review-conflisted

# review-conf Review an ansible.cfg and produce a structured severity report. This command never modifies files. --- ## Required Inputs 1. **path to ansible.cfg** — Resolved from discovery if not provided (checks ANSIBLE_CONFIG env, ./ansible.cfg, ~/.ansible.cfg, /etc/ansible/ansible.cfg in that order) --- ## Behavior ### Step 1 — Discovery Run discovery per `references/discovery.md`. Locate the ansible.cfg. Report which file will be reviewed. ### Step 2 — Load and Parse Read and parse the ansible.cfg as an INI file. Identify all sections and key-value pairs. ### Step 3 — Generate Severity Report ``` ## ansible.cfg Review: <path> Reviewed: <timestamp> Sections found: <list> --- ### CRITICAL [Critical issues] ### WARNING [Warnings] ### INFO [Informational notes] --- Summary: <X> critical, <Y> warnings, <Z> info ``` --- ## Checks to Perform ### CRITICAL | Check | Condition | Message | |-------|-----------|---------| | vault_password_file world-readable | `vault_password_file` path exists and is readable by others (check permissions) | `[defaults] vault_password_file '<path>' may be world-readable — run: chmod 600 <path>` | | Inline vault password | `vault_identity_list` contains an inline password (not a file path) | `[defaults] vault_identity_list contains what appears to be an inline password — use a file path instead` | | Deprecated accelerate | `[accelerate]` section present (removed in ansible-core 2.12) | `[accelerate] Section removed in ansible-core 2.