diff --git a/SPEC.md b/SPEC.md
index 2fe0ec5..ca69686 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -1212,8 +1212,27 @@ e2e had passed and the result was discarded and re-queued for nothing. The same
 `existing` was always empty and every run created a brand-new PR instead of updating one. A force-push
 alone is sufficient and non-destructive: an open PR follows its head ref and picks up the new commit.
 
+**DEC-080 — Caller-template drift is detected, because nothing else can see it.**
+`make link-workflows` *copies* the caller templates into a consumer's `.github/workflows/`, and
+`devkit-sync` deliberately never writes that directory (its `GITHUB_TOKEN` may not push workflow
+files). So the vendored devkit advances while the copied caller stands still, and **nothing at
+runtime notices** — both known instances were silent by construction: share-chat could not reach the
+`capture_all_traces` input for weeks because its caller predated it, and `actions: write` (DEC-074)
+had to be hand-propagated to four repos in four PRs, with the prune degrading to a *warning* in the
+meantime rather than failing.
+`e2e/ci/check-caller-drift.sh` compares the **executable contract** — triggers, dispatch inputs,
+permissions, job ids, `uses` refs, `with` inputs, and the secrets shape — and ignores comments,
+whitespace, quoting, key order and prose descriptions. That line is deliberate: a byte-diff would
+have fired on all four consumers the moment the devkit rewrote a header comment, and a checker that
+cries wolf gets `|| true`'d. Templates resolve to the consumer's own pinned `tests/_testkit` when
+available, so each repo is judged against the devkit ref *it* pinned rather than whatever `main`
+happens to be.
+The self-test is not decoration. It replays both real incidents as positive controls and pins the
+cosmetic tolerances as negative controls, so the tempting "fix" for a noisy checker — loosening it
+until it stops complaining — fails the suite instead of passing quietly.
+
 > **Numbering note:** DEC-070–072 were originally introduced as code comments only. They are now
-> written up above, so this section documents an unbroken 070–079. The lesson is worth keeping: a
+> written up above, so this section documents an unbroken 070–080. The lesson is worth keeping: a
 > decision that exists only as a code comment is invisible to anyone reading the SPEC, and all three
 > of these were load-bearing (a gate's timeout budget, the image the whole fleet pulls, and a wait
 > that was flaking half the runs).
diff --git a/e2e/ci/check-caller-drift.sh b/e2e/ci/check-caller-drift.sh
new file mode 100755
index 0000000..ea801e8
--- /dev/null
+++ b/e2e/ci/check-caller-drift.sh
@@ -0,0 +1,216 @@
+#!/usr/bin/env bash
+#
+# Caller-workflow drift check — does a consumer's copied caller still match the
+# devkit template it was copied from?
+#
+# WHY THIS EXISTS
+#   `make link-workflows` COPIES templates/{plugin-e2e,devkit-sync}.caller.yml
+#   into a consumer's .github/workflows/. `devkit-sync` then keeps the SUBMODULE
+#   pin current but deliberately never writes .github/workflows/ (its
+#   GITHUB_TOKEN may not push workflow files). So the vendored devkit advances
+#   while the copied caller stands still, and nothing anywhere notices.
+#
+#   That is not hypothetical. Two live examples:
+#     * share-chat's caller predated the `capture_all_traces` dispatch input by
+#       weeks — the input existed in the reusable workflow, the repo just could
+#       not reach it, and no run ever failed to say so.
+#     * `actions: write` (count-based artifact retention, DEC-074) had to be
+#       hand-propagated to four repos in four separate PRs, because a reusable
+#       workflow's permissions are CAPPED BY THE CALLER's grant. The prune step
+#       degraded to a warning instead of failing — silent, again.
+#   Both failure modes are invisible at runtime. A checker is the only detector.
+#
+# WHAT COUNTS AS DRIFT (and why not a byte diff)
+#   Byte-for-byte would be trivially correct and useless: every comment reflow in
+#   the devkit — e.g. the DEC-079 rewrite of the devkit-sync header — would fire
+#   on all consumers at once, and a checker that cries wolf gets `|| true`'d
+#   within a week. So this compares the EXECUTABLE CONTRACT of the YAML:
+#
+#     compared    name, triggers (`on`), permissions, job ids, `uses` refs,
+#                 `with` inputs, `secrets` (inherit vs the explicit key set),
+#                 dispatch input names/types/defaults
+#     ignored     comments, whitespace, quoting, key order, scalar-list order
+#                 (`branches: [main, master]` is a set), and the human-prose
+#                 `description:` of a dispatch input
+#
+#   Rationale for that line: everything on the left changes what CI DOES, and
+#   both real incidents above are on the left. Everything on the right changes
+#   only how the file reads. Ignoring `description` is the one judgement call —
+#   it is UI prose in the Actions run dialog, and letting a wording fix fail four
+#   repos is exactly how the signal gets ignored.
