@raishin/vanguard-frontier-agentic 1.2.0 → 1.4.0

package/skills/oci/oci-live-network-security-rule-guard/references/preflight-commands.md

@@ -0,0 +1,69 @@
+# Preflight Commands: OCI Live Network Security Rule Guard
+
+Run all of these before adding, modifying, or removing any Security List or NSG rule.
+
+## 1. Confirm active OCI profile and tenancy
+
+```bash
+oci iam region list --output table   # confirms CLI auth works
+oci iam tenancy get --tenancy-id $(oci iam user get --user-id $(oci iam user list --query 'data[0].id' --raw-output) --query 'data."compartment-id"' --raw-output) 2>/dev/null || echo "Use: oci iam user list --all"
+```
+
+Simpler identity check:
+```bash
+oci iam user list --all --query 'data[0].{name:name, description:description}' --output table
+```
+
+## 2. Capture current Security List rules (CRITICAL — save as rollback baseline)
+
+```bash
+# Get current ingress and egress rules — save this output BEFORE any mutation
+oci network security-list get \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --query 'data.{"display-name":"display-name", "ingress-security-rules":"ingress-security-rules", "egress-security-rules":"egress-security-rules"}'
+```
+
+## 3. Capture current NSG rules (CRITICAL — save as rollback baseline)
+
+```bash
+oci network nsg rules list \
+  --nsg-id <NSG_OCID> \
+  --all \
+  --query 'data[].{id:id, direction:direction, protocol:protocol, source:source, destination:destination, "source-type":"source-type", "tcp-options":"tcp-options", "udp-options":"udp-options", stateless:stateless}'
+```
+
+## 4. List Security Lists in a VCN to identify the target
+
+```bash
+oci network security-list list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --vcn-id <VCN_OCID> \
+  --query 'data[].{"display-name":"display-name", id:id, "lifecycle-state":"lifecycle-state"}'
+```
+
+## 5. Identify subnets attached to the Security List (blast radius)
+
+```bash
+oci network subnet list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --vcn-id <VCN_OCID> \
+  --query 'data[].{"display-name":"display-name", "cidr-block":"cidr-block", "security-list-ids":"security-list-ids", "prohibit-public-ip-on-vnic":"prohibit-public-ip-on-vnic"}'
+```
+
+`prohibit-public-ip-on-vnic: true` = private subnet. Ingress from 0.0.0.0/0 on a private subnet still allows internal CIDR access — confirm VCN CIDR scope.
+
+## 6. Check if DB System or Autonomous DB is in the affected subnet
+
+```bash
+# List DB systems in compartment
+oci db system list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --query 'data[].{"display-name":"display-name", "subnet-id":"subnet-id", "lifecycle-state":"lifecycle-state"}'
+
+# List Autonomous DBs
+oci db autonomous-database list \
+  --compartment-id <COMPARTMENT_OCID> \
+  --query 'data[].{"db-name":"db-name", "subnet-id":"subnet-id", "lifecycle-state":"lifecycle-state"}'
+```
+
+If the affected subnet hosts a DB workload, classify the change as **critical** and require explicit DBA approval.

package/skills/oci/oci-live-network-security-rule-guard/references/rollback-playbook.md

