@raishin/vanguard-frontier-agentic 1.4.0 → 1.6.0

package/skills/huawei/huawei-resilience-bcdr-review/metadata.json

@@ -0,0 +1,28 @@
+{
+  "id": "huawei-resilience-bcdr-review",
+  "name": "Huawei Cloud Resilience BCDR Review",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Huawei Cloud workload HA and BCDR designs — GaussDB High Availability (HA) instance failover, CBR (Cloud Backup and Recovery) cross-region vault, CCE multi-AZ deployment, DRS (Data Replication Service) for DR, RTO/RPO target analysis, and runbook completeness.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/gaussdb_mysql/index.html",
+    "https://support.huaweicloud.com/intl/en-us/cbr/index.html",
+    "https://support.huaweicloud.com/intl/en-us/cce/index.html",
+    "https://support.huaweicloud.com/intl/en-us/drs/index.html",
+    "https://support.huaweicloud.com/intl/en-us/elb/index.html"
+  ],
+  "security_notes": "Huawei Cloud CBR vaults use default encryption — enable KMS CMEK for vaults containing sensitive production data. GaussDB cross-region read replicas involve data leaving the source region — verify this is compliant with MLPS 2.0 Level 3 data residency requirements before enabling.",
+  "last_verified": "2026-05-09",
+  "path": "skills/huawei/huawei-resilience-bcdr-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/huawei/huawei-resilience-bcdr-review/references/official-sources.md

@@ -0,0 +1,28 @@
+# Official sources
+
+Use this reference only when you need source grounding for Huawei Cloud BCDR and resilience service behavior or the detailed source list.
+
+## Huawei Cloud documentation
+
+Use these as starting points, not as proof of the user's live Huawei Cloud state:
+
+- https://support.huaweicloud.com/intl/en-us/gaussdb_mysql/index.html
+- https://support.huaweicloud.com/intl/en-us/cbr/index.html
+- https://support.huaweicloud.com/intl/en-us/cce/index.html
+- https://support.huaweicloud.com/intl/en-us/drs/index.html
+- https://support.huaweicloud.com/intl/en-us/elb/index.html
+- https://support.huaweicloud.com/intl/en-us/ecs/index.html
+
+## Service behavior reference
+
+| Service | HA Scope | DR Mechanism | Notes |
+|---------|----------|--------------|-------|
+| GaussDB for MySQL | AZ pair failover (automatic) | Cross-region read replica (manual promote) | Cross-region failover is not automatic |
+| CBR | Single region vault | Cross-region vault (explicit config) | Same-region vault has no regional DR value |
+| CCE | Multi-AZ node distribution | Separate cluster + ELB + DNS | No native cross-region cluster failover |
+| DRS | Cross-region replication | Replication task with lag monitoring | Verify consistency check results |
+| ELB | Cross-AZ within region | DNS-based global ELB for cross-region | ELB does not span regions natively |
+
+## Grounding rule
+
+Official documentation explains Huawei Cloud service behavior. It does not prove the user's current account, region, quota, resource configuration, CBR vault location, DRS replication lag, IAM boundary, or operational DR state. Prefer live console evidence or sanitized user-provided evidence for current-state claims.

package/skills/huawei/huawei-resilience-bcdr-review/references/workflow-and-output.md

