@raishin/vanguard-frontier-agentic 1.0.0

package/skills/azure/azure-cosmosdb-platform-operator/references/mcp-and-evidence.md

@@ -0,0 +1,31 @@
+# MCP and evidence path
+
+Use this reference only when you need to decide how to gather evidence.
+
+## Live-first evidence rule
+
+1. Prefer live Azure MCP capability evidence when the active client exposes Azure tools.
+2. Treat the runtime-exposed tool inventory as truth.
+3. If Cosmos DB tooling is not exposed live, say so and switch to documentation-based guidance instead of pretending the namespace exists.
+
+## Azure MCP grounding
+
+Based on Microsoft documentation:
+
+- Azure MCP supports a documented `cosmos` namespace in namespace mode.
+- Microsoft recommends **consolidated mode** for AI agents because it reduces tool count and improves usability.
+- Namespace filtering means a client may expose only a subset of Azure tools.
+
+Implication:
+
+- Do not assume that `cosmos` is available in the current runtime just because Microsoft documents it.
+- If live MCP discovery is unclear, inspect or ask for the available Azure tool inventory before making namespace-specific claims.
+
+## Evidence hierarchy
+
+Use this order:
+
+1. **live evidence** — Azure MCP output, sanitized screenshots, sanitized metrics, sanitized query results, or user-provided config excerpts
+2. **user-provided sanitized evidence** — redacted portal output, SDK code, IaC snippets, logs, or query text
+3. **documentation-based** — Microsoft Learn and official Azure MCP documentation
+4. **inference** — conclusions derived from patterns but not directly proven by evidence

package/skills/azure/azure-cosmosdb-platform-operator/references/official-sources.md

@@ -0,0 +1,34 @@
+# Official sources
+
+Use this reference only when you need the detailed source list or need to ground a specific claim.
+
+## Azure MCP
+
+- Azure MCP overview  
+  https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview
+- Azure MCP concepts  
+  https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/concepts
+- Azure MCP tools overview  
+  https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/
+
+## Azure Cosmos DB
+
+- Partitioning and horizontal scaling in Azure Cosmos DB  
+  https://learn.microsoft.com/en-us/azure/cosmos-db/partitioning
+- Data modeling in Azure Cosmos DB for NoSQL  
+  https://learn.microsoft.com/en-us/azure/cosmos-db/modeling-data
+- Consistency levels in Azure Cosmos DB  
+  https://learn.microsoft.com/en-us/azure/cosmos-db/consistency-levels
+- Manage consistency levels in Azure Cosmos DB  
+  https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-manage-consistency
+- Tuning query performance with Azure Cosmos DB  
+  https://learn.microsoft.com/en-us/azure/cosmos-db/query-metrics
+- Architecture best practices for Azure Cosmos DB for NoSQL  
+  https://learn.microsoft.com/en-us/azure/well-architected/service-guides/cosmos-db
+- Hierarchical partition keys  
+  https://learn.microsoft.com/en-us/azure/cosmos-db/hierarchical-partition-keys
+
+## Grounded insights used by this skill
+
+- Do not trust generic NoSQL advice unless it matches Azure Cosmos DB partitioning and consistency behavior.
+- Runtime-exposed Azure MCP tools are truth; documentation does not prove current client exposure.

package/skills/azure/azure-cosmosdb-platform-operator/references/workflow-and-output.md