@@ -0,0 +1,79 @@
+# Rollback Playbook: OCI Live Network Security Rule Guard
+
+OCI Security List and NSG rule changes take effect immediately with no native undo operation. The only rollback path is restoring the previous rule set from a captured baseline. **Capture current rules before every mutation — no exceptions.**
+
+## Pre-mutation capture (mandatory)
+
+```bash
+# Security List — save to file before any change
+oci network security-list get \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --query 'data.{"ingress-security-rules":"ingress-security-rules","egress-security-rules":"egress-security-rules"}' \
+  > securitylist-backup-$(date +%Y%m%d-%H%M%S).json
+
+# NSG — save to file before any change
+oci network nsg rules list \
+  --nsg-id <NSG_OCID> --all \
+  > nsg-backup-$(date +%Y%m%d-%H%M%S).json
+```
+
+## Restore Security List rules from backup
+
+Security List update is a **full replace** — the update command overwrites the entire rule set. Pass the exact previous rules from the backup file.
+
+```bash
+# Restore ingress rules
+INGRESS=$(cat securitylist-backup-<TIMESTAMP>.json | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps(d['ingress-security-rules']))")
+oci network security-list update \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --ingress-security-rules "$INGRESS" \
+  --force
+
+# Restore egress rules (same file, egress key)
+EGRESS=$(cat securitylist-backup-<TIMESTAMP>.json | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps(d['egress-security-rules']))")
+oci network security-list update \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --egress-security-rules "$EGRESS" \
+  --force
+```
+
+## Restore NSG rules from backup
+
+NSG rule updates require rule IDs. To restore, remove new rules and re-add the old ones.
+
+```bash
+# List current rule IDs to identify added rules
+oci network nsg rules list --nsg-id <NSG_OCID> --all --query 'data[].id'
+
+# Remove a specific rule that was incorrectly added
+oci network nsg rules remove \
+  --nsg-id <NSG_OCID> \
+  --security-rule-ids '["<RULE_ID_TO_REMOVE>"]'
+```
+
+## Verify restoration
+
+```bash
+# Confirm rules match the backup
+oci network security-list get \
+  --security-list-id <SECURITY_LIST_OCID> \
+  --query 'data.{"ingress-security-rules":"ingress-security-rules","egress-security-rules":"egress-security-rules"}'
+```
+
+## Connectivity verification after rollback
+
+```bash
+# Check if affected instance can still reach expected endpoints
+# (Run from inside the VCN or use OCI Network Path Analyzer)
+oci network path-analyzer-test create \
+  --compartment-id <COMPARTMENT_OCID> \
+  --protocol-parameters '{"type":"TCP","destinationPort":<PORT>}' \
+  --source-endpoint '{"type":"COMPUTE_INSTANCE","instanceId":"<INSTANCE_OCID>"}' \
+  --destination-endpoint '{"type":"IP_ADDRESS","address":"<DEST_IP>"}'
+```
+
+## What cannot be rolled back
+
+- Traffic that flowed through an incorrectly open rule during the window cannot be recalled.
+- Data exfiltrated or connections established during the exposure window must be investigated separately via VCN Flow Logs.
+- Enable Flow Logs on affected subnets before and after any security rule change for forensic coverage.

package/skills/oci/oci-live-oke-rollout-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-oke-rollout-guard
 description: Guard OKE deployment rollouts via DevOps Service approval stages with canary and blue-green evidence, rollout health verification, and kubectl rollout undo gates.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # OCI Live OKE Rollout Guard

package/skills/oci/oci-live-resource-manager-stack-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-resource-manager-stack-guard
 description: Guard OCI Resource Manager stack plan, apply, and destroy jobs with drift detection, state-version rollback, stack auto-lock awareness, and approval gates.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # OCI Live Resource Manager Stack Guard

package/skills/oci/oci-live-vault-key-destruction-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-vault-key-destruction-guard
 description: Guard Vault master encryption key scheduled-deletion and HSM rotation with data-association audits, key-usage reference checks, deletion-window enforcement, and cancellation playbooks.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: security
 ---
 
 # OCI Live Vault Key Destruction Guard

package/skills/oci/oci-load-balancer-traffic-engineer/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-load-balancer-traffic-engineer
 description: Design, review, and troubleshoot OCI Load Balancer and Network Load Balancer traffic paths, listeners, backend sets, certificates, health checks, logging, and failover. Use for L7/L4 traffic engineering and availability reviews.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: networking
 ---
 
