feat: behavioral drift detection (agent-strace drift)

[Siddhant-K-code]

What

Adds agent-strace drift — a command that detects when agent behavior has shifted across sessions, without requiring an LLM.

Closes #70

How it works

Computes a behavioral fingerprint for a window of sessions: a compact JSON summary of six behavioral dimensions. Then measures how much the current window's fingerprint has diverged from a baseline using Jensen-Shannon divergence.

Six dimensions tracked:

Dimension	What it measures
tool_mix	Fraction of calls per tool type (Bash, Read, Write, etc.)
error_rate	Errors per session (mean, p50, p95)
retry_rate	Consecutive same-tool calls per session
blast_radius	Distinct files written per session
session_duration_s	Wall-clock time per session
decision_depth	log_decision() events per session

Overall drift score: weighted average of per-dimension JSD, normalized to [0, 1]. tool_mix is weighted 2x (most sensitive signal).

Usage

# Detect drift over the last 30 days (splits window in half automatically)
agent-strace drift --since 30d

# Compare against a saved baseline
agent-strace drift --baseline .agent-traces/baselines/behavior-main.json

# Save current fingerprint as baseline
agent-strace drift --since 30d --save-baseline .agent-traces/baselines/behavior-main.json

# JSON output for CI
agent-strace drift --since 30d --format json

Exits non-zero when drift score exceeds --threshold (default: 0.20).

Files changed

• src/agent_trace/drift.py — new module: BehavioralFingerprint, DriftReport, compute_fingerprint(), compute_drift(), print_report(), cmd_drift()
• src/agent_trace/cli.py — drift subcommand wired in
• tests/test_drift.py — 27 tests covering statistical helpers, fingerprint computation, drift scoring, serialization, and end-to-end store integration

Test results

Ran 593 tests in 3.4s — OK (27 new)