@raishin/vanguard-frontier-agentic 1.0.0

package/scripts/export-marketplace-agents.mjs

@@ -0,0 +1,244 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+const PLATFORM_CONFIG = {
+  codex: {
+    variants: [["codex", ".codex/agents", ".toml"]],
+  },
+  copilot: {
+    variants: [["copilot", ".github/agents", ".agent.md"]],
+  },
+  "claude-code": {
+    variants: [["claude-code", ".claude/agents", ".md"]],
+  },
+  cursor: {
+    variants: [["cursor", ".cursor/agents", ".md"]],
+  },
+  gemini: {
+    variants: [["gemini", ".gemini/agents", ".md"]],
+  },
+  "kiro-ide": {
+    variants: [["kiro-ide", ".kiro/agents", ".md"]],
+  },
+  "kiro-cli": {
+    variants: [["kiro-cli", ".kiro/agents", ".json"]],
+  },
+  kiro: {
+    variants: [
+      ["kiro-ide", ".kiro/agents", ".md"],
+      ["kiro-cli", ".kiro/agents", ".json"],
+    ],
+  },
+};
+
+const PLATFORM_ALIASES = {
+  claude: "claude-code",
+  kiroide: "kiro-ide",
+  kirocli: "kiro-cli",
+};
+
+function usage(exitCode = 0) {
+  const message = `
+Export selected marketplace agents into a consumer repository.
+
+Usage:
+  vfa-export-agents --platform <platform> --agents <agent-id[,agent-id...]> [--repo <path>] [--force]
+  vfa-export-agents --platform <platform> --all [--repo <path>] [--force]
+  vfa-export-agents --list
+
+Platforms:
+  codex, copilot, claude-code, cursor, gemini, kiro, kiro-ide, kiro-cli
+
+Examples:
+  vfa-export-agents --list
+  vfa-export-agents --platform claude-code --agents azure-cosmosdb-platform-operator-agent
+  vfa-export-agents --platform kiro --agents azure-cosmosdb-platform-operator-agent --repo ../consumer-repo
+  vfa-export-agents --platform copilot --all --repo /path/to/project --force
+`.trim();
+  console[exitCode === 0 ? "log" : "error"](message);
+  process.exit(exitCode);
+}
+
+function parseArgs(argv) {
+  const args = {
+    repo: process.cwd(),
+    force: false,
+    list: false,
+    all: false,
+    agents: [],
+    platform: null,
+  };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") usage(0);
+    if (arg === "--list") {
+      args.list = true;
+      continue;
+    }
+    if (arg === "--force") {
+      args.force = true;
+      continue;
+    }
+    if (arg === "--all") {
+      args.all = true;
+      continue;
+    }
+    if (arg === "--repo") {
+      args.repo = path.resolve(argv[++i] ?? "");
+      continue;
+    }
+    if (arg === "--platform") {
+      args.platform = argv[++i] ?? "";
+      continue;
+    }
+    if (arg === "--agents") {
+      args.agents = (argv[++i] ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+      continue;
+    }
+    usage(1);
+  }
+
+  return args;
+}
+
+function walk(dir, matcher, results = []) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      walk(fullPath, matcher, results);
+      continue;
+    }
+    if (matcher(fullPath)) results.push(fullPath);
+  }
+  return results;
+}
+
+function loadAgents() {
+  const metadataPaths = walk(path.join(repoRoot, "agents"), (fullPath) =>
+    fullPath.endsWith(`${path.sep}metadata.json`)
+  );
+
+  const agents = metadataPaths.map((metadataPath) => {