 # OCI Load Balancer Traffic Engineer

package/skills/oci/oci-maestro/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-maestro
 description: OCI Maestro routing skill. Classify the user's OCI task, select the narrowest specialist agent or the right team of specialists from the catalog, and dispatch them — single specialist for focused tasks, parallel team for multi-domain tasks. Never auto-dispatch live-guard agents.
+allowed-tools: Agent Skill Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # OCI Maestro Routing Skill

package/skills/oci/oci-migration-cutover-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-migration-cutover-architect
 description: Plan OCI migrations and cutovers with Cloud Migrations, dependency discovery, waves, rollback, DNS, data sync, validation, and support readiness. Use for migration assessment, move groups, cutover runbooks, and go/no-go reviews.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # OCI Migration Cutover Architect

package/skills/oci/oci-multi-cloud-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-multi-cloud-architect
 description: Design and review OCI multi-cloud architectures connecting Oracle Cloud Infrastructure with AWS, Azure, Google Cloud, on-premises, or SaaS through VPN, FastConnect, Direct Connect, ExpressRoute, Cloud Interconnect, identity federation, DNS, routing, security, observability, and operating-model controls.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # OCI Multi-Cloud Architect

package/skills/oci/oci-mysql-heatwave-ai-specialist/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-mysql-heatwave-ai-specialist
 description: OCI Operate and review MySQL HeatWave, MySQL AI, vector/RAG workflows, connection configs, object storage ingestion, and SQL safety. Use for MySQL AI questions, HeatWave ML, vector store loading, and MySQL operational reviews.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # OCI MySQL HeatWave AI Specialist

package/skills/oci/oci-network-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-network-architect
 description: Design, review, and troubleshoot OCI networking with safe compartment/region scoping, least-privilege network access, VCN/subnet/routing/security-list/NSG analysis, and evidence-based MCP or CLI discovery.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: networking
 ---
 
 # OCI Network Architect

package/skills/oci/oci-observability-incident-responder/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-observability-incident-responder
 description: Operate as a ruthless OCI observability and incident responder for Monitoring alarms, Logging, Events, Notifications, service health, metrics, runbooks, and IAM-scoped incident response. Use when work touches OCI alarms, telemetry, alert triage, incident evidence, or response permissions.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # OCI Observability Incident Responder

package/skills/oci/oci-recovery-service-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-recovery-service-operator
 description: Operate OCI Recovery Service protected databases, protection policies, recovery service subnets, backup health, redo status, and recovery metrics. Use for database recovery posture, protected database health, and restore readiness.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: resilience
 ---
 
 # OCI Recovery Service Operator

package/skills/oci/oci-registry-artifact-governor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-registry-artifact-governor
 description: Govern OCI Registry repositories, container images, artifact access, retention, promotion, and deployment safety. Use for OCIR repository reviews, image lifecycle, DevOps/OKE integration, and least-privilege push/pull access.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # OCI Registry Artifact Governor

package/skills/oci/oci-resource-search-inventory-analyst/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-resource-search-inventory-analyst
 description: Build OCI resource inventories and dependency maps using Resource Search, compartments, tags, and cross-service discovery. Use for tenancy inventory, ownership gaps, orphan detection, migration scoping, and architecture evidence collection.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # OCI Resource Search Inventory Analyst

package/skills/oci/oci-security-compliance-reviewer/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-security-compliance-reviewer
 description: "Review Oracle Cloud Infrastructure security, IAM, network, logging, encryption, and compliance posture. Use when asked to audit OCI policies, compartments, tenancy security, Cloud Guard findings, buckets, vaults, security lists, NSGs, or least-privilege access; prepare compliance evidence; or challenge risky OCI admin assumptions before changes."
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: compliance
 ---
 
 # OCI Security Compliance Reviewer

package/skills/oci/oci-solution-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-solution-architect
 description: Design, review, and stress-test Oracle Cloud Infrastructure solution architectures across identity, compartments, networking, compute, database, storage, observability, security, reliability, cost, and operations. Use when asked for OCI landing zones, target architectures, architecture review boards, migration designs, production readiness, or tradeoff decisions.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # OCI Solution Architect

package/skills/oci/oci-storage-backup-steward/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-storage-backup-steward
 description: Operate as a ruthless OCI storage and backup steward for Object Storage, Block Volume, File Storage, backup policies, retention, replication, lifecycle rules, restore readiness, and IAM-scoped storage operations. Use when work touches OCI storage inventory, backup posture, recovery planning, or storage permissions.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: resilience
 ---
 
