Rules now require that a baseline claim ("pre-existing on HEAD") names its tree and runs with explicit paths; a new check is classified as behaviour (pytest) or bookkeeping (pre-commit hook); mutation checks run on a copy outside the repository; an option that widens a grant is read before it is marked recommended; commit messages name behaviour in plain words, never a skill's internal step label; reviewer briefs that run adversarial shell cases require case files written with a file-editing tool and fake gh/git binaries.
write-guard.js no longer asks before writing a protected file that git already tracks (CLAUDE.md, AGENTS.md, CHANGELOG.md, .github/**, pyproject.toml and the rest): every such write is diffable and revertible, and the hook's ask could not be remembered, so each edit prompted again. Untracked, new and gitignored protected files, such as .claude/settings.local.json, still ask, and .claude/settings*.json and .pre-commit-config.yaml always ask because they take effect before any diff review.
The global self-improvement loop folds a correction into the project-owned rule, skill or agent file that governs it instead of a lessons file; .notes/lessons.md stays a legacy input of /foundry:distill.
Select fixed context-composition fixture sessions explicitly so rendering tests remain valid after the checkout ages beyond the default 24-hour usage window.
Recognize literal dictionary-key version assignments in continuity checks, preserving existing schema baselines while rejecting skipped versions.
Keep review coverage and confidence gaps as factual limitations; require a specific user decision for additional review and omit declined requests from findings and final actions.
Make the git-approve, git-push and gh-write questions readable: the first line states the ask (commit, push or write target), one blank line follows, then short fact lines; what each answer does moves into the one-line option descriptions instead of repeating in the question body. The Approve always description names what the grant never covers (push, force, history rewrite, discarding work, deleting unique history, auth changes). The git-push and gh-writeApprove descriptions keep the token terms (15-minute validity; gh-write also re-hashes the files the command reads). Branch, command span and grant-file requirements for the approval hook are unchanged.
Cross-validation protocol: state that aggregate readiness: complete requires every assessment readiness: complete and an empty open_concerns; one blocked or incomplete assessment makes the aggregate blocked or incomplete, and a missing required role or a null candidate makes it incomplete, overriding blocked, also under a null aggregate outcome. Resolver intake already enforced this; the protocol now says it.
State the adversarial-loop progress table in the always-loaded quality-gates rule: after each validated round, print exactly the Iteration | Critical | High | Medium | Low | Nits | Weighted score table with all rows kept and each cell as old + new. The format lived only in the lazily read full rule, and a live loop report replaced it with a reduced table.
Add a no-restating rule to the question-text guidance: a question never repeats rows, items or findings that the last printed text already shows or that its own options carry.
Clarify the version-one review publication in the cross-validation protocol: string-array evidence and limits, open concerns only for UNVERIFIED or pending candidates, no complete readiness beside an open candidate.
Show reviewer roles without execution provenance and render ratings in square brackets, keeping provenance in evidence and limits. Update the shared protocol and Foundry README to match.
Register Develop’s historical index-directory configuration note as documentation so the Codemap guard check accepts the changelog while retaining executable guard checks.
Add a boundary gate that checks calls-ahead and current context against estimated rebuild cost, verifies the owned skill-contract digest, attempts to log each decision, and prints the contract only when compaction is warranted.
Add Claude and Codex context-composition reports, including usage deduplication and compaction detection; harden transcript parsing and token bounds in the cost analyzer.
Extend skill-contract metadata with validated gate parameters and a session-scoped ownership stamp; save verified contracts at PreCompact and restore them after compaction.
Adopt explicit compaction boundaries in phased workflows, with a safe continuation fallback when Foundry is unavailable and phase-specific preservation of reports and state.
Build edited-file context from session timings, including MultiEdit and NotebookEdit, instead of relying on a truncated transcript tail.
Require follow-up questions to name the report path and key outcome fields within the text budget; move concise plans and decision context into question text while retaining full report headers for final replies.
Clarify compaction authority, question formatting, and approval scope in Foundry rules and CLAUDE.src.md.