+    const raw = fs.readFileSync(metadataPath, "utf8");
+    const metadata = JSON.parse(raw);
+    return {
+      id: metadata.id,
+      name: metadata.name,
+      provider: metadata.provider,
+      summary: metadata.summary,
+      harness_variants: metadata.harness_variants ?? {},
+      metadataPath,
+    };
+  });
+
+  const byId = new Map(agents.map((agent) => [agent.id, agent]));
+  return { agents, byId };
+}
+
+function normalizePlatform(platform) {
+  const lowered = platform.toLowerCase();
+  return PLATFORM_ALIASES[lowered] ?? lowered;
+}
+
+function ensurePlatform(platform) {
+  if (!platform) usage(1);
+  const normalized = normalizePlatform(platform);
+  if (!PLATFORM_CONFIG[normalized]) {
+    console.error(`Unsupported platform: ${platform}`);
+    usage(1);
+  }
+  return normalized;
+}
+
+function copyFile(source, destination, force) {
+  if (!force && fs.existsSync(destination)) {
+    throw new Error(`Refusing to overwrite existing file without --force: ${destination}`);
+  }
+  fs.mkdirSync(path.dirname(destination), { recursive: true });
+  fs.copyFileSync(source, destination);
+}
+
+function listAgents(agents) {
+  for (const agent of agents.sort((a, b) => a.id.localeCompare(b.id))) {
+    console.log(`${agent.id}\t${agent.provider}\t${agent.name}`);
+  }
+}
+
+function buildDestinations(agent, platform) {
+  const config = PLATFORM_CONFIG[platform];
+  const destinations = [];
+
+  for (const [variantKey, folder, extension] of config.variants) {
+    const relativeSource = agent.harness_variants[variantKey];
+    if (!relativeSource) {
+      throw new Error(`Agent ${agent.id} does not have a ${variantKey} harness variant.`);
+    }
+    destinations.push({
+      variantKey,
+      source: path.join(repoRoot, relativeSource),
+      destRelative: path.join(folder, `${agent.id}${extension}`),
+    });
+  }
+
+  return destinations;
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const { agents, byId } = loadAgents();
+
+  if (args.list) {
+    listAgents(agents);
+    return;
+  }
+
+  const platform = ensurePlatform(args.platform);
+  const selectedAgents = args.all
+    ? agents
+    : args.agents.map((agentId) => {
+        const agent = byId.get(agentId);
+        if (!agent) {
+          throw new Error(`Unknown agent id: ${agentId}`);
+        }
+        return agent;
+      });
+
+  if (selectedAgents.length === 0) {
+    throw new Error("No agents selected. Use --agents or --all.");
+  }
+
+  const operations = [];
+  for (const agent of selectedAgents) {
+    for (const destination of buildDestinations(agent, platform)) {
+      operations.push({
+        ...destination,
+        dest: path.join(args.repo, destination.destRelative),
+        agentId: agent.id,
+      });
+    }
+  }
+
+  for (const operation of operations) {
+    copyFile(operation.source, operation.dest, args.force);
+    console.log(
+      `installed\t${operation.agentId}\t${operation.variantKey}\t${path.relative(args.repo, operation.dest)}`
+    );
+  }
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(error.message);
+  process.exit(1);
+}

