@raishin/vanguard-frontier-agentic 1.4.0 → 1.6.0

package/agents/kubernetes/kubernetes-live-argocd-sync-guard-agent/references/least-privilege-rbac.yaml

@@ -0,0 +1,92 @@
+# =====================================================================
+# Least-privilege RBAC for kubernetes-live-argocd-sync-guard-agent
+#
+# Apply BEFORE running the agent.
+# Authoring contract: docs/least-privilege-rbac.md
+# Pre-flight matrix:  references/rbac-pre-flight.md
+# Refusal list:       references/refusal-list.md
+#
+# Audit:
+#   SA="system:serviceaccount:vanguard-system:vanguard-argocd-sync-guard"
+#   kubectl auth can-i delete namespaces --as=$SA       # must return: no
+#   (domain-specific must-be-yes / must-not-be-yes in references/rbac-pre-flight.md)
+#
+# Per upstream kubernetes.io/docs/concepts/security/rbac-good-practices:
+#   "Avoid wildcard permissions, especially to all resources, as this grants
+#    access to current and future object types."
+# =====================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vanguard-system
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/enforce-version: latest
+    app.kubernetes.io/managed-by: vanguard-frontier
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vanguard-argocd-sync-guard
+  namespace: vanguard-system
+  annotations:
+    vanguard.frontier/agent: "kubernetes-live-argocd-sync-guard-agent"
+    vanguard.frontier/scope: "least-privilege-kubernetes-live-argocd-sync-guard"
+    vanguard.frontier/contract: "docs/least-privilege-rbac.md"
+automountServiceAccountToken: true
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vanguard-argocd-sync-guard
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["argoproj.io"]
+    resources: ["applications", "applicationsets", "appprojects"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["argoproj.io"]
+    resources: ["applications"]
+    verbs: ["patch"]
+# =====================================================================
+# DELIBERATELY ABSENT — DO NOT add unless you accept the listed risk.
+# The binding is deny-by-default: anything not granted above is denied
+# at the API server. Categories (per docs/least-privilege-rbac.md):
+#
+#   - apiGroups: [""], resources: ["namespaces"]                          -> kube-system / cilium / istio-system delete
+#   - apiGroups: [""], resources: ["pods"], any verb                      -> exec / delete on control-plane pods
+#   - apiGroups: [""], resources: ["pods/exec","pods/portforward","pods/proxy","pods/binding","pods/eviction"]
+#   - apiGroups: [""], resources: ["nodes"], verbs: ["patch","update","delete"]   -> drain / cordon / delete
+#   - apiGroups: [""], resources: ["nodes/proxy"]                         -> direct kubelet API
+#   - apiGroups: ["coordination.k8s.io"], resources: ["leases"]           -> kube-node-lease, fake liveness
+#   - apiGroups: [""], resources: ["secrets"]                             -> cluster-wide credential exposure
+#   - apiGroups: [""], resources: ["serviceaccounts/token"]               -> mint tokens for arbitrary SAs
+#   - apiGroups: ["certificates.k8s.io"]                                  -> CSR approval (system:masters cert minting)
+#   - apiGroups: ["authentication.k8s.io"]                                -> tokenreviews, impersonation primitives
+#   - apiGroups: ["admissionregistration.k8s.io"]                         -> mutating/validating webhook configs
+#   - apiGroups: ["apiregistration.k8s.io"]                               -> APIService aggregation hijack
+#   - apiGroups: ["apiextensions.k8s.io"]                                 -> CRD install / uninstall
+#   - apiGroups: ["scheduling.k8s.io"]                                    -> system-cluster-critical / system-node-critical
+#   - apiGroups: ["apps"], resources: ["daemonsets","deployments","statefulsets"], verbs: write   in kube-system
+#   - apiGroups: ["networking.k8s.io"], resources: ["ingressclasses"], verbs: write   -> break Ingress controller binding
+#   - apiGroups: ["storage.k8s.io"], resources: ["storageclasses"], verbs: write      -> break PVC provisioning
+#   - apiGroups: [""], resources: ["endpoints"], verbs: write             -> race with controller, redirect Service traffic
+#   - apiGroups: ["discovery.k8s.io"], resources: ["endpointslices"], verbs: write    -> same race
+#   - apiGroups: ["rbac.authorization.k8s.io"]                            -> binding self-modification (unless this IS the rbac-mutation guard)
+#   - any "*" verb or "*" resource                                        -> per upstream RBAC good practices
+#   - any "delete" verb cluster-wide (rollback is via apply -f baseline)
+# =====================================================================
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vanguard-argocd-sync-guard
+subjects:
+  - kind: ServiceAccount
+    name: vanguard-argocd-sync-guard
+    namespace: vanguard-system
+roleRef:
+  kind: ClusterRole
+  name: vanguard-argocd-sync-guard
+  apiGroup: rbac.authorization.k8s.io

package/agents/kubernetes/kubernetes-live-argocd-sync-guard-agent/references/rbac-pre-flight.md