 # OCI Storage Backup Steward

package/skills/oci/oci-support-incident-coordinator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-support-incident-coordinator
 description: Coordinate OCI support incidents with evidence quality, severity discipline, resource scope, timelines, and escalation readiness. Use for support tickets, incident evidence packs, Oracle SR preparation, and post-incident follow-up.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # OCI Support Incident Coordinator

package/skills/oci/oracle-oci-mcp-grounded-advisor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oracle-oci-mcp-grounded-advisor
 description: Use this skill when the user asks about Oracle MCP servers, SQLcl MCP, OCI MCP, Oracle Database agent access, OCI automation, or cloud/database advice that must be grounded in official Oracle sources.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # Oracle and OCI MCP Grounded Advisor

package/skills/opentelemetry/README.md

@@ -0,0 +1,31 @@
+# 🔭 OpenTelemetry Skills
+
+<p align="center">
+  <!-- 🖼️ Add an OpenTelemetry logo to assets/logos/cnative/opentelemetry/ and update this path -->
+  <span style="font-size:3.5em">🔭</span>
+</p>
+
+This folder contains OpenTelemetry-focused skills curated for this marketplace.
+
+## Local marketplace portfolio
+
+This folder contains **1** local OpenTelemetry skill:
+
+- `opentelemetry-collector-config-review`
+
+## Portfolio posture
+
+OpenTelemetry skills for evidence-backed observability pipeline review covering the four `OpenTelemetryCollector` deployment modes (`deployment`, `statefulset`, `daemonset`, `sidecar`), the `Instrumentation` CR for auto-instrumentation across Java/Node/Python/.NET/Go, the Target Allocator for distributed Prometheus scraping, and exporter/processor/receiver pipeline correctness.
+
+These skills are intentionally conservative:
+
+- prefer `kubectl get opentelemetrycollectors,instrumentations -A -o yaml` for live collector state grounding before any review
+- treat **collector pipeline with no exporter** as a critical finding — telemetry is silently dropped at collector boundary
+- treat **removal of `memory_limiter` processor** as a critical finding — collector OOMs and loses spans/metrics
+- challenge tail sampling rule changes — past spans are not re-evaluated, sampling drift is permanent for already-collected windows
+- challenge `Instrumentation` CR removal from a running namespace — auto-instrumented pods stop emitting telemetry on next restart
+- challenge collector `service.pipelines` lacking the `k8sattributes` processor — telemetry loses Kubernetes context (namespace, pod, deployment)
+- challenge TLS `insecure: true` on production exporters — telemetry data flows in plaintext, often containing PII
+- use official OpenTelemetry documentation (opentelemetry.io, opentelemetry-operator) for Collector/Instrumentation CRD syntax, processor pipelines, and Target Allocator semantics
+
+Run `npm run validate` after changing cataloged OpenTelemetry skills.

