@drisp/cli 0.7.6 → 0.7.7

package/dist/{WorkflowInstallWizard-YANLNMTP.js → WorkflowInstallWizard-VVEEJW25.js}

@@ -8,7 +8,7 @@ import {
   installWorkflowPlugins,
   resolveWorkflow,
   writeGlobalConfig
-} from "./chunk-W57EQYCM.js";
+} from "./chunk-HZ6GRLOM.js";
 import "./chunk-G3PMV62Z.js";
 
 // src/setup/steps/WorkflowInstallWizard.tsx
@@ -93,4 +93,4 @@ function WorkflowInstallWizard({ source, onDone }) {
 export {
   WorkflowInstallWizard as default
 };
-//# sourceMappingURL=WorkflowInstallWizard-YANLNMTP.js.map
+//# sourceMappingURL=WorkflowInstallWizard-VVEEJW25.js.map

package/dist/{chunk-2N7IBKJF.js → chunk-D246FR4I.js}

@@ -54,7 +54,7 @@ import {
   verifyRendered,
   wakesFreshAfterHandover,
   workflowRegistryDir
-} from "./chunk-W57EQYCM.js";
+} from "./chunk-HZ6GRLOM.js";
 import {
   __commonJS,
   __toESM
@@ -14892,7 +14892,7 @@ async function restoreCheckpoint(store, input) {
 
 // ../../modules/runtime/src/software-version.ts
 import "fs";
-var runnerSoftwareVersion = true ? "0.7.6" : JSON.parse(readFileSync2(new URL("../../../apps/cli/package.json", import.meta.url), "utf8")).version;
+var runnerSoftwareVersion = true ? "0.7.7" : JSON.parse(readFileSync2(new URL("../../../apps/cli/package.json", import.meta.url), "utf8")).version;
 
 // ../../modules/runtime/src/connection.ts
 var RunnerDisconnectedError = class extends Error {
@@ -20176,7 +20176,33 @@ var fillSchema = external_exports.strictObject({
   areas: external_exports.array(external_exports.enum(AREAS)).min(1).refine((areas) => new Set(areas).size === areas.length, {
     error: "areas must be unique"
   }),
-  qa: external_exports.enum(["none", "web", "macos"]),
+  qa: external_exports.enum(["none", "web", "macos", "both"]),
+  profile: external_exports.enum(["implementation", "documentation", "investigation"]).optional(),
+  rationale: external_exports.string().min(1).max(2e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
+    error: INSTRUCTIONS_MESSAGE
+  }).optional(),
+  acceptanceEvidence: external_exports.array(
+    external_exports.string().min(1).max(2e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
+      error: INSTRUCTIONS_MESSAGE
+    })
+  ).min(1).optional(),
+  testFirst: external_exports.strictObject({
+    enabled: external_exports.boolean(),
+    reason: external_exports.string().min(1).max(1e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
+      error: INSTRUCTIONS_MESSAGE
+    })
+  }).optional(),
+  review: external_exports.strictObject({
+    enabled: external_exports.boolean(),
+    reason: external_exports.string().min(1).max(1e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
+      error: INSTRUCTIONS_MESSAGE
+    })
+  }).optional(),
+  checks: external_exports.array(
+    external_exports.string().min(1).max(500).regex(
+      /^(?:npm (?:run|test|--prefix apps\/cli run)|npx vitest run|make (?:-C apps\/macos|check|typecheck)|git diff --check)(?: [a-zA-Z0-9_./:=@-]+)*$/
+    )
+  ).min(1).optional(),
   sizeClass: external_exports.enum(["S", "M", "L"]),
   instructions: external_exports.string().min(1).max(6e3).refine((text) => !TEMPLATE_STRUCTURE.test(text), {
     error: INSTRUCTIONS_MESSAGE
@@ -20211,6 +20237,9 @@ var planInputSchema = external_exports.strictObject({
       // Names the issue's directory under `.athena/workflows/<slugId>/`, so only a Linear identifier.
       identifier: external_exports.string().regex(/^[A-Z][A-Z0-9]*-[0-9]+$/),
       title: external_exports.string(),
+      description: external_exports.string().optional(),
+      acceptanceCriteria: external_exports.string().optional(),
+      external: external_exports.boolean().optional(),
       url: external_exports.string().url(),
       branchName: external_exports.string().nullable(),
       state: external_exports.strictObject({
@@ -20240,7 +20269,12 @@ var SKIP_REASONS = [
   "ready-for-human",
   "merged",
   "done-pr-open",
-  "parent-only"
+  "parent-only",
+  "external",
+  "needs-info",
+  "needs-triage",
+  "wontfix",
+  "not-ready-for-agent"
 ];
 var count = external_exports.number().int().nonnegative();
 var issueEntrySchema = external_exports.strictObject({
@@ -20249,7 +20283,9 @@ var issueEntrySchema = external_exports.strictObject({
   title: external_exports.string(),
   blockedBy: external_exports.array(external_exports.string()),
   areas: external_exports.array(external_exports.enum(AREAS)).min(1),
-  qa: external_exports.enum(["none", "web", "macos"]),
+  qa: external_exports.enum(["none", "web", "macos", "both"]),
+  profile: external_exports.enum(["implementation", "documentation", "investigation"]).optional(),
+  scopeFingerprint: external_exports.string().optional(),
   sizeClass: external_exports.enum(["S", "M", "L"]),
   tokenCap: external_exports.number().int().positive(),
   model: external_exports.string(),
@@ -20441,6 +20477,32 @@ function mergeGuidance(earlier, guidance) {
   return rounds.slice(-GUIDANCE_ROUNDS);
 }
 
+// src/core/build/eligibility.ts
+import { createHash as createHash3 } from "crypto";
+function eligibilityReason(issue) {
+  if (issue.external) return "external";
+  for (const label of [
+    "ready-for-human",
+    "needs-info",
+    "needs-triage",
+    "wontfix"
+  ])
+    if (issue.labels.includes(label)) return label;
+  if (issue.state.type === "triage") return "needs-triage";
+  if (!issue.labels.includes("ready-for-agent")) return "not-ready-for-agent";
+  return void 0;
+}
+function scopeFingerprint(issue) {
+  return createHash3("sha256").update(
+    JSON.stringify([
+      issue.title,
+      issue.description ?? "",
+      issue.acceptanceCriteria ?? "",
+      issue.parentId
+    ])
+  ).digest("hex");
+}
+
 // src/core/build/planner.ts
 function skipReason(issue, pullRequests) {
   const prs = issue.branchName ? pullRequests[issue.branchName] : void 0;
@@ -20449,6 +20511,8 @@ function skipReason(issue, pullRequests) {
   if (issue.state.type === "completed") return "done";
   if (issue.state.type === "canceled") return "canceled";
   if (prs?.merged) return "merged";
+  const eligibility = eligibilityReason(issue);
+  if (eligibility) return eligibility;
   return void 0;
 }
 var byIdentifier = (a, b) => a.localeCompare(b, "en", { numeric: true });
@@ -20492,6 +20556,7 @@ function shownFromFill(fill) {
   return {
     areas: fill.areas,
     qa: fill.qa,
+    ...fill.profile ? { profile: fill.profile } : {},
     sizeClass: fill.sizeClass,
     tokenCap: limits.maxRunTokens,
     model: limits.model,
@@ -20590,11 +20655,21 @@ function planBuild(context) {
     ({ children, blockers } = blockingGraph(entries));
   }
   const held = new Set(
-    skipped.filter((skip) => skip.reason === "ready-for-human").map((skip) => skip.id)
+    skipped.filter(
+      (skip) => !["done", "merged", "done-pr-open", "parent-only"].includes(
+        skip.reason
+      )
+    ).map((skip) => skip.id)
   );
   const waitsFor = (issue) => [
     .../* @__PURE__ */ new Set([
-      ...issue.blockedBy.filter((id2) => blockers.has(id2) || held.has(id2)),
+      ...issue.blockedBy.filter(
+        (id2) => !input.issues.some(
+          (each) => each.id === id2 && (each.state.type === "completed" || skipped.some(
+            (skip) => skip.id === id2 && skip.reason === "merged"
+          ))
+        )
+      ),
       ...children.get(issue.id) ?? [],
       ...input.issues.filter((each) => each.parentId === issue.id && held.has(each.id)).map((each) => each.id)
     ])
@@ -20624,6 +20699,7 @@ function planBuild(context) {
       title: issue.title,
       blockedBy: waitsFor(issue),
       ...shownFromFill(fill),
+      scopeFingerprint: scopeFingerprint(issue),
       workflowName: workflowName2
     });
     workflows.push({
@@ -21195,7 +21271,7 @@ async function closeOrphanedRuns(store, {
 }
 
