[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CBMFQDKS1VCZEBSZBF8982":3,"skill-same:01M6CBMFQDKS1VCZEBSZBF8982":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":59,"linkOnly":60,"markdownContent":61,"markdownBody":62,"frontMatter":63,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":6,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6CBMFQDKS1VCZEBSZBF8982","pilot-compliance-audit",null,"Use when Pilot is RENDERING A PERIODIC POLICY-CONFORMANCE REPORT for a compliance audit. Natural phrasings: \"Pilot, run the quarterly compliance audit\", \"render the conformance report against policy\", \"audit our prod fleet against the security baseline\", \"produce the compliance evidence pack for the auditor\", \"Pilot, what are this quarter's policy violations + their evidence?\". Pilot consumes cub-scout's scope-wide `compare source-truth` (per-resource verdicts under the declared strategy) + `scan` findings (risk-pattern matches) + (optional) per-resource receipts persisted to the local store, then synthesizes a compliance-shaped report with violations table + fingerprinted evidence inventory. Differs from `pilot-fleet-conformance` which is the SAME-VERBS-SAME-DAY operational verdict; this skill is the LONGER-CYCLE compliance shape — the output is a quarterly\u002Fmonthly report with attached evidence inventory, not a real-time gate. Do NOT load for: a single-resource pre-deploy gate (use pilot-cd-gate), real-time event response (use pilot-watch-alert-response), incident close-out evidence (use pilot-incident-evidence), or a rollback decision (use pilot-rollback-decision).","confighub\u002Fcub-scout","confighub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206140369?v=4","01M6CBJBWD33AFNG4VXMJHSRXD","ConfigHub Inc","01M6CBJC0K0F8CJVFWGRSR0KYC",14,"MIT","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fpilot-compliance-audit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58],"Compliance Audit","audit","compliance","pilot compliance audit","project","evidence","alert","periodic","cub scout","scout compare","show","time","local","strategy","close","unit","rendering","which","describe","use","security","view","list","changeset","decision","Bash","verify","inventory","real-time","risk","kubectl","produce","release","run","policy","2026-11-10 10:12:30",false,"---\nname: pilot-compliance-audit\ndescription: 'Use when Pilot is RENDERING A PERIODIC POLICY-CONFORMANCE REPORT for a compliance audit. Natural phrasings: \"Pilot, run the quarterly compliance audit\", \"render the conformance report against policy\", \"audit our prod fleet against the security baseline\", \"produce the compliance evidence pack for the auditor\", \"Pilot, what are this quarter''s policy violations + their evidence?\". Pilot consumes cub-scout''s scope-wide `compare source-truth` (per-resource verdicts under the declared strategy) + `scan` findings (risk-pattern matches) + (optional) per-resource receipts persisted to the local store, then synthesizes a compliance-shaped report with violations table + fingerprinted evidence inventory. Differs from `pilot-fleet-conformance` which is the SAME-VERBS-SAME-DAY operational verdict; this skill is the LONGER-CYCLE compliance shape — the output is a quarterly\u002Fmonthly report with attached evidence inventory, not a real-time gate. Do NOT load for: a single-resource pre-deploy gate (use pilot-cd-gate), real-time event response (use pilot-watch-alert-response), incident close-out evidence (use pilot-incident-evidence), or a rollback decision (use pilot-rollback-decision).'\nphase: cross-cutting\nallowed-tools: Bash(.\u002Fcub-scout compare three-way *) Bash(cub-scout compare three-way *) Bash(cub scout compare three-way *) Bash(.\u002Fcub-scout compare source-truth *) Bash(cub-scout compare source-truth *) Bash(cub scout compare source-truth *) Bash(.\u002Fcub-scout compare drift *) Bash(cub-scout compare drift *) Bash(cub scout compare drift *) Bash(.\u002Fcub-scout scan *) Bash(cub-scout scan *) Bash(cub scout scan *) Bash(.\u002Fcub-scout patterns *) Bash(cub-scout patterns *) Bash(cub scout patterns *) Bash(.\u002Fcub-scout fleet outliers *) Bash(cub-scout fleet outliers *) Bash(cub scout fleet outliers *) Bash(.\u002Fcub-scout views resolve *) Bash(cub-scout views resolve *) Bash(cub scout views resolve *) Bash(.\u002Fcub-scout views project *) Bash(cub-scout views project *) Bash(cub scout views project *) Bash(.\u002Fcub-scout receipt verify *) Bash(cub-scout receipt verify *) Bash(cub scout receipt verify *) Bash(.\u002Fcub-scout receipt list *) Bash(cub-scout receipt list *) Bash(cub scout receipt list *) Bash(.\u002Fcub-scout receipt show *) Bash(cub-scout receipt show *) Bash(cub scout receipt show *) Bash(.\u002Fcub-scout receipt validate *) Bash(cub-scout receipt validate *) Bash(cub scout receipt validate *) Bash(.\u002Fcub-scout map list *) Bash(.\u002Fcub-scout map workloads *) Bash(.\u002Fcub-scout map orphans *) Bash(cub-scout map list *) Bash(cub-scout map workloads *) Bash(cub-scout map orphans *) Bash(cub scout map list *) Bash(cub scout map workloads *) Bash(cub scout map orphans *) Bash(.\u002Fcub-scout audit *) Bash(cub-scout audit *) Bash(cub scout audit *) Bash(kubectl get *) Bash(kubectl describe *) Bash(cub space list *) Bash(cub unit get *) Bash(cub unit list *) Bash(cub link get *) Bash(cub link list *) Bash(cub view get *) Bash(cub view list *) Bash(cub unit-event list *) Bash(cub resource list *) Bash(cub release list *) Bash(cub changeset list *) Bash(cub view list)\n\n---\n\n# pilot-compliance-audit\n\nThe periodic compliance-audit scenario from **Pilot's** side. A quarterly\u002Fmonthly audit window opens; Pilot is asked to render a structured **compliance report** with per-resource violations + their fingerprinted evidence. The downstream consumer is the auditor (internal security\u002Fcompliance team, external auditor, SOC 2 reviewer, regulator) — not the SRE team running the cluster.\n\nSame cub-scout verbs as `pilot-fleet-conformance`, different framing: that skill is the *operational* verdict (today's snapshot, today's decision); this skill is the *compliance* shape (last quarter's evidence, an auditor's report). The output cadence is longer; the evidence-attachment requirement is stricter.