package/skills/opentelemetry/opentelemetry-collector-config-review/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: opentelemetry-collector-config-review
+description: Use this skill for OpenTelemetry Operator review covering OpenTelemetryCollector deployment modes (Deployment, StatefulSet, DaemonSet, Sidecar), Instrumentation CR auto-instrumentation across Java/Node/Python/.NET/Go, Target Allocator for distributed Prometheus scraping, and pipeline correctness across receivers, processors, and exporters. Trigger when the user asks whether a collector configuration will lose telemetry, whether the right deployment mode is used, whether memory_limiter and batch are present, whether tail_sampling is safe to change, or whether auto-instrumentation will cover a workload after restart.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-05"
+  category: observability
+---
+
+# OpenTelemetry Collector Config Review
+
+## Purpose
+
+Review OpenTelemetry Operator-managed `OpenTelemetryCollector` and `Instrumentation` resources against pipeline correctness, deployment-mode appropriateness, memory safety, sampling integrity, exporter security, and Kubernetes-attribute enrichment. Telemetry pipelines fail silently — a misconfigured exporter drops every span; a missing `memory_limiter` OOMs the collector; a deleted `Instrumentation` resource stops auto-instrumentation on next pod restart.
+
+## Lean operating rules
+
+- Prefer live cluster evidence (`kubectl get opentelemetrycollectors,instrumentations -A -o yaml` plus collector logs and metrics) when the active client exposes it; otherwise fall back to official OpenTelemetry documentation (opentelemetry.io, opentelemetry-operator) and sanitized YAML.
+- Separate confirmed facts from inference. If collector pipeline state, exporter health, or `Instrumentation` propagation was not queried, say so.
+- Treat **a pipeline with no exporter** (or with only `debug` exporter in production) as a critical finding — telemetry is dropped at the collector.
+- Treat **removal of the `memory_limiter` processor** as a critical finding — collector OOMs and loses spans/metrics on burst traffic.
+- Treat **removal of the `k8sattributes` processor** as a high finding — telemetry loses `k8s.namespace.name`, `k8s.pod.name`, `k8s.deployment.name`, and SLO dashboards lose context.
+- Challenge tail sampling rule changes — past spans are not re-evaluated; sampling drift is permanent for already-collected windows.
+- Challenge `Instrumentation` CR removal in a running namespace — auto-instrumented pods stop emitting telemetry after their next restart.
+- Challenge collector exporters with `tls.insecure: true` in production — telemetry data flows in plaintext, often containing PII/PHI.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+
+## References
+
+Load these only when needed:
+
+- [Evidence path and tooling](references/mcp-and-evidence.md) — use when choosing live evidence, confirming Operator version and Collector pipeline state, or switching to documentation mode.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, applying stress checks per deployment mode, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when you need the detailed OpenTelemetry documentation list, processor pipeline references, and grounded insights.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target (`OpenTelemetryCollector` of which mode, `Instrumentation` CR, or pipeline element) and evidence level,
+- the deployment-mode appropriateness (Deployment / StatefulSet / DaemonSet / Sidecar) for the use case,
+- the pipeline correctness (receivers, processors, exporters all present and ordered safely),
+- the failure mode if exporter is unreachable or downstream is full (queue, drop, retry semantics),
+- the safest next actions and rollback plan,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/opentelemetry/opentelemetry-collector-config-review/metadata.json

@@ -0,0 +1,30 @@
+{
+  "id": "opentelemetry-collector-config-review",
+  "name": "OpenTelemetry Collector Config Review",
+  "type": "skill",
+  "provider": "opentelemetry",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review OpenTelemetry Operator OpenTelemetryCollector and Instrumentation resources for deployment-mode appropriateness, pipeline correctness, memory_limiter and k8sattributes presence, exporter security, and sampling integrity.",
+  "source_type": "original",
+  "official_docs": [
+    "https://opentelemetry.io/docs/",
+    "https://opentelemetry.io/docs/collector/",
+    "https://opentelemetry.io/docs/collector/configuration/",
+    "https://opentelemetry.io/docs/kubernetes/operator/",
+    "https://opentelemetry.io/docs/kubernetes/operator/automatic/",
+    "https://opentelemetry.io/docs/kubernetes/operator/target-allocator/",
+    "https://github.com/open-telemetry/opentelemetry-operator"
+  ],
+  "security_notes": "Pipeline with no exporter silently drops telemetry. Missing memory_limiter causes collector OOM under burst. Missing k8sattributes drops Kubernetes context. Tail sampling changes are not retroactive. Removing Instrumentation CR stops auto-instrumentation on next pod restart.",
+  "last_verified": "2026-05-01",
+  "path": "skills/opentelemetry/opentelemetry-collector-config-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/opentelemetry/opentelemetry-collector-config-review/references/mcp-and-evidence.md

