ariffazil/ASI-drift-watch
skills/_retired/ARCHIVE-dupe-2026-07-12/root_.agents_skills/ASI-drift-watch/SKILL.md
Detect drift between federation source (/root/<organ>) and runtime (/opt/<organ>/app). The chronic arifOS blocker documented in /root/CLAUDE.md §4.4. Runs on schedule and manually. Use when in doubt about which version is live, or as part of `verify-runtime`.
$ install --global
skillsauthnpx skillsauth add ariffazil/openclaw-workspace ASI-drift-watchInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 16, 2026, 3:54 AM178.8s1 file scanned
SKILL.md
- name:
- ASI-drift-watch
- description:
- Detect drift between federation source (/root/<organ>) and runtime (/opt/<organ>/app). The chronic arifOS blocker documented in /root/CLAUDE.md §4.4. Runs on schedule and manually. Use when in doubt about which version is live, or as part of `verify-runtime`.
- when_to_use:
- After deploy, when organ behavior surprises you, weekly health audit, before any "is it running what I think?" question.
- disable-model-invocation:
- false
- allowed_tools:
- [Bash, Read, Grep]
Drift Watch
A service running is not the same as a service running what you think. This skill surfaces that gap.
Steps
git -C /root/<organ> rev-parse HEAD→ source SHAcat /opt/<organ>/app/.git_commit→ runtime SHA (if file exists)- Compare → if mismatch → DRIFT
- If DRIFT:
- Source newer →
make deploy-localcandidate (per-organ) - Runtime newer → runtime patch not in source → 888 HOLD
- Source newer →
- Also check:
- Caddy port map:
/etc/caddy/Caddyfile(sovereign-locked, see FEDERATION_INVENTORY.md §4) - systemd unit file:
systemctl cat <unit> - env file presence:
/root/.env,/root/.secrets/all-secrets.md
- Caddy port map:
Verification loop
- Match → no action
- Mismatch → log + 888 HOLD with both SHAs + recommended action
.git_commitmissing on runtime → log warning, treat source as truth
Per-organ runtime locations
| Organ | Source | Runtime |
|-------|--------|---------|
| arifOS | /root/arifOS | /opt/arifos/app |
| GEOX | /root/geox | docker (compose) |
| WEALTH | /root/WEALTH | systemd |
| WELL | /root/WELL | systemd |
| APEX | /root/APEX | systemd |
| A-FORGE | /root/A-FORGE | dist/ + systemd |
| AAA | /root/AAA | static (Caddy) |
| HERMES | /root/HERMES | /usr/local/lib/hermes-agent |
Failure modes
- Runtime file missing → assume source is truth, surface to human
- Mismatch in
.git_commitonly (cosmetic) → warn, don't HOLD - Source repo not on
main→ flag, ask if intentional
Related Skills
ariffazil/openclaw
testing
VerifiedTrustedCommunity
OpenClaw edge agent bridge — operational triage, doctor, restart, and A2A bridge routing for the federation edge (Telegram surface). USE WHEN: "openclaw unhealthy", "gateway down", "edge bot not responding", "a2a bridge disconnected", "watchdog tripped", "openclaw doctor", "openclaw restart". NOT for token/security audit — use FORGE-telegram-audit.
2SKILL.mdUpdated Aug 8, 2026
ariffazil/MiniMax Image Generation
tools
VerifiedTrustedCommunity
Generate images, videos, TTS, voice clone, and music via MiniMax MCP server. Use when user asks to "draw", "generate image", "create picture", "make a photo", "text to image", "image generation".
2SKILL.mdUpdated Aug 8, 2026
ariffazil/arifos-constitutional-judge
testing
VerifiedTrustedCommunity
Single load-bearing constitutional-judgment skill. Routes all F1–F13, verdict, hold, seal, scope, authority and floor-check calls through the live arif_judge surface. Replaces 7 overlapping predecessors (arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge).
2SKILL.mdUpdated Aug 8, 2026
ariffazil/FORGE-lsp-pre-edit-gate
development
VerifiedTrustedCommunity
MANDATORY LSP grounding gate BEFORE any code mutation on .ts, .py, .js, .tsx, .jsx files. Forces the agent to read real-time compiler diagnostics and structural project context before editing — eliminating blind guesses and anchoring every mutation in F2 (TRUTH). Routes through arifOS kernel (:8088) for centralized gate logic.
2SKILL.mdUpdated Aug 8, 2026