\n\n## When to use\n\nExplicit phrasings:\n\n- \"Pilot, run the quarterly compliance audit\"\n- \"Render the conformance report against policy\"\n- \"Audit our prod fleet against the security baseline\"\n- \"Produce the compliance evidence pack for the auditor\"\n- \"Pilot, what are this quarter's policy violations + their evidence?\"\n- \"Generate the SOC 2 evidence inventory from cub-scout\"\n- \"Compliance run for {policy\u002Fbaseline name}\"\n\nImplicit intents:\n\n- The cadence is **periodic** (quarterly, monthly), not real-time\n- The audience is the **auditor** — an external or compliance-team reviewer who wants structured violations + fingerprinted evidence per violation\n- The report needs to be **fingerprint-stable** — the auditor may re-validate any receipt months later\n- The report rolls up across **scope** (View \u002F namespace \u002F cluster \u002F fleet) — not a single resource\n- Pilot's verdict per resource maps to a **compliance category** (Compliant \u002F Compliant with caveats \u002F Non-compliant \u002F Insufficient evidence) — slightly different vocabulary from PASS\u002FWATCH\u002FASK\u002FBLOCK\n\n## Do not load for\n\n- A **single-resource pre-deploy gate** — [`pilot-cd-gate`](..\u002Fpilot-cd-gate\u002FSKILL.md)\n- The **operational** version of the same audit (same-day; not for the auditor) — [`pilot-fleet-conformance`](..\u002Fpilot-fleet-conformance\u002FSKILL.md). Same verbs; different framing.\n- A **real-time event-driven** response — [`pilot-watch-alert-response`](..\u002Fpilot-watch-alert-response\u002FSKILL.md)\n- An **incident close-out** evidence pack — [`pilot-incident-evidence`](..\u002Fpilot-incident-evidence\u002FSKILL.md)\n- A **rollback decision** — [`pilot-rollback-decision`](..\u002Fpilot-rollback-decision\u002FSKILL.md)\n- A **promotion safety check** — [`pilot-promotion-gate`](..\u002Fpilot-promotion-gate\u002FSKILL.md)\n- Any **mutating action**. Compliance audits are read-only by design.\n\n## The Pilot ↔ cub-scout compliance loop\n\n```\n   quarterly compliance window opens (cron \u002F manual trigger)\n        │\n        ▼\n   Pilot (acceptance judge in compliance-report mode)\n        │  \"render Q2 2026 compliance report for view:prod-baseline\"\n        │\n        ├──► cub-scout views resolve \u003Cbaseline-view>   # scope confirmation\n        │\n        ├──► For each resource in scope:\n        │      cub-scout compare source-truth \u003Cr> -n \u003Cns> --strategy \u003Cs> --format json\n        │      cub-scout scan -n \u003Cns> --format json   # risk-pattern matches per resource\n        │      cub-scout receipt verify \u003Cr> -n \u003Cns> --strategy \u003Cs> \\\n        │        --save                              # fingerprinted, persisted to local store\n        │\n        ├──► Cross-cluster (if View has cluster scope):\n        │      cub-scout fleet outliers --view \u003Cbaseline-view> --format json\n        │\n        ├──► Audit-trail layer:\n        │      cub-scout audit list --since 90d --format json    # ConfigHub audit entries\n        │      cub-scout receipt list --format json              # full receipt inventory\n        │\n        └──► (optional) chain ALL per-resource receipts under one aggregate:\n              # When #448 aggregate-with-discovery half ships, this collapses to one call.\n              # Until then: produce one receipt per resource; the report inventory links each.\n        │\n        ▼\n   Pilot's compliance report:\n        │  Compliant resources:               \u003Clist with PASS receipts>\n        │  Compliant-with-caveats resources:  \u003Clist with WATCH receipts + proof_gaps>\n        │  Non-compliant resources:           \u003Clist with BLOCK receipts + violation reason>\n        │  Insufficient-evidence resources:   \u003Clist with INCONCLUSIVE receipts + omissions>\n        │  Audit-trail (last 90d):            \u003CConfigHub change events that touched the scope>\n        │  Receipt inventory:                 \u003Cfingerprint-stable file paths per resource>\n        │\n        ▼\n   auditor reads the report\n        │  Auditor can `cub-scout receipt validate \u003Cpath>` any individual entry to confirm tamper-free\n        └────────────────────────────────────────────────────\n```\n\n## Verdict mapping (cub-scout → compliance vocabulary)\n\nAuditors typically don't speak PASS \u002F WATCH \u002F ASK \u002F BLOCK. Map cub-scout's receipt verdicts to compliance vocabulary at the report-rendering layer:\n\n| Receipt verdict | Compliance category | Auditor-facing meaning |\n|------------------|---------------------|------------------------|\n| `PASS` | **Compliant** | Evidence supports the claim against the declared strategy \u002F baseline |\n| `WATCH` | **Compliant with caveats** | Evidence is ambiguous; proof_gaps listed; the auditor can decide whether the gaps invalidate compliance |\n| `BLOCK` | **Non-compliant** | Evidence contradicts the claim — a real violation |\n| `INCONCLUSIVE` | **Insufficient evidence** | The receipt couldn't be built (missing strategy, missing input); the auditor needs the cube-scout-side fix or a manual review |\n\n`ASK` is a source-truth `status` value, not a receipt verdict. When it surfaces during the audit, the wrapping receipt has verdict `WATCH` (per `pkg\u002Fagent\u002Freceipt_predicates.go:396-407`); Pilot's compliance report should list the auditor-facing meaning consistently.\n\n## Step-by-step\n\n### Step 1 — resolve the audit scope\n\nA **View** is the canonical compliance scope (declared in ConfigHub via `cub view create`):\n\n```bash\n$ cub-scout views resolve https:\u002F\u002Fhub.confighub.com\u002Fviews\u002Fprod-baseline-q2-2026\nView: prod-baseline-q2-2026\n  scope: cluster\n  columns: [team, service, source_truth_strategy, last_audited]\n  resolved at: 2026-05-22T22:00:00Z\n```\n\nScope sources for compliance: ConfigHub Views (preferred — declared scope is auditable), namespace, cluster. Avoid ad-hoc resource lists for periodic compliance — they're harder to defend later.\n\n### Step 2 — per-resource source-truth + scan + receipt\n\n```bash\n# Per-resource source-truth verdict against the baseline's declared strategy\n$ for r in $(cub-scout views project --view prod-baseline-q2-2026 --format json \\\n              | jq -r '.