AFNG4VXMJHSRXD","ConfigHub Inc","01M6CBJC0K0F8CJVFWGRSR0KYC",14,"MIT","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fcub-scout\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"scout","cub scout","integrate","when","capability","for","at","you","scenario","adopt","do","reference","observe","assistant","router","use","repo","Bash","how","verify","kubectl","help","diagnose","config","workflow","2026-11-10 10:12:30",false,"---\nname: cub-scout\ndescription: Use when working in the cub-scout repo or when answering capability-assistant questions (\"can cub-scout do X?\", \"should I use cub-scout or kubectl here?\", \"how does cub-scout differ from cub?\"). This is the umbrella router — it points you at the verb-grouped scenario skills under `skills\u002Fscout-*\u002F` and the workflow \u002F observer \u002F reference skills planned for batches 2–5. For a specific verb-group task (observe \u002F diagnose \u002F compare \u002F attribute \u002F adopt existing config \u002F govern \u002F integrate \u002F verify) load the corresponding `scout-*` skill directly.\nphase: cross-cutting\nallowed-tools: Bash(.\u002Fcub-scout --help) Bash(.\u002Fcub-scout help *) Bash(cub-scout --help) Bash(cub-scout help *) Bash(cub scout --help) Bash(cub scout help *)\n---\n\n# cub-scout (umbrella router)\n\nThis skill is the cross-cutting entry point. It picks the right verb-grouped skill for a user's question and explains the cub-scout \u002F `cub` boundary. For specific tasks, load the scenario skill directly.\n\n## When to use\n\n- \"Can cub-scout do X?\" \u002F \"what can cub-scout observe \u002F diagnose \u002F compare?\"\n- \"How does cub-scout differ from cub \u002F kubectl \u002F Argo \u002F Flux?\"\n- \"Should I use cub-scout or [other tool] for this?\"\n- Anything in this repo where the verb group isn't obvious from the prompt\n- General capability-assistant or demo conversations\n\n## Do not load for\n\n- A specific verb-grouped task — load the corresponding `scout-*` skill directly:\n  - [`scout-observe`](..\u002Fscout-observe\u002FSKILL.md) — see what's running\n  - [`scout-diagnose`](..\u002Fscout-diagnose\u002FSKILL.md) — interpret + recommend\n  - [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md) — intended vs actual\n  - [`scout-attribute`](..\u002Fscout-attribute\u002FSKILL.md) — provenance of field values\n  - [`scout-ingest`](..\u002Fscout-ingest\u002FSKILL.md) — adopt existing config into ConfigHub with preview first\n  - [`scout-govern`](..\u002Fscout-govern\u002FSKILL.md) — connected governance signals\n  - [`scout-mcp`](..\u002Fscout-mcp\u002FSKILL.md) — MCP gateway + context-pack\n  - [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md) — typed, fingerprinted evidence receipts\n- ConfigHub authoring or any mutating workflow — load [`confighub\u002Fconfighub-skills`](https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fconfighub-skills) skills (`cub-mutate`, `cub-apply`, etc.)\n- Live cluster mutation — cub-scout never mutates; route to `kubectl` (user driven) or a `cub` skill\n\n## Capability map (verb groups → skills)\n\n| Group | Skill | Status |\n|---|---|---|\n| Observe | [`scout-observe`](..\u002Fscout-observe\u002FSKILL.md) | shipped (batch 1) |\n| Diagnose | [`scout-diagnose`](..\u002Fscout-diagnose\u002FSKILL.md) | shipped (batch 1) |\n| Compare | [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md) | shipped (batch 1) |\n| Attribute | [`scout-attribute`](..\u002Fscout-attribute\u002FSKILL.md) | shipped (batch 1) |\n| Govern | [`scout-govern`](..\u002Fscout-govern\u002FSKILL.md) | shipped (batch 2) |\n| Adopt Existing Config | [`scout-ingest`](..\u002Fscout-ingest\u002FSKILL.md) | shipped (batch 2) |\n| Integrate | [`scout-mcp`](..\u002Fscout-mcp\u002FSKILL.md) | shipped (batch 2) |\n| Verify | [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md) | shipped (batch 2, consuming the `#446` receipt capability) |\n\nSee [`skills\u002FREADME.md`](..\u002FREADME.md) for the full plan including controller observer skills (`observe-argocd`, `observe-flux`, `observe-sveltos`, `observe-modelplane`, `observe-helm`, `observe-crossplane`, `observe-kro`), workflow scenario skills (`triage-unhealthy-workload`, `investigate-drift`, `audit-fleet-conformance`, etc.), and shared references.\n\n### Pilot–cub-scout integration scenarios (`#444`)\n\nThe consumer-side complement: same cub-scout verbs framed around **Pilot** (the acceptance judge) rendering verdicts from cub-scout's evidence. Load one of these instead of a `scout-*` skill when the user's prompt is shaped as \"Pilot, decide ...\" or \"render the verdict ...\". `#444` is complete: 9 scenarios shipped across batches A and B.