scenario: The Sysadmin — verify ujust check-local-overrides is present and list_recipes supports full configuration audit

[castrojo]

Scenario

You want to audit what has been customized on a machine relative to the image defaults. The AI surfaces the full ujust recipe list, which includes ujust check-local-overrides — the built-in recipe that diffs the system's /etc against the image baseline and reports configuration drift.

Tools that serve this scenario today

• list_recipes — returns the live ujust --list output, which should include check-local-overrides and any other audit-relevant recipes.

What to verify / improve

• Is ujust check-local-overrides (or an equivalent drift-detection recipe) present in the recipe list from projectbluefin/common? If not, this is a gap that should be tracked as a separate upstream contribution request.
• Does the recipe's description in ujust --list make its purpose clear to a sysadmin — specifically that it diffs /etc against the image baseline, not just "checks overrides"?
• Are there other audit-relevant recipes (e.g. listing pinned packages, checking image signing, verifying SELinux policy state) that should be present or better described?
• Does list_recipes output give enough context for the AI to say "run ujust check-local-overrides to see what has drifted from the image defaults"?

Acceptance criteria

• ujust check-local-overrides or equivalent is present and discoverable via list_recipes.
• The recipe description clearly communicates the /etc diff against image baseline behavior.
• An AI given list_recipes output can guide a sysadmin through a complete configuration audit using only built-in recipes.
• Any missing audit recipes are identified and tracked as follow-up work items.