@raishin/vanguard-frontier-agentic 1.2.0 → 1.4.0

package/scripts/export-marketplace-agents.mjs

@@ -43,21 +43,86 @@ const PLATFORM_ALIASES = {
   kirocli: "kiro-cli",
 };
 
+const SKILLS_PLATFORM_CONFIG = {
+  "claude-code": ".claude/skills",
+  copilot: ".github/skills",
+  gemini: ".gemini/skills",
+};
+
+/**
+ * Platforms that will NEVER support skill bundling because they have no native
+ * skill primitive. The value is an explicit notice that replaces the generic
+ * "not yet supported" fallback for these platforms.
+ *
+ * Design rationale: docs/cross-harness-skills.md
+ *   Cursor — uses Project Rules (.cursor/rules/*.mdc), not skills.
+ *   Kiro   — uses Steering files (.kiro/steering/*.md), not skills.
+ * Both mismatches are large enough that skill export is intentionally omitted
+ * as a permanent design decision, not a pending TODO.
+ */
+const SKIP_SKILLS_PLATFORM_NOTICES = {
+  cursor:
+    "[vfa] Skill export is not supported on Cursor. Cursor uses Project Rules " +
+    "(.cursor/rules/*.mdc), not skills. The semantics (style guides, glob-based " +
+    "triggers) differ significantly from our multi-section operating playbooks; " +
+    "this is a permanent design decision, not a pending TODO. " +
+    "See docs/cross-harness-skills.md for the full rationale.\n",
+  kiro:
+    "[vfa] Skill export is not supported on Kiro. Kiro uses Steering files " +
+    "(.kiro/steering/*.md), not skills. Steering is single-file guidance with " +
+    "plural-by-default inclusion; our SKILL packages bundle scripts/ and " +
+    "references/ siblings that Steering cannot accommodate. " +
+    "This is a permanent design decision, not a pending TODO. " +
+    "See docs/cross-harness-skills.md for the full rationale.\n",
+  "kiro-ide":
+    "[vfa] Skill export is not supported on Kiro. Kiro uses Steering files " +
+    "(.kiro/steering/*.md), not skills. Steering is single-file guidance with " +
+    "plural-by-default inclusion; our SKILL packages bundle scripts/ and " +
+    "references/ siblings that Steering cannot accommodate. " +
+    "This is a permanent design decision, not a pending TODO. " +
+    "See docs/cross-harness-skills.md for the full rationale.\n",
+  "kiro-cli":
+    "[vfa] Skill export is not supported on Kiro. Kiro uses Steering files " +
+    "(.kiro/steering/*.md), not skills. Steering is single-file guidance with " +
+    "plural-by-default inclusion; our SKILL packages bundle scripts/ and " +
+    "references/ siblings that Steering cannot accommodate. " +
+    "This is a permanent design decision, not a pending TODO. " +
+    "See docs/cross-harness-skills.md for the full rationale.\n",
+};
+
 function usage(exitCode = 0) {
   const message = `
 Export selected marketplace agents into a consumer repository.
 
 Usage:
   vfa-export-agents --platform <platform> --agents <agent-id[,agent-id...]> [--repo <path>] [--force]
+  vfa-export-agents --platform <platform> --role <role-id> [--provider <provider>] [--repo <path>] [--force]
   vfa-export-agents --platform <platform> --all [--repo <path>] [--force]
   vfa-export-agents --list
+  vfa-export-agents --list-roles
 
 Platforms:
   codex, copilot, claude-code, cursor, gemini, kiro, kiro-ide, kiro-cli
 