@@ -0,0 +1,37 @@
+# Workflow and output contract
+
+Use this reference only when you are performing the full review or implementation-guidance pass.
+
+## Workflow
+
+1. **Scope the target**
+   - Confirm API/workload if known: NoSQL, Mongo, Cassandra, Gremlin, Table, or unknown.
+   - Confirm whether the user needs this role specifically, not an adjacent Azure role.
+   - Confirm whether the question is about an existing workload or a new design.
+
+2. **Establish evidence level**
+   - Use live Azure MCP evidence when available.
+   - Otherwise use official docs plus sanitized user evidence.
+   - Explicitly label unknowns.
+
+3. **Stress checks**
+   - Check account, region, API surface, and whether the question is about an existing workload or a new design.
+   - Stress-test partition-key choice, logical-partition growth, hot-partition risk, and query alignment.
+   - Check throughput model, RU consumption, throttling behavior, indexing posture, and multi-region tradeoffs.
+   - Call out adjacent roles when the dominant problem is RBAC, networking, observability, or cost governance.
+
+4. **Check adjacent roles the user may be missing**
+   - **Azure RBAC Review** when the real issue is overbroad account or data-plane access.
+   - **Azure Network Topology Review** when private endpoints, DNS, routing, or egress control dominate the problem.
+   - **Azure Observability Investigator** when the question becomes metrics, alerts, logs, or telemetry gaps.
+   - **Azure Cost Optimization Governor** when the issue is sustained RU waste or poor autoscale governance.
+
+## Output contract
+
+Use this structure:
+
+1. **Verdict**
+2. **Evidence level**
+3. **Key findings**
+4. **Safest next actions**
+5. **Open questions**

package/skills/azure/azure-cost-estimation-review/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: azure-cost-estimation-review
+description: Review Azure cost estimates, pricing calculator assumptions, SKU and region choices, environment sizing realism, and uncertainty handling using official Microsoft cost-management and Azure MCP pricing documentation only.
+metadata:
+  author: github: Raishin
+  version: 0.1.0
+---
+
+# Azure Cost Estimation Review
+
+## Role Charter
+
+Act as a ruthless Azure cost estimation reviewer. Your job is to stop fake precision, weak sizing assumptions, region/SKU guesswork, and production-budget fantasies before they turn into a bad Azure bill or a misleading business case.
+
+Default access posture:
+- Prefer detected official Azure MCP pricing capabilities when available.
+- Otherwise work from official Microsoft documentation and user-provided sanitized assumptions.
+- Never ask the user to paste secrets, negotiated price sheets, private contracts, raw billing exports, credentials, tokens, or customer-identifying billing data into chat.
+- Do not hard-code MCP server names, subscriptions, billing accounts, management groups, regions, SKUs, currencies, or environment names.
+
+## Trigger Situations
+
+Use this skill when the user asks to:
+- review an Azure pricing calculator estimate before approval or deployment,
+- sanity-check Azure SKU, tier, region, quantity, or uptime assumptions,
+- compare nonproduction versus production cost assumptions,
+- challenge whether an Azure estimate is realistic enough for budgeting or architecture decisions,
+- estimate likely cost impact from sizing changes, region moves, HA/DR choices, or reserved-versus-pay-as-you-go posture,
+- verify whether the estimate labels uncertainty and missing facts honestly,
+- assess whether a Bicep, ARM, or equivalent deployment estimate is materially incomplete.
+
+## Lean operating rules
+
+- Prefer live Azure or Microsoft evidence first when the active client exposes it; otherwise fall back to official documentation and sanitized user evidence.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad access, broad scope, destructive changes, and hand-wavy production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+
+## References
+
+Load these only when needed:
+
+- [MCP and evidence path](references/mcp-and-evidence.md) — use when choosing live Azure evidence, confirming Microsoft MCP capability, or switching to documentation mode.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, applying stress checks, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when you need the detailed Microsoft documentation list or source notes.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks or control gaps,
+- the safest next actions,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/azure/azure-cost-estimation-review/metadata.json

@@ -0,0 +1,30 @@
+{
+  "id": "azure-cost-estimation-review",
+  "name": "Azure Cost Estimation Review",
+  "type": "skill",
+  "provider": "azure",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Azure cost estimates for pricing-calculator assumptions, SKU and region realism, production versus nonproduction sizing, omission risk, and explicit uncertainty labeling.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/en-us/azure/cost-management-billing/understand/plan-manage-costs",
+    "https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/pricing-calculator",
+    "https://learn.microsoft.com/en-us/azure/cost-management-billing/",
+    "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/governance",
+    "https://learn.microsoft.com/en-us/azure/cost-management-billing/savings-plan/manage-savings-plan",
+    "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/",
+    "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/azure-pricing"
+  ],
+  "security_notes": "Do not present calculator output as invoice truth, do not hide missing sizing assumptions, and do not imply unsupported Azure MCP pricing or billing capabilities. Treat negotiated pricing, discount posture, and future utilization as explicit uncertainty unless verified.",
+  "last_verified": "2026-04-27",
+  "path": "skills/azure/azure-cost-estimation-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/azure/azure-cost-estimation-review/references/mcp-and-evidence.md

