v0.25.0

Python package: brigade-cli==0.25.0

v0.24.0

Added

• brigade version --components reports managed native component installation state, with Windows native acceptance for supported paths.
• GraphTrail v0.4.0 and MiseLedger v0.6.0 source now live under engines/. Standalone repositories and release pipelines remain unchanged until Phase 4.
• brigade.code-reference.v1 defines exact code-reference evidence lookups before lexical fallback.
• brigade code sync|context|impact and brigade evidence crawl|search|doctor now execute the imported engines. brigade search aliases remain for two minor releases or 90 days, whichever is longer.

Fixed

• brigade run terminalizes interrupted and stale runs, refuses read-only execution on incapable seats, and rejects empty tasks.

Full details: CHANGELOG.md

v0.23.3

Post-install smoke now accepts the command-list help output produced by sessionfind v0.6.0 while retaining legacy usage-text compatibility. Clean Windows setup succeeds without Go or Cargo. See #355 and PR #372.

v0.23.2

Post-install smoke now accepts sessionfind v0.6.0's successful --help exit while retaining absolute managed-path and usage-text validation. See #355 and PR #370.

v0.23.1

Added

• Versioned component manifest v1 with pinned GraphTrail platform artifacts and provenance checks. (#353 / PR #367)
• brigade setup installs those pinned native components transactionally, with dry-run, offline cache, rollback, smoke checks, and state recording. (#355 / PR #368)

Changed

• Clarified cross-platform installation documentation. (#351)

v0.23.0

Fixed

• ACPX late permission prompts after a completed end_turn answer no longer discard the usable final result. Brigade now preserves the terminal text, stdout/stderr, exit code, session/request metadata, and records a typed transport_warning while marking the worker ok with warning instead of failing the run. Post-permission assistant chunks and permission errors without pre-final text no longer qualify as usable-with-warning. Pre-final permission failures remain failed. Stderr fallback infers late -32072 only when the stream has no structured JSON-RPC error; any structured error takes precedence over stderr markers. (#337)
• proc.run() decodes child stdout and stderr as explicit UTF-8 on every platform, including TimeoutExpired partial output, normalizes missing streams to empty text, preserves recoverable bytes with deterministic UTF-8 replacement, exposes explicit decode status on proc.Result, and surfaces typed harness decode failures through run_agent and ACP without counting a model verdict. Provider, output-validation, and chronology failures stay distinct. (#336)
• Run control selects a supported local transport per platform: Unix-domain sockets remain the default on Linux and macOS when the socket path fits platform limits; otherwise Brigade falls back to authenticated loopback TCP with an ephemeral port. Run metadata records a typed control_transport descriptor for clients, legacy control_socket remains for Unix runs, and malformed descriptors fail closed without leaking private paths or owner tokens into public summaries. (#341)
• Agent adapter detection and dispatch now share one resolved executable identity on Windows, so doctor can mark a seat runnable without run_agent later failing with command not found after discarding an npm shim. Only native .exe files and extensionless paths with a verified PE signature are runnable; .cmd, .bat, and unverified npm shims fail before inference with unsupported-command-shim and path-safe remediation to put the package native executable directory earlier on PATH. Launched provider workspace-trust refusals classify as provider-preflight instead of command resolution, and remaining process-creation failures no longer leak absolute paths. (#340)

Added

• brigade repos adoption separates configured harness wiring from observed work-loop use across the local repository fleet. It reports unwired, partial, advisory-only, enforced-idle, active, bypassed, and stale rows, correlates Claude session writes with brief, verify, outcome, GraphTrail, MiseLedger, and handoff evidence, exposes fleet denominators and stable JSON monitor keys, and provides a read-only repair plan. (#317)

• brigade operator checkup accepts repeatable --surface selectors, lists stable surface names with --list-surfaces, and provides an evidence-loop preset for work receipt integrity and outcome capture, GraphTrail health and receipt deltas, and MiseLedger work-receipt import state. Scoped JSON separates selected_ready from unevaluated overall_ready and reports selected, skipped, and per-surface elapsed data. The default six-doctor checkup is unchanged. (#298)

• The versioned harness-contract.v1 schema provides safe availability and opt-in version probes with bounded, redacted output. Codex Desktop and Cursor GUI remain external-only, while Antigravity availability resolves only the agy and antigravity command candidates without executing vendor commands. (#342)

• Project-scoped Claude Code work-loop hooks can brief once per session and repository, route direct verification commands through Brigade, and check completion receipts after write work. brigade work hooks install|update|status|uninstall manages the package without replacing unrelated Claude settings or hooks.

