@drisp/cli 0.7.5 → 0.7.7

package/dist/{WorkflowInstallWizard-4GRQGM42.js → WorkflowInstallWizard-VVEEJW25.js}

@@ -8,7 +8,7 @@ import {
   installWorkflowPlugins,
   resolveWorkflow,
   writeGlobalConfig
-} from "./chunk-UQWOGG3L.js";
+} from "./chunk-HZ6GRLOM.js";
 import "./chunk-G3PMV62Z.js";
 
 // src/setup/steps/WorkflowInstallWizard.tsx
@@ -93,4 +93,4 @@ function WorkflowInstallWizard({ source, onDone }) {
 export {
   WorkflowInstallWizard as default
 };
-//# sourceMappingURL=WorkflowInstallWizard-4GRQGM42.js.map
+//# sourceMappingURL=WorkflowInstallWizard-VVEEJW25.js.map

package/dist/{chunk-TG5EGPD2.js → chunk-D246FR4I.js}

@@ -54,7 +54,7 @@ import {
   verifyRendered,
   wakesFreshAfterHandover,
   workflowRegistryDir
-} from "./chunk-UQWOGG3L.js";
+} from "./chunk-HZ6GRLOM.js";
 import {
   __commonJS,
   __toESM
@@ -14892,7 +14892,7 @@ async function restoreCheckpoint(store, input) {
 
 // ../../modules/runtime/src/software-version.ts
 import "fs";
-var runnerSoftwareVersion = true ? "0.7.5" : JSON.parse(readFileSync2(new URL("../../../apps/cli/package.json", import.meta.url), "utf8")).version;
+var runnerSoftwareVersion = true ? "0.7.7" : JSON.parse(readFileSync2(new URL("../../../apps/cli/package.json", import.meta.url), "utf8")).version;
 
 // ../../modules/runtime/src/connection.ts
 var RunnerDisconnectedError = class extends Error {
@@ -20176,7 +20176,33 @@ var fillSchema = external_exports.strictObject({
   areas: external_exports.array(external_exports.enum(AREAS)).min(1).refine((areas) => new Set(areas).size === areas.length, {
     error: "areas must be unique"
   }),
-  qa: external_exports.enum(["none", "web", "macos"]),
+  qa: external_exports.enum(["none", "web", "macos", "both"]),
+  profile: external_exports.enum(["implementation", "documentation", "investigation"]).optional(),
+  rationale: external_exports.string().min(1).max(2e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
+    error: INSTRUCTIONS_MESSAGE
+  }).optional(),
+  acceptanceEvidence: external_exports.array(
+    external_exports.string().min(1).max(2e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
+      error: INSTRUCTIONS_MESSAGE
+    })
+  ).min(1).optional(),
+  testFirst: external_exports.strictObject({
+    enabled: external_exports.boolean(),
+    reason: external_exports.string().min(1).max(1e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
+      error: INSTRUCTIONS_MESSAGE
+    })
+  }).optional(),
+  review: external_exports.strictObject({
+    enabled: external_exports.boolean(),
+    reason: external_exports.string().min(1).max(1e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
+      error: INSTRUCTIONS_MESSAGE
+    })
+  }).optional(),
+  checks: external_exports.array(
+    external_exports.string().min(1).max(500).regex(
+      /^(?:npm (?:run|test|--prefix apps\/cli run)|npx vitest run|make (?:-C apps\/macos|check|typecheck)|git diff --check)(?: [a-zA-Z0-9_./:=@-]+)*$/
+    )
+  ).min(1).optional(),
   sizeClass: external_exports.enum(["S", "M", "L"]),
   instructions: external_exports.string().min(1).max(6e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
     error: INSTRUCTIONS_MESSAGE
@@ -20211,6 +20237,9 @@ var planInputSchema = external_exports.strictObject({
       // Names the issue's directory under `.athena/workflows/<slugId>/`, so only a Linear identifier.
       identifier: external_exports.string().regex(/^[A-Z][A-Z0-9]*-[0-9]+$/),
       title: external_exports.string(),
+      description: external_exports.string().optional(),
+      acceptanceCriteria: external_exports.string().optional(),
+      external: external_exports.boolean().optional(),
       url: external_exports.string().url(),
       branchName: external_exports.string().nullable(),
       state: external_exports.strictObject({
@@ -20240,7 +20269,12 @@ var SKIP_REASONS = [
   "ready-for-human",
   "merged",
   "done-pr-open",
-  "parent-only"
+  "parent-only",
+  "external",
+  "needs-info",
+  "needs-triage",
+  "wontfix",
+  "not-ready-for-agent"
 ];
 var count = external_exports.number().int().nonnegative();
 var issueEntrySchema = external_exports.strictObject({
@@ -20249,7 +20283,9 @@ var issueEntrySchema = external_exports.strictObject({
   title: external_exports.string(),
   blockedBy: external_exports.array(external_exports.string()),
   areas: external_exports.array(external_exports.enum(AREAS)).min(1),
-  qa: external_exports.enum(["none", "web", "macos"]),
+  qa: external_exports.enum(["none", "web", "macos", "both"]),
+  profile: external_exports.enum(["implementation", "documentation", "investigation"]).optional(),
+  scopeFingerprint: external_exports.string().optional(),
   sizeClass: external_exports.enum(["S", "M", "L"]),
   tokenCap: external_exports.number().int().positive(),
   model: external_exports.string(),
@@ -20441,6 +20477,32 @@ function mergeGuidance(earlier, guidance) {
   return rounds.slice(-GUIDANCE_ROUNDS);
 }
 
+// src/core/build/eligibility.ts
+import { createHash as createHash3 } from "crypto";
+function eligibilityReason(issue) {
+  if (issue.external) return "external";
+  for (const label of [
+    "ready-for-human",
+    "needs-info",
+    "needs-triage",
+    "wontfix"
+  ])
+    if (issue.labels.includes(label)) return label;
+  if (issue.state.type === "triage") return "needs-triage";
+  if (!issue.labels.includes("ready-for-agent")) return "not-ready-for-agent";
+  return void 0;
+}
+function scopeFingerprint(issue) {
+  return createHash3("sha256").update(
+    JSON.stringify([
+      issue.title,
+      issue.description ?? "",
+      issue.acceptanceCriteria ?? "",
+      issue.parentId
+    ])
+  ).digest("hex");
+}
+
 // src/core/build/planner.ts
 function skipReason(issue, pullRequests) {
   const prs = issue.branchName ? pullRequests[issue.branchName] : void 0;
@@ -20449,6 +20511,8 @@ function skipReason(issue, pullRequests) {
   if (issue.state.type === "completed") return "done";
   if (issue.state.type === "canceled") return "canceled";
   if (prs?.merged) return "merged";
+  const eligibility = eligibilityReason(issue);
+  if (eligibility) return eligibility;
   return void 0;
 }
 var byIdentifier = (a, b) => a.localeCompare(b, "en", { numeric: true });
@@ -20492,6 +20556,7 @@ function shownFromFill(fill) {
   return {
     areas: fill.areas,
     qa: fill.qa,
+    ...fill.profile ? { profile: fill.profile } : {},
     sizeClass: fill.sizeClass,
     tokenCap: limits.maxRunTokens,
     model: limits.model,
@@ -20590,11 +20655,21 @@ function planBuild(context) {
     ({ children, blockers } = blockingGraph(entries));
   }
   const held = new Set(
-    skipped.filter((skip) => skip.reason === "ready-for-human").map((skip) => skip.id)
+    skipped.filter(
+      (skip) => !["done", "merged", "done-pr-open", "parent-only"].includes(
+        skip.reason
+      )
+    ).map((skip) => skip.id)
   );
   const waitsFor = (issue) => [
     .../* @__PURE__ */ new Set([
-      ...issue.blockedBy.filter((id2) => blockers.has(id2) || held.has(id2)),
+      ...issue.blockedBy.filter(
+        (id2) => !input.issues.some(
+          (each) => each.id === id2 && (each.state.type === "completed" || skipped.some(
+            (skip) => skip.id === id2 && skip.reason === "merged"
+          ))
+        )
+      ),
       ...children.get(issue.id) ?? [],
       ...input.issues.filter((each) => each.parentId === issue.id && held.has(each.id)).map((each) => each.id)
     ])
@@ -20624,6 +20699,7 @@ function planBuild(context) {
       title: issue.title,
       blockedBy: waitsFor(issue),
       ...shownFromFill(fill),
+      scopeFingerprint: scopeFingerprint(issue),
       workflowName: workflowName2
     });
     workflows.push({
@@ -21195,7 +21271,7 @@ async function closeOrphanedRuns(store, {
 }
 
