# Cron Doctor Spec

## Problem

Scheduled jobs can silently degrade when a script is moved, a workdir disappears,
a provider run fails, or delivery starts failing. `hermes cron list` shows some of
this inline, but there is no compact read-only health check that can be run from a
terminal, cron job, or CI-style smoke check.

## Goal

Add `hermes cron doctor` as a read-only diagnostic command that summarizes cron
job health and exits non-zero when actionable issues are found.

## Non-goals

- Do not mutate jobs or auto-repair state.
- Do not start/stop the gateway.
- Do not inspect secrets or print credentials.

## Acceptance criteria

- `hermes cron doctor` returns `0` and prints a healthy message when active jobs
  have no detected issues.
- It returns `1` and prints grouped job-level issues when any active job has:
  - last run failure (`last_status` not `ok`),
  - last delivery failure,
  - no `next_run_at` while still active,
  - `no_agent` enabled without a script,
  - script path missing/outside `HERMES_HOME/scripts`, or
  - configured workdir path missing.
- Parser, command dispatch, and focused tests cover the new subcommand.