feat(drift): add identity to nightly drift matrix

[ensarkovankaya]

Context

paper-board/identity onboarded via service-template@v0.1.2 (agent-manager Task 34). Add it to the drift CI matrix so future template changes catch divergence.

Changes

• .github/workflows/template-drift.yml: enable identity matrix entry (was commented future placeholder)
• template-drift-allowlist.md: per-service overrides table — identity has none

Matrix entry

- service: identity
  advisory_lock_id: 1
  port: 8081
  enable_e2e: false

Verification

Identity commit c4d8f24 mirrors service-template@v0.1.2 (d289559) byte-for-byte for Tier 1 paths. First drift run after merge should report zero drift for identity. Will trigger workflow_dispatch from main post-merge to confirm.

Related

• agents-1.5 plan: tasks/2026-05-02-adr-0010-gap-analysis.md Task 34
• Prior PRs: feat(template-drift): nightly diff vs service-template (Task 33) #8 (drift CI bootstrap, Task 33)

[greptile-apps]

Greptile Summary

• Activates the pre-approved identity service entry in the nightly drift CI matrix (advisory_lock_id: 1, port: 8081, enable_e2e: false), which was previously a commented-out placeholder; no conflicts with existing agents entry or future reserved entries.
• Updates template-drift-allowlist.md to document that identity carries no post-render overrides, consistent with the enable_e2e: false flag that skips the sed override step in the workflow.

Confidence Score: 5/5

Safe to merge — straightforward uncomment of a pre-approved placeholder with no logic changes.

The diff is minimal: four YAML lines uncommented and one markdown table row added. The advisory_lock_id: 1 and port: 8081 values do not conflict with any active or future-reserved matrix entry. The enable_e2e: false flag correctly bypasses the post-render sed override, matching the allowlist documentation. No new shell code paths, no new secrets, and existing injection-prevention patterns are fully inherited.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/template-drift.yml	Uncomments the pre-approved identity matrix entry (advisory_lock_id: 1, port: 8081, enable_e2e: false); no conflicts with the existing agents entry (id: 3, port: 8080) or the still-commented future entries (billing: 2, platform: 4).
template-drift-allowlist.md	Adds the identity row to the per-service overrides table, correctly documenting no post-render overrides, consistent with enable_e2e: false skipping the sed step in the workflow.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions (nightly)
    participant ST as paper-board/service-template
    participant ID as paper-board/identity
    participant Issues as paper-board/.github Issues

    GH->>ST: checkout (DRIFT_PAT)
    GH->>GH: "render template (SVC=identity, ADVISORY_LOCK_ID=1, PORT=8081)"
    Note over GH: enable_e2e=false → no sed override applied
    GH->>ID: checkout (DRIFT_PAT)
    GH->>GH: compare-template.sh --template rendered --service identity
    alt drift detected
        GH->>Issues: create or append drift issue
    else no drift
        GH->>GH: job passes silently
    end

Loading

_{Reviews (1): Last reviewed commit: "feat(drift): add identity to nightly dri..." | Re-trigger Greptile}