create-agentic-workspace 0.9.1 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.9.1",
+    "plugin_version": "1.11.0",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.9.1",
+  "generated_for_plugin_version": "1.11.0",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",
@@ -203,11 +203,6 @@
       "tier": "allow",
       "rationale": "Read-only registry-integrity report (feat-foundry-repo-registry-formalization): physical-confinement + gitignore-pairing + origin-match rows over .claude/foundry-project.json; single read-only git choke point, sanitizing emission sink, writes nothing. Tiered at merge-reconciliation when the script landed after the map (the closed-world tripwire firing as designed)."
     },
-    {
-      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_run_metrics.py:*)",
-      "tier": "allow",
-      "rationale": "posttooluse telemetry logger invoked by the run-metrics hook; appends a loss-tracking line"
-    },
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_session_mode.py:*)",
       "tier": "allow",
@@ -223,6 +218,11 @@
       "tier": "ask",
       "rationale": "ceremony: front-authorization; --yes/--skip-audit-reason arrive after other args, not prefix-keyable, so the whole script is ask"
     },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-amend.py:*)",
+      "tier": "ask",
+      "rationale": "writes the frozen authorized: trailer (re-freeze after a non-widening amendment) — operator-prompted until permissions.yaml (R1) tiers it; a widening is refused by the verb itself"
+    },
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-bootstrap.sh:*)",
       "tier": "ask",
@@ -268,6 +268,11 @@
       "tier": "allow",
       "rationale": "read-only programme resolution + ready-set/idle/wake derivation; writes nothing (asserted byte-level over a whole fixture tree by AC-CDW-6) and issues no merge, dispatch, or authorization. NOT write-free means side-effect-free: via foundry_release it runs read-only git plumbing (log/rev-parse) in a repo dir, and it exec_module's the in-tree wave planner. Manifest-named spec_ref/contract_ref are confinement-checked BEFORE any derivation. NOT covered: the dir git runs in comes from the contract's own target_repo via _resolve_repo, whose unrecognized-key fallback can leave the corpus - pre-existing shipped behaviour, reached only through an already-confined, authorized contract"
     },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_command_deck_watch.py:*)",
+      "tier": "allow",
+      "rationale": "the command-deck watcher lifecycle: renders the tick prompt and keeps the watcher record. Reads are the read-only derivation it delegates to foundry_command_deck.py (same reach, same confinement). WRITES EXACTLY ONE PATH SHAPE: .foundry/watchers/<programme>.json under the project dir, where <programme> is re-checked against a [a-z0-9-]+ fullmatch BEFORE any path join, so a traversing or absolute identifier cannot reach os.path.join at all; forget removes only that same path. The record is inert data - no derivation reads it, it grants nothing and gates nothing. Manifest-derived text reaching the rendered prompt is passed through the shipped as_data sanitiser. NOT covered: it inherits foundry_command_deck.py's own pre-existing target_repo git-dir reach, unchanged by this script"
+    },
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_release.py accept:*)",
       "tier": "ask",
@@ -332,6 +337,10 @@
       "script": "foundry_audit_preconditions.py",
       "rationale": "the shipped __main__ is a manual-invocation debug CLI for a human/operator; never instructed by any skill/hook"
     },
+    {
+      "script": "foundry-autonomy-instrument.py",
+      "rationale": "deferred, not tiered: a standing Bash allow-rule is coordinator work (round-2 review remediation, PR #152) — the operator runs this report-only CLI manually and grants it per-invocation or via their own settings, never via a plugin-shipped allow row"
+    },
     {
       "script": "foundry_authz.py",
       "rationale": "library: no argparse/__main__; imported for authorization/spec-state reads (e.g. foundry_authz.spec_state)"