@drisp/cli 0.7.6 → 0.7.8

package/dist/cli.js

@@ -37,6 +37,7 @@ import {
   cursorToVisualPosition,
   defaultWorktreesRoot,
   detectClaudeVersion,
+  eligibilityReason,
   ensureBuildWorktree,
   ensureChildWorktree,
   expandHome,
@@ -126,6 +127,7 @@ import {
   runnerServiceUnit,
   runnerSoftwareVersion,
   runnerUpdateRequestSchema,
+  scopeFingerprint,
   serviceInstallationId,
   sessionsDir,
   sliceAnsi,
@@ -140,7 +142,7 @@ import {
   visualPositionToOffset,
   wrapText,
   writeIdentityOnce
-} from "./chunk-2N7IBKJF.js";
+} from "./chunk-HGMJ3YL2.js";
 import {
   generateId as generateId2
 } from "./chunk-PQIB66SG.js";
@@ -159,6 +161,7 @@ import {
   DESCRIPTION_TEMPLATE,
   GATES,
   LAYOUT_MARKERS,
+  MERGE_SIGN_OFF,
   NO_GATE_TEXT_TEMPLATE,
   ORCHESTRATOR_LIMITS,
   QA_SECTIONS,
@@ -198,7 +201,7 @@ import {
   workflowRegistryDir,
   writeGlobalConfig,
   writeProjectConfig
-} from "./chunk-W57EQYCM.js";
+} from "./chunk-OYUBT6RS.js";
 import {
   __toESM
 } from "./chunk-G3PMV62Z.js";
@@ -206,10 +209,10 @@ import {
 // src/app/entry/cli.tsx
 import { render } from "ink";
 import meow from "meow";
-import fs11 from "fs";
+import fs12 from "fs";
 import { createRequire } from "module";
 import os5 from "os";
-import path11 from "path";
+import path12 from "path";
 import { fileURLToPath } from "url";
 
 // src/app/shell/sessionUiState.ts
@@ -5328,14 +5331,14 @@ function extractWebSearch(_input, response) {
   return { type: "text", content: extractTextContent(response), maxLines: 10 };
 }
 function extractNotebookEdit(input, _response) {
-  const path12 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
+  const path13 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
   const mode = typeof input["edit_mode"] === "string" ? input["edit_mode"] : "replace";
   const source = typeof input["new_source"] === "string" ? input["new_source"] : "";
-  if (!source) return { type: "text", content: `${mode} cell in ${path12}` };
+  if (!source) return { type: "text", content: `${mode} cell in ${path13}` };
   return {
     type: "code",
     content: source,
-    language: detectLanguage(path12),
+    language: detectLanguage(path13),
     maxLines: 10
   };
 }
@@ -5861,10 +5864,10 @@ function extractToolSubject(toolName, toolInput) {
       const parts = [];
       const pattern = str(input, "pattern");
       const glob = str(input, "glob");
-      const path12 = str(input, "path");
+      const path13 = str(input, "path");
       if (pattern) parts.push(`"${pattern}"`);
       if (glob) parts.push(glob);
-      if (path12) parts.push(`in ${path12}`);
+      if (path13) parts.push(`in ${path13}`);
       return parts.length > 0 ? parts.join("  ") : void 0;
     }
     case "Skill":
@@ -13095,7 +13098,7 @@ var thisMachine = (installationId) => ({
   os: `${platform()} ${release()}`.slice(0, 64),
   softwareVersion: runnerSoftwareVersion
 });
-var post = (origin, path12, body) => fetch(new URL(path12, origin), {
+var post = (origin, path13, body) => fetch(new URL(path13, origin), {
   method: "POST",
   headers: { "Content-Type": "application/json" },
   body: JSON.stringify(body)
@@ -13114,8 +13117,8 @@ async function alreadyConnected(existing, { forTeam, ownIdentity }) {
   const problem = own ? await credentialAccepted(own.config) ? void 0 : "lapsed" : forTeam(existing.orgId).length ? "other_runner" : "missing";
   const runner = { orgId: existing.orgId, runnerId: existing.runnerId, name: existing.name };
   if (own && problem === void 0) return { status: "already_connected", ...runner, path: own.path };
-  const path12 = (own ?? forTeam(existing.orgId)[0])?.path;
-  return { status: "identity_unusable", ...runner, problem, ...path12 ? { path: path12 } : {} };
+  const path13 = (own ?? forTeam(existing.orgId)[0])?.path;
+  return { status: "identity_unusable", ...runner, problem, ...path13 ? { path: path13 } : {} };
 }
 async function connectWithCode({