+Roles:
+  cloud-security-engineer, cloud-platform-engineer, cloud-dba,
+  cloud-finops-analyst, cloud-solutions-architect, cloud-devops-engineer
+
+Companion skills:
+  By default, when --platform supports skill bundling (claude-code, copilot, gemini),
+  each agent's same-named SKILL.md companion is also exported into the
+  platform skill directory (e.g. <repo>/.claude/skills/, <repo>/.github/skills/,
+  or <repo>/.gemini/skills/).
+  Pairing rule: agent id '<name>-agent' bundles skill '<name>' if it exists.
+  Use --no-skills to export agents only.
+
 Examples:
   vfa-export-agents --list
+  vfa-export-agents --list-roles
   vfa-export-agents --platform claude-code --agents azure-cosmosdb-platform-operator-agent
+  vfa-export-agents --platform claude-code --role cloud-security-engineer
+  vfa-export-agents --platform claude-code --role cloud-security-engineer --provider azure
+  vfa-export-agents --platform claude-code --all --no-skills --repo /path/to/project
   vfa-export-agents --platform kiro --agents azure-cosmosdb-platform-operator-agent --repo ../consumer-repo
   vfa-export-agents --platform copilot --all --repo /path/to/project --force
 `.trim();
@@ -70,9 +135,13 @@ function parseArgs(argv) {
     repo: process.cwd(),
     force: false,
     list: false,
+    listRoles: false,
     all: false,
     agents: [],
     platform: null,
+    role: null,
+    provider: null,
+    noSkills: false,
   };
 
   for (let i = 0; i < argv.length; i += 1) {
@@ -82,6 +151,10 @@ function parseArgs(argv) {
       args.list = true;
       continue;
     }
+    if (arg === "--list-roles") {
+      args.listRoles = true;
+      continue;
+    }
     if (arg === "--force") {
       args.force = true;
       continue;
@@ -90,6 +163,10 @@ function parseArgs(argv) {
       args.all = true;
       continue;
     }
+    if (arg === "--no-skills") {
+      args.noSkills = true;
+      continue;
+    }
     if (arg === "--repo") {
       args.repo = path.resolve(argv[++i] ?? "");
       continue;
@@ -105,6 +182,14 @@ function parseArgs(argv) {
         .filter(Boolean);
       continue;
     }
+    if (arg === "--role") {
+      args.role = argv[++i] ?? "";
+      continue;
+    }
+    if (arg === "--provider") {
+      args.provider = argv[++i] ?? "";
+      continue;
+    }
     usage(1);
   }
 
@@ -137,6 +222,7 @@ function loadAgents() {
       provider: metadata.provider,
       summary: metadata.summary,
       harness_variants: metadata.harness_variants ?? {},
+      companion_skills: Array.isArray(metadata.companion_skills) ? metadata.companion_skills : undefined,
       metadataPath,
     };
   });
@@ -173,7 +259,81 @@ function assertWithin(parent, child, label) {
   }
 }
 
+function loadSkills() {
+  const skillsRoot = path.join(repoRoot, "skills");
+  if (!fs.existsSync(skillsRoot)) return new Map();
+  const byName = new Map();
+  for (const provider of fs.readdirSync(skillsRoot, { withFileTypes: true })) {
+    if (!provider.isDirectory()) continue;
+    const providerDir = path.join(skillsRoot, provider.name);
+    for (const skill of fs.readdirSync(providerDir, { withFileTypes: true })) {
+      if (!skill.isDirectory()) continue;
+      const skillDir = path.join(providerDir, skill.name);
+      if (fs.existsSync(path.join(skillDir, "SKILL.md"))) {
+        byName.set(skill.name, skillDir);
+      }
+    }
+  }
+  return byName;
+}
+
+function copySkillTree(sourceDir, destDir, force) {
+  assertWithin(repoRoot, sourceDir, "read skill source");
+  for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true })) {
+    const src = path.join(sourceDir, entry.name);
+    const dst = path.join(destDir, entry.name);
+    if (entry.isSymbolicLink()) {
+      throw new Error(`Refusing to copy symbolic link in skill tree: ${src}`);
+    }
+    if (entry.isDirectory()) {
+      copySkillTree(src, dst, force);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    if (!force && fs.existsSync(dst)) {
+      throw new Error(`Refusing to overwrite existing file without --force: ${dst}`);
+    }
+    fs.mkdirSync(path.dirname(dst), { recursive: true });
+    fs.copyFileSync(src, dst);
+  }
+}
+
+function resolveCompanionSkills(selectedAgents, skillsByName, role, includeAll) {
+  const skillNames = new Set();
+  if (includeAll) {
+    for (const name of skillsByName.keys()) skillNames.add(name);
+  }
+  if (role && Array.isArray(role.skills)) {
+    for (const id of role.skills) skillNames.add(id);
+  }
+  const orphans = [];
+  for (const agent of selectedAgents) {
+    // Prefer explicit companion_skills if declared (even if empty — that means intentional no-pair)
+    if (Array.isArray(agent.companion_skills)) {
+      for (const skillId of agent.companion_skills) {
+        if (skillsByName.has(skillId)) skillNames.add(skillId);
+      }
+      // companion_skills: [] is intentional no-pair — do NOT count as orphan
+      continue;
+    }
+    // Fall back to name-stripping convention
+    const skillName = agent.id.endsWith("-agent")
+      ? agent.id.slice(0, -"-agent".length)
+      : agent.id;
+    if (skillsByName.has(skillName)) {
+      skillNames.add(skillName);
+    } else if (!role) {
+      orphans.push(agent.id);
+    }
+  }
+  return { skillNames: [...skillNames].sort(), orphans };
+}
+
 function copyFile(source, destination, force) {
+  const sourceStat = fs.lstatSync(source);
+  if (sourceStat.isSymbolicLink()) {
+    throw new Error(`Refusing to copy symbolic link as harness source: ${source}`);
+  }
   if (!force && fs.existsSync(destination)) {
     throw new Error(`Refusing to overwrite existing file without --force: ${destination}`);
   }
@@ -181,12 +341,28 @@ function copyFile(source, destination, force) {
   fs.copyFileSync(source, destination);
 }
 