\n\n| Scenario | Skill | Pilot consumes | Pilot decides |\n|---|---|---|---|\n| Pre-deploy CD gate | [`pilot-cd-gate`](..\u002Fpilot-cd-gate\u002FSKILL.md) | `compare source-truth --strategy \u003Cs>` + optional `receipt verify --fail-on any-non-pass` | PASS \u002F WATCH \u002F ASK \u002F BLOCK on the release |\n| Fleet-wide conformance | [`pilot-fleet-conformance`](..\u002Fpilot-fleet-conformance\u002FSKILL.md) | `compare three-way --view` + per-resource source-truth + `fleet outliers` | Fleet verdict + per-resource breakdown |\n| Drift classification | [`pilot-patch-and-drift`](..\u002Fpilot-patch-and-drift\u002FSKILL.md) | attribution evidence (`cause` \u002F `managerHint` \u002F `gitSource` \u002F `bindingSource`) | revert \u002F quarantine \u002F accept-as-canonical \u002F ASK |\n| Real-time watch response | [`pilot-watch-alert-response`](..\u002Fpilot-watch-alert-response\u002FSKILL.md) | `cub-scout watch` \u002F `cub-scout bot` event stream with `--emit-receipt-on` inline receipts (v2 #463) | Per-event PASS \u002F WATCH \u002F ASK \u002F BLOCK |\n| Incident close-out | [`pilot-incident-evidence`](..\u002Fpilot-incident-evidence\u002FSKILL.md) | trace + explain + compare + bundle + history + audit + chained receipts (`--input-attestation`, v2 #463) | Incident verdict + immutable evidence pack |\n| Rollback decision | [`pilot-rollback-decision`](..\u002Fpilot-rollback-decision\u002FSKILL.md) | `history` + `impact` + per-candidate `receipt verify --at-commit \u003Csha>` chained into chosen-target receipt | Rollback target SHA + safety verdict |\n| Promotion gate | [`pilot-promotion-gate`](..\u002Fpilot-promotion-gate\u002FSKILL.md) | `compare three-way` per variant + `bindingSource` graph diff + chained variant-A receipt | Cross-variant PASS \u002F WATCH \u002F ASK \u002F BLOCK with diff reasons |\n| Compliance audit | [`pilot-compliance-audit`](..\u002Fpilot-compliance-audit\u002FSKILL.md) | scope-wide source-truth + `scan` + `audit list` + per-resource saved receipts | Compliance report (Compliant \u002F with-caveats \u002F Non-compliant \u002F Insufficient-evidence) + fingerprinted evidence inventory |\n| Release verification | [`pilot-release-verification`](..\u002Fpilot-release-verification\u002FSKILL.md) | `gitops status --with-confighub` + `compare three-way` + `history --since \u003Cdeploy-time>` + receipt evidence; `summary.agreement` and `deliveryEvidence` drive convergence signals | Post-deploy PASS \u002F WATCH (wait) \u002F BLOCK \u002F ASK |\n\n## Product value in one breath\n\n**cub scout observes and explains; it never decides.** It is the read-only Kubernetes and GitOps observer — it surfaces evidence about ownership, health, drift, and provenance, but it never mutates the cluster and never makes authority calls about what *should* be true. ConfigHub (driven by `cub`) is the authority; cub-scout is the witness.\n\n`cub scout` is the preferred documented form. In this repo, use `.\u002Fcub-scout ...` for exact local commands.\n\n## Tool boundaries\n\n### Use `cub scout` for\n\n- **Observe** — `doctor`, `map`, `trace`, `tree`, `scan`, `graph`, `snapshot`, `watch`, `bot`, `status`\n- **Diagnose** — `explain`, `debug`, `suggest-remedy`, `patterns`, `gitops status`\n- **Compare** — `compare drift`, `compare three-way`, `compare source-truth`, `compare \u003Ckind>\u002F\u003Cname>`\n- **Attribute** — read `cause` \u002F `managerHint` \u002F `gitSource` \u002F `bindingSource` on `compare` and `explain` JSON\n- **Adopt Existing Config** (preview first) — `import --dry-run`, `import --from-bundle`, `import --git-path`, `import parse-repo`, `import argocd`, `import cluster-aggregator`\n- **Govern** (connected) — `history`, `impact`, `fleet outliers`, `summary`, `views resolve`, `audit list`, `bundle inspect\u002Fdiff\u002Ftimeline`, `catalog list`\n- **Integrate** — `mcp serve`, `context-pack`, `bot`\n- **Verify** — `receipt verify \u002F show \u002F validate \u002F list` (typed, fingerprinted evidence; `receipt verify \u003Ckind>\u002F\u003Cname> --with-confighub` can freeze object-correlated delivery evidence under `predicate.evidence.deliveryEvidence`)\n\n### Use `cub` for\n\n- ConfigHub intended-state workflows\n- spaces, units, targets, workers\n- `cub variant upload` (load already-rendered resources as units)\n- `cub link list \u002F get` (the data feed for cub-scout's connected attribution layer)\n- Any mutation — `cub` is the writer side of the triad\n\n### Do not blur these\n\n- `cub-scout import --git-path` is a local structure \u002F import-preview flow — it does *not* render manifests or upload to ConfigHub\n- `cub variant upload` ingests already-rendered resources and writes them as units — it renders nothing, and `cub gitops discover` \u002F `cub gitops import` no longer exist (removed from cub 2026-07-25, #573)\n- SDK renderers are an implementation detail for `cub`, not an implied cub-scout feature\n- Attribution evidence on `compare` \u002F `explain` JSON is read-only enrichment — never implies a write\n\n## High-signal shipped capabilities\n\n- **Attribution layer** (#435 — A1+A1.5+A2 in #437, C1 in #438, C2 in #439, stage B in #440): `cause` + `managerHint` + `gitSource{repoUrl,revision,path,file,line}` + `bindingSource` on every field mismatch. See [`scout-attribute`](..