# Env Parity

> Local Docker vs onex-dev k8s environment parity checker -- dispatches to node_env_parity_compute for execution

- Skill: `omninode-ai/env-parity` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add omninode-ai/env-parity`
- Raw SKILL.md: https://api.skillmd.com/api/skills/omninode-ai/env-parity/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: OmniNode-ai (https://skillmd.com/u/omninode-ai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/omninode-ai/env-parity

---


<!-- routing-enforced: dispatches to node_env_parity_compute. -->

# Env Parity Checker

## Dispatch Surface

**Target**: Agent Teams

## Overview

Automated local-Docker vs onex-dev k8s parity checker. Detects:

- **CRITICAL** (default): credential drift, stale ECR tags, missing Infisical paths
- **WARNING** (--all-checks): schema drift, missing deployments, feature flag mismatches, Kafka topic gaps, package version mismatches

**Incident origin (2026-03-10):**
1. `omniintelligence-credentials` had `POSTGRES_USER=postgres` instead of `role_omniintelligence` — DB auth failures after pod restart
2. ECR tags deleted while still referenced in active deployment specs — `ErrImagePull` on rollout
3. Infisical paths never seeded — InfisicalSecret 404 loops for hours

The `onex:gap` skill covers code/contract drift. This skill fills the runtime state gap.

## Checks Catalog

| check_id | severity_tier | incident_class | default | auto_fixable |
|----------|--------------|----------------|---------|-------------|
| `credential` | CRITICAL | DB auth failure on pod restart | yes | no |
| `ecr` | CRITICAL | ErrImagePull on rollout | yes | no |
| `infisical` | CRITICAL | InfisicalSecret 404 loops | yes | yes |
| `schema` | WARNING | Migration state drift | --all-checks | no |
| `services` | WARNING | Missing deployment | --all-checks | no |
| `flags` | WARNING | Feature flag inconsistency | --all-checks | no |
| `kafka` | WARNING | Missing Kafka topics in cloud | --all-checks | no |
| `packages` | WARNING | Package version mismatch | --all-checks | no |

## When to Use

- **Post-incident**: After any DB auth failure, ErrImagePull, or InfisicalSecret error
- **Pre-deploy**: Before promoting a new release to verify cloud state matches local
- **Ad hoc**: When suspecting drift between local and cloud environments

## Quick Start

```bash
# Default: CRITICAL checks only (credential, ECR, Infisical) and ticket CRITICAL findings
/env-parity check

# All 8 checks
/env-parity check --all-checks

# Fix Infisical path gaps (only auto-fixable check)
/env-parity fix --checks infisical

# Dry-run fix
/env-parity fix --checks infisical --dry-run

# Explicitly request ticket creation (also the default)
/env-parity check --create-tickets

# Disable ticket creation for a read-only parity check
/env-parity check --no-create-tickets
```

## Alert Thresholds

| Severity | Action |
|----------|--------|
| **CRITICAL** | Fix today — active or imminent production impact |
| **WARNING** | Fix this sprint — quality/reliability risk |
| **INFO** | Informational — no action required |

## Ticket Creation

Linear ticket creation is enabled by default for CRITICAL findings so active env
mismatches are tracked. Pass `--no-create-tickets` for explicit read-only runs.
`--create-tickets` remains accepted for callers that want to be explicit.

When ticket creation is enabled, one ticket is created per CRITICAL finding using:
- Title: `[env-parity:<check_id>] <finding title verbatim>`
- Priority: 1 (Urgent)
- Project: Active Sprint
- Deduplication: exact prefix match on `[env-parity:<check_id>]` — skip if any existing ticket (any state) matches

## See Also

- `system-status` — overall platform health check
- `gap` — code/contract drift detection
- `omnibase_infra/scripts/system_health_check.sh` — infrastructure health
- `omnibase_infra/scripts/compare_environments.py` — the underlying probe script