lukasrepublic
UserThe factory: a Claude Code plugin for governed, spec-driven delivery — frozen acceptance contracts and a merge floor that refuses a red seam.
Categories
Indexed Skills (36)
audit
DORMANT-INVOCABLE, non-default deep audit (/foundry:audit) via the native Workflow tool — a PHASED remediate-between-passes engine. The single-pass /foundry:spec-review (see skills/spec-review/SKILL.md) replaced this as the default review verb; this engine is kept for an EXCEPTIONAL deep audit only (operator-invoked, never automatic). Runs an ORDERED sequential sweep prior-art -> requirement-quality -> steel-man -> adversarial -> red-team (workflows/spec-audit.js, itself unmodified/dormant); after each phase a SEPARATE fresh-context reviser self-remediates the spec IN the engine, guarded by a deterministic control-plane. Per an internal assessment establishing that 0 of 17 real runs converged and every paying finding landed in rounds 1-2, this is no longer the audit-before-merge gate and is never invoked automatically.
authorize-release
Batch front-authorization review over a release's N atoms (/foundry:authorize-release) — ergonomics without relaxing PER-ATOM granularity. Displays every atom's acceptance-contract checkpoints, the operator confirms, and each atom is authorized singly via the standard /foundry:authorize flow. Trigger after release-DRAFT-shaping, before implement.
authorize
The Foundry front-authorization gate (/foundry:authorize). Display an atom's acceptance-contract checkpoints to the operator, get explicit confirmation, then freeze the operator-signed authorization (spec_sha256 + contract_sha256) onto acceptance-contract.yaml. The load-bearing v1 safety action — an un-authorized spec can never reach main. Trigger when the operator says "authorize <spec>", "/foundry:authorize", or after a contract is drafted at Specify-exit and before any implementation dispatch.
certify-local
Deploy a release ONCE locally and run its full tagged journey suite against that one instance (/foundry:certify-local <release>, introduced in the v0.25.0 certification realignment, CONSTITUTION.md §V factory-mode tail). Resolves the release manifest + the active stack profile's boot recipe, runs plain `npx playwright test --grep` over every atom's journey tags, and reports per-atom pass/fail with the runner's own output as evidence — no verdict engine, no custom evidence format. REFUSES (never a vacuous pass) naming the missing prerequisite when there is no journey suite or no boot recipe. Trigger to certify a release before recording operator acceptance.
certify-staging
Emit the staging certification checklist for a release (/foundry:certify-staging <release>, introduced in the v0.25.0 certification realignment, CONSTITUTION.md §V factory-mode tail). Fills context/staging-checklist-template.md from the release manifest + the staging binding in .claude/foundry-project.json, observes deploy state via the kept /foundry:deploy-status surface, and STOPS — promotion stays CD-owned and operator-gated. REFUSES naming the missing prerequisite when no `staging` binding exists in .claude/foundry-project.json. Trigger after certify-local + operator acceptance, before any staging→production promotion decision.
coherence-check
Advisory citation-coherence sweep over the direct-edit WORKSPACE corpus (/foundry:coherence-check). Builds the citation graph FRESH every run (no cache trust), then reports broken citations vs out-of-scope citations as deterministic JSON with a tri-state fail-closed exit. ADVISORY, NOT a merge gate — not part of the merge floor (ci.yml + btb-gates), not a branch-protection required status, never reads a PR-merged diff. Trigger to sweep the workspace corpus for dangling/malformed citations.
context
Context lifecycle as thin seams over native primitives (/foundry:context <snapshot|resume|list|status>). WRAP of the ctx-* skills — additive over native /compact, --resume, /rewind, and the context sensor; never reinvents transcript replay. Trigger to snapshot/resume a session's distilled arc-state or check context budget.