   code,
@@ -13187,20 +13190,20 @@ async function saveIdentity(origin, credential, { single, forTeam }, directory)
     name: credential.name
   });
   const replaced = [];
-  for (const { path: path13 } of forTeam(credential.orgId)) {
-    const aside = `${path13}.replaced-${Date.now()}`;
-    await rename(path13, aside);
+  for (const { path: path14 } of forTeam(credential.orgId)) {
+    const aside = `${path14}.replaced-${Date.now()}`;
+    await rename(path14, aside);
     replaced.push(aside);
   }
-  const path12 = single ?? teamIdentityPath(origin, credential.orgId, directory);
+  const path13 = single ?? teamIdentityPath(origin, credential.orgId, directory);
   try {
-    await writeIdentityOnce(path12, JSON.stringify(config, null, 2) + "\n");
+    await writeIdentityOnce(path13, JSON.stringify(config, null, 2) + "\n");
   } catch (error) {
     if (error.code === "EEXIST")
-      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path12} meanwhile; it was left unchanged.`);
+      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path13} meanwhile; it was left unchanged.`);
     throw error;
   }
-  return { status: "connected", config, path: path12, replaced };
+  return { status: "connected", config, path: path13, replaced };
 }
 function pathSegment(value) {
   const segment = encodeURIComponent(value);
@@ -13240,7 +13243,7 @@ async function refuseExisting(target) {
   throw new Error(`This machine already has a Runner${name ? ` (${name})` : ""} configured at ${target}.`);
 }
 async function disconnectRunner({
-  identity: { path: path12, config },
+  identity: { path: path13, config },
   serviceManager,
   othersRemain
 }) {
@@ -13273,7 +13276,7 @@ async function disconnectRunner({
     await restore();
     throw new Error(`The Hub refused to disconnect ${name} (${body.error ?? response.status}); it is still connected.`);
   }
-  await forgetRunner(path12);
+  await forgetRunner(path13);
   if (othersRemain) await restore();
   else await serviceManager?.remove();
   return result;
@@ -13426,18 +13429,18 @@ async function runRunnerCommandV2(input, options = {}) {
             `This machine is already connected to this Team as ${outcome.name}, but ${why}. ` + (code ? `The code was not used: connect a new Runner in its place with ${retry}. ` : `Connect a new Runner in its place with a Connect code from Settings \u2192 Runners: ${retry}. `) + `The old ${outcome.name} stays listed in Settings \u2192 Runners, offline.`
           );
         }
-        const { config, path: path12, replaced } = outcome;
+        const { config, path: path13, replaced } = outcome;
         for (const aside of replaced)
           process.stdout.write(
             `The Hub no longer recognised this machine's earlier identity for this Team; it was moved aside to ${aside}.
 `
           );
         process.stdout.write(
-          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path12}.
+          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path13}.
 `
         );
         if (services) {
-          const service = await ensureService(services, config, path12);
+          const service = await ensureService(services, config, path13);
           process.stdout.write(`${serviceStarted(service)}
 `);
           return 0;
@@ -13446,7 +13449,7 @@ async function runRunnerCommandV2(input, options = {}) {
           process.stdout.write(
             "No launchd or systemd here to run the Runner as a background service; running it in the foreground instead.\n"
           );
-        await runConfiguredRunner(path12, options.signal);
+        await runConfiguredRunner(path13, options.signal);
         return 0;
       }
       case "disconnect": {
@@ -13517,9 +13520,9 @@ async function runRunnerCommandV2(input, options = {}) {
               configured: true,
               // One entry per Team this machine serves; credentials are never printed.
