evidence packets

Manual infrastructure changes often lack the audit trail required for compliance, troubleshooting, or peer review. This skill generates structured evidence packets that prove exactly what changed, why it happened, and how it was verified.

What it does

• State snapshots captures raw system state before and after execution to prevent "works on my machine" ambiguity.
• Audit logging records exact shell commands alongside full stdout/stderr output without paraphrasing.
• Independent verification validates changes using a secondary tool or path to confirm the primary tool reported correctly.
• Integrity hashing generates a SHA256 manifest of all artifacts to ensure the audit trail remains immutable.
• Redaction handling automatically scrubs sensitive credentials from captured logs while preserving the trace context.

How it works

1. Define criteria by setting success gates before any infrastructure commands are executed.
2. Capture pre-state using raw tool outputs to document the environment preconditions.
3. Execute and log the migration or configuration change in a strictly numbered sequence.
4. Run readback via a different access path to provide objective proof of the new state.
5. Finalize manifest by hashing all files into a signed MANIFEST.sha256 file within the evidence directory.

Frameworks & tools

Works with any CLI-based infrastructure tool including terraform, kubectl, iptables, systemd, and standard Linux networking/storage utilities.

Why this beats prompting it yourself

Generic prompts often summarize output or skip the "before" state, making them useless for audits. This skill enforces a strict, numbered file structure and mandatory independent readback that satisfies technical due diligence requirements.

Use cases

• Firewall updates to prove a specific port was opened and verify it via external scan.
• Cloud migrations to document resource capacity before moving workloads.
• Permission changes to audit IAM or filesystem access levels for compliance reviews.
• Service deployments to track the delta between a broken and working configuration.

Known limitations

Does not automatically mask custom proprietary secret formats; manual redaction markers may be needed for non-standard environment variables. Requires filesystem write access for the evidence directory.