 // ../../modules/runtime/src/run-artifacts.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { dirname as dirname4, join as join7 } from "path";
@@ -21238,7 +21314,7 @@ function runArtifactEmitter(directory, record, midTurnMinGapMs = MID_TURN_MIN_GA
       } catch {
         continue;
       }
-      const hash = createHash3("sha256").update(bytes).digest("hex");
+      const hash = createHash4("sha256").update(bytes).digest("hex");
       if (emitted[name] === hash) continue;
       let json;
       try {
@@ -21943,6 +22019,8 @@ export {
   repoLayoutAt,
   approvalAnswer,
   mergeGuidance,
+  eligibilityReason,
+  scopeFingerprint,
   planBuild,
   finalizePlan,
   fallbackBranch,
@@ -21967,4 +22045,4 @@ export {
   runMachineRunners,
   writeIdentityOnce
 };
-//# sourceMappingURL=chunk-TG5EGPD2.js.map
+//# sourceMappingURL=chunk-D246FR4I.js.map

package/dist/{chunk-N4B7HLBN.js → chunk-D5VZT7M3.js}

@@ -1,6 +1,6 @@
 import {
   runMachineRunners
-} from "./chunk-TG5EGPD2.js";
+} from "./chunk-D246FR4I.js";
 
 // src/app/entry/runnerDaemon.ts
 if (process.argv.includes("--help")) {
@@ -13,4 +13,4 @@ if (process.argv.includes("--help")) {
     process.exitCode = 1;
   });
 }
-//# sourceMappingURL=chunk-N4B7HLBN.js.map
+//# sourceMappingURL=chunk-D5VZT7M3.js.map

package/dist/{chunk-UQWOGG3L.js → chunk-HZ6GRLOM.js}

@@ -21281,7 +21281,7 @@ var GATES = [
 ];
 