               teams: identities.map(
-                ({ path: path12, config: { token: _token, ...config } }) => ({
+                ({ path: path13, config: { token: _token, ...config } }) => ({
                   ...config,
-                  path: path12
+                  path: path13
                 })
               ),
               service: service ? {
@@ -13615,7 +13618,7 @@ async function recoveryIdentity(runId) {
 }
 
 // src/app/entry/buildCommand.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 
 // src/core/build/planCommand.ts
 import fs6 from "fs";
@@ -13675,7 +13678,9 @@ function computeTemplateVersion() {
     JSON.stringify(QA_SECTIONS),
     JSON.stringify(GATES),
     JSON.stringify(RENDERER_RULES),
-    JSON.stringify(LAYOUT_MARKERS)
+    JSON.stringify(LAYOUT_MARKERS),
+    JSON.stringify(MERGE_SIGN_OFF),
+    BUILD_STRINGS.mergeSignOff
   ];
   const hash = createHash("sha256");
   for (const part of parts) hash.update(`${part.length}:${part}`);
@@ -13755,7 +13760,7 @@ function runBuildPlan(deps) {
     const fixturePullRequests = fixtureDir ? readJson(path6.join(fixtureDir, "pull-requests.json")) : void 0;
     const pullRequests = fixturePullRequests ?? Object.fromEntries(
       input.issues.filter(
-        (issue) => issue.branchName && issue.state.type !== "canceled" && !issue.labels.includes("ready-for-human")
+        (issue) => issue.branchName && issue.state.type !== "canceled" && !eligibilityReason(issue)
       ).map((issue) => [
         issue.branchName,
         deps.pullRequests(deps.folder, issue.branchName)
@@ -13780,7 +13785,8 @@ function runBuildPlan(deps) {
         fills: result.fills.map((fill) => ({
           ...fill,
           path: fillPath(fill.identifier)
-        }))
+        })),
+        ...result.reason ? { reason: result.reason } : {}
       };
     const host = deps.hostCapabilities();
     for (const workflow of result.workflows) {
@@ -13864,9 +13870,9 @@ var DrispClient = class _DrispClient {
     if (!match) throw new Error("invalid_hub_url");
     return new _DrispClient(url.origin, decodeURIComponent(match[1]), async () => token);
   }
-  async request(path12, body) {
+  async request(path13, body) {
     const response = await fetch(
-      `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}${path12}`,
+      `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}${path13}`,
       {
         method: body === void 0 ? "GET" : "POST",
         headers: {
@@ -14266,8 +14272,22 @@ function occupies(view) {
 function assessTick(facts) {
   const { entries, orchestratorRunId } = facts;
   const state = structuredClone(facts.state);
+  for (const [id, reason] of Object.entries(state.needsPerson))
+    if (reason.startsWith("Issue is no longer eligible") || reason.startsWith("Waiting for prerequisite"))
+      delete state.needsPerson[id];
   const views = new Map(facts.children.map((view) => [view.runId, view]));
   const issues = new Map(facts.issues.map((issue) => [issue.id, issue]));
+  const parentOnly = new Set(
+    facts.skipped?.filter((issue) => issue.reason === "parent-only").map((issue) => issue.id) ?? []
+  );
+  const expandBlocker = (id, seen = /* @__PURE__ */ new Set()) => {
+    if (!parentOnly.has(id) || seen.has(id)) return [id];
+    const children = facts.issues.filter((issue) => issue.parentId === id);
+    if (!children.length) return [id];
+    return children.flatMap(
+      (issue) => expandBlocker(issue.id, /* @__PURE__ */ new Set([...seen, id]))
+    );
+  };
   const attemptsOf = (id) => state.attempts[id] ?? [];
   for (const entry of entries) {
     const prefix = `${orchestratorRunId}:${entry.identifier}:a`;
@@ -14310,7 +14330,7 @@ function assessTick(facts) {
   const status = /* @__PURE__ */ new Map();
   const skippedBlocker = (id) => {
     const linear = issues.get(id)?.state.type;
-    return linear === "completed" || linear === "canceled" ? "done" : "blocked";
+    return linear === "completed" ? "done" : "blocked";
   };
   const repair = [];
   const repaired = new Set(state.repaired ?? []);
@@ -14321,7 +14341,7 @@ function assessTick(facts) {
     const linear = issues.get(entry.id)?.state.type;
     const statusOf = () => {
       if (linear === "completed" || linear === "canceled") return "done";
-      const prs = prsOf(entry);
+      const prs = entry.profile === "investigation" ? void 0 : prsOf(entry);
       if (prs?.merged) {
         if (!repaired.has(entry.id) && !(newest && occupies(view))) {
           const prUrl = prs.mergedUrl ?? branchOf(entry);
@@ -14336,18 +14356,36 @@ function assessTick(facts) {
         return "done";
       }
       if (newest && (!view || !view.closed)) return "live";
+      const current = issues.get(entry.id);
+      if (!current || eligibilityReason(current)) {
+        state.needsPerson[entry.id] = `Issue is no longer eligible (${current ? eligibilityReason(current) : "missing from Linear"}). Update Linear, then Build again.`;
+        return "needs_person";
+      }
+      if (entry.scopeFingerprint && entry.scopeFingerprint !== scopeFingerprint(current)) {
+        state.needsPerson[entry.id] = "Issue scope changed after approval. Build again to review the revised plan.";
