| name | gds-audit-estate |
| description | Use this skill in a control-plane admin session when the owner asks for a read-only audit across repositories, portfolios, installations, policies, projections, or rollout state. Aggregate bounded evidence without applying remediation. Do not use it for one-repository review or any external mutation. |
Contract
Aggregate a bounded, read-only estate audit from desired and observed evidence.
Use when
- The owner requests estate-wide health, compliance, adoption, or drift evidence.
- A rollout or governance change needs a baseline.
Do not use when
- The scope is one repository.
- The request authorizes applying fixes.
Inputs
- Control-plane estate root.
- Target selectors, freshness requirements, and maximum scope.
Preconditions
- Resolve the control-plane role with
gds context --json.
- Use read-only credentials and bounded concurrency.
- Treat inaccessible repositories as access failures, not deletions.
Workflow
- Compile desired inventory and selectors.
- Read current observed state within declared freshness limits.
- Run applicable estate validators.
- Classify drift by object, authority, severity, and proof state.
- Isolate individual repository failures from aggregate results.
Stop conditions
Stop before any repository, provider, workflow, ruleset, or rollout mutation.
Verification
Require a stable inventory version, observation timestamps, and per-target
result counts that reconcile to the requested scope.
Output
Return scope, coverage, confirmed findings, inaccessible and stale targets,
rate-limit evidence, and non-mutating next actions.
References
No additional runtime reference is required; use current structured gds evidence.
