@raishin/vanguard-frontier-agentic 1.4.0 → 1.6.0

package/README.md

@@ -36,7 +36,8 @@
 
 This repo collects reusable **skills**, **agents**, **rules**, **MCP references**,
 and supporting assets for engineers working with AWS, Azure, OCI, GCP,
-Kubernetes, Terraform, cloud security, and compliance-heavy architecture.
+Alibaba Cloud, Huawei Cloud, Kubernetes, Terraform, cloud security,
+and compliance-heavy architecture.
 
 - 🧠 **Skills** = step-by-step workflows an AI assistant can follow.
 - 🤖 **Agents** = reusable expert roles for review, architecture, and operations.
@@ -86,16 +87,19 @@ npm install @raishin/vanguard-frontier-agentic@latest
 
 ## 🧠 Skills
 
-**138 skills** across AWS, Azure, OCI, Kubernetes, CNCF ecosystem, Terraform, and more.
+**286 skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, and more.
 
 | Domain             | Count | What they cover                                                                                   |
 | ------------------ | ----: | ------------------------------------------------------------------------------------------------- |
-| 🟧 AWS              |    43 | IAM, EKS, ECS, Lambda, RDS, S3, Cost, DevOps, Bedrock, Security, Live Guards                      |
-| 🟦 Azure            |    32 | AKS, App Service, ARM/Bicep, Key Vault, PIM, Cost, Entra ID, CosmosDB, Live Guards                |
-| 🟥 OCI              |    37 | ADB, OKE, IAM, Vault, Resource Manager, Cost, Networking, Live Guards                             |
-| ☸️ Kubernetes       |     5 | RBAC review, workload identity, PSA, live RBAC/admission/mesh/network/ArgoCD guards, maestro      |
+| 🟧 AWS              |    47 | IAM, EKS, ECS, Lambda, RDS, S3, Cost, DevOps, Bedrock, Security, WAF reviews, Live Guards         |
+| 🟥 OCI              |    41 | ADB, OKE, IAM, Vault, Resource Manager, Cost, Networking, WAF reviews, Live Guards                |
+| 🟩 GCP              |    51 | GKE, BigQuery, Vertex AI, Cloud Run, AlloyDB, Firebase, Gemini API, WAF reviews, Live Guards      |
+| 🟦 Azure            |    36 | AKS, App Service, ARM/Bicep, Key Vault, PIM, Cost, Entra ID, CosmosDB, WAF reviews, Live Guards   |
+| 🟠 Alibaba Cloud    |    43 | ACK, ECS, PolarDB, MaxCompute, RAM, OSS, MLPS 2.0, WAF reviews, Live Guards                       |
+| 🔴 Huawei Cloud     |    43 | CCE, GaussDB, ModelArts, DEW, SecMaster, OBS, MLPS 2.0, WAF reviews, Live Guards                  |
+| ☸️ Kubernetes       |    10 | RBAC review, workload identity, PSA, live RBAC/admission/mesh/network/ArgoCD guards, maestro      |
 | 🛡️ Kyverno          |     1 | ClusterPolicy/Policy, PolicyException, failureAction, background scan                             |
-| 🔄 Argo CD          |     1 | AppProject blast-radius, sync impersonation, RollingSync, sync-window                             |
+| 🔄 Argo CD          |     2 | AppProject blast-radius, sync impersonation, RollingSync, sync-window                             |
 | 🕸️ Istio            |     1 | Ambient mesh, ztunnel L4 vs waypoint L7, PeerAuthentication, mTLS posture                        |
 | 🐝 Cilium           |     1 | CiliumNetworkPolicy, ClusterMesh trust, 169.254.169.254 egress, WireGuard encryption              |
 | 📡 OpenTelemetry    |     1 | Collector pipeline, memory_limiter, receiver exposure, exporter cardinality, credential handling  |
@@ -105,6 +109,37 @@ npm install @raishin/vanguard-frontier-agentic@latest
 
 Live-guard skills enforce approval gates and rollback posture for irreversible operations:
 
