[aniaisec]

Developers currently encounter setup failures when discovery or replay starts. Add cua doctor --tenant local to check prerequisites first, with text or versioned JSON reports, stable finding codes, actionable remedies, and exit codes 0 (ready for checked prerequisites), 1 (failed checks), and 64 (malformed invocation/project).

• Check project/configuration versions, platform/adapter, dependencies, Chromium executables, tenant/policy/family validity, capability compatibility and approval records, credential binding/source availability, and runtime directory write access. Diagnostics expose no secret values and create no keys, receipts, or approvals.
• Keep default checks local, with no model calls or application interaction. Add explicit --probe-browser launch/close and --probe-app unauthenticated HEAD checks, with distinct findings for missing executables, denied launches, missing credentials, timeouts, and unreachable applications.
• Update setup and troubleshooting documentation, packaged starter guides, strict browser integration coverage, and the installed-wheel gate.

Validation:

• Full non-browser/non-desktop suite: 988 passed, 1 skipped (Windows symlink privileges), 119 deselected.
• Final doctor regressions: 90 passed, including two malformed HTTP URL cases added after the full suite started.
• Real Chromium/HTTP doctor integration passed in strict browser mode.
• Fresh non-editable wheel checks passed outside the checkout: resources, all three templates, doctor JSON/browser probe, mock HTML, and the seven-stage demo. Replay used zero model calls and made exactly one consented commit.
• Ruff lint/format, strict Linux/Windows mypy (150 source files), and diff checks passed.

Live Windows UIA and hosted Linux CI were not executed locally; desktop session readiness remains a manual check.