 // ../../modules/runtime/src/run-artifacts.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { dirname as dirname4, join as join7 } from "path";
@@ -21238,7 +21314,7 @@ function runArtifactEmitter(directory, record, midTurnMinGapMs = MID_TURN_MIN_GA
       } catch {
         continue;
       }
-      const hash = createHash3("sha256").update(bytes).digest("hex");
+      const hash = createHash4("sha256").update(bytes).digest("hex");
       if (emitted[name] === hash) continue;
       let json;
       try {
@@ -21943,6 +22019,8 @@ export {
   repoLayoutAt,
   approvalAnswer,
   mergeGuidance,
+  eligibilityReason,
+  scopeFingerprint,
   planBuild,
   finalizePlan,
   fallbackBranch,
@@ -21967,4 +22045,4 @@ export {
   runMachineRunners,
   writeIdentityOnce
 };
-//# sourceMappingURL=chunk-2N7IBKJF.js.map
+//# sourceMappingURL=chunk-D246FR4I.js.map

package/dist/{chunk-Y6XJPUR2.js → chunk-D5VZT7M3.js}

@@ -1,6 +1,6 @@
 import {
   runMachineRunners
-} from "./chunk-2N7IBKJF.js";
+} from "./chunk-D246FR4I.js";
 
 // src/app/entry/runnerDaemon.ts
 if (process.argv.includes("--help")) {
@@ -13,4 +13,4 @@ if (process.argv.includes("--help")) {
     process.exitCode = 1;
   });
 }
-//# sourceMappingURL=chunk-Y6XJPUR2.js.map
+//# sourceMappingURL=chunk-D5VZT7M3.js.map

package/dist/{chunk-W57EQYCM.js → chunk-HZ6GRLOM.js}

@@ -21281,7 +21281,7 @@ var GATES = [
 ];
 