@@ -0,0 +1,49 @@
+# Evidence Path and Tooling
+
+## Evidence path
+
+1. Prefer live cluster evidence when a Kubernetes MCP server, `kubectl`, and access to the OpenTelemetry Operator namespace are available.
+2. Fall back to official OpenTelemetry documentation (opentelemetry.io, opentelemetry-operator GitHub) when live inspection is unavailable.
+3. Ask only for sanitized `OpenTelemetryCollector` / `Instrumentation` YAML, collector logs, and target backend reachability evidence when current-state proof matters.
+4. Label conclusions as `live evidence`, `documentation-based`, `sanitized user evidence`, or `inference`.
+
+## Useful live-evidence commands
+
+```shell
+# All Collectors and Instrumentation CRs across the cluster
+kubectl get opentelemetrycollectors,instrumentations -A -o yaml
+
+# Detailed Collector status — replicas, mode, generated config map
+kubectl -n <ns> get opentelemetrycollector <name> -o yaml
+kubectl -n <ns> get configmap <collector-name>-collector -o yaml
+
+# Operator state
+kubectl -n opentelemetry-operator-system get deploy,svc,validatingwebhookconfiguration
+
+# Collector pod logs — confirm pipeline is processing data
+kubectl -n <ns> logs deploy/<collector-name>-collector --tail=200 -f
+
+# Collector internal metrics (Prometheus on :8888 by default)
+kubectl -n <ns> port-forward svc/<collector-name>-collector 8888:8888
+curl http://localhost:8888/metrics | grep otelcol_
+
+# Auto-instrumentation propagation — which pods received the init container?
+kubectl get pods -A -o jsonpath='{range .items[?(@.metadata.annotations.instrumentation\.opentelemetry\.io/inject-java=="true")]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}'
+
+# Verify exporter reachability from within the collector pod
+kubectl -n <ns> exec -it deploy/<collector-name>-collector -- nc -zv <exporter-host> <exporter-port>
+```
+
+## Operator and Collector state to confirm before review
+
+- Operator version (`kubectl -n opentelemetry-operator-system get deploy opentelemetry-operator-controller-manager -o jsonpath='{.spec.template.spec.containers[*].image}'`) — `OpenTelemetryCollector` API has evolved; `v1beta1` is the current stable.
+- Collector image and version — different versions support different receivers/processors/exporters. The contrib distribution has a much wider set than the core distribution.
+- Whether Target Allocator is deployed — required for `mode: statefulset` Prometheus scraping at scale.
+- Whether `Instrumentation` CRs exist and which language images are pinned (Java, Node, Python, .NET, Go) — version drift between auto-instrumentation images and application runtimes is a common silent failure mode.
+- Backend reachability — the actual telemetry destination (vendor SaaS, Tempo, Jaeger, Prometheus remote write, Loki) must accept the collector's data; check from inside the pod.
+
+## Sanitization rules
+
+- Never request kubeconfig contents, vendor API keys, OTLP bearer tokens, or backend authentication secrets.
+- Replace identifiable backend hostnames, vendor URLs, and tenant IDs with placeholders unless the user provides them.
+- Do not print the collector's `Authorization` header values; reference them by configuration key only.

package/skills/opentelemetry/opentelemetry-collector-config-review/references/official-sources.md

