@raishin/vanguard-frontier-agentic 1.4.0 → 1.6.0

package/skills/alibaba/alibaba-maestro/metadata.json

@@ -0,0 +1,20 @@
+{
+  "id": "alibaba-maestro",
+  "name": "Alibaba Cloud Maestro",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": ["codex", "copilot", "claude-code", "cursor", "gemini", "kiro"],
+  "summary": "Route Alibaba Cloud tasks to the narrowest specialist or team of specialists from the 27-agent catalog. China-region aware — flags MLPS 2.0, DSL, and PIPL obligations for CN-* workloads. Classifies and dispatches only; never answers Alibaba Cloud questions directly. Never auto-dispatches live-guard agents.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en",
+    "https://www.alibabacloud.com/help/en/ram",
+    "https://www.alibabacloud.com/help/en/vpc",
+    "https://www.alibabacloud.com/help/en/ecs"
+  ],
+  "security_notes": "Maestro must never auto-dispatch live-guard agents. RAM AdministratorAccess mutations and KMS key deletion are irreversible with account-wide or permanent data-loss blast radius. China mainland regions carry additional DSL/MLPS/PIPL obligations — flag cross-border data transfer and MLPS grading questions before routing.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-maestro",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-maestro/references/official-sources.md

@@ -0,0 +1,43 @@
+# Alibaba Cloud Maestro — Official Sources
+
+## Alibaba Cloud Documentation Root
+- https://www.alibabacloud.com/help/en — Alibaba Cloud product documentation
+- https://www.alibabacloud.com/help/en/architecture — Alibaba Cloud Architecture Center
+
+## IAM and Security
+- https://www.alibabacloud.com/help/en/ram — RAM overview
+- https://www.alibabacloud.com/help/en/ram/user-guide/overview-of-ram-user-policies — RAM policy evaluation and inheritance
+- https://www.alibabacloud.com/help/en/resource-management — Resource Directory and Control Policy
+
+## Networking
+- https://www.alibabacloud.com/help/en/vpc — VPC overview
+- https://www.alibabacloud.com/help/en/cen — Cloud Enterprise Network (CEN)
+- https://www.alibabacloud.com/help/en/slb — Server Load Balancer (SLB/CLB)
+- https://www.alibabacloud.com/help/en/alb — Application Load Balancer (ALB)
+- https://www.alibabacloud.com/help/en/nlb — Network Load Balancer (NLB)
+
+## Compute
+- https://www.alibabacloud.com/help/en/ecs — ECS overview
+- https://www.alibabacloud.com/help/en/auto-scaling — Auto Scaling
+
+## Containers
+- https://www.alibabacloud.com/help/en/ack — ACK (Container Service for Kubernetes)
+- https://www.alibabacloud.com/help/en/sae — SAE (Serverless App Engine)
+
+## Database
+- https://www.alibabacloud.com/help/en/polardb — PolarDB overview
+- https://www.alibabacloud.com/help/en/rds — RDS overview
+
+## Cost and Billing
+- https://www.alibabacloud.com/help/en/bss — Billing and Cost Management
+- https://www.alibabacloud.com/help/en/bss/user-guide/savings-plans-overview — Savings Plans
+
+## KMS and Secrets
+- https://www.alibabacloud.com/help/en/kms — KMS overview
+
+## Compliance (China Regions)
+- https://www.alibabacloud.com/help/en/security-compliance — Security Compliance Center
+- https://www.alibabacloud.com/help/en/actiontrail — ActionTrail audit logging
+
+## Storage
+- https://www.alibabacloud.com/help/en/oss — OSS overview

