foundry

One-step re-freeze of a living, already-authorized spec (/foundry:amend). Recomputes spec_sha256/contract_sha256, bumps auth_seq, and records the amendment WITHOUT an operator step — unless the change widens a boundary (scope, checkpoint intended/ack, system_grounding, an identifier token in a checkpoint locator/expect.value, or a checkpoint-rigor reduction) or the contract's mandatory_review names a security review, in which case it refuses and routes to /foundry:authorize. Trigger when the operator or agent says "amend <spec>", "/foundry:amend", or implementation reality has changed an authorized spec's normative text or its contract after /foundry:authorize already ran.

DORMANT-INVOCABLE, non-default deep audit (/foundry:audit) via the native Workflow tool — a PHASED remediate-between-passes engine. The single-pass /foundry:spec-review (see skills/spec-review/SKILL.md) replaced this as the default review verb; this engine is kept for an EXCEPTIONAL deep audit only (operator-invoked, never automatic). Runs an ORDERED sequential sweep prior-art -> requirement-quality -> steel-man -> adversarial -> red-team (workflows/spec-audit.js, itself unmodified/dormant); after each phase a SEPARATE fresh-context reviser self-remediates the spec IN the engine, guarded by a deterministic control-plane. Per an internal assessment establishing that 0 of 17 real runs converged and every paying finding landed in rounds 1-2, this is no longer the audit-before-merge gate and is never invoked automatically.

The Foundry front-authorization gate (/foundry:authorize). Display an atom's acceptance-contract checkpoints to the operator, get explicit confirmation, then freeze the operator-signed authorization (spec_sha256 + contract_sha256) onto acceptance-contract.yaml. The load-bearing v1 safety action — an un-authorized spec can never reach main. Trigger when the operator says "authorize <spec>", "/foundry:authorize", or after a contract is drafted at Specify-exit and before any implementation dispatch.

Release-level authorization DASHBOARD (/foundry:authorize-release) — displays the release's atoms with their routed lane (charter/factory) and readiness, then routes ONLY the next unblocked atom (all depends_on satisfied) to a single just-in-time /foundry:authorize invocation. The bulk-signing loop is RETIRED — there is no bulk script and no "authorize the release" shortcut; foundry-authorize.py takes exactly one --spec/--contract pair per call. Trigger after release-DRAFT-shaping, before implement.

Deploy a release ONCE locally and run its full tagged journey suite against that one instance (/foundry:certify-local <release>, introduced in the v0.25.0 certification realignment, CONSTITUTION.md §V factory-mode tail). Resolves the release manifest + the active stack profile's boot recipe, runs plain `npx playwright test --grep` over every atom's journey tags, and reports per-atom pass/fail with the runner's own output as evidence — no verdict engine, no custom evidence format. REFUSES (never a vacuous pass) naming the missing prerequisite when there is no journey suite or no boot recipe. Trigger to certify a release before recording operator acceptance.

Emit the staging certification checklist for a release (/foundry:certify-staging <release>, introduced in the v0.25.0 certification realignment, CONSTITUTION.md §V factory-mode tail). Fills context/staging-checklist-template.md from the release manifest + the staging binding in .claude/foundry-project.json, observes deploy state via the kept /foundry:deploy-status surface, and STOPS — promotion stays CD-owned and operator-gated. REFUSES naming the missing prerequisite when no `staging` binding exists in .claude/foundry-project.json. Trigger after certify-local + operator acceptance, before any staging→production promotion decision.

Advisory citation-coherence sweep over the direct-edit WORKSPACE corpus (/foundry:coherence-check). Builds the citation graph FRESH every run (no cache trust), then reports broken citations vs out-of-scope citations as deterministic JSON with a tri-state fail-closed exit. ADVISORY, NOT a merge gate — not part of the merge floor (ci.yml + btb-gates), not a branch-protection required status, never reads a PR-merged diff. Trigger to sweep the workspace corpus for dangling/malformed citations.

