create-agentic-workspace 0.0.0 → 0.2.2

package/README.md

@@ -0,0 +1,46 @@
+# create-agentic-workspace
+
+The pre-session bootstrap wizard for an [Agentic Foundry](https://github.com/lukasrepublic/agentic-foundry)
+workspace. `/foundry:init` can never scaffold its own permission floor — a model editing its own
+confinement is a shape the platform's own classifier denies — so the floor is written **before a
+session exists**, in the operator's own terminal.
+
+```bash
+npx create-agentic-workspace --dir my-workspace
+```
+
+The CLI walks you through the target directory, greenfield-vs-existing, git/GitHub identity, and
+stage mode, **previews every file it will write and every capability it will declare**, writes
+the workspace, and stops. It never runs `claude`, never accepts the workspace trust dialog, and
+never pre-grants anything — it *declares*, the platform's trust dialog is the consent ceremony.
+
+## What it does
+
+- Emits the plugin's reviewed three-tier permission map verbatim into the new workspace's
+  committed `.claude/settings.json`, alongside `extraKnownMarketplaces` and `enabledPlugins`
+  pinned to an exact marketplace ref (`autoUpdate: false` — no floating grant).
+- Absorbs `foundry-bootstrap.sh`'s out-of-session `git` commit-identity isolation (`--gh-account`),
+  proved differentially equal to the shipped script.
+- Scaffolds a seven-file, schema-valid workspace seed.
+- Re-running is a **reconcile with a drift report** — an edited managed file is reported
+  `drifted` and left byte-identical, never overwritten. Never-clobber is unconditional.
+
+## Flags
+
+Run `npx create-agentic-workspace --help` for the full, single-sourced flag list (every flag has
+an interactive-prompt twin, and `--yes` never prompts).
+
+## No telemetry
+
+This CLI collects and transmits nothing — **no telemetry** of any kind, and no opt-out to offer
+because there is nothing to opt out of. No credential is read, derived, or written; the one
+optional `gh api user` identity probe reads whatever authentication your own `gh` already holds
+without ever persisting, logging, or printing it beyond the name/email you confirm.
+
+## Supply-chain posture
+
+Zero third-party dependencies, `scripts` closed to `{test}` (no lifecycle hook of any kind), and
+every `import` a `node:` built-in or a relative path. See the plugin's own
+[Security posture](https://github.com/lukasrepublic/agentic-foundry/blob/main/specs/features/foundry/onboarding/bootstrap-cli/feat-foundry-bootstrap-cli.md)
+for the honest limits of what a build-time check over the source tree can and cannot attest about
+a published tarball.

package/bin/create-agentic-workspace.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// create-agentic-workspace — the npx entrypoint (AC-BCL-2). Argv parsing itself lives in
+// ../src/argv.mjs, derived from the one question table in ../src/questions.mjs; this file only
+// wires process.argv/stdio to the orchestrator and prints its output.
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import os from 'node:os';
+import { runCli } from '../src/run.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const pkgDir = path.resolve(__dirname, '..');
+
+// A bare leading positional (`create-agentic-workspace my-app`) is sugar for `--dir my-app`
+// (prior art: create-next-app/create-vite). It is translated here, before the table-derived
+// argv parser ever sees it — the parser's own accepted-flag set stays exactly the question
+// table (AC-BCL-2's bijection).
