Menu
GitOps discipline — desired state in git, reconciliation, drift semantics, environment promotion. Tool-agnostic (works with any reconciler).
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Context engineering — memory navigation, textual graph traversal, progressive disclosure, recovery. Load when assembling context for a task or when lost.
Implementation-side security discipline — headers, dependencies, secrets, authz. Load for hardening work (sec-ops domain).
Commit conventions, branching, anchors in messages, and the git safety rules. Load for any git operation beyond status/diff.
Anti-generic-AI design discipline — bans, tells, and the slop test. Load for ANY new UI surface or visual redesign. Inspired by Impeccable (Apache 2.0).
Motion & animation discipline — purpose, performance, reduced-motion. Load when work involves animation, transitions or scroll effects.
Microcopy discipline — buttons, errors, empty/loading/success states, alt text. Voice and tone come from the project's memory, not from this skill.
| name | gitops |
| description | GitOps discipline — desired state in git, reconciliation, drift semantics, environment promotion. Tool-agnostic (works with any reconciler). |
Owned by dev-ops; deep-dive of the GitOps summary in infra-patterns. Reconciler tooling from memory-long §stack.
Git is the only write path to the runtime. Desired state lives in a repo; a reconciler converges the runtime toward it continuously. Consequences that must hold:
git revert (which makes the release-engineering one-command rollback real for infra/workloads)git-workflow)infra-patterns cattle test)Detected drift is a decision, not noise: either someone had a reason (→ codify it, PR it) or nobody did (→ auto-revert). Reconcilers in enforce mode for prod, notify mode acceptable in sandboxes only · manual mutation in prod = incident-grade event · drift dashboards reviewed on cadence, not on curiosity.
Same manifests, different overlays/values per env — never forked env branches that drift apart · promotion is a PR moving a version/digest from staging values to prod values (reviewable, revertible, anchored) · app code and deployment manifests in separate repos or clearly separated paths — app CI shouldn't be able to mutate prod desired state directly.
Never plaintext in the repo, obviously — sealed/encrypted-at-rest references or external secret-store pointers · the reconciler's own credentials are the crown jewels: scope per-namespace/env, rotate, audit (see infra-security identity rules).
Prod state diff against git = empty (checked on schedule) · a change can be traced: PR → commit → reconcile event → runtime · freshly bootstrapped env from repo alone succeeds (the ultimate test, run in CI when feasible).