@@ -0,0 +1,31 @@
+# MCP and Evidence Path
+
+## Official Azure MCP Linkage
+
+Use official Azure MCP servers as configured in the active runtime. Do not hard-code the server name; users may register the official Azure MCP server under any label. Detect by exposed tool capability and package identity hints, not by fixed server naming.
+
+Preferred official Azure MCP capability for this role:
+
+- `pricing` for retail pricing lookups, region/SKU comparisons, and template-backed cost estimation.
+
+Secondary official context:
+
+- broader Azure MCP tools inventory only to confirm documented capability existence, not to invent cost-analysis or billing behavior beyond the official docs.
+
+If the expected Azure MCP pricing capability is missing or ambiguous, ask only which configured MCP server exposes the official Azure pricing tools. Do not ask for secrets, contract pricing, subscription dumps, credentials, or tokens.
+
+Do not invent unsupported MCP tools. If a live need exceeds confirmed Azure MCP capability, switch to documentation mode and say so.
+
+## Platform-Agnostic Execution
+
+This skill must work on macOS, Windows, Linux, browser-first clients, and MCP-only clients. Prefer Azure MCP pricing evidence when available. When portal checks, pricing calculator workflows, CLI, PowerShell, Bicep, or ARM examples are useful, show neutral command or workflow shape with `<placeholders>` and adapt only after the user's active platform is known.
+
+## Documentation Fallback When Live Data Is Unavailable
+
+Live Azure MCP pricing data beats documentation. If live data is unavailable, incomplete, denied, or unsafe to query, switch to documentation/reference mode:
+
+- Use Microsoft Learn pricing-calculator and cost-management documentation for estimate behavior, scope limits, and planning guidance.
+- Use Microsoft Learn Azure MCP documentation only to describe confirmed official pricing-tool capability, not to imply tenant-specific cost visibility.
+- Ask for sanitized estimate exports, screenshots, template snippets, region/SKU lists, uptime assumptions, transaction or throughput assumptions, storage-growth assumptions, and HA/DR assumptions when current-state evidence is required.
+- Label every conclusion as `live evidence`, `documentation-based`, `user-provided sanitized evidence`, or `inference`.
+- Do not pretend documentation proves the user's negotiated pricing, current discounts, exact invoice outcome, tax treatment, or real future utilization.

package/skills/azure/azure-cost-estimation-review/references/official-sources.md

@@ -0,0 +1,23 @@
+# Official Sources
+
+## References
+
+Load these only when needed, following progressive disclosure:
+
+- [Plan to manage Azure costs](https://learn.microsoft.com/en-us/azure/cost-management-billing/understand/plan-manage-costs) — use for the core Microsoft framing: estimate first, then monitor, analyze, and manage.
+- [Estimate costs with the Azure pricing calculator](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/pricing-calculator) — use for calculator behavior, inputs, saved estimates, agreement-price caveats, and estimate-sharing limits.
+- [Cost Management + Billing documentation](https://learn.microsoft.com/en-us/azure/cost-management-billing/) — use for pricing-and-estimation navigation, scope concepts, and adjacent cost-management references.
+- [Azure landing zone governance design area](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/governance) — use when the estimate must be tied to ownership, scope, policy, and governance accountability.
+- [Manage savings plans](https://learn.microsoft.com/en-us/azure/cost-management-billing/savings-plan/manage-savings-plan) — use when the estimate depends on savings-plan assumptions and those assumptions need ownership and scope realism.
+- [Azure MCP Server tools inventory](https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/) — use to confirm official Azure MCP capability names before describing live-tool usage.
+- [Azure pricing tools for the Azure MCP Server](https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/azure-pricing) — use when official Azure MCP pricing evidence is available for retail pricing, billing questions, or template-based estimate support.
+
+## Official Sources
+
+- Microsoft Learn — Plan to manage Azure costs: https://learn.microsoft.com/en-us/azure/cost-management-billing/understand/plan-manage-costs
+- Microsoft Learn — Estimate costs with the Azure pricing calculator: https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/pricing-calculator
+- Microsoft Learn — Cost Management + Billing documentation: https://learn.microsoft.com/en-us/azure/cost-management-billing/
+- Microsoft Learn — Azure landing zone governance design area: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/governance
+- Microsoft Learn — Manage savings plans: https://learn.microsoft.com/en-us/azure/cost-management-billing/savings-plan/manage-savings-plan
+- Microsoft Learn — Azure MCP Server tools inventory: https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/
+- Microsoft Learn — Azure pricing tools for the Azure MCP Server: https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/azure-pricing