+        return "needs_person";
+      }
       if (newest?.outcome === "template_mismatch") return "replan";
       if (newest?.outcome === "completed")
-        state.needsPerson[entry.id] ??= BUILD_STRINGS.completedUnmerged;
+        state.needsPerson[entry.id] ??= entry.profile === "investigation" ? "The investigation ended without marking its accepted findings Done in Linear. Review its evidence." : BUILD_STRINGS.completedUnmerged;
       if (state.needsPerson[entry.id] || newest && !mayRetry(attempts))
         return "needs_person";
-      const blockers = entry.blockedBy.map(
-        (id) => status.get(id) ?? skippedBlocker(id)
-      );
+      const blockers = [
+        .../* @__PURE__ */ new Set([
+          ...entry.blockedBy,
+          ...current.blockedBy.flatMap((id) => expandBlocker(id))
+        ])
+      ].map((id) => {
+        if (issues.get(id)?.state.type === "canceled") return "blocked";
+        return status.get(id) ?? (entries.some((each) => each.id === id) && issues.get(id)?.state.type !== "completed" ? "pending" : skippedBlocker(id));
+      });
       if (blockers.some(
         (b) => b === "needs_person" || b === "replan" || b === "blocked"
-      ))
+      )) {
+        if (current.blockedBy.some((id) => !entry.blockedBy.includes(id)))
+          state.needsPerson[entry.id] = "Waiting for prerequisite work. Resolve its readiness, completion or cancellation in Linear, then resume.";
         return "blocked";
+      }
       return blockers.every((b) => b === "done") ? "ready" : "pending";
     };
     status.set(entry.id, statusOf());
@@ -14399,6 +14437,12 @@ function tickAction(input) {
   const done = input.entries.filter(
     (entry) => input.status.get(entry.id) === "done"
   ).length;
+  if (done !== input.entries.length)
+    return {
+      action: "park",
+      reason: "attention",
+      message: `Built ${done} of ${input.entries.length}. Remaining issues are blocked or need attention. Resolve the issue or dependency, then resume; Build again if the approved scope changed.`
+    };
   return {
     action: "complete",
     message: `Built ${done} of ${input.entries.length}`
@@ -14523,6 +14567,7 @@ async function runBuildTick(deps) {
   const entries = plan.groups.flatMap((group) => group.issues).filter((entry) => approved.has(entry.id));
   const issues = new Map(input.issues.map((issue) => [issue.id, issue]));
   const assessment = assessTick({
+    skipped: plan.skipped,
     orchestratorRunId,
     entries,
     issues: input.issues,
@@ -14725,8 +14770,25 @@ function evaluateRemoteChecks(runs) {
 }
 
 // src/core/build/step.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash2 } from "crypto";
 import fs8 from "fs";
 import path8 from "path";
+var receiptSchema = external_exports.strictObject({
+  title: external_exports.string().min(1),
+  revision: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  evidence: external_exports.string().min(1).max(16e3),
+  kind: external_exports.literal("agent-attestation")
+});
+var COMMIT_SHA = /^[0-9a-f]{40}$/;
+var gateEvidenceSchema = external_exports.strictObject({
+  receipts: external_exports.array(receiptSchema).max(100),
+  /**
+   * The Sign-off on the Merge step (`merge: you`): the head commit the child attests the member signed off on in
+   * its Thread. Like the receipts, an agent attestation.
+   */
+  signOff: external_exports.strictObject({ sha: external_exports.string().regex(COMMIT_SHA) }).optional()
+});
 var QA_KINDS = fillSchema.shape.qa.options;
 function runBuildStep(input) {
   const directory = requireEnv(input.env, "DRISP_RUN_ARTIFACTS");
@@ -14735,20 +14797,133 @@ function runBuildStep(input) {
     throw new BuildUsageError(
       `--qa must be one of ${QA_KINDS.join(", ")}, not "${qa}".`
     );
-  const titles = gateTitles({ qa });
+  const parsedProfile = fillSchema.shape.profile.safeParse(input.profile);
+  if (!parsedProfile.success)
+    throw new BuildUsageError("Unknown workflow profile.");
+  const profile = parsedProfile.data;
+  const selection = (value) => {
+    if (value === void 0) return void 0;
+    if (value !== "true" && value !== "false")
+      throw new BuildUsageError("Step selection must be true or false.");
+    return { enabled: value === "true", reason: "Approved workflow" };
+  };
+  const titles = gateTitles({
+    qa,
+    profile,
+    testFirst: selection(input.testFirst),
+    review: selection(input.review)
+  });
   const index = /^[0-9]+$/.test(input.n ?? "") ? Number(input.n) : 0;
   if (index < 1 || index > titles.length)
     throw new BuildUsageError(
       `Step must be a whole number between 1 and ${titles.length}, not "${input.n ?? ""}".`
     );
+  if (input.merge !== void 0 && input.merge !== "agent" && input.merge !== "you")
+    throw new BuildUsageError("--merge must be agent or you.");
+  const mergeStep = titles.indexOf("Merge") + 1;
+  const signsOff = input.merge === "you" && index === mergeStep;
+  if (input.signOff !== void 0) {
+    if (input.merge !== "you")
+      throw new BuildUsageError(
+        "--sign-off needs --merge you: agents merge this pull request."
