feat: add work verification closeouts

Author: solomonneas

CHANGELOG.md

@@ -75,6 +75,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `brigade handoff list/show/archive` for local Memory Handoff draft queue visibility, stale or invalid draft health, and reviewed archive records without running the ingestor.
 - `brigade handoff runs`, `run-show`, and `reconcile` for local handoff ingestion receipt visibility, draft outcome reconciliation, and archive outcome metadata without running the ingestor.
 - `brigade work review init/plan/run/runs/show/import-findings/findings/finding-show/closeout` for explicit local multi-harness code review producers, receipts, normalized findings, imported finding resolution, local closeout records, and `code-review` work inbox imports without automatic fixes or remote mutation.
+- `brigade work verify plan/run/runs/show` and `brigade work closeout <session-id-or-latest>` for local verification receipts and work closeout records that collect task acceptance, test command results, scanner sweep status, code review closeout state, handoff draft status, and session evidence without CI or remote mutation.
 - `brigade work backup init/status/doctor/import-issues` for read-only local backup health summaries and `backup-health` inbox imports.
 - Backup health checks for stale snapshots, failed or stale checks, failed or stale prunes, missing summaries, overdue restore rehearsals, and unsafe private summary fields.
 - `brigade tools init/list/show/search/describe/contracts/call plan/call queue/call list/call show/call approve/call reject/call hold/call run/runtime/policy/plan/apply/doctor/import-issues`, plus `brigade tools run list/show/latest/replay` and `brigade tools checkpoint list/show/approve/reject/resume`, for portable tool, slash command, skill, superpower, script, and MCP catalog discovery plus explicit projection writes, read-only call planning, local call approval review, explicit approved script and local MCP execution, run history inspection, replay review, checkpointed resume, runtime supervision, and host-local execution policy.

README.md

@@ -199,6 +199,11 @@ brigade work review import-findings <run-id>
 brigade work review findings
 brigade work review finding-show <finding-id-or-import-id>
 brigade work review closeout latest
+brigade work verify plan
+brigade work verify run
+brigade work verify runs
+brigade work verify show <run-id>
+brigade work closeout latest
 brigade work sweep
 brigade work sweep --all
 brigade work sweeps
@@ -515,6 +520,15 @@ Manual session commands:
 - `brigade work end --note "what happened"` closes the active session and writes `end.md`.
 - `brigade work end --handoff` also writes a Memory Handoff.
 
+Work verification and closeout commands:
+
+- `brigade work verify plan` previews the local verification commands and current evidence snapshot without running anything.
+- `brigade work verify run` executes explicit local verification commands without a shell and writes receipts under `.brigade/work/verify-runs/`.
+- `brigade work verify runs` and `brigade work verify show <run-id>` inspect local verification receipts, command exit codes, summaries, and log paths.
+- `brigade work closeout <session-id-or-latest>` writes a local closeout receipt under `.brigade/work/closeouts/` that collects task acceptance, latest verification, scanner sweep status, code review closeout state, handoff draft status, and session evidence.
+
+Verification and closeout are local gates. Brigade does not mutate CI, GitHub, reviewers, scanner promotions, handoff ingestion, daemons, or schedulers. Verification commands run only when explicitly requested.
+
 ### Memory And Bootstrap Health
 
 Memory and bootstrap readiness are part of the same operating-system health story.

ROADMAP.md

@@ -42,6 +42,7 @@ Goal: make Brigade a safe target for local automations that discover useful work
 - Connect local handoff ingestor outcomes back to draft review state. Status: implemented with normalized receipts under `.brigade/handoffs/ingest-runs/`, `brigade handoff runs`, `run-show`, `reconcile`, ingestion status in draft list/show, archive outcome metadata, and daily-loop warnings for stale unreconciled drafts, without running the ingestor.
 - Run explicit multi-harness code review producers and route findings through the scanner inbox. Status: implemented with gitignored `.brigade/reviews.toml`, `brigade work review`, local receipts under `.brigade/reviews/runs/`, normalized `code-review` findings, daily brief surfacing, and work doctor checks, without automatic fixes or remote mutation.
 - Close out imported review findings against downstream work. Status: implemented with `brigade work review findings`, `finding-show`, `closeout`, source-fingerprint re-review detection, task review evidence, and daily-loop warnings for unclosed review runs.
+- Close out completed work against local verification evidence. Status: implemented with `brigade work verify plan/run/runs/show` and `brigade work closeout`, collecting task acceptance, test command receipts, scanner sweep state, code review closeout state, handoff draft status, and session evidence without CI or remote mutation.
 
