code-foundry 1.10.0 → 1.11.0

package/.github/CONTRIBUTING.md

@@ -181,11 +181,11 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |
 | Scheduled or manual validation                     | Full audit tier                                                                       |
 | Push to a working branch                           | Draft PR workflow                                                                     |
-| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |
+| Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |
 
 Draft pull requests do not start validation. The lightweight Draft Guard also converts ordinary pull requests opened, reopened, or updated while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier. Convert it back to draft after an update, then mark it ready again after every update so the required checks attach to the current head. Converting it to draft runs only the lightweight cancellation control.
 
-Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Both callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate.
+Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Pull-request and scheduled/manual callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate. Main pushes run the default-branch CodeQL lane separately.
 
 Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 

package/.github/code-foundry.yml

@@ -23,7 +23,11 @@ unit_runner: ubuntu-slim
 performance_runner: ubuntu-latest
 cache_packages: auto
 cache_build: auto
+required_capabilities:
+coverage_enforcement: auto
 coverage_minimum: 80
+coverage_metrics: lines
+coverage_report:
 turbo_remote: auto
 ci_runner: ubuntu-latest
 test_runner: ubuntu-latest

package/.github/workflows/ci.yml

@@ -63,6 +63,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -107,6 +108,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -146,6 +148,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -190,6 +193,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |

package/.github/workflows/codeql.yml

@@ -118,6 +118,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -210,6 +211,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         if: ${{ matrix.entry.changed == true }}

package/.github/workflows/security.yml

@@ -88,6 +88,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -210,6 +211,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |

package/.github/workflows/test.yml

@@ -78,6 +78,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -143,6 +144,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -208,6 +210,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -257,6 +260,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |
@@ -318,6 +322,7 @@ jobs:
           sparse-checkout: |
             .github/actions
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: |

package/.github/workflows/validation-no-codeql.yml

@@ -143,6 +143,7 @@ jobs:
           path: .github/.code-foundry
           sparse-checkout: |
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"

package/.github/workflows/validation.yml

@@ -155,6 +155,7 @@ jobs:
           path: .github/.code-foundry
           sparse-checkout: |
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"

package/.github/workflows/validation_self-ci.yml

@@ -1,6 +1,8 @@
 name: Code Foundry
 
 on:
+  push:
+    branches: [main]
   pull_request:
     branches: [main, staging]
     types:
@@ -18,9 +20,9 @@ concurrency:
 jobs:
   mode:
     name: Mode
-    # The workflow is emitted only for ready_for_review, so draft pull requests
-    # register no skipped validation checks and allocate no validation runner.
-    if: vars.CI_BILLING_PAUSED != 'true'
+    # The mode classifier is only needed for pull requests. Main pushes use
+    # the dedicated default-branch CodeQL lane below.
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'pull_request'
     runs-on: ubuntu-slim
     timeout-minutes: 10
     permissions:
@@ -43,6 +45,7 @@ jobs:
           path: .github/.code-foundry
           sparse-checkout: |
             src/lib
+            src/runtime-core.mjs
             src/runtime.mjs
       - name: Install runtime
         run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
@@ -59,7 +62,7 @@ jobs:
   validation:
     name: Validation
     needs: mode
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'pull_request'
     # Reusable workflows can only maintain or reduce the caller job's scopes.
     # The audit tier needs security-events: write for CodeQL uploads.
     permissions:
@@ -87,3 +90,23 @@ jobs:
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
+
+  # CodeQL requires a push analysis to populate default-branch code-scanning
+  # alerts. Keep the full validation gate pull-request-only so main pushes do
+  # not duplicate CI, test, or security work.
+  default-branch-codeql:
+    name: CodeQL (default branch)
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    uses: ./.github/workflows/codeql.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-latest
+      rust-shards: '["all"]'
+      rust-threads: '1'
+      rust-max-parallel: 1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [1.11.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.10.1...v1.11.0) (2026-09-09)
+
+
+### Features
+
+* **validation:** enforce required capabilities, coverage, and task evidence ([#534](https://github.com/0xPlayerOne/code-foundry/issues/534)) ([2e341d9](https://github.com/0xPlayerOne/code-foundry/commit/2e341d94381599f1d78ec1394d42883157b30ea6))
+
+## [1.10.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.10.0...v1.10.1) (2026-09-09)
+
+
+### Bug Fixes
+
+* **doctor:** honor shared config and correctly identify npm/Yarn lockfiles ([#533](https://github.com/0xPlayerOne/code-foundry/issues/533)) ([6464409](https://github.com/0xPlayerOne/code-foundry/commit/646440907ad3fc47f63e27b9621c8e0025459964))
+* **validation:** scan default branch with CodeQL on push ([#540](https://github.com/0xPlayerOne/code-foundry/issues/540)) ([98d8241](https://github.com/0xPlayerOne/code-foundry/commit/98d8241522c78e1b6d3f4f29a44053d33888edba))
+
 ## [1.10.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.13...v1.10.0) (2026-09-08)
 
