@raishin/vanguard-frontier-agentic 1.1.0 → 1.3.0

package/skills/oci/oci-live-network-security-rule-guard/references/official-sources.md

@@ -0,0 +1,21 @@
+# Official Sources
+
+Load these only when needed:
+
+- [Security Lists](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm) — use for Security List model, ingress/egress rule structure, stateful vs stateless semantics, and maximum rule limits.
+- [Network Security Groups](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/networksecuritygroups.htm) — use for NSG model, VNIC-level vs subnet-level application, and NSG vs Security List trade-offs.
+- [Managing NSG Security Rules](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/manage-nsg-security-rules.htm) — use for `oci network nsg rules add`, `update`, `remove`, and `list` CLI syntax.
+- [Updating a Security List](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/update-securitylist.htm) — use for `oci network security-list update` full-replace semantics and required parameters.
+- [Network Path Analyzer](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/path_analyzer.htm) — use for simulating end-to-end network paths through Security Lists, NSGs, route tables, and gateways before approving a rule change.
+- [VCN Flow Logs](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/vcn-flow-logs.htm) — use when enabling forensic coverage for a subnet before or after a security rule change.
+- [OCI IAM Policy Reference — Network](https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/networkpolicyreference.htm) — use for least-privilege IAM policy statements covering `security-lists`, `network-security-groups`, and `virtual-network-family`.
+
+## Grounded insights worth carrying into the skill
+
+- `oci network security-list update` performs a **full replace** of the entire ingress or egress rule set — partial updates are not possible. Always pass the complete desired rule list including rules you want to keep.
+- OCI Security Lists are **stateful by default** (`stateless: false`). Return traffic is automatically allowed. Stateless rules require explicit return rules and are a common source of asymmetric traffic failures.
+- NSG rule IDs are required for deletion (`oci network nsg rules remove`). Capture rule IDs from `oci network nsg rules list` before any mutation.
+- A Security List is attached to a subnet, not a VNIC. One change affects every instance in that subnet simultaneously — blast radius scales with subnet size.
+- NSGs are attached to individual VNICs, giving finer-grained control but requiring per-VNIC management. Prefer NSGs for production database servers over Security Lists for reduced blast radius.
+- VCN Flow Logs must be explicitly enabled per subnet — they are not on by default. Without them, there is no record of traffic through an accidentally opened rule.
+- The `0.0.0.0/0` ingress source in OCI context still includes traffic from peered VCNs, DRG-attached networks, and FastConnect circuits if routing allows — it is never safe to assume it means "internet only."

package/skills/oci/oci-live-network-security-rule-guard/references/permission-model.md