@@ -0,0 +1,31 @@
+# Official Sources
+
+Load these only when needed:
+
+- [OpenTelemetry documentation home](https://opentelemetry.io/docs/) — use as the entry point for any OTEL question.
+- [Collector overview](https://opentelemetry.io/docs/collector/) — use for collector architecture, distributions (core vs contrib), and component model.
+- [Collector configuration](https://opentelemetry.io/docs/collector/configuration/) — use for receivers, processors, exporters, extensions, and `service.pipelines` syntax.
+- [Operator overview](https://opentelemetry.io/docs/kubernetes/operator/) — use for `OpenTelemetryCollector` CRD, deployment modes, and Operator behavior.
+- [Operator automatic instrumentation](https://opentelemetry.io/docs/kubernetes/operator/automatic/) — use for `Instrumentation` CR, language-specific init containers, annotation-based pod injection.
+- [Target Allocator](https://opentelemetry.io/docs/kubernetes/operator/target-allocator/) — use for sharding Prometheus scrape jobs across collector replicas.
+- [opentelemetry-operator GitHub](https://github.com/open-telemetry/opentelemetry-operator) — use for CRD source, examples, and recent feature notes.
+- [opentelemetry-collector-contrib processors](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor) — use for `k8sattributes`, `resourcedetection`, `tail_sampling`, `transform`, `filter`, `routing` processor configs.
+- [opentelemetry-collector-contrib receivers](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver) — use for `kubeletstats`, `k8s_cluster`, `prometheus`, `filelog` receiver configs.
+- [opentelemetry-collector-contrib exporters](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter) — use for vendor exporters and queue/retry semantics.
+- [Sampling guide](https://opentelemetry.io/docs/concepts/sampling/) — use when designing tail sampling vs probabilistic sampling vs head sampling.
+- [Semantic conventions for Kubernetes](https://opentelemetry.io/docs/specs/semconv/resource/k8s/) — use for the canonical `k8s.*` attribute names that `k8sattributes` populates.
+- [Collector internal observability](https://opentelemetry.io/docs/collector/internal-telemetry/) — use for `otelcol_*` self-metrics that diagnose collector health.
+
+## Grounded insights worth carrying into the skill
+
+- The OpenTelemetry Operator manages `OpenTelemetryCollector` and `Instrumentation` CRs and supports four deployment modes: `deployment`, `statefulset`, `daemonset`, and `sidecar`. Each is appropriate for a different use case and the wrong mode silently produces incomplete or duplicate data.
+- A pipeline with **no exporter** is valid YAML and silently drops every span/metric/log. The collector emits an internal warning at startup but otherwise behaves as if data is being processed.
+- `memory_limiter` is the only protection against OOM under burst load. Without it, the collector consumes memory until the kernel kills the pod and loses everything in flight. It is recommended as the **first processor** in every pipeline.
+- `batch` is recommended **last before exporters** because batching drops in-flight individual signals into batched export calls. Without it, every span is a separate export, which destroys throughput at any meaningful volume.
+- `k8sattributes` enriches signals with Kubernetes object names. Without it, traces and metrics cannot be grouped by namespace/pod/deployment, breaking SLO dashboards and alerting. It requires RBAC: `pods/get,list,watch`, `namespaces/get,list,watch`, `replicasets/get,list,watch`.
+- `tail_sampling` is the most common production sampling mode because it samples on complete trace properties (root span attributes, total duration). The critical caveat: **changes are not retroactive** — already-collected windows do not re-sample, so a sampling change creates a discontinuity in observed trace counts.
+- `Instrumentation` CR removal is invisible to running pods; the next pod restart silently starts without auto-instrumentation. Many silent SLO regressions trace back to an `Instrumentation` CR being removed during a "cleanup".
+- The Target Allocator is required for any `mode: statefulset` Prometheus collector serving more than a handful of scrape targets. Without it, every replica scrapes every target and the data is duplicated.
+- Auto-instrumentation images are pinned per language (Java, Node.js, Python, .NET, Go). When the application's runtime version moves ahead of the instrumentation image, instrumentation can fail to load silently. Treat the auto-instrumentation image versions as a cataloged dependency.
+- The collector exposes its own metrics on `:8888/metrics`. The most useful Prometheus series for diagnosing pipeline health: `otelcol_exporter_send_failed_spans`, `otelcol_processor_dropped_spans`, `otelcol_receiver_refused_spans`, `otelcol_processor_batch_send_size`. Any non-zero value on the failure counters is a finding.
+- The `debug` exporter (formerly `logging` exporter) prints to the collector's stdout and is meant for development. It is a frequent silent failure mode in production when someone replaced a real exporter with `debug` for debugging and forgot to restore it.