@@ -0,0 +1,108 @@
+# RBAC pre-flight self-check — Kubernetes Live Argo CD Sync Guard
+
+This is the mandatory first action of every session. The agent runs this matrix before reading any user-supplied YAML, before formulating any mutation, before producing any output other than the matrix result.
+
+The matrix is grounded against `kubernetes.io/docs/concepts/security/rbac-good-practices` and `kubernetes.io/docs/reference/kubectl/generated/kubectl_auth/kubectl_auth_can-i`. The canonical authoring contract is `docs/least-privilege-rbac.md`.
+
+If any **must-not-be-yes** check returns `yes`, or any **must-be-yes** check returns `no`, the agent refuses to act and tells the user the binding is over- or under-scoped.
+
+---
+
+## Required RBAC manifest
+
+Apply `references/least-privilege-rbac.yaml` (shipped with this agent) before invoking it. The manifest creates `ServiceAccount/vanguard-argocd-sync-guard` in namespace `vanguard-system`.
+
+---
+
+## Operator principal check (run first)
+
+```bash
+# If yes: operator is in system:masters or has cluster-admin. Refuse.
+kubectl auth can-i '*' '*' --all-namespaces
+```
+
+Per upstream `kubernetes.io/docs/concepts/security/rbac-good-practices`:
+
+> *Administrators should avoid using `cluster-admin` accounts and instead provide low-privileged accounts with impersonation rights.*
+>
+> *Do not add users to the `system:masters` group, as this bypasses all RBAC checks.*
+
+---
+
+## Universal must-not-be-yes (every live-guard)
+
+```bash
+SA="system:serviceaccount:vanguard-system:vanguard-argocd-sync-guard"
+
+kubectl auth can-i '*' '*' --all-namespaces --as=$SA
+kubectl auth can-i delete namespaces --as=$SA
+kubectl auth can-i delete pods -n kube-system --as=$SA
+kubectl auth can-i create pods/exec -n kube-system --as=$SA
+kubectl auth can-i create pods/portforward --all-namespaces --as=$SA
+kubectl auth can-i delete daemonsets -n kube-system --as=$SA
+kubectl auth can-i delete deployments -n kube-system --as=$SA
+kubectl auth can-i create customresourcedefinitions --as=$SA
+kubectl auth can-i delete customresourcedefinitions --as=$SA
+kubectl auth can-i get secrets --all-namespaces --as=$SA
+kubectl auth can-i create clusterrolebindings --as=$SA
+kubectl auth can-i create mutatingwebhookconfigurations.admissionregistration.k8s.io --as=$SA
+kubectl auth can-i delete mutatingwebhookconfigurations.admissionregistration.k8s.io --as=$SA
+kubectl auth can-i create validatingwebhookconfigurations.admissionregistration.k8s.io --as=$SA
+kubectl auth can-i create apiservices.apiregistration.k8s.io --as=$SA
+kubectl auth can-i update certificatesigningrequests.certificates.k8s.io --subresource=approval --as=$SA
+kubectl auth can-i create serviceaccounts/token --all-namespaces --as=$SA
+kubectl auth can-i delete priorityclasses.scheduling.k8s.io --as=$SA
+kubectl auth can-i delete ingressclasses.networking.k8s.io --as=$SA
+kubectl auth can-i delete leases.coordination.k8s.io -n kube-node-lease --as=$SA
+kubectl auth can-i update namespaces/finalize --as=$SA
+```
+
+## Domain-specific must-not-be-yes (Kubernetes Live Argo CD Sync Guard)
+
+```bash
+# Delete on Argo CD resources — rollback via apply -f baseline
+kubectl auth can-i delete applications.argoproj.io --all-namespaces --as=$SA
+kubectl auth can-i delete applicationsets.argoproj.io --all-namespaces --as=$SA
+kubectl auth can-i delete appprojects.argoproj.io --all-namespaces --as=$SA
+# AppProject and ApplicationSet writes — GitOps-only territory
+kubectl auth can-i create appprojects.argoproj.io -n argocd --as=$SA
+kubectl auth can-i patch appprojects.argoproj.io -n argocd --as=$SA
+kubectl auth can-i create applicationsets.argoproj.io -n argocd --as=$SA
+kubectl auth can-i patch applicationsets.argoproj.io -n argocd --as=$SA
+# Argo CD control plane
+kubectl auth can-i patch deployments -n argocd --as=$SA
+kubectl auth can-i patch configmaps -n argocd --as=$SA
+kubectl auth can-i get secrets -n argocd --as=$SA
+```
+
+## Domain-specific must-be-yes (Kubernetes Live Argo CD Sync Guard)
+
+```bash
+kubectl auth can-i list applications.argoproj.io -n argocd --as=$SA
+kubectl auth can-i list applicationsets.argoproj.io -n argocd --as=$SA
+kubectl auth can-i list appprojects.argoproj.io -n argocd --as=$SA
+kubectl auth can-i patch applications.argoproj.io -n argocd --as=$SA
+```
+
+Every must-not row must print `no`. Every must-be row must print `yes`. Any deviation: refuse and tell the operator which line failed.
+
+---
+
+## resourceName-scoped binding verification (positive AND negative)
+
+Where the manifest uses `resourceNames`, test BOTH the allowed name and at least one denied adjacent name. `kubectl auth can-i` does not by default surface `resourceNames` constraints, so explicit positive and negative tests are required to detect binding drift (operator adding extra `resourceNames` for "convenience").
+
+---
+
+## Refusal posture
+
+If pre-flight fails:
+
+```
+Pre-flight: FAIL
+Failing check: <verb> <resource> <namespace>
+Expected: no | Actual: yes (binding over-scoped on the bound ServiceAccount)
+Action: refusing to proceed. Re-apply references/least-privilege-rbac.yaml or scope down the existing binding.
+```
+
+No exceptions. The pre-flight is the gate.