The programme-level command deck (/foundry:command-deck <programme-id>) — arm a recurring watcher that drives one release forward unattended, then manage it with the subcommands status | stop | restart | tick | prompt | list. Each tick re-measures the ready-set from disk, dispatches what the wave barrier has unblocked, verifies independently, lands what passes, and reports Accomplishments / Next / Blockers. Trigger on "command deck", "/foundry:command-deck", "watch this programme", "arm the watcher", "drive this release unattended", "start the command deck", "stop the watcher", "is the watcher running", "re-arm the deck". NOT /foundry:mode-autonomous, which is the per-wave IMPLEMENTATION driver for an already-authorized release and holds the merge-authority record; reach for the command deck when you want a CLOCK over a whole programme and one executive status per tick, and for mode-autonomous when you are driving one authorized release's atoms through implementation right now.

Context lifecycle as thin seams over native primitives (/foundry:context <snapshot|resume|list|status>). WRAP of the retired context-lifecycle skills — additive over native /compact, --resume, /rewind, and the context sensor; never reinvents transcript replay. Trigger to snapshot/resume a session's distilled arc-state or check context budget.

Cut an agentic-foundry release as a guarded playbook (/foundry:cut-release). Encodes the hand-run cut procedure as a loop whose EXIT GATE is the existing acceptance verdict — verifies the ordered preconditions (plugin.json version, CHANGELOG section, clean tree, and the candidate tree's own test suite; note the preflight TOLERATES a marketplace.json catalogue version left at the preceding release but the acceptance gate HARD-STOPS on it, so the catalogue bumps in R and only source.sha defers to the re-pin commit R2), refuses to emit any publish plan until run_acceptance returns pass, and only afterward emits the gotcha-correct publish plan (re-pin marketplace source.sha to the release commit → annotated tag on the re-pin commit → machine-verify the tag → push, never force) WITHOUT pushing. Trigger when the operator is cutting/releasing a version — "cut a release", "release v0.6.1", "/foundry:cut-release", "ship the release".

Migrate a fleet of hand-built monitoring dashboards into version-controlled code with a MACHINE-CHECKED equivalence proof. The five-part harness: immutable golden originals → a typed emitter with a generic panel factory whose unknown-kind fallback FLAGS (never silently guesses) → a renderer back to platform JSON → a semantic-signature extractor → ONE shared definition of MATCH used by both the per-dashboard convert self-verify AND the fleet gate (scripts/foundry-dashboard-fidelity.py: N/N MATCH fail-closed). Platform-generic (a Grafana-style schemaVersioned export is the illustration). Carries the path-scoped CI wiring, the restricted-PSA job hardening, and the CSI-before-stateful-metrics-store + sidecar-egress ordering prerequisites. Trigger: "port the dashboards to code", "dashboards as code", "prove the dashboard migration is lossless", "/foundry:dashboards-as-code".

The governed turn-off primitive — no legacy component is severed until its replacement has PROVEN independence and the old side is provably safe, recorded in an append-only operator-bound validation ledger the gate RE-DERIVES from live re-checks at turn-off time (fail-closed, waiver-blind). Drives scripts/foundry-decommission.py: validate-register (class-aware register, GENERATED gate_status), record (append-only ledger; refuses incomplete VALIDATED rows incl. the custody real-operation proof), gate-check (GO only on latest-VALIDATED + live reverify/old-safe re-checks under a forced waiver-blind phase; else NO-GO exit 1). Turn-off is structurally the LAST wave. Trigger: "decommission", "turn off the legacy", "is it safe to delete", "sever the old side", "/foundry:decommission-gate".

Observe-only deploy status (/foundry:deploy-status). Deploy is CD-owned (ArgoCD App-of-Apps, GitOps); Foundry OBSERVES sync + health AND cross-checks deployed-artifact identity vs the expected merged commit (STALE/NOT-ROLLED), it does not push deploys. Production deploy is operator-gated under BOTH modes. Trigger to check what's deployed / sync+health / whether the merged commit actually rolled, never to trigger a deploy.

