Restyle the animated execution diagrams of the /foundry:audit, calibrate, manage and distill skills: card text is short fragments instead of sentences, key names are bold and conditions or bounds are italic, and each diagram's legend explains the emphasis; stop and skip conditions and gates are unchanged.
The global ~/.claude/CLAUDE.md written at setup now states the four delivery principles — consistent simple delivery, root cause not symptom, automatic correction and recovery, and honest stops with real handoffs — so every change follows them, including work done in a session that runs no foundry skill.
Review outcomes now distinguish bounded, low-impact correctness, test and compatibility repairs from material behavioral defects or substantial repair. Final verdicts cite the controlling findings and their impact, keeping required fixes actionable under Minor and verification readiness separate from source approval.
Weigh production impact above file type: documentation and test gaps normally remain Minor without evidence supporting a stronger judgment. These factors inform one combined judgment: high-impact findings can control the verdict and are never diluted by minor items. Use the strongest confirmed consequence as the baseline, account for proven joint effects, and keep severity, source disposition and verification separate. Missing tests no longer receive an automatic High rating; numeric topic discounts require independent calibration before they can determine verdicts.
Check local Codex activity before drafting commits, so contributions outside the Claude conversation are considered for co-author credit; ask once when only thread activity indicates possible involvement.
check_agent_waits.py also flags task calls that would cost a turn of their own: a task-only text block that sets in_progress (standalone-in-progress), a task-only block whose preceding text and body never say it rides with real work or precedes long output (unexplained-task-block), and a skill directory that drives tasks without stating that task calls ride with the next call (missing-ride-rule). Blocks are read line by line, so reflowing a paragraph never changes a verdict.
check_bin_test_coverage.py finds a script's test file at any depth under tests/, such as tests/audit/plugin/test_foo.py. A test nested two or more folders deep is now checked for empty or stub-only test functions like a flat one, instead of falling back to a name search across the test tree that reports "no test file" when nothing names the script.
python-testing.md sets a test-tree layout: a tests/ directory past 15 test files groups them into topic subfolders of 4 or more files each, _-prefixed helpers and the tree-wide conftest.py stay at the test root and resolve from any depth, path anchors come from one shared helper or conftest constant because parents[N] shifts one per folder level, and single-consumer fixtures and data live beside their consumer.
python-testing.md adds test-design rules, so reviewers and foundry:qa-specialist flag more silent test defects:
while loops count as test-body logic, like if and for.
Test names state the observable outcome, without filler tokens such as correctly, works or should.
Three uncollected-test shapes: a nested def test_*, a same-name redefinition and code after return.
A check whose absence could break nothing undetected is linting and belongs in a pre-commit hook or Ruff rule, not pytest.
Patches prefer the autospec=True decorator and always name a replacement shape; speed never justifies mocking a real-interaction test.
Test helpers stay within one test tree, and production code never imports one.
Tests reading Markdown or prose parse it line by line, and the Markdown is never edited to fit a test.
The Ruff rules that enforce test style (D100–D103, W505, TID251, PT, F811) are listed, with the checks Ruff cannot express left to reviewers.
foundry:qa-specialist requires a docstring on every test, so a descriptive test name no longer waives it (Ruff D102/D103).
Require proportional planning and challenge before accepted execution, then consolidate actual results with independent review and verification; routine authorized work gains no user approval prompt. Validate bounded outcomes, decompose larger work, and complete branches depth-first with focused context and useful disjoint sibling delegation; parent consolidation retains valid-evidence and mandatory acceptance gates.
Keep module-documentation scanning active when a checkout ancestor has an excluded directory name, while still excluding vendored files within the selected scan root.
The loop cost log moves to schema 2 and adds tokens_total, so a Claude review round records the background agent's subagent_tokens total and duration_ms (as duration_s) instead of leaving tokens null; schema 1 records stay accepted.
Review loops record the failing-before/passing-after check as a literal command line in the pre-baseline attestation and as a probe: entry on fix actions, so the parent can rerun it after later edits; the helper never executes it and reviewers do not receive it as a resolver account.
Assess confidence in the delivered result and how it was checked separately from completion status, while retaining required gates.
Accept case variations in reviewer invariant labels while preserving the original evidence, so valid challenge findings can proceed to action validation.
Commit subjects omit a scope that repeats the type, while keeping distinct affected-area scopes and the existing message and attribution rules.
/foundry:setup no longer stops at the permissions merge when the gh-write guard reads the retired Bash(gh api repos/*:*) allow rule in the command text as a gh write. The retired allow rules now ship in permissions-allow-retired.json and reach merge_settings_permissions.py through the new --drop-allow-file option, so settings.json loses the same rules and the command no longer names gh api. The merge also stops with settings unchanged when a retired-rules file is null or holds a non-string entry or an option path is empty, and refuses a drop or retire option given without the allow or deny merge it modifies.
/foundry:audit --efficiency --measured (new flag, off by default) lists the projects whose sessions ran a flagged skill, asks which to measure (a multi-select, the current project recommended), and measures their real transcripts (new efficiency_measured.py) for every inline skill that declares model:: dollars per model-switch rewrite, cold-start and pre-gate cost, subagent growth and idle-gap cache losses, each skill from each typed invocation to the next different command (a mid-run /compact or /model does not cut it short), including the model rewrite on entry and on the revert after it, which only a skill the scan flags owns (a neighbouring unpinned skill is never charged for it). Worktrees count with their project, and each record stores the chosen projects, warning when a later run covers other ones. It keeps a baseline in .notes/efficiency/baselines.jsonl, so a re-run prints the change against the pinned baseline (the first record, or the latest written with --rebaseline) and against the previous run, with how many sessions the baseline already held. An unreadable transcript is skipped with a reason, and a failed collector run is reported as a failure, not as "no sessions". A project name with no transcript directory, or a projects file that names none, stops the pass (exit 2) instead of silently measuring another set. Each record also stores whether border rewrites were counted, and a later run that counted them the other way prints a warning. --measured without --efficiency is rejected.
The efficiency audit no longer drops a model-placement finding when the per-file review calls the tier a fit, and its scanner now covers codemap-py's claude-skills/ skills, whose five model: pins were never scanned.
/foundry:audit --efficiency also judges the size of instruction text against its importance (E11, source tree only, new size_importance.py, zero model tokens): each block of a rule, skill or agent is spine (workflow steps, gates, deliverable contracts, high-stakes rules; the default whenever in doubt) or complement (flag-only steps, rationale, examples), and only complement is flagged — move out of always-loaded or flag-only text, trim when lazy text weighs over twice the median per obligation. A flag-only step is sized by what its flag scopes (a flag-only heading, its section up to a default-path sub-heading and without the line that loads a mode file), so rules that share its block are left out of the count; a mode, template or shared file made mostly of flag-only blocks is the gated unit itself and is not flagged. Doubt means spine, so only text proven to be complement is flagged. Advisory, never auto-fixed. The --measured evidence steps now live in their own mode file loaded only with that flag, so a plain --efficiency run no longer loads them.
New rule model-tiering.md (loads on first access of a skill or agent file): a tier ladder from script to Haiku, Sonnet and Opus with checkable escalation triggers, no model: on inline skills, lean brief-file delegation, and an author cost checklist.
New /foundry:audit --consolidate (Check 47) finds rule, skill and agent sections that express one intent in different words and proposes fewer, broader ones. It inventories sections with their load group and merge-blocking dependencies (shared-file copies, policy-sibling markers, frontmatter, install alternatives), clusters by purpose, judges each cluster keep/sharpen/merge-prune with an obligation map, has an independent foundry:challenger try to break each merge and each sharpen that removes text, and reports tokens saved per load class. Merging is limited to always-loaded and path-scoped rules; a skill's or the agents' files can only be sharpened or kept. Advisory: it edits nothing, skips pre-commit auto-fix and the fix gate, and rejects combination with --upgrade, --adversarial and --efficiency. Also fixes audit_preflight.py exiting 2 when the arguments are only a flag (/foundry:audit --efficiency, --consolidate), and now stops --consolidate on an unknown --flag instead of passing it into the scope. A controlled fixture run (tests/audit/fixtures/consolidate_fixture.json) shows the mode merging a paraphrase family and keeping an incident-encoded ban; discovery recall and restraint across runs and models, and the agent keep-control case, are not yet measured.
Review loops add a pre-baseline attestation: before the first review of a diff the parent or its resolver wrote, the author lists each changed behavior's invariant, sibling routes, consumer and failing-before/passing-after check, and fixes the gaps within scope. Fewer avoidable defects reach a paid independent review. The reviewer never sees the attestation, it never counts toward scoring or clean acceptance, and it is skipped for review-only requests, unauthored code and continuations of a prior ledger.
adversarial_loop.py --append-metrics records each round's cost (route, brief bytes, duration, tokens, attested gaps; unknown values stay null) in an advisory loop-metrics.jsonl beside the ledger, so later investigations can price review rounds. It never affects scores, recurrence or clean acceptance.
