Three-axis drift: catching code↔schema, env, and dependency mismatches before they ship

The bug isn't in the code you're reading — it's in the gap between the code and the schema, the env, or the manifest. SecondOS surfaces all three, read-only.

Some of the nastiest bugs aren't in a file — they're in the gap between two things that were supposed to agree. The code writes a column the schema doesn't have. The code reads an env var nobody documented. You import a package that isn't in package.json. Everything looks fine in review, and breaks in production.

SecondOS surfaces three of these gaps, read-only, with both locations:

1. Code vs DB schema

It reads your Drizzle schema into a model and checks the columns your code actually writes against it. Write lastSeenAt in routes/ping.ts when the users table has no such column, and schema_drift flags it — with the code location and the schema location. Dynamic/spread writes are skipped and counted, so it never cries wolf.

2. Env vars vs .env.example

The process.env values your code reads, checked against what .env.example documents: the ones you read but never declared (a deploy waiting to fail), and the ones declared but never used.

3. Imports vs package.json

The packages you import, checked against your manifest: an import with no dependency entry, and declared-but-unused packages.

Read-only, and honest

Drift is an alert, not an auto-fix — it never changes your code. And it reports only what it can prove; ambiguous cases are counted, not guessed. Run it from the CLI (secondos drift) or read it over MCP (schema_drift, cross_repo_drift) so your AI tool catches the mismatch too.

The map that powers this is the same one every AI tool reads. See the product.