@@ -0,0 +1,56 @@
+# Workflow and output contract
+
+Use this reference only when performing a full BCDR review, HA gap analysis, or recovery readiness assessment.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- Workload criticality: tier classification, business impact of outage, contractual SLA
+- RTO/RPO targets: documented targets vs tested evidence; label as aspirational if untested
+- GaussDB HA: instance type, failover mode, AZ pair configuration, cross-region read replica status
+- CBR backup: vault region, retention policy, backup frequency, restore test evidence
+- CCE multi-AZ: node group AZ distribution, pod anti-affinity rules, cross-region cluster existence
+- DRS replication: task status, replication lag (seconds), last consistency check result and date
+- ECS HA: Auto Scaling group span, ECS placement group, health check linkage to ELB
+- Runbook completeness: documented steps, last tested date, who owns execution
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload type and criticality tier:
+   - Stated RTO/RPO targets:
+   - Current-state evidence:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live Huawei Cloud console evidence (CBR vault region, DRS task status, CCE node AZ spread).
+   - Otherwise inspect IaC/config, sanitized user evidence, or official Huawei Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test design**
+   - What fails if a single AZ goes down?
+   - What fails if the primary region is unavailable?
+   - Is the CBR vault in a different region from the production workload?
+   - Is the DRS task active and within acceptable replication lag?
+   - When was the last DR drill performed and what was the result?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Huawei Cloud BCDR Review: <scope>
+## Workload criticality and RTO/RPO targets
+## Current HA architecture assessment (GaussDB/CCE/ECS)
+## Cross-region/AZ redundancy gaps
+## CBR backup coverage and cross-region vault verification
+## DRS replication lag and consistency status
+## Recovery test evidence (last drill date, scope, result)
+## Prioritized BCDR improvements
+```
+
+Each section must include an evidence level label.

package/skills/huawei/huawei-secmaster-security-operations/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: huawei-secmaster-security-operations
+description: Operate Huawei SecMaster (integrated SIEM/SOAR/threat intelligence), HSS (Host Security Service) host intrusion detection, CFW (Cloud Firewall), WAF (Web Application Firewall), Anti-DDoS, and VSS (Vulnerability Scan Service) for comprehensive cloud security operations.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: security
+---
+
+# Huawei Cloud SecMaster Security Operations
+
+## Purpose
+
+Act as the Huawei Cloud security operations specialist who manages SecMaster SIEM/SOAR, HSS host intrusion detection, CFW firewall policy, WAF rule governance, Anti-DDoS coverage, and VSS vulnerability scanning with evidence-backed threat assessment and safe-change sequencing for MLPS Level 3 compliance.
+
+## When to use
+
+Use this skill for:
+
+- SecMaster: SIEM alert triage, SOAR playbook design and dry-run, threat intelligence feed management
+- HSS: agent deployment, baseline check remediation, malware detection response, login audit for MLPS
+- CFW (Cloud Firewall): east-west VPC firewall policy, internet ingress/egress rule management, IPS signature configuration
+- WAF: web application firewall rule set management, CC attack protection, IP whitelist governance
+- Anti-DDoS: EIP binding coverage, protection threshold configuration, traffic scrubbing review
+- VSS (Vulnerability Scan Service): web vulnerability scan task management, finding remediation tracking
+- MLPS Level 3 security operations: HSS (intrusion detection), CFW (boundary protection), LTS (login audit), SecMaster (security incident management)
+
+## Key specifics
+
+- SecMaster = SIEM + SOAR + threat intelligence in a single Huawei console — no equivalent in AWS/Azure without 3rd-party tooling at this integration level.
+- HSS: agent-based — malware detection, baseline check, vulnerability scan, login audit. MLPS Level 3 requires HSS on all in-scope hosts.
+- CFW: next-gen firewall for VPC east-west and internet traffic — rule changes affect all instances in scope simultaneously; test in low-traffic window.
+- MLPS Level 3 requires: HSS (intrusion detection), CFW (boundary protection), LTS (login audit), SecMaster (security incident management).
+- VSS: agentless web vulnerability scanning — does not require host access; scan targets are public URLs or internal endpoints via VPC endpoint.
+- WAF bypass via IP whitelist: any whitelist entry bypasses all WAF rules for that source IP — requires documented business justification.
+
+## Lean operating rules
+
+- Prefer official Huawei Cloud SecMaster/HSS/CFW documentation for service behavior grounding. If documentation cannot be retrieved, say: "I'm falling back to documentation-based inference — verify against Huawei Cloud console or official docs." Then label accordingly.
+- Separate confirmed facts from inference. If live security state was not queried or shown, say so.
+- CFW rule changes affect all instances in scope simultaneously — require blast-radius assessment and low-traffic window scheduling.
+- HSS agent uninstall removes MLPS-required host detection visibility — flag immediately; this is a compliance gap, not a normal maintenance activity.
+- SecMaster SOAR playbook changes require dry-run before live execution — never enable a new playbook without a tested dry run.
+- WAF bypass via IP whitelist requires documented business justification — challenge any whitelist addition without documentation.
+- Challenge security architectures missing HSS on MLPS Level 3 hosts, CFW east-west gaps, or SecMaster SOAR without tested playbooks.
+- Load references only when needed.
+
+## References
+
+Load these only when needed:
+
+- [Official sources](references/official-sources.md) — use when grounding SecMaster, HSS, CFW, WAF, or VSS service behavior or checking the detailed source list.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing a full security operations review or formatting the final answer.
+
+## Response minimum
+
+Return, at minimum:
+
+- security operations scope and evidence level,
+- SecMaster SIEM alert summary and SOAR playbook status,
+- HSS coverage and MLPS Level 3 host compliance,
+- CFW rule inventory and east-west gap assessment,
+- WAF rule posture and whitelist governance,
+- Anti-DDoS EIP binding coverage,
+- open questions that must be resolved before proceeding.

