@raishin/vanguard-frontier-agentic 1.3.0 → 1.5.0

package/skills/oci/oci-fusion-apps-environment-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-fusion-apps-environment-operator
 description: OCI Review Fusion Apps as a Service environment families, environments, lifecycle status, availability, and operational readiness. Use for Fusion environment inventory, status checks, change planning, and support evidence.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # OCI Fusion Apps Environment Operator

package/skills/oci/oci-goldengate-replication-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-goldengate-replication-operator
 description: OCI Operate and review Oracle GoldenGate domains, connections, extracts, replicats, checkpoint tables, trails, distribution paths, and replication health. Use for replication setup, lag triage, data movement, and cutover safety.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: data
 ---
 
 # OCI GoldenGate Replication Operator

package/skills/oci/oci-identity-access-governor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-identity-access-governor
 description: Govern OCI Identity and Access Management with least-privilege policy review, compartment scoping, group/dynamic-group analysis, and safe access-change workflows. Use for OCI IAM policy design, access audits, privilege reduction, identity troubleshooting, or destructive-access risk review.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: compliance
 ---
 
 # OCI Identity Access Governor

package/skills/oci/oci-iot-digital-twin-engineer/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-iot-digital-twin-engineer
 description: Design and operate OCI IoT digital twin adapters, models, instances, relationships, and domain context. Use for digital twin topology, lifecycle, integration, and safe model/relationship changes.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # OCI IoT Digital Twin Engineer

package/skills/oci/oci-limits-capacity-planner/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-limits-capacity-planner
 description: Review OCI service limits, quotas, capacity availability, regional subscriptions, and growth risk. Use before deployments, migrations, DR expansion, shape changes, OKE scaling, database scaling, or quota increase requests.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # OCI Limits Capacity Planner

package/skills/oci/oci-live-autonomous-db-lifecycle-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-autonomous-db-lifecycle-guard
 description: Guard Autonomous Database lifecycle changes — scale, start, stop, clone, terminate — with protection-tag enforcement, backup verification, and connection-string impact analysis before any mutation.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: data
 ---
 
 # OCI Live Autonomous DB Lifecycle Guard

package/skills/oci/oci-live-cost-budget-runaway-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-cost-budget-runaway-guard
 description: Gate OCI budget mutations and GPU/HPC shape provisioning against compartment spend limits, with inventory searches, quota audits, and emergency spend-stop playbooks.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: finops
 ---
 
 # OCI Live Cost Budget Runaway Guard

package/skills/oci/oci-live-iam-policy-compartment-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-iam-policy-compartment-guard
 description: Guard OCI IAM policy writes and dynamic group changes with verb-hierarchy audit, compartment scope enforcement, anti-pattern detection (any-user/any-group), and rollback via statement restore.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: security
 ---
 
 # OCI Live IAM Policy Compartment Guard

package/skills/oci/oci-live-network-security-rule-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-network-security-rule-guard
 description: Guard live OCI Security List and Network Security Group (NSG) rule changes with current-state capture, open-internet and sensitive-port detection, stateful/stateless assessment, and explicit approval before ingress or egress rule mutation. Use only when an intentional network rule change targets a confirmed VCN component.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: security
 ---
 
 # OCI Live Network Security Rule Guard

package/skills/oci/oci-live-oke-rollout-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-oke-rollout-guard
 description: Guard OKE deployment rollouts via DevOps Service approval stages with canary and blue-green evidence, rollout health verification, and kubectl rollout undo gates.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # OCI Live OKE Rollout Guard

package/skills/oci/oci-live-resource-manager-stack-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-resource-manager-stack-guard
 description: Guard OCI Resource Manager stack plan, apply, and destroy jobs with drift detection, state-version rollback, stack auto-lock awareness, and approval gates.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # OCI Live Resource Manager Stack Guard

package/skills/oci/oci-live-vault-key-destruction-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-live-vault-key-destruction-guard
 description: Guard Vault master encryption key scheduled-deletion and HSM rotation with data-association audits, key-usage reference checks, deletion-window enforcement, and cancellation playbooks.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: security
 ---
 
 # OCI Live Vault Key Destruction Guard

package/skills/oci/oci-load-balancer-traffic-engineer/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-load-balancer-traffic-engineer
 description: Design, review, and troubleshoot OCI Load Balancer and Network Load Balancer traffic paths, listeners, backend sets, certificates, health checks, logging, and failover. Use for L7/L4 traffic engineering and availability reviews.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: networking
 ---
 