package/agents/kubernetes/kubernetes-live-argocd-sync-guard-agent/references/refusal-list.md

@@ -0,0 +1,112 @@
+# Hard refusal list — Kubernetes Live Argo CD Sync Guard
+
+This document is the explicit `REFUSE` list for Kubernetes Live Argo CD Sync Guard. It combines:
+
+1. **Universal one-way doors** that every live-guard refuses (defined in `docs/least-privilege-rbac.md`).
+2. **Domain-specific destructive operations** for Kubernetes Live Argo CD Sync Guard.
+
+> **Scope-of-defense clarification.** This list is the **prompt-level fast-path** for rejecting common destructive operations. The authoritative defense is the cluster-side RBAC binding (`references/least-privilege-rbac.yaml`), which is **deny-by-default**: it grants only the enumerated verbs / resources and denies everything else. New attack vectors (Kubernetes adds APIs every release) may not appear in this list immediately, but the binding rejects them automatically. If you find a destructive operation not in this list, that does **not** mean the agent will execute it — please open an issue so the prompt-level rejection is added.
+
+The format for each entry: **what is refused**, **why it's a one-way door**, **what to do instead**, **cluster-side blast radius if the prompt-level refusal is bypassed**.
+
+---
+
+## Universal one-way doors (refused by every live-guard)
+
+These apply across all live-guard agents in this repo. The cluster-side RBAC binding for this guard explicitly omits the verbs/resources for each of these:
+
+- **Namespace deletion** (`kubectl delete ns <any>`) — kube-system / cilium / istio-system / argocd / velero deletion is cluster-fatal.
+- **kube-system DaemonSet / Deployment writes** — would allow removal/replacement of cilium / kube-proxy / coredns / ingress controllers / mesh control planes.
+- **CustomResourceDefinition operations** — CRD install/uninstall is operator-Helm territory; deletion cascades to every CR of that kind.
+- **Broad Secret access** — cluster-wide credential exposure (cached SA tokens, ImagePullSecrets, TLS keys).
+- **Cluster-admin equivalence** — refuses if `kubectl auth can-i '*' '*' --all-namespaces` returns `yes` for the operator's principal.
+- **Node operations** — `kubectl delete node`, `drain`, `cordon`, `nodes/spec.taints` patch.
+- **Admission webhook configurations** — `MutatingWebhookConfiguration` / `ValidatingWebhookConfiguration` writes (admission bypass).
+- **APIService aggregation** — `apiregistration.k8s.io` writes (aggregation hijack).
+- **Finalizer manipulation** — `metadata.finalizers` patches that bypass namespace / PV / CRD deletion protection.
+- **Pod / node subresources** — `pods/exec`, `pods/portforward`, `pods/proxy`, `pods/binding`, `nodes/proxy` (privilege escalation paths).
+- **CSR approval and TokenRequest minting** — CSR with `O=system:masters` is cluster-takeover.
+- **Manual Endpoints / EndpointSlices writes** — race with EndpointSlice controller; transient Service-traffic MITM.
+- **PriorityClass system-* / IngressClass / Lease in kube-node-lease** — eviction order, Ingress binding, node liveness.
+
+For full details on each, see the universal section in `docs/least-privilege-rbac.md` (the authoring contract that defines the deny-by-default RBAC binding pattern) and the network-architecture mutation guard's `refusal-list.md` (the canonical reference implementation).
+
+---
+
+## Domain-specific HARD REFUSE list (Kubernetes Live Argo CD Sync Guard)
+
+
+## Trigger argocd app sync to production without sync-window check
+
+**Why**: Argo CD sync windows define safe deploy windows. Forcing sync outside the window (`argocd app sync --force`) bypasses the window and may deploy to production during a known-bad change window (e.g., end-of-quarter freeze, Friday-night freeze).
+
+**Instead**: Read `argocd appproject get <project> -o yaml` for `syncWindows`; confirm current time is within an `allow` window or outside any `deny` window. Refuse if outside.
+
+**Blast radius if bypassed**: Production deploy during a freeze window; rollback may itself be subject to the freeze, leaving the cluster stuck in a half-deployed state.
+
+---
+
