@raishin/vanguard-frontier-agentic 1.0.0 → 1.2.0

package/skills/aws/aws-ticket-triage-escalation-coordinator/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: aws-ticket-triage-escalation-coordinator
+description: Triage AWS tickets and alerts using priority, owner, evidence, incident context, escalation path, OpsCenter, health signals, and safe next steps. Prefer this for non-destructive request coordination and escalation; prefer deep domain skills for implementation or root-cause investigation.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# AWS Ticket Triage Escalation Coordinator
+
+## Purpose
+
+Act as the AWS ticket triage escalation coordinator who reduces chaos by classifying urgency, owner, missing evidence, and next escalation without pretending triage is resolution.
+
+## When to use
+
+Use this skill for:
+
+- AWS ticket queue triage, prioritization, or assignment support
+- alert-to-owner routing, escalation mapping, or missing-evidence review
+- business-safe coordination of cloud operations requests and follow-up
+- non-destructive classification of incidents, requests, or recurring operational work
+
+## Lean operating rules
+
+- Prefer `AwsDocumentationMcpServer` when available via `uvx awslabs.aws-documentation-mcp-server@latest`; if `uvx` cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
+- This role is non-destructive by default. Prefer read-only discovery, reporting, notification, escalation, and approval-gated recommendations over direct mutation.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad access, destructive automation, unsupported production claims, weak ownership, and vague business impact.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, advisory workflow, or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before privileged, cost-changing, compliance-impacting, or production-impacting recommendations.
+- [Official sources](references/official-sources.md) — use when grounding AWS service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks, blockers, or coordination gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/aws/aws-ticket-triage-escalation-coordinator/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "aws-ticket-triage-escalation-coordinator",
+  "name": "AWS Ticket Triage Escalation Coordinator",
+  "type": "skill",
+  "provider": "aws",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Triage AWS operational tickets, alerts, and requests into priority, owner, evidence needs, and safe escalation paths without taking destructive actions.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.aws.amazon.com/systems-manager/latest/userguide/OpsCenter-working-with-OpsItems.html",
+    "https://docs.aws.amazon.com/health/latest/ug/what-is-aws-health.html",
+    "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html",
+    "https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/prepare.html"
+  ],
+  "security_notes": "Do not mutate infrastructure, suppress alerts, or close issues without evidence and approval. This role classifies, routes, and escalates; it does not perform destructive remediation.",
+  "last_verified": "2026-04-29",
+  "path": "skills/aws/aws-ticket-triage-escalation-coordinator",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/aws/aws-ticket-triage-escalation-coordinator/references/official-sources.md

@@ -0,0 +1,12 @@
+# Official sources
+
+Use this reference when grounding current AWS service behavior for this role.
+
+- https://docs.aws.amazon.com/systems-manager/latest/userguide/OpsCenter-working-with-OpsItems.html
+- https://docs.aws.amazon.com/health/latest/ug/what-is-aws-health.html
+- https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html
+- https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/prepare.html
+
+## Grounding rule
+
+Docs explain service behavior. They do not prove the user's deployed state, ownership, SLAs, budget posture, or current incident reality.

package/skills/aws/aws-ticket-triage-escalation-coordinator/references/safety-checklist.md

@@ -0,0 +1,14 @@
+# Safety checklist
+
+Use before recommending automation, escalation, or production-affecting follow-up from AWS Ticket Triage Escalation Coordinator.
+
+## Non-negotiables
+
+- Do not ask for or print secrets, credentials, private keys, account numbers, customer identifiers, or unsanitized operational payloads.
+- Keep this role non-destructive. Prefer read-only discovery, status reporting, notification, evidence gathering, and approval-gated recommendations.
+- Do not suppress alerts, alter workloads, or change infrastructure from this role by default.
+- Confirm ownership, priority, evidence quality, and business impact before strong recommendations.
+
+## Evidence labels
+
+Use `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.

