feat: add repo fleet evidence sweeps

Author: solomonneas

CHANGELOG.md

@@ -87,6 +87,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `brigade center status/activity/reviews/templates`, `brigade center report plan/build/list/show/archive/review/compare/closeout`, and `brigade center actions plan/build/list/show/start/done/defer/archive` for local operator-center summaries, local report bundles, reviewed daily action queues, freshness comparison, and report closeout over work, scanner, review, handoff, tool, learning, context, project, security, and release state.
 - `brigade roadmap audit` and `brigade roadmap patterns` for roadmap closure checks, stale phase warnings, documented command drift, neutral pattern-family coverage, and source-pattern decisions.
 - `brigade repos init/list/show/scan/doctor/import-issues` for gitignored local repo-fleet readiness checks, safe setup metadata, fallback guidance detection, and `repo-fleet` work inbox imports.
+- `brigade repos sweep plan/run/runs/show/closeout` for explicit repo-fleet evidence refresh sweeps that run configured local read/report commands, write gitignored sweep receipts, track per-repo command status, and surface stale, failed, or unclosed sweeps through repo, center, work, and release health.
 - `brigade repos report plan/build/list/show/archive/closeout` and `brigade repos actions plan/build/list/show/start/done/defer/archive` for local repo-fleet operator rollups and reviewed fleet action queues using safe labels, counts, statuses, fingerprints, and receipt labels only.
 - `brigade work sweep closeout <sweep-id|latest>` for reviewable sweep closeout records that block unresolved pending imports, support explicit deferrals, and surface unclosed sweeps through inbox hygiene.
 - `brigade work backup init/status/doctor/import-issues` for read-only local backup health summaries and `backup-health` inbox imports.

README.md

@@ -515,10 +515,11 @@ Roadmap and repo-fleet commands:
 - `brigade repos init` writes gitignored `.brigade/repos.toml`.
 - `brigade repos list`, `show <repo-id>`, and `scan` report safe repo metadata only: repo labels, branch, dirty counts, guidance-file presence, docs presence, test hints, handoff inboxes, publish-guard hook presence, Brigade config presence, and local receipt references.
 - `brigade repos doctor` reports setup gaps, and `brigade repos import-issues` creates `source: repo-fleet` task imports with stable source fingerprints.
+- `brigade repos sweep plan/run/runs/show/closeout` explicitly refreshes safe local evidence across configured repos, writes one fleet sweep receipt under `.brigade/repos/sweeps/`, can include optional configured read-only health commands, and records only repo ids, safe labels, command labels, status counts, receipt labels, and local log labels.
 - `brigade repos report plan/build/list/show/archive/closeout` builds local fleet operator reports under `.brigade/repos/reports/`, using safe repo ids, labels, counts, statuses, and receipt labels only.
 - `brigade repos actions plan/build/list/show/start/done/defer/archive` turns reviewed fleet reports into local fleet action queues under `.brigade/repos/actions/` without executing the suggested commands.
 
-Repo fleet and pattern registry output is local and privacy preserving. It records presence, counts, labels, fingerprints, and receipt references, but does not copy repo guidance files, private paths, raw logs, scanner output, private config, owner names, exact private repo names, or raw evidence into public artifacts.
+Repo fleet and pattern registry output is local and privacy preserving. It records presence, counts, labels, fingerprints, command labels, log labels, and receipt references, but does not copy repo guidance files, private paths, raw logs, scanner output, private config, owner names, exact private repo names, or raw evidence into public artifacts. Fleet sweeps run only explicit foreground local read/report commands, never clone, pull, push, fix, promote, dismiss, or mutate remotes.
 
 Code review producer commands:
 