 // src/core/workflows/builtins/orchestrator/workflow.md
-var workflow_default = '# Orchestrator: plan and run a Build\n\nYou plan and run a Drisp Build of one Plan: the open issues of one Linear project. The Run\'s prompt names the\nLinear project, the Plan key and the project folder, which is your working directory. You never write code here:\neach issue is built by its own child Run, which `drisp build tick` starts.\n\nThe Runner sets these for you:\n\n- `DRISP_RUN_ARTIFACTS`: this Run\'s artifact directory. Files you write there are shown to the member.\n- `DRISP_RUN_ID`, `DRISP_RUNNER_ID`, `DRISP_RUN_TOKEN`, `DRISP_HUB_URL`: this Run, its Runner and its right to start\n  child Runs; `drisp build` reads them itself.\n\n## 1. Read Linear (first Turn)\n\nWith the `linear` MCP server, read the project and every issue in it, then write\n`$DRISP_RUN_ARTIFACTS/input/plan-input.json` (create the `input` directory) in exactly this shape. Every issue carries\nevery field, empty when it has none. `readAt` is the output of\n`node -e "console.log(new Date().toISOString())"` run just before you read Linear; never write a time yourself:\n\n```json\n{\n	"version": 1,\n	"readAt": "<the command\'s output, e.g. 2026-10-11T09:30:00.000Z>",\n	"project": {\n		"id": "<the project\'s `uuid`, not its `id`>",\n		"name": "<the project\'s `name`>",\n		"slugId": "<the last `-`-separated part of the project\'s `url`>"\n	},\n	"issues": [\n		{\n			"id": "<the issue\'s `uuid`, not its `id`>",\n			"identifier": "<the issue\'s `id`, e.g. DRI-12>",\n			"title": "<the issue\'s `title`>",\n			"url": "<the issue\'s `url`>",\n			"branchName": "<the issue\'s `gitBranchName`, or null>",\n			"state": {\n				"type": "<the issue\'s `statusType`: backlog|unstarted|started|completed|canceled|triage>",\n				"name": "<the issue\'s `status`>"\n			},\n			"labels": ["<each of the issue\'s `labels`>"],\n			"parentId": "<the parent issue\'s `uuid`, or null>",\n			"blockedBy": ["<the `uuid` of each issue in `relations.blockedBy`>"],\n			"prioritySortOrder": 0\n		}\n	]\n}\n```\n\nLinear\'s MCP names fields differently from this file, and the difference matters: the app finds each issue\'s row by\nits UUID, so a plan that carries identifiers shows no Build state on any row.\n\n- The MCP\'s `id` is the readable identifier (`DRI-12`, or `P-DRI-7` for a project); the UUID is in `uuid`. Every\n  `id`, `parentId` and `blockedBy` value in `plan-input.json` is a UUID (`7f7b03f7-accf-46b2-98fb-abadfed76594`).\n- An issue\'s `parentId` and `relations.blockedBy` from the MCP name issues by identifier. Look each one up: use the\n  `uuid` of the project\'s issue with that identifier, or `get_issue` it when it is outside the project.\n- Read relations with `get_issue` and `includeRelations: true`; read the project\'s issues with `list_issues` and\n  `fields` including `uuid`.\n- The project\'s `url` ends in its `slugId` (`\u2026/project/build-sandbox-b7640301cd64` \u2192 `b7640301cd64`).\n\n`drisp build plan` rejects a plan with an identifier where a UUID belongs and names the field to fix.\n\nInclude every issue of the project, done and canceled ones too: the plan decides what to skip. Then run:\n\n```sh\ndrisp build plan --input "$DRISP_RUN_ARTIFACTS/input/plan-input.json"\n```\n\nIt prints one JSON object. Act on its `status`.\n\n## 2. `needs_fills`\n\n`fills` lists issues that need a `fill.json` (`identifier`, `title`, `url`, `path`) and `templateVersion` is the value\neach fill must carry. For each listed issue: read it through `linear` (description, acceptance criteria, comments) and\nthe repo\'s ADRs and CONTEXT files it touches, then write its `fill.json` at `path`:\n\n```json\n{\n	"version": 1,\n	"templateVersion": "<templateVersion, copied exactly>",\n	"areas": ["macos|web|cli|hub|protocol|docs", "\u2026"],\n	"qa": "none|web|macos",\n	"sizeClass": "S|M|L",\n	"instructions": "<what the child needs beyond the issue>",\n	"ownWork": true\n}\n```\n\n- `areas`: the parts of the repo the change touches, each once.\n- `qa`: `web` when the change shows in a web page, `macos` when it shows in the macOS app, else `none`.\n- `sizeClass`: `S` for a change of a file or two, `M` for a feature across a few modules, `L` for a large or risky\n  change.\n- `instructions` (at most 6000 characters): start with one short paragraph saying what to build, then restate the\n  acceptance criteria, name the ADRs it touches and the parts of the codebase involved. Plain prose and `-` lists\n  only: no headings, code fences or HTML comments (`drisp build plan` rejects them).\n- `ownWork`: `false` only for an issue with sub-issues whose own description asks for nothing beyond them, such as\n  a PRD above its slices; the plan then skips it and waits for its sub-issues instead. Otherwise `true`.\n\nThen run `drisp build plan` again with the same `--input` path.\n\n## 3. `planned` or `failed`\n\nOn `planned` the Build plan is written and shown to the member, who decides whether to start it: end the Turn with\n`<!-- AWAITING_APPROVAL -->` as the Journal\'s last line. On `failed` the reason is shown instead: end with\n`<!-- WORKFLOW_COMPLETE -->`.\n\n## 4. Every later wake: tick\n\nYou are woken when the member answers the approval question (with Start, or with words of their own before it) and whenever one of your child Runs closes or parks.\nEach time: read Linear again into `$DRISP_RUN_ARTIFACTS/input/plan-input.json` as in step 1 (with a new `readAt`),\nthen run:\n\n```sh\ndrisp build tick --input "$DRISP_RUN_ARTIFACTS/input/plan-input.json"\n```\n\nIt prints one JSON object. Act on its `action`, and repeat until an action ends the Turn:\n\n- `refresh_input`: read Linear into the input again (a newer `readAt`) and tick again.\n- `replan`: the member wrote words before starting, and `guidance` lists every round of them, oldest first. Plan again\n  with them as the member\'s wishes: read the issues they concern (and the repo) as in step 2, rewrite the `fill.json`\n  of each issue the guidance changes (`instructions`, `areas`, `qa`, `sizeClass`, or `ownWork` to leave an issue out),\n  and run `drisp build plan` again with the same `--input` path. Then end as in step 3: with\n  `<!-- AWAITING_APPROVAL -->` on `planned`, `<!-- WORKFLOW_COMPLETE -->` on `failed`. Write nothing but those\n  `fill.json` files.\n- `repair`: for each of `issues`, read it in Linear first and skip an issue Linear now shows Done or Canceled (its\n  child got there first); otherwise move it to Done and post its `comment` verbatim through `linear`. Then read\n  Linear into the input again and tick again.\n- `rebase`: for each of `items`, in its `worktree`: `git rebase origin/main`, resolve the conflicts, then\n  `git push --force-with-lease origin <branch>` (the item\'s `branch`) if the branch is on the remote. Never push any\n  other branch. If a rebase cannot be resolved, `git rebase --abort`.\n  Then read Linear into the input again and tick again, adding `--rebase-failed <identifier>` for each that failed.\n- `wait`: end the Turn with `<!-- WAITING_ON_CHILDREN -->` as the Journal\'s last line.\n- `park`: end the Turn with `<!-- NEEDS_HUMAN: <message> -->` as the Journal\'s last line, copying `message`\n  verbatim.\n- `complete`: end the Turn with `<!-- WORKFLOW_COMPLETE -->` as the Journal\'s last line.\n\n## Rules\n\n- Never start, cancel or edit Runs, Workflows, worktrees or branches except as an action says; `drisp build` does\n  what is needed.\n- Never write to Linear except a `repair`; never open a pull request.\n- Write only `plan-input.json` and the `fill.json` files `drisp build plan` asks for. Never write `answer.json`.\n';
+var workflow_default = '# Orchestrator: plan and run a Build\n\nYou plan and run a Drisp Build of one Plan: the open issues of one Linear project. The Run\'s prompt names the\nLinear project, the Plan key and the project folder, which is your working directory. You never write code here:\neach issue is built by its own child Run, which `drisp build tick` starts.\n\nThe Runner sets these for you:\n\n- `DRISP_RUN_ARTIFACTS`: this Run\'s artifact directory. Files you write there are shown to the member.\n- `DRISP_RUN_ID`, `DRISP_RUNNER_ID`, `DRISP_RUN_TOKEN`, `DRISP_HUB_URL`: this Run, its Runner and its right to start\n  child Runs; `drisp build` reads them itself.\n\n## 1. Read Linear (first Turn)\n\nWith the `linear` MCP server, read the project and every issue in it, then write\n`$DRISP_RUN_ARTIFACTS/input/plan-input.json` (create the `input` directory) in exactly this shape. Every issue carries\nevery field, empty when it has none. `readAt` is the output of\n`node -e "console.log(new Date().toISOString())"` run just before you read Linear; never write a time yourself:\n\n```json\n{\n	"version": 1,\n	"readAt": "<the command\'s output, e.g. 2026-10-11T09:30:00.000Z>",\n	"project": {\n		"id": "<the project\'s `uuid`, not its `id`>",\n		"name": "<the project\'s `name`>",\n		"slugId": "<the last `-`-separated part of the project\'s `url`>"\n	},\n	"issues": [\n		{\n			"id": "<the issue\'s `uuid`, not its `id`>",\n			"identifier": "<the issue\'s `id`, e.g. DRI-12>",\n			"title": "<the issue\'s `title`>",\n			"description": "<full current description>",\n			"acceptanceCriteria": "<acceptance criteria, empty when included in description>",\n			"external": false,\n			"url": "<the issue\'s `url`>",\n			"branchName": "<the issue\'s `gitBranchName`, or null>",\n			"state": {\n				"type": "<the issue\'s `statusType`: backlog|unstarted|started|completed|canceled|triage>",\n				"name": "<the issue\'s `status`>"\n			},\n			"labels": ["<each of the issue\'s `labels`>"],\n			"parentId": "<the parent issue\'s `uuid`, or null>",\n			"blockedBy": ["<the `uuid` of each issue in `relations.blockedBy`>"],\n			"prioritySortOrder": 0\n		}\n	]\n}\n```\n\nLinear\'s MCP names fields differently from this file, and the difference matters: the app finds each issue\'s row by\nits UUID, so a plan that carries identifiers shows no Build state on any row.\n\n- The MCP\'s `id` is the readable identifier (`DRI-12`, or `P-DRI-7` for a project); the UUID is in `uuid`. Every\n  `id`, `parentId` and `blockedBy` value in `plan-input.json` is a UUID (`7f7b03f7-accf-46b2-98fb-abadfed76594`).\n- An issue\'s `parentId` and `relations.blockedBy` from the MCP name issues by identifier. Look each one up: use the\n  `uuid` of the project\'s issue with that identifier, or `get_issue` it when it is outside the project.\n- Read relations with `get_issue` and `includeRelations: true`; read the project\'s issues with `list_issues` and\n  `fields` including `uuid`.\n- The project\'s `url` ends in its `slugId` (`\u2026/project/build-sandbox-b7640301cd64` \u2192 `b7640301cd64`).\n\n`drisp build plan` rejects a plan with an identifier where a UUID belongs and names the field to fix.\n\nAlso include every referenced blocker outside the project, with `external: true`, its current status and UUID. Follow blocker relations recursively; deduplicate by UUID. Never mark a project issue external. External issues are read only and never scheduled. Preserve actual prioritySortOrder when available.\n\nOnly ready-for-agent issues without conflicting ready-for-human, needs-info, needs-triage or wontfix labels are eligible. Do not invent or change labels to make an issue eligible.\n\nInclude every issue of the project, done and canceled ones too: the plan decides what to skip. Then run:\n\n```sh\ndrisp build plan --input "$DRISP_RUN_ARTIFACTS/input/plan-input.json"\n```\n\nIt prints one JSON object. Act on its `status`.\n\n## 2. `needs_fills`\n\n`fills` lists issues that need a `fill.json` (`identifier`, `title`, `url`, `path`) and `templateVersion` is the value\neach fill must carry. For each listed issue: read it through `linear` (description, acceptance criteria, comments) and\nthe repo\'s ADRs and CONTEXT files it touches, then write its `fill.json` at `path`:\n\n```json\n{\n	"version": 1,\n	"templateVersion": "<templateVersion, copied exactly>",\n	"areas": ["macos|web|cli|hub|protocol|docs", "\u2026"],\n	"qa": "none|web|macos|both",\n	"profile": "implementation|documentation|investigation",\n	"rationale": "<why these steps are appropriate>",\n	"acceptanceEvidence": [\n		"<each acceptance criterion and the evidence that demonstrates it>"\n	],\n	"sizeClass": "S|M|L",\n	"instructions": "<what the child needs beyond the issue>",\n	"ownWork": true\n}\n```\n\n- `areas`: the parts of the repo the change touches, each once.\n- `profile`: implementation for behavior changes, documentation for prose-only repository changes, investigation for findings with no repository changes. Implementation defaults to TDD and two-reviewer code review; documentation and investigation omit these by default. Choose the profile from the actual deliverable, not the issue size.\n- Optional `testFirst` and `review`: `{ "enabled": true|false, "reason": "<issue-specific justification>" }`. Retain tests and review for behavioral changes; omit only when not applicable and explain why. These selections also control required skills.\n- Optional `checks`: a nonempty list of actual validation commands from the repo, using the supported npm, vitest, make or git diff command families. Read repository tooling and add the relevant test/build checks: typechecking alone does not prove behavior. If a necessary command is unsupported, state that limitation in instructions and require human attention, never claim validation passed.\n- `acceptanceEvidence`: cover every criterion, including the method and expected outcome.\n- `qa`: `both` when both interfaces change, `web` when the change shows in a web page, `macos` when it shows in the macOS app, else `none`.\n- `sizeClass`: `S` for a change of a file or two, `M` for a feature across a few modules, `L` for a large or risky\n  change.\n- `instructions` (at most 6000 characters): start with one short paragraph saying what to build, then restate the\n  acceptance criteria, name the ADRs it touches and the parts of the codebase involved. Plain prose and `-` lists\n  only: no headings, code fences or HTML comments (`drisp build plan` rejects them).\n- `ownWork`: `false` only for an issue with sub-issues whose own description asks for nothing beyond them, such as\n  a PRD above its slices; the plan then skips it and waits for its sub-issues instead. Otherwise `true`.\n\nThen run `drisp build plan` again with the same `--input` path.\n\n## 3. `planned` or `failed`\n\nOn `planned` the Build plan is written and shown to the member, who decides whether to start it: end the Turn with\n`<!-- AWAITING_APPROVAL -->` as the Journal\'s last line. On `failed` the reason is shown instead: end with\n`<!-- WORKFLOW_COMPLETE -->`.\n\n## 4. Every later wake: tick\n\nYou are woken when the member answers the approval question (with Start, or with words of their own before it) and whenever one of your child Runs closes or parks.\nEach time: read Linear again into `$DRISP_RUN_ARTIFACTS/input/plan-input.json` as in step 1 (with a new `readAt`),\nincluding full descriptions, acceptance criteria, labels and external blocker status. A scope change holds the affected issue for a fresh Build and approval. Then run:\n\n```sh\ndrisp build tick --input "$DRISP_RUN_ARTIFACTS/input/plan-input.json"\n```\n\nIt prints one JSON object. Act on its `action`, and repeat until an action ends the Turn:\n\n- `refresh_input`: read Linear into the input again (a newer `readAt`) and tick again.\n- `replan`: the member wrote words before starting, and `guidance` lists every round of them, oldest first. Plan again\n  with them as the member\'s wishes: read the issues they concern (and the repo) as in step 2, rewrite the `fill.json`\n  of each issue the guidance changes (`instructions`, `areas`, `qa`, `sizeClass`, or `ownWork` to leave an issue out),\n  and run `drisp build plan` again with the same `--input` path. Then end as in step 3: with\n  `<!-- AWAITING_APPROVAL -->` on `planned`, `<!-- WORKFLOW_COMPLETE -->` on `failed`. Write nothing but those\n  `fill.json` files.\n- `repair`: for each of `issues`, read it in Linear first and skip an issue Linear now shows Done or Canceled (its\n  child got there first); otherwise move it to Done and post its `comment` verbatim through `linear`. Then read\n  Linear into the input again and tick again.\n- `rebase`: for each of `items`, in its `worktree`: `git rebase origin/main`, resolve the conflicts, then\n  `git push --force-with-lease origin <branch>` (the item\'s `branch`) if the branch is on the remote. Never push any\n  other branch. If a rebase cannot be resolved, `git rebase --abort`.\n  Then read Linear into the input again and tick again, adding `--rebase-failed <identifier>` for each that failed.\n- `wait`: end the Turn with `<!-- WAITING_ON_CHILDREN -->` as the Journal\'s last line.\n- `park`: end the Turn with `<!-- NEEDS_HUMAN: <message> -->` as the Journal\'s last line, copying `message`\n  verbatim.\n- `complete`: end the Turn with `<!-- WORKFLOW_COMPLETE -->` as the Journal\'s last line.\n\n## Rules\n\n- Never start, cancel or edit Runs, Workflows, worktrees or branches except as an action says; `drisp build` does\n  what is needed.\n- Never write to Linear except a `repair`; never open a pull request.\n- Write only `plan-input.json` and the `fill.json` files `drisp build plan` asks for. Never write `answer.json`.\n';
 
 // src/core/workflows/builtins/orchestrator/index.ts
 var ORCHESTRATOR_WORKFLOW_NAME = "orchestrator";
@@ -21440,6 +21440,14 @@ Journal's last line.
 