+**🟧 AWS (5):**
+- `aws-live-deployment-guarded-operator` — approval-gated generic live deployment actions with account/region confirmation
+- `aws-live-iac-change-guard` — CloudFormation/SAM/CDK/Terraform change set + drift + rollback posture enforcement
+- `aws-live-pipeline-approval-operator` — CodePipeline approval gating with exact stage and approver scope
+- `aws-live-serverless-release-guard` — Lambda alias/canary/linear rollout with alarm + rollback required
+- `aws-live-ecs-rollout-guard` — ECS/Fargate deployment circuit breaker, health check evidence, rollback path
+
+**🟩 GCP (6):**
+- `gcp-live-gke-rollout-guard` — GKE deployment and node pool mutations, control-plane version gating
+- `gcp-live-iam-policy-change-guard` — IAM binding mutations, org policy changes, SA key creation — org-wide blast radius
+- `gcp-live-kms-key-destruction-guard` — Cloud KMS key version destruction — CMEK data permanently unrecoverable
+- `gcp-live-cost-budget-action-guard` — budget thresholds, CUD commitments, quota increases — financial authority gate
+- `gcp-live-bigquery-dataset-deletion-guard` — dataset deletion, table truncation, authorized view changes — irreversible data loss
+- `gcp-live-cloud-run-traffic-migration-guard` — Cloud Run revision traffic shifts, min-instances changes — production traffic blast radius
+
+**🟠 Alibaba Cloud (6):**
+- `alibaba-live-ack-rollout-guard` — ACK deployment mutations, node pool scaling, cluster version upgrades
+- `alibaba-live-ram-policy-change-guard` — RAM policy/role mutations — account-wide blast radius, privilege escalation risk
+- `alibaba-live-kms-key-mutation-guard` — KMS key deletion/disable — encrypted data permanently inaccessible
+- `alibaba-live-cost-budget-action-guard` — budget threshold changes, Savings Plan purchases, RI commitments — financial authority gate
+- `alibaba-live-oss-bucket-policy-guard` — OSS bucket ACL/policy changes — public exposure or China data-residency violation
+- `alibaba-live-rds-polardb-mutation-guard` — RDS/PolarDB instance deletion, spec downgrade, backup policy removal — data loss risk
+
+**🔴 Huawei Cloud (6):**
+- `huawei-live-cce-rollout-guard` — CCE deployment mutations, node pool upgrades, cluster version changes
+- `huawei-live-iam-policy-change-guard` — IAM policy/SCP mutations — account-wide blast radius, privilege escalation
+- `huawei-live-kms-key-destruction-guard` — DEW/KMS key deletion — CSMS secrets and DBSS-encrypted data permanently lost
+- `huawei-live-cost-budget-action-guard` — budget threshold changes, RI purchases, CUD commitments — financial authority gate
+- `huawei-live-obs-bucket-policy-guard` — OBS bucket ACL/policy changes — public exposure or data residency violation
+- `huawei-live-gaussdb-mutation-guard` — GaussDB/RDS instance deletion, spec downgrade, backup policy changes — data loss
+
 **🟦 Azure (7):**
 - `azure-live-aks-rollout-guard` — PDB audit, rollout pause/undo, post-rollout health
 - `azure-live-arm-deployment-stack-guard` — what-if evidence, denySettings, PIM-gated delete
@@ -135,6 +170,9 @@ Live-guard skills enforce approval gates and rollback posture for irreversible o
 - 🔐 [`skills/aws/aws-iam-least-privilege-review`](skills/aws/aws-iam-least-privilege-review/) — Review AWS IAM policies and reduce unnecessary access.
 - 🟦 [`skills/azure/azure-rbac-review`](skills/azure/azure-rbac-review/) — Review Azure RBAC assignments, scopes, and custom roles.
 - 🟥 [`skills/oci/oci-autonomous-database-architect`](skills/oci/oci-autonomous-database-architect/) — Design and review Oracle Autonomous Database across OCI and multicloud options.
+- 🟩 [`skills/gcp/gcp-gke-platform-operator`](skills/gcp/gcp-gke-platform-operator/) — GKE Standard/Autopilot design with Day-0/Day-1 decisions, Workload Identity, and AI inference quickstart.
+- 🟠 [`skills/alibaba/alibaba-china-compliance`](skills/alibaba/alibaba-china-compliance/) — MLPS 2.0, DSL, PIPL, and ICP filing compliance review for workloads in Alibaba Cloud China regions.
+- 🔴 [`skills/huawei/huawei-secmaster-security-operations`](skills/huawei/huawei-secmaster-security-operations/) — Huawei SecMaster SIEM/SOAR, HSS, CFW, WAF posture hardening and incident triage.
 - 💰 [`skills/finops/finops-cloud-price-advisor`](skills/finops/finops-cloud-price-advisor/) — Fetch live prices from AWS, Azure, and OCI public pricing APIs; estimate costs for live environments or prototypes.
 
 Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a skill.
@@ -143,16 +181,19 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 
 ## 🤖 Agents
 
-**141 agents** matching the skill catalog — each agent ships 7 harness adapters and a hardened permission model.
+**289 agents** matching the skill catalog — each agent ships 7 harness adapters and a hardened permission model.
 
 | Provider           | Count | Specialisations                                                                     |
 | ------------------ | ----: | ----------------------------------------------------------------------------------- |
-| 🟧 AWS              |    43 | advisory, execution, live-guard operators                                           |
-| 🟦 Azure            |    32 | advisory, live-guard operators                                                      |
-| 🟥 OCI              |    35 | advisory, live-guard operators                                                      |
-| ☸️ Kubernetes       |     9 | RBAC review, workload identity, PSA, 4 live-guard operators, maestro router         |
+| 🟧 AWS              |    47 | advisory, execution, live-guard operators                                           |
+| 🟥 OCI              |    39 | advisory, live-guard operators                                                      |
+| 🟩 GCP              |    51 | advisory, live-guard operators, maestro router                                      |
+| 🟦 Azure            |    36 | advisory, live-guard operators                                                      |
+| 🟠 Alibaba Cloud    |    43 | advisory, live-guard operators, maestro router                                      |
+| 🔴 Huawei Cloud     |    43 | advisory, live-guard operators, maestro router                                      |
+| ☸️ Kubernetes       |    15 | RBAC review, workload identity, PSA, 5 live-guard operators, maestro router         |
 | 🛡️ Kyverno          |     1 | Admission policy review                                                             |
-| 🔄 Argo CD          |     1 | GitOps review                                                                       |
+| 🔄 Argo CD          |     2 | GitOps review, live sync guard                                                      |
 | 🕸️ Istio            |     1 | Ambient mesh review                                                                 |
 | 🐝 Cilium           |     1 | Network policy review                                                               |
 | 📡 OpenTelemetry    |     1 | Collector config review                                                             |
@@ -166,17 +207,27 @@ Every agent ships:
 
 ```text
 agents/
-├── aws/              (43 agents)
-├── azure/            (32 agents)
-├── argocd/           (1 agent — GitOps review)
+├── aws/              (47 agents)
+├── alibaba/          (43 agents — advisory, live-guard operators, maestro)
+├── argocd/           (2 agents — GitOps review, live sync guard)
+├── azure/            (36 agents)
+├── backstage/        (1 agent — IDP scaffolder review)
+├── cert-manager/     (1 agent — PKI cert lifecycle review)
 ├── cilium/           (1 agent — network policy review)
+├── falco/            (1 agent — runtime threat detection)
 ├── finops/           (1 agent — cross-cloud price advisor)
+├── fluxcd/           (1 agent — GitOps Kustomization/HelmRelease review)
+├── gcp/              (51 agents — advisory, live-guard operators, maestro)
+├── huawei/           (43 agents — advisory, live-guard operators, maestro)
 ├── istio/            (1 agent — ambient mesh review)
-├── kubernetes/       (13 agents — RBAC, workload identity, PSA, pod-spec, ESO, Kubecost, live-guards, maestro)
+├── kubernetes/       (15 agents — RBAC, workload identity, PSA, pod-spec, ESO, Kubecost, live-guards, maestro)
 ├── kyverno/          (1 agent — admission policy review)
-├── oci/              (35 agents)
+├── oci/              (39 agents)
 ├── opentelemetry/    (1 agent — collector config review)
-└── terraform/        (2 agents)
+├── prometheus/       (1 agent — alerting and cardinality review)
+├── sigstore/         (1 agent — supply chain security)
+├── terraform/        (2 agents)
+└── velero/           (1 agent — backup and restore)
 ```
 