package/skills/AGENTS.md

@@ -0,0 +1,23 @@
+# AGENTS.md
+
+## Purpose
+- Store reusable task workflows grouped by provider or domain.
+
+## Patterns
+- `skills/<provider>/<skill-id>/SKILL.md` is the workflow entrypoint.
+- `skills/<provider>/<skill-id>/metadata.json` mirrors `catalog/skills.json`.
+- `references/` holds lazy-loaded deep context for hefty skills.
+- OCI skills are consolidated under `skills/oci/`.
+
+## Rules
+- Use progressive disclosure; do not dump all references into `SKILL.md`.
+- Keep cloud and compliance claims source-grounded.
+- Never request secrets, wallets, credentials, tokens, or customer identifiers.
+- For provider-specific `README.md` files under `skills/`, place the matching repo-local cloud logo near the top.
+- Update `catalog/skills.json` when adding, moving, or removing a skill.
+- Run `npm run manifest:write` after intentional skill edits.
+- Run `npm run validate` before finishing.
+
+## Do Not Miss
+- Manifest drift means changed skill content; refresh only when intentional.
+- New high-risk cloud skills need safety gates, rollback notes, and least-privilege posture.

package/skills/aws/aws-iam-least-privilege-review/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: aws-iam-least-privilege-review
+description: Use this skill whenever the user asks to review AWS IAM policies, trust policies, S3 bucket policies, role permissions, Access Analyzer findings, or least-privilege cloud access. Trigger even if the user says "just check this policy" or "is this role safe?".
+metadata:
+  author: github: Raishin
+  version: 0.1.0
+---
+
+# AWS IAM Least Privilege Review
+
+## Purpose
+
+Review AWS identity, trust, and resource policies for unnecessary access, privilege escalation, wildcard risk, confused-deputy exposure, and missing validation evidence.
+
+## Workflow
+
+1. Identify policy type: identity policy, trust policy, permission boundary, SCP, session policy, or resource policy.
+2. Separate facts from inference. Do not assume account IDs, regions, principals, or resource ARNs.
+3. Check for high-risk patterns:
+   - `Action: "*"` or service-wide wildcards without conditions.
+   - `Resource: "*"` where resource scoping is supported.
+   - trust policies missing `aws:SourceArn`, `aws:SourceAccount`, external ID, organization, or principal constraints.
+   - object actions granted on bucket ARNs or bucket actions granted on object ARNs.
+   - broad pass-role, sts, kms, iam, organizations, and secretsmanager permissions.
+4. Prefer least-privilege remediation over preserving legacy breadth.
+5. Validate with AWS IAM Access Analyzer policy validation when AWS credentials and profile are available.
+
+## Output
+
+Return:
+
+- risk summary,
+- exact risky statements,
+- proposed minimum-permission replacement,
+- validation command,
+- assumptions and unknowns.
+
+## Security notes
+
+Never invent ARNs or account IDs. If the requested change may affect production, require explicit user approval before applying it.

package/skills/aws/aws-iam-least-privilege-review/metadata.json

@@ -0,0 +1,25 @@
+{
+  "id": "aws-iam-least-privilege-review",
+  "name": "AWS IAM Least Privilege Review",
+  "type": "skill",
+  "provider": "aws",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review AWS IAM policies, trust policies, and resource policies for least-privilege risks with official-doc-backed remediation.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-validation.html"
+  ],
+  "security_notes": "Prefer read-only inspection. Do not broaden permissions. Validate policy changes with IAM Access Analyzer where available.",
+  "last_verified": "2026-04-27",
+  "path": "skills/aws/aws-iam-least-privilege-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/azure/README.md

@@ -0,0 +1,78 @@
+# Azure skills
+
+![Azure logo](../../assets/logos/cloud/azure/azure.png)
+
+This folder contains Azure-focused skills curated for this marketplace.
+
+## Local marketplace portfolio
+
+As of **2026-04-28**, this folder contains **24** local Azure skills:
+
+- `azure-ai-foundry-ops-governor`
+- `azure-aks-platform-operator`
+- `azure-app-service-production-readiness`
+- `azure-cost-estimation-review`
+- `azure-cost-optimization-governor`
+- `azure-entra-id-specialist`
+- `azure-cosmosdb-application-developer`
+- `azure-cosmosdb-platform-operator`
+- `azure-cosmosdb-performance-investigator`
+- `azure-governance-policy-guardrails`
+- `azure-identity-governance-review`
+- `azure-key-vault-secret-lifecycle-auditor`
+- `azure-landing-zone-architect`
+- `azure-migrate-landing-zone-cutover`
+- `azure-network-topology-review`
+- `azure-observability-investigator`
+- `azure-platform-automation-devops`
+- `azure-private-endpoint-adoption-planner`
+- `azure-rbac-review`
+- `azure-resilience-bcdr-review`
+- `azure-resource-health-incident-triage`
+- `azure-role-selector`
+- `azure-security-posture-hardening`
+- `azure-subscription-resource-organization`
+
+## Official upstream reference
+
+When adding or reviewing Azure skills, check the official Microsoft Azure skills repository first:
+
+- https://github.com/microsoft/azure-skills
+
+Use it as the primary upstream reference for Azure-specific workflow ideas, patterns, and alignment with Microsoft-maintained guidance.
+
+## Official Azure skills snapshot
+
+Source: `https://github.com/microsoft/azure-skills`
+
+Snapshot date: **2026-04-27**
+
+Based on the upstream `skills/` folder on 2026-04-27, the listed skill directories are:
+
+- `airunway-aks-setup`
+- `appinsights-instrumentation`
+- `azure-ai`
+- `azure-aigateway`
+- `azure-cloud-migrate`
+- `azure-compliance`
+- `azure-compute`
+- `azure-cost`
+- `azure-deploy`
+- `azure-diagnostics`
+- `azure-enterprise-infra-planner`
+- `azure-hosted-copilot-sdk`
+- `azure-kubernetes`
+- `azure-kusto`
+- `azure-messaging`
+- `azure-prepare`
+- `azure-quotas`
+- `azure-rbac`
+- `azure-resource-lookup`
+- `azure-resource-visualizer`
+- `azure-storage`
+- `azure-upgrade`
+- `azure-validate`
+- `entra-app-registration`
+- `microsoft-foundry`
+
+Note: the upstream repository README currently says it ships **20 curated Azure skills**, but the visible `skills/` directory listing on 2026-04-27 shows **25 skill directories**. Treat the directory listing as the fresher source unless Microsoft clarifies otherwise.