package/skills/huawei/huawei-secmaster-security-operations/metadata.json

@@ -0,0 +1,19 @@
+{
+  "id": "huawei-secmaster-security-operations",
+  "name": "Huawei Cloud SecMaster Security Operations",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Operate Huawei SecMaster SIEM/SOAR, HSS host intrusion detection, CFW, WAF, Anti-DDoS, and VSS for comprehensive cloud security operations and MLPS Level 3 compliance.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/secmaster/index.html",
+    "https://support.huaweicloud.com/intl/en-us/hss/index.html",
+    "https://support.huaweicloud.com/intl/en-us/cfw/index.html"
+  ],
+  "security_notes": "CFW rule changes affect all instances in scope simultaneously. HSS agent uninstall removes MLPS-required host detection visibility — flag immediately. SecMaster SOAR playbook dry-run required before live execution. WAF bypass via IP whitelist requires documented business justification.",
+  "last_verified": "2026-05-08",
+  "path": "skills/huawei/huawei-secmaster-security-operations",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/huawei/huawei-secmaster-security-operations/references/official-sources.md

@@ -0,0 +1,18 @@
+# Official sources
+
+Use this reference only when you need source grounding for Huawei Cloud SecMaster, HSS, CFW, WAF, Anti-DDoS, or VSS service behavior or the detailed source list.
+
+## Huawei Cloud documentation
+
+Use these as starting points, not as proof of the user's live Huawei Cloud state:
+
+- https://support.huaweicloud.com/intl/en-us/secmaster/index.html
+- https://support.huaweicloud.com/intl/en-us/hss/index.html
+- https://support.huaweicloud.com/intl/en-us/cfw/index.html
+- https://support.huaweicloud.com/intl/en-us/waf/index.html
+- https://support.huaweicloud.com/intl/en-us/antiddos/index.html
+- https://support.huaweicloud.com/intl/en-us/vss/index.html
+
+## Grounding rule
+
+If live Huawei Cloud tooling is unavailable, say: "I can't query live state here, so I'm falling back to official Huawei Cloud docs." Then fall back to these sources and sanitized user evidence.

package/skills/huawei/huawei-secmaster-security-operations/references/workflow-and-output.md

@@ -0,0 +1,37 @@
+# Workflow and output contract
+
+Use this reference only when performing a full security operations review or MLPS Level 3 security posture assessment.
+
+## Security operations areas to check
+
+- SecMaster: SIEM alert inventory (open/acknowledged/suppressed), SOAR playbook status (draft/active/dry-run required), threat intelligence feed health
+- HSS: agent coverage (% of in-scope hosts), baseline check compliance, malware alert history, login audit enabled
+- CFW: rule inventory, default-deny posture, east-west coverage gaps, IPS signature update status
+- WAF: rule set version, CC protection threshold, IP whitelist entries with justification status, recent false positive rate
+- Anti-DDoS: EIP inventory, binding coverage, protection threshold, recent attack traffic events
+- VSS: scheduled scan tasks, open critical/high findings, remediation SLA tracking
+
+## Safe workflow
+
+1. **Frame scope** — confirm in-scope services, MLPS classification, enterprise project, and non-goals
+2. **Collect evidence** — prefer live SecMaster/HSS/CFW dashboards; label all evidence types
+3. **Stress-test** — HSS coverage gaps, CFW rule blast radius, SOAR playbook untested scenarios, WAF whitelist risk
+4. **Recommend safest action** — HSS deployment to uncovered hosts, CFW rule dry-run in test environment, SOAR playbook dry-run
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Huawei Cloud Security Operations: <scope>
+## Scope and evidence level
+## SecMaster SIEM and SOAR status
+## HSS coverage and MLPS compliance
+## CFW policy assessment
+## WAF and Anti-DDoS posture
+## VSS vulnerability findings summary
+## Recommended actions
+## Open questions
+```
+
+Each section must include an evidence level label.

