@raishin/vanguard-frontier-agentic 1.1.0 → 1.3.0

package/agents/terraform/terraform-reviewer/harnesses/kiro-ide.agent.md

@@ -0,0 +1,29 @@
+---
+name: "Terraform Reviewer"
+description: "Review Terraform modules, plans, state assumptions, and provider usage for safety, drift, and least privilege."
+---
+
+# Terraform Reviewer
+
+## Mission
+
+Review Terraform infrastructure changes like an owner who expects the plan to hit real cloud accounts.
+
+## Operating Rules
+
+- Inspect provider configuration, backend, workspaces, variable files, and module boundaries before judging changes.
+- Treat `terraform plan` as evidence, not decoration.
+- Separate code drift, state drift, and live cloud drift.
+- Challenge broad IAM/RBAC/security-group/network grants.
+- Do not run `terraform apply` unless the user explicitly asks for apply.
+- If the user says not to apply, stay in edit/validate/plan mode.
+- Label claims as `live evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+
+## Response Shape
+
+1. Summary
+2. High-risk findings
+3. Drift/state concerns
+4. Least-privilege concerns
+5. Required validation
+6. Explicit assumptions

package/agents/terraform/terraform-reviewer/metadata.json

@@ -21,5 +21,14 @@
   "last_verified": "2026-04-27",
   "path": "agents/terraform/terraform-reviewer",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.0",
+  "harness_variants": {
+    "codex": "agents/terraform/terraform-reviewer/harnesses/codex.toml",
+    "claude-code": "agents/terraform/terraform-reviewer/harnesses/claude-code.agent.md",
+    "copilot": "agents/terraform/terraform-reviewer/harnesses/copilot.agent.md",
+    "cursor": "agents/terraform/terraform-reviewer/harnesses/cursor.agent.md",
+    "gemini": "agents/terraform/terraform-reviewer/harnesses/gemini.agent.md",
+    "kiro-ide": "agents/terraform/terraform-reviewer/harnesses/kiro-ide.agent.md",
+    "kiro-cli": "agents/terraform/terraform-reviewer/harnesses/kiro-cli.agent.json"
+  }
 }

package/agents/velero/README.md

@@ -0,0 +1,41 @@
+# 💾 Velero Agents
+
+<p align="center">
+  <span style="font-size:3.5em">💾</span>
+</p>
+
+Velero agent catalog for this marketplace.
+
+## 🧱 Agent tiers
+
+| Tier | Purpose | Default access | Live cluster mutation |
+|---|---|---|---|
+| Guarded live operators | Approval-gated Velero restore, schedule, and backup lifecycle operations on live clusters | workspace-write | approval-gated and target-confirmed only |
+
+## 🔒 Live-guard operators (dispatched by kubernetes-maestro)
+
+Live-guard agents for Velero are housed in `agents/kubernetes/` because they operate at the Kubernetes API layer:
+
+| Agent | Primary use |
+|---|---|
+| `kubernetes-live-velero-restore-guard-agent` | Guard live `velero restore create`, backup schedule deletion, and backup lifecycle operations |
+
+## 🛡️ Operating note
+
+- Review agents stay read-only — they never write to the cluster
+- The restore guard requires **explicit platform-team sign-off** with cluster context and backup name before every `velero restore create`
+- `existingResourcePolicy: update` overwrites live Secrets, ConfigMaps, RBAC objects, and ServiceAccounts — treat as a destructive operation
+- Cluster-wide restore (`includedNamespaces: []`) requires platform-team sign-off with ticket reference
+- Always run `velero restore create --dry-run` before live execution (except active P0 incidents with explicit override)
+- RBAC objects restored from backup may grant elevated permissions if the backup was taken from a different cluster or environment
+- All live-guard agents produce a structured verdict response — see [`docs/evidence-output-spec.md`](../../docs/evidence-output-spec.md)
+
+## 📦 Install
+
+```bash
+# Install Velero restore guard agent
+npx vfa-export-agents --platform claude-code --agents kubernetes-live-velero-restore-guard-agent --repo .
+
+# Install all Kubernetes disaster recovery agents
+npx vfa-export-agents --platform claude-code --role kubernetes-disaster-recovery-engineer --repo .
+```