+const rawArgv = process.argv.slice(2);
+let argv = rawArgv;
+if (rawArgv.length > 0 && !rawArgv[0].startsWith('--')) {
+  argv = ['--dir', rawArgv[0], ...rawArgv.slice(1)];
+}
+
+const { exitCode, output } = await runCli(argv, {
+  cwd: process.cwd(),
+  isTTY: Boolean(process.stdin.isTTY),
+  input: process.stdin,
+  output: process.stdout,
+  homeDir: process.env.HOME || os.homedir(),
+  pkgDir,
+});
+
+process.stdout.write(`${output}\n`);
+process.exitCode = exitCode;

package/package.json

@@ -1,8 +1,40 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.0.0",
-  "description": "Placeholder reserving this name for the npm trusted-publishing bootstrap. Do not install; use the latest version.",
+  "version": "0.2.2",
+  "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
-  "bin": { "create-agentic-workspace": "bin.mjs" },
-  "files": ["bin.mjs", "package.json"]
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lukasrepublic/agentic-foundry.git",
+    "directory": "cli"
+  },
+  "homepage": "https://github.com/lukasrepublic/agentic-foundry/tree/main/cli#readme",
+  "bugs": {
+    "url": "https://github.com/lukasrepublic/agentic-foundry/issues"
+  },
+  "bin": {
+    "create-agentic-workspace": "bin/create-agentic-workspace.mjs"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "files": [
+    "bin/create-agentic-workspace.mjs",
+    "src",
+    "templates",
+    "permission-floor.json",
+    "package.json",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --test 'test/**/*.test.mjs'"
+  },
+  "foundry": {
+    "marketplace_name": "agentic-foundry",
+    "marketplace_repo": "lukasrepublic/agentic-foundry",
+    "plugin_name": "foundry",
+    "plugin_version": "1.2.2",
+    "pins_researched": "2026-08-02"
+  }
 }

package/permission-floor.json

@@ -0,0 +1,411 @@
+{
+  "schema_version": 1,
+  "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
+  "generated_for_plugin_version": "1.2.2",
+  "entries": [
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",
+      "tier": "allow",
+      "rationale": "read-only CLI over foundry_contract; validates/hashes a contract, writes nothing"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-apply-runtime-gitignore.sh:*)",
+      "tier": "allow",
+      "rationale": "idempotent managed-block writer confined to <repo-root>/.gitignore; refuses on malformed state"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-audit-prepare.py:*)",
+      "tier": "allow",
+      "rationale": "deterministic host-side Claim-Check binder for the audit engine; read-only path loader"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-audit-record.py:*)",
+      "tier": "allow",
+      "rationale": "writes one schema-validated evidence row to .foundry/audit-ledger.jsonl at the end of /foundry:audit"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-build-citation-graph.py:*)",
+      "tier": "allow",
+      "rationale": "builds the derived citation-graph cache from plain-text source-of-truth files"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-coherence-check.py:*)",
+      "tier": "allow",
+      "rationale": "advisory citation-coherence sweep; builds the graph fresh in-memory, never a merge gate"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-config.py:*)",
+      "tier": "allow",
+      "rationale": "adopter-config drift check; check writes nothing, adopt writes exactly one baseline file"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-content-conformance.py:*)",
+      "tier": "allow",
+      "rationale": "declarative content shape/leak checker the operator runs over docs/pack/skill content atoms"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-dashboard-fidelity.py:*)",
+      "tier": "allow",
+      "rationale": "N/N MATCH fidelity gate between golden dashboards and the code-generated renderer output"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-deploy-status.py:*)",
+      "tier": "allow",
+      "rationale": "observe-only deployed-artifact-identity cross-check against ArgoCD sync + build provenance"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-distill.py:*)",
+      "tier": "allow",
+      "rationale": "reads dated learning-capture files and distills them; run directly by the operator per learn-distill"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-doctor.py)",
+      "tier": "allow",
+      "rationale": "bare invocation runs the thin 5-check health probe; read-only, fail-open; exact rule deliberately — flag-qualified forms fall through to a prompt so no allow-prefix can reach the --heal ceremony (security review 2026-08-02)."