+#
+#   Drift is reported in three flavours, all fatal, because they rot differently:
+#     missing  template has it, consumer does not  — the silent-rot case above
+#     changed  both have it, values differ         — a local edit or a stale value
+#     extra    consumer has it, template does not  — a local edit that the NEXT
+#              `make link-workflows` will silently delete
+#
+# USAGE
+#   check-caller-drift.sh [consumer-repo-root ...]     # default: .
+#
+#   In consumer CI (the vendored copy, no args) it checks the repo it runs in
+#   against its own pinned devkit templates — so the check advances exactly when
+#   the submodule does. Locally, pass repo roots to sweep the fleet:
+#     check-caller-drift.sh ~/src/.../agent-zero-plugin-*
+#
+# Env:
+#   TEMPLATES_DIR   devkit templates/ dir. Auto-detected when unset, in order:
+#                   <script>/../../templates (vendored: e2e/ci/ -> devkit root),
+#                   <script>/../templates, then each consumer's tests/_testkit.
+#   GITHUB_ACTIONS  when "true", drift is emitted as ::error:: annotations too.
+#
+# Exit: 0 no drift · 1 drift found · 2 usage/setup error.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# The two files this check owns. Consumer basename -> template basename.
+# Anything else in .github/workflows/ (a repo's own unit.yml, say) is not ours.
+CALLERS=(
+  "plugin-e2e.yml:plugin-e2e.caller.yml"
+  "devkit-sync.yml:devkit-sync.caller.yml"
+)
+
+consumers=("$@")
+[ ${#consumers[@]} -eq 0 ] && consumers=(".")
+
+# Resolve the templates dir once if it is fleet-wide; otherwise resolve per
+# consumer from its own vendored devkit, so each repo is judged against the
+# devkit ref IT pinned — not against whatever happens to be checked out here.
+resolve_templates() {
+  local consumer="$1"
+  if [ -n "${TEMPLATES_DIR:-}" ]; then echo "$TEMPLATES_DIR"; return; fi
+  local cand
+  for cand in \
+    "$SCRIPT_DIR/../../templates" \
+    "$SCRIPT_DIR/../templates" \
+    "$consumer/tests/_testkit/templates"
+  do
+    [ -d "$cand" ] && { (cd "$cand" && pwd); return; }
+  done
+  return 1
+}
+
+compare() {
+  # compare <template.yml> <consumer.yml> <label>
+  # Prints one line per drifting path; exits 1 via its own return code.
+  TPL="$1" CUR="$2" LABEL="$3" python3 - <<'PY'
+import os, re, sys
+import yaml
+
+tpl_path, cur_path, label = os.environ["TPL"], os.environ["CUR"], os.environ["LABEL"]
+
+# Prose-only paths. Everything NOT matched here is part of the contract.
+IGNORE = [
+    re.compile(r"^on\.workflow_dispatch\.inputs\.[^.]+\.description$"),
+]
+
+def load(path):
+    with open(path, encoding="utf-8") as fh:
+        doc = yaml.safe_load(fh) or {}
+    # YAML 1.1 resolves a bare `on:` key to the boolean True. Every workflow
+    # file hits this; normalise before anything else touches the tree.
+    if True in doc:
+        doc["on"] = doc.pop(True)
+    return doc
+
+def flatten(node, prefix=""):
+    """Dotted-path -> scalar. Scalar lists collapse to a sorted canonical string
+    because trigger lists (`branches`, `paths`) are sets, not sequences; lists
+    holding structure keep their index, where order can matter."""