• brigade receipts export miseledger --json prints a typed brigade.miseledger_export_result.v1 summary (status empty, nothing-new, exported, or failed, plus export/skip/error counts) to stdout while writing JSONL to a named --out file. A zero-receipt non-JSON export exits 0 with no output. --fleet --json runs the same export across enabled [[repo]] entries from .brigade/repos.toml, aggregates rows into one batch, keeps per-repo cursors, imports valid partial output at most once, returns brigade.miseledger_fleet_export_result.v1 with per-repo counts and privacy-safe errors, and treats aggregate import failure as top-level failed without incrementing failed_count. (#254)

• Route as a third outcome-ledger cohort axis (Phase 1: record and surface, no scoring change). brigade outcome capture stamps a coarse route manifest (followed, path, size, sorted signals, coverage) and a route_fingerprint on each record, resolved from the owning brigade run's route. A bare verify-capture with no owning run is the honest unrouted cohort. brigade outcome explain splits records into routed-vs-unrouted cohorts with a help-rate, so the ledger can finally answer whether runs that followed a composed route verify greener. Ratchet unchanged; see docs/design/route-outcome-cohort.md.

• Recency-weighted outcome ranking (context-aware outcomes follow-up): outcome rank --recency (default half-life 45 days, --recency-half-life DAYS to override) weights the score it sorts by over recency-weighted counts, so a signal's weight halves every half-life and credit earned under a drifted-away environment fades without rewriting the append-only log. It applies to the pooled score by default and the capability-shrunk score with --by-capability; the two flags compose. Off by default, so rank output stays byte-identical. The Wilson bound and shrinkage prior now accept fractional counts; the promotion ratchet never uses recency. See docs/design/context-blind-spot.md.

v0.22.0

Fixed

• Security health and release readiness now honor the latest accepted-risk closeout by exact finding fingerprint, while new or changed findings become active again. Harness-wiring health also follows the configured template-inclusion policy instead of blocking a release on excluded managed-template URLs.
• Route calibration from a task corpus: a docs rewrite (rewrite the QUICKSTART) no longer takes the full code route (a bare rewrite/redesign no longer beats a docs hint), UI words panel/dashboard/sidebar/widget/view/tooltip now pull the UI review lenses, and a migration earns tests the way an auth change does.
• Route derivation no longer misroutes conventional-commit code work as docs: fix(install): ... referencing docs and feat(skills): ship ... CHANGELOG.md route as code, while prose like fix typo in README and fix(docs): ... stay docs. A code fix losing its review lenses to a stray "docs" keyword was the one misroute direction that cost coverage.