package/skills/azure/azure-ai-foundry-ops-governor/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: azure-ai-foundry-ops-governor
+description: Use this skill for Microsoft Foundry and Azure AI Foundry operations governance: resource-versus-project boundary design, RBAC review, quota planning, network isolation, logging, and safe MCP-backed read or write execution. Trigger when the user asks how to run Foundry safely across teams without access sprawl, quota surprises, or unsafe production mutations.
+metadata:
+  author: github: Raishin
+  version: 0.1.0
+---
+
+# Azure AI Foundry Ops Governor
+
+## Role Charter
+
+Act as a ruthless Azure AI Foundry operations governor. Prevent access sprawl, quota collisions, weak isolation, and unsafe MCP mutations.
+
+Default posture:
+- Prefer live evidence from official Microsoft Foundry or Azure MCP capabilities when available.
+- Treat the **Foundry resource** as the top-level governance, security, networking, monitoring, and deployment boundary.
+- Treat the **project** as the development boundary for teams, agents, files, evaluations, and project-scoped workflows.
+- Do not assume every API or feature works at project scope. Verify whether the workload requires parent resource scope.
+- Never request secrets, tokens, keys, connection strings, or customer data in chat.
+
+## Trigger Situations
+
+Use this skill when the user asks to:
+- design or review Foundry resource vs project boundaries,
+- grant team access or review Foundry RBAC safely,
+- plan Foundry model quota or deployment capacity across teams,
+- harden Foundry networking with private access or isolation,
+- verify diagnostics, audit logs, metrics, or operational monitoring,
+- perform or approve Foundry MCP-backed read/write operations,
+- govern multi-team Foundry rollout, environment separation, or production readiness.
+
+## Lean operating rules
+
+- Prefer live Azure or Microsoft evidence first when the active client exposes it; otherwise fall back to official documentation and sanitized user evidence.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad access, broad scope, destructive changes, and hand-wavy production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+
+## References
+
+Load these only when needed:
+
+- [MCP and evidence path](references/mcp-and-evidence.md) — use when choosing live Azure evidence, confirming Microsoft MCP capability, or switching to documentation mode.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, applying stress checks, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when you need the detailed Microsoft documentation list or source notes.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks or control gaps,
+- the safest next actions,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/azure/azure-ai-foundry-ops-governor/metadata.json

@@ -0,0 +1,33 @@
+{
+  "id": "azure-ai-foundry-ops-governor",
+  "name": "Azure AI Foundry Ops Governor",
+  "type": "skill",
+  "provider": "azure",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Govern Microsoft Foundry and Azure AI Foundry operations across resource-versus-project boundaries, RBAC, quotas, network isolation, logging, and safe MCP-backed execution.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/en-us/azure/foundry/concepts/architecture",
+    "https://learn.microsoft.com/en-us/azure/foundry/concepts/rbac-foundry",
+    "https://learn.microsoft.com/en-us/azure/foundry/concepts/planning",
+    "https://learn.microsoft.com/en-us/azure/foundry/mcp/security-best-practices?view=foundry",
+    "https://learn.microsoft.com/en-us/azure/foundry/how-to/configure-private-link",
+    "https://learn.microsoft.com/en-us/azure/foundry/how-to/managed-virtual-network",
+    "https://learn.microsoft.com/en-us/azure/foundry/how-to/quota",
+    "https://learn.microsoft.com/en-us/azure/foundry/foundry-models/quotas-limits",
+    "https://learn.microsoft.com/en-us/azure/foundry/foundry-models/how-to/monitor-models",
+    "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/"
+  ],
+  "security_notes": "Keep Foundry resource governance separate from project developer isolation, prefer Entra ID over key-based auth, verify quota and diagnostics before rollout, and treat MCP mutations as higher risk than read-only discovery, especially because hosted Foundry MCP security guidance documents preview and public-endpoint limitations.",
+  "last_verified": "2026-04-27",
+  "path": "skills/azure/azure-ai-foundry-ops-governor",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/azure/azure-ai-foundry-ops-governor/references/mcp-and-evidence.md