+    out = {}
+    if isinstance(node, dict):
+        for k, v in node.items():
+            out.update(flatten(v, f"{prefix}.{k}" if prefix else str(k)))
+    elif isinstance(node, list):
+        if all(not isinstance(i, (dict, list)) for i in node):
+            out[prefix] = "[" + ", ".join(sorted(str(i) for i in node)) + "]"
+        else:
+            for i, v in enumerate(node):
+                out.update(flatten(v, f"{prefix}[{i}]"))
+    else:
+        out[prefix] = node
+    return out
+
+def contract(path):
+    return {k: v for k, v in flatten(load(path)).items()
+            if not any(rx.match(k) for rx in IGNORE)}
+
+tpl, cur = contract(tpl_path), contract(cur_path)
+
+rows = []
+for key in sorted(set(tpl) | set(cur)):
+    if key not in cur:
+        rows.append(("missing", key, tpl[key], None))
+    elif key not in tpl:
+        rows.append(("extra", key, None, cur[key]))
+    elif tpl[key] != cur[key]:
+        rows.append(("changed", key, tpl[key], cur[key]))
+
+if not rows:
+    sys.exit(0)
+
+print(f"  {label}: {len(rows)} drifted path(s)")
+for kind, key, want, got in rows:
+    if kind == "missing":
+        print(f"    - [missing] {key}\n        template: {want!r}\n        consumer: <absent>")
+    elif kind == "extra":
+        print(f"    - [extra]   {key}\n        template: <absent>\n        consumer: {got!r}")
+    else:
+        print(f"    - [changed] {key}\n        template: {want!r}\n        consumer: {got!r}")
+sys.exit(1)
+PY
+}
+
+drifted=0
+checked=0
+
+for consumer in "${consumers[@]}"; do
+  [ -d "$consumer" ] || { echo "::error::not a directory: $consumer" >&2; exit 2; }
+  name="$(basename "$(cd "$consumer" && pwd)")"
+
+  # A repo with no caller at all is not this check's business — it never adopted
+  # the devkit. Skipping beats failing every unrelated repo in a fleet sweep.
+  have_any=0
+  for pair in "${CALLERS[@]}"; do
+    [ -f "$consumer/.github/workflows/${pair%%:*}" ] && have_any=1
+  done
+  [ "$have_any" -eq 1 ] || { echo "== $name: no devkit caller workflows — skipped"; continue; }
+
+  templates="$(resolve_templates "$consumer")" || {
+    echo "::error::could not locate devkit templates/ for $name (set TEMPLATES_DIR)" >&2
+    exit 2
+  }
+
+  echo "== $name (templates: $templates)"
+  repo_drift=0
+  for pair in "${CALLERS[@]}"; do
+    caller="${pair%%:*}"; template="${pair##*:}"
+    cur="$consumer/.github/workflows/$caller"
+    tpl="$templates/$template"
+    [ -f "$tpl" ] || { echo "::error::missing template $tpl" >&2; exit 2; }
+    if [ ! -f "$cur" ]; then
+      # Half-adopted: one caller present, the other never copied or deleted.
+      echo "  $caller: NOT PRESENT (template exists) — run 'make link-workflows'"
+      repo_drift=1; continue
+    fi
+    checked=$((checked + 1))
+    compare "$tpl" "$cur" "$caller" || repo_drift=1
+  done
+
+  if [ "$repo_drift" -eq 1 ]; then
+    drifted=$((drifted + 1))
+    [ "${GITHUB_ACTIONS:-}" = "true" ] && \
+      echo "::error::$name: caller workflows drifted from the devkit templates — run 'make link-workflows'"
+  else
+    echo "  in sync"
+  fi
+done
+
+echo
+if [ "$drifted" -gt 0 ]; then
+  echo "DRIFT: $drifted repo(s) out of sync across $checked caller file(s)."
+  echo "Fix: run 'make link-workflows' in each, review the diff, and commit."
+  exit 1
+fi
+echo "OK: $checked caller file(s) match their devkit templates."
diff --git a/e2e/ci/test-check-caller-drift.sh b/e2e/ci/test-check-caller-drift.sh
new file mode 100755
index 0000000..fc6b0d4
--- /dev/null
+++ b/e2e/ci/test-check-caller-drift.sh
@@ -0,0 +1,233 @@
+#!/usr/bin/env bash
+#
+# Self-test for check-caller-drift.sh.
+#
+# WHY A POSITIVE CONTROL AND NOT JUST A SMOKE RUN
+#   A drift checker that silently passes is strictly worse than no checker: it
+#   converts "nobody is looking" into "someone is looking and says it's fine".
+#   The only way to trust a green run is to prove the same code goes red on a
+#   drift you planted on purpose. Case 1 below is that proof — and it plants the
+#   two drifts that actually happened in this fleet (a missing dispatch input, a
+#   missing `actions: write`), not invented ones.
+#
+#   The negative controls matter just as much: cases 4-6 plant the differences
+#   the checker MUST tolerate. Without them the honest fix for a noisy checker is
+#   to loosen it, and nothing would catch the loosening going too far.
+#
+# Runs fully in a temp dir against synthetic fixtures — never touches a repo.
+# Exit: 0 all cases pass · 1 a case failed.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CHECK="$SCRIPT_DIR/check-caller-drift.sh"
+[ -x "$CHECK" ] || chmod +x "$CHECK"
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+TEMPLATES="$WORK/templates"
+mkdir -p "$TEMPLATES"
+
+cat > "$TEMPLATES/plugin-e2e.caller.yml" <<'YAML'
+# plugin-e2e — caller template.
