code-foundry 1.9.5 → 1.9.6

package/.github/actions/setup/action.yml

@@ -748,8 +748,9 @@ runs:
           ${{ runner.os }}-rust-build-v2-
     - name: Setup
       if: ${{ steps.profile.outputs.mise_required == 'true' }}
-      uses: jdx/mise-action@v4
+      uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4
       with:
+        version: 2026.9.2
         cache: true
         install_args: ${{ steps.profile.outputs.mise_tools }}
     - name: Setup Rust components

package/.github/code-foundry.yml

@@ -35,10 +35,8 @@ prune_standard: false
 post_release: false
 post_release_workflow:
 post_release_mode: auto
-opencode_security: false
 sync_mode: overlay
 custom_workflows: preserve
-staging_validation_mode: fast
 performance: auto
 performance_command:
 performance_profile:

package/.github/workflows/ci.yml

@@ -71,7 +71,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci should_run format >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run format >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -86,7 +86,7 @@ jobs:
           task: format
       - name: Format
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci format
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci format
 
   lint:
     name: Lint
@@ -115,7 +115,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci should_run lint >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run lint >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -125,7 +125,7 @@ jobs:
           task: lint
       - name: Lint
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci lint
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci lint
 
   type-check:
     name: Type-Check
@@ -154,7 +154,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci should_run type_check >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run type_check >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -164,7 +164,7 @@ jobs:
           task: type_check
       - name: Type-Check
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci type_check
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
 
   build:
     name: Build
@@ -198,7 +198,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci should_run build >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run build >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -208,4 +208,4 @@ jobs:
           task: build
       - name: Build
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci build
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci build

package/.github/workflows/cloudflare-deploy.yml

@@ -13,6 +13,21 @@ on:
         required: false
         type: string
         default: '.'
+      install-working-directory:
+        description: 'Directory containing bun.lock. Used only when build-script is set.'
+        required: false
+        type: string
+        default: '.'
+      build-script:
+        description: 'Optional Bun package script to run before Wrangler deploys.'
+        required: false
+        type: string
+        default: ''
+      bun-version:
+        description: 'Bun version used for dependency installation and the optional build.'
+        required: false
+        type: string
+        default: '1.4.0'
       runner:
         required: false
         type: string
@@ -48,6 +63,24 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Set up Bun
+        if: inputs.build-script != ''
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+
+      - name: Install dependencies
+        if: inputs.build-script != ''
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile
+
+      - name: Build Worker
+        if: inputs.build-script != ''
+        working-directory: ${{ inputs.working-directory }}
+        env:
+          BUILD_SCRIPT: ${{ inputs.build-script }}
+        run: bun run "$BUILD_SCRIPT"
+
       - name: Deploy to Cloudflare
         id: deploy
         working-directory: ${{ inputs.working-directory }}

package/.github/workflows/codeql.yml

@@ -131,7 +131,7 @@ jobs:
           REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs codeql
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" codeql
       - id: matrix
         name: Build analysis matrix
         env:

package/.github/workflows/draft-control_self-ci.yml

@@ -0,0 +1,44 @@
+name: Code Foundry Draft Control
+
+on:
+  pull_request:
+    branches: [main, staging]
+    types:
+      - converted_to_draft
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  cancel:
+    name: Draft Control / Halt CI
+    if: vars.CI_BILLING_PAUSED != 'true'
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    steps:
+      - name: Cancel queued and running checks for this branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
+          CURRENT_RUN_ID: ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          for status in queued in_progress; do
+            gh api "repos/$GITHUB_REPOSITORY/actions/runs" \
+              --method GET \
+              -f branch="$HEAD_BRANCH" \
+              -f event=pull_request \
+              -f status="$status" \
+              --paginate \
+              --jq '.workflow_runs[].id' |
+              while read -r run_id; do
+                if [ -n "$run_id" ] && [ "$run_id" -lt "$CURRENT_RUN_ID" ]; then
+                  gh api \
+                    --method POST \
+                    "repos/$GITHUB_REPOSITORY/actions/runs/$run_id/cancel" \
+                    --silent || true
+                fi
+              done
+          done
+          echo "CI is halted while pull request #${{ github.event.pull_request.number }} remains draft."

package/.github/workflows/opencode-security_self-ci.yml

@@ -4,11 +4,7 @@ on:
   pull_request:
     branches: [main, staging]
     types:
-      - opened
-      - synchronize
-      - reopened
       - ready_for_review
-      - converted_to_draft
   workflow_dispatch:
 
 permissions:
@@ -20,8 +16,7 @@ jobs:
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
       (github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.draft == false &&
-      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')))
+      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main'))
     runs-on: ubuntu-slim
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}
@@ -39,14 +34,11 @@ jobs:
         run: |
           enabled=false
           token=false
-          # The OPENCODE_SECURITY repository variable overrides the
-          # configuration: true opts a repository in, false opts it out, and
-          # an unset value falls back to the code-foundry configuration.
+          # OpenCode Security is controlled only by the repository or
+          # organization variable. An unset value is disabled.
           if [ "$OPENCODE_SECURITY_OVERRIDE" = "true" ]; then
             enabled=true
-          elif [ "$OPENCODE_SECURITY_OVERRIDE" = "false" ]; then
-            enabled=false
-          elif grep -Eq '^opencode_security:\s*(true|auto)\s*$' .github/code-foundry.yml 2>/dev/null; then enabled=true; fi
+          fi
           if [ -n "$OPENCODE_API_KEY" ]; then token=true; fi
           echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
           echo "token=$token" >> "$GITHUB_OUTPUT"