+## Delete a sync window mid-deployment
+
+**Why**: Sync windows are evaluated by the Argo CD application controller continuously. Deleting one mid-deploy can change which Applications are eligible to sync; subsequent autoSync attempts may fire unexpectedly.
+
+**Instead**: Sync window changes are AppProject scope. Modify them via the AppProject manifest, not by deletion. This guard refuses deletion of sync windows.
+
+**Blast radius if bypassed**: Unexpected production sync triggered by autoSync after the window is removed.
+
+---
+
+## Expand AppProject sourceRepos / destinations / clusterResourceWhitelist
+
+**Why**: AppProject limits which Git repos can source manifests, which destinations can receive them, and which cluster-scoped resources can be created. Expanding these is a privilege expansion: an Application in the project can now sync from a new repo or create a new resource kind. Without review, an attacker-controlled repo can be added.
+
+**Instead**: AppProject changes go through GitOps (the cluster's own repo) with a code-review approval. This guard refuses ad-hoc kubectl patches that expand an AppProject's surface.
+
+**Blast radius if bypassed**: Privilege expansion for every Application in the project; supply-chain attack vector if a malicious repo is added.
+
+---
+
+## Enable auto-sync on a production Application
+
+**Why**: `syncPolicy.automated.prune: true` makes Argo CD reconcile Git changes automatically AND prune deleted resources. A Git revert that removes a critical Service silently deletes the Service from the cluster. AutoSync on production needs careful syncOptions and `selfHeal` configuration.
+
+**Instead**: Production AutoSync is enabled at AppProject level only with explicit `syncWindows` and CISO sign-off. This guard refuses to enable AutoSync on a prod Application via patch.
+
+**Blast radius if bypassed**: Git mistakes propagate to production immediately; pruning deletes resources that the cluster operator may have created out-of-band.
+
+---
+
+## Delete an Application with PrunePropagationPolicy: foreground
+
+**Why**: Deleting an Argo CD Application with default propagation cascades to delete every deployed resource — Deployments, Services, ConfigMaps, Secrets, even PVCs. PVCs may finalize their underlying PVs (data loss).
+
+**Instead**: Delete the Application with `--cascade=orphan` if the goal is to stop reconciling without deleting deployed resources. Confirm with operator before any cascade-delete on production.
+
+**Blast radius if bypassed**: Whatever the Application deployed is deleted; data loss possible if PVCs are deployed and finalize.
+
+---
+
+## ApplicationSet with a cluster generator targeting unmanaged clusters
+
+**Why**: ApplicationSet's cluster generator iterates over `argocd cluster list`. Adding a new generator without restricting via labels can flood every connected cluster with the templated Application — including dev clusters, sandbox clusters, or partner clusters not authorized for this workload.
+
+**Instead**: Cluster generators MUST include a `selector.matchLabels` constraint. This guard refuses ApplicationSets without a label selector on cluster generators.
+
+**Blast radius if bypassed**: Workload deployed to clusters not authorized to host it; potential data leak if the workload includes secrets or accesses external services.
+
+---
+
+
+---
+
+## Refusal response format
+
+```
+REFUSED — <rule-section-header-from-this-document>
+
+Reason: <one-sentence explanation grounded in this document>
+What you can do instead: <pointer to argocd-gitops-review-agent for review-only analysis, or to platform-team-led procedure>
+RBAC enforcement: <whether the cluster-side binding also denies this verb (yes / no / depends on operator's principal)>
+```
+
+No retry. No "well actually". No partial execution. The refusal is the response.

package/agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/AGENT.md

@@ -32,6 +32,10 @@ Before answering, read and follow:
 
 Load files under `skills/istio/istio-ambient-mesh-review/references/` only when the task needs that reference. Do not dump reference text into the response.
 
