What is drift?

Drift is when what's on disk no longer matches harness.json's install receipt. This can happen if someone hand-edits a vendored file, a managed region body goes stale, or the installed version falls behind the exact version harness.json recorded (its pin).

Two ways it's checked

Every install writes a receipt into the manifest: a sha256 per vendored file, per managed-region body, and per delivered capability artifact.

• Local: baselane drift compares those receipt hashes against what's actually on disk. A hand-edit changes the hash. So this check always matches what was actually written.
• Fleet: the org's drift view re-renders the pack fresh from its pinned version and compares the result against disk. It reports the worst of none < content (hand-edited) < version (stale pin) < missing (region gone). This can catch drift the local check cannot see yet. For example, it flags drift right after a pack's render logic changes upstream, before anyone reinstalls.

Checking for drift

baselane drift

Exits 0 when clean, 1 when drift is detected. Wire it into CI to catch drift before it ships.

Example

Clean:

baselane drift: clean (4 vendored file(s), 1 region(s) verified)

After someone hand-edits a vendored skill file:

baselane drift: DRIFT DETECTED (/repo/harness.json)
  ! .claude/skills/security-review/SKILL.md: modified

The ! line names the exact file that no longer matches its receipt.