code-mower 0.9.2b1__tar.gz → 0.9.4b1__tar.gz

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.9.2b1
+Version: 0.9.4b1
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.12
@@ -95,6 +95,9 @@ wrappers, run `code-mower migration setup-drift --repo-path .` before copying a
 fresh `.code-mower.generated` tree. It is read-only and reports path-level
 classifications (`same`, `differs`, `new`, `repo-only`,
 `missing-from-output`) without file contents or diffs.
+If the repository already has builder or dispatch lanes, rerun setup drift with
+the current builder set, for example `--builders codex,claude,cursor`, before
+opening the reviewed upgrade PR.
 Use [Upgrade An Existing Repository](docs/upgrade-existing-repo.md) for the
 reviewed PR flow, repo-only file handling, builder identity checks, and
 wrapper/pin drift checks.
@@ -113,8 +116,9 @@ Plain `board serve` is read-only. If the default Board port is busy, the CLI
 uses a nearby free loopback port and prints the URL; an explicit `--port` stays
 strict and reports a friendly conflict. To build local history while the browser
 view is open, run `code-mower board serve --repo OWNER/REPO --record-events`; it
-records at most one snapshot every 60 seconds by default. To append one snapshot
-without serving the browser view, run
+records at most one snapshot every 60 seconds by default. The Board header shows
+the Code Mower version serving the page and flags when a restart is needed after
+an upgrade. To append one snapshot without serving the browser view, run
 `code-mower board record --repo OWNER/REPO` from the repository checkout; it
 writes metadata-only snapshots to `.code-mower/board/events.jsonl` with default
 14-day and 500-event retention. `code-mower board events` prints recent stored
@@ -169,13 +173,13 @@ after reinstalling, especially when switching between pipx and uv.
 | C. Builder experiment | You want to compare authoring loops before trusting them broadly. | Use a work order or experiment spec, run `code-mower builder-experiment run` around an explicit command, then review the source-free `authoringRun` artifact and normal audit evidence. | [Builder Experiments](docs/builder-experiments.md) |
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v0.9.2-beta.1/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v0.9.4-beta.1/docs/try-in-10-minutes.md)
 guide. The v0.9 beta includes the completed native Board work plus the adoption
-and upgrade hardening from recent install rehearsals; v0.9.2 keeps the path
-simple by removing the retired third-party observe bridge, softening
-dispatch-token expiry metadata when the secret is present, and making
-stale-audit waits name the runner/dispatcher requeue path. Package-only users
-can start from the public package rather than a source checkout.
+and upgrade hardening from recent install rehearsals; v0.9.3 keeps the path
+smooth by clarifying starter-package diagnostics, surfacing richer top-level
+lane status detail, showing Board version drift, and reporting standalone pin
+drift during existing-repo upgrades. Package-only users can start from the
+public package rather than a source checkout.
 
 ## What Calibration Does And Does Not Prove
 
@@ -206,7 +210,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v0.9.2-beta.1` / `code-mower==0.9.2b1`. The
+the package-index procedure for `v0.9.4-beta.1` / `code-mower==0.9.4b1`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 
 ## Optional: Plan Before Coding
@@ -354,8 +358,8 @@ The first recommended lanes are local/manual:
 | Gitar | advisory third signal | informational until calibrated |
 
 Everything else starts manual or informational until your own calibration data
-proves it is useful: Antigravity/Gemini, Hermes, CodeRabbit CLI, Cursor BugBot,
-Qodo, Greptile, Devin, local LLMs, and future ACP bridges.
+proves it is useful: Antigravity/Gemini, Muse, Hermes, CodeRabbit CLI, Cursor
+BugBot, Qodo, Greptile, Devin, local LLMs, and future ACP bridges.
 
 Gemini CLI and Antigravity are distinct lane ids even though both are Google
 surfaces and may use Gemini model infrastructure. Keep their auth, model
@@ -392,8 +396,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index beta baseline is `v0.9.2-beta.1`, with pinned package
-install spec `code-mower==0.9.2b1`. Release evidence is recorded on the GitHub
+The current package-index beta baseline is `v0.9.4-beta.1`, with pinned package
+install spec `code-mower==0.9.4b1`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/README.md