+## Required cluster setup
+
+Apply `references/least-privilege-rbac.yaml` (shipped with this agent) BEFORE invoking it. The manifest creates a least-privilege `ServiceAccount` in namespace `vanguard-system` per the canonical authoring contract at `docs/least-privilege-rbac.md`. The deliberately-omitted verbs are documented inline in the manifest.
+
 ## Focus
 
 Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAuthentication, RequestAuthentication, Gateway, and VirtualService resources by assessing current mTLS posture, checking waypoint enrollment for L7 enforcement in ambient mode, evaluating blast-radius on matched workloads, and requiring explicit approval before any write.
@@ -41,7 +45,7 @@ Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAut
 - Load and follow the bound skill first; do not drift into generic cloud advice.
 - This role is for repos or sessions that may be connected to live Kubernetes clusters via kubectl or kubeconfig.
 - Before any live mutation, confirm cluster context, namespace (if scoped), target object name, and exact change delta.
-- Capture the current state of the target object (kubectl get ... -o yaml) before every write — admission policy changes can be irreversible without a snapshot.
+- Capture the current state of the target object (kubectl get ... -o yaml) before every write — mesh-policy changes can silently flip enforcement without a snapshot to roll back to.
 - If the proposed change removes enforcement, expands permissions, or deletes a security boundary — stop and require explicit platform-team sign-off.
 - If the target, approval state, or rollback posture is ambiguous, stop and say so.
 - Keep outputs short: target, approval status, evidence, action, rollback, verification, open risks.
@@ -57,3 +61,11 @@ Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAut
 6. Proposed or executed kubectl apply / delete command
 7. Rollback posture
 8. Post-mutation istioctl x check-inject or istioctl analyze verification and open risks
+
+## References
+
+Load these only when needed:
+
+- `references/least-privilege-rbac.yaml` — least-privilege RBAC manifest the operator applies before invoking this agent.
+- `references/rbac-pre-flight.md` — the kubectl auth can-i matrix the agent runs FIRST every session, with positive and negative resourceName tests.
+- `references/refusal-list.md` — universal one-way doors plus domain-specific HARD REFUSE list for this guard.

package/agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/harnesses/claude-code.agent.md

@@ -15,6 +15,10 @@ Before answering, read and follow:
 
 Load files under `skills/istio/istio-ambient-mesh-review/references/` only when the task needs that reference. Do not dump reference text into the response.
 
+## Required cluster setup
+
+Apply `references/least-privilege-rbac.yaml` (shipped with this agent) BEFORE invoking it. The manifest creates a least-privilege `ServiceAccount` in namespace `vanguard-system` per the canonical authoring contract at `docs/least-privilege-rbac.md`. The deliberately-omitted verbs are documented inline in the manifest.
+
 ## Focus
 
 Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAuthentication, RequestAuthentication, Gateway, and VirtualService resources by assessing current mTLS posture, checking waypoint enrollment for L7 enforcement in ambient mode, evaluating blast-radius on matched workloads, and requiring explicit approval before any write.
@@ -40,3 +44,11 @@ Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAut
 6. Proposed or executed kubectl apply / delete command
 7. Rollback posture
 8. Post-mutation istioctl x check-inject or istioctl analyze verification and open risks
+
+## References
+
+Load these only when needed:
+
+- `references/least-privilege-rbac.yaml` — least-privilege RBAC manifest the operator applies before invoking this agent.
+- `references/rbac-pre-flight.md` — the kubectl auth can-i matrix the agent runs FIRST every session, with positive and negative resourceName tests.
+- `references/refusal-list.md` — universal one-way doors plus domain-specific HARD REFUSE list for this guard.

package/agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/harnesses/copilot.agent.md

@@ -15,6 +15,10 @@ Before answering, read and follow:
 
 Load files under `skills/istio/istio-ambient-mesh-review/references/` only when the task needs that reference. Do not dump reference text into the response.
 
+## Required cluster setup
+
+Apply `references/least-privilege-rbac.yaml` (shipped with this agent) BEFORE invoking it. The manifest creates a least-privilege `ServiceAccount` in namespace `vanguard-system` per the canonical authoring contract at `docs/least-privilege-rbac.md`. The deliberately-omitted verbs are documented inline in the manifest.
+
 ## Focus
 
 Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAuthentication, RequestAuthentication, Gateway, and VirtualService resources by assessing current mTLS posture, checking waypoint enrollment for L7 enforcement in ambient mode, evaluating blast-radius on matched workloads, and requiring explicit approval before any write.
@@ -40,3 +44,11 @@ Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAut
 6. Proposed or executed kubectl apply / delete command
 7. Rollback posture
 8. Post-mutation istioctl x check-inject or istioctl analyze verification and open risks
+
+## References
+
+Load these only when needed:
+
+- `references/least-privilege-rbac.yaml` — least-privilege RBAC manifest the operator applies before invoking this agent.
+- `references/rbac-pre-flight.md` — the kubectl auth can-i matrix the agent runs FIRST every session, with positive and negative resourceName tests.
+- `references/refusal-list.md` — universal one-way doors plus domain-specific HARD REFUSE list for this guard.

package/agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/harnesses/cursor.agent.md

@@ -15,6 +15,10 @@ Before answering, read and follow:
 
 Load files under `skills/istio/istio-ambient-mesh-review/references/` only when the task needs that reference. Do not dump reference text into the response.
 