Dispatch one authorized atom's implementation to a worker via the NATIVE Agent tool (/foundry:dispatch). The lean replacement for the bespoke dispatch-queue + dispatch-agent stack — no queue/flock/manifest for SINGLE-REPO adopters. A MULTI-REPO adopter (workspace ⟷ product-clone) adds a minimal target_repo manifest + WorktreeCreate redirect + foundry-wt. Trigger to implement an AUTHORIZED atom in an isolated worktree, or point at workflows/release-wave.js for single-repo multi-atom fan-out.

Foundry health check (/foundry:doctor) — a thin, six-check probe (the v0.25.0 test-suite realignment shrank this from a 2,900-line drop-in-check registry to one file). Checks the plugin manifest loads, hooks.json parses with every referenced hook script present, every skills/*/SKILL.md frontmatter YAML-parses, the stack-profile lock (if any) resolves, the operator registry resolves, and the control-plane preflight (no dangling repos{} path, no ancestor manifest already governing this project dir). Plus three advisory-only lines never counted toward RED — permissions-policy, agent-teams, and branches. Fails CLOSED for an operator-invoked check (exit non-zero on any hard failure); the --session-start cadence is advisory (fail-open, never wedges a session). Trigger when the operator says "/foundry:doctor", "foundry health check", or to diagnose why a session looks unhealthy.

CURRENTLY DORMANT (named honestly — the scripts/foundry_drift_sweep.py engine this skill drives was retired and does not ship; this file is design intent for a re-implementation, not a live procedure). Advisory batch drift-suspect sweep — given a base->head system-state snapshot pair (from the system-state snapshot tool), lists every AUTHORIZED contract whose frozen system_grounding block (or, for atoms predating it, its spec body) still references a schema/module identifier the migration DROPPED or RENAMED. ADVISORY, NOT a merge gate — not part of the merge floor (ci.yml + btb-gates), is not a branch-protection required status, opens no grounding source itself. Trigger to sweep the AUTHORIZED-contract corpus for stale schema references after a migration lands.

Environment-isolation-hygiene — own-scoped ephemeral-env lifecycle + teardown (/foundry:env-hygiene). Status of this session's owned dev/test resources (containers, kind/k3d/minikube clusters, LocalStack, dev servers) + the shared runtime daemon; on-demand own-scoped teardown; the reuse-before-start / label-what-you-start / pair-setup-with-teardown / never-stop-the-shared-runtime directive. Trigger to check what this session left running, tear down own resources, or learn the hygiene lifecycle.

Extract functional specifications FROM existing code (brownfield → spec). A read-only two-phase playbook — survey a codebase into a behavioral map, then promote a chosen capability into a CANDIDATE atomic spec in the industry-grounded template shape, routed through /foundry:intake (never a self-declared baseline). Trigger when the operator says "extract a spec from this code", "mine specs for <module>", "reverse-engineer a spec", "onboard this brownfield repo to specs", or "/foundry:extract-spec".

The session roster (/foundry:fleet) — native `/list-agents` annotated with each row's foundry programme, over the NATIVE session/container list. Read-only/advisory. Trigger to see all your parallel sessions and containers at a glance with their foundry context, or when supervising many sessions and asking "what is each one doing".

Advisory grounding-conformance backfill sweep — classifies every frozen acceptance-contract.yaml in the corpus as GROUNDED / UNGROUNDED / STALE against the current system-state snapshot (from the system-state snapshot tool), reusing the system_grounding contract block's structural AND consistency validators (the system_grounding validators), and emits a deterministic backfill worklist naming every non-conformant atom. ADVISORY, NOT a merge gate — not part of the merge floor (ci.yml + btb-gates), is not a branch-protection required status, never rewrites a frozen contract. Trigger to measure how much of the AUTHORIZED corpus is reality-grounded and to surface the atoms still needing a system_grounding block backfilled or re-audited.

The read-only forward-design ENTRY mode (infra-delivery step 2) — for "the app runs locally, there is NO deployment yet — design where it should run." Design a target infra topology from requirements (archetype × load projection × cost/ops/compliance → selected stack-profile(s)), then run the adversarial DESIGN-AUDIT loop to convergence BEFORE any IaC is written. A PROCEDURE skill the generic agent runs: its cost/quota/capability lookups are all read-only. It NEVER scaffolds IaC, applies, or provisions — id-architect designs + audits; the output is the audited topology design + a .foundry/id-architect-report design-audit STEP-REPORT NOTE (NOT walk-evidence, NOT a verdict input, no candidate-GREEN claim — this step runs no plan). ADVISORY craft FOR the operator; it is NOT a gate.

