What is post-upgrade?

A post-upgrade review procedure for an installed coding-agent plugin. It reads the updater's report and checks the changes that require human judgement rather than just automatic file updates.

Use it after updating the workspace to inspect the upgrade report, compare the installed version, run the project doctor, and review exceptions before accepting the upgrade.

It catches stale reports, changed protected data, and other upgrade effects that an automatic updater cannot safely resolve on its own.

post-upgrade — Skill for Claude Code by lukasrepublic/agentic-foundry

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add lukasrepublic/agentic-foundry --skill post-upgrade

Clone the repo

git clone --depth 1 https://github.com/lukasrepublic/agentic-foundry

Made for: Claude Code.

Or install foundry, the plugin that ships this one along with the rest of its 84 skills, 8 agents, 11 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/post-upgrade/github.svg)](https://agentmods.dev/skills/lukasrepublic/agentic-foundry/post-upgrade)

Your own site

<a href="https://agentmods.dev/skills/lukasrepublic/agentic-foundry/post-upgrade"><img src="https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/post-upgrade/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/lukasrepublic/agentic-foundry/post-upgrade"><img src="https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/post-upgrade.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 245 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,151 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00245	$0.04151
Opus 5.5	$0.00098	$0.01660
Sonnet 5.5	$0.00049	$0.00830
Haiku 4.5	$0.00024	$0.00415

Measured 18d ago against content hash cb39f23e8d6a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

post-upgrade scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/post-upgrade/SKILL.md · 208 lines

How it starts

The opening of the file, as written. The whole thing — 208 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/foundry:post-upgrade — finish what the updater cannot

An upgrade has two halves. update-agentic-workspace owns the deterministic one and leaves a report. This skill owns the other: committing what the updater wrote (so the workspace's main matches what its sessions run), and the steps that need judgement or would move a frozen hash or delete a ref. It is versioned with the plugin, so the procedure matches the release that was just installed.

It runs to the end — no step hands a decision back

The operator's review of the ONE pull request at the end is where judgement is exercised. Every step below has a default, and the default is taken: a step with nothing to do is a table row that says so, never a question. The only stops are the preconditions. Specifically, none of these is a reason to stop or to ask:

a step that finds nothing (no grants held, no unfrozen contract, no lock, no retired artifact);
the number of branches the gc classified merged — 3 or 300, the classifier is the evidence;
a gc refusal (dirty tree, a branch backing a live worktree) — it is recorded and the walk goes on;
an updater-shaped change the report does not list (step 1 says what to do with it);
a workspace check that fails on an updater write (step 1 says what to do with it);
something that looks like it needs the operator — it goes in the PR body under For the operator, and the walk goes on.

If the operator is in the session they can interrupt at any time; the skill does not wait for them.

Preconditions (the only stops)

Read .foundry/upgrade-report.json. Absent → stop: "run npx update-agentic-workspace@latest first — it writes the report this skill reads." Not a regular file (a symlink, or the updater's last run printed [refused] .foundry/upgrade-report.json) → stop the same way. config_dir is not this session's (${CLAUDE_CONFIG_DIR:-$HOME/.claude}) → stop: "this report describes another environment (an agent container's ~/.claude is its own volume) — run the updater here." to_plugin_version differs from the installed plugin (claude plugin list, or the doctor's header) → stop: the report is stale. updater_version absent, or updater_plugin_version differs from to_plugin_version → stop: "the report was written by an updater built for another plugin version (a stale npx cache) — run npx update-agentic-workspace@<version> and come back." Check the walk's arithmetic: amendments.backfilled + present + skipped + failed must equal amendments.total; a non-zero failed is reported, not retried by hand.
Run /foundry:doctor once and keep its output; the last step compares against it.

Read the full file on GitHub · 208 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

18d ago Changed · +85 lines · +13 tokens per session cb39f23e8d6a
20d ago Changed · +14 lines · +30 tokens per session 807a6d12ef44
21d ago First seen · 109 lines · 202 tokens per session scan A 0879bb052166

Subscribe to this mod's changes

post-upgrade is a skill published in the GitHub repository lukasrepublic/agentic-foundry (1 stars, last pushed 7d ago), licensed MIT. It adds 245 tokens to every session and 4,151 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-24.

Claude Code DevOps and cloud Git and workflow agentic-ai ai-agents anthropic claude-code-plugin developer-tools

atlas-changelog

Maintain per-repo and cross-repo changelogs — append structured entries after agent work. Use when asked to "log this change", "update changelog", "what changed", "change history".

tonone-ai/tonone · 45 tokens

apex-status

CTO-level project status from git and codebase state. Use when asked "where are we", "project status", "what's done", or at the start of a work session.

tonone-ai/tonone · 42 tokens

g-doc-review

Documentation review gate. Dispatches the doc-reviewer agent on the changed file set to check documentation currency against the code it describes, then issues a standalone DOCS READY or DOCS HOLD verdict. On DOCS READY it writes the doc-approval sentinel that the commit gate checks for doc/mixed commits. Read-only on…

onlygian/G-Forge · 102 tokens

g-retro

Synthesize a session retrospective from the silent-observer journal — no interview. Reads the passive activity log (.claude/journal/), git history, and g-docs/todo.md, and writes g-docs/retros/YYYY-MM-DD-topic.md with what happened, decisions inferred, patterns, and cold-start context.

onlygian/G-Forge · 69 tokens

g-update

Fix G-Forge-managed files via Step 0 staleness preflight (stops with zero writes if cache lags GitHub, directs to /plugins first), then realigns CLAUDE.md Rules, agents, architecture rules, hooks, and native pre-commit gate. Safe — G-Forge markers only.