fix: distinguish configuration from hook trust

packages/casan-devkit/casan-init.py

@@ -201,6 +201,7 @@ def _render_level(result):
 
 def _render_doctor(result):
     ready = result["status"] == "ready"
+    operational = result.get("operational_status")
     _heading("CASAN Doctor")
     print("  %s Harness integrity" % _mark(result["integrity"]["ok"]))
     print("  %s Project bootstrap" % _mark(result["bootstrap"]["ok"]))
@@ -218,8 +219,18 @@ def _render_doctor(result):
         print(_color("1;33", "Warnings"))
         for warning in result["warnings"]:
             print("  %s %s" % (_warn_mark(), warning))
+    if result.get("required_actions"):
+        print()
+        print(_color("1;33", "Required actions"))
+        for action in result["required_actions"]:
+            print("  %s %s" % (_warn_mark(), action["message"]))
     print()
-    status = _color("1;32", "READY") if ready else _color("1;31", "NOT READY")
+    if ready and operational == "user_action_required":
+        status = _color("1;33", "CONFIGURED — USER ACTION REQUIRED")
+    elif ready:
+        status = _color("1;32", "READY")
+    else:
+        status = _color("1;31", "NOT READY")
     print("Status: %s" % status)
 
 
@@ -1531,6 +1542,7 @@ def cmd_doctor(args):
         "bootstrap": {"ok": bootstrap_ok},
         "client_checks": {},
         "warnings": [],
+        "required_actions": [],
     }
     ready = integrity_ok and bootstrap_ok
     vendored_harness = os.path.isfile(os.path.join(
@@ -1608,6 +1620,12 @@ def cmd_doctor(args):
     if "codex" in clients:
         checks["warnings"].append(
             "Codex project hooks do not run until their exact hash is reviewed and trusted via /hooks.")
+        checks["required_actions"].append({
+            "code": "codex_hook_trust",
+            "message": (
+                "Open /hooks in a local Codex client, review the exact hook hash, "
+                "and trust it before treating Codex as operational."),
+        })
     if "vscode-copilot" in clients:
         checks["warnings"].append(
             "Only prompts explicitly sent to @casan use the CASAN-owned Copilot route; "
@@ -1621,7 +1639,18 @@ def cmd_doctor(args):
             "Legacy prompt-boundary prose outside CASAN-managed markers conflicts "
             "with Plan-20 hooks and needs manual review: %s." %
             ", ".join(legacy_conflicts))
+        checks["required_actions"].append({
+            "code": "legacy_prompt_policy_review",
+            "message": (
+                "Review and migrate conflicting legacy prompt policy: %s." %
+                ", ".join(legacy_conflicts)),
+        })
     checks["status"] = "ready" if ready else "not_ready"
+    checks["operational_status"] = (
+        "not_ready" if not ready
+        else "user_action_required" if checks["required_actions"]
+        else "ready"
+    )
     _emit_json_or_human(args, checks, _render_doctor)
     return 0 if ready else 2
 

packages/casan-devkit/tests/hybrid-install-tests.sh

@@ -480,7 +480,7 @@ else
   pass "init no longer dumps raw JSON by default"
 fi
 ( cd "$UN" && "$DKC" doctor --json ) | python3 -c \
-  'import json,sys; d=json.load(sys.stdin); assert d["status"] == "ready"' \
+  'import json,sys; d=json.load(sys.stdin); assert d["status"] == "ready"; assert d["operational_status"] == "ready"' \
   && pass "doctor --json preserves the machine-readable contract" \
   || fail "doctor --json is not valid/ready"
 echo "project-owned requirement" > "$UN/apps/uninstall-project/domain/input/requirement.md"