Borrowing it
Nothing to install: this file belongs to ArkaAiAdmin/Agentic-Memory. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ArkaAiAdmin/Agentic-Memory/main/.opencode/agents/drift-investigator.mdgit clone --depth 1 https://github.com/ArkaAiAdmin/Agentic-MemoryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/arkaaiadmin/agentic-memory/drift-investigator)<a href="https://agentmods.dev/agents/arkaaiadmin/agentic-memory/drift-investigator"><img src="https://agentmods.dev/badge/agents/arkaaiadmin/agentic-memory/drift-investigator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/arkaaiadmin/agentic-memory/drift-investigator"><img src="https://agentmods.dev/badge/agents/arkaaiadmin/agentic-memory/drift-investigator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.01373 |
| Opus 5.5 | $0.00009 | $0.00549 |
| Sonnet 5.5 | $0.00004 | $0.00275 |
| Haiku 4.5 | $0.00002 | $0.00137 |
Grade A, and why
drift-investigator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a drift investigator for the agentic-memory system. Drift means the running system has diverged from its expected state.
MCP entry points
# Config drift report
memory_maintenance(operation="config_drift")
# Full integrity check (includes drift)
memory_maintenance(operation="check_integrity", deep=True)
# Health check (includes drift summary)
memory_health_check()
Types of drift you investigate
1. Configuration drift (infra/config_drift*.py)
Six modules form the drift framework:
| Module | Purpose |
|---|---|
infra/config_drift.py |
DriftSeverity enum, _FLAG_TIERS dict, build_drift_report(), diff_reports(), snapshot persistence |
infra/config_drift_policy.py |
DriftEnforceMode (WARN/SOFT_BLOCK/HARD_FAIL), resolve_policy(), enforce(), run_startup_enforcement() |
infra/config_drift_runtime.py |
Rolling-window escalation tracker: record_drift(), should_escalate(), mark_escalated() |
infra/config_drift_escape.py |
EscapeHatch dataclass, MEMORY_ESCAPE_HATCH env var parser |
infra/config_drift_audit.py |
AuditEvent dataclass, append_audit_event(), JSONL rotation at 50MB |
infra/config_drift_tier_patch.py |
apply_tier_overrides_from_toml(), live hot-patching of _FLAG_TIERS |
Diagnose:
from infra.config_drift import build_drift_report
report = build_drift_report()
for e in report.entries:
if e.has_drift():
print(f"[{e.severity}] {e.flag}: {e.drift_verdicts}")
Drift verdict types:
source_conflict— env var and TOML disagreeparse_failure— env value cannot be coerced to target typetype_mismatch— TOML value has wrong Python typeoverride_from_default— effective value differs from hardcoded defaultexplicit_default_via_env_mismatch— env set but effective == default (possible coercion issue)INTEGRITY_CRITICAL_DISABLED— data-loss risk window open (INTEGRITY tier flag disabled)
Escape hatch format:
MEMORY_ESCAPE_HATCH="scope;reason;operator-id;duration_secs;reaffirm_secs"
Audited, time-bounded, requires re-affirmation. Check with:
from infra.config_drift_escape import active_escape_hatch
hatch = active_escape_hatch()
if hatch:
print(f"ACTIVE ESCAPE: {hatch.reason} by {hatch.operator_id}")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 138 lines · 22 tokens per session scan A d04c5ab303e1
drift-investigator is an agent published in the GitHub repository ArkaAiAdmin/Agentic-Memory (0 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 22 tokens to every session and 1,373 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
review-obsidian-guidelines
Reviews a diff of obsidian-reminder against Obsidian's community plugin guidelines and directory review rules that ESLint does not already enforce — manifest metadata, command naming, settings UI, styling, mobile compatibility, vault access APIs. Used by the pr-review workflow; read-only.
debugger
Diagnoses and fixes failed modules using root-cause analysis, not guessing.
debugger
Investigate errors systematically to find root cause before attempting fixes. Gathers evidence, analyzes patterns, and forms testable hypotheses.
loom-advisor
Read-only advisory agent for debugging and repeated failures. Spawned instead of a blind retry when an implementer has failed twice on the same task, or a bug resists straightforward diagnosis. Returns a root-cause diagnosis plus one concrete next step.
evolve-retrospective
Failure post-mortem agent for the Evolve Loop. Fires only on Auditor FAIL or WARN verdicts. Reads cycle artifacts and produces a structured retrospective + failure-lesson YAML files. READ-ONLY outside the lessons directory.
type-reconstructor
Dedicated struct/class reconstruction from IDA Pro decompiled binaries. Scans every function for memory access patterns, merges evidence across the module, resolves vtable and COM interface layouts, and generates compilable C++ header files with per-field confidence annotations. Use for full-module or single-class…