Env Parity Checker

Dispatch Surface

Target: Agent Teams

Overview

Automated local-Docker vs onex-dev k8s parity checker. Detects:

• CRITICAL (default): credential drift, stale ECR tags, missing Infisical paths
• WARNING (--all-checks): schema drift, missing deployments, feature flag mismatches, Kafka topic gaps, package version mismatches

Incident origin (2026-03-10):

1. omniintelligence-credentials had POSTGRES_USER=postgres instead of role_omniintelligence — DB auth failures after pod restart
2. ECR tags deleted while still referenced in active deployment specs — ErrImagePull on rollout
3. Infisical paths never seeded — InfisicalSecret 404 loops for hours

The onex:gap skill covers code/contract drift. This skill fills the runtime state gap.

Checks Catalog

check_id	severity_tier	incident_class	default	auto_fixable
credential	CRITICAL	DB auth failure on pod restart	yes	no
ecr	CRITICAL	ErrImagePull on rollout	yes	no
infisical	CRITICAL	InfisicalSecret 404 loops	yes	yes
schema	WARNING	Migration state drift	--all-checks	no
services	WARNING	Missing deployment	--all-checks	no
flags	WARNING	Feature flag inconsistency	--all-checks	no
kafka	WARNING	Missing Kafka topics in cloud	--all-checks	no
packages	WARNING	Package version mismatch	--all-checks	no

When to Use

• Post-incident: After any DB auth failure, ErrImagePull, or InfisicalSecret error
• Pre-deploy: Before promoting a new release to verify cloud state matches local
• Ad hoc: When suspecting drift between local and cloud environments

Quick Start

# Default: CRITICAL checks only (credential, ECR, Infisical) and ticket CRITICAL findings
/env-parity check

# All 8 checks
/env-parity check --all-checks

# Fix Infisical path gaps (only auto-fixable check)
/env-parity fix --checks infisical

# Dry-run fix
/env-parity fix --checks infisical --dry-run

# Explicitly request ticket creation (also the default)
/env-parity check --create-tickets

# Disable ticket creation for a read-only parity check
/env-parity check --no-create-tickets

Alert Thresholds

Severity	Action
CRITICAL	Fix today — active or imminent production impact
WARNING	Fix this sprint — quality/reliability risk
INFO	Informational — no action required

Ticket Creation

Linear ticket creation is enabled by default for CRITICAL findings so active env
mismatches are tracked. Pass --no-create-tickets for explicit read-only runs.
--create-tickets remains accepted for callers that want to be explicit.

When ticket creation is enabled, one ticket is created per CRITICAL finding using:

• Title: [env-parity:<check_id>] <finding title verbatim>
• Priority: 1 (Urgent)
• Project: none
• Deduplication: exact prefix match on [env-parity:<check_id>] — skip if any existing ticket (any state) matches

See Also

• system-status — overall platform health check
• gap — code/contract drift detection
• omnibase_infra/scripts/system_health_check.sh — infrastructure health
• omnibase_infra/scripts/compare_environments.py — the underlying probe script