package/skills/azure/azure-cost-estimation-review/references/workflow-and-output.md

@@ -0,0 +1,72 @@
+# Workflow and Output Contract
+
+## Safe Workflow
+
+1. **Define the estimate boundary**: identify billing scope, target environment, currency, timeframe, and whether the estimate is for rough planning, architecture comparison, or approval.
+2. **Separate retail estimate from real payable cost**: check whether the estimate uses retail pricing only, logged-in agreement pricing, savings-plan assumptions, or reserved-capacity assumptions.
+3. **Inspect workload assumptions**: uptime, scale units, storage growth, bandwidth, transaction volume, backup, HA/DR, and environment count.
+4. **Inspect SKU and region realism**: verify that the chosen region, service tier, VM family, database tier, redundancy option, and network path match the stated workload and compliance constraints.
+5. **Challenge nonproduction shortcuts**: confirm whether dev/test assumptions are being incorrectly reused for production, especially around uptime, redundancy, throughput headroom, support, and recovery expectations.
+6. **Check omission risk**: look for missing networking, monitoring, backup, egress, public IP, log ingestion, premium storage, or disaster-recovery components that make the estimate falsely low.
+7. **Check uncertainty labeling**: require explicit statements about what is estimated, what is unknown, what depends on future utilization, and what may change by region, agreement, or discount posture.
+8. **Return an estimate-credibility verdict**: call the estimate credible only if scope, assumptions, omissions, and uncertainty are explicit.
+
+## Role-Specific Stress Checks
+
+- Do not accept calculator output as truth merely because it came from Microsoft tooling. Garbage assumptions still produce garbage estimates.
+- Do not confuse retail pricing with negotiated enterprise pricing or final invoice cost.
+- Do not accept production estimates that omit HA, DR, logging, backup, or support expectations.
+- Do not accept “same SKU in every region” thinking without latency, availability, and price variation review.
+- Do not let teams reuse nonproduction right-sizing assumptions for production without headroom and resilience justification.
+- Do not accept monthly totals without checking whether the estimate assumes 24x7 runtime, partial-hours usage, autoscale behavior, or paused resources.
+- Do not accept savings-plan or reservation claims unless the ownership, scope, term, and utilization confidence are explicit.
+- Do not hide uncertainty. If storage growth, throughput, egress, or retention is unknown, say the estimate is weak.
+
+## Output Template
+
+```markdown
+# Azure Cost Estimation Review: <scope>
+
+## Verdict
+- Status: CREDIBLE / CREDIBLE WITH RISKS / NOT CREDIBLE
+- Biggest estimate risk:
+- Evidence level: live evidence / documentation-based / user-provided sanitized evidence / inference
+
+## Scope
+- Billing or resource scope:
+- Environment: dev / test / prod / mixed
+- Time horizon:
+- Currency:
+- Requested action:
+
+## Assumption review
+| Area | Current assumption | Risk | Evidence | Recommendation | Owner |
+|---|---|---|---|---|---|
+| Region |  |  |  |  |  |
+| SKU / tier |  |  |  |  |  |
+| Runtime / uptime |  |  |  |  |  |
+| Scale / quantity |  |  |  |  |  |
+| Storage / retention |  |  |  |  |  |
+| Network / egress |  |  |  |  |  |
+| HA / DR |  |  |  |  |  |
+| Savings plan / reservation |  |  |  |  |  |
+| Missing components |  |  |  |  |  |
+| Uncertainty labeling |  |  |  |  |  |
+
+## Safe next actions
+1.
+2.
+3.
+
+## Open questions
+- 
+```
+
+## Red Flags
+
+- The estimate is being used for approval, but nobody can explain the region, SKU, or runtime assumptions.
+- The estimate mixes nonproduction and production expectations into one number.
+- The estimate assumes savings-plan or reserved pricing without ownership or utilization confidence.
+- The estimate excludes DR, monitoring, backup, or network egress for a production workload.
+- The estimate presents a single monthly number with no uncertainty band or missing-assumption list.
+- The estimate claims invoice accuracy even though it is based only on retail pricing or incomplete sizing inputs.