@@ -78,6 +78,9 @@ wrappers, run `code-mower migration setup-drift --repo-path .` before copying a
 fresh `.code-mower.generated` tree. It is read-only and reports path-level
 classifications (`same`, `differs`, `new`, `repo-only`,
 `missing-from-output`) without file contents or diffs.
+If the repository already has builder or dispatch lanes, rerun setup drift with
+the current builder set, for example `--builders codex,claude,cursor`, before
+opening the reviewed upgrade PR.
 Use [Upgrade An Existing Repository](docs/upgrade-existing-repo.md) for the
 reviewed PR flow, repo-only file handling, builder identity checks, and
 wrapper/pin drift checks.
@@ -96,8 +99,9 @@ Plain `board serve` is read-only. If the default Board port is busy, the CLI
 uses a nearby free loopback port and prints the URL; an explicit `--port` stays
 strict and reports a friendly conflict. To build local history while the browser
 view is open, run `code-mower board serve --repo OWNER/REPO --record-events`; it
-records at most one snapshot every 60 seconds by default. To append one snapshot
-without serving the browser view, run
+records at most one snapshot every 60 seconds by default. The Board header shows
+the Code Mower version serving the page and flags when a restart is needed after
+an upgrade. To append one snapshot without serving the browser view, run
 `code-mower board record --repo OWNER/REPO` from the repository checkout; it
 writes metadata-only snapshots to `.code-mower/board/events.jsonl` with default
 14-day and 500-event retention. `code-mower board events` prints recent stored
@@ -152,13 +156,13 @@ after reinstalling, especially when switching between pipx and uv.
 | C. Builder experiment | You want to compare authoring loops before trusting them broadly. | Use a work order or experiment spec, run `code-mower builder-experiment run` around an explicit command, then review the source-free `authoringRun` artifact and normal audit evidence. | [Builder Experiments](docs/builder-experiments.md) |
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v0.9.2-beta.1/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v0.9.4-beta.1/docs/try-in-10-minutes.md)
 guide. The v0.9 beta includes the completed native Board work plus the adoption
-and upgrade hardening from recent install rehearsals; v0.9.2 keeps the path
-simple by removing the retired third-party observe bridge, softening
-dispatch-token expiry metadata when the secret is present, and making
-stale-audit waits name the runner/dispatcher requeue path. Package-only users
-can start from the public package rather than a source checkout.
+and upgrade hardening from recent install rehearsals; v0.9.3 keeps the path
+smooth by clarifying starter-package diagnostics, surfacing richer top-level
+lane status detail, showing Board version drift, and reporting standalone pin
+drift during existing-repo upgrades. Package-only users can start from the
+public package rather than a source checkout.
 
 ## What Calibration Does And Does Not Prove
 
@@ -189,7 +193,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v0.9.2-beta.1` / `code-mower==0.9.2b1`. The
+the package-index procedure for `v0.9.4-beta.1` / `code-mower==0.9.4b1`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 
 ## Optional: Plan Before Coding
@@ -337,8 +341,8 @@ The first recommended lanes are local/manual:
 | Gitar | advisory third signal | informational until calibrated |
 
 Everything else starts manual or informational until your own calibration data
-proves it is useful: Antigravity/Gemini, Hermes, CodeRabbit CLI, Cursor BugBot,
-Qodo, Greptile, Devin, local LLMs, and future ACP bridges.
+proves it is useful: Antigravity/Gemini, Muse, Hermes, CodeRabbit CLI, Cursor
+BugBot, Qodo, Greptile, Devin, local LLMs, and future ACP bridges.
 
 Gemini CLI and Antigravity are distinct lane ids even though both are Google
 surfaces and may use Gemini model infrastructure. Keep their auth, model
@@ -375,8 +379,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index beta baseline is `v0.9.2-beta.1`, with pinned package
-install spec `code-mower==0.9.2b1`. Release evidence is recorded on the GitHub
+The current package-index beta baseline is `v0.9.4-beta.1`, with pinned package
+install spec `code-mower==0.9.4b1`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.9.2b1"
+version = "0.9.4b1"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.12"
 readme = "README.md"

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.9.2b1"
+__version__ = "0.9.4b1"

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/board.py

@@ -15,11 +15,13 @@ from dataclasses import dataclass
 from datetime import UTC, datetime
 from http import HTTPStatus
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from importlib import metadata
 from pathlib import Path
 from threading import Lock
 from typing import Any
 from urllib.parse import urlparse
 
+from . import __version__ as CODE_MOWER_VERSION
 from . import board_store
 from . import lane_status
 from . import reviewer_spend
@@ -120,6 +122,22 @@ def _candidate_ports(config: BoardConfig) -> list[int]:
     return list(range(config.port, last_port + 1))
 