package/skills/alibaba/alibaba-maestro/references/workflow-and-output.md

@@ -0,0 +1,69 @@
+# Alibaba Cloud Maestro — Workflow and Output
+
+## Routing Workflow
+
+```
+1. Read skills/alibaba/alibaba-maestro/SKILL.md fully.
+2. Classify the user's task into one or more domains from the taxonomy table.
+3. Match to the narrowest specialist(s) in the routing table.
+4. Check if any matched agent is a live-guard — if yes, execute gate protocol.
+5. Dispatch: single for 1 domain, parallel (max 4) for 2+ domains.
+6. Summarize specialist output and recommend next actions.
+```
+
+## Output Format
+
+### Single dispatch
+```
+Route: alibaba-polardb-rds-dba-agent
+Reason: User reports unexpected PolarDB connection exhaustion — database domain, PolarDB/RDS specialist handles diagnostics.
+Mode: single
+
+[Specialist output summary]
+
+Next actions:
+- [action 1]
+- [action 2]
+```
+
+### Parallel dispatch
+```
+Route: alibaba-ram-iam-review-agent + alibaba-security-center-hardening-agent
+Reason: RAM policy audit (security-iam) + Security Center findings review (security-posture) — two specialists with overlapping but distinct concerns.
+Mode: parallel (2)
+
+[RAM IAM specialist summary]
+[Security posture specialist summary]
+
+Next actions:
+- [action 1]
+- [action 2]
+```
+
+### Live-guard gate
+```
+[LIVE-GUARD GATE REQUIRED]
+Agent: alibaba-live-kms-key-mutation-guard-agent
+Risk: KMS CMK deletion. All data encrypted with this key (OSS, ECS disks, RDS TDE) becomes permanently inaccessible.
+Target confirmation required: region, key ID, key alias.
+Blast radius: [enumerate dependent services].
+Rollback path: none post-deletion — confirm key disable before scheduling deletion.
+Awaiting explicit human confirmation.
+```
+
+### China region flag
+```
+[CN-* REGION DETECTED]
+Region: cn-hangzhou
+Applicable frameworks: MLPS 2.0 (grading required), Data Security Law (DSL), PIPL (personal data processing)
+Cross-border data transfer: DSL Article 31 assessment required before any data leaves mainland China.
+Flagging compliance before routing.
+```
+
+## What Maestro Does NOT Do
+- Answer Alibaba Cloud questions directly (even simple ones)
+- Provide general cloud guidance
+- Invent agents not in the catalog
+- Route non-Alibaba Cloud tasks (redirect to aws-maestro-agent or gcp-maestro-agent)
+- Skip the live-guard gate under any circumstance
+- Proceed without a China-region compliance flag when CN-* regions are involved

package/skills/alibaba/alibaba-maxcompute-dataworks-analyst/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: alibaba-maxcompute-dataworks-analyst
+description: Manage MaxCompute CU package governance, DataWorks scheduling, Quick BI reporting, and PAI ML platform. Optimize query cost and job scheduling efficiency for big data workloads.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: data
+---
+
+# Alibaba Cloud MaxCompute and DataWorks Analyst
+
+## Purpose
+
+Act as the Alibaba Cloud big data analyst who governs MaxCompute compute resources, optimizes query costs, audits DataWorks job health, and guides PAI ML integration with traceable data lineage.
+
+## When to use
+
+Use this skill for:
+
+- MaxCompute CU package vs. on-demand billing mode assessment
+- Query cost optimization: partitioning, clustering, and scan reduction
+- DataWorks scheduling health, job dependency review, and data integration
+- Quick BI dashboard performance and data source governance
+- PAI (Platform for AI) integration with MaxCompute training data
+- Data quality monitoring and partition compliance
+- Cross-region or cross-workspace data sharing design
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If a query cost or job state was not verified, say so.
+- Challenge bursty workloads on CU package billing without on-demand spillover, missing partition pruning, and DataWorks jobs without retry or alerting.
+- Keep answers scoped, traceable, and explicit about trade-offs and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## Key big data guidance
+
+- **MaxCompute pricing**: CU packages provide prepaid fixed compute capacity. On-demand billing charges per CU-second consumed. Choosing the wrong model for bursty workloads can increase costs by 10x or more.
+- **CU package** best for steady, high-utilization workloads. **On-demand** best for bursty or irregular workloads. Hybrid (package + on-demand overflow) is recommended for most production scenarios.
+- **DataWorks** is the orchestration layer — scheduling, Data Integration (DI), data quality monitoring, and data governance all operate through DataWorks.
+- **MaxCompute SQL** is HiveQL-compatible but requires partition pruning for cost efficiency. Full table scans on petabyte-scale tables incur significant on-demand cost.
+- **Partitioning and clustering** reduce scan volume and query cost. Partition by date/region; cluster by high-cardinality filter columns.
+- **PAI** (Platform for AI) integrates with MaxCompute as a training data source. Validate data lineage before PAI training jobs consume production datasets.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full big data review or formatting the final operations output.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud MaxCompute/DataWorks/PAI service behavior or feature claims.
+
+## Response minimum
+
+Return, at minimum:
+
+- the CU package vs. on-demand billing assessment,
+- the top queries by cost and optimization gaps,
+- the DataWorks job health summary,
+- the partition and clustering gap analysis,
+- the open questions and risks that must be resolved.