@@ -0,0 +1,34 @@
+# MCP and Evidence Path
+
+## Official Azure / Foundry MCP Linkage
+
+Use only official Microsoft MCP surfaces documented for this role.
+
+Preferred order:
+1. **Foundry MCP Server** for Foundry-native operations when the active client exposes it.
+2. **Azure MCP Server** for adjacent Azure evidence such as monitoring, quotas, and Key Vault-backed dependency checks.
+3. **Portal / CLI / documentation fallback** when the required capability is absent or write safety is unclear.
+
+Rules:
+- Do **not** invent MCP namespaces or assume a namespace exists because it would be convenient.
+- Discover tool availability first, then map the request to the exposed capability.
+- Treat read/list/query operations as lower risk than create/update/delete operations.
+- For mutating operations, require explicit confirmation of target scope, environment, and rollback path.
+- If using Foundry MCP Server, remember Microsoft documents it as preview and documents public-endpoint and cross-region processing caveats.
+
+## Platform-Agnostic Execution
+
+This skill must work in MCP-only, portal-guided, CLI-guided, macOS, Linux, and Windows environments.
+
+When examples are needed:
+- use neutral placeholders like `<subscription>`, `<resource-group>`, `<foundry-resource>`, and `<project>`,
+- avoid shell-specific assumptions until the platform is known,
+- prefer evidence collection and decision framing over long command dumps.
+
+## Documentation Fallback When Live Data Is Unavailable
+
+If live access is missing, denied, incomplete, or unsafe:
+- ground recommendations in official Microsoft Learn documentation only,
+- label conclusions as `live evidence`, `documentation-based`, `sanitized user evidence`, or `inference`,
+- do not present documentation as proof of the user's current state,
+- ask for sanitized scope details only when needed: subscription layout, resource count, project count, regions, environment split, or redacted screenshots.

package/skills/azure/azure-ai-foundry-ops-governor/references/official-sources.md

@@ -0,0 +1,25 @@
+# Official Sources
+
+## References
+
+Load only what is needed:
+- Microsoft Foundry architecture
+- Microsoft Foundry rollout planning
+- Foundry RBAC guidance
+- Foundry MCP security best practices
+- Foundry network isolation guidance
+- Foundry quota and monitoring guidance
+- Azure MCP Server tools inventory
+
+## Official Sources
+
+- Microsoft Foundry architecture: https://learn.microsoft.com/en-us/azure/foundry/concepts/architecture
+- Role-based access control for Microsoft Foundry: https://learn.microsoft.com/en-us/azure/foundry/concepts/rbac-foundry
+- Microsoft Foundry rollout across my organization: https://learn.microsoft.com/en-us/azure/foundry/concepts/planning
+- Foundry MCP Server security best practices: https://learn.microsoft.com/en-us/azure/foundry/mcp/security-best-practices?view=foundry
+- Configure network isolation for Microsoft Foundry: https://learn.microsoft.com/en-us/azure/foundry/how-to/configure-private-link
+- Configure managed virtual network for Microsoft Foundry projects: https://learn.microsoft.com/en-us/azure/foundry/how-to/managed-virtual-network
+- Manage and increase quotas for Foundry resources: https://learn.microsoft.com/en-us/azure/foundry/how-to/quota
+- Microsoft Foundry Models quotas and limits: https://learn.microsoft.com/en-us/azure/foundry/foundry-models/quotas-limits
+- Monitor model deployments in Microsoft Foundry Models: https://learn.microsoft.com/en-us/azure/foundry/foundry-models/how-to/monitor-models
+- Azure MCP Server tools inventory: https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/

package/skills/azure/azure-ai-foundry-ops-governor/references/workflow-and-output.md

