@raishin/vanguard-frontier-agentic 1.4.0 → 1.6.0

package/skills/gcp/gcp-migration-cutover-architect/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "gcp-migration-cutover-architect",
+  "name": "GCP Migration Cutover Architect",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Plan and execute migrations to GCP using Migrate to Virtual Machines, Database Migration Service, Storage Transfer Service, and design cutover sequencing with rollback plans.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/migrate/virtual-machines/docs/5.0/overview",
+    "https://cloud.google.com/database-migration/docs/overview",
+    "https://cloud.google.com/storage-transfer/docs/overview"
+  ],
+  "security_notes": "Keep the original source available for minimum 30 days post-cutover. DNS TTL must be reduced to 60s at least 24-48h before cutover. Reverting DNS is faster than reverting data. DMS continuous replication must be validated before the cutover window begins.",
+  "last_verified": "2026-05-08",
+  "path": "skills/gcp/gcp-migration-cutover-architect",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/gcp/gcp-migration-cutover-architect/references/official-sources.md

@@ -0,0 +1,18 @@
+# Official sources
+
+Use this reference only when you need source grounding for GCP migration service behavior or the detailed source list.
+
+## Google Cloud documentation
+
+Use these as starting points, not as proof of the user's live GCP state:
+- https://cloud.google.com/migrate/virtual-machines/docs/5.0/overview
+- https://cloud.google.com/database-migration/docs/overview
+- https://cloud.google.com/storage-transfer/docs/overview
+- https://cloud.google.com/bigquery-transfer/docs/introduction
+- https://cloud.google.com/migrate/virtual-machines/docs/5.0/before-you-begin
+- https://cloud.google.com/database-migration/docs/mysql/quickstart
+- https://cloud.google.com/database-migration/docs/postgres/quickstart
+
+## Grounding rule
+
+Official documentation explains GCP migration service behavior. It does not prove the user's current replication state, DMS lag, cutover readiness, or source environment configuration. Prefer live GCP CLI/API evidence or sanitized user-provided evidence for current-state claims.

package/skills/gcp/gcp-migration-cutover-architect/references/workflow-and-output.md

@@ -0,0 +1,60 @@
+# Workflow and output contract
+
+Use this reference only when performing the full migration plan, cutover review, implementation guidance, or go/no-go assessment.
+
+## Review domains
+
+Check these areas before giving a verdict:
+- Migration scope: source environment type (VMware/AWS/Azure/physical), workload count, data volume
+- Tool selection: Migrate to VMs (compute), DMS (database), Storage Transfer (bulk data) — confirm correct tool per workload type
+- DMS replication: CDC lag, replication state, last checkpoint, validation query results
+- Cutover sequence: lowest-risk workloads first, dependency mapping, timing windows
+- Rollback: original source still running, DNS TTL reduced, rollback trigger criteria defined
+- Data validation: row count comparison, checksum validation, application smoke tests
+- DNS: TTL reduced to 60s at least 24-48h before cutover; revert DNS is the first rollback step
+
+## Safe workflow
+
+1. **Frame scope**
+   - Source environment and target GCP environment:
+   - Business criticality and owner:
+   - Data classification and compliance driver:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live GCP CLI/API and DMS/MigrateOps read-only evidence if available.
+   - Otherwise inspect source environment documentation, sanitized user evidence, or official Google Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What is the rollback procedure if cutover fails at each step?
+   - What data validation checks confirm replication fidelity?
+   - What dependencies are not yet mapped?
+   - What evidence is missing to approve cutover?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# GCP Migration Cutover Architect: <scope>
+## Executive verdict
+- Status: GO / GO WITH CONDITIONS / NO-GO / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Validation
+- Commands or checks:
+- Expected result:
+## Residual risk
+- <risk or explicit none>
+```

