create-agentic-workspace 0.17.5 → 0.18.0

package/README.md

@@ -52,7 +52,7 @@ it does invoke `claude` (bounded by a closed allowlist — see its own README).
 - `.foundry/permissions.yaml` is a SEED, not a managed file: written once when absent (an empty,
   commented starter for standing grants — see the plugin's `docs/how-to/standing-grants.md`),
   then operator-owned — reported `[kept]`, never compared, never drifted, never written again.
-- The Amendments backfill: every `specs/**/feat-*.md` with a normative region and no
+- The Amendments backfill: every `specs/**/*.md` (any basename, since v1.17.1) with a normative region and no
   `## Amendments` section after it gets the empty section `/foundry:amend` requires, reported as
   one row (`[amendments] backfilled N of M specs (K already present, J skipped: no normative
   region)`). Outside the hashed region, so no `spec_sha256` moves; already-present, marker-less and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.17.5",
+  "version": "0.18.0",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -35,7 +35,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.17.5",
+    "plugin_version": "1.18.0",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.17.5",
+  "generated_for_plugin_version": "1.18.0",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",
@@ -233,11 +233,6 @@
       "tier": "allow",
       "rationale": "routine-wake (autonomy-continuation R3, AC-RWK-1): validates <programme>/--deck-name as [a-z0-9-]+ slugs and prints the self-contained Routine prompt plus the /schedule recipe and prerequisites; reads no corpus state and writes nothing"
     },
-    {
-      "rule": "Bash(claude plugin tag:*)",
-      "tier": "ask",
-      "rationale": "a tree path arrives between the verb and --push, not prefix-keyable at finer grain; a dry-run also prompts"
-    },
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-authorize.py:*)",
       "tier": "ask",
@@ -358,11 +353,6 @@
       "tier": "deny",
       "rationale": "absolute anti-pattern: bypasses required reviews/checks on the merge floor"
     },
-    {
-      "rule": "Bash(git push --force:*)",
-      "tier": "deny",
-      "rationale": "absolute anti-pattern: force-push; belt-and-braces behind the hook-enforced floor (R3)"
-    },
     {
       "rule": "Bash(tofu destroy -auto-approve:*)",
       "tier": "deny",

package/src/amendmentsBackfill.mjs

@@ -103,7 +103,7 @@ export function planAmendmentsBackfill({ physicalRoot }) {
     else if (verdict === 'no-marker') skipped += 1;
     else toAppend.push(abs);
   }
-  return { toAppend, present, skipped, symlinks, total: files.length, applied: false };
+  return { physicalRoot, toAppend, present, skipped, symlinks, total: files.length, applied: false };
 }
 
 /** The bytes to append for a given current text: the block, preceded by one newline when the text
@@ -119,32 +119,43 @@ export function appendBytesFor(text) {
  * gained the section between plan and apply is left alone. Returns the count actually written. */
 export function applyAmendmentsBackfill(plan) {
   let written = 0;
+  // v1.18.0 (AC-V118C-8): every planned spec lands in exactly one bucket — written, gained the
+  // section since the plan (present), or failed — so backfilled + present + skipped + failed ==
+  // total and the post-upgrade arithmetic check can never refuse on an uncounted file.
+  let failed = 0;
+  const writtenPaths = [];
   for (const abs of plan.toAppend) {
     let text;
     try {
       text = fs.readFileSync(abs, 'utf-8');
     } catch {
+      failed += 1;
       continue;
     }
-    if (classifySpec(text) !== 'absent') continue;
+    if (classifySpec(text) !== 'absent') { plan.present += 1; continue; }
     const tmp = `${abs}.amendments-backfill.tmp`;
     // v1.17.1 security review Risk 2: `wx` refuses to write through a planted sibling — a symlink
     // or a leftover file at the temp path means this spec is skipped, never written elsewhere.
     try {
       fs.writeFileSync(tmp, text + appendBytesFor(text), { encoding: 'utf-8', flag: 'wx' });
     } catch {
+      failed += 1;
       continue;
     }
     try {
       fs.renameSync(tmp, abs);
     } catch {
       fs.rmSync(tmp, { force: true });
+      failed += 1;
       continue;
     }
     written += 1;
+    if (plan.physicalRoot) writtenPaths.push(path.relative(plan.physicalRoot, abs).split(path.sep).join('/'));
   }
   plan.applied = true;
   plan.written = written;
+  plan.failed = failed;
+  plan.writtenPaths = writtenPaths;
   return written;
 }
 
@@ -154,7 +165,8 @@ export function applyAmendmentsBackfill(plan) {
 export function renderAmendmentsRow(plan) {
   if (!plan || (plan.total === 0 && plan.symlinks.length === 0)) return null;
   const n = plan.applied ? plan.written : plan.toAppend.length;
-  let row = `  [amendments] backfilled ${n} of ${plan.total} specs (${plan.present} already present, ${plan.skipped} skipped: no normative region)`;
+  const verb = plan.applied ? 'backfilled' : 'would backfill';
+  let row = `  [amendments] ${verb} ${n} of ${plan.total} specs (${plan.present} already present, ${plan.skipped} skipped: no normative region${plan.failed ? `, ${plan.failed} FAILED to write` : ''})`;
   if (plan.symlinks.length > 0) {
     row += `; ${plan.symlinks.length} symlinked spec file(s) not touched: ${plan.symlinks.map((p) => path.basename(p)).join(', ')}`;
   }

package/src/floorReconcile.mjs

@@ -32,7 +32,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { confinedJoin, RefusalError } from './util.mjs';
-import { buildSettings, classifyDrift } from './permissionFloor.mjs';
+import { PROJECTED_TIERS, buildSettings, classifyDrift } from './permissionFloor.mjs';
 
 /** The drift classes whose findings name a rule this module may ADD. Everything else the
  * classifier can emit is report-only: blanket-allow, ask-shadowed, ask-shadowed-ceremony and
@@ -147,6 +147,8 @@ export function planAdditions({ findings, map, settingsObj, pins }) {
   for (const f of findings) {
     if (!ADDITIVE_CLASSES.includes(f.class)) continue;
     const tier = tierOfRule.get(f.rule);
+    // v1.18.0: only the projected tier (deny) is ever written; script rows are a registry
+    if (!PROJECTED_TIERS.includes(tier)) continue;
     // the tier comes from the map; a finding naming a rule the map does not declare is not ours
     if (tier === undefined || tier !== TIER_OF_CLASS[f.class]) continue;
     if (tier === 'allow' && withheldAllow) continue;
@@ -197,7 +199,9 @@ function escapeLiteral(s) {
  * a second hardcoded copy of it — the same one-source-of-truth reasoning foldRegexFromGlob already
  * documents for the addition side. */
 function floorRootShapeRe(pluginRootGlob) {
-  return new RegExp(`^Bash\\(${escapeLiteral(pluginRootGlob)}/scripts/(${ROOT_SHAPE_NAME_RE})(?: (.+))?:\\*\\)$`);
+  // v1.18.0: the `:*` suffix is optional — earlier releases also wrote a bare row (the doctor's
+  // `Bash(<glob>/scripts/foundry-doctor.py)`), and retirement must take that back too.
+  return new RegExp(`^Bash\\(${escapeLiteral(pluginRootGlob)}/scripts/(${ROOT_SHAPE_NAME_RE})(?: (.+?))?(?::\\*)?\\)$`);
 }
 
