[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CBP32CYJT8DJSGNCRWXQTM":3,"skill-same:01M6CBP32CYJT8DJSGNCRWXQTM":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M6CBP32CYJT8DJSGNCRWXQTM","scout-govern",null,"Use when the user wants to consume CONNECTED ConfigHub governance signals from cub-scout — the Govern verb group. Natural phrasing: \"show me the ChangeSet history for this unit\", \"what is the blast radius if I change this unit?\", \"which clusters in my fleet are outliers?\", \"show me yesterday's connected summary\", \"render this view across the fleet\", \"audit who changed this\", \"where did the last apply come from?\", \"list ConfigHub bundles I have\", \"show me the catalog of past snapshots\". Load whenever intent is history \u002F impact \u002F blast-radius \u002F fleet-outliers \u002F summary \u002F view \u002F audit \u002F bundle \u002F catalog \u002F connected-context. Do NOT load for: live cluster comparison (use scout-compare), receipts (use scout-verify), inventory of running pods (use scout-observe), or any mutation via cub. Most of this skill requires `cub auth login` — say so upfront.","confighub\u002Fcub-scout","confighub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206140369?v=4","01M6CBJBWD33AFNG4VXMJHSRXD","ConfigHub Inc","01M6CBJC0K0F8CJVFWGRSR0KYC",14,"MIT","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-govern\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"scout","scout govern","snapshots","when","inspect","which","blast-radius","render","unit","impact","mutation","get","project","show","cub scout","observe","change","say","diff","use","catalog","view","changeset","history","Bash","show me","verify","inventory","audit","blast radius","governance","auth","2026-11-10 10:12:30",false,"---\nname: scout-govern\ndescription: 'Use when the user wants to consume CONNECTED ConfigHub governance signals from cub-scout — the Govern verb group. Natural phrasing: \"show me the ChangeSet history for this unit\", \"what is the blast radius if I change this unit?\", \"which clusters in my fleet are outliers?\", \"show me yesterday''s connected summary\", \"render this view across the fleet\", \"audit who changed this\", \"where did the last apply come from?\", \"list ConfigHub bundles I have\", \"show me the catalog of past snapshots\". Load whenever intent is history \u002F impact \u002F blast-radius \u002F fleet-outliers \u002F summary \u002F view \u002F audit \u002F bundle \u002F catalog \u002F connected-context. Do NOT load for: live cluster comparison (use scout-compare), receipts (use scout-verify), inventory of running pods (use scout-observe), or any mutation via cub. Most of this skill requires `cub auth login` — say so upfront.'\nphase: verify\nallowed-tools: Bash(.\u002Fcub-scout history *) Bash(cub-scout history *) Bash(cub scout history *) Bash(.\u002Fcub-scout impact *) Bash(cub-scout impact *) Bash(cub scout impact *) Bash(.\u002Fcub-scout fleet *) Bash(cub-scout fleet *) Bash(cub scout fleet *) Bash(.\u002Fcub-scout summary list *) Bash(cub-scout summary list *) Bash(cub scout summary list *) Bash(.\u002Fcub-scout views resolve *) Bash(.\u002Fcub-scout views project *) Bash(cub-scout views resolve *) Bash(cub-scout views project *) Bash(cub scout views resolve *) Bash(cub scout views project *) Bash(.\u002Fcub-scout audit *) Bash(cub-scout audit *) Bash(cub scout audit *) Bash(.\u002Fcub-scout bundle diff *) Bash(.\u002Fcub-scout bundle inspect *) Bash(.\u002Fcub-scout bundle summarize *) Bash(.\u002Fcub-scout bundle timeline *) Bash(cub-scout bundle diff *) Bash(cub-scout bundle inspect *) Bash(cub-scout bundle summarize *) Bash(cub-scout bundle timeline *) Bash(cub scout bundle diff *) Bash(cub scout bundle inspect *) Bash(cub scout bundle summarize *) Bash(cub scout bundle timeline *) Bash(.\u002Fcub-scout catalog list *) Bash(.\u002Fcub-scout catalog validate *) Bash(cub-scout catalog list *) Bash(cub-scout catalog validate *) Bash(cub scout catalog list *) Bash(cub scout catalog validate *) Bash(.\u002Fcub-scout status) Bash(cub-scout status) Bash(cub scout status) Bash(kubectl get *) Bash(kubectl describe *) Bash(cub space list *) Bash(cub unit get *) Bash(cub unit list *) Bash(cub link get *) Bash(cub link list *) Bash(cub view get *) Bash(cub view list *) Bash(cub unit-event list *) Bash(cub resource list *) Bash(cub release list *) Bash(cub changeset list *) Bash(cub auth status)\n---\n\n# scout-govern\n\nThe Govern verb group of cub-scout. Read-only consumption of connected ConfigHub governance signals — ChangeSet history, blast-radius impact analysis, fleet conformance, connected summaries, Views, audit trails, and bundle \u002F catalog state.