Module check 

drep check - the commit gate, end to end.

Three concerns, three sibling modules, one orchestrator here:

• input resolves the four input modes (paths, --staged, --diff, and pre-commit’s pre-push ref environment) into a uniform [Hunk] list. Whatever the caller passed, the rest of the pipeline sees the same shape.
• deterministic runs the configured per-language tools, collecting their findings AND marking every file in a batch failed when a tool was Unavailable — the per-tool/per-file join the exit-2 contract rests on.
• render turns the two layers’ findings plus the failure map into the text or JSON output the user sees.
• refusal answers whether site policy permits a semantic layer here at all, and owns the ordering that keeps a refused repository from ever reaching a credential, a chain or the cache.

The split is by topic, not by file size, because the smallest meaningful unit of check is “one input mode” or “one output format” and the dependencies between those are weak. The orchestrator (run) is the only place where the layers meet, which is what the loading-order invariants and the exit-code precedence are pinned against.

Re-exports

pub use crate::Exit;

Structs

CheckArgs

CheckOutcome

Everything one check run produced.

ProviderUse

One provider’s share of a run.

Enums

ReviewActivity

Visible accounting for a fresh semantic review.

Constants

CACHE_MAX_BYTES

See CACHE_TTL_DAYS.

CACHE_TTL_DAYS

How long a cached LLM response stays valid, and how large the store may grow. Documented tunables rather than magic numbers at the call site.

Functions

run

One check invocation: resolve input, run both layers, gate, render, return Exit.