Require parent validation of review candidates at every severity before publishing actionable findings, retaining the source revision, contract, trigger, checks, counterevidence, environment, limits, and disposition.
Separate source judgment from verification readiness; distinguish confirmed, refuted, already-fixed, optional, unfinished, and unavailable concerns, and preserve unresolved obligations with an owner and closure condition.
Version the review ratings and finding records while preserving historical meanings and archive readers; reject incompatible current consumers and partial contract downgrades.
Carry validation identity and retained evidence through report merging, dispatch, remediation, and late-wave checks; reuse proof only while it still applies, and keep a rejected repair separate from refuting the underlying defect.
Align Foundry shared protocols and README guidance with the cross-plugin review contract.
Guard gh writes with gh-write-guard.js: exact writes require a user-approved single-use grant, and force updates remain denied even with a grant.
Add approval provenance through approval-guard.js and grant records: standing approval applies only to plain local commits; pushes and GitHub writes consume one-use grants, with self-grant attempts rejected.
Generalize the shell Git lexer for Bash and Zsh invocation differences, and use it when checking commit-guard push commands.
Add an optional GitHub-read lane to allow dispatch and allow audit verification to accept two- or three-lane verdicts.
Show report headers, plans, findings, trees, and queues once as option previews, moving oversized output to a named file and unknown-flag or blocker prompts into the question text.
Make foundry:sw-engineer spawns choose worktree isolation at the call site; update distill execution clusters to transplant each worktree patch and keep management scaffolds in the caller's tree.
Add rule-inject.js to load spawn and commit rules lazily after the first matching tool call, including failed calls and compacted sessions.
Deny git push --force-if-includes and git push --mirror as explicit backstops, and update Foundry's commit permission guidance.
Resolve the current Haiku model at runtime with a 24-hour cache and fallback; disable thinking, raise its token allowance, and report resolver failures instead of treating them as an empty result.
Put compact and repeated-failure guidance in the actual follow-up question, and update the model-window and cache-write guidance.
Ground completion claims in cited source evidence and a representative real case; retain the real-case check through investigation, implementation, and verification.
Wait briefly for transcript flush before rejecting a just-printed report header; explain visible-text failures and permit one identical follow-up retry without printing the table again.
Make audit and profile delivery hooks check the current report at both the follow-up question and turn end; keep diagnostic and recovery questions available when delivery evidence is missing.
Standardize confidence gaps as per-gap deductions that sum to the reported shortfall, including in calibration prompts and report templates.
Add POSIX and native-Windows python launchers that select an eligible Python 3.10+ runtime, preserve workload arguments and exit status, and leave a real python earlier on PATH in control.
Add a SessionStart rule check that detects missing setup-created foundry-<name>.md links, names the rule files to load, and injects the commit rule so an incomplete setup does not silently omit commit policy.
Route registered hooks through Node.js from PATH or supported fixed locations, then exit cleanly when no Node runtime is available.
Require co-author trailers to replace host-default attribution, with Codex attribution when Codex shaped the work and Claude attribution when Claude shaped the diff.
Continue independent review-and-fix cycles while the same-scope nonnegative integer score strictly decreases; stop on a plateau, increase, lost authority, or exhausted caller budget, with no arbitrary three-review cap.
Clarify evidence and contract handling in Foundry quality gates and the audit workflow, and make the strict-decrease rule visible in the quality-gate example.
Make audit and calibration histories append-only through append_ledger.py: stage audit findings in .rec files and append calibration's per-target result files with --from, preserving prior history and avoiding duplicate legacy migration.
Run isolation-motivated agent spawns regardless of task size, while retaining the ordinary budget rules for other spawns.
Replace agent-wait polling with per-agent deadlines armed at spawn and checked on each wake; mark a missed deadline or notification without output timed out immediately.
Warn at SessionStart when the loaded Foundry plugin root is marked orphaned or differs from the installed path, and tell the user to restart without blocking the session.
At SessionEnd, sweep only registered idle agent-* and oss-* worktrees; retain dirty trees, ignored run output, other prefixes, and orphan directories.
Shorten report template fields while keeping authoring guidance outside the completed report.