 /** Parse `rule` against the floor's own root-glob shape (the same shape `buildSettings` writes).
@@ -234,7 +238,7 @@ function floorPinnedShapeRe(pluginRootGlob) {
     seen += 1;
     return seen === stars ? '(\\*|\\d+\\.\\d+\\.\\d+[A-Za-z0-9.+-]*)' : '(\\*|[A-Za-z0-9_-]+)';
   });
-  return new RegExp(`^Bash\\(${src}/scripts/(${ROOT_SHAPE_NAME_RE})(?: (.+))?:\\*\\)$`);
+  return new RegExp(`^Bash\\(${src}/scripts/(${ROOT_SHAPE_NAME_RE})(?: (.+?))?(?::\\*)?\\)$`);
 }
 
 /** Parse `rule` as a version-/marketplace-PINNED variant of the floor's own row shape. Returns
@@ -290,46 +294,45 @@ export function askRootKeys(settingsObj, map) {
  * retirement only narrows a grant or a prompt, and a deny row read back as "extra" is, if anything,
  * a reason to leave it exactly where the operator (or an earlier release) put it. Returns
  * `{ retirements: { allow: [...], ask: [...] }, total }`. */
-export function planRetirements({ settingsObj, map, askCoveredBy = null }) {
-  const shipped = shippedRootNames(map);
-  const shippedAsk = new Set();
-  for (const e of map.entries) {
-    if (e.tier !== 'ask') continue;
-    const parsed = parseFloorRootShape(e.rule, map.plugin_root_glob);
-    if (parsed) shippedAsk.add(rootNameKey(parsed));
-  }
-  // hotfix-v1.17.4 (PR #237 security review Risk 3): for a file this pass does NOT also reconcile
-  // (`.claude/settings.local.json`), "the wildcard ask row replaces it" is only true when the
-  // TRACKED file actually carries that wildcard row — so the caller passes the tracked file's ask
-  // keys (`askRootKeys`) and a pinned `ask` row is retired only when both sets hold the pair.
-  // `null` (the tracked-file call sites, where the same pass adds the wildcard row) keeps the
-  // v1.17.3 rule unchanged.
-  const askReplaced = (key) => shippedAsk.has(key) && (askCoveredBy === null || askCoveredBy.has(key));
-  const retirements = { allow: [], ask: [] };
+/** Rows an earlier release of the floor wrote verbatim and v1.18.0 takes back (AC-V118A-2/-4): the
+ * broad force-push deny (the git-discipline hook is the floor — it refuses protected targets and
+ * allows feature branches, which this row wrongly refused), the release-ceremony ask row, and the
+ * policy file's self-guard deny pair (operator decision 2026-09-25). Literal text only. */
+export const RETIRED_FLOOR_LITERALS = Object.freeze({
+  allow: Object.freeze([]),
+  ask: Object.freeze(['Bash(claude plugin tag:*)']),
+  deny: Object.freeze([
+    'Bash(git push --force:*)',
+    'Edit(.foundry/permissions.yaml)',
+    'Write(.foundry/permissions.yaml)',
+  ]),
+});
+
+/** v1.18.0 (AC-V118A-2): every `allow`/`ask` row shaped exactly like the floor's own script rows —
+ * wildcard (`<plugin_root_glob>/scripts/<x>`) or version-/marketplace-pinned — is retired, whether
+ * or not the script still ships: those rows never matched a real invocation (measured), and the
+ * plugin's scripts are allowed by the PreToolUse hook instead. Plus the RETIRED_FLOOR_LITERALS.
+ * Any other shape — an operator's own rule, a different prefix, a hand-written bare path — is never
+ * touched (AC-FRR-2). Retiring an `ask` row cannot turn a prompt into a grant the operator did not
+ * choose: the scripts it named are allowed by design (operator decision: no foundry script prompts).
+ * `askCoveredBy` is accepted for call-site compatibility and ignored. */
+export function planRetirements({ settingsObj, map, askCoveredBy = null }) { // eslint-disable-line no-unused-vars
+  const retirements = { allow: [], ask: [], deny: [] };
   const perms = (settingsObj && settingsObj.permissions) || {};
   for (const tier of ['allow', 'ask']) {
     for (const rule of perms[tier] || []) {
-      const parsed = parseFloorRootShape(rule, map.plugin_root_glob);
-      if (parsed) {
-        if (!shipped.has(rootNameKey(parsed))) retirements[tier].push(rule);
-        continue;
-      }
-      // hotfix-v1.17.3: a version-/marketplace-pinned variant of the floor's own shape. An `allow`
-      // row is retired whether or not the script still ships — the wildcard row covers a shipped
-      // script (added in this same pass when absent), and a pinned row for a gone script is exactly
-      // the ER #199 class. An `ask` row is retired ONLY when the shipped map declares the same
-      // (name, sub) at `ask`, so the wildcard `ask` row replaces it (PR #233 security review Risk 1:
-      // `ask` beats `allow`, so dropping an ask row under a broader allow would turn a prompt into a
-      // silent grant — a widening this pass must never perform).
-      const pinned = parseFloorPinnedShape(rule, map.plugin_root_glob);
-      if (pinned) {
-        if (tier === 'allow') retirements[tier].push(rule);
-        else if (askReplaced(rootNameKey(pinned))) retirements[tier].push(rule);
+      if (typeof rule !== 'string') continue;
+      if (parseFloorRootShape(rule, map.plugin_root_glob) || parseFloorPinnedShape(rule, map.plugin_root_glob)) {
+        retirements[tier].push(rule);
       }
-      // any other shape -> never touched (AC-FRR-2)
     }
   }
-  const total = retirements.allow.length + retirements.ask.length;
+  for (const tier of ['allow', 'ask', 'deny']) {
+    for (const rule of perms[tier] || []) {
+      if (RETIRED_FLOOR_LITERALS[tier].includes(rule) && !retirements[tier].includes(rule)) retirements[tier].push(rule);
+    }
+  }
+  const total = retirements.allow.length + retirements.ask.length + retirements.deny.length;
   return { retirements, total };
 }
 