 // src/core/workflows/builtins/orchestrator/workflow.md
-var workflow_default = '# Orchestrator: plan and run a Build\n\nYou plan and run a Drisp Build of one Plan: the open issues of one Linear project. The Run\'s prompt names the\nLinear project, the Plan key and the project folder, which is your working directory. You never write code here:\neach issue is built by its own child Run, which `drisp build tick` starts.\n\nThe Runner sets these for you:\n\n- `DRISP_RUN_ARTIFACTS`: this Run\'s artifact directory. Files you write there are shown to the member.\n- `DRISP_RUN_ID`, `DRISP_RUNNER_ID`, `DRISP_RUN_TOKEN`, `DRISP_HUB_URL`: this Run, its Runner and its right to start\n  child Runs; `drisp build` reads them itself.\n\n## 1. Read Linear (first Turn)\n\nWith the `linear` MCP server, read the project and every issue in it, then write\n`$DRISP_RUN_ARTIFACTS/input/plan-input.json` (create the `input` directory) in exactly this shape. Every issue carries\nevery field, empty when it has none. `readAt` is the output of\n`node -e "console.log(new Date().toISOString())"` run just before you read Linear; never write a time yourself:\n\n```json\n{\n	"version": 1,\n	"readAt": "<the command\'s output, e.g. 2026-10-11T09:30:00.000Z>",\n	"project": {\n		"id": "<the project\'s `uuid`, not its `id`>",\n		"name": "<the project\'s `name`>",\n		"slugId": "<the last `-`-separated part of the project\'s `url`>"\n	},\n	"issues": [\n		{\n			"id": "<the issue\'s `uuid`, not its `id`>",\n			"identifier": "<the issue\'s `id`, e.g. DRI-12>",\n			"title": "<the issue\'s `title`>",\n			"url": "<the issue\'s `url`>",\n			"branchName": "<the issue\'s `gitBranchName`, or null>",\n			"state": {\n				"type": "<the issue\'s `statusType`: backlog|unstarted|started|completed|canceled|triage>",\n				"name": "<the issue\'s `status`>"\n			},\n			"labels": ["<each of the issue\'s `labels`>"],\n			"parentId": "<the parent issue\'s `uuid`, or null>",\n			"blockedBy": ["<the `uuid` of each issue in `relations.blockedBy`>"],\n			"prioritySortOrder": 0\n		}\n	]\n}\n```\n\nLinear\'s MCP names fields differently from this file, and the difference matters: the app finds each issue\'s row by\nits UUID, so a plan that carries identifiers shows no Build state on any row.\n\n- The MCP\'s `id` is the readable identifier (`DRI-12`, or `P-DRI-7` for a project); the UUID is in `uuid`. Every\n  `id`, `parentId` and `blockedBy` value in `plan-input.json` is a UUID (`7f7b03f7-accf-46b2-98fb-abadfed76594`).\n- An issue\'s `parentId` and `relations.blockedBy` from the MCP name issues by identifier. Look each one up: use the\n  `uuid` of the project\'s issue with that identifier, or `get_issue` it when it is outside the project.\n- Read relations with `get_issue` and `includeRelations: true`; read the project\'s issues with `list_issues` and\n  `fields` including `uuid`.\n- The project\'s `url` ends in its `slugId` (`\u2026/project/build-sandbox-b7640301cd64` \u2192 `b7640301cd64`).\n\n`drisp build plan` rejects a plan with an identifier where a UUID belongs and names the field to fix.\n\nInclude every issue of the project, done and canceled ones too: the plan decides what to skip. Then run:\n\n```sh\ndrisp build plan --input "$DRISP_RUN_ARTIFACTS/input/plan-input.json"\n```\n\nIt prints one JSON object. Act on its `status`.\n\n## 2. `needs_fills`\n\n`fills` lists issues that need a `fill.json` (`identifier`, `title`, `url`, `path`) and `templateVersion` is the value\neach fill must carry. For each listed issue: read it through `linear` (description, acceptance criteria, comments) and\nthe repo\'s ADRs and CONTEXT files it touches, then write its `fill.json` at `path`:\n\n```json\n{\n	"version": 1,\n	"templateVersion": "<templateVersion, copied exactly>",\n	"areas": ["macos|web|cli|hub|protocol|docs", "\u2026"],\n	"qa": "none|web|macos",\n	"sizeClass": "S|M|L",\n	"instructions": "<what the child needs beyond the issue>",\n	"ownWork": true\n}\n```\n\n- `areas`: the parts of the repo the change touches, each once.\n- `qa`: `web` when the change shows in a web page, `macos` when it shows in the macOS app, else `none`.\n- `sizeClass`: `S` for a change of a file or two, `M` for a feature across a few modules, `L` for a large or risky\n  change.\n- `instructions` (at most 6000 characters): start with one short paragraph saying what to build, then restate the\n  acceptance criteria, name the ADRs it touches and the parts of the codebase involved. Plain prose and `-` lists\n  only: no headings, code fences or HTML comments (`drisp build plan` rejects them).\n- `ownWork`: `false` only for an issue with sub-issues whose own description asks for nothing beyond them, such as\n  a PRD above its slices; the plan then skips it and waits for its sub-issues instead. Otherwise `true`.\n\nThen run `drisp build plan` again with the same `--input` path.\n\n## 3. `planned` or `failed`\n\nOn `planned` the Build plan is written and shown to the member, who decides whether to start it: end the Turn with\n`<!-- AWAITING_APPROVAL -->` as the Journal\'s last line. On `failed` the reason is shown instead: end with\n`<!-- WORKFLOW_COMPLETE -->`.\n\n## 4. Every later wake: tick\n\nYou are woken when the member answers the approval question (with Start, or with words of their own before it) and whenever one of your child Runs closes or parks.\nEach time: read Linear again into `$DRISP_RUN_ARTIFACTS/input/plan-input.json` as in step 1 (with a new `readAt`),\nthen run:\n\n```sh\ndrisp build tick --input "$DRISP_RUN_ARTIFACTS/input/plan-input.json"\n```\n\nIt prints one JSON object. Act on its `action`, and repeat until an action ends the Turn:\n\n- `refresh_input`: read Linear into the input again (a newer `readAt`) and tick again.\n- `replan`: the member wrote words before starting, and `guidance` lists every round of them, oldest first. Plan again\n  with them as the member\'s wishes: read the issues they concern (and the repo) as in step 2, rewrite the `fill.json`\n  of each issue the guidance changes (`instructions`, `areas`, `qa`, `sizeClass`, or `ownWork` to leave an issue out),\n  and run `drisp build plan` again with the same `--input` path. Then end as in step 3: with\n  `<!-- AWAITING_APPROVAL -->` on `planned`, `<!-- WORKFLOW_COMPLETE -->` on `failed`. Write nothing but those\n  `fill.json` files.\n- `repair`: for each of `issues`, read it in Linear first and skip an issue Linear now shows Done or Canceled (its\n  child got there first); otherwise move it to Done and post its `comment` verbatim through `linear`. Then read\n  Linear into the input again and tick again.\n- `rebase`: for each of `items`, in its `worktree`: `git rebase origin/main`, resolve the conflicts, then\n  `git push --force-with-lease origin <branch>` (the item\'s `branch`) if the branch is on the remote. Never push any\n  other branch. If a rebase cannot be resolved, `git rebase --abort`.\n  Then read Linear into the input again and tick again, adding `--rebase-failed <identifier>` for each that failed.\n- `wait`: end the Turn with `<!-- WAITING_ON_CHILDREN -->` as the Journal\'s last line.\n- `park`: end the Turn with `<!-- NEEDS_HUMAN: <message> -->` as the Journal\'s last line, copying `message`\n  verbatim.\n- `complete`: end the Turn with `<!-- WORKFLOW_COMPLETE -->` as the Journal\'s last line.\n\n## Rules\n\n- Never start, cancel or edit Runs, Workflows, worktrees or branches except as an action says; `drisp build` does\n  what is needed.\n- Never write to Linear except a `repair`; never open a pull request.\n- Write only `plan-input.json` and the `fill.json` files `drisp build plan` asks for. Never write `answer.json`.\n';
