Software Development Skills

The Foundry front-authorization gate (/foundry:authorize). Display an atom's acceptance-contract checkpoints to the operator, get explicit confirmation, then freeze the operator-signed authorization (specsha256 + contractsha256) onto acceptance-contract.yaml. The load-bearing v1 safety action — an un-authorized spec can never reach main. Trigger when the operator says "authorize ", "/foundry:authorize", or after a contract is drafted at Specify-exit and before any implementation dispatch.

Batch front-authorization review over a release's N atoms (/foundry:authorize-release) — ergonomics without relaxing PER-ATOM granularity. Displays every atom's acceptance-contract checkpoints, the operator confirms, and each atom is authorized singly via the standard /foundry:authorize flow. Trigger after release-DRAFT-shaping, before implement.

Deploy a release ONCE locally and run its full tagged journey suite against that one instance (/foundry:certify-local , introduced in the v0.25.0 certification realignment, CONSTITUTION.md §V factory-mode tail). Resolves the release manifest + the active stack profile's boot recipe, runs plain npx playwright test --grep over every atom's journey tags, and reports per-atom pass/fail with the runner's own output as evidence — no verdict engine, no custom evidence format. REFUSES (never a vacuous pass) naming the missing prerequisite when there is no journey suite or no boot recipe. Trigger to certify a release before recording operator acceptance.

Emit the staging certification checklist for a release (/foundry:certify-staging , introduced in the v0.25.0 certification realignment, CONSTITUTION.md §V factory-mode tail). Fills context/staging-checklist-template.md from the release manifest + the staging binding in .claude/foundry-project.json, observes deploy state via the kept /foundry:deploy-status surface, and STOPS — promotion stays CD-owned and operator-gated. REFUSES naming the missing prerequisite when no staging binding exists in .claude/foundry-project.json. Trigger after certify-local + operator acceptance, before any staging→production promotion decision.

Migrate a fleet of hand-built monitoring dashboards into version-controlled code with a MACHINE-CHECKED equivalence proof. The five-part harness: immutable golden originals → a typed emitter with a generic panel factory whose unknown-kind fallback FLAGS (never silently guesses) → a renderer back to platform JSON → a semantic-signature extractor → ONE shared definition of MATCH used by both the per-dashboard convert self-verify AND the fleet gate (scripts/foundry-dashboard-fidelity.py: N/N MATCH fail-closed). Platform-generic (a Grafana-style schemaVersioned export is the illustration). Carries the path-scoped CI wiring, the restricted-PSA job hardening, and the CSI-before-stateful-metrics-store + sidecar-egress ordering prerequisites. Trigger: "port the dashboards to code", "dashboards as code", "prove the dashboard migration is lossless", "/foundry:dashboards-as-code".

The stateful-tier migration PROCEDURE skill — cut an app''s SQL database + cache over from self-managed instances to a managed serverless target. A read-only procedure the generic agent runs alongside the id- infra-delivery steps: it drives the fail-closed cutover-mechanism DECISION TREE (snapshot-restore vs CDC-replicate + fast-promote), the per-app connection-pool INVENTORY read from application source (never the deploy layer), the live-vs-committed VERIFICATION GATE (committed IaC defaults are NOT live truth — offline-green ≠ live-parity), fills one of the two parameterized RUNBOOK shapes (each with an explicit rollback column), and routes a BLOCKING security-reviewer pass for custodial tiers (per-store key-policy isolation). It authors plan artifacts and runbooks; it NEVER applies, restores, promotes, or mutates — every apply step in the emitted runbook is operator-run through the id-apply posture discipline. Trigger: "cut over the database", "migrate the data tier", "snapshot restore vs CDC", "/foundry:data-tier-cutover".

The governed turn-off primitive — no legacy component is severed until its replacement has PROVEN independence and the old side is provably safe, recorded in an append-only operator-bound validation ledger the gate RE-DERIVES from live re-checks at turn-off time (fail-closed, waiver-blind). Drives scripts/foundry-decommission.py: validate-register (class-aware register, GENERATED gatestatus), record (append-only ledger; refuses incomplete VALIDATED rows incl. the custody real-operation proof), gate-check (GO only on latest-VALIDATED + live reverify/old-safe re-checks under a forced waiver-blind phase; else NO-GO exit 1). Turn-off is structurally the LAST wave. Trigger: "decommission", "turn off the legacy", "is it safe to delete", "sever the old side", "/foundry:decommission-gate".