package/skills/gcp/gcp-network-architect/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: gcp-network-architect
+description: Design and review GCP network architecture including global VPC topology, Shared VPC patterns, Cloud Interconnect/VPN hybrid connectivity, Cloud NAT, DNS, Cloud Armor, and Traffic Director service mesh.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: networking
+---
+
+# GCP Network Architect
+
+## Purpose
+
+Act as a rigorous GCP network architect. Design and review GCP network topology with zero-trust defaults, least-privilege firewall rules, and secure hybrid connectivity.
+
+## When to use
+
+Use this skill for:
+
+- GCP VPC design, subnet planning, and IP address management
+- Shared VPC host/service project pattern implementation
+- Cloud Interconnect (Dedicated or Partner) and Cloud VPN design
+- Cloud NAT, Private Google Access, and DNS architecture
+- Cloud Armor WAF rules, DDoS protection, and firewall policy design
+- Traffic Director service mesh planning
+
+## Key GCP networking specifics
+
+- GCP VPCs are GLOBAL — subnets are regional but a single VPC spans all GCP regions. This is fundamentally different from AWS (per-region VPC).
+- Shared VPC: Host project owns the VPC; service projects use it. IAM roles at subnet level (roles/compute.networkUser) control which service project can use which subnet.
+- Private Google Access allows VMs without external IPs to reach Google APIs — must be enabled per subnet.
+- Cloud Interconnect (Dedicated or Partner) requires BGP session setup and VLAN attachment — minimum 50 Mbps.
+- Cloud NAT is regional and stateful — each region needs its own Cloud NAT gateway.
+- Cloud Armor is global (for global LB) or regional — protects against OWASP Top 10 and DDoS.
+
+## Lean operating rules
+
+- Prefer official GCP documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad firewall rules, public IP exposure, shared VPC misconfigurations, and missing Private Google Access.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding GCP networking behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks or control gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/gcp/gcp-network-architect/metadata.json

@@ -0,0 +1,28 @@
+{
+  "id": "gcp-network-architect",
+  "name": "GCP Network Architect",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Design GCP network architecture including global VPC topology, Shared VPC host/service project patterns, Cloud Interconnect/VPN connectivity, Cloud NAT, DNS architecture, Cloud Armor WAF/DDoS, and Traffic Director service mesh.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/vpc/docs/vpc",
+    "https://cloud.google.com/vpc/docs/shared-vpc",
+    "https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview",
+    "https://cloud.google.com/nat/docs/overview",
+    "https://cloud.google.com/armor/docs/cloud-armor-overview"
+  ],
+  "security_notes": "GCP VPCs are global — a single VPC spans all regions. Shared VPC IAM roles at subnet level control service project access. Never expose internal services through public IP without Cloud Armor or equivalent WAF protection.",
+  "last_verified": "2026-05-08",
+  "path": "skills/gcp/gcp-network-architect",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/gcp/gcp-network-architect/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference only when you need source grounding for GCP networking behavior or the detailed source list.
+
+## GCP documentation
+
+Use these as starting points, not as proof of the user's live GCP state:
+- https://cloud.google.com/vpc/docs/vpc
+- https://cloud.google.com/vpc/docs/shared-vpc
+- https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview
+- https://cloud.google.com/nat/docs/overview
+- https://cloud.google.com/armor/docs/cloud-armor-overview
+
+## Grounding rule
+
+Official documentation explains GCP networking behavior. It does not prove the user's current VPC configuration, firewall rules, BGP session state, quota, pricing, or operational state. Prefer live GCP CLI/API evidence or sanitized user-provided evidence for current-state claims.

