feat: add roadmap and repo fleet audit

Author: solomonneas

CHANGELOG.md

@@ -78,6 +78,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `brigade work verify plan/run/runs/show` and `brigade work closeout <session-id-or-latest>` for local verification receipts and work closeout records that collect task acceptance, test command results, scanner sweep status, code review closeout state, handoff draft status, and session evidence without CI or remote mutation.
 - `brigade release plan/doctor/run/runs/show` for local release-readiness receipts that collect work closeout, verification, review closeout, scanner sweep, security, handoff, content-guard, docs, changelog, roadmap, and git-state evidence without pushing, tagging, or mutating remotes.
 - `brigade release candidate plan/build/list/show/archive` for local release candidate bundles with readiness evidence, release notes drafts, manual-only publish plans, changed file lists, blockers, warnings, and content-guard summaries without pushing, tagging, or creating releases.
+- `brigade roadmap audit` and `brigade roadmap patterns` for roadmap closure checks, stale phase warnings, documented command drift, neutral pattern-family coverage, and source-pattern decisions.
+- `brigade repos init/list/show/scan/doctor/import-issues` for gitignored local repo-fleet readiness checks, safe setup metadata, fallback guidance detection, and `repo-fleet` work inbox imports.
+- `brigade work sweep closeout <sweep-id|latest>` for reviewable sweep closeout records that block unresolved pending imports, support explicit deferrals, and surface unclosed sweeps through inbox hygiene.
 - `brigade work backup init/status/doctor/import-issues` for read-only local backup health summaries and `backup-health` inbox imports.
 - Backup health checks for stale snapshots, failed or stale checks, failed or stale prunes, missing summaries, overdue restore rehearsals, and unsafe private summary fields.
 - `brigade tools init/list/show/search/describe/contracts/call plan/call queue/call list/call show/call approve/call reject/call hold/call run/runtime/policy/plan/apply/doctor/import-issues`, plus `brigade tools run list/show/latest/replay` and `brigade tools checkpoint list/show/approve/reject/resume`, for portable tool, slash command, skill, superpower, script, and MCP catalog discovery plus explicit projection writes, read-only call planning, local call approval review, explicit approved script and local MCP execution, run history inspection, replay review, checkpointed resume, runtime supervision, and host-local execution policy.

README.md

@@ -387,6 +387,10 @@ Start-of-day commands:
 - `brigade work scanners run --due` explicitly runs due enabled scanner producers, writes local receipts, and leaves promotion to the operator.
 - `brigade work sweep` explicitly runs due scanner producers, ingests configured JSONL outputs by default, and writes one local sweep report for review.
 - `brigade work sweep-review latest` shows created imports, skipped or dismissed fingerprints, grouping, and next commands for the latest sweep.
+- `brigade work sweep closeout latest` records that all actionable sweep imports were promoted, dismissed, archived, or explicitly deferred.
+- `brigade roadmap audit` reports roadmap status, stale phase sections, documented command drift, and optional roadmap-audit work imports.
+- `brigade roadmap patterns` shows neutral inspiration pattern coverage and source-pattern decisions without naming private references.
+- `brigade repos scan` inspects configured local repos for safe setup metadata, and `brigade repos import-issues` routes repo-fleet gaps into the work inbox.
 - `brigade chat sweep import-issues <surface-id>` converts a local chat export sweep into public-safe scanner inbox imports.
 - `brigade tools doctor` inspects the local portable tool catalog and reports source, projection, schema, MCP, auth-field, and command-shape issues without invoking tools.
 - `brigade work next` prints only the next task. Add `--json` for wrappers.
@@ -425,7 +429,7 @@ Import inbox commands:
 - `brigade work import promote-handoff <import-id>` promotes one reviewed durable import into a linted Memory Handoff draft.
 - `brigade work import promote --run <import-id>` promotes exactly one task import, then immediately runs that task through the normal work-session loop.
 - `brigade work import promote --all --source memory-care --kind task` batch-promotes filtered imports; metadata filters also work for scanner-specific fields such as `handoff_issue_category=route-skip`.
-- `brigade work inbox doctor` reports missing scanner provenance, stale pending imports, broken promoted task links, changed dismissed fingerprints, noisy sources, and scanner runs that produced no imports.
+- `brigade work inbox doctor` reports missing scanner provenance, stale pending imports, broken promoted task links, changed dismissed fingerprints, noisy sources, scanner runs that produced no imports, missing sweep references, and unclosed sweeps.
 - `brigade work inbox archive` moves old promoted, dismissed, and superseded imports into `.brigade/work/imports/archive.jsonl` while preserving pending imports.
 