CURRENTLY DORMANT (named honestly — the scripts/foundrydriftsweep.py engine this skill drives was retired and does not ship; this file is design intent for a re-implementation, not a live procedure). Advisory batch drift-suspect sweep — given a base->head system-state snapshot pair (from the system-state snapshot tool), lists every AUTHORIZED contract whose frozen systemgrounding block (or, for atoms predating it, its spec body) still references a schema/module identifier the migration DROPPED or RENAMED. ADVISORY, NOT a merge gate — not part of the merge floor (ci.yml + btb-gates), is not a branch-protection required status, opens no grounding source itself. Trigger to sweep the AUTHORIZED-contract corpus for stale schema references after a migration lands.

Environment-isolation-hygiene — own-scoped ephemeral-env lifecycle + teardown (/foundry:env-hygiene). Status of this session's owned dev/test resources (containers, kind/k3d/minikube clusters, LocalStack, dev servers) + the shared runtime daemon; on-demand own-scoped teardown; the reuse-before-start / label-what-you-start / pair-setup-with-teardown / never-stop-the-shared-runtime directive. Trigger to check what this session left running, tear down own resources, or learn the hygiene lifecycle.

Advisory grounding-conformance backfill sweep — classifies every frozen acceptance-contract.yaml in the corpus as GROUNDED / UNGROUNDED / STALE against the current system-state snapshot (from the system-state snapshot tool), reusing the systemgrounding contract block's structural AND consistency validators (the systemgrounding validators), and emits a deterministic backfill worklist naming every non-conformant atom. ADVISORY, NOT a merge gate — not part of the merge floor (ci.yml + btb-gates), is not a branch-protection required status, never rewrites a frozen contract. Trigger to measure how much of the AUTHORIZED corpus is reality-grounded and to surface the atoms still needing a systemgrounding block backfilled or re-audited.

The infra-delivery APPLY gate PROCEDURE skill (/foundry:id-apply, infra-delivery step 12) — the one place the framework may MUTATE infra, and only as the CTX posture permits. A PROCEDURE — it probes ctx-posture (read-only), RE-DERIVES the GitOps class via classifygitops(changedpaths, infrabinding) from the FROZEN change-scope × the profile's infrabinding.gitopspaths (never a caller bool), drives decideapply (pure, total, fail-closed; REFUSE dominates), and executes the chosen branch — EXECUTE (run the frozen infrabinding.apply), GENERATERUNBOOK (emit the frozen apply runbook for the OPERATOR to run in CTX, then verify read-only — the SoD generate-then-execute split), VERIFYONLY (GitOps; the ArgoCD controller mutates, the framework only verifies), or REFUSE (nothing emitted/run). The runbook content is ALWAYS the frozen infrabinding.apply (never freeform); the post-apply check is the DISTINCT read-only infrabinding.verify slot. ADVISORY craft FOR the trusted operator — it does NOT gate, approve, or merge; the merge floor (the adopter's branch protection + CI checks — see the plugin's docs/merge-floor.md) is the merge authority. id-apply is the post-merge REALIZE gate.

The read-only forward-design ENTRY mode (infra-delivery step 2) — for "the app runs locally, there is NO deployment yet — design where it should run." Design a target infra topology from requirements (archetype × load projection × cost/ops/compliance → selected stack-profile(s)), then run the adversarial DESIGN-AUDIT loop to convergence BEFORE any IaC is written. A PROCEDURE skill the generic agent runs inside a CTX session: its cost/quota/capability lookups are read-only and flow PASSIVELY through the CTX command-policy guard (read-only reads are allowed even in guarded prod — like the shipped id-baseline, it does NOT invoke ctx-posture, which is mutation-only). It NEVER scaffolds IaC, applies, or provisions — id-architect designs + audits; the output is the audited topology design + a .foundry/id-architect-report design-audit STEP-REPORT NOTE (NOT walk-evidence, NOT a verdict input, no candidate-GREEN claim — this step runs no plan). ADVISORY craft FOR the operator; it is NOT a gate.