@@ -342,8 +345,8 @@ export function planRetirements({ settingsObj, map, askCoveredBy = null }) {
 export function applyRetirements(settingsObj, retirementPlan) {
   const next = { ...settingsObj };
   const perms = { ...(settingsObj.permissions || {}) };
-  for (const tier of ['allow', 'ask']) {
-    const toRemove = new Set(retirementPlan.retirements[tier]);
+  for (const tier of ['allow', 'ask', 'deny']) {
+    const toRemove = new Set(retirementPlan.retirements[tier] || []);
     if (toRemove.size === 0) continue;
     const existing = Array.isArray(perms[tier]) ? perms[tier] : [];
     perms[tier] = existing.filter((rule) => !toRemove.has(rule));
@@ -497,18 +500,21 @@ export function writeTargetAtomically(targetPath, obj) {
 export function renderPlan(plan, { applied, retirementPlan = null, mapEntryCount = null }) {
   const lines = [];
   const verb = applied ? 'added' : 'would add';
+  const rverb = applied ? 'retired' : 'would retire';
+  // v1.18.0 (AC-V118A-7): every row names its file and its tier, so no reader can mistake which
+  // file holds which tier (the 2026-09-25 misread: an ask row relayed as a deny).
   for (const tier of ['allow', 'ask', 'deny']) {
-    for (const rule of plan.additions[tier]) lines.push(`  [${tier}] ${rule}`);
+    for (const rule of plan.additions[tier]) lines.push(`  [${applied ? 'added' : 'would add'}] .claude/settings.json ${tier}: ${rule}`);
   }
   if (retirementPlan) {
-    for (const tier of ['allow', 'ask']) {
-      for (const rule of retirementPlan.retirements[tier]) lines.push(`  [retired] ${rule}`);
+    for (const tier of ['allow', 'ask', 'deny']) {
+      for (const rule of retirementPlan.retirements[tier] || []) lines.push(`  [${rverb}] .claude/settings.json ${tier}: ${rule}`);
     }
   }
-  let summary = `permission-floor reconcile: ${verb} ` +
+  let summary = `permission-floor reconcile (.claude/settings.json): ${verb} ` +
       ['allow', 'ask', 'deny'].map((t) => `${t}=${plan.additions[t].length}`).join(', ');
-  if (retirementPlan && typeof mapEntryCount === 'number') {
-    summary += ` — ${plan.total} added, ${retirementPlan.total} retired, ${mapEntryCount - plan.total} unchanged`;
+  if (retirementPlan) {
+    summary += `; ${rverb} ` + ['allow', 'ask', 'deny'].map((t) => `${t}=${(retirementPlan.retirements[t] || []).length}`).join(', ');
   }
   lines.push(summary);
   if (plan.pin.state === 'absent') {

package/src/permissionFloor.mjs

@@ -4,7 +4,6 @@
 // (AC-BCL-8). `covers()` agrees with tests/test_permission_floor_map.py::_subsumes on the shared
 // 8-row table by construction (same prefix-subsumption rule).
 import fs from 'node:fs';
-import { SELF_GUARD_DENY } from './selfGuardDeny.mjs';
 import os from 'node:os';
 
 /** The one map schema_version this build understands. A map declaring anything else is refused
@@ -210,15 +209,19 @@ export const DRIFT_CLASSES = Object.freeze([
 
 /** Build the settings.json object the CLI writes, verbatim from the bundled map plus the
  * marketplace/plugin pins (AC-BCL-4). */
+/** v1.18.0 (AC-V118A-2): the ONLY tier the floor writes into settings. Measured 2026-09-25 with live
+ * `claude -p` runs: no Bash rule naming a script path matches (not the floor's
+ * plugin-cache glob shape, not even an exact absolute path), so the
+ * allow rows granted nothing and the ask rows gated nothing. The plugin's own scripts are allowed by
+ * the `foundry-plugin-scripts-allow.py` PreToolUse hook instead, and the map's script rows stay as the
+ * closed-world REGISTRY of every script (AC-PFM-2), never projected. */
+export const PROJECTED_TIERS = Object.freeze(['deny']);
+
 export function buildSettings(map, pins) {
   const byTier = { allow: [], ask: [], deny: [] };
   for (const e of map.entries) {
-    byTier[e.tier].push(e.rule);
+    if (PROJECTED_TIERS.includes(e.tier)) byTier[e.tier].push(e.rule);
   }
-  // hotfix-v1.17.3: the policy file's own self-guard pair rides with the floor on the create path
-  // (the scaffold seeds .foundry/permissions.yaml in the same run), so a fresh workspace is in-sync
-  // instead of `policy drift (2)` until someone runs the compiler.
-  for (const r of SELF_GUARD_DENY) if (!byTier.deny.includes(r)) byTier.deny.push(r);
   // THE PINNED LITERAL — SUPERSEDED (feat-foundry-installer-unpinning, AC-IUP-3). This block used
   // to read (AC-BCL-4(b), contract v1.2 — PR #61 security review Block 1), verbatim:
   //
@@ -278,7 +281,8 @@ export function buildSettings(map, pins) {
  * rationale (AC-BCL-3). */
 export function renderCapabilityLines(map) {
   const lines = [];
-  for (const tier of ['allow', 'ask', 'deny']) {
+  lines.push("  [allow] the plugin's own scripts — by the plugin's PreToolUse hook, not by settings rules");
+  for (const tier of PROJECTED_TIERS) {
     const entries = map.entries.filter((e) => e.tier === tier);
     if (entries.length === 0) continue;
     lines.push(`  [${tier}] (${entries.length} rules)`);

package/src/run.mjs

@@ -9,7 +9,7 @@ import { QUESTION_TABLE } from './questions.mjs';
 import { parseArgv, renderHelp } from './argv.mjs';
 import { resolveAnswers, isYesMode } from './answers.mjs';
 import { RefusalError, physicalResolve, isNonEmptyDir } from './util.mjs';
-import { loadMap, buildSettings, classifyDrift } from './permissionFloor.mjs';
+import { PROJECTED_TIERS, loadMap, buildSettings, classifyDrift } from './permissionFloor.mjs';
 import { buildManagedFiles, DECLARED_PATH_SET } from './scaffold.mjs';
 import { planManagedFiles, applyPlan, exitCodeForPlan } from './reconcile.mjs';
 import { renderPreview, TRUST_HANDOFF_TEXT } from './preview.mjs';
@@ -20,7 +20,6 @@ import {
 import { reconcileGitignorePlan, applyGitignorePlan, renderGitignoreRow } from './gitignoreReconcile.mjs';
 import { planAmendmentsBackfill, applyAmendmentsBackfill, renderAmendmentsRow } from './amendmentsBackfill.mjs';
 import { planStatuslineWiring, applyStatuslineWiring, renderStatuslineRows } from './statuslineWiring.mjs';
-import { policyPresent, missingSelfGuardDeny, applySelfGuardDeny, renderSelfGuardRow, selfGuardShapeOk } from './selfGuardDeny.mjs';
 
 export { DECLARED_PATH_SET };
 
