UNOFFICIAL/EXPERIMENTAL. Live receipt generated by scripts/run-drift-detection-gap.mjs; do not hand-edit. Regenerate with npm run drift-gap:proof.
Claim. cub-scout compare three-way --dry-from detects desired-vs-live drift (replicas/image, with cause attribution manual-edit) - but it MISSES a container env-var change. A Deployment whose env is drifted on the live cluster is reported as AGREED / 0 mismatches. Drift detection works but has incomplete field coverage: a real drift can pass as no-drift.
The day-1 drift claim: cub-scout compare three-way --dry-from <renderedDir> flags desired-vs-live drift. It works - but field coverage matters. Proven live on a throwaway kind cluster with two Deployments, each drifted a different way:
| Drift | Confirmed live | cub-scout detected? | Expected |
|---|---|---|---|
spec.replicas 1→3 | - | yes | detected |
container env FOO bar→DRIFTED | yes | no | detected |
Overall: watch. Confirmed: cub-scout detected the replicas drift but MISSED the env-var drift (live env change verified). Drift detection has a field-coverage hole - extend it to container env (and audit other pod-spec fields), or a drifted env passes as no-drift.
- Positive: cub-scout does detect drift - replicas/image, with cause attribution (
drift-cause: manual-edit). The mechanism works. - Gap: it misses container env-var drift (verified: the live env really changed, and cub-scout reported 0 mismatches). A real drift passes as no-drift.
- Fix: extend
--dry-fromfield comparison to container env (and audit other pod-spec fields - resources, command, volumeMounts). Until then, drift detection is partial. - Receipt:
runs/drift-detection-gap/receipt.yaml.