package/skills/azure/azure-cost-optimization-governor/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: azure-cost-optimization-governor
+description: Review Azure spend governance, budgets, alerts, cost analysis visibility, reservation and savings-plan awareness, tagging for cost allocation, exports, and FinOps ownership with official Microsoft documentation and Azure MCP evidence where available.
+metadata:
+  author: github: Raishin
+  version: 0.1.0
+---
+
+# Azure Cost Optimization Governor
+
+## Role Charter
+
+Act as a ruthless Azure cost optimization governor. Your job is to stop vague FinOps theater, missing ownership, and fake savings claims before they become budget drift. Force exact scope, billing boundary, owner, timeframe, tagging posture, visibility gaps, and control maturity before recommending changes.
+
+Default access posture:
+- Prefer detected official Azure MCP tools when available.
+- Otherwise work from official Microsoft documentation and user-provided sanitized evidence.
+- Never ask the user to paste secrets, billing exports with customer data, credentials, tokens, tenant secrets, or account identifiers into chat.
+- Do not hard-code MCP server names, subscriptions, management groups, billing accounts, resource groups, storage accounts, or automation identities.
+
+## Trigger Situations
+
+Use this skill when the user asks to:
+- Review Azure cost governance, spend controls, or FinOps operating posture.
+- Design or critique budgets, threshold alerts, forecast alerts, or stakeholder notification paths.
+- Improve cost analysis visibility across management groups, subscriptions, resource groups, services, or tags.
+- Assess reservation or Azure savings plan awareness and whether amortized-versus-actual views are being handled correctly.
+- Evaluate tagging strategy for cost allocation, chargeback, showback, or ownership accountability.
+- Set up or review exports, recurring cost data delivery, downstream reporting, or automation-friendly spend datasets.
+- Challenge whether Azure Advisor cost recommendations, pricing data, or quota signals are being used effectively.
+
+## Lean operating rules
+
+- Prefer live Azure or Microsoft evidence first when the active client exposes it; otherwise fall back to official documentation and sanitized user evidence.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad access, broad scope, destructive changes, and hand-wavy production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+
+## References
+
+Load these only when needed:
+
+- [MCP and evidence path](references/mcp-and-evidence.md) — use when choosing live Azure evidence, confirming Microsoft MCP capability, or switching to documentation mode.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, applying stress checks, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when you need the detailed Microsoft documentation list or source notes.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks or control gaps,
+- the safest next actions,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/azure/azure-cost-optimization-governor/metadata.json

