feat: add repo fleet release trains

Author: solomonneas

CHANGELOG.md

@@ -90,6 +90,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `brigade repos sweep plan/run/runs/show/closeout` for explicit repo-fleet evidence refresh sweeps that run configured local read/report commands, write gitignored sweep receipts, track per-repo command status, and surface stale, failed, or unclosed sweeps through repo, center, work, and release health.
 - `brigade repos report plan/build/list/show/archive/closeout` and `brigade repos actions plan/build/list/show/start/done/defer/archive` for local repo-fleet operator rollups and reviewed fleet action queues using safe labels, counts, statuses, fingerprints, and receipt labels only.
 - `brigade repos actions dispatch plan/apply`, `dispatch --all-reviewed`, `reconcile`, and `context plan/build` for routing reviewed fleet actions into target repo work imports, building action-scoped context packs, and reconciling target repo completion evidence back into the local fleet queue.
+- `brigade repos release plan/build/list/show/compare/closeout/archive` for local fleet release train bundles that collect per-repo release readiness, release candidates, fleet action reconciliation, verification, review, security, and operator evidence into manual-only publish plans without remote mutation.
 - `brigade work sweep closeout <sweep-id|latest>` for reviewable sweep closeout records that block unresolved pending imports, support explicit deferrals, and surface unclosed sweeps through inbox hygiene.
 - `brigade work backup init/status/doctor/import-issues` for read-only local backup health summaries and `backup-health` inbox imports.
 - Backup health checks for stale snapshots, failed or stale checks, failed or stale prunes, missing summaries, overdue restore rehearsals, and unsafe private summary fields.

README.md

@@ -519,8 +519,9 @@ Roadmap and repo-fleet commands:
 - `brigade repos report plan/build/list/show/archive/closeout` builds local fleet operator reports under `.brigade/repos/reports/`, using safe repo ids, labels, counts, statuses, and receipt labels only.
 - `brigade repos actions plan/build/list/show/start/done/defer/archive` turns reviewed fleet reports into local fleet action queues under `.brigade/repos/actions/` without executing the suggested commands.
 - `brigade repos actions dispatch plan/apply`, `dispatch --all-reviewed`, `reconcile`, and `context plan/build` route reviewed fleet actions into target repo work imports, build action-scoped context packs, and reconcile target repo progress back to the fleet action queue without promoting, running, fixing, cloning, or mutating remotes.
+- `brigade repos release plan/build/list/show/compare/closeout/archive` builds local fleet release train bundles under `.brigade/repos/releases/`, classifies each configured repo as ready, blocked, needing review or dispatch, in progress, stale, missing a release candidate, or deferred, and writes a manual-only publish checklist without pushing, tagging, publishing, or mutating remotes.
 
-Repo fleet and pattern registry output is local and privacy preserving. It records presence, counts, labels, fingerprints, command labels, log labels, and receipt references, but does not copy repo guidance files, private paths, raw logs, scanner output, private config, owner names, exact private repo names, or raw evidence into public artifacts. Fleet sweeps run only explicit foreground local read/report commands, never clone, pull, push, fix, promote, dismiss, or mutate remotes.
+Repo fleet and pattern registry output is local and privacy preserving. It records presence, counts, labels, fingerprints, command labels, log labels, and receipt references, but does not copy repo guidance files, private paths, raw logs, scanner output, private config, owner names, exact private repo names, or raw evidence into public artifacts. Fleet sweeps and fleet release trains run only explicit foreground local read/report commands, never clone, pull, push, tag, publish, fix, promote, dismiss, or mutate remotes.
 
 Code review producer commands:
 