 

package/README.md

@@ -70,7 +70,7 @@ when present and otherwise uses native language tooling; choose `native` or
 
 The standard workflow triggers are:
 
-- Pushes to `main` (and `staging` when `git_workflow: staging-release` is configured).
+- Pushes to `main` (and `staging` when `git_workflow: staging-release` is configured); main pushes also run the default-branch CodeQL scan.
 - Pull requests targeting `main` (and `staging` in the staging-release topology).
 - Draft PR automation for supported feature/fix branches.
 

package/docs/CONFIGURATION.md

@@ -36,10 +36,15 @@ repository manifests and source
 | `package_manager`          | `bun`, `pnpm`, `yarn`, `npm`, `none`                                             | JavaScript setup                                                                                                    |
 | `toolchain`                | `auto`, `native`, `mise`                                                         | Environment setup policy; defaults to `auto`                                                                        |
 | `staging_validation_mode`  | `fast`, `audit`                                                                  | Staging-release-only validation tier; omitted from direct repositories                                              |
-| `performance`              | `auto`, `true`, `false`                                                          | Run a deterministic performance task when a supported entrypoint exists; defaults to `auto`                         |
+| `performance`              | `auto`, `true`, `false`                                                          | `auto` discovers an optional task; `true` requires a supported performance entrypoint; `false` disables discovery   |
 | `performance_command`      | JSON argv array or array of argv arrays                                          | One or more ordered commands for non-package harnesses; package scripts take precedence                             |
 | `performance_profile`      | empty, `node-package`                                                            | Optional shared package import, memory, archive, and dependency budget harness                                      |
 | `performance_budget_file`  | repository path                                                                  | Budget policy for the shared package harness; defaults to `performance-package-budgets.json`                        |
+| `required_capabilities`    | comma-separated task names                                                       | Fail closed when a required task or `coverage` evidence is unavailable; defaults to none                            |
+| `coverage_enforcement`     | `auto`, `required`, `off`                                                        | Shared coverage report policy; `auto` accepts explicit skips, `required` rejects missing reports, `off` skips it    |
+| `coverage_minimum`         | percentage from `0` to `100`                                                     | Minimum measured coverage; defaults to `80`                                                                         |
+| `coverage_metrics`         | `lines`, `functions`, `branches`, `statements`                                   | Metrics checked by the shared coverage gate; defaults to `lines`                                                    |
+| `coverage_report`          | comma-separated repository paths                                                 | Istanbul summary or LCOV evidence files; defaults to standard coverage paths                                        |
 | `features`                 | `all` or a list                                                                  | Standard workflow callers                                                                                           |
 | `codeql`                   | `auto`, `true`, `false`                                                          | CodeQL policy; public repositories default to enabled, non-public repositories default to disabled                  |
 | `codeql_rust_shards`       | JSON array of paths                                                              | Rust scan scopes; `["all"]` keeps the safe single full scan                                                         |

package/docs/README.md

@@ -13,6 +13,7 @@ its own names, environments, and deployment details.
 - [Publishing packages](PUBLISHING.md)
 - [Caching and remote caching](CACHING.md)
 - [Performance budgets and baselines](PERFORMANCE.md)
+- [Required capabilities and task evidence](required-capabilities.md)
 