\n\nMost of this skill requires **connected mode** (a logged-in `cub` CLI: `cub auth login`). Standalone-mode users get `bundle` \u002F `catalog` \u002F `audit` against local artifacts only.\n\n## When to use\n\nExplicit phrasings:\n\n- \"Show me the ChangeSet history for unit `payments-api`\"\n- \"What's the blast radius if I change this unit?\" \u002F \"what depends on this?\"\n- \"Which clusters in my fleet are outliers?\" \u002F \"show fleet conformance\"\n- \"Show me yesterday's connected summary for cluster X\"\n- \"Render Hub View `monthly-spend-by-team` across the fleet\"\n- \"Audit who changed deploy\u002Fapi recently\"\n- \"Where did the last apply come from?\"\n- \"List the ConfigHub bundles I have locally\"\n- \"Show me the catalog of past snapshots\"\n- \"What ConfigHub units \u002F spaces does this resource belong to?\"\n\nImplicit intents:\n\n- The user is investigating a change *retroactively* (history \u002F audit \u002F postmortem framing)\n- The user is gating a change *prospectively* (impact \u002F blast-radius \u002F promotion-safety framing)\n- The user is reasoning across the fleet (multi-cluster outliers, conformance)\n- The user wants a structured connected-mode snapshot rather than ad-hoc reads\n\n## Do not load for\n\n- Live cluster comparison (DRY\u002FWET\u002FLIVE) — [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md)\n- Typed, fingerprinted evidence artifacts (receipts) — [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md)\n- Inventory of running pods \u002F status — [`scout-observe`](..\u002Fscout-observe\u002FSKILL.md)\n- Interpreting *why* something is broken — [`scout-diagnose`](..\u002Fscout-diagnose\u002FSKILL.md)\n- ConfigHub mutations (create \u002F update \u002F delete units) — that's `cub`, not cub-scout. Route to [`confighub\u002Fconfighub-skills`](https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fconfighub-skills).\n\n## Standalone vs connected\n\n- **Connected (cluster + `cub auth login`):** `history`, `impact`, `fleet outliers`, `summary list\u002Fslack`, `views resolve`, `audit list` — all require ConfigHub auth.\n- **Standalone (cluster only):** `audit list` against local audit logs; `bundle inspect\u002Freplay\u002Fdiff\u002Fsummarize\u002Ftimeline` and `catalog list` against on-disk artifacts. No ConfigHub needed.\n- **Offline (artifact only):** `bundle inspect`, `bundle replay`, `bundle diff`, `bundle timeline`, `catalog list` work against `.bundle.tar` \u002F `.catalog.json` files with no cluster and no ConfigHub.\n\n`cub-scout status` is the entry point that says which mode you're in.\n\n## Tool boundary\n\n- **Allowed (read-only):** all eight Govern verbs; `kubectl get\u002Fdescribe` for cross-reference; `cub \u003Centity> get \u002F list` for the entities named in allowed-tools (connected); `cub auth status` to confirm mode.\n- **Not allowed:** `cub * create\u002Fupdate\u002Fdelete`, `cub variant upload` (mutating), `kubectl apply\u002Fedit\u002Fpatch\u002Fdelete`, `argocd app sync`, `flux reconcile --with-source`. Governance verbs *read* the connected surface; they never write to it.\n- **`fleet` and `summary`:** read across multiple clusters via ConfigHub's connected snapshots. They do NOT shell out to each cluster's kubeconfig directly — the connected surface is the source of truth.\n\n## The verb menu\n\n| Question | Verb | Notes |\n|---|---|---|\n| \"Who changed this unit, when?\" | `cub-scout history \u003Ckind>\u002F\u003Cname> -n \u003Cns>` | ChangeSet timeline for the unit tied to this resource. Requires connected. |\n| \"What depends on this unit?\" | `cub-scout impact \u003Cunit-slug>` | Blast-radius preview: which downstream units \u002F clusters \u002F Apps would be affected. Requires connected. |\n| \"Which clusters are outliers?\" | `cub-scout fleet outliers --view \u003Cview>` | Fleet-wide conformance against a View. Requires connected. |\n| \"Show me the connected summary\" | `cub-scout summary list --cluster \u003Cname> --format json` | List stored connected summaries with `observation` metadata. `summary slack` formats for Slack output. |\n| \"Render a Hub View\" | `cub-scout views resolve \u003Curl-or-uuid>` | Resolve a ConfigHub Hub View URL to its structured columns. `--scope cluster` for fleet-wide. |\n| \"Audit who changed what\" | `cub-scout audit list` | Audit log entries. Read-only access to ConfigHub's audit trail. |\n| \"Inspect a debug bundle\" | `cub-scout bundle inspect \u003Cpath>` | `bundle replay \u002F diff \u002F summarize \u002F timeline` for richer per-bundle reads. |\n| \"List my bundle catalogs\" | `cub-scout catalog list` | Multi-bundle catalog view — useful for time-series \u002F per-environment archives. |\n\n## The loop\n\n1. **Check the mode.