+var workflow_default = '# Orchestrator: plan and run a Build\n\nYou plan and run a Drisp Build of one Plan: the open issues of one Linear project. The Run\'s prompt names the\nLinear project, the Plan key and the project folder, which is your working directory. You never write code here:\neach issue is built by its own child Run, which `drisp build tick` starts.\n\nThe Runner sets these for you:\n\n- `DRISP_RUN_ARTIFACTS`: this Run\'s artifact directory. Files you write there are shown to the member.\n- `DRISP_RUN_ID`, `DRISP_RUNNER_ID`, `DRISP_RUN_TOKEN`, `DRISP_HUB_URL`: this Run, its Runner and its right to start\n  child Runs; `drisp build` reads them itself.\n\n## 1. Read Linear (first Turn)\n\nWith the `linear` MCP server, read the project and every issue in it, then write\n`$DRISP_RUN_ARTIFACTS/input/plan-input.json` (create the `input` directory) in exactly this shape. Every issue carries\nevery field, empty when it has none. `readAt` is the output of\n`node -e "console.log(new Date().toISOString())"` run just before you read Linear; never write a time yourself:\n\n```json\n{\n	"version": 1,\n	"readAt": "<the command\'s output, e.g. 2026-10-11T09:30:00.000Z>",\n	"project": {\n		"id": "<the project\'s `uuid`, not its `id`>",\n		"name": "<the project\'s `name`>",\n		"slugId": "<the last `-`-separated part of the project\'s `url`>"\n	},\n	"issues": [\n		{\n			"id": "<the issue\'s `uuid`, not its `id`>",\n			"identifier": "<the issue\'s `id`, e.g. DRI-12>",\n			"title": "<the issue\'s `title`>",\n			"description": "<full current description>",\n			"acceptanceCriteria": "<acceptance criteria, empty when included in description>",\n			"external": false,\n			"url": "<the issue\'s `url`>",\n			"branchName": "<the issue\'s `gitBranchName`, or null>",\n			"state": {\n				"type": "<the issue\'s `statusType`: backlog|unstarted|started|completed|canceled|triage>",\n				"name": "<the issue\'s `status`>"\n			},\n			"labels": ["<each of the issue\'s `labels`>"],\n			"parentId": "<the parent issue\'s `uuid`, or null>",\n			"blockedBy": ["<the `uuid` of each issue in `relations.blockedBy`>"],\n			"prioritySortOrder": 0\n		}\n	]\n}\n```\n\nLinear\'s MCP names fields differently from this file, and the difference matters: the app finds each issue\'s row by\nits UUID, so a plan that carries identifiers shows no Build state on any row.\n\n- The MCP\'s `id` is the readable identifier (`DRI-12`, or `P-DRI-7` for a project); the UUID is in `uuid`. Every\n  `id`, `parentId` and `blockedBy` value in `plan-input.json` is a UUID (`7f7b03f7-accf-46b2-98fb-abadfed76594`).\n- An issue\'s `parentId` and `relations.blockedBy` from the MCP name issues by identifier. Look each one up: use the\n  `uuid` of the project\'s issue with that identifier, or `get_issue` it when it is outside the project.\n- Read relations with `get_issue` and `includeRelations: true`; read the project\'s issues with `list_issues` and\n  `fields` including `uuid`.\n- The project\'s `url` ends in its `slugId` (`\u2026/project/build-sandbox-b7640301cd64` \u2192 `b7640301cd64`).\n\n`drisp build plan` rejects a plan with an identifier where a UUID belongs and names the field to fix.\n\nAlso include every referenced blocker outside the project, with `external: true`, its current status and UUID. Follow blocker relations recursively; deduplicate by UUID. Never mark a project issue external. External issues are read only and never scheduled. Preserve actual prioritySortOrder when available.\n\nOnly ready-for-agent issues without conflicting ready-for-human, needs-info, needs-triage or wontfix labels are eligible. Do not invent or change labels to make an issue eligible.\n\nInclude every issue of the project, done and canceled ones too: the plan decides what to skip. Then run:\n\n```sh\ndrisp build plan --input "$DRISP_RUN_ARTIFACTS/input/plan-input.json"\n```\n\nIt prints one JSON object. Act on its `status`.\n\n## 2. `needs_fills`\n\n`fills` lists issues that need a `fill.json` (`identifier`, `title`, `url`, `path`) and `templateVersion` is the value\neach fill must carry. For each listed issue: read it through `linear` (description, acceptance criteria, comments) and\nthe repo\'s ADRs and CONTEXT files it touches, then write its `fill.json` at `path`:\n\n```json\n{\n	"version": 1,\n	"templateVersion": "<templateVersion, copied exactly>",\n	"areas": ["macos|web|cli|hub|protocol|docs", "\u2026"],\n	"qa": "none|web|macos|both",\n	"profile": "implementation|documentation|investigation",\n	"rationale": "<why these steps are appropriate>",\n	"acceptanceEvidence": [\n		"<each acceptance criterion and the evidence that demonstrates it>"\n	],\n	"sizeClass": "S|M|L",\n	"instructions": "<what the child needs beyond the issue>",\n	"ownWork": true\n}\n```\n\n- `areas`: the parts of the repo the change touches, each once.\n- `profile`: implementation for behavior changes, documentation for prose-only repository changes, investigation for findings with no repository changes. Implementation defaults to TDD and two-reviewer code review; documentation and investigation omit these by default. Choose the profile from the actual deliverable, not the issue size.\n- Optional `testFirst` and `review`: `{ "enabled": true|false, "reason": "<issue-specific justification>" }`. Retain tests and review for behavioral changes; omit only when not applicable and explain why. These selections also control required skills.\n- Optional `checks`: a nonempty list of actual validation commands from the repo, using the supported npm, vitest, make or git diff command families. Read repository tooling and add the relevant test/build checks: typechecking alone does not prove behavior. If a necessary command is unsupported, state that limitation in instructions and require human attention, never claim validation passed.\n- `acceptanceEvidence`: cover every criterion, including the method and expected outcome.\n- `qa`: `both` when both interfaces change, `web` when the change shows in a web page, `macos` when it shows in the macOS app, else `none`.\n- `sizeClass`: `S` for a change of a file or two, `M` for a feature across a few modules, `L` for a large or risky\n  change.\n- `instructions` (at most 6000 characters): start with one short paragraph saying what to build, then restate the\n  acceptance criteria, name the ADRs it touches and the parts of the codebase involved. Plain prose and `-` lists\n  only: no headings, code fences or HTML comments (`drisp build plan` rejects them).\n- `ownWork`: `false` only for an issue with sub-issues whose own description asks for nothing beyond them, such as\n  a PRD above its slices; the plan then skips it and waits for its sub-issues instead. Otherwise `true`.\n\nThen run `drisp build plan` again with the same `--input` path.\n\n## 3. `planned` or `failed`\n\nOn `planned` the Build plan is written and shown to the member, who decides whether to start it: end the Turn with\n`<!-- AWAITING_APPROVAL -->` as the Journal\'s last line. On `failed` the reason is shown instead: end with\n`<!-- WORKFLOW_COMPLETE -->`.\n\n## 4. Every later wake: tick\n\nYou are woken when the member answers the approval question (with Start, or with words of their own before it) and whenever one of your child Runs closes or parks.\nEach time: read Linear again into `$DRISP_RUN_ARTIFACTS/input/plan-input.json` as in step 1 (with a new `readAt`),\nincluding full descriptions, acceptance criteria, labels and external blocker status. A scope change holds the affected issue for a fresh Build and approval. Then run:\n\n```sh\ndrisp build tick --input "$DRISP_RUN_ARTIFACTS/input/plan-input.json"\n```\n\nIt prints one JSON object. Act on its `action`, and repeat until an action ends the Turn:\n\n- `refresh_input`: read Linear into the input again (a newer `readAt`) and tick again.\n- `replan`: the member wrote words before starting, and `guidance` lists every round of them, oldest first. Plan again\n  with them as the member\'s wishes: read the issues they concern (and the repo) as in step 2, rewrite the `fill.json`\n  of each issue the guidance changes (`instructions`, `areas`, `qa`, `sizeClass`, or `ownWork` to leave an issue out),\n  and run `drisp build plan` again with the same `--input` path. Then end as in step 3: with\n  `<!-- AWAITING_APPROVAL -->` on `planned`, `<!-- WORKFLOW_COMPLETE -->` on `failed`. Write nothing but those\n  `fill.json` files.\n- `repair`: for each of `issues`, read it in Linear first and skip an issue Linear now shows Done or Canceled (its\n  child got there first); otherwise move it to Done and post its `comment` verbatim through `linear`. Then read\n  Linear into the input again and tick again.\n- `rebase`: for each of `items`, in its `worktree`: `git rebase origin/main`, resolve the conflicts, then\n  `git push --force-with-lease origin <branch>` (the item\'s `branch`) if the branch is on the remote. Never push any\n  other branch. If a rebase cannot be resolved, `git rebase --abort`.\n  Then read Linear into the input again and tick again, adding `--rebase-failed <identifier>` for each that failed.\n- `wait`: end the Turn with `<!-- WAITING_ON_CHILDREN -->` as the Journal\'s last line.\n- `park`: end the Turn with `<!-- NEEDS_HUMAN: <message> -->` as the Journal\'s last line, copying `message`\n  verbatim.\n- `complete`: end the Turn with `<!-- WORKFLOW_COMPLETE -->` as the Journal\'s last line.\n\n## Rules\n\n- Never start, cancel or edit Runs, Workflows, worktrees or branches except as an action says; `drisp build` does\n  what is needed.\n- Never write to Linear except a `repair`; never open a pull request.\n- Write only `plan-input.json` and the `fill.json` files `drisp build plan` asks for. Never write `answer.json`.\n';
 
