Check drift

Check Drift

Audit a contract tree against the real code. Contracts that drift out of sync become lies the other flows trust — this skill finds them.

Hard rule: this skill is report-only. It lists suspected problems and suggests fixes. It does not edit contracts or code. Fixing is a separate, deliberate step (usually via change-with-contracts or map-modules).

The canonical format is ../map-modules/references/contract-format.md.

What to check

Read .contract-tree/tree.md, then for each CONTRACT.md:

1. Entrypoints exist — every file:symbol in entrypoints resolves to a real file and a real exported symbol. A missing one is the strongest staleness signal (the boundary moved or was renamed).
2. Signatures match declared I/O — the entrypoint's actual parameter and return types are consistent with io.input (precondition) / io.output (postcondition). Flag mismatches (e.g. contract says output alt in meters but the type/comment now says feet). A downstream module's declared consumption is effectively a consumer contract on this output; a mismatch that would violate what a downstream relies on is high severity — the provider silently stopped satisfying a consumer.
3. Upstream matches real imports — the module's actual cross-module imports match its declared upstream. Flag both directions: a declared upstream that isn't imported anymore, and a real cross-module import that isn't declared.
4. Invariants still plausible — where cheaply checkable, note invariants the code visibly contradicts. (Deep verification isn't expected; flag the obvious.)

Tree-level checks

• Contract-less modules (tree holes) — directories that look like modules (cohesive code behind a public surface, imported by others) but have no CONTRACT.md. Report them as gaps to map.
• Index vs contracts — tree.md edges that no longer match the contracts' inverted upstream. Since the index is regenerable, the fix is to regenerate; report the divergence.

Output

Produce a report grouped by severity:

• Stale (high): entrypoint missing, or I/O clearly contradicted.
• Suspect (medium): upstream/import mismatch, index/contract divergence.
• Gaps: code modules without a contract.

For each item: the module id, what looks wrong, and the suggested corrective flow (change-with-contracts to fix a moved boundary, map-modules to fill a gap or regenerate the index). Do not apply the fixes — hand the report to the user.

Scope caveat

This audit sees only declared static dependencies. It cannot detect implicit coupling — shared formats, global state, a shared database, event ordering, duplicated constants — which drifts invisibly because no upstream edge records it. When a contract's I/O carries strong connascence (a unit/meaning, a wire format, a magic value), say so in the report: the real drift surface may be wider than the graph. See ../contract-tree/references/principles.md.