 Imports are stored under `.brigade/work/imports/inbox.jsonl`, stay gitignored, and do not write memory directly.
@@ -455,9 +459,20 @@ Scanner registry commands:
 - `brigade work sweep` is the daily operator action for scanner review. It runs due scanners by default, or `--all` / `--scanner <id>` when selected, ingests configured JSONL outputs unless `--no-ingest` is present, and writes one report under `.brigade/scanners/sweeps/`.
 - `brigade work sweeps` and `brigade work sweep-show <sweep-id>` review sweep reports, including scanner run receipt paths, import counts, inbox hygiene, and suggested next commands.
 - `brigade work sweep-review <sweep-id>` and `sweep-review latest` triage one sweep by grouping created imports by source, kind, priority, acceptance coverage, provenance completeness, and status. Pending imports show exact plan, promote, dismiss, promote-run, plan-handoff, or promote-handoff commands as appropriate.
+- `brigade work sweep closeout <sweep-id|latest>` marks a sweep reviewed only after all actionable imports are no longer pending, or after the operator records explicit deferrals with `--defer <import-id>` or `--defer-all`.
 - `brigade work scanners doctor --import-issues` reports missing config, disabled required producers, bad commands, missing or stale output paths, schedule conflicts, failed or timed-out runs, malformed receipts, missing logs, and due scanners, then can import those health issues as local task imports.
 
-The scanner registry is explicit and local. Brigade does not install cron jobs, start a daemon, run scanners from `brief` or `doctor`, promote scanner output automatically, or mutate scanner output beyond the configured command's own behavior. `brigade work sweep` is still explicit foreground execution, not a scheduler, and `sweep-review` is read-only.
+The scanner registry is explicit and local. Brigade does not install cron jobs, start a daemon, run scanners from `brief` or `doctor`, promote scanner output automatically, or mutate scanner output beyond the configured command's own behavior. `brigade work sweep` is still explicit foreground execution, not a scheduler, `sweep-review` is read-only, and sweep closeout records review state only.
+
+Roadmap and repo-fleet commands:
+
+- `brigade roadmap audit` parses `ROADMAP.md`, classifies roadmap bullets, detects stale current or next phase sections, compares documented commands with the CLI, and can import roadmap hygiene issues with `--import-issues`.
+- `brigade roadmap patterns` shows neutral pattern-family coverage and local source-pattern decisions: `bake-in`, `integrate`, `catalog-only`, `move-candidate`, and `leave-alone`.
+- `brigade repos init` writes gitignored `.brigade/repos.toml`.
+- `brigade repos list`, `show <repo-id>`, and `scan` report safe repo metadata only: repo labels, branch, dirty counts, guidance-file presence, docs presence, test hints, handoff inboxes, publish-guard hook presence, Brigade config presence, and local receipt references.
+- `brigade repos doctor` reports setup gaps, and `brigade repos import-issues` creates `source: repo-fleet` task imports with stable source fingerprints.
+
+Repo fleet and pattern registry output is local and privacy preserving. It records presence, counts, labels, fingerprints, and receipt references, but does not copy repo guidance files, private paths, raw logs, scanner output, private config, owner names, exact private repo names, or raw evidence into public artifacts.
 
 Code review producer commands:
 
@@ -860,6 +875,8 @@ Each subsystem has a companion doc under [`docs/`](docs/) with the full local co
 - [`docs/backup-health.md`](docs/backup-health.md) - read-only backup health summaries and issue routing
 - [`docs/memory-care.md`](docs/memory-care.md) - memory card decay scanning and refresh imports
 - [`docs/security.md`](docs/security.md) - the agent workspace security scanner and evidence bundles
+- [`docs/inspiration-patterns.md`](docs/inspiration-patterns.md) - neutral pattern families and source-pattern decisions
+- [`docs/roadmap-completion-plan.md`](docs/roadmap-completion-plan.md) - the large-roadmap completion plan and phase boundaries
 
