@atmem/architect 0.0.0-stage → 0.2.0

package/agent-skills/upstream/gcp/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: agent-platform-architecture
+description: >-
+  Designs, engineers, and validates enterprise Gemini platform
+  architectures. Use when designing multi-project
+  hierarchies (Host, Central Governance Hub, Runtime Spoke, Tool/MCP Spoke),
+  configuring Agent Gateway, authoring Agent Connectivity Templates (ALL_TRAFFIC
+  vs PRIVATE_RANGES_ONLY), deploying Secure Web Proxy (SWP) with Policy-Based
+  Routing (PBR) or Cross-Cloud mTLS Egress Hubs, configuring Private CA
+  TrustConfig with Internal ALB + Serverless NEG, implementing Unified Access
+  Policies (UAP Policy V2 CEL) and Semantic Governance (SGP), configuring 3P IdP
+  Token Exchange (EntraID/Ping/Okta via ext_proc + STS) or Agent Identity Auth
+  Manager (SPIFFE), enforcing Model Armor Floor Settings and Fail-Closed
+  guardrails, deploying Cross-Project Registry sync, binding ADK agents on Agent
+  Runtime, or executing Day-2 lifecycle operations. Don't use for read-only live
+  log triage or incident diagnosis, or generic Google Cloud Identity and Access
+  Management (IAM) debugging.
+license: Apache-2.0
+metadata:
+  version: "1.0.0"
+  category: AiAndMachineLearning
+---
+
+# Gemini platform Architecture and Engineering Guide
+
+This skill is the reference system for designing, engineering, and validating enterprise-grade **Gemini platform** architectures across multi-project hierarchies, hybrid/cross-cloud networks, zero-trust identity boundaries, and inline safety/policy enforcement planes.
+
+## Usage Attribution
+
+**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you
+MUST read and follow the instructions in
+[Usage Attribution](references/attribution.md).
+
+> [!IMPORTANT] **Architectural Scope and Reference Discipline**: Use `SKILL.md` to
+> select the target topology, egress mode, ingress pattern, and governance
+> plane, then consult the authoritative `references/*.md` manual for exact CLI
+> commands, REST/YAML schemas, Common Expression Language (CEL) expressions, and
+> Python Agent Development Kit (ADK) runtime code (`references/*.md` is the
+> single source of truth for all implementation syntax). When remote Model
+> Context Protocol (MCP) tools (such as the Google Developer Knowledge MCP
+> server or Google-managed MCP endpoints) are available, prefer remote MCP tool
+> invocation over raw CLI/REST commands. Do not execute unrequested live
+> mutations against customer projects when asked for architectural designs.
+
+> [!CAUTION] **Human Approval Gate for Sensitive Operations**: Always prompt the
+> user for explicit confirmation before executing commands or applying
+> configurations that grant permissive Identity and Access Management (IAM)
+> bindings (`roles/iap.egressor`, `roles/compute.networkUser`,
+> `roles/networkservices.admin`), modify Organization Policies
+> (`constraints/iam.managed.disableAccessPolicyBinding`), update Unified Access
+> Policy (UAP) or VPC Service Controls (VPC-SC) policies, or delete resources
+> (REST `DELETE ...?force=true` or CLI `--quiet`).
+
+---
+
+## Prerequisites, Authentication, Region, and Billing Setup
+
+1.  **Google Cloud SDK, Authentication, and Project Setup**:
+    -   Install the
+        [Google Cloud SDK (`gcloud`)](https://cloud.google.com/sdk/docs/install)
+        and authenticate CLI and Application Default Credentials
+        (`gcloud auth login && gcloud auth application-default login`, or set
+        `GOOGLE_APPLICATION_CREDENTIALS`).
+    -   Select or create the target project (`gcloud projects create
+        {project_id}` / `gcloud config set project {project_id}`), set the
+        default region (`gcloud config set compute/region {region}`, defaulting
+        to **`us-central1`**; see
+        [Google Cloud Locations](https://cloud.google.com/about/locations)), and
+        enable required APIs:
+
+        ```bash
+        gcloud services enable aiplatform.googleapis.com agentregistry.googleapis.com \
+          agentidentity.googleapis.com agentidentitycredentials.googleapis.com \
+          networkservices.googleapis.com networksecurity.googleapis.com iap.googleapis.com \
+          modelarmor.googleapis.com compute.googleapis.com dns.googleapis.com \
+          certificatemanager.googleapis.com servicenetworking.googleapis.com
+        ```
+2.  **Billing, Least-Privilege IAM, and Product Terminology**:
+    -   Verify an active billing account is attached (`gcloud billing projects
+        describe {project_id} --format="value(billingEnabled)"`) across
+        `{host_project_id}`, `{gov_project_id}`, `{runtime_project_id}`, and
+        `{mcp_project_id}` (required even when evaluating free-tier allowances;
+        review [Google Cloud Pricing](https://cloud.google.com/pricing)).
