check

What this skill does

# Quick Drift Check

You are performing a fast, focused drift check on a specific target. This skill detects whether code aligns with its governing ADRs and specs.

## Process

<!-- Governing: ADR-0016 (Workspace Mode), SPEC-0014 REQ "Artifact Path Resolution" -->

0. **Resolve artifact paths**: Follow the **Artifact Path Resolution** pattern from `references/shared-patterns.md` to determine the ADR and spec directories. If `$ARGUMENTS` contains `--module <name>`, resolve paths relative to that module; otherwise, in a workspace, aggregate across all modules. The resolved ADR directory is `{adr-dir}` and spec directory is `{spec-dir}`.

   <!-- Governing: ADR-0016 (Workspace Mode), SPEC-0014 REQ "Cross-Module Aggregation" -->

   **Cross-module aggregation**: When in aggregate mode (no `--module`, workspace detected), check all modules and group findings by module in the output. Add a `Module` column to the findings table and organize findings under per-module subheadings. When `--module` is provided, check only that module — no module labels needed. When in single-module mode (no workspace), operate normally.

1. **Parse the target**: Extract the target from `$ARGUMENTS`.
   - A file path: `src/auth/login.ts`
   - A directory path: `src/auth/`
   - An ADR reference: `ADR-0001`
   - A SPEC reference: `SPEC-0001`
   - If `$ARGUMENTS` is empty, check all artifacts against the entire codebase.

2. **Validate the target exists**:
   - For file/directory targets: verify the path exists. If not, report: "Target not found: `{target}`. Provide a valid file path, directory, ADR reference (ADR-XXXX), or SPEC reference (SPEC-XXXX)."
   - For ADR references: glob `{adr-dir}/ADR-{number}-*.md`. If not found, report: "ADR-{XXXX} not found in `{adr-dir}`. Run `/sdd:list adr` to see available ADRs."
   - For SPEC references: glob `{spec-dir}/*/spec.md` and search for the matching SPEC number. If not found, report: "SPEC-{XXXX} not found in `{spec-dir}`. Run `/sdd:list spec` to see available specs."

3. **Locate design artifacts**:
   - Scan `{adr-dir}` for ADR files. If the directory does not exist, report: "The `{adr-dir}` directory does not exist. Run `/sdd:adr [description]` to create your first ADR."
   - Scan `{spec-dir}` for spec files. If the directory does not exist, report: "The `{spec-dir}` directory does not exist. Run `/sdd:spec [capability]` to create your first spec."
   - If neither ADRs nor specs exist, report: "No design artifacts found. Create an ADR with `/sdd:adr` or a spec with `/sdd:spec` first."
   - It is valid for only ADRs or only specs to exist -- proceed with whatever is available.

3a. **Tier 3 staleness check** (v5.0.0+):

   <!-- Governing: ADR-0026 (Tiered Index Freshness), SPEC-0019 REQ "Tier 3 Staleness Threshold for Consumer Skills" -->

   On entry, check the qmd index's last-modified timestamp for this repo's collections (use the exact-prefix match algorithm from `references/qmd-helpers.md` § "This-Repo Collection Identification" to identify them, then take the maximum `lastUpdated` across them). If that timestamp is older than the configured staleness threshold, run a silent `qmd update` first.

   The threshold default is **120 minutes** and is configurable in CLAUDE.md `### SDD Configuration` `#### Index Freshness` `**Staleness Threshold**` (e.g., `30m`, `4h`). Read it via the **Config Resolution** pattern in `references/shared-patterns.md`.

   On stale → update path, emit a one-line note in the report header: `Index was {age} stale — refreshed before running.` On fresh, proceed silently. On qmd update failure, surface the error per `references/qmd-helpers.md` § "Error Handling" and continue (best-effort; the check still runs against the existing index).

4. **Determine relevant artifacts**:

   <!-- Governing: ADR-0024 (qmd as hard dependency), SPEC-0019 REQ "qmd-Smart Drift Skills" -->

   Use qmd hybrid retrieval to identify the top-K candidate ADRs and specs governing the target before reading any artifact in full. The pre-v5 "read all ADRs and specs to find which ones govern the target" path is removed in v5.0.0 — qmd retrieval is the canonical mechanism.