package/.github/workflows/release.yml

@@ -101,9 +101,9 @@ jobs:
             releaseType = fs.existsSync('package.json') ? 'node' : fs.existsSync('pyproject.toml') ? 'python' : fs.existsSync('Cargo.toml') ? 'rust' : fs.existsSync('version.txt') ? 'simple' : 'none'
           }
           if (!['node', 'python', 'rust', 'simple', 'none'].includes(releaseType)) throw new Error(`Unsupported release_type: ${releaseType}`)
-          const allowedStrategies = gitWorkflow === 'staging-release' ? ['rebase'] : ['rebase', 'squash']
+          const allowedStrategies = gitWorkflow === 'staging-release' ? ['rebase'] : ['squash']
           if (!allowedStrategies.includes(releaseMergeStrategy)) {
-            throw new Error(`release_merge_strategy must be "rebase"${gitWorkflow === 'staging-release' ? '' : ' or "squash" (direct topology)'} for automated release merges; got ${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}`)
+            throw new Error(`release_merge_strategy must be "${gitWorkflow === 'staging-release' ? 'rebase' : 'squash'}" for automated release merges; got ${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}`)
           }
           if (releaseType === 'none' || !fs.existsSync('package.json')) npmPublish = 'false'
           let legacyReleaseType = ''
@@ -218,9 +218,13 @@ jobs:
           for pr in "${release_prs[@]}"; do
             PR_DRAFT=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" --json isDraft --jq '.isDraft')
             if [ "$AUTO_MERGE" = true ]; then
-              if [ "$PR_DRAFT" = true ]; then
-                gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
+              if [ "$PR_DRAFT" = false ]; then
+                # A Release Please PR can be updated while already ready. Reset
+                # it so ready_for_review always starts validation for the exact
+                # current release head.
+                gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
               fi
+              gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
             else
               if [ "$PR_DRAFT" = false ]; then
                 gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"

package/.github/workflows/security.yml

@@ -99,7 +99,7 @@ jobs:
         env:
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security profile >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security profile >> "$GITHUB_OUTPUT"
       - id: matrix
         name: Build audit matrix
         env:
@@ -268,21 +268,24 @@ jobs:
             esac
           fi
 
-          printf 'toolchain_mode=%s\n' "$toolchain" >> "$GITHUB_OUTPUT"
-          printf 'package_manager=%s\n' "$package_manager" >> "$GITHUB_OUTPUT"
-          printf 'mise_tools=%s\n' "$mise_tools" >> "$GITHUB_OUTPUT"
+          {
+            printf 'toolchain_mode=%s\n' "$toolchain"
+            printf 'package_manager=%s\n' "$package_manager"
+            printf 'mise_tools=%s\n' "$mise_tools"
+          } >> "$GITHUB_OUTPUT"
       - name: Detect JavaScript
         id: applicability-javascript
         if: matrix.entry.language == 'javascript'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security should_run javascript >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security should_run javascript >> "$GITHUB_OUTPUT"
       - name: Detect Rust
         id: applicability-rust
         if: matrix.entry.language == 'rust'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security should_run rust >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security should_run rust >> "$GITHUB_OUTPUT"
       - name: Setup mise toolchain
         if: steps.audit-toolchain.outputs.mise_tools != ''
         uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4
         with:
+          version: 2026.9.2
           cache: false
           install_args: ${{ steps.audit-toolchain.outputs.mise_tools }}
       - name: Setup Node
@@ -316,7 +319,7 @@ jobs:
         if: >-
           matrix.entry.language == 'javascript' &&
           steps.applicability-javascript.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit javascript
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit javascript
       - name: Check Rust
         id: system-rust
         if: >-
@@ -349,7 +352,7 @@ jobs:
         if: >-
           matrix.entry.language == 'rust' &&
           steps.applicability-rust.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit rust
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit rust
       - name: Setup Python
         if: >-
           matrix.entry.language == 'python' &&
@@ -375,4 +378,4 @@ jobs:
           enable-cache: false
       - name: Audit Python dependencies
         if: matrix.entry.language == 'python'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit python
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit python

package/.github/workflows/test.yml

@@ -86,7 +86,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile unit >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile unit >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -104,7 +104,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Unit
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci unit
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci unit
       - name: Upload coverage
         if: >-
           always() &&
@@ -151,7 +151,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile performance >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile performance >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -170,7 +170,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Performance
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci performance
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci performance
       - name: Upload performance results
         if: >-
           always() &&
@@ -216,7 +216,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile integration >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile integration >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -234,7 +234,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Integration
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci integration
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci integration
 
   e2e:
     name: E2E
@@ -265,7 +265,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile e2e >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile e2e >> "$GITHUB_OUTPUT"
       - name: Cache browser binaries
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.browser == 'true'
         uses: ./.github/actions/cache
@@ -295,7 +295,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: E2E
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci e2e
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci e2e
 
   smoke:
     name: Smoke
@@ -326,7 +326,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile smoke >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile smoke >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -344,4 +344,4 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Smoke
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci smoke
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci smoke

package/.github/workflows/validation_self-ci.yml

@@ -4,11 +4,7 @@ on:
   pull_request:
     branches: [main, staging]
     types:
-      - opened
-      - synchronize
-      - reopened
       - ready_for_review
-      - converted_to_draft
 
