fix: tune adoption doctor postures

[jeffhuber]

Summary

• classify doctor config source as packaged starter, source-tree starter, explicit config, or repository config
• keep shared human automation token gaps blocking for reviewer-gate posture while warning for hosted-builder and orchestrator-only adoption postures
• skip local wrapper token/env probes when hosted-builder or orchestrator-only posture skips local CLI execution checks

Verification

• scripts/dev-python -m unittest tests.test_doctor_registry tests.test_doctor_github_checks tests.test_doctor_provider_env_tokens tests.test_doctor_provider_env_required
• scripts/dev-python -m ruff check src/code_mower/doctor.py src/code_mower/doctor_checks/adoption.py src/code_mower/doctor_checks/runner.py src/code_mower/doctor_checks/github.py src/code_mower/doctor_checks/github_human_token.py src/code_mower/doctor_checks/providers.py tests/test_doctor_registry.py tests/test_doctor_github_checks.py
• scripts/dev-python -m code_mower.cli doctor --adoption --hosted-builders --repo codemower-ai/code-mower --json
• scripts/dev-python -m code_mower.cli doctor --adoption --orchestrator-only --repo codemower-ai/code-mower --json
• scripts/dev-python -m code_mower.cli doctor --adoption --repo codemower-ai/code-mower --json
• scripts/dev-python scripts/privacy_scan.py
• scripts/dev-python -m pytest

Closes #539.

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: 6cc3988f82af89e1befb848245248d18ce415eff
Findings: P0=0, P1=0, P2=0, P3=1 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

PR retunes doctor severity/labeling for hosted-builders/orchestrator-only postures. Logic changes are consistent with the stated intent, covered by new/updated tests, and preserve prior behavior for the default reviewer-gate posture. No correctness, security, or data-loss blockers found.

Findings:

• [P3] Duplicate posture set definitions -- src/code_mower/doctor_checks/github_human_token.py:16
  Finding ID: claude:055c0274b5ac01b9ba87
  OBSERVER_POSTURES in github_human_token.py and LOCAL_CLI_SKIP_POSTURES in providers.py independently enumerate the same hosted-builders/orchestrator-only set. If a future posture is added to one but not the other, behavior will silently diverge. Non-blocking.

[github-actions]

Code Mower notice: previously audited head 6cc3988f82af is no longer an ancestor of current head 8f506a76530e; commits may have been dropped. Only current-head audit verdicts count.

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Refactors adoption doctor postures to classify config sources and conditionally skip local wrapper token/env probes based on posture type, addressing repeated token/required env checks across driver branches. No issues found.

✅ 1 resolved

✅ Quality: Repeated token/required env checks across four driver branches

📄 src/code_mower/doctor_checks/providers.py:189-203
In check_lane_runtime the pair checks.extend(check_token_env(...)) / checks.extend(check_required_env(...)) is now duplicated in all four driver branches (local_cli, api_model, manual/hosted_bridge/saas_event, else) so it can be skipped only for the local_cli skip-posture. This is correct but fragile: a future driver branch could silently omit the env checks. Consider running the two env checks once up front, guarded by a single if not (driver == "local_cli" and adoption_posture in LOCAL_CLI_SKIP_POSTURES) condition, so the skip rule lives in one place.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: 8f506a76530e89af5df23c24c04020233e6ce20f
Findings: P0=0, P1=0, P2=0, P3=0 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

Reviewed the doctor posture-tuning PR: downgrading DISPATCH_TOKEN/human-automation-token failures to warnings and skipping local-CLI token/env checks for hosted-builders/orchestrator-only postures is explicitly documented (README.md, docs/install.md, docs/quickstart.md) and matches the code changes in github_human_token.py and doctor_checks/providers.py. The default reviewer-gate posture is unchanged and still fails on missing/expired tokens, confirmed by existing and new tests. Config-source labeling (doctor.py, adoption.py) is additive and defensively defaulted. No correctness, security, or data-loss regressions found.

Findings: none.