The loop rule names where a first-reported finding's origin class is stored (an origin: evidence entry), so missed versus fix-introduced defects can be counted from the ledger.
Review loops report why a stalled round stalled: adversarial_loop.py --plateau-kind prints stuck (the fix did not land), whack-a-mole (the fix exposed new siblings) or mixed on stderr, and the loop rule recommends the matching next step. It is informational only and never changes the stop decision, exit status or JSON summary.
The cost log's route follows a shared vocabulary (parent, agent:…, bridge:…, codex:…, other:…) so routes can be joined to outcomes, and --append warns, never refuses, when a finding first reported after round 1 has no origin: evidence entry.
Review loops can pilot a leaner reviewer brief: adversarial_loop.py --brief-arm assigns lean or full per run directory, only for loops that are not filter or gate reviews and have no open security or critical finding. The cost log records the wording sent (brief), so about 10 runs can be compared by first-reported weight, rounds and brief size. A high or higher severity finding first found after a lean baseline pauses the lean arm.
The review-loop cost log and pilot flags are hardened: a rejected cost record now only warns (warning: metrics-rejected:…) and no longer hides the committed round's summary or progress table; records bind only to a valid current ledger, take fractional duration_s, keep one stripped route per line even after a partial write, and a brief-arm-pause file carries the lean-arm pause. --brief-arm refuses to combine with another action, --plateau-kind speaks only at a plateau or non-converging stop, the origin: warning also fires for an unknown class, and the attestation goes to a randomly named temp file outside the workspace so a reviewer cannot derive its path, and attested_gaps is null whenever no attestation was written.
Blueprint generation and manifest re-checks reject unsupported shell forms. Stale or tampered entries cannot regain auto-approval through the following forms:
Parameter expansions beyond supported reads.
Encoded command substitutions or ambiguous closing braces in parameter defaults.
zsh variable subscripts that assign, execute code or read lookup variables.
Arithmetic beyond read-only $((…)) expressions.
Malformed or unterminated heredocs.
Comments hiding closing delimiters in command substitutions.
zsh glob qualifiers and misplaced array assignments.
Shell options outside pipefail, errexit, nounset and nomatch, including wrapped or constructed flags.
Wrapper options requiring operands.
Unsupported $ expansions and named-descriptor redirections.
Unmodeled brace compounds, including inside nested case arms.
Blueprint checks reject lookup and startup-variable writes through assignments, declarations, loops and wrappers, including disguised names, invisible characters and arithmetic operands. Manifest re-checks also reject command-shadowing functions and source/., preventing executable overrides. Ordinary text and supported length expansions avoid false rejections; indirect writes through arithmetic re-evaluation of text stored in variables remain outside the classifier's scope.
Blueprint checks keep ordinary text operands and quoted-delimiter heredocs as data, while checking command substitutions across lines in unquoted heredocs. Quoted assignment text avoids false rejections, and dangerous commands cannot hide in expanded heredoc text. Shell script paths held in variables require -- before the path to remain auto-allowed.
Blueprint checks and sentinel reads accept literal string-only printf/print formats with fixed widths, literal percent signs and newline, tab or backslash escapes. Supported formatted output remains auto-allowed under the stricter checks. Nonliteral formats, non-string conversions and unsupported escapes are rejected. Every format word is checked against that closed list whatever its first character, so a dash-leading print -f or printf format can no longer write a lookup variable, while print -rf, printf -- '-%s', env printf and inert quoted text stay allowed.
Shipped audit and setup blocks are rewritten to remain auto-allowed under stricter formatter checks. Counts and exit-code output are preserved, and an empty example count still reports a diagnostic with status 2. Audit Check 45 prints paths with backslashes literally and now requires each policy-sibling to list the declaring file back, so one-way or chained markers are reported as asymmetric.
Sentinel reads require plain target names and reject lookup variables, prompt strings, hook arrays and command tables. Only empty IFS= prefixes on read are allowed, preventing other field-separator writes and shell-environment changes. Arguments accept supported variable reads, literal or variable defaults and trims; unsupported expansions and named-descriptor redirections are rejected.
The gh-write and push guards block unreadable shell commands even without a gh call, including unsupported expansions, named-descriptor redirections and unsafe option switches. Attached parenthesis groups are rejected except valid array assignments, so zsh glob qualifiers cannot hide writes or pushes. Supported case conversions, unset-variable errors, zsh splitting and tracing options, shopt -q, bash --rcfile FILE and braced case statements remain readable.
The gh-write and push guards follow executable shell input through shell and env option values, including clusters, normalized script paths and nested shell input. Piped or redirected stdin reaches whole shell compounds, and only command words select shell stdin consumers; shell names used as arguments remain data. Script arguments, other interpreters' code, shell version queries, compound timing, loop regex tests and leading comments avoid false blocks, while eval substitutions consume only their output rather than later printed text. The guards inspect these executable sources:
Shell -c strings and eval operands.
env -S command text, including defined escapes.
Pipes and heredocs feeding shell stdin.
Files written and then run or sourced in the same command.
xargs and parallel placeholders receiving stdin.
The gh-write and push guards also read fish -C startup code and here-strings read through a saved stdin descriptor (exec 3<<< …; sh <&3), and treat an unprovable descriptor or startup string as unreadable. Alias queries, harmless function definitions and eval used as an argument stay readable, while definitions that shadow a modeled command remain unreadable. A rejected env -S split now blocks as unreadable instead of throwing.
Printed shell input requires literal echo/print text without backslashes or supported string-only formatter output. Runtime operands and unsupported decoding are blocked when printed as executable source, preventing encoded gh writes and pushes while leaving ordinary printed data unaffected. Executable formatter output requires ASCII operands and limits padding to 65,536 characters, keeping generated shell input readable.
Newly propagated helpers inherit their canonical file's committed version baseline, avoiding false version-family errors. Version checks report canonical Git-read failures, and genuinely new canonical files and copies must start at version 1.
Review → fix loops now keep a round ledger and progress table, making review history visible. Repeated invariants are tracked across all earlier rounds, including renamed findings, requiring root-cause evidence on repetition and stopping at the third occurrence. Action invariants must match their ledger findings after whitespace and case normalization, preventing inconsistent recurrence tracking.
Filter reviews require grammar coverage across every reader, exposing unmodeled constructs as findings and preventing clean verdicts with incomplete coverage. Repeated filter failures require defaults that reject unmodeled input, preventing another narrow bypass fix.
The adversarial-loop rule and the challenger dispatch rule list a reviewer reply truncated before its required closing block (envelope or ## Confidence) as an agent failure, so a cut-off reply is no longer scored as a complete round with fewer findings. Where the host can continue that reviewer, the parent asks it for only the remainder, in replies short enough to pass the transport, until the closing block arrives; a reply that adds nothing new records the failure.
The adversarial-loop progress table shows security findings in their own Security column ahead of Critical, instead of folding them into Critical, so a reader sees how many open findings are security bypasses. Score weights and the Weighted score column are unchanged.
The adversarial-loop rule treats any reviewer round that returns no deliverable, a refused findings write, an unparsable envelope, a safety-classifier stop or a blocked envelope as an agent failure, records its cause in loop-report.md (never as a round, where it would read as a clean review), re-dispatches that reviewer once with a brief that removes the cause, switches to another permitted reviewer route if the same one fails again or cannot be re-dispatched (no attempt left, no approval, or a cause no brief can remove), and stops as independence-unavailable only when no route remains, instead of letting the round drop out as not-run.
/foundry:calibrate arms a 60-minute pipeline deadline when --full or --ab-test is set (previously 10 minutes, 15 with Codex), so a full A/B calibration with Codex scoring is no longer cut off at 15 minutes.
The calibrate pipeline runs every Codex call, problem generation and scoring, in the foreground, and gives each scoring call a 180-second budget at medium effort and the generation call a 120-second budget. Before, a pipeline that waited on a background Codex job went idle and returned nothing.
Calibration problem generation asks for harder extreme problems (evidence split across two sections, plus a construct that looks defective but is correct, kept out of the ground truth) and bans labels or hints that give the flaw away in medium and harder problems. The result records a gap when extreme_recall is 0.95 or higher (marked a single-problem signal when fewer than two extreme problems exist), so a saturated tier is no longer read as proof of capability.
foundry:challenger keeps its report short: one quote or citation as the target reference, an attack of at most three sentences, a single required change and one-line Refuted Challenges entries. It compresses wording only, so no finding, field or refutation is dropped, and over-budget triage compresses wording and then lets the report run over instead of dropping Nitpicks.
foundry:challenger delivers its findings in its final reply instead of a report file or SendMessage, labels them in the adversarial loop's six tiers (security to nit) so each round can be scored, always states its Codex cross-check result, and in a security-filter review runs the bypass search through Codex and classifies the candidates statically instead of writing bypass strings itself.
The always-loaded quality-gates rule points at a new Challenger Rounds section in its full rule, which holds the round-failure and Codex procedure.