 
+def _installed_package_version() -> str:
+    try:
+        return metadata.version("code-mower")
+    except metadata.PackageNotFoundError:
+        return ""
+
+
+def board_version_payload() -> dict[str, Any]:
+    installed_version = _installed_package_version()
+    return {
+        "serving_version": CODE_MOWER_VERSION,
+        "installed_version": installed_version,
+        "restart_recommended": bool(installed_version and installed_version != CODE_MOWER_VERSION),
+    }
+
+
 def _explicit_port_conflict_message(host: str, port: int) -> str:
     suggestions = list(range(port + 1, min(65535, port + 3) + 1))
     suggestion_text = f" such as {', '.join(str(candidate) for candidate in suggestions)}" if suggestions else ""
@@ -171,6 +189,7 @@ def status_payload(
     payload["board"] = {
         "schema": "code_mower.board.v1",
         "mode": "local_recording" if config.record_events else "local_read_only",
+        "version": board_version_payload(),
         "refresh_seconds": config.refresh_seconds,
         "local_paths": "shown" if config.show_local_paths else "redacted",
         "recording": {
@@ -628,7 +647,7 @@ def render_board_html(config: BoardConfig) -> str:
 </head>
 <body>
   <header>
-    <div><h1>Code Mower Board</h1><div class="muted" id="repo"></div></div>
+    <div><h1>Code Mower Board</h1><div class="muted" id="repo"></div><div class="muted" id="version"></div></div>
     <div class="muted" id="generated">Loading...</div>
   </header>
   <main>
@@ -671,6 +690,12 @@ def render_board_html(config: BoardConfig) -> str:
     }}
     function render(data) {{
       document.getElementById("repo").textContent = REPO;
+      const version = data.board?.version || {{}};
+      const servingVersion = version.serving_version || "unknown";
+      const installedVersion = version.installed_version || servingVersion;
+      document.getElementById("version").textContent = version.restart_recommended
+        ? `serving ${{servingVersion}}; installed ${{installedVersion}} available after restart`
+        : `serving ${{servingVersion}}`;
       document.getElementById("generated").innerHTML = data.generated_at ? `Generated ${{localTime(data.generated_at)}}` : "Loading...";
       const prs = data.remote?.pull_requests || [];
       const runs = data.remote?.workflow_runs || [];
@@ -683,6 +708,7 @@ def render_board_html(config: BoardConfig) -> str:
       const spendGroups = spend.groups || [];
       put("summary", [
         `<div class="metric"><span class="muted">Next action</span><b>${{esc(data.next_action || "inspect")}}</b></div>`,
+        data.next_detail ? `<div class="metric"><span class="muted">Detail</span><b>${{esc(data.next_detail)}}</b></div>` : "",
         `<div class="metric"><span class="muted">GitHub</span><b class="${{data.remote?.available ? "ok" : "warn"}}">${{data.remote?.available ? "available" : "unavailable"}}</b></div>`,
         `<div class="metric"><span class="muted">Open PRs</span><b>${{prs.length}}</b></div>`,
         `<div class="metric"><span class="muted">Owner queue</span><b class="${{ownerQueue.length ? "warn" : "ok"}}">${{ownerQueue.length}}</b></div>`,

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/calibration/arms.py

@@ -15,6 +15,7 @@ DEFAULT_CLI_LANES = (
     "hermes_cli",
     "coderabbit_cli",
     "grok_build",
+    "muse_cli",
 )
 
 

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/calibration/planning.py

@@ -232,6 +232,7 @@ def build_pilot_plan(
                             "gemini_cli",
                             "grok_build",
                             "hermes_cli",
+                            "muse_cli",
                         }:
                             output_leaf = _local_cli_output_leaf(
                                 lane_slug=lane_slug,

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/cli.py

@@ -70,6 +70,7 @@ from . import local_llm_bakeoff
 from . import local_llm_calibration
 from . import local_llm_profiles
 from . import migration as code_mower_migration
+from . import muse_cli_audit_pr
 from . import next_steps as code_mower_next_steps
 from . import package as code_mower_package
 from . import prompts as code_mower_prompts
@@ -454,6 +455,7 @@ COMMAND_DESCRIPTIONS: dict[str, str] = {
     "local-llm": "Probe and run local OpenAI-compatible model lanes.",
     "migration": "Rehearse standalone package and wrapper migration paths.",
     "merge-plan": "Inspect merge-readiness signals and lane labels.",
+    "muse-cli": "Run a Muse CLI structured audit lane.",
     "next-steps": "Print the recommended next actions after setup.",
     "package": "Build or inspect package extraction artifacts.",
     "plan": "Create local issue-derived planning artifacts.",
@@ -593,6 +595,7 @@ COMMAND_HANDLERS: dict[str, CommandHandler] = {
     "local-llm": _local_llm_main,
     "migration": code_mower_migration.main,
     "merge-plan": code_mower_merge.main,
+    "muse-cli": muse_cli_audit_pr.main,
     "next-steps": code_mower_next_steps.main,
     "package": _package_main,
     "plan": code_mower_work_orders.plan_main,