package/skills/gcp/gcp-network-architect/references/workflow-and-output.md

@@ -0,0 +1,61 @@
+# Workflow and output contract
+
+Use this reference only when performing the full review, implementation guidance, or production-readiness pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+- Connectivity requirements (on-premises, multi-cloud, internet ingress/egress)
+- VPC design (global topology, subnet CIDR planning, secondary ranges for GKE)
+- Shared VPC configuration (host project, service projects, subnet IAM)
+- Hybrid connectivity (Cloud Interconnect type, Cloud VPN tunnels, BGP sessions)
+- DNS architecture (Cloud DNS zones, Private Google Access, DNS peering)
+- NAT design (Cloud NAT per region, port allocation)
+- Security perimeter (Cloud Armor policies, VPC firewall rules, firewall policies, hierarchical firewall policies)
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload/project/region/environment:
+   - Connectivity requirements (on-prem bandwidth, latency SLA):
+   - Data classification and compliance driver:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live GCP CLI/API read-only evidence if available.
+   - Otherwise inspect repository IaC/config, sanitized user evidence, or official GCP docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What firewall rules allow overly broad access?
+   - What resources have external IPs that should be private?
+   - What subnets lack Private Google Access?
+   - What regions lack Cloud NAT where required?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# GCP Network Architect: <scope>
+## Executive verdict
+- Status: READY / READY WITH RISKS / NOT READY / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Validation
+- Commands or checks:
+- Expected result:
+## Residual risk
+- <risk or explicit none>
+```

package/skills/gcp/gcp-networking-observability/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: gcp-networking-observability
+description: "Investigate GCP network issues by analyzing VPC Flow Logs, firewall logs, Cloud NAT logs, threat logs, and networking metrics. Diagnose connectivity, packet loss, top talkers, and firewall block events using BigQuery-first methodology and Cloud Monitoring fallback. Use when investigating VPC traffic anomalies, firewall DENY events, NAT port exhaustion, latency spikes, or running Connectivity Tests for path diagnostics."
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: observability
+---
+
+# GCP Networking Observability
+
+## Core Directive: Results First
+
+1. Identify the primary source (VPC Flow, firewall, NAT, threat, metrics)
+2. Execute minimum required query; present direct answer
+3. Once primary source answers the question — STOP and report
+
+## Log & Telemetry Sources
+
+- **Threat Logs**: Cloud Firewall Plus / Cloud IDS — malicious traffic, SQL injection, malware signatures
+- **VPC Flow Logs**: sampled IP traffic to/from NICs — volume trends, top talkers
+- **Firewall Logs**: connection attempts matched by rules — DENY/ALLOW verification
+- **Cloud NAT Logs**: NAT translations — audit, port exhaustion diagnosis
+- **Networking Metrics**: time-series throughput, RTT, packet loss via Cloud Monitoring
+- **Connectivity Tests**: static path analysis — firewall and routing misconfiguration
+
+## Procedures
+
+1. **Log source preference**: ALWAYS check BigQuery linked datasets (`_AllLogs`) before Cloud Logging for high-volume/aggregation. For metadata NULL issue: if VM name returns nothing, retry with `src_ip` (EXCLUDE_ALL_METADATA scenario).
+2. **Tool selection**: MCP servers first (Cloud Monitoring MCP, BigQuery MCP, Cloud Logging MCP), then gcloud/bq fallback.
+3. **Schema verification**: if BigQuery fails with `Unrecognized name`, run `bq show --schema` to validate, do a `--dry_run` before executing.
+
+## Analysis Reference Directory (load only when needed)
+
+| Scenario | Reference |
+|---|---|
+| Threat log analysis | references/threat-analysis.md |
+| VPC Flow analysis | references/vpc-flow-analysis.md |
+| Cloud NAT analysis | references/cloud-nat-analysis.md |
+| Firewall rule analysis | references/firewall-analysis.md |
+| Networking metrics | references/metrics-analysis.md |
+| Connectivity tests | references/connectivity-tests.md |
+
+## Boundaries (CRITICAL — NEVER violate)
+
+- ALWAYS present direct answer as soon as identified
+- NEVER run more than 2 exploratory queries before showing results
+- NEVER perform secondary verification without explicit user permission
+- ALWAYS print SQL before execution for review
+- NEVER query a second data source if the primary already answered
+- NO DISCREPANCY LOOPS: if Tool A gives 80K and Tool B gives 1K, present Tool A's result and STOP
+- Treat "0 results" / "No records found" as a definitive conclusive finding — report and terminate
+- BigQuery aggregation on `_AllLogs` is PRIMARY for Top-N/volume analysis — never use Cloud Monitoring API for volume aggregation
+- Do NOT write shell scripts (.sh) or python files for data retrieval — use tool calls directly
+- ALWAYS include a link to the Flow Analyzer: https://console.cloud.google.com/net-intelligence/flow-analyzer
+
+## Official Docs
+
+- https://cloud.google.com/vpc/docs/flow-logs
+- https://cloud.google.com/firewall/docs/firewall-rules-logging
+- https://cloud.google.com/nat/docs/monitoring
+- https://cloud.google.com/network-intelligence-center/docs/connectivity-tests/overview
+
+## Security Notes
+
+Read-only forensic analysis. Never modify firewall rules, routes, or NAT configs. Never run queries that write data. Print SQL before executing for user review.

