---
name: teleo-infra-provenance
description: Use when tracing Teleo repo/deploy/runtime provenance, preventing path confusion between GitHub, local checkouts, VPS mirrors, live service cwd, and generated report artifacts.
---

# Teleo Infrastructure Provenance

## Job

Prevent incorrect assumptions about where Leo/Teleo code, runtime state, DB state, and evidence live.

## Trigger Phrases

- "where is Leo running from"
- "VPS provenance"
- "teleo-infrastructure repo"
- "deploy source"
- "why /opt/teleo-eval"
- "what is canonical"

## Surfaces To Separate

- GitHub/canonical repo truth.
- Local Codex workspace checkout.
- VPS live deploy/source mirror.
- Hermes/leoclean runtime profile.
- Postgres canonical DB.
- `kb_stage` proposal ledger.
- Retained proof artifacts under local `outputs/`.
- Synced report artifacts under the VPS profile report directory.

## Current Known Path Map

- Repo-local evidence pack: `docs/reports/leo-working-state-20260709/`
- VPS deploy/source area: `/opt/teleo-eval/workspaces/deploy-infra`
- VPS profile reports: `/home/teleo/.hermes/profiles/leoclean/kb_stage/reports/`
- Live service: `leoclean-gateway.service`

## Required Readbacks

Before claiming provenance:

1. `git -C <path> status --short --branch`
2. `git -C <path> rev-parse HEAD`
3. service `WorkingDirectory` and `User`
4. file checksum if comparing script deployment
5. latest retained report artifact timestamp

## Common Failure

Do not say the repo/deploy split is the direct cause of a Leo outage unless evidence ties it to the active failure. The split can be a reproducibility/parity risk without being the immediate runtime cause.

## Output

Return:

- current repo HEADs,
- dirty state,
- live service cwd/user,
- which path owns code changes,
- which path owns runtime reports,
- exact stale/provenance risk if any.
