| name | AUDIT-drift-detector |
| description | Real-time drift detection across tool manifests, agent cards, and skill registries. Compares live state against saved baselines and reports mismatches. Runs as a periodic audit or on-demand before SEAL operations. USE WHEN: "check drift", "verify registry", "detect manifest drift", "tool surface audit".
|
| version | 1.0.0 |
| tags | ["drift","audit","registry","manifest","F2","F11"] |
| floor_scope | ["F02","F04","F11"] |
AUDIT-drift-detector
Purpose
The federation has multiple registries (tool_registry.json, agent cards, SKILL_ALIAS_TABLE, affordances.yaml). Drift between them causes routing failures, orphaned skills, and silent capability loss.
Drift Dimensions
- Build vs Runtime Manifest Drift — Canonical drift check via
arifOS/runtime/manifest.py (build_manifest vs runtime_manifest). This is the primary drift detection mechanism post-KSR Epoch 1+2.
- Tool Manifest Drift — Live MCP tools vs registered tools vs agent card references
- Skill Registry Drift — SKILL_ALIAS_TABLE vs actual directories vs agent card skill IDs
- Agent Card Drift — Card skill IDs vs existing skill directories
- Schema Drift — Tool input schemas vs documented schemas
- Floor Drift — Declared floor_scope vs actual floor enforcement
- Verdict Taxonomy Drift — Verdict emissions vs closed 6-value set (OBSERVE_ONLY|SEAL|SABAR|VOID|HOLD|888_HOLD)
Detection Pipeline
- Snapshot — Capture current state of all registries
- Compare — Diff against saved baseline (or last-known-good)
- Classify — Each mismatch: CRITICAL (breaks routing), WARNING (orphan), INFO (cosmetic)
- Report — Structured drift report with fix recommendations
- Escalate — CRITICAL drift → 888_HOLD before any SEAL operation
Baselines
- Canonical drift check:
arifOS/runtime/manifest.py — build_manifest vs runtime_manifest (post-KSR Epoch 1+2)
- Tool registry:
/root/arifOS/tool_registry.json
- Agent cards:
/root/AAA/a2a-server/agent-cards/
- Skill alias:
/root/AAA/skills/SKILL_ALIAS_TABLE.json
- MCP surface: Live
tools/list from each organ
- Verdict taxonomy:
arifOS/runtime/verdict.py — closed 6-value set
Floors
- F2 TRUTH: Report only what is actually observed. No inference without evidence.
- F4 CLARITY: Drift report must be actionable, not noise.
- F11 AUDITABILITY: Every drift check logged with timestamp and findings.
