Verify dotfiles

The surface is the Ansible playbook main.yml, which a user runs through dotfiles [ansible args]. That wrapper also runs git pull on this checkout and upgrades Galaxy collections, so verification drives ansible-playbook main.yml from the repo root with the same arguments. Every command goes through verify.sh in this folder.

There are two modes. Pick the strongest one the role allows.

• check runs --check --diff against the real home. It is read-only and works for every role. It proves what would change, and it skips every shell and command task.
• sandbox runs the role for real, twice, into a fresh home under $TMPDIR/verify-dotfiles/. It overrides the user_dir fact and HOME, so links, git config --global, claude mcp add, and npx all land in the sandbox. It is the only mode that proves a role converges and is idempotent. It refuses roles with Homebrew tasks, because those install on the real machine.

Launch

There is no server. The playbook is short-lived and each run is its own process.

.claude/skills/verify-dotfiles/verify.sh doctor

Ready means the last line is doctor: ready. The script needs ansible-playbook (Homebrew), the community.general collection in ~/.ansible/collections, and ~/.ansible-vault/vault.secret for the git and ssh roles.