cut-release
Cut an agentic-foundry release as a guarded playbook (/foundry:cut-release). Encodes the hand-run cut procedure as a loop whose EXIT GATE is the existing acceptance verdict — verifies the ordered preconditions (plugin.json version, CHANGELOG section; the marketplace.json catalogue bump is deferred to the re-pin commit R2), refuses to emit any publish plan until run_acceptance returns pass, and only afterward emits the gotcha-correct publish plan (re-pin marketplace source.sha to the release commit → annotated tag on the re-pin commit → machine-verify the tag → push, never force) WITHOUT pushing. Trigger when the operator is cutting/releasing a version — "cut a release", "release v0.6.1", "/foundry:cut-release", "ship the release".
dashboards-as-code
Migrate a fleet of hand-built monitoring dashboards into version-controlled code with a MACHINE-CHECKED equivalence proof. The five-part harness: immutable golden originals → a typed emitter with a generic panel factory whose unknown-kind fallback FLAGS (never silently guesses) → a renderer back to platform JSON → a semantic-signature extractor → ONE shared definition of MATCH used by both the per-dashboard convert self-verify AND the fleet gate (scripts/foundry-dashboard-fidelity.py: N/N MATCH fail-closed). Platform-generic (a Grafana-style schemaVersioned export is the illustration). Carries the path-scoped CI wiring, the restricted-PSA job hardening, and the CSI-before-stateful-metrics-store + sidecar-egress ordering prerequisites. Trigger: "port the dashboards to code", "dashboards as code", "prove the dashboard migration is lossless", "/foundry:dashboards-as-code".
data-tier-cutover
The stateful-tier migration PROCEDURE skill — cut an app's SQL database + cache over from self-managed instances to a managed serverless target. A read-only procedure the generic agent runs alongside the id-* infra-delivery steps: it drives the fail-closed cutover-mechanism DECISION TREE (snapshot-restore vs CDC-replicate + fast-promote), the per-app connection-pool INVENTORY read from application source (never the deploy layer), the live-vs-committed VERIFICATION GATE (committed IaC defaults are NOT live truth — offline-green ≠ live-parity), fills one of the two parameterized RUNBOOK shapes (each with an explicit rollback column), and routes a BLOCKING security-reviewer pass for custodial tiers (per-store key-policy isolation). It authors plan artifacts and runbooks; it NEVER applies, restores, promotes, or mutates — every apply step in the emitted runbook is operator-run through the id-apply posture discipline. Trigger: "cut over the database", "migrate the data tier", "snapshot restore vs CDC", "/foundry:d
decommission-gate
The governed turn-off primitive — no legacy component is severed until its replacement has PROVEN independence and the old side is provably safe, recorded in an append-only operator-bound validation ledger the gate RE-DERIVES from live re-checks at turn-off time (fail-closed, waiver-blind). Drives scripts/foundry-decommission.py: validate-register (class-aware register, GENERATED gate_status), record (append-only ledger; refuses incomplete VALIDATED rows incl. the custody real-operation proof), gate-check (GO only on latest-VALIDATED + live reverify/old-safe re-checks under a forced waiver-blind phase; else NO-GO exit 1). Turn-off is structurally the LAST wave. Trigger: "decommission", "turn off the legacy", "is it safe to delete", "sever the old side", "/foundry:decommission-gate".
deploy-status
Observe-only deploy status (/foundry:deploy-status). Deploy is CD-owned (ArgoCD App-of-Apps, GitOps); Foundry OBSERVES sync + health AND cross-checks deployed-artifact identity vs the expected merged commit (STALE/NOT-ROLLED), it does not push deploys. Production deploy is operator-gated under BOTH modes. Trigger to check what's deployed / sync+health / whether the merged commit actually rolled, never to trigger a deploy.