+function loadRoles() {
+  const rolesPath = path.join(repoRoot, "catalog", "install-roles.json");
+  if (!fs.existsSync(rolesPath)) {
+    throw new Error("catalog/install-roles.json not found. Ensure the package is correctly installed.");
+  }
+  return JSON.parse(fs.readFileSync(rolesPath, "utf8"));
+}
+
 function listAgents(agents) {
   for (const agent of agents.sort((a, b) => a.id.localeCompare(b.id))) {
     console.log(`${agent.id}\t${agent.provider}\t${agent.name}`);
   }
 }
 
+function listRoles(rolesData) {
+  for (const [roleId, role] of Object.entries(rolesData.roles)) {
+    const agentCount = role.agents.length;
+    const skillCount = (role.skills ?? []).length;
+    console.log(`${roleId}\t${role.label}\t${agentCount} agents, ${skillCount} skills`);
+  }
+}
+
 function buildDestinations(agent, platform) {
   const config = PLATFORM_CONFIG[platform];
   const destinations = [];
@@ -222,6 +398,16 @@ function buildDestinations(agent, platform) {
 
 function main() {
   const args = parseArgs(process.argv.slice(2));
+
+  const cwd = process.cwd();
+  const cwdWithSep = cwd.endsWith(path.sep) ? cwd : cwd + path.sep;
+  if (args.repo !== cwd && !args.repo.startsWith(cwdWithSep)) {
+    process.stderr.write(
+      `[vfa] Warning: --repo '${args.repo}' is outside the current working directory.\n` +
+      `[vfa] Verify this is the intended target before continuing.\n`
+    );
+  }
+
   const { agents, byId } = loadAgents();
 
   if (args.list) {
@@ -229,19 +415,58 @@ function main() {
     return;
   }
 
+  if (args.listRoles) {
+    const rolesData = loadRoles();
+    listRoles(rolesData);
+    return;
+  }
+
   const platform = ensurePlatform(args.platform);
-  const selectedAgents = args.all
-    ? agents
-    : args.agents.map((agentId) => {
-        const agent = byId.get(agentId);
-        if (!agent) {
-          throw new Error(`Unknown agent id: ${agentId}`);
-        }
-        return agent;
+
+  let selectedAgents;
+  let selectedRole = null;
+  if (args.role) {
+    const rolesData = loadRoles();
+    const role = Object.hasOwn(rolesData.roles, args.role) ? rolesData.roles[args.role] : undefined;
+    selectedRole = role;
+    if (!role) {
+      const validRoles = Object.keys(rolesData.roles).join(", ");
+      throw new Error(`Unknown role: ${args.role}. Valid roles: ${validRoles}`);
+    }
+    let roleAgentIds = role.agents;
+    if (args.provider) {
+      if (!/^[a-z0-9][a-z0-9-]*$/.test(args.provider)) {
+        throw new Error(`Invalid --provider value. Must match /^[a-z0-9][a-z0-9-]*$/.`);
+      }
+      roleAgentIds = roleAgentIds.filter((id) => {
+        const agent = byId.get(id);
+        return agent && agent.provider === args.provider;
       });
+      if (roleAgentIds.length === 0) {
+        throw new Error(`No agents found for role '${args.role}' with the requested provider.`);
+      }
+    }
+    selectedAgents = roleAgentIds.map((agentId) => {
+      const agent = byId.get(agentId);
+      if (!agent) {
+        throw new Error(`Role '${args.role}' references unknown agent id: ${agentId}. Run npm run validate to check catalog integrity.`);
+      }
+      return agent;
+    });
+  } else if (args.all) {
+    selectedAgents = agents;
+  } else {
+    selectedAgents = args.agents.map((agentId) => {
+      const agent = byId.get(agentId);
+      if (!agent) {
+        throw new Error(`Unknown agent id: ${agentId}`);
+      }
+      return agent;
+    });
+  }
 
