gitops-auditlisted

# gitops-audit The deployed cluster state matches a git-declared desired state, reconciled by a controller. This skill audits that the reconciliation discipline actually holds. ## Premise Imperative out-of-band changes and un-reconciled drift are forbidden — every change lands via a reviewed commit, and the controller reconciles git→cluster. Every finding cites the real artifact: the `kubectl apply` in a CI job or runbook that bypasses git, the Argo `Application` showing `OutOfSync` / `status: Unknown`, the committed manifest with a base64 `data:` secret that is not sealed/SOPS-encrypted, the `syncPolicy.automated.prune: true` with no safeguard, the dependent resources with no `sync-wave` annotation. A "there's drift" claim without the controller's sync-status output is not a finding. **Boundary (read first — this is not a CI/CD skill):** - `@ci-reviewer` and `add-ci` own the **CI pipeline** — build, test, scan, artifact publish, the workflow YAML. They do not audit whether the cluster matches git. - `@deployment-engineer` owns the **deploy strategy** (rolling/canary/rollback command). It mentions GitOps as one option; it does not audit the reconciliation loop's health. - **infra/cluster provisioning** (Terraform, cluster creation) is out of scope — this is not "how the cluster was built." - **THIS** owns the git→cluster **reconciliation discipline**: the controller loop, drift detection/auto-heal, no-manual-kubectl, sync waves, secrets-in-git safety, auto-sync+prune safe