 # Default every caller job to no repository permissions. Individual jobs grant
 # only the scopes their own validation path consumes.
@@ -22,10 +18,9 @@ concurrency:
 jobs:
   mode:
     name: Mode
-    # Draft updates still create a lightweight skipped workflow record so a
-    # converted-to-draft event can cancel in-flight validation, but no runner
-    # or reusable validation workflow starts until the PR is ready for review.
-    if: vars.CI_BILLING_PAUSED != 'true' && github.event.pull_request.draft == false
+    # The workflow is emitted only for ready_for_review, so draft pull requests
+    # register no skipped validation checks and allocate no validation runner.
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ubuntu-slim
     timeout-minutes: 10
     permissions:
@@ -64,7 +59,7 @@ jobs:
   validation:
     name: Validation
     needs: mode
-    if: vars.CI_BILLING_PAUSED != 'true' && github.event.pull_request.draft == false
+    if: vars.CI_BILLING_PAUSED != 'true'
     # Reusable workflows can only maintain or reduce the caller job's scopes.
     # The audit tier needs security-events: write for CodeQL uploads.
     permissions:

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.9.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.5...v1.9.6) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** finalize direct fleet policy ([#513](https://github.com/0xPlayerOne/code-foundry/issues/513)) ([98c59a7](https://github.com/0xPlayerOne/code-foundry/commit/98c59a713f31d0bc5e3b9893434d89dba3257550))
+
 ## [1.9.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.4...v1.9.5) (2026-09-08)
 
 

package/README.md

@@ -75,9 +75,10 @@ The standard workflow triggers are:
 - Draft PR automation for supported feature/fix branches.
 
 Automated feature/fix and staging-promotion pull requests open as drafts.
-Pull-request validation waits until a PR is marked ready for review; later
-commits retrigger it, and converting the PR back to draft cancels in-flight
-validation. Scheduled and manually dispatched audits are unaffected.
+Pull-request validation runs on the ready-for-review transition. After later
+commits, convert the PR to draft and mark it ready again so checks attach to
+the current head. Converting a PR to draft runs only the lightweight
+cancellation control. Scheduled and manually dispatched audits are unaffected.
 
 Jobs are language-aware and skip irrelevant setup inside the applicable
 aggregate checks. TypeScript uses Oxlint, Oxfmt, and Bun's native
@@ -102,7 +103,8 @@ checks, runners, coverage, caching, and custom workflow extensions.
 
 The contribution policy defaults to the `direct` workflow: feature PRs squash
 into `main`, and Release Please version PRs use the configured
-`release_merge_strategy` (rebase by default, or squash when opted in).
+`release_merge_strategy` (squash for direct repositories; rebase for the
+optional staging-release topology).
 Repositories with a preview/staging environment opt into
 `git_workflow: staging-release`, where feature PRs squash into `staging`, the
 promotion PR rebases into `main` (`merge_strategy: rebase`), and Release Please

package/docs/CONFIGURATION.md

@@ -35,7 +35,7 @@ repository manifests and source
 | `languages`                | detected list                                                                    | TypeScript, Rust, Python, Solidity                                                                                  |
 | `package_manager`          | `bun`, `pnpm`, `yarn`, `npm`, `none`                                             | JavaScript setup                                                                                                    |
 | `toolchain`                | `auto`, `native`, `mise`                                                         | Environment setup policy; defaults to `auto`                                                                        |
-| `staging_validation_mode`  | `fast`, `audit`                                                                  | Validation tier for pull requests targeting `staging`; defaults to `fast`                                           |
+| `staging_validation_mode`  | `fast`, `audit`                                                                  | Staging-release-only validation tier; omitted from direct repositories                                              |
 | `performance`              | `auto`, `true`, `false`                                                          | Run a deterministic performance task when a supported entrypoint exists; defaults to `auto`                         |
 | `performance_command`      | JSON argv array or array of argv arrays                                          | One or more ordered commands for non-package harnesses; package scripts take precedence                             |
 | `performance_profile`      | empty, `node-package`                                                            | Optional shared package import, memory, archive, and dependency budget harness                                      |
@@ -53,8 +53,8 @@ repository manifests and source
 | `npm_publish`              | `true` or `false`                                                                | Opt into npm publication                                                                                            |
 | `license`                  | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `apache-2.0`, `mit`, `preserve`, `none` | License policy; new repositories default to GPLv3                                                                   |
 | `git_workflow`             | `direct` (default), `staging-release`                                            | Branch/release model; `direct` opens feature branches into `main`, `staging-release` promotes `staging` into `main` |
-| `merge_strategy`           | `rebase`                                                                         | Promotion merge method for `staging` → `main`; only enforced by the `staging-release` topology                      |
-| `release_merge_strategy`   | `rebase`, `squash` (direct topology only)                                        | Merge method for Release Please version PRs into `main`; release automation fails closed on anything else           |
+| `merge_strategy`           | `squash` (direct), `rebase` (staging-release)                                    | Feature/promotion merge policy; direct repositories require squash                                                  |
+| `release_merge_strategy`   | `squash` (direct), `rebase` (staging-release)                                    | Merge method for Release Please version PRs into `main`; release automation fails closed on anything else           |
 | `runner` fields            | GitHub runner names                                                              | Per-workflow runner policy, including `performance_runner`                                                          |
 
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,
@@ -113,14 +113,13 @@ checks should remain separate from this deterministic validation task.
 