\u002Fscout-attribute\u002FSKILL.md).\n- **Source-truth contract** (#393 + #418): `compare source-truth` with Phase 1 + Phase 2 strategies (9 total).\n- **Views integration** (#391): `views resolve`, `views open`, `views project --with-reality`, `compare three-way --view`.\n- **`doctor` \u002F `explain`** with `--presentation` and `--hint-mode`.\n- **MCP gateway** (`mcp serve`): standalone + connected tool sets, including `gitops_status` for GitOps delivery and controller-coverage evidence.\n- **ConfigHub delivery evidence**: `gitops status --with-confighub`, `doctor --with-confighub`, `map activity --with-confighub`, `trace --with-confighub`, `explain --with-confighub`, and single-resource `receipt verify --with-confighub` add bounded release history, unit events, live-status freshness, and event-consumer health. `doctor` adds a scope-level `delivery` rollup, `map activity` renders the evidence as timeline rows, and receipts freeze object-correlated snapshots as fingerprint-covered supporting evidence.\n- **Controller-family coverage**: `gitops status` emits `controllerCoverage[]` for Flux, Argo CD, ConfigHub, Sveltos, and Modelplane so absence and RBAC\u002FAPI omissions stay distinguishable.\n- **Stage B back-resolution** (#440): `compare three-way --source-path \u003Clocal-checkout>` populates `gitSource.file:line` for raw YAML manifests.\n- **Receipt capability** (#446 — v1 complete; #454 + #455 + #456): typed, fingerprinted, immutable evidence artifacts wrapping cub-scout evidence into an in-toto Statement v1 envelope. Three predicates: `applied-matches-spec`, `source-truth-pass`, `no-manual-edits-since`. `verify` \u002F `show` \u002F `validate` \u002F `list` + local store with immutable canonical filenames. See [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md).\n\n## Read first (for capability-assistant work)\n\n1. [`AI-README-FIRST.md`](..\u002F..\u002FAI-README-FIRST.md) — cold-start guide, current shipped capabilities, current open queue\n2. [`HANDOVER.md`](..\u002F..\u002FHANDOVER.md) — latest execution snapshot\n3. [`README.md`](..\u002F..\u002FREADME.md) § \"Capability Map\" — the eight verb groups\n4. [`docs\u002Freference\u002Fcommands.md`](..\u002F..\u002Fdocs\u002Freference\u002Fcommands.md) — exact command surface\n5. [`docs\u002Freference\u002Fjson-contracts.md`](..\u002F..\u002Fdocs\u002Freference\u002Fjson-contracts.md) — JSON shapes\n6. `references\u002Fcapability-assistant.md` (in this directory) — the original capability-assistant profile, kept for back-compatibility\n\n## Verification rule\n\nDo not invent command surfaces.\n\nVerify from local help before claiming capability. `help \u003Ccommand>` is the\nauto-approved form. `\u003Ccommand> --help` is not: a wildcard grant for it would\nalso admit `import -y --audit-reason --help`, where `--help` is the flag's\nvalue and the import runs:\n\n```bash\n.\u002Fcub-scout --help\n.\u002Fcub-scout help doctor\n.\u002Fcub-scout help explain\n.\u002Fcub-scout help compare three-way\n.\u002Fcub-scout help compare source-truth\n.\u002Fcub-scout help import\n.\u002Fcub-scout help views\n.\u002Fcub-scout help mcp serve\n```\n\nWhen the workflow crosses into ConfigHub:\n\n```bash\ncub variant upload --help\ncub k8s --help\ncub link --help\ncub link list --help\n```\n\n## Safety rule (read-only triad lock — #410 \u002F #428)\n\n- `cub-scout` is cluster read-only by default\n- connected import writes inventory \u002F state to ConfigHub, **not** cluster manifests\n- prefer preview or dry-run paths first\n- attribution evidence is enrichment, never mutation\n- `suggest-remedy` describes a fix; it does not apply it (the executor was removed in #428)\n\n## Authoring guidance for new skills\n\nWhen adding skills under `skills\u002F`, follow:\n\n- [`skills\u002FSKILL_TEMPLATE.md`](..\u002FSKILL_TEMPLATE.md) — the canonical template (cub-scout, read-only variant)\n- The read-only-triad invariant — no mutating patterns in `allowed-tools`, ever\n- Standalone-first worked examples; connected-mode is the enrichment\n- CI-tool-neutral wording — no GitHub Actions \u002F GitLab CI \u002F Jenkins-specific syntax committed\n","# cub-scout (umbrella router)\n\nThis skill is the cross-cutting entry point. It picks the right verb-grouped skill for a user's question and explains the cub-scout \u002F `cub` boundary. For specific tasks, load the scenario skill directly.