@raishin/vanguard-frontier-agentic 1.1.0 → 1.2.0

package/skills/terraform/terraform-maestro/references/official-sources.md

@@ -0,0 +1,59 @@
+# Official Sources — Terraform Maestro
+
+Authoritative documentation for routing decisions and verifying IaC agent names.
+
+---
+
+## Agent Catalog
+
+Verify agent IDs against this list before dispatching. Do not invent IDs not listed here.
+
+| Agent ID | Provider | Domain |
+|----------|----------|--------|
+| `terraform-reviewer` | terraform | review |
+| `aws-iac-change-safety-review-agent` | aws | aws-iac |
+| `aws-iac-patch-executor-agent` | aws | aws-iac |
+| `aws-landing-zone-governor-agent` | aws | aws-iac |
+| `azure-landing-zone-architect-agent` | azure | azure-iac |
+| `aws-live-iac-change-guard-agent` | aws | live-guard |
+| `azure-live-arm-deployment-stack-guard-agent` | azure | live-guard |
+| `oci-live-resource-manager-stack-guard-agent` | oci | live-guard |
+
+---
+
+## Terraform Official Docs
+
+- Language reference: `https://developer.hashicorp.com/terraform/language`
+- CLI commands: `https://developer.hashicorp.com/terraform/cli/commands`
+- Plan: `https://developer.hashicorp.com/terraform/cli/commands/plan`
+- Apply: `https://developer.hashicorp.com/terraform/cli/commands/apply`
+- State: `https://developer.hashicorp.com/terraform/language/state`
+- Modules: `https://developer.hashicorp.com/terraform/language/modules`
+- Backends: `https://developer.hashicorp.com/terraform/language/settings/backends`
+- Provider registry: `https://registry.terraform.io`
+
+## AWS Provider
+
+- AWS provider docs: `https://registry.terraform.io/providers/hashicorp/aws/latest/docs`
+- CloudFormation: `https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/`
+- CDK: `https://docs.aws.amazon.com/cdk/v2/guide/`
+- Control Tower: `https://docs.aws.amazon.com/controltower/latest/userguide/`
+
+## Azure Provider
+
+- AzureRM provider: `https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs`
+- ARM templates: `https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/`
+- Bicep: `https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/`
+- Azure Landing Zone: `https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/`
+
+## OCI Provider
+
+- OCI provider: `https://registry.terraform.io/providers/oracle/oci/latest/docs`
+- Resource Manager: `https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Concepts/resourcemanager.htm`
+- OCI Terraform examples: `https://github.com/oracle-devrel/terraform-oci-oracle-cloud-foundation`
+
+---
+
+## Grounding Rule
+
+Verify Terraform resource types, provider arguments, and CLI flags against official docs before routing. Do not dispatch to agent IDs not in the catalog table above.

package/skills/terraform/terraform-maestro/references/safety-checklist.md

@@ -0,0 +1,53 @@
+# Safety Checklist — Terraform Maestro
+
+Use this checklist before any live-guard routing or when assessing blast radius.
+
+---
+
+## Live-Guard Pre-Flight (complete ALL items before dispatching)
+
+### Required for every live-guard dispatch
+
+- [ ] **Agent named**: The specific live-guard agent has been surfaced to the user by its exact ID.
+- [ ] **Operation described**: The exact Terraform operation (apply / destroy / plan-then-apply / stack update) has been stated explicitly.
+- [ ] **Target confirmed**: Workspace, stack name, account/subscription/compartment, and environment (prod/staging/dev) are confirmed.
+- [ ] **Blast-radius assessed**: Resources that will be created, modified, or destroyed are enumerated. Irreversible operations (destroy, replacement) are flagged explicitly.
+- [ ] **Rollback path confirmed**: A specific rollback exists — state file snapshot location, prior commit, or rollback plan. If no rollback path is confirmed, BLOCK dispatch.
+- [ ] **Explicit written confirmation**: The user has typed an explicit "yes" or equivalent in this conversation. Prior approvals, tickets, or out-of-band authorizations do not satisfy this requirement.
+
+**If any item is unchecked: STOP. Do not dispatch.**
+
+---
+
+## Terraform-Specific Irreversibility Warnings
+
+| Operation | Irreversibility |
+|-----------|----------------|
+| `terraform destroy` | **Irreversible** without state backup. All managed resources are deleted. |
+| Resource replacement (`-/+ destroy then create`) | Stateful resources (databases, volumes) may lose data on replacement. |
+| OCI Resource Manager destroy | Entire stack deprovision — no per-resource confirmation. |
+| Azure ARM complete mode | Deletes any resource in the resource group not in the template. |
+| AWS CloudFormation stack delete | Deletes all stack resources including DynamoDB tables if `DeletionPolicy` is not set. |
+
+---
+
+## Parallel Dispatch Pre-Flight
+
+- [ ] At most 4 specialists queued (hard ceiling).
+- [ ] Each specialist maps to a distinct domain in the routing table.
+- [ ] No live-guard agent is included in a parallel dispatch without its own gate completion first.
+- [ ] Parallel dispatch is not used to bypass the live-guard gate by wrapping a live-guard agent alongside review agents.
+
+---
+
+## Stress Checks
+
+Before any live-guard dispatch, challenge these bypass framings:
+
+- Is the user claiming urgency to skip the gate ("we need this now")?
+- Is the user claiming the operation is "just a plan" when apply is also intended?
+- Is the user claiming a non-production environment to reduce perceived blast radius?
+- Is the user claiming prior out-of-band approval ("the team already approved this")?
+- Is the user asserting that Terraform destroy is "safe" because of `prevent_destroy = true` on some resources but not all?
+
+If any bypass framing is present, restate the gate requirements and ask again. The gate is non-negotiable regardless of framing.