 {instructions}
 
+## Evidence receipts
+
+Progress is not proof that a step passed. Follow each Finish instruction only after its acceptance condition holds.
+Record actual results, commands, output paths and acceptance criteria, never a generic claim of success.
+Commit repository changes before recording validation evidence. Changes to HEAD or source invalidate validation
+receipts: rerun affected tests, review, checks and QA, including after a rebase, before verifying the Merge step.
+Keep evidence files under .athena/evidence/ and do not commit them after validation, since a new commit invalidates receipts.
+
 ## Gates
 
 Work through the gates in this order. Start each gate by running the command its "Start" line gives, which reports the
@@ -21464,10 +21472,17 @@ is in \`ignored\`: it does not block the merge and its name goes in the evidence
 empty, wait a minute and run it again. When \`failed\` is not empty, fix the change; if it still fails, the Merge gate
 cannot pass. Never judge a check by its timing.
 
+Immediately before merging, verify the current revision again: {mergeVerify}. If evidence is stale, rerun the
+selected validation steps and record fresh receipts before continuing.
+
 Merge with \`gh pr merge --squash --delete-branch --match-head-commit <sha>\`, where \`<sha>\` is HEAD after the last
 push. When it exits non-zero, \`gh pr view --json state\` decides: \`MERGED\` means the merge happened (a worktree
 cannot check out main afterwards); anything else means it did not.
 
+After a merge, and only then, run \`drisp build merged <pr url>\` in this worktree: it records the merged pull request as the
+\`pull_request\` run artifact and exits non-zero if the pull request is not merged. Never run it before the merge or
+after a failed one; if it fails only because GitHub has not caught up, wait a few seconds and run it again.
+
 ## Evidence comment
 
 Post exactly this on the Linear issue, filling the angle brackets:
@@ -21502,12 +21517,13 @@ No gate text: the loop's caps apply.`;
 
 // src/core/workflows/builtins/build-child/render.ts
 var RENDERER_RULES = {
-  alwaysSkills: ["tdd", "code-review"],
+  alwaysSkills: [],
+  profiles: ["implementation", "documentation", "investigation"],
   alwaysMcpServers: ["linear"],
   areaSkills: {
     macos: ["swiftui-expert-skill", "apple-docs", "apple-hig-components"]
   },
-  qaMcpServers: { web: ["drisp-browser"] },
+  qaMcpServers: { web: ["drisp-browser"], both: ["drisp-browser"] },
   npmTestAreas: ["cli", "hub", "protocol"],
   /**
    * The Checks gate's commands, resolved from the fill's areas and the repo's layout at the plan's commit: a repo
@@ -21570,6 +21586,7 @@ var RENDERER_RULES = {
     shell: [
       "drisp build checks",
       "drisp build step",
+      "drisp build merged",
       "gh pr checks",
       "gh pr create",
       "gh pr list",
@@ -21611,7 +21628,10 @@ var LAYOUT_MARKERS = [
   "apps/cli/package.json"
 ];
 function checkCommands(fill, layout) {
+  if (fill.checks) return [...fill.checks];
   const rules = RENDERER_RULES.checks;
+  if (fill.profile === "documentation" || fill.profile === "investigation")
+    return [...rules.otherwise];
   if (layout.includes("Makefile"))
     return [
       ...rules.rootMakefile,
@@ -21630,7 +21650,11 @@ function checkCommands(fill, layout) {
 function installCommand(fill, layout) {
   const { install } = RENDERER_RULES.checks;
   if (!layout.includes(install.needs)) return void 0;
-  const needsNode = layout.includes("Makefile") || checkCommands(fill, layout).some((command) => /^np[mx] /.test(command));
+  const needsNode = checkCommands(fill, layout).some(
+    (command) => /^np[mx] /.test(command) || layout.includes("Makefile") && RENDERER_RULES.checks.rootMakefile.some(
+      (rootCommand) => rootCommand === command
+    )
+  );
   return needsNode ? install.command : void 0;
 }
 var GENERATED_NAME = /^build--([a-z0-9]+)--([A-Z][A-Z0-9]*-[0-9]+)$/;
@@ -21648,6 +21672,8 @@ function renderedSkills(fill) {
   return [
     .../* @__PURE__ */ new Set([
       ...RENDERER_RULES.alwaysSkills,
+      ...usesTestFirst(fill) ? ["tdd"] : [],
+      ...usesReview(fill) ? ["code-review"] : [],
       ...fill.areas.flatMap((area) => RENDERER_RULES.areaSkills[area] ?? [])
     ])
   ].sort();
@@ -21660,8 +21686,24 @@ function renderedMcpServers(fill) {
     ])
   ].sort();
 }
+function shellCommands(fill) {
+  const commands = [...RENDERER_RULES.permissions.shell];
+  return fill.profile !== "investigation" ? commands : commands.filter(
+    (command) => ![
+      "drisp build merged",
+      "gh pr create",
+      "gh pr merge",
+      "git add",
+      "git commit",
+      "git push",
+      "git rebase",
+      "git restore"
+    ].includes(command)
+  );
+}
 function renderedPermissions(fill) {
-  const { edit, shell, deny } = RENDERER_RULES.permissions;
+  const { edit, deny } = RENDERER_RULES.permissions;
+  const shell = shellCommands(fill);
   return {
     allow: [
       ...edit,
@@ -21671,10 +21713,29 @@ function renderedPermissions(fill) {
     deny: [...deny]
   };
 }
-function gateTitles(fill) {
-  return GATES.filter((gate) => gate.title !== "QA" || fill.qa !== "none").map(
-    (gate) => gate.title
+var usesTestFirst = (fill) => fill.testFirst?.enabled ?? (!fill.profile || fill.profile === "implementation");
+var usesReview = (fill) => fill.review?.enabled ?? (!fill.profile || fill.profile === "implementation");
+function selectedGates(fill) {
+  const gates = GATES.filter(
+    (gate) => (gate.title !== "QA" || fill.qa !== "none") && (gate.title !== "Test first" || usesTestFirst(fill)) && (gate.title !== "Code review" || usesReview(fill)) && (fill.profile !== "investigation" || !["Pull request", "Merge"].includes(gate.title))
+  ).map(
+    (gate) => fill.profile === "investigation" && gate.title === "Checks" ? {
+      ...gate,
+      passesWhen: "{install}{checks} pass; each finding is supported by a source or reproducible observation and each acceptance criterion has evidence; unresolved questions are stated explicitly"
+    } : fill.profile === "investigation" && gate.title === "Evidence" ? {
+      ...gate,
+      passesWhen: "findings and evidence for each acceptance criterion are posted on the Linear issue, with unresolved questions explicitly stated; the issue is moved to Done only when all acceptance criteria are satisfied"
+    } : gate
   );
+  if (!usesTestFirst(fill))
+    gates.splice(1, 0, {
+      title: fill.profile === "investigation" ? "Investigate" : "Implement",
+      passesWhen: fill.profile === "investigation" ? "the question is investigated and findings address every acceptance criterion; no repository changes are made" : "the requested change is implemented and each acceptance criterion is checked"
+    });
+  return gates;
+}
+function gateTitles(fill) {
+  return selectedGates(fill).map((gate) => gate.title);
 }
 function summarizeInstructions(instructions) {
   const paragraph = (instructions.trim().split(/\n\s*\n/)[0] ?? "").replace(/\s+/g, " ").trim();
@@ -21689,21 +21750,29 @@ function checksText(commands) {
   return quoted.length === 1 ? quoted[0] : `${quoted.slice(0, -1).join(", ")} and ${quoted.at(-1)}`;
 }
 var fillSlots = (template, slots) => template.replace(/\{(\w+)\}/g, (whole, key) => slots[key] ?? whole);
+function selectionFlags(fill) {
+  return `${fill.profile ? ` --profile ${fill.profile}` : ""}${fill.testFirst ? ` --test-first ${fill.testFirst.enabled}` : ""}${fill.review ? ` --review ${fill.review.enabled}` : ""}`;
+}
 function renderStages(fill, checks, install) {
-  const gates = GATES.filter((gate) => gate.title !== "QA" || fill.qa !== "none");
+  const gates = selectedGates(fill);
   return gates.map((gate, index) => {
     const passesWhen = fillSlots(gate.passesWhen, {
       install: install ? `after \`${install}\`, ` : "",
       checks: checksText(checks),
-      qa: fill.qa === "none" ? "" : QA_SECTIONS[fill.qa]
+      qa: fill.qa === "none" ? "" : fill.qa === "both" ? `${QA_SECTIONS.web}; also ${QA_SECTIONS.macos}` : QA_SECTIONS[fill.qa]
     });
+    const command = `drisp build step ${index + 1} --qa ${fill.qa}${selectionFlags(fill)}`;
     const stage = fillSlots(STAGE_TEMPLATE, {
       n: String(index + 1),
       title: gate.title,
-      stepCommand: `drisp build step ${index + 1} --qa ${fill.qa}`,
+      stepCommand: command,
       passesWhen
     });
-    return stage + (gate.cannotPass ? fillSlots(CANNOT_PASS_TEMPLATE, { cannotPass: gate.cannotPass }) : NO_GATE_TEXT_TEMPLATE);
+    return stage + (["Merge", "Evidence"].includes(gate.title) ? `
+
+Before doing this step: run \`${command} --verify\`. Missing or stale evidence must be refreshed first.` : "") + `
+
+Finish: write the actual result and supporting paths to \`.athena/evidence/step-${index + 1}.md\`, then run \`${command} --complete --evidence .athena/evidence/step-${index + 1}.md\`. This records an agent attestation, not independent verification.` + (gate.cannotPass ? fillSlots(CANNOT_PASS_TEMPLATE, { cannotPass: gate.cannotPass }) : NO_GATE_TEXT_TEMPLATE);
   }).join("\n\n");
 }
 function render(fill, workflowName, layout) {
@@ -21713,7 +21782,7 @@ function render(fill, workflowName, layout) {
   const limits = sizeClassLimits(fill.sizeClass);
   const workflow = {
     name: workflowName,
-    description: fillSlots(DESCRIPTION_TEMPLATE, {
+    description: fill.profile === "investigation" ? `Investigates ${parsed.identifier} and delivers findings with acceptance evidence.` : fillSlots(DESCRIPTION_TEMPLATE, {
       identifier: parsed.identifier
     }),
     promptTemplate: "{input}",
@@ -21730,12 +21799,40 @@ function render(fill, workflowName, layout) {
     permissions: renderedPermissions(fill)
   };
   const checks = checkCommands(fill, layout);
-  const workflowMd = fillSlots(WORKFLOW_MD_TEMPLATE, {
+  let template = WORKFLOW_MD_TEMPLATE;
+  if (!usesReview(fill))
+    template = template.replaceAll(
+      "both reviewers pass;",
+      "review is omitted by the approved plan;"
+    ).replaceAll(
+      "Review: Standards \u2713 \xB7 Spec \u2713",
+      "Review: omitted by the approved plan"
+    );
+  if (fill.profile === "investigation") {
+    template = template.replace(
+      /## Merge gate[\s\S]*?## Linear/,
+      "## Findings\n\nPost findings and acceptance evidence on the Linear issue. No pull request or merge is required.\n\n## Linear"
+    );
+    template = template.replace(
+      "Your Linear writes are exactly: In Progress in Explore, `PR: <url>` in Pull request, the evidence comment and Done in\nEvidence.",
+      "Your Linear writes are In Progress in Explore, findings and evidence, and Done in Evidence."
+    );
+  }
+  const workflowMd = fillSlots(template, {
     identifier: parsed.identifier,
-    instructions: fill.instructions.trim(),
+    instructions: [
+      fill.instructions.trim(),
+      fill.rationale ? `Plan rationale: ${fill.rationale}` : "",
+      fill.testFirst ? `Test first: ${fill.testFirst.enabled ? "included" : "omitted"} \u2014 ${fill.testFirst.reason}` : "",
+      fill.review ? `Code review: ${fill.review.enabled ? "included" : "omitted"} \u2014 ${fill.review.reason}` : "",
+      ...(fill.acceptanceEvidence ?? []).map(
+        (item) => `Acceptance evidence: ${item}`
+      )
+    ].filter(Boolean).join("\n\n"),
     gates: renderStages(fill, checks, installCommand(fill, layout)),
+    mergeVerify: `\`drisp build step ${gateTitles(fill).indexOf("Merge") + 1} --qa ${fill.qa}${selectionFlags(fill)} --verify\``,
     checksEvidence: checks.map((command) => `${command} \u2713`).join(" \xB7 "),
-    shellCommands: checksText([...RENDERER_RULES.permissions.shell])
+    shellCommands: checksText(shellCommands(fill))
   });
   return { workflowJson: `${JSON.stringify(workflow, null, 2)}
 `, workflowMd };
@@ -24250,4 +24347,4 @@ export {
   compileWorkflowPlan,
   collectMcpServersWithOptions
 };
-//# sourceMappingURL=chunk-UQWOGG3L.js.map
+//# sourceMappingURL=chunk-HZ6GRLOM.js.map