 ## Repository-specific documentation
 

package/docs/WORKFLOWS.md

@@ -4,16 +4,21 @@
 
 Validation uses two callers so pull-request code and default-branch-capable
 audit events never share a caller-selected runtime ref. The canonical
-`validation.yml` caller handles pull requests only:
+`validation.yml` caller handles pull requests and a lightweight default-branch
+CodeQL lane:
 
 ```yaml
+push:
+  branches: [main] # CodeQL only
 pull_request:
   branches: [main, staging] # staging-release topology
   # direct topology: branches: [main]
 ```
 
-The generated validation caller listens only for `ready_for_review`, so draft
-pull requests register no validation checks and allocate no validation runner.
+The generated validation caller listens for `ready_for_review` and `push` to
+`main`. Draft pull requests register no validation checks and allocate no
+validation runner; main pushes run only the default-branch CodeQL lane, while
+full validation remains pull-request-only.
 A separate lightweight Draft Guard runs from the trusted base branch on
 `opened`, `reopened`, and `synchronize`; it converts ordinary ready pull
 requests back to draft without checking out pull-request code. It rechecks the
@@ -44,7 +49,7 @@ Scheduled and manual runs select the audit tier in both topologies. Draft PR
 automation separately listens to supported topic-branch pushes and always
 opens those PRs as drafts. Promotion automation listens to `staging` pushes
 (staging-release only) and also always opens its PR as a draft. Release
-automation listens to `main` pushes.
+automation and default-branch CodeQL listen to `main` pushes.
 Custom deployment, indexing, search, Slither, or other workflows are
 repository-owned extensions and should use the same ready-transition policy.
 