+    -   Grant explicit least-privilege IAM roles (`roles/aiplatform.user`,
+        `roles/networkservices.admin`, `roles/compute.networkAdmin`,
+        `roles/compute.networkUser`, `roles/iap.egressor`, or a custom role with
+        `networkservices.agentGateways.get,networkservices.agentGateways.use,networkservices.operations.get`)
+        rather than primitive `roles/owner` or `roles/editor`.
+    -   Use approved product names: **Gemini platform**,
+        **Agent Runtime** (`reasoningEngines`), **Agent Gateway**
+        (`240.0.0.2:443`), **Agent Connectivity Template (ACT)**, **Agent
+        Registry**, and **Unified Access Policy (UAP Policy V2)** / **Semantic
+        Governance Policy (SGP)**.
+
+---
+
+## 3-Phase Architect Workflow and Decision Tree
+
+```mermaid
+graph TD
+    Start["Enterprise Gemini platform Architecture"] --> Q1{"1. Egress Destinations?"}
+    Q1 -->|"RFC 1918 + Google APIs Only"| Priv["ACT: vpcEgress = PRIVATE_RANGES_ONLY<br/>• Direct Private Google Access (PGA)"]
+    Q1 -->|"Public Internet, VPC-SC, or Non-RFC 1918 PUPI"| All["ACT: vpcEgress = ALL_TRAFFIC<br/>• 100% Egress via AGW VIP 240.0.0.2:443<br/>• Consolidate Core Google APIs FQDNs"]
+    All --> Q2{"2. Layer 7 URL List or Cross-Cloud mTLS?"}
+    Q2 -->|"No (Standard NAT)"| Nat["Direct Cloud NAT on PSC-I Subnet<br/>• ENDPOINT_TYPE_VM,ENDPOINT_TYPE_SWG"]
+    Q2 -->|"Yes (Next-Hop SWP)"| Swp["Next-Hop SWP (NEXT_HOP_ROUTING_MODE) + PBR<br/>• Internal and Google API DEFAULT_ROUTING bypasses<br/>• Default route via SWP ILB IP<br/>• Exclude PSC-I from manual Cloud NAT"]
+```
+
+1.  **Phase 1 — Scope Verification and Architecture Discovery**:
+    -   **Scope Boundaries and Single-Region Discovery**: Decline generic Google
+        Cloud IAM/Compute/Storage debugging unrelated to the Gemini platform
+        stack or requests to run broad multi-region live project scanning loops,
+        pointing instead to `gcloud ai reasoning-engines list --region={region}`.
+    -   **Architecture Design and Engineering**: Identify the project
+        hierarchy (`Host`, `Governance Hub`, `Runtime Spoke`, `Tool/MCP Spoke`),
+        egress mode (`ALL_TRAFFIC` vs `PRIVATE_RANGES_ONLY`), policy plane (UAP
+        V2, SGP, Model Armor), and target output format (topology
+        specification, `gcloud` CLI commands, or REST/YAML manifests).
+2.  **Phase 2 — Draft Architecture Plan and Resource Mapping**:
+    -   Synthesize the topology diagram, project/VPC layout, IAM bootstrap
+        matrix, and security controls using the **Domain Router and Symptom
+        Matrix**, and map each manual's canonical REST/YAML schema and CLI
+        commands into the target deployment artifacts.
+3.  **Phase 3 — Post-Deployment and Audit Log Verification**:
+    -   Pair every architecture design with the **Post-Deployment and Cloud Audit
+        Log Verification** checklist
+        (`references/topologies_and_project_layouts.md`) and runtime query
+        validation (`references/agent_runtime_and_identity.md`).