\n\n## When to use\n\n- \"Can cub-scout do X?\" \u002F \"what can cub-scout observe \u002F diagnose \u002F compare?\"\n- \"How does cub-scout differ from cub \u002F kubectl \u002F Argo \u002F Flux?\"\n- \"Should I use cub-scout or [other tool] for this?\"\n- Anything in this repo where the verb group isn't obvious from the prompt\n- General capability-assistant or demo conversations\n\n## Do not load for\n\n- A specific verb-grouped task — load the corresponding `scout-*` skill directly:\n  - [`scout-observe`](..\u002Fscout-observe\u002FSKILL.md) — see what's running\n  - [`scout-diagnose`](..\u002Fscout-diagnose\u002FSKILL.md) — interpret + recommend\n  - [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md) — intended vs actual\n  - [`scout-attribute`](..\u002Fscout-attribute\u002FSKILL.md) — provenance of field values\n  - [`scout-ingest`](..\u002Fscout-ingest\u002FSKILL.md) — adopt existing config into ConfigHub with preview first\n  - [`scout-govern`](..\u002Fscout-govern\u002FSKILL.md) — connected governance signals\n  - [`scout-mcp`](..\u002Fscout-mcp\u002FSKILL.md) — MCP gateway + context-pack\n  - [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md) — typed, fingerprinted evidence receipts\n- ConfigHub authoring or any mutating workflow — load [`confighub\u002Fconfighub-skills`](https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fconfighub-skills) skills (`cub-mutate`, `cub-apply`, etc.)\n- Live cluster mutation — cub-scout never mutates; route to `kubectl` (user driven) or a `cub` skill\n\n## Capability map (verb groups → skills)\n\n| Group | Skill | Status |\n|---|---|---|\n| Observe | [`scout-observe`](..\u002Fscout-observe\u002FSKILL.md) | shipped (batch 1) |\n| Diagnose | [`scout-diagnose`](..\u002Fscout-diagnose\u002FSKILL.md) | shipped (batch 1) |\n| Compare | [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md) | shipped (batch 1) |\n| Attribute | [`scout-attribute`](..\u002Fscout-attribute\u002FSKILL.md) | shipped (batch 1) |\n| Govern | [`scout-govern`](..\u002Fscout-govern\u002FSKILL.md) | shipped (batch 2) |\n| Adopt Existing Config | [`scout-ingest`](..\u002Fscout-ingest\u002FSKILL.md) | shipped (batch 2) |\n| Integrate | [`scout-mcp`](..\u002Fscout-mcp\u002FSKILL.md) | shipped (batch 2) |\n| Verify | [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md) | shipped (batch 2, consuming the `#446` receipt capability) |\n\nSee [`skills\u002FREADME.md`](..\u002FREADME.md) for the full plan including controller observer skills (`observe-argocd`, `observe-flux`, `observe-sveltos`, `observe-modelplane`, `observe-helm`, `observe-crossplane`, `observe-kro`), workflow scenario skills (`triage-unhealthy-workload`, `investigate-drift`, `audit-fleet-conformance`, etc.), and shared references.\n\n### Pilot–cub-scout integration scenarios (`#444`)\n\nThe consumer-side complement: same cub-scout verbs framed around **Pilot** (the acceptance judge) rendering verdicts from cub-scout's evidence. Load one of these instead of a `scout-*` skill when the user's prompt is shaped as \"Pilot, decide ...\" or \"render the verdict ...\". `#444` is complete: 9 scenarios shipped across batches A and B.\n\n| Scenario | Skill | Pilot consumes | Pilot decides |\n|---|---|---|---|\n| Pre-deploy CD gate | [`pilot-cd-gate`](..\u002Fpilot-cd-gate\u002FSKILL.md) | `compare source-truth --strategy \u003Cs>` + optional `receipt verify --fail-on any-non-pass` | PASS \u002F WATCH \u002F ASK \u002F BLOCK on the release |\n| Fleet-wide conformance | [`pilot-fleet-conformance`](..\u002Fpilot-fleet-conformance\u002FSKILL.md) | `compare three-way --view` + per-resource source-truth + `fleet outliers` | Fleet verdict + per-resource breakdown |\n| Drift classification | [`pilot-patch-and-drift`](..\u002Fpilot-patch-and-drift\u002FSKILL.md) | attribution evidence (`cause` \u002F `managerHint` \u002F `gitSource` \u002F `bindingSource`) | revert \u002F quarantine \u002F accept-as-canonical \u002F ASK |\n| Real-time watch response | [`pilot-watch-alert-response`](..\u002Fpilot-watch-alert-response\u002FSKILL.md) | `cub-scout watch` \u002F `cub-scout bot` event stream with `--emit-receipt-on` inline receipts (v2 #463) | Per-event PASS \u002F WATCH \u002F ASK \u002F BLOCK |\n| Incident close-out | [`pilot-incident-evidence`](..\u002Fpilot-incident-evidence\u002FSKILL.md) | trace + explain + compare + bundle + history + audit + chained receipts (`--input-attestation`, v2 #463) | Incident verdict + immutable evidence pack |\n| Rollback decision | [`pilot-rollback-decision`](..