+name: plugin-e2e
+
+on:
+  pull_request:
+    branches: ["main", "master"]
+  workflow_dispatch:
+    inputs:
+      capture_all_traces:
+        description: "Capture a Playwright trace for EVERY scenario (not just failures)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: write
+
+jobs:
+  e2e:
+    uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/plugin-e2e.yml@main
+    secrets: inherit
+    with:
+      capture-all-traces: ${{ inputs.capture_all_traces || false }}
+YAML
+
+cat > "$TEMPLATES/devkit-sync.caller.yml" <<'YAML'
+# devkit-sync — caller template.
+name: devkit-sync
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync:
+    uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/devkit-sync.yml@main
+    with:
+      devkit-submodule-path: "tests/_testkit"
+    secrets:
+      SKILLS_SYNC_APP_CLIENT_ID: ${{ secrets.SKILLS_SYNC_APP_CLIENT_ID }}
+      SKILLS_SYNC_APP_PRIVATE_KEY: ${{ secrets.SKILLS_SYNC_APP_PRIVATE_KEY }}
+YAML
+
+# A consumer that is, by construction, a byte-identical copy — the in-sync base
+# every case mutates from.
+new_consumer() {
+  local dir="$WORK/$1"
+  rm -rf "$dir"; mkdir -p "$dir/.github/workflows"
+  cp "$TEMPLATES/plugin-e2e.caller.yml"   "$dir/.github/workflows/plugin-e2e.yml"
+  cp "$TEMPLATES/devkit-sync.caller.yml"  "$dir/.github/workflows/devkit-sync.yml"
+  echo "$dir"
+}
+
+pass=0; fail=0
+# expect <want-exit> <case-name> <consumer-dir> [grep-pattern ...]
+expect() {
+  local want="$1" name="$2" dir="$3"; shift 3
+  local out rc
+  out="$(TEMPLATES_DIR="$TEMPLATES" "$CHECK" "$dir" 2>&1)"; rc=$?
+  local ok=1
+  [ "$rc" -eq "$want" ] || ok=0
+  local pat
+  for pat in "$@"; do grep -qF -- "$pat" <<<"$out" || ok=0; done
+  if [ "$ok" -eq 1 ]; then
+    pass=$((pass + 1)); echo "PASS  $name (exit $rc)"
+  else
+    fail=$((fail + 1))
+    echo "FAIL  $name (exit $rc, wanted $want)"
+    sed 's/^/        /' <<<"$out"
+  fi
+}
+
+echo "--- positive controls: real drifts, must be DETECTED ---"
+
+# Case 1 — the two incidents that actually happened, on one repo.
+d="$(new_consumer c1-real-incidents)"
+python3 - "$d/.github/workflows/plugin-e2e.yml" <<'PY'
+import sys
+p = sys.argv[1]
+t = open(p).read()
+# share-chat: caller predated capture_all_traces, so the dispatch input and the
+# `with:` that forwards it were both absent.
+t = t.replace('''  workflow_dispatch:
+    inputs:
+      capture_all_traces:
+        description: "Capture a Playwright trace for EVERY scenario (not just failures)"
+        type: boolean
+        default: false
+''', '  workflow_dispatch:\n')
+t = t.replace('''    with:
+      capture-all-traces: ${{ inputs.capture_all_traces || false }}
+''', '')
+# DEC-074: actions: write hand-propagated to 4 repos, one PR each.
+t = t.replace('  actions: write\n', '')
+open(p, 'w').write(t)
+PY
+expect 1 "missing capture_all_traces input + actions: write" "$d" \
+  "[missing] on.workflow_dispatch.inputs.capture_all_traces.type" \
+  "[missing] jobs.e2e.with.capture-all-traces" \
+  "[missing] permissions.actions"
+
+# Case 2 — a stale `uses` ref. Pins the consumer to an old devkit no matter what
+# the submodule says; the most consequential single-token drift there is.
+d="$(new_consumer c2-stale-uses)"
+sed -i 's|plugin-e2e.yml@main|plugin-e2e.yml@v1|' "$d/.github/workflows/plugin-e2e.yml"
+expect 1 "stale reusable-workflow ref (@v1 vs @main)" "$d" "[changed] jobs.e2e.uses"
+
+# Case 3 — devkit-sync still on the retired nightly schedule (DEC-079), and a
+# secret key dropped. Proves the second file is really checked, not just the first.