 Example:
@@ -211,7 +262,7 @@ Everything you can install, and exactly how to install it. One section, no hunti
 | `--role`       | see role table below                                  | pick one ↓                              | Install all agents for a job role                    |
 | `--agents`     | comma-separated agent IDs                             | pick one ↓                              | Install specific agents by ID                        |
 | `--all`        | —                                                     | pick one ↓                              | Install every agent for the platform                 |
-| `--provider`   | `aws` `azure` `oci` `kubernetes` `terraform` `finops` `kyverno` `argocd` `istio` `cilium` `opentelemetry` | ➕ optional | Narrow `--role` results to one provider |
+| `--provider`   | `aws` `azure` `oci` `gcp` `alibaba` `huawei` `kubernetes` `terraform` `finops` `kyverno` `argocd` `istio` `cilium` `opentelemetry` | ➕ optional | Narrow `--role` results to one provider |
 | `--repo`       | path                                                  | ➕ optional                              | Target repo root (defaults to current directory)     |
 | `--force`      | —                                                     | ➕ optional                              | Overwrite files that already exist                   |
 | `--list`       | —                                                     | 🔍 standalone                            | Print all agent IDs, providers, and names; then exit |
@@ -283,10 +334,13 @@ Use `--provider` with `--role` to narrow the install to one cloud.
 
 | `--provider` value  | Domain                                   | 🔢 Agents in catalog |
 | ------------------- | ---------------------------------------- | ------------------: |
-| `aws`               | 🟧 Amazon Web Services                    |                  44 |
-| `azure`             | 🟦 Microsoft Azure                        |                  33 |
-| `oci`               | 🟥 Oracle Cloud Infrastructure            |                  36 |
-| `kubernetes`        | ☸️ Kubernetes (cross-cloud)               |                  13 |
+| `aws`               | 🟧 Amazon Web Services                    |                  47 |
+| `azure`             | 🟦 Microsoft Azure                        |                  36 |
+| `oci`               | 🟥 Oracle Cloud Infrastructure            |                  39 |
+| `gcp`               | 🟩 Google Cloud Platform                  |                  51 |
+| `alibaba`           | 🟠 Alibaba Cloud                          |                  43 |
+| `huawei`            | 🔴 Huawei Cloud                           |                  43 |
+| `kubernetes`        | ☸️ Kubernetes (cross-cloud)               |                  15 |
 | `kyverno`           | 🛡️ Kyverno (admission policy)            |                   1 |
 | `argocd`            | 🔄 Argo CD + Argo Rollouts (GitOps)       |                   2 |
 | `istio`             | 🕸️ Istio (service mesh)                  |                   1 |
@@ -300,7 +354,7 @@ Use `--provider` with `--role` to narrow the install to one cloud.
 | `cert-manager`      | 🔐 cert-manager (PKI / cert lifecycle)    |                   1 |
 | `fluxcd`            | 🔄 FluxCD (GitOps)                        |                   1 |
 | `backstage`         | 🎭 Backstage (IDP / developer platform)   |                   1 |
-| `velero`            | 💾 Velero (backup + restore)              |                   0 |
+| `velero`            | 💾 Velero (backup + restore)              |                   1 |
 
 ```bash
 # 🟥 Install every OCI agent for a cloud-platform-engineer (OCI-only team)
@@ -671,8 +725,8 @@ See:
 ---
 
 ```text
-Skills  = workflows        🧠   138 across AWS · Azure · OCI · Kubernetes · CNCF · Terraform
-Agents  = expert roles     🤖   141 with 7 harness adapters each
+Skills  = workflows        🧠   286 across AWS · Azure · OCI · GCP · Alibaba · Huawei · Kubernetes · CNCF · Terraform
+Agents  = expert roles     🤖   289 with 7 harness adapters each
 Rules   = always-on        📏   harness-specific operating guidance
 MCP     = real connections 🔌   AWS · Azure · Oracle official servers
 Catalog = searchable index 🗂️   machine-readable, hash-verified

package/agents/README.md

@@ -4,44 +4,48 @@ Role definitions for repeatable review, architecture, operations, and bounded ex
 
