The post-deploy-env-diff Skill — Catching Config Drift Before Archive
How Datarim's post-deploy-env-diff skill diffs the on-host env file against the repo template at /dr-archive time, surfacing prod configs that still carry an old default.
A deploy can ship a new default value in .env.example while leaving the live .env on the host untouched. The pipeline reports success. Production quietly runs on the old setting. The post-deploy-env-diff skill exists to surface that gap before the task is considered closed.
When the gate fires
The skill loads during /dr-archive when two conditions are true together: the closing task touched an env template — .env.example, config.sample.yaml, or a similar checked-in defaults file — AND the task involved a deploy to a host where the live config lives on disk outside the repo. If the deploy pipeline already copies the template to the host on every run, the gate skips automatically.
What the diff does
For every KEY=value line whose default changed between the merge base and HEAD, the gate reads the matching key from the on-host config via ssh <host> grep "^KEY=" <path> and compares. When the on-host value still carries the old default, the gate writes a single line to the archive document's Operator Handoff section — specifying the key, the new default, the host path, and the exact command to run. The "all V-AC met" claim in the human summary is blocked until the operator either flips the value or records an explicit rationale of at least 50 characters for accepting the drift.
What the gate does not do
The gate is read-only. It never modifies the on-host file, never restarts a service, and never auto-applies the new default. The operator owns the toggle action. This boundary is intentional: production config changes are irreversible and require human authorization. The gate's job is to make the drift visible and block the archive from being stamped "done" while it exists.
The failure class it prevents
The class "production ran on the previous default for N hours after a deploy advertised a new default" has shipped silently when no step in the pipeline diffs deploy intent against deploy state. This gate is a read-only probe at archive time — cheap to run, and it closes a gap that deploy scripts routinely leave open. See the post-deploy-env-diff reference or read what Datarim is for the bigger picture.