The read-only adopt-existing-IaC entry mode (infra-delivery step 2) — adopt an EXISTING OpenTofu/Terraform repo and VALIDATE it is drift-free against the live environment, proven by the acceptance seam tofu plan == ∅ (the IaC equals reality). A PROCEDURE skill the generic agent runs inside a CTX session: the tofu plan / argocd app diff reads flow through the CTX command-policy guard (all read-only, allowed even in guarded prod). It NEVER applies and NEVER auto-reconciles — adoption is read-only validation, proven by the empty diff; drift is SURFACED, never fixed. ADVISORY craft (produces a baseline/drift report + a .foundry/-partitioned drift step-report note; adoption VALIDATES, it does NOT claim a machine-adjudicated GREEN verdict — a change isn''t being delivered, and the merge floor, branch protection + CI checks, is the merge authority).

The everyday-change ENTRY survey (infra-delivery step 2 default) — a read-only inventory of the target infra (the relevant IaC roots + the in-scope live resources) plus the change surface the intended change touches, producing the change-scope report. A PROCEDURE skill the generic agent runs inside a CTX session: the tofu plan / argocd app diff / kubectl get reads flow through the CTX command-policy guard (all read-only, allowed even in guarded prod, the id-baseline way). It NEVER applies, scaffolds, or reconciles — discovery is read-only survey + scope, nothing more. ADVISORY craft (produces the change-scope report + a .foundry/-partitioned survey step-report note; it surveys, it does NOT claim a machine-adjudicated GREEN verdict — the merge floor, branch protection + CI checks, is the merge authority). It does NOT invoke ctx-posture — a read-only survey never mutates, so the posture mutation-gate does no work for it.

The infra-delivery documentation step (step 16) — generate/update the change documentation (the change-record / ADR, the blast-radius summary, the runbook, the rollback note, and the changelog entry) a delivered IaC change requires, DERIVED from the RECORDED pre-merge plan step-report note + the plan summary and MATCHED to the surrounding repo''s existing doc conventions. A read-only doc-output PROCEDURE skill the generic agent runs: it READS the recorded .foundry/-partitioned id-plan step-report note (actionsdetail) as the source of what changed, reads the blast tier from the same recorded observation, and sources the rollback note from the realization-frame id-rollback incident path (git revert → reconcile → verify-landed) — NOT from the infrabinding.apply forward-mutation slot. It records its OWN output as a .foundry/ doc step-report NOTE (.foundry/id-document-report), NOT walk-evidence and NOT a verdict input (the bespoke emitinfrawalkevidence recorder this note is contrasted against was retired and does not exist in scripts/). ADVISORY craft — it surfaces the documentation to the operator; it issues no mutating verb, decides no merge verdict, and flips no workflow step.

The infra-delivery RECURRING drift sentinel (post-spine) — a read-only forever drift check that re-runs the empty-plan seam (tofu plan == ∅) on a CADENCE to compare reality vs the merged IaC. It runs the active profile's infrabinding.plan as a read-only tofu plan through the CTX command-policy guard (read-only ⇒ it does NOT invoke ctx-posture, the mutation-only gate), reads the per-resource plan delta from the canonical contractless parser foundryplanmodel.parseactionsdetail, and frames an empty plan as DRIFT-FREE / a non-empty plan as DRIFT — naming the diverging resources. It records its observation as a .foundry/-partitioned STEP-REPORT NOTE (.foundry/id-drift-report), NOT contract-keyed walk-evidence; there is no argocd app diff live read. ADVISORY craft — drift is SURFACED and handed to id-sync/id-rollback, NEVER auto-reconciled.

Two advisory pre-merge reads of an infra-delivery change. (v2) The POLICY-RISK read — surface foundryplanmodel.parsepolicyfindings output {rule, resource, severity, gating} and distinguish hard-FAIL-shaped (gating==deny) vs ackable-shaped (gating==warn ∧ severity==high ⇒ freeze a policy:high-blast-ack {rule, resource}) vs advisory, per the ADR C1 gating table. (v1, KEPT) The fast pre-policy blastradius tier hint LOW / MEDIUM / HIGH (Karpenter-aware) — match each plan action against the active profile's machine-evaluable blastradius rules. ADVISORY + read-only; it surfaces the findings + the tier hint for the operator/reviewer to weigh at the merge floor — the bespoke verdict machinery that once mechanically enforced the gating table was retired, so this read is not machine-enforced today (see docs/merge-floor.md).