ROADMAP.md

@@ -46,7 +46,7 @@ Goal: make Brigade a safe target for local automations that discover useful work
 - Check local release readiness before publish operations. Status: implemented with `brigade release plan`, `doctor`, `run`, `runs`, and `show`, collecting work closeout, verification, review, scanner, security, handoff, content-guard, docs, changelog, roadmap, and git-state evidence without pushing, tagging, or mutating remotes.
 - Build local release candidate packets before manual publish steps. Status: implemented with `brigade release candidate plan/build/list/show/archive`, local candidate bundles, evidence JSON, release notes drafts, manual-only publish plans, candidate health warnings, and no remote mutation.
 - Audit roadmap closure and neutral pattern coverage. Status: started with `brigade roadmap audit`, `brigade roadmap patterns`, stale phase warnings, documented command drift checks, roadmap-audit imports, and source-pattern decision records without public reference names.
-- Inspect local repo fleet readiness without copying private repo contents. Status: started with gitignored `.brigade/repos.toml`, `brigade repos init/list/show/scan/doctor/import-issues`, `brigade repos report plan/build/list/show/archive/closeout`, and `brigade repos actions plan/build/list/show/start/done/defer/archive`, using safe metadata summaries, local fleet reports, reviewed fleet action queues, AGENTS and fallback guidance detection, repo-fleet imports, and daily-loop health surfacing.
+- Inspect local repo fleet readiness without copying private repo contents. Status: started with gitignored `.brigade/repos.toml`, `brigade repos init/list/show/scan/doctor/import-issues`, `brigade repos sweep plan/run/runs/show/closeout`, `brigade repos report plan/build/list/show/archive/closeout`, and `brigade repos actions plan/build/list/show/start/done/defer/archive`, using safe metadata summaries, explicit fleet evidence sweeps, local fleet reports, reviewed fleet action queues, AGENTS and fallback guidance detection, repo-fleet imports, and daily-loop health surfacing.
 - Close out scanner sweeps after review. Status: started with `brigade work sweep closeout <sweep-id|latest>`, deferred import recording, missing-reference blocking, and inbox hygiene warnings for unclosed sweeps.
 - Inspect local operator state from one read-only center view. Status: started with `brigade center status/activity/reviews/templates`, `brigade center report plan/build/list/show/archive/review/compare/closeout`, and `brigade center actions plan/build/list/show/start/done/defer/archive`, aggregating local work, imports, sweeps, reviews, handoffs, tools, learning, context packs, projects, security, and release state into JSON, reviewed action queues, closeouts, and local report bundles without a daemon or server.
 

docs/operator-center.md

@@ -107,10 +107,12 @@ Each action stores:
 
 ## Repo Fleet Rollups
 
+`brigade repos sweep plan/run/runs/show/closeout` explicitly refreshes safe local evidence across configured repos. A sweep runs only configured foreground local read/report commands inside each enabled repo, records per-command status and safe stdout/stderr summaries, stores raw logs only in gitignored local files, and writes one receipt under `.brigade/repos/sweeps/`. Sweep receipts use safe repo ids, labels, command labels, status counts, receipt labels, and local log labels.
+
 `brigade repos report plan/build/list/show/archive/closeout` builds a local fleet rollup from configured `.brigade/repos.toml` entries. Fleet reports live under `.brigade/repos/reports/` and use safe repo ids, labels, counts, statuses, fingerprints, and receipt labels only. They do not copy exact private repo names, owner names, org names, local paths, raw logs, raw scanner output, or raw evidence into public artifacts.
 
 `brigade repos actions plan/build/list/show/start/done/defer/archive` turns a reviewed or deferred fleet report into a local fleet action queue under `.brigade/repos/actions/`. Fleet actions are metadata records only. They point to the safe repo label, source subsystem, source local id, safe summary, and suggested command, but do not execute the command.
 
-Center status, center reviews, work brief, work doctor, release doctor, and release evidence include fleet report and fleet action queue health.
+Center status, center reviews, work brief, work doctor, release doctor, and release evidence include fleet sweep, fleet report, and fleet action queue health.
 
 The operator center never invokes scanners, tools, reviewers, handoff ingestion, release publishing, git commands that mutate state, or remote APIs. Only `center report build`, `center report archive`, and `center actions build/start/done/defer/archive` write local gitignored center files.