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/doctor_checks/__init__.py

@@ -32,7 +32,10 @@ from .github_human_token import (
     human_automation_token_config,
     human_automation_token_required,
 )
-from .github_trusted_authors import trusted_author_variable_statuses
+from .github_trusted_authors import (
+    trusted_author_variable_probe,
+    trusted_author_variable_statuses,
+)
 from .groups import GROUP_LABELS, doctor_check_group_id
 from .models import (
     STATUS_FAIL,
@@ -113,6 +116,7 @@ __all__ = [
     "check_macos_runner_launchagent",
     "check_github_setup",
     "check_human_automation_token",
+    "trusted_author_variable_probe",
     "trusted_author_variable_statuses",
     "check_repository_posture",
     "check_lane_runtime",

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/doctor_checks/adoption.py

@@ -170,7 +170,7 @@ def check_adoption_posture_guidance(
             name="doctor.adoption.posture_hint",
             status=STATUS_WARN,
             message=(
-                "default reviewer-gate posture found local provider setup gaps"
+                "default reviewer-gate posture checks local reviewer CLIs on this host"
             ),
             detail={
                 "adoption_posture": adoption_posture,
@@ -186,9 +186,12 @@ def check_adoption_posture_guidance(
                 ],
             },
             remediation=(
-                "If this host only coordinates or observes hosted builders, "
-                "rerun with `--orchestrator-only` or `--hosted-builders`; "
-                "otherwise finish the local CLI/token setup for the listed lanes."
+                "If this host only coordinates work, rerun "
+                "`code-mower doctor --adoption --orchestrator-only --repo OWNER/REPO`. "
+                "If it observes hosted builder lanes, rerun "
+                "`code-mower doctor --adoption --hosted-builders --repo OWNER/REPO`. "
+                "Only keep the default reviewer-gate posture on machines that "
+                "run local reviewer CLIs."
             ),
         ),
     )
@@ -205,6 +208,7 @@ def check_adoption_setup(
     config_source: str = "",
     repo_root: Path | None = None,
     trusted_author_variables: Mapping[str, str] | None = None,
+    trusted_author_variable_errors: Mapping[str, Any] | None = None,
 ) -> tuple[DoctorCheck, ...]:
     """Return first-run adoption posture checks."""
 
@@ -371,10 +375,16 @@ def check_adoption_setup(
     }
     if trusted_author_variables is not None:
         variable_status = {
-            name: str(trusted_author_variables.get(name) or "missing")
+            name: str(trusted_author_variables.get(name) or "not_confirmed")
             for name in TRUSTED_AUDIT_AUTHOR_VARIABLES
         }
         trusted_detail["variable_status"] = variable_status
+        if trusted_author_variable_errors:
+            trusted_detail["variable_read_errors"] = {
+                name: trusted_author_variable_errors[name]
+                for name in sorted(trusted_author_variable_errors)
+                if name in TRUSTED_AUDIT_AUTHOR_VARIABLES
+            }
         all_present = all(
             variable_status[name] == "present" for name in TRUSTED_AUDIT_AUTHOR_VARIABLES
         )
@@ -388,6 +398,27 @@ def check_adoption_setup(
                 )
             )
             return tuple(checks)
+        if any(
+            variable_status[name] == "not_confirmed"
+            for name in TRUSTED_AUDIT_AUTHOR_VARIABLES
+        ):
+            checks.append(
+                DoctorCheck(
+                    name="doctor.adoption.trusted_authors",
+                    status=STATUS_WARN,
+                    message=(
+                        "trusted audit-comment author variables were not fully confirmed"
+                    ),
+                    detail=trusted_detail,
+                    remediation=(
+                        "Ensure `gh auth status` can read repository Actions "
+                        "variables for this repo, then set CLAUDE_AUDIT_BOT_AUTHORS "
+                        "and CODEX_BOT_AUTHORS to the GitHub logins that may post "
+                        "trusted audit verdicts."
+                    ),
+                )
+            )
+            return tuple(checks)
 