package/skills/aws/aws-ticket-triage-escalation-coordinator/references/workflow-and-output.md

@@ -0,0 +1,37 @@
+# Workflow and output contract
+
+Use this reference for full AWS Ticket Triage Escalation Coordinator work.
+
+## Workflow
+
+1. **Classify the request**
+   - business briefing
+   - queue triage / escalation
+   - change advisory
+   - automation design
+   - proactive watch / anomaly review
+
+2. **Stay non-destructive**
+   - Default to read-only discovery, reporting, evidence collection, notifications, approvals, and escalation.
+   - Do not recommend direct infrastructure mutation unless the user explicitly asks for deeper implementation work and a separate specialist role is more appropriate.
+
+3. **Review the operating context**
+   - owners and stakeholders
+   - evidence quality
+   - operational urgency
+   - business impact
+   - safe next actions
+
+4. **Validate**
+   - Distinguish documentation-based guidance from live AWS evidence.
+   - Confirm missing evidence, blockers, ownership gaps, and rollback or follow-up paths.
+
+## Output contract
+
+Return:
+
+1. Scope and evidence level
+2. Main risks / blockers
+3. Business or operational impact
+4. Safe next actions
+5. Escalation or rollback path

package/skills/azure/azure-live-aks-rollout-guard/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: azure-live-aks-rollout-guard
+description: Guard live AKS deployment rollouts with PDB audit, maxUnavailable/surge validation, rollout pause/undo gates, and post-rollout health verification.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# Azure Live AKS Rollout Guard
+
+## Purpose
+
+Act as the guarded live Azure operator for azure-live-aks-rollout-guard work. Insist on preview evidence before execution and treat ambiguous target or approval state as a stop condition.
+
+## When to use
+
+Use this skill when:
+
+- a Kubernetes deployment rollout must proceed against a live AKS cluster
+- a rollout is paused mid-flight and an operator must decide to resume or undo
+- PDB violations or replica health issues are blocking a rollout and resolution is needed
+
+## Lean operating rules
+
+- Prefer Azure CLI (`az`) official documentation when available; fall back to Microsoft Learn docs and sanitized user evidence.
+- Do not execute a live Azure change until subscription, resource group, active principal, and resource ownership are explicit.
+- Prefer what-if, preview, describe, status, dry-run, plan, and rollback evidence before execution.
+- If the request skips preview or rollback design, push back.
+- Never print secrets, access tokens, connection strings, or raw environment values. Summarize sanitized evidence only.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Preflight commands](references/preflight-commands.md) — CLI commands to run before any mutation.
+- [Rollback playbook](references/rollback-playbook.md) — concrete rollback steps for this service.
+- [Permission model](references/permission-model.md) — RBAC role definitions and PIM guidance.
+- [Official sources](references/official-sources.md) — authoritative Azure documentation links.
+
+## Response minimum
+
+Return, at minimum:
+
+- confirmed target subscription, resource group, and principal
+- preflight evidence (what-if diff, status, health check, or plan output)
+- approval status for the proposed mutation
+- rollback posture or explicit statement of what cannot be rolled back
+- post-action verification steps or refusal reason

package/skills/azure/azure-live-aks-rollout-guard/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "azure-live-aks-rollout-guard",
+  "name": "Azure Live AKS Rollout Guard",
+  "type": "skill",
+  "provider": "azure",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Guard live AKS deployment rollouts with PDB audit, maxUnavailable/surge validation, rollout pause/undo gates, and post-rollout health verification.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-security",
+    "https://learn.microsoft.com/en-us/azure/aks/concepts-clusters-workloads",
+    "https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#rolling-update-deployment",
+    "https://kubernetes.io/docs/tasks/run-application/configure-pdb/"
+  ],
+  "security_notes": "Never advance an AKS rollout without PDB audit and replica health check. kubectl rollout undo is safe but must be confirmed before execution to avoid double-rollback churn.",
+  "last_verified": "2026-04-30",
+  "path": "skills/azure/azure-live-aks-rollout-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/azure/azure-live-aks-rollout-guard/references/official-sources.md