dispatch
Dispatch one authorized atom's implementation to a worker via the NATIVE Agent tool (/foundry:dispatch). The lean replacement for the bespoke dispatch-queue + dispatch-agent stack — no queue/flock/manifest for SINGLE-REPO adopters. A MULTI-REPO adopter (workspace ⟷ product-clone) adds a minimal target_repo manifest + WorktreeCreate redirect + foundry-wt. Trigger to implement an AUTHORIZED atom in an isolated worktree, or point at workflows/release-wave.js for single-repo multi-atom fan-out.
doctor
Foundry health check (/foundry:doctor) — a thin, five-check probe (the v0.25.0 test-suite realignment shrank this from a 2,900-line drop-in-check registry to one file). Checks the plugin manifest loads, hooks.json parses with every referenced hook script present, every skills/*/SKILL.md frontmatter YAML-parses, the stack-profile lock (if any) resolves, and the operator registry resolves. Fails CLOSED for an operator-invoked check (exit non-zero on any hard failure); the --session-start cadence is advisory (fail-open, never wedges a session). Trigger when the operator says "/foundry:doctor", "foundry health check", or to diagnose why a session looks unhealthy.
drift-sweep
CURRENTLY DORMANT (named honestly — the scripts/foundry_drift_sweep.py engine this skill drives was retired and does not ship; this file is design intent for a re-implementation, not a live procedure). Advisory batch drift-suspect sweep — given a base->head system-state snapshot pair (from the system-state snapshot tool), lists every AUTHORIZED contract whose frozen system_grounding block (or, for atoms predating it, its spec body) still references a schema/module identifier the migration DROPPED or RENAMED. ADVISORY, NOT a merge gate — not part of the merge floor (ci.yml + btb-gates), is not a branch-protection required status, opens no grounding source itself. Trigger to sweep the AUTHORIZED-contract corpus for stale schema references after a migration lands.
env-hygiene
Environment-isolation-hygiene — own-scoped ephemeral-env lifecycle + teardown (/foundry:env-hygiene). Status of this session's owned dev/test resources (containers, kind/k3d/minikube clusters, LocalStack, dev servers) + the shared runtime daemon; on-demand own-scoped teardown; the reuse-before-start / label-what-you-start / pair-setup-with-teardown / never-stop-the-shared-runtime directive. Trigger to check what this session left running, tear down own resources, or learn the hygiene lifecycle.
extract-spec
Extract functional specifications FROM existing code (brownfield → spec). A read-only two-phase playbook — survey a codebase into a behavioral map, then promote a chosen capability into a CANDIDATE atomic spec in the industry-grounded template shape, routed through /foundry:intake (never a self-declared baseline). Trigger when the operator says "extract a spec from this code", "mine specs for <module>", "reverse-engineer a spec", "onboard this brownfield repo to specs", or "/foundry:extract-spec".
fleet
The single-pane session roster (/foundry:fleet) — every active Claude Code session joined to its foundry work-context (epic/atom/governance), over the NATIVE session list. Read-only/advisory. Trigger to see all your parallel sessions at a glance with their foundry context, or when supervising many sessions and asking "what is each one doing / which need a decision".
grounding-conformance
Advisory grounding-conformance backfill sweep — classifies every frozen acceptance-contract.yaml in the corpus as GROUNDED / UNGROUNDED / STALE against the current system-state snapshot (from the system-state snapshot tool), reusing the system_grounding contract block's structural AND consistency validators (the system_grounding validators), and emits a deterministic backfill worklist naming every non-conformant atom. ADVISORY, NOT a merge gate — not part of the merge floor (ci.yml + btb-gates), is not a branch-protection required status, never rewrites a frozen contract. Trigger to measure how much of the AUTHORIZED corpus is reality-grounded and to surface the atoms still needing a system_grounding block backfilled or re-audited.
