deploy-status

deploy-status is a skill for Claude Code, Codex from lukasrepublic/agentic-foundry. It costs 100 tokens per session (982 once invoked), scanned A, original, MIT.

An observe-only check of deployment status in ArgoCD, a tool that applies Git-managed configuration to environments. It compares reported health and sync state with the identity of the code that should actually be running.

In plain words
What is it for?
Use it to check whether a target environment is synced, healthy, and running the expected merged commit, without starting a deployment.
Why use it?
It catches cases where a deployment looks healthy but is still running an older build because an earlier CI or delivery step failed.

Skill for Claude CodeCodex

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the foundry plugin — 47 skills, 8 agents, 8 hooks, 1 MCP server shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/lukasrepublic/agentic-foundry/deploy-status
Any agent
npx skills add lukasrepublic/agentic-foundry --skill deploy-status
Clone the repo
git clone --depth 1 https://github.com/lukasrepublic/agentic-foundry

Made for: Claude Code, Codex.

Or install foundry, the plugin that ships this one along with the rest of its 47 skills, 8 agents, 8 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for deploy-status

README.md
[![agentmods](https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/deploy-status.svg)](https://agentmods.dev/skills/lukasrepublic/agentic-foundry/deploy-status)
Your own site
<a href="https://agentmods.dev/skills/lukasrepublic/agentic-foundry/deploy-status"><img src="https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/deploy-status.svg" alt="Measured on agentmods" height="20"></a>
Per session 100 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 982 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00100 $0.00982
Opus 5 $0.00050 $0.00491
Sonnet 5 $0.00020 $0.00196
Haiku 4.5 $0.00010 $0.00098

Measured 3d ago against content hash 8c5487c2cfbd, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

deploy-status scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/deploy-status/SKILL.md · 62 lines

How it starts

The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/foundry:deploy-status

Observe-only. Deploy = CD (ArgoCD App-of-Apps, GitOps from the infra repo); Foundry does NOT own the deploy action — it observes. Production deploy is operator-gated under BOTH modes; there is no autonomous prod-deploy.

When to trigger

  • "deploy status", "/foundry:deploy-status", "what's synced/healthy in <env>?".
  • NEVER to initiate a deploy (that's the operator + CD).

Procedure

  1. Cross-check deployed-artifact identity (STALE/NOT-ROLLED). Before trusting sync+health, confirm the merged commit actually rolled. A workflow_run-gated CD pipeline silently skips when its upstream CI false-reds: the merged commit never builds, gitops is never written back, the old image keeps running — and ArgoCD then reads "Synced + Healthy" against the stale image. Run the identity check:
    python3 "${CLAUDE_PLUGIN_ROOT}/scripts/foundry-deploy-status.py" \
      --config "$CLAUDE_PROJECT_DIR/.foundry/deploy-targets.yaml"
    
    It compares each target's deployed gitops image.tag against the expected merged-commit identity (the target repo's main HEAD / its build-provenance SHA) and reports:
    • ROLLED — deployed identity == expected, upstream CI success.
    • STALE/NOT-ROLLED — identity mismatch or the expected commit's CI was not success (the gated build skipped). This is reported independently of sync/health, so a Synced+Healthy stale image can never read GREEN. When the cause is the skipped build it is named upstream-ci-not-success, distinct from a bare identity drift. The expected-SHA→gitops-path mapping is adopter-config (.foundry/deploy-targets.yaml, shape in deploy-targets.example.yaml); no product specifics ship in the plugin.
  2. Observe ArgoCD sync + health for the target env's apps (read-only): argocd app list / argocd app get <app> (or the gh/kubectl read equivalents). Report per-app sync status (Synced/OutOfSync) + health (Healthy/Degraded/Progressing).
  3. Correlate a merged atom to its rollout (the marker's model_pin/built_at aid incident forensics) — but do NOT mutate cluster state.
  4. Escalate a STALE/NOT-ROLLED, Degraded, or OutOfSync prod app by notifying the operator; resolution is forward-fix (re-trigger the build / merge) or /foundry:revert — never a silent cluster edit.

Read the full file on GitHub · 62 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 62 lines · 100 tokens per session scan A 8c5487c2cfbd

Subscribe to this mod's changes

deploy-status is a skill published in the GitHub repository lukasrepublic/agentic-foundry (1 stars, last pushed yesterday), licensed MIT. It adds 100 tokens to every session and 982 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.