Check harness drift in CI

baselane drift exits 0 when everything on disk matches the pins and hashes in harness.json, and 1 when anything drifted. That makes it a one-line CI gate: nobody can hand-edit vendored config or a managed region without the build saying so.

What it catches

• modified — a vendored file (a pack-installed skill, say) was hand-edited; its hash no longer matches the install receipt.
• missing / file-missing — a recorded file was deleted.
• region-missing / content-drift — a managed region in AGENTS.md or CLAUDE.md was removed or edited in place.
• version-drift — the region on disk was rendered by a different pack version than the manifest pins.

Edits outside managed regions are yours and never flagged — drift protects the generated parts, not your writing.

GitHub Actions

name: harness-drift
on:
  pull_request:
  push:
    branches: [main]

jobs:
  drift:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: npx baselane@latest drift .

That's the whole job. No install step for baselane itself — npx baselane@latest fetches the CLI, and drift only reads files, so the job needs no tokens or write permissions.

Machine-readable reports

baselane drift . --json

Emits the full report as JSON — vendored, regions, and a top-level clean boolean — if you'd rather post the details as a PR comment or feed a dashboard than just fail the build.

When the gate fires

A red drift check means someone changed generated config by hand. Two honest ways forward: revert the hand-edit and change the pack source instead (so every repo gets the fix), or — if the change should be local prose — move it outside the managed region, where it's yours. Re-running baselane apply restores the generated parts to match the pins.