@@ -0,0 +1,19 @@
+# Official Sources: Azure Live AKS Rollout Guard
+
+## Azure AKS
+
+- https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-security
+- https://learn.microsoft.com/en-us/azure/aks/concepts-clusters-workloads
+- https://learn.microsoft.com/en-us/azure/aks/manage-azure-rbac
+- https://learn.microsoft.com/en-us/azure/aks/use-azure-ad
+
+## Kubernetes rolling updates and rollback
+
+- https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#rolling-update-deployment
+- https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#rolling-back-a-deployment
+- https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+
+## Source-grounding rule
+
+Use official Microsoft Learn and Kubernetes.io documentation as source of truth.
+Do not override official guidance with secondary examples or training data assumptions.

package/skills/azure/azure-live-aks-rollout-guard/references/permission-model.md

@@ -0,0 +1,54 @@
+# Permission Model: Azure Live AKS Rollout Guard
+
+## Azure RBAC (control plane — cluster credential access)
+
+```json
+{
+  "Name": "AKS Rollout Guard",
+  "IsCustom": true,
+  "Description": "Read AKS cluster state and fetch user-level kubeconfig. No cluster admin rights.",
+  "Actions": [
+    "Microsoft.ContainerService/managedClusters/read",
+    "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
+  ],
+  "NotActions": [
+    "Microsoft.ContainerService/managedClusters/delete",
+    "Microsoft.ContainerService/managedClusters/agentPools/write"
+  ],
+  "AssignableScopes": [
+    "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<TARGET_RG>/providers/Microsoft.ContainerService/managedClusters/<CLUSTER_NAME>"
+  ]
+}
+```
+
+`listClusterUserCredential` grants a user-level kubeconfig. What the user can do inside
+the cluster is governed by AKS-integrated Entra ID RBAC, not this control-plane role.
+
+## Kubernetes RBAC (data plane — in-cluster namespace scope)
+
+Bind the operator's Entra ID identity to a namespace-scoped Role (never ClusterRole):
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: rollout-guard
+  namespace: <TARGET_NAMESPACE>
+rules:
+- apiGroups: ["apps"]
+  resources: ["deployments", "replicasets"]
+  verbs: ["get", "list", "watch", "patch", "update"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["policy"]
+  resources: ["poddisruptionbudgets"]
+  verbs: ["get", "list"]
+```
+
+## Do not assign
+
+- `Azure Kubernetes Service Cluster Admin Role` — full cluster admin kubeconfig
+- `cluster-admin` ClusterRoleBinding in Kubernetes
+- `Microsoft.ContainerService/managedClusters/agentPools/delete`
+- Subscription-level Contributor for routine rollout operations

package/skills/azure/azure-live-aks-rollout-guard/references/preflight-commands.md

