code-foundry 1.47.1 → 1.47.5

package/.github/CONTRIBUTING.md

@@ -115,17 +115,23 @@ If the worktree is dirty, stop and understand the existing changes before switch
 
 ## Local validation
 
-The repository runtime detects supported tools and skips checks that do not apply:
+Use the commands declared in this repository's manifests and documentation, or
+invoke the installed Code Foundry CLI. The shared runtime detects supported tools
+and skips checks that do not apply:
 
 ```sh
 npx code-foundry doctor
-npm run format:check   # or the package manager's equivalent
-npm run lint
-npm run type-check
-npm test
-Security and dependency audits run through the GitHub Security workflow.
+npx code-foundry plan --tier fast
+npx code-foundry check --tier fast
+npx code-foundry check --tier audit
 ```
 
+`doctor` diagnoses setup; `plan` discovers tasks without running them. `check`
+runs the selected tier: `fast` includes CI tasks, unit tests and performance,
+while `audit` adds integration, E2E and smoke.
+
+Security and dependency audits run through the GitHub Security workflow.
+
 Run the checks relevant to the change. For a release or security-sensitive change, run the complete set. Record the commands and results in the pull request.
 
 <!-- /code-foundry-managed: local-validation -->

package/.github/workflows/ci.yml

@@ -183,6 +183,9 @@ jobs:
   type-check:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      contents: read
+      issues: read
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -226,6 +229,8 @@ jobs:
       - name: Type-Check
         id: execute
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
       - name: Retain task receipt
         if: >-

package/.github/workflows/validation-billing.yml

@@ -533,6 +533,9 @@ jobs:
   type-check:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      contents: read
+      issues: read
     runs-on: ${{ inputs.ci-runner }}
     timeout-minutes: 30
     steps:
@@ -576,6 +579,8 @@ jobs:
       - name: Type-Check
         id: execute
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
       - name: Retain task receipt
         if: >-

package/.github/workflows/validation-no-codeql.yml

@@ -104,6 +104,12 @@ jobs:
   ci:
     name: CI
     if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    # Forward issue-read only to the CI workflow that runs Type-Check.
+    permissions:
+      actions: read
+      contents: read
+      issues: read
+      packages: read
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}

package/.github/workflows/validation.yml

@@ -104,6 +104,12 @@ jobs:
   ci:
     name: CI
     if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    # Type-Check reads the issue-backed requirements ledger with github.token.
+    permissions:
+      actions: read
+      contents: read
+      issues: read
+      packages: read
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}

package/.github/workflows/validation_audit_self-ci.yml

@@ -22,6 +22,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      issues: read
       packages: read
       security-events: write
     uses: 0xPlayerOne/code-foundry/.github/workflows/validation.yml@main

package/.github/workflows/validation_self-ci.yml

@@ -78,6 +78,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      issues: read
       packages: read
       security-events: write
     uses: ./.github/workflows/validation.yml

package/.gitignore

@@ -83,3 +83,4 @@ mise.local.lock
 # committed pre-commit gate is tracked.
 .githooks/*
 !.githooks/pre-commit
+.fleet-wt/

package/AGENTS.md

@@ -4,7 +4,7 @@
 
 These instructions are the repository-level operating contract for coding agents, including Hermes, OpenCode, and other automation.
 
-They complement `CONTRIBUTING.md`. More specific instructions in nested `AGENTS.md` files and project documentation take precedence for their directory.
+They complement `.github/CONTRIBUTING.md`. More specific instructions in nested `AGENTS.md` files and project documentation take precedence for their directory.
 
 <!-- /code-foundry-managed: config-aware-policy -->
 
@@ -183,7 +183,22 @@ This repository uses the `direct` workflow. Topic pull requests target `main`.
 
 ## Validation
 
-Use the shared scripts when present. They detect supported tools and skip inapplicable checks:
+From a consumer repository, use its documented package scripts or the installed
+Code Foundry CLI:
+
+```sh
+npx code-foundry plan --tier fast
+npx code-foundry check --tier fast
+npx code-foundry check --tier audit
+```
+
+`plan` discovers tasks without running them. `check` invokes the shared runtime;
+`fast` includes CI tasks, unit tests and performance, while `audit` adds
+integration, E2E and smoke.
+
+From a Code Foundry source checkout only, the shared runtime is also available.
+The paths below are relative to that checkout, not a consumer repository. The
+runtime detects supported tools and skips inapplicable checks:
 
 ```sh
 node src/runtime.mjs ci format
@@ -196,9 +211,10 @@ node src/runtime.mjs ci e2e
 node src/runtime.mjs ci smoke
 node src/runtime.mjs ci eval
 node src/runtime.mjs ci performance
-Security and dependency audits run through the GitHub Security workflow.
 ```
 
+Security and dependency audits run through the GitHub Security workflow.
+
 Run focused tests first, then the complete applicable set for release, security, workflow, dependency, and configuration changes.
 