The file-handoff protocol lists the report names Claude Code refuses for a subagent Write (findings.md, report.md, summary.md, analysis.md and suffixed findings-*.md), so an agent names its file after itself and the report is no longer lost.
check_codemap_guard.py registers the Codex Rig adapter's run-directory index override and drops the stale entry for the oss review codemap mode, so the pre-commit check no longer fails on every commit.
The runtime blueprint-allow.js hook refuses, even on a manifest hit, every command that can point a command name at another program: hash, builtin, alias, enable, functions, eval and their kin; any mention of the zsh commands/functions/aliases or bash BASH_CMDS/BASH_ALIASES tables, attached option prefixes included (set -Acommands); set -A, read -a, printf -v, name references and indirect expansions. Spellings that slipped past the earlier per-spelling checks, such as set -Acommands ruff /bin/echo and builtin -- hash -p …, are now refused.
The same hook reads each command as the shell's own words before judging it: quotes, backslash escapes, $'…' strings and line continuations are resolved and joined, and redirections are set aside with their targets. \rm, r""m, h$'a'sh, \-v and co""mmands therefore count as rm, hash, -v and commands, and a redirection such as printf 2>/dev/null -v … or 2>"a b" set -A … no longer hides the option or the command. A command word written as a pattern that can expand to a refused name (/bin/r?, {ha,}sh) is refused. The hook reads past the zsh precommand modifiers noglob, nocorrect and - and past a wrapper's own arguments (timeout 5 set -A …), and it judges the command text carried by a shell's -c (after options such as -o shwordsplit), a trap action, watch and env -S, so noglob rm -rf x and zsh -o shwordsplit -c 'set -A …' are refused. An option written after another option's argument (set -o noglob -A …, read -t 5 -a …, print -f '%s %s' -v …) still counts. Text the reader cannot settle is refused rather than guessed: a command that ends inside an unclosed quote; a $'…' escape bash and zsh decode differently, wherever it stands, assignment and redirection target included (a NUL byte, \u…, \c…, an unknown letter such as \m, an octal value above \377); an expansion inside a command word (h${x}sh); and a pattern among a wrapper's words or a POSIX bracket class in a command pattern (command h[a]sh …, /bin/r[[:lower:]]). A shell's -c script written after -- is judged like any other. Short options are read as clusters, so zsh -co shwordsplit '…', zsh -xo name -c '…' and env -iS '…' still reach the carried script, and every argument after a -c cluster is judged as script text. A / inside an expansion (h${x:-/}sh) no longer counts as a path separator. unset -f, -F or -m, which remove a function that shadows a command, is refused like unalias. A -c string counts as a bare variable (bash -c "$METRIC_CMD") only when it is exactly that variable, so invisible Unicode whitespace around it no longer makes the hook and the generator disagree. An expansion where printf, print, set, read, unset or a declaring builtin still reads options (printf "$o" …) is refused, since its value may be -v or -A. A quoted or escaped prefix ('h'${x}sh) no longer hides an expansion inside a command word, and a bracket class holding a quote or backslash (h[\!a]sh) is matched as any one character. The command after a zsh short or brace form (for x (a) cmd, select x (a) cmd, if true { cmd }, while … { cmd }, repeat 1 cmd) or after bash coproc is judged like any other command. The & of 2>&1 or &> no longer splits a command in two, an escaped quote in $'\'' no longer ends the string early (also when a line continuation splits $ from '), a parenthesis inside a quoted string no longer ends a $(…), and a {fd}> redirection is set aside like 2>.
The blueprint manifest generator applies the same rebind denial as the hook, by name instead of by spelling. It reads commands with the same rules as the hook, the refusals for text it cannot settle included. command … -v counts as a name lookup only when -v or -V stands among its leading options, so a trailing -v no longer exempts the command command runs. No shipped block uses any of those commands or tables, so no manifest loses an entry and every drop count is unchanged.
The manifest allowlist no longer admits eval "$RUNNER …" or eval "$(…)": a block that runs eval gets no manifest entry and prompts.
Audit Sub-check 23e reports a command-name rebind in any shipped shell fence, including the option forms (set -A, read -a, printf -v, declare -n) and a rebind behind command, an assignment, a backslash, a wrapper or a redirection, so a new block that would lose its manifest entry this way is named with the reason. A # inside quotes, an escaped \" included, no longer hides the rest of the line from the check. A line ending in \ is joined with the next, a command word with $ after its first character (h$'\x61'sh) is flagged, and print -v after an option value such as -f '%s %s' is caught. Whitespace inside quotes stays part of its word, so 2>"a b" set -A … keeps set in command position, and a read operand built by a backtick substitution is flagged. Redirections are set aside with their targets before matching, so read 2>/dev/null "$n", hash>/dev/null -p … and {fd}>/dev/null set -A … are flagged. A rebind behind a wrapper's options (command -- hash …, sudo -u root hash …) is reported too, while a command -v lookup is not.
Audit Check 45 prints its findings with printf '%b', so a % in a reported path is no longer read as a format directive.
The blueprint hook refuses a command whose raw text has a backslash-escaped blank at a line end or before #. The shell ends the command there, or keeps the rest of the line as an argument, while normalization would read a continuation or a comment, so a shipped digest could approve a different command. No shipped block contains the shape.
The sentinel-read shape lane judges every word a read receives: a sensitive variable such as PATH named anywhere, attached to an option (-aPATH) or after an option's argument, or a computed name (read "$V") refuses the command. Only the first name was checked before, so read -r IGNORE PATH < file could rebind command lookup without a prompt.
The manifest generator gives no entry to a block that sources a state file, runs a variable's value as a command (bash -c "$VAR", $RUNNER …) or writes heredoc data (python - <<'PY' code keeps its entry), emits per-line entries only for complete commands, and admits a mutating bin/ helper only when it is listed with its guard (heal_git_artifacts.py and merge_specialist_batch.py added). Entries fell from 1298/2023/949/698 to 1090/1817/845/655 across foundry, oss, develop and research.
A census test rebuilds every admitted manifest entry and fails when one sources a file, runs a variable as shell code, writes heredoc data, is a line bash cannot parse alone, or calls a helper whose source deletes trees or writes git history without review.
permissions-guide.md no longer lists bash -c "$CMD" or sourcing a state file as allowed shapes, and describes the escaped-blank refusal.
Helper scripts that write or read a session sentinel (parse-skill-flags.py, extract-keep-flag.py, write_skill_contract.py, audit_preflight.py, state.py) fall back to /tmp on POSIX when TMPDIR is unset, the directory a skill's ${TMPDIR:-/tmp} names, instead of tempfile.gettempdir(), which picks TEMP or TMP first; with either set, script and skill read different files. Native Windows keeps gettempdir(). Path checks that confine a file to the temp dir (settings_json.py, jq_write.py --slurpfile, --out-file of the flag parsers) accept both directories. claude-config.md, python-code.md, bin-authoring-guide.md and the /foundry:distill executable brief prescribe the same fallback.
The shared quality stack (used by /develop:fix, /develop:feature and /develop:refactor) runs ruff, mypy and pytest through a runner array that a closed case builds from the three detected literals (uv run, poetry run, python -m) instead of eval "$RUNNER …": a missing, stale or planted quality-stack-runner session file now stops with ! BLOCKED — runner state missing or not one of … and executes nothing (a missing file used to fall back to python -m even in a uv or poetry project), and failing pytest node-ids are retried as separate array elements.
The runner fences of the shared quality stack are no longer pre-approved by the blueprint hook: "${R[@]}" ruff is an expansion in command position, which both gates decline, so the six runner blocks (and their propagated copies in cc_develop) prompt instead of running silently as the eval "$RUNNER …" form did (quality-stack manifest entries 107 → 101 in foundry, 112 → 106 in develop). An earlier design that taught the gates to trust fixed-text arrays was dropped after repeated review rounds kept finding new ways to overwrite a trusted array.
The runtime danger check (blueprint-allow.js) and the generator's is_dangerous treat uv run and poetry run as carrying their wrapped command, flag hash name=/path, hash -p /path name (also the attached -p/path and bundled -rp spellings) and builtin hash …, which rebind a command word to another binary, and refuse blocks that may write the zsh commands or bash 4 BASH_CMDS tables in any spelling (commands[x]=, commands=(…), +=, ${…:=…}, printf -v, read -A, or a write nested in a lookup subscript such as ${commands[$(…)]}); a plain ${commands[x]} or ${commands[$name]} lookup stays allowed. The generator's uv run check declines any option it does not know (uv run -f ruff rm …, where -f swallows the next word), so a value-taking option can no longer hide the command that really runs; before, that block was admitted.
Bash(eval:*) is no longer in the shipped allow list and /foundry:setup removes it from settings.json, including an identical entry added by hand: ad-hoc eval commands now prompt, while shipped blocks no longer use eval.