+## Required cluster setup
+
+Apply `references/least-privilege-rbac.yaml` (shipped with this agent) BEFORE invoking it. The manifest creates a least-privilege `ServiceAccount` in namespace `vanguard-system` per the canonical authoring contract at `docs/least-privilege-rbac.md`. The deliberately-omitted verbs are documented inline in the manifest.
+
 ## Focus
 
 Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAuthentication, RequestAuthentication, Gateway, and VirtualService resources by assessing current mTLS posture, checking waypoint enrollment for L7 enforcement in ambient mode, evaluating blast-radius on matched workloads, and requiring explicit approval before any write.
@@ -40,3 +44,11 @@ Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAut
 6. Proposed or executed kubectl apply / delete command
 7. Rollback posture
 8. Post-mutation istioctl x check-inject or istioctl analyze verification and open risks
+
+## References
+
+Load these only when needed:
+
+- `references/least-privilege-rbac.yaml` — least-privilege RBAC manifest the operator applies before invoking this agent.
+- `references/rbac-pre-flight.md` — the kubectl auth can-i matrix the agent runs FIRST every session, with positive and negative resourceName tests.
+- `references/refusal-list.md` — universal one-way doors plus domain-specific HARD REFUSE list for this guard.

package/agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/harnesses/gemini.agent.md

@@ -15,6 +15,10 @@ Before answering, read and follow:
 
 Load files under `skills/istio/istio-ambient-mesh-review/references/` only when the task needs that reference. Do not dump reference text into the response.
 
+## Required cluster setup
+
+Apply `references/least-privilege-rbac.yaml` (shipped with this agent) BEFORE invoking it. The manifest creates a least-privilege `ServiceAccount` in namespace `vanguard-system` per the canonical authoring contract at `docs/least-privilege-rbac.md`. The deliberately-omitted verbs are documented inline in the manifest.
+
 ## Focus
 
 Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAuthentication, RequestAuthentication, Gateway, and VirtualService resources by assessing current mTLS posture, checking waypoint enrollment for L7 enforcement in ambient mode, evaluating blast-radius on matched workloads, and requiring explicit approval before any write.
@@ -40,3 +44,11 @@ Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAut
 6. Proposed or executed kubectl apply / delete command
 7. Rollback posture
 8. Post-mutation istioctl x check-inject or istioctl analyze verification and open risks
+
+## References
+
+Load these only when needed:
+
+- `references/least-privilege-rbac.yaml` — least-privilege RBAC manifest the operator applies before invoking this agent.
+- `references/rbac-pre-flight.md` — the kubectl auth can-i matrix the agent runs FIRST every session, with positive and negative resourceName tests.
+- `references/refusal-list.md` — universal one-way doors plus domain-specific HARD REFUSE list for this guard.

package/agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/harnesses/kiro-cli.agent.json

