feat: harden roadmap audit phase queue

Author: solomonneas

CHANGELOG.md

@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- `docs/phase-61-100-plan.md` as the public, testable phase queue for roadmap completion hardening.
 - Public `templates/` index that points fresh-start users at the packaged starter templates without exposing local dogfood workspace files.
 - Built-in `brigade doctor` bootstrap budget checks that fail hard when installed bootstrap files exceed conservative byte limits.
 - Built-in `brigade doctor` memory-card budget checks that fail when `memory/cards/*.md` cards become too large.
@@ -148,6 +149,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `brigade run --read-only` prompt policy for planning and review runs that should inspect and recommend only, with native `codex exec --sandbox read-only` enforcement for Codex agents.
 
 ### Changed
+- `brigade roadmap audit` now reads documented commands from command snippets instead of prose and normalizes parameterized examples such as `brigade tools show <id>` to their CLI command path.
+- Roadmap phase headings now distinguish foundations, active work, and the phase queue so stale Current/Next warnings are actionable.
 - Public repo contents now keep live dogfood workspace files, internal planning notes, and root memory cards untracked; public templates remain under `src/brigade/templates/`.
 - Dogfood handoff defaults now use `.codex/memory-handoffs/` for new Codex-driven local configs while preserving explicit configured inbox paths such as `.claude/memory-handoffs/`.
 - Bootstrap truncation is now treated as a hard doctor failure to prevent by moving durable detail into memory cards before agents load context.

README.md

@@ -53,7 +53,7 @@ The cookbook explains the why. This package gives you the kitchen.
 Browse the public template index in [`templates/`](templates/).
 The installable source files live under `src/brigade/templates/`; root workspace files are local dogfood state and stay ignored.
 
-See [`ROADMAP.md`](ROADMAP.md) for the daily-driver, scanner inbox, chat-surface scanner, and memory-card decay roadmap.
+See [`ROADMAP.md`](ROADMAP.md) for the daily-driver, scanner inbox, chat-surface scanner, and memory-card decay roadmap. The active phase queue for roadmap completion hardening is tracked in [`docs/phase-61-100-plan.md`](docs/phase-61-100-plan.md).
 
 ## What you do not get
 

ROADMAP.md

@@ -2,7 +2,7 @@
 
 Brigade is being built as a practical daily workflow first, then a portable setup other people can adapt. The core direction is an organized version of real agent work: one command to start, predictable local artifacts, reviewable memory handoffs, and enough inspection to trust the loop during normal work.
 
-## Current Phase: Daily Driver
+## Foundation: Daily Driver
 
 Status: in progress.
 
@@ -14,7 +14,7 @@ Status: in progress.
 - `brigade work run --queue-next` queues extracted follow-up work without duplicating equivalent pending tasks.
 - `brigade work import add/list/show/promote` gives scanners and wrappers a stable local inbox for candidate work.
 
-## Next Phase: Scanner-Ready Inbox
+## Foundation: Scanner-Ready Inbox
 
 Status: active.
 
@@ -127,7 +127,7 @@ Brigade-specific additions:
 - Track false-positive taxonomy, runtime-confidence rules, suppressions, and regression fixtures as first-class project artifacts. Status: started with `brigade security findings`, `show`, `review`, reasoned suppressions, unsuppress, and stale-suppression doctor warnings.
 - Close out reviewed security findings and accepted risk. Status: started with `brigade security closeout` and local receipts that preserve safe finding ids, fingerprints, suppressions, and accepted-risk status.
 
-## Current Phase: Issue And TDD Work Loop
+## Active Phase: Issue And TDD Work Loop
 
 Goal: make Brigade support a narrow issue lifecycle for daily work: pick one task, define acceptance, test first when practical, implement, review, refactor, and close.
 
@@ -172,3 +172,9 @@ Goal: keep the system usable by the original operator while making it adaptable
 - Provide templates for fresh-start users without publishing private workspace state.
 - Keep public repo docs focused on patterns, commands, and safety contracts.
 - Leave release, tag, push-to-main, and production-impacting actions behind explicit approval gates.
+
+## Active Phase Queue: Roadmap Completion Hardening
+
+Status: active.
+
+The detailed working queue for phases 61-100 lives in [`docs/phase-61-100-plan.md`](docs/phase-61-100-plan.md). The queue focuses on roadmap audit precision, deferred-item ownership, command documentation contracts, cross-producer provenance, privacy regression coverage, chat export hardening, backup and tool closeouts, context and learning receipts, security report compatibility, issue/TDD repair imports, memory and handoff hardening, release evidence schemas, operator-center schemas, fleet release reports, CI platform warnings, install smoke receipts, public template privacy, and a final local operator readiness closeout.