The infra-delivery change-authoring craft (step 5) — author/edit the IaC for the intended change ON A BRANCH, kept in sync with the frozen intended-change manifest (the tofu-plan checkpoint''s operator-frozen intended set in the acceptance-contract). A PROCEDURE skill the generic agent runs inside a CTX session: it WRITES files (scaffold/edit the OpenTofu/Kubernetes IaC to the handbook conventions) and runs NO plan and mutates NOTHING. The load-bearing discipline: the authored IaC is BRANCH-QUARANTINED (never main) and NEVER-APPLY (no tofu apply/kubectl apply/live mutation here), and it stays in sync with the frozen intended set so the downstream read-only id-plan plan can attribute it for the operator/reviewer. Records a .foundry/id-implement-report authoring STEP-REPORT NOTE — NOT walk-evidence, NOT a verdict input (the bespoke emitinfrawalkevidence plan recorder this note is contrasted against was retired and does not exist in scripts/). ADVISORY craft, NOT a gate — the merge floor (branch protection + CI checks, see docs/merge-floor.md) is the authority.

The read-only live-env → IaC import entry mode (infra-delivery step 2) — survey an existing AWS/Kubernetes environment that has NO IaC, codify it into OpenTofu/Kubernetes IaC, and prove fidelity by the acceptance seam tofu plan == ∅ (the IaC equals reality). A PROCEDURE skill the generic agent runs inside a CTX session: the aws/tofu reads flow through the CTX command-policy guard (all read-only, allowed even in guarded prod). It NEVER applies — import discovers + codifies, proven by the empty diff. ADVISORY craft (produces an IaC skeleton + a .foundry/-partitioned import step-report note; does NOT gate, approve, or block — the merge floor, the adopter''s branch protection + CI checks, see docs/merge-floor.md, remains the merge authority).

The infra-delivery PRE-MERGE seam PROCEDURE skill (/foundry:id-plan, infra-delivery step 8). A read-only PROCEDURE — it resolves the active stack profile, drives the profile''s infrabinding.plan command strings READ-ONLY (tofu plan + kubectl --dry-run=server + argocd app diff) through the CTX guard, collects the structured plan/diff (candidate vs merge-base, attributable), and produces the review artifact + a .foundry/-partitioned plan STEP-REPORT NOTE. It NAMES infrabinding.plan as its command source and the review artifact as its output. It issues NO mutating verb and does NOT self-certify a PASS. Honest disclosure: the bespoke emitinfrawalkevidence recorder / derivewalkverdict verdict machinery this skill used to name as its evidence backend and verdict authority were retired and do not exist in scripts/ — the merge floor (the adopter''s branch protection + CI checks, see docs/merge-floor.md) is the merge authority now. ADVISORY craft FOR the trusted operator; it does NOT gate, approve, or merge.

The infra-delivery cross-env PROMOTION orchestrator (step 16) — "this change passed in env N, carry it to env N+1 (e.g. staging→prod)." ADVISORY orchestration that RE-RUNS the existing per-env change-delivery loop in the TARGET env, adding NO new verdict. For the target env it resolves the next env's ctx-posture (Posture.decision), surfaces the ADVISORY id-impact v1 blastradius hint (a DISPLAY hint for the operator, NOT a routing input — the dropped matchblast engine is NOT used), then drives id-apply's BUILT decideapply(posture, gitopsclass, infrabinding) with its ACTUAL THREE inputs RE-DERIVED in the target env (posture from the next env's ctx-posture; gitopsclass from classifygitops(changedpaths, infrabinding); infrabinding from the target profile — NEVER an env-N value, NEVER the removed blasttier/highblastacked args; a REFUSE posture or ambiguous gitopsclass REFUSEs, fail-closed). Guarded prod ⇒ GENERATERUNBOOK / VERIFYONLY (the framework never mutates prod directly). The HIGH-blast-without-ack expectation is surfaced from the real parsepolicyfindings read (policy:high-blast-ack) for the operator/reviewer at the target env's merge floor to weigh — honestly disclosed as no longer machine-enforced, since the bespoke merge-gate verdict machinery that once mechanically enforced this ack was retired, so decideapply is NOT coupled to it and no live component blocks on it automatically today. Because merge IS deploy and the change is already on main, landing is proven by the POST-DEPLOY REALIZATION frame — emitrealizationevidence(changescope, candidatesha, postapplyplanresults, argocdstatus, artifact) + deriverealizationverdict (both real, live functions) — NOT the pre-merge restricted-base attributability. REFLECTS the merge floor + realization verdict + posture gate re-derive per env; never relaxes a posture, skips the gate, self-certifies a promotion, or issues a mutating verb in the GENERATERUNBOOK / VERIFYONLY / REFUSE branches.