** Run `cub-scout status` to confirm whether you're connected. If not and the user needs connected data, say so explicitly — don't half-answer with stale local data.\n2. **Pick the verb.** Most user prompts map cleanly to one of the eight verbs above.\n3. **Invoke.** Use `--format json` for agent \u002F CI consumption; the default ASCII output is human-friendly.\n4. **Read the evidence.** Each verb has a structured shape (ChangeSet timeline, impact graph, fleet outlier list, View column matrix). They feed Pilot's acceptance kernel and similar tooling directly.\n5. **Hand off.** If the user wants to *act* on a governance finding (\"revert this change\", \"promote to staging\", \"apply the missing unit\"), route to a `cub` skill. cub-scout never mutates ConfigHub.\n\n## Worked examples\n\n### A: ChangeSet history (connected)\n\n```bash\n$ cub-scout history deploy\u002Fapi -n prod\nChangeSet timeline for unit payments-api:\n  2026-05-22T10:30Z  Apply by ci-bot     rev=42  \"promote v2.3.0\"\n  2026-05-21T14:00Z  Apply by alice      rev=41  \"config tuning\"\n  2026-05-20T09:15Z  Create by alice     rev=40  \"initial unit\"\n\nConfigHub URL: https:\u002F\u002Fhub.confighub.com\u002Fp\u002Fpayments\u002Fu\u002Fpayments-api\n```\n\n### B: blast-radius impact (connected)\n\n```bash\n$ cub-scout impact payments-api --format json\n{\n  \"unit\": \"payments-api\",\n  \"downstream\": [\n    {\"kind\": \"App\", \"name\": \"checkout\", \"via\": \"link:env-shared\"},\n    {\"kind\": \"Unit\", \"name\": \"payments-worker\", \"via\": \"link:image-shared\"}\n  ],\n  \"clusters\": [\"prod-use2\", \"prod-euw1\", \"staging-use2\"]\n}\n```\n\n### C: fleet outliers against a View (connected)\n\n```bash\n$ cub-scout fleet outliers --view monthly-spend-by-team\nView: monthly-spend-by-team\nClusters: 12\n\n  payments  EXPECTED 3 deploys \u002F cluster   prod-euw1: 2 (outlier: missing payments-worker)\n  checkout  EXPECTED 5 deploys \u002F cluster   ALL match\n  search    EXPECTED 4 deploys \u002F cluster   staging-use2: 3 (outlier: missing search-replica)\n```\n\n### D: bundle inspect (offline, no cluster needed)\n\n```bash\n$ cub-scout bundle inspect .\u002Fprod-snapshot.bundle.tar\nBundle: prod-snapshot.bundle.tar\n  capturedAt: 2026-05-22T10:30:00Z\n  cluster: prod-use2\n  resources: 247\n  topNamespaces: payments(48), checkout(32), platform(20)\n```\n\n`bundle diff` \u002F `bundle timeline` work the same way for multi-bundle comparisons.\n\n## Output evidence\n\n| Verb | Returns |\n|---|---|\n| `history` | ChangeSet timeline + ConfigHub deep-link |\n| `impact` | Downstream unit \u002F cluster \u002F App graph |\n| `fleet outliers` | Per-View matrix with outlier rows highlighted |\n| `summary` | Stored connected summaries indexed by cluster \u002F timestamp, with `summary-store` observation metadata in JSON output |\n| `views resolve` | Structured columns from a Hub View URL |\n| `audit` | Audit log entries (read-only ConfigHub audit trail) |\n| `bundle inspect\u002Fdiff\u002Fsummarize\u002Ftimeline` | Per-bundle structured reads |\n| `catalog list` | Multi-bundle catalog metadata |\n\n## Connected-mode trust surface\n\nWhere `history` \u002F `impact` \u002F `fleet outliers` return guidance about whether to act, those hints are **trust signals** for Pilot and similar acceptance kernels. They are NEVER action recommendations from cub-scout itself. Per the read-only triad (#410 \u002F #428):\n\n- cub-scout = evidence (this skill)\n- ConfigHub = authority (where the state lives)\n- Pilot = judge (decides accept \u002F wait \u002F block)\n\nIf a user is reading impact output and asks \"should I promote?\", route them to Pilot or to a human acceptance step — never let cub-scout produce an \"approved\" answer.\n\n## References\n\n- Command reference: [`docs\u002Freference\u002Fcommands.md`](..\u002F..\u002Fdocs\u002Freference\u002Fcommands.md) § history, § impact, § fleet, § summary, § views, § audit, § bundle, § catalog\n- Bundle format: [`docs\u002Fhowto\u002Fbundle-diff.md`](..\u002F..\u002Fdocs\u002Fhowto\u002Fbundle-diff.md), [`docs\u002Fhowto\u002Fbundle-timeline.md`](..\u002F..