package/dist/cli.js

@@ -37,6 +37,7 @@ import {
   cursorToVisualPosition,
   defaultWorktreesRoot,
   detectClaudeVersion,
+  eligibilityReason,
   ensureBuildWorktree,
   ensureChildWorktree,
   expandHome,
@@ -126,6 +127,7 @@ import {
   runnerServiceUnit,
   runnerSoftwareVersion,
   runnerUpdateRequestSchema,
+  scopeFingerprint,
   serviceInstallationId,
   sessionsDir,
   sliceAnsi,
@@ -140,7 +142,7 @@ import {
   visualPositionToOffset,
   wrapText,
   writeIdentityOnce
-} from "./chunk-TG5EGPD2.js";
+} from "./chunk-D246FR4I.js";
 import {
   generateId as generateId2
 } from "./chunk-PQIB66SG.js";
@@ -198,7 +200,7 @@ import {
   workflowRegistryDir,
   writeGlobalConfig,
   writeProjectConfig
-} from "./chunk-UQWOGG3L.js";
+} from "./chunk-HZ6GRLOM.js";
 import {
   __toESM
 } from "./chunk-G3PMV62Z.js";
@@ -206,10 +208,10 @@ import {
 // src/app/entry/cli.tsx
 import { render } from "ink";
 import meow from "meow";
-import fs10 from "fs";
+import fs11 from "fs";
 import { createRequire } from "module";
 import os5 from "os";
-import path10 from "path";
+import path11 from "path";
 import { fileURLToPath } from "url";
 
