Compares the leaf key paths declared by each of your Rails encrypted credential files and fails when they disagree. Paths only, never values, so rotating a secret is not drift and no secret reaches an error message. Hooked where Rails already checks for pending migrations: a development middleware, the test suite boot, and a rake task.