feat(work): capture-before-retry enforcement for failed verifies

[solomonneas]

Summary

• Check the latest verify receipt with the same command identity before starting a retry.
• Warn by default when that receipt failed without an outcome capture. The configured block mode exits before creating a run, while off keeps the prior behavior.
• Print an executable remediation command with the failed receipt ID.

Command identity

Identity is the ordered command list within one target repository. Each command is normalized with shlex.split and shlex.join, so whitespace and equivalent quoting do not create a new identity.

Environment assignments inside --command remain part of identity because they affect execution. For example, VAR=1 false and false are different commands. This follows the command handling implicated by #541.

Exact matching does not stop an agent from changing the command string to bypass the check. Fuzzy matching is outside this issue.

Config

The existing .brigade/config.json surface accepts:

{
  "capture_before_retry": "warn"
}

Allowed values are warn, block, and off. The default is warn, and the default value is omitted when Brigade writes the config.

Tests

• Failed verify, then the same command: default warning.
• Failed verify in block mode: exit 1 without creating a run.
• Captured failed receipt: retry proceeds silently.
• First run and passing reruns: no warning.
• Passing receipt after an earlier failure: later retry remains silent.
• off mode: prior behavior.
• Environment prefixes remain part of identity.
• Whitespace is normalized for identity.
• Config default, explicit value, and invalid values.
• Receipt storage remains compatible with work verify: harness_session silently dropped when the invocation carries a second env prefix #541 after rebasing onto current main.

Verification

Final Brigade receipt: 20260726-210751-work-verify-dfeb03, exit 0.

./scripts/verify
4319 passed, 3 skipped in 364.17s
Required test coverage of 78% reached. Total coverage: 82.81%

Manual scratch-repository demo:

$ .venv/bin/brigade work verify run --target /tmp/brigade-475-demo.a3ayVw --command false
warning: brigade outcome capture brigade-work --run-id 20260726-204615-work-verify-3c7e80
work verify run: /tmp/brigade-475-demo.a3ayVw
run: 20260726-204622-work-verify-8b743c
status: failed
- false [failed] exit=1

$ .venv/bin/brigade outcome capture brigade-work --target /tmp/brigade-475-demo.a3ayVw --run-id 20260726-204622-work-verify-8b743c
outcome capture: brigade-work
source: verify [failed] signal=-1
evidence: /tmp/brigade-475-demo.a3ayVw/.brigade/work/verify-runs/20260726-204622-work-verify-8b743c/receipt.json

$ .venv/bin/brigade work verify run --target /tmp/brigade-475-demo.a3ayVw --command false
work verify run: /tmp/brigade-475-demo.a3ayVw
run: 20260726-204628-work-verify-fe2fc9
status: failed
- false [failed] exit=1

The final run starts without a capture warning.

Closes #475.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 84cb13d3-610d-4b3f-8d17-283b99ec595d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/475-capture-before-retry

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}