docs/repo-fleet.md

@@ -11,6 +11,11 @@ brigade repos show <repo-id>
 brigade repos scan
 brigade repos doctor
 brigade repos import-issues
+brigade repos sweep plan
+brigade repos sweep run
+brigade repos sweep runs
+brigade repos sweep show <sweep-id>
+brigade repos sweep closeout <sweep-id|latest>
 brigade repos report plan
 brigade repos report build
 brigade repos report list
@@ -39,8 +44,29 @@ Fleet action queues are written under:
 .brigade/repos/actions/
 ```
 
+Fleet sweep receipts are written under:
+
+```text
+.brigade/repos/sweeps/
+```
+
 Fleet reports include safe repo ids, safe labels, status counts, blocker and warning counts, top pending action summaries, receipt labels, and suggested next commands. Fleet actions store local metadata only: repo id, safe label, source subsystem, source local id, status, priority or severity, safe summary, suggested command, timestamps, and source fingerprint.
 
+`brigade repos sweep plan` shows which configured repos would be refreshed and which read-only local Brigade commands would run. `brigade repos sweep run` executes the configured foreground refresh for selected repos, records per-repo command summaries, and stores raw stdout and stderr only in gitignored local logs. Receipt JSON uses repo ids, safe labels, command labels, status counts, fingerprints, and local log labels. It does not store exact repo paths.
+
+Repos may define optional read-only health commands in gitignored config:
+
+```toml
+[[repo.health_command]]
+label = "local-health"
+command = "python3 -m brigade work brief --json"
+timeout = 120
+```
+
+Health commands are parsed into argv and run without a shell. High-risk shell, remote-copy, and metacharacter-heavy command shapes are rejected before a sweep runs.
+
+Sweep filters include `--repo <repo-id>`, `--all`, `--stale-only`, `--include-disabled`, and `--force`. `brigade repos sweep closeout` marks a sweep as `reviewed`, `deferred`, `superseded`, or `archived` after the operator has inspected the refreshed evidence. Fleet reports, center status, center reviews, work brief, work doctor, and release doctor surface stale, failed, or unclosed fleet sweeps.
+
 `brigade repos actions build` requires the source fleet report to be closed out as `reviewed` or `deferred` unless `--allow-unreviewed` is passed. Repeated builds dedupe by repo id, report fingerprint, and source item fingerprint, including archived actions from the same report.
 
 Privacy boundaries:

docs/roadmap-completion-plan.md

@@ -132,6 +132,7 @@ Implementation scope:
 
 - Add gitignored `.brigade/repos.toml`.
 - Add `brigade repos init/list/show/scan/doctor/import-issues`.
+- Add `brigade repos sweep plan/run/runs/show/closeout`.
 - Add `brigade repos report plan/build/list/show/archive/closeout`.
 - Add `brigade repos actions plan/build/list/show/start/done/defer/archive`.
 - Discover repos under configured roots such as `~/repos`.
@@ -148,13 +149,15 @@ Implementation scope:
   - missing test command hint
   - missing Brigade bootstrap where opted in
 - Import issues into the scanner inbox as `source: repo-fleet`.
+- Refresh safe local evidence explicitly through fleet sweeps that run configured read/report commands, write local receipts, and feed reports and action queues without cloning, fixing, promoting, or mutating remotes.
 
 Acceptance:
 
 - Tests cover config init/list/show/scan/doctor text and JSON.
 - Tests cover repo fixtures with AGENTS, CLAUDE fallback, roadmap, publish-guard, handoff inboxes, and dirty state.
 - Tests prove private file contents are not copied into imports or docs.
 - Tests cover repo-fleet imports, dedupe, and dismissed-until-changed behavior.
+- Tests cover fleet sweep plan/run/runs/show/closeout text and JSON, filtering, stale-only selection, failed-repo isolation, safe log labels, and daily-loop integration.
 - Tests cover fleet report plan/build/list/show/archive and fleet action plan/build/list/show/start/done/defer/archive text and JSON.
 - Tests prove private repo names, owner names, org names, local paths, and raw evidence are not copied into public docs, fixtures, imports, handoffs, release evidence, or committed diffs.
 
@@ -172,6 +175,12 @@ Phase 40 status:
 - Fleet actions write local queues under `.brigade/repos/actions/`, require a reviewed or deferred fleet report unless explicitly overridden, dedupe by repo id plus report/source fingerprint, and update action metadata only.
 - Center status, center reviews, work brief, work doctor, and release doctor surface fleet report and fleet action health.
 
+Phase 41 status:
+
+- Implemented command surface: `brigade repos sweep plan/run/runs/show/closeout`.
+- Fleet sweeps run explicit local read/report commands in configured repos, write gitignored receipts under `.brigade/repos/sweeps/`, store raw logs locally, and expose safe repo ids, labels, command labels, status counts, log labels, and receipt labels only.
+- Fleet reports, center status, center reviews, work brief, work doctor, and release doctor surface stale, failed, or unclosed fleet sweep health.
+
 ### 3. Inspiration Pattern Registry
 
 Deliverable: a bounded local record of external workflow patterns Brigade intends to support.

src/brigade/center_cmd.py

@@ -406,7 +406,8 @@ def _reviews(target: Path) -> list[dict[str, Any]]:
     repo_health = repos_cmd.health(target)
     repo_report = repo_health.get("report") if isinstance(repo_health.get("report"), dict) else {}
     repo_actions = repo_health.get("actions") if isinstance(repo_health.get("actions"), dict) else {}
-    for bucket, command in ((repo_report, "brigade repos report build"), (repo_actions, "brigade repos actions list")):