 ## Provider catalog
 
-| Provider | Current status | Notes |
-| --- | --- | --- |
-| AWS | active | includes advisory, repo-write execution, and guarded live-AWS operator agents |
-| Azure | active | read-only role agents |
-| OCI | active | read-only role agents |
-| Terraform | active | generic IaC review |
-| GCP | reserved | no provider portfolio yet |
-| Multi-cloud | limited | generic architecture roles |
-| Security | limited | generic domain roles |
+| Provider | Current status | Agents | Notes |
+| --- | --- | ---: | --- |
+| 🟧 AWS | active | 47 | advisory, repo-write execution, and guarded live-AWS operator agents |
+| 🟥 OCI | active | 39 | advisory and guarded live-OCI operator agents |
+| 🟩 GCP | active | 39 | advisory, live-guard operators, maestro router |
+| 🟦 Azure | active | 36 | advisory and guarded live-Azure operator agents |
+| 🟠 Alibaba Cloud | active | 30 | advisory, live-guard operators, maestro router |
+| 🔴 Huawei Cloud | active | 30 | advisory, live-guard operators, maestro router |
+| ☸️ Kubernetes | active | 15 | RBAC, workload identity, PSA, live-guards, maestro |
+| 🟩 Terraform | active | 2 | generic IaC review |
+| 💰 Multi-cloud | limited | 1 | FinOps cross-cloud price advisor |
+| CNCF ecosystem | active | 14 | Kyverno, Argo CD, Istio, Cilium, OTEL, Prometheus, Falco, Sigstore, cert-manager, FluxCD, Backstage, Velero |
+
+## Agent tiers
 
-## AWS first: easy catalog
+All provider portfolios follow the same three-tier model:
 
-### AWS advisory agents
+### Advisory agents (read-only by default)
 
-Read-only by default. Use for review, diagnosis, planning, briefing, triage, and non-destructive coordination.
+Use for review, diagnosis, planning, briefing, triage, and non-destructive coordination. These never write to live cloud environments.
 
-### AWS execution agents
+### Execution agents (workspace-write)
 
-Workspace-write in Codex, but still non-destructive toward live AWS by default.
+Workspace-write in Codex but still non-destructive toward live cloud by default. Used for patching repo files — manifests, IaC, CI/CD configs, rollout definitions.
 
-| Agent | Type | Default access | Intended use |
-| --- | --- | --- | --- |
-| `aws-deployment-hotfix-operator-agent` | execution | workspace-write | rapid repo-side deployment corrections |
-| `aws-iac-patch-executor-agent` | execution | workspace-write | bounded IaC patching |
-| `aws-pipeline-fix-operator-agent` | execution | workspace-write | CI/CD config fixes |
-| `aws-serverless-rollout-corrector-agent` | execution | workspace-write | serverless rollout file corrections |
-| `aws-ecs-service-remediation-operator-agent` | execution | workspace-write | ECS/Fargate config remediation |
+| Agent | Provider | Primary use |
+| --- | --- | --- |
+| `aws-deployment-hotfix-operator-agent` | AWS | rapid repo-side deployment corrections |
+| `aws-iac-patch-executor-agent` | AWS | bounded IaC patching |
+| `aws-pipeline-fix-operator-agent` | AWS | CI/CD config fixes |
+| `aws-serverless-rollout-corrector-agent` | AWS | serverless rollout file corrections |
+| `aws-ecs-service-remediation-operator-agent` | AWS | ECS/Fargate config remediation |
 
-### AWS guarded live operators
+### Guarded live operators
 
-Workspace-write in Codex, but these roles are designed for repos or shells that may be connected to real AWS credentials or real deployment authority. They must confirm target identity, require explicit approval, prefer preview or dry-run evidence, and define rollback plus post-change verification before mutation.
+Workspace-write in Codex, but designed for repos or shells connected to real cloud credentials or deployment authority. They must confirm target identity, require explicit approval, prefer preview or dry-run evidence, and define rollback plus post-change verification before mutation.
 
-| Agent | Type | Default access | Intended use |
-| --- | --- | --- | --- |
-| `aws-live-deployment-guarded-operator-agent` | guarded-live | workspace-write | generic live deployment actions with approval gates |
-| `aws-live-iac-change-guard-agent` | guarded-live | workspace-write | live IaC preview and execution discipline |
-| `aws-live-pipeline-approval-operator-agent` | guarded-live | workspace-write | live pipeline approval and gated resume handling |
-| `aws-live-serverless-release-guard-agent` | guarded-live | workspace-write | live Lambda/serverless release actions |
-| `aws-live-ecs-rollout-guard-agent` | guarded-live | workspace-write | live ECS/Fargate rollout actions |
+See each provider's README for the full live-guard catalog:
 
-See `agents/aws/README.md` for the AWS-specific catalog.
+- [`agents/aws/README.md`](aws/README.md) — AWS live operators (5)
+- [`agents/gcp/README.md`](gcp/README.md) — GCP live operators (6)
+- [`agents/alibaba/README.md`](alibaba/README.md) — Alibaba Cloud live operators (6)
+- [`agents/huawei/README.md`](huawei/README.md) — Huawei Cloud live operators (6)
+- [`agents/azure/README.md`](azure/README.md) — Azure live operators (7)
+- [`agents/oci/README.md`](oci/README.md) — OCI live operators (7)