@@ -254,18 +253,8 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
     // permission floor unattended; --yes must be given EXPLICITLY. This sits above applyPlan
     // deliberately — a "refused" verdict printed after the scaffold write had already landed reads
     // as "nothing happened", which is the one thing it must not mean.
-    // hotfix-v1.17.3 (PR #233 review Risk 4): the self-guard pair is previewed here and counts as
-    // floor work, so a piped run cannot write it without an explicit --yes and --dry-run names it.
-    let selfGuardPreview = { missing: [], shapeOk: true };
-    if (answers.reconcileFloor && floorTarget && floorTarget.present && policyPresent(physicalRoot)) {
-      const cur0 = readTarget(floorTarget.path);
-      selfGuardPreview = { missing: missingSelfGuardDeny(cur0), shapeOk: selfGuardShapeOk(cur0) };
-      const prow = renderSelfGuardRow(physicalRoot, selfGuardPreview.missing.length, { shapeOk: selfGuardPreview.shapeOk, applied: false });
-      if (prow) print(prow);
-    }
     const floorHasWork = Boolean(floorPlan)
-      && (floorPlan.total > 0 || (floorRetirementPlan && floorRetirementPlan.total > 0)
-          || selfGuardPreview.missing.length > 0);
+      && (floorPlan.total > 0 || (floorRetirementPlan && floorRetirementPlan.total > 0));
     if (floorHasWork && !isTTY && answers.yes !== true) {
       throw new RefusalError(
         'refusing --reconcile-floor without a terminal: pass --yes explicitly to confirm the write',
@@ -308,17 +297,6 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
         applied: true, retirementPlan: floorRetirementPlan, mapEntryCount: map.entries.length,
       })) print(line);
     }
-    // hotfix-v1.17.3 (ER #232): under --reconcile-floor (the one opt-in that permits a narrow
-    // settings write on --existing), converge the policy file's self-guard deny pair, fresh from
-    // disk after the floor write, whenever a policy file exists.
-    if (answers.reconcileFloor && floorTarget && floorTarget.present && policyPresent(physicalRoot)) {
-      const cur = readTarget(floorTarget.path);
-      const shapeOk = selfGuardShapeOk(cur);
-      const missing = missingSelfGuardDeny(cur);
-      if (shapeOk && missing.length > 0) writeTargetAtomically(floorTarget.path, applySelfGuardDeny(cur));
-      const row = renderSelfGuardRow(physicalRoot, missing.length, { shapeOk });
-      if (row) print(row);
-    }
     // AFTER the floor write above: that write serialises a settings object read before this
     // point, so wiring the statusLine keys first would have been overwritten by it. The wiring
     // re-reads settings.json itself and adds only the absent keys (AC-SLW-2).
@@ -357,7 +335,10 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
     // classification stays above the write and over the tracked file alone — consent has to be
     // informed by what WILL be written, which is a different question from what remains after.
     const { effective, unreadable } = readEffectiveRules(physicalRoot);
-    const findings = classifyDrift(map, effective, {
+    // v1.18.0: classify only the projected tier (deny) — the map's script rows are a registry the
+    // floor never writes, so reporting them absent would read as a failed write.
+    const projectedMap = { ...map, entries: map.entries.filter((e) => PROJECTED_TIERS.includes(e.tier)) };
+    const findings = classifyDrift(projectedMap, effective, {
       pluginRootExpansion, unreadableOrigins: unreadable, home: homeDir,
     });
     if (findings.length > 0) {

package/src/update.mjs

@@ -7,6 +7,7 @@
 // machinery run.mjs's create path already uses (cli/src/reconcile.mjs, cli/src/floorReconcile.mjs).
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 import { RefusalError, physicalResolve, confinedJoin } from './util.mjs';
 import { loadMap, buildSettings } from './permissionFloor.mjs';
 import { buildManagedFiles } from './scaffold.mjs';
@@ -18,7 +19,6 @@ import { reconcileGitignorePlan, applyGitignorePlan, renderGitignoreRow } from '
 import { planAmendmentsBackfill, applyAmendmentsBackfill, renderAmendmentsRow } from './amendmentsBackfill.mjs';
 import { buildUpgradeReport, writeUpgradeReport, installedVersionBefore, versionOrNull, NEXT_LINE } from './upgradeReport.mjs';
 import { planStatuslineWiring, applyStatuslineWiring, renderStatuslineRows, statuslineChanged } from './statuslineWiring.mjs';
-import { policyPresent, missingSelfGuardDeny, applySelfGuardDeny, renderSelfGuardRow, selfGuardShapeOk } from './selfGuardDeny.mjs';
 import { loadRetiredCatalogue, planRetiredArtifacts, applyRetiredArtifacts, renderRetiredArtifactRows } from './retiredArtifacts.mjs';
 import { planRetirements, applyRetirements, askRootKeys } from './floorReconcile.mjs';
 import {
@@ -32,14 +32,18 @@ import { runCleanupPhase } from './cleanup.mjs';
 
 export { ALLOWED_CLAUDE_SUBCOMMANDS };
 
+/** v1.18.0 (AC-V118C-3): managed paths with their own reconciler on the update path. */
+const SEPARATELY_RECONCILED = new Set(['.claude/settings.json', '.gitignore']);
+
 /** The update entry point's OWN small flag table (Clarifications: "the update entry point carries
  * its own small flag table, disjoint from the wizard's") — deliberately NOT cli/src/argv.mjs +
  * QUESTION_TABLE, which is denied to the sibling cleanup atom and whose flag set is derived from
  * the wizard's prompts, not this command's. `--cleanup` is the cleanup atom's own opt-in. */
 export function parseUpdateArgv(argv) {
-  const values = { cleanup: false, help: false };
+  const values = { cleanup: false, help: false, dryRun: false };
   for (const tok of argv) {
     if (tok === '--cleanup') values.cleanup = true;
+    else if (tok === '--dry-run') values.dryRun = true;
     else if (tok === '--help') values.help = true;
     else throw new RefusalError(`unknown flag: ${tok}`, tok);
   }
@@ -119,11 +123,13 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
 