+      );
+    if (mergeStep === 0)
+      throw new BuildUsageError(
+        "--sign-off is for the Merge step, and this workflow has none."
+      );
+    if (!signsOff)
+      throw new BuildUsageError(
+        `--sign-off is for the Merge step (${mergeStep}), not step ${index}.`
+      );
+    if (!COMMIT_SHA.test(input.signOff))
+      throw new BuildUsageError(
+        "--sign-off needs the full 40-character commit SHA the member signed off on."
+      );
+  }
   if (!fs8.statSync(directory, { throwIfNoEntry: false })?.isDirectory())
     throw new BuildUsageError(
       `DRISP_RUN_ARTIFACTS (${directory}) is not a directory.`
     );
+  const receiptsPath = path8.join(directory, "gate_evidence.json");
+  let receipts = [];
+  let signOff;
+  if (fs8.existsSync(receiptsPath)) {
+    try {
+      ({ receipts, signOff } = gateEvidenceSchema.parse(
+        JSON.parse(fs8.readFileSync(receiptsPath, "utf8"))
+      ));
+    } catch {
+      throw new BuildUsageError("Gate evidence is invalid.");
+    }
+  }
+  const save = () => fs8.writeFileSync(
+    receiptsPath,
+    JSON.stringify({ receipts, ...signOff ? { signOff } : {} }) + "\n"
+  );
+  const head = signsOff && (input.signOff || input.verify) ? headCommit(input.cwd ?? process.cwd()) : "";
+  if (input.signOff !== void 0) {
+    if (input.signOff !== head)
+      throw new BuildUsageError(
+        `The Sign-off names ${input.signOff}, but HEAD is ${head}. ${askForSignOff(head)}`
+      );
+    signOff = { sha: head };
+    save();
+  }
+  const revision = receipts.length || input.complete || input.verify ? workRevision(input.cwd ?? process.cwd()) : "";
+  const fresh = (receipt) => ["Explore", "Pull request", "Evidence", "Merge"].includes(receipt.title) || receipt.revision === revision;
+  if (input.verify || input.complete && titles[index - 1] === "Evidence") {
+    const missing = titles.slice(0, index - 1).filter((title) => !receipts.some((r) => r.title === title && fresh(r)));
+    if (missing.length)
+      throw new BuildUsageError(
+        `Missing or stale evidence: ${missing.join(", ")}. Repeat those steps on the current revision.`
+      );
+  }
+  if (signsOff && input.verify) {
+    if (!signOff)
+      throw new BuildUsageError(
+        `No Sign-off on HEAD (${head}) yet. ${askForSignOff(head)}`
+      );
+    if (signOff.sha !== head)
+      throw new BuildUsageError(
+        `The Sign-off names ${signOff.sha}, but HEAD is now ${head}. ${askForSignOff(head)}`
+      );
+  }
+  if (signsOff && input.complete && !signOff)
+    throw new BuildUsageError(
+      "No Sign-off was recorded: verify and merge only after the member signs off on HEAD."
+    );
+  if (input.complete) {
+    if (!input.evidence)
+      throw new BuildUsageError(
+        "--complete requires --evidence <file> containing the result and supporting paths."
+      );
+    let evidence;
+    try {
+      evidence = fs8.readFileSync(
+        path8.resolve(input.cwd ?? process.cwd(), input.evidence),
+        "utf8"
+      ).trim();
+    } catch {
+      throw new BuildUsageError("Cannot read the evidence file.");
+    }
+    if (!evidence || evidence.length > 16e3)
+      throw new BuildUsageError("Evidence must contain 1\u201316000 characters.");
+    receipts = receipts.filter((r) => r.title !== titles[index - 1]);
+    receipts.push({
+      title: titles[index - 1],
+      revision,
+      evidence,
+      kind: "agent-attestation"
+    });
+    save();
+  }
   const artifact = {
     index,
     title: titles[index - 1],
-    total: titles.length
+    total: titles.length,
+    ...receipts.length ? {
+      completed: receipts.filter(fresh).map((r) => titles.indexOf(r.title) + 1).filter((n) => n > 0)
+    } : {}
   };
   fs8.writeFileSync(
     path8.join(directory, "step.json"),
@@ -14757,6 +14932,34 @@ function runBuildStep(input) {
   );
   return artifact;
 }
+function askForSignOff(sha) {
+  return `Ask the member: end the Turn with <!-- NEEDS_HUMAN: ${BUILD_STRINGS.mergeSignOff.replace("{sha}", sha)} -->`;
+}
+var gitIn = (cwd) => (...args) => execFileSync("git", args, {
+  cwd,
+  encoding: "utf8",
+  stdio: ["ignore", "pipe", "pipe"]
+});
+function headCommit(cwd) {