\u002Fdocs\u002Fhowto\u002Fbundle-timeline.md)\n- Catalog format: [`docs\u002Fhowto\u002Fcatalog.md`](..\u002F..\u002Fdocs\u002Fhowto\u002Fcatalog.md)\n- Views: [`docs\u002Freference\u002Fjson-contracts.md`](..\u002F..\u002Fdocs\u002Freference\u002Fjson-contracts.md), `cub-scout\u002F#391`\n- Read-only triad: `cub-scout\u002F#410`, `cub-scout\u002F#428`\n\n## Constraints\n\n- Connected verbs (history \u002F impact \u002F fleet \u002F summary \u002F views \u002F audit) refuse to run without `cub auth login`. The error message points at auth, not at the verb.\n- `bundle` \u002F `catalog` work in standalone mode but cannot resolve ConfigHub-specific identifiers (unit slugs, space names) without connected context. They surface the unresolved references explicitly.\n- This skill does not generate receipts — receipts are [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md)'s job. Govern returns *governance evidence*; Verify returns *fingerprinted artifacts*.\n","# scout-govern\n\nThe Govern verb group of cub-scout. Read-only consumption of connected ConfigHub governance signals — ChangeSet history, blast-radius impact analysis, fleet conformance, connected summaries, Views, audit trails, and bundle \u002F catalog state.\n\nMost of this skill requires **connected mode** (a logged-in `cub` CLI: `cub auth login`). Standalone-mode users get `bundle` \u002F `catalog` \u002F `audit` against local artifacts only.\n\n## When to use\n\nExplicit phrasings:\n\n- \"Show me the ChangeSet history for unit `payments-api`\"\n- \"What's the blast radius if I change this unit?\" \u002F \"what depends on this?\"\n- \"Which clusters in my fleet are outliers?\" \u002F \"show fleet conformance\"\n- \"Show me yesterday's connected summary for cluster X\"\n- \"Render Hub View `monthly-spend-by-team` across the fleet\"\n- \"Audit who changed deploy\u002Fapi recently\"\n- \"Where did the last apply come from?\"\n- \"List the ConfigHub bundles I have locally\"\n- \"Show me the catalog of past snapshots\"\n- \"What ConfigHub units \u002F spaces does this resource belong to?\"\n\nImplicit intents:\n\n- The user is investigating a change *retroactively* (history \u002F audit \u002F postmortem framing)\n- The user is gating a change *prospectively* (impact \u002F blast-radius \u002F promotion-safety framing)\n- The user is reasoning across the fleet (multi-cluster outliers, conformance)\n- The user wants a structured connected-mode snapshot rather than ad-hoc reads\n\n## Do not load for\n\n- Live cluster comparison (DRY\u002FWET\u002FLIVE) — [`scout-compare`](..\u002Fscout-compare\u002FSKILL.md)\n- Typed, fingerprinted evidence artifacts (receipts) — [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md)\n- Inventory of running pods \u002F status — [`scout-observe`](..\u002Fscout-observe\u002FSKILL.md)\n- Interpreting *why* something is broken — [`scout-diagnose`](..\u002Fscout-diagnose\u002FSKILL.md)\n- ConfigHub mutations (create \u002F update \u002F delete units) — that's `cub`, not cub-scout. Route to [`confighub\u002Fconfighub-skills`](https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fconfighub-skills).\n\n## Standalone vs connected\n\n- **Connected (cluster + `cub auth login`):** `history`, `impact`, `fleet outliers`, `summary list\u002Fslack`, `views resolve`, `audit list` — all require ConfigHub auth.\n- **Standalone (cluster only):** `audit list` against local audit logs; `bundle inspect\u002Freplay\u002Fdiff\u002Fsummarize\u002Ftimeline` and `catalog list` against on-disk artifacts. No ConfigHub needed.\n- **Offline (artifact only):** `bundle inspect`, `bundle replay`, `bundle diff`, `bundle timeline`, `catalog list` work against `.bundle.tar` \u002F `.catalog.json` files with no cluster and no ConfigHub.\n\n`cub-scout status` is the entry point that says which mode you're in.\n\n## Tool boundary\n\n- **Allowed (read-only):** all eight Govern verbs; `kubectl get\u002Fdescribe` for cross-reference; `cub \u003Centity> get \u002F list` for the entities named in allowed-tools (connected); `cub auth status` to confirm mode.\n- **Not allowed:** `cub * create\u002Fupdate\u002Fdelete`, `cub variant upload` (mutating), `kubectl apply\u002Fedit\u002Fpatch\u002Fdelete`, `argocd app sync`, `flux reconcile --with-source`. Governance verbs *read* the connected surface; they never write to it.\n- **`fleet` and `summary`:** read across multiple clusters via ConfigHub's connected snapshots. They do NOT shell out to each cluster's kubeconfig directly — the connected surface is the source of truth.