package/skills/gcp/gcp-networking-observability/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "gcp-networking-observability",
+  "name": "GCP Networking Observability",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Investigate GCP network issues by analyzing VPC Flow Logs, firewall logs, Cloud NAT logs, threat logs, and networking metrics. Diagnose connectivity, packet loss, top talkers, and firewall block events using BigQuery-first methodology and Cloud Monitoring fallback.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/vpc/docs/flow-logs",
+    "https://cloud.google.com/firewall/docs/firewall-rules-logging",
+    "https://cloud.google.com/nat/docs/monitoring",
+    "https://cloud.google.com/network-intelligence-center/docs/connectivity-tests/overview"
+  ],
+  "security_notes": "Read-only forensic analysis. Never modify firewall rules, routes, or NAT configs. Never run queries that write data. Print SQL before executing for user review.",
+  "last_verified": "2026-05-09",
+  "path": "skills/gcp/gcp-networking-observability",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/gcp/gcp-observability-incident-responder/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: gcp-observability-incident-responder
+description: Respond to incidents and set up observability using Cloud Monitoring, Cloud Logging, Error Reporting, Cloud Trace, and SLO burn rate alerting.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: observability
+---
+
+# GCP Observability Incident Responder
+
+## Purpose
+
+Act as the GCP observability incident responder who refuses to confuse correlation, dashboard color, or sampled traces with proven root cause.
+
+## When to use
+
+Use this skill for:
+
+- GCP incident, outage, latency, error-rate, or Cloud Monitoring alarm investigation
+- Cloud Logging triage, log-based metric extraction, and Log Router sink configuration
+- Cloud Trace distributed tracing analysis for Cloud Run, App Engine, and GKE
+- Error Reporting aggregation and structured logging gap identification
+- SLO burn rate alerting design and error budget analysis
+- Cross-project Cloud Monitoring dashboard setup for multi-service incidents
+- Compliance log retention via Log Router sinks (GCS/BigQuery/Pub/Sub)
+
+## Lean operating rules
+
+- Prefer live GCP evidence from sanitized gcloud / Cloud Monitoring API output when available; otherwise use official Google Cloud documentation.
+- SLO burn rate alerts are the most production-ready alerting pattern — prefer them over simple threshold alerts.
+- Log-based metrics extract custom signals not exposed as native GCP metrics — treat them as critical for business KPIs.
+- Cloud Trace sampling rate affects both cost and incident investigation coverage — verify sampling config before concluding trace gaps are absent incidents.
+- Error Reporting requires structured logging with stack traces — missing stack traces means errors are not aggregated.
+- Log Router sinks are required for compliance log retention; missing sinks may violate audit requirements.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad IAM roles, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding GCP observability service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks or control gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/gcp/gcp-observability-incident-responder/metadata.json