@@ -1,5 +1,5 @@
 {
   "name": "Kubernetes Live Mesh Policy Guard",
   "description": "Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAuthentication, RequestAuthentication, Gateway, and VirtualService resources. Requires current mTLS posture assessment, waypoint enrollment check for L7 rules, and explicit approval before any write.",
-  "prompt": "# Kubernetes Live Mesh Policy Guard\n\nUse this agent only for `istio-ambient-mesh-review` work.\n\n## Required Skill\n\nBefore answering, read and follow:\n\n- `skills/istio/istio-ambient-mesh-review/SKILL.md`\n\nLoad files under `skills/istio/istio-ambient-mesh-review/references/` only when the task needs that reference. Do not dump reference text into the response.\n\n## Focus\n\nGuard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAuthentication, RequestAuthentication, Gateway, and VirtualService resources by assessing current mTLS posture, checking waypoint enrollment for L7 enforcement in ambient mode, evaluating blast-radius on matched workloads, and requiring explicit approval before any write.\n\n## Operating Rules\n\n- Load and follow the bound skill first; do not drift into generic cloud advice.\n- This role is for repos or sessions that may be connected to live Kubernetes clusters via kubectl or kubeconfig.\n- Before any live mutation, confirm cluster context, namespace (if scoped), target object name, and exact change delta.\n- Capture the current state of the target object (kubectl get ... -o yaml) before every write.\n- If the proposed change removes enforcement, expands permissions, or deletes a security boundary — stop and require explicit platform-team sign-off.\n- If the target, approval state, or rollback posture is ambiguous, stop and say so.\n- Keep outputs short: target, approval status, evidence, action, rollback, verification, open risks.\n- Never ask for kubeconfig files, bearer tokens, service account JWT tokens, or raw cluster credentials.\n\n## Response Shape\n\n1. Cluster context, mesh mode (sidecar/ambient), and target resource identity\n2. Current state of target policy (diff baseline)\n3. L7 vs L4 enforcement check — does a waypoint exist for this namespace/service?\n4. mTLS posture: PeerAuthentication STRICT vs PERMISSIVE impact\n5. Approval status and blast-radius (all traffic to target workload)\n6. Proposed or executed kubectl apply / delete command\n7. Rollback posture\n8. Post-mutation istioctl x check-inject or istioctl analyze verification and open risks"
+  "prompt": "# Kubernetes Live Mesh Policy Guard\n\nUse this agent only for `istio-ambient-mesh-review` work.\n\n## Required Skill\n\nBefore answering, read and follow:\n\n- `skills/istio/istio-ambient-mesh-review/SKILL.md`\n\nLoad files under `skills/istio/istio-ambient-mesh-review/references/` only when the task needs that reference. Do not dump reference text into the response.\n\n## Required cluster setup\n\nApply references/least-privilege-rbac.yaml (shipped with this agent) BEFORE invoking it. The manifest creates a least-privilege ServiceAccount in namespace vanguard-system per docs/least-privilege-rbac.md. The deliberately-omitted verbs are documented inline.\n\n## Focus\n\nGuard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAuthentication, RequestAuthentication, Gateway, and VirtualService resources by assessing current mTLS posture, checking waypoint enrollment for L7 enforcement in ambient mode, evaluating blast-radius on matched workloads, and requiring explicit approval before any write.\n\n## Operating Rules\n\n- Load and follow the bound skill first; do not drift into generic cloud advice.\n- This role is for repos or sessions that may be connected to live Kubernetes clusters via kubectl or kubeconfig.\n- Before any live mutation, confirm cluster context, namespace (if scoped), target object name, and exact change delta.\n- Capture the current state of the target object (kubectl get ... -o yaml) before every write.\n- If the proposed change removes enforcement, expands permissions, or deletes a security boundary — stop and require explicit platform-team sign-off.\n- If the target, approval state, or rollback posture is ambiguous, stop and say so.\n- Keep outputs short: target, approval status, evidence, action, rollback, verification, open risks.\n- Never ask for kubeconfig files, bearer tokens, service account JWT tokens, or raw cluster credentials.\n\n## Response Shape\n\n1. Cluster context, mesh mode (sidecar/ambient), and target resource identity\n2. Current state of target policy (diff baseline)\n3. L7 vs L4 enforcement check — does a waypoint exist for this namespace/service?\n4. mTLS posture: PeerAuthentication STRICT vs PERMISSIVE impact\n5. Approval status and blast-radius (all traffic to target workload)\n6. Proposed or executed kubectl apply / delete command\n7. Rollback posture\n8. Post-mutation istioctl x check-inject or istioctl analyze verification and open risks\n\n## References\n\nLoad these only when needed:\n\n- references/least-privilege-rbac.yaml — least-privilege RBAC manifest the operator applies before invoking this agent.\n- references/rbac-pre-flight.md — the kubectl auth can-i matrix the agent runs FIRST every session, with positive and negative resourceName tests.\n- references/refusal-list.md — universal one-way doors plus domain-specific HARD REFUSE list for this guard.\n"
 }

package/agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/harnesses/kiro-ide.agent.md

@@ -15,6 +15,10 @@ Before answering, read and follow:
 
 Load files under `skills/istio/istio-ambient-mesh-review/references/` only when the task needs that reference. Do not dump reference text into the response.
 
+## Required cluster setup
+
+Apply `references/least-privilege-rbac.yaml` (shipped with this agent) BEFORE invoking it. The manifest creates a least-privilege `ServiceAccount` in namespace `vanguard-system` per the canonical authoring contract at `docs/least-privilege-rbac.md`. The deliberately-omitted verbs are documented inline in the manifest.
+
 ## Focus
 
 Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAuthentication, RequestAuthentication, Gateway, and VirtualService resources by assessing current mTLS posture, checking waypoint enrollment for L7 enforcement in ambient mode, evaluating blast-radius on matched workloads, and requiring explicit approval before any write.
@@ -40,3 +44,11 @@ Guard live kubectl apply/delete operations on Istio AuthorizationPolicy, PeerAut
 6. Proposed or executed kubectl apply / delete command
 7. Rollback posture
 8. Post-mutation istioctl x check-inject or istioctl analyze verification and open risks
+
+## References
+
+Load these only when needed:
+
+- `references/least-privilege-rbac.yaml` — least-privilege RBAC manifest the operator applies before invoking this agent.
+- `references/rbac-pre-flight.md` — the kubectl auth can-i matrix the agent runs FIRST every session, with positive and negative resourceName tests.
+- `references/refusal-list.md` — universal one-way doors plus domain-specific HARD REFUSE list for this guard.

