Add deploy-verification skill

[blarghmatey]

What are the relevant tickets?

N/A

Description (What does it do?)

• Adds a new deploy-verification skill (skills/process/deploy-verification/SKILL.md) that walks the checklist for confirming a merged config/infra change actually took effect, not just that it merged:
  • CD pipeline ran and succeeded after the merge SHA
  • Pods actually rolled (age vs. deploy time, not just a green pipeline)
  • Config read out of the running process, not the manifest
  • Before/after metric comparison via the appropriate toolhive-swe-{ci,qa,prod} Grafana/Prometheus MCP tier, with an explicit fair-comparison window
  • Scope check across sibling Pulumi stacks to catch a change that leaked into an unintended environment
• Each step demands raw evidence (pod age, rollout status, query + numbers, preview diff) rather than inferring success from the previous step.
• Registers the skill in agent-config.toml ([skills], plus the process and infrastructure profiles) and adds it to both skills/README.md and skills/process/README.md per the skill-authoring checklist in AGENTS.md.

How can this be tested?

• Validated frontmatter with npx skills-ref validate ./skills/process/deploy-verification — passes.
• Ran agent-kit validate agent-config.toml — no drift beyond the expected "not yet installed locally" entries for a brand-new skill.
• Ran prek run --files agent-config.toml skills/README.md skills/process/README.md skills/process/deploy-verification/SKILL.md — all checks pass (markdownlint, TOML, secrets, etc.).
• No functional test suite for skill markdown.

[Copilot]

Pull request overview

Adds a reusable skill for validating that infrastructure and configuration changes reached live environments.

Changes:

• Adds a five-step deployment verification workflow.
• Registers the skill in process and infrastructure profiles.
• Updates both skill catalogs.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
agent-config.toml	Registers the skill and profile membership.
skills/README.md	Adds the skill to the main catalog.
skills/process/README.md	Adds the process-category listing.
skills/process/deploy-verification/SKILL.md	Defines the deployment verification procedure.

Suppressed comments (4)

skills/process/deploy-verification/SKILL.md:63

• The skill is triggered for any config/Pulumi/Helm change, but many valid changes do not require replacing pods (for example, Service/Ingress changes or config handled by a live reloader). Treating an older pod as a silent failure gives false negatives; first establish whether this change was expected to roll the workload, and otherwise verify the relevant live resource or reload path.

If pod `AGE` predates the pipeline run, the workload did not restart. This
is the single most common silent failure in this checklist: a
`ConfigMap`/`Secret` change with no checksum/annotation-based restart
trigger on the pod template is inert until something else causes a restart.

skills/process/deploy-verification/SKILL.md:98

• The literal mcp__<server>__... form is client-specific, while this repository installs skills for Claude Code, Pi, GitHub Copilot, and OpenCode; the server prefix can also depend on the user's MCP configuration. Agents on other clients may therefore look for a nonexistent tool. Name the server and its unprefixed tool instead, allowing each client to resolve its exposed invocation name.

mcp__toolhive-swe-<tier>__grafana_query_prometheus

skills/process/deploy-verification/SKILL.md:128

• A Pulumi preview reports differences between the current stack state and what a future update would deploy; it cannot prove that a sibling environment already received this change. In fact, a sibling diff usually means that stack has not applied the new desired state. Distinguish an actual leak (sibling update history/live state changed after the merge) from a latent scope bug (preview says a future sibling update would change it).

`"0 changes"` on every stack except the intended target confirms scope. Any
unexpected diff on an unrelated stack is a blocker, not a footnote — surface
it before calling the deploy verified.

skills/process/deploy-verification/SKILL.md:83

• This skill explicitly covers Secret changes, but these commands print environment variables or mounted files into the agent transcript and logs. That can disclose production credentials. Keep plaintext inspection only for non-sensitive config; for secret-backed values, compare an approved expected checksum with a checksum computed inside the container so the value never leaves it.

kubectl exec -n <namespace> <pod> -- env | grep <VAR>
# or, for a file-mounted config:
kubectl exec -n <namespace> <pod> -- cat <mounted-path>

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.