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-env-hygiene.py:*)",
+      "tier": "allow",
+      "rationale": "status/reap over machine-scoped worker sandbox envs; confined to isolated per-worker state"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-fleet-doctor.py:*)",
+      "tier": "allow",
+      "rationale": "read-only health sweep across all adopter handbooks wiring the plugin on one machine"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-fleet-roster.py:*)",
+      "tier": "allow",
+      "rationale": "read-only live roster render, one row per native session, via the session-registry"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-fleet-session-machinery.py:*)",
+      "tier": "allow",
+      "rationale": "derives a typed process-machinery overlay for the fleet surface; read-only"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-fleet-session-registry.py:*)",
+      "tier": "allow",
+      "rationale": "thin read-only overlay of foundry work-context onto the native session list"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-graph-mcp.py:*)",
+      "tier": "allow",
+      "rationale": "advisory citation-graph staleness surface / MCP server; run in CONTRIBUTING dev loop + CI"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-index.py:*)",
+      "tier": "allow",
+      "rationale": "read-only machinery index derived on demand from skills/agents frontmatter"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-native-todo-discipline.py:*)",
+      "tier": "allow",
+      "rationale": "SessionStart injection directive over the native Tasks list; no external writes"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-prepublication-leak-scan.py:*)",
+      "tier": "allow",
+      "rationale": "pre-visibility-flip leak scan; read-only denylist/term-matching over the tree"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-project-rtm.py:*)",
+      "tier": "allow",
+      "rationale": "read-only requirements-traceability-matrix report over committed governance records"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-release-acceptance.py:*)",
+      "tier": "allow",
+      "rationale": "pre-cut acceptance gate wrapping the tool's own first-party claude plugin validators"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-spec-lint.py:*)",
+      "tier": "allow",
+      "rationale": "Phase 0 deterministic pre-lint wrapper for /foundry:spec-review; read-only checks"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-stack-profile.py --load:*)",
+      "tier": "allow",
+      "rationale": "read-only resolve of the already-locked stack-profile.lock"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-stack-profile.py --validate:*)",
+      "tier": "allow",
+      "rationale": "read-only profile validation against packs/ or a path"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-statusline.sh:*)",
+      "tier": "allow",
+      "rationale": "read-only, fail-open statusline renderer; prints and exits 0"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-subagent-statusline.sh:*)",
+      "tier": "allow",
+      "rationale": "read-only, fail-open sub-agent statusline renderer; prints and exits 0"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-verify.py:*)",
+      "tier": "allow",
+      "rationale": "profile-parameterized static-validation + test executor (SDLC steps 7 & 8); dev-loop CLI"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-wave-plan.py:*)",
+      "tier": "allow",
+      "rationale": "deterministic release-wave planning over a release manifest; read-only"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-wt:*)",
+      "tier": "allow",
+      "rationale": "worktree wrapper, workspace-root-confined by construction; consumed by WorktreeCreate + dispatch"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_ceremony_tier.py:*)",
+      "tier": "allow",
+      "rationale": "one-line ceremony-tier classification printed by /foundry:intake and /foundry:spec-review"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_control_plane.py:*)",
+      "tier": "allow",
+      "rationale": "read-only control-plane preflight probe run at /foundry:init"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_dispatch_lint.py:*)",
+      "tier": "allow",
+      "rationale": "advisory context-diet lint over an assembled dispatch prompt; fail-open, flags-only"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_env_isolation.py:*)",
+      "tier": "allow",
+      "rationale": "read-only per-worker env-isolation check consumed by the env-reap hook"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_grounding_conformance.py:*)",
+      "tier": "allow",
+      "rationale": "classifies corpus grounding conformance against an already-built system snapshot; read-only"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_intake_grounding.py:*)",
+      "tier": "allow",
+      "rationale": "read-only intake schema-defect / grounding checker over a project dir"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_repo_fleet.py status:*)",
+      "tier": "allow",
+      "rationale": "read-only per-repo status rows through the hardened choke point; no network, no mutation."
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_repo_fleet.py validate:*)",
+      "tier": "allow",
+      "rationale": "read-only manifest⟷reality⟷gitignore round-trip incl. the reverse scan; surfaces, never fixes."
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_repo_registry.py:*)",
+      "tier": "allow",
+      "rationale": "Read-only registry-integrity report (feat-foundry-repo-registry-formalization): physical-confinement + gitignore-pairing + origin-match rows over .claude/foundry-project.json; single read-only git choke point, sanitizing emission sink, writes nothing. Tiered at merge-reconciliation when the script landed after the map (the closed-world tripwire firing as designed)."