@@ -0,0 +1,32 @@
+{
+  "id": "azure-cost-optimization-governor",
+  "name": "Azure Cost Optimization Governor",
+  "type": "skill",
+  "provider": "azure",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Azure FinOps and spend-governance posture across budgets, alerts, cost analysis visibility, tagging, exports, and reservation or savings-plan awareness with explicit ownership and evidence handling.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/en-us/azure/cost-management-billing/understand/plan-manage-costs",
+    "https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-acm-create-budgets",
+    "https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/governance",
+    "https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/reporting-get-started",
+    "https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-improved-exports",
+    "https://learn.microsoft.com/en-us/azure/advisor/advisor-reference-cost-recommendations",
+    "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/",
+    "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/azure-pricing",
+    "https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/azure-advisor"
+  ],
+  "security_notes": "Do not promise savings without utilization evidence, treat budgets as alerts rather than enforcement, keep billing and export data sanitized, and require named ownership for alerts, tags, exports, and optimization follow-up before calling the FinOps posture credible.",
+  "last_verified": "2026-04-27",
+  "path": "skills/azure/azure-cost-optimization-governor",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/azure/azure-cost-optimization-governor/references/mcp-and-evidence.md

@@ -0,0 +1,30 @@
+# MCP and Evidence Path
+
+## Official Azure MCP Linkage
+
+Use official Azure MCP servers as configured in the active runtime. Do not hard-code the server name; users may register the official Azure MCP server under any label. Detect by exposed tool capability and package identity hints, not by fixed server naming.
+
+Preferred official Azure MCP capability for this role:
+
+- `pricing` for retail pricing, deployment-cost estimation, and pricing comparisons.
+- `advisor` for live cost recommendation posture and optimization candidates.
+- `quota` only when quota posture materially affects reservation, sizing, or cost-governance decisions.
+
+If the expected Azure MCP tools are missing or ambiguous, ask only which configured MCP server exposes the official Azure tools. Do not ask for secrets, raw billing exports, subscription dumps, credentials, or tokens.
+
+Do not invent unsupported MCP tools. If a live need exceeds confirmed Azure MCP capability, switch to documentation mode and say so.
+
+## Platform-Agnostic Execution
+
+This skill must work on macOS, Windows, Linux, browser-first clients, and MCP-only clients. Prefer Azure MCP evidence. When portal checks, CLI, PowerShell, Bicep, or automation examples are useful, show neutral command or workflow shape with `<placeholders>` and adapt only after the user's active platform is known.
+
+## Documentation Fallback When Live Data Is Unavailable
+
+Live Azure MCP data beats documentation. If live data is unavailable, incomplete, denied, or unsafe to query, switch to documentation/reference mode:
+
+- Use Microsoft Learn Cost Management and Billing documentation for cost-governance behavior, budget mechanics, cost-analysis visibility, exports, and optimization framing.
+- Use Microsoft Learn Azure Advisor guidance for recommendation categories and cost-saving posture.
+- Use Microsoft Learn Azure MCP documentation only to describe confirmed official MCP capabilities, not to invent runtime access or tenant state.
+- Ask for sanitized screenshots, cost-analysis views, redacted export samples, tag dictionaries, ownership matrices, or redacted budget definitions when current-state evidence is required.
+- Label every conclusion as `live evidence`, `documentation-based`, `user-provided sanitized evidence`, or `inference`.
+- Do not pretend documentation proves current spend, current savings opportunity, or current reservation coverage.

package/skills/azure/azure-cost-optimization-governor/references/official-sources.md

@@ -0,0 +1,14 @@
+# Official Sources
+
+## References
+
+Load these only when needed, following progressive disclosure:
+
+- [Plan to manage Azure costs](https://learn.microsoft.com/en-us/azure/cost-management-billing/understand/plan-manage-costs) — use for baseline cost-governance posture, budgets, alerts, pricing, and optimization framing.
+- [Tutorial: Create and manage budgets](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-acm-create-budgets) — use for budget scope, thresholds, forecast alerts, and evaluation behavior.
+- [Azure landing zone governance design area](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/governance) — use when cost controls must be anchored in broader Azure governance ownership, scope, and policy operating model.
+- [Get started with Cost Management reporting](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/reporting-get-started) — use for cost analysis visibility, reporting limits, and scope-aware analysis workflow.
+- [Tutorial: Create and manage Cost Management exports](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-improved-exports) — use for export automation, datasets, storage delivery, and recurring reporting workflows.
+- [Cost recommendations - Azure Advisor](https://learn.microsoft.com/en-us/azure/advisor/advisor-reference-cost-recommendations) — use when challenging waste, idle capacity, or optimization recommendation quality.
+- [Azure pricing tools for the Azure MCP Server](https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/azure-pricing) — use when cost estimation, pricing lookup, or template-based pricing evidence is needed through official Azure MCP tooling.
+- [Azure Advisor tools for the Azure MCP Server overview](https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/azure-advisor) — use when live Advisor-backed cost recommendation evidence is available through Azure MCP.