The read-only adopt-existing-IaC entry mode (infra-delivery step 2) — adopt an EXISTING OpenTofu/Terraform repo and VALIDATE it is drift-free against the live environment, proven by the acceptance seam `tofu plan == ∅` (the IaC equals reality). A PROCEDURE skill the generic agent runs: the `tofu plan` / `argocd app diff` reads are all read-only. It NEVER applies and NEVER auto-reconciles — adoption is read-only validation, proven by the empty diff; drift is SURFACED, never fixed. ADVISORY craft (produces a baseline/drift report + a `.foundry/`-partitioned drift step-report note; adoption VALIDATES, it does NOT claim a machine-adjudicated GREEN verdict — a change isn't being delivered, and the merge floor, branch protection + CI checks, is the merge authority).

The everyday-change ENTRY survey (infra-delivery step 2 default) — a read-only inventory of the target infra (the relevant IaC roots + the in-scope live resources) plus the change surface the intended change touches, producing the change-scope report. A PROCEDURE skill the generic agent runs: the `tofu plan` / `argocd app diff` / `kubectl get` reads are all read-only, the id-baseline way. It NEVER applies, scaffolds, or reconciles — discovery is read-only survey + scope, nothing more. ADVISORY craft (produces the change-scope report + a `.foundry/`-partitioned survey step-report note; it surveys, it does NOT claim a machine-adjudicated GREEN verdict — the merge floor, branch protection + CI checks, is the merge authority).

The infra-delivery RECURRING drift sentinel (post-spine) — a read-only forever drift check that re-runs the empty-plan seam (`tofu plan == ∅`) on a CADENCE to compare reality vs the merged IaC. It runs the active profile's `infra_binding.plan` as a read-only `tofu plan`, reads the per-resource plan delta from the canonical contractless parser `foundry_plan_model.parse_actions_detail`, and frames an empty plan as DRIFT-FREE / a non-empty plan as DRIFT — naming the diverging resources. It records its observation as a `.foundry/`-partitioned STEP-REPORT NOTE (`.foundry/id-drift-report`), NOT contract-keyed walk-evidence; there is no `argocd app diff` live read. ADVISORY craft — drift is SURFACED and handed to id-sync/id-rollback, NEVER auto-reconciled.

Two advisory pre-merge reads of an infra-delivery change. (v2) The POLICY-RISK read — surface foundry_plan_model.parse_policy_findings output {rule, resource, severity, gating} and distinguish hard-FAIL-shaped (gating==deny) vs ackable-shaped (gating==warn ∧ severity==high ⇒ freeze a policy:high-blast-ack {rule, resource}) vs advisory, per the ADR C1 gating table. (v1, KEPT) The fast pre-policy blast_radius tier hint LOW / MEDIUM / HIGH (Karpenter-aware) — match each plan action against the active profile's machine-evaluable blast_radius rules. ADVISORY + read-only; it surfaces the findings + the tier hint for the operator/reviewer to weigh at the merge floor — the bespoke verdict machinery that once mechanically enforced the gating table was retired, so this read is not machine-enforced today (see docs/merge-floor.md).

The read-only live-env → IaC import entry mode (infra-delivery step 2) — survey an existing AWS/Kubernetes environment that has NO IaC, codify it into OpenTofu/Kubernetes IaC, and prove fidelity by the acceptance seam `tofu plan == ∅` (the IaC equals reality). A PROCEDURE skill the generic agent runs: the `aws`/`tofu` reads are all read-only. It NEVER applies — import discovers + codifies, proven by the empty diff. ADVISORY craft (produces an IaC skeleton + a `.foundry/`-partitioned import step-report note; does NOT gate, approve, or block — the merge floor, the adopter's branch protection + CI checks, see docs/merge-floor.md, remains the merge authority).