package/docs/required-capabilities.md

@@ -0,0 +1,82 @@
+# Required capabilities and task evidence
+
+Declared requirements fail closed when discovery cannot find an executable task.
+Existing optional task discovery remains available. Configure scalar values in
+`.github/code-foundry.yml`:
+
+```yaml
+required_capabilities: type_check,unit,e2e,performance,coverage
+performance: true
+coverage_enforcement: required
+coverage_minimum: 80
+coverage_metrics: lines,branches
+coverage_report: coverage/coverage-summary.json
+```
+
+Supported task capabilities are `format`, `lint`, `type_check`, `build`, `unit`,
+`integration`, `e2e`, `smoke`, and `performance`. `coverage` additionally requires
+unit tests. Unknown names, contradictory requirements, and invalid thresholds
+are errors. `performance: true` now means required, not merely enabled when a
+script happens to exist. Use `performance: auto` to retain optional discovery.
+
+The public `src/runtime.mjs` entrypoint delegates ecosystem execution to the
+unchanged private `src/runtime-core.mjs`. Keep both files and `src/lib` when
+vendoring the runtime. Published packages and the reusable workflows' existing
+cone-mode sparse checkout include both files. Do not call the private executor
+from consumer CI: it intentionally does not enforce the public policy contract.
+
+## Coverage migration
+
+`coverage_enforcement` accepts:
+
+- `auto` (default): missing reports are explicitly reported as skipped; present
+  reports must be fresh, valid, and meet the threshold.
+- `required`: missing reports also fail, as does required capability `coverage`.
+- `off`: skip the shared report gate. This does not disable a test runner's own
+  coverage threshold, and cannot be combined with required coverage.
+
+The default report candidates are `coverage/coverage-summary.json` (Istanbul
+summary) and `coverage/lcov.info`. `coverage_report` accepts a comma-separated
+list of repository-relative files. When multiple reports exist, every report
+must meet the selected metrics. Percentages are recomputed from measured counts,
+not trusted from reported `pct` fields. Empty reports, unmeasured selected
+metrics, stale files, traversal, and escaping symlinks fail. LCOV supports lines,
+functions, and branches; use JSON summaries for statement coverage.
+
+Configure the repository-owned unit-test command to generate the report on each
+run before enabling required mode. The runtime does not inject coverage tooling,
+install a new runner, delete old reports, or lower thresholds. Auto mode preserves
+repos that declare a threshold but have not yet configured report generation;
+a passing unit task with `coverage.status: skipped` is **not** coverage evidence.
+
+## Results and validation tiers
+
+Each executed CI task writes `.code-foundry/results/<task>.json`, including its
+status (`passed`, `failed`, or `skipped`), discovery reason, delegated command and
+exit status, source SHA when available, timestamps, and evidence paths. Coverage
+has its own nested status. Discovery also records optional skips. Task reports
+appear in the GitHub job summary when `GITHUB_STEP_SUMMARY` is available.
+
+The recorded command is the delegated executor invocation, not a transcript of
+all nested package scripts. No environment variables or captured command output
+are copied into the report. Repository scripts remain responsible for sanitizing
+their own logs. Upload `.code-foundry/results/*.json` with `if: always()` and
+`include-hidden-files: true` to retain downloadable reports; only upload this
+specific directory, not arbitrary hidden files or the entire checkout.
+
+`node src/runtime.mjs ci plan` prints a JSON discovery plan without executing
+checks. Discovery validates every required task before reusable workflows select
+jobs. A fast/unit-only tier is still a subset: discovery proves that E2E exists,
+not that E2E ran. Require the existing audit validation gate before merging.
+
+Native task detection rejects known no-ops such as a JavaScript project with no
+build script or a Python project with no supported type-check command. Add a
+repository-owned script for unsupported layouts or toolchains. Do not infer that
+an installed package manager or discovered project proves task execution.
+
+## Verification
+
+`node --test test/task-policy.test.mjs` exercises policy parsing, discovery,
+coverage parsing/thresholds/freshness/path safety, exit propagation, and reports
+with a deterministic executor fixture. The unchanged ecosystem executor remains
+covered by `test/runtime.test.mjs` in the full suite.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -5,6 +5,7 @@ import { join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { includesValue, readConfig } from '../lib/config.mjs'
 import { recommendRunners, resolveProfile } from '../lib/profile.mjs'
+import { packageManagerForLockfile } from '../lib/lockfiles.mjs'
 import { doctorGithub } from '../lib/github-doctor.mjs'
 import { isGeneratedEventCaller } from './sync.mjs'
 
@@ -69,9 +70,7 @@ export function doctor(root, options = {}) {
     if (lockfiles.length > 1) error('multiple JavaScript lockfiles found; keep one package manager')
     if (packageJson.packageManager && lockfiles.length) {
       const declared = String(packageJson.packageManager).split('@')[0]
-      const actual = lockfiles[0]?.startsWith('bun')
-        ? 'bun'
-        : lockfiles[0]?.split('-')[0].replace('.yaml', '')
+      const actual = packageManagerForLockfile(lockfiles[0])
       if (actual && declared !== actual)
         error(`packageManager (${declared}) does not match ${actual} lockfile`)
     }