ROADMAP.md

@@ -46,7 +46,7 @@ Goal: make Brigade a safe target for local automations that discover useful work
 - Check local release readiness before publish operations. Status: implemented with `brigade release plan`, `doctor`, `run`, `runs`, and `show`, collecting work closeout, verification, review, scanner, security, handoff, content-guard, docs, changelog, roadmap, and git-state evidence without pushing, tagging, or mutating remotes.
 - Build local release candidate packets before manual publish steps. Status: implemented with `brigade release candidate plan/build/list/show/archive`, local candidate bundles, evidence JSON, release notes drafts, manual-only publish plans, candidate health warnings, and no remote mutation.
 - Audit roadmap closure and neutral pattern coverage. Status: started with `brigade roadmap audit`, `brigade roadmap patterns`, stale phase warnings, documented command drift checks, roadmap-audit imports, and source-pattern decision records without public reference names.
-- Inspect local repo fleet readiness without copying private repo contents. Status: started with gitignored `.brigade/repos.toml`, `brigade repos init/list/show/scan/doctor/import-issues`, `brigade repos sweep plan/run/runs/show/closeout`, `brigade repos report plan/build/list/show/archive/closeout`, `brigade repos actions plan/build/list/show/start/done/defer/archive`, `brigade repos actions dispatch`, `brigade repos actions reconcile`, and `brigade repos actions context`, using safe metadata summaries, explicit fleet evidence sweeps, local fleet reports, reviewed fleet action queues, per-repo work import dispatch, action-scoped context packs, AGENTS and fallback guidance detection, repo-fleet imports, and daily-loop health surfacing.
+- Inspect local repo fleet readiness without copying private repo contents. Status: started with gitignored `.brigade/repos.toml`, `brigade repos init/list/show/scan/doctor/import-issues`, `brigade repos sweep plan/run/runs/show/closeout`, `brigade repos report plan/build/list/show/archive/closeout`, `brigade repos actions plan/build/list/show/start/done/defer/archive`, `brigade repos actions dispatch`, `brigade repos actions reconcile`, `brigade repos actions context`, and `brigade repos release plan/build/list/show/compare/closeout/archive`, using safe metadata summaries, explicit fleet evidence sweeps, local fleet reports, reviewed fleet action queues, per-repo work import dispatch, action-scoped context packs, fleet release train bundles, AGENTS and fallback guidance detection, repo-fleet imports, and daily-loop health surfacing.
 - Close out scanner sweeps after review. Status: started with `brigade work sweep closeout <sweep-id|latest>`, deferred import recording, missing-reference blocking, and inbox hygiene warnings for unclosed sweeps.
 - Inspect local operator state from one read-only center view. Status: started with `brigade center status/activity/reviews/templates`, `brigade center report plan/build/list/show/archive/review/compare/closeout`, and `brigade center actions plan/build/list/show/start/done/defer/archive`, aggregating local work, imports, sweeps, reviews, handoffs, tools, learning, context packs, projects, security, and release state into JSON, reviewed action queues, closeouts, and local report bundles without a daemon or server.
 

docs/operator-center.md

@@ -115,6 +115,8 @@ Each action stores:
 
 `brigade repos actions dispatch plan/apply`, `dispatch --all-reviewed`, `reconcile`, and `context plan/build` connect those local fleet actions to each target repo's existing work import and context pack paths. Dispatch writes only gitignored target repo Brigade state, never promotes the import, never runs work, and never executes suggested commands. Reconciliation reads target repo imports, tasks, closeouts, release receipts, and operator reports, then updates local fleet action metadata.
 
-Center status, center reviews, work brief, work doctor, release doctor, and release evidence include fleet sweep, fleet report, fleet action queue, dispatch, and reconciliation health.
+`brigade repos release plan/build/list/show/compare/closeout/archive` creates local fleet release train bundles under `.brigade/repos/releases/`. Release trains aggregate per-repo readiness, candidates, fleet action reconciliation, verification, review, security, operator reports, and dirty-state counts into a manual-only publish plan. They classify repos as ready, blocked, needing review or dispatch, in progress, stale, missing a release candidate, or deferred. Compare and closeout keep the train reviewable without pushing, tagging, publishing, or mutating remotes.
+
+Center status, center reviews, work brief, work doctor, release doctor, and release evidence include fleet sweep, fleet report, fleet action queue, dispatch, reconciliation, and fleet release train health.
 
 The operator center never invokes scanners, tools, reviewers, handoff ingestion, release publishing, git commands that mutate state, or remote APIs. Only `center report build`, `center report archive`, and `center actions build/start/done/defer/archive` write local gitignored center files.

docs/release-candidates.md

@@ -44,6 +44,14 @@ These are warnings because candidate bundles are review artifacts. They do not r
 
 Release readiness, candidate bundles, and candidate compare include operator report health so an operator can tell whether the local daily review packet is fresh and closed out before publishing manually.
 