 ## OpenCode Security opt-in and opt-out
 
-`opencode_security` controls the optional OpenCode scan, and the generated
-caller ships in every repository. The `OPENCODE_SECURITY` repository variable
-overrides the configuration at run time, so a scan can be toggled on any
-repository without a configuration change or a new secret:
+The generated OpenCode caller ships in every repository. The
+`OPENCODE_SECURITY` repository or organization variable is its only enablement
+control, so a scan can be toggled without a code change:
 
 - `OPENCODE_SECURITY: true` opts the repository in.
 - `OPENCODE_SECURITY: false` opts the repository out.
-- unset falls back to the `opencode_security` configuration (default `false`).
+- unset is disabled.
 
 The scan only runs when it is enabled and the `OPENCODE_API_KEY` secret is
 present.
@@ -131,8 +130,8 @@ present.
 
 - `direct` (default): feature branches open pull requests directly into
   `main`. Validation and security scans run on every PR. No `staging` branch
-  exists, no promotion caller is generated, and `merge_strategy` is not
-  enforced. Release Please version PRs squash into `main`
+  exists, no promotion caller is generated, and `merge_strategy` must be
+  `squash`. Release Please version PRs squash into `main`
   (`release_merge_strategy: squash`). Dependabot updates target `main`. This is
   the right choice when a repository has no preview or staging environment.
 - `staging-release` (opt-in): feature branches squash into `staging`, a
@@ -181,4 +180,7 @@ Vercel's integration) by adding a small caller for the runtime's reusable
 for pull-request previews and `wrangler deploy` for production, records a
 GitHub deployment plus status with the workers.dev URL, and respects
 `CI_BILLING_PAUSED`. It requires the `CLOUDFLARE_API_TOKEN` and
-`CLOUDFLARE_ACCOUNT_ID` secrets in the consumer repository.
+`CLOUDFLARE_ACCOUNT_ID` secrets in the consumer repository. Bun consumers may
+also pass `build-script`, `install-working-directory`, and `bun-version`; the
+runtime installs the frozen lockfile and builds the Worker before invoking
+Wrangler.

package/docs/RELEASES.md

@@ -27,7 +27,7 @@ rebase`), and Release Please version PRs merge with **rebase**
 branches squash straight into `main` and Release Please version PRs squash into
 `main` (`release_merge_strategy: squash`). `merge_strategy` is not enforced. Release automation never defaults
 to a merge method and never merges with `--admin`: `staging-release` accepts
-only rebase for release PRs, while `direct` accepts rebase or squash.
+only rebase for release PRs, while `direct` requires squash.
 
 The release workflow opens or updates a versioned PR after changes reach
 `main`. Merging that PR updates the changelog, creates the Git tag and GitHub
@@ -54,7 +54,7 @@ selected, `merge_strategy` applies to promotion PRs (`staging` into `main`)
 and `release_merge_strategy` to Release Please version PRs; feature PRs into
 `staging` use squash merges. `code-foundry doctor`, `code-foundry sync`, and
 the release workflow reject any non-`rebase` `merge_strategy` or release
-strategy in `staging-release`; `direct` accepts `rebase` or `squash` for
+strategy in `staging-release`; `direct` requires `squash` for
 release PRs and never falls back to `merge`. Both keep `main` fully linear,
 which is what makes the post-release reconciliation possible. The final
 branch trees are inspected before mutation; validated main-only changes are