\n\n## The verb menu\n\n| Question | Verb | Notes |\n|---|---|---|\n| \"Who changed this unit, when?\" | `cub-scout history \u003Ckind>\u002F\u003Cname> -n \u003Cns>` | ChangeSet timeline for the unit tied to this resource. Requires connected. |\n| \"What depends on this unit?\" | `cub-scout impact \u003Cunit-slug>` | Blast-radius preview: which downstream units \u002F clusters \u002F Apps would be affected. Requires connected. |\n| \"Which clusters are outliers?\" | `cub-scout fleet outliers --view \u003Cview>` | Fleet-wide conformance against a View. Requires connected. |\n| \"Show me the connected summary\" | `cub-scout summary list --cluster \u003Cname> --format json` | List stored connected summaries with `observation` metadata. `summary slack` formats for Slack output. |\n| \"Render a Hub View\" | `cub-scout views resolve \u003Curl-or-uuid>` | Resolve a ConfigHub Hub View URL to its structured columns. `--scope cluster` for fleet-wide. |\n| \"Audit who changed what\" | `cub-scout audit list` | Audit log entries. Read-only access to ConfigHub's audit trail. |\n| \"Inspect a debug bundle\" | `cub-scout bundle inspect \u003Cpath>` | `bundle replay \u002F diff \u002F summarize \u002F timeline` for richer per-bundle reads. |\n| \"List my bundle catalogs\" | `cub-scout catalog list` | Multi-bundle catalog view — useful for time-series \u002F per-environment archives. |\n\n## The loop\n\n1. **Check the mode.** Run `cub-scout status` to confirm whether you're connected. If not and the user needs connected data, say so explicitly — don't half-answer with stale local data.\n2. **Pick the verb.** Most user prompts map cleanly to one of the eight verbs above.\n3. **Invoke.** Use `--format json` for agent \u002F CI consumption; the default ASCII output is human-friendly.\n4. **Read the evidence.** Each verb has a structured shape (ChangeSet timeline, impact graph, fleet outlier list, View column matrix). They feed Pilot's acceptance kernel and similar tooling directly.\n5. **Hand off.** If the user wants to *act* on a governance finding (\"revert this change\", \"promote to staging\", \"apply the missing unit\"), route to a `cub` skill. cub-scout never mutates ConfigHub.\n\n## Worked examples\n\n### A: ChangeSet history (connected)\n\n```bash\n$ cub-scout history deploy\u002Fapi -n prod\nChangeSet timeline for unit payments-api:\n  2026-05-22T10:30Z  Apply by ci-bot     rev=42  \"promote v2.3.0\"\n  2026-05-21T14:00Z  Apply by alice      rev=41  \"config tuning\"\n  2026-05-20T09:15Z  Create by alice     rev=40  \"initial unit\"\n\nConfigHub URL: https:\u002F\u002Fhub.confighub.com\u002Fp\u002Fpayments\u002Fu\u002Fpayments-api\n```\n\n### B: blast-radius impact (connected)\n\n```bash\n$ cub-scout impact payments-api --format json\n{\n  \"unit\": \"payments-api\",\n  \"downstream\": [\n    {\"kind\": \"App\", \"name\": \"checkout\", \"via\": \"link:env-shared\"},\n    {\"kind\": \"Unit\", \"name\": \"payments-worker\", \"via\": \"link:image-shared\"}\n  ],\n  \"clusters\": [\"prod-use2\", \"prod-euw1\", \"staging-use2\"]\n}\n```\n\n### C: fleet outliers against a View (connected)\n\n```bash\n$ cub-scout fleet outliers --view monthly-spend-by-team\nView: monthly-spend-by-team\nClusters: 12\n\n  payments  EXPECTED 3 deploys \u002F cluster   prod-euw1: 2 (outlier: missing payments-worker)\n  checkout  EXPECTED 5 deploys \u002F cluster   ALL match\n  search    EXPECTED 4 deploys \u002F cluster   staging-use2: 3 (outlier: missing search-replica)\n```\n\n### D: bundle inspect (offline, no cluster needed)\n\n```bash\n$ cub-scout bundle inspect .\u002Fprod-snapshot.bundle.tar\nBundle: prod-snapshot.bundle.tar\n  capturedAt: 2026-05-22T10:30:00Z\n  cluster: prod-use2\n  resources: 247\n  topNamespaces: payments(48), checkout(32), platform(20)\n```\n\n`bundle diff` \u002F `bundle timeline` work the same way for multi-bundle comparisons.\n\n## Output evidence\n\n| Verb | Returns |\n|---|---|\n| `history` | ChangeSet timeline + ConfigHub deep-link |\n| `impact` | Downstream unit \u002F cluster \u002F App graph |\n| `fleet outliers` | Per-View matrix with outlier rows highlighted |\n| `summary` | Stored connected summaries indexed by cluster \u002F timestamp, with `summary-store` observation metadata in JSON output |\n| `views resolve` | Structured columns from a Hub View URL |\n| `audit` | Audit log entries (read-only ConfigHub audit trail) |\n| `bundle inspect\u002Fdiff\u002Fsummarize\u002Ftimeline` | Per-bundle structured reads |\n| `catalog list` | Multi-bundle catalog metadata |\n\n## Connected-mode trust surface\n\nWhere `history` \u002F `impact` \u002F `fleet outliers` return guidance about whether to act, those hints are **trust signals** for Pilot and similar acceptance kernels. They are NEVER action recommendations from cub-scout itself. Per the read-only triad (#410 \u002F #428):\n\n- cub-scout = evidence (this skill)\n- ConfigHub = authority (where the state lives)\n- Pilot = judge (decides accept \u002F wait \u002F block)\n\nIf a user is reading impact output and asks \"should I promote?