Add a Foundry notebook-authoring rule covering notebook narrative, cell boundaries, plotting, and shell usage; propagate the canonical shared style to the plugin.
Persist shared quality-stack variables across Bash blocks so batch mode and shell-variable checks use the intended values.
Probe xdist for wide runs while keeping diagnostic retries serial; check collection before folding doctests into pytest, classify doctest assertion failures as genuine, quote failed node IDs through eval, and explicitly report the degraded unmerged doctest path.
Split oversized Foundry bin helpers into smaller functions with maintainer-facing main() docstrings, improving navigation without changing their command contracts.
Strengthen producer-to-consumer evidence checks and validate host-manifest agreement and changed shipped version or schema continuity against committed HEAD; reject skipped or downgraded values, removed tracked manifests, and ambiguous unsupported selections.
Set model-specific spawn ceilings and use them to batch Foundry audit and adversarial waves.
Harden Foundry path utilities against destination overwrite, command injection, and traversal; bound file sizes and make hook-registry matching literal rather than regex-based.
Bound independent review to three rounds including baseline, show the cumulative table once after each validated round, and require a parent action record for every unresolved finding.
Show the full cumulative old/new findings table after each validated review round, preserving previous rows and excluding verified-fixed and rejected findings.
Tighten Foundry's Codemap consumer contract: reuse only matching fresh answers, check query completeness, cap supplementary queries, and keep direct source reads available when Codemap is absent or incomplete.
Add the short and detailed native-question guides to Foundry's propagation manifest so independently installed Codex-facing plugins can ship synchronized copies.
Gate audit and profile follow-ups on saved report evidence and current-turn delivery of the required summary or matching header table; keep diagnostic and recovery questions available.
Resolve the active Codemap provider's shared gates and context at runtime instead of shipping stale copies; degrade to Foundry's fallback when the optional provider is absent.
Set a 15-second timeout on SessionEnd task-log and audit-close hooks.
Update SessionEnd retention for PR-scoped numbered OSS review runs: expire individual runs after thirty days and remove empty PR parents while retaining legacy flat-run handling.
Extend Foundry audit and adversarial guidance to check producer-consumer handoffs and ordinary user actions, keeping evidence and authority gates active across the whole route.
Require each agent task to begin with a distinct delta-first name, description, and task-leading line; check duplicate slots and follow the live tool fields rather than stale examples.
Replace Foundry skill flag parsing based on Bash-only regex capture and ad hoc text matching with shared argument parsers that work under Zsh as well as Bash.
Add severity-weighted independent review and remediation loops with an original default cap of three iterations. Use score ratios to continue or stop; stop on structural findings or repeated failure signatures, and block completion or commits while security or critical findings remain open.
Replace synchronous or polling assumptions with background-spawn, end-turn, and completion-notification handling; preserve missing-output timeout reporting, update audit checks for the background contract.
Extract repeated Foundry skill shell blocks into Python helpers while leaving judgment steps, agent prompts, and output templates in the skills.
Fix install-state detection for Claude's nested installed-plugin registry shape, and let investigation contracts record tried and probed candidates for safe post-compaction resume.
Unify auto-allow decisions under ranked provenance and shape dispatch; append decision and completion audit records, and add canonical record hashing with verify/prune commands. Logs are not tamper-evident. Verification exits 1 for record-hash mismatch, while framing and schema findings remain warnings; unusable inputs exit 2.
Use ASCII status labels for success, no-op propagation, and orphan warnings so Foundry CLI output works on legacy Windows consoles.
Expand maintainer-facing contracts and executable examples for Foundry Python helpers, including bridge checks, resolver-site classification, cost analysis, and timing analysis.
Add severity/fix requirements and precision discipline across foundry agents (challenger, creator, curator, doc-scribe, solution-architect, sw-engineer, web-explorer) so every finding states severity, cites a named criterion, and speculative items are labelled rather than dropped
debugging.md (+_full): forbid dispatching foundry:challenger as subagent_type fork; challenger gets diff+symptom+spec only, no implementer reasoning trail
Stop after the same failure signature twice rather than exhausting the iteration cap; keep approved plans read-only during implementation unless the user explicitly authorizes revision.