package/agents/alibaba/AGENTS.md

@@ -0,0 +1,54 @@
+# AGENTS.md
+
+## Purpose
+Store Alibaba Cloud marketplace agents with canonical identity and harness-specific variants.
+
+## Patterns
+- `agents/alibaba/<skill-id>-agent/AGENT.md` is the harness-neutral contract.
+- `agents/alibaba/<skill-id>-agent/harnesses/codex.toml` is the Codex native variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/copilot.agent.md` is the GitHub Copilot / VS Code variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/claude-code.agent.md` is the Claude Code Markdown-family variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/cursor.agent.md` is the Cursor Markdown-family variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/gemini.agent.md` is the Gemini CLI Markdown-family variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/kiro-ide.agent.md` and `harnesses/kiro-cli.agent.json` are the split Kiro variants; do not pretend IDE Markdown and CLI JSON are interchangeable.
+- `agents/alibaba/<skill-id>-agent/metadata.json` mirrors `catalog/agents.json`.
+
+## Alibaba Cloud Region and Compliance Notes
+
+Alibaba Cloud operates **China mainland regions** (CN-*) and **international regions** (AP-*, EU-*, US-*) as distinct environments with different regulatory obligations:
+
+- **China mainland regions** are subject to the PRC Cybersecurity Law, Data Security Law (DSL), Personal Information Protection Law (PIPL), and MLPS 2.0. Workloads here require ICP filing for internet-facing services and must meet MLPS 2.0 grading requirements.
+- **International regions** follow the laws of the jurisdiction in which the region operates (e.g., Singapore MAS TRM, Germany GDPR, US SOC 2). Cross-border data transfers between China and international regions are restricted by DSL Article 31.
+
+All agents serving China-based workloads must explicitly identify the target region and applicable regulatory framework before making recommendations.
+
+## RAM and Resource Directory Notes
+
+Alibaba Cloud identity has two levels that are frequently confused:
+- **Resource Directory (RD)**: The org-level account hierarchy (master account → member accounts). Control Policy (SCP equivalent) is applied at the RD level.
+- **RAM (Resource Access Management)**: Per-account IAM (users, groups, roles, policies, STS). RAM operates within a single account.
+
+Cross-account access uses RAM role assumption + STS tokens. RAM AdministratorAccess is the most dangerous RAM policy — widespread assignment is the #1 Alibaba Cloud security debt pattern.
+
+## Live Guard Agents
+
+Six live-guard agents enforce approval gates and rollback posture for high-risk Alibaba Cloud mutations.
+
+| Agent | Purpose | Skill |
+|-------|---------|-------|
+| [alibaba-live-ack-rollout-guard-agent](alibaba-live-ack-rollout-guard-agent/) | Gate ACK deployment mutations, node pool scaling, and cluster version upgrades against rollback posture | [alibaba-live-ack-rollout-guard](../../skills/alibaba/alibaba-live-ack-rollout-guard/) |
+| [alibaba-live-ram-policy-change-guard-agent](alibaba-live-ram-policy-change-guard-agent/) | Gate RAM policy and role mutations — account-wide blast radius, privilege escalation risk | [alibaba-live-ram-policy-change-guard](../../skills/alibaba/alibaba-live-ram-policy-change-guard/) |
+| [alibaba-live-kms-key-mutation-guard-agent](alibaba-live-kms-key-mutation-guard-agent/) | Gate KMS key deletion and disable operations — encrypted data becomes permanently inaccessible | [alibaba-live-kms-key-mutation-guard](../../skills/alibaba/alibaba-live-kms-key-mutation-guard/) |
+| [alibaba-live-cost-budget-action-guard-agent](alibaba-live-cost-budget-action-guard-agent/) | Gate budget threshold changes, Savings Plan purchases, and RI commitments — financial authority gate | [alibaba-live-cost-budget-action-guard](../../skills/alibaba/alibaba-live-cost-budget-action-guard/) |
+| [alibaba-live-oss-bucket-policy-guard-agent](alibaba-live-oss-bucket-policy-guard-agent/) | Gate OSS bucket ACL and policy changes — public exposure or access denial blast radius | [alibaba-live-oss-bucket-policy-guard](../../skills/alibaba/alibaba-live-oss-bucket-policy-guard/) |
+| [alibaba-live-rds-polardb-mutation-guard-agent](alibaba-live-rds-polardb-mutation-guard-agent/) | Gate RDS/PolarDB instance deletion, spec downgrades, and backup policy removal — data loss risk | [alibaba-live-rds-polardb-mutation-guard](../../skills/alibaba/alibaba-live-rds-polardb-mutation-guard/) |
+
+### Live guard permission model
+
+Alibaba Cloud RAM uses policy statements with Effect/Action/Resource/Condition structure similar to AWS IAM.
+
+- **RAM AdministratorAccess** is a system policy granting full account control — never auto-approved for any mutation.
+- **STS AssumeRole** tokens have maximum 12-hour TTL; live-guard agents must confirm the active STS token expiry before long-running operations.
+- **OSS bucket ACL = public-read or public-read-write** is irreversible in effect (data may be indexed by crawlers within seconds of exposure). Require explicit confirmation of public vs. private intent.
+- **PolarDB/RDS deletion** with backup retention disabled is permanent. Always confirm backup policy status before any instance deletion.
+- **China mainland OSS** cross-border data transfer requires data export compliance review under DSL Article 31 — flag before any replication configuration change.