@@ -0,0 +1,65 @@
+# Permission Model: OCI Live Network Security Rule Guard
+
+## Least-privilege IAM policy for network rule read (preflight only)
+
+```
+Allow group NetworkAuditors to read virtual-network-family in compartment <compartment>
+Allow group NetworkAuditors to read vcns in compartment <compartment>
+Allow group NetworkAuditors to read security-lists in compartment <compartment>
+Allow group NetworkAuditors to read network-security-groups in compartment <compartment>
+Allow group NetworkAuditors to read subnets in compartment <compartment>
+Allow group NetworkAuditors to read db-systems in compartment <compartment>
+Allow group NetworkAuditors to read autonomous-databases in compartment <compartment>
+```
+
+Read-only audit: use `inspect` or `read` verbs only. Never `manage` for auditors.
+
+## Least-privilege IAM policy for network rule mutation (guarded operator only)
+
+```
+Allow group NetworkOperators to manage security-lists in compartment <compartment>
+Allow group NetworkOperators to manage network-security-groups in compartment <compartment>
+Allow group NetworkOperators to read vcns in compartment <compartment>
+Allow group NetworkOperators to read subnets in compartment <compartment>
+```
+
+Do **not** grant `manage virtual-network-family` — that is broader than needed and includes VCN, route tables, internet gateways, and peering.
+
+## Risk classification by rule type
+
+| Rule | Risk | Reason |
+|---|---|---|
+| Ingress `0.0.0.0/0` any protocol | Critical | Open internet access to entire subnet |
+| Ingress `0.0.0.0/0` port 22 | Critical | SSH from internet — never acceptable in production |
+| Ingress `0.0.0.0/0` port 3389 | Critical | RDP from internet — never acceptable in production |
+| Ingress `0.0.0.0/0` port 1521/1522 | Critical | Oracle DB from internet — data exfiltration path |
+| Ingress `0.0.0.0/0` port 3306/5432 | Critical | MySQL/PostgreSQL from internet |
+| Ingress from VCN CIDR, specific port | Low | Internal only — verify VCN CIDR is not transit-routed |
+| Egress `0.0.0.0/0` all | Medium | Standard but verify no data-loss risk for DB subnets |
+| Stateless rule on DB subnet | High | No connection tracking — asymmetric TCP risk |
+
+## Stateful vs stateless
+
+- **Stateful** (default, `stateless: false`): OCI tracks connection state and automatically allows return traffic. Use for all production workloads.
+- **Stateless** (`stateless: true`): Higher performance, but return traffic requires an explicit rule in the opposite direction. A missing return rule silently drops responses. Only use when performance benchmarked at scale.
+
+## Subnet criticality classification
+
+| Subnet pattern | Classification |
+|---|---|
+| Hosts Autonomous DB, DB System, Exadata | Database — highest protection |
+| Hosts compute instances with public IP | Public compute — ingress rules must be minimal |
+| Private subnet (`prohibit-public-ip: true`) | Internal — `0.0.0.0/0` still covers all VCN-routed traffic |
+| Bastion subnet | Bastion — SSH/RDP ingress from known CIDRs only |
+
+## OCI Network Path Analyzer — preferred verification tool
+
+Before approving a connectivity change, use Path Analyzer to simulate the traffic path:
+```bash
+oci network path-analyzer-test create \
+  --compartment-id <COMPARTMENT_OCID> \
+  --protocol-parameters '{"type":"TCP","destinationPort":<PORT>}' \
+  --source-endpoint '{"type":"COMPUTE_INSTANCE","instanceId":"<INSTANCE_OCID>"}' \
+  --destination-endpoint '{"type":"IP_ADDRESS","address":"<DEST_IP>"}'
+```
+Path Analyzer respects Security Lists, NSGs, route tables, and service gateways — use it as the final approval gate for any rule change.

package/skills/oci/oci-live-network-security-rule-guard/references/preflight-commands.md

@@ -0,0 +1,69 @@
+# Preflight Commands: OCI Live Network Security Rule Guard
+
+Run all of these before adding, modifying, or removing any Security List or NSG rule.
+
+## 1. Confirm active OCI profile and tenancy
+
+```bash
+oci iam region list --output table   # confirms CLI auth works
+oci iam tenancy get --tenancy-id $(oci iam user get --user-id $(oci iam user list --query 'data[0].id' --raw-output) --query 'data."compartment-id"' --raw-output) 2>/dev/null || echo "Use: oci iam user list --all"
+```
+
+Simpler identity check:
+```bash
+oci iam user list --all --query 'data[0].{name:name, description:description}' --output table
+```
+
+## 2. Capture current Security List rules (CRITICAL — save as rollback baseline)
+
+```bash
+# Get current ingress and egress rules — save this output BEFORE any mutation
+oci network security-list get \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --query 'data.{"display-name":"display-name", "ingress-security-rules":"ingress-security-rules", "egress-security-rules":"egress-security-rules"}'
+```
+
+## 3. Capture current NSG rules (CRITICAL — save as rollback baseline)
+
+```bash
+oci network nsg rules list \
+  --nsg-id <NSG_OCID> \
+  --all \
+  --query 'data[].{id:id, direction:direction, protocol:protocol, source:source, destination:destination, "source-type":"source-type", "tcp-options":"tcp-options", "udp-options":"udp-options", stateless:stateless}'
+```
+
+## 4. List Security Lists in a VCN to identify the target
+
+```bash
+oci network security-list list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --vcn-id <VCN_OCID> \
+  --query 'data[].{"display-name":"display-name", id:id, "lifecycle-state":"lifecycle-state"}'
+```
+
+## 5. Identify subnets attached to the Security List (blast radius)
+
+```bash
+oci network subnet list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --vcn-id <VCN_OCID> \
+  --query 'data[].{"display-name":"display-name", "cidr-block":"cidr-block", "security-list-ids":"security-list-ids", "prohibit-public-ip-on-vnic":"prohibit-public-ip-on-vnic"}'
+```
+
+`prohibit-public-ip-on-vnic: true` = private subnet. Ingress from 0.0.0.0/0 on a private subnet still allows internal CIDR access — confirm VCN CIDR scope.
+
+## 6. Check if DB System or Autonomous DB is in the affected subnet
+
+```bash
+# List DB systems in compartment
+oci db system list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --query 'data[].{"display-name":"display-name", "subnet-id":"subnet-id", "lifecycle-state":"lifecycle-state"}'
+
+# List Autonomous DBs
+oci db autonomous-database list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --query 'data[].{"db-name":"db-name", "subnet-id":"subnet-id", "lifecycle-state":"lifecycle-state"}'
+```
+
+If the affected subnet hosts a DB workload, classify the change as **critical** and require explicit DBA approval.

