sailr-flow-reviewer

name	sailr-flow-reviewer
description	Review Sailr delivery flows for security, reliability, and correctness. Analyzes CircleCI config, GitOps setup, and Sailr workflow profiles against invariant rules. Use this skill when asked to review a deployment pipeline, check CI configuration, or audit a release process.

Sailr Flow Reviewer

This skill audits delivery flows against Sailr invariants.

Query sailr capabilities --format json first and review the repository against the installed contract rather than documentation guesses. Refuse unsupported features, never request or store credentials/private keys, and stop before any production apply.

1. Trigger

Activate this skill when the user asks to:

• "Review this delivery flow"
• "Audit our CI/CD setup"
• "Check if this pipeline is safe"

2. Review Scope

A full review covers:

• sailr.workflow.toml profiles.
• CI configuration (e.g., .circleci/config.yml).
• GitOps configuration (if applicable).
• Artifact building and pushing logic.

3. Core Principles

• Production flows require decoupled publication and release.
• Images must be identified by digest.
• Production deployments require explicit approval gates.
• Direct push requires credential isolation.
• GitOps write-backs must not trigger infinite loops.
• Direct production flows must use publication validation, full digest promotion, portable prepare/apply, rollout verification, and release locking.
• Candidate manifests must bind every selected report by its canonical Sailr report digest.
• Block unpinned Sailr installers, single-report assumptions for multi-service candidates, production rebuilds, missing serialization, and mismatched sign stages/policies.
• Do not infer production from names; use declared flow stages and environment policy.

4. Output Contract

Produce a structured report categorizing findings by severity (Blocker, High, Medium, Low, Advisory). See references/severity-model.md.