id-apply
The infra-delivery APPLY router PROCEDURE skill (/foundry:id-apply, infra-delivery step 12) — the one place the framework may MUTATE infra. A PROCEDURE — it resolves the active stack profile, RE-DERIVES the GitOps class via classify_gitops(changed_paths, infra_binding) from the FROZEN change-scope × the profile's infra_binding.gitops_paths (never a caller bool), drives decide_apply (pure, total, fail-closed; REFUSE dominates and calls classify_gitops itself — no parameter offers a class override), and executes the chosen branch — EXECUTE (run the frozen infra_binding.apply — the default path), VERIFY_ONLY (GitOps; the ArgoCD controller mutates, the framework only verifies), or REFUSE (nothing emitted/run). The command run is ALWAYS the frozen infra_binding.apply verbatim (never freeform); the post-apply check is the DISTINCT read-only infra_binding.verify slot. The operator supplies a correctly configured AWS context; its IAM restrictions ARE the control the framework relies on and does not re-implement, veri
id-architect
The read-only forward-design ENTRY mode (infra-delivery step 2) — for "the app runs locally, there is NO deployment yet — design where it should run." Design a target infra topology from requirements (archetype × load projection × cost/ops/compliance → selected stack-profile(s)), then run the adversarial DESIGN-AUDIT loop to convergence BEFORE any IaC is written. A PROCEDURE skill the generic agent runs: its cost/quota/capability lookups are all read-only. It NEVER scaffolds IaC, applies, or provisions — id-architect designs + audits; the output is the audited topology design + a .foundry/id-architect-report design-audit STEP-REPORT NOTE (NOT walk-evidence, NOT a verdict input, no candidate-GREEN claim — this step runs no plan). ADVISORY craft FOR the operator; it is NOT a gate.
id-baseline
The read-only adopt-existing-IaC entry mode (infra-delivery step 2) — adopt an EXISTING OpenTofu/Terraform repo and VALIDATE it is drift-free against the live environment, proven by the acceptance seam `tofu plan == ∅` (the IaC equals reality). A PROCEDURE skill the generic agent runs: the `tofu plan` / `argocd app diff` reads are all read-only. It NEVER applies and NEVER auto-reconciles — adoption is read-only validation, proven by the empty diff; drift is SURFACED, never fixed. ADVISORY craft (produces a baseline/drift report + a `.foundry/`-partitioned drift step-report note; adoption VALIDATES, it does NOT claim a machine-adjudicated GREEN verdict — a change isn't being delivered, and the merge floor, branch protection + CI checks, is the merge authority).
id-discover
The everyday-change ENTRY survey (infra-delivery step 2 default) — a read-only inventory of the target infra (the relevant IaC roots + the in-scope live resources) plus the change surface the intended change touches, producing the change-scope report. A PROCEDURE skill the generic agent runs: the `tofu plan` / `argocd app diff` / `kubectl get` reads are all read-only, the id-baseline way. It NEVER applies, scaffolds, or reconciles — discovery is read-only survey + scope, nothing more. ADVISORY craft (produces the change-scope report + a `.foundry/`-partitioned survey step-report note; it surveys, it does NOT claim a machine-adjudicated GREEN verdict — the merge floor, branch protection + CI checks, is the merge authority).
id-document
The infra-delivery documentation step (step 16) — generate/update the change documentation (the change-record / ADR, the blast-radius summary, the runbook, the rollback note, and the changelog entry) a delivered IaC change requires, DERIVED from the RECORDED pre-merge plan step-report note + the plan summary and MATCHED to the surrounding repo's existing doc conventions. A read-only doc-output PROCEDURE skill the generic agent runs: it READS the recorded `.foundry/`-partitioned `id-plan` step-report note (`actions_detail`) as the source of what changed, reads the blast tier from the same recorded observation, and sources the rollback note from the realization-frame `id-rollback` incident path (git revert → reconcile → verify-landed) — NOT from the `infra_binding.apply` forward-mutation slot. It records its OWN output as a `.foundry/` doc step-report NOTE (`.foundry/id-document-report`), NOT walk-evidence and NOT a verdict input (the bespoke `emit_infra_walk_evidence` recorder this note is contrasted against w
id-drift
The infra-delivery RECURRING drift sentinel (post-spine) — a read-only forever drift check that re-runs the empty-plan seam (`tofu plan == ∅`) on a CADENCE to compare reality vs the merged IaC. It runs the active profile's `infra_binding.plan` as a read-only `tofu plan`, reads the per-resource plan delta from the canonical contractless parser `foundry_plan_model.parse_actions_detail`, and frames an empty plan as DRIFT-FREE / a non-empty plan as DRIFT — naming the diverging resources. It records its observation as a `.foundry/`-partitioned STEP-REPORT NOTE (`.foundry/id-drift-report`), NOT contract-keyed walk-evidence; there is no `argocd app diff` live read. ADVISORY craft — drift is SURFACED and handed to id-sync/id-rollback, NEVER auto-reconciled.