package/docs/WORKFLOWS.md

@@ -12,10 +12,12 @@ pull_request:
   # direct topology: branches: [main]
 ```
 
-The generated caller suppresses runner and reusable-workflow jobs while the
-pull request is a draft. It listens for `ready_for_review` to start validation,
-for later `synchronize` events to rerun it, and for `converted_to_draft` to
-cancel in-flight validation through the caller's concurrency group.
+The generated validation caller listens only for `ready_for_review`, so draft
+pull requests register no validation checks and allocate no validation runner.
+After any later update, convert the pull request to draft and mark it ready
+again so required checks attach to the current head. A separate lightweight
+draft-control caller listens for `converted_to_draft` and cancels queued or
+running pull-request workflows without creating skipped validation jobs.
 
 The separate `validation-audit.yml` caller is pinned to the configured released
 runtime and handles scheduled and manual audits:
@@ -39,7 +41,7 @@ opens those PRs as drafts. Promotion automation listens to `staging` pushes
 (staging-release only) and also always opens its PR as a draft. Release
 automation listens to `main` pushes.
 Custom deployment, indexing, search, Slither, or other workflows are
-repository-owned extensions and should keep their own triggers and permissions.
+repository-owned extensions and should use the same ready-transition policy.
 
 ## Billing pause
 
@@ -83,9 +85,9 @@ throughout the bounded release flow.
 Custom workflows are repository-owned and are not rewritten by sync. Add
 `if: vars.CI_BILLING_PAUSED != 'true'` to each custom root job that should
 honor the shared billing pause. The optional OpenCode Security scan honors a
-second toggle: the `OPENCODE_SECURITY` repository variable (`true`/`false`)
-overrides the `opencode_security` configuration per run, so individual
-repositories can opt in or out without a code change.
+second toggle: the `OPENCODE_SECURITY` repository or organization variable
+(`true`/`false`) is its only enablement control, so individual repositories can
+opt in or out without a code change.
 
 ## Standard workflow responsibilities
 
@@ -114,20 +116,20 @@ succeeds.
 
 The merge audit pins one merge method per transition. `code-foundry doctor`
 and `code-foundry sync` validate release strategy against the repository
-topology. Staging-release release PRs require `rebase`; direct release PRs
-allow `rebase` or `squash`. The release workflow fails closed on any other
-strategy and never falls back to `merge`.
+topology. Direct feature and release PRs require `squash`; staging-release
+promotion and release PRs require `rebase`. The release workflow fails closed
+on any other strategy and never falls back to `merge`.
 
-| Transition                                                 | Merge method                                                              | Enforcement                                                                                                                                                                |
-| ---------------------------------------------------------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Feature/fix PR into `main` (direct topology)               | Squash                                                                    | Contribution policy; see `CONTRIBUTING.md`                                                                                                                                 |
-| Feature/fix PR into `staging` (staging-release topology)   | Squash                                                                    | Contribution policy; see `CONTRIBUTING.md`                                                                                                                                 |
-| `staging` → `main` promotion PR (staging-release topology) | Rebase (`merge_strategy: rebase`)                                         | Code Foundry creates a one-commit head with `main` as its parent and the exact validated `staging` tree; `merge_strategy` must be `rebase`, and merge commits are rejected |
-| Release Please version PR into `main`                      | Configured (`release_merge_strategy`: rebase default; squash direct only) | Release automation fails closed on unsupported topology/strategy; never defaults to `merge`, never uses `--admin`                                                          |
+| Transition                                                 | Merge method                                | Enforcement                                                                                                                                                                |
+| ---------------------------------------------------------- | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Feature/fix PR into `main` (direct topology)               | Squash                                      | Contribution policy; see `CONTRIBUTING.md`                                                                                                                                 |
+| Feature/fix PR into `staging` (staging-release topology)   | Squash                                      | Contribution policy; see `CONTRIBUTING.md`                                                                                                                                 |
+| `staging` → `main` promotion PR (staging-release topology) | Rebase (`merge_strategy: rebase`)           | Code Foundry creates a one-commit head with `main` as its parent and the exact validated `staging` tree; `merge_strategy` must be `rebase`, and merge commits are rejected |
+| Release Please version PR into `main`                      | Squash (direct) or rebase (staging-release) | Release automation fails closed on unsupported topology/strategy; never defaults to `merge`, never uses `--admin`                                                          |
 