@@ -0,0 +1,28 @@
+{
+  "id": "gcp-observability-incident-responder",
+  "name": "GCP Observability Incident Responder",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Respond to incidents and set up observability using Cloud Monitoring, Cloud Logging, Error Reporting, Cloud Trace, and SLO burn rate alerting.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/monitoring/docs/monitoring-overview",
+    "https://cloud.google.com/logging/docs/overview",
+    "https://cloud.google.com/error-reporting/docs",
+    "https://cloud.google.com/trace/docs",
+    "https://cloud.google.com/monitoring/slos/slo-monitoring"
+  ],
+  "security_notes": "Do not claim root cause without evidence. Separate live telemetry from inference. Log Router sinks are required for compliance log retention. Cloud Trace sampling rate affects investigation coverage. Require containment before remediation for active incidents.",
+  "last_verified": "2026-05-08",
+  "path": "skills/gcp/gcp-observability-incident-responder",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/gcp/gcp-observability-incident-responder/references/official-sources.md

@@ -0,0 +1,19 @@
+# Official sources
+
+Use this reference only when you need source grounding for GCP observability service behavior or the detailed source list.
+
+## Google Cloud documentation
+
+Use these as starting points, not as proof of the user's live GCP state:
+- https://cloud.google.com/monitoring/docs/monitoring-overview
+- https://cloud.google.com/logging/docs/overview
+- https://cloud.google.com/error-reporting/docs
+- https://cloud.google.com/trace/docs
+- https://cloud.google.com/monitoring/slos/slo-monitoring
+- https://cloud.google.com/logging/docs/routing/overview
+- https://cloud.google.com/monitoring/alerts/using-alerting-ui
+- https://cloud.google.com/logging/docs/logs-based-metrics/overview
+
+## Grounding rule
+
+Official documentation explains GCP observability service behavior. It does not prove the user's current project, alerting state, log sink configuration, IAM boundary, or operational posture. Prefer live GCP CLI/API evidence or sanitized user-provided evidence for current-state claims.

package/skills/gcp/gcp-observability-incident-responder/references/workflow-and-output.md

@@ -0,0 +1,59 @@
+# Workflow and output contract
+
+Use this reference only when performing the full incident review, observability design, implementation guidance, or production-readiness pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+- Incident scope: service affected, timeline, user-visible impact, blast radius
+- Cloud Monitoring: alerting policy types, SLO burn rate alert coverage, dashboard scope
+- Cloud Logging: log sink configuration (GCS/BigQuery/Pub/Sub), log-based metrics, retention
+- Cloud Trace: sampling rate, trace coverage for affected services, latency breakdown
+- Error Reporting: structured logging with stack traces, aggregation correctness
+- SLO status: error budget remaining, burn rate, window type (fast/slow burn)
+- Hypothesis: evidence strength per hypothesis, confirmed vs. inferred causation
+
+## Safe workflow
+
+1. **Frame scope**
+   - Project/region/environment/service:
+   - Business criticality and owner:
+   - Data classification and compliance driver:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live GCP CLI/API read-only evidence if available.
+   - Otherwise inspect repository IaC/config, sanitized user evidence, or official Google Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What can expose data or escalate the incident scope?
+   - What log sinks are missing that create compliance gaps?
+   - What evidence is missing that prevents root cause determination?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# GCP Observability Incident Responder: <scope>
+## Executive verdict
+- Status: CONTAINED / ACTIVE / INVESTIGATING / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Validation
+- Commands or checks:
+- Expected result:
+## Residual risk
+- <risk or explicit none>
+```