+## Fleet Release Trains
+
+`brigade repos release plan/build/list/show/compare/closeout/archive` coordinates release readiness across configured local repos. Fleet release train bundles live under `.brigade/repos/releases/` and include `FLEET_RELEASE_TRAIN.md`, `FLEET_RELEASE_EVIDENCE.json`, and `MANUAL_PUBLISH_PLAN.md`.
+
+The train evidence uses safe repo ids, safe labels, local ids, statuses, counts, fingerprints, receipt labels, and suggested next commands only. It collects per-repo release readiness, release candidates, fleet action reconciliation, verification, review, security, and operator evidence, then classifies each repo as ready, blocked, needing review or dispatch, in progress, stale, missing a release candidate, or deferred.
+
+The fleet publish plan is manual-only. It can include checklist labels for verification, release doctor, candidate compare, tagging, pushing, and release creation, but Brigade does not run those commands or mutate remotes.
+
 ## Boundary
 
-Release candidate commands are local and explicit. Brigade does not push, tag, create GitHub releases, mutate pull requests, edit changelogs outside the candidate bundle, upload artifacts, approve content-guard findings, start daemons, install schedulers, or store secrets.
+Release candidate and fleet release train commands are local and explicit. Brigade does not push, tag, create releases, mutate pull requests, edit changelogs outside generated local bundles, upload artifacts, approve content-guard findings, start daemons, install schedulers, or store secrets.

docs/repo-fleet.md

@@ -36,6 +36,13 @@ brigade repos actions dispatch --all-reviewed
 brigade repos actions reconcile [fleet-action-id]
 brigade repos actions context plan <fleet-action-id>
 brigade repos actions context build <fleet-action-id>
+brigade repos release plan
+brigade repos release build
+brigade repos release list
+brigade repos release show <train-id>
+brigade repos release compare <train-id|latest>
+brigade repos release closeout <train-id|latest>
+brigade repos release archive <train-id>
 ```
 
 Fleet reports are written under:
@@ -56,6 +63,12 @@ Fleet sweep receipts are written under:
 .brigade/repos/sweeps/
 ```
 
+Fleet release train bundles are written under:
+
+```text
+.brigade/repos/releases/
+```
+
 Fleet reports include safe repo ids, safe labels, status counts, blocker and warning counts, top pending action summaries, receipt labels, and suggested next commands. Fleet actions store local metadata only: repo id, safe label, source subsystem, source local id, status, priority or severity, safe summary, suggested command, timestamps, and source fingerprint.
 
 `brigade repos sweep plan` shows which configured repos would be refreshed and which read-only local Brigade commands would run. `brigade repos sweep run` executes the configured foreground refresh for selected repos, records per-repo command summaries, and stores raw stdout and stderr only in gitignored local logs. Receipt JSON uses repo ids, safe labels, command labels, status counts, fingerprints, and local log labels. It does not store exact repo paths.
@@ -83,10 +96,17 @@ Dispatch is idempotent by fleet action id and source fingerprint. Repeated dispa
 
 `brigade repos actions reconcile` reads target repo work imports, promoted tasks, completed tasks, closeouts, release readiness receipts, and operator reports, then updates local fleet action metadata. Reconciliation states include `dispatched`, `in-progress`, `completed`, `dismissed`, `superseded`, `stale`, and `broken-reference`. Completed target tasks mark the fleet action done. Repo fleet health also warns when safe target evidence changes after dispatch. No suggested command is executed.
 
+`brigade repos release plan/build/list/show/compare/closeout/archive` coordinates release readiness across configured repos without publishing anything. A release train collects safe per-repo evidence from fleet sweeps, fleet reports, fleet action reconciliation, target repo operator reports, work closeouts, verification receipts, review closeouts, security closeouts, release readiness receipts, release candidates, dirty tracked counts, and ahead or behind labels when available.
+
+Each repo is classified as `ready`, `blocked`, `needs-review`, `needs-dispatch`, `in-progress`, `stale-evidence`, `no-release-candidate`, or `deferred`. `build` writes `FLEET_RELEASE_TRAIN.md`, `FLEET_RELEASE_EVIDENCE.json`, and `MANUAL_PUBLISH_PLAN.md`. The publish plan contains placeholders and manual-only checklist steps for verification, release doctor, candidate compare, tags, pushes, and release creation. Brigade does not execute any publish step.
+
+`brigade repos release compare <train-id|latest>` checks whether captured repo HEAD labels changed, newer release readiness or candidate receipts exist, fleet action reconciliation changed, referenced safe receipt ids disappeared, or unresolved fleet action state changed. `closeout` records `reviewed`, `deferred`, `superseded`, or `archived` status. Repo doctor, center status, center reviews, work brief, work doctor, and release doctor surface blocked, stale, or unclosed release train state.
+
 Privacy boundaries:
 
 - No cloning.
 - No remote mutation.
+- No push, tag, release, PR, visibility, transfer, or archive mutation.
 - No automatic action execution.
 - No automatic promotion or dismissal.
 - No automatic target task promotion, work run, or code fix.

docs/roadmap-completion-plan.md

@@ -152,6 +152,7 @@ Implementation scope:
 - Import issues into the scanner inbox as `source: repo-fleet`.
 - Refresh safe local evidence explicitly through fleet sweeps that run configured read/report commands, write local receipts, and feed reports and action queues without cloning, fixing, promoting, or mutating remotes.
 - Route reviewed fleet actions into target repo work imports and reconcile target repo progress back into the fleet queue without automatic promotion, work execution, fixes, cloning, or remote mutation.
+- Coordinate local fleet release trains from safe per-repo release readiness, candidate, verification, review, security, operator, and fleet action evidence without pushing, tagging, publishing, or mutating remotes.
 