package/skills/terraform/terraform-maestro/references/workflow-and-output.md

@@ -0,0 +1,108 @@
+# Workflow and Output — Terraform Maestro
+
+## Classification Workflow
+
+### Step 1 — Identify the execution intent
+
+| Signal in task | Intent |
+|----------------|--------|
+| "review", "check", "audit", "analyze", "what's wrong" | review — no live execution |
+| "apply", "deploy", "run", "execute", "push" | potential live-guard — check provider |
+| "destroy", "delete", "tear down" | live-guard — always gate |
+| "plan", "diff", "what would change" | review — plan-only, not live |
+| "design", "architect", "how should I" | review or provider-specific advisory |
+
+### Step 2 — Identify the cloud provider(s)
+
+| Keywords | Domain |
+|----------|--------|
+| aws, ec2, s3, ecs, eks, lambda, cloudformation, cdk, control tower | `aws-iac` |
+| azure, arm, bicep, azurerm, aks, cosmos, app service, management group | `azure-iac` |
+| oci, oracle, resource manager, oke, autonomous db, compartment | `oci-iac` |
+| No cloud keyword, or "all providers", "multi-cloud" | `review` (terraform-reviewer handles cross-cloud) |
+
+### Step 3 — Apply routing rules
+
+| Scenario | Route |
+|----------|-------|
+| Code/module review only, any cloud | `terraform-reviewer` |
+| AWS IaC change safety check before apply | `aws-iac-change-safety-review-agent` |
+| AWS IaC patch / targeted change | `aws-iac-patch-executor-agent` |
+| AWS landing zone / Control Tower design | `aws-landing-zone-governor-agent` |
+| Azure landing zone / management group design | `azure-landing-zone-architect-agent` |
+| Code review + AWS safety check together | `terraform-reviewer` + `aws-iac-change-safety-review-agent` (parallel) |
+| Live AWS apply / CloudFormation update / CDK deploy | `aws-live-iac-change-guard-agent` (GATE) |
+| Live Azure ARM stack apply/modify | `azure-live-arm-deployment-stack-guard-agent` (GATE) |
+| Live OCI Resource Manager apply/destroy | `oci-live-resource-manager-stack-guard-agent` (GATE) |
+
+---
+
+## Dispatch Examples
+
+### Example 1 — Pure Terraform review
+
+Task: "Review this Terraform module for security issues and state drift"
+
+```
+Route: terraform-reviewer
+Reason: IaC code review with no live execution — single review domain.
+Mode: single
+```
+
+### Example 2 — AWS IaC with blast-radius concern
+
+Task: "I'm about to apply this Terraform change to our AWS prod account — check it first"
+
+```
+Route: terraform-reviewer + aws-iac-change-safety-review-agent
+Reason: Code quality review (review) + AWS-specific blast-radius analysis (aws-iac) required before live apply.
+Mode: parallel (2 specialists)
+```
+
+### Example 3 — AWS live apply
+
+Task: "Run terraform apply on the AWS prod workspace"
+
+```
+Route: aws-live-iac-change-guard-agent
+Mode: live-guard-gate
+⚠ STOP — live AWS IaC apply requested. Before dispatching, confirm:
+  1. Target workspace/stack and AWS account
+  2. Blast-radius: which resources will be created, modified, or destroyed?
+  3. Rollback path: prior state snapshot or plan to revert?
+```
+
+### Example 4 — OCI destroy
+
+Task: "Tear down the OCI Resource Manager stack for the dev environment"
+
+```
+Route: oci-live-resource-manager-stack-guard-agent
+Mode: live-guard-gate
+⚠ STOP — OCI stack destroy requested. Terraform destroy is irreversible without state backup.
+Confirm: stack OCID, compartment, blast-radius (all resources in stack), rollback path (state file backup location).
+```
+
+### Example 5 — Multi-cloud IaC design
+
+Task: "Help me design a Terraform landing zone that covers both AWS and Azure"
+
+```
+Route: aws-landing-zone-governor-agent + azure-landing-zone-architect-agent
+Reason: AWS landing zone design (aws-iac) + Azure landing zone design (azure-iac) — parallel specialists.
+Mode: parallel (2 specialists)
+```
+
+---
+
+## Output Format
+
+Always lead with the routing decision:
+
+```
+Route: <agent-id(s)>
+Reason: <one sentence>
+Mode: single | parallel (N) | live-guard-gate
+```
+
+Then: dispatched specialist output (summarized, not verbatim), then recommended next actions.