   if (selectedAgents.length === 0) {
-    throw new Error("No agents selected. Use --agents or --all.");
+    throw new Error("No agents selected. Use --agents, --role, or --all.");
   }
 
   const operations = [];
@@ -262,6 +487,47 @@ function main() {
       `installed\t${operation.agentId}\t${operation.variantKey}\t${path.relative(args.repo, operation.dest)}`
     );
   }
+
+  const skillsDestRoot = SKILLS_PLATFORM_CONFIG[platform];
+  if (args.noSkills) {
+    process.stderr.write(`[vfa] --no-skills: companion skills not bundled.\n`);
+  } else if (!skillsDestRoot) {
+    const specificNotice = SKIP_SKILLS_PLATFORM_NOTICES[platform];
+    if (specificNotice) {
+      process.stderr.write(specificNotice);
+    } else {
+      process.stderr.write(
+        `[vfa] Note: skills bundling is not yet supported on platform '${platform}'. ` +
+        `Agents exported only. Pass --no-skills to silence.\n`
+      );
+    }
+  } else {
+    const skillsByName = loadSkills();
+    const { skillNames, orphans } = resolveCompanionSkills(
+      selectedAgents,
+      skillsByName,
+      selectedRole,
+      args.all
+    );
+    let bundled = 0;
+    for (const skillName of skillNames) {
+      const sourceDir = skillsByName.get(skillName);
+      if (!sourceDir) continue;
+      const destDir = path.join(args.repo, skillsDestRoot, skillName);
+      assertWithin(args.repo, destDir, "write skill destination");
+      copySkillTree(sourceDir, destDir, args.force);
+      console.log(`installed\tskill:${skillName}\t${platform}\t${path.relative(args.repo, destDir)}`);
+      bundled += 1;
+    }
+    process.stderr.write(
+      `[vfa] Bundled ${bundled} companion skill(s) alongside ${selectedAgents.length} agent(s)` +
+      (orphans.length ? ` (no-skill agents: ${orphans.length})` : "") +
+      `. Use --no-skills to opt out.\n`
+    );
+    if (orphans.length && orphans.length <= 10) {
+      process.stderr.write(`[vfa] Agents without companion skill: ${orphans.join(", ")}\n`);
+    }
+  }
 }
 