\", route them to Pilot or to a human acceptance step — never let cub-scout produce an \"approved\" answer.\n\n## References\n\n- Command reference: [`docs\u002Freference\u002Fcommands.md`](..\u002F..\u002Fdocs\u002Freference\u002Fcommands.md) § history, § impact, § fleet, § summary, § views, § audit, § bundle, § catalog\n- Bundle format: [`docs\u002Fhowto\u002Fbundle-diff.md`](..\u002F..\u002Fdocs\u002Fhowto\u002Fbundle-diff.md), [`docs\u002Fhowto\u002Fbundle-timeline.md`](..\u002F..\u002Fdocs\u002Fhowto\u002Fbundle-timeline.md)\n- Catalog format: [`docs\u002Fhowto\u002Fcatalog.md`](..\u002F..\u002Fdocs\u002Fhowto\u002Fcatalog.md)\n- Views: [`docs\u002Freference\u002Fjson-contracts.md`](..\u002F..\u002Fdocs\u002Freference\u002Fjson-contracts.md), `cub-scout\u002F#391`\n- Read-only triad: `cub-scout\u002F#410`, `cub-scout\u002F#428`\n\n## Constraints\n\n- Connected verbs (history \u002F impact \u002F fleet \u002F summary \u002F views \u002F audit) refuse to run without `cub auth login`. The error message points at auth, not at the verb.\n- `bundle` \u002F `catalog` work in standalone mode but cannot resolve ConfigHub-specific identifiers (unit slugs, space names) without connected context. They surface the unresolved references explicitly.\n- This skill does not generate receipts — receipts are [`scout-verify`](..\u002Fscout-verify\u002FSKILL.md)'s job. Govern returns *governance evidence*; Verify returns *fingerprinted artifacts*.\n",{"name":5,"phase":45,"description":7,"allowed-tools":56},"Bash(.\u002Fcub-scout history *) Bash(cub-scout history *) Bash(cub scout history *) Bash(.\u002Fcub-scout impact *) Bash(cub-scout impact *) Bash(cub scout impact *) Bash(.\u002Fcub-scout fleet *) Bash(cub-scout fleet *) Bash(cub scout fleet *) Bash(.\u002Fcub-scout summary list *) Bash(cub-scout summary list *) Bash(cub scout summary list *) Bash(.\u002Fcub-scout views resolve *) Bash(.\u002Fcub-scout views project *) Bash(cub-scout views resolve *) Bash(cub-scout views project *) Bash(cub scout views resolve *) Bash(cub scout views project *) Bash(.\u002Fcub-scout audit *) Bash(cub-scout audit *) Bash(cub scout audit *) Bash(.\u002Fcub-scout bundle diff *) Bash(.\u002Fcub-scout bundle inspect *) Bash(.\u002Fcub-scout bundle summarize *) Bash(.\u002Fcub-scout bundle timeline *) Bash(cub-scout bundle diff *) Bash(cub-scout bundle inspect *) Bash(cub-scout bundle summarize *) Bash(cub-scout bundle timeline *) Bash(cub scout bundle diff *) Bash(cub scout bundle inspect *) Bash(cub scout bundle summarize *) Bash(cub scout bundle timeline *) Bash(.\u002Fcub-scout catalog list *) Bash(.\u002Fcub-scout catalog validate *) Bash(cub-scout catalog list *) Bash(cub-scout catalog validate *) Bash(cub scout catalog list *) Bash(cub scout catalog validate *) Bash(.\u002Fcub-scout status) Bash(cub-scout status) Bash(cub scout status) Bash(kubectl get *) Bash(kubectl describe *) Bash(cub space list *) Bash(cub unit get *) Bash(cub unit list *) Bash(cub link get *) Bash(cub link list *) Bash(cub view get *) Bash(cub view list *) Bash(cub unit-event list *) Bash(cub resource list *) Bash(cub release list *) Bash(cub changeset list *) Bash(cub auth status)","main","261862e7ec5e5c93ce377ccfd6b583f5ac03c95c","skills\u002Fscout-govern",1,"https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout","https:\u002F\u002Fgithub.com\u002Fconfighub","http:\u002F\u002Fwww.confighub.com","Public repo for ConfigHub","2026-11-11 04:47:05",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add confighub\u002Fcub-scout --skill scout-govern",{"tool":72,"command":73},"bunx","bunx skills add confighub\u002Fcub-scout --skill scout-govern",{"tool":75,"command":76},"pnpm","pnpm dlx skills add confighub\u002Fcub-scout --skill scout-govern","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-govern\u002FSKILL.md",true,[],[81,115,135,153,178,200],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":92,"publishedAt":51},"01M6CBPQHTK7YGVZD3MMH1328H","triage-unhealthy-workload","Use when the user is responding to a broken Kubernetes workload UNDER TIME PRESSURE — pager-going-off, CI-red, \"prod is down\" framing. Natural phrasing: \"deploy\u002Fapi is CrashLoopBackOff, what now?