+  try {
+    return gitIn(cwd)("rev-parse", "HEAD").trim();
+  } catch {
+    throw new BuildUsageError("A Sign-off must be recorded in a git worktree.");
+  }
+}
+function workRevision(cwd) {
+  const git2 = gitIn(cwd);
+  try {
+    const hash = createHash2("sha256").update(git2("rev-parse", "HEAD")).update(git2("diff", "HEAD", "--", ".", ":!.athena/evidence"));
+    for (const name of git2("ls-files", "--others", "--exclude-standard", "-z").split("\0").filter(Boolean).sort()) {
+      if (name.startsWith(".athena/evidence/")) continue;
+      hash.update(name).update(fs8.readFileSync(path8.join(cwd, name)));
+    }
+    return hash.digest("hex");
+  } catch {
+    throw new BuildUsageError("Evidence must be recorded in a git worktree.");
+  }
+}
 
 // src/core/build/merged.ts
 import fs9 from "fs";
@@ -14812,21 +15015,89 @@ function runBuildMerged(input) {
   return parsed.data;
 }
 
+// src/core/build/check.ts
+import { spawnSync } from "child_process";
+import fs10 from "fs";
+import path10 from "path";
+var checkRecordSchema = external_exports.strictObject({
+  name: external_exports.string().trim().min(1).max(64),
+  outcome: external_exports.enum(["passed", "failed"])
+});
+var NAME_PATTERN = /^[^\p{Cc}]+$/u;
+var MAX_RECORDS = 50;
+function spawnCheck(command, cwd, onOutput) {
+  const [program, ...args] = command;
+  const result = spawnSync(program, args, {
+    cwd,
+    stdio: onOutput ? ["inherit", "pipe", "inherit"] : "inherit",
+    maxBuffer: 64 * 1024 * 1024
+  });
+  if (onOutput) onOutput(result.stdout);
+  if (result.error) return 127;
+  return result.status ?? 1;
+}
+function readRecords(file) {
+  try {
+    const parsed = external_exports.array(checkRecordSchema).safeParse(JSON.parse(fs10.readFileSync(file, "utf8")));
+    return parsed.success ? parsed.data : [];
+  } catch {
+    return [];
+  }
+}
+function runBuildCheck(input) {
+  const directory = requireEnv(input.env, "DRISP_RUN_ARTIFACTS");
+  const name = (input.name ?? "").trim();
+  if (!name || name.length > 64 || !NAME_PATTERN.test(name))
+    throw new BuildUsageError(
+      "A check needs a name of 1 to 64 characters on one line."
+    );
+  if (input.command.length === 0 || input.command.some((token) => !token))
+    throw new BuildUsageError("A check needs a command after `--`.");
+  if (!fs10.statSync(directory, { throwIfNoEntry: false })?.isDirectory())
+    throw new BuildUsageError(
+      `DRISP_RUN_ARTIFACTS (${directory}) is not a directory.`
+    );
+  const code = input.run(input.command, input.cwd);
+  const file = path10.join(directory, "checks.json");
+  const record = { name, outcome: code === 0 ? "passed" : "failed" };
+  const records = readRecords(file);
+  const at = records.findIndex((existing) => existing.name === name);
+  if (at >= 0) records[at] = record;
+  else records.push(record);
+  const temporary = `${file}.${process.pid}.tmp`;
+  fs10.writeFileSync(
+    temporary,
+    `${JSON.stringify(records.slice(-MAX_RECORDS))}
+`
+  );
+  fs10.renameSync(temporary, file);
+  return code;
+}
+
 // src/app/entry/buildCommand.ts
 var USAGE3 = `Usage: drisp build plan --input <path>
        drisp build tick --input <path> [--rebase-failed <IDENTIFIER>]...
        drisp build checks
-       drisp build step <n> [--qa none|web|macos]
+       drisp build step <n> [--qa none|web|macos|both] [--profile implementation|documentation|investigation]
+       [--test-first true|false] [--review true|false] [--merge agent|you] [--sign-off <sha>]
+       [--complete --evidence <file>] [--verify]
        drisp build merged [<pr url or number>]
+       drisp build check <name> -- <command>
 plan and tick run inside an Orchestrator Run (DRISP_RUN_ID, DRISP_RUNNER_ID and DRISP_RUN_ARTIFACTS set; tick also
 DRISP_RUN_TOKEN and DRISP_HUB_URL). DRISP_BUILD_PLAN_INPUT=<path> stands in for plan's --input, with
 fills/<IDENTIFIER>.json beside it. checks runs in a child's worktree: the merge gate's verdict on HEAD's GitHub runs.
 step runs in any Run with DRISP_RUN_ARTIFACTS set: it writes the step artifact {index, title, total} for gate <n> of the
-build-child template (QA is a gate unless --qa none) and refuses an index outside the list.
