feat(guardrails): anti-pattern K — SSOT sync drift (migration changed without mirroring the SSOT / version pins) #288

Summary

New guardrail pattern beyond the existing A–J set: SSOT sync drift. An implementation changes one authoritative artifact (migration, contract, version pin) but forgets the mirror(s) that must end in the same final state. The existing CI contract check correctly fails — but only at PR time, after the implementation already shipped the half-change.

Trigger incident (2026-08-03, Grift PR anomalyco#1761)

Issue anomalyco#1719 asked to drop the now-unused index idx_conversation_turns_case (L-1). The implementer:

• ✅ Added migration 000060_drop_idx_conversation_turns_case.up.sql (DROP INDEX)
• ❌ Left packages/contracts/initial-schema.sql (SSOT) still CREATE-ing the same index
• ❌ Left the Alpha expected post-migration version pins at 59 across 4 files (grift-deployment-policies.json, alpha_migration_preflight.go, check-v2-alpha-deployment-contract.mjs, v2-alpha-cd.yml)

Result: contract-validation (migrate-built DB vs initial-schema-built DB) failed correctly. The pipeline worked as designed; the implementation was half-synced.

Why this is NOT covered by A–J

The pattern (generalized)

When a change makes two or more artifacts that must agree on the SAME final state (schema DDL vs migrations, OpenAPI vs generated code, version pins in workflow/policy/preflight), the implementer updates one side and leaves the other(s) stale.

Common shapes:

• DB schema: migration DDL vs initial-schema.sql SSOT
• API contract: openapi.yaml vs generated clients / server stubs
• Version pins: a version appears in N files (workflow, policy JSON, Go preflight, JS contract check); bumping it in one place is missed in others
• Replicated constants: the same value hardcoded in two languages

Proposed mechanism (mechanism over prose)

1. CI wiring stays the source of truth — it already works. Add a local pre-push hook / command (/ssot-check or extend /plan-light) that runs the same "migrate-built vs SSOT-built" comparison the CI gate runs, so the drift fails locally instead of at PR time.
2. Plugin hook (K): detect when a tool call modifies files under a "mirror set" (e.g., services/*/migrations/* OR packages/contracts/initial-schema.sql) and prompt: "this change touches a mirrored artifact — run the SSOT comparison now". Pure guidance, no block (avoid over-restriction, pattern I).
3. Version-pin wiring test: a test that enumerates every file declaring the expected migration version (workflow, policy, preflight, contract check) and asserts they are equal — this is the F-style CI wiring test applied to K.
4. Skill: ssot-sync skill (parallel to impact-analysis) — before changing a mirrored artifact, grep the mirror set, update all, and run the comparison.

Acceptance evidence (per pattern I, prove no over-restriction)

• Negative: a migration change that ALSO updates the SSOT in the same commit passes with no warning.
• Positive: a migration-only change triggers the prompt and fails the local comparison.
• Falsification: disabling the guard allows the half-change through (existing CI still catches it, which is the safety net).

Scope

Fork-side packages/guardrails/profile/ plugin/command/skill + test. No upstream opencode changes required.

Refs

• Incident: Cor-Incorporated/Grift#1761, Opencode not loading, OTel bug? anomalyco/opencode#1719
• Related existing patterns: feat(guardrails): implement 8 anti-pattern guards in profile (plugin/command/permission/skill) #284 (A–J set), epic epic: internal AI guardrails thin distribution for Cor-Incorporated #1