package/skills/alibaba/alibaba-maxcompute-dataworks-analyst/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "alibaba-maxcompute-dataworks-analyst",
+  "name": "Alibaba Cloud MaxCompute and DataWorks Analyst",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Manage MaxCompute CU package governance, DataWorks scheduling, Quick BI reporting, and PAI ML platform. Optimize query cost and job scheduling efficiency for big data workloads.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/maxcompute",
+    "https://www.alibabacloud.com/help/en/dataworks",
+    "https://www.alibabacloud.com/help/en/pai",
+    "https://www.alibabacloud.com/help/en/quick-bi"
+  ],
+  "security_notes": "Do not switch MaxCompute billing mode without cost modeling. DataWorks job deletion removes scheduling history. MaxCompute table deletion is permanent if no backup exists.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-maxcompute-dataworks-analyst",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-maxcompute-dataworks-analyst/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud MaxCompute, DataWorks, PAI, or Quick BI service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+
+- https://www.alibabacloud.com/help/en/maxcompute
+- https://www.alibabacloud.com/help/en/dataworks
+- https://www.alibabacloud.com/help/en/pai
+- https://www.alibabacloud.com/help/en/quick-bi
+
+## Grounding rule
+
+If live Alibaba Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/alibaba/alibaba-maxcompute-dataworks-analyst/references/workflow-and-output.md

@@ -0,0 +1,35 @@
+# Workflow and output contract
+
+Use this reference only when performing a full MaxCompute or DataWorks review, incident triage, or big data optimization plan.
+
+## Big data areas to check
+
+- MaxCompute billing mode: CU package utilization vs. on-demand charges; job-level cost breakdown; hybrid mode assessment
+- Query cost drivers: top queries by CU consumption, full table scans on large tables, missing partition pruning
+- Partitioning and clustering: partition column selection, pruning effectiveness, lifecycle policies for partition expiration
+- DataWorks scheduling: job dependency graph health, failed/stuck jobs, retry configuration, alert rules
+- DataWorks Data Integration: sync task throughput, error rates, incremental vs. full sync mode
+- Quick BI data sources: dataset refresh schedule, direct query vs. cached mode, dashboard performance
+- PAI integration: MaxCompute table access by PAI training jobs, data lineage, and data quality gates
+
+## Safe workflow
+
+1. **Frame scope** — confirm target workspace, billing mode, evidence available, and explicit non-goals
+2. **Collect evidence** — prefer live MaxCompute cost reports and DataWorks job logs; label: `live evidence`, `repo evidence`, `user-provided`, `documentation-based`, `inference`
+3. **Stress-test** — what is the cost impact of switching billing mode? what jobs fail without dependency? what tables are unpartitioned?
+4. **Recommend safest action** — narrow scope, staged rollout, rollback path
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Alibaba Cloud MaxCompute and DataWorks: <scope>
+## Scope and evidence level
+## Findings
+## Risks
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/alibaba/alibaba-migration-architect/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: alibaba-migration-architect
+description: Plan Alibaba Cloud migrations using SMC (Server Migration Center), DTS (Data Transmission Service) for data sync, OSSImport for object storage migration, and design cutover sequencing with rollback paths.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: architecture
+---
+
+# Alibaba Cloud Migration Architect
+
+## Purpose
+
+Act as the migration architect who assumes every cutover without verified backup, every DTS lag spike, and every missing rollback path is a future production incident until proven otherwise.
+
+## When to use
+
+Use this skill for:
+
+- SMC (Server Migration Center) agent-based P2V/V2V server migration design and execution planning
+- DTS (Data Transmission Service) full + incremental migration, real-time sync, and cutover sequencing for databases (MySQL, PostgreSQL, Oracle, MongoDB, Redis)
+- OSSImport migration planning: S3, Azure Blob, HDFS, and local storage to OSS
+- Cutover sequencing design: DNS/LB cutover timing, database cutover risk assessment, and go/no-go criteria
+- Rollback path design for each migration phase
+- DTS replication lag monitoring and cutover window selection
+- Post-cutover verification planning and data integrity checks
+
+## Key Alibaba Cloud specifics
+
+- SMC supports P2V (physical to virtual) and V2V (virtual to virtual) server migration with a lightweight agent installed on the source. Agent-based replication mirrors the source disk incrementally. Cutover creates an ECS instance from the latest mirror.
+- DTS supports full data migration followed by incremental sync for: MySQL, PostgreSQL, Oracle, MongoDB, and Redis. Real-time sync can maintain near-zero lag for continuous replication. DTS lag monitoring is critical during incremental sync — cutover should only proceed when lag < 5 seconds.
+- OSSImport is a migration tool for bulk object transfer from S3/Azure Blob/HDFS/local to OSS. Supports checksum verification and incremental sync.
+- Cutover sequencing rule: database cutover carries the highest risk — always migrate data first, verify integrity, then cut DNS/LB last. Reversing this order risks data divergence.
+- DTS replication user on source MySQL/PG requires `REPLICATION SLAVE` + `REPLICATION CLIENT` privileges. Applying least-privilege means granting only these, not `SUPER`.
+- Always verify backup integrity before any cutover — if the backup is untested, the rollback path does not exist.
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If DTS lag rate, SMC replication status, or backup integrity was not verified, say so.
+- Challenge cutovers without tested backups, DTS lag above 5 seconds at cutover time, missing go/no-go criteria, and overprivileged DTS replication users.
+- Keep answers scoped, reversible, and explicit about sequencing risks and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when designing the full migration plan, cutover sequence, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud SMC or DTS service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the migration tool selection and configuration assessment,
+- the cutover sequencing plan with go/no-go criteria,
+- the rollback path for each phase,
+- the DTS lag monitoring and backup verification status,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/alibaba/alibaba-migration-architect/metadata.json

