[BUG] apm audit --ci misses local-path sub-package MCP declaration REMOVAL (exits 0); change-drift exits 1

[danielmeppiel]

Describe the bug

apm audit --ci config-consistency detects when a locally-installed local-path sub-package changes its MCP server config, but does not detect when that sub-package removes its entire dependencies.mcp declaration after install. When the recorded mcp_configs lockfile baseline has a server that the current source no longer declares, audit still reports "All checks passed" and exits 0. The drift-detection guarantee is one-directional: it compares current-source entries against the lock baseline but ignores lock-only (removed) entries.

This is the removal sibling of #2127 (change-drift). The pending fix for #2127 (#2132) was empirically verified to fix the change sub-case but still miss removal: overlaying #2132's ci_checks.py on a working build leaves the post-removal audit at exit 0.

To Reproduce

Baseline SHA: 26d8cee8a4079bb3d31956f1b57d343654835fc8 (origin/main).

1. Consumer apm.yml declares a local dependency ./packages/agent-config.
2. ./packages/agent-config/apm.yml declares one MCP server (dependencies.mcp with name/command/args).
3. apm install --force --trust-transitive-mcp --target copilot --no-policy -> exit 0; server recorded in apm.lock.yaml mcp_configs.
4. apm audit --ci --no-policy --no-fail-fast (baseline, source unchanged) -> exit 0 (correct).
5. Edit ./packages/agent-config/apm.yml to delete the entire dependencies.mcp block.
6. apm audit --ci --no-policy --no-fail-fast -> exit 0, "All checks passed" (BUG; should be exit 1 with a source-vs-lock drift diagnostic).

Expected behavior

Audit must compare the complete current MCP declaration graph against the stored lock baseline symmetrically: changed, added, AND removed declarations must all affect the consistency verdict. A removed source declaration that still exists in the lock baseline is drift and must exit 1.

Environment

• OS: macOS
• APM Version: 0.24.1 (26d8cee8a)

Root-cause (architecture)

src/apm_cli/policy/ci_checks.py::_check_config_consistency derives current_configs only from present manifest declarations and diffs one-directionally, so lock-only (removed) servers are never compared. Recommended fix (architecture cluster r2-symmetric-source-lock-consistency): introduce a side-effect-free current-MCP-config view resolver plus one symmetric source-vs-lock diff (changed / source-only / lock-only) consumed by _check_config_consistency and install/update reconciliation. Keep mcp_config_provenance for ownership classification, not as a blanket removal exemption. Vendor-neutral, no primitive-schema change, no harness translation layer.

Additional context

Filed from an authorized first-party reliability/regression validation sweep (red-team Round 2). Independently reproduced twice by a separate confirmer (finder != confirmer), with control (unchanged source exits 0) and cleanup verification. Distinct from #2127/#2132 (change vs removal).

[github-actions]

Triage Panel Verdict

Thank you for filing this, @danielmeppiel -- this is a well-reproduced, clearly scoped bug report.

Decision: ACCEPT

Summary: apm audit --ci performs a one-directional source-vs-lock diff for MCP config consistency. It catches changes and additions (partially addressed by #2132) but silently ignores lock-only (removed) entries -- causing a false-clean exit 0 when a local-path sub-package removes its dependencies.mcp block entirely.

Panel findings:

• Supply Chain Security: This is an audit integrity gap. The audit command's security guarantee is that it detects drift between installed state and current source. A removed MCP server declaration that remains in the lock is drift -- and a false-clean audit is worse than no audit at all. The one-directional diff must be made symmetric.
• DevX UX Expert: "All checks passed" with exit 0 when drift exists breaks the CI gate contract. Users running apm audit --ci in automated pipelines will not catch removal drift, defeating the purpose of the command.
• APM CEO: Clear, bounded fix. Root cause is in _check_config_consistency in ci_checks.py. Architecture cluster r2-symmetric-source-lock-consistency already named in the issue. Should be paired with or follow fix(audit): detect local-path sub-package MCP source drift (closes #2127) #2132 to close the full audit integrity gap. High priority.

Label decisions:

• Confirm existing: area/lockfile, area/audit-policy, type/bug (authoritative, not changed)
• Add: theme/security -- MCP audit integrity is a security surface
• Add: priority/high -- false-clean CI audit exit is a reliability and security gap

Suggested next action: Implement a symmetric source-vs-lock diff in _check_config_consistency: after comparing current-source entries against lock baseline, add a second pass comparing lock-only entries (present in lock but absent from current source) and flag those as removal drift (exit 1). Coordinate with #2132 to avoid merge conflicts.

---

Triage status: agentic proposal pending human ratification.
Silence is approval. Maintainers can:

• Override any label or milestone above by editing it directly --
  human edits are authoritative and will not be reverted on
  subsequent runs.
• Re-trigger triage by applying the status/needs-triage label, or
  by removing status/triaged to enroll the issue in the next
  daily sweep.

Posted by the Triage Panel workflow. See .apm/skills/apm-triage-panel for the panel skill.

Generated by Triage Panel for issue #2136 · 28.5 AIC · ⌖ 6.77 AIC · ⊞ 9.2K · ◷