[] | \"\\(.kind)\u002F\\(.name) -n \\(.namespace)\"'); do\n    cub-scout compare source-truth $r --strategy git-argo --format json \\\n      > evidence\u002F$r-source-truth.json\n  done\n\n# Risk-pattern scan (CVE, expiring certs, dangling resources, etc.)\n$ cub-scout scan --format json > evidence\u002Fscan-findings.json\n\n# Fingerprinted per-resource receipts (immutable; survive the audit window)\n$ for r in $(cub-scout views project --view prod-baseline-q2-2026 --format json \\\n              | jq -r '.[] | \"\\(.kind)\u002F\\(.name) -n \\(.namespace)\"'); do\n    cub-scout receipt verify $r --strategy git-argo --save\n  done\n```\n\nEach receipt lands in the immutable local store (`$CUB_SCOUT_RECEIPTS_DIR → $XDG_DATA_HOME → $HOME\u002F.local\u002Fshare\u002Fcub-scout\u002Freceipts`) with a canonical filename. Auditors can validate any receipt months later with `cub-scout receipt validate`.\n\n### Step 3 — connected-mode audit trail layer\n\n```bash\n$ cub-scout audit list --since 90d --format json > evidence\u002Fconfighub-audit.json\n$ cub-scout fleet outliers --view prod-baseline-q2-2026 --format json > evidence\u002Ffleet-outliers.json\n```\n\n`audit list` (connected) captures break-glass accept\u002Freject entries from ConfigHub — the human-decision audit trail that paired with the per-resource verdicts during the quarter. `fleet outliers` flags cross-cluster divergences against the baseline.\n\n### Step 4 — compose the report\n\nPilot's compliance report shape:\n\n```json\n{\n  \"report_type\": \"quarterly_compliance\",\n  \"audit_window\": \"Q2 2026 (2026-04-01 → 2026-06-30)\",\n  \"scope\": \"view:prod-baseline-q2-2026\",\n  \"declared_strategy\": \"git-argo\",\n  \"rollup\": {\n    \"compliant\": 184,\n    \"compliant_with_caveats\": 12,\n    \"non_compliant\": 3,\n    \"insufficient_evidence\": 1\n  },\n  \"non_compliant\": [\n    {\n      \"resource\": \"Deployment\u002Fpayments-cron in prod-use1\",\n      \"verdict\": \"BLOCK\",\n      \"reason\": \"source_truth=MISMATCH; manual-edit detected on container image\",\n      \"receipt\": \"\u002Fpath\u002Fto\u002Freceipts\u002F2026-Q2\u002Fpayments-cron.receipt.json\"\n    },\n    {\"resource\": \"Deployment\u002Flegacy-api in prod-euw1\", \"verdict\": \"BLOCK\", \"reason\": \"fleet outlier: missing per-cluster baseline\", \"receipt\": \"\u002Fpath\u002Fto\u002F...\" }\n  ],\n  \"compliant_with_caveats\": [\n    {\"resource\": \"Deployment\u002Fapi in prod-use1\", \"verdict\": \"WATCH\", \"proof_gaps\": [\"git-source-anchor unresolved: argocd CLI not installed\"], \"receipt\": \"\u002Fpath\u002Fto\u002F...\"}\n  ],\n  \"insufficient_evidence\": [\n    {\"resource\": \"Deployment\u002Flegacy-tool in prod-use1\", \"verdict\": \"INCONCLUSIVE\", \"omissions\": [\"managedFields\"], \"receipt\": \"\u002Fpath\u002Fto\u002F...\"}\n  ],\n  \"audit_trail_entries\": \"evidence\u002Fconfighub-audit.json (90 entries)\",\n  \"scan_findings\": \"evidence\u002Fscan-findings.json (4 critical, 12 warning, 31 info)\",\n  \"fleet_outliers\": \"evidence\u002Ffleet-outliers.json (2 outliers)\",\n  \"evidence_inventory\": \"evidence\u002Freceipt-list.json (200 receipts; all fingerprint-verifiable)\"\n}\n```\n\n### Step 5 — handoff + later re-validation\n\nThe auditor receives the report + the `evidence\u002F` directory. To validate any individual receipt:\n\n```bash\n$ cub-scout receipt validate evidence\u002Fnon-compliant\u002Fpayments-cron.receipt.json\n# exit 0 = fingerprint intact; 1 = mismatch; 2 = I\u002FO\n\n$ cub-scout receipt show evidence\u002Fnon-compliant\u002Fpayments-cron.receipt.json --format ascii\n# Renders the same evidence Pilot's report cited — tamper-evident\n```\n\nPilot's report is **only as durable as the receipt store** — auditors typically want the evidence\u002F directory archived externally (S3, GitHub Release artifact, ConfigHub bundle catalog) for the retention period.\n\n## Worked example\n\nQ2 2026 compliance run; scope = `view:prod-baseline-q2-2026`; strategy = `git-argo`.\n\n```bash\n$ mkdir -p evidence\u002F{non-compliant,with-caveats,inconclusive}\n\n# Per-resource receipts (saved to immutable store + linked into evidence\u002F)\n$ for r in $(cub-scout views project --view prod-baseline-q2-2026 --format json \\\n              | jq -r '.[] | \"\\(.kind)\u002F\\(.name) -n \\(.namespace)\"'); do\n    cub-scout receipt verify $r --strategy git-argo --save 2>\u002Fdev\u002Fnull\n  done\n\n# Categorize by verdict\n$ cub-scout receipt list --format json \\\n    | jq '[.[] | select(.verdict == \"BLOCK\")]' > evidence\u002Fnon-compliant.json\n$ cub-scout receipt list --format json \\\n    | jq '[.[] | select(.verdict == \"WATCH\")]' > evidence\u002Fwith-caveats.json\n$ cub-scout receipt list --format json \\\n    | jq '[.[] | select(.verdict == \"INCONCLUSIVE\")]' > evidence\u002Finconclusive.json\n\n# Audit-trail + scan + fleet outliers\n$ cub-scout audit list --since 90d --format json > evidence\u002Faudit.json\n$ cub-scout scan --format json > evidence\u002Fscan.json\n$ cub-scout fleet outliers --view prod-baseline-q2-2026 --format json > evidence\u002Foutliers.json\n\n# Rollup\n$ jq 'length' evidence\u002F{non-compliant,with-caveats,inconclusive}.json\n3\n12\n1\n```\n\nPilot's report cites the 3 non-compliant resources by name + their receipts + their violation reasons; the WATCH\u002FINCONCLUSIVE lists fill in the caveats; the audit-trail \u002F scan \u002F outliers layers give the auditor the cross-axis evidence. Total artifact count: 200 receipts (one per resource in scope) + 3 supporting JSON files. All fingerprint-verifiable.\n\n## Standalone vs connected\n\n**Connected mode is effectively required** for compliance audits:\n\n- `compare source-truth --strategy` — connected\n- `views resolve` \u002F `views project` — connected\n- `fleet outliers` — connected\n- `audit list` — connected\n- `receipt verify --strategy source-truth-pass` — connected\n\nStandalone-mode compliance is *narrower* (no View scope; no ConfigHub audit trail; no fleet-outlier dimension) and rarely useful for an external auditor. If standalone is the only option, Pilot's report should call out the limitation explicitly so the auditor knows what's missing.