 // src/app/shell/sessionUiState.ts
@@ -5328,14 +5330,14 @@ function extractWebSearch(_input, response) {
   return { type: "text", content: extractTextContent(response), maxLines: 10 };
 }
 function extractNotebookEdit(input, _response) {
-  const path11 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
+  const path12 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
   const mode = typeof input["edit_mode"] === "string" ? input["edit_mode"] : "replace";
   const source = typeof input["new_source"] === "string" ? input["new_source"] : "";
-  if (!source) return { type: "text", content: `${mode} cell in ${path11}` };
+  if (!source) return { type: "text", content: `${mode} cell in ${path12}` };
   return {
     type: "code",
     content: source,
-    language: detectLanguage(path11),
+    language: detectLanguage(path12),
     maxLines: 10
   };
 }
@@ -5861,10 +5863,10 @@ function extractToolSubject(toolName, toolInput) {
       const parts = [];
       const pattern = str(input, "pattern");
       const glob = str(input, "glob");
-      const path11 = str(input, "path");
+      const path12 = str(input, "path");
       if (pattern) parts.push(`"${pattern}"`);
       if (glob) parts.push(glob);
-      if (path11) parts.push(`in ${path11}`);
+      if (path12) parts.push(`in ${path12}`);
       return parts.length > 0 ? parts.join("  ") : void 0;
     }
     case "Skill":
@@ -13095,7 +13097,7 @@ var thisMachine = (installationId) => ({
   os: `${platform()} ${release()}`.slice(0, 64),
   softwareVersion: runnerSoftwareVersion
 });
-var post = (origin, path11, body) => fetch(new URL(path11, origin), {
+var post = (origin, path12, body) => fetch(new URL(path12, origin), {
   method: "POST",
   headers: { "Content-Type": "application/json" },
   body: JSON.stringify(body)
@@ -13114,8 +13116,8 @@ async function alreadyConnected(existing, { forTeam, ownIdentity }) {
   const problem = own ? await credentialAccepted(own.config) ? void 0 : "lapsed" : forTeam(existing.orgId).length ? "other_runner" : "missing";
   const runner = { orgId: existing.orgId, runnerId: existing.runnerId, name: existing.name };
   if (own && problem === void 0) return { status: "already_connected", ...runner, path: own.path };
-  const path11 = (own ?? forTeam(existing.orgId)[0])?.path;
-  return { status: "identity_unusable", ...runner, problem, ...path11 ? { path: path11 } : {} };
+  const path12 = (own ?? forTeam(existing.orgId)[0])?.path;
+  return { status: "identity_unusable", ...runner, problem, ...path12 ? { path: path12 } : {} };
 }
 async function connectWithCode({
   code,
@@ -13187,20 +13189,20 @@ async function saveIdentity(origin, credential, { single, forTeam }, directory)
     name: credential.name
   });
   const replaced = [];
-  for (const { path: path12 } of forTeam(credential.orgId)) {
-    const aside = `${path12}.replaced-${Date.now()}`;
-    await rename(path12, aside);
+  for (const { path: path13 } of forTeam(credential.orgId)) {
+    const aside = `${path13}.replaced-${Date.now()}`;
+    await rename(path13, aside);
     replaced.push(aside);
   }
-  const path11 = single ?? teamIdentityPath(origin, credential.orgId, directory);
+  const path12 = single ?? teamIdentityPath(origin, credential.orgId, directory);
   try {
-    await writeIdentityOnce(path11, JSON.stringify(config, null, 2) + "\n");
+    await writeIdentityOnce(path12, JSON.stringify(config, null, 2) + "\n");
   } catch (error) {
     if (error.code === "EEXIST")
-      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path11} meanwhile; it was left unchanged.`);
+      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path12} meanwhile; it was left unchanged.`);
     throw error;
   }
-  return { status: "connected", config, path: path11, replaced };
+  return { status: "connected", config, path: path12, replaced };
 }
 function pathSegment(value) {
   const segment = encodeURIComponent(value);
@@ -13240,7 +13242,7 @@ async function refuseExisting(target) {
   throw new Error(`This machine already has a Runner${name ? ` (${name})` : ""} configured at ${target}.`);
 }
 async function disconnectRunner({
-  identity: { path: path11, config },
+  identity: { path: path12, config },
   serviceManager,
   othersRemain
 }) {
@@ -13273,7 +13275,7 @@ async function disconnectRunner({
     await restore();
     throw new Error(`The Hub refused to disconnect ${name} (${body.error ?? response.status}); it is still connected.`);
   }
-  await forgetRunner(path11);
+  await forgetRunner(path12);
   if (othersRemain) await restore();
   else await serviceManager?.remove();
   return result;
@@ -13426,18 +13428,18 @@ async function runRunnerCommandV2(input, options = {}) {
             `This machine is already connected to this Team as ${outcome.name}, but ${why}. ` + (code ? `The code was not used: connect a new Runner in its place with ${retry}. ` : `Connect a new Runner in its place with a Connect code from Settings \u2192 Runners: ${retry}. `) + `The old ${outcome.name} stays listed in Settings \u2192 Runners, offline.`
           );
         }
-        const { config, path: path11, replaced } = outcome;
+        const { config, path: path12, replaced } = outcome;
         for (const aside of replaced)
           process.stdout.write(
             `The Hub no longer recognised this machine's earlier identity for this Team; it was moved aside to ${aside}.
 `
           );
         process.stdout.write(
-          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path11}.
+          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path12}.
 `
         );
         if (services) {
-          const service = await ensureService(services, config, path11);
+          const service = await ensureService(services, config, path12);
           process.stdout.write(`${serviceStarted(service)}
 `);
           return 0;
@@ -13446,7 +13448,7 @@ async function runRunnerCommandV2(input, options = {}) {
           process.stdout.write(
             "No launchd or systemd here to run the Runner as a background service; running it in the foreground instead.\n"
           );
-        await runConfiguredRunner(path11, options.signal);
+        await runConfiguredRunner(path12, options.signal);
         return 0;
       }
       case "disconnect": {
@@ -13517,9 +13519,9 @@ async function runRunnerCommandV2(input, options = {}) {
               configured: true,
               // One entry per Team this machine serves; credentials are never printed.
               teams: identities.map(
-                ({ path: path11, config: { token: _token, ...config } }) => ({
+                ({ path: path12, config: { token: _token, ...config } }) => ({
                   ...config,
-                  path: path11
+                  path: path12
                 })
               ),
               service: service ? {
@@ -13615,7 +13617,7 @@ async function recoveryIdentity(runId) {
 }
 
 // src/app/entry/buildCommand.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 
 // src/core/build/planCommand.ts
 import fs6 from "fs";
@@ -13755,7 +13757,7 @@ function runBuildPlan(deps) {
     const fixturePullRequests = fixtureDir ? readJson(path6.join(fixtureDir, "pull-requests.json")) : void 0;
     const pullRequests = fixturePullRequests ?? Object.fromEntries(
       input.issues.filter(
-        (issue) => issue.branchName && issue.state.type !== "canceled" && !issue.labels.includes("ready-for-human")
+        (issue) => issue.branchName && issue.state.type !== "canceled" && !eligibilityReason(issue)
       ).map((issue) => [
         issue.branchName,
         deps.pullRequests(deps.folder, issue.branchName)
@@ -13864,9 +13866,9 @@ var DrispClient = class _DrispClient {
     if (!match) throw new Error("invalid_hub_url");
     return new _DrispClient(url.origin, decodeURIComponent(match[1]), async () => token);
   }
-  async request(path11, body) {
+  async request(path12, body) {
     const response = await fetch(
-      `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}${path11}`,
+      `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}${path12}`,
       {
         method: body === void 0 ? "GET" : "POST",
         headers: {
@@ -14266,8 +14268,22 @@ function occupies(view) {
 function assessTick(facts) {
   const { entries, orchestratorRunId } = facts;
   const state = structuredClone(facts.state);
+  for (const [id, reason] of Object.entries(state.needsPerson))
+    if (reason.startsWith("Issue is no longer eligible") || reason.startsWith("Waiting for prerequisite"))
+      delete state.needsPerson[id];
   const views = new Map(facts.children.map((view) => [view.runId, view]));
   const issues = new Map(facts.issues.map((issue) => [issue.id, issue]));
+  const parentOnly = new Set(
+    facts.skipped?.filter((issue) => issue.reason === "parent-only").map((issue) => issue.id) ?? []
+  );
+  const expandBlocker = (id, seen = /* @__PURE__ */ new Set()) => {
+    if (!parentOnly.has(id) || seen.has(id)) return [id];
+    const children = facts.issues.filter((issue) => issue.parentId === id);
+    if (!children.length) return [id];
+    return children.flatMap(
+      (issue) => expandBlocker(issue.id, /* @__PURE__ */ new Set([...seen, id]))
+    );
+  };
   const attemptsOf = (id) => state.attempts[id] ?? [];
   for (const entry of entries) {
     const prefix = `${orchestratorRunId}:${entry.identifier}:a`;
@@ -14310,7 +14326,7 @@ function assessTick(facts) {
   const status = /* @__PURE__ */ new Map();
   const skippedBlocker = (id) => {
     const linear = issues.get(id)?.state.type;
-    return linear === "completed" || linear === "canceled" ? "done" : "blocked";
+    return linear === "completed" ? "done" : "blocked";
   };
   const repair = [];
   const repaired = new Set(state.repaired ?? []);
@@ -14321,7 +14337,7 @@ function assessTick(facts) {
     const linear = issues.get(entry.id)?.state.type;
     const statusOf = () => {
       if (linear === "completed" || linear === "canceled") return "done";
-      const prs = prsOf(entry);
+      const prs = entry.profile === "investigation" ? void 0 : prsOf(entry);
       if (prs?.merged) {
         if (!repaired.has(entry.id) && !(newest && occupies(view))) {
           const prUrl = prs.mergedUrl ?? branchOf(entry);
@@ -14336,18 +14352,36 @@ function assessTick(facts) {
         return "done";
       }
       if (newest && (!view || !view.closed)) return "live";
+      const current = issues.get(entry.id);
+      if (!current || eligibilityReason(current)) {
+        state.needsPerson[entry.id] = `Issue is no longer eligible (${current ? eligibilityReason(current) : "missing from Linear"}). Update Linear, then Build again.`;
+        return "needs_person";
+      }
+      if (entry.scopeFingerprint && entry.scopeFingerprint !== scopeFingerprint(current)) {
+        state.needsPerson[entry.id] = "Issue scope changed after approval. Build again to review the revised plan.";
+        return "needs_person";
+      }
       if (newest?.outcome === "template_mismatch") return "replan";
       if (newest?.outcome === "completed")
-        state.needsPerson[entry.id] ??= BUILD_STRINGS.completedUnmerged;
+        state.needsPerson[entry.id] ??= entry.profile === "investigation" ? "The investigation ended without marking its accepted findings Done in Linear. Review its evidence." : BUILD_STRINGS.completedUnmerged;
       if (state.needsPerson[entry.id] || newest && !mayRetry(attempts))
         return "needs_person";
-      const blockers = entry.blockedBy.map(
-        (id) => status.get(id) ?? skippedBlocker(id)
-      );
+      const blockers = [
+        .../* @__PURE__ */ new Set([
+          ...entry.blockedBy,
+          ...current.blockedBy.flatMap((id) => expandBlocker(id))
+        ])
+      ].map((id) => {
+        if (issues.get(id)?.state.type === "canceled") return "blocked";
+        return status.get(id) ?? (entries.some((each) => each.id === id) && issues.get(id)?.state.type !== "completed" ? "pending" : skippedBlocker(id));
+      });
       if (blockers.some(
         (b) => b === "needs_person" || b === "replan" || b === "blocked"
-      ))
+      )) {
+        if (current.blockedBy.some((id) => !entry.blockedBy.includes(id)))
+          state.needsPerson[entry.id] = "Waiting for prerequisite work. Resolve its readiness, completion or cancellation in Linear, then resume.";
         return "blocked";
+      }
       return blockers.every((b) => b === "done") ? "ready" : "pending";
     };
     status.set(entry.id, statusOf());
@@ -14399,6 +14433,12 @@ function tickAction(input) {
   const done = input.entries.filter(
     (entry) => input.status.get(entry.id) === "done"
   ).length;
+  if (done !== input.entries.length)
+    return {
+      action: "park",
+      reason: "attention",
+      message: `Built ${done} of ${input.entries.length}. Remaining issues are blocked or need attention. Resolve the issue or dependency, then resume; Build again if the approved scope changed.`
+    };
   return {
     action: "complete",
     message: `Built ${done} of ${input.entries.length}`
@@ -14523,6 +14563,7 @@ async function runBuildTick(deps) {
   const entries = plan.groups.flatMap((group) => group.issues).filter((entry) => approved.has(entry.id));
   const issues = new Map(input.issues.map((issue) => [issue.id, issue]));
   const assessment = assessTick({
+    skipped: plan.skipped,
     orchestratorRunId,
     entries,
     issues: input.issues,
@@ -14725,8 +14766,16 @@ function evaluateRemoteChecks(runs) {
 }
 