 try {

package/scripts/update-catalog-new-agents.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Add all new agent and skill metadata.json entries to catalog JSON files."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+CATALOG_AGENTS = ROOT / "catalog" / "agents.json"
+CATALOG_SKILLS = ROOT / "catalog" / "skills.json"
+
+CATALOG_FIELDS_AGENT = {
+    "id", "name", "type", "provider", "summary", "path",
+    "harnesses", "last_verified", "official_docs", "security_notes",
+    "source_type", "version",
+}
+CATALOG_FIELDS_SKILL = CATALOG_FIELDS_AGENT | {"author"}
+
+
+def metadata_to_catalog_entry(m: dict, kind: str) -> dict:
+    entry: dict = {}
+    for key in ("id", "name", "type", "provider", "harnesses", "summary",
+                "source_type", "official_docs", "security_notes",
+                "last_verified", "path", "version"):
+        if key in m:
+            entry[key] = m[key]
+    # Normalise path — strip trailing slash
+    if "path" in entry and isinstance(entry["path"], str):
+        entry["path"] = entry["path"].rstrip("/")
+    if kind == "skill" and "author" in m:
+        entry["author"] = m["author"]
+    return entry
+
+
+def main() -> None:
+    agents_catalog: list[dict] = json.loads(CATALOG_AGENTS.read_text(encoding="utf-8"))
+    skills_catalog: list[dict] = json.loads(CATALOG_SKILLS.read_text(encoding="utf-8"))
+
+    existing_agent_ids = {e["id"] for e in agents_catalog}
+    existing_skill_ids = {e["id"] for e in skills_catalog}
+
+    new_agents: list[dict] = []
+    for meta_path in sorted(ROOT.glob("agents/**/metadata.json")):
+        m = json.loads(meta_path.read_text(encoding="utf-8"))
+        if m.get("type") != "agent":
+            continue
+        if m["id"] not in existing_agent_ids:
+            entry = metadata_to_catalog_entry(m, "agent")
+            new_agents.append(entry)
+            print(f"  + agent: {entry['id']}")
+
+    new_skills: list[dict] = []
+    for meta_path in sorted(ROOT.glob("skills/**/metadata.json")):
+        m = json.loads(meta_path.read_text(encoding="utf-8"))
+        if m.get("type") != "skill":
+            continue
+        if m["id"] not in existing_skill_ids:
+            entry = metadata_to_catalog_entry(m, "skill")
+            new_skills.append(entry)
+            print(f"  + skill: {entry['id']}")
+
+    if new_agents:
+        agents_catalog.extend(new_agents)
+        agents_catalog.sort(key=lambda x: x["id"])
+        CATALOG_AGENTS.write_text(
+            json.dumps(agents_catalog, indent=2, ensure_ascii=False) + "\n",
+            encoding="utf-8",
+        )
+        print(f"\nWrote {len(agents_catalog)} agents to {CATALOG_AGENTS.relative_to(ROOT)}")
+    else:
+        print("No new agents to add.")
+
+    if new_skills:
+        skills_catalog.extend(new_skills)
+        skills_catalog.sort(key=lambda x: x["id"])
+        CATALOG_SKILLS.write_text(
+            json.dumps(skills_catalog, indent=2, ensure_ascii=False) + "\n",
+            encoding="utf-8",
+        )
+        print(f"Wrote {len(skills_catalog)} skills to {CATALOG_SKILLS.relative_to(ROOT)}")
+    else:
+        print("No new skills to add.")
+
+
+if __name__ == "__main__":
+    main()

package/skills/argocd/README.md

@@ -0,0 +1,30 @@
+# 🚢 Argo CD Skills
+
+<p align="center">
+  <!-- 🖼️ Add an Argo CD logo to assets/logos/cnative/argocd/ and update this path -->
+  <span style="font-size:3.5em">🚢</span>
+</p>
+
+This folder contains Argo CD-focused skills curated for this marketplace.
+
+## Local marketplace portfolio
+
+This folder contains **1** local Argo CD skill:
+
+- `argocd-gitops-review`
+
+## Portfolio posture
+
+Argo CD skills for evidence-backed GitOps delivery review across `Application`, `AppProject`, `ApplicationSet`, sync windows, RBAC, sync impersonation, and multi-cluster (Argo CD Agent) topologies.
+
+These skills are intentionally conservative:
+
+- prefer `kubectl get applications,appprojects,applicationsets -n argocd -o yaml` and `argocd-cm` configmap state for live grounding before any review
+- treat `application.sync.impersonation.enabled: false` in production as a critical finding — the controller's cluster-admin ServiceAccount is the sync identity
+- treat `AppProject` with `sourceRepos: ['*']` and `destinations: ['*']` as a wide-blast-radius finding requiring explicit justification
+- challenge `automated.prune: true` + `automated.selfHeal: true` on production Applications — Git divergence becomes irreversible deletion
+- challenge `ApplicationSet` generators that include unbounded clusters or label selectors — one mis-labeled cluster joins the rollout
+- prefer `destinationServiceAccounts` (per-Application impersonation) over the controller's default cluster-admin
+- use official Argo CD documentation (argo-cd.readthedocs.io) for sync semantics, RBAC syntax, ApplicationSet strategies, and Argo CD Agent hub-and-spoke topology
+
+Run `npm run validate` after changing cataloged Argo CD skills.

