CLI: agentic-auth drift
Record observed agent edges, then check them against manifests, offline. check never exits
0 without evidence: 0 pass, 1 drift, 2 could not run.
drift record --out FILE [--events FILE] -- COMMAND...
Runs COMMAND (everything after --) with edge recording switched on via the
AGENTIC_AUTH_TRACE_PATH environment variable, then aggregates what was recorded into an
EdgeTrace written to --out. Exits with COMMAND's own exit code (or 0 if no command was
given and --events was aggregated directly).
--events names the raw JSON-lines events file; if omitted, a temporary one is created and
cleaned up automatically. The command refuses to mix runs — an --events file that already has
content is an error, not silently appended to.
drift check --manifest DIR [--manifest DIR ...] --trace FILE [options]
Compares the observed edges in --trace against the declared edges across all --manifest
directories (repeatable; their union is the declared set) — using the same edge-classification
rule the PDP runs at request time, with no network call.
| Option | Default | Notes |
|---|---|---|
--format | text | text | json | github |
--report FILE | — | Also write the full JSON report here |
--metrics-out FILE.prom | — | Write Prometheus textfile-collector metrics |
--deterministic | false | Omit the wall-clock timestamp, for golden-file tests |
Exit codes: 0 pass, 1 drift found (each undeclared edge classified as
UNDECLARED_TOOL / UNDECLARED_DELEGATION / UNKNOWN_AGENT), 2 could not run (bad
arguments, unreadable trace).