package/skills/oci/oci-live-network-security-rule-guard/references/rollback-playbook.md

@@ -0,0 +1,79 @@
+# Rollback Playbook: OCI Live Network Security Rule Guard
+
+OCI Security List and NSG rule changes take effect immediately with no native undo operation. The only rollback path is restoring the previous rule set from a captured baseline. **Capture current rules before every mutation — no exceptions.**
+
+## Pre-mutation capture (mandatory)
+
+```bash
+# Security List — save to file before any change
+oci network security-list get \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --query 'data.{"ingress-security-rules":"ingress-security-rules","egress-security-rules":"egress-security-rules"}' \
+  > securitylist-backup-$(date +%Y%m%d-%H%M%S).json
+
+# NSG — save to file before any change
+oci network nsg rules list \
+  --nsg-id <NSG_OCID> --all \
+  > nsg-backup-$(date +%Y%m%d-%H%M%S).json
+```
+
+## Restore Security List rules from backup
+
+Security List update is a **full replace** — the update command overwrites the entire rule set. Pass the exact previous rules from the backup file.
+
+```bash
+# Restore ingress rules
+INGRESS=$(cat securitylist-backup-<TIMESTAMP>.json | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps(d['ingress-security-rules']))")
+oci network security-list update \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --ingress-security-rules "$INGRESS" \
+  --force
+
+# Restore egress rules (same file, egress key)
+EGRESS=$(cat securitylist-backup-<TIMESTAMP>.json | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps(d['egress-security-rules']))")
+oci network security-list update \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --egress-security-rules "$EGRESS" \
+  --force
+```
+
+## Restore NSG rules from backup
+
+NSG rule updates require rule IDs. To restore, remove new rules and re-add the old ones.
+
+```bash
+# List current rule IDs to identify added rules
+oci network nsg rules list --nsg-id <NSG_OCID> --all --query 'data[].id'
+
+# Remove a specific rule that was incorrectly added
+oci network nsg rules remove \
+  --nsg-id <NSG_OCID> \
+  --security-rule-ids '["<RULE_ID_TO_REMOVE>"]'
+```
+
+## Verify restoration
+
+```bash
+# Confirm rules match the backup
+oci network security-list get \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --query 'data.{"ingress-security-rules":"ingress-security-rules","egress-security-rules":"egress-security-rules"}'
+```
+
+## Connectivity verification after rollback
+
+```bash
+# Check if affected instance can still reach expected endpoints
+# (Run from inside the VCN or use OCI Network Path Analyzer)
+oci network path-analyzer-test create \
+  --compartment-id <COMPARTMENT_OCID> \
+  --protocol-parameters '{"type":"TCP","destinationPort":<PORT>}' \
+  --source-endpoint '{"type":"COMPUTE_INSTANCE","instanceId":"<INSTANCE_OCID>"}' \
+  --destination-endpoint '{"type":"IP_ADDRESS","address":"<DEST_IP>"}'
+```
+
+## What cannot be rolled back
+
+- Traffic that flowed through an incorrectly open rule during the window cannot be recalled.
+- Data exfiltrated or connections established during the exposure window must be investigated separately via VCN Flow Logs.
+- Enable Flow Logs on affected subnets before and after any security rule change for forensic coverage.

