@raishin/vanguard-frontier-agentic 1.1.0 → 1.3.0

package/catalog/install-roles.json

@@ -0,0 +1,455 @@
+{
+  "version": "0.1.0",
+  "description": "Role-based agent and skill selections for vfa-export-agents --role installs. Each role maps to the minimal, high-value agent and skill IDs a practitioner in that function needs across all supported cloud providers. Roles are intentionally overlapping \u2014 a single agent may serve multiple roles.",
+  "roles": {
+    "cloud-security-engineer": {
+      "label": "Cloud Security Engineer",
+      "description": "IAM/RBAC review, secrets lifecycle, security posture hardening, identity governance, live guards for access and key mutations across AWS, Azure, OCI, and Kubernetes.",
+      "agents": [
+        "aws-bedrock-agent-security-governor-agent",
+        "aws-compliance-evidence-mapper-agent",
+        "aws-iam-least-privilege-review-agent",
+        "aws-kms-secrets-lifecycle-steward-agent",
+        "aws-s3-data-perimeter-governor-agent",
+        "aws-security-posture-hardening-agent",
+        "azure-entra-id-specialist-agent",
+        "azure-governance-policy-guardrails-agent",
+        "azure-identity-governance-review-agent",
+        "azure-key-vault-secret-lifecycle-auditor-agent",
+        "azure-live-entra-role-assignment-guard-agent",
+        "azure-live-keyvault-rotation-purge-guard-agent",
+        "azure-live-pim-jit-activation-guard-agent",
+        "azure-rbac-review-agent",
+        "azure-role-selector-agent",
+        "azure-security-posture-hardening-agent",
+        "kubernetes-live-rbac-mutation-guard-agent",
+        "kubernetes-psa-review-agent",
+        "kubernetes-rbac-review-agent",
+        "kubernetes-workload-identity-review-agent",
+        "kyverno-policy-review-agent",
+        "oci-cloud-guard-responder-agent",
+        "oci-identity-access-governor-agent",
+        "oci-live-iam-policy-compartment-guard-agent",
+        "oci-live-vault-key-destruction-guard-agent",
+        "oci-security-compliance-reviewer-agent"
+      ],
+      "skills": [
+        "aws-bedrock-agent-security-governor",
+        "aws-compliance-evidence-mapper",
+        "aws-iam-least-privilege-review",
+        "aws-kms-secrets-lifecycle-steward",
+        "aws-s3-data-perimeter-governor",
+        "aws-security-posture-hardening",
+        "azure-entra-id-specialist",
+        "azure-governance-policy-guardrails",
+        "azure-identity-governance-review",
+        "azure-key-vault-secret-lifecycle-auditor",
+        "azure-live-entra-role-assignment-guard",
+        "azure-live-keyvault-rotation-purge-guard",
+        "azure-live-pim-jit-activation-guard",
+        "azure-rbac-review",
+        "azure-role-selector",
+        "azure-security-posture-hardening",
+        "kubernetes-live-rbac-mutation-guard",
+        "kubernetes-pod-security-admission-review",
+        "kubernetes-rbac-review",
+        "kubernetes-workload-identity-review",
+        "kyverno-policy-review",
+        "oci-cloud-guard-responder",
+        "oci-identity-access-governor",
+        "oci-live-iam-policy-compartment-guard",
+        "oci-live-vault-key-destruction-guard",
+        "oci-security-compliance-reviewer"
+      ]
+    },
+    "cloud-platform-engineer": {
+      "label": "Cloud Platform Engineer",
+      "description": "Infrastructure operators, IaC safety review, landing zones, networking, container platform operations, live deployment guards across AWS, Azure, OCI, and Terraform.",
+      "agents": [
+        "aws-ec2-compute-operations-steward-agent",
+        "aws-ecs-fargate-platform-operator-agent",
+        "aws-eks-platform-operator-agent",
+        "aws-iac-change-safety-review-agent",
+        "aws-iac-patch-executor-agent",
+        "aws-landing-zone-governor-agent",
+        "aws-live-iac-change-guard-agent",
+        "aws-network-architect-agent",
+        "azure-aks-platform-operator-agent",
+        "azure-landing-zone-architect-agent",
+        "azure-live-aks-rollout-guard-agent",
+        "azure-live-arm-deployment-stack-guard-agent",
+        "azure-network-topology-review-agent",
+        "azure-private-endpoint-adoption-planner-agent",
+        "azure-subscription-resource-organization-agent",
+        "oci-compute-instance-agent-operator-agent",
+        "oci-compute-platform-operator-agent",