 // src/core/build/step.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash2 } from "crypto";
 import fs8 from "fs";
 import path8 from "path";
+var receiptSchema = external_exports.strictObject({
+  title: external_exports.string().min(1),
+  revision: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  evidence: external_exports.string().min(1).max(16e3),
+  kind: external_exports.literal("agent-attestation")
+});
 var QA_KINDS = fillSchema.shape.qa.options;
 function runBuildStep(input) {
   const directory = requireEnv(input.env, "DRISP_RUN_ARTIFACTS");
@@ -14735,7 +14784,22 @@ function runBuildStep(input) {
     throw new BuildUsageError(
       `--qa must be one of ${QA_KINDS.join(", ")}, not "${qa}".`
     );
-  const titles = gateTitles({ qa });
+  const parsedProfile = fillSchema.shape.profile.safeParse(input.profile);
+  if (!parsedProfile.success)
+    throw new BuildUsageError("Unknown workflow profile.");
+  const profile = parsedProfile.data;
+  const selection = (value) => {
+    if (value === void 0) return void 0;
+    if (value !== "true" && value !== "false")
+      throw new BuildUsageError("Step selection must be true or false.");
+    return { enabled: value === "true", reason: "Approved workflow" };
+  };
+  const titles = gateTitles({
+    qa,
+    profile,
+    testFirst: selection(input.testFirst),
+    review: selection(input.review)
+  });
   const index = /^[0-9]+$/.test(input.n ?? "") ? Number(input.n) : 0;
   if (index < 1 || index > titles.length)
     throw new BuildUsageError(
@@ -14745,10 +14809,56 @@ function runBuildStep(input) {
     throw new BuildUsageError(
       `DRISP_RUN_ARTIFACTS (${directory}) is not a directory.`
     );
+  const receiptsPath = path8.join(directory, "gate_evidence.json");
+  let receipts = [];
+  if (fs8.existsSync(receiptsPath)) {
+    try {
+      receipts = external_exports.strictObject({ receipts: external_exports.array(receiptSchema).max(100) }).parse(JSON.parse(fs8.readFileSync(receiptsPath, "utf8"))).receipts;
+    } catch {
+      throw new BuildUsageError("Gate evidence is invalid.");
+    }
+  }
+  const revision = receipts.length || input.complete || input.verify ? workRevision(input.cwd ?? process.cwd()) : "";
+  const fresh = (receipt) => ["Explore", "Pull request", "Evidence", "Merge"].includes(receipt.title) || receipt.revision === revision;
+  if (input.verify || input.complete && titles[index - 1] === "Evidence") {
+    const missing = titles.slice(0, index - 1).filter((title) => !receipts.some((r) => r.title === title && fresh(r)));
+    if (missing.length)
+      throw new BuildUsageError(
+        `Missing or stale evidence: ${missing.join(", ")}. Repeat those steps on the current revision.`
+      );
+  }
+  if (input.complete) {
+    if (!input.evidence)
+      throw new BuildUsageError(
+        "--complete requires --evidence <file> containing the result and supporting paths."
+      );
+    let evidence;
+    try {
+      evidence = fs8.readFileSync(
+        path8.resolve(input.cwd ?? process.cwd(), input.evidence),
+        "utf8"
+      ).trim();
+    } catch {
+      throw new BuildUsageError("Cannot read the evidence file.");
+    }
+    if (!evidence || evidence.length > 16e3)
+      throw new BuildUsageError("Evidence must contain 1\u201316000 characters.");
+    receipts = receipts.filter((r) => r.title !== titles[index - 1]);
+    receipts.push({
+      title: titles[index - 1],
+      revision,
+      evidence,
+      kind: "agent-attestation"
+    });
+    fs8.writeFileSync(receiptsPath, JSON.stringify({ receipts }) + "\n");
+  }
   const artifact = {
     index,
     title: titles[index - 1],
-    total: titles.length
+    total: titles.length,
+    ...receipts.length ? {
+      completed: receipts.filter(fresh).map((r) => titles.indexOf(r.title) + 1).filter((n) => n > 0)
+    } : {}
   };
   fs8.writeFileSync(
     path8.join(directory, "step.json"),
@@ -14757,19 +14867,96 @@ function runBuildStep(input) {
   );
   return artifact;
 }
+function workRevision(cwd) {
+  const git2 = (...args) => execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  try {
+    const hash = createHash2("sha256").update(git2("rev-parse", "HEAD")).update(git2("diff", "HEAD", "--", ".", ":!.athena/evidence"));
+    for (const name of git2("ls-files", "--others", "--exclude-standard", "-z").split("\0").filter(Boolean).sort()) {
+      if (name.startsWith(".athena/evidence/")) continue;
+      hash.update(name).update(fs8.readFileSync(path8.join(cwd, name)));
+    }
+    return hash.digest("hex");
+  } catch {
+    throw new BuildUsageError("Evidence must be recorded in a git worktree.");
+  }
+}
+
+// src/core/build/merged.ts
+import fs9 from "fs";
+import path9 from "path";
+var pullRequestArtifactSchema = external_exports.strictObject({
+  url: external_exports.url(),
+  number: external_exports.number().int().positive(),
+  sha: external_exports.string().regex(/^[0-9a-f]{40}$/),
+  mergedAt: external_exports.iso.datetime()
+});
+function runBuildMerged(input) {
+  const directory = requireEnv(input.env, "DRISP_RUN_ARTIFACTS");
+  if (!fs9.statSync(directory, { throwIfNoEntry: false })?.isDirectory())
+    throw new BuildUsageError(
+      `DRISP_RUN_ARTIFACTS (${directory}) is not a directory.`
+    );
+  let view;
+  try {
+    view = JSON.parse(
+      input.gh(
+        [
+          "pr",
+          "view",
+          ...input.pullRequest ? [input.pullRequest] : [],
+          "--json",
+          "state,url,number,mergeCommit,mergedAt"
+        ],
+        input.cwd
+      )
+    );
+  } catch {
+    throw new BuildUsageError("gh pr view did not report this pull request.");
+  }
+  if (view.state !== "MERGED")
+    throw new BuildUsageError(
+      `This pull request is not merged (state ${String(view.state)}).`
+    );
+  const parsed = pullRequestArtifactSchema.safeParse({
+    url: view.url,
+    number: view.number,
+    sha: view.mergeCommit?.oid,
+    mergedAt: view.mergedAt
+  });
+  if (!parsed.success)
+    throw new BuildUsageError(
+      `The merged pull request has a bad shape: ${parsed.error.issues.map((issue) => issue.path.join(".")).join(", ")}.`
+    );
+  fs9.writeFileSync(
+    path9.join(directory, "pull_request.json"),
+    `${JSON.stringify(parsed.data)}
+`
+  );
+  return parsed.data;
+}
 