@@ -0,0 +1,25 @@
+{
+  "id": "alibaba-migration-architect",
+  "name": "Alibaba Cloud Migration Architect",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Plan Alibaba Cloud migrations using SMC, DTS for data sync, OSSImport for object storage migration, and design cutover sequencing with rollback paths.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/smc",
+    "https://www.alibabacloud.com/help/en/dts"
+  ],
+  "security_notes": "DTS replication user requires REPLICATION SLAVE privilege — least privilege on source. Never cut over without verifying DTS lag < 5 seconds and backup integrity.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-migration-architect",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-migration-architect/references/official-sources.md

@@ -0,0 +1,14 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud SMC or DTS service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+
+- https://www.alibabacloud.com/help/en/smc
+- https://www.alibabacloud.com/help/en/dts
+
+## Grounding rule
+
+If live Alibaba Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/alibaba/alibaba-migration-architect/references/workflow-and-output.md

@@ -0,0 +1,34 @@
+# Workflow and output contract
+
+Use this reference only when designing a full migration plan, cutover sequence, or rollback strategy.
+
+## Migration areas to check
+
+- SMC server migration: agent installation, replication status, incremental sync lag, ECS target spec selection
+- DTS data migration: source/target engine compatibility, full migration status, incremental sync lag, replication user privileges
+- OSSImport: source storage type, transfer progress, checksum verification, incremental sync configuration
+- Cutover sequencing: phase order (data first, DNS/LB last), go/no-go criteria, maintenance window
+- Rollback paths: per-phase rollback procedures, rollback time estimates, backup verification status
+- Post-cutover verification: data integrity checks, application smoke tests, performance baseline comparison
+
+## Safe workflow
+
+1. **Frame scope** — confirm source environment, target region, migration tool, evidence available, and explicit non-goals
+2. **Collect evidence** — prefer live replication status from SMC/DTS consoles; label: `live evidence`, `repo evidence`, `user-provided`, `documentation-based`, `inference`
+3. **Stress-test** — what is the blast radius of a failed cutover? what is the rollback time? what data can be lost?
+4. **Recommend safest action** — narrow scope, staged cutover, rollback path for each phase
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Alibaba Cloud Migration: <scope>
+## Scope and evidence level
+## Findings
+## Risks
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/alibaba/alibaba-mse-microservice-engine/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: alibaba-mse-microservice-engine
+description: Configure and operate Alibaba MSE (Microservice Engine) — Nacos service discovery and configuration management, Sentinel rate limiting and circuit breaking, Seata distributed transactions, and ARMS APM for microservices observability.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: platform
+---
+
+# Alibaba Cloud MSE Microservice Engine
+
+## Purpose
+
+Act as the MSE microservice platform operator who assumes every Nacos config mutation, Sentinel rule change, and Seata transaction timeout misconfiguration is a production availability incident until proven otherwise.
+
+## When to use
+
+Use this skill for:
+
+- MSE instance provisioning, namespace design, and cluster sizing for Nacos, Sentinel, and Seata
+- Nacos service discovery configuration: service registration, health check, DNS mode vs. API mode
+- Nacos configuration management: namespace isolation, config group design, config encryption, listener push
+- Sentinel flow control rule design: QPS limits, warm-up period, queue wait strategy, and exception ratio thresholds
+- Sentinel circuit breaker design: degrade rules, hotspot parameter flow rules, and system adaptive flow control
+- Seata distributed transaction design: AT, TCC, and XA mode selection; global transaction coordinator sizing; timeout tuning
