verify-brigade

Verify Brigade

Brigade has no server and no UI. The surface a user touches is the brigade CLI, and the only honest way to prove a change is to run that CLI against a target and read what it wrote. This skill drives it through one helper, control-brigade.py, so a proof is a rerunnable command instead of a story.

Every drive happens in a temp target this skill creates. The helper enforces that: --target is accepted only when it resolves under <state-root>/targets, so the operator home, the Brigade checkout, and every other path are refused before a command runs. The state root gets the same treatment whether it comes from --root or from the default - resolved, refused if it resolves to or contains the home directory or the checkout, and refused if it is a symlink at the root or at targets//captures/, so a link planted in a world-writable temp dir cannot redirect a drive. cleanup removes only paths new-target recorded. AGENTS.md forbids driving the real workspace anyway; here it is not reachable.

What that paragraph does not claim:

• A path under the temp base is allowed even when $TMPDIR sits inside the home directory. That is the only carve-out, and it is exactly that narrow: the home and checkout refusals run first, so the allowance applies only when the temp base itself resolves inside the home directory and outside the checkout. A $TMPDIR inside the checkout is still refused, and a relative $TMPDIR is refused outright rather than resolved against the working directory. The temp base itself is refused - a state root there would chmod the shared scratch tree to 0700.
• The default evidence root is <checkout>/.brigade/verification-evidence, which is inside the checkout. That is the one deliberate exception: it is gitignored, and it sits outside the state root on purpose so cleanup cannot reach the proof. The default and --evidence-root are both guarded like --root, symlink check included: a link planted at either is refused, not followed. --label names the directory under that root, so it must be a simple [A-Za-z0-9._-] name of 1-64 characters - no separators, no ...
• grokbot-feed --manifest is the one flag outside the target contract. It is a caller-supplied path, read for validation only and never written, so an operator can validate a real private feed manifest from wherever it lives. Everything the drive writes still lands in the target or the state root.