docs/phase-61-100-plan.md

@@ -0,0 +1,212 @@
+# Brigade Phase 61-100 Plan
+
+This plan is the working queue for the next long roadmap completion run. It turns the remaining roadmap gaps, deferred items, and hardening needs into finite phases with testable stop conditions.
+
+## Boundaries
+
+- Keep behavior local, explicit, and receipt-backed.
+- Do not add a daemon, scheduler mutation, hosted UI, database, remote sync, automatic promotion, automatic fixes, automatic memory mutation, automatic publish action, or secret storage.
+- Do not copy private repo names, owner names, org names, private paths, raw chat, raw logs, raw scanner output, hostnames, tokens, webhook URLs, or exact external reference repo names into public docs, fixtures, imports, handoffs, or release evidence.
+- Each phase must update focused tests, docs when public behavior changes, a Memory Handoff when durable knowledge is produced, and the roadmap status when complete.
+
+## Phase Queue
+
+### Phase 61: Roadmap Audit Precision And Phase Queue
+Goal: make `brigade roadmap audit` accurate enough to drive phases 61-100. Normalize documented commands, stop treating prose and parameterized examples as missing CLI commands, close known pattern-owner gaps, and add this phase queue as the public source of truth.
+
+Acceptance: roadmap audit tests cover command normalization, parent-command examples, prose filtering, stale phase behavior, and pattern coverage. README, ROADMAP, CHANGELOG, and this plan document the phase queue.
+
+### Phase 62: Roadmap Ownership And Deferred Item Records
+Goal: add explicit roadmap ownership records for deferred items so later phases can close or re-defer them without ambiguous status text.
+
+Acceptance: roadmap audit JSON includes owner, subsystem, deferred reason, and suggested next phase for known deferred items.
+
+### Phase 63: Public Command Documentation Contract
+Goal: make public docs and CLI command discovery agree through a stable command contract, without relying on fragile prose scans.
+
+Acceptance: tests compare documented command snippets to parser command paths and public docs list every supported top-level command group.
+
+### Phase 64: Cross-Producer Provenance Compatibility Audit
+Goal: audit scanner, backup, memory-care, security, review, tool-catalog, repo-fleet, and learning imports for a common provenance and fingerprint contract.
+
+Acceptance: focused fixtures prove every local producer writes source fingerprints, safe summaries, evidence labels, and dismissed-until-changed metadata.
+
+### Phase 65: Producer Privacy Regression Suite
+Goal: add shared privacy fixtures proving raw private evidence never leaks from producer outputs into imports, handoffs, context packs, release evidence, or public docs.
+
+Acceptance: tests cover chat, backup, security, repo-fleet, context, learning, and release paths with redaction assertions.
+
+### Phase 66: Chat Export Provider Alias Completion
+Goal: complete local export-family aliases for configured chat surfaces while keeping live APIs out of scope.
+
+Acceptance: tests cover alias validation, ingest, import counts, sweep review, task promotion, and handoff promotion for configured export families.
+
+### Phase 67: Backup Closeout Policy And Operator Summary
+Goal: make backup closeouts quiet reviewed risks while surfacing changed fingerprints, stale restore rehearsal evidence, and safe operator status summaries.
+
+Acceptance: tests cover closeout quieting, changed-risk resurfacing, restore rehearsal release evidence, and no private destination leakage.
+
+### Phase 68: Tool Projection Parity Closeout
+Goal: add explicit parity closeout receipts for portable tool projections across configured harnesses.
+
+Acceptance: tests cover current, stale, missing, conflicted, unmanaged, deferred, and reviewed parity states in doctor, brief, and import routing.
+
+### Phase 69: Tool Pack Release Evidence Integration
+Goal: make tool packs and sync plans first-class release evidence without applying projections automatically.
+
+Acceptance: release readiness and candidate tests include tool pack freshness, parity closeout state, approvals, run history, and sync blockers.
+
+### Phase 70: Context Sync Planning Receipts
+Goal: add reviewable context sync plans and receipts for configured harness destinations without writing context files by default.
+
+Acceptance: tests cover context sync plan text and JSON, freshness checks, conflicts, and release/operator-center integration.
+
+### Phase 71: Context Pack Freshness And Import Routing
+Goal: surface stale context packs, missing references, outdated task acceptance, and stale tool references as reviewable imports.
+
+Acceptance: tests cover doctor, work brief, center reviews, release readiness, and `source: context-pack` imports.
