# Codex Docs Drift Scout

> Install the AutoHub docs-drift Codex automation from signed AutoVault skill resources and audit its render fidelity with autovault doctor.

- **Type:** Skill
- **Install:** `agentstack add skill-autoworks-ai-autovault-codex-docs-drift-scout`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [autoworks-ai](https://agentstack.voostack.com/s/autoworks-ai)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [autoworks-ai](https://github.com/autoworks-ai)
- **Source:** https://github.com/autoworks-ai/autovault/tree/main/skills/codex-docs-drift-scout
- **Website:** https://autovault.dev

## Install

```sh
agentstack add skill-autoworks-ai-autovault-codex-docs-drift-scout
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Codex Docs Drift Scout

## When To Use

Use this skill to install the AutoHub docs-drift Codex automation. The automation
lives as signed AutoVault skill resources (`.tpl` templates), but Codex reads
machine-local **rendered** files through a symlink.

Install is a deliberate, human-initiated mutation (it renders machine-specific
files and plants a symlink under `~/.codex`), so it sits behind the
`requires-tty` anti-automation wall. Auditing is read-only and runs
non-interactively through `autovault doctor` — see [Audit](#audit).

## Install

`--project-root` is required and has no shipped default. Pass the absolute path
to the target repository:

```bash
autovault skill install-codex codex-docs-drift-scout --project-root /ABSOLUTE/PATH/TO/autohub
```

The complete install surface is:

```text
autovault skill install-codex codex-docs-drift-scout --project-root PATH [--automation-id ID] [--replace-existing]
```

By default, the helper renders beneath `${AUTOVAULT_STORAGE_PATH:-~/.autovault}`:

```text
~/.autovault/rendered/codex-automations/docs-drift-scout/automation.toml
~/.autovault/rendered/codex-automations/docs-drift-scout/environment.toml
```

and exposes the rendered directory beneath `${CODEX_HOME:-~/.codex}` as:

```text
~/.codex/automations/docs-drift-scout
```

The helper refuses to replace an existing Codex automation path unless the
render index proves the symlink is already managed by AutoVault or
`--replace-existing` is passed. Replacement moves the existing path aside with a
timestamped `.backup.` suffix.

Before writing, the helper refuses a corrupt or unsupported existing render
index. It renders to temporary files, parses the TOML with `python3` +
`tomllib`, then atomically publishes the index and Codex symlink. The
machine-local index is `${AUTOVAULT_STORAGE_PATH:-~/.autovault}/render-index.json`
— the per-bundle record `autovault doctor` hash-compares against. Python 3.11 or
newer is required for the standard-library `tomllib` parser.

### Substitution variables

The signed templates carry no machine-specific paths. The helper substitutes
these placeholders at render time, so no personal absolute path is ever baked
into the signed bytes:

- `{{PROJECT_ROOT_TOML}}` — the TOML-escaped `--project-root` you pass.
- `{{ENVIRONMENT_PATH_TOML}}` — the TOML-escaped rendered environment path.
- `{{AUTOMATION_ID}}` — the Codex automation id (default `docs-drift-scout`).
- `{{RENDERED_AT_MS}}` — the current install time in Unix milliseconds.

## Audit

Render fidelity is a first-class, non-interactive `autovault doctor` check — not
a separate bin action. It re-verifies the signed templates and hash-compares the
rendered files and `~/.codex` symlink against the render index. It never
re-renders.

```bash
autovault doctor codex-docs-drift-scout --json
```

`doctor` reports each skill's render fidelity as a first-class field. For this
bundle, assert:

```text
.skills[] | select(.name == "codex-docs-drift-scout") | .render.kind == "ok"
```

`doctor` exits non-zero when any error is present, but a cron/Codex preflight
that wants "my automation is actually installed AND verified" **must positively
assert `render.kind == "ok"`** — not exit code and not the skill's overall
`status`. A never-rendered install reports `render.kind == "skipped"`, which
leaves both `status` and the exit code clean.

The check verifies, per recorded bundle:

- the signed templates are authentic and unchanged since render (catches a
  template edited without reinstalling);
- the rendered `automation.toml` / `environment.toml` exist and match the
  recorded hashes (catches hand-edits and deletions);
- the `~/.codex` automation path is a symlink pointing at the render root
  (catches a missing, replaced, or repointed symlink).

A full `autovault doctor` run additionally sweeps the active
`${CODEX_HOME:-~/.codex}/automations` root for **orphan** symlinks that point
into the AutoVault render tree but have no backing index entry — including when
the index itself was deleted.

## Boundary

Do not edit the rendered TOML by hand. Make template changes inside this signed
skill package, reinstall the skill, then run `install-codex` again.

Do not copy these rendered files into `~/.codex`. Codex should only see the
symlinked rendered directory so machine-specific substitutions stay outside the
signed package bytes.

The automation has PR-only authority: it may create and update documentation
branches and PRs for AutoHub, run checks, and address review comments. It must
not merge PRs, and must never read, print, or write secrets.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [autoworks-ai](https://github.com/autoworks-ai)
- **Source:** [autoworks-ai/autovault](https://github.com/autoworks-ai/autovault)
- **License:** MIT
- **Homepage:** https://autovault.dev

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-autoworks-ai-autovault-codex-docs-drift-scout
- Seller: https://agentstack.voostack.com/s/autoworks-ai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.