# ops-review Lenses

Focused review prompts for operational infrastructure analysis.

## Architecture

**Linter-first hybrid**: Each lens works with static tool output when available.

```
Static Tools (syntax)     LLM Lens (semantics)
─────────────────────     ───────────────────
shellcheck ──────────────► shell-safety.md
statix + deadnix ────────► nix-hygiene.md
hadolint ────────────────► (container checks)
gitleaks patterns ───────► secrets.md
```

## Available Lenses

### Phase 1: Core Safety

| Lens | Focus | Linter |
|------|-------|--------|
| [secrets.md](secrets.md) | Credentials, SOPS, secrets in logs | gitleaks |
| [shell-safety.md](shell-safety.md) | Error handling, quoting, pipefail | shellcheck |
| [blast-radius.md](blast-radius.md) | Destructive ops, rollback, dry-run | LLM-primary |
| [privilege.md](privilege.md) | Least privilege, sudo, capabilities | LLM-primary |

### Phase 2: Reliability

| Lens | Focus | Linter |
|------|-------|--------|
| [idempotency.md](idempotency.md) | Safe re-run, atomic ops | LLM-primary |
| [supply-chain.md](supply-chain.md) | Pinning, SRI hashes, provenance | LLM-primary |
| [observability.md](observability.md) | Logging, health checks, metrics | LLM-primary |

### Phase 3: Architecture

| Lens | Focus | Linter |
|------|-------|--------|
| [nix-hygiene.md](nix-hygiene.md) | Dead code, anti-patterns, modules | statix, deadnix |
| [resilience.md](resilience.md) | Timeouts, retries, limits | LLM-primary |
| [orchestration.md](orchestration.md) | Ordering, prerequisites, coupling | LLM-primary |

## Lens Boundaries

To avoid duplicate findings:

| Lens | Owns | Does NOT Own |
|------|------|--------------|
| **idempotency** | Safe re-run, convergence, atomic writes | Rollback, retries |
| **resilience** | Runtime fault tolerance, timeouts, retries | Change safety, re-run |
| **blast-radius** | Change safety, dry-run, rollback, batching | Runtime behavior |

## Output Format

All lenses use consistent output:

```
[TAG] <severity:HIGH|MED|LOW> <file:line>
Issue: <what's wrong>
Suggest: <how to fix>
Evidence: <why it matters>
```

## Severity Guidelines

| Severity | Criteria |
|----------|----------|
| **HIGH** | Exploitable vulnerability, data loss, will break on re-run |
| **MED** | Reliability issue, tech debt, best practice violation |
| **LOW** | Polish, maintainability, defense-in-depth |

## Deployment

Lenses are deployed to `~/.config/lenses/ops/` via home-manager.