+        "oci-devops-container-platform-engineer-agent",
+        "oci-live-network-security-rule-guard-agent",
+        "oci-live-oke-rollout-guard-agent",
+        "oci-live-resource-manager-stack-guard-agent",
+        "oci-load-balancer-traffic-engineer-agent",
+        "oci-network-architect-agent",
+        "terraform-maestro-agent",
+        "terraform-reviewer"
+      ],
+      "skills": [
+        "argocd-gitops-review",
+        "aws-ec2-compute-operations-steward",
+        "aws-ecs-fargate-platform-operator",
+        "aws-eks-platform-operator",
+        "aws-iac-change-safety-review",
+        "aws-iac-patch-executor",
+        "aws-landing-zone-governor",
+        "aws-live-iac-change-guard",
+        "aws-network-architect",
+        "azure-aks-platform-operator",
+        "azure-landing-zone-architect",
+        "azure-live-aks-rollout-guard",
+        "azure-live-arm-deployment-stack-guard",
+        "azure-network-topology-review",
+        "azure-private-endpoint-adoption-planner",
+        "azure-subscription-resource-organization",
+        "cilium-network-policy-review",
+        "istio-ambient-mesh-review",
+        "kubernetes-pod-security-admission-review",
+        "kubernetes-workload-identity-review",
+        "oci-compute-instance-agent-operator",
+        "oci-compute-platform-operator",
+        "oci-devops-container-platform-engineer",
+        "oci-live-network-security-rule-guard",
+        "oci-live-oke-rollout-guard",
+        "oci-live-resource-manager-stack-guard",
+        "oci-load-balancer-traffic-engineer",
+        "oci-network-architect",
+        "opentelemetry-collector-config-review",
+        "terraform-maestro"
+      ]
+    },
+    "cloud-dba": {
+      "label": "Cloud Database Administrator",
+      "description": "Database architects, performance investigators, DBA operators, replication, and live database lifecycle guards across AWS RDS/DynamoDB, Azure CosmosDB, and OCI Autonomous/Exadata/MySQL.",
+      "agents": [
+        "aws-dynamodb-data-modeling-performance-review-agent",
+        "aws-rds-aurora-performance-investigator-agent",
+        "azure-cosmosdb-application-developer-agent",
+        "azure-cosmosdb-performance-investigator-agent",
+        "azure-cosmosdb-platform-operator-agent",
+        "oci-autonomous-database-architect-agent",
+        "oci-database-platform-dba-agent",
+        "oci-dbtools-sql-analyst-agent",
+        "oci-exadata-platform-architect-agent",
+        "oci-goldengate-replication-operator-agent",
+        "oci-live-autonomous-db-lifecycle-guard-agent",
+        "oci-mysql-heatwave-ai-specialist-agent",
+        "oci-recovery-service-operator-agent"
+      ],
+      "skills": [
+        "aws-dynamodb-data-modeling-performance-review",
+        "aws-rds-aurora-performance-investigator",
+        "azure-cosmosdb-application-developer",
+        "azure-cosmosdb-performance-investigator",
+        "azure-cosmosdb-platform-operator",
+        "oci-autonomous-database-architect",
+        "oci-database-platform-dba",
+        "oci-dbtools-sql-analyst",
+        "oci-exadata-database-architect",
+        "oci-exadata-platform-architect",
+        "oci-goldengate-replication-operator",
+        "oci-live-autonomous-db-lifecycle-guard",
+        "oci-mysql-heatwave-ai-specialist",
+        "oci-recovery-service-operator"
+      ]
+    },
+    "cloud-finops-analyst": {
+      "label": "Cloud FinOps Analyst",
+      "description": "Cost optimization governors, anomaly watchers, budget runaway guards, capacity planning, and cross-provider cost estimation across AWS, Azure, OCI, and FinOps-neutral tools.",
+      "agents": [
+        "aws-cost-anomaly-watch-coordinator-agent",
+        "aws-cost-optimization-governor-agent",
+        "azure-cost-estimation-review-agent",
+        "azure-cost-optimization-governor-agent",
+        "azure-live-cost-budget-action-guard-agent",
+        "finops-cloud-price-advisor-agent",
+        "oci-cost-finops-analyst-agent",
+        "oci-limits-capacity-planner-agent",
+        "oci-live-cost-budget-runaway-guard-agent"
+      ],
+      "skills": [
+        "aws-cost-anomaly-watch-coordinator",
+        "aws-cost-optimization-governor",
+        "azure-cost-estimation-review",
+        "azure-cost-optimization-governor",
