Not yet reviewed. Artifacts stay locked until you approve them.
Policy Drift · Preview
Where policy and reality stop matching
Instructions get edited, dependencies get added, tools change their action surface, and a decision made in March quietly stops being true. These are the ten checks that would find that — each shown as a worked example, with what it would need connected before it can run.
Examples, not findings
Worked examples, not findings about your setup. TokenCheat is not connected to a repository, a package registry, or an advisory feed, so it has observed nothing. These show the shape each check produces and what it would need in order to run. Every one names a fictional repository.
- criticalSecurityExample
A critical advisory affects an approved package.
- Observed
- An advisory feed reports a critical issue in a package the policy approved.
- Policy says
- Approved dependencies carry no unresolved critical advisory.
- Needs
- An advisory feed, plus the manifest to match it against.
You could:InvestigateOpen a proposal— nothing here changes a repository or a policy on its own. - highComplianceExample
An evidence requirement disappeared from the instruction files.
- Observed
- The rule requiring command output as evidence is no longer present.
- Policy says
- Work is reported as done only with the output that proves it.
- Needs
- A compliance pack, and the repository state to check it against.
You could:InvestigateRevise the policy— nothing here changes a repository or a policy on its own. - highTechnologyExample
A prohibited dependency was added.
- Observed
- example-org/example-app added a vector database client in package.json.
- Policy says
- Retrieval is marked prohibited, with human-only exception authority.
- Needs
- Read access to the package manifest and lockfile.
You could:InvestigateDraft a decisionRevise the policy— nothing here changes a repository or a policy on its own. - highToolExample
An MCP server gained an action with no Tool Contract.
- Observed
- A configured server exposes a state-changing action the contracts do not cover.
- Policy says
- Every external mutation is declared and requires explicit confirmation.
- Needs
- The MCP configuration, and a prior snapshot to compare it with.
You could:InvestigateRevise the policy— nothing here changes a repository or a policy on its own. - mediumAdapterExample
A generated export no longer matches its host format.
- Observed
- The host changed its rule file format after this adapter was last verified.
- Policy says
- Each adapter records the date its format was checked.
- Needs
- The host's current format, checked against the adapter's recorded date.
You could:InvestigateOpen a proposal— nothing here changes a repository or a policy on its own. - mediumContextExample
Always-on instructions duplicate the compiled policy.
- Observed
- A repository file repeats rules the compiled pack already carries.
- Policy says
- A rule is stated once, at the scope that owns it.
- Needs
- The repository's instruction files and the compiled pack.
You could:InvestigateRevise the policy— nothing here changes a repository or a policy on its own. - mediumDecisionExample
Code contradicts an accepted decision.
- Observed
- example-org/example-app uses an ORM the ledger recorded a decision against.
- Policy says
- An accepted decision holds until a superseding decision is recorded.
- Needs
- Repository read access, and an accepted decision to check against.
You could:InvestigateDraft a decision— nothing here changes a repository or a policy on its own. - mediumFreshnessExample
An approved package is deprecated upstream.
- Observed
- The registry marks a package in use as deprecated.
- Policy says
- Approved technologies carry a review date and a maintained upstream.
- Needs
- Registry metadata for the packages in the manifest.
You could:InvestigateDraft a decisionDismiss— nothing here changes a repository or a policy on its own. - mediumInstructionExample
A repository instruction file contradicts an approval gate.
- Observed
- example-org/example-app/CLAUDE.md tells the agent to deploy once tests pass.
- Policy says
- Production deploys require explicit confirmation and a stated rollback plan.
- Needs
- Read access to the repository's instruction files.
You could:InvestigateRevise the policyDraft a decision— nothing here changes a repository or a policy on its own. - lowBrandExample
A generated instruction would permit a prohibited claim.
- Observed
- An instruction file invites performance claims the brand policy forbids.
- Policy says
- Prohibited claims never appear in customer-facing output.
- Needs
- A brand policy with prohibited claims recorded.
You could:InvestigateRevise the policyDismiss— nothing here changes a repository or a policy on its own.
What a decision record looks like
Two real entries — TokenCheat's own, not yours. Your ledger is built from your rider and ships as ai/DECISIONS.md. These are here because “draft a decision” is the action above that costs the most effort, and it is fair to show what it produces before asking for it.
- accepted2026-08-23T00:00:00.000Z· Chip Martin
Context precedence is eleven levels, with client and without environment
- Context
- The PRD specifies the precedence order twice and the two disagree. FR-6 lists nine levels; the Technical Architecture section lists eleven. Checked against FR-1's own PolicyScope enum, neither is usable as written: FR-6 merges project and repository, which FR-1 separates; the Technical Architecture list adds environment, which is not a scope anything can be authored at; and both omit client, which FR-1 has and which the agency persona depends on contractually.
- Decision
- Adopt eleven levels — host, locked global safety, client, team, personal Rider, project, repository, Tool Contract, skill, task brief, reference. That is the Technical Architecture structure with environment replaced by client.
- Because
- Precedence answers whose rule wins; environment answers whether a rule applies right now. Ranking environment against repository compares two things that are not on the same axis, so environment belongs to the contextActivation domain, and a prod-safety rule that must never lose rides at level 2 as a locked rule. Client is contractual and owed to someone outside the team, so it outranks the team's own defaults. Project and repository stay distinct because one repository can hold several projects and one project can span several repositories — true in this codebase today.
Rejected, and why
- Implement FR-6's nine as the numbered spec. Rejected: it contradicts FR-1's scope enum, and merging project with repository is wrong for any monorepo.
- Implement the Technical Architecture eleven verbatim. Rejected: environment is not an authority level, and it still omits client.
- Make precedence configurable per rider. Rejected: a canonical order users can reason about is the point; a configurable one cannot be taught.
Known risk
Widening the order later would break every exported context-manifest.yaml. Narrowing is free, so the order was chosen wide.
- accepted2026-08-23T00:00:00.000Z· Chip Martin
The engine package stays dependency-free; Zod lives in its own package
- Context
- The PRD requires Zod validation for policy and exports. packages/skill-compiler has no runtime dependencies, is consumed by tooling/scripts and cli/ through raw paths, and zod is not resolvable from either.
- Decision
- Keep the engine dependency-free and put the Zod layer in packages/riders-schema, with each schema pinned to its engine type using `satisfies z.ZodType<T>`.
- Because
- A single runtime import reachable from the engine's barrel breaks all six tsx verify guards, verify:cli and two type-check tasks at once. Pinning each schema to its engine type means a field added to one without the other is a compile error, so the split costs nothing in drift.
Rejected, and why
- Add zod to packages/skill-compiler and to tooling/scripts. Rejected: it removes the property that lets the CLI import the engine by raw path.
- Put the schemas in apps/marketing. Rejected: the saas app could not reuse them, and the guard could not test them.
Known risk
A future contributor adds zod to the engine as a tidy-up. A guard assertion reads packages/skill-compiler/package.json and fails if dependencies is non-empty.