Define spawn discipline in Foundry configuration: use work-displacement spawns only when expected work exceeds their overhead, while preserving isolation-motivated review and role spawns.
Propagate Foundry-owned quality-stack and cross-validation guidance into consumer plugins as namespaced files, with shared-file checks preventing drift.
Replace Foundry's legacy Codex rescue integration with explicit bridge implement, advise, and review calls, including unavailable and disabled behavior.
Resolve the active plugin registry's nested structure, distribute Foundry's availability detector to each independent consumer, and add an audit utility that compares local Bash transcripts with installed blueprint manifests.
Document Foundry's consumer-owned skills/_shared/codemap-context.md as the host for the v2 integration body, retaining v1 sentinels and read-only integration audit. It ships without a managed block until integration applies it.
Close sentinel-read auto-allow bypasses by rejecting unsafe shell functions, traversal, write redirection, and loader or lookup assignments; retain only validated read forms.
Add heal_git_artifacts.py to safely recover stale skill locks and orphaned Git worktrees, and propagate its canonical Foundry implementation through the shared-file manifest.
Anchor Foundry Codemap context and query paths at the repository root, and provide canonical consumer guidance plus audit checks for declared provider routes and CLI flags.
foundry:session becomes one inline skill with six modes — dump, recall, list, park, sweep, drop; park/sweep/drop are new, replacing the behavioural parking rule that only ever loaded on invocation and so never fired
hooks/carryover-restore.js renamed session-restore.js; store path, injection banner and the oversized-doc pointer now read /foundry:session recall <slug>; hooks.json SessionStart command updated
rules/compaction.md manual-sibling note, rules/foundry-config.md log table, and distill's slug-divergence guard no longer name removed skills or logs; calibrate/modes/skills.md had the same skill listed twice, bare and plugin-prefixed — the bare row is gone
README rows, mode listings, hook description, skill-directory count and test table synced in both plugins/cc_foundry/README.md and .claude/README.md; version 0.45.0 to 0.46.0
Compress duplicated bin-authoring gate wording across Foundry manage spawn prompts.
Replace the estimated compaction break-even with measured session observations.
Convert two Foundry audit/calibrate loader sites to the appropriate resolver calls; require Python variable documentation in #: comments where a docstring cannot bind.
Add an agent-budget note to Foundry spawn sites: account for fixed spawn overhead, avoid work-displacement spawns below break-even, and require partial results when an agent exhausts its call budget.
Extract Foundry's shared-document and mode loaders into Python bin helpers, replacing repeated resolve-then-cat blocks in skill bodies.
Bound supplementary Codemap queries to three and stop enumeration after a complete result while preserving required source reads; budget spawns and require honest partial-output envelopes.
Move subagent-type telemetry evidence and a worked failure example into rules/_full/CLAUDE-full.md, leaving the mandatory rule in the always-loaded stub.
Require evidence before factual claims and explicit disclosure when verification is unavailable; move worked rule detail to on-demand _full files while retaining mandatory stubs.
Move agent supplemental references into references/; re-key agent records so SubagentStop removes them, use separate worktree and non-worktree age limits, and strengthen audit Bash-correctness and efficiency checks.
Install Foundry rules under namespaced foundry-<name>.md links and migrate legacy links during setup.
Adopt a destination only when its target resolves within this Foundry install or its matching marketplace lineage; preserve links into other plugins, checkouts, or dotfiles as conflicts.
Give each plugin its own shared-file resolver and remove Foundry-path reach-ins from consumer workflows, so installed siblings can operate independently.
Add an orphaned-plugin-cache cleanup helper that reports by default and supports guarded explicit apply. Setup passes the displayed candidate count and aborts cleanup if that count changes.
foundry:audit — enforce-audit-header.js; also adds the report.md Write step Step 11 was missing entirely (Path: field pointed at a file nothing ever created); gates on summary.jsonl instead of report.md since report.md is written after the gate fires
foundry:profile — enforce-profile-header.js; parses REPORT_DIR out of the Step 1 KEY=VALUE state file
Add a Bash pre-tool hook that auto-allows only validated read-only sentinel and timestamp command substitutions; unsafe shell forms continue through normal permission checks.