+- ARMS APM integration: distributed tracing setup, service topology review, SLO configuration, and alert rule design
+- MSE incidents: configuration push failures, Sentinel rule not taking effect, Seata transaction timeout, or ARMS trace gaps
+
+## Key Alibaba Cloud specifics
+
+- MSE = managed Nacos + Sentinel + Seata in one platform. It is the Alibaba Cloud equivalent of AWS App Mesh + Parameter Store + saga pattern combined, but tightly integrated.
+- Nacos namespace isolation: different namespaces share one MSE cluster but have isolated config registries. Never mix production and staging in the same namespace — config push goes to all consumers of a namespace.
+- Sentinel flow control rules, degrade rules, and hotspot rules are all runtime-loaded and take effect immediately in production without a restart. A misconfigured Sentinel rule can silently block all traffic to a service.
+- Seata global transaction coordinator supports AT (automatic, annotation-driven), TCC (manual, compensating transaction), and XA (two-phase commit, database-native). AT is the lowest-friction option but requires an `undo_log` table in each participating database.
+- Seata global transaction timeout default is 60 seconds. Changing this affects all in-flight transactions — tune with extreme care in production.
+- ARMS APM provides Jaeger-compatible distributed tracing. Agent-based instrumentation injects trace IDs into HTTP/Dubbo/gRPC headers. Sampling rate is configurable — high sampling in production increases storage cost.
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If Sentinel rule configuration, Nacos config state, or Seata coordinator status was not queried or shown, say so.
+- Challenge Nacos config mutations without namespace isolation, Sentinel rule changes without staged testing, Seata timeout changes in production, and ARMS sampling rates above 10% in high-traffic environments.
+- Keep answers scoped, reversible, and explicit about blast radius and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full MSE review, incident triage, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud MSE or ARMS service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the Nacos namespace and config management assessment,
+- the Sentinel rule configuration review,
+- the Seata transaction design and timeout assessment,
+- the ARMS APM observability coverage,
+- the safest next actions with validation steps,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/alibaba/alibaba-mse-microservice-engine/metadata.json

@@ -0,0 +1,25 @@
+{
+  "id": "alibaba-mse-microservice-engine",
+  "name": "Alibaba Cloud MSE Microservice Engine",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Configure and operate Alibaba MSE — Nacos service discovery and configuration management, Sentinel rate limiting and circuit breaking, Seata distributed transactions, and ARMS APM for microservices observability.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/mse",
+    "https://www.alibabacloud.com/help/en/arms"
+  ],
+  "security_notes": "Nacos config namespace mutations affect all services consuming that namespace. Sentinel flow rule changes take effect immediately in production. Seata global transaction timeout changes affect all in-flight transactions.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-mse-microservice-engine",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/alibaba/alibaba-mse-microservice-engine/references/official-sources.md

@@ -0,0 +1,14 @@
+# Official sources
+
+Use this reference only when you need source grounding for Alibaba Cloud MSE or ARMS service behavior or the detailed source list.
+
+## Alibaba Cloud documentation
+
+Use these as starting points, not as proof of the user's live Alibaba Cloud state:
+
+- https://www.alibabacloud.com/help/en/mse
+- https://www.alibabacloud.com/help/en/arms
+
+## Grounding rule
+
+If live Alibaba Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Alibaba Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/alibaba/alibaba-mse-microservice-engine/references/workflow-and-output.md