+d="$(new_consumer c3-stale-sync)"
+python3 - "$d/.github/workflows/devkit-sync.yml" <<'PY'
+import sys
+p = sys.argv[1]
+t = open(p).read()
+t = t.replace('on:\n  workflow_dispatch:',
+              'on:\n  schedule:\n    - cron: "0 4 * * *"\n  workflow_dispatch:')
+t = t.replace('      SKILLS_SYNC_APP_PRIVATE_KEY: ${{ secrets.SKILLS_SYNC_APP_PRIVATE_KEY }}\n', '')
+open(p, 'w').write(t)
+PY
+expect 1 "retired nightly schedule + dropped secret" "$d" \
+  "[extra]   on.schedule" \
+  "[missing] jobs.sync.secrets.SKILLS_SYNC_APP_PRIVATE_KEY"
+
+echo
+echo "--- negative controls: cosmetic differences, must be TOLERATED ---"
+
+# Case 4 — comments and blank lines. The devkit rewrote the whole devkit-sync
+# header for DEC-079; if that fired on every consumer the check gets ignored.
+d="$(new_consumer c4-comments)"
+python3 - "$d/.github/workflows/devkit-sync.yml" <<'PY'
+import sys
+p = sys.argv[1]
+t = open(p).read()
+t = t.replace('# devkit-sync — caller template.',
+              '# devkit-sync — caller template (SPEC DEC-044).\n#\n# Rewritten header.\n# ON DEMAND ONLY (DEC-079).\n')
+open(p, 'w').write(t + "\n\n")
+PY
+expect 0 "comment rewrite + trailing blank lines" "$d" "in sync"
+
+# Case 5 — quoting, key order, and branch-list order. Same contract, different
+# spelling; a line-diff would flag all three.
+d="$(new_consumer c5-formatting)"
+python3 - "$d/.github/workflows/plugin-e2e.yml" <<'PY'
+import sys
+p = sys.argv[1]
+t = open(p).read()
+t = t.replace('branches: ["main", "master"]', "branches: [master, main]")
+t = t.replace('''permissions:
+  contents: read
+  pull-requests: write
+  actions: write''', '''permissions:
+  actions: write
+  pull-requests: write
+  contents: read''')
+open(p, 'w').write(t)
+PY
+expect 0 "requoting, reordered keys, reordered branch list" "$d" "in sync"
+
+# Case 6 — the one judgement call, asserted explicitly so a future tightening
+# has to change this test on purpose rather than by accident.
+d="$(new_consumer c6-description)"
+sed -i 's|description: "Capture a Playwright trace.*|description: "Trace every scenario"|' \
+  "$d/.github/workflows/plugin-e2e.yml"
+expect 0 "reworded dispatch-input description (prose only)" "$d" "in sync"
+
+echo
+echo "--- structural cases ---"
+
+# Case 7 — clean copy. Guards against a checker that flags everything, which
+# would make cases 1-3 pass for the wrong reason.
+d="$(new_consumer c7-clean)"
+expect 0 "untouched copy" "$d" "OK: 2 caller file(s)"
+
+# Case 8 — half-adopted: one caller deleted. devkit-sync cannot restore it.
+d="$(new_consumer c8-half)"
+rm "$d/.github/workflows/devkit-sync.yml"
+expect 1 "caller file deleted entirely" "$d" "devkit-sync.yml: NOT PRESENT"
+
+# Case 9 — a repo that never adopted the devkit must not fail a fleet sweep.
+d="$WORK/c9-nonadopter"; mkdir -p "$d/.github/workflows"
+echo "name: unit" > "$d/.github/workflows/unit.yml"
+expect 0 "non-adopter repo is skipped, not failed" "$d" "no devkit caller workflows — skipped"
+
+# Case 10 — a fleet sweep: one bad repo must fail the whole run.
+good="$(new_consumer c10-good)"
+bad="$(new_consumer c10-bad)"
+sed -i 's|  actions: write||' "$bad/.github/workflows/plugin-e2e.yml"
+out="$(TEMPLATES_DIR="$TEMPLATES" "$CHECK" "$good" "$bad" 2>&1)"; rc=$?
+if [ "$rc" -eq 1 ] && grep -qF "DRIFT: 1 repo(s)" <<<"$out"; then
+  pass=$((pass + 1)); echo "PASS  multi-repo sweep fails on one bad repo (exit $rc)"
+else
+  fail=$((fail + 1)); echo "FAIL  multi-repo sweep (exit $rc)"; sed 's/^/        /' <<<"$out"
+fi
+
+echo
+echo "passed: $pass  failed: $fail"
+[ "$fail" -eq 0 ] || exit 1
+echo "SELF-TEST OK — the checker detects planted drift and tolerates cosmetics."