\u002Fpilot-rollback-decision\u002FSKILL.md) | `history` + `impact` + per-candidate `receipt verify --at-commit \u003Csha>` chained into chosen-target receipt | Rollback target SHA + safety verdict |\n| Promotion gate | [`pilot-promotion-gate`](..\u002Fpilot-promotion-gate\u002FSKILL.md) | `compare three-way` per variant + `bindingSource` graph diff + chained variant-A receipt | Cross-variant PASS \u002F WATCH \u002F ASK \u002F BLOCK with diff reasons |\n| Compliance audit | [`pilot-compliance-audit`](..\u002Fpilot-compliance-audit\u002FSKILL.md) | scope-wide source-truth + `scan` + `audit list` + per-resource saved receipts | Compliance report (Compliant \u002F with-caveats \u002F Non-compliant \u002F Insufficient-evidence) + fingerprinted evidence inventory |\n| Release verification | [`pilot-release-verification`](..\u002Fpilot-release-verification\u002FSKILL.md) | `gitops status --with-confighub` + `compare three-way` + `history --since \u003Cdeploy-time>` + receipt evidence; `summary.agreement` and `deliveryEvidence` drive convergence signals | Post-deploy PASS \u002F WATCH (wait) \u002F BLOCK \u002F ASK |\n\n## Product value in one breath\n\n**cub scout observes and explains; it never decides.** It is the read-only Kubernetes and GitOps observer — it surfaces evidence about ownership, health, drift, and provenance, but it never mutates the cluster and never makes authority calls about what *should* be true. ConfigHub (driven by `cub`) is the authority; cub-scout is the witness.\n\n`cub scout` is the preferred documented form. In this repo, use `.\u002Fcub-scout ...` for exact local commands.\n\n## Tool boundaries\n\n### Use `cub scout` for\n\n- **Observe** — `doctor`, `map`, `trace`, `tree`, `scan`, `graph`, `snapshot`, `watch`, `bot`, `status`\n- **Diagnose** — `explain`, `debug`, `suggest-remedy`, `patterns`, `gitops status`\n- **Compare** — `compare drift`, `compare three-way`, `compare source-truth`, `compare \u003Ckind>\u002F\u003Cname>`\n- **Attribute** — read `cause` \u002F `managerHint` \u002F `gitSource` \u002F `bindingSource` on `compare` and `explain` JSON\n- **Adopt Existing Config** (preview first) — `import --dry-run`, `import --from-bundle`, `import --git-path`, `import parse-repo`, `import argocd`, `import cluster-aggregator`\n- **Govern** (connected) — `history`, `impact`, `fleet outliers`, `summary`, `views resolve`, `audit list`, `bundle inspect\u002Fdiff\u002Ftimeline`, `catalog list`\n- **Integrate** — `mcp serve`, `context-pack`, `bot`\n- **Verify** — `receipt verify \u002F show \u002F validate \u002F list` (typed, fingerprinted evidence; `receipt verify \u003Ckind>\u002F\u003Cname> --with-confighub` can freeze object-correlated delivery evidence under `predicate.evidence.deliveryEvidence`)\n\n### Use `cub` for\n\n- ConfigHub intended-state workflows\n- spaces, units, targets, workers\n- `cub variant upload` (load already-rendered resources as units)\n- `cub link list \u002F get` (the data feed for cub-scout's connected attribution layer)\n- Any mutation — `cub` is the writer side of the triad\n\n### Do not blur these\n\n- `cub-scout import --git-path` is a local structure \u002F import-preview flow — it does *not* render manifests or upload to ConfigHub\n- `cub variant upload` ingests already-rendered resources and writes them as units — it renders nothing, and `cub gitops discover` \u002F `cub gitops import` no longer exist (removed from cub 2026-07-25, #573)\n- SDK renderers are an implementation detail for `cub`, not an implied cub-scout feature\n- Attribution evidence on `compare` \u002F `explain` JSON is read-only enrichment — never implies a write\n\n## High-signal shipped capabilities\n\n- **Attribution layer** (#435 — A1+A1.5+A2 in #437, C1 in #438, C2 in #439, stage B in #440): `cause` + `managerHint` + `gitSource{repoUrl,revision,path,file,line}` + `bindingSource` on every field mismatch. See [`scout-attribute`](..\u002Fscout-attribute\u002FSKILL.md).\n- **Source-truth contract** (#393 + #418): `compare source-truth` with Phase 1 + Phase 2 strategies (9 total).\n- **Views integration** (#391): `views resolve`, `views open`, `views project --with-reality`, `compare three-way --view`.\n- **`doctor` \u002F `explain`** with `--presentation` and `--hint-mode`.\n- **MCP gateway** (`mcp serve`): standalone + connected tool sets, including `gitops_status` for GitOps delivery and controller-coverage evidence.