     if (flags.help) {
       print([
-        'Usage: update-agentic-workspace [--cleanup] [--help]',
+        'Usage: update-agentic-workspace [--dry-run] [--cleanup] [--help]',
         '',
         '  --cleanup   Also prune superseded plugin-cache versions and remove a stale or',
         '              duplicate marketplace registration (previewed either way; only',
         '              removed under this flag). Off by default.',
+        '  --dry-run   Plan and print everything; write nothing and run no claude command.',
+        '              Exits 0 or 2 exactly as the real run would.',
         '  --help      Show this help and exit.',
       ].join('\n'));
       return { exitCode: 0, output: lines.join('\n') };
@@ -182,6 +188,15 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
       settingsBytes,
     });
     const filePlan = planManagedFiles(managedFiles);
+    // v1.18.0 (AC-V118C-3): on the UPDATE path, a present file is never "drifted" just because it
+    // is not byte-identical to a fresh scaffold. `.claude/settings.json` and `.gitignore` each have
+    // their own reconciler below (the whole-file compare could never pass: it has no statusLine key
+    // and no operator rows, so every run exited 2); CLAUDE.md and foundry-project.json are
+    // operator-owned after creation; the framework READMEs are create-only and reported `kept`.
+    for (const f of filePlan) {
+      if (f.action !== 'drifted') continue;
+      f.action = SEPARATELY_RECONCILED.has(f.relPath) ? 'reconciled' : 'kept';
+    }
 
     // This is a PREVIEW-ONLY computation: `.claude/settings.json` is also `project` scope's
     // settings file, and Phase 1's migration (below) may write to that SAME path. Applying THIS
@@ -208,7 +223,11 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     const previewGitignorePlan = reconcileGitignorePlan({ physicalRoot, templatesDir });
 
     // ── AC-UAW-7: the preview, before the first `claude` invocation and the first write ─────────
-    const previewLines = ['The following claude invocations will be made:'];
+    const previewLines = [
+      flags.dryRun ? 'DRY RUN — the plan below is printed; nothing will be written and no claude command will run.'
+        : 'PLAN — printed before anything is written (rows below describe what the run will do):',
+      'The following claude invocations will be made:',
+    ];
     for (const { scopeSnap, trigger } of migrations) {
       for (const args of migrationActions(trigger, {
         scope: scopeSnap.name, marketplaceName, marketplaceRepo, pluginKey,
@@ -233,16 +252,10 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     previewLines.push('The following workspace paths will be reconciled (never-clobber):');
     for (const f of filePlan) previewLines.push(`  [${f.action}] ${f.relPath}`);
     if (previewFloorPlan) {
-      previewLines.push(`  [permission-floor] would add allow=${previewFloorPlan.additions.allow.length}, ask=${previewFloorPlan.additions.ask.length}, deny=${previewFloorPlan.additions.deny.length}`);
+      previewLines.push(`  [permission-floor] .claude/settings.json: would add deny=${previewFloorPlan.additions.deny.length} (the floor writes only deny rows; foundry scripts are allowed by the plugin's PreToolUse hook)`);
       if (previewRetirementPlan && previewRetirementPlan.total > 0) {
-        previewLines.push(`  [permission-floor] would retire allow=${previewRetirementPlan.retirements.allow.length}, ask=${previewRetirementPlan.retirements.ask.length}`);
-      }
-      // hotfix-v1.17.3 (PR #233 review Risk 4): the self-guard pair is previewed like the floor.
-      if (policyPresent(physicalRoot) || filePlan.some((f) => f.seed && f.action === 'create')) {
-        const cur0 = readTarget(floorTarget.path);
-        const prow = renderSelfGuardRow(physicalRoot, missingSelfGuardDeny(cur0).length, { shapeOk: selfGuardShapeOk(cur0), applied: false });
-        if (prow) previewLines.push(prow);
-        else previewLines.push('  [permissions] would add self-guard deny rules (2): Edit/Write on .foundry/permissions.yaml (with the seed)');
+        const r = previewRetirementPlan.retirements;
+        previewLines.push(`  [permission-floor] .claude/settings.json: would retire allow=${r.allow.length}, ask=${r.ask.length}, deny=${(r.deny || []).length}`);
       }
     } else {
       previewLines.push('  [permission-floor] .claude/settings.json absent — left to the create path');
@@ -264,12 +277,23 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
       const lp = planLocalRetirement({
         physicalRoot, map, trackedSettingsObj: floorTarget.present ? readTarget(floorTarget.path) : null,
       });
-      if (lp.plan && lp.plan.total > 0) previewLines.push(`  [permission-floor] ${lp.rel}: would retire allow=${lp.plan.retirements.allow.length}, ask=${lp.plan.retirements.ask.length} (never adds)`);
+      if (lp.plan && lp.plan.total > 0) previewLines.push(`  [permission-floor] ${lp.rel}: would retire allow=${lp.plan.retirements.allow.length}, ask=${lp.plan.retirements.ask.length}, deny=${(lp.plan.retirements.deny || []).length} (never adds)`);
       else if (lp.error) previewLines.push(`  [permission-floor] ${lp.rel}: would not be reconciled (${lp.error})`);
     }
     print(previewLines.join('\n'));
+    if (flags.dryRun) {
+      print('');
+      print('dry run: nothing was written and no claude command was run.');
+      const gitignoreRefusedPreview = previewGitignorePlan && previewGitignorePlan.action === 'refused';
+      return { exitCode: filePlan.some((f) => f.action === 'drifted') || gitignoreRefusedPreview ? 2 : 0, output: lines.join('\n') };
+    }
 
     const env = { ...spawnEnv, CLAUDE_CONFIG_DIR: configDir };
+    // v1.18.0 (AC-V118C-1): every tracked path this run writes or removes, for the report — the
+    // post-upgrade skill commits exactly these (nothing the updater writes may stay uncommitted).
+    const written = [];
+    const removed = [];
+    const wrote = (relPath, kind) => { if (!written.some((w) => w.path === relPath)) written.push({ path: relPath, kind }); };
     const phases = [];
 