@@ -0,0 +1,55 @@
+# Preflight Commands: Azure Live AKS Rollout Guard
+
+Run these commands before any AKS rollout mutation. Paste sanitized output as evidence.
+
+## 1. Confirm identity and cluster target
+
+```bash
+az account show --query "{subscription:id, name:name, user:user.name}"
+az aks show -g <RESOURCE_GROUP> -n <CLUSTER_NAME> \
+  --query "{provisioningState:provisioningState, kubernetesVersion:kubernetesVersion, fqdn:fqdn}"
+```
+
+## 2. Fetch user-level kubeconfig
+
+```bash
+az aks get-credentials -g <RESOURCE_GROUP> -n <CLUSTER_NAME> --overwrite-existing
+kubectl config current-context
+```
+
+## 3. Audit PodDisruptionBudgets in target namespace
+
+```bash
+kubectl get pdb -n <NAMESPACE> -o wide
+# minAvailable or maxUnavailable must leave at least one pod available during rollout
+```
+
+## 4. Check current deployment rollout status
+
+```bash
+kubectl rollout status deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+kubectl get deployment <DEPLOYMENT_NAME> -n <NAMESPACE> -o jsonpath='{.spec.strategy}'
+```
+
+## 5. Verify node readiness and resource headroom
+
+```bash
+kubectl get nodes -o wide
+kubectl top nodes
+kubectl get pods -n <NAMESPACE> -o wide
+```
+
+## 6. Confirm maxSurge / maxUnavailable strategy
+
+```bash
+kubectl get deployment <DEPLOYMENT_NAME> -n <NAMESPACE> \
+  -o jsonpath='{.spec.strategy.rollingUpdate}'
+# maxUnavailable=0 is safest for production; maxSurge=1 is a conservative default
+```
+
+## 7. Check HorizontalPodAutoscaler (if present)
+
+```bash
+kubectl get hpa -n <NAMESPACE>
+# HPA minReplicas must exceed PDB minAvailable or the rollout will deadlock
+```

package/skills/azure/azure-live-aks-rollout-guard/references/rollback-playbook.md

@@ -0,0 +1,38 @@
+# Rollback Playbook: Azure Live AKS Rollout Guard
+
+## Immediate rollback — undo to previous ReplicaSet
+
+```bash
+# Pause the rollout first to stop further progress
+kubectl rollout pause deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+
+# Check rollout history to identify the target revision
+kubectl rollout history deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+
+# Undo to the immediately prior revision
+kubectl rollout undo deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+
+# Or undo to a specific revision
+kubectl rollout undo deployment/<DEPLOYMENT_NAME> -n <NAMESPACE> --to-revision=<N>
+```
+
+## Verify rollback success
+
+```bash
+kubectl rollout status deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+kubectl get pods -n <NAMESPACE> -o wide
+kubectl describe deployment <DEPLOYMENT_NAME> -n <NAMESPACE> | grep -A 5 "Conditions:"
+```
+
+## Rollback limitations
+
+- `kubectl rollout undo` reverts the pod template spec only (image, env, volumes).
+- It does NOT revert ConfigMaps, Secrets, PVCs, or Service endpoint changes.
+- If a schema migration ran as an init container, the rollback will reuse the new schema.
+- HPA target replicas and PDB settings are not reverted by `rollout undo`.
+
+## Escalation path
+
+1. If rollback leaves pods in `CrashLoopBackOff`: check logs with `kubectl logs <POD> -n <NAMESPACE> --previous`
+2. If node is under memory pressure: drain the node with `kubectl drain <NODE> --ignore-daemonsets`
+3. If the cluster is unresponsive: escalate to AKS support via Azure portal → cluster → Support + troubleshooting

package/skills/azure/azure-live-app-service-slot-swap-guard/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: azure-live-app-service-slot-swap-guard
+description: Guard live App Service slot swaps with sticky-settings audit, warmup probe verification, swap-with-preview staging, and instant rollback posture.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# Azure Live App Service Slot Swap Guard
+
+## Purpose
+
+Act as the guarded live Azure operator for azure-live-app-service-slot-swap-guard work. Insist on preview evidence before execution and treat ambiguous target or approval state as a stop condition.
+
+## When to use
+
+Use this skill when:
+
+- an App Service slot swap to production must be staged and committed against a live environment
+- sticky settings or connection strings differ between slots and the operator must audit before swap
+- a swap-with-preview is in progress and the operator must decide to complete or reset
+
+## Lean operating rules
+
+- Prefer Azure CLI (`az`) official documentation when available; fall back to Microsoft Learn docs and sanitized user evidence.
+- Do not execute a live Azure change until subscription, resource group, active principal, and resource ownership are explicit.
+- Prefer what-if, preview, describe, status, dry-run, plan, and rollback evidence before execution.
+- If the request skips preview or rollback design, push back.
+- Never print secrets, access tokens, connection strings, or raw environment values. Summarize sanitized evidence only.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Preflight commands](references/preflight-commands.md) — CLI commands to run before any mutation.
+- [Rollback playbook](references/rollback-playbook.md) — concrete rollback steps for this service.
+- [Permission model](references/permission-model.md) — RBAC role definitions and PIM guidance.
+- [Official sources](references/official-sources.md) — authoritative Azure documentation links.
+
+## Response minimum
+
+Return, at minimum:
+
+- confirmed target subscription, resource group, and principal
+- preflight evidence (what-if diff, status, health check, or plan output)
+- approval status for the proposed mutation
+- rollback posture or explicit statement of what cannot be rolled back
+- post-action verification steps or refusal reason