+
+### Phase 72: Project Migration Readiness Receipts
+Goal: turn project audit decisions into local readiness receipts for docs, license, security, release, ownership, and migration blockers.
+
+Acceptance: tests cover bake-in, integrate, catalog-only, move-candidate, and leave-alone readiness without remote mutation.
+
+### Phase 73: Project Move Plan Closeout
+Goal: add reviewed closeout for manual-only project move plans so deferred moves do not stay noisy unless fingerprints change.
+
+Acceptance: tests cover reviewed, deferred, superseded, archived, changed-fingerprint, and import routing states.
+
+### Phase 74: Learning Accepted-Risk And Dismissal Quieting
+Goal: add source-aware quieting for learning candidates that become accepted risk, dismissed, archived, or deferred.
+
+Acceptance: tests cover scanner, security, review, tool, handoff, memory-care, backup, and release learning candidates.
+
+### Phase 75: Learning Replay Compare Receipts
+Goal: compare learning replay receipts before and after code, rule, or policy changes without editing memory or source automatically.
+
+Acceptance: tests cover replay export, replay compare, redaction, release evidence, and center reviews.
+
+### Phase 76: Dependency-Free Security SARIF Export
+Goal: add SARIF output for security findings if it can be implemented with no dependencies, otherwise record a precise deferral.
+
+Acceptance: tests cover SARIF schema shape or a documented deferral with release evidence and roadmap status.
+
+### Phase 77: Agent Instruction Guardrail Fixtures
+Goal: expand security fixtures for repo guidance, skills, slash commands, subagents, tool wrappers, and prompt-injection risks.
+
+Acceptance: tests cover guardrail categories, runtime confidence, public-template treatment, and safe remediation imports.
+
+### Phase 78: Security Policy Pack Closeouts
+Goal: make personal, public-repo, CI, and strict security policy packs reviewable with accepted-risk closeouts.
+
+Acceptance: tests cover policy-specific blockers, warnings, suppressions, accepted risk, release readiness, and release candidates.
+
+### Phase 79: Repo-Shareable Workflow Rule Templates
+Goal: add public-safe workflow rule templates for issue/TDD loops without embedding personal preferences.
+
+Acceptance: tests cover install output, docs, privacy scan, and work doctor visibility.
+
+### Phase 80: Stale Active Issue Repair Imports
+Goal: route stale active issue context and closed remote issue mismatches into repairable local imports.
+
+Acceptance: tests cover issue-backed tasks, missing issue context, closed remote issue checks, and no GitHub mutation.
+
+### Phase 81: Task Acceptance Release Rollup Hardening
+Goal: improve acceptance coverage rollups across pending tasks, completed tasks, review findings, work closeouts, release readiness, and release candidates.
+
+Acceptance: tests cover acceptance gaps, completion metadata gaps, review-finding task outcomes, and release evidence.
+
+### Phase 82: Memory Card Freshness Metadata Review
+Goal: make memory-care status explain missing or stale freshness metadata without editing memory cards.
+
+Acceptance: tests cover reviewed dates, freshness dates, confidence, evidence metadata, and memory-care imports.
+
+### Phase 83: Memory-Care Safe Autofix Planning
+Goal: add planning only for low-risk memory metadata repairs, with no automatic memory mutation.
+
+Acceptance: tests cover safe plans, blocked plans, raw evidence exclusion, and handoff/task review paths.
+
+### Phase 84: Handoff Ingest Warning Parser Hardening
+Goal: improve local parsing of ingestor warning logs including no-reply, skipped, failed, malformed, and unreachable-source states.
+
+Acceptance: tests cover normalized receipts, draft reconciliation, repair imports, and daily brief quieting.
+
+### Phase 85: Handoff Source Coverage Repair Flow
+Goal: turn uncovered handoff inboxes and source config drift into reviewed work imports and closeouts.
+
+Acceptance: tests cover source coverage doctor, imports, dismissed-until-changed behavior, and no canonical memory edits.
+
+### Phase 86: Release Evidence Schema Manifest
+Goal: add a machine-readable schema manifest for release readiness, candidates, train bundles, waivers, and evidence records.
+
+Acceptance: tests cover schema manifest generation, missing receipt detection, and wrapper-friendly JSON.
+
+### Phase 87: Release Candidate Provenance Audit
+Goal: audit release candidate bundles for stale receipts, missing evidence, changed HEAD, changed docs, changed command contracts, and privacy boundaries.
+
+Acceptance: tests cover audit text and JSON, release doctor integration, and import routing.
+
+### Phase 88: Operator Center JSON Schema Export
