OmniNode-ai Env Parity Checker
Dispatch Surface
Target: Agent Teams
Overview
Automated local-Docker vs onex-dev k8s parity checker. Detects:
- CRITICAL (default): credential drift, stale ECR tags, missing Infisical paths
- WARNING (--all-checks): schema drift, missing deployments, feature flag mismatches, Kafka topic gaps, package version mismatches
Incident origin (2026-03-10):
omniintelligence-credentialshadPOSTGRES_USER=postgresinstead ofrole_omniintelligence— DB auth failures after pod restart- ECR tags deleted while still referenced in active deployment specs —
ErrImagePullon rollout - Infisical paths never seeded — InfisicalSecret 404 loops for hours
The onex:gap skill covers code/contract drift. This skill fills the runtime state gap.
Checks Catalog
| check_id | severity_tier | incident_class | default | auto_fixable |
|---|---|---|---|---|
credential |
CRITICAL | DB auth failure on pod restart | yes | no |
ecr |
CRITICAL | ErrImagePull on rollout | yes | no |
infisical |
CRITICAL | InfisicalSecret 404 loops | yes | yes |
schema |
WARNING | Migration state drift | --all-checks | no |
services |
WARNING | Missing deployment | --all-checks | no |
flags |
WARNING | Feature flag inconsistency | --all-checks | no |
kafka |
WARNING | Missing Kafka topics in cloud | --all-checks | no |
packages |
WARNING | Package version mismatch | --all-checks | no |
When to Use
- Post-incident: After any DB auth failure, ErrImagePull, or InfisicalSecret error
- Pre-deploy: Before promoting a new release to verify cloud state matches local
- Ad hoc: When suspecting drift between local and cloud environments
Quick Start
# Default: CRITICAL checks only (credential, ECR, Infisical) and ticket CRITICAL findings
/env-parity check
# All 8 checks
/env-parity check --all-checks
# Fix Infisical path gaps (only auto-fixable check)
/env-parity fix --checks infisical
# Dry-run fix
/env-parity fix --checks infisical --dry-run
# Explicitly request ticket creation (also the default)
/env-parity check --create-tickets
# Disable ticket creation for a read-only parity check
/env-parity check --no-create-tickets
Alert Thresholds
| Severity | Action |
|---|---|
| CRITICAL | Fix today — active or imminent production impact |
| WARNING | Fix this sprint — quality/reliability risk |
| INFO | Informational — no action required |
Ticket Creation
Linear ticket creation is enabled by default for CRITICAL findings so active env
mismatches are tracked. Pass --no-create-tickets for explicit read-only runs.
--create-tickets remains accepted for callers that want to be explicit.
When ticket creation is enabled, one ticket is created per CRITICAL finding using:
- Title:
[env-parity:<check_id>] <finding title verbatim> - Priority: 1 (Urgent)
- Project: Active Sprint
- Deduplication: exact prefix match on
[env-parity:<check_id>]— skip if any existing ticket (any state) matches
See Also
system-status— overall platform health checkgap— code/contract drift detectionomnibase_infra/scripts/system_health_check.sh— infrastructure healthomnibase_infra/scripts/compare_environments.py— the underlying probe script