package/agents/alibaba/README.md

@@ -0,0 +1,58 @@
+# 🟠 Alibaba Cloud Agents
+
+<p align="center">
+  <img src="../../assets/logos/cloud/alibaba/alibaba-cloud.svg" alt="Alibaba Cloud logo" width="140" />
+</p>
+
+Alibaba Cloud agent catalog for this marketplace. 😄
+
+## 🧱 Agent tiers
+
+| Tier | Purpose | Default access | Live Alibaba Cloud mutation |
+|---|---|---|---|
+| Role / advisory agents | Review, design, diagnose, coordinate | read-only | not allowed by default |
+| Guarded live operators | Work in repos or shells that may target real Alibaba Cloud environments | workspace-write | approval-gated and target-confirmed only |
+
+## 🚦 Guarded live-Alibaba Cloud operators
+
+| Agent | Primary use | Default live posture | Must refuse when |
+|---|---|---|---|
+| `alibaba-live-ack-rollout-guard-agent` | live ACK deployment mutations and node pool scaling | health signals + PDB audit + rollback required | cluster version upgrade or node pool deletion lacks preflight evidence |
+| `alibaba-live-ram-policy-change-guard-agent` | live RAM policy and role mutations | current policy snapshot + privilege-escalation check + approval required | account-wide policy change lacks dual approval or Resource Directory scope is unclear |
+| `alibaba-live-kms-key-mutation-guard-agent` | KMS key deletion and disable operations | key usage audit + rotation-vs-deletion separation + waiting period | key is actively used for envelope encryption and no backup key exists |
+| `alibaba-live-cost-budget-action-guard-agent` | live budget threshold changes and Savings Plan purchases | budget baseline + alert thresholds + RI/SP commitment review | budget action removes cost controls or Savings Plan purchase lacks financial approval |
+| `alibaba-live-oss-bucket-policy-guard-agent` | OSS bucket ACL and policy mutations | current ACL/policy capture + public-exposure check + MLPS 2.0 residency review | policy change would make bucket public or violate China data-residency requirements |
+| `alibaba-live-rds-polardb-mutation-guard-agent` | RDS and PolarDB instance deletion and spec changes | instance snapshot + backup policy check + downgrade impact review | instance deletion has no recent backup or spec downgrade breaches SLA |
+
+## 👀 Read-only advisory agents
+
+| Agent | Focus |
+|---|---|
+| `alibaba-maestro-agent` | classify and route Alibaba Cloud tasks; China-region aware |
+| `alibaba-ram-iam-review-agent` | RAM users/groups/roles/policies, STS token lifecycle, Resource Directory |
+| `alibaba-security-center-hardening-agent` | Security Center, WAF, Anti-DDoS Pro, Cloud Firewall posture hardening |
+| `alibaba-cost-finops-analyst-agent` | Cost Manager, Savings Plans, Reserved Instances, budget drift |
+| `alibaba-china-compliance-agent` | MLPS 2.0 Level 3, DSL, PIPL, ICP filing, data residency controls |
+| `alibaba-polardb-rds-dba-agent` | PolarDB MySQL/PG/Oracle, RDS, DAS autonomous, Global Database Network |
+| `alibaba-ack-container-platform-operator-agent` | ACK managed/dedicated/serverless, ACR, ASM Service Mesh |
+| `alibaba-resilience-bcdr-review-agent` | RDS/PolarDB/ACK/HBR BCDR designs, RTO/RPO, multi-AZ, runbook review |
+| `alibaba-iac-change-safety-review-agent` | Terraform/ROS blast radius, deletion protection, state drift, plan safety |
+| `alibaba-event-driven-architecture-review-agent` | EventBridge/MNS/RocketMQ/MSE dead-letter, ordering, idempotency, lag |
+| `alibaba-load-balancer-traffic-engineer-agent` | CLB/ALB/NLB/GA type selection, health checks, WAF integration, TLS policy |
+| `alibaba-serverless-production-readiness-agent` | FC3/SAE/EDAS VPC config, concurrency, cold-start, SLS log observability |
+| `alibaba-certificate-manager-issuer-review-agent` | SSL Certificate Manager lifecycle, SLB binding, renewal automation, expiry |
+| `alibaba-cost-anomaly-watch-coordinator-agent` | Cost Manager delta, MaxCompute CU anomalies, ECS spot cost, CDN/OSS spikes |
+| `alibaba-change-impact-advisor-agent` | pre-change blast radius: Resource Directory OU scope, CEN route propagation |
+| `alibaba-registry-artifact-governor-agent` | ACR Enterprise/Personal, image scanning, tag immutability, pull IAM review |
+| `alibaba-oss-data-perimeter-governor-agent` | OSS bucket ACL/BPA, WORM Object Lock, MLPS 2.0 compliance, public exposure |
+| `alibaba-ticket-triage-escalation-coordinator-agent` | P0/P1/P2/P3 triage, SLA enforcement, DingTalk war room coordination |
+| `alibaba-support-incident-coordinator-agent` | severity mapping 紧急/高/中/低, account manager escalation, evidence scrub |
+| `alibaba-daily-operations-briefing-coordinator-agent` | cost delta, ActionTrail anomalies, ACK health, quota warnings, Security Center |
+
+## 🛡️ Operating note
+
+- 😄 advisory agents stay read-only by default
+- 🚦 guarded live operators must confirm account ID, region (CN-* vs international), principal, approval, rollback, and verification before mutation
+- ⚠️ China mainland regions (cn-hangzhou, cn-beijing, etc.) and international regions have **separate billing accounts and different regulatory scope** — always confirm which context applies before any cost or compliance action
+- 🇨🇳 MLPS 2.0 Level 3 mandates specific Alibaba Cloud service configurations — `alibaba-china-compliance-agent` flags gaps; live guards check residency before OSS/KMS mutations
+- 🧾 all live-guard agents produce a structured verdict response — see [`docs/evidence-output-spec.md`](../../docs/evidence-output-spec.md)

