check-drift

check-drift is a command for coding agents from tacoda/keystone. It costs 9 tokens per session (397 once invoked), scanned A, original, MIT.

A command that compares current code changes with the project's written rules and guidance. It is a quick check performed before the full verification step.

In plain words
What is it for?
Use it during implementation to inspect the diff, identify the relevant guides for changed files, and report rule violations with their sources.
Why use it?
It catches changes that have drifted from agreed coding practices while the work is still easy to adjust.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/tacoda/keystone/check-drift
Clone the repo
git clone --depth 1 https://github.com/tacoda/keystone

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for check-drift

README.md
[![agentmods](https://agentmods.dev/badge/commands/tacoda/keystone/check-drift.svg)](https://agentmods.dev/commands/tacoda/keystone/check-drift)
Your own site
<a href="https://agentmods.dev/commands/tacoda/keystone/check-drift"><img src="https://agentmods.dev/badge/commands/tacoda/keystone/check-drift.svg" alt="Measured on agentmods" height="20"></a>
Per session 9 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 397 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00009 $0.00397
Opus 5 $0.00005 $0.00198
Sonnet 5 $0.00002 $0.00079
Haiku 4.5 $0.00001 $0.00040

Measured 3d ago against content hash 9600cb61421d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

check-drift scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.charter/commands/check-drift.md · 24 lines

What it actually says

check-drift

Run the drift sensor on the current diff. Compare the in-progress changes against loaded charter rules. Fast pre-verify check. Read .charter/sensors/drift.md and .charter/guides/process/implementation.md.

Activities

  1. Identify the diffgit diff, the staged changes, or the in-progress edits. The list of changed files is the touched-files set for this action.
  2. List which guides apply — load .charter/guides/idioms/<stack>/*.md for each touched stack, plus .charter/guides/process/implementation.md and any guides from installed policys (.charter/policies/*/guides/). For each candidate, if it declares globs: in frontmatter, keep it only when at least one touched file matches; guides without globs: keep today's loading.
  3. Compare diff to guides — line by line, surface violations or hot drift signals. A guide's findings are reported only against files matching its globs: (or all touched files when no globs: is set).
  4. Report findings — one bullet per drift. Cite the guide that was violated.

When to invoke

Between implementation and verify. Faster and cheaper than the full verify pass; meant to catch obvious drifts before sensors run.

Index freshness precondition

check-drift reads .keystone/INDEX.json to know which guides apply to the touched files. If the index is stale (any guide file modified more recently than INDEX.json), run keystone index first — otherwise the drift check uses an outdated set of rules.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 24 lines · 9 tokens per session scan A 9600cb61421d

Subscribe to this mod's changes

check-drift is a command published in the GitHub repository tacoda/keystone (44 stars, last pushed 2mo ago), licensed MIT. It adds 9 tokens to every session and 397 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.