+
+---
+
+## Domain Router and Symptom Matrix
+
+Each reference manual in `references/` is the **single source of truth** for its
+domain's CLI commands, REST/YAML schemas, quotas, and CEL expressions. Always
+read the corresponding reference manual before generating configurations or
+answering domain-specific questions:
+
+Architecture Domain                                               | Topics and Architectural Decisions Covered                                                                                                                                                                                                                                            | Symptoms and Failure Modes Routed Here                                                                                                                                                                                         | Canonical Reference Manual
+:---------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------
+**1. Project Hierarchy, Shared VPC, VPC-SC, and Custom Routing**  | Multi-project separation (`Host`, `Governance Hub`, `Runtime Spoke`, `Tool/MCP Spoke`), PSC-I subnet sizing, cross-project Service Agent IAM bootstrap, VPC-SC perimeters, non-RFC 1918 PUPI/peered custom route exchange, and post-deployment Cloud Audit Log verification.          | PSC-I IP exhaustion, cross-project attachment or `addressGroup` permission denials, VPC-SC perimeter blocks, dropped non-RFC 1918 internal routes, or post-deployment verification.                                            | [`references/topologies_and_project_layouts.md`](references/topologies_and_project_layouts.md)
+**2. Agent Connectivity Template (ACT) and Agent Gateway**        | Choosing `ALL_TRAFFIC` vs `PRIVATE_RANGES_ONLY`, ACT and Agent Gateway REST/YAML schemas, control-plane URI formatting, registry attachment limits, and container custom Root CA bundle trust.                                                                                        | Control-plane URI validation errors, registry attachment limit errors, or container TLS verification failures (`[SSL: UNEXPECTED_EOF_WHILE_READING]`).                                                                         | [`references/agent_gateway_and_act.md`](references/agent_gateway_and_act.md)
+**3. Outbound Routing, Next-Hop SWP, PBR, and Hybrid mTLS**       | Source-range Policy-Based Routes (PBR) for PSC-I subnets, Next-Hop Secure Web Proxy (`NEXT_HOP_ROUTING_MODE`), `swg-autogen-nat` vs manual Cloud NAT coexistence, gRPC/A2A/WebSocket routing, Spanner SA impersonation, and Cross-Cloud mTLS Egress Hubs (`Hybrid NEG`).              | Asymmetric return-routing drops between manual Cloud NAT and `swg-autogen-nat`, outbound URL filtering on PSC-I interfaces, or cross-cloud mTLS origination over Cloud Interconnect/VPN.                                       | [`references/egress_routing_and_swp.md`](references/egress_routing_and_swp.md)
+**4. Ingress ALB, URL Rewrites, Private CA, and 3P IdP STS**      | Two-Tier and Single-Tier ALB ingress with URL Map `hostRewrite`/`pathPrefixRewrite`, Private CA `TrustConfig` with Regional Internal ALB + Serverless NEG for Cloud Run MCP servers, and 3P IdP (`EntraID`/`Ping`/`Okta`) token exchange via `LbTrafficExtension` (`ext_proc` + STS). | WebPKI root stripping (`NO_ADDITIONAL_ROOTS`), empty `:authority` drops on Serverless NEGs, `*.run.app` Google-managed certificate mismatches, or OAuth/IAP header collisions.                                                 | [`references/ingress_patterns_and_rewrites.md`](references/ingress_patterns_and_rewrites.md)
+**5. UAP Policy V2, IAP V1, SGP, and Model Armor Governance**     | Organization/Folder/Project UAP Policy V2 and IAP V1 CEL authorization rules, Semantic Governance Policy (SGP `CONTENT_AUTHZ`), custom `AuthzExtension` / `AuthzPolicy` targets, and fail-closed Model Armor Floor Settings, templates, and ADK callbacks.                            | `Egress request is not authorized` (`HTTP 403` / `status.code=7`) on MCP `initialize` or `tools/list`, `failed to parse the service URL` on `AuthzExtension`, binary gRPC parser crashes, or fail-open safety bypasses.        | [`references/governance_security_policies.md`](references/governance_security_policies.md)
+**6. Agent Registry, Consolidated `googleapis`, and Federation**  | Consolidating core Google APIs FQDNs into a single `googleapis` service (`ALL_TRAFFIC`), registering MCP/A2A/REST services, extracting server-generated `registryResource` UUIDs for `roles/iap.egressor`, and Event-Driven Spoke-to-Hub Registry Federation.                         | `ALL_TRAFFIC` agent startup or telemetry blackholing, IAM binding target mismatches on Registry resources, OpenAPI/MCP spec size rejections, or multi-project catalog drift.                                                   | [`references/registry_and_federation.md`](references/registry_and_federation.md)
+**7. ADK Runtime Packaging, Agent Identity, and Day-2 Operations**| Packaging ADK agents with `AGENT_IDENTITY` (SPIFFE) and Auth Manager, regional residency, BigQuery pre-execution cost guards, in-place ACT updates, reverse-dependency teardown, and external Cloud NAT IP verification.                                                              | Raw credential exposure, `HTTP 409 ABORTED` control-plane mutex locks, `HTTP 400 FAILED_PRECONDITION` (`FROM_AGENT_GATEWAY*` or `contains child resources: sessions`), or `X-Forwarded-For: 0.0.0.0` when probing `*.run.app`. | [`references/agent_runtime_and_identity.md`](references/agent_runtime_and_identity.md)
+
+---
+
+## Supporting Public Documentation Links
+
+- [Agent Runtime Overview](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents.md.txt)
+- [Agent Gateway Overview](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/gateways/agent-gateway-overview.md.txt)
+- [Policies Overview](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/policies/overview.md.txt)
+- [Agent Identity Overview](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/agent-identity-overview.md.txt)
+- [Agent Registry Overview](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/agent-registry.md.txt)
+- [Deploy Agent Gateway Runtime](https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/runtime/agent-gateway-runtime-deploy.md.txt)
+- [Private Service Connect Interface](https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/runtime/private-service-connect-interface.md.txt)

package/agent-skills/upstream/manifest.json

@@ -0,0 +1,57 @@
+[
+  {
+    "id": "aws",
+    "repository": "aws/agent-toolkit-for-aws",
+    "commit": "fb298e0b6bf2b308a3d2c212b2a09b9bace8e090",
+    "sourcePath": "plugins/aws-core/skills/aws-well-architected-review/SKILL.md",
+    "url": "https://raw.githubusercontent.com/aws/agent-toolkit-for-aws/fb298e0b6bf2b308a3d2c212b2a09b9bace8e090/plugins/aws-core/skills/aws-well-architected-review/SKILL.md",
+    "sha256": "aa8fef39ef6d64365e48827d9acc90b2b8755023f5c177341cf1c954c1057811",
+    "file": "agent-skills/upstream/aws/SKILL.md",
+    "status": "reference-only",
+    "note": "Imported source reference, not an enabled script/tool package. AtMem AI Architect specialist guidance is reviewed separately; referenced upstream companion files are not bundled."
