chore(agents): upgrade Agent Foundry to 414f822 #66

Merged

claudiomaradonna merged 2 commits from chore/foundry-upgrade into master

2026-11-09 12:46:01 +01:00

motoko commented

2026-11-09 12:44:41 +01:00

Collaborator

Why

The agent policy comes from Agent Foundry, pinned in the foundry-upgrade skill's Record at 2546ee9 of 30 October. The source has since moved 48 commits: it extracted the procedures several skills repeated, moved rules from AGENTS.md into the skills and templates that hold their steps, and gave .claude/settings.json rules that keep secrets from Claude Code and turn its Bash sandbox on. Staying behind makes every later upgrade a larger merge, and the new rules protect every session on this repository. The upgrade follows the source's UPGRADING.md.

What changed

Agents find three new skills, prove-on-main, run-sandboxed, and settle-findings, which the workflow skills call instead of repeating their steps. AGENTS.md keeps the repository's own Architecture, Set-up, Test, and Quality gates text and takes the source's reordered rules; the Template lifecycle and Members sections stay out, as the adoption removed them.

Claude Code on this repository now refuses to read secret files such as .env and private keys, asks before git fetch, pull, and push, and runs every Bash command in its sandbox. A session inside a client container also needs sandbox.enableWeakerNestedSandbox in the container's Claude settings, which docs/development.md now says, pointing at Nested sandboxes.

How to verify

Build the claude image from the branch, launch it in this repository, and run a Bash command through Claude Code with sandbox.enableWeakerNestedSandbox set in the container's Claude settings. Expect it to run; without the setting, expect Can't mount proc on /newroot/proc.
Ask Claude Code to read .env or ~/.ssh/id_ed25519. Expect a refusal.

On the tip, make lint && .agents/hooks/shellcheck.sh repo && make test passes (57 scripts clean, 349 tests, 0 failures), the source's scripts/verify-agent-config.sh reports the configuration valid, and prettier --check passes on the changed Markdown. The branch adds no test: it changes policy text and settings only. Scenario 1 was checked by hand in a container, not by a test.

Considerations

Every changed file apart from AGENTS.md and docs/development.md is the source's byte for byte.

## Why The agent policy comes from Agent Foundry, pinned in the `foundry-upgrade` skill's Record at `2546ee9` of 30 October. The source has since moved 48 commits: it extracted the procedures several skills repeated, moved rules from `AGENTS.md` into the skills and templates that hold their steps, and gave `.claude/settings.json` rules that keep secrets from Claude Code and turn its Bash sandbox on. Staying behind makes every later upgrade a larger merge, and the new rules protect every session on this repository. The upgrade follows the source's `UPGRADING.md`. ## What changed Agents find three new skills, `prove-on-main`, `run-sandboxed`, and `settle-findings`, which the workflow skills call instead of repeating their steps. `AGENTS.md` keeps the repository's own Architecture, Set-up, Test, and Quality gates text and takes the source's reordered rules; the Template lifecycle and Members sections stay out, as the adoption removed them. Claude Code on this repository now refuses to read secret files such as `.env` and private keys, asks before `git fetch`, `pull`, and `push`, and runs every Bash command in its sandbox. A session inside a client container also needs `sandbox.enableWeakerNestedSandbox` in the container's Claude settings, which `docs/development.md` now says, pointing at Nested sandboxes. ## How to verify 1. Build the `claude` image from the branch, launch it in this repository, and run a Bash command through Claude Code with `sandbox.enableWeakerNestedSandbox` set in the container's Claude settings. Expect it to run; without the setting, expect `Can't mount proc on /newroot/proc`. 2. Ask Claude Code to read `.env` or `~/.ssh/id_ed25519`. Expect a refusal. On the tip, `make lint && .agents/hooks/shellcheck.sh repo && make test` passes (57 scripts clean, 349 tests, 0 failures), the source's `scripts/verify-agent-config.sh` reports the configuration valid, and `prettier --check` passes on the changed Markdown. The branch adds no test: it changes policy text and settings only. Scenario 1 was checked by hand in a container, not by a test. ## Considerations Every changed file apart from `AGENTS.md` and `docs/development.md` is the source's byte for byte.

motoko added 2 commits

2026-11-09 12:44:44 +01:00

chore(agents): upgrade Agent Foundry to 414f822 84a265eb47

Merge the source from 2546ee9 to 414f822 as its UPGRADING.md directs.
The source extracts three shared skills, prove-on-main, run-sandboxed,
and settle-findings, moves the rules AGENTS.md held on reports,
workflow start points, and work folders into the skills and templates
that hold their steps, and lets run-sandboxed.sh run a member with -C.

.claude/settings.json now denies reads of secret files, asks before
git's network commands, and turns Claude Code's Bash sandbox on, as the
user chose; in a client container the sandbox needs
sandbox.enableWeakerNestedSandbox in the developer's local settings.

The Template lifecycle and Members sections stay out, as the adoption
removes them.

docs(development): say the repository turns Claude's sandbox on 44ca78a12a

The upgrade's .claude/settings.json turns Claude Code's Bash sandbox on
for every contributor who opens the repository in Claude Code. In a
client container that sandbox fails on every command until the weaker
nested sandbox is set, which only configuration.md explained, with no
pointer from the development guide to this repository's setting.

claudiomaradonna merged commit 44ca78a12a into master

2026-11-09 12:46:01 +01:00

claudiomaradonna deleted branch chore/foundry-upgrade

2026-11-09 12:46:07 +01:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

claudiomaradonna/azkaban!66

No description provided.

Rows
Columns