+selected build-child profile (QA is a gate unless --qa none) and refuses an index outside the list.
+--complete --evidence <file> records an agent attestation bound to the source revision; --verify requires fresh
+receipts for all preceding steps. Keep evidence files under .athena/evidence/. With --merge you, the Merge step's
+--verify also needs the member's Sign-off on HEAD (--complete one at all), which --sign-off <sha> records for that full
+SHA only.
 merged runs in a child's worktree after its pull request merged: it writes the pull_request artifact
-{url, number, sha, mergedAt} and refuses a pull request that is not merged.`;
+{url, number, sha, mergedAt} and refuses a pull request that is not merged.
+check runs <command>, passes its output through, exits with its code and records {name, outcome} in the checks run artifact
+(DRISP_RUN_ARTIFACTS set); it refuses a missing name or command before running anything.`;
 function githubPullRequests(folder, branch) {
-  const output = execFileSync(
+  const output = execFileSync2(
     "gh",
     [
       "pr",
@@ -14865,7 +15136,7 @@ function hostCapabilities(folder) {
 }
 var defaultChecks = {
   head: (cwd) => git(cwd, ["rev-parse", "HEAD"]),
-  gh: (args, cwd) => execFileSync("gh", args, {
+  gh: (args, cwd) => execFileSync2("gh", args, {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -14942,6 +15213,16 @@ async function runBuildCommand(input) {
       case "checks":
         output = runBuildChecks(input.cwd, input.checks ?? defaultChecks);
         break;
+      case "check": {
+        const code = runBuildCheck({
+          env: env2,
+          cwd: input.cwd,
+          name: input.positional?.[0],
+          command: input.command ?? [],
+          run: input.checkRunner ?? spawnCheck
+        });
+        return code;
+      }
       case "merged":
         output = runBuildMerged({
           env: env2,
@@ -14954,6 +15235,15 @@ async function runBuildCommand(input) {
         output = runBuildStep({
           env: env2,
           n: input.positional?.[0],
+          cwd: input.cwd,
+          profile: input.flags.profile,
+          testFirst: input.flags.testFirst,
+          review: input.flags.review,
+          merge: input.flags.merge,
+          signOff: input.flags.signOff,
+          complete: input.flags.complete,
+          verify: input.flags.verify,
+          evidence: input.flags.evidence,
           ...input.flags.qa ? { qa: input.flags.qa } : {}
         });
         break;
@@ -14978,10 +15268,10 @@ ${USAGE3}
 import process7 from "process";
 
 // src/harnesses/claude/system/doctorEnvironment.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import * as fs10 from "fs";
+import { execFileSync as execFileSync3 } from "child_process";
+import * as fs11 from "fs";
 import * as os4 from "os";
-import * as path10 from "path";
+import * as path11 from "path";
 var MANAGED_POLICY_KEYS = [
   "forceLoginMethod",
   "forceLoginOrgUUID",
@@ -15056,7 +15346,7 @@ function readEnforcement(scopes) {
 }
 function tryRichAuth(claudeBinary) {
   try {
-    const output = execFileSync2(claudeBinary, ["auth", "status"], {
+    const output = execFileSync3(claudeBinary, ["auth", "status"], {
       timeout: 1e4,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -15085,8 +15375,8 @@ function collectEnvironment(options = {}) {
   const detectVersion = options.detectClaudeVersionFn ?? detectClaudeVersion;
   const runAuthStatus = options.runClaudeAuthStatusFn ?? runClaudeAuthStatus;
   const resolveForwarder = options.resolveHookForwarderCommandFn ?? resolveHookForwarderCommand;
-  const statFn = options.statFn ?? ((p) => fs10.statSync(p));
-  const readFileFn = options.readFileFn ?? ((p) => fs10.readFileSync(p, "utf8"));
+  const statFn = options.statFn ?? ((p) => fs11.statSync(p));
+  const readFileFn = options.readFileFn ?? ((p) => fs11.readFileSync(p, "utf8"));
   const settingsPaths = resolveClaudeSettingsSurfacePaths(
     homeDir,
     cwd,
@@ -15131,7 +15421,7 @@ function collectEnvironment(options = {}) {
   });
   let globalConfigPresent = false;
   try {
-    statFn(path10.join(homeDir, ".claude.json"));
+    statFn(path11.join(homeDir, ".claude.json"));
     globalConfigPresent = true;
   } catch {
     globalConfigPresent = false;
@@ -15611,13 +15901,13 @@ function runRunsCommand(input) {
 // src/app/entry/cli.tsx
 import { jsx as jsx24 } from "react/jsx-runtime";
 function resolvePackageJsonPath(entryUrl) {
-  let currentDir = path11.dirname(fileURLToPath(entryUrl));
+  let currentDir = path12.dirname(fileURLToPath(entryUrl));
   for (; ; ) {
-    const candidatePath = path11.join(currentDir, "package.json");
-    if (fs11.existsSync(candidatePath)) {
+    const candidatePath = path12.join(currentDir, "package.json");
+    if (fs12.existsSync(candidatePath)) {
       return candidatePath;
     }
-    const parentDir = path11.dirname(currentDir);
+    const parentDir = path12.dirname(currentDir);
     if (parentDir === currentDir) {
       throw new Error("Could not locate package.json for CLI metadata.");
     }
@@ -15789,7 +16079,8 @@ var cli = meow(
 			build plan --input <path>  Plan a Build inside an Orchestrator Run (prints one JSON object)
 			build tick --input <path>  Run one step of a started Build (prints the next action; [--rebase-failed <ID>]...)