 # OCI Load Balancer Traffic Engineer

package/skills/oci/oci-maestro/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-maestro
 description: OCI Maestro routing skill. Classify the user's OCI task, select the narrowest specialist agent or the right team of specialists from the catalog, and dispatch them — single specialist for focused tasks, parallel team for multi-domain tasks. Never auto-dispatch live-guard agents.
+allowed-tools: Agent Skill Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # OCI Maestro Routing Skill

package/skills/oci/oci-migration-cutover-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-migration-cutover-architect
 description: Plan OCI migrations and cutovers with Cloud Migrations, dependency discovery, waves, rollback, DNS, data sync, validation, and support readiness. Use for migration assessment, move groups, cutover runbooks, and go/no-go reviews.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # OCI Migration Cutover Architect

package/skills/oci/oci-multi-cloud-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-multi-cloud-architect
 description: Design and review OCI multi-cloud architectures connecting Oracle Cloud Infrastructure with AWS, Azure, Google Cloud, on-premises, or SaaS through VPN, FastConnect, Direct Connect, ExpressRoute, Cloud Interconnect, identity federation, DNS, routing, security, observability, and operating-model controls.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # OCI Multi-Cloud Architect

package/skills/oci/oci-mysql-heatwave-ai-specialist/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-mysql-heatwave-ai-specialist
 description: OCI Operate and review MySQL HeatWave, MySQL AI, vector/RAG workflows, connection configs, object storage ingestion, and SQL safety. Use for MySQL AI questions, HeatWave ML, vector store loading, and MySQL operational reviews.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # OCI MySQL HeatWave AI Specialist

package/skills/oci/oci-network-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-network-architect
 description: Design, review, and troubleshoot OCI networking with safe compartment/region scoping, least-privilege network access, VCN/subnet/routing/security-list/NSG analysis, and evidence-based MCP or CLI discovery.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: networking
 ---
 
 # OCI Network Architect

package/skills/oci/oci-observability-incident-responder/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-observability-incident-responder
 description: Operate as a ruthless OCI observability and incident responder for Monitoring alarms, Logging, Events, Notifications, service health, metrics, runbooks, and IAM-scoped incident response. Use when work touches OCI alarms, telemetry, alert triage, incident evidence, or response permissions.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # OCI Observability Incident Responder

package/skills/oci/oci-recovery-service-operator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-recovery-service-operator
 description: Operate OCI Recovery Service protected databases, protection policies, recovery service subnets, backup health, redo status, and recovery metrics. Use for database recovery posture, protected database health, and restore readiness.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: resilience
 ---
 
 # OCI Recovery Service Operator

package/skills/oci/oci-registry-artifact-governor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-registry-artifact-governor
 description: Govern OCI Registry repositories, container images, artifact access, retention, promotion, and deployment safety. Use for OCIR repository reviews, image lifecycle, DevOps/OKE integration, and least-privilege push/pull access.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: delivery
 ---
 
 # OCI Registry Artifact Governor

package/skills/oci/oci-resource-search-inventory-analyst/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-resource-search-inventory-analyst
 description: Build OCI resource inventories and dependency maps using Resource Search, compartments, tags, and cross-service discovery. Use for tenancy inventory, ownership gaps, orphan detection, migration scoping, and architecture evidence collection.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # OCI Resource Search Inventory Analyst

package/skills/oci/oci-security-compliance-reviewer/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-security-compliance-reviewer
 description: "Review Oracle Cloud Infrastructure security, IAM, network, logging, encryption, and compliance posture. Use when asked to audit OCI policies, compartments, tenancy security, Cloud Guard findings, buckets, vaults, security lists, NSGs, or least-privilege access; prepare compliance evidence; or challenge risky OCI admin assumptions before changes."
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: compliance
 ---
 
 # OCI Security Compliance Reviewer

package/skills/oci/oci-solution-architect/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-solution-architect
 description: Design, review, and stress-test Oracle Cloud Infrastructure solution architectures across identity, compartments, networking, compute, database, storage, observability, security, reliability, cost, and operations. Use when asked for OCI landing zones, target architectures, architecture review boards, migration designs, production readiness, or tradeoff decisions.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: platform
 ---
 
 # OCI Solution Architect

package/skills/oci/oci-storage-backup-steward/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-storage-backup-steward
 description: Operate as a ruthless OCI storage and backup steward for Object Storage, Block Volume, File Storage, backup policies, retention, replication, lifecycle rules, restore readiness, and IAM-scoped storage operations. Use when work touches OCI storage inventory, backup posture, recovery planning, or storage permissions.
+allowed-tools: Read Grep Glob
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: resilience
 ---
 