+        "azure-live-cost-budget-action-guard",
+        "oci-cost-finops-analyst",
+        "oci-limits-capacity-planner",
+        "oci-live-cost-budget-runaway-guard"
+      ]
+    },
+    "cloud-solutions-architect": {
+      "label": "Cloud Solutions Architect",
+      "description": "Solution architects, migration cutover planners, resilience and BCDR reviewers, event-driven architects, AI/generative developers, and multi-cloud designers across AWS, Azure, and OCI.",
+      "agents": [
+        "aws-agentcore-agent",
+        "aws-api-edge-delivery-review-agent",
+        "aws-change-impact-advisor-agent",
+        "aws-event-driven-architecture-review-agent",
+        "aws-generative-ai-developer-agent",
+        "aws-maestro-agent",
+        "aws-migration-cutover-architect-agent",
+        "aws-resilience-bcdr-review-agent",
+        "aws-solution-architect-agent",
+        "azure-ai-foundry-ops-governor-agent",
+        "azure-landing-zone-architect-agent",
+        "azure-maestro-agent",
+        "azure-migrate-landing-zone-cutover-agent",
+        "azure-network-topology-review-agent",
+        "azure-resilience-bcdr-review-agent",
+        "oci-maestro-agent",
+        "oci-migration-cutover-architect-agent",
+        "oci-multi-cloud-architect-agent",
+        "oci-network-architect-agent",
+        "oci-solution-architect-agent"
+      ],
+      "skills": [
+        "aws-agentcore",
+        "aws-api-edge-delivery-review",
+        "aws-change-impact-advisor",
+        "aws-event-driven-architecture-review",
+        "aws-generative-ai-developer",
+        "aws-maestro",
+        "aws-migration-cutover-architect",
+        "aws-resilience-bcdr-review",
+        "aws-solution-architect",
+        "azure-ai-foundry-ops-governor",
+        "azure-landing-zone-architect",
+        "azure-maestro",
+        "azure-migrate-landing-zone-cutover",
+        "azure-network-topology-review",
+        "azure-resilience-bcdr-review",
+        "oci-maestro",
+        "oci-migration-cutover-architect",
+        "oci-multi-cloud-architect",
+        "oci-network-architect",
+        "oci-solution-architect"
+      ]
+    },
+    "cloud-devops-engineer": {
+      "label": "Cloud DevOps Engineer",
+      "description": "CI/CD release engineers, deployment and rollout operators, live pipeline approval guards, serverless production readiness, observability responders, and artifact governance across AWS, Azure, and OCI.",
+      "agents": [
+        "aws-ci-cd-release-engineer-agent",
+        "aws-daily-operations-briefing-coordinator-agent",
+        "aws-deployment-hotfix-operator-agent",
+        "aws-devops-agent-skill-designer-agent",
+        "aws-ecs-service-remediation-operator-agent",
+        "aws-live-deployment-guarded-operator-agent",
+        "aws-live-ecs-rollout-guard-agent",
+        "aws-live-pipeline-approval-operator-agent",
+        "aws-live-serverless-release-guard-agent",
+        "aws-non-destructive-task-automation-advisor-agent",
+        "aws-observability-incident-responder-agent",
+        "aws-pipeline-fix-operator-agent",
+        "aws-serverless-production-readiness-agent",
+        "aws-serverless-rollout-corrector-agent",
+        "aws-ticket-triage-escalation-coordinator-agent",
+        "azure-app-service-production-readiness-agent",
+        "azure-live-app-service-slot-swap-guard-agent",
+        "azure-observability-investigator-agent",
+        "azure-platform-automation-devops-agent",
+        "azure-resource-health-incident-triage-agent",
+        "oci-devops-container-platform-engineer-agent",
+        "oci-live-oke-rollout-guard-agent",
+        "oci-observability-incident-responder-agent",
+        "oci-registry-artifact-governor-agent",
+        "oci-support-incident-coordinator-agent"
+      ],
+      "skills": [
+        "argocd-gitops-review",
+        "aws-ci-cd-release-engineer",
+        "aws-daily-operations-briefing-coordinator",
+        "aws-deployment-hotfix-operator",
+        "aws-devops-agent-skill-designer",
+        "aws-ecs-service-remediation-operator",
+        "aws-live-deployment-guarded-operator",
+        "aws-live-ecs-rollout-guard",
+        "aws-live-pipeline-approval-operator",
+        "aws-live-serverless-release-guard",
+        "aws-non-destructive-task-automation-advisor",