\n\n## Tool boundary\n\n- **Allowed (cub-scout):** Compare verbs (read-only), `scan`, `patterns`, `fleet outliers`, `views resolve` \u002F `project`, `receipt verify` \u002F `show` \u002F `validate` \u002F `list`, `map`, `audit list`. All read-only.\n- **Allowed (cluster):** `kubectl get\u002Fdescribe`. NOT `kubectl apply \u002F edit \u002F patch \u002F delete`.\n- **Allowed (ConfigHub):** `cub \u003Centity> get \u002F list` for the entities named in allowed-tools. NOT `cub * create \u002F update \u002F delete`.\n- **Compliance audits are read-only by design.** The audit produces evidence; remediation (re-aligning the non-compliant resources) is a separate operational decision, typically routed through `pilot-patch-and-drift` or `pilot-rollback-decision` — those skills handle Pilot's mutation path. This skill stops at the report.\n\n## References\n\n- [`pilot-fleet-conformance`](..\u002Fpilot-fleet-conformance\u002FSKILL.md) — same verbs, operational (same-day) framing instead of compliance (periodic) framing\n- [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md) — Compare verbs\n- [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md) — receipt persistence + validation\n- [`scout-govern`](..\u002Fscout-govern\u002FSKILL.md) — fleet, views, audit, summary\n- [`audit-fleet-conformance`](..\u002Faudit-fleet-conformance\u002FSKILL.md) — operator-side counterpart\n- [`scout-attribute`](..\u002Fscout-attribute\u002FSKILL.md) — per-field attribution for violation explainability\n- Source-truth contract: `#393`, `#418` (Phase 2 strategies)\n- Receipts v1+v2: `#446` (v1), `#463` (v2 surface)\n- Read-only triad: [`references\u002Fread-only-triad.md`](..\u002Freferences\u002Fread-only-triad.md)\n\n## Constraints\n\n- The audit is **point-in-time**: the report reflects the cluster + ConfigHub state at evaluation. Compliance frameworks that require continuous monitoring should pair this skill with [`pilot-watch-alert-response`](..\u002Fpilot-watch-alert-response\u002FSKILL.md) for the event-driven side.\n- Receipts are **fingerprint-stable but not signed** in v1\u002Fv2 (`#463`); cryptographic signing is a future hardening direction. Auditors who require non-repudiation need the future signing layer — flag this in the report.\n- The local receipt store at `$XDG_DATA_HOME\u002Fcub-scout\u002Freceipts` is **per-host**. For multi-host compliance pipelines, Pilot should archive each run's `evidence\u002F` directory externally (S3, ConfigHub bundle catalog, GitHub Release artifact) for the retention period.\n- `scan` covers ~46 built-in risk patterns; bespoke policies (custom CIS benchmarks, SOC 2 controls) need either custom patterns (out of cub-scout scope) or a policy engine (Kyverno, OPA Gatekeeper) that this skill doesn't replace.\n- Compliance vocabulary (Compliant \u002F Non-compliant) is the report-layer translation of receipt verdicts (PASS \u002F BLOCK). cub-scout doesn't speak compliance vocabulary natively; Pilot's report renders the translation.\n","# pilot-compliance-audit\n\nThe periodic compliance-audit scenario from **Pilot's** side. A quarterly\u002Fmonthly audit window opens; Pilot is asked to render a structured **compliance report** with per-resource violations + their fingerprinted evidence. The downstream consumer is the auditor (internal security\u002Fcompliance team, external auditor, SOC 2 reviewer, regulator) — not the SRE team running the cluster.\n\nSame cub-scout verbs as `pilot-fleet-conformance`, different framing: that skill is the *operational* verdict (today's snapshot, today's decision); this skill is the *compliance* shape (last quarter's evidence, an auditor's report). The output cadence is longer; the evidence-attachment requirement is stricter.\n\n## When to use\n\nExplicit phrasings:\n\n- \"Pilot, run the quarterly compliance audit\"\n- \"Render the conformance report against policy\"\n- \"Audit our prod fleet against the security baseline\"\n- \"Produce the compliance evidence pack for the auditor\"\n- \"Pilot, what are this quarter's policy violations + their evidence?\"\n- \"Generate the SOC 2 evidence inventory from cub-scout\"\n- \"Compliance run for {policy\u002Fbaseline name}\"\n\nImplicit intents:\n\n- The cadence is **periodic** (quarterly, monthly), not real-time\n- The audience is the **auditor** — an external or compliance-team reviewer who wants structured violations + fingerprinted evidence per violation\n- The report needs to be **fingerprint-stable** — the auditor may re-validate any receipt months later\n- The report rolls up across **scope** (View \u002F namespace \u002F cluster \u002F fleet) — not a single resource\n- Pilot's verdict per resource maps to a **compliance category** (Compliant \u002F Compliant with caveats \u002F Non-compliant \u002F Insufficient evidence) — slightly different vocabulary from PASS\u002FWATCH\u002FASK\u002FBLOCK\n\n## Do not load for\n\n- A **single-resource pre-deploy gate** — [`pilot-cd-gate`](..\u002Fpilot-cd-gate\u002FSKILL.md)\n- The **operational** version of the same audit (same-day; not for the auditor) — [`pilot-fleet-conformance`](..\u002Fpilot-fleet-conformance\u002FSKILL.md). Same verbs; different framing.\n- A **real-time event-driven** response — [`pilot-watch-alert-response`](..\u002Fpilot-watch-alert-response\u002FSKILL.md)\n- An **incident close-out** evidence pack — [`pilot-incident-evidence`](..\u002Fpilot-incident-evidence\u002FSKILL.md)\n- A **rollback decision** — [`pilot-rollback-decision`](..\u002Fpilot-rollback-decision\u002FSKILL.md)\n- A **promotion safety check** — [`pilot-promotion-gate`](..\u002Fpilot-promotion-gate\u002FSKILL.md)\n- Any **mutating action**. Compliance audits are read-only by design.