\", \"the rollout is stuck, help\", \"this pod won't start\", \"pager fired on payments\", \"everything is red in argocd\", \"what should I check first?\", \"give me a triage plan for this workload\". Composes doctor → explain → trace into a tight ~30-second loop the operator can run in a pager-acknowledged context. Do NOT load for: a planned investigation without urgency (use scout-diagnose directly), a drift question (use investigate-drift), or anything mutating (cub-scout never mutates — route to kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Ftriage-unhealthy-workload\u002FSKILL.md",[87],{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[93,94,95,96,97,98,99,100,101,102,43,103,104,105,106,107,38,108,109,33,110,111,112,113,30,114,22],"triage","workload","triage unhealthy workload","kubernetes","diagnose","doctor","logs","ci","payments","api","loop","explain","check","broken","question","rollout","never","route","drift","map","time","now",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":51},"01M6CBPKYVREY83CQYNFW6BVD0","scout-verify","Use when the user wants a TYPED, FINGERPRINTED, IMMUTABLE evidence artifact about a Kubernetes resource — the Verify verb group of cub-scout (the receipt capability shipped in #446). Natural phrasing: \"produce a receipt that this is in compliance\", \"give me an attestation that the cluster matches Git\", \"I need a verifiable record for the audit trail\", \"build a receipt verifying no manual edits since deploy\", \"verify deploy\u002Fapi against source-truth and save the artifact\", \"validate this receipt has not been tampered with\", \"show me what receipts we have\", \"is this receipt tampered with?\", \"attach evidence to my CI gate\". Load whenever intent is receipt \u002F attestation \u002F evidence-artifact \u002F tamper-evident-record \u002F verified-record \u002F audit-trail \u002F postmortem-evidence \u002F acceptance-judge-input. Do NOT load for: a live comparison without a persisted artifact (use scout-compare), interpreting a single field's provenance (use scout-attribute), or actually applying a fix (cub-scout never mutates — route to cub \u002F argocd \u002F kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-verify\u002FSKILL.md",[121],{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},[45,123,19,96,124,125,100,126,127,102,44,43,128,41,129,40,130,38,109,131,33,32,110,132,30,133,27,134,22],"scout verify","acceptance","produce","attestation","provenance","postmortem","argocd","fix","evidence","me","app","managed",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":51},"01M6CBPF8WZBM7F9X096WT8PJD","scout-observe","Use when the user wants to SEE what is running in a Kubernetes cluster, who owns it, and how it is structured — the read-only Observe verb group of cub-scout. Natural phrasing: \"what is running in my cluster?\", \"give me a map of resources\", \"who owns this Deployment?\", \"trace this back to its source\", \"show me the ownership tree\", \"scan this cluster for risk\", \"dump the cluster as JSON\", \"stream cluster events\", \"run cub-scout as a bot\", \"what is the connection status?\", \"is this cluster healthy?\". Load when intent is observe \u002F inventory \u002F map \u002F show \u002F list \u002F trace \u002F scan \u002F dump \u002F stream \u002F bot \u002F health-check over a Kubernetes cluster. Do NOT load for: explaining WHY something is broken (use scout-diagnose), comparing cluster state to intended state (use scout-compare), provenance of individual field values (use scout-attribute), or any action that mutates the cluster (cub-scout never mutates — route to cub or kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-observe\u002FSKILL.md",[],[34,142,19,143,96,97,144,98,99,145,127,46,44,43,106,38,146,109,147,148,33,32,149,150,112,30,151,152,22],"scout observe","bot","deployment","risk","version","only","hooks","back","health-check","resources","meaning",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":162,"publishedAt":51},"01M6CBPBM5J9PX4H8CE628AY5X","scout-mcp","Use when the user wants to expose cub-scout to an AI agent over MCP, wants a deterministic AI-ready snapshot of cluster context, or wants cub-scout running as a read-only event bot — the Integrate verb group. Natural phrasing: \"start the MCP server\", \"expose cub-scout to Claude \u002F Codex \u002F my agent\", \"give me an AI-ready context pack of this cluster\", \"set up the MCP gateway\", \"what MCP tools does cub-scout expose?