+        "aws-observability-incident-responder",
+        "aws-pipeline-fix-operator",
+        "aws-serverless-production-readiness",
+        "aws-serverless-rollout-corrector",
+        "aws-ticket-triage-escalation-coordinator",
+        "azure-app-service-production-readiness",
+        "azure-live-app-service-slot-swap-guard",
+        "azure-observability-investigator",
+        "azure-platform-automation-devops",
+        "azure-resource-health-incident-triage",
+        "oci-devops-container-platform-engineer",
+        "oci-live-oke-rollout-guard",
+        "oci-observability-incident-responder",
+        "oci-registry-artifact-governor",
+        "oci-support-incident-coordinator",
+        "opentelemetry-collector-config-review"
+      ]
+    },
+    "kubernetes-admission-security-engineer": {
+      "label": "Kubernetes Admission Security Engineer",
+      "description": "API and image admission control: Kyverno, native ValidatingAdmissionPolicy (CEL), Pod Security Admission, image signature verification, RBAC privilege-escalation review, and live admission policy mutation guards. Anchors the cluster's deny-by-default story.",
+      "agents": [
+        "kubernetes-live-admission-policy-guard-agent",
+        "kubernetes-live-rbac-mutation-guard-agent",
+        "kubernetes-maestro-agent",
+        "kubernetes-psa-review-agent",
+        "kubernetes-rbac-review-agent",
+        "kyverno-policy-review-agent"
+      ],
+      "skills": [
+        "kubernetes-live-rbac-mutation-guard",
+        "kubernetes-maestro",
+        "kubernetes-pod-security-admission-review",
+        "kubernetes-rbac-review",
+        "kyverno-policy-review"
+      ]
+    },
+    "kubernetes-network-engineer": {
+      "label": "Kubernetes Network Engineer",
+      "description": "CNI, service mesh, ingress, egress: Cilium NetworkPolicy and CiliumClusterwideNetworkPolicy, Cilium ClusterMesh, CiliumEgressGatewayPolicy, Hubble flow observability, and Istio mesh in both sidecar and ambient modes including the L7-AuthorizationPolicy-without-waypoint trap.",
+      "agents": [
+        "cilium-network-policy-review-agent",
+        "istio-ambient-mesh-review-agent",
+        "kubernetes-live-mesh-policy-guard-agent",
+        "kubernetes-live-network-policy-guard-agent",
+        "kubernetes-maestro-agent"
+      ],
+      "skills": [
+        "cilium-network-policy-review",
+        "istio-ambient-mesh-review",
+        "kubernetes-maestro"
+      ]
+    },
+    "kubernetes-application-platform-engineer": {
+      "label": "Kubernetes Application Platform Engineer",
+      "description": "Golden paths and GitOps delivery: Argo CD Application/AppProject/ApplicationSet review, sync impersonation, RBAC, sync windows, and Argo CD Agent multi-cluster topologies. Owns the path from Git to running workload with bounded blast radius.",
+      "agents": [
+        "argocd-gitops-review-agent",
+        "kubernetes-live-argocd-sync-guard-agent",
+        "kubernetes-maestro-agent"
+      ],
+      "skills": [
+        "argocd-gitops-review",
+        "kubernetes-maestro",
+        "kubernetes-pod-security-admission-review"
+      ]
+    },
+    "kubernetes-runtime-security-engineer": {
+      "label": "Kubernetes Runtime Security Engineer",
+      "description": "Runtime defense and workload identity: RBAC privilege-escalation verbs, ServiceAccount token projection, AWS IRSA, Azure Workload Identity, GCP Workload Identity Federation, and the OIDC trust-policy review that ties pods to cloud IAM without long-lived static credentials.",
+      "agents": [
+        "falco-runtime-threat-rules-review-agent",
+        "kubernetes-live-rbac-mutation-guard-agent",
+        "kubernetes-maestro-agent",
+        "kubernetes-rbac-review-agent",
+        "kubernetes-workload-identity-review-agent",
+        "sigstore-cosign-supply-chain-review-agent"
+      ],
+      "skills": [
+        "falco-runtime-threat-rules-review",
+        "kubernetes-live-rbac-mutation-guard",
+        "kubernetes-maestro",
+        "kubernetes-pod-security-admission-review",
+        "kubernetes-rbac-review",
+        "kubernetes-workload-identity-review",
+        "sigstore-cosign-supply-chain-review"
+      ]
+    },
+    "kubernetes-pki-engineer": {
+      "label": "Kubernetes PKI Engineer",