The infra-delivery two-lens advisory review procedure the generic agent runs at the infra-delivery review step (/foundry:id-review, infra-delivery review step / step 10 — the sd-review analog for infra). A PROCEDURE — it DISPATCHES the MERGED pr-reviewer general code lens (agents/pr-reviewer.md) ALWAYS, plus the security-reviewer security lens (agents/security-reviewer.md) WHEN the change touches auth/IAM, secrets/credentials, or supply-chain/dependencies, feeding both the infra context — the diff + the change''s POLICY-RISK findings (parsepolicyfindings) + the plan actionsdetail ({address, action}) — as plan-as-DATA, then collates the categorized findings for the operator and surfaces the policy:high-blast-ack extra-approval expectation for the operator/reviewer to weigh (the bespoke merge-gate machinery that once re-derived this automatically was retired). It does NOT re-implement review (the agents own the review craft). Advisory, read-only: it surfaces findings; it does NOT gate, approve, or merge — the merge floor (the adopter''s branch protection + CI checks, see docs/merge-floor.md) is the merge authority.

The infra-delivery INCIDENT safe-revert PROCEDURE skill (the recurring/incident rollback step) — the PROCEDURE the generic agent runs when a delivered change did NOT land (a NOT-LANDED realization, an escaped defect, bad config) to restore the last-known-good IaC and prove reality matches it again. The shape is git revert -> reconcile -> verify-landed: revert the offending commit via the governed /foundry:revert (restoring the prior authorized IaC — the reused prior authorization, NOT a no-skip bypass; still subject to the merge floor), drive the GitOps controller''s idempotent reconcile toward the REVERTED IaC PINNED to the reverted commit''s candidatesha (the merged-HEAD pin, never an arbitrary HEAD), then run the realization read and RECORD the realization observation via the DEDICATED post-deploy producer emitrealizationevidence(, changescope, candidatesha, postapplyplanresults, argocdstatus, artifact) (scripts/foundryrealization.py, DC3 — a real, live producer) — recording {candidatesha, postapplyplanempty, argocd:{applicable, syncstatus, healthstatus}, artifact:{applicable, deployedidentity, mergedcommit}} that deriverealizationverdict consumes — confirming LANDED iff postapplyplanempty AND (argocd NA OR Synced ∧ Healthy) AND (artifact NA OR identity-match) against the reverted IaC. The mutation is POSTURE-GATED (delegated to ctx-posture / id-apply EXECUTE | GENERATERUNBOOK | VERIFYONLY | REFUSE — never break-glass, never a mutating verb of its own; guarded prod GENERATES the revert runbook for the operator). ADVISORY observe-and-record (the realization read is NOT a merge-floor verdict the skill self-certifies; the merge floor — branch protection + CI checks, see docs/merge-floor.md — governs the revert''s reused authorization); NOT-LANDED is a tracked incident state surfaced, never force-reverted blindly / papered over.

The infra-delivery OFFLINE LOCAL-SIMULATION step (the new simulate step, between id-test and id-plan) — a PROCEDURE skill the generic agent runs ENTIRELY OFFLINE (no live cloud, no ctx) to author-and-prove the IaC corpus before the live pre-merge plan. Layer 1: apply the profile''s EXISTING primitive OpenTofu modules against LocalStack via tflocal (or a provider-endpoint override) — proving they APPLY, not merely validate, honest about the CE-vs-Pro coverage boundary. Layer 2: stand up an ephemeral kind/k3d cluster, install ArgoCD, and reconcile the app-of-apps with Karpenter-kwok + ESO-fake — proving the GitOps structure reconciles. It records the local-sim observation as a .foundry/-partitioned STEP-REPORT NOTE (.foundry/id-simulate-report). ADVISORY — it surfaces the observation; it does NOT gate, approve, or merge (the merge floor, branch protection + CI checks, see docs/merge-floor.md, is the merge authority), and (running no tofu plan against live state) it records a STEP-REPORT NOTE, NOT walk-evidence — the bespoke emitinfrawalkevidence recorder this note is contrasted against was retired and does not exist in scripts/. OFFLINE — every Layer-1 apply is against the LocalStack endpoint (never a real AWS account); every Layer-2 apply/reconcile is against a throwaway local kind/k3d (never the guarded live cluster); it issues no live mutation, never runs infrabinding.apply, and never invokes ctx-posture.