Overview

One binary does three things, and each looks for a different class of problem. This section is one coverage page per mode — what it examines, what it can conclude, and what it deliberately leaves to the others.

Mode	The question it answers	Needs
lookout scan	What is broken in this cluster right now? Every target-free incident check in one call, then a dependency-edge drill-down into whatever it flagged.	a kubeconfig
lookout audit	What has no safety net, while it is still healthy? Standing posture claims — no PDB, single replica, privileged containers, no NetworkPolicy, upgrades nobody is watching.	a kubeconfig
The sentinel	What is about to break, and did it recover? A resident in-cluster process turning leading indicators into agent sessions, and closing them when the symptom stays clear.	a deployment

The first two need nothing deployed and take no arguments — run them against a cluster you have never seen. The sentinel is the one that has to live somewhere, because watching is not something a one-shot command can do.

Incidents, posture, and leading indicators

The split between the three is a claim about what clears the finding, and it is why they are separate commands rather than one flag:

• An incident is broken now and clears itself when fixed. scan reports these, which is what makes its output a worklist.
• A posture finding never self-clears — a workload with one replica has one replica until someone decides otherwise. audit reports these, and they are --exemptions-auditable precisely because the answer is often “yes, deliberately”.
• A leading indicator is neither: nothing is broken yet. Only a process that has been watching can see a slope, a flap, or a countdown, which is the sentinel’s whole reason to exist.

Mixing them would flood a healthy cluster’s first run and swamp the findings diff transition stream with a flat backlog, so audit is off in a bare scan and named in the summary’s skipped= note so it stays discoverable while off.

The exhaustive catalogs

These pages are organized for reading. When you have a kind= in hand and want to know what it claims, the flat catalogs are the faster lookup:

• Finding kinds — every kind the read path (scan, audit, and every other command) can emit, in one table.
• Signal kinds — the sentinel’s frozen signal-schema v1 wire vocabulary.