id-impact
Two advisory pre-merge reads of an infra-delivery change. (v2) The POLICY-RISK read — surface foundry_plan_model.parse_policy_findings output {rule, resource, severity, gating} and distinguish hard-FAIL-shaped (gating==deny) vs ackable-shaped (gating==warn ∧ severity==high ⇒ freeze a policy:high-blast-ack {rule, resource}) vs advisory, per the ADR C1 gating table. (v1, KEPT) The fast pre-policy blast_radius tier hint LOW / MEDIUM / HIGH (Karpenter-aware) — match each plan action against the active profile's machine-evaluable blast_radius rules. ADVISORY + read-only; it surfaces the findings + the tier hint for the operator/reviewer to weigh at the merge floor — the bespoke verdict machinery that once mechanically enforced the gating table was retired, so this read is not machine-enforced today (see docs/merge-floor.md).
id-implement
The infra-delivery change-authoring craft (step 5) — author/edit the IaC for the intended change ON A BRANCH, kept in sync with the frozen intended-change manifest (the `tofu-plan` checkpoint's operator-frozen `intended` set in the acceptance-contract). A PROCEDURE skill the generic agent runs: it WRITES files (scaffold/edit the OpenTofu/Kubernetes IaC to the handbook conventions) and runs NO plan and mutates NOTHING. The load-bearing discipline: the authored IaC is BRANCH-QUARANTINED (never `main`) and NEVER-APPLY (no `tofu apply`/`kubectl apply`/live mutation here), and it stays in sync with the frozen `intended` set so the downstream read-only `id-plan` plan can attribute it for the operator/reviewer. Records a `.foundry/id-implement-report` authoring STEP-REPORT NOTE — NOT walk-evidence, NOT a verdict input (the bespoke `emit_infra_walk_evidence` plan recorder this note is contrasted against was retired and does not exist in scripts/). ADVISORY craft, NOT a gate — the merge floor (branch protection + CI c
id-import
The read-only live-env → IaC import entry mode (infra-delivery step 2) — survey an existing AWS/Kubernetes environment that has NO IaC, codify it into OpenTofu/Kubernetes IaC, and prove fidelity by the acceptance seam `tofu plan == ∅` (the IaC equals reality). A PROCEDURE skill the generic agent runs: the `aws`/`tofu` reads are all read-only. It NEVER applies — import discovers + codifies, proven by the empty diff. ADVISORY craft (produces an IaC skeleton + a `.foundry/`-partitioned import step-report note; does NOT gate, approve, or block — the merge floor, the adopter's branch protection + CI checks, see docs/merge-floor.md, remains the merge authority).
