Re-derive the hash of every skill and MCP server pinned in this truecopy lock and report whether each still matches what was vetted. Use this before trusting a tool surface, or to answer "has anything changed underneath me?". Each entry comes back as one of: ok (bytes identical to what was pinned), drifted (content changed since it was vetted), poisoned (re-scan found an injection or exfiltration pattern), untrusted (signed by a key that is not in the trust store), unsigned (a signature was required but is absent), or missing (the pinned source is no longer on disk). Read-only: it never re-pins, never edits the lock, and never fetches anything over the network.

List what this truecopy lock pins, without re-verifying it. Returns each entry with the kind of artifact (skill, mcp, or file), the scan verdict recorded at pin time, and whether it carries a signature. Use this to see the vetted set at a glance — what an agent is permitted to run — or to confirm the gate is reading the lock you expect. For whether those bytes are still unchanged, call truecopy-verify instead. Read-only.