 // src/core/workflows/builtins/orchestrator/index.ts
 var ORCHESTRATOR_WORKFLOW_NAME = "orchestrator";
@@ -21440,6 +21440,14 @@ Journal's last line.
 
 {instructions}
 
+## Evidence receipts
+
+Progress is not proof that a step passed. Follow each Finish instruction only after its acceptance condition holds.
+Record actual results, commands, output paths and acceptance criteria, never a generic claim of success.
+Commit repository changes before recording validation evidence. Changes to HEAD or source invalidate validation
+receipts: rerun affected tests, review, checks and QA, including after a rebase, before verifying the Merge step.
+Keep evidence files under .athena/evidence/ and do not commit them after validation, since a new commit invalidates receipts.
+
 ## Gates
 
 Work through the gates in this order. Start each gate by running the command its "Start" line gives, which reports the
@@ -21464,6 +21472,9 @@ is in \`ignored\`: it does not block the merge and its name goes in the evidence
 empty, wait a minute and run it again. When \`failed\` is not empty, fix the change; if it still fails, the Merge gate
 cannot pass. Never judge a check by its timing.
 
+Immediately before merging, verify the current revision again: {mergeVerify}. If evidence is stale, rerun the
+selected validation steps and record fresh receipts before continuing.
+
 Merge with \`gh pr merge --squash --delete-branch --match-head-commit <sha>\`, where \`<sha>\` is HEAD after the last
 push. When it exits non-zero, \`gh pr view --json state\` decides: \`MERGED\` means the merge happened (a worktree
 cannot check out main afterwards); anything else means it did not.
@@ -21506,12 +21517,13 @@ No gate text: the loop's caps apply.`;
 
 // src/core/workflows/builtins/build-child/render.ts
 var RENDERER_RULES = {
-  alwaysSkills: ["tdd", "code-review"],
+  alwaysSkills: [],
+  profiles: ["implementation", "documentation", "investigation"],
   alwaysMcpServers: ["linear"],
   areaSkills: {
     macos: ["swiftui-expert-skill", "apple-docs", "apple-hig-components"]
   },
-  qaMcpServers: { web: ["drisp-browser"] },
+  qaMcpServers: { web: ["drisp-browser"], both: ["drisp-browser"] },
   npmTestAreas: ["cli", "hub", "protocol"],
   /**
    * The Checks gate's commands, resolved from the fill's areas and the repo's layout at the plan's commit: a repo
@@ -21574,6 +21586,7 @@ var RENDERER_RULES = {
     shell: [
       "drisp build checks",
       "drisp build step",
+      "drisp build merged",
       "gh pr checks",
       "gh pr create",
       "gh pr list",
@@ -21615,7 +21628,10 @@ var LAYOUT_MARKERS = [
   "apps/cli/package.json"
 ];
 function checkCommands(fill, layout) {
+  if (fill.checks) return [...fill.checks];
   const rules = RENDERER_RULES.checks;
+  if (fill.profile === "documentation" || fill.profile === "investigation")
+    return [...rules.otherwise];
   if (layout.includes("Makefile"))
     return [
       ...rules.rootMakefile,
@@ -21634,7 +21650,11 @@ function checkCommands(fill, layout) {
 function installCommand(fill, layout) {
   const { install } = RENDERER_RULES.checks;
   if (!layout.includes(install.needs)) return void 0;
-  const needsNode = layout.includes("Makefile") || checkCommands(fill, layout).some((command) => /^np[mx] /.test(command));
+  const needsNode = checkCommands(fill, layout).some(
+    (command) => /^np[mx] /.test(command) || layout.includes("Makefile") && RENDERER_RULES.checks.rootMakefile.some(
+      (rootCommand) => rootCommand === command
+    )
+  );
   return needsNode ? install.command : void 0;
 }
 var GENERATED_NAME = /^build--([a-z0-9]+)--([A-Z][A-Z0-9]*-[0-9]+)$/;
@@ -21652,6 +21672,8 @@ function renderedSkills(fill) {
   return [
     .../* @__PURE__ */ new Set([
       ...RENDERER_RULES.alwaysSkills,
+      ...usesTestFirst(fill) ? ["tdd"] : [],
+      ...usesReview(fill) ? ["code-review"] : [],
       ...fill.areas.flatMap((area) => RENDERER_RULES.areaSkills[area] ?? [])
     ])
   ].sort();
@@ -21664,8 +21686,24 @@ function renderedMcpServers(fill) {
     ])
   ].sort();
 }
+function shellCommands(fill) {
+  const commands = [...RENDERER_RULES.permissions.shell];
+  return fill.profile !== "investigation" ? commands : commands.filter(
+    (command) => ![
+      "drisp build merged",
+      "gh pr create",
+      "gh pr merge",
+      "git add",
+      "git commit",
+      "git push",
+      "git rebase",
+      "git restore"
+    ].includes(command)
+  );
+}
 function renderedPermissions(fill) {
-  const { edit, shell, deny } = RENDERER_RULES.permissions;
+  const { edit, deny } = RENDERER_RULES.permissions;
+  const shell = shellCommands(fill);
   return {
     allow: [
       ...edit,
@@ -21675,10 +21713,29 @@ function renderedPermissions(fill) {
     deny: [...deny]
   };
 }
-function gateTitles(fill) {
-  return GATES.filter((gate) => gate.title !== "QA" || fill.qa !== "none").map(
-    (gate) => gate.title
+var usesTestFirst = (fill) => fill.testFirst?.enabled ?? (!fill.profile || fill.profile === "implementation");
+var usesReview = (fill) => fill.review?.enabled ?? (!fill.profile || fill.profile === "implementation");
+function selectedGates(fill) {
+  const gates = GATES.filter(
+    (gate) => (gate.title !== "QA" || fill.qa !== "none") && (gate.title !== "Test first" || usesTestFirst(fill)) && (gate.title !== "Code review" || usesReview(fill)) && (fill.profile !== "investigation" || !["Pull request", "Merge"].includes(gate.title))
+  ).map(
+    (gate) => fill.profile === "investigation" && gate.title === "Checks" ? {
+      ...gate,
+      passesWhen: "{install}{checks} pass; each finding is supported by a source or reproducible observation and each acceptance criterion has evidence; unresolved questions are stated explicitly"
+    } : fill.profile === "investigation" && gate.title === "Evidence" ? {
+      ...gate,
