create-agentic-workspace 0.14.0 → 0.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.14.0",
+    "plugin_version": "1.15.0",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.14.0",
+  "generated_for_plugin_version": "1.15.0",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",
@@ -64,29 +64,19 @@
       "rationale": "bare invocation runs the thin 5-check health probe; read-only, fail-open; exact rule deliberately — flag-qualified forms fall through to a prompt so no allow-prefix can reach the --heal ceremony (security review 2026-08-02)."
     },
     {
-      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-env-hygiene.py:*)",
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-done-when-backfill.py --dry-run:*)",
       "tier": "allow",
-      "rationale": "status/reap over machine-scoped worker sandbox envs; confined to isolated per-worker state"
+      "rationale": "read-only report of every acceptance-contract.yaml lacking a top-level done_when and its derivation; writes nothing (AC-SUB-3)"
     },
     {
-      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-fleet-doctor.py:*)",
-      "tier": "allow",
-      "rationale": "read-only health sweep across all adopter handbooks wiring the plugin on one machine"
-    },
-    {
-      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-fleet-roster.py:*)",
-      "tier": "allow",
-      "rationale": "read-only live roster render, one row per native session, via the session-registry"
-    },
-    {
-      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-fleet-session-machinery.py:*)",
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-env-hygiene.py:*)",
       "tier": "allow",
-      "rationale": "derives a typed process-machinery overlay for the fleet surface; read-only"
+      "rationale": "status/reap over machine-scoped worker sandbox envs; confined to isolated per-worker state"
     },
     {
-      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-fleet-session-registry.py:*)",
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-governance-budget.py:*)",
       "tier": "allow",
-      "rationale": "thin read-only overlay of foundry work-context onto the native session list"
+      "rationale": "read-only report of skill prose lines / shipped scripts / floor rows / hook commands / pytest count; prints only, writes nothing (AC-SUB-4)"
     },
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-graph-mcp.py:*)",
@@ -278,6 +268,11 @@
       "tier": "ask",
       "rationale": "ceremony: leading subcommand, writes a decommission record"
     },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-done-when-backfill.py --apply:*)",
+      "tier": "ask",
+      "rationale": "writes a derived done_when: block into every acceptance-contract.yaml it backfills across the workspace's whole spec corpus; the --dry-run flag above is the read-only tier (AC-SUB-3)"
+    },
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-doctor.py --heal:*)",
       "tier": "ask",

package/src/cleanup.mjs

@@ -16,9 +16,9 @@ import {
 
 /** The union of every scope record's `version` for `<plugin>@<marketplace>` in
  * installed_plugins.json, plus the refreshed marketplace manifest's `version` — NEVER the highest
- * semver on disk. `scripts/foundry-fleet-doctor.py:70-83`'s `installed_index()` is correct for its
- * own job (report ONE adopter's resolved plugin) and unsafe here: it `break`s after the first
- * record and would silently drop a scope pinned to an older version that is still live. */
+ * semver on disk. Stopping after the first matching record (rather than unioning every one) would
+ * silently drop a scope pinned to an older version that is still live — this cleanup path must
+ * never prune a directory a live scope still resolves to. */
 export function deriveLiveSet({ registry, manifestVersion, pluginKey }) {
   if (!registry.ok) return { ok: false, reason: registry.reason };
   const records = scopeRecordsFor(registry.doc, pluginKey);