command-center/agent/managed-skills/kernel-flag-claim-audit/SKILL.md

name, description

name	description
kernel-flag-claim-audit	Audit a kernel/boot-parameter performance claim before it justifies a host decision (census feature presence, read the patch series verbatim, then publish the corrected plan to a Gitea issue without leaking the token).

Use when a decision rests on a kernel/boot-line performance claim (iommu=off vs pt, a module param, a new engine flag) and the question is "does an upstream change retire this trade?", or when the answer must land as a Gitea issue comment.

1. Census before theory (read-only, no reboot)

uname -r; cat /proc/cmdline
grep -c . /dev/null; ls /sys/kernel/iommu_groups | wc -l        # or the relevant sysfs knob
nm -b /boot/System.map-$(uname -r) 2>/dev/null | grep -i <feature_symbol> | head
apt-cache policy <meta-packages>                                  # what the distro can actually install
grep -E 'CONFIG_(...)' /boot/config-$(uname -r)
ls -l /dev/<device>; id -nG                                      # container-access question

• Symbol absence in System.map + archive pinning = the claim is not actionable today, regardless of merge status. Say that plainly.
• Answer the container/device question from node mode + group membership; it never needs a reboot.

2. Primary source beats press

Read the patch series itself (cover letter + the implementation patch), not the news write-up. The press number is a symptom; the patch text carries the preconditions that decide applicability.

Rules that only surface in the patch text (2026-10-18 AMD PerfOpt case):

• enable path "rehomes devices already on the identity domain" → the feature is a companion to iommu=pt, never an alternative;
• the enable path disables ATS/PRI/PASID/GCR3 (skip_caps in attach_device) → identity mode still pays a 1:1 page walk until this arms; a passthrough boot is therefore "most of the fix", not all of it;
• a per-IOMMU bit is refcounted / re-armed on resume → matters for suspend users.

Also check the driver-side consumer's gate condition (e.g. amdgpu_device_use_perfopt() requires AMD_IS_APU and the identity domain) — the feature and the endpoint you care about can live on independent paths (amdxdna binds its own SVA domain regardless of default domain type), which is what decouples "perf lever" from "device works again".

Never inherit a vendor/press delta as a local cost: record it as vendor-claimed, never measured here, and make the procedure demand a local A/B in the maintenance window. Flag stale baselines by quoting the current measured figure.

3. Correct every carrier, in one cutover

Decision-record page (new dated section + front-matter description re-key), the retired-endpoint runbook that carries the now-dead law, AGENTS.md key-lesson bullet, worklog. Delete the dead law rather than annotating it.

4. Publish to Gitea without leaking the token

Token NEVER in argv (curl -H "Authorization: …" is world-readable in /proc/<pid>/cmdline). Reuse the git credential store, write a 0600 curl config, delete it after:

line = next(l for l in (~/.config/secrets/gitea).read_text().splitlines() if HOST in line)
user, tok = urllib.parse.unquote(...)      # store file is percent-encoded
cfg = 0o600 temp:  user = "USER:TOKEN"
subprocess.run(["curl","-sS","-K",cfg,"-o",resp,"-w","%{http_code}", ...])
os.unlink(cfg)

• New comment: POST /api/v1/repos/{o}/{r}/issues/{n}/comments, body {"body": markdown} → 201.
• Correction: PATCH /api/v1/repos/{o}/{r}/issues/comments/{id} — edit in place, do NOT post a follow-up. A wrong claim published is fixed by editing it; leaving the wrong text up for future readers is the failure mode.
• Verify: anonymous GET .../issues/{n}/comments then assert the corrected marker is present AND the retracted phrase is absent.

5. Verification

./tests/run.sh (docs completeness + vault link integrity cover the doc edits), commit, push. Secrets scratch files: unlink them; do not leave a token-bearing temp behind.

Gotchas

• Markdown bullet lines inserted through the edit tool: an escape like +- item came out verbatim (file kept +- ), twice. When a list block must be rewritten, write the whole file instead of guessing escape syntax.
• A reader-mode read of a news page can return the ad-blocker JS blob; use the mailing-list/patch archive (native method) for primary sources.