Document the safe sentinel-read form and scope it to the active session and temporary directory.
Scope temporary sentinels to the current Claude session to prevent collisions across sessions and projects; move skill contracts and logs to their intended writable locations.
Replace emoji confidence bars with distinct plain fit and conf scores, add runtime-state write/delete permissions, and put unique task labels before spawn boilerplate.
Update the Foundry README rule table to match the confidence display.
fixes headless block: sync.sh runs claude --print /foundry:setup --approve, where a Write-tool permission prompt on ~/.claude/settings.json cannot be approved and hangs; in-bash writeback needs no tool prompt
Require code-touching agents to check declared dependency APIs before adding utilities and verify public symbols from the installed library rather than relying on memory.
Restrict the hook to push approval: force-push remains blocked, regular push needs a user-armed one-use token, and commits use the prompt authorization rule.
foundry: calibrate now confirms via AskUserQuestion before large fan-outs — mode-category scopes (all/agents/skills/plugins) always confirm since exact spawn count isn't knowable until Step 2; narrow scopes confirm past a 50-spawn threshold; --apply alone no longer bypasses this gate, only --skip-gate does
foundry: extract audit SKILL.md Steps 4/5/5b/7 into modes/steps-4-5-7.md (52KB to 37.8KB force-loaded on every invocation)
foundry: extract sw-engineer.md packaging/API-stability guidance into packaging-patterns.md, mirroring the existing hook-authoring.md pattern
Add explicit compaction checkpoints and preserve contracts to Foundry's phased workflows, with per-skill checkpoint data, optional keep-items, and cleanup on completion.
Layer 2 (judgment by domain): audit Step 3 now groups all of a plugin's files into one holistic foundry:curator for plugin scope, so cross-file breaks (tool-grant mismatch, contract splits, dead dispatch) that per-file batching misses get caught.
manage: /foundry:calibrate mandatory only on routing-surface (description/trigger) changes, not every content edit
Remove Foundry's redundant preflight-helper load, prune repeated deterministic curator checks and unused color metadata, and correct README and hook paths.
Add state.py set, load, and clear namespaces to persist small shell values across independent Bash calls.
Replace RTK command-prefix allowlisting with positive read-only checks for guarded commands; compound shell commands and unproven commands now pass to the normal permission matcher.
Add GitHub API mutation deny entries as defense in depth.
Use the most common case as the default shape for test-data factories, prefer plain functions for pure factory data, and flag newly duplicated code blocks across files.
Rename distill lessons mode to memory; process all projects by default, support an interactive project picker, and parallelize multi-project analysis and curator writes.
Centralize validated installed-root resolution, retain background agent tracking after dispatch, and introduce health-sentinel boilerplate plus an audit fix hierarchy.
Extract brainstorm breakdown into a mode file and include required descriptions when the agent router rewrites rerouted tool input.
foundry curator + audit: curator.md step 7 in §Code Block Authoring adds bash compression as P3 flag — multi-line if/fi with single body → &&/|| one-liner, _rc capture only when format string contains %d, ;-joined sequential single-assignment lines, WHY-only comment rule; audit/SKILL.md adds verbose-bash-block to PARALLEL_SAFE_CATEGORIES so compression fixes can run in parallel without cross-file reads
Add source-grounding rules to Foundry agent cards: verify behavioral claims against source or tests instead of memory or inference.
Register Codemap blast-radius calibration and identify it as the calibratable subtask of development workflows.
Print report YAML metadata first and exempt it from decorative boxes; offer a challenger review after substantive manage changes, with explicit trivial-edit and mode exemptions.
foundry/skills/brainstorm/SKILL.md — AQQ ≤4 cap compliance: branch selection via free-text reply, tree ops as category-picker with follow-up AQQ per category
plugins/CLAUDE.md — markdown annotation rule: > for prose comments in plugin .md files; # only inside code fences
Require both an architectural and a visual-domain signal before applying the CV/ML documentation checklist, and make architecture discovery language aware.