+    repo_sweep = repo_health.get("sweep") if isinstance(repo_health.get("sweep"), dict) else {}
+    for bucket, command in ((repo_report, "brigade repos report build"), (repo_actions, "brigade repos actions list"), (repo_sweep, "brigade repos sweep run")):
         top = bucket.get("top_issue") if isinstance(bucket.get("top_issue"), dict) else None
         if top:
             items.append(_item("repo-fleet", str(top.get("name") or "repo-fleet"), str(top.get("status") or "warn"), str(top.get("detail") or "repo fleet issue"), str(top.get("suggested_next_command") or command)))

src/brigade/cli.py

@@ -263,6 +263,32 @@ def _build_parser() -> argparse.ArgumentParser:
     p_repos_actions_archive.add_argument("--completed", action="store_true", required=True, help="Archive completed actions.")
     p_repos_actions_archive.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to update.")
     p_repos_actions_archive.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_repos_sweep = repos_sub.add_parser("sweep", help="Plan, run, and close out explicit repo fleet evidence sweeps.")
+    repos_sweep_sub = p_repos_sweep.add_subparsers(dest="repos_sweep_command", metavar="<repos-sweep-command>")
+    repos_sweep_sub.required = True
+    for name in ("plan", "run"):
+        p_repos_sweep_cmd = repos_sweep_sub.add_parser(name, help=f"{name.title()} a repo fleet evidence sweep.")
+        p_repos_sweep_cmd.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to inspect.")
+        p_repos_sweep_cmd.add_argument("--repo", dest="repo_ids", action="append", default=[], help="Repo id to include. May be repeated.")
+        p_repos_sweep_cmd.add_argument("--all", dest="all_repos", action="store_true", help="Include all enabled repos.")
+        p_repos_sweep_cmd.add_argument("--stale-only", action="store_true", help="Only include repos without a successful sweep.")
+        p_repos_sweep_cmd.add_argument("--include-disabled", action="store_true", help="Allow disabled configured repos.")
+        p_repos_sweep_cmd.add_argument("--force", action="store_true", help="Force a refresh even when evidence is fresh.")
+        p_repos_sweep_cmd.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_repos_sweep_runs = repos_sweep_sub.add_parser("runs", help="List repo fleet sweep receipts.")
+    p_repos_sweep_runs.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to inspect.")
+    p_repos_sweep_runs.add_argument("--limit", type=int, default=20, help="Maximum sweeps to list.")
+    p_repos_sweep_runs.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_repos_sweep_show = repos_sweep_sub.add_parser("show", help="Show one repo fleet sweep receipt.")
+    p_repos_sweep_show.add_argument("sweep_id", help="Sweep id, unique prefix, or latest.")
+    p_repos_sweep_show.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to inspect.")
+    p_repos_sweep_show.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
+    p_repos_sweep_closeout = repos_sweep_sub.add_parser("closeout", help="Close out one repo fleet sweep review.")
+    p_repos_sweep_closeout.add_argument("sweep_id", nargs="?", default="latest", help="Sweep id, unique prefix, or latest.")
+    p_repos_sweep_closeout.add_argument("--target", "-t", type=Path, default=Path("."), help="Repo or workspace to update.")
+    p_repos_sweep_closeout.add_argument("--status", choices=["reviewed", "deferred", "superseded", "archived"], default="reviewed")
+    p_repos_sweep_closeout.add_argument("--reason", default=None, help="Review reason.")
+    p_repos_sweep_closeout.add_argument("--json", action="store_true", help="Print machine-readable JSON.")
 
     # handoff
     p_handoff = sub.add_parser("handoff", help="Inspect memory handoff inbox health.")
@@ -1601,6 +1627,35 @@ def main(argv=None) -> int:
                 return repos_cmd.actions_archive_completed(target=args.target, json_output=args.json)
             parser.error(f"unknown repos actions command: {args.repos_actions_command}")
             return 2
+        if args.repos_command == "sweep":
+            if args.repos_sweep_command == "plan":
+                return repos_cmd.sweep_plan(
+                    target=args.target,
+                    repo_ids=args.repo_ids,
+                    all_repos=args.all_repos,
+                    stale_only=args.stale_only,
+                    include_disabled=args.include_disabled,
+                    force=args.force,
+                    json_output=args.json,
+                )
+            if args.repos_sweep_command == "run":
+                return repos_cmd.sweep_run(
+                    target=args.target,
+                    repo_ids=args.repo_ids,
+                    all_repos=args.all_repos,
+                    stale_only=args.stale_only,
+                    include_disabled=args.include_disabled,
+                    force=args.force,
+                    json_output=args.json,
+                )
+            if args.repos_sweep_command == "runs":
+                return repos_cmd.sweep_runs(target=args.target, limit=args.limit, json_output=args.json)
+            if args.repos_sweep_command == "show":
+                return repos_cmd.sweep_show(target=args.target, sweep_id=args.sweep_id, json_output=args.json)
+            if args.repos_sweep_command == "closeout":
+                return repos_cmd.sweep_closeout(target=args.target, sweep_id=args.sweep_id, status=args.status, reason=args.reason, json_output=args.json)
+            parser.error(f"unknown repos sweep command: {args.repos_sweep_command}")
+            return 2
         parser.error(f"unknown repos command: {args.repos_command}")
         return 2
     if cmd == "handoff":