List the foundry machinery — a read-only catalog of every skill, playbook, and agent with how to trigger it (/foundry:index). Derives name → machinery → trigger from the skills/agents frontmatter, computed on demand so it never drifts. Trigger when the operator asks "what can I run", "list the foundry machinery / skills / commands", "show the catalog / index", "what playbooks are there", "/foundry:index".

Adopter scaffolder (/foundry:init). Stands up a new adopting project's Foundry wiring — operator registry, per-project gh identity isolation (multi-account machines), the app-exercise binding (the live-seam driver map, the generic analog of `make dev`), env/identity mapping — then fail-closes via /foundry:doctor. Branch-protection-as-CODE is retired pending a Rulesets-API rebuild; Tier A itself is NOT retired — it is applied by hand and is live on this framework's own main. An adopter who has not applied it is on Tier B advisory (ci.yml + btb-gates) + the git-discipline gh clause. Trigger when onboarding a new repo to Foundry, or extracting Foundry to a standalone plugin repo.

The front door (/foundry:intake, phase 0 of the pipeline). Ingest a fuzzy input (prose, a human-written spec, a PRD, a Figma/Claude-Design export, an MCP connector) → interactive discovery → a deterministic LLM-authored atomic spec ready for the single-pass spec-review + front-authorization. Trigger to turn a fuzzy ask into a spec the factory can build.

The direct/lean interactive-session learnings PRODUCER (/foundry:learn-capture). Normally automatic — an enforced once-per-session Stop hook injects a reflection turn that distills the session and emits records via the capture CLI into the .foundry/session-learnings partition /foundry:learn-distill consumes. This skill documents that mechanism + the manual capture escape hatch. Trigger to capture the current session's learnings on demand, or to understand the Stop-reflection producer.

Cluster session-learning records into HBK/memory/skill candidates (/foundry:learn-distill), on a native-scheduled cadence. The distill consumer (token-overlap clustering, deterministic) is CUSTOM; the CADENCE is a WRAP over native ScheduleWakeup/CronCreate. Trigger on the scheduled tick or when the operator asks for a cluster report.

The one primitive that replaces sleep-then-poll around a merge (/foundry:merge-when-green <pr>). Polls `gh pr checks <pr>` and `gh pr view <pr> --json mergeStateStatus` and merges via the single already-permitted `gh pr merge <pr> --squash` shape the instant every check has concluded pass AND mergeStateStatus is CLEAN; blocks naming a failing check or a behind-main state (remediation `git rebase origin/main`); escalates ONCE with evidence when no check will ever report at all. Trigger instead of a hand-rolled sleep-then-retry loop, whenever a PR's checks need to be waited on before merging — "wait for PR <n> to go green and merge it", "/foundry:merge-when-green <pr>", or a driver about to land an atom whose checks are still pending.

The autonomous implementation driver (/foundry:mode-autonomous). WRAP composing the native /loop (outer session cadence) + the foundry-release-wave Workflow (per-wave fan-out) + the native merge floor (ci.yml + btb-gates). Replaces impl-wizard's impl-progress.yaml wave-state with the Workflow journal + native scheduling. Trigger to drive an authorized release's atoms toward merge (the auto-merge grant was RESTORED 2026-08-13 by operator decision, bounded by the git-discipline hook's checks-green clause — --admin stays blocked outright and a plain merge needs every check passing). NOT /foundry:command-deck, which is the PROGRAMME-level clock — a recurring watcher armed over one release that re-measures, dispatches and reports once per tick; reach for this one when you are driving an already-authorized release's atoms through implementation right now, and for the command deck when you want a programme watched unattended.

The interactive implementation posture (/foundry:mode-interactive) — the default lean direct loop. The operator drives edit→verify→merge in one accountable context; the operator reviews the diff at the merge button (the Regular-mode segregation). Sibling of mode-autonomous; they differ ONLY at the two ends (who paces, who approves the merge).

