/fleet-retrofit

name: fleet-retrofit
description: >
  Bulk remediation across the fleet registry: fix drift repo-by-repo and
  optionally bootstrap the un-governed ones — every repo previewed and
  confirmed individually. TRIGGER when the user says "fix drift across all
  my repos", "retrofit the fleet", "retrofit all my repos", "bring every
  repo into compliance", "remediate my whole fleet", "bootstrap all my
  repos", "set up nyann on every repo", "clean up governance across my
  repos", "/nyann:fleet-retrofit".
  Do NOT trigger on single-repo remediation ("fix this repo's drift") —
  that's `retrofit` — or single-repo setup — that's `bootstrap-project`.
  Do NOT trigger on "show fleet health" / "which repos are drifting" —
  that's `fleet` (read-only).

fleet-retrofit

> **Plugin root:** `<plugin_root>/skills/fleet-retrofit/SKILL.md` — the > planning/bookkeeping engine is `<plugin_root>/bin/fleet-retrofit.sh`; > per-repo mutation reuses the SAME scripts the single-repo flows use.

**The safety contract (non-negotiable):** every mutation happens through the per-repo preview-and-confirm chain — plan → `preview.sh` → an AskUserQuestion for THAT repo → SHA-bound `bootstrap.sh`. There is no "yes to all": a fleet-wide approval would skip previews, which nyann never does. Each repo writes its own BootRecord, so any repo is individually reversible via `/nyann:undo-bootstrap`. In a non-interactive context (`NYANN_NONINTERACTIVE=true` / CI), stop after the plan and report — bulk mutation without a human cannot happen, by construction.

1. Plan

run_file=$(mktemp -t nyann-fleet-run.XXXXXX)
bin/fleet-retrofit.sh --plan [--bootstrap-missing] [--tag t] [--only a,b] \
                      --run-file "$run_file"

The plan classifies every registry entry — `clean`, `drifted` (report-only drift computation), `ungoverned` (no boot record and no resolvable profile), or `error` — read-only, one broken repo never aborts it. Exit 0 means nothing to do: report "fleet is clean" and stop.

Include `--bootstrap-missing` only when the user asked to set up new repos too ("bootstrap all my repos", "including the ones nyann never touched"). If they didn't say and the plan shows `ungoverned` repos being skipped, mention the count and ask once whether to re-plan with the flag.

2. Confirm the scope

Show the plan summary (drifted / ungoverned / clean / error counts and the worst repos) and confirm with ONE AskUserQuestion that the user wants to walk the fleet. Offer "stop here" — the plan alone is a useful artifact.

3. Walk the repos (plan order — worst first)

For each `pending` repo, work **inside that repo's path** (every `--target` below is the fleet entry's path, and the profile is the plan row's `profile`):

• **`drifted` →** follow the remediation flow in

`skills/retrofit/SKILL.md` §5 verbatim (ActionPlan from the drift report → `route-docs.sh` → `render-plan.sh` → `preview.sh` → confirm → `bootstrap.sh --plan-sha256 <sha> --source retrofit`). Do not re-derive it here — the single-repo skill is the source of truth.

• **`ungoverned` (only with `--bootstrap-missing`) →** follow

`skills/bootstrap-project/SKILL.md` for that path: `suggest-profile.sh` picks the profile (confirm the pick when confidence is low), then the standard detect → plan → preview → confirm → `bootstrap.sh` chain.

Per repo, the AskUserQuestion offers: **apply** / **skip this repo** / **stop the run**. Record the outcome immediately after each repo:

bin/fleet-retrofit.sh --record --run-file "$run_file" --repo <path> \
  --action retrofitted|bootstrapped|declined|skipped|failed \
  [--exit-code <n>] [--detail "<one line>"]

A failed repo is recorded `failed` and the walk continues — failure isolation is the point of the run file.

4. Finalize + report

bin/fleet-retrofit.sh --finalize --run-file "$run_file"

Unreached repos become `skipped`; the summary counts fill in. Render the final table (retrofitted / bootstrapped / declined / skipped / failed per repo) and close with:

• **Verify:** offer `/nyann:fleet` (fleet-doctor) to confirm the drift is

gone — before/after fleet scores make the run's value visible.

• **Undo:** any repo can be individually reverted:

"`/nyann:undo-bootstrap` inside <path>".

• Pinned-profile hygiene: repos remediated against a `fallback` profile

should get a pin (`bin/fleet.sh --add <path> --profile <p>`) so the next run doesn't guess.

What this skill does NOT do

• No history rewrites, no pushes, no PRs — same limits as single-repo

retrofit.

• No mutation outside the per-repo confirm. Declining a repo records

`declined` and moves on; it is never re-asked in the same run.