     checks.append(
         DoctorCheck(

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/doctor_checks/github.py

@@ -36,6 +36,7 @@ def check_github_setup(
     lanes: Sequence[tuple[str, Mapping[str, Any]]],
     http_timeout: int,
     actions_cost_sample: int = ACTIONS_COST_SAMPLE_DEFAULT,
+    adoption: bool = False,
     adoption_posture: str = "reviewer-gate",
 ) -> list[DoctorCheck]:
     checks: list[DoctorCheck] = []
@@ -127,6 +128,7 @@ def check_github_setup(
                     required_status_context=(
                         "code-mower/gate" if has_merge_authority else None
                     ),
+                    adoption=adoption,
                 ),
                 check_recent_pr_diff_median(
                     gh_path=gh_path,
@@ -143,12 +145,18 @@ def check_github_setup(
                 config=config,
                 lanes=lanes,
                 http_timeout=http_timeout,
+                adoption=adoption,
                 adoption_posture=adoption_posture,
             )
         )
         if has_merge_authority:
             checks.append(
-                check_repo_auto_merge(slug=slug, repo_payload=metadata.payload)
+                check_repo_auto_merge(
+                    slug=slug,
+                    repo_payload=metadata.payload,
+                    adoption=adoption,
+                    adoption_posture=adoption_posture,
+                )
             )
 
     provider_check = check_private_repo_provider_surface(

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/doctor_checks/github_branch.py

@@ -18,6 +18,7 @@ def check_branch_protection(
     default_branch: str,
     http_timeout: int,
     required_status_context: str | None = None,
+    adoption: bool = False,
 ) -> DoctorCheck:
     encoded_branch = urllib.parse.quote(default_branch, safe="")
     protection_payload, protection_detail = _github_api_json(
@@ -77,9 +78,10 @@ def check_branch_protection(
             if str(GITHUB_ACTIONS_APP_ID) in app_ids
             else "a specific GitHub App"
         )
+        status = STATUS_WARN if adoption else STATUS_FAIL
         return DoctorCheck(
             name="github.branch_protection",
-            status=STATUS_FAIL,
+            status=status,
             message=(
                 f"{slug}@{default_branch} requires {required_status_context} "
                 f"from {source_description} instead of Any source"
@@ -87,6 +89,8 @@ def check_branch_protection(
             detail={
                 "repo": slug,
                 "default_branch": default_branch,
+                "owner_action": adoption,
+                "owner_action_kind": "branch_protection_gate_binding",
                 "required_status_context": required_status_context,
                 "required_status_contexts": contexts,
                 "required_status_check_count": len(contexts),
@@ -110,6 +114,8 @@ def check_branch_protection(
             detail={
                 "repo": slug,
                 "default_branch": default_branch,
+                "owner_action": adoption,
+                "owner_action_kind": "branch_protection_gate_requirement",
                 "required_status_context": required_status_context,
                 "required_status_check_count": len(contexts),
                 "required_status_contexts": contexts,

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/doctor_checks/github_human_token.py