+      passesWhen: "findings and evidence for each acceptance criterion are posted on the Linear issue, with unresolved questions explicitly stated; the issue is moved to Done only when all acceptance criteria are satisfied"
+    } : gate
   );
+  if (!usesTestFirst(fill))
+    gates.splice(1, 0, {
+      title: fill.profile === "investigation" ? "Investigate" : "Implement",
+      passesWhen: fill.profile === "investigation" ? "the question is investigated and findings address every acceptance criterion; no repository changes are made" : "the requested change is implemented and each acceptance criterion is checked"
+    });
+  return gates;
+}
+function gateTitles(fill) {
+  return selectedGates(fill).map((gate) => gate.title);
 }
 function summarizeInstructions(instructions) {
   const paragraph = (instructions.trim().split(/\n\s*\n/)[0] ?? "").replace(/\s+/g, " ").trim();
@@ -21693,21 +21750,29 @@ function checksText(commands) {
   return quoted.length === 1 ? quoted[0] : `${quoted.slice(0, -1).join(", ")} and ${quoted.at(-1)}`;
 }
 var fillSlots = (template, slots) => template.replace(/\{(\w+)\}/g, (whole, key) => slots[key] ?? whole);
+function selectionFlags(fill) {
+  return `${fill.profile ? ` --profile ${fill.profile}` : ""}${fill.testFirst ? ` --test-first ${fill.testFirst.enabled}` : ""}${fill.review ? ` --review ${fill.review.enabled}` : ""}`;
+}
 function renderStages(fill, checks, install) {
-  const gates = GATES.filter((gate) => gate.title !== "QA" || fill.qa !== "none");
+  const gates = selectedGates(fill);
   return gates.map((gate, index) => {
     const passesWhen = fillSlots(gate.passesWhen, {
       install: install ? `after \`${install}\`, ` : "",
       checks: checksText(checks),
-      qa: fill.qa === "none" ? "" : QA_SECTIONS[fill.qa]
+      qa: fill.qa === "none" ? "" : fill.qa === "both" ? `${QA_SECTIONS.web}; also ${QA_SECTIONS.macos}` : QA_SECTIONS[fill.qa]
     });
+    const command = `drisp build step ${index + 1} --qa ${fill.qa}${selectionFlags(fill)}`;
     const stage = fillSlots(STAGE_TEMPLATE, {
       n: String(index + 1),
       title: gate.title,
-      stepCommand: `drisp build step ${index + 1} --qa ${fill.qa}`,
+      stepCommand: command,
       passesWhen
     });
-    return stage + (gate.cannotPass ? fillSlots(CANNOT_PASS_TEMPLATE, { cannotPass: gate.cannotPass }) : NO_GATE_TEXT_TEMPLATE);
+    return stage + (["Merge", "Evidence"].includes(gate.title) ? `
+
+Before doing this step: run \`${command} --verify\`. Missing or stale evidence must be refreshed first.` : "") + `
+
+Finish: write the actual result and supporting paths to \`.athena/evidence/step-${index + 1}.md\`, then run \`${command} --complete --evidence .athena/evidence/step-${index + 1}.md\`. This records an agent attestation, not independent verification.` + (gate.cannotPass ? fillSlots(CANNOT_PASS_TEMPLATE, { cannotPass: gate.cannotPass }) : NO_GATE_TEXT_TEMPLATE);
   }).join("\n\n");
 }
 function render(fill, workflowName, layout) {
@@ -21717,7 +21782,7 @@ function render(fill, workflowName, layout) {
   const limits = sizeClassLimits(fill.sizeClass);
   const workflow = {
     name: workflowName,
-    description: fillSlots(DESCRIPTION_TEMPLATE, {
+    description: fill.profile === "investigation" ? `Investigates ${parsed.identifier} and delivers findings with acceptance evidence.` : fillSlots(DESCRIPTION_TEMPLATE, {
       identifier: parsed.identifier
     }),
     promptTemplate: "{input}",
@@ -21734,12 +21799,40 @@ function render(fill, workflowName, layout) {
     permissions: renderedPermissions(fill)
   };
   const checks = checkCommands(fill, layout);
-  const workflowMd = fillSlots(WORKFLOW_MD_TEMPLATE, {
+  let template = WORKFLOW_MD_TEMPLATE;
+  if (!usesReview(fill))
+    template = template.replaceAll(
+      "both reviewers pass;",
+      "review is omitted by the approved plan;"
+    ).replaceAll(
+      "Review: Standards \u2713 \xB7 Spec \u2713",
+      "Review: omitted by the approved plan"
+    );
+  if (fill.profile === "investigation") {
+    template = template.replace(
+      /## Merge gate[\s\S]*?## Linear/,
+      "## Findings\n\nPost findings and acceptance evidence on the Linear issue. No pull request or merge is required.\n\n## Linear"
+    );
+    template = template.replace(
+      "Your Linear writes are exactly: In Progress in Explore, `PR: <url>` in Pull request, the evidence comment and Done in\nEvidence.",
+      "Your Linear writes are In Progress in Explore, findings and evidence, and Done in Evidence."
+    );
+  }
+  const workflowMd = fillSlots(template, {
     identifier: parsed.identifier,
-    instructions: fill.instructions.trim(),
+    instructions: [
+      fill.instructions.trim(),
+      fill.rationale ? `Plan rationale: ${fill.rationale}` : "",
+      fill.testFirst ? `Test first: ${fill.testFirst.enabled ? "included" : "omitted"} \u2014 ${fill.testFirst.reason}` : "",
+      fill.review ? `Code review: ${fill.review.enabled ? "included" : "omitted"} \u2014 ${fill.review.reason}` : "",
+      ...(fill.acceptanceEvidence ?? []).map(
+        (item) => `Acceptance evidence: ${item}`
+      )
+    ].filter(Boolean).join("\n\n"),
     gates: renderStages(fill, checks, installCommand(fill, layout)),
+    mergeVerify: `\`drisp build step ${gateTitles(fill).indexOf("Merge") + 1} --qa ${fill.qa}${selectionFlags(fill)} --verify\``,
     checksEvidence: checks.map((command) => `${command} \u2713`).join(" \xB7 "),
-    shellCommands: checksText([...RENDERER_RULES.permissions.shell])
+    shellCommands: checksText(shellCommands(fill))
   });
   return { workflowJson: `${JSON.stringify(workflow, null, 2)}
 `, workflowMd };
@@ -24254,4 +24347,4 @@ export {
   compileWorkflowPlan,
   collectMcpServersWithOptions
 };
-//# sourceMappingURL=chunk-W57EQYCM.js.map
+//# sourceMappingURL=chunk-HZ6GRLOM.js.map

