claudiomaradonna/castrum
1
0
Fork 0
Code Issues Pull requests Activity Actions

docs(agents): upgrade agent-foundry to b04e778 #46

Merged
claudiomaradonna merged 1 commit from chore/foundry-upgrade-b04e778 into main 2026-11-12 09:07:51 +01:00
Conversation 0 Commits 1 Files changed 59 +1153 -523
motoko commented 2026-11-12 09:06:04 +01:00
Collaborator
Copy link

Why

The agent policy, skills and client settings come from Agent Foundry,
pinned at 6df8975. The source has since gained 102 commits: shared
skills for sandboxed runs, proofs on main and settling review findings,
a pull request template, OpenCode 2 plugins, and Claude Code settings
that keep secret files from agents. This brings the repository to
b04e778 through the foundry-upgrade skill's three-way merge.

What changed

  • Agents follow the source's policy and skills at b04e778. castrum's own
    AGENTS.md sections are unchanged, apart from saying "agent jail" for
    the container so it reads apart from Claude Code's sandbox.
  • Claude Code now refuses reads of generic secret files at every depth.
    It asks before edits to the agent policy files and before the landing
    merge, and runs Bash in its sandbox. In Manual and acceptEdits mode,
    sandboxed commands, ansible-playbook, ssh and git push included,
    no longer ask first. CONTRIBUTING § Working with coding agents says
    this, says what stays open, and says how an operator gets the prompt
    back.
  • OpenCode hooks run as OpenCode 2 plugins (the source's breaking
    change).
  • New pull requests on Forgejo get .forgejo/pull_request_template.md.

How to verify

  1. With the source cloned at b04e778, run
    <clone>/scripts/verify-agent-config.sh . on the branch. It prints
    agent configuration statically valid.
  2. Run make check: exit 0.
  3. Run git -C <clone> diff 6df8975 b04e778 against git diff main.
    Every file except AGENTS.md, CONTRIBUTING and the Record equals the
    source.

Steps 1 and 2 pass on this tip. make test, molecule and
tag_propagation, was not run because the agent environment has no
podman.

Considerations

The settings follow the source in full, sandbox included, by
deliberate choice. Three low wording findings from the second review
round are set aside as below the bar: "nothing asks" also covers the
landing merge, which still asks; a missing comma after socat; "the
remedy for each" also covers the missing-tool case, which has no remedy
in the guide.

## Why The agent policy, skills and client settings come from Agent Foundry, pinned at 6df8975. The source has since gained 102 commits: shared skills for sandboxed runs, proofs on main and settling review findings, a pull request template, OpenCode 2 plugins, and Claude Code settings that keep secret files from agents. This brings the repository to b04e778 through the `foundry-upgrade` skill's three-way merge. ## What changed - Agents follow the source's policy and skills at b04e778. castrum's own `AGENTS.md` sections are unchanged, apart from saying "agent jail" for the container so it reads apart from Claude Code's sandbox. - Claude Code now refuses reads of generic secret files at every depth. It asks before edits to the agent policy files and before the landing merge, and runs Bash in its sandbox. In Manual and `acceptEdits` mode, sandboxed commands, `ansible-playbook`, `ssh` and `git push` included, no longer ask first. CONTRIBUTING § Working with coding agents says this, says what stays open, and says how an operator gets the prompt back. - OpenCode hooks run as OpenCode 2 plugins (the source's breaking change). - New pull requests on Forgejo get `.forgejo/pull_request_template.md`. ## How to verify 1. With the source cloned at b04e778, run `<clone>/scripts/verify-agent-config.sh .` on the branch. It prints `agent configuration statically valid`. 2. Run `make check`: exit 0. 3. Run `git -C <clone> diff 6df8975 b04e778` against `git diff main`. Every file except `AGENTS.md`, CONTRIBUTING and the Record equals the source. Steps 1 and 2 pass on this tip. `make test`, molecule and `tag_propagation`, was not run because the agent environment has no podman. ## Considerations The settings follow the source in full, sandbox included, by deliberate choice. Three low wording findings from the second review round are set aside as below the bar: "nothing asks" also covers the landing merge, which still asks; a missing comma after `socat`; "the remedy for each" also covers the missing-tool case, which has no remedy in the guide. 
Merge Agent Foundry from 6df8975 to b04e778. The source's settings
now deny reads of secret files at every depth, ask before edits to
the agent policy and before landing merges, and turn on Claude Code's
sandbox; CONTRIBUTING says what that means for contributors, rootless
podman included.

Add the prove-on-main, run-sandboxed and settle-findings skills, move
the pull request form to .agents/templates/ and copy it to
.forgejo/, and run the OpenCode hooks as OpenCode 2 plugins.
claudiomaradonna deleted branch chore/foundry-upgrade-b04e778 2026-11-12 09:07:57 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
claudiomaradonna/castrum!46
No description provided.