@@ -119,6 +119,7 @@ def check_human_automation_token(
     config: Mapping[str, Any],
     lanes: Sequence[tuple[str, Mapping[str, Any]]],
     http_timeout: int,
+    adoption: bool = False,
     adoption_posture: str = "reviewer-gate",
     now: datetime | None = None,
 ) -> DoctorCheck:
@@ -146,7 +147,8 @@ def check_human_automation_token(
         http_timeout=http_timeout,
     )
     if secret_payload is None:
-        status = _blocking_status_for_posture(adoption_posture)
+        status = STATUS_WARN if adoption else _blocking_status_for_posture(adoption_posture)
+        owner_action = status == STATUS_WARN
         return DoctorCheck(
             name="github.human_automation_token",
             status=status,
@@ -158,7 +160,12 @@ def check_human_automation_token(
                     else ""
                 )
             ),
-            detail={**detail, "secret_check": secret_detail},
+            detail={
+                **detail,
+                "owner_action": owner_action,
+                "owner_action_kind": "human_automation_token",
+                "secret_check": secret_detail,
+            },
             remediation=(
                 f"Create one human-owned fine-grained PAT secret with "
                 f"`gh secret set {secret_name}`. Grant repository Contents read, "
@@ -179,6 +186,8 @@ def check_human_automation_token(
             message=f"{slug} is missing the {expires_var} human token expiry metadata",
             detail={
                 **detail,
+                "owner_action": True,
+                "owner_action_kind": "human_automation_token_expiry",
                 "created_at": str(secret_payload.get("created_at") or ""),
                 "updated_at": str(secret_payload.get("updated_at") or ""),
                 "expiry_check": variable_detail,
@@ -210,7 +219,12 @@ def check_human_automation_token(
             name="github.human_automation_token",
             status=STATUS_WARN,
             message=f"{slug} still has placeholder {expires_var} value",
-            detail={**detail, "expires_at": expiry_text},
+            detail={
+                **detail,
+                "owner_action": True,
+                "owner_action_kind": "human_automation_token_expiry",
+                "expires_at": expiry_text,
+            },
             remediation=(
                 f"Set {expires_var} to the PAT expiry date in YYYY-MM-DD "
                 "format, or to `never` for a non-expiring PAT."
@@ -222,7 +236,12 @@ def check_human_automation_token(
             name="github.human_automation_token",
             status=STATUS_WARN,
             message=f"{slug} has an invalid {expires_var} value",
-            detail={**detail, "expires_at": expiry_text},
+            detail={
+                **detail,
+                "owner_action": True,
+                "owner_action_kind": "human_automation_token_expiry",
+                "expires_at": expiry_text,
+            },
             remediation=(
                 f"Set {expires_var} to the PAT expiry date in YYYY-MM-DD "
                 "format, or to `never` for a non-expiring PAT."
@@ -247,6 +266,8 @@ def check_human_automation_token(
         ),
         detail={
             **detail,
+            "owner_action": status != STATUS_PASS,
+            "owner_action_kind": "human_automation_token_expiry",
             "created_at": str(secret_payload.get("created_at") or ""),
             "updated_at": str(secret_payload.get("updated_at") or ""),
             "expires_at": expiry.isoformat(),

{code_mower-0.9.2b1 → code_mower-0.9.4b1}/src/code_mower/doctor_checks/github_repo.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 from typing import Any, Mapping
 
-from .common import DoctorCheck, STATUS_FAIL, STATUS_PASS, STATUS_WARN
+from .common import DoctorCheck, OBSERVER_ADOPTION_POSTURES, STATUS_FAIL, STATUS_PASS, STATUS_WARN
 from .github_api import _github_api_json
 
 
@@ -120,13 +120,23 @@ def check_repo_permissions(*, slug: str, repo_payload: Mapping[str, Any]) -> Doc
     )
 
 
-def check_repo_auto_merge(*, slug: str, repo_payload: Mapping[str, Any]) -> DoctorCheck:
+def check_repo_auto_merge(
+    *,
+    slug: str,
+    repo_payload: Mapping[str, Any],
+    adoption: bool = False,
+    adoption_posture: str = "reviewer-gate",
+) -> DoctorCheck:
     if "allow_auto_merge" not in repo_payload:
         return DoctorCheck(
             name="github.repo.auto_merge",
             status=STATUS_WARN,
             message=f"{slug} metadata did not include auto-merge posture",
-            detail={"repo": slug},
+            detail={
+                "repo": slug,
+                "owner_action": adoption,
+                "owner_action_kind": "repo_auto_merge_visibility",
+            },
             remediation=(
                 "Verify repository auto-merge manually before relying on the "
                 "generated Code Mower gate to call enablePullRequestAutoMerge."
@@ -134,15 +144,26 @@ def check_repo_auto_merge(*, slug: str, repo_payload: Mapping[str, Any]) -> Doct
         )
 
     allow_auto_merge = bool(repo_payload.get("allow_auto_merge"))
+    blocked = (
+        not allow_auto_merge
+        and not adoption
+        and adoption_posture not in OBSERVER_ADOPTION_POSTURES
+    )
     return DoctorCheck(
         name="github.repo.auto_merge",
-        status=STATUS_PASS if allow_auto_merge else STATUS_FAIL,
+        status=STATUS_PASS if allow_auto_merge else (STATUS_FAIL if blocked else STATUS_WARN),
         message=(
             f"{slug} has auto-merge enabled"
             if allow_auto_merge
             else f"{slug} does not allow auto-merge"
         ),
-        detail={"repo": slug, "allow_auto_merge": allow_auto_merge},
+        detail={
+            "repo": slug,
+            "allow_auto_merge": allow_auto_merge,
+            "owner_action": not allow_auto_merge,
+            "owner_action_kind": "repo_auto_merge",
+            "adoption_posture": adoption_posture,
+        },
         remediation=(
             None
             if allow_auto_merge