---
description: Local Docker vs onex-dev k8s environment parity checker -- dispatches to node_env_parity_compute for execution
mode: full
version: 1.0.0
level: advanced
debug: false
category: operations
tags: [parity, drift, credentials, ecr, infisical, k8s, docker]
author: OmniClaude Team
composable: true
inputs:
  - name: subcommand
    type: str
    description: "Mode: check (audit) or fix (auto-fix Infisical paths only)"
    required: false
args:
  - name: subcommand
    description: "Mode: check (default) or fix"
    required: false
  - name: --checks
    description: "Comma-separated check IDs (default: credential,ecr,infisical)"
    required: false
  - name: --all-checks
    description: "Run all 8 checks including secondary (schema, services, flags, kafka, packages)"
    required: false
  - name: --namespace
    description: "k8s namespace to probe (default: onex-dev)"
    required: false
  - name: --dry-run
    description: "Preview fix actions without executing"
    required: false
  - name: --create-tickets
    description: "Create Linear tickets for CRITICAL findings. Default: true (on-by-default; pass --no-create-tickets to disable)"
    required: false
  - name: --no-create-tickets
    description: "Do not create Linear tickets for CRITICAL findings"
    required: false
---

<!-- routing-enforced: dispatches to node_env_parity_compute. -->

# Env Parity Checker

## Dispatch Surface

**Target**: Agent Teams

## Overview

Automated local-Docker vs onex-dev k8s parity checker. Detects:

- **CRITICAL** (default): credential drift, stale ECR tags, missing Infisical paths
- **WARNING** (--all-checks): schema drift, missing deployments, feature flag mismatches, Kafka topic gaps, package version mismatches

**Incident origin (2026-03-10):**
1. `omniintelligence-credentials` had `POSTGRES_USER=postgres` instead of `role_omniintelligence` — DB auth failures after pod restart
2. ECR tags deleted while still referenced in active deployment specs — `ErrImagePull` on rollout
3. Infisical paths never seeded — InfisicalSecret 404 loops for hours

The `onex:gap` skill covers code/contract drift. This skill fills the runtime state gap.

## Checks Catalog

| check_id | severity_tier | incident_class | default | auto_fixable |
|----------|--------------|----------------|---------|-------------|
| `credential` | CRITICAL | DB auth failure on pod restart | yes | no |
| `ecr` | CRITICAL | ErrImagePull on rollout | yes | no |
| `infisical` | CRITICAL | InfisicalSecret 404 loops | yes | yes |
| `schema` | WARNING | Migration state drift | --all-checks | no |
| `services` | WARNING | Missing deployment | --all-checks | no |
| `flags` | WARNING | Feature flag inconsistency | --all-checks | no |
| `kafka` | WARNING | Missing Kafka topics in cloud | --all-checks | no |
| `packages` | WARNING | Package version mismatch | --all-checks | no |

## When to Use

- **Post-incident**: After any DB auth failure, ErrImagePull, or InfisicalSecret error
- **Pre-deploy**: Before promoting a new release to verify cloud state matches local
- **Ad hoc**: When suspecting drift between local and cloud environments

## Quick Start

```bash
# Default: CRITICAL checks only (credential, ECR, Infisical) and ticket CRITICAL findings
/env-parity check

# All 8 checks
/env-parity check --all-checks

# Fix Infisical path gaps (only auto-fixable check)
/env-parity fix --checks infisical

# Dry-run fix
/env-parity fix --checks infisical --dry-run

# Explicitly request ticket creation (also the default)
/env-parity check --create-tickets

# Disable ticket creation for a read-only parity check
/env-parity check --no-create-tickets
```

## Alert Thresholds

| Severity | Action |
|----------|--------|
| **CRITICAL** | Fix today — active or imminent production impact |
| **WARNING** | Fix this sprint — quality/reliability risk |
| **INFO** | Informational — no action required |

## Ticket Creation

Linear ticket creation is enabled by default for CRITICAL findings so active env
mismatches are tracked. Pass `--no-create-tickets` for explicit read-only runs.
`--create-tickets` remains accepted for callers that want to be explicit.

When ticket creation is enabled, one ticket is created per CRITICAL finding using:
- Title: `[env-parity:<check_id>] <finding title verbatim>`
- Priority: 1 (Urgent)
- Project: Active Sprint
- Deduplication: exact prefix match on `[env-parity:<check_id>]` — skip if any existing ticket (any state) matches

## See Also

- `system-status` — overall platform health check
- `gap` — code/contract drift detection
- `omnibase_infra/scripts/system_health_check.sh` — infrastructure health
- `omnibase_infra/scripts/compare_environments.py` — the underlying probe script