 The promotion rows above apply only to `staging-release`; `direct`
-repositories never generate a promotion caller and `merge_strategy` is not
-enforced for them.
+repositories never generate a promotion caller and require `merge_strategy:
+squash` for feature pull requests.
 
 Release auto-merge waits for required checks and then polls `mergeStateStatus`
 until it is `CLEAN`, or `UNSTABLE` with `mergeable` `MERGEABLE`, before
@@ -139,7 +141,7 @@ merge policy-blocked. The mergeability poll is bounded and fails closed on
 conflicts or timeout; releases without an automation token remain manual.
 
 Keeping `main` linear — rebase promotions and release PRs in the
-`staging-release` topology, or a single-commit rebase/squash release PR in the
+`staging-release` topology, or a single-commit squash release PR in the
 `direct` topology — is what lets the post-release reconciliation fast-forward
 or replay `staging` safely. `direct` repositories have no reconciliation step:
 releases merge straight into `main` with the configured
@@ -147,7 +149,7 @@ releases merge straight into `main` with the configured
 
 Protect `main` with the aggregate `Validation / Gate`. Require squash for
 feature/fix pull requests and permit the configured Release Please method:
-rebase in `staging-release`, or rebase/squash in `direct`. In the
+rebase in `staging-release`, or squash in `direct`. In the
 `staging-release` topology, protect `staging` the same way with a single GitHub
 Actions integration path. That path uses the
 GitHub Actions integration token by default, and optionally an SSH deploy key

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.9.5",
+  "version": "1.9.6",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -116,30 +116,45 @@ export function doctor(root, options = {}) {
     error(`unsupported git_workflow: ${workflow}; use direct or staging-release`)
   }
   const mergeStrategy = config.merge_strategy ?? 'rebase'
+  if (workflow === 'direct' && mergeStrategy !== 'squash') {
+    error(
+      `merge_strategy must be "squash" for direct feature pull requests; got "${mergeStrategy}".`
+    )
+  }
   if (workflow === 'staging-release' && mergeStrategy !== 'rebase') {
     error(
       `merge_strategy must be "rebase" for the staging-release promotion topology; got "${mergeStrategy}".`
     )
   }
   const releaseMergeStrategy = config.release_merge_strategy ?? ''
-  const allowedReleaseStrategies =
-    workflow === 'staging-release' ? ['rebase'] : ['rebase', 'squash']
+  const allowedReleaseStrategies = workflow === 'staging-release' ? ['rebase'] : ['squash']
   if (
     includesValue(features, 'release') &&
     !allowedReleaseStrategies.includes(releaseMergeStrategy)
   ) {
     error(
-      `release_merge_strategy must be "rebase"${workflow === 'staging-release' ? '' : ' or "squash" (direct topology)'} for automated release merges; got "${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}".`
+      `release_merge_strategy must be "${workflow === 'staging-release' ? 'rebase' : 'squash'}" for automated release merges; got "${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}".`
     )
   }
-  for (const name of ['validation', 'draft-pr', 'release-pr', 'release']) {
-    if (name === 'release-pr' && workflow !== 'staging-release') continue
-    if (includesValue(features, name) && !existsSync(join(target, `.github/workflows/${name}.yml`)))
-      error(`missing enabled workflow: ${name}.yml`)
-  }
+  if ('opencode_security' in config)
+    error('opencode_security is obsolete; use the OPENCODE_SECURITY repository variable.')
+  if (workflow === 'direct' && 'staging_validation_mode' in config)
+    error(
+      'staging_validation_mode is not valid in a direct-topology repository; run sync to prune it.'
+    )
   const validationEnabled =
     includesValue(features, 'validation') ||
     ['ci', 'test', 'security', 'codeql'].some((legacy) => includesValue(features, legacy))
+  for (const name of ['validation', 'draft-control', 'draft-pr', 'release-pr', 'release']) {
+    if (name === 'release-pr' && workflow !== 'staging-release') continue
+    const enabled = name === 'draft-control' ? validationEnabled : includesValue(features, name)
+    const candidates = [
+      join(target, `.github/workflows/${name}.yml`),
+      join(target, `.github/workflows/${name}_self-ci.yml`),
+    ]
+    if (enabled && !candidates.some((file) => existsSync(file)))
+      error(`missing enabled workflow: ${name}.yml`)
+  }
   const validationCaller = ['validation.yml', 'validation_self-ci.yml']
     .map((file) => join(target, `.github/workflows/${file}`))
     .find((file) => existsSync(file) && /pull_request:/.test(readFileSync(file, 'utf8')))
@@ -152,6 +167,12 @@ export function doctor(root, options = {}) {
         'validation caller is missing the Validation job; the Validation / Gate aggregate check cannot form.'
       )
     }
+    if (!/types:\n\s+- ready_for_review/.test(caller)) {
+      error('validation caller must wait for the ready_for_review transition.')
+    }
+    if (/\s+- (?:opened|synchronize|reopened|converted_to_draft)\s*$/.test(caller)) {
+      error('validation caller registers draft-time checks; run code-foundry sync.')
+    }
     if (
       !/uses:\s+(?:\.\/\.github\/workflows\/validation(?:-no-codeql)?\.yml|\S+\/\.github\/workflows\/validation(?:-no-codeql)?\.yml@)/.test(
         caller

package/src/commands/sync.mjs

@@ -43,6 +43,7 @@ const standardFiles = [
   '.github/ISSUE_TEMPLATE/feature_request.yml',
   '.github/workflows/validation.yml',
   '.github/workflows/validation-audit.yml',
+  '.github/workflows/draft-control.yml',
   '.github/workflows/draft-pr.yml',
   '.github/workflows/release-pr.yml',
   '.github/workflows/release.yml',
@@ -117,6 +118,15 @@ export function syncRepository(options) {