/foundry:audit Check 23c flags any eval "$…", eval $(…) or eval -- … in a shipped skill, mode, template or _shared file (previously _shared files were never scanned) as high severity (was medium, SKILL.md only) with no exemption for parse-skill-flags.py or derive_codemap_target.py, and only lines inside code fences (backtick or ~~~, blockquoted ones included, each closed only by a marker at least as long as its opener) are scanned, a comment inside a blockquoted fence stays a comment, so prose that quotes `eval "$(…)"` is never a finding while a comment mentioning eval, a quoted # or a backtick command substitution no longer hides a live eval in code; Check 30b's fix pattern uses a closed-case runner array. permissions-guide.md, bin-authoring-guide.md and the curator agent name --keep-state sentinel files as the replacement for eval of script output.
The quality stack's failed-test retry reads a node id with one nested bracket level (test_x[[a] b]) whole instead of cutting it at the first ] followed by a space, so the isolated retry targets the right test; deeper nesting still truncates, which selects nothing and fails loudly.
check_cli_flag_drift.py stops reading a documented command's flags at a standalone -- that is not inside a quoted value (a $(…) or backtick inside double quotes still ends the scope, quotes and backslashes are read the way the shell reads them, so a backslash inside single quotes such as 'C:\' is a plain character while an ANSI-C $'it\'s' value honours its escapes, and a quoted value continued onto the next line with \ is read as one value), and treats argparse's implicit -h/--help as defined unless every parser in the script sets add_help=False (a help-less parent parser shared through parents= does not count), so flags forwarded to a wrapped tool (dev_run_tests.py pytest -- --tb=short) are no longer reported as drift of the wrapper script.
/foundry:calibrate A/B verdicts replace none with baseline-ahead (general agent ahead), inconclusive (both arms at the recall ceiling) and no-lift, evaluated first match wins; a mixed-sign result reports its negative delta as a trade-off, and older none ledger entries are documented as covering all three.
foundry:challenger, foundry:creator, foundry:doc-scribe, foundry:linting-expert and /foundry:manage decline out-of-scope requests with one ! UNSUPPORTED — <reason>; owner: … line and still write a mandated deliverable file or envelope; the shared file-handoff protocol adds an unsupported status that orchestrators surface as a routing miss, never as findings or a timeout.
/foundry:manage matches add perm and remove perm as command words, so permission commands no longer trip the out-of-scope redirect.
Severity output is anchored by consequence: foundry:solution-architect gains a severity rubric (compatibility breaks and startup cycles [HIGH], governance gaps at most [MEDIUM]) and returns only findings for review-only asks; foundry:perf-optimizer caps constant-factor waste at high, keeps advisories out of numbered findings and marks static reviews [Measured] none; foundry:linting-expert defaults plain mypy errors and B006 to medium; foundry:challenger rates meta-findings and contagion by each finding's own failure mode.
foundry:qa-specialist limits Coverage Gaps to documented or code-explicit contracts and moves unspecified behaviour to Contract questions:; foundry:doc-scribe treats a documentation standard as a hard filter only when the prompt makes it the acceptance criteria; foundry:creator lets the outline's ## Format override house format defaults.
foundry:sw-engineer reviews separate correctness bugs from suggestions and direct from latent bugs, with minimal fix diffs; read-only third-party release impact questions route to general-purpose, and foundry:web-explorer no longer sends local code analysis to foundry:sw-engineer without a fix request.
/foundry:humanizer check mode rates findings by checklist group (Syntax high, Vocabulary medium, Formatting low) and flags triads only when vague; /foundry:audit accepts permissions-guide.md, MEMORY.md and configuration README targets instead of declining them.
Narrow broad find, node, claude, and sed allows while retaining scoped read-only rules and broad eval/python for existing recipes; ad-hoc commands outside shipped blocks now prompt unless a narrower rule covers them. Setup removes the old broad entries from settings.json, including an identical entry added by hand.
Shared keep-state helpers reject sentinel identities containing .. before changing state; audit Check R4 also recognizes real tests that import or reference a script under another test filename, reducing false missing-test findings.
/foundry:setup uses Python for every JSON read, probe and atomic settings write, so setup completes without jq on native Windows and other hosts while preserving existing env values and safe re-runs.
The Windows Python launcher disables implicit current-directory executable lookup, preventing a checkout's planted interpreter from running during runtime selection.
/foundry:calibrate --local help now states what the flag changes (rules target, mode files, cross-plugin availability check) and that agent/skill targets always come from the source tree, matching resolve_agent_file.py.
/foundry:setup validates settings with Python instead of jq, so machines without jq keep a valid settings merge rather than restoring its backup; malformed JSON still triggers restoration.
/foundry:brainstorm writes its question-delivery copies (<slug>-branches.md, -tree.md, -spec-draft.md, -plan.md) under a per-invocation .reports/brainstorm/<ts>/ run dir printed at Step 0, so a later brainstorm or breakdown run on the same slug no longer overwrites an earlier run's files; rounds within one run still replace their own copy.
foundry:perf-optimizer and foundry:sw-engineer replace basic tool-usage examples (py-spy/scalene/timeit/strace commands, a sample pyproject.toml, a Protocol class, an exception-hierarchy listing) with one-line principles, shrinking each agent's always-loaded prompt; the macOS SIP tracing caveat and the pstats read-back one-liner stay.
parse-skill-flags.py no longer drops a --keep value whose quotes the shell consumed when the host substituted $ARGUMENTS (--keep "a b" used to arrive as --keep a b and persist an empty keep list); it now also accepts --keep 'a b' and --keep="a b", strips a dangling --keep from CLEAN_ARGS, and warns on stderr when the value was unquoted or empty, so a lost compaction keep list is visible instead of silent.
/foundry:audit Check 45 resolves a policy-sibling path against the marker file's own plugin root when it is not found from the repository root, so plugin-relative sibling paths in shipped files (codex-rig, research) no longer raise false 45-BROKEN findings (20 on the current tree, now 0).
/foundry:brainstorm, /foundry:investigate, /foundry:distill and /foundry:calibrate start with one parse-skill-flags.py --keep-state call instead of extract-keep-flag.py followed by an eval of parse-skill-flags.py: one process fewer per skill start and no eval of script output, with the same owner-safe stale-contract clear and keep sentinel. /foundry:manage and /foundry:profile drop eval too and read their flags from per-session sentinels. parse-skill-flags.py gains --keep-state <prefix>, --out-file and --inlined (synced from oss).
resolve_shared_path.py's last-resort source-tree tier now uses a cwd-relative plugins/<dir>/<subdir> only when the working directory is that plugin's own source repository (plugins/<dir>/.claude-plugin/plugin.json names the requested plugin). Otherwise the tier is skipped and the CLI exits 1 with a ! message naming the refused tree, so a repository under analysis can no longer supply the shared docs that foundry loads via load_shared_doc.py or a sibling plugin loads via its own copy.
heal_git_artifacts.py worktrees no longer deletes unregistered directories (orphans) by default: they are reported with a hint and removed only with the new --include-orphans, after a fresh re-check right before deletion (still unregistered, git worktree list answering, untouched since the sweep, no uncommitted work in its own .git). Symlinked children are reported as skipped instead of silently dropped from the report, and --managed-prefix rejects * (exit 2), so one sweep can no longer claim every child of a directory.
/foundry:audit Check 23 and the curator agent accept a shared-doc load by either cat or a plugin bin/ loader and no longer propose converting one to the other.
/foundry:audit Check 28 and the Check 27 _shared path greps now also scan plugins/*/claude-skills/, so bridge and codemap-py skills get the cross-plugin and subagent_type checks.
/foundry:audit Layer 1 gains the agent-plugin-root check (bin/check_agent_plugin_root.py): agent Markdown that writes ${CLAUDE_PLUGIN_ROOT:-plugins/<plugin>} is flagged, because the host substitutes only the exact ${CLAUDE_PLUGIN_ROOT} token in an agent prompt and the default form resolves to a repo-relative path an installed plugin does not have. audit_static.py exits 1 on a finding; a line carrying plugin-root-check: allow is exempt. The foundry agents now use the exact token. audit_static.py --scan-dir <one plugin> passes that plugin to readme-drift, mode-dispatch and tag-symmetry directly instead of reporting a findingless FAIL or skipping, and a checker that exits non-zero without findings is reported as an error with its stderr line.
/foundry:audit --efficiency now flags a model: field on any inline skill (one without context: fork) in every plugin, not only foundry; on this tree that covers 9 skills outside foundry: cc_ossresolve, analyse, review and release, and codemap-pyquery-code, integration, debrief-coding, rename-refs and test-impact.
bin/plugin_layout.py prints each plugin's manifest-declared skills and agents directories, and --local audits glob those instead of a fixed */skills/*/SKILL.md, so a plugin that renames its skills directory (for example claude-skills/) is no longer silently skipped.
Skills that run inline in the main session (humanizer, investigate, profile, session, setup) no longer set model:, which only applies with context: fork. The efficiency audit flags an inline skill that sets one, and humanizer leaves the haiku ceiling row and the isolation-spawn examples in the rules.