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_run_metrics.py:*)",
+      "tier": "allow",
+      "rationale": "posttooluse telemetry logger invoked by the run-metrics hook; appends a loss-tracking line"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_session_mode.py:*)",
+      "tier": "allow",
+      "rationale": "session-scoped mode/fork-policy set-and-resolve state-writer; not a release/repo ceremony"
+    },
+    {
+      "rule": "Bash(claude plugin tag:*)",
+      "tier": "ask",
+      "rationale": "a tree path arrives between the verb and --push, not prefix-keyable at finer grain; a dry-run also prompts"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-authorize.py:*)",
+      "tier": "ask",
+      "rationale": "ceremony: front-authorization; --yes/--skip-audit-reason arrive after other args, not prefix-keyable, so the whole script is ask"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-bootstrap.sh:*)",
+      "tier": "ask",
+      "rationale": "writes GLOBAL git config (--global --unset-all/--get-regexp, two includeIf.*.path writes); machine-scope state"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-cut-release.py:*)",
+      "tier": "ask",
+      "rationale": "ER class-C release-cut ceremony marker, taken at the coarser fail-safe tier; the script itself mutates no tree"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-decommission.py gate-check:*)",
+      "tier": "ask",
+      "rationale": "ceremony: leading subcommand, gate-checks a decommission"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-decommission.py record:*)",
+      "tier": "ask",
+      "rationale": "ceremony: leading subcommand, writes a decommission record"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-doctor.py --heal:*)",
+      "tier": "ask",
+      "rationale": "pinned ceremony (AC-PFM-3): documented no-op today, but the flag is the shape a future auto-heal would reuse"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-project-sync.py:*)",
+      "tier": "ask",
+      "rationale": "re-tiered by spec review: non-dry-run path issues authenticated GraphQL write mutations against a remote"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-stack-profile.py --relock:*)",
+      "tier": "ask",
+      "rationale": "pinned ceremony (AC-PFM-3): re-writes the lock in place; leading flag verified prefix-keyable; the split tier with --validate/--load is safe ONLY because main() checks those flags before --relock — a combined invocation runs the earlier-checked verb (security review 2026-08-02)."
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-upstream-submit.py:*)",
+      "tier": "ask",
+      "rationale": "ceremony: --create arrives after other args, not prefix-keyable, so the whole script is ask"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_release.py accept:*)",
+      "tier": "ask",
+      "rationale": "ceremony: leading subcommand, appends a PRACTICE acceptance record"
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_repo_fleet.py foreach:*)",
+      "tier": "ask",
+      "rationale": "foreach fans an operator-supplied command over every present repo — arbitrary exec from the agent's hands prompts; the operator's own in-terminal use is unaffected."
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_repo_fleet.py sync:*)",
+      "tier": "ask",
+      "rationale": "sync clones/fetches from manifest-declared remotes — the factory's first network egress; the manifest write is the standing consent, the ask is the per-run operator moment (feat-foundry-workspace-repo-verbs). Subcommand split is reach-disjoint: argparse positional subcommands, first token decides the verb."
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_repo_attach.py attach:*)",
+      "tier": "ask",
+      "rationale": "attach-existing writes the manifest + gitignore pairing and hands the new row to reconcile (clone/fetch egress) - a workspace mutation with network reach prompts per run; the preview is the consent surface (feat-foundry-wizard-attach-repo-flow)."
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_repo_attach.py create:*)",
+      "tier": "ask",
+      "rationale": "create-new invokes `gh repo create` under the operator's identity then falls through to attach - remote resource creation always prompts. Subcommand split is reach-disjoint: argparse positional subcommands, first token decides the verb (feat-foundry-wizard-attach-repo-flow)."