     // ── Phase 1: marketplace refresh ─────────────────────────────────────────────────────────────
@@ -277,6 +301,7 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     for (const { scopeSnap, trigger } of migrations) {
       migrateScope({ scopeSnap, trigger, marketplaceName, marketplaceRepo, pluginKey, env, cwd, claudeBin });
       anyMigrated = true;
+      if (scopeSnap.name === 'project') wrote('.claude/settings.json', 'marketplace-migration');
     }
     const manifestBefore = readMarketplaceManifest(configDir, marketplaceName);
     const beforeEntry = manifestBefore.present ? pluginEntryOf(manifestBefore.doc, pins.plugin_name) : null;
@@ -302,7 +327,15 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     for (const scopeName of enabledScopes) {
       runPluginUpdate({ scope: scopeName, pluginKey, env, cwd, claudeBin });
     }
-    phases.push({ name: 'plugin-update', verdict: refreshed ? 'changed' : 'already current' });
+    // v1.18.0 (AC-V118C-5): the verdict is what THIS workspace has installed, read back from the
+    // platform's own registry — never whether the marketplace clone moved in this run (a machine's
+    // second workspace read "already current" whatever it installed).
+    const installedAfter = installedVersionBefore(readInstalledPluginsRegistry(configDir), pluginKey, cwd);
+    phases.push({
+      name: 'plugin-update',
+      verdict: installedAfter && installedAfter !== installedBefore ? 'changed' : 'already current',
+      ...(installedAfter ? {} : { reason: 'installed version unreadable from installed_plugins.json' }),
+    });
 
     // ── Phase 3: cleanup (sibling atom; always previewed, only acts under --cleanup) ────────────
     const cleanupScopeDescriptors = scopes; // same {name, settingsPath} pairs, unresolved-required
@@ -315,6 +348,7 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
 
     // ── Phase 4: reinitialization — managed files, then the additive floor reconcile ───────────
     applyPlan(filePlan);
+    for (const f of filePlan) if (f.action === 'create') wrote(f.relPath, f.seed ? 'seed' : 'managed');
     // Recomputed FRESH from disk — never the preview-time `previewFloorPlan` — because Phase 1's
     // migration may have just rewritten this exact file (project scope's settings.json IS the
     // floor-reconcile target). Applying a stale pre-migration plan here would silently clobber it.
@@ -334,21 +368,11 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
       floorRetirementPlan = retirementPlan;
       if (floorPlan.total > 0 || floorRetirementPlan.total > 0) {
         writeTargetAtomically(freshFloorTarget.path, applyAdditions(floorPlan.settingsObj, floorPlan, { map, pins }));
+        wrote('.claude/settings.json', 'permission-floor');
         for (const line of renderPlan(floorPlan, {
           applied: true, retirementPlan: floorRetirementPlan, mapEntryCount: map.entries.length,
         })) print(line);
       }
-      // hotfix-v1.17.3 (ER #232): the policy file's self-guard deny pair is framework-owned — converge
-      // it here, fresh from disk after the floor write, whenever a policy file exists (seeded above or
-      // kept). Grants stay the compiler's (operator-run) business.
-      if (policyPresent(physicalRoot)) {
-        const cur = readTarget(freshFloorTarget.path);
-        const shapeOk = selfGuardShapeOk(cur);
-        const missing = missingSelfGuardDeny(cur);
-        if (shapeOk && missing.length > 0) writeTargetAtomically(freshFloorTarget.path, applySelfGuardDeny(cur));
-        const row = renderSelfGuardRow(physicalRoot, missing.length, { shapeOk });
-        if (row) print(row);
-      }
     }
     // Recomputed FRESH from disk, same reasoning as floorPlan just above: never apply a plan
     // captured before Phases 1-3 ran, even though `.gitignore` is not itself a migration target.
@@ -361,6 +385,7 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     if (gitignoreFileAction !== 'create') {
       freshGitignorePlan = reconcileGitignorePlan({ physicalRoot, templatesDir });
       applyGitignorePlan(freshGitignorePlan);
+      if (freshGitignorePlan.action === 'converged' || freshGitignorePlan.action === 'appended') wrote('.gitignore', 'managed-block');
       const gitignoreRow = renderGitignoreRow(freshGitignorePlan);
       if (gitignoreRow) print(gitignoreRow);
     }
@@ -369,6 +394,7 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     // above, applied with the module's own re-classify-before-append guard.
     const amendmentsPlan = planAmendmentsBackfill({ physicalRoot });
     applyAmendmentsBackfill(amendmentsPlan);
+    for (const rel of amendmentsPlan.writtenPaths || []) wrote(rel, 'amendments-backfill');
     const amendmentsRow = renderAmendmentsRow(amendmentsPlan);
     if (amendmentsRow) print(amendmentsRow);
 
@@ -384,6 +410,8 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     // here, after the floor write above, so the settings read is the current one.
     const statuslinePlan = planStatuslineWiring({ physicalRoot, templatesDir });
     applyStatuslineWiring(statuslinePlan);
+    for (const f of statuslinePlan.files || []) if (f.action === 'create' || f.action === 'converged') wrote(f.rel, 'statusline');
+    if ((statuslinePlan.keys || []).some((k) => k.action === 'wired')) wrote('.claude/settings.json', 'statusline');
     for (const row of renderStatuslineRows(statuslinePlan)) print(row);
     // retired-artifacts (hotfix-v1.17.4, ER #236): re-planned FRESH from disk; reported every run,
     // removed only under --cleanup, only catalogued paths of the catalogued kind, never a hook a
@@ -391,6 +419,7 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     const retiredPlan = planRetiredArtifacts({ physicalRoot, catalogue: retiredCatalogue });
     let retiredRemoved = 0;
     if (flags.cleanup && retiredPlan.present > 0) retiredRemoved = applyRetiredArtifacts(retiredPlan, physicalRoot);
+    for (const r of retiredPlan.rows) if (r.state === 'removed') removed.push(r.relPath);
     for (const row of renderRetiredArtifactRows(retiredPlan, { cleanup: flags.cleanup })) print(row);
 
     // settings.local.json (hotfix-v1.17.4): the tracked-file reconcile never reads it, so a
@@ -407,8 +436,9 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
       });
       if (lp.plan && lp.plan.total > 0) {
         writeTargetAtomically(lp.abs, applyRetirements(lp.settingsObj, lp.plan));
+        wrote(lp.rel, 'local-retirement');
         localRetired = lp.plan.total;
-        for (const tier of ['allow', 'ask']) for (const r of lp.plan.retirements[tier]) print(`  [retired] ${lp.rel}: ${r}`);
+        for (const tier of ['allow', 'ask', 'deny']) for (const r of lp.plan.retirements[tier] || []) print(`  [retired] ${lp.rel} ${tier}: ${r}`);
         print(`  [permission-floor] ${lp.rel}: retired ${localRetired} version-pinned/gone row(s)`);
       } else if (lp.error) {
         print(`  [permission-floor] ${lp.rel}: not reconciled (${lp.error})`);
@@ -428,7 +458,8 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     // completed run (overwritten — a report, not a managed file; `.foundry/*` is gitignored), and
     // named in the LAST line so the operator's next step is never a guess.
     const report = buildUpgradeReport({
-      installedBefore, afterEntry, toPluginVersion: pins.plugin_version, phases, filePlan, amendmentsPlan,
+      installedBefore, installedAfter, afterEntry, toPluginVersion: pins.plugin_version, phases, filePlan, amendmentsPlan,
+      written, removed, configDir, hostname: os.hostname(),
       updaterVersion, coreVersion: corePkg.version, updaterPluginVersion: pins.plugin_version,
       retiredArtifacts: { present: retiredPlan.rows.filter((r) => r.state === 'stale').map((r) => r.relPath), removed: retiredRemoved, refused: retiredPlan.refused },
       localRetired,

