Reconcile RoR .agents/ ↔ pack divergence + add drift detection

[justin808]

Context

react_on_rails vendors this pack under .agents/ and is meant to track it. Both repos are now under active concurrent development, so the copies have drifted apart in both directions, with nothing flagging it. This tracks (1) a one-time per-file reconciliation and (2) a durable drift-detection check so it stops happening silently.

Snapshot: agent-workflows@a2123e6 vs react_on_rails@2b4854034 (2026-06-27). Compare RoR <react_on_rails>/.agents/<path> vs pack <path>.

Diverged files (current snapshot)

diff-lines	file	notes
431	skills/pr-batch/bin/pr-security-preflight-test.rb	Pack ahead (~+180 lines): the #5 review-resolution fixtures + #12 pagination + #20 trust-config tests landed in the pack; RoR's copy is behind.
161	skills/pr-batch/bin/pr-security-preflight	Large; appears to have crossed over — pack now carries #5/#12/#20 and RoR's hosted-CI block looks removed. Diff carefully to pick the canonical side.
80	workflows/pr-processing.md	Equal length, substantive content drift — both evolved independently.
36	skills/qa-stress/SKILL.md	Symmetric (18/18) bidirectional edits since the skill was created.
13	skills/pr-batch/SKILL.md	Small.
4	workflows/adversarial-pr-review.md	Small.
3	skills/spec/SKILL.md	Trivial.
2	skills/post-merge-audit/SKILL.md	Trivial.
2	skills/plan-pr-batch/SKILL.md	Trivial.
2	skills/pr-batch/bin/agent-coord-bounded-test.rb	Trivial.
1	skills/replicate-ci/SKILL.md	Trivial.

Already reconciled/aligned: tdd is identical both sides. Intentionally RoR-only: skills/stress-test (RoR-specific — stays local).

Approach (per file)

Decide the canonical side and sync, keeping repo-specific values OUT of the pack (defer to the consumer's AGENTS.md ## Agent Workflow Configuration seam). Where RoR is ahead with generic improvements, port them up exactly as #5 did (generic only; repo-specific stays in RoR). Where the pack is now ahead (e.g. pr-security-preflight + test), RoR re-vendors.

Suggested order: (1) pr-security-preflight + its test (largest, security-relevant; likely pack→RoR re-vendor), (2) pr-processing.md, (3) qa-stress, (4) sweep the ~7 trivial 1–13-line drifts in one PR.

Durable fix — drift detection

One-time reconciliation will re-drift as both repos keep moving. Add a check that flags divergence between RoR's .agents/ and the pack — e.g. a small script or CI job that diffs the vendored tree against a pinned pack revision and reports files that differ but aren't on an allowlist (stress-test). This is the higher-leverage half of the fix.

---

Generated from a divergence scan during the agent-workflows enablement work (PRs #1–#5). #5 is the template for a generic-only per-file port.

[justin808]

No-PR split handoff for Issue #23.

Fresh drift facts are currently UNKNOWN because the only local react_on_rails checkout found during this batch was stale and not on current remote main. The source-pack side was verified current at agent-workflows@a2123e6; Issue #23 was refreshed live and no implementation PR was created from this lane.

Recommended follow-up order:

1. issue23-refresh-drift-evidence/no-pr: use a fresh read-only RoR main checkout and produce a sanitized per-file drift matrix plus canonical-side recommendations.
2. pr22-closeout: finish PR Add downstream seam sync command and registry #22 before adding durable downstream drift tooling that may overlap docs, validation, registry, or preset surfaces.
3. issue23-security-helper-reconcile: reconcile pr-security-preflight and its test after fresh evidence; direction remains UNKNOWN until lane 1.
4. issue23-workflow-reconcile: reconcile workflows/pr-processing.md and skills/pr-batch/SKILL.md, keeping shared text generic.
5. issue23-secondary-skill-sweep: reconcile secondary shared skills/workflows; keep RoR-only domain skills local to RoR.
6. issue23-drift-detector-pack: add a generic source-pack drift detector with tests.
7. issue23-ror-wire-drift-check: wire the detector into RoR with a pinned source revision and allowlist.

React on Rails PR permission is required for any consumer-side re-vendor, RoR helper edits, or RoR CI/check wiring. It is not required for this no-PR audit, PR #22 closeout, or source-pack-only detector work. Current RoR drift facts remain UNKNOWN until the fresh checkout lane runs.

Validation evidence from this lane: pr-security-preflight --repo shakacode/agent-workflows 23 passed; git fetch --prune origin main passed; no files changed. A plain bin/validate run on current source-pack main hit an existing macOS Bash 3.2 issue in bin/upgrade-agent-workflows; the lane did not edit that out-of-scope area.