\", \"run cub-scout as a bot\", \"produce JSON context for an LLM to reason about this cluster\". Load whenever intent is mcp \u002F mcp-gateway \u002F mcp-serve \u002F context-pack \u002F bot \u002F agent-context \u002F ai-snapshot \u002F llm-context \u002F model-context-protocol. Do NOT load for: actually running a non-integrate verb (those are scout-observe \u002F scout-diagnose \u002F scout-compare \u002F scout-attribute \u002F scout-ingest \u002F scout-govern \u002F scout-verify), or `cub` MCP integration (that's a separate tool surface).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-mcp\u002FSKILL.md",[159],{"categoryNo":160,"categoryName":161,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000023","Skill与智能体开发",[163,164,19,143,165,166,50,167,168,169,170,171,43,172,41,173,174,147,175,176,34,30,27,177,22],"MCP","scout mcp","mcp server","ai agent","config","run","release","server","SET","model","read","snapshot","ready","up","agent-context",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":51},"01M6CBP7D72G704FWGRXNB6F9T","scout-ingest","Use when the user wants to ADOPT existing Kubernetes \u002F GitOps workload structure into ConfigHub after observing the live cluster — the adoption\u002Fimport verb group of cub-scout. Natural phrasing: \"discover workloads in this cluster and propose ConfigHub units\", \"show me the import proposal before I apply\", \"import this Argo Application set\", \"bring my Flux Kustomizations into ConfigHub\", \"preview what would land in ConfigHub if I imported this repo\", \"parse my git repo as a ConfigHub import bundle\", \"import a cluster aggregator\", \"what would --git-path produce for this repo?\". Load whenever intent is adopt \u002F import \u002F ingest \u002F preview \u002F propose \u002F parse-repo \u002F discovery \u002F aggregator \u002F bring-into-confighub \u002F what-would-confighub-see. Do NOT load for: questions about who changed a resource, whether it was edited by hand or drifted (use scout-attribute or investigate-drift); reading an exported `kubectl get -o yaml` dump to answer a question about the cluster (that is not an import); basic live-cluster inventory (use scout-observe), troubleshooting (use scout-diagnose), comparing live state to ConfigHub (use scout-compare), or the actual write to ConfigHub via `cub variant upload` (that is `cub`, not cub-scout — route to cub skills). Important: `cub-scout import apply` IS the mutating write into ConfigHub — this skill teaches the read-only preview path and explicitly refuses to invoke `import apply` itself.","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-ingest\u002FSKILL.md",[],[185,186,19,96,97,169,187,125,188,171,46,189,44,43,41,190,107,173,191,40,38,147,34,33,32,192,193,194,195,133,27,196,197,198,199],"ingest","scout ingest","state","adoption","discovery","repo","write","structure","aggregator","adopt","argo","reading","exported","invoke","parse",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":206,"publishedAt":51},"01M6CBNZ2JCB0050H8NYYGQMDN","scout-diagnose","Use when the user wants cub-scout to INTERPRET what it sees and suggest a next step — the Diagnose verb group. Natural phrasing: \"explain this Deployment\", \"why is this broken?\", \"what should I do about this?\", \"is this drift or just slow sync?\", \"what does this error mean?\", \"is there a known pattern for this?\", \"is my GitOps pipeline healthy?\", \"what events are firing on this Pod?\", \"give me a suggested remedy for this finding\". Load whenever intent is explain \u002F why \u002F what-does-it-mean \u002F what-should-I-do \u002F interpret \u002F diagnose \u002F recommend \u002F suggest-fix over a Kubernetes cluster or a scan finding. Do NOT load for: pure cluster inventory (use scout-observe), comparing intended vs running state at the field level (use scout-compare), field-level provenance (use scout-attribute), or actually applying a fix (cub-scout never mutates — route to cub or kubectl with the user driving).","https:\u002F\u002Fgithub.com\u002Fconfighub\u002Fcub-scout\u002Fblob\u002Fmain\u002Fskills\u002Fscout-diagnose\u002FSKILL.md",[],[97,207,19,96,208,144,187,99,209,127,46,43,104,129,210,106,130,38,109,34,33,110,111,132,211,30,133,212,213,22],"scout diagnose","debug","pipeline","just","next","error","what-should-i-do"]