Added

• brigade run --route-signal +auth-surface / ~ship-requested and the same flag on brigade route force-add or suppress a derived route signal when the heuristic is wrong on one task, a middle ground short of --no-route. Forced signals still pull their dependents (a forced +auth-surface earns tests and a security review).
• brigade route --json now carries triggered_by (the live signal that pulled each stage in) and overrides, alongside the existing signals/approvals/route/waves/held.
• Property tests fuzz the router over 2,000 random catalogs, asserting the invariants a route must always hold (held stages never route, inputs always satisfiable, waves a strict topological order, cycles raise). Plan attempts now record unknown_covers: a covers tag naming a stage not in the route is surfaced instead of silently ignored.
• --route-signal refuses to add or suppress a path signal (code/docs/system): the path is a derive-time decision, and stripping it collapsed the route to a pathless remnant. Found by dogfooding the new latent-premises review skill against the router's own diff.
• brigade run --wait[=SECONDS] can wait for an active per-target run lock with a finite timeout; lock conflicts remain fail-fast unless the flag is present.
• Explicit adapter execution modes keep read-only and writable CLI flags aligned, reject unsupported direct Cursor Composer plan runs, and point those seats to the reviewed ACP transport. Authenticated ACP checks passed composer-2.5 and grok-4.5; Brigade does not rewrite the direct-only grok-4.5-xhigh alias because acpx exposes no separate reasoning flag.
• The GraphTrail personalized ranking benchmark corpus adds checked synthetic MRR and latency thresholds; the managed snapshot pins that reviewed revision.
• Internal typed run transport and receipt modules separate adapter execution from artifact writing without changing CLI or artifact contracts.
• Capability-aware outcome scoring (Phase 2 of context-aware outcomes): outcome rank and outcome explain resolve the current runtime capability and score each artifact's content-current records earned under it, with a thin cohort pulled toward the pooled rate by deterministic shrinkage (helped + kappa*pooled_rate)/(total + kappa) (one documented kappa=4.0). outcome rank --by-capability sorts by "what worked under my current context" (shrunk estimate, then on-capability sample size, then pooled). Records with no capability fingerprint are grandfathered into the current-capability cohort, so a pre-context ledger's default rank/explain output stays byte-identical until signals under a different capability accumulate. The default sort and the promotion ratchet are unchanged; the ratchet still scores the pooled current-fingerprint cohort only. Recency decay and a regression-attribution guard are tracked as follow-ups in docs/design/context-blind-spot.md.
• Runtime-context manifest on outcome records (Phase 1 of context-aware outcomes): outcome capture and outcome record now stamp each new record with a coarse context manifest (Brigade version, interpreter major.minor, platform, plus best-effort harness and model tagged with their source) and a capability_fingerprint over the low-cardinality vector {harness, model_family, python, platform}. outcome explain surfaces a per-capability breakdown. This is capture-and-surface only: scores, rank order, and the promotion ratchet are unchanged, and records without a manifest are grandfathered. A content hash cannot see the harness a signal was earned under; this is the data foundation for cohort-aware scoring. Design and three-model rationale in docs/design/context-blind-spot.md.
• Transitive card-link fingerprints: a card's content_fingerprint now folds in the transitive closure of the cards it [[links]] (each reachable card's content hash), so editing a linked card invalidates every card that reaches it, the same logic_tracking idea applied to memory cards. The walk is cycle-safe, deterministic, and tolerant of dead links (a [[missing]] link contributes nothing until that card exists). A card with no resolvable links hashes to exactly sha256(card content), byte-identical to the prior scheme, so existing single-card records are never invalidated.
• Skill bundle fingerprints (the ledger's logic_tracking): a skill's content_fingerprint now covers its whole bundle (every file's path plus content hash, skipping .DS_Store and the skill.json sidecar), so editing a bundled helper invalidates the skill's signals the same way editing SKILL.md does. A skill whose only content file is SKILL.md hashes to exactly sha256(SKILL.md), byte-identical to the prior scheme, so existing single-file records are never invalidated. Cards stay single-file; transitive [[wiki-link]] tracking remains future work.
• Fingerprint-aware promotion ratchet: outcome reconcile and outcome fork now score the current-fingerprint cohort when deciding, so an edited skill must re-earn install_min_helped against the text that now ships instead of coasting on signals for text that no longer exists. The decision rules (thresholds, cooldown, forward-only ratchet) are unchanged; only the score fed in narrows, and grandfathering keeps a never-edited artifact's decision, receipt, and output byte-identical to before. Decisions that drop proven-stale evidence carry audit fields (content_fingerprint, lifetime_*, stale_records, legacy_records).
• Skill content fingerprints in the outcome ledger (CocoIndex's memo-key idea applied to the ratchet): outcome capture and outcome record stamp each new record with the SHA-256 of the artifact's content (content_fingerprint, the installed copy first and the registry master as fallback), and outcome rank / outcome explain default to a score that drops proven-stale records (fingerprinted against a different revision) while keeping lifetime counts visible, so an edited skill earns its score back instead of inheriting signals for text that no longer exists. Pre-fingerprint records are grandfathered into the current score, so a never-edited skill keeps its score and rank output stays byte-identical until a skill is actually edited. The ledger remains append-only and the digest chain unchanged; reconcile/promotion rules are untouched.
• Deterministic route brief for brigade run: route_catalog.derive_signals maps the task to signals (auth surface, UI, migration, bug, docs, system, ship request), a pure-function router (brigade/router.py, algorithm adapted from alp-river, MIT) composes the required stages into dependency-ordered parallel waves with while/until holds, and the plan prompt carries the result. Plans tag assignments with covers; a plan missing required stages gets one corrective retry, and gaps are recorded in plan-attempts.json rather than failing the run. The route lands in run.json telemetry. Opt out with brigade run --no-route; release a held ship stage with --approve-ship.
• brigade route <task> [--template --changed-path --approve-ship --json] shows the composed route for a task: signals, stages with the signal that pulled each in, parallel waves, and held stages. At run time the route also reads git-changed paths (segment-matched) and an optional --route-template hint.
• Registry skills latent-premises (unguarded-assumption review across input/contract/environment/ordering/cardinality) and retry-safety (side-effect re-run safety, migration deploy-window lens), vendored from skillet.
• brigade stations verify <path> checks an explicitly selected station.json without running install commands. On POSIX, read-only surfaces and narrowly checked help/version probes run without a shell in an isolated temporary home, with process-group cleanup, finite positive timeouts, strict JSON parsing, and a 64 KiB combined output ceiling. Windows fails closed before probe creation. JSON results omit raw child output, control characters are removed from details, unreadable manifests return structured exit 2, and managed-catalog drift is advisory unless --check-managed is set.

