{"wiki":null,"facts":{"id":"th-osid-01","name":"OS Identity Drift Sweep","machine_name":"th-osid-01","owner":"agt_028","function":"Independently reads caroladmin+per-agent crontabs (root reader helper), running processes and carol-* unit users; compares against registry droid ownership; red on any agent process outside its owner login","process_type":"scheduled","schedule":"Daily 05:25","process_name":"tools/os_identity_drift_sweep.py","avatar_color":"#94a3b8","created_for":"","purpose":"Enforce cookbook 1281 / CAROL-INI-3789: every agent process runs under its own OS identity; caroladmin is Orion alone","duties":"Detect drift on 4 surfaces (operator crontab, agent crontabs, processes, services); store findings in data/os_identity_drift.db; file one initiative per red run via normal intake; record unauditable surfaces as unauditable, never clean","constraints":"Read-only; needs sudo pin on carol-crontab-read; never repairs drift itself (Themis reports, the operator/Radagast cure)","status":"running","gender":"","archetype":"","building_block":null,"service_override":null,"enabled":1,"task_key":null,"model_free":0},"page":{"type":"droid","page_class":"main","class_label":"Main page","kind_label":"Droid","kind_gloss":"","listed":true}}