   - **If the target is a file or directory**: construct a hybrid query per `references/qmd-helpers.md` § "Hybrid Retrieval" derived from the target's content. The query SHOULD include:
     - `lex`: the file path basename, exported symbol names from a quick scan, and any `Governing:` comment block content (if present)
     - `vec`: a one-sentence summary of what the target file/dir does (e.g., for `src/auth/login.go` → "user authentication via JWT-based session login flow")
     - `intent: "/sdd:check {target} — find ADRs and specs governing this code"`

     Filter to `collections: ["{repo}-adrs", "{repo}-specs"]` (or per-module variants in workspace mode). Set `limit: 8` and `minScore: 0.3`. Read the top-K candidates in full before evaluating drift.

   - **If the target is an ADR (`ADR-XXXX`)**: read the ADR directly. Then qmd-search `{repo}-specs` for related specs (those that implement or reference the ADR) and `{repo}-code` for code that should implement the decision. Same query structure as the file/dir case, with the ADR's title and decision as the `vec` query.

   - **If the target is a SPEC (`SPEC-XXXX`)**: read the spec directly. Then qmd-search `{repo}-adrs` for governing ADRs and `{repo}-code` for implementing files. Same pattern.

   On qmd unreachable / timeout per `qmd-helpers.md` § "Error Handling", surface the error and stop. Per ADR-0024 and SPEC-0019 REQ "qmd Assumption in Consumer Skills", fallback paths were eliminated in v5; the failure mode is "fix qmd, retry" not "scan the entire corpus."

5. **Validate spec artifact pairing**: For each spec directory found under `{spec-dir}`, check that both `spec.md` and `design.md` exist. If a `spec.md` exists without a corresponding `design.md` (or vice versa), report as `[WARNING]` under "Code vs. Spec" with finding: "Unpaired spec artifact: {path} exists but {missing-file} is missing. Per ADR-0003, spec.md and design.md are a paired unit." (Governing: ADR-0003, SPEC-0003)

6. **Security lint scan**: Scan source code files in the target for dangerous patterns that indicate security risks. Use text-based pattern matching (Grep tool with regex), NOT AST analysis. False positives are acceptable — flag patterns for human review.

   <!-- Governing: ADR-0018 (Security-by-Default), ADR-0019 (Frontend Quality Standards), SPEC-0016 REQ "Security Lint Patterns" -->

   For each pattern below, search applicable source files and report any matches as findings in the output table. All security lint findings use category **Security Lint** and severity **[WARNING]**.

   **Pattern 1 — Unbounded body read**: Reading an HTTP request body without enforcing a size limit allows a single request to allocate arbitrary memory.
   - Go: `io.ReadAll(r.Body)` or `ioutil.ReadAll(r.Body)` without `http.MaxBytesReader` wrapping the body in the same function or file.
   - JS/Node: `req.on('data'` accumulating chunks without a size check, or body-parser / express.json without a `limit` option.
   - Python: Reading `request.body` or `request.data` without `DATA_UPLOAD_MAX_MEMORY_SIZE` or equivalent framework-level limit.
   - Remediation: "Wrap the body with a size-limiting reader (e.g., `http.MaxBytesReader` in Go, `{ limit: '1mb' }` in Express, `DATA_UPLOAD_MAX_MEMORY_SIZE` in Django) before reading."

   **Pattern 2 — Template safety bypass**: Disabling template auto-escaping injects raw HTML into rendered output, enabling XSS.
   - Go: `template.HTML(` casting user-supplied or unsanitized content.
   - JS/React: `dangerouslySetInnerHTML` usage.
   - Python/Jinja: `|safe` filter or `{% autoescape false %}` in Jinja/Django templates.
   - Remediation: "Avoid bypassing template auto-escaping. If raw HTML is required, sanitize the content with a trusted library before marking it safe."

   **Pattern 3 — User-controlled redirect**: HT