package/skills/azure/azure-live-app-service-slot-swap-guard/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "azure-live-app-service-slot-swap-guard",
+  "name": "Azure Live App Service Slot Swap Guard",
+  "type": "skill",
+  "provider": "azure",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Guard live App Service slot swaps with sticky-settings audit, warmup probe verification, swap-with-preview staging, and instant rollback posture.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots",
+    "https://learn.microsoft.com/en-us/azure/app-service/deploy-best-practices",
+    "https://learn.microsoft.com/en-us/azure/app-service/configure-common"
+  ],
+  "security_notes": "Never perform a production slot swap without sticky-settings diff audit and warmup health confirmation. A bad swap with no rollback plan can take a production app offline instantly.",
+  "last_verified": "2026-04-30",
+  "path": "skills/azure/azure-live-app-service-slot-swap-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/azure/azure-live-app-service-slot-swap-guard/references/official-sources.md

@@ -0,0 +1,12 @@
+# Official Sources: Azure Live App Service Slot Swap Guard
+
+## App Service staging slots
+
+- https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots
+- https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots#swap-operation-steps
+- https://learn.microsoft.com/en-us/azure/app-service/configure-common
+
+## Source-grounding rule
+
+Use official Microsoft Learn documentation as the source of truth for App Service behavior.
+Slot-sticky setting behavior must be verified from official docs before every swap operation.

package/skills/azure/azure-live-app-service-slot-swap-guard/references/permission-model.md

@@ -0,0 +1,40 @@
+# Permission Model: Azure Live App Service Slot Swap Guard
+
+## Custom role — slot swap only, no config writes
+
+```json
+{
+  "Name": "App Service Slot Swap Guard",
+  "IsCustom": true,
+  "Description": "Read App Service slot config and perform staged swap. No write to app settings or deployment config.",
+  "Actions": [
+    "Microsoft.Web/sites/read",
+    "Microsoft.Web/sites/slots/read",
+    "Microsoft.Web/sites/slots/config/read",
+    "Microsoft.Web/sites/slots/slotsswap/action",
+    "Microsoft.Web/sites/slotsswap/action",
+    "Microsoft.Web/sites/config/read"
+  ],
+  "NotActions": [
+    "Microsoft.Web/sites/config/write",
+    "Microsoft.Web/sites/slots/config/write",
+    "Microsoft.Web/sites/delete",
+    "Microsoft.Web/sites/slots/delete"
+  ],
+  "AssignableScopes": [
+    "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<TARGET_RG>/providers/Microsoft.Web/sites/<APP_NAME>"
+  ]
+}
+```
+
+## Nearest built-in alternative
+
+`Website Contributor` includes swap rights but also allows config writes.
+Use only when custom role scope is impractical — and scope it to the single App Service, not the resource group.
+
+## Do not assign
+
+- `Owner` on the App Service — allows deletion
+- `Microsoft.Web/sites/config/write` without a change-management gate
+- `Microsoft.Web/sites/slots/delete` — slot deletion is irreversible and must not be in the swap role
+- Subscription-level `Website Contributor` for routine swap operations

package/skills/azure/azure-live-app-service-slot-swap-guard/references/preflight-commands.md