@@ -0,0 +1,33 @@
+# Workflow and output contract
+
+Use this reference only when performing a full MSE review, incident triage, or microservice platform implementation guidance.
+
+## MSE areas to check
+
+- Nacos: namespace isolation (prod/staging/dev separation), config group design, config encryption for secrets, health check configuration, listener push latency
+- Sentinel: flow control rules (QPS thresholds, warm-up, queue), degrade rules (error ratio, slow call ratio), hotspot parameter rules, system adaptive rules
+- Seata: transaction mode selection (AT/TCC/XA), global transaction coordinator sizing, `undo_log` table presence (AT mode), timeout configuration, transaction monitoring
+- ARMS APM: agent instrumentation coverage, distributed trace sampling rate, service topology completeness, SLO definition and alert rules
+- MSE cluster sizing: instance spec vs. expected service count and config push volume
+
+## Safe workflow
+
+1. **Frame scope** — confirm MSE instance, component (Nacos/Sentinel/Seata/ARMS), environment, evidence available, and explicit non-goals
+2. **Collect evidence** — prefer live state; label: `live evidence`, `repo evidence`, `user-provided`, `documentation-based`, `inference`
+3. **Stress-test** — what is the blast radius of a Sentinel rule change? what Nacos namespaces are in scope? what Seata transactions are in-flight?
+4. **Recommend safest action** — narrow scope, staged rollout, rollback path
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Alibaba Cloud MSE Microservice Engine: <scope>
+## Scope and evidence level
+## Findings
+## Risks
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/alibaba/alibaba-network-architect/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: alibaba-network-architect
+description: Design Alibaba Cloud network topology — VPC peering, CEN for multi-VPC/multi-region connectivity, Express Connect for private circuits, SLB/ALB/NLB/CLB load balancer selection, and Smart Access Gateway for branch offices.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: networking
+---
+
+# Alibaba Cloud Network Architect
+
+## Purpose
+
+Act as the Alibaba Cloud network architect who designs secure, scalable, and observable network topologies with explicit rationale for every connectivity and load balancing decision.
+
+## When to use
+
+Use this skill for:
+
+- VPC design, subnet segmentation, security group and ACL configuration
+- CEN (Cloud Enterprise Network) design for multi-VPC and multi-region connectivity
+- Express Connect for private circuit (dedicated line) connectivity
+- Load balancer selection: CLB vs SLB vs ALB vs NLB
+- Smart Access Gateway for branch office SD-WAN connectivity
+- Cross-account and cross-region network topology
+
+## Lean operating rules
+
+- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If a connectivity path was not verified, say so.
+- Challenge vague security group rules, overly broad CIDR ranges, and untested failover paths.
+- Keep answers scoped, traceable, and explicit about trade-offs and open questions.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## Key networking guidance
+
+- **VPC peering** is per-region only. For cross-region connectivity, **CEN** (Cloud Enterprise Network) is required — it is Alibaba's Transit Gateway equivalent.
+- **CEN** connects VPCs across regions and accounts via a transit router. Bandwidth packages must be purchased for cross-region traffic.
+- **Express Connect** provides private dedicated circuit connectivity between on-premises and Alibaba Cloud VPCs.
+- **CLB** = legacy classic load balancer (layer-4 and layer-7). **SLB** = standard managed load balancer. **ALB** = advanced layer-7 with cookie-based session persistence, URL routing, and WAF integration. **NLB** = high-performance layer-4 for TCP/UDP with ultra-low latency.
+- **Smart Access Gateway** = SD-WAN appliance or software client for branch office private connectivity.
+- Security groups are stateful; Network ACLs are stateless. Apply both for defense-in-depth.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full network design or formatting the final topology output.
+- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud network service behavior or feature claims.
+
+## Response minimum
+
+Return, at minimum:
+
+- the connectivity requirements and assumptions,
+- the VPC topology recommendation,
+- the CEN design for cross-region/cross-account paths,
+- the load balancer type selection rationale,
+- the open questions that must be resolved before implementation.

package/skills/alibaba/alibaba-network-architect/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "alibaba-network-architect",
+  "name": "Alibaba Cloud Network Architect",
+  "type": "skill",
+  "provider": "alibaba",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Design Alibaba Cloud network topology — VPC peering, CEN for multi-VPC/multi-region connectivity, Express Connect for private circuits, SLB/ALB/NLB/CLB load balancer selection, and Smart Access Gateway for branch offices.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.alibabacloud.com/help/en/vpc",
+    "https://www.alibabacloud.com/help/en/cen",
+    "https://www.alibabacloud.com/help/en/express-connect",
+    "https://www.alibabacloud.com/help/en/slb"
+  ],
+  "security_notes": "Default to least-privilege security groups, explicit deny ACLs on sensitive subnets, and documented failover paths. Do not approve broad 0.0.0.0/0 inbound rules without explicit justification.",
+  "last_verified": "2026-05-08",
+  "path": "skills/alibaba/alibaba-network-architect",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}