package/src/upgradeReport.mjs

@@ -30,9 +30,9 @@ export function versionOrNull(v) {
  * the refresh (or null); `filePlan` is the managed-file plan;
  * `amendmentsPlan` is the applied backfill plan (or null); `phases` is what renderSummary got. */
 export function buildUpgradeReport({
-  installedBefore = null, afterEntry, toPluginVersion, phases, filePlan, amendmentsPlan, now = new Date(),
+  installedBefore = null, installedAfter = null, afterEntry, toPluginVersion, phases, filePlan, amendmentsPlan, now = new Date(),
   updaterVersion = null, coreVersion = null, updaterPluginVersion = null,
-  retiredArtifacts = null, localRetired = 0,
+  retiredArtifacts = null, localRetired = 0, written = [], removed = [], configDir = null, hostname = null,
 }) {
   const seedRow = (filePlan || []).find((f) => f.seed);
   return {
@@ -43,7 +43,9 @@ export function buildUpgradeReport({
     // and already moved by the time Phase 1 reads it. null (no record, unreadable registry, a
     // first install) makes the skill list only the current version's CHANGELOG section.
     from_plugin_version: versionOrNull(installedBefore),
-    to_plugin_version: (afterEntry && versionOrNull(afterEntry.version)) || versionOrNull(toPluginVersion),
+    // v1.18.0 (AC-V118C-5): what this workspace has INSTALLED after the run, from the platform's own
+    // registry; the marketplace's advertised version only when the registry could not be read.
+    to_plugin_version: versionOrNull(installedAfter) || (afterEntry && versionOrNull(afterEntry.version)) || versionOrNull(toPluginVersion),
     // ER #228 (v1.17.2): WHICH updater ran. A stale npx-cached updater was indistinguishable from a
     // broken walk; the skill refuses a report whose updater was built for another plugin version.
     updater_version: versionOrNull(updaterVersion),
@@ -54,8 +56,9 @@ export function buildUpgradeReport({
     // walk that never opened a file cannot read as a clean pass.
     amendments: amendmentsPlan
       ? { backfilled: amendmentsPlan.written ?? 0, present: amendmentsPlan.present, skipped: amendmentsPlan.skipped,
+          failed: amendmentsPlan.failed ?? 0,
           total: amendmentsPlan.total ?? ((amendmentsPlan.written ?? 0) + amendmentsPlan.present + amendmentsPlan.skipped) }
-      : { backfilled: 0, present: 0, skipped: 0, total: 0 },
+      : { backfilled: 0, present: 0, skipped: 0, failed: 0, total: 0 },
     permissions_policy: seedRow ? (seedRow.action === 'create' ? 'created' : 'kept') : 'absent',
     drifted: (filePlan || []).filter((f) => f.action === 'drifted').map((f) => f.relPath),
     // hotfix-v1.17.4: what the sweep found (paths are workspace-relative catalogue entries, never free text)
@@ -63,6 +66,14 @@ export function buildUpgradeReport({
       ? { present: retiredArtifacts.present, removed: retiredArtifacts.removed, refused: retiredArtifacts.refused }
       : { present: [], removed: 0, refused: 0 },
     settings_local_retired: localRetired,
+    // v1.18.0 (AC-V118C-1/-2): every path this run wrote or removed — `/foundry:post-upgrade`
+    // commits exactly the tracked ones as the first commit of its PR, so nothing the updater writes
+    // stays uncommitted; `config_dir`/`hostname` say WHICH environment the versions describe (a
+    // container's ~/.claude is its own volume), so a report from another environment is refused.
+    written: (written || []).map((w) => ({ path: String(w.path), kind: String(w.kind) })),
+    removed: (removed || []).map(String),
+    config_dir: typeof configDir === 'string' ? configDir : null,
+    hostname: typeof hostname === 'string' ? hostname : null,
   };
 }
 

package/templates/foundry-statusline.sh

@@ -31,7 +31,9 @@ RENDERER="foundry-statusline.sh"
 selected=""
 # 1. installed_plugins.json (jq when available; the file is small and the key shape is fixed)
 if [ -r "${CFG}/plugins/installed_plugins.json" ] && command -v jq >/dev/null 2>&1; then
-  ip="$(jq -r '(.plugins."foundry@agentic-foundry" // ."foundry@agentic-foundry" // []) | (if type=="array" then .[0] else . end) | (.installPath // empty)' "${CFG}/plugins/installed_plugins.json" 2>/dev/null)"
+  # v1.18.0: THIS project's record first, then the user-scope record, then any — never simply the
+  # first record, which may be another project's install at another version.
+  ip="$(jq -r --arg p "${CLAUDE_PROJECT_DIR:-$PWD}" '(.plugins."foundry@agentic-foundry" // ."foundry@agentic-foundry" // []) | (if type=="array" then . else [.] end) | ((map(select(.projectPath == $p)) + map(select(.projectPath == null)) + .)[0] // {}) | (.installPath // empty)' "${CFG}/plugins/installed_plugins.json" 2>/dev/null)"
   [ -n "$ip" ] && [ -r "${ip}/scripts/${RENDERER}" ] && selected="${ip}/scripts/${RENDERER}"
 fi
 # 2. the plugin cache, newest by version segment

package/templates/foundry-subagent-statusline.sh

@@ -17,7 +17,9 @@ RENDERER="foundry-subagent-statusline.sh"
 
 selected=""
 if [ -r "${CFG}/plugins/installed_plugins.json" ] && command -v jq >/dev/null 2>&1; then
-  ip="$(jq -r '(.plugins."foundry@agentic-foundry" // ."foundry@agentic-foundry" // []) | (if type=="array" then .[0] else . end) | (.installPath // empty)' "${CFG}/plugins/installed_plugins.json" 2>/dev/null)"
+  # v1.18.0: THIS project's record first, then the user-scope record, then any — never simply the
+  # first record, which may be another project's install at another version.
+  ip="$(jq -r --arg p "${CLAUDE_PROJECT_DIR:-$PWD}" '(.plugins."foundry@agentic-foundry" // ."foundry@agentic-foundry" // []) | (if type=="array" then . else [.] end) | ((map(select(.projectPath == $p)) + map(select(.projectPath == null)) + .)[0] // {}) | (.installPath // empty)' "${CFG}/plugins/installed_plugins.json" 2>/dev/null)"
   [ -n "$ip" ] && [ -r "${ip}/scripts/${RENDERER}" ] && selected="${ip}/scripts/${RENDERER}"
 fi
 if [ -z "$selected" ]; then

