pinset check

When to use

Use after installation, for diagnosis or CI reports. Default checks are read-only. --deep inspects payloads; --probe starts tools and records evidence.

Examples

pinset check
pinset check --deep --probe --format json > pinset-check.json

Illustrative plain-check output:

Tool  Configured  Installed  Bound  Observed
node  yes  yes  yes  no
Check passed: yes

Observed: no means no probe ran, not a failed tool. The second writes overall and per-tool passed results.

Behavior

By default, does not decrypt, start tools, access the network or write files. --deep compares payload fingerprints with receipts. --probe runs bounded version probes and writes executable, version, host and timestamp evidence under Pinset home. Java/Android observations do not certify a project build.

JSON uses schema_version: 1; field names, types and meanings are stable, with additive changes only. Tools include tool, expected_version, actual_version, artifact_digest, passed. Without observed probes, actual_version is null; without payload inspection, payload_verified is null. Receipt/lock digest agreement differs from payload/receipt agreement; neither claims to rehash the original archive. See JSON check contract.

Parameters, exit codes and common errors

All selected tools passing requested checks exits 0. Failed tools still produce a full report and exit 1. Operational errors exit 1 with JSON passed: false and error; invalid arguments exit 2. Read detail to distinguish missing installs, payload changes and version mismatches before repairing.