\n\n## The Pilot ↔ cub-scout compliance loop\n\n```\n   quarterly compliance window opens (cron \u002F manual trigger)\n        │\n        ▼\n   Pilot (acceptance judge in compliance-report mode)\n        │  \"render Q2 2026 compliance report for view:prod-baseline\"\n        │\n        ├──► cub-scout views resolve \u003Cbaseline-view>   # scope confirmation\n        │\n        ├──► For each resource in scope:\n        │      cub-scout compare source-truth \u003Cr> -n \u003Cns> --strategy \u003Cs> --format json\n        │      cub-scout scan -n \u003Cns> --format json   # risk-pattern matches per resource\n        │      cub-scout receipt verify \u003Cr> -n \u003Cns> --strategy \u003Cs> \\\n        │        --save                              # fingerprinted, persisted to local store\n        │\n        ├──► Cross-cluster (if View has cluster scope):\n        │      cub-scout fleet outliers --view \u003Cbaseline-view> --format json\n        │\n        ├──► Audit-trail layer:\n        │      cub-scout audit list --since 90d --format json    # ConfigHub audit entries\n        │      cub-scout receipt list --format json              # full receipt inventory\n        │\n        └──► (optional) chain ALL per-resource receipts under one aggregate:\n              # When #448 aggregate-with-discovery half ships, this collapses to one call.\n              # Until then: produce one receipt per resource; the report inventory links each.\n        │\n        ▼\n   Pilot's compliance report:\n        │  Compliant resources:               \u003Clist with PASS receipts>\n        │  Compliant-with-caveats resources:  \u003Clist with WATCH receipts + proof_gaps>\n        │  Non-compliant resources:           \u003Clist with BLOCK receipts + violation reason>\n        │  Insufficient-evidence resources:   \u003Clist with INCONCLUSIVE receipts + omissions>\n        │  Audit-trail (last 90d):            \u003CConfigHub change events that touched the scope>\n        │  Receipt inventory:                 \u003Cfingerprint-stable file paths per resource>\n        │\n        ▼\n   auditor reads the report\n        │  Auditor can `cub-scout receipt validate \u003Cpath>` any individual entry to confirm tamper-free\n        └────────────────────────────────────────────────────\n```\n\n## Verdict mapping (cub-scout → compliance vocabulary)\n\nAuditors typically don't speak PASS \u002F WATCH \u002F ASK \u002F BLOCK. Map cub-scout's receipt verdicts to compliance vocabulary at the report-rendering layer:\n\n| Receipt verdict | Compliance category | Auditor-facing meaning |\n|------------------|---------------------|------------------------|\n| `PASS` | **Compliant** | Evidence supports the claim against the declared strategy \u002F baseline |\n| `WATCH` | **Compliant with caveats** | Evidence is ambiguous; proof_gaps listed; the auditor can decide whether the gaps invalidate compliance |\n| `BLOCK` | **Non-compliant** | Evidence contradicts the claim — a real violation |\n| `INCONCLUSIVE` | **Insufficient evidence** | The receipt couldn't be built (missing strategy, missing input); the auditor needs the cube-scout-side fix or a manual review |\n\n`ASK` is a source-truth `status` value, not a receipt verdict. When it surfaces during the audit, the wrapping receipt has verdict `WATCH` (per `pkg\u002Fagent\u002Freceipt_predicates.go:396-407`); Pilot's compliance report should list the auditor-facing meaning consistently.\n\n## Step-by-step\n\n### Step 1 — resolve the audit scope\n\nA **View** is the canonical compliance scope (declared in ConfigHub via `cub view create`):\n\n```bash\n$ cub-scout views resolve https:\u002F\u002Fhub.confighub.com\u002Fviews\u002Fprod-baseline-q2-2026\nView: prod-baseline-q2-2026\n  scope: cluster\n  columns: [team, service, source_truth_strategy, last_audited]\n  resolved at: 2026-05-22T22:00:00Z\n```\n\nScope sources for compliance: ConfigHub Views (preferred — declared scope is auditable), namespace, cluster. Avoid ad-hoc resource lists for periodic compliance — they're harder to defend later.\n\n### Step 2 — per-resource source-truth + scan + receipt\n\n```bash\n# Per-resource source-truth verdict against the baseline's declared strategy\n$ for r in $(cub-scout views project --view prod-baseline-q2-2026 --format json \\\n              | jq -r '.[] | \"\\(.kind)\u002F\\(.name) -n \\(.namespace)\"'); do\n    cub-scout compare source-truth $r --strategy git-argo --format json \\\n      > evidence\u002F$r-source-truth.json\n  done\n\n# Risk-pattern scan (CVE, expiring certs, dangling resources, etc.)\n$ cub-scout scan --format json > evidence\u002Fscan-findings.json\n\n# Fingerprinted per-resource receipts (immutable; survive the audit window)\n$ for r in $(cub-scout views project --view prod-baseline-q2-2026 --format json \\\n              | jq -r '.[] | \"\\(.kind)\u002F\\(.name) -n \\(.namespace)\"'); do\n    cub-scout receipt verify $r --strategy git-argo --save\n  done\n```\n\nEach receipt lands in the immutable local store (`$CUB_SCOUT_RECEIPTS_DIR → $XDG_DATA_HOME → $HOME\u002F.local\u002Fshare\u002Fcub-scout\u002Freceipts`) with a canonical filename. Auditors can validate any receipt months later with `cub-scout receipt validate`.\n\n### Step 3 — connected-mode audit trail layer\n\n```bash\n$ cub-scout audit list --since 90d --format json > evidence\u002Fconfighub-audit.json\n$ cub-scout fleet outliers --view prod-baseline-q2-2026 --format json > evidence\u002Ffleet-outliers.json\n```\n\n`audit list` (connected) captures break-glass accept\u002Freject entries from ConfigHub — the human-decision audit trail that paired with the per-resource verdicts during the quarter. `fleet outliers` flags cross-cluster divergences against the baseline.\n\n### Step 4 — compose the report\n\nPilot's compliance report shape:\n\n```json\n{\n  \"report_type\": \"quarterly_compliance\",\n  \"audit_window\": \"Q2 2026 (2026-04-01 → 2026-06-30)\",\n  \"scope\": \"view:prod-baseline-q2-2026\",\n  \"declared_strategy\": \"git-argo\",\n  \"rollup\": {\n    \"compliant\": 184,\n    \"compliant_with_caveats\": 12,\n    \"non_compliant\": 3,\n    \"insufficient_evidence\": 1\n  },\n  \"non_compliant\": [\n    {\n      \"resource\": \"Deployment\u002Fpayments-cron in prod-use1\",\n      \"verdict\": \"BLOCK\",\n      \"reason\": \"source_truth=MISMATCH; manual-edit detected on container image\",\n      \"receipt\": \"\u002Fpath\u002Fto\u002Freceipts\u002F2026-Q2\u002Fpayments-cron.receipt.json\"\n    },\n    {\"resource\": \"Deployment\u002Flegacy-api in prod-euw1\", \"verdict\": \"BLOCK\", \"reason\": \"fleet outlier: missing per-cluster baseline\", \"receipt\": \"\u002Fpath\u002Fto\u002F...