package/templates/permissions.yaml.tmpl

@@ -1,21 +1,22 @@
 # .foundry/permissions.yaml — this workspace's STANDING GRANTS as policy.
 #
-# The operator edits this file; the agent never does (`Edit`/`Write` on it are refused by the
-# compiled floor). `foundry-permissions-compile.py --write` turns every grant into one native
-# Claude Code rule `<tool>(<pattern>)` in .claude/settings.json; `--check` reports drift; the
-# doctor's `permissions-policy` line says `policy in-sync (<n>)` when the two agree. A contract's
-# `requires_capabilities` is checked against these grants by the capability preflight before an
-# atom is dispatched, so a denial surfaces before the work starts, not in the middle of it.
+# Operator-owned (the agent writes it only when you ask). Grants only ever WIDEN: an `automatic`
+# grant compiles (`foundry-permissions-compile.py --write`) to one native allow rule
+# `<tool>(<pattern>)` in .claude/settings.json; an `approval_required` grant compiles to NOTHING — the
+# command keeps the session's normal permission mode, and the agent's own loop stops to ask you.
+# Nothing here can add a prompt or a refusal. `--check` reports drift; the doctor's
+# `permissions-policy` line says `policy in-sync` when the two agree. The plugin's own scripts need
+# no grant (a PreToolUse hook allows them).
 #
-# Seeded EMPTY by `npx update-agentic-workspace` / `create-agentic-workspace --existing` and never
-# reconciled again (operator-owned). Schema: <plugin>/schema/permissions.schema.json.
+# Seeded EMPTY by the updater / `create-agentic-workspace --existing` and never reconciled again.
+# Schema: <plugin>/schema/permissions.schema.json.
 #
 # Each grant:
 #   id             a slug; surfaced in report and blocker lines
 #   tool           Bash | Edit | Write | Read | WebFetch | Agent
 #   pattern        the native rule's parenthesised body — the compiled rule is exactly <tool>(<pattern>)
 #   mode           automatic         — proceed once every listed precondition has been verified by command
-#                  approval_required — one blocker line naming this grant's id; the operator decides
+#                  approval_required — writes no rule; the agent stops with one line naming this id, you decide
 #   preconditions  closed set: ci-green, security-reviewed-label, spec-authorized, charter-committed,
 #                  worktree-clean, branch-up-to-date
 #

package/src/selfGuardDeny.mjs

@@ -1,75 +0,0 @@
-// selfGuardDeny.mjs — the two framework-owned deny rules that protect the operator's policy file
-// (hotfix-v1.17.3, ER #232): `Edit(.foundry/permissions.yaml)` and `Write(.foundry/permissions.yaml)`.
-//
-// They are what `scripts/foundry-permissions-compile.py --write` derives for a policy with ZERO grants
-// (its SELF_GUARD pair) — no operator judgement is in them, so every writer that seeds or keeps the
-// policy file converges them too, and a fresh seed is in-sync instead of `policy drift (2)` until
-// someone remembers the compiler. Grants stay the compiler's (operator-run) business.
-//
-// Discipline: add-if-absent onto `permissions.deny`, never reorder or remove anything, never touch
-// another key; a settings object without a `permissions` block gains one with only `deny`.
-import fs from 'node:fs';
-import path from 'node:path';
-
-export const POLICY_REL = '.foundry/permissions.yaml';
-export const SELF_GUARD_DENY = Object.freeze([
-  `Edit(${POLICY_REL})`,
-  `Write(${POLICY_REL})`,
-]);
-
-const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-
-/** `true` when `settingsObj.permissions` is absent or a plain object whose `deny`, if present, is an
- * array — the only shapes this module will write into. Anything else is refused rather than
- * guessed (PR #233 security review Risk 3: a string `deny` would otherwise be spread into
- * characters and written back). */
-export function selfGuardShapeOk(settingsObj) {
-  if (!isPlainObject(settingsObj)) return false;
-  const perms = settingsObj.permissions;
-  if (perms === undefined) return true;
-  if (!isPlainObject(perms)) return false;
-  return perms.deny === undefined || Array.isArray(perms.deny);
-}
-
-/** Which of the two rules `settingsObj` still lacks. Pure. Returns [] for a shape this module will
- * not write into (see selfGuardShapeOk) — the caller reports that separately. */
-export function missingSelfGuardDeny(settingsObj) {
-  if (!selfGuardShapeOk(settingsObj)) return [];
-  const deny = (settingsObj.permissions && settingsObj.permissions.deny) || [];
-  return SELF_GUARD_DENY.filter((r) => !deny.includes(r));
-}
-
-/** A NEW settings object with the missing rules appended to `permissions.deny`. Pure; returns the
- * input unchanged for a shape it will not write into. */
-export function applySelfGuardDeny(settingsObj) {
-  if (!selfGuardShapeOk(settingsObj)) return settingsObj;
-  const missing = missingSelfGuardDeny(settingsObj);
-  if (missing.length === 0) return settingsObj;
-  const next = { ...settingsObj };
-  next.permissions = { ...(next.permissions || {}) };
-  next.permissions.deny = [...(next.permissions.deny || []), ...missing];
-  return next;
-}
-
-/** `true` when the policy file exists as a regular file under `physicalRoot` (seeded or kept) — the
- * rules guard a file, so they are written only when there is one. Never follows a symlink. */
-export function policyPresent(physicalRoot) {
-  try {
-    return fs.lstatSync(path.join(physicalRoot, POLICY_REL)).isFile();
-  } catch {
-    return false;
-  }
-}
-
-/** The one row every writer prints: `[permissions] self-guard deny rules added (N)` or
- * `already present`. `null` when there is no policy file to guard (nothing to say). */
-export function renderSelfGuardRow(physicalRoot, addedCount, { shapeOk = true, applied = true } = {}) {
-  if (!policyPresent(physicalRoot)) return null;
-  if (!shapeOk) return '  [permissions] settings.permissions is not the shape expected (object with an array deny) — self-guard deny rules NOT written';
-  if (addedCount > 0) {
-    return applied
-      ? `  [permissions] self-guard deny rules added (${addedCount}): Edit/Write on ${POLICY_REL}`
-      : `  [permissions] would add self-guard deny rules (${addedCount}): Edit/Write on ${POLICY_REL}`;
-  }
-  return '  [permissions] self-guard deny rules already present';
-}