belay
belay records a filesystem’s state, diffs two records, and explains the difference. Packages come from pip’s and dpkg’s own databases, branch moves and history rewrites from git’s refs and reflog, text changes as line counts. Permission and capability changes are never folded away.
Given a task’s protect spec, it checks the end state against a baseline taken before the run. It sees state, not what a process read. A scan of a live tree marks what changed under it as unknown instead of guessing.
Dogfooded on its own development. Open source.