heinzel-fleet-audit

# heinzel-fleet-audit Cross-server policy audit. Heinzel knows every host individually but has nothing that holds hosts against each other. This skill closes that gap by probing the same set of settings on every server in `memory/servers/` and rendering a side-by-side comparison so silent drift becomes visible. **No configuration changes.** The audit never alters any host's configuration. The only write is a single audit-trail line to each host's system journal (step 6 below). Acting on findings is a separate step (heinzel-housekeeping for per-host fixes, or manual edits with explicit user approval). **Never run automatically** — only on explicit user request. ## When to use - "Run a fleet audit" - "Vergleiche die Policies auf allen Servern" - "Drift check across the fleet" - After fixing a config bug on one host: "which other hosts have the same problem?" Do NOT auto-invoke for generic phrases like "check my servers" — that maps to single-host housekeeping. ## Workflow 1. **Discover hosts.** List directories under `memory/servers/` whose name resolves to a real host (skip placeholders like `server1.example.com` and `192.168.64.20` unless the user names them explicitly). The user may pass an explicit subset as arguments — in that case audit only those. 2. **Resolve SSH users.** Read `memory/user.md` for the per-host SSH user. Hosts without a mapping go on a "skipped: no SSH user known" list (do not prompt — just report). 3. **Probe in paral...