control-deployment — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited control-deployment (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The iron rule: never mutate a live environment. flyctl, sentry-cli, PostHog and the GitHub API are investigation tools here — logs, status, releases, issues. Every change, including config and pipeline fixes, rides a PR through CI/CD (flyctl deploy, flyctl secrets set, dashboard edits are all forbidden). If a fix genuinely cannot ride a PR (needs Luc's credentials, a paid-plan switch), report BLOCKED-HUMAN instead of improvising.
Read references/deploy-topologies.md first — each repo deploys differently, and assuming one shape is how monitoring misses a stage.
gh run list --branch main --limit 5 --json databaseId,name,headSha,status,conclusion
# Tag-publish repos (openlatch-client/provider): tag runs never show under --branch main —
gh run list --workflow publish.yml --limit 3 --json databaseId,headSha,status,conclusion
gh run watch <run-id> --exit-status # the run whose headSha matches the merged SHAWatch every stage the repo's pipeline actually has (staging deploy, smoke, canary, auto-prod where it exists — monitor those too; they're part of the same run).
gh run view <id> --log-failed, then:
| Failure | Action |
|---|---|
| Build/image (deps, Dockerfile syntax) | Fix PR (lockfile refresh, Dockerfile correction) |
| Secrets/config staging step | Fix the workflow/config-as-code via PR; if the secret VALUE is missing/wrong → BLOCKED-HUMAN (only Luc can set secrets) |
| Migration step | Escalate — never guess migrations; a wrong fix corrupts data |
| Health-check/canary rollback | Investigate the app logs (step 3 tools), root-cause, fix PR |
| Infra flake (registry timeout, runner death) | gh run rerun <id> --failed once; recurring → investigate |
Fix PRs go through the normal shepherding (the caller — usually /ship-it — merges them under its green-CI-only rules). Then watch the new run. Cap: 3 fix attempts per issue, then FAILED + diagnosis.
flyctl status -a <app> + flyctl logs -a <app> --no-tail — machines healthy, no crash loops, no new error-level lines.sentry-cli if installed (sentry-cli --version probe) — new issues since the deploy timestamp; if not installed, skip and say so in the report (don't fake the signal).DEPLOYMENT — <LANDED | LOOPING: cause | FAILED: diagnosis | BLOCKED-HUMAN: what>
Pipeline: <run url> <stages: ok/fixed/failed> | Health: <probes> | Soak: <clean | findings (signals used)>
Fix PRs: <#n — what> ~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.