ce-probe-infralisted

# Probe Infra **Invocation input:** Scope to audit (a repo path, or empty for the whole repo): $ARGUMENTS Audit Infrastructure-as-Code, Kubernetes, and cloud manifests **statically** — reading the declarative resource graph on disk, not a running system. This is a **discovery** tool: it runs on **any repo**, needs no plan or spec, writes a dated audit report, and reports **findings, not verdicts** — every one cited to `file:line`, every actionable one routed up the spine. **Not a CSPM and not a policy engine** — a first cut that surfaces leads, with the deep work done by mature scanners where installed and a human owning the call. Sister to `ce-probe-sec` and `ce-probe-perf`: same probe-family discipline — orchestrate installed tools and degrade loudly, findings-not-verdicts, a tool-specific three-state evidence axis, a dated never-overwritten report under `docs/`. The difference is the whole point of the tool: those two exercise a **live** target; this one **parses files** and runs nothing, so it inherits none of their consent/production machinery and instead carries a **Secret-Redaction Rule**. ## Architecture — spine + per-format modules This `SKILL.md` is the **spine**: it owns the workflow arc, the evidence model, the redaction rule, the lenses, triage, the report, and Autonomous Mode. The **per-format check content** lives in modules loaded on demand at Stage 0: | Family (v1) | Detect by | Load module | Prefer scanner (where installed) | |---|---|---|---| | Terra