 ## Related
 

ROADMAP.md

@@ -45,6 +45,9 @@ Goal: make Brigade a safe target for local automations that discover useful work
 - Close out completed work against local verification evidence. Status: implemented with `brigade work verify plan/run/runs/show` and `brigade work closeout`, collecting task acceptance, test command receipts, scanner sweep state, code review closeout state, handoff draft status, and session evidence without CI or remote mutation.
 - Check local release readiness before publish operations. Status: implemented with `brigade release plan`, `doctor`, `run`, `runs`, and `show`, collecting work closeout, verification, review, scanner, security, handoff, content-guard, docs, changelog, roadmap, and git-state evidence without pushing, tagging, or mutating remotes.
 - Build local release candidate packets before manual publish steps. Status: implemented with `brigade release candidate plan/build/list/show/archive`, local candidate bundles, evidence JSON, release notes drafts, manual-only publish plans, candidate health warnings, and no remote mutation.
+- Audit roadmap closure and neutral pattern coverage. Status: started with `brigade roadmap audit`, `brigade roadmap patterns`, stale phase warnings, documented command drift checks, roadmap-audit imports, and source-pattern decision records without public reference names.
+- Inspect local repo fleet readiness without copying private repo contents. Status: started with gitignored `.brigade/repos.toml`, `brigade repos init/list/show/scan/doctor/import-issues`, safe metadata summaries, AGENTS and fallback guidance detection, repo-fleet imports, and daily-loop health surfacing.
+- Close out scanner sweeps after review. Status: started with `brigade work sweep closeout <sweep-id|latest>`, deferred import recording, missing-reference blocking, and inbox hygiene warnings for unclosed sweeps.
 
 ## Later Phase: Chat Surface Scanners
 

docs/import-schema.md

@@ -88,6 +88,13 @@ Scanner run provenance metadata is added by `brigade work scanners run --ingest-
 - `scanner_import_path`: configured JSONL import output path when present.
 - `source_fingerprint`: producer fingerprint or Brigade-computed fingerprint for dedupe and dismissed-change checks.
 
+Roadmap and repo-fleet producers use the same import contract:
+
+- `source: roadmap-audit` records roadmap hygiene issues such as stale phase sections or documented command drift. Metadata includes `issue_type`, `safe_summary`, `source_item_key`, and `source_fingerprint`.
+- `source: repo-fleet` records local repository readiness gaps from `brigade repos import-issues`. Metadata includes `repo_id`, `issue_type`, `safe_summary`, `source_item_key`, and `source_fingerprint`.
+
+Repo-fleet imports must use safe labels only. Do not copy full local paths, guidance file contents, private config values, raw logs, scanner output, owner names, exact private repo names, or raw evidence into import text or metadata.
+
 ## Privacy Rules
 
 - Keep raw chat exports, message bodies, and third-party personal details out of public docs and public repos.

docs/inspiration-patterns.md

@@ -0,0 +1,38 @@
+# Inspiration Pattern Registry
+
+Brigade keeps public inspiration records at the pattern-family level. Public docs describe the workflow shape Brigade is adopting, not the exact private repos, owners, organizations, raw examples, or local evidence that inspired the work.
+
+Use:
+
+```bash
+brigade roadmap patterns
+brigade roadmap patterns --json
+```
+
+## Pattern Families
+
+- `command-harness-patterns`: command surfaces, subcommands, project settings, permission boundaries, and local command discovery.
+- `delivery-loop-patterns`: think, plan, implement, review, verify, release, and learn loops with receipts.
+- `durable-memory-eval-patterns`: markdown-backed handoffs, memory repair candidates, replayable eval records, and bounded learning cycles.
+- `portable-skill-patterns`: small composable skills, portable source files, projection planning, and conflict-safe apply.
+- `agent-security-guardrails`: local security scans, prompt and instruction risk checks, tool permission findings, and redacted evidence bundles.
+- `context-engineering-packs`: planned context pack creation, freshness checks, and harness-specific export receipts.
+- `cross-harness-skill-plugin-sync`: explicit sync plans, managed metadata, add-only defaults, dry-run output, and no silent deletes.
+- `local-side-project-categories`: safe fleet metadata, disposition planning, and reviewed local work imports.
+- `mcp-tooling`: local server metadata, tool listing, call planning, runtime checks, and receipts.
+- `portable-tools`: catalog, projection, contract, approval, policy, runtime, execution, history, replay, checkpoint, and local MCP execution flows.
+- `security-gates`: publish readiness checks, introduced-content checks, suppressions, accepted-risk records, and release blockers.
+- `self-learning`: learning output becomes reviewed tasks, handoffs, suppressions, or receipts, not unbounded self-mutation.
+- `release-gates`: verification, closeout, review, scanner, security, docs, changelog, roadmap, candidate bundle, and manual publish-plan checks.
+
+## Decision Types
+
+- `bake-in`: the pattern is small and belongs directly in Brigade.
+- `integrate`: the pattern should stay in its own tool but report into Brigade through receipts or imports.
+- `catalog-only`: Brigade should inspect and track it, not own execution or projection.
+- `move-candidate`: the repo or tool may need a reviewed migration or consolidation plan.
+- `leave-alone`: the reference is useful context but not Brigade scope.
+
+## Public Boundary
+
+Do not put exact private reference repo names, side-project names, owner names, organization names, private paths, raw logs, private config, tokens, or raw evidence in this file, public fixtures, handoffs, imports, release evidence, or committed diffs. Exact local source names belong only in gitignored host-local config when the operator needs them.