package/skills/oci/oci-live-oke-rollout-guard/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: oci-live-oke-rollout-guard
+description: Guard OKE deployment rollouts via DevOps Service approval stages with canary and blue-green evidence, rollout health verification, and kubectl rollout undo gates.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# OCI Live OKE Rollout Guard
+
+## Purpose
+
+Act as the guarded live OCI operator for oci-live-oke-rollout-guard work. Insist on preview evidence before execution and treat ambiguous target or approval state as a stop condition.
+
+## When to use
+
+Use this skill when:
+
+- an OKE deployment rollout must advance through a DevOps Service pipeline approval stage
+- a blue-green or canary OKE deployment is in flight and the operator must decide to promote or rollback
+- a kubectl rollout is paused on a live OKE cluster and an undo or resume decision is required
+
+## Lean operating rules
+
+- Prefer OCI CLI (`oci`) official documentation when available; fall back to Oracle Cloud docs and sanitized user evidence.
+- Do not execute a live OCI change until tenancy, compartment, active principal, and resource ownership are explicit.
+- Prefer plan, detect-drift, inspect, read, describe, and rollback evidence before execution.
+- If the request skips preview or rollback design, push back.
+- Never print secrets, API keys, tenancy OCIDs, private key contents, or raw config values. Summarize sanitized evidence only.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Preflight commands](references/preflight-commands.md) — OCI CLI commands to run before any mutation.
+- [Rollback playbook](references/rollback-playbook.md) — concrete rollback steps for this service.
+- [Permission model](references/permission-model.md) — OCI IAM policy statements and dynamic group guidance.
+- [Official sources](references/official-sources.md) — authoritative OCI documentation links.
+
+## Response minimum
+
+Return, at minimum:
+
+- confirmed tenancy, compartment, and active principal
+- preflight evidence (plan output, drift result, inspect/read, health check)
+- approval status for the proposed mutation
+- rollback posture or explicit statement of what cannot be rolled back
+- post-action verification steps or refusal reason

package/skills/oci/oci-live-oke-rollout-guard/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "oci-live-oke-rollout-guard",
+  "name": "OCI Live OKE Rollout Guard",
+  "type": "skill",
+  "provider": "oci",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Guard OKE deployment rollouts via DevOps Service approval stages with canary and blue-green evidence, rollout health verification, and kubectl rollout undo gates.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.oracle.com/en-us/iaas/Content/devops/using/deploy_oke.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/devops/using/bgoke_deploy.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/devops/using/canaryoke_deploy.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm"
+  ],
+  "security_notes": "Never advance an OKE rollout past an approval stage without rollout status and PDB health evidence. kubectl rollout undo is irreversible in the sense that the prior version may not be identical to the deployed artifact \u2014 confirm target revision before undo.",
+  "last_verified": "2026-04-30",
+  "path": "skills/oci/oci-live-oke-rollout-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/oci/oci-live-oke-rollout-guard/references/official-sources.md

@@ -0,0 +1,18 @@
+# Official Sources: OCI Live OKE Rollout Guard
+
+## OCI Container Engine for Kubernetes (OKE)
+
+- https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
+- https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengupgradingk8sworkernode.htm
+- https://docs.oracle.com/en-us/iaas/Content/DevOps/Concepts/devopsoverview.htm
+
+## Kubernetes rolling updates
+
+- https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#rolling-update-deployment
+- https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#rolling-back-a-deployment
+- https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+
+## Source-grounding rule
+
+Use official Oracle Cloud Infrastructure and Kubernetes.io documentation as source of truth.
+OCI DevOps pipeline stage configuration details must be verified from current OCI docs.

