ariffazil/AUDIT-drift-detector
skills/AUDIT-drift-detector/SKILL.md
Real-time drift detection across tool manifests, agent cards, skill registries, and runtime-injected files. Compares live state against saved baselines and reports mismatches. USE WHEN: "check drift", "verify registry", "detect manifest drift", "tool surface audit", "runtime injection detection".
$ install --global
skillsauthnpx skillsauth add ariffazil/openclaw-workspace AUDIT-drift-detectorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 20, 2026, 3:08 AM41.1s1 file scanned
SKILL.md
- name:
- AUDIT-drift-detector
- description:
- >
- mismatches. USE WHEN:
- check drift", "verify registry", "detect manifest drift",
- version:
- 2026.07.19
- tags:
- [drift, audit, registry, manifest, F2, F11]
- floor_scope:
- [F02, F04, F11]
AUDIT-drift-detector
Purpose
The federation has multiple registries (tool_registry.json, agent cards, SKILL_ALIAS_TABLE, affordances.yaml). Drift between them causes routing failures, orphaned skills, and silent capability loss.
Drift Dimensions
- Build vs Runtime Manifest Drift — Canonical drift check via
arifOS/runtime/manifest.py(build_manifestvsruntime_manifest). This is the primary drift detection mechanism post-KSR Epoch 1+2. - Tool Manifest Drift — Live MCP tools vs registered tools vs agent card references
- Skill Registry Drift — SKILL_ALIAS_TABLE vs actual directories vs agent card skill IDs
- Agent Card Drift — Card skill IDs vs existing skill directories
- Schema Drift — Tool input schemas vs documented schemas
- Floor Drift — Declared floor_scope vs actual floor enforcement
- Verdict Taxonomy Drift — Verdict emissions vs closed 6-value set (OBSERVE_ONLY|SEAL|SABAR|VOID|HOLD|888_HOLD)
Detection Pipeline
- Snapshot — Capture current state of all registries
- Compare — Diff against saved baseline (or last-known-good)
- Classify — Each mismatch: CRITICAL (breaks routing), WARNING (orphan), INFO (cosmetic)
- Report — Structured drift report with fix recommendations
- Escalate — CRITICAL drift → 888_HOLD before any SEAL operation
⚠️ Runtime-Injected Files (2026-07-19)
Some organ services modify files at runtime. Known patterns:
- WELL
index.html: WebMCP adapter injected on service start → dirty after commit - arifOS session-state: Runtime state files that change during operation
When dirty after clean commit: check if injected content was already committed → if yes, re-commit; if no, actual drift.
Baselines
- Canonical drift check:
arifOS/runtime/manifest.py—build_manifestvsruntime_manifest(post-KSR Epoch 1+2) - Tool registry:
/root/arifOS/tool_registry.json - Agent cards:
/root/AAA/a2a-server/agent-cards/ - Skill alias:
/root/AAA/skills/SKILL_ALIAS_TABLE.json - MCP surface: Live
tools/listfrom each organ - Verdict taxonomy:
arifOS/runtime/verdict.py— closed 6-value set
Floors
- F2 TRUTH: Report only what is actually observed. No inference without evidence.
- F4 CLARITY: Drift report must be actionable, not noise.
- F11 AUDITABILITY: Every drift check logged with timestamp and findings.
Related Skills
ariffazil/XAUUSD-trading-stack
development
VerifiedTrustedCommunity
Federation-wide gold (XAUUSD) trading capability. Python stack, OANDA broker, backtesting, macro signals, RSI strategy. Every organ has a role.
2SKILL.mdUpdated Jul 24, 2026
ariffazil/wealth-claim-state
development
VerifiedTrustedCommunity
Capital claim state management — tracks claim lifecycle across WEALTH organ.
2SKILL.mdUpdated Jul 24, 2026
ariffazil/warga-constitutional
development
VerifiedTrustedCommunity
Archived constitutional warga placeholder retained only for audit provenance. Do not use for active work; use the live arifOS governance and constitutional skills instead.
2SKILL.mdUpdated Jul 24, 2026
ariffazil/warga
testing
VerifiedTrustedCommunity
Warga (citizen) agent skills for AAA federation members. See subdirectories for specialized warga skills.
2SKILL.mdUpdated Jul 24, 2026