package/skills/huawei/huawei-serverless-production-readiness/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: huawei-serverless-production-readiness
+description: Review FunctionGraph production readiness on Huawei Cloud — VPC access configuration, concurrency limits and reserved instances, cold-start optimization, observability via LTS and AOM, timeout configuration, dependency package size, custom vs managed runtimes, and ServiceStage application lifecycle.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: serverless
+---
+
+# Huawei Cloud Serverless Production Readiness
+
+## Purpose
+
+Act as the Huawei Cloud FunctionGraph production readiness reviewer who produces evidence-backed assessments of VPC configuration, concurrency and reserved instance planning, cold-start mitigation, observability coverage, timeout tuning, dependency management, runtime selection, and ServiceStage application lifecycle controls.
+
+## When to use
+
+Use this skill for:
+
+- FunctionGraph VPC access configuration and security group review
+- Concurrency limit and reserved instance planning for predictable latency
+- Cold-start optimization strategies (pre-stop, dependency trimming, runtime selection)
+- Observability coverage via LTS (Log Tank Service) log output and AOM (Application Operations Management) metrics
+- Function timeout configuration and downstream dependency timeout chain analysis
+- Dependency package size audit and layer management
+- Custom runtime vs managed runtime selection guidance
+- ServiceStage application lifecycle configuration and health check review
+
+## Lean operating rules
+
+- Prefer Huawei Cloud Console evidence and hcloud CLI output for live state grounding; fall back to official Huawei Cloud documentation at support.huaweicloud.com/intl/en-us. If documentation cannot be retrieved, say: "I'm falling back to documentation-based inference — verify against Huawei Cloud console or official docs." Then label accordingly.
+- FunctionGraph functions without VPC configuration run in a Huawei-managed network and cannot reach VPC-private resources (RDS, GaussDB, private ELB) — verify VPC binding is correct before assuming database connectivity works.
+- FunctionGraph concurrency is soft-limited per function — without reserved instances, cold starts occur on every burst above the warm instance count; quantify expected burst pattern before recommending reserved instance count.
+- Cold starts are directly proportional to package size and initialization code volume — always check deployment package size and initialization path before optimizing concurrency.
+- FunctionGraph LTS log output is not enabled by default — verify LTS log group and log stream are bound to the function; absent log binding means errors are invisible in production.
+- AOM metrics for FunctionGraph cover invocation count, error rate, and duration — configure AOM alarms on error rate and p99 duration for all production functions.
+- Function timeout must be shorter than the event trigger timeout or the upstream caller timeout — an invocation that times out at the trigger level retries, potentially causing duplicate processing.
+- Custom runtimes require the function author to maintain the runtime security patch lifecycle — prefer managed runtimes unless there is a documented language or version requirement that managed runtimes cannot satisfy.
+- Never ask for AK/SK credentials, function environment variable values containing secrets, or customer data payloads.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+
+## References
+
+Load these only when needed:
+
+- [Official sources](references/official-sources.md) — use when grounding Huawei Cloud FunctionGraph and ServiceStage service behavior or checking the detailed source list.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full serverless production readiness review or formatting the final answer.
+
+## Response minimum
+
+Return, at minimum:
+
+- VPC configuration and network connectivity assessment with evidence level,
+- concurrency and reserved instance planning analysis,
+- cold-start optimization assessment,
+- observability coverage via LTS and AOM,
+- timeout configuration and dependency chain analysis,
+- dependency package size and layer management review,
+- runtime selection rationale,
+- ServiceStage lifecycle and health check status,
+- prioritized production readiness improvements with remediation steps.

