check

ds:check — drift detector

Validates DOSSIER.md against reality and returns a severity-tagged violation list. It changes no DOSSIER.md content and no repo. Two derived paths are written: INDEX.md, which ds ds-check regenerates on every run (step 3), and .scratchpad/.verify-cache/, which ds verify-sweep populates at step 2a. Both are caches rebuilt from source, never source themselves — the carve-out step 6 states.

Steps

1. Locate

Live dossier per ds:status step 1. --all adds archived dossiers as a sanity sweep.

2. Plan scout dispatch

One scout mission per §X repo, independent and parallel.

Mission template (per scout):

You are a dossier-scout. Read-only.

Dossier: <path-to-DOSSIER.md> (full file pasted below)
Repo to scan: <repo-path>

Headings are dual-spelled and the pasted file may use either. A ds:new
scaffold writes the plain names (`## Invariants`, `## Tasks`, `## Repos`);
older files write the sigils (`## §V`, `## §T`, `## §X`). The §-names below
are the section, not the literal heading — match whichever the file carries.

Tasks:
1. For each Invariants (§V) row with `check` = shell predicate: run the predicate, report PASS/FAIL.
2. For each Invariants (§V) row with `check` = test name: locate test in <repo-path>, run if executable, report PASS/FAIL/MISSING.
3. For each Tasks (§T) row with state=`x` + `cite=<sha>`: verify <sha> exists in <repo-path> git log. Report VALID/MISSING.
4. Refresh Repos (§X) for <repo>: git status -sb, ahead-count, latest tag, push state. Report current values; do NOT modify DOSSIER.md.

Output: terse pipe-table. One row per finding.

<paste DOSSIER.md here>

Spawn one dossier-scout per repo, in parallel, via the Agent tool with subagent_type: dossier:dossier-scout.

§X repos > 2 and Workflow present → route the same missions through the §workflow fan-out (${CLAUDE_PLUGIN_ROOT}/ADAPTERS.md): schema-validated rows, budget-gated width, crash-resumable. Otherwise the Agent spawns above.

2a. Verify-layer sweep (existing content)