\n- **ConfigHub delivery evidence**: `gitops status --with-confighub`, `doctor --with-confighub`, `map activity --with-confighub`, `trace --with-confighub`, `explain --with-confighub`, and single-resource `receipt verify --with-confighub` add bounded release history, unit events, live-status freshness, and event-consumer health. `doctor` adds a scope-level `delivery` rollup, `map activity` renders the evidence as timeline rows, and receipts freeze object-correlated snapshots as fingerprint-covered supporting evidence.\n- **Controller-family coverage**: `gitops status` emits `controllerCoverage[]` for Flux, Argo CD, ConfigHub, Sveltos, and Modelplane so absence and RBAC\u002FAPI omissions stay distinguishable.\n- **Stage B back-resolution** (#440): `compare three-way --source-path \u003Clocal-checkout>` populates `gitSource.file:line` for raw YAML manifests.\n- **Receipt capability** (#446 — v1 complete; #454 + #455 + #456): typed, fingerprinted, immutable evidence artifacts wrapping cub-scout evidence into an in-toto Statement v1 envelope. Three predicates: `applied-matches-spec`, `source-truth-pass`, `no-manual-edits-since`. `verify` \u002F `show` \u002F `validate` \u002F `list` + local store with immutable canonical filenames. See [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md).\n\n## Read first (for capability-assistant work)\n\n1. [`AI-README-FIRST.md`](..\u002F..\u002FAI-README-FIRST.md) — cold-start guide, current shipped capabilities, current open queue\n2. [`HANDOVER.md`](..\u002F..\u002FHANDOVER.md) — latest execution snapshot\n3. [`README.md`](..\u002F..\u002FREADME.md) § \"Capability Map\" — the eight verb groups\n4. [`docs\u002Freference\u002Fcommands.md`](..\u002F..\u002Fdocs\u002Freference\u002Fcommands.md) — exact command surface\n5. [`docs\u002Freference\u002Fjson-contracts.md`](..\u002F..\u002Fdocs\u002Freference\u002Fjson-contracts.md) — JSON shapes\n6. `references\u002Fcapability-assistant.md` (in this directory) — the original capability-assistant profile, kept for back-compatibility\n\n## Verification rule\n\nDo not invent command surfaces.\n\nVerify from local help before claiming capability. `help \u003Ccommand>` is the\nauto-approved form. `\u003Ccommand> --help` is not: a wildcard grant for it would\nalso admit `import -y --audit-reason --help`, where `--help` is the flag's\nvalue and the import runs:\n\n```bash\n.\u002Fcub-scout --help\n.\u002Fcub-scout help doctor\n.\u002Fcub-scout help explain\n.\u002Fcub-scout help compare three-way\n.\u002Fcub-scout help compare source-truth\n.\u002Fcub-scout help import\n.\u002Fcub-scout help views\n.\u002Fcub-scout help mcp serve\n```\n\nWhen the workflow crosses into ConfigHub:\n\n```bash\ncub variant upload --help\ncub k8s --help\ncub link --help\ncub link list --help\n```\n\n## Safety rule (read-only triad lock — #410 \u002F #428)\n\n- `cub-scout` is cluster read-only by default\n- connected import writes inventory \u002F state to ConfigHub, **not** cluster manifests\n- prefer preview or dry-run paths first\n- attribution evidence is enrichment, never mutation\n- `suggest-remedy` describes a fix; it does not apply it (the executor was removed in #428)\n\n## Authoring guidance for new skills\n\nWhen adding skills under `skills\u002F`, follow:\n\n- [`skills\u002FSKILL_TEMPLATE.md`](..\u002FSKILL_TEMPLATE.md) — the canonical template (cub-scout, read-only variant)\n- The read-only-triad invariant — no mutating patterns in `allowed-tools`, ever\n- Standalone-first worked examples; connected-mode is the enrichment\n- CI-tool-neutral wording — no GitHub Actions \u002F GitLab CI \u002F Jenkins-specific syntax committed\n",{"name":5,"phase":49,"description":7,"allowed-tools":50},"cross-cutting","Bash(.\u002Fcub-scout --help) Bash(.\u002Fcub-scout help *) Bash(cub-scout --help) Bash(cub-scout help *) Bash(cub scout --help) Bash(cub scout help *)","main","261862e7ec5e5c93ce377ccfd6b583f5ac03c95c","skills\u002Fcub-scout",1,"https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout","https:\u002F\u002Fconfighub.com","https:\u002F\u002Fgithub.com\u002Fconfighub","http:\u002F\u002Fwww.confighub.com","Public repo for ConfigHub","2026-11-14 03:24:15",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add confighub\u002Fcub-scout --skill cub-scout",{"tool":67,"command":68},"bunx","bunx skills add confighub\u002Fcub-scout --skill cub-scout",{"tool":70,"command":71},"pnpm","pnpm dlx skills add confighub\u002Fcub-scout --skill cub-scout","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fcub-scout\u002FSKILL.md",true,[75,81],{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"agents\u002Fopenai.yaml","REFERENCE","参考文档",124,"https:\u002F\u002Fgithub.com\u002Fmalinskibeniamin\u002Fskills\u002Fblob\u002Fmain\u002Fcodex-skills\u002Fbetter-writing\u002Fagents\u002Fopenai.yaml",{"path":82,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fcapability-assistant.md",2365,"https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fcub-scout\u002Freferences\u002Fcapability-assistant.md",[86,120,145,164,189,209],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":97,"publishedAt":44},"01M6CBPQHTK7YGVZD3MMH1328H","triage-unhealthy-workload","Use when the user is responding to a broken Kubernetes workload UNDER TIME PRESSURE — pager-going-off, CI-red, \"prod is down\" framing. Natural phrasing: \"deploy\u002Fapi is CrashLoopBackOff, what now?