package/skills/argocd/argo-rollouts-progressive-delivery-review/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: argo-rollouts-progressive-delivery-review
+description: Use this skill when reviewing Argo Rollouts progressive delivery configuration. Trigger when the user asks about canary or blue-green Rollout strategy correctness, AnalysisTemplate success/failure conditions, traffic weighting provider alignment, canaryService isolation, PDB deadlock risk with Rollout maxSurge settings, automated rollback posture, or manual vs automated promotion configuration.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
+---
+
+# Argo Rollouts Progressive Delivery Review
+
+## Purpose
+
+Review Argo Rollouts canary and blue-green strategy configuration, AnalysisTemplate success and failure condition correctness, traffic management provider alignment, canaryService vs stableService isolation, PDB compatibility with Rollout surge settings, and automated rollback posture. Argo Rollouts' safety depends entirely on AnalysisTemplate conditions that actually fail — an always-true successCondition means automated rollback never fires, regardless of actual error rates.
+
+## Lean operating rules
+
+- Prefer live evidence (`kubectl get rollout -A -o yaml`, `kubectl get analysistemplate -A -o yaml`, `kubectl argo rollouts status <name>`) when the active client exposes it; otherwise fall back to official Argo Rollouts documentation and sanitized YAML from the user.
+- Separate confirmed facts from inference. If AnalysisTemplate metric query results, traffic provider actual behavior, or PDB state was not directly queried, say so.
+- Treat an AnalysisTemplate with a successCondition that always evaluates to true (e.g., `result >= 0`, `true`) as a critical finding — automated rollback can never fire.
+- Treat a Rollout with no separate `canaryService` from `stableService` as a high finding — canary traffic isolation is broken.
+- Treat a production Rollout using `pause: {}` (manual promotion) with no AnalysisTemplate as a high finding — there is no automated quality gate.
+- Treat a traffic provider in `spec.strategy.canary.trafficRouting` that does not match the actual ingress controller installed in the cluster as a high finding — weight changes are silently ignored.
+- Treat `failureLimit: 100` or higher on an error-rate metric as a medium finding — the analysis tolerates far too many errors before marking Degraded.
+- Keep the answer scoped, evidence-labeled, and explicit about what was not queried.
+
+## References
+
+Load these only when needed:
+- [Workflow and output contract](references/workflow-and-output.md)
+
+## Response minimum
+
+Return, at minimum:
+- the scoped target (Rollout name, AnalysisTemplate name, or traffic provider config) and evidence level,
+- the deployment strategy (canary with steps vs canary without steps, blue-green) and whether steps include AnalysisRun gates,
+- AnalysisTemplate successCondition and failureCondition correctness,
+- canaryService vs stableService isolation posture,
+- traffic provider alignment with the actual cluster ingress,
+- PDB compatibility with Rollout maxSurge/maxUnavailable,
+- the safest next actions and any assumptions or blockers.

package/skills/argocd/argo-rollouts-progressive-delivery-review/metadata.json

@@ -0,0 +1,22 @@
+{
+  "id": "argo-rollouts-progressive-delivery-review",
+  "name": "Argo Rollouts Progressive Delivery Review",
+  "type": "skill",
+  "provider": "argocd",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Review Argo Rollouts canary and blue-green strategy configuration, AnalysisTemplate success/failure conditions, traffic management provider alignment, canaryService isolation, PDB deadlock risk, and automated rollback posture for progressive delivery safety.",
+  "source_type": "original",
+  "official_docs": [
+    "https://argoproj.github.io/argo-rollouts/",
+    "https://argoproj.github.io/argo-rollouts/features/canary/",
+    "https://argoproj.github.io/argo-rollouts/features/analysis/",
+    "https://argoproj.github.io/argo-rollouts/features/traffic-management/",
+    "https://argoproj.github.io/argo-rollouts/features/bluegreen/",
+    "https://argoproj.github.io/argo-rollouts/generated/kubectl-argo-rollouts/kubectl-argo-rollouts_promote/"
+  ],
+  "security_notes": "AnalysisTemplates with always-true success conditions defeat automated rollback entirely. A canary that never fails analysis will silently promote a broken release to 100% production traffic.",
+  "last_verified": "2026-05-02",
+  "path": "skills/argocd/argo-rollouts-progressive-delivery-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}