Review a configuration change for static disruption risks

From the repository root, compare the retained Prometheus bases:

node scripts/review-config-disruption.mjs \
  --before recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml \
  --after recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml

The candidate omits ten CRDs. The result flags their compatibility/lifecycle risk; it does not establish that a delivery controller will delete them. Pruning, ownership and retention policy remain unassessed.

Input and result contract

Use exactly one --before FILE and one --after FILE, or --help alone. Inputs may contain YAML object documents or a JSON array of objects. Empty comment-only YAML documents are skipped; explicit null documents are rejected. Use [] for an explicitly empty object set. Paths resolve from the caller's working directory. Inputs are local regular files; no URL retrieval, rendering, cluster operation or output-file write occurs.

The adapter rejects malformed objects, duplicate identities or mapping keys, YAML aliases, non-object documents, and inputs exceeding its size, nesting or object-count limits. Each file is limited to 10 MiB, 1,000 JSON objects or YAML documents (including empty separators), and 64 levels of nesting; parsing has a five-second timeout. Convert an alias-based manifest to explicit objects before review. Split oversized inputs into coherent scopes and retain each scope's identity; separate reviews do not prove dependencies between those scopes.

Successful output has kind ConfigDisruptionReview, schema version 1, the SHA-256 of each input file's exact bytes, object counts, and a review object. The review binds object identities to canonical before/after hashes, changed JSON Pointer paths and static rules. Field values and local paths are omitted. Object names and field names remain visible; this is not an anonymization service, and callers decide where to disclose the report.

Exit code 0 means a valid comparison was produced, including a review-required result. It never means approved, deployable or safe. Exit code 2 means the request could not be reviewed; stdout is empty and stderr contains a sanitized JSON error. Fix the inputs or prerequisites and retry; do not interpret an error as an empty diff.

Interpreting the categories

• replace-immutable-field: an apps/v1 Deployment selector changed. The API rejects an in-place patch; replacement requires a separate delivery decision.
• recreate-workload: an apps/v1 workload Pod template changed. The resulting strategy affects replacement; OnDelete and partitioned rollouts need care.
• crd-or-apiversion-change: API compatibility or CRD lifecycle needs review.
• unclassified: the classifier cannot establish the change's runtime effect.

no-config-change means the supplied object sets compare identically. It does not establish live health. Rules are scoped hazard indicators, not an exhaustive assessment of every changed field. Review all changed paths and the returned unassessed list.

The adapter currently supports repository and local agent use. It is not new cub syntax, a packaged plugin, a hosted API, or a completed live-chat API demo. Those entry paths remain tracked in #1861. Driver/drain and dependency-order rules, preview integration and target evidence remain in #1660. Runtime continuity, rollback data safety and rollback success require separate proofs under #1582.

Verification

Run npm run disruption-review:verify to check the retained proof and the classifier and adapter tests. These verify configuration behavior and input handling; they do not run a fleet upgrade.