Problem
SETUP.md provisioning spans four dashboards, two GitHub environments, per-env password-manager items, and three local env files. Mid-setup there is no single view of what's done vs missing — state ends up tracked from memory (or from a chat scrollback), which is error-prone.
Proposal
A read-only scripts/setup-doctor.mjs that prints:
- GitHub: environments exist; per-env variables (
CONVEX_URL, CLOUDFLARE_ACCOUNT_ID, WORKOS_REDIRECT_URI) and secrets (presence via gh secret list, values never touched)
- Password manager: per-env items exist; which fields are filled vs empty (presence only, values never printed)
- Local:
.dev.vars / .env.local files placeholder-vs-filled; Convex dev deployment linked
- DNS: zone on Cloudflare nameservers; dev/prod hosts reachable
- Deploys: last
deploy.yml run per branch
- Next actions, computed from the gaps and split by actor: dashboard steps for the human, pipeable
op read … | gh secret set … steps for the agent/CLI — including which GitHub values are blocked until their password-manager field is filled
Reference SETUP.md from the top ("run this anytime to see where you are"). A working version exists in a downstream project and can be upstreamed mostly as-is; the vault backend should follow the secret-manager-agnostic direction of #10.
Problem
SETUP.md provisioning spans four dashboards, two GitHub environments, per-env password-manager items, and three local env files. Mid-setup there is no single view of what's done vs missing — state ends up tracked from memory (or from a chat scrollback), which is error-prone.
Proposal
A read-only
scripts/setup-doctor.mjsthat prints:CONVEX_URL,CLOUDFLARE_ACCOUNT_ID,WORKOS_REDIRECT_URI) and secrets (presence viagh secret list, values never touched).dev.vars/.env.localfiles placeholder-vs-filled; Convex dev deployment linkeddeploy.ymlrun per branchop read … | gh secret set …steps for the agent/CLI — including which GitHub values are blocked until their password-manager field is filledReference SETUP.md from the top ("run this anytime to see where you are"). A working version exists in a downstream project and can be upstreamed mostly as-is; the vault backend should follow the secret-manager-agnostic direction of #10.