v0.18.0

Migration

Upgrading from 0.17.x, two breaking changes need one-time action:

• Extras surface. If any script, cron, or habit runs release, center, repos, research, roadmap, friction, chat, context, projects, learn, runbook, dogfood, pantry, notifications, budgets, untrusted, either fragments group, or work phases, run brigade extras on once per machine before upgrading (or export BRIGADE_EXTRAS=1 in that environment). Disabled commands exit 2 with this guidance rather than failing silently.
• Minimal repo installs. brigade init and operator quickstart at repo depth now write only AGENTS.md and SAFETY_RULES.md plus gitignored state. If your setup expects rules/, hooks/pre-push, INSTALL_FOR_AGENTS.md, or the default tool packs, pass --full (or add the repo-extras include). Existing repos are untouched by the upgrade itself; re-running quickstart on an existing repo only adds missing files and never overwrites.

Docs

• README opening reframed: the one-liner now leads with the per-tool config and memory sprawl instead of abstract nouns, "What it does" defines a receipt as the file it is, and a sample verify-receipt ticket shows one. The receipts wording elsewhere in the opening was trimmed so the word appears where it is the feature, not as a refrain.

Added

• brigade run artifacts now carry brigade-computed ground truth (issue #125): worker-results.json and synthesis.json include a ground_truth block with git diff --stat, the changed and untracked file lists, a changes.patch reference, and verify exit codes parsed from the actual .brigade/work/verify-runs receipts. The synthesis prompt gets a compact brigade-computed facts section, so the chef synthesizes against facts instead of worker narration.
• brigade run now attaches a fail-open GraphTrail code-graph brief when .graphtrail/graphtrail.db exists. The read-only markdown context is prepended to orchestration and worker prompts, can be disabled with --no-code-graph, and records code_graph_brief metadata in run.json.

Changed

• brigade work phases (the phase-execution ledger) moved behind the extras wall with the other operator-suite surface; it stubs out with enable guidance when extras are disabled.
• The shared render.emit renderer now backs the mechanical output sites in tools_cmd, daily_cmd, center_cmd, and phases_cmd (110 sites converted, byte-identical output); sites with interleaved logic or stderr remain on direct prints.

Breaking

• The CLI surface is now split into core and extras. 18 operator-suite command groups (release, center, repos, research, roadmap, friction, chat, context, projects, learn, runbook, dogfood, pantry, notifications, budgets, untrusted, openclaw-fragments, hermes-fragments) register only when extras are enabled. Enable once with brigade extras on, per invocation with BRIGADE_EXTRAS=1, and check with brigade extras status. A disabled extras command exits 2 with that guidance instead of a parse error. The 24 core groups (init, mcp, tools, skills, handoff, ingest, memory, work, outcome, operator, run, roster, runs, daily, security, scrub, doctor, status, add, stations, profiles, reconfigure, completions, extras) are unchanged.
• Repo-depth installs default to a minimal footprint: AGENTS.md and SAFETY_RULES.md plus gitignored .brigade/ state and the selected harness inboxes and skills. The full kit (rules/, the inactive hooks/pre-push, INSTALL_FOR_AGENTS.md, and the four default tool packs projected into tools/ and scripts/) moved behind --full on brigade init and operator quickstart, or the repo-extras include. Workspace-depth installs are unchanged and always get the full kitchen.

Fixed

• doctor's memory-card budget check now honors .brigade/memory-care.toml (max_card_bytes and exclude_paths), matching brigade memory care. It previously used a hardcoded 8000-byte limit and scanned excluded directories (e.g. archive/, decay/), so the two subsystems disagreed. The default card budget is now 12000 (single-sourced in budgets.MEMORY_CARD_BUDGET_BYTES), reconciling the prior 8000-vs-12000 default mismatch.
• brigade run --worktree could write a corrupt changes.patch: trailing-whitespace trimming dropped a diff's final blank context line, and git apply rejected the file (issue #124). Patches are now written byte-faithful, validated with git apply --check --reverse before the run is declared done, and a failed validation keeps the worktree as the recoverable copy and exits nonzero.
• Repo-depth installs no longer point agents at files that do not exist: the generated AGENTS.md, CLAUDE.md, and INSTALL_FOR_AGENTS.md referenced SOUL.md, USER.md, MEMORY.md, and memory/cards/, none of which a repo-depth install creates. Repo depth now gets repo-scoped variants; manifest file entries accept an optional depth key for per-depth template selection.
• brigade mcp sync no longer grows a .vscode/ directory unasked. VS Code is included only when the repo already has .vscode/; the skip is reported in the plan notes and --harness vscode still forces it.
• An empty tool catalog (.brigade/tools.toml with no [[tool]] entries) is now valid, and default tools that were never projected no longer block operator doctor readiness. Once tracked sources exist under tools/, a missing projection blocks again as drift.

Added

• brigade operator quickstart --dry-run prints the file-by-file plan the README always promised: each planned step lists its dir and file writes, including the operator-init artifacts and the MCP catalog path.
• brigade extras on|off|status manages the extras surface via a user-level marker under $XDG_CONFIG_HOME/brigade/extras.

Documentation

• README: the sample doctor output now matches a fresh install (content-guard reported missing until brigade add guard), and the no-background-process claim names its one scoped exception (brigade tools runtime start).