     throw new Error('Missing .github/code-foundry.yml; run init first.')
   const defaults = createDefaultConfig(target, source, existingConfig.git_workflow)
   let config = { ...defaults, ...existingConfig }
+  const workflow = gitWorkflow(config.git_workflow)
+  if (!['direct', 'staging-release'].includes(workflow)) {
+    throw new Error(`Unsupported git_workflow: ${workflow}; use direct or staging-release.`)
+  }
+  const obsoleteConfigKeys = [
+    'opencode_security',
+    ...(workflow === 'direct' ? ['staging_validation_mode'] : []),
+  ]
+  for (const key of obsoleteConfigKeys) delete config[key]
   // Resolve and validate the license policy before any sync writes occur
   // (including config/default additions) so an unsupported policy fails
   // fast without leaving partially generated files behind.
@@ -133,10 +143,11 @@ export function syncRepository(options) {
     writeOrReport(configPath, renderConfig(config), dryRun)
   } else {
     const missing = Object.keys(defaults).filter((key) => !(key in existingConfig))
-    if (missing.length) {
-      const current = readFileSync(configPath, 'utf8').trimEnd()
+    const original = readFileSync(configPath, 'utf8')
+    const normalized = removeConfigKeys(original, obsoleteConfigKeys).trimEnd()
+    if (missing.length || normalized !== original.trimEnd()) {
       const additions = missing.map((key) => renderConfigLine(key, defaults[key])).join('\n')
-      writeOrReport(configPath, `${current}\n${additions}\n`, dryRun)
+      writeOrReport(configPath, `${normalized}${additions ? `\n${additions}` : ''}\n`, dryRun)
     }
   }
 
@@ -155,17 +166,18 @@ export function syncRepository(options) {
   if (!['auto', 'native', 'mise'].includes(toolchain)) {
     throw new Error(`Unsupported toolchain: ${toolchain}; use auto, native, or mise.`)
   }
-  const workflow = gitWorkflow(config.git_workflow)
-  if (!['direct', 'staging-release'].includes(workflow)) {
-    throw new Error(`Unsupported git_workflow: ${workflow}; use direct or staging-release.`)
-  }
   const stagingValidationMode = configured(config.staging_validation_mode, 'fast')
-  if (!['fast', 'audit'].includes(stagingValidationMode)) {
+  if (workflow === 'staging-release' && !['fast', 'audit'].includes(stagingValidationMode)) {
     throw new Error(
       `Unsupported staging_validation_mode: ${stagingValidationMode}; use fast or audit.`
     )
   }
   const mergeStrategy = configured(config.merge_strategy, 'rebase')
+  if (workflow === 'direct' && mergeStrategy !== 'squash') {
+    throw new Error(
+      `Unsupported merge_strategy: ${mergeStrategy}; the direct topology requires squash for feature pull requests.`
+    )
+  }
   if (workflow === 'staging-release' && mergeStrategy !== 'rebase') {
     throw new Error(
       `Unsupported merge_strategy: ${mergeStrategy}; the staging-release topology requires rebase for staging to main promotions.`
@@ -177,11 +189,10 @@ export function syncRepository(options) {
     // release commits; the direct topology has no reconciliation step, so it
     // may also squash Release Please version PRs (a single-commit release PR
     // squashes to the identical tree, and release-please recommends squash).
-    const allowedReleaseStrategies =
-      workflow === 'staging-release' ? ['rebase'] : ['rebase', 'squash']
+    const allowedReleaseStrategies = workflow === 'staging-release' ? ['rebase'] : ['squash']
     if (!allowedReleaseStrategies.includes(releaseMergeStrategy)) {
       throw new Error(
-        `Unsupported release_merge_strategy: ${releaseMergeStrategy || '(unset)'}; release automation requires rebase (or squash in the direct topology) for Release Please version pull requests and never defaults to merge.`
+        `Unsupported release_merge_strategy: ${releaseMergeStrategy || '(unset)'}; release automation requires ${workflow === 'staging-release' ? 'rebase' : 'squash'} for Release Please version pull requests and never defaults to merge.`
       )
     }
   }
@@ -459,6 +470,7 @@ function shouldInclude(file, languages, features, config) {
   // the configuration or the variable enables it and the API key exists.
   if (file === '.github/workflows/opencode-security.yml') return true
   const workflow = file.match(/^\.github\/workflows\/([^/]+)\.yml$/)?.[1]
+  if (workflow === 'draft-control') return true
   // The staging promotion caller only exists in the staging-release topology;
   // direct repositories open feature branches into main and need no promotion.
   if (workflow === 'release-pr' && !isStagingRelease(config.git_workflow)) return false
@@ -695,7 +707,7 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       'The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.',
-      'The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. Feature branches never touch `staging`; repositories with a preview/staging environment opt into `git_workflow: staging-release` explicitly.',
+      'The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. This repository has one protected integration and release branch: `main`.',
     ],
     [
       'git switch staging\ngit pull --ff-only origin staging',
@@ -723,6 +735,10 @@ const DIRECT_DOC_REPLACEMENTS = {
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',
       '| Change | Target | Merge method | Merge gate |\n|----------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Working branch | `main` | Squash | All applicable required checks pass |\n| Release Please version PR | `main` | Squash (`release_merge_strategy`) | Validation gate and release policy pass |',
     ],
+    [
+      'Draft pull requests do not start runner-heavy validation. Marking a pull request ready for review starts the applicable validation tier; converting it back to draft cancels in-flight validation, and no replacement starts until it is ready again.',