\" }\n  ],\n  \"compliant_with_caveats\": [\n    {\"resource\": \"Deployment\u002Fapi in prod-use1\", \"verdict\": \"WATCH\", \"proof_gaps\": [\"git-source-anchor unresolved: argocd CLI not installed\"], \"receipt\": \"\u002Fpath\u002Fto\u002F...\"}\n  ],\n  \"insufficient_evidence\": [\n    {\"resource\": \"Deployment\u002Flegacy-tool in prod-use1\", \"verdict\": \"INCONCLUSIVE\", \"omissions\": [\"managedFields\"], \"receipt\": \"\u002Fpath\u002Fto\u002F...\"}\n  ],\n  \"audit_trail_entries\": \"evidence\u002Fconfighub-audit.json (90 entries)\",\n  \"scan_findings\": \"evidence\u002Fscan-findings.json (4 critical, 12 warning, 31 info)\",\n  \"fleet_outliers\": \"evidence\u002Ffleet-outliers.json (2 outliers)\",\n  \"evidence_inventory\": \"evidence\u002Freceipt-list.json (200 receipts; all fingerprint-verifiable)\"\n}\n```\n\n### Step 5 — handoff + later re-validation\n\nThe auditor receives the report + the `evidence\u002F` directory. To validate any individual receipt:\n\n```bash\n$ cub-scout receipt validate evidence\u002Fnon-compliant\u002Fpayments-cron.receipt.json\n# exit 0 = fingerprint intact; 1 = mismatch; 2 = I\u002FO\n\n$ cub-scout receipt show evidence\u002Fnon-compliant\u002Fpayments-cron.receipt.json --format ascii\n# Renders the same evidence Pilot's report cited — tamper-evident\n```\n\nPilot's report is **only as durable as the receipt store** — auditors typically want the evidence\u002F directory archived externally (S3, GitHub Release artifact, ConfigHub bundle catalog) for the retention period.\n\n## Worked example\n\nQ2 2026 compliance run; scope = `view:prod-baseline-q2-2026`; strategy = `git-argo`.\n\n```bash\n$ mkdir -p evidence\u002F{non-compliant,with-caveats,inconclusive}\n\n# Per-resource receipts (saved to immutable store + linked into evidence\u002F)\n$ for r in $(cub-scout views project --view prod-baseline-q2-2026 --format json \\\n              | jq -r '.[] | \"\\(.kind)\u002F\\(.name) -n \\(.namespace)\"'); do\n    cub-scout receipt verify $r --strategy git-argo --save 2>\u002Fdev\u002Fnull\n  done\n\n# Categorize by verdict\n$ cub-scout receipt list --format json \\\n    | jq '[.[] | select(.verdict == \"BLOCK\")]' > evidence\u002Fnon-compliant.json\n$ cub-scout receipt list --format json \\\n    | jq '[.[] | select(.verdict == \"WATCH\")]' > evidence\u002Fwith-caveats.json\n$ cub-scout receipt list --format json \\\n    | jq '[.[] | select(.verdict == \"INCONCLUSIVE\")]' > evidence\u002Finconclusive.json\n\n# Audit-trail + scan + fleet outliers\n$ cub-scout audit list --since 90d --format json > evidence\u002Faudit.json\n$ cub-scout scan --format json > evidence\u002Fscan.json\n$ cub-scout fleet outliers --view prod-baseline-q2-2026 --format json > evidence\u002Foutliers.json\n\n# Rollup\n$ jq 'length' evidence\u002F{non-compliant,with-caveats,inconclusive}.json\n3\n12\n1\n```\n\nPilot's report cites the 3 non-compliant resources by name + their receipts + their violation reasons; the WATCH\u002FINCONCLUSIVE lists fill in the caveats; the audit-trail \u002F scan \u002F outliers layers give the auditor the cross-axis evidence. Total artifact count: 200 receipts (one per resource in scope) + 3 supporting JSON files. All fingerprint-verifiable.\n\n## Standalone vs connected\n\n**Connected mode is effectively required** for compliance audits:\n\n- `compare source-truth --strategy` — connected\n- `views resolve` \u002F `views project` — connected\n- `fleet outliers` — connected\n- `audit list` — connected\n- `receipt verify --strategy source-truth-pass` — connected\n\nStandalone-mode compliance is *narrower* (no View scope; no ConfigHub audit trail; no fleet-outlier dimension) and rarely useful for an external auditor. If standalone is the only option, Pilot's report should call out the limitation explicitly so the auditor knows what's missing.\n\n## Tool boundary\n\n- **Allowed (cub-scout):** Compare verbs (read-only), `scan`, `patterns`, `fleet outliers`, `views resolve` \u002F `project`, `receipt verify` \u002F `show` \u002F `validate` \u002F `list`, `map`, `audit list`. All read-only.\n- **Allowed (cluster):** `kubectl get\u002Fdescribe`. NOT `kubectl apply \u002F edit \u002F patch \u002F delete`.\n- **Allowed (ConfigHub):** `cub \u003Centity> get \u002F list` for the entities named in allowed-tools. NOT `cub * create \u002F update \u002F delete`.\n- **Compliance audits are read-only by design.** The audit produces evidence; remediation (re-aligning the non-compliant resources) is a separate operational decision, typically routed through `pilot-patch-and-drift` or `pilot-rollback-decision` — those skills handle Pilot's mutation path. This skill stops at the report.\n\n## References\n\n- [`pilot-fleet-conformance`](..\u002Fpilot-fleet-conformance\u002FSKILL.md) — same verbs, operational (same-day) framing instead of compliance (periodic) framing\n- [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md) — Compare verbs\n- [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md) — receipt persistence + validation\n- [`scout-govern`](..\u002Fscout-govern\u002FSKILL.md) — fleet, views, audit, summary\n- [`audit-fleet-conformance`](..\u002Faudit-fleet-conformance\u002FSKILL.md) — operator-side counterpart\n- [`scout-attribute`](..\u002Fscout-attribute\u002FSKILL.md) — per-field attribution for violation explainability\n- Source-truth contract: `#393`, `#418` (Phase 2 strategies)\n- Receipts v1+v2: `#446` (v1), `#463` (v2 surface)\n- Read-only triad: [`references\u002Fread-only-triad.md`](..\u002Freferences\u002Fread-only-triad.md)\n\n## Constraints\n\n- The audit is **point-in-time**: the report reflects the cluster + ConfigHub state at evaluation. Compliance frameworks that require continuous monitoring should pair this skill with [`pilot-watch-alert-response`](..\u002Fpilot-watch-alert-response\u002FSKILL.md) for the event-driven side.\n- Receipts are **fingerprint-stable but not signed** in v1\u002Fv2 (`#463`); cryptographic signing is a future hardening direction. Auditors who require non-repudiation need the future signing layer — flag this in the report.\n- The local receipt store at `$XDG_DATA_HOME\u002Fcub-scout\u002Freceipts` is **per-host**. For multi-host compliance pipelines, Pilot should archive each run's `evidence\u002F` directory externally (S3, ConfigHub bundle catalog, GitHub Release artifact) for the retention period.