KEVLAR-CONFIG-DRIFT ● ERROR PRECISION: VERY-HIGH integrity reproducibility supply-chain lockfile-sync

Manifest & Lockfile Configuration Drift

Detected an integrity mismatch between the declared manifest specifications and the resolved lockfile tree. Deterministic build guarantees are compromised, risking phantom deployments and unverified runtime behavior.

Overview Risk & Impact How Kevlar Detects It Remediation Guide Suppression & Policy

Overview

Modern build ecosystems separate dependency management into two distinct layers:

The Manifest (package.json, pyproject.toml, .csproj, composer.json, go.mod): Defines developer intent and loose SemVer constraints.
The Lockfile (package-lock.json, poetry.lock, packages.lock.json, composer.lock, go.sum): Freezes the exact immutable resolution graph with cryptographic checksums.

The KEVLAR-CONFIG-DRIFT rule triggers when a direct dependency in the manifest is missing from the lockfile, points to an incompatible version, or has drifted due to manual editing, git merge conflicts, or incomplete package manager invocations.

Declared in Manifest (Intent)


            "dependencies": {

              "lodash": "^4.17.21"

            }

Resolved in Lockfile (Stale Drift)


            "node_modules/lodash": {

              "version": "4.17.15" // Vulnerable!

            }

Critical Build Integrity Violation When drift is present, the code audited by Kevlar or executed locally does NOT match the code compiled in CI/CD pipelines or deployed in production containers. This violates SOC 2 CC6.6 and SLSA Build Level 2 requirements.

Risk & Impact Analysis

Allowing manifest and lockfile drift breaks foundational assumptions in software engineering and security operations:

● "Works on My Machine" Syndrome

Developers pulling code experience unpredictable compilation failures, mismatched dependency versions, and untraceable bugs that can't be reproduced on other machines.

● Silent Vulnerability Downgrades

A developer updates package.json to patch a high-severity CVE, but forgets to regenerate the lockfile. Production continues to build the vulnerable legacy package.

● Pipeline & Deployment Aborts

Hardened CI/CD systems executing deterministic install commands (such as npm ci, poetry install --frozen) fail abruptly, blocking hotfix releases.

● Supply Chain Substitution

Without synchronized lockfile hash verification, environments that fall back to dynamic resolution are vulnerable to package squatting and dependency confusion attacks.

How Kevlar Detects It

Kevlar CheckDeps executes a hermetic topological check across project configuration files:

1
Manifest Declaration Extraction: Parses all direct, dev, and peer dependency requirements and SemVer ranges specified in root manifests.
2
Lockfile Tree Cross-Validation: Verifies that every declared requirement has an exact matching node in the lockfile satisfying the requested version constraint.
3
Integrity & Missing File Check: Asserts that the lockfile exists on disk and is under version control. If drift or constraint violations are detected, Kevlar raises an error level SARIF finding with dual physical locations.

Example SARIF v2.1.0 result emitted by Kevlar:

sarif-report.json (v2.1.0)

{
  "ruleId": "KEVLAR-CONFIG-DRIFT",
  "level": "error",
  "message": {
    "text": "Config drift detected: 'package.json' requires 'lodash@^4.17.21' but 'package-lock.json' resolved '4.17.15'. Deterministic build compromised."
  },
  "locations": [
    {
      "physicalLocation": {
        "artifactLocation": { "uri": "package.json" },
        "region": { "startLine": 16, "endLine": 16 }
      }
    }
  ],
  "relatedLocations": [
    {
      "id": 1,
      "physicalLocation": {
        "artifactLocation": { "uri": "package-lock.json" },
        "region": { "startLine": 342, "endLine": 345 }
      },
      "message": { "text": "Mismatched resolved lockfile node" }
    }
  ],
  "properties": {
    "package": "lodash",
    "manifestConstraint": "^4.17.21",
    "lockfileResolved": "4.17.15",
    "precision": "very-high"
  }
}

Remediation Guide by Ecosystem

Resolve configuration drift by synchronizing your lockfile with manifest intent, then enforce strict frozen checks in your CI/CD pipeline.

1. Re-synchronize package-lock.json without redownloading all node_modules:

bash

npm install --package-lock-only

2. In CI/CD pipelines, always use npm ci to strictly enforce zero drift:

bash

# Fails immediately if package.json and package-lock.json diverge
npm ci

3. For Yarn and pnpm users:

bash

# Yarn Berry (v2 - v4)
yarn install --immutable

# pnpm
pnpm install --frozen-lockfile

1. Re-lock poetry.lock to reflect pyproject.toml without upgrading other packages:

bash

poetry lock --no-update

2. In CI/CD pipelines, enforce frozen lockfile consistency:

bash

poetry check
poetry install --sync

3. When using pip-tools with requirements.txt:

bash

pip-compile --generate-hashes pyproject.toml -o requirements.txt

1. Ensure lockfile generation is enabled in your .csproj or Directory.Build.props:

xml

<PropertyGroup>
  <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
</PropertyGroup>

2. Force re-evaluation and update packages.lock.json:

bash

dotnet restore --force-evaluate

3. Enforce locked-mode verification in CI workflows:

bash

dotnet restore --locked-mode

1. Re-generate composer.lock to match composer.json without bumping version numbers:

bash

composer update --lock

2. Validate configuration synchronization in CI pipelines:

bash

composer validate --strict
composer install --prefer-dist --no-progress

1. Re-synchronize go.mod and go.sum with imported code packages:

bash

go mod tidy

2. Verify module integrity and ensure read-only build behavior in CI:

bash

go mod verify
go build -mod=readonly ./...

Suppression & Policy Configuration

Configuration drift represents an acute build integrity flaw and should rarely be suppressed. However, during complex monorepo migrations or emergency hotfixes where a lockfile regeneration is queued in a parallel branch, you can establish a short-lived waiver in kevlar-suppressions.json:

Mandatory Architecture Review Suppressions for KEVLAR-CONFIG-DRIFT should always specify an immediate expiration (maximum 72 hours) and include direct references to the tracking Pull Request that repairs the synchronization.

kevlar-suppressions.json

{
  "version": "1.0",
  "suppressions": [
    {
      "ruleId": "KEVLAR-CONFIG-DRIFT",
      "package": "lodash",
      "reason": "Emergency hotfix deployment. Lockfile regeneration queued in PR #814.",
      "approvedBy": "[email protected]",
      "expiresAt": "2026-10-02T12:00:00Z",
      "ticketUrl": "https://github.com/company/repo/pull/814"
    }
  ]
}