+      'Draft pull requests do not start validation. Marking a pull request ready for review starts the applicable validation tier. Convert it back to draft after an update, then mark it ready again after every update so the required checks attach to the current head. Converting it to draft runs only the lightweight cancellation control.',
+    ],
     ['1. Create a focused branch from `staging`.', '1. Create a focused branch from `main`.'],
   ],
   '.github/SECURITY.md': [
@@ -1149,7 +1165,7 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     runtime_ref: `v${readPackageVersion(source)}`,
     ...runners,
     toolchain: 'auto',
-    staging_validation_mode: 'fast',
+    ...(stagingRelease ? { staging_validation_mode: 'fast' } : {}),
     performance: 'auto',
     performance_command: '',
     performance_profile: '',
@@ -1164,7 +1180,6 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     post_release: 'false',
     post_release_workflow: '',
     post_release_mode: 'auto',
-    opencode_security: 'false',
     opencode_security_model: '',
     sync_mode: 'overlay',
     custom_workflows: 'preserve',
@@ -1181,6 +1196,20 @@ function renderConfig(config) {
     .map(([key, value]) => renderConfigLine(key, value))
     .join('\n')}\n`
 }
+
+/** @param {string} content @param {string[]} keys */
+function removeConfigKeys(content, keys) {
+  if (!keys.length) return content
+  const rejected = new Set(keys)
+  return content
+    .split(/\r?\n/)
+    .filter((line) => {
+      const key = line.match(/^([A-Za-z0-9_-]+):/)?.[1]
+      return !key || !rejected.has(key)
+    })
+    .join('\n')
+}
+
 /** @param {string} key @param {string} value */
 function renderConfigLine(key, value) {
   if (value === '') return `${key}:`

package/src/lib/github-doctor.mjs

@@ -71,7 +71,42 @@ export function doctorGithub(root) {
     )
   }
 
-  const config = readConfig(root)
+  const config = readConfig(join(root, '.github/code-foundry.yml'))
+  const repositorySettings = ghJson(['api', `repos/${repository}`]) ?? {}
+  const configuredWorkflow = config.git_workflow ?? 'direct'
+  details.mergeMethods = {
+    squash: repositorySettings.allow_squash_merge,
+    rebase: repositorySettings.allow_rebase_merge,
+    merge: repositorySettings.allow_merge_commit,
+    autoMerge: repositorySettings.allow_auto_merge,
+  }
+  if (configuredWorkflow === 'direct') {
+    if (repositorySettings.allow_squash_merge !== true)
+      errors.push('direct topology requires squash merging to be enabled.')
+    if (
+      repositorySettings.allow_rebase_merge === true ||
+      repositorySettings.allow_merge_commit === true
+    )
+      errors.push('direct topology must disable rebase and merge-commit methods.')
+    if (config.release_type !== 'none' && repositorySettings.allow_auto_merge !== true)
+      errors.push('automated releases require repository auto-merge to be enabled.')
+    details.stagingBranchExists = Boolean(
+      ghJson(['api', `repos/${repository}/branches/staging`])?.name
+    )
+    if (details.stagingBranchExists)
+      errors.push('direct topology still has a staging branch; remove the obsolete branch.')
+    for (const ruleset of mainRulesets) {
+      for (const rule of ruleset.rules ?? []) {
+        if (rule?.type !== 'pull_request') continue
+        const methods = rule.parameters?.allowed_merge_methods ?? []
+        if (methods.length !== 1 || methods[0] !== 'squash') {
+          errors.push(
+            `main ruleset ${ruleset.name ?? ruleset.id} must allow only squash merges; got ${methods.join(', ') || '(none)'}.`
+          )
+        }
+      }
+    }
+  }
   if (
     ['workflow-dispatch', 'dispatch'].includes(config.post_release_mode) &&
     config.post_release !== 'false' &&
@@ -80,11 +115,19 @@ export function doctorGithub(root) {
   ) {
     errors.push('post-release workflow-dispatch mode requires CODE_FOUNDRY_TOKEN to be present.')
   }
+  const repositoryVariables =
+    ghJson(['variable', 'list', '--repo', repository, '--json', 'name,value']) ?? []
+  const opencodeSecurityVariable = Array.isArray(repositoryVariables)
+    ? repositoryVariables.find(
+        /** @param {{ name?: string }} variable */ (variable) =>
+          variable.name === 'OPENCODE_SECURITY'
+      )
+    : undefined
   const credentialChecks = {
     npmTokenPresent: secretNames.includes('NPM_TOKEN'),
     turboTokenPresent: secretNames.includes('TURBO_TOKEN'),
     turboTeamPresent: Boolean(
-      ghJson(['variable', 'list', '--repo', repository, '--json', 'name'])?.some(
+      repositoryVariables.some(
         /** @param {{ name?: string }} variable */ (variable) => variable.name === 'TURBO_TEAM'
       )
     ),
@@ -103,18 +146,15 @@ export function doctorGithub(root) {
       'turbo_remote is enabled but TURBO_TOKEN and/or TURBO_TEAM is not configured; remote caching will be skipped.'
     )
   if (
-    ['true', 'auto'].includes(config.opencode_security ?? 'false') &&
+    String(opencodeSecurityVariable?.value ?? 'false').toLowerCase() === 'true' &&
     !credentialChecks.opencodeApiKeyPresent
   )
     warnings.push(
-      'opencode_security is enabled but OPENCODE_API_KEY is not configured; the optional scan will be skipped.'
+      'OPENCODE_SECURITY is true but OPENCODE_API_KEY is not configured; the optional scan will be skipped.'
     )
-  if (['true', 'auto'].includes(config.opencode_security ?? 'false'))
-    details.credentials.opencodeSecurityConfigured = true
-  details.credentials.opencodeSecurityVariable =
-    ghJson(['variable', 'list', '--repo', repository, '--json', 'name'])?.some(
-      /** @param {{ name?: string }} variable */ (variable) => variable.name === 'OPENCODE_SECURITY'
-    ) ?? false
+  details.credentials.opencodeSecurityEnabled =
+    String(opencodeSecurityVariable?.value ?? 'false').toLowerCase() === 'true'
+  details.credentials.opencodeSecurityVariable = Boolean(opencodeSecurityVariable)
 
   const prs = ghJson([
     'pr',