Boot Context Integrity

The problem

An agent's always-loaded files are its identity: memory, operating rules, routing. They are also silently mutable. A bad write, a truncated save, or an unauthorized edit changes what your agent believes at every boot, and nothing alerts you. The drift compounds until behavior visibly breaks, and by then the clean baseline is gone.

What it does

• Keeps a SHA-256 plus character-count baseline of every watched file in a JSON state file, seeded automatically on first run.
• A heartbeat check compares live files against the baseline and reports OK, ALERT on unauthorized drift, or WARN_AUTHORIZED when a change matches a journal authorization marker.
• Drift alerts name the file, the size delta, and both hashes, delivered to your Telegram chat.
• Re-seeding the baseline is human-gated: a Telegram card with a single-use tap token, expiring in 30 minutes, consumed on use. No approval, no new baseline.
• An authorized-change path: journal entries with recognized markers let deliberate edits re-baseline with a warning instead of an alarm.
• A deploy-parity test catches the divergence class where the checker you deploy is not the checker you tested.

Frameworks & tools

Python 3.11+ and a POSIX shell, standard library only. Zero external dependencies. Telegram Bot API via urllib and curl for cards and alerts. Wire the heartbeat snippet into any scheduler: cron, launchd, or your agent's own loop.

Why this beats prompting it yourself

This skill exists because of one specific production incident: a deployed integrity checker diverged from the tested version, and the divergence was invisible until it mattered. The full incident write-up ships in the package at references/deploy-parity-incident.md, and the deploy-parity acceptance test exists so that class of failure is caught structurally instead of discovered in production. The re-seed path is deliberately hostile to convenience: baselines change only through a human tap on a single-use, expiring token, because an integrity system that can be silently re-baselined is not an integrity system.

The suite ships six acceptance tests, six passing: first-run seed, no-change, unauthorized drift, authorized drift, the full tap-token re-seed round-trip in a clean temp workspace, and shell deploy parity.

Use cases

• Guarding an agent's memory and operating-rules files against unauthorized edits between boots.
• Catching silent corruption or truncation of always-loaded context before it changes agent behavior.
• Requiring human sign-off before any baseline change is accepted as the new normal.
• Verifying that the integrity checker running in production is byte-identical to the one you tested.

Known limitations

The heartbeat is a snippet you wire into your own scheduler; no daemon is included. Alerts and re-seed cards are Telegram specific by design, with documented swap points. The typed-fallback router referenced on cards ships in the approval-gated-writes skill; without it, wire your own or use validate_token directly. Watched files are configured in one dict and default to an OpenClaw workspace layout, overridable via WORKSPACE_ROOT.

About the builder

Built by Tradeplier: a licensed Massachusetts builder running a $1M/yr construction company on an agent back office, in production since April 2026. We file the bugs we find upstream: six issues on openclaw/openclaw to date, four rated diamond lobster by the project. If this skill breaks in your fleet, the incident becomes a test and you get the fix. The full audit story behind all three, including the part where the audit caught these packages themselves, is at https://www.tradeplier.com/audit-story/