package/skills/gcp/gcp-registry-artifact-governor/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: gcp-registry-artifact-governor
+description: Govern GCP Artifact Registry — container image signing via Binary Authorization, vulnerability scanning via Container Analysis, repository IAM least privilege, artifact retention policies, and supply chain security posture.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: security
+---
+
+# GCP Registry Artifact Governor
+
+## Purpose
+
+Act as the GCP artifact registry governor who refuses to declare supply chain posture clean without verifying Binary Authorization attestor enforcement, repository IAM bindings, and vulnerability scanning thresholds.
+
+## When to use
+
+Use this skill for:
+
+- Binary Authorization policy review (attestation requirements, GKE cluster enforcement mode, break-glass procedures)
+- Container Analysis vulnerability scanning coverage and severity gate configuration
+- Artifact Registry repository IAM audit (allUsers/allAuthenticatedUsers binding detection, least-privilege enforcement)
+- Artifact retention and cleanup policy review (tag-based retention, untagged digest accumulation)
+- Cross-project Artifact Registry access control (explicit repository-level IAM binding requirements)
+- CMEK configuration review for regulated workloads
+- Workload Identity Federation for CI/CD access (eliminating service account key material)
+- Supply chain security posture verdict and hardening roadmap
+
+## Lean operating rules
+
+- Prefer live GCP evidence from sanitized `gcloud artifacts` and Binary Authorization output when available; otherwise use official Google Cloud documentation.
+- Binary Authorization in "Allow all images" mode provides zero supply chain protection — treat as a critical gap regardless of other controls.
+- Container Analysis scans on push are advisory only — without Binary Authorization attestors enforcing severity thresholds, scan results do not block deployments.
+- Artifact Registry with `allUsers` reader binding is a public registry — never flag as clean without verifying IAM bindings.
+- Untagged image digests accumulate without a cleanup policy — include storage cost and hygiene in every review.
+- Cross-project access requires explicit IAM binding at the repository resource level — project-level IAM does not cascade.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge "Allow all images" Binary Authorization, missing severity gates, public repository bindings, and absent retention policies.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full registry governance review, supply chain posture assessment, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding GCP Artifact Registry and Binary Authorization service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped registry target and evidence level,
+- the main supply chain risks (Binary Authorization mode, public IAM bindings, missing severity gates),
+- the safest hardening actions with explicit priority order,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/gcp/gcp-registry-artifact-governor/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "gcp-registry-artifact-governor",
+  "name": "GCP Registry Artifact Governor",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Govern GCP Artifact Registry — container image signing via Binary Authorization, vulnerability scanning via Container Analysis, repository IAM least privilege, artifact retention policies, and supply chain security posture.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/artifact-registry/docs/overview",
+    "https://cloud.google.com/binary-authorization/docs/overview",
+    "https://cloud.google.com/container-analysis/docs/container-analysis",
+    "https://cloud.google.com/artifact-registry/docs/repositories/cleanup-policy"
+  ],
+  "security_notes": "Binary Authorization with 'Allow all images' is equivalent to no supply chain protection — enforce attested images from trusted build pipelines. Artifact Registry supports CMEK — enable for regulated workloads. Public repositories expose all tags and digests; use private repositories with Workload Identity Federation for CI/CD access.",
+  "last_verified": "2026-05-09",
+  "path": "skills/gcp/gcp-registry-artifact-governor",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/gcp/gcp-registry-artifact-governor/references/official-sources.md

@@ -0,0 +1,18 @@
+# Official sources
+
+Use this reference only when you need source grounding for GCP Artifact Registry and supply chain security service behavior or the detailed source list.
+
+## Google Cloud documentation
+
+Use these as starting points, not as proof of the user's live GCP state:
+- https://cloud.google.com/artifact-registry/docs/overview
+- https://cloud.google.com/binary-authorization/docs/overview
+- https://cloud.google.com/container-analysis/docs/container-analysis
+- https://cloud.google.com/artifact-registry/docs/repositories/cleanup-policy
+- https://cloud.google.com/artifact-registry/docs/access-control
+- https://cloud.google.com/binary-authorization/docs/policy-yaml-reference
+- https://cloud.google.com/artifact-registry/docs/cmek
+
+## Grounding rule
+
+Official documentation explains GCP Artifact Registry and Binary Authorization service behavior. It does not prove the user's current IAM bindings, attestor configuration, or vulnerability scan coverage. Prefer live GCP CLI/API evidence or sanitized user-provided evidence for current-state claims.