 # OCI Storage Backup Steward

package/skills/oci/oci-support-incident-coordinator/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oci-support-incident-coordinator
 description: Coordinate OCI support incidents with evidence quality, severity discipline, resource scope, timelines, and escalation readiness. Use for support tickets, incident evidence packs, Oracle SR preparation, and post-incident follow-up.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # OCI Support Incident Coordinator

package/skills/oci/oracle-oci-mcp-grounded-advisor/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: oracle-oci-mcp-grounded-advisor
 description: Use this skill when the user asks about Oracle MCP servers, SQLcl MCP, OCI MCP, Oracle Database agent access, OCI automation, or cloud/database advice that must be grounded in official Oracle sources.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: github: Raishin
   version: 0.1.0
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # Oracle and OCI MCP Grounded Advisor

package/skills/opentelemetry/opentelemetry-collector-config-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: opentelemetry-collector-config-review
 description: Use this skill for OpenTelemetry Operator review covering OpenTelemetryCollector deployment modes (Deployment, StatefulSet, DaemonSet, Sidecar), Instrumentation CR auto-instrumentation across Java/Node/Python/.NET/Go, Target Allocator for distributed Prometheus scraping, and pipeline correctness across receivers, processors, and exporters. Trigger when the user asks whether a collector configuration will lose telemetry, whether the right deployment mode is used, whether memory_limiter and batch are present, whether tail_sampling is safe to change, or whether auto-instrumentation will cover a workload after restart.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # OpenTelemetry Collector Config Review

package/skills/prometheus/prometheus-alerting-cardinality-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: prometheus-alerting-cardinality-review
 description: Use this skill when reviewing Prometheus or AlertManager configuration for cardinality, alerting correctness, scrape security, remote_write safety, or retention adequacy. Trigger when a user provides prometheus.yml, alertmanager.yml, recording rules YAML, alerting rules YAML, or asks whether their Prometheus setup is production-ready.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: observability
 ---
 
 # Prometheus Alerting and Cardinality Review

package/skills/sigstore/sigstore-cosign-supply-chain-review/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: sigstore-cosign-supply-chain-review
 description: Use this skill when reviewing Sigstore Cosign supply chain security for Kubernetes workloads. Trigger when the user asks whether images are properly signed, whether Kyverno imageVerify policy is correctly scoped, whether SLSA provenance attestations exist, whether SBOM attestations are present, whether keyless signing is in use, or whether Rekor transparency log posture is appropriate for private images.
+allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: security
 ---
 
 # Sigstore Cosign Supply Chain Review

package/skills/terraform/terraform-maestro/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: terraform-maestro
 description: Route Terraform and IaC tasks to the right specialist from the cross-cloud IaC catalog. Use when you do not already know the specific IaC specialist needed. Not for direct Terraform answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any live apply, destroy, or stack mutation.
+allowed-tools: Agent Skill Read Grep Glob
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: ai
 ---
 
 # Terraform Maestro — Routing Skill

package/skills/velero/velero-backup-restore-guard/SKILL.md

@@ -1,9 +1,12 @@
 ---
 name: velero-backup-restore-guard
 description: Use this skill when guarding Velero backup schedule changes, restore operations, BackupStorageLocation mutations, or volume snapshot configuration. Trigger on any request to run a velero restore, delete a Schedule, change a BSL default, or modify backup retention.
+allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
   version: "0.1.0"
+  updated: "2026-05-05"
+  category: resilience
 ---
 
 # Velero Backup/Restore Guard
@@ -17,7 +20,7 @@ Guard live Velero operations — restore execution, schedule deletion, BackupSto
 - Confirm cluster context (`kubectl config current-context`) and target namespace before any Velero operation — ambiguous context is a hard stop.
 - Capture current state of the target Backup, Schedule, or BSL (`velero backup describe <name> --details`, `kubectl get schedule <name> -o yaml`) before every write — Velero has no built-in undo.
 - For restore operations: require `includedNamespaces` to be explicitly scoped; a cluster-wide restore (`includedNamespaces: []`) requires explicit platform-team sign-off.
-- Recommend `velero restore create --dry-run` before every non-emergency restore; treat missing dry-run as a hard stop in non-emergency scenarios.
+- Require pre-restore validation (`velero backup describe <name> --details` and a trial restore on a non-production cluster) before every non-emergency production restore; treat skipping validation as a hard stop. **Velero has no `--dry-run` flag on `velero restore create`** — do not recommend one.
 - Block deleting a Schedule that is the only backup for a production namespace unless an alternative backup source is confirmed.
 - Block changing a BSL `default: true` without confirming no in-progress backups and reviewing the impact on all dependent Schedules.
 - Check pre-backup hook coverage on stateful workloads (PostgreSQL, MySQL, Kafka) — missing quiesce hooks mean inconsistent backups.
@@ -36,6 +39,6 @@ Load these only when needed:
 - Current state of the Backup/Schedule/BSL (evidence level)
 - Hard-stop assessment (is this a blocked operation?)
 - Explicit platform-team sign-off status
-- Recommended dry-run or safe-path command
+- Recommended validation step or safe-path command
 - Rollback posture
 - Post-operation verification steps