+    },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_tier_preflight.py:*)",
+      "tier": "ask",
+      "rationale": "--apply POSTs repository rulesets with an Administration (write) token; it writes the merge floor itself"
+    },
+    {
+      "rule": "Bash(docker system prune:*)",
+      "tier": "deny",
+      "rationale": "absolute anti-pattern: unattended bulk local-state destruction"
+    },
+    {
+      "rule": "Bash(gh pr merge --admin:*)",
+      "tier": "deny",
+      "rationale": "absolute anti-pattern: bypasses required reviews/checks on the merge floor"
+    },
+    {
+      "rule": "Bash(git push --force:*)",
+      "tier": "deny",
+      "rationale": "absolute anti-pattern: force-push; belt-and-braces behind the hook-enforced floor (R3)"
+    },
+    {
+      "rule": "Bash(tofu destroy -auto-approve:*)",
+      "tier": "deny",
+      "rationale": "absolute anti-pattern: unattended destructive infra apply with no plan review"
+    }
+  ],
+  "not_invoked": [
+    {
+      "script": "foundry_audit_ledger.py",
+      "rationale": "library: no argparse/__main__; imported by foundry-audit-record.py for the ledger schema/writer"
+    },
+    {
+      "script": "foundry_audit_log.py",
+      "rationale": "library: no argparse/__main__; shared audit-log helper imported by other scripts"
+    },
+    {
+      "script": "foundry_audit_preconditions.py",
+      "rationale": "the shipped __main__ is a manual-invocation debug CLI for a human/operator; never instructed by any skill/hook"
+    },
+    {
+      "script": "foundry_authz.py",
+      "rationale": "library: no argparse/__main__; imported for authorization/spec-state reads (e.g. foundry_authz.spec_state)"
+    },
+    {
+      "script": "foundry_blueprint.py",
+      "rationale": "library: no argparse/__main__; blueprint load/render helpers imported by stack-profile"
+    },
+    {
+      "script": "foundry_contract.py",
+      "rationale": "library: no argparse/__main__; acceptance-contract schema/hash helpers imported by other scripts"
+    },
+    {
+      "script": "foundry_ctx_posture.py",
+      "rationale": "library: no argparse/__main__; command-policy posture helpers imported by id-* skills"
+    },
+    {
+      "script": "foundry_graph.py",
+      "rationale": "library: no argparse/__main__; citation-graph primitives imported by the graph CLIs"
+    },
+    {
+      "script": "foundry_id_alloc.py",
+      "rationale": "library: no argparse/__main__; id-allocation helpers imported by id-* skills"
+    },
+    {
+      "script": "foundry_id_apply.py",
+      "rationale": "pure decision library: no argparse/main()/__main__; exposes classify_gitops/decide_apply as pure functions (R5)"
+    },
+    {
+      "script": "foundry_permission_floor.py",
+      "rationale": "pure library: no argparse/main()/__main__; imported by scripts/foundry-doctor.py's permission-floor probe (feat-foundry-doctor-permission-floor-check), never in command position"
+    },
+    {
+      "script": "foundry_plan_model.py",
+      "rationale": "the shipped __main__ is a convenience CLI (parse a plan JSON on stdin); the shipped workflow only imports its parsers"
+    },
+    {
+      "script": "foundry_pr_review.py",
+      "rationale": "library: no argparse/__main__; PR-review helpers imported by other scripts"
+    },
+    {
+      "script": "foundry_project_config.py",
+      "rationale": "the shipped __main__ prints resolved governance paths for a human; the shipped workflow only imports its reader"
+    },
+    {
+      "script": "foundry_project_tracking.py",
+      "rationale": "has an argparse CLI, but it is never instructed by any skill/hook; the workflow only imports read_config"
+    },
+    {
+      "script": "foundry_realization.py",
+      "rationale": "library: no argparse/__main__; loads foundry_plan_model.py dynamically for the empties-check"
+    },
+    {
+      "script": "foundry_reconcile.py",
