Proposal: carwatch doctor post-install verifier

[mvanhorn]

Motivation

#23 documented that cloners never get far; several install fixes landed, but there is still no one command that proves a fresh Pi clone is actually runnable. HN trust also suffers when setup fails silently halfway through llama/model guidance.

Research Summary

Evidence Vault

• last30days + Repo review, 1 Sep 2026: ranked improvements for the driver and for cloners #23: install/cloner brokenness.
• install.sh guides optional brain/model but does not verify.
• No doctor/smoke module in tree.

Proposed Solution

Add python3 -m carwatch.doctor (and call it at the end of install.sh):

Checks (read-only unless --fix later):

1. Config resolves to one file; required keys present (api_key/room/handle/owner as applicable).
2. Systemd unit files installed for core services; Enabled/Active state reported.
3. Brain binary path and model path existence (warn, not fail hard if optional).
4. Dashboard port :8088 not obviously conflicted; dash-token file mode 600.
5. Owner gate / hardcoded-user leftovers: fail if units still say User=petrus on a non-petrus host.
6. Exit non-zero on hard failures; print a short next-actions list.

Approach

Ideas Discussion; stdlib-only module matching repo constraints.

Test Strategy

Temp config fixtures; fake unit text; assert exit codes and message substrings.

Alternatives Considered

• More README prose only: rejected (cloners already drown in docs).
• Security hardening drive-by: deferred to open Dashboard token travels in the URL query string #12–Systemd units ship zero hardening (NoNewPrivileges, ProtectSystem, ProtectHome) #18.

PR Strategy

Ideas then PR.

Builds on the install fixes from #23 rather than reopening that checklist.

Happy to open a draft PR if this shape looks right. Looking for maintainer signal before writing code.