package/skills/huawei/huawei-serverless-production-readiness/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "huawei-serverless-production-readiness",
+  "name": "Huawei Cloud Serverless Production Readiness",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": [
+    "codex",
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review FunctionGraph production readiness on Huawei Cloud — VPC access configuration, concurrency limits and reserved instances, cold-start optimization, observability via LTS and AOM, timeout configuration, dependency package size, custom vs managed runtimes, and ServiceStage application lifecycle.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/fg/index.html",
+    "https://support.huaweicloud.com/intl/en-us/servicestage/index.html",
+    "https://support.huaweicloud.com/intl/en-us/aom/index.html"
+  ],
+  "security_notes": "FunctionGraph function environment variables may contain secrets — use DEW (Data Encryption Workshop) or Secret Manager references instead of plaintext values in environment variables. Custom runtimes require the function author to maintain runtime security patch lifecycle — document a patching cadence if custom runtimes are used in production.",
+  "last_verified": "2026-05-09",
+  "path": "skills/huawei/huawei-serverless-production-readiness",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/huawei/huawei-serverless-production-readiness/references/official-sources.md

@@ -0,0 +1,28 @@
+# Official sources
+
+Use this reference only when you need source grounding for Huawei Cloud FunctionGraph, ServiceStage, or AOM service behavior or the detailed source list.
+
+## Huawei Cloud documentation
+
+Use these as starting points, not as proof of the user's live Huawei Cloud state:
+
+- https://support.huaweicloud.com/intl/en-us/fg/index.html
+- https://support.huaweicloud.com/intl/en-us/servicestage/index.html
+- https://support.huaweicloud.com/intl/en-us/aom/index.html
+
+## Key service behavior references
+
+| Service | Behavior | Implication | Risk if Absent |
+|---------|----------|-------------|----------------|
+| FunctionGraph | VPC binding required to reach private resources | Functions without VPC cannot access RDS, GaussDB, or private ELB | Silent connection failures to private services |
+| FunctionGraph | LTS log output not enabled by default | Log group and stream must be explicitly bound | Production errors are invisible |
+| FunctionGraph | Concurrency soft-limited per function | Reserved instances prevent cold starts at burst | Unpredictable latency spikes under load |
+| FunctionGraph | Cold start duration scales with package size | Trim dependencies and use layers to reduce initialization time | Poor p99 latency under burst |
+| FunctionGraph | Function timeout must be less than trigger/caller timeout | Timeout mismatch causes retry loops and duplicate processing | Duplicate side effects and quota exhaustion |
+| FunctionGraph | Custom runtimes require owner to manage security patches | Managed runtimes are patched by Huawei | Unpatched runtime CVEs in custom environments |
+| AOM | Provides invocation count, error rate, and duration metrics | Configure alarms on error rate and p99 duration | Silent error accumulation without alerting |
+| ServiceStage | Application lifecycle managed via health checks | Health check endpoint must reflect actual readiness | Traffic routed to unready function instances |
+
+## Grounding rule
+
+Official documentation explains Huawei Cloud service behavior. It does not prove the user's current account, region, quota, resource configuration, IAM boundary, pricing, or operational state. Prefer live console evidence or sanitized user-provided evidence for current-state claims.

package/skills/huawei/huawei-serverless-production-readiness/references/workflow-and-output.md