v0.21.1

Added

• Embedded memory-doctor verbs under brigade memory: status, lint (dead wiki-links), compact (flatten/tighten MEMORY.md), and init-git. Also available as python -m brigade.memory_doctor. Handoff promotion stays on brigade ingest.
• Search station CLI: brigade search status|doctor and review-only sync plan for GraphTrail plus optional code-search. Shared station health schema (station_health) powers status/doctor/plan across stations.
• Tokens station CLI: brigade tokens status|doctor and review-only wire plan for Token Glace (current name; TokenJuice is the old name) plus optional usage-tracker managed tool under the tokens station.
• brigade stations discover finds local station.json catalogs (brigade.station.v1) and prints brigade add <path> next commands.
• Plating managed tool under the guard station for optional demo render / leak scan / drift verify helpers.
• Evidence station CLI: brigade evidence status|doctor, review-only crawl plan and export plan, and brigade add evidence next-step banner. MiseLedger stays a process-boundary Go binary; crawl/import are operator-run.
• Pantry station first-class path: brigade pantry doctor, status/expiry/setup plans emit explicit next commands and product docs links, and brigade add pantry prints the multi-machine setup sequence. Agent Pantry stays a process-boundary Go sidecar.
• MCP adapter for Hermes: user-scoped ~/.hermes/config.yaml under mcp_servers (YAML subset, zero-dep surgical merge). Requires --user-scope.
• MCP adapters for Grok CLI: project .grok/config.toml (grok) and user ~/.grok/config.toml (grok-user, requires --user-scope). Same Codex-like [mcp_servers.<name>] TOML shape. (#183)

Fixed

• Release preflight now bumps and synchronizes every version stamp before the full verification and cold-start gates, and the checklist confirms the published PyPI version after tagging.
• MCP Codex/Grok empty-args fingerprint conflicts: to_provider no longer emits args: [], matching TOML render which omits empty arrays, so force-sync stays idempotent. (#181)
• MCP import of url-only servers no longer lands as invalid stdio+url; coerce to http/sse, including OpenClaw sources with a bogus transport: stdio or a command that is actually a URL. (#182)
• Productized GraphTrail ↔ Brigade ↔ MiseLedger dogfood path: brigade operator checkup reports optional loop health (graph / ledger / last and mean brief_hit_rate from run receipts) without blocking readiness; brigade add graphtrail installs the code-graph tool under the search station; QUICKSTART documents install → checkup → export → rank.
• Outcome rank/reconcile surfaces mean context_eval.brief_hit_rate per skill as a quality signal (secondary sort among equal Wilson scores; install/rollback thresholds still use verified exit codes only).
• brigade-work skill teaches the full loop: verify with capture → outcome from run → MiseLedger export → evidence brief next time.
• brigade add accepts a managed tool name (e.g. graphtrail) as well as a station name, so optional loop sidecars install without pulling every tool on the station.

Changed

• Memory station no longer installs the external memory-doctor package. Maintenance is built into brigade-cli; bootstrap-doctor remains an optional sidecar for OpenClaw prefix trim.