+  },
+  {
+    "id": "azure",
+    "repository": "microsoft/azure-skills",
+    "commit": "3c89228484f4a9241d255ec7c703976d13277c2d",
+    "sourcePath": "skills/azure-reliability/SKILL.md",
+    "url": "https://raw.githubusercontent.com/microsoft/azure-skills/3c89228484f4a9241d255ec7c703976d13277c2d/skills/azure-reliability/SKILL.md",
+    "sha256": "a70f0a799c8f3cf805ada741e82af31a149b57cb1e2388d7805036492cdceb71",
+    "file": "agent-skills/upstream/azure/SKILL.md",
+    "status": "reference-only",
+    "note": "Imported source reference, not an enabled script/tool package. AtMem AI Architect specialist guidance is reviewed separately; referenced upstream companion files are not bundled."
+  },
+  {
+    "id": "gcp",
+    "repository": "google/skills",
+    "commit": "a1a942f058366f70e11e36fda390ac4019272c9c",
+    "sourcePath": "skills/cloud/agent-platform-architecture/SKILL.md",
+    "url": "https://raw.githubusercontent.com/google/skills/a1a942f058366f70e11e36fda390ac4019272c9c/skills/cloud/agent-platform-architecture/SKILL.md",
+    "sha256": "db60e7b5d1128403132720c1445cfc2e26049f0651db14e71e94de074d175d48",
+    "file": "agent-skills/upstream/gcp/SKILL.md",
+    "status": "reference-only",
+    "note": "Imported source reference, not an enabled script/tool package. AtMem AI Architect specialist guidance is reviewed separately; referenced upstream companion files are not bundled."
+  },
+  {
+    "id": "terraform",
+    "repository": "hashicorp/agent-skills",
+    "commit": "5e30fa5c867ba6777c37e4206babfd08049c396f",
+    "sourcePath": "plugins/terraform/skills/terraform-style-guide/SKILL.md",
+    "url": "https://raw.githubusercontent.com/hashicorp/agent-skills/5e30fa5c867ba6777c37e4206babfd08049c396f/plugins/terraform/skills/terraform-style-guide/SKILL.md",
+    "sha256": "3a5c2e06a1daa07600d03f48328d1479284e7a9d59d66b2663693ca972080e22",
+    "file": "agent-skills/upstream/terraform/SKILL.md",
+    "status": "reference-only",
+    "note": "Imported source reference, not an enabled script/tool package. AtMem AI Architect specialist guidance is reviewed separately; referenced upstream companion files are not bundled."
+  },
+  {
+    "id": "pulumi",
+    "repository": "pulumi/agent-skills",
+    "commit": "82f222a529a499e8005a820000148cc5e28c934c",
+    "sourcePath": "pulumi/skills/pulumi-best-practices/SKILL.md",
+    "url": "https://raw.githubusercontent.com/pulumi/agent-skills/82f222a529a499e8005a820000148cc5e28c934c/pulumi/skills/pulumi-best-practices/SKILL.md",
+    "sha256": "701bf94433f77f7851ed979ea74700a50dc69f958a20327f13da53d6a1468765",
+    "file": "agent-skills/upstream/pulumi/SKILL.md",
+    "status": "reference-only",
+    "note": "Imported source reference, not an enabled script/tool package. AtMem AI Architect specialist guidance is reviewed separately; referenced upstream companion files are not bundled."
+  }
+]

package/agent-skills/upstream/pulumi/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.