@@ -0,0 +1,58 @@
+# Workflow and output contract
+
+Use this reference only when performing a full FunctionGraph production readiness assessment for a Huawei Cloud serverless workload.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- VPC configuration: whether the function is bound to a VPC and whether security group rules permit connectivity to required private resources
+- Concurrency and reserved instances: whether the concurrency limit is set, whether reserved instances match expected baseline load, and whether burst handling is documented
+- Cold-start optimization: package size, dependency layer usage, initialization code volume, and whether pre-stop hooks are configured
+- Observability: whether LTS log group and stream are bound, whether AOM alarms are configured on error rate and p99 duration, and whether distributed tracing is enabled
+- Timeout configuration: whether the function timeout is shorter than the trigger and upstream caller timeout, and whether retry semantics are intentional
+- Dependency management: deployment package size, whether FunctionGraph layers are used for shared dependencies, and whether unused dependencies are removed
+- Runtime selection: whether managed or custom runtime is used and whether the choice is documented
+- ServiceStage lifecycle: whether health check endpoints are configured and whether deployment strategy is documented
+
+## Safe workflow
+
+1. **Frame scope**
+   - Function(s) in scope and their event triggers:
+   - Region and account context:
+   - Current-state evidence:
+   - Required latency and reliability targets:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live Huawei Cloud console evidence if available.
+   - Otherwise inspect IaC/config, sanitized user evidence, or official Huawei Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test the configuration**
+   - What VPC resources are unreachable if VPC binding is absent or security group rules are too restrictive?
+   - What errors are invisible in production if LTS log binding is not configured?
+   - What p99 latency impact occurs if reserved instances are absent during traffic bursts?
+   - What duplicate processing occurs if the function timeout exceeds the trigger timeout and retries fire?
+   - What security vulnerabilities are present if a custom runtime is not patched?
+   - What evidence is missing to confirm the function meets its latency and reliability targets?
+4. **Recommend the smallest safe action**
+   - Prefer targeted fixes, staged changes, and verification steps.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Huawei Cloud Serverless Production Readiness: <scope>
+## VPC configuration and network connectivity assessment
+## Concurrency and reserved instance planning
+## Cold-start optimization assessment
+## Observability coverage via LTS and AOM
+## Timeout configuration and dependency chain analysis
+## Dependency package size and layer management review
+## Runtime selection rationale
+## ServiceStage lifecycle and health check status
+## Prioritized production readiness improvements
+```
+
+Each section must include an evidence level label.

package/skills/huawei/huawei-solution-architect/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: huawei-solution-architect
+description: Design Huawei Cloud solutions — product selection, enterprise-project model design, region selection for MLPS/sovereignty requirements, architecture patterns, multi-zone and multi-region HA. Covers region mapping (China and international), GaussDB vs RDS selection, ModelArts/Ascend NPU considerations, and the six-pillar Huawei Cloud Architecture Framework including the Trusted pillar.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: platform
+---
+
+# Huawei Cloud Solution Architect
+
+## Purpose
+
+Act as the Huawei Cloud solution architect who produces evidence-backed architecture designs with explicit region rationale, product selection, enterprise-project governance model, and compliance traceability.
+
+## When to use
+
+Use this skill for:
+
+- New Huawei Cloud workload design or migration architecture
+- Region selection with MLPS or data sovereignty constraints
+- Product selection decisions (ECS, CCE, GaussDB, RDS, ModelArts, OBS, etc.)
+- Enterprise-project model design for cost and access governance
+- Multi-AZ and multi-region HA topology design
+- Huawei Cloud Architecture Framework (six pillars including Trusted) reviews
+
+## Lean operating rules
+
+- Prefer official Huawei Cloud documentation for service behavior grounding. If documentation cannot be retrieved, say: "I'm falling back to documentation-based inference — verify against Huawei Cloud console or official docs." Then label accordingly.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- China regions (cn-north-4=Beijing IV, cn-east-3=Shanghai I, cn-south-1=Guangzhou) are sovereign; MLPS workloads must stay in China regions unless explicitly scoped otherwise.
+- Enterprise projects are resource grouping WITHIN a single Huawei Cloud account — they are not separate billing accounts.
+- GaussDB for MySQL: cloud-native shared storage, up to 15 read replicas — prefer for scale-out or Oracle migration workloads. RDS: standard managed databases for simpler workloads.
+- ModelArts uses Ascend NPUs by default — flag GPU-only workloads that may require migration or adapter consideration.
+- Challenge broad access, destructive automation, untested recovery, hidden cost, and vague production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Official sources](references/official-sources.md) — use when grounding Huawei Cloud service behavior or checking the detailed source list.
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full architecture review or formatting the final answer.
+
+## Response minimum
+
+Return, at minimum:
+
+- the workload requirements and evidence level,
+- region selection with MLPS/sovereignty rationale,
+- product selection with decision rationale,
+- enterprise-project model,
+- architecture topology summary,
+- cost and compliance considerations,
+- open questions that must be resolved before proceeding.