package/skills/azure/azure-cost-optimization-governor/references/workflow-and-output.md

@@ -0,0 +1,71 @@
+# Workflow and Output Contract
+
+## Safe Workflow
+
+1. **Fix the scope first**: management group, subscription, resource group, billing scope, or mixed; name the decision owner and reporting audience.
+2. **Check visibility before optimization**: confirm cost analysis usage, scope coverage, tag coverage, amortized-versus-actual view awareness, and whether exported data exists for durable reporting.
+3. **Inspect ownership and accountability**: who receives alerts, who approves spend exceptions, who owns tag quality, who acts on Advisor findings, and who reviews recurring exports.
+4. **Review spend controls**: budgets, threshold alerts, forecast alerts, cadence, and whether thresholds are aligned to actual governance response rather than vanity numbers.
+5. **Review optimization evidence**: Advisor cost recommendations, pricing posture, reservation awareness, savings-plan awareness, idle or oversized patterns, and known blind spots.
+6. **Review allocation and reporting quality**: tag strategy, missing owner/cost-center tags, export automation, dataset choice, and downstream reporting consumers.
+7. **Give a prioritized governance verdict**: visibility gaps first, ownership gaps second, control gaps third, optimization actions fourth. Do not reverse that order unless evidence is overwhelming.
+
+## Role-Specific Stress Checks
+
+- Do not promise savings without utilization or recommendation evidence.
+- Do not confuse price estimation with governance. A pricing quote is not a cost-control operating model.
+- Do not call budgets “enforcement.” Budgets alert; they do not stop resource consumption.
+- Do not ignore actual-versus-amortized cost views when reservations or savings plans matter.
+- Do not accept “we have tags” as success unless tag coverage, consistency, and ownership are real.
+- Do not recommend exports without naming dataset consumers, refresh cadence, storage path ownership, and verification checks.
+- Do not treat Azure Advisor recommendations as self-justifying. Check ownership, feasibility, and risk before calling them savings.
+- Do not accept governance claims when no one owns alerts, no one reviews exports, and no one triages cost anomalies.
+
+## Output Template
+
+```markdown
+# Azure Cost Governance Review: <scope>
+
+## Verdict
+- Status: READY / READY WITH RISKS / NOT READY
+- Biggest cost-governance gap:
+- Evidence level: live evidence / documentation-based / sanitized evidence / inference
+
+## Scope
+- Billing or resource scope:
+- Owner:
+- Audience:
+- Requested action:
+
+## Visibility and ownership
+| Area | Current state | Risk | Evidence | Recommendation | Owner |
+|---|---|---|---|---|---|
+| Cost analysis |  |  |  |  |  |
+| Budgets and alerts |  |  |  |  |  |
+| Tags for cost |  |  |  |  |  |
+| Exports and reporting |  |  |  |  |  |
+| Reservation and savings-plan awareness |  |  |  |  |  |
+| Advisor and optimization review |  |  |  |  |  |
+
+## Prioritized controls
+1.
+2.
+3.
+
+## Safe next actions
+1.
+2.
+3.
+
+## Open questions
+- 
+```
+
+## Red Flags
+
+- The request asks for “cost optimization” but no scope owner, budget owner, or reporting audience exists.
+- The answer claims savings based only on pricing pages or intuition, without usage evidence, Advisor findings, or documented governance gaps.
+- The design depends on reservations or savings plans but ignores amortized reporting.
+- The team has budgets but no alert recipients with accountability.
+- The team exports data but cannot name who consumes it or how failed exports are detected.
+- The plan depends on tags for cost allocation but tag coverage or ownership is unknown.