package/dist/cli.js

@@ -37,6 +37,7 @@ import {
   cursorToVisualPosition,
   defaultWorktreesRoot,
   detectClaudeVersion,
+  eligibilityReason,
   ensureBuildWorktree,
   ensureChildWorktree,
   expandHome,
@@ -126,6 +127,7 @@ import {
   runnerServiceUnit,
   runnerSoftwareVersion,
   runnerUpdateRequestSchema,
+  scopeFingerprint,
   serviceInstallationId,
   sessionsDir,
   sliceAnsi,
@@ -140,7 +142,7 @@ import {
   visualPositionToOffset,
   wrapText,
   writeIdentityOnce
-} from "./chunk-2N7IBKJF.js";
+} from "./chunk-D246FR4I.js";
 import {
   generateId as generateId2
 } from "./chunk-PQIB66SG.js";
@@ -198,7 +200,7 @@ import {
   workflowRegistryDir,
   writeGlobalConfig,
   writeProjectConfig
-} from "./chunk-W57EQYCM.js";
+} from "./chunk-HZ6GRLOM.js";
 import {
   __toESM
 } from "./chunk-G3PMV62Z.js";
@@ -13615,7 +13617,7 @@ async function recoveryIdentity(runId) {
 }
 
 // src/app/entry/buildCommand.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 
 // src/core/build/planCommand.ts
 import fs6 from "fs";
@@ -13755,7 +13757,7 @@ function runBuildPlan(deps) {
     const fixturePullRequests = fixtureDir ? readJson(path6.join(fixtureDir, "pull-requests.json")) : void 0;
     const pullRequests = fixturePullRequests ?? Object.fromEntries(
       input.issues.filter(
-        (issue) => issue.branchName && issue.state.type !== "canceled" && !issue.labels.includes("ready-for-human")
+        (issue) => issue.branchName && issue.state.type !== "canceled" && !eligibilityReason(issue)
       ).map((issue) => [
         issue.branchName,
         deps.pullRequests(deps.folder, issue.branchName)
@@ -14266,8 +14268,22 @@ function occupies(view) {
 function assessTick(facts) {
   const { entries, orchestratorRunId } = facts;
   const state = structuredClone(facts.state);
+  for (const [id, reason] of Object.entries(state.needsPerson))
+    if (reason.startsWith("Issue is no longer eligible") || reason.startsWith("Waiting for prerequisite"))
+      delete state.needsPerson[id];
   const views = new Map(facts.children.map((view) => [view.runId, view]));
   const issues = new Map(facts.issues.map((issue) => [issue.id, issue]));
+  const parentOnly = new Set(
+    facts.skipped?.filter((issue) => issue.reason === "parent-only").map((issue) => issue.id) ?? []
+  );
+  const expandBlocker = (id, seen = /* @__PURE__ */ new Set()) => {
+    if (!parentOnly.has(id) || seen.has(id)) return [id];
+    const children = facts.issues.filter((issue) => issue.parentId === id);
+    if (!children.length) return [id];
+    return children.flatMap(
+      (issue) => expandBlocker(issue.id, /* @__PURE__ */ new Set([...seen, id]))
+    );
+  };
   const attemptsOf = (id) => state.attempts[id] ?? [];
   for (const entry of entries) {
     const prefix = `${orchestratorRunId}:${entry.identifier}:a`;
@@ -14310,7 +14326,7 @@ function assessTick(facts) {
   const status = /* @__PURE__ */ new Map();
   const skippedBlocker = (id) => {
     const linear = issues.get(id)?.state.type;
-    return linear === "completed" || linear === "canceled" ? "done" : "blocked";
+    return linear === "completed" ? "done" : "blocked";
   };
   const repair = [];
   const repaired = new Set(state.repaired ?? []);
@@ -14321,7 +14337,7 @@ function assessTick(facts) {
     const linear = issues.get(entry.id)?.state.type;
     const statusOf = () => {
       if (linear === "completed" || linear === "canceled") return "done";
-      const prs = prsOf(entry);
+      const prs = entry.profile === "investigation" ? void 0 : prsOf(entry);
       if (prs?.merged) {
         if (!repaired.has(entry.id) && !(newest && occupies(view))) {
           const prUrl = prs.mergedUrl ?? branchOf(entry);
@@ -14336,18 +14352,36 @@ function assessTick(facts) {
         return "done";
       }
       if (newest && (!view || !view.closed)) return "live";
+      const current = issues.get(entry.id);
+      if (!current || eligibilityReason(current)) {
+        state.needsPerson[entry.id] = `Issue is no longer eligible (${current ? eligibilityReason(current) : "missing from Linear"}). Update Linear, then Build again.`;
+        return "needs_person";
+      }
+      if (entry.scopeFingerprint && entry.scopeFingerprint !== scopeFingerprint(current)) {
+        state.needsPerson[entry.id] = "Issue scope changed after approval. Build again to review the revised plan.";
+        return "needs_person";
+      }
       if (newest?.outcome === "template_mismatch") return "replan";
       if (newest?.outcome === "completed")
-        state.needsPerson[entry.id] ??= BUILD_STRINGS.completedUnmerged;
+        state.needsPerson[entry.id] ??= entry.profile === "investigation" ? "The investigation ended without marking its accepted findings Done in Linear. Review its evidence." : BUILD_STRINGS.completedUnmerged;
       if (state.needsPerson[entry.id] || newest && !mayRetry(attempts))
         return "needs_person";
-      const blockers = entry.blockedBy.map(
-        (id) => status.get(id) ?? skippedBlocker(id)
-      );
+      const blockers = [
+        .../* @__PURE__ */ new Set([
+          ...entry.blockedBy,
+          ...current.blockedBy.flatMap((id) => expandBlocker(id))
+        ])
+      ].map((id) => {
+        if (issues.get(id)?.state.type === "canceled") return "blocked";
+        return status.get(id) ?? (entries.some((each) => each.id === id) && issues.get(id)?.state.type !== "completed" ? "pending" : skippedBlocker(id));
+      });
       if (blockers.some(
         (b) => b === "needs_person" || b === "replan" || b === "blocked"
-      ))
+      )) {
+        if (current.blockedBy.some((id) => !entry.blockedBy.includes(id)))
+          state.needsPerson[entry.id] = "Waiting for prerequisite work. Resolve its readiness, completion or cancellation in Linear, then resume.";
         return "blocked";
+      }
       return blockers.every((b) => b === "done") ? "ready" : "pending";
     };
     status.set(entry.id, statusOf());
@@ -14399,6 +14433,12 @@ function tickAction(input) {
   const done = input.entries.filter(
     (entry) => input.status.get(entry.id) === "done"
   ).length;
+  if (done !== input.entries.length)
+    return {
+      action: "park",
+      reason: "attention",
+      message: `Built ${done} of ${input.entries.length}. Remaining issues are blocked or need attention. Resolve the issue or dependency, then resume; Build again if the approved scope changed.`
+    };
   return {
     action: "complete",
     message: `Built ${done} of ${input.entries.length}`
@@ -14523,6 +14563,7 @@ async function runBuildTick(deps) {
   const entries = plan.groups.flatMap((group) => group.issues).filter((entry) => approved.has(entry.id));
   const issues = new Map(input.issues.map((issue) => [issue.id, issue]));
   const assessment = assessTick({
+    skipped: plan.skipped,
     orchestratorRunId,
     entries,
     issues: input.issues,
@@ -14725,8 +14766,16 @@ function evaluateRemoteChecks(runs) {
 }
 
 // src/core/build/step.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash2 } from "crypto";
 import fs8 from "fs";
 import path8 from "path";
+var receiptSchema = external_exports.strictObject({
+  title: external_exports.string().min(1),
+  revision: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  evidence: external_exports.string().min(1).max(16e3),
+  kind: external_exports.literal("agent-attestation")
+});
 var QA_KINDS = fillSchema.shape.qa.options;
 function runBuildStep(input) {
   const directory = requireEnv(input.env, "DRISP_RUN_ARTIFACTS");
@@ -14735,7 +14784,22 @@ function runBuildStep(input) {
     throw new BuildUsageError(
       `--qa must be one of ${QA_KINDS.join(", ")}, not "${qa}".`
     );
-  const titles = gateTitles({ qa });
+  const parsedProfile = fillSchema.shape.profile.safeParse(input.profile);
+  if (!parsedProfile.success)
+    throw new BuildUsageError("Unknown workflow profile.");
+  const profile = parsedProfile.data;
+  const selection = (value) => {
+    if (value === void 0) return void 0;
+    if (value !== "true" && value !== "false")
+      throw new BuildUsageError("Step selection must be true or false.");
+    return { enabled: value === "true", reason: "Approved workflow" };
+  };
+  const titles = gateTitles({
+    qa,
+    profile,
+    testFirst: selection(input.testFirst),
+    review: selection(input.review)
+  });
   const index = /^[0-9]+$/.test(input.n ?? "") ? Number(input.n) : 0;
   if (index < 1 || index > titles.length)
     throw new BuildUsageError(
@@ -14745,10 +14809,56 @@ function runBuildStep(input) {
     throw new BuildUsageError(
       `DRISP_RUN_ARTIFACTS (${directory}) is not a directory.`
     );
+  const receiptsPath = path8.join(directory, "gate_evidence.json");
+  let receipts = [];
+  if (fs8.existsSync(receiptsPath)) {
+    try {
+      receipts = external_exports.strictObject({ receipts: external_exports.array(receiptSchema).max(100) }).parse(JSON.parse(fs8.readFileSync(receiptsPath, "utf8"))).receipts;
+    } catch {
+      throw new BuildUsageError("Gate evidence is invalid.");
+    }
+  }
+  const revision = receipts.length || input.complete || input.verify ? workRevision(input.cwd ?? process.cwd()) : "";
+  const fresh = (receipt) => ["Explore", "Pull request", "Evidence", "Merge"].includes(receipt.title) || receipt.revision === revision;
+  if (input.verify || input.complete && titles[index - 1] === "Evidence") {
+    const missing = titles.slice(0, index - 1).filter((title) => !receipts.some((r) => r.title === title && fresh(r)));
+    if (missing.length)
+      throw new BuildUsageError(
+        `Missing or stale evidence: ${missing.join(", ")}. Repeat those steps on the current revision.`
+      );
+  }
+  if (input.complete) {
+    if (!input.evidence)
+      throw new BuildUsageError(
+        "--complete requires --evidence <file> containing the result and supporting paths."
+      );
+    let evidence;
+    try {
+      evidence = fs8.readFileSync(
+        path8.resolve(input.cwd ?? process.cwd(), input.evidence),
+        "utf8"
+      ).trim();
+    } catch {
+      throw new BuildUsageError("Cannot read the evidence file.");
+    }
+    if (!evidence || evidence.length > 16e3)
+      throw new BuildUsageError("Evidence must contain 1\u201316000 characters.");
+    receipts = receipts.filter((r) => r.title !== titles[index - 1]);
+    receipts.push({
+      title: titles[index - 1],
+      revision,
+      evidence,
+      kind: "agent-attestation"
+    });
+    fs8.writeFileSync(receiptsPath, JSON.stringify({ receipts }) + "\n");
+  }
   const artifact = {
     index,
     title: titles[index - 1],
-    total: titles.length
+    total: titles.length,
+    ...receipts.length ? {
+      completed: receipts.filter(fresh).map((r) => titles.indexOf(r.title) + 1).filter((n) => n > 0)
+    } : {}
   };
   fs8.writeFileSync(
     path8.join(directory, "step.json"),
@@ -14757,6 +14867,23 @@ function runBuildStep(input) {
   );
   return artifact;
 }
+function workRevision(cwd) {
+  const git2 = (...args) => execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  try {
+    const hash = createHash2("sha256").update(git2("rev-parse", "HEAD")).update(git2("diff", "HEAD", "--", ".", ":!.athena/evidence"));
+    for (const name of git2("ls-files", "--others", "--exclude-standard", "-z").split("\0").filter(Boolean).sort()) {
+      if (name.startsWith(".athena/evidence/")) continue;
+      hash.update(name).update(fs8.readFileSync(path8.join(cwd, name)));
+    }
+    return hash.digest("hex");
+  } catch {
+    throw new BuildUsageError("Evidence must be recorded in a git worktree.");
+  }
+}
 
