What to verify with doctor

hermetic doctor

Reconciles three sources that can silently disagree: the DynamoDB agents scan, EC2’s own view of managed instances (hermetic:managed=true tag), and Tailscale’s device list. It also reports the account/fleet guard status and any credential env-var overrides in effect. Run it after init, and any time the fleet feels off before you trust agent ps.