package/src/commands/sync.mjs

@@ -537,12 +537,15 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   let rendered = content.replaceAll(localPrefix, remotePrefix)
   // An explicitly unavailable CodeQL capability selects an orchestrator that
   // omits the job entirely, so GitHub does not register a misleading skipped
-  // check on every pull request. `auto` retains runtime capability detection.
+  // check on every pull request or an unused main-push run. `auto` retains
+  // runtime capability detection.
   if (configured(config.codeql, 'auto') === 'false') {
     rendered = rendered.replaceAll(
       `${remotePrefix}validation.yml`,
       `${remotePrefix}validation-no-codeql.yml`
     )
+    rendered = removeWorkflowBlock(rendered, 'default-branch-codeql')
+    rendered = removeWorkflowBlock(rendered, 'push')
   }
   rendered = rendered.replace(
     new RegExp(`${escapeRegExp(remotePrefix)}([^\\s@]+)`, 'g'),
@@ -640,6 +643,25 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   return rendered
 }
 
+/**
+ * Remove a root-level YAML block by id while preserving the surrounding file.
+ * This is used for workflow jobs and triggers whose feature is disabled by
+ * configuration.
+ * @param {string} content
+ * @param {string} blockId
+ * @returns {string}
+ */
+function removeWorkflowBlock(content, blockId) {
+  const lines = content.split('\n')
+  const start = lines.findIndex((line) => line === `  ${blockId}:`)
+  if (start === -1) return content
+  let end = start + 1
+  while (end < lines.length && !/^  [A-Za-z0-9_-]+:\s*$/.test(lines[end])) end += 1
+  lines.splice(start, end - start)
+  if (content.endsWith('\n') && lines.at(-1) !== '') lines.push('')
+  return lines.join('\n')
+}
+
 /**
  * Dependabot updates land on the repository's integration branch. Direct
  * repositories have no staging branch, so every update targets main. Cargo,
@@ -779,8 +801,8 @@ const DIRECT_DOC_REPLACEMENTS = {
       '7. Push to the fork and open a pull request targeting `main`.',
     ],
     [
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |\n',
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |\n',
+      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |\n',
+      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |\n',
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',
@@ -1266,7 +1288,11 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     prune_standard: 'false',
     cache_packages: 'auto',
     cache_build: 'auto',
+    required_capabilities: '',
+    coverage_enforcement: 'auto',
     coverage_minimum: '80',
+    coverage_metrics: 'lines',
+    coverage_report: '',
     turbo_remote: 'auto',
     release_type: detectPackageManager(root) === 'none' ? 'auto' : 'node',
     npm_publish: 'false',

package/src/lib/github-doctor.mjs

@@ -3,6 +3,7 @@
 import { readFileSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { readConfig } from './config.mjs'
 
 /** @param {string} root @returns {{ errors: string[], warnings: string[], details: Record<string, unknown> }} */
 export function doctorGithub(root) {
@@ -306,22 +307,3 @@ function ghJson(args) {
 function commandExists(command) {
   return spawnSync(command, ['--version'], { stdio: 'ignore' }).status === 0
 }
-
-/** @param {string} root @returns {Record<string, string>} */
-function readConfig(root) {
-  const file = join(root, '.github/code-foundry.yml')
-  try {
-    return Object.fromEntries(
-      readFileSync(file, 'utf8')
-        .split(/\r?\n/)
-        .flatMap((line) => {
-          const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*?)\s*$/)
-          return match
-            ? [[match[1], match[2].replace(/\s+#.*$/, '').replace(/^['"]|['"]$/g, '')]]
-            : []
-        })
-    )
-  } catch {
-    return {}
-  }
-}

package/src/lib/lockfiles.mjs

@@ -0,0 +1,15 @@
+// @ts-check
+
+/** @type {Readonly<Record<string, string>>} */
+const managers = Object.freeze({
+  'bun.lock': 'bun',
+  'bun.lockb': 'bun',
+  'pnpm-lock.yaml': 'pnpm',
+  'yarn.lock': 'yarn',
+  'package-lock.json': 'npm',
+})
+
+/** @param {string | undefined} file @returns {string | undefined} */
+export function packageManagerForLockfile(file) {
+  return file && Object.hasOwn(managers, file) ? managers[file] : undefined
+}