post-deploy-env-diff

Detect production environment drift by comparing repository env-template default changes from merge-base to head with persistent on-host env file values via SSH probing. It checks whether the live on-host config still carries previous defaults after a deploy that does not overwrite disk config.

Archive-time gatekeeping blocks release completion framing by surfacing config drift in operator handoff notes. The deploy remains blocked until the operator either corrects the on-host values or explicitly acknowledges the drift with a rationale.

Environment drift detection uses safe, read-only enforcement and does not auto-edit the host configuration. It performs probing reads of KEY lines to ensure operators maintain full control over toggles and manual corrections.

You need on-host env file validation when your deploy pipeline changes default values in checked-in env templates but does not overwrite persistent on-host config, especially for services reading disk config at boot or on signal.

Yes, SSH probing reads specific KEY lines from the persistent on-host env file to perform a per-key comparison against the new repository defaults. This identifies exactly which environment variables have drifted from the intended template state.