package/skills/oci/oci-live-oke-rollout-guard/references/permission-model.md

@@ -0,0 +1,80 @@
+# Permission Model: OCI Live OKE Rollout Guard
+
+## 3-tier IAM separation
+
+| Tier | Group/Principal | Verb | Scope |
+|------|----------------|------|-------|
+| Audit | `<oke-auditors>` | read | `<prod-compartment>` |
+| Operator | `<oke-operators>` | read + use devops | `<prod-compartment>` |
+| Admin | `<oke-admins>` | use cluster + manage node-pools | `<prod-compartment>` |
+| Pipeline | `<devops-pipeline-runners>` (dynamic group) | use cluster + manage node-pools | `<prod-compartment>` |
+
+## OKE cluster read (no deploy rights)
+
+```
+Allow group <oke-auditors> to read clusters in compartment <prod-compartment>
+Allow group <oke-auditors> to read cluster-node-pools in compartment <prod-compartment>
+```
+
+## DevOps pipeline read + deployment use
+
+```
+Allow group <oke-operators> to read devops-pipelines in compartment <prod-compartment>
+Allow group <oke-operators> to read devops-deployments in compartment <prod-compartment>
+Allow group <oke-operators> to use devops-deployments in compartment <prod-compartment>
+```
+
+## OKE admin (use, NOT manage — cannot delete clusters)
+
+```
+Allow group <oke-admins> to use clusters in compartment <prod-compartment>
+Allow group <oke-admins> to manage cluster-node-pools in compartment <prod-compartment>
+```
+
+## DevOps pipeline dynamic group
+
+```
+Allow dynamic-group <devops-pipeline-runners> to use cluster in compartment <prod-compartment>
+Allow dynamic-group <devops-pipeline-runners> to manage cluster-node-pools in compartment <prod-compartment>
+```
+
+`use cluster` (not `manage cluster`) for the pipeline: `manage` grants cluster termination rights.
+
+## Service-principal policies (required for OKE and DevOps services)
+
+```
+Allow service OKE to manage cluster-node-pools in compartment <prod-compartment>
+Allow service OKE to use virtual-network-family in compartment <prod-compartment>
+Allow service OKE to manage instance-family in compartment <prod-compartment>
+  where target.resource.tag.Operations.OkeManaged.value = 'true'
+
+Allow service devops to use ons-topics in compartment <prod-compartment>
+Allow service devops to manage repos in compartment <prod-compartment>
+Allow service devops to read secret-family in compartment <prod-compartment>
+```
+
+The `OkeManaged = 'true'` tag prevents the OKE service principal from acting on
+instances outside of managed node pools.
+
+## Do not use
+
+```
+# FORBIDDEN
+Allow group <oke-operators> to manage clusters in compartment prod
+Allow dynamic-group <all-instances> to manage all-resources in compartment prod
+```
+
+## Kubernetes RBAC (in-cluster, namespace-scoped)
+
+```yaml
+rules:
+- apiGroups: ["apps"]
+  resources: ["deployments", "replicasets"]
+  verbs: ["get", "list", "watch", "patch", "update"]
+- apiGroups: [""]
+  resources: ["pods", "pods/log", "services"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["policy"]
+  resources: ["poddisruptionbudgets"]
+  verbs: ["get", "list"]
+```

package/skills/oci/oci-live-oke-rollout-guard/references/preflight-commands.md

@@ -0,0 +1,55 @@
+# Preflight Commands: OCI Live OKE Rollout Guard
+
+Run these before any OKE rollout mutation. Paste sanitized output as evidence.
+
+## 1. Confirm identity and compartment target
+
+```bash
+oci iam region-subscription list
+oci ce cluster list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --query "data[].{name:name,id:id,lifecycleState:\"lifecycle-state\",kubernetesVersion:\"kubernetes-version\"}"
+```
+
+## 2. Get cluster kubeconfig
+
+```bash
+oci ce cluster create-kubeconfig \
+  --cluster-id <CLUSTER_OCID> \
+  --file ~/.kube/config \
+  --region <REGION> \
+  --token-version 2.0.0
+kubectl config current-context
+```
+
+## 3. Check node pool health
+
+```bash
+oci ce node-pool list \
+  --cluster-id <CLUSTER_OCID> \
+  --compartment-id <COMPARTMENT_OCID> \
+  --query "data[].{name:name,id:id,lifecycleState:\"lifecycle-state\",quantityPerSubnet:\"quantity-per-subnet\"}"
+kubectl get nodes -o wide
+```
+
+## 4. Check PodDisruptionBudgets
+
+```bash
+kubectl get pdb -n <NAMESPACE> -o wide
+```
+
+## 5. Check current deployment rollout status
+
+```bash
+kubectl rollout status deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+kubectl get deployment <DEPLOYMENT_NAME> -n <NAMESPACE> \
+  -o jsonpath='{.spec.strategy.rollingUpdate}'
+```
+
+## 6. Verify DevOps pipeline approval stage is configured
+
+```bash
+oci devops deployment-pipeline list \
+  --project-id <PROJECT_OCID> \
+  --query "data[].{displayName:\"display-name\",id:id,lifecycleState:\"lifecycle-state\"}"
+```