package/skills/velero/velero-backup-restore-guard/references/safety-checklist.md

@@ -8,7 +8,7 @@ Before executing any `velero restore create` command, confirm all 10 items. A si
 - [ ] **2. Namespace scope is explicit** — `includedNamespaces` lists one or more specific namespaces. Empty list (`[]`) = cluster-wide restore = requires explicit platform-team sign-off with ticket reference.
 - [ ] **3. Backup timestamp verified** — the backup name and creation timestamp have been confirmed as the correct recovery point. Do not restore from an older backup if a closer-in-time backup exists and is healthy.
 - [ ] **4. Backup phase is Completed** — `velero backup describe <name>` shows `Phase: Completed`. Do not restore from a `PartiallyFailed` or `Failed` backup without explicit acknowledgment of the incomplete scope.
-- [ ] **5. Dry-run executed and reviewed** — `velero restore create --dry-run` output has been reviewed for unexpected resource counts, namespace scope, and PV restore entries. (Exception: active P0 incident with explicit platform-team override.)
+- [ ] **5. Pre-restore validation executed** — `velero backup describe <name> --details` has been reviewed for resource counts, namespace scope, and PV entries; for material restores, a trial restore was first executed on a non-production cluster and inspected with `velero restore describe <name> --details` and `velero restore logs <name>`. **Velero has no `--dry-run` flag on `velero restore create`** — never substitute it. (Exception: active P0 incident with explicit platform-team override and ticket reference.)
 - [ ] **6. existingResourcePolicy reviewed** — if `existingResourcePolicy: update` is used, the approver understands this will overwrite live Secrets, ConfigMaps, RBAC objects, and ServiceAccounts in the target namespace.
 - [ ] **7. PV restore posture confirmed** — `restorePVs: true/false` intent is explicit. If false, stateful applications will start with empty persistent volumes.
 - [ ] **8. Current state captured** — target namespace resources have been exported (`kubectl get all,cm,secret,pvc -n <ns> -o yaml > pre-restore-state.yaml`) as a rollback artifact.

package/skills/velero/velero-backup-restore-guard/references/workflow-and-output.md

@@ -75,19 +75,28 @@ spec:
   restorePVs: true
 ```
 
-### Step 5 — Dry-run (mandatory in non-emergency scenarios)
+### Step 5 — Pre-restore validation (mandatory in non-emergency scenarios)
+
+> **Velero has no `--dry-run` flag on `velero restore create`.** Earlier guidance that suggested one was incorrect. Validate via `velero backup describe`, then trial-restore on a non-production cluster.
 
 ```bash
-velero restore create myapp-restore-dryrun \
+# 1. Inspect what the backup actually contains, including resource and PV counts
+velero backup describe myapp-backup-20260501 --details
+
+# 2. Trial-restore on a non-production cluster, then inspect the result
+velero restore create myapp-restore-trial \
   --from-backup myapp-backup-20260501 \
   --include-namespaces myapp-production \
-  --dry-run -o yaml
+  --wait
+velero restore describe myapp-restore-trial --details
+velero restore logs myapp-restore-trial
 ```
 
-Review the dry-run output for:
-- Unexpected resource counts (compare against last-known production state)
-- Resources that would be overwritten if `existingResourcePolicy: update`
-- Missing PV restore entries
+Review the validation output for:
+- Unexpected resource counts (compare `velero backup describe` against last-known production state).
+- Resources that would be overwritten if `existingResourcePolicy: update`.
+- Missing PV restore entries (check `restorePVs` and the volume snapshot list).
+- Any partially-failed items in the trial-restore logs.
 
 ### Step 6 — Sign-off gate
 
@@ -196,7 +205,7 @@ Return:
 2. **Hard-stop assessment** — is this operation blocked? List exact rule triggered.
 3. **Evidence level** — live evidence, documentation-based, or inference
 4. **Approval status** — confirmed sign-off or pending
-5. **Recommended command** — dry-run first, then execute
+5. **Recommended command** — `velero backup describe --details` and a trial restore on a non-production cluster first, then execute on production
 6. **Rollback posture** — saved state file, re-apply command
 7. **Verification steps** — post-restore pod health, resource counts, PV binding status
 8. **Open risks** — hook coverage gaps, snapshot TTL mismatches, BSL credential posture