+Goal: export stable local JSON schemas for center status, activity, reviews, templates, reports, and action queues.
+
+Acceptance: tests cover schema output, read-only behavior, and wrapper-facing field stability.
+
+### Phase 89: Operator Report Diff Receipts
+Goal: compare two operator reports and write local diff receipts showing changed queues, resolved items, new blockers, and stale references.
+
+Acceptance: tests cover report diff text and JSON, center activity, work doctor, and release doctor integration.
+
+### Phase 90: Operator Action Aging And SLA Policy
+Goal: add local aging thresholds and review policies for operator actions without executing suggested commands.
+
+Acceptance: tests cover stale pending, stale active, deferred too long, archived completed, and import routing.
+
+### Phase 91: Safe Repo Root Discovery Plan
+Goal: add an explicit root discovery plan for repo fleet entries under configured roots without scanning arbitrary home directories by default.
+
+Acceptance: tests cover dry-run discovery, include/exclude rules, safe labels, private path redaction, and no cloning.
+
+### Phase 92: Fleet Health Command Registry
+Goal: make optional read-only fleet health commands named, validated, and receipt-backed across configured repos.
+
+Acceptance: tests cover command labels, timeouts, high-risk command refusal, stale receipts, and fleet report integration.
+
+### Phase 93: Fleet Dispatch Supersede Reports
+Goal: add reports explaining dispatch supersession, target import changes, dismissed target imports, and broken references.
+
+Acceptance: tests cover dispatch history, superseded imports, reconciliation warnings, and center review integration.
+
+### Phase 94: Fleet Release Matrix Report
+Goal: generate a release train matrix across repos, evidence steps, waivers, readiness, closeouts, and manual publish evidence.
+
+Acceptance: tests cover Markdown and JSON matrix files, no remote mutation, and release doctor integration.
+
+### Phase 95: Fleet Waiver Policy Templates
+Goal: add local templates and checks for waiver expiry, renewal reason quality, review owner labels, and waiver scope.
+
+Acceptance: tests cover waiver policy warnings, imports, ready gate visibility, and no hidden blockers.
+
+### Phase 96: CI Platform Deprecation Watcher
+Goal: detect local GitHub Actions platform deprecation warnings and route them into release readiness without mutating workflows.
+
+Acceptance: tests cover Node action deprecation summaries, safe excerpts, work imports, release evidence, and no network requirement.
+
+### Phase 97: Install Smoke Matrix Receipts
+Goal: store local install smoke-test matrix receipts matching supported harness combinations.
+
+Acceptance: tests cover receipt parsing, stale smoke warnings, release candidate evidence, and center activity.
+
+### Phase 98: Public Template Privacy Audit
+Goal: add a focused audit for public templates to prove they contain placeholders, not private operator state.
+
+Acceptance: tests cover workspace templates, harness templates, docs references, allowlisted examples, and privacy scan integration.
+
+### Phase 99: Docs Command Contract Generator
+Goal: generate or verify a docs command inventory from the CLI parser so public docs stay aligned.
+
+Acceptance: tests cover generated inventory, drift warnings, roadmap audit integration, and no private content.
+
+### Phase 100: Local Operator Readiness Closeout
+Goal: build one final local readiness closeout over roadmap audit, center state, release evidence, repo fleet, security, memory, tools, context, learning, and docs command contracts.
+
+Acceptance: tests cover clean ready, blocked ready, waiver-aware ready, imports for unresolved readiness issues, and a manual-only publish checklist.

docs/roadmap-completion-plan.md

@@ -252,6 +252,12 @@ Phase 56-60 status:
 - Waiver doctor reports expired active waivers, waivers missing expiry, stale waiver reviews, and waivers tied to an older train fingerprint. Waiver import routing creates `source: repo-fleet-release-waiver` tasks with stable fingerprints and dismissed-until-changed behavior.
 - Release ready and release audit include waiver health issues so reviewed risk remains visible even when an active waiver allows readiness to pass.
 
+Phase 61 status:
+
+- Implemented `docs/phase-61-100-plan.md` as the public phase queue for roadmap completion hardening.
+- Tightened `brigade roadmap audit` command discovery so it scans command snippets, ignores prose, and normalizes parent commands and parameterized examples to known CLI command paths.
+- Closed the context-engineering pattern registry owner and test-hint gap.
+
 ### 3. Inspiration Pattern Registry
 
 Deliverable: a bounded local record of external workflow patterns Brigade intends to support.