docs(agents): upgrade agent-foundry to 6df8975 #43

Merged

claudiomaradonna merged 1 commit from docs/foundry-6df8975 into main 2026-10-22 09:14:37 +02:00

Conversation 0 Commits 1 Files changed 41 +752 -213

motoko commented 2026-10-21 18:05:46 +02:00

Collaborator

Copy link

Why

castrum's agent policy sits at Agent Foundry 4545b66 (8e39ec8); the
source has since added a main-checkout guard, sandboxed runs of others'
code, and issue triage. This brings it to 6df8975 through the
foundry-upgrade skill.

What changed

• A hook in Claude Code, Codex and OpenCode refuses edits in the main
  checkout, so changes happen in .worktrees/.
• review-pr, check-issue and outside-built diagnose reproductions
  run code only in a bubblewrap sandbox; the new check-issue skill
  triages an issue into a verdict.
• The review form moves to .agents/templates/review.md; later review
  rounds report earlier findings in the report's Verdict.
• AGENTS.md gains the source's rules on remotes, pull-request approval
  and writing in English; castrum's project sections are unchanged.
• Breaking for Claude Code users: .claude/settings.json denies
  Workflow, ScheduleWakeup, ReportFindings and ListAgents, which
  turns off /loop, Workflow runs and /code-review findings.
• CONTRIBUTING.md names what a workstation needs for the agents: jq
  for the hooks, bubblewrap for sandboxed runs, and Codex hook trust.

How to verify

• make verify from the repository root: passes (needs podman).
• <agent-foundry>/scripts/verify-agent-config.sh . from a source
  checkout at 6df8975: prints agent configuration statically valid.
• In Claude Code on the main checkout, an edit to a tracked file is
  refused; the same edit in a worktree goes through.

Run: the source validator (pass), make check (pass),
git diff --check origin/main (clean). Not run: make test and
make verify, since the agent sandbox has no podman.

Considerations

Codex users trust the new hooks in /hooks on each workstation once
this lands; Codex skips them until then.

## Why castrum's agent policy sits at Agent Foundry 4545b66 (8e39ec8); the source has since added a main-checkout guard, sandboxed runs of others' code, and issue triage. This brings it to 6df8975 through the `foundry-upgrade` skill. ## What changed - A hook in Claude Code, Codex and OpenCode refuses edits in the main checkout, so changes happen in `.worktrees/`. - `review-pr`, `check-issue` and outside-built `diagnose` reproductions run code only in a bubblewrap sandbox; the new `check-issue` skill triages an issue into a verdict. - The review form moves to `.agents/templates/review.md`; later review rounds report earlier findings in the report's Verdict. - `AGENTS.md` gains the source's rules on remotes, pull-request approval and writing in English; castrum's project sections are unchanged. - Breaking for Claude Code users: `.claude/settings.json` denies `Workflow`, `ScheduleWakeup`, `ReportFindings` and `ListAgents`, which turns off `/loop`, Workflow runs and `/code-review` findings. - `CONTRIBUTING.md` names what a workstation needs for the agents: `jq` for the hooks, bubblewrap for sandboxed runs, and Codex hook trust. ## How to verify - `make verify` from the repository root: passes (needs podman). - `<agent-foundry>/scripts/verify-agent-config.sh .` from a source checkout at 6df8975: prints `agent configuration statically valid`. - In Claude Code on the main checkout, an edit to a tracked file is refused; the same edit in a worktree goes through. Run: the source validator (pass), `make check` (pass), `git diff --check origin/main` (clean). Not run: `make test` and `make verify`, since the agent sandbox has no podman. ## Considerations Codex users trust the new hooks in `/hooks` on each workstation once this lands; Codex skips them until then.

motoko added 1 commit 2026-10-21 18:05:48 +02:00

docs(agents): upgrade agent-foundry to 6df8975 ... 17b87d9e4a

Merge Agent Foundry from 33160c4 to 6df8975 three ways. Work now runs
through workflow skills (implement-feature, fix-bug, refactor-code,
document-feature, check-issue) and shared actions, with a single work
file template in .agents/templates/ in place of designs and plans.

AGENTS.md takes the source's sections by question. The project's
architecture, set-up, test, and gate text move into the Architecture
and How to interact with the project sections, and the Ansible
conventions, sandbox, and lint rules become Project rules. The Test
subsection names the levels, as the user chose: the behavior gates in
tests/gates/ are unit tests, the molecule scenarios integration. The
memory fields go, since the source no longer ships memory and this
repository had it off.

docs-auditor becomes document-reviewer, security-reviewer joins, and a
hook in each client refuses edits in the main checkout. Claude Code
denies Workflow, ScheduleWakeup, ReportFindings, and ListAgents, as the
user chose, and turns off auto memory.

motoko force-pushed docs/foundry-6df8975 from 17b87d9e4a to 234ee67a4d 2026-10-21 18:22:40 +02:00 Compare

claudiomaradonna merged commit 234ee67a4d into main 2026-10-22 09:14:37 +02:00

claudiomaradonna deleted branch docs/foundry-6df8975 2026-10-22 09:14:46 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

claudiomaradonna/castrum!43

No description provided.