\", \"the rollout is stuck, help\", \"this pod won't start\", \"pager fired on payments\", \"everything is red in argocd\", \"what should I check first?\", \"give me a triage plan for this workload\". Composes doctor → explain → trace into a tight ~30-second loop the operator can run in a pager-acknowledged context. Do NOT load for: a planned investigation without urgency (use scout-diagnose directly), a drift question (use investigate-drift), or anything mutating (cub-scout never mutates — route to kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Ftriage-unhealthy-workload\u002FSKILL.md",[92],{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[98,99,100,101,41,102,103,104,105,106,36,107,108,109,110,111,34,112,113,20,114,115,116,117,118,119,22],"triage","workload","triage unhealthy workload","kubernetes","doctor","logs","ci","payments","api","loop","explain","check","broken","question","rollout","never","route","drift","map","time","get","now",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":127,"publishedAt":44},"01M6CBPKYVREY83CQYNFW6BVD0","scout-verify","Use when the user wants a TYPED, FINGERPRINTED, IMMUTABLE evidence artifact about a Kubernetes resource — the Verify verb group of cub-scout (the receipt capability shipped in #446). Natural phrasing: \"produce a receipt that this is in compliance\", \"give me an attestation that the cluster matches Git\", \"I need a verifiable record for the audit trail\", \"build a receipt verifying no manual edits since deploy\", \"verify deploy\u002Fapi against source-truth and save the artifact\", \"validate this receipt has not been tampered with\", \"show me what receipts we have\", \"is this receipt tampered with?\", \"attach evidence to my CI gate\". Load whenever intent is receipt \u002F attestation \u002F evidence-artifact \u002F tamper-evident-record \u002F verified-record \u002F audit-trail \u002F postmortem-evidence \u002F acceptance-judge-input. Do NOT load for: a live comparison without a persisted artifact (use scout-compare), interpreting a single field's provenance (use scout-attribute), or actually applying a fix (cub-scout never mutates — route to cub \u002F argocd \u002F kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-verify\u002FSKILL.md",[126],{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},[38,128,19,101,129,130,104,131,132,106,133,36,134,135,136,137,138,34,113,139,20,140,114,141,118,142,143,144,22],"scout verify","acceptance","produce","attestation","provenance","show me","postmortem","changeset","argocd","view","fix","evidence","show","me","app","unit","managed",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":44},"01M6CBPF8WZBM7F9X096WT8PJD","scout-observe","Use when the user wants to SEE what is running in a Kubernetes cluster, who owns it, and how it is structured — the read-only Observe verb group of cub-scout. Natural phrasing: \"what is running in my cluster?\", \"give me a map of resources\", \"who owns this Deployment?\", \"trace this back to its source\", \"show me the ownership tree\", \"scan this cluster for risk\", \"dump the cluster as JSON\", \"stream cluster events\", \"run cub-scout as a bot\", \"what is the connection status?\", \"is this cluster healthy?\". Load when intent is observe \u002F inventory \u002F map \u002F show \u002F list \u002F trace \u002F scan \u002F dump \u002F stream \u002F bot \u002F health-check over a Kubernetes cluster. Do NOT load for: explaining WHY something is broken (use scout-diagnose), comparing cluster state to intended state (use scout-compare), provenance of individual field values (use scout-attribute), or any action that mutates the cluster (cub-scout never mutates — route to cub or kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-observe\u002FSKILL.md",[],[31,152,19,153,101,41,154,102,103,155,132,156,133,36,110,34,157,113,158,159,20,140,160,161,116,118,162,163,22],"scout observe","bot","deployment","risk","inventory","version","only","hooks","back","health-check","resources","meaning",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":173,"publishedAt":44},"01M6CBPBM5J9PX4H8CE628AY5X","scout-mcp","Use when the user wants to expose cub-scout to an AI agent over MCP, wants a deterministic AI-ready snapshot of cluster context, or wants cub-scout running as a read-only event bot — the Integrate verb group. Natural phrasing: \"start the MCP server\", \"expose cub-scout to Claude \u002F Codex \u002F my agent\", \"give me an AI-ready context pack of this cluster\", \"set up the MCP gateway\", \"what MCP tools does cub-scout expose?