teleo-infrastructure/.agents/skills/teleo-infra-provenance/SKILL.md

name	description
teleo-infra-provenance	Use when tracing Teleo repo/deploy/runtime provenance, preventing path confusion between GitHub, local checkouts, VPS mirrors, live service cwd, and generated report artifacts.

Teleo Infrastructure Provenance

Job

Prevent incorrect assumptions about where Leo/Teleo code, runtime state, DB state, and evidence live.

Trigger Phrases

• "where is Leo running from"
• "VPS provenance"
• "teleo-infrastructure repo"
• "deploy source"
• "why /opt/teleo-eval"
• "what is canonical"

Surfaces To Separate

• GitHub/canonical repo truth.
• Local Codex workspace checkout.
• VPS live deploy/source mirror.
• Hermes/leoclean runtime profile.
• Postgres canonical DB.
• kb_stage proposal ledger.
• Caller-specific external output directories, which are retained evidence but are not repository routes unless copied into the repo evidence pack.
• Synced report artifacts under the VPS profile report directory.

Current Known Path Map

• Canonical code/deployment repository: GitHub living-ip/teleo-infrastructure.
• Repo-local evidence pack: docs/reports/leo-working-state-20260709/
• VPS deploy/source area: /opt/teleo-eval/workspaces/deploy-infra
• VPS deploy stamp: /opt/teleo-eval/.last-deploy-sha
• Auto-sync: teleo-auto-deploy.timer checks main every two minutes.
• VPS profile reports: /home/teleo/.hermes/profiles/leoclean/kb_stage/reports/
• Live service: leoclean-gateway.service

Required Readbacks

Before claiming provenance:

1. git -C <path> status --short --branch
2. git -C <path> rev-parse HEAD
3. /opt/teleo-eval/.last-deploy-sha
4. latest teleo-auto-deploy.service journal decision
5. service PID, start timestamp, restart count, WorkingDirectory, and User
6. commit delta and file checksums for the runtime paths being compared
7. latest retained report artifact timestamp

Common Failure

Do not say the repo/deploy split is the direct cause of a Leo outage unless evidence ties it to the active failure. The split can be a reproducibility/parity risk without being the immediate runtime cause. A commit present in the deploy checkout or stamp does not prove a gateway restart, runtime-profile change, permission migration, worker enablement, or DB apply.

Output

Return:

• current repo HEADs,
• dirty state,
• live service cwd/user,
• which path owns code changes,
• which path owns runtime reports,
• exact stale/provenance risk if any.