 ## Later Phase: Chat Surface Scanners
 

docs/work-closeout.md

@@ -0,0 +1,50 @@
+# Work Verification And Closeout
+
+Brigade can write local verification receipts and work closeout records for completed work sessions. This gives the operator one reviewable answer for task acceptance, test command results, scanner sweep state, code review closeout state, handoff draft state, and session evidence.
+
+## Commands
+
+```bash
+brigade work verify plan
+brigade work verify run
+brigade work verify run --command "PYTHONPATH=src python3 -m pytest -q"
+brigade work verify runs
+brigade work verify show <run-id>
+brigade work closeout latest
+brigade work closeout <session-id>
+```
+
+`verify plan` inspects the repo and proposes local verification commands. It recognizes Python test layouts and package.json projects, and it reports blockers without running anything.
+
+`verify run` executes only explicit local commands, directly with `shell=False`. It supports simple leading environment assignments such as `PYTHONPATH=src`, rejects high-risk shell-like commands, captures stdout and stderr logs locally, and writes a receipt under:
+
+```text
+.brigade/work/verify-runs/
+```
+
+`verify runs` and `verify show` inspect those receipts.
+
+`work closeout` writes a closeout record under:
+
+```text
+.brigade/work/closeouts/
+```
+
+The closeout includes the selected work session, task acceptance criteria when present, latest verification receipt, latest scanner sweep state, code review closeout state, handoff draft queue state, and blockers. It also stores a compact closeout reference on the session `session.json`.
+
+## Ready State
+
+A closeout is ready when:
+
+- the work session is ended
+- the latest verification receipt completed
+- the consumed task has acceptance criteria when task evidence is present
+- the latest scanner sweep has no unresolved review issue
+- code review has no unclosed review run and no unresolved imported finding
+- handoff draft health has no open issue
+
+Blocked closeouts are still written, so the operator has a local record of what remains.
+
+## Boundary
+
+Verification and closeout are local and explicit. Brigade does not mutate CI, GitHub, reviewers, scanner imports, handoff drafts, canonical memory, daemons, schedulers, or remotes. Verification commands run only when the operator asks for `brigade work verify run`.

src/brigade/cli.py

@@ -243,6 +243,30 @@ def _build_parser() -> argparse.ArgumentParser:
     p_work_sweep_review.add_argument("sweep_id", help="Sweep id, unique prefix, or latest.")
     p_work_sweep_review.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to inspect.")
     p_work_sweep_review.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_work_verify = work_sub.add_parser("verify", help="Plan and run local work verification.")
+    verify_sub = p_work_verify.add_subparsers(dest="verify_command", metavar="<verify-command>")
+    verify_sub.required = True
+    p_work_verify_plan = verify_sub.add_parser("plan", help="Plan local verification without running commands.")
+    p_work_verify_plan.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to inspect.")
+    p_work_verify_plan.add_argument("--command", dest="verify_commands", action="append", default=None, help="Verification command. May be repeated.")
+    p_work_verify_plan.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_work_verify_run = verify_sub.add_parser("run", help="Run local verification commands and write a receipt.")
+    p_work_verify_run.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to update.")
+    p_work_verify_run.add_argument("--command", dest="verify_commands", action="append", default=None, help="Verification command. May be repeated.")
+    p_work_verify_run.add_argument("--timeout", type=int, default=900, help="Timeout per command in seconds.")
+    p_work_verify_run.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_work_verify_runs = verify_sub.add_parser("runs", help="List local work verification receipts.")
+    p_work_verify_runs.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to inspect.")
+    p_work_verify_runs.add_argument("--limit", type=int, default=20, help="Maximum runs to list.")
+    p_work_verify_runs.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_work_verify_show = verify_sub.add_parser("show", help="Show one local work verification receipt.")
+    p_work_verify_show.add_argument("run_id", help="Run id, unique prefix, or latest.")
+    p_work_verify_show.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to inspect.")
+    p_work_verify_show.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_work_closeout = work_sub.add_parser("closeout", help="Write a local work closeout receipt.")
+    p_work_closeout.add_argument("session_id", help="Work session id, unique prefix, or latest.")
+    p_work_closeout.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to update.")
+    p_work_closeout.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
     p_work_inbox = work_sub.add_parser("inbox", help="Review scanner-ready work imports.")
     p_work_inbox.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to inspect.")
     p_work_inbox.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
@@ -1280,6 +1304,24 @@ def main(argv=None) -> int:
             return work_cmd.sweep_show(target=args.target, sweep_id=args.sweep_id, json_output=args.json)
         if args.work_command == "sweep-review":
             return work_cmd.sweep_review(target=args.target, sweep_id=args.sweep_id, json_output=args.json)
+        if args.work_command == "verify":
+            if args.verify_command == "plan":
+                return work_cmd.verify_plan(target=args.target, commands=args.verify_commands, json_output=args.json)
+            if args.verify_command == "run":
+                return work_cmd.verify_run(
+                    target=args.target,
+                    commands=args.verify_commands,
+                    timeout=args.timeout,
+                    json_output=args.json,
+                )
+            if args.verify_command == "runs":
+                return work_cmd.verify_runs(target=args.target, limit=args.limit, json_output=args.json)
+            if args.verify_command == "show":
+                return work_cmd.verify_show(target=args.target, run_id=args.run_id, json_output=args.json)
+            parser.error(f"unknown verify command: {args.verify_command}")
+            return 2
+        if args.work_command == "closeout":
+            return work_cmd.closeout(target=args.target, session_id=args.session_id, json_output=args.json)
         if args.work_command == "inbox" and getattr(args, "inbox_command", None):
             if args.inbox_command == "doctor":
                 return work_cmd.inbox_doctor(target=args.target, json_output=args.json)