Driftglass / Test policy changes
When replay passes but authority widens
Recorded actions tell only part of the story. Driftglass also compares what two policies would allow within its supported rule grammar.
Synthetic demonstration · Reproduced 16 October 2026 · Development project
01 / The input
The baseline allows files.write only for repo/*. The candidate removes that resource constraint. The sole recorded write targets repo/readme, so it remains allowed under both policies.
02 / The result
| Synthetic event | Baseline decision | Candidate decision |
|---|---|---|
| Recorded write: repo/readme | ALLOW | ALLOW |
| Unrecorded write: outside/payroll | DENY | ALLOW |
Historical regressions: 0. Newly allowed representative cells: 16. Combined gate: BLOCK. The outside/payroll event is a concrete witness of wider authority; representative cells are policy partitions, not counts of real actions.
Inspect full inputs and outputs (JSON) →03 / What this means for a review
A green replay result cannot establish that a policy grants no additional authority. Pair historical checks with a policy comparison, then review the newly allowed cases before deployment.
What this establishes — and its limits
Exact comparison applies only to the supported policy grammar and a completed analysis. Supplied events and mappings are trusted; omitted or altered actions cannot be detected from the trace alone. This is policy evaluation, not live interception. Production-export compatibility remains unverified.
This is an independently developed engineering example, not a client engagement or production validation.
Source and reproduction
Output generated from Driftglass revision e6858ef using the reproduction script. Read the source contract and limitations.
Reproduce the three examples locally
With the site and three project repositories checked out beneath C:/dev/playground, pin each project to the revisions below. Use clean checkouts and Node 24.19 or newer.
cd C:/dev/playground
git -C coldgate checkout --detach 87844dd8bbfeefae60202d175f18eefc51eecb0f
git -C driftglass checkout --detach e6858ef591b0012d3334d8943ef853eb4a6b04d4
git -C signalforge checkout --detach bfe0a9f93d7049ac9554061a58c119ae5ba517da
cd frostedlogic-site
node scripts/reproduce-work.mjs ../coldgate ../driftglass ../signalforgeApply the method
Discuss policy testing and implementation
Bring a specific workflow and the decision you need to make. We can scope the review, evidence needed, and practical next steps.