Persist brainstorm viewer state across Bash calls and prevent create outlines from overwriting existing files.
Harden native-Windows path serialization and containment, reject POSIX absolute paths during run-directory validation, handle home-directory fallback, and prevent duplicate feature dispatch for the same brainstorm specification.
Rename /foundry:init to /foundry:setup and update Foundry skill references.
Collect non-auto-fixable audit decisions before changes begin, add high-churn and recency guidance to commit review, and introduce a JSON writer plus health-sentinel updates.
Automatically arm the commit sentinel after an explicit user commit request; retain workflow and confirmation authorization, the separate default-branch question, and an independent authorization signal for push.
Add a registry-aware helper that resolves the active Foundry install path, plus root-cause debugging guidance and audit checks for executable boundaries and security risks.
Add extract_code_blocks.py and a bin-authoring guide for classifying fenced code and deciding when to extract scripts; use token estimates and explicit gate/score/verdict columns in audit Check 33.
Make audit Check 17 and efficiency Check 33 group code blocks by functional purpose, using syntactic similarity as a secondary signal; keep efficiency tables out of the base audit path.
Strengthen Foundry challenger findings with numbered, evidence-backed required changes; add calibration-only model-tier guidance and scaffold templates for skills and agents.
foundry:manage — plugin-prefixed invocations (/foundry:manage); jq replaces python3 for settings check; DIRECTIVE variable made explicit in content-edit mode
foundry:investigate — symptom/signals/hypothesis captured in bash vars before Codex spawn; inline Confidence block example; shell var refs replace literal placeholders in prompts
foundry:calibrate — graceful-exit protocol (safety-net result.jsonl on any crash/exit); CODEX_MODES variable fix; phase timeout hint injected into subagent prompts; Skill added to allowed-tools
Resolve the default branch dynamically and require its additional five-minute authorization sentinel alongside the ordinary fifteen-minute commit sentinel.
Reset statusline agent badges immediately on /clear; remove per-turn lock files and clean stale session directories without deleting live concurrent sessions.
Correct agent frontmatter names to unprefixed local names, quote skill argument hints for valid YAML, and register OSS analysis and release calibration targets.
Add a resilience rule that prevents a plugin's recovery mechanism from depending on the plugin it is meant to recover, and raise challenger and creator effort to xhigh.
Add a Codex cross-check to challenger with a --no-codex opt-out, convergence reporting, and surfaced failures; register Research verification cases for calibration.
Classify manage content edits as trivial or substantive before dispatch, and rename the CI guardian role to CI/CD steward throughout routing references.
Add a read-only, red-team challenger that tests plans and code across assumptions, missing cases, security, architecture, and complexity, then must attempt to refute each finding.
Add an external-resource mode to /distill that analyzes a plugin or skill from a URL or local path, compares it with the current setup, scores adoption candidates, and presents adopt, adapt, discuss, or skip choices.
Check for lesson conflicts before writing and show the resulting diff for review; start a fast calibration benchmark when the target has no prior run.
Deny sudo, SSH, world-writable permissions, and recursive force deletion in Foundry policy; add plugin audit checks for Bash correctness and dependency cycles.
Add a live browser tree viewer with JSON sidecar updates to brainstorm; require an approved design before implementation and distinguish rejected from resolved branches.
Add a screenshot of the brainstorm tree to the Foundry README.
Add a PreToolUse commit guard with a short-lived authorization sentinel and wire its lifecycle into /resolve; clarify report confidence templates and shared-file failure handling.
Make /foundry:audit converge through up to five fix and revalidation passes, report remaining findings when the cap is reached, and write per-pass cross-file validation results.
Establish plugins/foundry/ as the canonical distribution for agents, skills, hooks, and rules, with /foundry:init merging settings and linking or copying configuration into the host environment.
Move the team protocol, permissions guide, configuration, and shared rules into the plugin; replace former .claude/ files with links and remove duplicate permission and status-line configuration.
Namespace Foundry skill and agent dispatch references and repair broken setup links so the split plugin can resolve its own workflows and cross-plugin roles.