Skip to main content

Component: CI Drift Action

What it is: a GitHub Action + CLI that runs an agent's tests, diffs the observed call graph against the declared manifest, and fails the build naming the exact offending edge(s).

What it does: records passively during a normal test run, then checks entirely offline — against the same edge-classification rule the PDP runs at request time, so CI can never disagree with runtime about what's allowed.

Why the acting agent, never the caller, is recorded: at hop 1 the request's caller might be user:alice, but the agent actually acting is the root grant's holder. Recording caller would put an edge no manifest could ever declare (user:alice → agent://orchestrator) into the trace — so the recorder always uses the PDP's verified answer for who's acting; an unattributed event is counted as unattributed, never guessed. See Reference → Edge Trace schema.