\", \"run cub-scout as a bot\", \"produce JSON context for an LLM to reason about this cluster\". Load whenever intent is mcp \u002F mcp-gateway \u002F mcp-serve \u002F context-pack \u002F bot \u002F agent-context \u002F ai-snapshot \u002F llm-context \u002F model-context-protocol. Do NOT load for: actually running a non-integrate verb (those are scout-observe \u002F scout-diagnose \u002F scout-compare \u002F scout-attribute \u002F scout-ingest \u002F scout-govern \u002F scout-verify), or `cub` MCP integration (that's a separate tool surface).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-mcp\u002FSKILL.md",[170],{"categoryNo":171,"categoryName":172,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000023","Skill与智能体开发",[174,175,19,153,176,177,178,42,179,180,181,182,36,183,135,184,185,158,186,187,31,118,143,188,22],"MCP","scout mcp","mcp server","ai agent","auth","run","release","server","SET","model","read","snapshot","ready","up","agent-context",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":195,"publishedAt":44},"01M6CBP7D72G704FWGRXNB6F9T","scout-ingest","Use when the user wants to ADOPT existing Kubernetes \u002F GitOps workload structure into ConfigHub after observing the live cluster — the adoption\u002Fimport verb group of cub-scout. Natural phrasing: \"discover workloads in this cluster and propose ConfigHub units\", \"show me the import proposal before I apply\", \"import this Argo Application set\", \"bring my Flux Kustomizations into ConfigHub\", \"preview what would land in ConfigHub if I imported this repo\", \"parse my git repo as a ConfigHub import bundle\", \"import a cluster aggregator\", \"what would --git-path produce for this repo?\". Load whenever intent is adopt \u002F import \u002F ingest \u002F preview \u002F propose \u002F parse-repo \u002F discovery \u002F aggregator \u002F bring-into-confighub \u002F what-would-confighub-see. Do NOT load for: questions about who changed a resource, whether it was edited by hand or drifted (use scout-attribute or investigate-drift); reading an exported `kubectl get -o yaml` dump to answer a question about the cluster (that is not an import); basic live-cluster inventory (use scout-observe), troubleshooting (use scout-diagnose), comparing live state to ConfigHub (use scout-compare), or the actual write to ConfigHub via `cub variant upload` (that is `cub`, not cub-scout — route to cub skills). Important: `cub-scout import apply` IS the mutating write into ConfigHub — this skill teaches the read-only preview path and explicitly refuses to invoke `import apply` itself.","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-ingest\u002FSKILL.md",[],[196,197,19,101,41,180,198,130,199,182,156,200,133,36,135,35,111,184,201,137,34,158,31,20,140,202,203,28,204,142,143,205,206,207,208],"ingest","scout ingest","state","adoption","discovery","write","structure","aggregator","argo","reading","exported","invoke","parse",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":215,"publishedAt":44},"01M6CBP32CYJT8DJSGNCRWXQTM","scout-govern","Use when the user wants to consume CONNECTED ConfigHub governance signals from cub-scout — the Govern verb group. Natural phrasing: \"show me the ChangeSet history for this unit\", \"what is the blast radius if I change this unit?\", \"which clusters in my fleet are outliers?\", \"show me yesterday's connected summary\", \"render this view across the fleet\", \"audit who changed this\", \"where did the last apply come from?\", \"list ConfigHub bundles I have\", \"show me the catalog of past snapshots\". Load whenever intent is history \u002F impact \u002F blast-radius \u002F fleet-outliers \u002F summary \u002F view \u002F audit \u002F bundle \u002F catalog \u002F connected-context. Do NOT load for: live cluster comparison (use scout-compare), receipts (use scout-verify), inventory of running pods (use scout-observe), or any mutation via cub. Most of this skill requires `cub auth login` — say so upfront.","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-govern\u002FSKILL.md",[],[216,19,217,178,218,219,220,156,38,133,36,221,135,137,222,34,223,224,225,31,20,140,226,118,227,228,143,229,230,231,232,22],"scout govern","change","governance","blast radius","audit","history","catalog","diff","say","snapshots","project","mutation","impact","render","blast-radius","which","inspect"]