ariffazil/drift-watch
skills/ARCHIVE-drift-watch/SKILL.md
Detect drift between federation source (/root/<organ>) and runtime (/opt/<organ>/app). The chronic arifOS blocker documented in /root/CLAUDE.md §4.4. Runs on schedule and manually. Use when in doubt about which version is live, or as part of `verify-runtime`.
$ install --global
skillsauthnpx skillsauth add ariffazil/openclaw-workspace drift-watchInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 16, 2026, 4:36 AM2.5s1 file scanned
SKILL.md
- name:
- drift-watch
- description:
- Detect drift between federation source (/root/<organ>) and runtime (/opt/<organ>/app). The chronic arifOS blocker documented in /root/CLAUDE.md §4.4. Runs on schedule and manually. Use when in doubt about which version is live, or as part of `verify-runtime`.
- when_to_use:
- After deploy, when organ behavior surprises you, weekly health audit, before any "is it running what I think?" question.
- disable-model-invocation:
- false
- allowed_tools:
- [Bash, Read, Grep]
Drift Watch
A service running is not the same as a service running what you think. This skill surfaces that gap.
Steps
git -C /root/<organ> rev-parse HEAD→ source SHAcat /opt/<organ>/app/.git_commit→ runtime SHA (if file exists)- Compare → if mismatch → DRIFT
- If DRIFT:
- Source newer →
make deploy-localcandidate (per-organ) - Runtime newer → runtime patch not in source → 888 HOLD
- Source newer →
- Also check:
- Caddy port map:
/etc/caddy/Caddyfile(sovereign-locked, see FEDERATION_INVENTORY.md §4) - systemd unit file:
systemctl cat <unit> - env file presence:
/root/.env,/root/.secrets/all-secrets.md
- Caddy port map:
Verification loop
- Match → no action
- Mismatch → log + 888 HOLD with both SHAs + recommended action
.git_commitmissing on runtime → log warning, treat source as truth
Per-organ runtime locations
| Organ | Source | Runtime |
|-------|--------|---------|
| arifOS | /root/arifOS | /opt/arifos/app |
| GEOX | /root/geox | docker (compose) |
| WEALTH | /root/WEALTH | systemd |
| WELL | /root/WELL | systemd |
| APEX | /root/APEX | systemd |
| A-FORGE | /root/A-FORGE | dist/ + systemd |
| AAA | /root/AAA | static (Caddy) |
| HERMES | /root/HERMES | /usr/local/lib/hermes-agent |
Failure modes
- Runtime file missing → assume source is truth, surface to human
- Mismatch in
.git_commitonly (cosmetic) → warn, don't HOLD - Source repo not on
main→ flag, ask if intentional
Related Skills
ariffazil/XAUUSD-trading-stack
development
VerifiedTrustedCommunity
Federation-wide gold (XAUUSD) trading capability. Python stack, OANDA broker, backtesting, macro signals, RSI strategy. Every organ has a role.
2SKILL.mdUpdated Jul 24, 2026
ariffazil/wealth-claim-state
development
VerifiedTrustedCommunity
Capital claim state management — tracks claim lifecycle across WEALTH organ.
2SKILL.mdUpdated Jul 24, 2026
ariffazil/warga-constitutional
development
VerifiedTrustedCommunity
Archived constitutional warga placeholder retained only for audit provenance. Do not use for active work; use the live arifOS governance and constitutional skills instead.
2SKILL.mdUpdated Jul 24, 2026
ariffazil/warga
testing
VerifiedTrustedCommunity
Warga (citizen) agent skills for AAA federation members. See subdirectories for specialized warga skills.
2SKILL.mdUpdated Jul 24, 2026