/foundry:audit: the /distill executables follow-up option is gone from the gate, --adversarial Phase A spawns foundry:challenger (--no-codex) and Phase D reads .py files only, --upgrade accepts a change only on a capability A/B run with --local and a 0.05 noise floor, and audit_preflight.py stops with BLOCKED on an unsafe session id or a state directory owned by someone else. /foundry:manage prints the final /foundry:audit and /foundry:calibrate commands for the user to run, since both are disable-model-invocation.
check_bash_persistence.py no longer misses cross-block variable references (Checks 41 and 43), also scans modes/ files, and an explicit --scan-dir with no match no longer falls back to the current directory.
/foundry:calibrate accepts claude-skills targets, passes model= for --local targets, records severity_assigned[], adds a pace gate and ledger, and persists TIMESTAMP in apply mode; interactive skills (create, brainstorm, manage create) are excluded from the skill domain table. /foundry:create splits its first question. /foundry:brainstorm reviews its Step 5 output through foundry:challenger, caps D2 at 4, and keeps /develop:* and /foundry:manage out of its B3 invocations. /foundry:distill external mode reviews before writing, and --project defaults to the current project only.
quality-stack.md reads its shared directory from the qs-shared-dir-${CSID} sentinel and stops with BLOCKED when it is missing; it also recognises uv.lock, poetry and pre-commit setups, treats MYPY as advisory, and spawns the Cycle 1 agents directly. perf-optimizer checkpoints with git stash create; sw-engineer routes pre-commit work and doc-scribe carries a NOT-for clause; solution-architect and creator fall back to a needs_decision envelope; challenger gets the Skill tool and a security scope.
! BREAKING: resolve_skill_subdir.py resolves the project-local tier only with --local, so /foundry:manage create no longer sees .claude/skills overrides.
Bin hardening: sentinel and state writes are atomic and link-safe (extract-keep-flag.py also takes --inlined and skips a contract owned by another session), jq_write.py exits 3 on an unlisted flag, write_skill_contract.py rejects a multi-line value, find-polluter.py exits 1 on a timeout or an option-shaped test id, check_bridge.py accepts only allow-listed marketplaces, heal_git_artifacts.py rejects a --pattern that is not a bare file-name glob and keeps a worktree with an unreadable status out of the removable tier, and resolve_shared_path.py rejects SUBDIR traversal and reads its own name from plugin.json. purge_plugin_cache.py deletes nothing when the registry is unusable, resolve_agent_file.py rejects path components, compact_gate.py rejects a wildcard session id, symlink_with_guard.py rejects a degenerate marker or a source link leaving the plugin root, check_codemap_guard.py reads its MANIFEST with ast.literal_eval instead of importing the file, and verify_blueprint_audit.py survives a deeply nested record.
extract-keep-flag.py refuses a keep sentinel another user already owns (exit 1 with an error naming the file, instead of reusing a planted value) and creates a missing --out-file state directory with mode 0700, so other users can no longer list it. Sentinel names are unchanged; native Windows skips the owner check.
merge_settings_permissions.py merges the shipped permissions in the order they were written (no re-sort) and writes through a symlinked settings.json. The blueprint allow manifest drops 18 mutating command idioms, so those blocks prompt again instead of auto-allowing.
The /foundry:audit skills checks moved from one checks-skills.md into checks-skills-{gaps,bash,contract,crossplugin,deadfiles,duplication,sweep}.md, which checks-skills.md now indexes. A skills scope run no longer loads the sweep file (Checks 35, 42, 43, 44; the plugins and full scopes still do), and the Check 27 and 30b self-exclusion greps cover every checks-skills*.md file.
write_skill_contract.py takes a leading --keep-sentinel <name> or --keep-file <path> (not both) and appends the first line of that sentinel or file as user-keep: itself; a missing or empty source adds nothing. audit, calibrate, distill, brainstorm and investigate use it instead of an inline read -r _KEEP plus string append.
load_shared_doc.py --optional prints a one-line warning and exits 0 when the plugin, subdir or file is missing, instead of ! BREAKING and exit 1; the audit codex pre-pass and the Step 6 cross-validation load use it in place of an inline [ -f ] || warn block.
New compaction_boundary.py runs the compaction contract resolve and gate as one call, finds the contract relative to its own plugin so an installed plugin works from any directory, and times out its child processes; it is propagated to develop and oss.
New codemap_changed_modules.py lists the codemap modules touched by the current diff from git diff -z, so a path git quotes or one with a comma now resolves; challenger, doc-scribe, perf-optimizer, qa-specialist, solution-architect and sw-engineer call it instead of an inline pipeline.
extract_code_blocks.py now finds fences inside blockquotes: it strips the opener's quote depth from content and close lines and skips a block whose quote ends before the close, so blockquoted fences that were missed before are now found.
jq_write.py accepts --slurpfile <name> <file> (source confined to the working directory, TMPDIR or ~/.claude) and writes settings*.json directly under ~/.claude, so /foundry:setup no longer needs an unchecked jq … > tmp && mv write-back. list_audit_files.py --paths-only -0 prints NUL-separated paths for xargs -0.
/foundry:manage Step 4 (create, rename, content-edit, delete, perm) and /foundry:calibrate Step 6 (apply) moved into modes/ files loaded on demand, so a run reads only the mode it uses. Duplicated rules in manage, calibrate, distill, profile, investigate and brainstorm are stated once.
/foundry:audit --efficiency run alone now writes the aggregate.md and summary.jsonl the audit gate reads, and check_codemap_guard.py tracks the split oss dispatch files. Agent tools: grants match what each file uses: challenger drops WebFetch/WebSearch and web-explorer drops Glob.
quality-stack.md: when doctests run as a separate pass (their collection failed, so they could not join the main run), a failing doctest now halts the quality stack with GENUINE FAILURE, and any other non-zero pytest exit except 5 halts with CONFIG ERROR. Before, that exit code was recorded and never read, so failing doctests were reported as not-merged and the run continued. Exit 5 (no doctests in the module) still passes.
resolve_shared_path.py no longer executes a plugins/<dir>/bin/get_plugin_install_path.py found in the working directory: with CLAUDE_PLUGIN_ROOT unset and no cached copy it runs the helper shipped beside itself, so a repository checked out for review cannot plant code that runs during path resolution. The registry lookup reads <home>/.claude/plugins/installed_plugins.json explicitly and ignores a recorded installPath outside ~/.claude/plugins/cache/borda-ai-rig, falling back to the cache scan.
/foundry:audit without --local no longer claims to audit the installed plugin cache, which it never read. When the project's .claude/ holds no agents or skills, the run records ⚠ UNSCANNED for them and the report carries an Unscanned Plugins section instead of a clean result.
build_blueprint_manifest.py admits an entry to blueprint-manifest.json only when every command it runs passes a fail-closed allowlist. An unknown command word (ln, perl, strace, an unlisted CLI) keeps the block out, so it prompts, while the reviewed shapes shipped skills rely on stay auto-allowed: read-only utilities, plugin python scripts, python -c with fixed code, eval "$RUNNER …" whose runner the same block reads from the skill's own sentinel or sets to a literal, sourcing or unlinking a session state file, cp, tee, mv "$F" "$F.done" consume-marker renames, mv (plain or -f) between two session state paths that name no variable except TMPDIR, CSID or one the block sets from its own state (so .temp/$DEST with an outside value still prompts), and wrappers whose wrapped command passes. On the same tree cc_foundry keeps 1292 of the 1336 entries the previous gate admitted. The blocks left out are the perf-optimizergit restore checkpoint revert, the /foundry:setup loop that unlinks and re-links files in ~/.claude/rules, and documentation examples (uv tool install, strace, uv pip, placeholder <script>.sh blocks).
The blueprint hook's danger re-check (blueprint-allow.js) and the generator's is_dangerous now see a command hidden behind a case arm label or inside a function definition, so case x in a) rm -rf /;; esac and f() { rm -rf x; } are refused even on a manifest hit. Before, the label or the f() word was read as the command and the rm passed. New shared cross-language vectors pin both languages to the same verdicts.
batch-nudge.js runs on PostToolBatch instead of guessing parallelism from a 1.5 s gap between PreToolUse calls. The batch size is read directly, so a slow tool or a fast model turn no longer counts as a missed batch. The reminder is injected as additionalContext instead of PostToolUse exit 2 stderr, node starts once per batch instead of twice per tool call, and the reminder cites foundry-claude-config.md §Turn Batching, which exists, instead of a missing CLAUDE.md section. Verified on Claude Code 2.1.304; the docs give no minimum version, and a build without the event leaves the nudge inactive.
batch-nudge.js keeps one streak per agent (agent_id). Subagents share the session id, so their single calls used to add up and nudge the wrong agent. A user turn resets only the main agent's streak. A subagent's file, agent-<agent_id>.json (so an id of main never touches the main agent's streak), is deleted on SubagentStart (spawn, resume, a teammate handling a new message) and on SubagentStop, so no streak carries into the agent's next turn and finished agents leave no file. A failed state write removes its temp file.