 // src/core/build/merged.ts
 import fs9 from "fs";
@@ -14816,17 +14943,20 @@ function runBuildMerged(input) {
 var USAGE3 = `Usage: drisp build plan --input <path>
        drisp build tick --input <path> [--rebase-failed <IDENTIFIER>]...
        drisp build checks
-       drisp build step <n> [--qa none|web|macos]
+       drisp build step <n> [--qa none|web|macos|both] [--profile implementation|documentation|investigation]
+       [--test-first true|false] [--review true|false] [--complete --evidence <file>] [--verify]
        drisp build merged [<pr url or number>]
 plan and tick run inside an Orchestrator Run (DRISP_RUN_ID, DRISP_RUNNER_ID and DRISP_RUN_ARTIFACTS set; tick also
 DRISP_RUN_TOKEN and DRISP_HUB_URL). DRISP_BUILD_PLAN_INPUT=<path> stands in for plan's --input, with
 fills/<IDENTIFIER>.json beside it. checks runs in a child's worktree: the merge gate's verdict on HEAD's GitHub runs.
 step runs in any Run with DRISP_RUN_ARTIFACTS set: it writes the step artifact {index, title, total} for gate <n> of the
-build-child template (QA is a gate unless --qa none) and refuses an index outside the list.
+selected build-child profile (QA is a gate unless --qa none) and refuses an index outside the list.
+--complete --evidence <file> records an agent attestation bound to the source revision; --verify requires fresh
+receipts for all preceding steps. Keep evidence files under .athena/evidence/.
 merged runs in a child's worktree after its pull request merged: it writes the pull_request artifact
 {url, number, sha, mergedAt} and refuses a pull request that is not merged.`;
 function githubPullRequests(folder, branch) {
-  const output = execFileSync(
+  const output = execFileSync2(
     "gh",
     [
       "pr",
@@ -14865,7 +14995,7 @@ function hostCapabilities(folder) {
 }
 var defaultChecks = {
   head: (cwd) => git(cwd, ["rev-parse", "HEAD"]),
-  gh: (args, cwd) => execFileSync("gh", args, {
+  gh: (args, cwd) => execFileSync2("gh", args, {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -14954,6 +15084,13 @@ async function runBuildCommand(input) {
         output = runBuildStep({
           env: env2,
           n: input.positional?.[0],
+          cwd: input.cwd,
+          profile: input.flags.profile,
+          testFirst: input.flags.testFirst,
+          review: input.flags.review,
+          complete: input.flags.complete,
+          verify: input.flags.verify,
+          evidence: input.flags.evidence,
           ...input.flags.qa ? { qa: input.flags.qa } : {}
         });
         break;
@@ -14978,7 +15115,7 @@ ${USAGE3}
 import process7 from "process";
 
 // src/harnesses/claude/system/doctorEnvironment.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import * as fs10 from "fs";
 import * as os4 from "os";
 import * as path10 from "path";
@@ -15056,7 +15193,7 @@ function readEnforcement(scopes) {
 }
 function tryRichAuth(claudeBinary) {
   try {
-    const output = execFileSync2(claudeBinary, ["auth", "status"], {
+    const output = execFileSync3(claudeBinary, ["auth", "status"], {
       timeout: 1e4,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -15789,7 +15926,7 @@ var cli = meow(
 			build plan --input <path>  Plan a Build inside an Orchestrator Run (prints one JSON object)
 			build tick --input <path>  Run one step of a started Build (prints the next action; [--rebase-failed <ID>]...)
 			build checks               The merge gate's verdict on HEAD's GitHub runs (in a child's worktree)
-			build step <n>             Report the Run's current step: writes the step run artifact ([--qa none|web|macos])
+			build step <n>             Report the Run's current step: writes the step run artifact ([--qa none|web|macos|both], --profile, --complete --evidence, --verify)
 			build merged               Record the merged pull request: writes the pull_request run artifact
 			telemetry [action]    Manage anonymous telemetry (enable/disable/status)
 			doctor                Diagnose Claude headless setup (use with --harness=claude)
@@ -15928,6 +16065,12 @@ var cli = meow(
         type: "string",
         isMultiple: true
       },
+      profile: { type: "string" },
+      testFirst: { type: "string" },
+      review: { type: "string" },
+      complete: { type: "boolean" },
+      verify: { type: "boolean" },
+      evidence: { type: "string" },
       qa: {
         type: "string"
       },
@@ -16024,7 +16167,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         await exitWith(1);
         return;
       }
-      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-YANLNMTP.js");
+      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-VVEEJW25.js");
       const { waitUntilExit } = render(
         /* @__PURE__ */ jsx24(
           WorkflowInstallWizard,
@@ -16110,6 +16253,12 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         positional: buildArgs,
         flags: {
           ...typeof cli.flags.qa === "string" ? { qa: cli.flags.qa } : {},
+          profile: cli.flags.profile,
+          testFirst: cli.flags.testFirst,
+          review: cli.flags.review,
+          complete: cli.flags.complete,
+          verify: cli.flags.verify,
+          evidence: cli.flags.evidence,
           ...typeof cli.flags.input === "string" ? { input: cli.flags.input } : {},
           ...cli.flags.rebaseFailed?.length ? { rebaseFailed: cli.flags.rebaseFailed } : {}
         },

package/dist/dashboard-daemon.js

@@ -1,6 +1,6 @@
-import "./chunk-Y6XJPUR2.js";
-import "./chunk-2N7IBKJF.js";
+import "./chunk-D5VZT7M3.js";
+import "./chunk-D246FR4I.js";
 import "./chunk-PQIB66SG.js";
-import "./chunk-W57EQYCM.js";
+import "./chunk-HZ6GRLOM.js";
 import "./chunk-G3PMV62Z.js";
 //# sourceMappingURL=dashboard-daemon.js.map

package/dist/runner.js

@@ -1,6 +1,6 @@
-import "./chunk-Y6XJPUR2.js";
-import "./chunk-2N7IBKJF.js";
+import "./chunk-D5VZT7M3.js";
+import "./chunk-D246FR4I.js";
 import "./chunk-PQIB66SG.js";
-import "./chunk-W57EQYCM.js";
+import "./chunk-HZ6GRLOM.js";
 import "./chunk-G3PMV62Z.js";
 //# sourceMappingURL=runner.js.map

package/package.json

@@ -17,7 +17,7 @@
 		"hooks",
 		"dashboard"
 	],
-	"version": "0.7.6",
+	"version": "0.7.7",
 	"license": "MIT",
 	"bin": {
 		"athena": "dist/cli.js",