package/skills/azure/azure-entra-id-specialist/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: azure-entra-id-specialist
+description: Use this skill for Microsoft Entra ID specialist work, especially Conditional Access, authentication methods, MFA and SSPR registration, identity protection, workload identities, app registrations, external identities, agent identities, break-glass posture, and tenant identity control reviews.
+metadata:
+  author: github: Raishin
+  version: 0.1.0
+---
+
+# Azure Entra ID Specialist
+
+## Purpose
+
+Review and guide Microsoft Entra ID posture beyond governance-only workflows. Use this skill when the user needs broader Entra identity administration, access-control hardening, sign-in control critique, identity-risk handling, workload identity review, or app-registration security guidance.
+
+This skill is for Entra-focused work across:
+
+- Conditional Access design and lockout-risk review,
+- MFA, SSPR, authentication methods, and registration protection,
+- identity protection and risky-user or risky-sign-in handling,
+- workload identities, managed identities, and service-principal access posture,
+- agent identities, AI-agent Conditional Access, and agent-governance control boundaries,
+- application registrations and enterprise-app access shape,
+- external identities and B2B/B2C-style tenant access boundaries,
+- break-glass and emergency-access account safety,
+- tenant-level identity control review that is broader than governance alone.
+
+## When to use
+
+Use this skill when the user asks for:
+
+- Microsoft Entra ID security or tenant identity review,
+- Conditional Access design or exclusions critique,
+- MFA, SSPR, or authentication-method posture review,
+- identity protection or risky sign-in/risky user response guidance,
+- workload identity or service principal risk review,
+- AI agent identity, agent blueprint, or agent-governance posture review,
+- app-registration or enterprise-app access hardening,
+- external identity or guest access posture review.
+
+Do not use this skill as a substitute for:
+
+- a narrower PIM / access review / entitlement-management governance review when that is the whole problem,
+- low-level authentication bug fixing inside application code,
+- generic Azure RBAC review when the real problem is Azure resource authorization rather than Entra identity control,
+- full network or landing-zone design where identity is only incidental.
+
+If the problem narrows mainly to PIM, access reviews, entitlement management, or standing-versus-eligible access, use **Azure Identity Governance Review** instead of stretching this skill.
+
+## Lean operating rules
+
+- Prefer live Azure or Microsoft evidence first when the active client exposes it; otherwise fall back to official documentation and sanitized user evidence.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Treat Microsoft licensing and service entitlement as a first-class constraint; do not imply a control exists for the tenant if the required license or product entitlement is unproven.
+- If the user mentions an adjacent Microsoft service that is not explicitly covered in the current examples, consult official references before concluding feature rights, identity scope, or licensing behavior. The examples in this skill are anchors, not the limit of the role.
+- Challenge broad exclusions, permanent privileged access, vague emergency-access stories, weak app-registration ownership, and hand-wavy production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+
+## References
+
+Load these only when needed:
+
+- [MCP and evidence path](references/mcp-and-evidence.md) — use when choosing live Azure evidence, confirming Microsoft MCP capability, or switching to documentation mode.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, applying stress checks, or formatting the final answer.
+- [Licensing and service entitlements](references/licensing-and-service-entitlements.md) — use when Conditional Access, PIM, ID Protection, Workload ID, Microsoft 365 bundles, Microsoft Fabric examples, or cross-service feature rights are in scope.
+- [Adjacent Microsoft service expansion](references/adjacent-service-expansion.md) — use when the user brings up another Microsoft service and you need to learn the identity, entitlement, or licensing relationship before answering.
+- [Official sources](references/official-sources.md) — use when you need the detailed Microsoft documentation list or source notes.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main Entra control gaps or safety risks,
+- the safest next actions,
+- the assumptions or blockers that prevent stronger conclusions.