package/skills/oci/oci-live-oke-rollout-guard/references/rollback-playbook.md

@@ -0,0 +1,45 @@
+# Rollback Playbook: OCI Live OKE Rollout Guard
+
+## Rollback a Kubernetes deployment to the previous revision
+
+```bash
+# Pause rollout immediately
+kubectl rollout pause deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+
+# Check rollout history
+kubectl rollout history deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+
+# Undo to previous revision
+kubectl rollout undo deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+
+# Or undo to a specific revision
+kubectl rollout undo deployment/<DEPLOYMENT_NAME> -n <NAMESPACE> --to-revision=<N>
+
+# Verify
+kubectl rollout status deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
+```
+
+## Cancel an in-flight DevOps pipeline deployment
+
+```bash
+oci devops deployment list \
+  --deployment-pipeline-id <PIPELINE_OCID> \
+  --query "data[?\"lifecycle-state\"=='IN_PROGRESS'].{id:id,displayName:\"display-name\"}"
+
+oci devops deployment cancel --deployment-id <DEPLOYMENT_OCID> --force
+```
+
+## Rollback a node pool version upgrade
+
+```bash
+oci ce node-pool update \
+  --node-pool-id <NODE_POOL_OCID> \
+  --kubernetes-version <PREVIOUS_VERSION>
+```
+
+## Rollback limitations
+
+- `kubectl rollout undo` reverts the pod template spec only — does not revert ConfigMaps, Secrets, or database schema migrations.
+- DevOps pipeline deployment cancellation stops future stages but does not undo already-applied Kubernetes resources.
+- Node pool version downgrade is not supported by OCI — you can only go to an equal or newer Kubernetes version.
+- If the cluster upgrade (control plane version) was applied, it cannot be rolled back.

package/skills/oci/oci-live-resource-manager-stack-guard/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: oci-live-resource-manager-stack-guard
+description: Guard OCI Resource Manager stack plan, apply, and destroy jobs with drift detection, state-version rollback, stack auto-lock awareness, and approval gates.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# OCI Live Resource Manager Stack Guard
+
+## Purpose
+
+Act as the guarded live OCI operator for oci-live-resource-manager-stack-guard work. Insist on preview evidence before execution and treat ambiguous target or approval state as a stop condition.
+
+## When to use
+
+Use this skill when:
+
+- an OCI Resource Manager stack apply or destroy job must be run against a live environment
+- drift has been detected on a stack and resolution requires an apply job with human approval
+- a Resource Manager stack state must be inspected, imported, or rolled back after a partial apply
+
+## Lean operating rules
+
+- Prefer OCI CLI (`oci`) official documentation when available; fall back to Oracle Cloud docs and sanitized user evidence.
+- Do not execute a live OCI change until tenancy, compartment, active principal, and resource ownership are explicit.
+- Prefer plan, detect-drift, inspect, read, describe, and rollback evidence before execution.
+- If the request skips preview or rollback design, push back.
+- Never print secrets, API keys, tenancy OCIDs, private key contents, or raw config values. Summarize sanitized evidence only.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Preflight commands](references/preflight-commands.md) — OCI CLI commands to run before any mutation.
+- [Rollback playbook](references/rollback-playbook.md) — concrete rollback steps for this service.
+- [Permission model](references/permission-model.md) — OCI IAM policy statements and dynamic group guidance.
+- [Official sources](references/official-sources.md) — authoritative OCI documentation links.
+
+## Response minimum
+
+Return, at minimum:
+
+- confirmed tenancy, compartment, and active principal
+- preflight evidence (plan output, drift result, inspect/read, health check)
+- approval status for the proposed mutation
+- rollback posture or explicit statement of what cannot be rolled back
+- post-action verification steps or refusal reason

package/skills/oci/oci-live-resource-manager-stack-guard/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "oci-live-resource-manager-stack-guard",
+  "name": "OCI Live Resource Manager Stack Guard",
+  "type": "skill",
+  "provider": "oci",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Guard OCI Resource Manager stack plan, apply, and destroy jobs with drift detection, state-version rollback, stack auto-lock awareness, and approval gates.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Concepts/resourcemanager.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Tasks/detect-drift.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Tasks/create-job-lock-file.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/ResourceManager/home.htm"
+  ],
+  "security_notes": "OCI Resource Manager auto-locks a stack state during job execution. Never approve an apply or destroy job without a plan-job output review and drift detection evidence. Repo write access does not authorize live OCI infrastructure mutations.",
+  "last_verified": "2026-04-30",
+  "path": "skills/oci/oci-live-resource-manager-stack-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/oci/oci-live-resource-manager-stack-guard/references/official-sources.md

@@ -0,0 +1,12 @@
+# Official Sources: OCI Live Resource Manager Stack Guard
+
+## OCI Resource Manager
+
+- https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Concepts/resourcemanager.htm
+- https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Tasks/creatingjobs.htm
+- https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Tasks/managingstacksandjobs.htm
+
+## Source-grounding rule
+
+Use official Oracle Cloud Infrastructure documentation as the source of truth for Resource Manager behavior.
+Terraform version support and job type capabilities must be verified from current OCI docs.