+      "description": "Certificate lifecycle, CA trust hierarchy, and secrets management: cert-manager Issuer/ClusterIssuer scope, CertificateRequestPolicy auto-approval gap, trust-manager bundle blast radius, External Secrets Operator scope and auth, and cloud-backed CA integration via AWS Private CA, Azure Key Vault, and OCI Certificates.",
+      "agents": [
+        "aws-private-ca-issuer-review-agent",
+        "azure-keyvault-certificate-issuer-review-agent",
+        "cert-manager-issuer-trust-review-agent",
+        "external-secrets-operator-review-agent",
+        "kubernetes-maestro-agent",
+        "oci-certificates-issuer-review-agent"
+      ],
+      "skills": [
+        "aws-private-ca-issuer-review",
+        "azure-keyvault-certificate-issuer-review",
+        "cert-manager-issuer-trust-review",
+        "external-secrets-operator-review",
+        "kubernetes-maestro",
+        "oci-certificates-issuer-review"
+      ]
+    },
+    "kubernetes-observability-engineer": {
+      "label": "Kubernetes Observability Engineer",
+      "description": "Metrics, alerting, cardinality, cost attribution, and telemetry pipeline: Prometheus alerting and recording rules, label cardinality, Alertmanager routing, OpenTelemetry Collector pipeline safety, and Kubecost chargeback and allocation model review.",
+      "agents": [
+        "kubecost-chargeback-allocation-review-agent",
+        "kubernetes-maestro-agent",
+        "opentelemetry-collector-config-review-agent",
+        "prometheus-alerting-cardinality-review-agent"
+      ],
+      "skills": [
+        "kubecost-chargeback-allocation-review",
+        "kubernetes-maestro",
+        "opentelemetry-collector-config-review",
+        "prometheus-alerting-cardinality-review"
+      ]
+    },
+    "kubernetes-supply-chain-security-engineer": {
+      "label": "Kubernetes Supply Chain Security Engineer",
+      "description": "Software supply chain integrity: Sigstore/Cosign image signing and SBOM attestation, Falco runtime threat rules, Kyverno admission policy for enforcement, Pod Security Admission hardening, and workload pod-spec review for privilege and capabilities.",
+      "agents": [
+        "falco-runtime-threat-rules-review-agent",
+        "kubernetes-live-admission-policy-guard-agent",
+        "kubernetes-maestro-agent",
+        "kubernetes-pod-spec-review-agent",
+        "kubernetes-psa-review-agent",
+        "kyverno-policy-review-agent",
+        "sigstore-cosign-supply-chain-review-agent"
+      ],
+      "skills": [
+        "falco-runtime-threat-rules-review",
+        "kubernetes-maestro",
+        "kubernetes-pod-security-admission-review",
+        "kubernetes-pod-spec-review",
+        "kyverno-policy-review",
+        "sigstore-cosign-supply-chain-review"
+      ]
+    },
+    "kubernetes-developer-platform-engineer": {
+      "label": "Kubernetes Developer Platform Engineer",
+      "description": "Internal developer platform and GitOps delivery: Backstage Scaffolder template security review, Argo CD and Argo Rollouts progressive delivery, FluxCD Kustomization and HelmRelease GitOps review, and the kubernetes-maestro router for cross-domain dispatch.",
+      "agents": [
+        "argocd-gitops-review-agent",
+        "argo-rollouts-progressive-delivery-review-agent",
+        "backstage-scaffolder-template-review-agent",
+        "fluxcd-kustomization-helmrelease-review-agent",
+        "kubernetes-live-argocd-sync-guard-agent",
+        "kubernetes-maestro-agent"
+      ],
+      "skills": [
+        "argocd-gitops-review",
+        "argo-rollouts-progressive-delivery-review",
+        "backstage-scaffolder-template-review",
+        "fluxcd-kustomization-helmrelease-review",
+        "kubernetes-maestro"
+      ]
+    },
+    "kubernetes-disaster-recovery-engineer": {
+      "label": "Kubernetes Disaster Recovery Engineer",
+      "description": "Backup, restore, and business continuity: Velero backup schedule review, live-guarded restore operations with pre-restore safety checklist, PV restore posture, existingResourcePolicy risk, and cross-cluster restore scope governance.",
+      "agents": [
+        "kubernetes-live-velero-restore-guard-agent",
+        "kubernetes-maestro-agent"
+      ],
+      "skills": [
+        "kubernetes-maestro",
+        "velero-backup-restore-guard"
+      ]
+    }
+  }
+}