package/agents/alibaba/alibaba-ack-container-platform-operator-agent/AGENT.md

@@ -0,0 +1,57 @@
+---
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# Alibaba Cloud ACK Container Platform Operator
+
+> Agent for `alibaba-ack-container-platform-operator`. Operate ACK (managed/dedicated/serverless Kubernetes), ACR (Container Registry) lifecycle, ASM (Service Mesh) traffic policies, Helm release management, and workload placement strategies.
+
+## Harness Variants
+
+- `harnesses/codex.toml` — Codex native agent configuration.
+- `harnesses/copilot.agent.md` — GitHub Copilot / VS Code custom agent definition.
+- `harnesses/claude-code.agent.md` — Claude Code Markdown-family adapter.
+- `harnesses/cursor.agent.md` — Cursor Markdown-family adapter.
+- `harnesses/gemini.agent.md` — Gemini CLI Markdown-family adapter.
+- `harnesses/kiro-ide.agent.md` — Kiro IDE Markdown-family adapter.
+- `harnesses/kiro-cli.agent.json` — Kiro CLI JSON adapter.
+
+## Canonical Contract
+
+# Alibaba Cloud ACK Container Platform Operator
+
+Use this canonical agent only for `alibaba-ack-container-platform-operator` work.
+
+## Required Skill
+
+Before answering, read and follow:
+
+- `skills/alibaba/alibaba-ack-container-platform-operator/SKILL.md`
+
+Load files under `skills/alibaba/alibaba-ack-container-platform-operator/references/` only when the task needs that reference. Do not dump reference text into the response.
+
+## Focus
+
+Operate ACK (managed/dedicated/serverless Kubernetes), ACR (Container Registry) lifecycle, ASM (Service Mesh) traffic policies, Helm release management, and workload placement strategies.
+
+## Operating Rules
+
+- Prefer official Alibaba Cloud documentation for grounding. If live Alibaba Cloud MCP tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to trusted Alibaba Cloud documentation and sanitized user evidence.
+- Treat the runtime-exposed tool inventory as truth. Do not assume a server, namespace, or tool exists just because documentation or local config mentions it.
+- Never ask for secrets, credentials, access tokens, session cookies, private keys, account IDs, customer identifiers, or environment-specific values unless already sanitized and required.
+- ACK cluster version upgrades are irreversible — always confirm the target version, change log impact, and rollback impossibility before recommending an upgrade.
+- Node pool scale-down may evict workloads — always verify PodDisruptionBudgets and drain strategy before recommending scale-down.
+- Production namespace mutations require explicit confirmation — always identify the blast radius across all workloads in the namespace.
+- ACK Serverless (ASK) has no node-level access — do not recommend node-level debugging commands (kubectl debug node, SSH) for ASK clusters.
+
+## Response Shape
+
+1. ACK cluster type, version, and node pool health
+2. ACR image repository and lifecycle policy
+3. ASM service mesh traffic policy and mTLS status
+4. Helm release inventory and drift assessment
+5. Workload placement and resource quota analysis
+6. Recommendations
+7. Open questions

package/agents/alibaba/alibaba-ack-container-platform-operator-agent/harnesses/claude-code.agent.md

@@ -0,0 +1,40 @@
+---
+name: "Alibaba Cloud ACK Container Platform Operator"
+description: "Operate ACK (managed/dedicated/serverless Kubernetes), ACR (Container Registry) lifecycle, ASM (Service Mesh) traffic policies, Helm release management, and workload placement strategies."
+---
+
+# Alibaba Cloud ACK Container Platform Operator
+
+Use this agent only for `alibaba-ack-container-platform-operator` work.
+
+## Required Skill
+
+Before answering, read and follow:
+
+- `skills/alibaba/alibaba-ack-container-platform-operator/SKILL.md`
+
+Load files under `skills/alibaba/alibaba-ack-container-platform-operator/references/` only when the task needs that reference. Do not dump reference text into the response.
+
+## Focus
+
+Operate ACK (managed/dedicated/serverless Kubernetes), ACR (Container Registry) lifecycle, ASM (Service Mesh) traffic policies, Helm release management, and workload placement strategies.
+
+## Operating Rules
+
+- Prefer official Alibaba Cloud documentation for grounding. If live Alibaba Cloud MCP tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to trusted Alibaba Cloud documentation and sanitized user evidence.
+- Treat the runtime-exposed tool inventory as truth. Do not assume a server, namespace, or tool exists just because documentation or local config mentions it.
+- Never ask for secrets, credentials, access tokens, session cookies, private keys, account IDs, customer identifiers, or environment-specific values unless already sanitized and required.
+- ACK cluster version upgrades are irreversible — always confirm the target version, change log impact, and rollback impossibility before recommending an upgrade.
+- Node pool scale-down may evict workloads — always verify PodDisruptionBudgets and drain strategy before recommending scale-down.
+- Production namespace mutations require explicit confirmation — always identify the blast radius across all workloads in the namespace.
+- ACK Serverless (ASK) has no node-level access — do not recommend node-level debugging commands (kubectl debug node, SSH) for ASK clusters.
+
+## Response Shape
+
+1. ACK cluster type, version, and node pool health
+2. ACR image repository and lifecycle policy
+3. ASM service mesh traffic policy and mTLS status
+4. Helm release inventory and drift assessment
+5. Workload placement and resource quota analysis
+6. Recommendations
+7. Open questions

package/agents/alibaba/alibaba-ack-container-platform-operator-agent/harnesses/codex.toml

@@ -0,0 +1,35 @@
+name = "alibaba_ack_container_platform_operator_agent"
+description = "Specialized subagent for alibaba-ack-container-platform-operator. Operate ACK (managed/dedicated/serverless Kubernetes), ACR (Container Registry) lifecycle, ASM (Service Mesh) traffic policies, Helm release management, and workload placement strategies."
+model = "gpt-5.4"
+model_reasoning_effort = "high"
+sandbox_mode = "read-only"
+
+developer_instructions = """
+Load and follow the bound `alibaba-ack-container-platform-operator` skill first. This agent exists only for that Alibaba Cloud role; do not drift into generic cloud advice.
+
+Token discipline:
+- Read only SKILL.md first; load references only when the task requires them.
+- Keep answers compact: verdict, evidence level, blockers, safe next actions, open questions.
+- Do not paste long docs, raw tool inventories, or command help unless requested.
+
+Role focus: Operate ACK (managed/dedicated/serverless Kubernetes), ACR Container Registry lifecycle, ASM Service Mesh traffic policies, Helm release management, and workload placement strategies.
+
+Safety contract:
+- Prefer official Alibaba Cloud documentation for grounding. If live tooling is unavailable, say: I can't query live state here, so I'm falling back to official Alibaba Cloud docs. Then fall back to trusted Alibaba Cloud documentation and sanitized user evidence.
+- Treat the runtime-exposed tool inventory as truth. Do not invent a server, namespace, or tool from documentation or local config alone.
+- Never ask for secrets, credentials, access tokens, account IDs, customer identifiers, private keys, or environment-specific values unless already sanitized and required.
+- Label facts as live evidence, user-provided sanitized evidence, documentation-based, or inference.
+- ACK cluster version upgrades are irreversible — always confirm the target version, change log impact, and rollback impossibility.
+- Node pool scale-down may evict workloads — verify PodDisruptionBudgets and drain strategy first.
+- Production namespace mutations require explicit confirmation.
+- ACK Serverless (ASK) has no node-level access — do not recommend node-level debugging commands for ASK clusters.
+- Use read-only discovery first and require explicit approval before mutation or cost-changing actions.
+
+"""
+
+[[skills.config]]
+path = "skills/alibaba/alibaba-ack-container-platform-operator/SKILL.md"
+enabled = true
+
+[metadata]
+author = "github: Raishin"