 			build checks               The merge gate's verdict on HEAD's GitHub runs (in a child's worktree)
-			build step <n>             Report the Run's current step: writes the step run artifact ([--qa none|web|macos])
+			build step <n>             Report the Run's current step: writes the step run artifact ([--qa none|web|macos|both], --profile, --merge you, --sign-off <sha>, --complete --evidence, --verify)
+			build check <name> -- <cmd> Run a command and record its outcome: writes the checks run artifact
 			build merged               Record the merged pull request: writes the pull_request run artifact
 			telemetry [action]    Manage anonymous telemetry (enable/disable/status)
 			doctor                Diagnose Claude headless setup (use with --harness=claude)
@@ -15928,6 +16219,14 @@ var cli = meow(
         type: "string",
         isMultiple: true
       },
+      profile: { type: "string" },
+      testFirst: { type: "string" },
+      review: { type: "string" },
+      merge: { type: "string" },
+      signOff: { type: "string" },
+      complete: { type: "boolean" },
+      verify: { type: "boolean" },
+      evidence: { type: "string" },
       qa: {
         type: "string"
       },
@@ -15970,7 +16269,7 @@ var cli = meow(
   }
 );
 async function main() {
-  const projectDir = path11.resolve(cli.flags.projectDir);
+  const projectDir = path12.resolve(cli.flags.projectDir);
   const [command, ...commandArgs] = cli.input;
   const isRunCommand = command === "run" || command === "exec";
   if (command && !KNOWN_COMMANDS.has(command)) {
@@ -16024,7 +16323,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         await exitWith(1);
         return;
       }
-      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-YANLNMTP.js");
+      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-IOJD3YOA.js");
       const { waitUntilExit } = render(
         /* @__PURE__ */ jsx24(
           WorkflowInstallWizard,
@@ -16103,13 +16402,26 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
     return;
   }
   if (command === "build") {
-    const [subcommand = "", ...buildArgs] = commandArgs;
+    const rawArgs = process.argv.slice(2);
+    const dashIdx = rawArgs.indexOf("--");
+    const checkTokens = dashIdx >= 0 ? rawArgs.slice(dashIdx + 1) : [];
+    const cleanArgs = checkTokens.length > 0 ? commandArgs.slice(0, commandArgs.length - checkTokens.length) : commandArgs;
+    const [subcommand = "", ...buildArgs] = cleanArgs;
     await exitWith(
       await runBuildCommand({
         subcommand,
         positional: buildArgs,
+        command: checkTokens,
         flags: {
           ...typeof cli.flags.qa === "string" ? { qa: cli.flags.qa } : {},
+          profile: cli.flags.profile,
+          testFirst: cli.flags.testFirst,
+          review: cli.flags.review,
+          merge: cli.flags.merge,
+          signOff: cli.flags.signOff,
+          complete: cli.flags.complete,
+          verify: cli.flags.verify,
+          evidence: cli.flags.evidence,
           ...typeof cli.flags.input === "string" ? { input: cli.flags.input } : {},
           ...cli.flags.rebaseFailed?.length ? { rebaseFailed: cli.flags.rebaseFailed } : {}
         },
@@ -16191,8 +16503,8 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
   const showSetup = isRunCommand ? false : shouldShowSetup({
     cliInput: cli.input,
     setupComplete: globalConfig.setupComplete,
-    globalConfigExists: fs11.existsSync(
-      path11.join(os5.homedir(), ".config", "athena", "config.json")
+    globalConfigExists: fs12.existsSync(
+      path12.join(os5.homedir(), ".config", "athena", "config.json")
     )
   });
   let runtimeConfig;