feat(miner): validate config content in doctor, not just its path

[real-venus]

Summary

doctor only reported the discovered .gittensory-miner config file's path — it never validated the file's content, so a malformed config silently degraded to defaults instead of being caught before a run.

This adds a config-content doctor check: it parses the discovered config with the engine's tolerant goal-spec parser (parseMinerGoalSpecContent) and surfaces its warnings, so doctor reports specific, actionable errors for a malformed config (e.g. MinerGoalSpec field "wantedPaths" must be a list; ignoring a string value) and exits non-zero.

• No config file present → clean pass (defaults apply).
• Well-formed config → pass.
• Malformed config → flagged with the parser's exact warnings.
• Config discovered but unreadable → reported.

runDoctorChecks / runDoctor now take an optional cwd (the config is discovered relative to it), defaulting to process.cwd() — backward-compatible.

Scope

• Narrow, one coherent change — one new doctor check reusing the existing engine parser + config discovery
• In scope (packages/), no blockedPaths, no secrets/private terms
• .d.ts companion updated (new export + the optional cwd params)

Validation

• npm run typecheck
• npm run test:coverage (full unsharded suite)
• test/unit/miner-status.test.ts: checkConfigContent unit tests (no config → pass, well-formed → pass, malformed → flagged with the parser's warnings, unreadable → reported), the doctor check list now includes config-content, and doctor flags a malformed config file and exits non-zero
• Every added line covered; no regressions against a clean-main baseline (the one Windows-only path-separator test failure is pre-existing and unrelated)

Safety

• Read-only: parses an already-discovered local config; no network, no writes
• Reuses the engine's existing tolerant parser (no new schema surface); a read failure is caught and reported, never thrown
• No secrets, tokens, wallets, trust scores, or reward values in code, tests, or this description

Closes #4873

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.44%. Comparing base (91842d3) to head (16f585f).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5402   +/-   ##
=======================================
  Coverage   94.44%   94.44%           
=======================================
  Files         552      552           
  Lines       44291    44298    +7     
  Branches    14657    14657           
=======================================
+ Hits        41832    41839    +7     
  Misses       1784     1784           
  Partials      675      675           

Flag	Coverage Δ
shard-1	43.88% <0.00%> (-0.27%)	⬇️
shard-2	34.16% <0.00%> (-0.48%)	⬇️
shard-3	32.11% <0.00%> (+0.58%)	⬆️
shard-4	31.38% <37.50%> (-0.13%)	⬇️
shard-5	32.88% <100.00%> (-0.40%)	⬇️
shard-6	43.92% <0.00%> (+0.57%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/gittensory-miner/lib/status.js	93.63% <100.00%> (+0.43%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-12 16:52:11 UTC}

3 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This adds a `config-content` doctor check that reads the discovered `.gittensory-miner` config and validates it with the engine's existing tolerant parser, surfacing the parser's own warnings instead of letting a malformed config silently degrade. The threading of an optional `cwd` through `runDoctorChecks`/`runDoctor` is backward-compatible (defaults to `process.cwd()`), and the new function correctly reuses `discoverConfigFile`, `parseMinerGoalSpecContent`, and `describeError` rather than inventing new validation logic. Tests cover all four stated states (no config, valid, malformed, unreadable) and confirm the doctor check-list ordering and exit code, closing #4873.

Nits — 5 non-blocking

• packages/gittensory-miner/lib/status.js: `checkConfigContent` calls `discoverConfigFile` a second time on every `doctor` run (once here, once implicitly if `collectStatus`/`runStatus` were also called elsewhere in the same process) — not a real cost given it's just `existsSync` on 4 candidates, but worth noting if this list grows.
• test/unit/miner-status.test.ts: the read-failure test only asserts `result.detail` contains 'permission denied' — consider also asserting `describeError` formatting is applied consistently with other checks like `checkStoreIntegrity` for parity.
• Consider whether `checkConfigContent`'s `readImpl` injection should default-export a shared file-read-with-describeError helper if this same read-then-describeError pattern recurs in future doctor checks, to avoid drift (currently just a 2-argument default, fine as-is).
• nit: packages/gittensory-miner/lib/status.js:42 duplicates the engine's documented miner config filename list even though this new check depends on exact parser/discovery parity; consider importing the exported filename list or adding a parity test so future engine discovery changes do not leave doctor validating a different file set.
• nit: test/unit/miner-status.test.ts:140 only checks that malformed output mentions wantedPaths; asserting the parser's warning text more specifically would better lock the user-facing doctor detail promised by this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4873
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 99 registered-repo PR(s), 53 merged, 10 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	real-venus; Gittensor profile; 99 PR(s), 10 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: real-venus
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 99 PR(s), 10 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.