batch-nudge.js counts a Bash call only when it is provably read-only, so git add → commit → push no longer draws a "batch these" reminder. Every character must be a letter, digit, space, tab or one of _./=:@%,+-. Quotes, escapes, braces, parentheses, $ and globs let the shell rewrite words or run code after the check (find . "-delete", find . {-delete,-print}, git log -1 ${IFS}--output=x, zsh cat =(touch x)), so such commands are not counted. Within that, git counts only for log/status/diff/show/rev-parse/ls-files/blame without --output, and find only without -delete/-exec/write actions. Strict on purpose: 2>/dev/null, git -C <path>, pipes and find -name '*.py' are not counted.
write-guard.js stops asking on every edit to a new file. A tracked file never asks now, .claude/settings*.json and .pre-commit-config.yaml included, and an untracked or gitignored file asks only for CLAUDE.md, AGENTS.md, .claude/settings.json, .claude/settings.local.json, .pre-commit-config.yaml and pyproject.toml. .github/** (scripts such as .github/scripts/action_runner.py as well as workflows), CHANGELOG.md and dependency lockfiles left the protected set: a new file there is untracked by nature, so each edit of work the user had just requested prompted again and protected nothing. A protected file that does not exist yet asks once on creation and is recorded per session; later writes to it in that session pass, while a file that already existed untracked keeps asking.
task-log.js masks credentials before writing to ~/.claude/logs: NAME=value env assignments (leading, after export/env/&&), credential-named assignments, --token/--password flags, JSON credential fields, URL credentials, Bearer/Basic values and well-known token prefixes (ghp_, github_pat_, glpat-, npm_, sk-, xox*-, AKIA, eyJ and others), in Bash commands, agent prompts, last assistant messages, Skill arguments and the generic tool summary. Control, zero-width and directional characters are stripped. Paths and desc=, skill=, type= values stay intact because sessionEditedFiles and timing_analyzer.py parse them.
task-log.js creates the log directory 0700 and log files 0600, and tightens a pre-existing one (owned by the user, not a symlink) the same way.
File-handoff protocol: a tool or permission denial that blocked part of a task returns done_with_concerns with the denied tool named in summary, never done; the denied call or a bypass of it is not re-run (restructuring to an already-allowed form is fine), and error is used when nothing completed.
The compaction boundary gate no longer holds a skill run. When compacting would pay off, compact_gate.py now prints advise: the skill starts its next phase right away and shows the /compact hint at the next point where its turn ends anyway (after a spawn, or in the next question). The old hold-and-wait behaviour is opt-in through FOUNDRY_COMPACT_GATE=stop, which prints stop. A timed wait is not offered because a Claude Code turn cannot resume on a timer.
The /compact hint is one fixed short line, /compact keep: skill contract .temp/state/skill-contract.md, in its own code block. The old line copied the contract's next: text and ran to about 1,400 characters; a terminal copy wrapped it, and Claude Code turned the paste into a pasted-text block that never ran as a command. The PreCompact and SessionStart hooks already carry the full contract, so the gate no longer echoes it after the decision line.
Rules now require that a baseline claim ("pre-existing on HEAD") names its tree and runs with explicit paths; a new check is classified as behaviour (pytest) or bookkeeping (pre-commit hook); mutation checks run on a copy outside the repository; an option that widens a grant is read before it is marked recommended; commit messages name behaviour in plain words, never a skill's internal step label; reviewer briefs that run adversarial shell cases require case files written with a file-editing tool and fake gh/git binaries.
write-guard.js no longer asks before writing a protected file that git already tracks (CLAUDE.md, AGENTS.md, CHANGELOG.md, .github/**, pyproject.toml and the rest): every such write is diffable and revertible, and the hook's ask could not be remembered, so each edit prompted again. Untracked, new and gitignored protected files, such as .claude/settings.local.json, still ask, and .claude/settings*.json and .pre-commit-config.yaml always ask because they take effect before any diff review.
The global self-improvement loop folds a correction into the project-owned rule, skill or agent file that governs it instead of a lessons file; .notes/lessons.md stays a legacy input of /foundry:distill.
Select fixed context-composition fixture sessions explicitly so rendering tests remain valid after the checkout ages beyond the default 24-hour usage window.
Recognize literal dictionary-key version assignments in continuity checks, preserving existing schema baselines while rejecting skipped versions.
Keep review coverage and confidence gaps as factual limitations; require a specific user decision for additional review and omit declined requests from findings and final actions.
Make the git-approve, git-push and gh-write questions readable: the first line states the ask (commit, push or write target), one blank line follows, then short fact lines; what each answer does moves into the one-line option descriptions instead of repeating in the question body. The Approve always description names what the grant never covers (push, force, history rewrite, discarding work, deleting unique history, auth changes). The git-push and gh-writeApprove descriptions keep the token terms (15-minute validity; gh-write also re-hashes the files the command reads). Branch, command span and grant-file requirements for the approval hook are unchanged.
Cross-validation protocol: state that aggregate readiness: complete requires every assessment readiness: complete and an empty open_concerns; one blocked or incomplete assessment makes the aggregate blocked or incomplete, and a missing required role or a null candidate makes it incomplete, overriding blocked, also under a null aggregate outcome. Resolver intake already enforced this; the protocol now says it.
State the adversarial-loop progress table in the always-loaded quality-gates rule: after each validated round, print exactly the Iteration | Critical | High | Medium | Low | Nits | Weighted score table with all rows kept and each cell as old + new. The format lived only in the lazily read full rule, and a live loop report replaced it with a reduced table.
Add a no-restating rule to the question-text guidance: a question never repeats rows, items or findings that the last printed text already shows or that its own options carry.
Clarify the version-one review publication in the cross-validation protocol: string-array evidence and limits, open concerns only for UNVERIFIED or pending candidates, no complete readiness beside an open candidate.
Show reviewer roles without execution provenance and render ratings in square brackets, keeping provenance in evidence and limits. Update the shared protocol and Foundry README to match.
Register Develop’s historical index-directory configuration note as documentation so the Codemap guard check accepts the changelog while retaining executable guard checks.
Add a boundary gate that checks calls-ahead and current context against estimated rebuild cost, verifies the owned skill-contract digest, attempts to log each decision, and prints the contract only when compaction is warranted.
Add Claude and Codex context-composition reports, including usage deduplication and compaction detection; harden transcript parsing and token bounds in the cost analyzer.
Extend skill-contract metadata with validated gate parameters and a session-scoped ownership stamp; save verified contracts at PreCompact and restore them after compaction.
Adopt explicit compaction boundaries in phased workflows, with a safe continuation fallback when Foundry is unavailable and phase-specific preservation of reports and state.
Build edited-file context from session timings, including MultiEdit and NotebookEdit, instead of relying on a truncated transcript tail.
Require follow-up questions to name the report path and key outcome fields within the text budget; move concise plans and decision context into question text while retaining full report headers for final replies.
Clarify compaction authority, question formatting, and approval scope in Foundry rules and CLAUDE.src.md.
Require parent validation of review candidates at every severity before publishing actionable findings, retaining the source revision, contract, trigger, checks, counterevidence, environment, limits, and disposition.
Separate source judgment from verification readiness; distinguish confirmed, refuted, already-fixed, optional, unfinished, and unavailable concerns, and preserve unresolved obligations with an owner and closure condition.
Version the review ratings and finding records while preserving historical meanings and archive readers; reject incompatible current consumers and partial contract downgrades.
Carry validation identity and retained evidence through report merging, dispatch, remediation, and late-wave checks; reuse proof only while it still applies, and keep a rejected repair separate from refuting the underlying defect.
Align Foundry shared protocols and README guidance with the cross-plugin review contract.
Guard gh writes with gh-write-guard.js: exact writes require a user-approved single-use grant, and force updates remain denied even with a grant.
Add approval provenance through approval-guard.js and grant records: standing approval applies only to plain local commits; pushes and GitHub writes consume one-use grants, with self-grant attempts rejected.
Generalize the shell Git lexer for Bash and Zsh invocation differences, and use it when checking commit-guard push commands.
Add an optional GitHub-read lane to allow dispatch and allow audit verification to accept two- or three-lane verdicts.
Show report headers, plans, findings, trees, and queues once as option previews, moving oversized output to a named file and unknown-flag or blocker prompts into the question text.
Make foundry:sw-engineer spawns choose worktree isolation at the call site; update distill execution clusters to transplant each worktree patch and keep management scaffolds in the caller's tree.
Add rule-inject.js to load spawn and commit rules lazily after the first matching tool call, including failed calls and compacted sessions.
Deny git push --force-if-includes and git push --mirror as explicit backstops, and update Foundry's commit permission guidance.
Resolve the current Haiku model at runtime with a 24-hour cache and fallback; disable thinking, raise its token allowance, and report resolver failures instead of treating them as an empty result.
Put compact and repeated-failure guidance in the actual follow-up question, and update the model-window and cache-write guidance.
Ground completion claims in cited source evidence and a representative real case; retain the real-case check through investigation, implementation, and verification.
Wait briefly for transcript flush before rejecting a just-printed report header; explain visible-text failures and permit one identical follow-up retry without printing the table again.