@@ -0,0 +1,46 @@
+# Preflight Commands: Azure Live App Service Slot Swap Guard
+
+Run these before initiating a slot swap. Paste sanitized output as evidence.
+
+## 1. Confirm identity and App Service target
+
+```bash
+az account show --query "{subscription:id, name:name, user:user.name}"
+az webapp show -g <RESOURCE_GROUP> -n <APP_NAME> \
+  --query "{name:name, state:properties.state, hostNames:properties.hostNames}"
+```
+
+## 2. List all slots and their current traffic weights
+
+```bash
+az webapp deployment slot list -g <RESOURCE_GROUP> -n <APP_NAME> \
+  --query "[].{name:name, state:properties.state}"
+az webapp traffic-routing show -g <RESOURCE_GROUP> -n <APP_NAME>
+```
+
+## 3. Compare app settings between slots
+
+```bash
+az webapp config appsettings list -g <RESOURCE_GROUP> -n <APP_NAME> \
+  --slot staging --query "[].{name:name, slotSetting:slotSetting}"
+az webapp config appsettings list -g <RESOURCE_GROUP> -n <APP_NAME> \
+  --query "[].{name:name, slotSetting:slotSetting}"
+```
+
+Pay special attention to `slotSetting: false` — those settings WILL swap with the slot.
+Settings with `slotSetting: true` are slot-sticky and will NOT be swapped.
+
+## 4. Check slot health before swap
+
+```bash
+az webapp show -g <RESOURCE_GROUP> -n <APP_NAME> --slot staging \
+  --query "{state:properties.state, availabilityState:properties.availabilityState}"
+# State must be "Running" and availabilityState must be "Normal" before swap
+```
+
+## 5. Review connection strings
+
+```bash
+az webapp config connection-string list -g <RESOURCE_GROUP> -n <APP_NAME> --slot staging \
+  --query "[].{name:name, type:type, slotSetting:slotSetting}"
+```

package/skills/azure/azure-live-app-service-slot-swap-guard/references/rollback-playbook.md

@@ -0,0 +1,46 @@
+# Rollback Playbook: Azure Live App Service Slot Swap Guard
+
+## Immediate swap-back (standard rollback path)
+
+The swap operation is symmetric — a second swap returns both slots to their original state.
+
+```bash
+# Verify current slot state before swapping back
+az webapp show -g <RESOURCE_GROUP> -n <APP_NAME> \
+  --query "{hostNames:properties.hostNames}"
+az webapp show -g <RESOURCE_GROUP> -n <APP_NAME> --slot staging \
+  --query "{hostNames:properties.hostNames}"
+
+# Swap back: production → staging (reverts the original swap)
+az webapp deployment slot swap \
+  -g <RESOURCE_GROUP> -n <APP_NAME> \
+  --slot staging \
+  --target-slot production
+```
+
+## Verify after rollback
+
+```bash
+az webapp show -g <RESOURCE_GROUP> -n <APP_NAME> \
+  --query "{state:properties.state, defaultHostName:properties.defaultHostName}"
+# Check application health endpoint
+curl -s https://<APP_NAME>.azurewebsites.net/health
+```
+
+## Traffic shifting (partial rollback via A/B routing)
+
+```bash
+# Route 10% of traffic to staging while investigating
+az webapp traffic-routing set -g <RESOURCE_GROUP> -n <APP_NAME> \
+  --distribution staging=10
+
+# Return all traffic to production
+az webapp traffic-routing clear -g <RESOURCE_GROUP> -n <APP_NAME>
+```
+
+## Rollback limitations
+
+- Slot swap is symmetric and reversible **only if you swap back before a second swap**.
+- App settings with `slotSetting: false` were swapped — they will swap back.
+- Any data written by the new code version to a shared database or storage is NOT rolled back by swapping.
+- Log stream evidence must be captured before initiating a rollback; logs do not travel with slot state.