+      "rationale": "library: no argparse/__main__; reconciliation helpers imported by other scripts"
+    },
+    {
+      "script": "foundry_sandbox_signature.py",
+      "rationale": "library: no argparse/__main__; sandbox-apply signature helpers, dormant per skills/infra-sandboxed-apply"
+    },
+    {
+      "script": "foundry_security_review.py",
+      "rationale": "library: no argparse/__main__; security-review helpers imported by other scripts"
+    },
+    {
+      "script": "foundry_system_snapshot.py",
+      "rationale": "the shipped __main__/CLI is never instructed; the workflow only imports build_system_snapshot"
+    },
+    {
+      "script": "foundry-statusline-wrapper.sh",
+      "rationale": "installed into the adopter repo; the platform's statusLine key runs the installed copy, never an agent Bash call"
+    },
+    {
+      "script": "foundry-subagent-statusline-wrapper.sh",
+      "rationale": "installed into the adopter repo; the platform's subagentStatusLine key runs the installed copy, never an agent Bash call"
+    },
+    {
+      "script": "foundry-direnv-lib.sh",
+      "rationale": "direnv global-lib file, sourced by direnv, definitions only; not owner-executable, outside the AC-PFM-2 closed world"
+    }
+  ]
+}

package/src/answers.mjs

@@ -0,0 +1,68 @@
+// answers.mjs — resolves the final answer set from parsed argv + (optionally) interactive
+// prompts, honoring AC-BCL-2's "yes-mode: zero prompts" invariant.
+import { createInterface } from 'node:readline/promises';
+import { RefusalError } from './util.mjs';
+
+function coerceBoolean(raw) {
+  const v = String(raw).trim().toLowerCase();
+  if (v === '' ) return undefined;
+  return v === 'y' || v === 'yes' || v === 'true' || v === '1';
+}
+
+/** yesMode is true when --yes was given OR stdin is not a TTY (AC-BCL-2): both suppress every
+ * prompt, including the write-phase confirmation (AC-BCL-3). */
+export function isYesMode(values, isTTY) {
+  return values.yes === true || !isTTY;
+}
+
+/** Resolve every table record to a final value. In yes-mode: apply declared defaults, refusing
+ * (naming the flag) on an unanswered required record. Interactively: prompt only records marked
+ * `interactive: true` and not already provided by a flag; a non-interactive record always takes
+ * its provided value or its default. */
+export async function resolveAnswers(table, parsed, { yesMode, input, output }) {
+  const { values, provided } = parsed;
+  const resolved = { ...values };
+
+  const needsPrompt = yesMode
+    ? []
+    : table.filter((r) => r.interactive && !provided.has(r.id));
+
+  let rl = null;
+  if (needsPrompt.length > 0) {
+    rl = createInterface({ input, output });
+  }
+  try {
+    for (const rec of table) {
+      if (provided.has(rec.id)) continue;
+      if (yesMode || !rec.interactive) {
+        if (rec.required) {
+          throw new RefusalError(`missing required flag: --${rec.flag}`, rec.flag);
+        }
+        resolved[rec.id] = rec.default;
+        continue;
+      }
+      const suffix = rec.choices ? ` (${rec.choices.join('/')})` : rec.default !== undefined && rec.default !== '' ? ` [${rec.default}]` : '';
+      const answer = (await rl.question(`${rec.prompt}${suffix}: `)).trim();
+      if (rec.type === 'boolean') {
+        const b = coerceBoolean(answer);
+        resolved[rec.id] = b === undefined ? rec.default : b;
+      } else if (answer === '') {
+        if (rec.required) {
+          throw new RefusalError(`missing required flag: --${rec.flag}`, rec.flag);
+        }
+        resolved[rec.id] = rec.default;
+      } else {
+        if (rec.choices && !rec.choices.includes(answer)) {
+          throw new RefusalError(
+            `--${rec.flag} must be one of: ${rec.choices.join(', ')} (got ${JSON.stringify(answer)})`,
+            rec.flag,
+          );
+        }
+        resolved[rec.id] = answer;
+      }
+    }
+  } finally {
+    if (rl) rl.close();
+  }
+  return resolved;
+}