Make audit and profile delivery hooks check the current report at both the follow-up question and turn end; keep diagnostic and recovery questions available when delivery evidence is missing.
Standardize confidence gaps as per-gap deductions that sum to the reported shortfall, including in calibration prompts and report templates.
Add POSIX and native-Windows python launchers that select an eligible Python 3.10+ runtime, preserve workload arguments and exit status, and leave a real python earlier on PATH in control.
Add a SessionStart rule check that detects missing setup-created foundry-<name>.md links, names the rule files to load, and injects the commit rule so an incomplete setup does not silently omit commit policy.
Route registered hooks through Node.js from PATH or supported fixed locations, then exit cleanly when no Node runtime is available.
Require co-author trailers to replace host-default attribution, with Codex attribution when Codex shaped the work and Claude attribution when Claude shaped the diff.
Continue independent review-and-fix cycles while the same-scope nonnegative integer score strictly decreases; stop on a plateau, increase, lost authority, or exhausted caller budget, with no arbitrary three-review cap.
Clarify evidence and contract handling in Foundry quality gates and the audit workflow, and make the strict-decrease rule visible in the quality-gate example.
Make audit and calibration histories append-only through append_ledger.py: stage audit findings in .rec files and append calibration's per-target result files with --from, preserving prior history and avoiding duplicate legacy migration.
Run isolation-motivated agent spawns regardless of task size, while retaining the ordinary budget rules for other spawns.
Replace agent-wait polling with per-agent deadlines armed at spawn and checked on each wake; mark a missed deadline or notification without output timed out immediately.
Warn at SessionStart when the loaded Foundry plugin root is marked orphaned or differs from the installed path, and tell the user to restart without blocking the session.
At SessionEnd, sweep only registered idle agent-* and oss-* worktrees; retain dirty trees, ignored run output, other prefixes, and orphan directories.
Shorten report template fields while keeping authoring guidance outside the completed report.
Add a Foundry notebook-authoring rule covering notebook narrative, cell boundaries, plotting, and shell usage; propagate the canonical shared style to the plugin.
Persist shared quality-stack variables across Bash blocks so batch mode and shell-variable checks use the intended values.
Probe xdist for wide runs while keeping diagnostic retries serial; check collection before folding doctests into pytest, classify doctest assertion failures as genuine, quote failed node IDs through eval, and explicitly report the degraded unmerged doctest path.
Split oversized Foundry bin helpers into smaller functions with maintainer-facing main() docstrings, improving navigation without changing their command contracts.
Strengthen producer-to-consumer evidence checks and validate host-manifest agreement and changed shipped version or schema continuity against committed HEAD; reject skipped or downgraded values, removed tracked manifests, and ambiguous unsupported selections.
Set model-specific spawn ceilings and use them to batch Foundry audit and adversarial waves.
Harden Foundry path utilities against destination overwrite, command injection, and traversal; bound file sizes and make hook-registry matching literal rather than regex-based.
Bound independent review to three rounds including baseline, show the cumulative table once after each validated round, and require a parent action record for every unresolved finding.
Show the full cumulative old/new findings table after each validated review round, preserving previous rows and excluding verified-fixed and rejected findings.
Tighten Foundry's Codemap consumer contract: reuse only matching fresh answers, check query completeness, cap supplementary queries, and keep direct source reads available when Codemap is absent or incomplete.
Add the short and detailed native-question guides to Foundry's propagation manifest so independently installed Codex-facing plugins can ship synchronized copies.
Gate audit and profile follow-ups on saved report evidence and current-turn delivery of the required summary or matching header table; keep diagnostic and recovery questions available.
Resolve the active Codemap provider's shared gates and context at runtime instead of shipping stale copies; degrade to Foundry's fallback when the optional provider is absent.
Set a 15-second timeout on SessionEnd task-log and audit-close hooks.
Update SessionEnd retention for PR-scoped numbered OSS review runs: expire individual runs after thirty days and remove empty PR parents while retaining legacy flat-run handling.
Extend Foundry audit and adversarial guidance to check producer-consumer handoffs and ordinary user actions, keeping evidence and authority gates active across the whole route.
Require each agent task to begin with a distinct delta-first name, description, and task-leading line; check duplicate slots and follow the live tool fields rather than stale examples.
Replace Foundry skill flag parsing based on Bash-only regex capture and ad hoc text matching with shared argument parsers that work under Zsh as well as Bash.
Add severity-weighted independent review and remediation loops with an original default cap of three iterations. Use score ratios to continue or stop; stop on structural findings or repeated failure signatures, and block completion or commits while security or critical findings remain open.
Replace synchronous or polling assumptions with background-spawn, end-turn, and completion-notification handling; preserve missing-output timeout reporting, update audit checks for the background contract.
Extract repeated Foundry skill shell blocks into Python helpers while leaving judgment steps, agent prompts, and output templates in the skills.
Fix install-state detection for Claude's nested installed-plugin registry shape, and let investigation contracts record tried and probed candidates for safe post-compaction resume.
Unify auto-allow decisions under ranked provenance and shape dispatch; append decision and completion audit records, and add canonical record hashing with verify/prune commands. Logs are not tamper-evident. Verification exits 1 for record-hash mismatch, while framing and schema findings remain warnings; unusable inputs exit 2.
Use ASCII status labels for success, no-op propagation, and orphan warnings so Foundry CLI output works on legacy Windows consoles.
Expand maintainer-facing contracts and executable examples for Foundry Python helpers, including bridge checks, resolver-site classification, cost analysis, and timing analysis.
Add severity/fix requirements and precision discipline across foundry agents (challenger, creator, curator, doc-scribe, solution-architect, sw-engineer, web-explorer) so every finding states severity, cites a named criterion, and speculative items are labelled rather than dropped
debugging.md (+_full): forbid dispatching foundry:challenger as subagent_type fork; challenger gets diff+symptom+spec only, no implementer reasoning trail
Stop after the same failure signature twice rather than exhausting the iteration cap; keep approved plans read-only during implementation unless the user explicitly authorizes revision.
Define spawn discipline in Foundry configuration: use work-displacement spawns only when expected work exceeds their overhead, while preserving isolation-motivated review and role spawns.
Propagate Foundry-owned quality-stack and cross-validation guidance into consumer plugins as namespaced files, with shared-file checks preventing drift.
Replace Foundry's legacy Codex rescue integration with explicit bridge implement, advise, and review calls, including unavailable and disabled behavior.
Resolve the active plugin registry's nested structure, distribute Foundry's availability detector to each independent consumer, and add an audit utility that compares local Bash transcripts with installed blueprint manifests.
Document Foundry's consumer-owned skills/_shared/codemap-context.md as the host for the v2 integration body, retaining v1 sentinels and read-only integration audit. It ships without a managed block until integration applies it.
Close sentinel-read auto-allow bypasses by rejecting unsafe shell functions, traversal, write redirection, and loader or lookup assignments; retain only validated read forms.
Add heal_git_artifacts.py to safely recover stale skill locks and orphaned Git worktrees, and propagate its canonical Foundry implementation through the shared-file manifest.
Anchor Foundry Codemap context and query paths at the repository root, and provide canonical consumer guidance plus audit checks for declared provider routes and CLI flags.
foundry:session becomes one inline skill with six modes — dump, recall, list, park, sweep, drop; park/sweep/drop are new, replacing the behavioural parking rule that only ever loaded on invocation and so never fired
hooks/carryover-restore.js renamed session-restore.js; store path, injection banner and the oversized-doc pointer now read /foundry:session recall <slug>; hooks.json SessionStart command updated
rules/compaction.md manual-sibling note, rules/foundry-config.md log table, and distill's slug-divergence guard no longer name removed skills or logs; calibrate/modes/skills.md had the same skill listed twice, bare and plugin-prefixed — the bare row is gone
README rows, mode listings, hook description, skill-directory count and test table synced in both plugins/cc_foundry/README.md and .claude/README.md; version 0.45.0 to 0.46.0
Compress duplicated bin-authoring gate wording across Foundry manage spawn prompts.
Replace the estimated compaction break-even with measured session observations.
Convert two Foundry audit/calibrate loader sites to the appropriate resolver calls; require Python variable documentation in #: comments where a docstring cannot bind.
Add an agent-budget note to Foundry spawn sites: account for fixed spawn overhead, avoid work-displacement spawns below break-even, and require partial results when an agent exhausts its call budget.
Extract Foundry's shared-document and mode loaders into Python bin helpers, replacing repeated resolve-then-cat blocks in skill bodies.
Bound supplementary Codemap queries to three and stop enumeration after a complete result while preserving required source reads; budget spawns and require honest partial-output envelopes.
Move subagent-type telemetry evidence and a worked failure example into rules/_full/CLAUDE-full.md, leaving the mandatory rule in the always-loaded stub.
Require evidence before factual claims and explicit disclosure when verification is unavailable; move worked rule detail to on-demand _full files while retaining mandatory stubs.