v0.21.0

Added

• Verified binary pins for runbooks: a runbook can pin each step's binary by sha256, runbook plan shows pin status without executing, runbook run refuses on mismatch unless --allow-pin-mismatch is passed and records the check (and any override) in the receipt, and brigade runbook pin <runbook.json> writes pins from the current binaries. Unpinned runbooks behave exactly as before. (#156)
• Tamper-evident receipts: verify, runbook, and outcome artifacts carry a sha256 digests block binding the receipt payload and every referenced log file; memory/outcome/records.jsonl is hash-chained with prev_digest/digest so an edited or deleted middle record breaks visibly; brigade receipts verify walks everything and reports OK, MISMATCH, MISSING, or legacy, wired into brigade doctor and outcome doctor. Pre-existing artifacts report as legacy, not failures. (#157)
• Optional receipt signing: brigade receipts keygen writes a local 0600 key, receipts then carry an HMAC-SHA256 signature and key_id over the receipt digest, and receipts verify reports SIGNED-OK, flips SIGNATURE-MISMATCH nonzero, or marks foreign-key signatures unverifiable. Without a key, receipts are byte-identical to before. (#164)
• Code-graph delta receipts: verify runs and brigade run snapshot the target's GraphTrail database (WAL-safe), re-sync and diff after, and attach a compact code_graph_delta summary to the receipt with the full diff as a digest-covered graph-delta.json sidecar. Snapshots are deleted after the diff with their sha256s kept as attestations. Fail-open everywhere; read-only, dry-run, and --no-code-graph runs skip capture. (#158)
• MiseLedger receipt export: brigade receipts export miseledger emits one miseledger.adapter.v1 JSONL line per verify-run and run receipt, with raw.hash reusing the receipt digest so re-imports dedupe on content identity. --new-only adds a cursor so reruns export only new receipts, and --import pipes the export straight through miseledger import adapter, fail-open when the binary is absent and skipping the import subprocess entirely when nothing new was exported. (#159, #162, #165)
• Git provenance on receipts: verify receipts and run payloads capture head, branch, and dirty_files inside the digest-covered content, and the MiseLedger export emits the GitHub commit URL as a link. (#162)
• Delta-aware outcome ledger: outcome capture copies the receipt's compact code-graph delta onto the hash-chained record, outcome capture --run-receipt <run-id|latest> captures from run receipts (where code actually changes) with status mapped to signal, and outcome rank/reconcile report graph: N changing / M no-op per subject. Promotion decision rules are unchanged. (#163, #169)
• Context evals on run receipts: when a run had a code-graph brief and its delta captured cleanly, context_eval records whether the pre-run context named the files the run actually touched (hits, missed, brief_hit_rate). Absent when there is no brief, no clean delta, or nothing changed. (#167)
• Evidence briefs close the receipts-to-context loop: brigade run can attach a capped, fail-open brief of recent verified evidence for the target repo pulled from MiseLedger, always framed as untrusted evidence rather than instructions, gated by --no-evidence, and recorded in run.json. brigade work import context --from-miseledger '<query>' runs the same fetch on demand. (#171)
• Workflow sequence scanner: mines run artifacts for recurring command sequences and proposes runbooks (with empty pin stubs) from what operators actually repeat. (#155)
• Detached run control: brigade run --detach, live watch, and steer/interrupt verbs for app-server runs. (#154)
• Vendored content-guard under brigade.guard, added python -m brigade.guard and brigade guard ..., and packaged the guard policies so scrub works without a separate checkout. (#166)

Changed

• brigade scrub now defaults to the embedded brigade.guard scanner and policy set. Setting CONTENT_GUARD_DIR still preserves the old external checkout behavior, including python -m content_guard with that checkout's src on PYTHONPATH. (#166)

Fixed

• Run receipts are written atomically, closing a race where a concurrent reader could catch a partially written run.json. (#161)
• Friction imports use shared import identity keys, so re-imports no longer duplicate items. (#153)
• The technical guide no longer overstates runbook approval semantics. (#152)

v0.19.0

Added

• Managed station tools now declare machine-readable surfaces: live doctor JSON, bounded markdown briefs, summary JSON, and verify commands where each tool supports them. brigade stations list --json includes those surfaces so profiles can show what a station can feed into automation before it is installed.
• brigade add <path> can discover a local station.json manifest, report its install command and machine surfaces, and refuse to run manifest install commands unless --install is passed. Built-in station installation by station name still works as before.
• brigade run now has a run-level brief budget. Code graph and upstream drift impact briefs are ranked by task type, clipped when needed, and recorded in run.json with attached brief names, sizes, and truncation flags.
• brigade run can attach a fail-open upstream drift impact brief when a repo has a GraphTrail database and pending upstream-drift state. The brief combines drift report excerpts with graphtrail impact output so workers see likely blast radius before editing.
• brigade memory care scan now validates evidence: frontmatter for receipt-like paths and MiseLedger evidence refs, reporting missing-evidence-ref issues and evidence reference counts.
• brigade pantry expiry-alert reports near-expiry Agent Pantry sessions and plans an agent-notify message by default. It sends only when --send is passed.
• brigade outcome rebuild-status, fork, and diff add a drift oracle for outcome receipts. Operators can rebuild status.json from records and compare alternate reconciliation configs without mutating live state.

Changed

• The three largest modules are now packages: repos_cmd (6,417 lines -> 8 files), tools_cmd (6,079 -> 18), and phases_cmd (5,621 -> 7), each behind a facade that preserves the full external surface and monkeypatch semantics; no source file exceeds 2,000 lines. The mypy override list dropped from 45 entries to 21, and type-ratcheting surfaced and fixed four latent defects along the way (a friction-show crash on malformed JSON, a notifications tuple-shape crash, a fleet-health wrong-module read, and a research runner returning an object where callers expected text).
• Agent Pantry health now prefers agentpantry doctor --json, uses the old status JSON as a compatibility fallback, and exposes the new inventory --markdown brief surface for near-expiry session summaries.