\n- `scan` covers ~46 built-in risk patterns; bespoke policies (custom CIS benchmarks, SOC 2 controls) need either custom patterns (out of cub-scout scope) or a policy engine (Kyverno, OPA Gatekeeper) that this skill doesn't replace.\n- Compliance vocabulary (Compliant \u002F Non-compliant) is the report-layer translation of receipt verdicts (PASS \u002F BLOCK). cub-scout doesn't speak compliance vocabulary natively; Pilot's report renders the translation.\n",{"name":5,"phase":64,"description":7,"allowed-tools":65},"cross-cutting","Bash(.\u002Fcub-scout compare three-way *) Bash(cub-scout compare three-way *) Bash(cub scout compare three-way *) Bash(.\u002Fcub-scout compare source-truth *) Bash(cub-scout compare source-truth *) Bash(cub scout compare source-truth *) Bash(.\u002Fcub-scout compare drift *) Bash(cub-scout compare drift *) Bash(cub scout compare drift *) Bash(.\u002Fcub-scout scan *) Bash(cub-scout scan *) Bash(cub scout scan *) Bash(.\u002Fcub-scout patterns *) Bash(cub-scout patterns *) Bash(cub scout patterns *) Bash(.\u002Fcub-scout fleet outliers *) Bash(cub-scout fleet outliers *) Bash(cub scout fleet outliers *) Bash(.\u002Fcub-scout views resolve *) Bash(cub-scout views resolve *) Bash(cub scout views resolve *) Bash(.\u002Fcub-scout views project *) Bash(cub-scout views project *) Bash(cub scout views project *) Bash(.\u002Fcub-scout receipt verify *) Bash(cub-scout receipt verify *) Bash(cub scout receipt verify *) Bash(.\u002Fcub-scout receipt list *) Bash(cub-scout receipt list *) Bash(cub scout receipt list *) Bash(.\u002Fcub-scout receipt show *) Bash(cub-scout receipt show *) Bash(cub scout receipt show *) Bash(.\u002Fcub-scout receipt validate *) Bash(cub-scout receipt validate *) Bash(cub scout receipt validate *) Bash(.\u002Fcub-scout map list *) Bash(.\u002Fcub-scout map workloads *) Bash(.\u002Fcub-scout map orphans *) Bash(cub-scout map list *) Bash(cub-scout map workloads *) Bash(cub-scout map orphans *) Bash(cub scout map list *) Bash(cub scout map workloads *) Bash(cub scout map orphans *) Bash(.\u002Fcub-scout audit *) Bash(cub-scout audit *) Bash(cub scout audit *) Bash(kubectl get *) Bash(kubectl describe *) Bash(cub space list *) Bash(cub unit get *) Bash(cub unit list *) Bash(cub link get *) Bash(cub link list *) Bash(cub view get *) Bash(cub view list *) Bash(cub unit-event list *) Bash(cub resource list *) Bash(cub release list *) Bash(cub changeset list *) Bash(cub view list)","main","261862e7ec5e5c93ce377ccfd6b583f5ac03c95c","skills\u002Fpilot-compliance-audit",1,"https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout","https:\u002F\u002Fgithub.com\u002Fconfighub","http:\u002F\u002Fwww.confighub.com","Public repo for ConfigHub","2026-11-11 04:47:05",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add confighub\u002Fcub-scout --skill pilot-compliance-audit",{"tool":81,"command":82},"bunx","bunx skills add confighub\u002Fcub-scout --skill pilot-compliance-audit",{"tool":84,"command":85},"pnpm","pnpm dlx skills add confighub\u002Fcub-scout --skill pilot-compliance-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fpilot-compliance-audit\u002FSKILL.md",true,[],[90,125,145,163,187,209],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":101,"publishedAt":59},"01M6CBPQHTK7YGVZD3MMH1328H","triage-unhealthy-workload","Use when the user is responding to a broken Kubernetes workload UNDER TIME PRESSURE — pager-going-off, CI-red, \"prod is down\" framing. Natural phrasing: \"deploy\u002Fapi is CrashLoopBackOff, what now?\", \"the rollout is stuck, help\", \"this pod won't start\", \"pager fired on payments\", \"everything is red in argocd\", \"what should I check first?\", \"give me a triage plan for this workload\". Composes doctor → explain → trace into a tight ~30-second loop the operator can run in a pager-acknowledged context. Do NOT load for: a planned investigation without urgency (use scout-diagnose directly), a drift question (use investigate-drift), or anything mutating (cub-scout never mutates — route to kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Ftriage-unhealthy-workload\u002FSKILL.md",[96],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[102,103,104,105,106,107,108,109,110,111,49,112,113,114,115,116,43,117,118,32,119,120,121,35,122,123,124],"triage","workload","triage unhealthy workload","kubernetes","diagnose","doctor","logs","ci","payments","api","loop","explain","check","broken","question","rollout","never","route","drift","map","get","now","when",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":59},"01M6CBPKYVREY83CQYNFW6BVD0","scout-verify","Use when the user wants a TYPED, FINGERPRINTED, IMMUTABLE evidence artifact about a Kubernetes resource — the Verify verb group of cub-scout (the receipt capability shipped in #446). Natural phrasing: \"produce a receipt that this is in compliance\", \"give me an attestation that the cluster matches Git\", \"I need a verifiable record for the audit trail\", \"build a receipt verifying no manual edits since deploy\", \"verify deploy\u002Fapi against source-truth and save the artifact\", \"validate this receipt has not been tampered with\", \"show me what receipts we have\", \"is this receipt tampered with?\", \"attach evidence to my CI gate\". Load whenever intent is receipt \u002F attestation \u002F evidence-artifact \u002F tamper-evident-record \u002F verified-record \u002F audit-trail \u002F postmortem-evidence \u002F acceptance-judge-input. Do NOT load for: a live comparison without a persisted artifact (use scout-compare), interpreting a single field's provenance (use scout-attribute), or actually applying a fix (cub-scout never mutates — route to cub \u002F argocd \u002F kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-verify\u002FSKILL.md",[131],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},[50,133,134,105,135,55,109,136,137,111,138,49,139,47,140,45,141,43,118,29,32,34,119,142,122,143,39,144,124],"scout verify","scout","acceptance","attestation","provenance","show me","postmortem","argocd","fix","me","app","managed",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":59},"01M6CBPF8WZBM7F9X096WT8PJD","scout-observe","Use when the user wants to SEE what is running in a Kubernetes cluster, who owns it, and how it is structured — the read-only Observe verb group of cub-scout. Natural phrasing: \"what is running in my cluster?