id-plan
The infra-delivery PRE-MERGE seam PROCEDURE skill (/foundry:id-plan, infra-delivery step 8). A read-only PROCEDURE — it resolves the active stack profile, drives the profile's infra_binding.plan command strings READ-ONLY (tofu plan + kubectl --dry-run=server + argocd app diff) against the real environment, collects the structured plan/diff (candidate vs merge-base, attributable), and produces the review artifact + a `.foundry/`-partitioned plan STEP-REPORT NOTE. It NAMES infra_binding.plan as its command source and the review artifact as its output. It issues NO mutating verb and does NOT self-certify a PASS. Honest disclosure: the bespoke `emit_infra_walk_evidence` recorder / `derive_walk_verdict` verdict machinery this skill used to name as its evidence backend and verdict authority were retired and do not exist in scripts/ — the merge floor (the adopter's branch protection + CI checks, see docs/merge-floor.md) is the merge authority now. ADVISORY craft FOR the trusted operator; it does NOT gate, approve, o
id-promote
The infra-delivery cross-env PROMOTION orchestrator (step 16) — "this change passed in env N, carry it to env N+1 (e.g. staging→prod)." ADVISORY orchestration that RE-RUNS the existing per-env change-delivery loop in the TARGET env, adding NO new verdict. For the target env it re-derives the GitOps class via classify_gitops(changed_paths, infra_binding) from the frozen change scope × the target profile's infra_binding.gitops_paths, surfaces the ADVISORY id-impact v1 blast_radius hint (a DISPLAY hint for the operator, NOT a routing input — the dropped match_blast engine is NOT used), then drives id-apply's BUILT decide_apply(changed_paths, infra_binding) with its ACTUAL TWO inputs RE-DERIVED in the target env (changed_paths from the frozen change scope; infra_binding from the target profile — NEVER an env-N value, NEVER the removed blast_tier/high_blast_acked args; an unresolvable input REFUSEs, fail-closed). The EXECUTE branch runs the frozen infra_binding.apply against the AWS context the operator has alread
id-review
The infra-delivery two-lens advisory review procedure the generic agent runs at the infra-delivery review step (/foundry:id-review, infra-delivery review step / step 10 — the sd-review analog for infra). A PROCEDURE — it DISPATCHES the MERGED pr-reviewer general code lens (agents/pr-reviewer.md) ALWAYS, plus the security-reviewer security lens (agents/security-reviewer.md) WHEN the change touches auth/IAM, secrets/credentials, or supply-chain/dependencies, feeding both the infra context — the diff + the change's POLICY-RISK findings (parse_policy_findings) + the plan actions_detail ({address, action}) — as plan-as-DATA, then collates the categorized findings for the operator and surfaces the policy:high-blast-ack extra-approval expectation for the operator/reviewer to weigh (the bespoke merge-gate machinery that once re-derived this automatically was retired). It does NOT re-implement review (the agents own the review craft). Advisory, read-only: it surfaces findings; it does NOT gate, approve, or merge — the
id-rollback
The infra-delivery INCIDENT safe-revert PROCEDURE skill (the recurring/incident rollback step) — the PROCEDURE the generic agent runs when a delivered change did NOT land (a NOT-LANDED realization, an escaped defect, bad config) to restore the last-known-good IaC and prove reality matches it again. The shape is git revert -> reconcile -> verify-landed: revert the offending commit via the governed /foundry:revert (restoring the prior authorized IaC — the reused prior authorization, NOT a no-skip bypass; still subject to the merge floor), drive the GitOps controller's idempotent reconcile toward the REVERTED IaC PINNED to the reverted commit's candidate_sha (the merged-HEAD pin, never an arbitrary HEAD), then run the realization read and RECORD the realization observation via the DEDICATED post-deploy producer emit_realization_evidence(*, change_scope, candidate_sha, post_apply_plan_results, argocd_status, artifact) (scripts/foundry_realization.py, DC3 — a real, live producer) — recording {candidate_sha, post_a
id-simulate