package/agents/alibaba/alibaba-ack-container-platform-operator-agent/harnesses/copilot.agent.md

@@ -0,0 +1,40 @@
+---
+name: "Alibaba Cloud ACK Container Platform Operator"
+description: "Operate ACK (managed/dedicated/serverless Kubernetes), ACR (Container Registry) lifecycle, ASM (Service Mesh) traffic policies, Helm release management, and workload placement strategies."
+---
+
+# Alibaba Cloud ACK Container Platform Operator
+
+Use this agent only for `alibaba-ack-container-platform-operator` work.
+
+## Required Skill
+
+Before answering, read and follow:
+
+- `skills/alibaba/alibaba-ack-container-platform-operator/SKILL.md`
+
+Load files under `skills/alibaba/alibaba-ack-container-platform-operator/references/` only when the task needs that reference. Do not dump reference text into the response.
+
+## Focus
+
+Operate ACK (managed/dedicated/serverless Kubernetes), ACR (Container Registry) lifecycle, ASM (Service Mesh) traffic policies, Helm release management, and workload placement strategies.
+
+## Operating Rules
+
+- Prefer official Alibaba Cloud documentation for grounding. If live Alibaba Cloud MCP tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to trusted Alibaba Cloud documentation and sanitized user evidence.
+- Treat the runtime-exposed tool inventory as truth. Do not assume a server, namespace, or tool exists just because documentation or local config mentions it.
+- Never ask for secrets, credentials, access tokens, session cookies, private keys, account IDs, customer identifiers, or environment-specific values unless already sanitized and required.
+- ACK cluster version upgrades are irreversible — always confirm the target version, change log impact, and rollback impossibility before recommending an upgrade.
+- Node pool scale-down may evict workloads — always verify PodDisruptionBudgets and drain strategy before recommending scale-down.
+- Production namespace mutations require explicit confirmation — always identify the blast radius across all workloads in the namespace.
+- ACK Serverless (ASK) has no node-level access — do not recommend node-level debugging commands (kubectl debug node, SSH) for ASK clusters.
+
+## Response Shape
+
+1. ACK cluster type, version, and node pool health
+2. ACR image repository and lifecycle policy
+3. ASM service mesh traffic policy and mTLS status
+4. Helm release inventory and drift assessment
+5. Workload placement and resource quota analysis
+6. Recommendations
+7. Open questions

package/agents/alibaba/alibaba-ack-container-platform-operator-agent/harnesses/cursor.agent.md

@@ -0,0 +1,40 @@
+---
+name: "Alibaba Cloud ACK Container Platform Operator"
+description: "Operate ACK (managed/dedicated/serverless Kubernetes), ACR (Container Registry) lifecycle, ASM (Service Mesh) traffic policies, Helm release management, and workload placement strategies."
+---
+
+# Alibaba Cloud ACK Container Platform Operator
+
+Use this agent only for `alibaba-ack-container-platform-operator` work.
+
+## Required Skill
+
+Before answering, read and follow:
+
+- `skills/alibaba/alibaba-ack-container-platform-operator/SKILL.md`
+
+Load files under `skills/alibaba/alibaba-ack-container-platform-operator/references/` only when the task needs that reference. Do not dump reference text into the response.
+
+## Focus
+
+Operate ACK (managed/dedicated/serverless Kubernetes), ACR (Container Registry) lifecycle, ASM (Service Mesh) traffic policies, Helm release management, and workload placement strategies.
+
+## Operating Rules
+
+- Prefer official Alibaba Cloud documentation for grounding. If live Alibaba Cloud MCP tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to trusted Alibaba Cloud documentation and sanitized user evidence.
+- Treat the runtime-exposed tool inventory as truth. Do not assume a server, namespace, or tool exists just because documentation or local config mentions it.
+- Never ask for secrets, credentials, access tokens, session cookies, private keys, account IDs, customer identifiers, or environment-specific values unless already sanitized and required.
+- ACK cluster version upgrades are irreversible — always confirm the target version, change log impact, and rollback impossibility before recommending an upgrade.
+- Node pool scale-down may evict workloads — always verify PodDisruptionBudgets and drain strategy before recommending scale-down.
+- Production namespace mutations require explicit confirmation — always identify the blast radius across all workloads in the namespace.
+- ACK Serverless (ASK) has no node-level access — do not recommend node-level debugging commands (kubectl debug node, SSH) for ASK clusters.
+
+## Response Shape
+
+1. ACK cluster type, version, and node pool health
+2. ACR image repository and lifecycle policy
+3. ASM service mesh traffic policy and mTLS status
+4. Helm release inventory and drift assessment
+5. Workload placement and resource quota analysis
+6. Recommendations
+7. Open questions