[Horpeyehmi]

Overview

This PR adds contributor-facing diagnostics that check local setup and dependency health, report failures with actionable messages, and expose the results through the status API. The slice covers normal, failure, retry, and authorization paths for the diagnostic checks.

Related Issue

Closes #[issue-number]

Changes

🩺 Diagnostics Core

• [ADD] core/diagnostics/types.ts

  • Shared types for check definitions, results, and aggregate reports.

• [ADD] core/diagnostics/checks.ts

  • Individual setup and dependency checks, each returning pass / warn / fail with a remediation hint.

• [ADD] core/diagnostics/runner.ts

  • Executes checks with per-check timeouts and bounded retries for transient failures; isolates a crashing check so it cannot abort the whole run.

• [ADD] core/diagnostics/index.ts

  • Public entry point re-exporting the runner and check registry.

• [MODIFY] core/dependencies/graph.ts

  • Exposes dependency resolution data consumed by the dependency checks so they can report missing or cyclic dependencies.

🌐 Status Endpoint

• [MODIFY] app/api/status/route.ts
  • Returns the diagnostic report; diagnostic details are gated behind the existing authorization check so unauthenticated callers receive only a coarse health status.

✅ Tests

• [ADD] core/diagnostics/__tests__/diagnostics.test.ts
  • Covers passing, failing, retried, timed-out, and unauthorized paths.

Operational Notes & Recovery

• Checks are read-only; running diagnostics never mutates local setup or dependency state.
• A check that throws or times out is recorded as fail with its error; the run continues and the report remains complete.
• Retries apply only to checks marked transient; deterministic failures are not retried.
• Rollback: the status route falls back to the previous coarse response shape if the diagnostics module is removed, so no consumer contract is broken.

Verification

Acceptance Criteria	Status
Normal, failure, retry, and authorization paths covered	✅ Covered in diagnostics.test.ts
Automated tests or executable verification added	✅ Test file added
Operational edge cases and recovery documented	✅ See Operational Notes above
Existing contracts preserved	✅ Status route keeps its prior response shape for unauthorized callers

Closes #321

[BigDella]

Merged during the October maintenance pass after static malware-indicator review and a passing Malware guard. This is not a full security audit or a claim that the test suite passes.