operator-incident-evidence

What problem does it solve?

This Skill solves the problem of producing an audit-ready, structured evidence package for a Kubernetes/GitOps incident after the peak has passed, so the postmortem can be written with confidence rather than guesswork.

Core Features & Use Cases

• Structured evidence capture: Composes trace + explain + compare three-way for affected resources to attribute what happened at the field level.
• Connected-mode timelines: Captures ChangeSets/history and ConfigHub audit trails to connect operator-visible events to governed intent.
• Fingerprintable receipts and validation: Generates immutable receipts via receipt verify --save and supports later receipt validate to prove evidence integrity.
• Offline replay artifacts: Uses bundle and snapshot so reviewers can inspect what cub-scout observed at capture time, even after the cluster moves on.

Quick Start

Build the evidence package for last night's incident for namespace prod and the affected workload payments-api, saving receipts and a bundle for offline review.