id-applylisted

The infra-delivery APPLY router PROCEDURE skill (/foundry:id-apply, infra-delivery step 12) — the one place the framework may MUTATE infra. A PROCEDURE — it resolves the active stack profile, RE-DERIVES the GitOps class via classify_gitops(changed_paths, infra_binding) from the FROZEN change-scope × the profile's infra_binding.gitops_paths (never a caller bool), drives decide_apply (pure, total, fail-closed; REFUSE dominates and calls classify_gitops itself — no parameter offers a class override), and executes the chosen branch — EXECUTE (run the frozen infra_binding.apply — the default path), VERIFY_ONLY (GitOps; the ArgoCD controller mutates, the framework only verifies), or REFUSE (nothing emitted/run). The command run is ALWAYS the frozen infra_binding.apply verbatim (never freeform); the post-apply check is the DISTINCT read-only infra_binding.verify slot. The operator supplies a correctly configured AWS context; its IAM restrictions ARE the control the framework relies on and does not re-implement, veri
lukasrepublic/agentic-foundry · ★ 1 · AI & Automation · score 67

Install: claude install-skill lukasrepublic/agentic-foundry

# /foundry:id-apply — the apply router (EXECUTE | VERIFY_ONLY | REFUSE) The `infra-delivery` step sequence (a documented procedure this skill family forms — no workflow engine or state-machine file ships) drives an IaC change spec → merge → **realize**. Step 12 is the **apply router**: the one place the framework may **MUTATE** infrastructure. Infrastructure has no app to boot; the merge floor already authorized the merge. `id-apply` is the disciplined procedure the generic agent runs **after merge** to realize the change — resolving the profile, letting the gate re-derive the change's **GitOps classification** from the frozen scope, and driving the closed outcome that falls out, fail-closed. **The operator supplies the AWS context.** The operator has already configured a correctly-scoped AWS context (credentials + connectivity); its **IAM restrictions ARE the control** on what the mutating command may do, and that control is **outside the framework's scope** — the framework relies on it and does **not** model, verify, re-derive or second-guess it. The framework **never acquires credentials or connectivity**: it runs no `aws sso login`, no `aws configure`, no assume-role, and establishes no VPN — those are the operator's job, done before this skill ever runs. The framework **never mutates** in the VERIFY_ONLY / REFUSE branches. ## When to trigger - The `infra-delivery` sequence advances to the **apply router** (step 12), after an IaC change is **merged** and must be rea