package/skills/huawei/huawei-solution-architect/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "huawei-solution-architect",
+  "name": "Huawei Cloud Solution Architect",
+  "type": "skill",
+  "provider": "huawei",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Design Huawei Cloud solutions — product selection, enterprise-project model design, region selection for MLPS/sovereignty requirements, architecture patterns, multi-zone and multi-region HA.",
+  "source_type": "original",
+  "official_docs": [
+    "https://support.huaweicloud.com/intl/en-us/ecs/index.html",
+    "https://support.huaweicloud.com/intl/en-us/cce/index.html",
+    "https://support.huaweicloud.com/intl/en-us/gaussdb_mysql/index.html"
+  ],
+  "security_notes": "Do not approve a Huawei Cloud architecture without region sovereignty check, enterprise-project boundary definition, IAM review, network exposure, data protection, MLPS compliance mapping, and cost evidence.",
+  "last_verified": "2026-05-08",
+  "path": "skills/huawei/huawei-solution-architect",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/huawei/huawei-solution-architect/references/official-sources.md

@@ -0,0 +1,29 @@
+# Official sources
+
+Use this reference only when you need source grounding for Huawei Cloud service behavior or the detailed source list.
+
+## Huawei Cloud documentation
+
+Use these as starting points, not as proof of the user's live Huawei Cloud state:
+
+- https://support.huaweicloud.com/intl/en-us/ecs/index.html
+- https://support.huaweicloud.com/intl/en-us/cce/index.html
+- https://support.huaweicloud.com/intl/en-us/gaussdb_mysql/index.html
+- https://support.huaweicloud.com/intl/en-us/rds/index.html
+- https://support.huaweicloud.com/intl/en-us/obs/index.html
+- https://support.huaweicloud.com/intl/en-us/modelarts/index.html
+
+## Region reference
+
+| Region ID      | Location         | Notes                              |
+|---------------|------------------|------------------------------------|
+| cn-north-4    | Beijing IV       | China sovereign, MLPS anchor       |
+| cn-east-3     | Shanghai I       | China sovereign                    |
+| cn-south-1    | Guangzhou        | China sovereign                    |
+| ap-southeast-1| Hong Kong        | International                      |
+| ap-southeast-2| Bangkok          | International                      |
+| ap-southeast-3| Singapore        | International                      |
+
+## Grounding rule
+
+Official documentation explains Huawei Cloud service behavior. It does not prove the user's current account, region, quota, resource configuration, IAM boundary, pricing, or operational state. Prefer live console evidence or sanitized user-provided evidence for current-state claims.

package/skills/huawei/huawei-solution-architect/references/workflow-and-output.md

@@ -0,0 +1,54 @@
+# Workflow and output contract
+
+Use this reference only when performing a full architecture design, migration assessment, or production-readiness review.
+
+## Design domains
+
+Check these areas before giving a verdict:
+
+- Workload profile: compute, storage, network, data, and AI/ML requirements
+- Region selection: MLPS level, data sovereignty, latency, and DR requirements
+- Product selection: ECS vs CCE vs FunctionGraph, GaussDB vs RDS, OBS vs SFS vs EVS
+- Enterprise-project model: resource grouping, cost allocation, and access governance
+- Network topology: VPC design, AZ spread, ELB placement, hybrid connectivity
+- Compliance: MLPS Level 2/3, ISO 27001, SOC 2, local regulations
+- Cost: on-demand vs reserved instances, storage tiers, data transfer
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload type and criticality:
+   - Region constraints (MLPS/sovereignty):
+   - Current-state evidence:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live Huawei Cloud console evidence if available.
+   - Otherwise inspect IaC/config, sanitized user evidence, or official Huawei Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test design**
+   - What fails if a single AZ goes down?
+   - What fails if primary region is unavailable?
+   - What can expose data outside sovereignty boundary?
+   - What can escalate privilege across enterprise-project boundaries?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Huawei Cloud Solution Architecture: <scope>
+## Workload requirements
+## Region selection rationale (MLPS/sovereignty)
+## Product selection
+## Enterprise-project model
+## Architecture topology
+## Cost and compliance considerations
+## Open questions
+```
+
+Each section must include an evidence level label.