 At minimum:

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [1.47.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.4...v1.47.5) (2026-10-15)
+
+
+### Bug Fixes
+
+* validation-issue-read-v1471 ([#759](https://github.com/0xPlayerOne/code-foundry/issues/759)) ([7119b3e](https://github.com/0xPlayerOne/code-foundry/commit/7119b3e2baebfbfdd47d32428cbf5df2f2079afa))
+
+## [1.47.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.3...v1.47.4) (2026-10-15)
+
+
+### Documentation
+
+* fix generated agent contribution and validation references ([#760](https://github.com/0xPlayerOne/code-foundry/issues/760)) ([c3564c9](https://github.com/0xPlayerOne/code-foundry/commit/c3564c92cb168449317afe2e40359144bf7a0c71))
+
+## [1.47.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.2...v1.47.3) (2026-10-09)
+
+
+### Maintenance
+
+* **fleet:** point the manifest at the rollout worktrees and filter adea's actionlint ([#757](https://github.com/0xPlayerOne/code-foundry/issues/757)) ([55bae8b](https://github.com/0xPlayerOne/code-foundry/commit/55bae8bf99a022bfa03294972d89a3cca20a6203))
+
+## [1.47.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.1...v1.47.2) (2026-10-08)
+
+
+### Bug Fixes
+
+* **qualification:** exclude pending parallel syntax by content, not filename ([#755](https://github.com/0xPlayerOne/code-foundry/issues/755)) ([1f7cae8](https://github.com/0xPlayerOne/code-foundry/commit/1f7cae8167002061850e56e3dc0fa800a69d7be9))
+
 ## [1.47.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.0...v1.47.1) (2026-10-08)
 
 
@@ -112,37 +140,9 @@
 
 * **release:** query the version-PR branch directly in the REST fallback ([#722](https://github.com/0xPlayerOne/code-foundry/issues/722)) ([b38f394](https://github.com/0xPlayerOne/code-foundry/commit/b38f394c0ca6438117fdd2f45bd106b0b145a0f9))
 
-## [1.44.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.6...v1.44.7) (2026-10-05)
-
-
-### Bug Fixes
-
-* **release:** complete rejected release-please runs over REST ([#720](https://github.com/0xPlayerOne/code-foundry/issues/720)) ([14e88b5](https://github.com/0xPlayerOne/code-foundry/commit/14e88b5561803fc8d5d3a77b67b99e1be90bc4af))
-
-## [1.44.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.5...v1.44.6) (2026-10-05)
-
-
-### Bug Fixes
-
-* **config:** pin the lint-bearing CI lane to a standard runner by default ([#718](https://github.com/0xPlayerOne/code-foundry/issues/718)) ([fc0ed14](https://github.com/0xPlayerOne/code-foundry/commit/fc0ed14434151fb11eef7c0d4c324c7a370d5058))
-
-## [1.44.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.4...v1.44.5) (2026-10-05)
-
-
-### Bug Fixes
-
-* **release:** probe the tag-creation write before trusting the automation token ([#716](https://github.com/0xPlayerOne/code-foundry/issues/716)) ([fabaddc](https://github.com/0xPlayerOne/code-foundry/commit/fabaddcb05d5dc701248b693f91be6ee433f8d39))
-
-## [1.44.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.3...v1.44.4) (2026-10-03)
-
-
-### Bug Fixes
-
-* **ci:** declare the e2e shard inputs on the no-codeql orchestrator ([#714](https://github.com/0xPlayerOne/code-foundry/issues/714)) ([7500208](https://github.com/0xPlayerOne/code-foundry/commit/7500208f3b25dfe55c41ea45b382e021cf804012))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 243 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 247 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.47.1",
+  "version": "1.47.5",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/lib/consumer-qualification.mjs

@@ -157,17 +157,16 @@ function lintContracts(consumer, candidate, destination, actionlint, version) {
     paths.push(target)
   }
   // Check all candidate callees as well as rendered callers, without executing them.
-  // actionlint v1.7.12 (still the latest release as of 2026-10-07) predates
+  // actionlint v1.7.12 (still the latest release as of 2026-10-08) predates
   // the June 2026 step parallelism keywords (background/wait/wait-all/
   // cancel/parallel), so files using them are excluded from this pass until
   // actionlint ships support — GitHub's own loader accepts the syntax, which
   // is verified by live runs and pinned in test/billing-lanes.test.mjs.
-  // Restore the removal of this exclusion when rhysd/actionlint releases
-  // post-parallel support.
-  const actionlintPendingParallelSyntax = new Set(['validation-billing.yml'])
-  const workflows = readdirSync(join(destination, '.github/workflows')).filter(
-    (name) => /\.ya?ml$/.test(name) && !actionlintPendingParallelSyntax.has(name)
-  )
+  // The exclusion is content-based so repository-owned workflows adopting the
+  // keywords (adea's desktop-shell, for one) stay covered without list
+  // maintenance. Restore the removal of this exclusion when
+  // rhysd/actionlint releases post-parallel support.
+  const workflows = actionlintEligibleWorkflows(join(destination, '.github/workflows'))
   run(
     actionlint,
     [
@@ -180,6 +179,15 @@ function lintContracts(consumer, candidate, destination, actionlint, version) {
   return paths.length
 }
 
+/** @param {string} workflowsDirectory */
+export function actionlintEligibleWorkflows(workflowsDirectory) {
+  const pendingParallelSyntax = /^[ \t]*(?:-[ \t]+)?(?:background|wait|wait-all|cancel|parallel):/m
+  return readdirSync(workflowsDirectory).filter((name) => {
+    if (!/\.ya?ml$/.test(name)) return false
+    return !pendingParallelSyntax.test(readFileSync(join(workflowsDirectory, name), 'utf8'))
+  })
+}
+
 /** @param {{ packageFile: string, sourceSha: string, reportPath: string, actionlint?: string }} options */
 export function qualifyCandidate(options) {
   if (!/^[a-f0-9]{40}$/.test(options.sourceSha))

package/src/lib/merge-queue.mjs

@@ -110,6 +110,7 @@ on:
 permissions:
   actions: read
   contents: read
+  issues: read
   packages: read
   security-events: write
 

package/src/templates/workflows/validation-audit.yml

@@ -22,6 +22,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      issues: read
       packages: read
       security-events: write
     uses: ./.github/workflows/validation.yml