The infra-delivery OFFLINE LOCAL-SIMULATION step (the new `simulate` step, between `id-test` and `id-plan`) — a PROCEDURE skill the generic agent runs ENTIRELY OFFLINE (no live cloud, no credentials) to author-and-prove the IaC corpus before the live pre-merge plan. Layer 1: `apply` the profile's EXISTING primitive OpenTofu modules against LocalStack via `tflocal` (or a provider-endpoint override) — proving they APPLY, not merely validate, honest about the CE-vs-Pro coverage boundary. Layer 2: stand up an ephemeral `kind`/`k3d` cluster, install ArgoCD, and reconcile the app-of-apps with Karpenter-`kwok` + ESO-fake — proving the GitOps structure reconciles. It records the local-sim observation as a `.foundry/`-partitioned STEP-REPORT NOTE (`.foundry/id-simulate-report`). ADVISORY — it surfaces the observation; it does NOT gate, approve, or merge (the merge floor, branch protection + CI checks, see docs/merge-floor.md, is the merge authority), and (running no `tofu plan` against live state) it records a STEP-RE
id-sync
The infra-delivery POST-MERGE GitOps reconcile-and-observe driver (step 13) — the PROCEDURE the generic agent runs AFTER merge (merge IS the deploy trigger) to drive the GitOps controller's idempotent reconcile toward the GATE-MERGED IaC, PINNED to the merged candidate_sha (argocd app sync/refresh, reusing the shipped candidate_sha/expected_sha staleness pin so the realization read is coupled to the merged commit, never an arbitrary HEAD), then READ the realized state and RECORD the realization observation via the DEDICATED post-deploy producer emit_realization_evidence (scripts/foundry_realization.py) — recording {candidate_sha, post_apply_plan_empty, argocd:{applicable, sync_status, health_status}, artifact:{applicable, deployed_identity, merged_commit}} that derive_realization_verdict consumes — NOT the pre-merge emit_infra_walk_evidence. BOTH ArgoCD axes via argocd_adjudicate (Synced ∧ Healthy ⇒ LANDED; a Degraded-but-Synced app must NOT green). never-force-sync is NOT machine-enforced (a --force/--prune
id-test
The infra-delivery TEST step (step 7) — run the active stack profile's EXISTING read-only `infra_binding.policy` slot (the policy-as-code / CONTRACT tests, `conftest test` / OPA over `kustomize build` / `helm template` output) backstopped by read-only `tofu validate`, against the change, and RECORD the pass/fail observation as a `.foundry/`-partitioned STEP-REPORT NOTE (`.foundry/id-test-report`). A PROCEDURE skill the generic agent runs: the `conftest test` + `tofu validate` reads are all read-only. It NEVER applies and NEVER auto-fixes — a failing test is reported, never fixed, and the live env is never mutated. It runs entirely offline — no live cloud account, no cluster, no credentials — and issues no mutating command. ADVISORY craft — it surfaces a pass/fail verdict to the operator + downstream steps; it does NOT gate, approve, or merge (the merge floor — the adopter's branch protection + CI checks, see docs/merge-floor.md — is the merge authority), and (running no `tofu plan`, having no plan-evidence su
id-validate
The read-only infra-delivery STATIC-VALIDATION step (step 6) — statically validate an infra change BEFORE the test/plan/merge steps. A PROCEDURE skill the generic agent runs: resolve the active stack profile, run the directly-allowlisted read-role `tofu validate` + `tofu fmt` verbs (the IaC is well-formed + canonically formatted) plus the active profile's EXISTING read-only `infra_binding.policy` slot (the render + conftest/OPA evaluation), all read-only, SURFACE violations, and record the validation observation as a `.foundry/id-validate-report` STEP-REPORT NOTE. Read-only/never-fix: it NEVER applies, edits the IaC, runs `tofu fmt -write`, or waves a violation through. ADVISORY craft — it does NOT gate, approve, or merge; the merge floor (the adopter's branch protection + CI checks, see docs/merge-floor.md) is the merge authority. Static validation runs no `tofu plan` (no `plan_results`), so it records a STEP-REPORT NOTE — the bespoke `emit_infra_walk_evidence` plan recorder this note used to be contrasted a
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.