@@ -0,0 +1,96 @@
+# Workflow and Output Contract
+
+## Safe Workflow
+
+1. **Classify the boundary**
+   - Identify tenant, subscription, resource group, Foundry resource, and project scope.
+   - Decide whether the question is resource-governance, project-operations, or connected-resource governance.
+
+2. **Verify resource vs project fit**
+   - Check whether the workload can live at project scope.
+   - If a required API or capability stays at parent resource scope, do not fake project isolation; recommend separate Foundry resources where justified.
+
+3. **Review RBAC and identity model**
+   - Prefer Entra ID and least privilege.
+   - Separate admin, project manager, and project user responsibilities.
+   - Challenge key-based access because Microsoft documents that keys bypass RBAC restrictions.
+
+4. **Review quota and deployment posture**
+   - Check current model quotas, deployment counts, rate limits, and cross-team contention risk.
+   - Distinguish experimentation quota from production quota.
+   - Call out 429 risk, PTU saturation risk, and quota ownership gaps.
+
+5. **Review network isolation and connected resources**
+   - Separate inbound access, outbound access from Foundry, and outbound access from agents.
+   - Check whether private endpoints, DNS, and dependent resources are part of the design.
+   - Remember Storage, Key Vault, and Azure AI Search keep their own governance boundaries.
+
+6. **Review logging and monitoring**
+   - Check metrics, audit logs, request/response logs, trace logs, and diagnostic settings.
+   - Call out when monitoring exists only on paper and not in routed diagnostics.
+
+7. **Gate MCP execution safety**
+   - Read-only discovery first.
+   - Mutations only after target, blast radius, approval path, and rollback are explicit.
+   - Default production changes to staged or nonproduction-first unless the user clearly authorizes otherwise.
+
+8. **Return a go / no-go verdict**
+   - Summarize blockers, residual risks, and the safest next actions.
+
+## Role-Specific Stress Checks
+
+- Are you confusing the Foundry resource governance boundary with the project development boundary?
+- Are you assuming project-scoped RBAC works for APIs that still require parent resource scope?
+- Are you recommending key-based auth even though it bypasses RBAC restrictions?
+- Are you proposing private access without DNS, Private Link, dependent-resource, or agent-network implications?
+- Are you claiming observability exists without diagnostic settings and actual destinations?
+- Are you proposing MCP writes without confirming preview status, public-endpoint limitations, rollback, and environment scope?
+- Are you treating quota as a one-team problem when multiple projects share the same resource-level constraints?
+
+## Output Template
+
+```markdown
+# Foundry Operations Governance Review: <scope>
+
+## Verdict
+- Status: READY / READY WITH RISKS / NOT READY
+- Biggest risk:
+- Evidence level: live evidence / documentation-based / sanitized user evidence / inference
+
+## Scope
+- Subscription / resource group:
+- Foundry resource:
+- Project(s):
+- Environment: dev / test / prod
+- Requested action:
+
+## Boundary decision
+- Resource-level controls:
+- Project-level controls:
+- Connected resources requiring separate governance:
+- Unsupported or parent-scope-only capabilities:
+
+## Findings
+| Area | Finding | Severity | Evidence | Recommendation | Owner |
+|---|---|---|---|---|---|
+
+## Safe execution plan
+1.
+2.
+3.
+
+## Rollout blockers
+- 
+
+## Open questions
+- 
+```
+
+## Red Flags
+
+- One Foundry resource is being used as a catch-all for unrelated teams with no cost, quota, or access ownership.
+- The design assumes projects alone provide full isolation even when required APIs operate at parent resource scope.
+- The plan uses key-based auth for convenience instead of Entra ID and scoped RBAC.
+- Private networking is requested, but no one owns private DNS, private endpoints, or connected-resource approvals.
+- Diagnostics are called mandatory, but no Log Analytics, retention, or alert ownership exists.
+- MCP mutation is proposed directly against production without a staged validation path.