evidence packets

Manual infrastructure changes often lack the audit trail required for compliance, troubleshooting, or peer review. This skill generates structured evidence packets that prove exactly what changed, why it happened, and how it was verified. ## What it does - **State snapshots** captures raw system state before and after execution to prevent "works on my machine" ambiguity. - **Audit logging** records exact shell commands alongside full stdout/stderr output without paraphrasing. - **Independent verification** validates changes using a secondary tool or path to confirm the primary tool reported correctly. - **Integrity hashing** generates a SHA256 manifest of all artifacts to ensure the audit trail remains immutable. - **Redaction handling** automatically scrubs sensitive credentials from captured logs while preserving the trace context. ## How it works 1. **Define criteria** by setting success gates before any infrastructure commands are executed. 2. **Capture pre-state** using raw tool outputs to document the environment preconditions. 3. **Execute and log** the migration or configuration change in a strictly numbered sequence. 4. **Run readback** via a different access path to provide objective proof of the new state. 5. **Finalize manifest** by hashing all files into a signed `MANIFEST.sha256` file within the evidence directory. ## Frameworks & tools Works with any CLI-based infrastructure tool including `terraform`, `kubectl`, `iptables`, `systemd`, and standard Linux networking/storage utilities. ## Why this beats prompting it yourself Generic prompts often summarize output or skip the "before" state, making them useless for audits. This skill enforces a strict, numbered file structure and mandatory independent readback that satisfies technical due diligence requirements. ## Use cases - **Firewall updates** to prove a specific port was opened and verify it via external scan. - **Cloud migrations** to document resource capacity before moving workloads. - **Permission changes** to audit IAM or filesystem access levels for compliance reviews. - **Service deployments** to track the delta between a broken and working configuration. ## Known limitations Does not automatically mask custom proprietary secret formats; manual redaction markers may be needed for non-standard environment variables. Requires filesystem write access for the evidence directory.