 Acceptance:
 
@@ -162,6 +163,7 @@ Acceptance:
 - Tests cover fleet sweep plan/run/runs/show/closeout text and JSON, filtering, stale-only selection, failed-repo isolation, safe log labels, and daily-loop integration.
 - Tests cover fleet report plan/build/list/show/archive and fleet action plan/build/list/show/start/done/defer/archive text and JSON.
 - Tests cover fleet action dispatch, idempotency, dismissed-until-changed behavior, changed-fingerprint superseding, action context packs, reconciliation states, and daily-loop integration.
+- Tests cover fleet release train plan/build/list/show/compare/closeout/archive text and JSON, per-repo classifications, bundle evidence, manual-only publish plans, compare warnings, closeout states, daily-loop integration, and release-doctor integration.
 - Tests prove private repo names, owner names, org names, local paths, and raw evidence are not copied into public docs, fixtures, imports, handoffs, release evidence, or committed diffs.
 
 Phase 35 status:
@@ -191,6 +193,14 @@ Phase 42 status:
 - Action-scoped context packs are written in the target repo under `.brigade/context/packs/` with safe summaries, guidance presence, receipt labels, dispatch state, and explicit private-evidence exclusions.
 - Reconciliation reads target repo imports, tasks, work closeouts, release readiness, and operator reports, then records `dispatched`, `in-progress`, `completed`, `dismissed`, `superseded`, `stale`, or `broken-reference` state on the fleet action.
 
+Phase 43 status:
+
+- Implemented command surface: `brigade repos release plan/build/list/show/compare/closeout/archive`.
+- Fleet release trains write local `FLEET_RELEASE_TRAIN.md`, `FLEET_RELEASE_EVIDENCE.json`, and `MANUAL_PUBLISH_PLAN.md` bundles under `.brigade/repos/releases/`.
+- Release train evidence classifies configured repos as `ready`, `blocked`, `needs-review`, `needs-dispatch`, `in-progress`, `stale-evidence`, `no-release-candidate`, or `deferred`, using safe repo ids, labels, counts, fingerprints, receipt labels, and suggested next commands only.
+- Compare detects changed repo HEAD labels, newer release readiness, newer release candidates, changed fleet action reconciliation, missing safe receipt ids, and unresolved state changes.
+- Closeout records `reviewed`, `deferred`, `superseded`, or `archived` state. Repo doctor, center status, center reviews, work brief, work doctor, and release doctor surface blocked, stale, or unclosed release train health.
+
 ### 3. Inspiration Pattern Registry
 
 Deliverable: a bounded local record of external workflow patterns Brigade intends to support.

src/brigade/center_cmd.py

@@ -407,7 +407,8 @@ def _reviews(target: Path) -> list[dict[str, Any]]:
     repo_report = repo_health.get("report") if isinstance(repo_health.get("report"), dict) else {}
     repo_actions = repo_health.get("actions") if isinstance(repo_health.get("actions"), dict) else {}
     repo_sweep = repo_health.get("sweep") if isinstance(repo_health.get("sweep"), dict) else {}
-    for bucket, command in ((repo_report, "brigade repos report build"), (repo_actions, "brigade repos actions list"), (repo_sweep, "brigade repos sweep run")):
+    repo_release = repo_health.get("release_train") if isinstance(repo_health.get("release_train"), dict) else {}
+    for bucket, command in ((repo_report, "brigade repos report build"), (repo_actions, "brigade repos actions list"), (repo_sweep, "brigade repos sweep run"), (repo_release, "brigade repos release build")):
         top = bucket.get("top_issue") if isinstance(bucket.get("top_issue"), dict) else None
         if top:
             items.append(_item("repo-fleet", str(top.get("name") or "repo-fleet"), str(top.get("status") or "warn"), str(top.get("detail") or "repo fleet issue"), str(top.get("suggested_next_command") or command)))