菜单
Use when investigating a failed, stuck, superseded, or ambiguous deployment across GitHub Actions, deployment event artifacts, mcl status summaries, target journals, cache health, and post-switch health checks.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | deployment-investigation |
| description | Use when investigating a failed, stuck, superseded, or ambiguous deployment across GitHub Actions, deployment event artifacts, mcl status summaries, target journals, cache health, and post-switch health checks. |
gh run view "$RUN_ID" --log
gh run download "$RUN_ID" --dir .result/deployment-artifacts
mcl deploy-status summarize .result/deployment-artifacts/events.jsonl \
--output .result/deployment-summary.md \
--json-output .result/deployment-summary.json
ssh "$TARGET" 'sudo journalctl -u mcl-deploy-agent.service -u mcl-deployment-reconciler.service -b --no-pager -n 200'
ssh "$TARGET" 'sudo journalctl -u sshd.service -u ssh.service -b --no-pager -n 120'
nix path-info --store "$SUBSTITUTER" --recursive "$SYSTEM_PATH" \
--option trusted-public-keys "$TRUSTED_PUBLIC_KEY"
Use mcl deploy-status summarize first when an event JSONL artifact exists.
Use target journals next only for phases that reached the target:
agent-restore, switch, healthcheck, rollback, or complete.
command.status from the status
summary.correlationId or deploymentId; do not mix events from separate
attempts.evaluate, build, or cache-push is controller-side;
activate-requested is transport or reconciler-side;
agent-restore, switch, healthcheck, rollback, and complete are
target-side.desiredSystemPath with
nix path-info --store and the cache operation logs./var/lib/mcl/deployments.Stop and ask a human operator before changing desired state, retrying a production target, rolling back, exposing secrets or tokens, rotating cache keys, overriding host-key checking, or acting on a target whose name does not match the signed manifest.
Investigation does not roll back by itself. If rollback is required, hand off to the break-glass workflow with the deployment id, target, current generation, failed generation, and evidence collected above.
Use when central deployment automation is unavailable and an approved operator must recover a target through direct SSH, signed manifests, forced-command deploy keys, and explicit rollback evidence.
Use when running deployment migration rehearsals in NixOS VM tests or Incus/LXC topology simulations, including check-env, check-runtime, dry-run, runtime launch, failure injections, and production evidence gates.
Use when inspecting Attic or Cachix deployment cache health, proving closure substitute coverage, repairing cache misses, or handling cache token and signing-key boundaries.
Use when performing normal deployment operations, confirming deployment health, running direct SSH deployment wrappers, or deciding whether to fall back to rollback.
Use when inspecting or repairing desired-state reconciliation, latest-only state, pending or failed retries, superseded deployments, target locks, and pull-agent status.