 // src/app/entry/buildCommand.ts
 var USAGE3 = `Usage: drisp build plan --input <path>
        drisp build tick --input <path> [--rebase-failed <IDENTIFIER>]...
        drisp build checks
-       drisp build step <n> [--qa none|web|macos]
+       drisp build step <n> [--qa none|web|macos|both] [--profile implementation|documentation|investigation]
+       [--test-first true|false] [--review true|false] [--complete --evidence <file>] [--verify]
+       drisp build merged [<pr url or number>]
 plan and tick run inside an Orchestrator Run (DRISP_RUN_ID, DRISP_RUNNER_ID and DRISP_RUN_ARTIFACTS set; tick also
 DRISP_RUN_TOKEN and DRISP_HUB_URL). DRISP_BUILD_PLAN_INPUT=<path> stands in for plan's --input, with
 fills/<IDENTIFIER>.json beside it. checks runs in a child's worktree: the merge gate's verdict on HEAD's GitHub runs.
 step runs in any Run with DRISP_RUN_ARTIFACTS set: it writes the step artifact {index, title, total} for gate <n> of the
-build-child template (QA is a gate unless --qa none) and refuses an index outside the list.`;
+selected build-child profile (QA is a gate unless --qa none) and refuses an index outside the list.
+--complete --evidence <file> records an agent attestation bound to the source revision; --verify requires fresh
+receipts for all preceding steps. Keep evidence files under .athena/evidence/.
+merged runs in a child's worktree after its pull request merged: it writes the pull_request artifact
+{url, number, sha, mergedAt} and refuses a pull request that is not merged.`;
 function githubPullRequests(folder, branch) {
-  const output = execFileSync(
+  const output = execFileSync2(
     "gh",
     [
       "pr",
@@ -14808,7 +14995,7 @@ function hostCapabilities(folder) {
 }
 var defaultChecks = {
   head: (cwd) => git(cwd, ["rev-parse", "HEAD"]),
-  gh: (args, cwd) => execFileSync("gh", args, {
+  gh: (args, cwd) => execFileSync2("gh", args, {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -14885,10 +15072,25 @@ async function runBuildCommand(input) {
       case "checks":
         output = runBuildChecks(input.cwd, input.checks ?? defaultChecks);
         break;
+      case "merged":
+        output = runBuildMerged({
+          env: env2,
+          cwd: input.cwd,
+          ...input.positional?.[0] ? { pullRequest: input.positional[0] } : {},
+          gh: (input.checks ?? defaultChecks).gh
+        });
+        break;
       case "step":
         output = runBuildStep({
           env: env2,
           n: input.positional?.[0],
+          cwd: input.cwd,
+          profile: input.flags.profile,
+          testFirst: input.flags.testFirst,
+          review: input.flags.review,
+          complete: input.flags.complete,
+          verify: input.flags.verify,
+          evidence: input.flags.evidence,
           ...input.flags.qa ? { qa: input.flags.qa } : {}
         });
         break;
@@ -14913,10 +15115,10 @@ ${USAGE3}
 import process7 from "process";
 
 // src/harnesses/claude/system/doctorEnvironment.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import * as fs9 from "fs";
+import { execFileSync as execFileSync3 } from "child_process";
+import * as fs10 from "fs";
 import * as os4 from "os";
-import * as path9 from "path";
+import * as path10 from "path";
 var MANAGED_POLICY_KEYS = [
   "forceLoginMethod",
   "forceLoginOrgUUID",
@@ -14991,7 +15193,7 @@ function readEnforcement(scopes) {
 }
 function tryRichAuth(claudeBinary) {
   try {
-    const output = execFileSync2(claudeBinary, ["auth", "status"], {
+    const output = execFileSync3(claudeBinary, ["auth", "status"], {
       timeout: 1e4,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -15020,8 +15222,8 @@ function collectEnvironment(options = {}) {
   const detectVersion = options.detectClaudeVersionFn ?? detectClaudeVersion;
   const runAuthStatus = options.runClaudeAuthStatusFn ?? runClaudeAuthStatus;
   const resolveForwarder = options.resolveHookForwarderCommandFn ?? resolveHookForwarderCommand;
-  const statFn = options.statFn ?? ((p) => fs9.statSync(p));
-  const readFileFn = options.readFileFn ?? ((p) => fs9.readFileSync(p, "utf8"));
+  const statFn = options.statFn ?? ((p) => fs10.statSync(p));
+  const readFileFn = options.readFileFn ?? ((p) => fs10.readFileSync(p, "utf8"));
   const settingsPaths = resolveClaudeSettingsSurfacePaths(
     homeDir,
     cwd,
@@ -15066,7 +15268,7 @@ function collectEnvironment(options = {}) {
   });
   let globalConfigPresent = false;
   try {
-    statFn(path9.join(homeDir, ".claude.json"));
+    statFn(path10.join(homeDir, ".claude.json"));
     globalConfigPresent = true;
   } catch {
     globalConfigPresent = false;
@@ -15546,13 +15748,13 @@ function runRunsCommand(input) {
 // src/app/entry/cli.tsx
 import { jsx as jsx24 } from "react/jsx-runtime";
 function resolvePackageJsonPath(entryUrl) {
-  let currentDir = path10.dirname(fileURLToPath(entryUrl));
+  let currentDir = path11.dirname(fileURLToPath(entryUrl));
   for (; ; ) {
-    const candidatePath = path10.join(currentDir, "package.json");
-    if (fs10.existsSync(candidatePath)) {
+    const candidatePath = path11.join(currentDir, "package.json");
+    if (fs11.existsSync(candidatePath)) {
       return candidatePath;
     }
-    const parentDir = path10.dirname(currentDir);
+    const parentDir = path11.dirname(currentDir);
     if (parentDir === currentDir) {
       throw new Error("Could not locate package.json for CLI metadata.");
     }
@@ -15724,7 +15926,8 @@ var cli = meow(
 			build plan --input <path>  Plan a Build inside an Orchestrator Run (prints one JSON object)
 			build tick --input <path>  Run one step of a started Build (prints the next action; [--rebase-failed <ID>]...)
 			build checks               The merge gate's verdict on HEAD's GitHub runs (in a child's worktree)
-			build step <n>             Report the Run's current step: writes the step run artifact ([--qa none|web|macos])
+			build step <n>             Report the Run's current step: writes the step run artifact ([--qa none|web|macos|both], --profile, --complete --evidence, --verify)
+			build merged               Record the merged pull request: writes the pull_request run artifact
 			telemetry [action]    Manage anonymous telemetry (enable/disable/status)
 			doctor                Diagnose Claude headless setup (use with --harness=claude)
 
@@ -15862,6 +16065,12 @@ var cli = meow(
         type: "string",
         isMultiple: true
       },
+      profile: { type: "string" },
+      testFirst: { type: "string" },
+      review: { type: "string" },
+      complete: { type: "boolean" },
+      verify: { type: "boolean" },
+      evidence: { type: "string" },
       qa: {
         type: "string"
       },
@@ -15904,7 +16113,7 @@ var cli = meow(
   }
 );
 async function main() {
-  const projectDir = path10.resolve(cli.flags.projectDir);
+  const projectDir = path11.resolve(cli.flags.projectDir);
   const [command, ...commandArgs] = cli.input;
   const isRunCommand = command === "run" || command === "exec";
   if (command && !KNOWN_COMMANDS.has(command)) {
@@ -15958,7 +16167,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         await exitWith(1);
         return;
       }
-      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-4GRQGM42.js");
+      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-VVEEJW25.js");
       const { waitUntilExit } = render(
         /* @__PURE__ */ jsx24(
           WorkflowInstallWizard,
@@ -16044,6 +16253,12 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         positional: buildArgs,
         flags: {
           ...typeof cli.flags.qa === "string" ? { qa: cli.flags.qa } : {},
+          profile: cli.flags.profile,
+          testFirst: cli.flags.testFirst,
+          review: cli.flags.review,
+          complete: cli.flags.complete,
+          verify: cli.flags.verify,
+          evidence: cli.flags.evidence,
           ...typeof cli.flags.input === "string" ? { input: cli.flags.input } : {},
           ...cli.flags.rebaseFailed?.length ? { rebaseFailed: cli.flags.rebaseFailed } : {}
         },
@@ -16125,8 +16340,8 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
   const showSetup = isRunCommand ? false : shouldShowSetup({
     cliInput: cli.input,
     setupComplete: globalConfig.setupComplete,
-    globalConfigExists: fs10.existsSync(
-      path10.join(os5.homedir(), ".config", "athena", "config.json")
+    globalConfigExists: fs11.existsSync(
+      path11.join(os5.homedir(), ".config", "athena", "config.json")
     )
   });
   let runtimeConfig;

package/dist/dashboard-daemon.js

@@ -1,6 +1,6 @@
-import "./chunk-N4B7HLBN.js";
-import "./chunk-TG5EGPD2.js";
+import "./chunk-D5VZT7M3.js";
+import "./chunk-D246FR4I.js";
 import "./chunk-PQIB66SG.js";
-import "./chunk-UQWOGG3L.js";
+import "./chunk-HZ6GRLOM.js";
 import "./chunk-G3PMV62Z.js";
 //# sourceMappingURL=dashboard-daemon.js.map

package/dist/runner.js

@@ -1,6 +1,6 @@
-import "./chunk-N4B7HLBN.js";
-import "./chunk-TG5EGPD2.js";
+import "./chunk-D5VZT7M3.js";
+import "./chunk-D246FR4I.js";
 import "./chunk-PQIB66SG.js";
-import "./chunk-UQWOGG3L.js";
+import "./chunk-HZ6GRLOM.js";
 import "./chunk-G3PMV62Z.js";
 //# sourceMappingURL=runner.js.map

package/package.json

@@ -17,7 +17,7 @@
 		"hooks",
 		"dashboard"
 	],
-	"version": "0.7.5",
+	"version": "0.7.7",
 	"license": "MIT",
 	"bin": {
 		"athena": "dist/cli.js",