\", \"give me a map of resources\", \"who owns this Deployment?\", \"trace this back to its source\", \"show me the ownership tree\", \"scan this cluster for risk\", \"dump the cluster as JSON\", \"stream cluster events\", \"run cub-scout as a bot\", \"what is the connection status?\", \"is this cluster healthy?\". Load when intent is observe \u002F inventory \u002F map \u002F show \u002F list \u002F trace \u002F scan \u002F dump \u002F stream \u002F bot \u002F health-check over a Kubernetes cluster. Do NOT load for: explaining WHY something is broken (use scout-diagnose), comparing cluster state to intended state (use scout-compare), provenance of individual field values (use scout-attribute), or any action that mutates the cluster (cub-scout never mutates — route to cub or kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-observe\u002FSKILL.md",[],[152,153,134,154,105,106,155,107,108,53,137,51,138,49,115,43,156,118,157,158,32,34,159,160,121,122,161,162,124],"observe","scout observe","bot","deployment","version","only","hooks","back","health-check","resources","meaning",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":172,"publishedAt":59},"01M6CBPBM5J9PX4H8CE628AY5X","scout-mcp","Use when the user wants to expose cub-scout to an AI agent over MCP, wants a deterministic AI-ready snapshot of cluster context, or wants cub-scout running as a read-only event bot — the Integrate verb group. Natural phrasing: \"start the MCP server\", \"expose cub-scout to Claude \u002F Codex \u002F my agent\", \"give me an AI-ready context pack of this cluster\", \"set up the MCP gateway\", \"what MCP tools does cub-scout expose?\", \"run cub-scout as a bot\", \"produce JSON context for an LLM to reason about this cluster\". Load whenever intent is mcp \u002F mcp-gateway \u002F mcp-serve \u002F context-pack \u002F bot \u002F agent-context \u002F ai-snapshot \u002F llm-context \u002F model-context-protocol. Do NOT load for: actually running a non-integrate verb (those are scout-observe \u002F scout-diagnose \u002F scout-compare \u002F scout-attribute \u002F scout-ingest \u002F scout-govern \u002F scout-verify), or `cub` MCP integration (that's a separate tool surface).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-mcp\u002FSKILL.md",[169],{"categoryNo":170,"categoryName":171,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000023","Skill与智能体开发",[173,174,134,154,175,176,177,178,57,56,179,180,49,181,47,182,183,157,184,185,152,122,39,186,124],"MCP","scout mcp","mcp server","ai agent","auth","config","server","SET","model","read","snapshot","ready","up","agent-context",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":59},"01M6CBP7D72G704FWGRXNB6F9T","scout-ingest","Use when the user wants to ADOPT existing Kubernetes \u002F GitOps workload structure into ConfigHub after observing the live cluster — the adoption\u002Fimport verb group of cub-scout. Natural phrasing: \"discover workloads in this cluster and propose ConfigHub units\", \"show me the import proposal before I apply\", \"import this Argo Application set\", \"bring my Flux Kustomizations into ConfigHub\", \"preview what would land in ConfigHub if I imported this repo\", \"parse my git repo as a ConfigHub import bundle\", \"import a cluster aggregator\", \"what would --git-path produce for this repo?\". Load whenever intent is adopt \u002F import \u002F ingest \u002F preview \u002F propose \u002F parse-repo \u002F discovery \u002F aggregator \u002F bring-into-confighub \u002F what-would-confighub-see. Do NOT load for: questions about who changed a resource, whether it was edited by hand or drifted (use scout-attribute or investigate-drift); reading an exported `kubectl get -o yaml` dump to answer a question about the cluster (that is not an import); basic live-cluster inventory (use scout-observe), troubleshooting (use scout-diagnose), comparing live state to ConfigHub (use scout-compare), or the actual write to ConfigHub via `cub variant upload` (that is `cub`, not cub-scout — route to cub skills). Important: `cub-scout import apply` IS the mutating write into ConfigHub — this skill teaches the read-only preview path and explicitly refuses to invoke `import apply` itself.","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-ingest\u002FSKILL.md",[],[194,195,134,105,106,56,196,55,197,180,51,198,138,49,47,199,116,182,200,45,43,157,152,32,34,201,202,203,204,143,39,205,206,207,208],"ingest","scout ingest","state","adoption","discovery","repo","write","structure","aggregator","adopt","argo","reading","exported","invoke","parse",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":215,"publishedAt":59},"01M6CBP32CYJT8DJSGNCRWXQTM","scout-govern","Use when the user wants to consume CONNECTED ConfigHub governance signals from cub-scout — the Govern verb group. Natural phrasing: \"show me the ChangeSet history for this unit\", \"what is the blast radius if I change this unit?\", \"which clusters in my fleet are outliers?\", \"show me yesterday's connected summary\", \"render this view across the fleet\", \"audit who changed this\", \"where did the last apply come from?\", \"list ConfigHub bundles I have\", \"show me the catalog of past snapshots\". Load whenever intent is history \u002F impact \u002F blast-radius \u002F fleet-outliers \u002F summary \u002F view \u002F audit \u002F bundle \u002F catalog \u002F connected-context. Do NOT load for: live cluster comparison (use scout-compare), receipts (use scout-verify), inventory of running pods (use scout-observe), or any mutation via cub. Most of this skill requires `cub auth login` — say so upfront.","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-govern\u002FSKILL.md",[],[216,134,217,177,218,219,25,51,50,138,49,220,47,45,221,43,222,223,224,152,32,34,28,122,225,226,39,227,228,41,229,124],"scout govern","change","governance","blast radius","history","catalog","diff","say","snapshots","mutation","impact","render","blast-radius","inspect"]