The release lifecycle operator surface (/foundry:release, release-manager). Shape a release (release.yaml manifest + dependency graph), drive its backlog→planned→active→completed state machine, and CLOSE it through the evidence-derived closure gate (refused on assertion; re-derived per atom from authorized (recompute-match) + merged-on-main, fail-closed). Trigger to create/inspect a release, advance its state, or close it. Complements /foundry:authorize-release (gate-in) and release-wave/mode-autonomous (wave).

Re-lock the stack-profile lock after a trusted profile-version advance (/foundry:relock). When `/foundry:doctor` shows a `stack-profile` RED because a profile in `packs/` advanced (e.g. aws-eks-karpenter 0.3.0→0.4.0) and `.foundry/stack-profile.lock` still pins the old version/sha, this re-resolves the ALREADY-locked profiles against `packs/` and atomically re-writes the lock with their current {version, sha256, blueprints_sha256} — validate-before-write, refusing a downgrade / invalid / core-incompatible profile. Trigger after a `claude plugin update` bumped a locked profile, or when the operator says "/foundry:relock", "doctor stack-profile is red after updating", "re-lock the stack profile".

Build/refresh the citation-graph cache + expose it natively via MCP (/foundry:report-citation-graph). Rebuilds .foundry/graph.json (materialized backlinks = delta-1) and serves it through the foundry-graph MCP server. Trigger to refresh the graph or query "what cites X" / "what does X cite".

The governed-repo fleet verbs (/foundry:repos <sync|status|foreach|validate>) over the repos{} registry — clone the not-cloned, fetch the matching, report the rest; never confused with /foundry:fleet, the SESSION ROSTER (one row per active Claude Code session, no repository governed at all). Trigger to bring a fresh clone of the workspace up to date, check every hosted repo's status at a glance, run a command across them, or catch an undeclared checkout.

The durable research-evidence-trail discipline. At a deep-research-bearing research-first gate, persist the FULL claim-level trail (verified ∧ REFUTED) as <run-id>-<slug>.md at the configured governance.research_path (defaults to .foundry/research/) from the research-artifact template, and author the ADR at the configured governance.decisions_path (defaults to .foundry/decisions/) with a `## Refuted / disconfirming evidence` section — so a later auditor can check whether the claimed "industry consensus" was real. A discipline (a template + an author convention), NOT a code helper. Trigger after a deep-research run feeds a design decision.

The research-first discipline as an invocable primitive. Run this at ANY design/decision fork with ambiguity — a new capability, an approach/architecture choice, an unfamiliar domain, a mid-build fork between two designs — BEFORE designing or building something non-obvious. It runs DEEP industry-best-practice research FIRST, distills the consensus, ADOPTS it autonomously, and escalates to the operator ONLY on a genuine no-consensus. Prevents the "phantom-atom" pathology (building what the industry doesn't build). Other primitives (intake's pre-design research gate, the deep spec audit's prior-art lens) LOAD this; the operator can invoke it directly ("research-first <question>"). The threshold is approach-ambiguity, NOT mechanical work.

Governed incident-revert (/foundry:revert) — first-class, NOT a bypass of the no-skip front-authorization gate. Cuts a revert PR restoring a previously-AUTHORIZED state, reusing the prior authorization (no new contract), still subject to the merge floor + re-certified. Trigger on an escaped-defect merge needing rollback.

The disciplined debug/fix loop the generic agent runs when a sd-verify / sd-test run FAILS (/foundry:sd-debug, software-delivery debug step, step 9). A PROCEDURE — reproduce → isolate → root-cause → minimal-fix → re-verify, ONE hypothesis per iteration (NOT shotgun edits), BOUNDED so it converges (the failure is fixed and re-verified) or escalates to the operator with a structured hand-off. Advisory: it disciplines a debugging process; it does NOT gate, approve, or merge.

Survey an existing (brownfield) codebase at SDLC step 3 — BEFORE implement — so the implementation is idiom-faithful, not foreign. Maps the repo's architecture, conventions, entry-points, test-layout, and persisted data model, then emits a consumable discovery note the implement step reads (and, for the data-model dimension, the intake authoring step). ADVISORY craft (produces a survey; does NOT gate, approve, or block — the merge floor, the adopter's branch protection + CI checks, remains the merge authority).