Move agent supplemental references into references/; re-key agent records so SubagentStop removes them, use separate worktree and non-worktree age limits, and strengthen audit Bash-correctness and efficiency checks.
Install Foundry rules under namespaced foundry-<name>.md links and migrate legacy links during setup.
Adopt a destination only when its target resolves within this Foundry install or its matching marketplace lineage; preserve links into other plugins, checkouts, or dotfiles as conflicts.
Give each plugin its own shared-file resolver and remove Foundry-path reach-ins from consumer workflows, so installed siblings can operate independently.
Add an orphaned-plugin-cache cleanup helper that reports by default and supports guarded explicit apply. Setup passes the displayed candidate count and aborts cleanup if that count changes.
foundry:audit — enforce-audit-header.js; also adds the report.md Write step Step 11 was missing entirely (Path: field pointed at a file nothing ever created); gates on summary.jsonl instead of report.md since report.md is written after the gate fires
foundry:profile — enforce-profile-header.js; parses REPORT_DIR out of the Step 1 KEY=VALUE state file
Add a Bash pre-tool hook that auto-allows only validated read-only sentinel and timestamp command substitutions; unsafe shell forms continue through normal permission checks.
Document the safe sentinel-read form and scope it to the active session and temporary directory.
Scope temporary sentinels to the current Claude session to prevent collisions across sessions and projects; move skill contracts and logs to their intended writable locations.
Replace emoji confidence bars with distinct plain fit and conf scores, add runtime-state write/delete permissions, and put unique task labels before spawn boilerplate.
Update the Foundry README rule table to match the confidence display.
fixes headless block: sync.sh runs claude --print /foundry:setup --approve, where a Write-tool permission prompt on ~/.claude/settings.json cannot be approved and hangs; in-bash writeback needs no tool prompt
Require code-touching agents to check declared dependency APIs before adding utilities and verify public symbols from the installed library rather than relying on memory.
Restrict the hook to push approval: force-push remains blocked, regular push needs a user-armed one-use token, and commits use the prompt authorization rule.
foundry: calibrate now confirms via AskUserQuestion before large fan-outs — mode-category scopes (all/agents/skills/plugins) always confirm since exact spawn count isn't knowable until Step 2; narrow scopes confirm past a 50-spawn threshold; --apply alone no longer bypasses this gate, only --skip-gate does
foundry: extract audit SKILL.md Steps 4/5/5b/7 into modes/steps-4-5-7.md (52KB to 37.8KB force-loaded on every invocation)
foundry: extract sw-engineer.md packaging/API-stability guidance into packaging-patterns.md, mirroring the existing hook-authoring.md pattern
Add explicit compaction checkpoints and preserve contracts to Foundry's phased workflows, with per-skill checkpoint data, optional keep-items, and cleanup on completion.
Layer 2 (judgment by domain): audit Step 3 now groups all of a plugin's files into one holistic foundry:curator for plugin scope, so cross-file breaks (tool-grant mismatch, contract splits, dead dispatch) that per-file batching misses get caught.
manage: /foundry:calibrate mandatory only on routing-surface (description/trigger) changes, not every content edit
Remove Foundry's redundant preflight-helper load, prune repeated deterministic curator checks and unused color metadata, and correct README and hook paths.
Add state.py set, load, and clear namespaces to persist small shell values across independent Bash calls.
Replace RTK command-prefix allowlisting with positive read-only checks for guarded commands; compound shell commands and unproven commands now pass to the normal permission matcher.
Add GitHub API mutation deny entries as defense in depth.
Use the most common case as the default shape for test-data factories, prefer plain functions for pure factory data, and flag newly duplicated code blocks across files.
Rename distill lessons mode to memory; process all projects by default, support an interactive project picker, and parallelize multi-project analysis and curator writes.
Centralize validated installed-root resolution, retain background agent tracking after dispatch, and introduce health-sentinel boilerplate plus an audit fix hierarchy.
Extract brainstorm breakdown into a mode file and include required descriptions when the agent router rewrites rerouted tool input.
foundry curator + audit: curator.md step 7 in §Code Block Authoring adds bash compression as P3 flag — multi-line if/fi with single body → &&/|| one-liner, _rc capture only when format string contains %d, ;-joined sequential single-assignment lines, WHY-only comment rule; audit/SKILL.md adds verbose-bash-block to PARALLEL_SAFE_CATEGORIES so compression fixes can run in parallel without cross-file reads
Add source-grounding rules to Foundry agent cards: verify behavioral claims against source or tests instead of memory or inference.
Register Codemap blast-radius calibration and identify it as the calibratable subtask of development workflows.
Print report YAML metadata first and exempt it from decorative boxes; offer a challenger review after substantive manage changes, with explicit trivial-edit and mode exemptions.
foundry/skills/brainstorm/SKILL.md — AQQ ≤4 cap compliance: branch selection via free-text reply, tree ops as category-picker with follow-up AQQ per category
plugins/CLAUDE.md — markdown annotation rule: > for prose comments in plugin .md files; # only inside code fences
Require both an architectural and a visual-domain signal before applying the CV/ML documentation checklist, and make architecture discovery language aware.
Persist brainstorm viewer state across Bash calls and prevent create outlines from overwriting existing files.
Harden native-Windows path serialization and containment, reject POSIX absolute paths during run-directory validation, handle home-directory fallback, and prevent duplicate feature dispatch for the same brainstorm specification.
Rename /foundry:init to /foundry:setup and update Foundry skill references.
Collect non-auto-fixable audit decisions before changes begin, add high-churn and recency guidance to commit review, and introduce a JSON writer plus health-sentinel updates.
Automatically arm the commit sentinel after an explicit user commit request; retain workflow and confirmation authorization, the separate default-branch question, and an independent authorization signal for push.
Add a registry-aware helper that resolves the active Foundry install path, plus root-cause debugging guidance and audit checks for executable boundaries and security risks.
Add extract_code_blocks.py and a bin-authoring guide for classifying fenced code and deciding when to extract scripts; use token estimates and explicit gate/score/verdict columns in audit Check 33.
Make audit Check 17 and efficiency Check 33 group code blocks by functional purpose, using syntactic similarity as a secondary signal; keep efficiency tables out of the base audit path.
Strengthen Foundry challenger findings with numbered, evidence-backed required changes; add calibration-only model-tier guidance and scaffold templates for skills and agents.
foundry:manage — plugin-prefixed invocations (/foundry:manage); jq replaces python3 for settings check; DIRECTIVE variable made explicit in content-edit mode
foundry:investigate — symptom/signals/hypothesis captured in bash vars before Codex spawn; inline Confidence block example; shell var refs replace literal placeholders in prompts
foundry:calibrate — graceful-exit protocol (safety-net result.jsonl on any crash/exit); CODEX_MODES variable fix; phase timeout hint injected into subagent prompts; Skill added to allowed-tools
Resolve the default branch dynamically and require its additional five-minute authorization sentinel alongside the ordinary fifteen-minute commit sentinel.
Reset statusline agent badges immediately on /clear; remove per-turn lock files and clean stale session directories without deleting live concurrent sessions.
Correct agent frontmatter names to unprefixed local names, quote skill argument hints for valid YAML, and register OSS analysis and release calibration targets.
Add a resilience rule that prevents a plugin's recovery mechanism from depending on the plugin it is meant to recover, and raise challenger and creator effort to xhigh.
Add a Codex cross-check to challenger with a --no-codex opt-out, convergence reporting, and surfaced failures; register Research verification cases for calibration.
Classify manage content edits as trivial or substantive before dispatch, and rename the CI guardian role to CI/CD steward throughout routing references.
Add a read-only, red-team challenger that tests plans and code across assumptions, missing cases, security, architecture, and complexity, then must attempt to refute each finding.
Add an external-resource mode to /distill that analyzes a plugin or skill from a URL or local path, compares it with the current setup, scores adoption candidates, and presents adopt, adapt, discuss, or skip choices.
Check for lesson conflicts before writing and show the resulting diff for review; start a fast calibration benchmark when the target has no prior run.
Deny sudo, SSH, world-writable permissions, and recursive force deletion in Foundry policy; add plugin audit checks for Bash correctness and dependency cycles.
Add a live browser tree viewer with JSON sidecar updates to brainstorm; require an approved design before implementation and distinguish rejected from resolved branches.
Add a screenshot of the brainstorm tree to the Foundry README.
Add a PreToolUse commit guard with a short-lived authorization sentinel and wire its lifecycle into /resolve; clarify report confidence templates and shared-file failure handling.
Make /foundry:audit converge through up to five fix and revalidation passes, report remaining findings when the cap is reached, and write per-pass cross-file validation results.
Establish plugins/foundry/ as the canonical distribution for agents, skills, hooks, and rules, with /foundry:init merging settings and linking or copying configuration into the host environment.
Move the team protocol, permissions guide, configuration, and shared rules into the plugin; replace former .claude/ files with links and remove duplicate permission and status-line configuration.
Namespace Foundry skill and agent dispatch references and repair broken setup links so the split plugin can resolve its own workflows and cross-plugin roles.