The documentation craft skill (software-delivery document step / SDLC step 12). A PROCEDURE skill the generic agent runs to produce or refresh the docs a change requires — public API/contract docs, the changelog entry, and operator-facing usage — DERIVED from the authorized spec + the orchestrator-supplied diff and MATCHED to the surrounding repo's existing doc conventions (where docs live, the changelog format, the API-doc style). Trigger after a change is implemented + verified and its docs must be written/refreshed. ADVISORY craft guidance for the trusted operator — a mistake-catcher for the missing changelog entry / stale API doc / convention mismatch — NOT a gate, never blocks or auto-merges, and does NOT itself flip the software-delivery workflow's document step.

The test-planning craft skill (software-delivery SDLC step 5). Run it AFTER front-authorization has frozen an atom's ACs and BEFORE implementation, to derive a per-AC test plan — happy / edge / negative cases plus the change-attributable baseline case for each pre-change checkpoint — mapped to the acceptance-contract checkpoints, and emit a test-plan note keyed to the AC-IDs. ADVISORY craft: it produces a plan, it never gates, approves, or merges; the merge floor (the adopter's branch protection + CI checks — see the plugin's docs/merge-floor.md) is the merge authority.

The two-lens advisory review procedure the generic agent runs at the software-delivery review step (/foundry:sd-review, software-delivery review step). A PROCEDURE — it DISPATCHES the MERGED pr-reviewer general code lens (agents/pr-reviewer.md) ALWAYS, plus the security-reviewer security lens (agents/security-reviewer.md) WHEN the change touches auth/IAM, secrets/credentials, or supply-chain/dependencies, then collates the categorized findings for the operator. It does NOT re-implement review (the agents own the review craft). Advisory: it surfaces findings to the operator; it does NOT gate, approve, or merge — the merge floor (the adopter's branch protection + CI checks) is the merge authority.

The disciplined test-recipe gate the generic agent runs for the software-delivery TEST step (/foundry:sd-test, step 8). A PROCEDURE — invoke the MERGED foundry-verify.py executor, read the run record's records whose phase == "test_recipe" (unit / integration / e2e), surface the profile's numeric coverage_gate and advise confirming coverage meets it, and reach a fail-closed verdict (no-profile / zero / >1 resolved is NEVER green; green requires an exactly-one profile whose test_recipe records all passed). Reads ONLY the test_recipe phase — the static_validation phase belongs to the separate sd-verify step. Advisory: it disciplines a test-reading process; it does NOT gate, approve, or merge.

The software-delivery VERIFY step skill — the STATIC-VALIDATION gate the generic agent runs at the verify step (/foundry:sd-verify, software-delivery verify step, step 7). A PROCEDURE — it DRIVES the MERGED foundry-verify.py executor over the active stack profile and reads the run records whose phase == "static_validation" (format / lint / typecheck / build); GREEN iff every static_validation record passed, surfacing the verdict FAIL-CLOSED ("nothing to run" / no-profile is NEVER green). It IGNORES the test_recipe records (the separate sd-test step). It does NOT re-implement verification (the executor owns that, proven in tests/test_release.py). Advisory: it surfaces a verdict for the trusted operator; it does NOT gate, approve, or merge.

The discipline for authoring foundry skills — information hierarchy / progressive disclosure, leading words, completion criteria, no-op pruning. A REFERENCE the author consults when writing or revising a skills/<name>/SKILL.md; advisory craft, it does NOT gate, approve, or merge.

Post-plugin-update config hygiene (/foundry:upgrade). After `claude plugin update foundry@<marketplace>`, answers the two questions nothing else in Foundry could: has my adopter config drifted since it was set up, and is it even well-formed? Drives scripts/foundry-config.py — `check` reports per-key drift against a recorded baseline plus JSON-Schema validity (read-only, writes nothing), and `adopt` records the baseline. NEITHER verb ever writes .claude/foundry-operators.json or .claude/foundry-project.json — drift is reported, the operator edits by hand. Trigger after a plugin update, when the operator says "/foundry:upgrade", "did my config drift", "check my foundry config", or to record the baseline for the first time.