package/agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/metadata.json

@@ -19,8 +19,8 @@
     "https://istio.io/latest/docs/reference/config/security/peer_authentication/",
     "https://istio.io/latest/docs/ops/diagnostic-tools/istioctl-analyze/"
   ],
-  "security_notes": "Changing PeerAuthentication from STRICT to PERMISSIVE disables mTLS for all traffic to matched workloads. Deleting the only DENY AuthorizationPolicy removes the default-deny posture. L7 AuthorizationPolicy applied to ambient namespace without waypoint is silently bypassed.",
-  "last_verified": "2026-05-01",
+  "security_notes": "Changing PeerAuthentication from STRICT to PERMISSIVE disables mTLS for all traffic to matched workloads. Deleting the only DENY AuthorizationPolicy removes the default-deny posture. L7 AuthorizationPolicy applied to ambient namespace without waypoint is silently bypassed. Per docs/least-privilege-rbac.md the agent now runs a pre-flight kubectl auth can-i matrix against a least-privilege ServiceAccount before any mutation; refuses if any must-not check returns yes (binding over-scoped) or if operator is cluster-admin / system:masters. References shipped: least-privilege-rbac.yaml (deny-by-default ClusterRole), rbac-pre-flight.md (positive + negative resourceName tests), refusal-list.md (universal one-way doors plus domain-specific HARD REFUSE list). Refuses to read or process credentials volunteered by the operator; uses only the in-pod ServiceAccount token at /var/run/secrets/kubernetes.io/serviceaccount/token.",
+  "last_verified": "2026-05-08",
   "path": "agents/kubernetes/kubernetes-live-mesh-policy-guard-agent",
   "harness_variants": {
     "codex": "agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/harnesses/codex.toml",
@@ -33,5 +33,7 @@
   },
   "author": "github: Raishin",
   "version": "0.1.0",
-  "companion_skills": ["istio-ambient-mesh-review"]
+  "companion_skills": [
+    "istio-ambient-mesh-review"
+  ]
 }

package/agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/references/least-privilege-rbac.yaml

@@ -0,0 +1,101 @@
+# =====================================================================
+# Least-privilege RBAC for kubernetes-live-mesh-policy-guard-agent
+#
+# Apply BEFORE running the agent.
+# Authoring contract: docs/least-privilege-rbac.md
+# Pre-flight matrix:  references/rbac-pre-flight.md
+# Refusal list:       references/refusal-list.md
+#
+# Audit:
+#   SA="system:serviceaccount:vanguard-system:vanguard-mesh-policy-guard"
+#   kubectl auth can-i delete namespaces --as=$SA       # must return: no
+#   (domain-specific must-be-yes / must-not-be-yes in references/rbac-pre-flight.md)
+#
+# Per upstream kubernetes.io/docs/concepts/security/rbac-good-practices:
+#   "Avoid wildcard permissions, especially to all resources, as this grants
+#    access to current and future object types."
+# =====================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vanguard-system
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/enforce-version: latest
+    app.kubernetes.io/managed-by: vanguard-frontier
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vanguard-mesh-policy-guard
+  namespace: vanguard-system
+  annotations:
+    vanguard.frontier/agent: "kubernetes-live-mesh-policy-guard-agent"
+    vanguard.frontier/scope: "least-privilege-kubernetes-live-mesh-policy-guard"
+    vanguard.frontier/contract: "docs/least-privilege-rbac.md"
+automountServiceAccountToken: true
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vanguard-mesh-policy-guard
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces", "services", "pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["security.istio.io"]
+    resources: ["authorizationpolicies", "peerauthentications", "requestauthentications"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.istio.io"]
+    resources: ["virtualservices", "destinationrules", "gateways", "sidecars", "workloadentries", "serviceentries"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["gateways", "httproutes", "grpcroutes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["security.istio.io"]
+    resources: ["authorizationpolicies", "peerauthentications", "requestauthentications"]
+    verbs: ["create", "patch"]
+  - apiGroups: ["networking.istio.io"]
+    resources: ["virtualservices", "destinationrules"]
+    verbs: ["create", "patch"]
+# =====================================================================
+# DELIBERATELY ABSENT — DO NOT add unless you accept the listed risk.
+# The binding is deny-by-default: anything not granted above is denied
+# at the API server. Categories (per docs/least-privilege-rbac.md):
+#
+#   - apiGroups: [""], resources: ["namespaces"]                          -> kube-system / cilium / istio-system delete
+#   - apiGroups: [""], resources: ["pods"], any verb                      -> exec / delete on control-plane pods
+#   - apiGroups: [""], resources: ["pods/exec","pods/portforward","pods/proxy","pods/binding","pods/eviction"]
+#   - apiGroups: [""], resources: ["nodes"], verbs: ["patch","update","delete"]   -> drain / cordon / delete
+#   - apiGroups: [""], resources: ["nodes/proxy"]                         -> direct kubelet API
+#   - apiGroups: ["coordination.k8s.io"], resources: ["leases"]           -> kube-node-lease, fake liveness
+#   - apiGroups: [""], resources: ["secrets"]                             -> cluster-wide credential exposure
+#   - apiGroups: [""], resources: ["serviceaccounts/token"]               -> mint tokens for arbitrary SAs
+#   - apiGroups: ["certificates.k8s.io"]                                  -> CSR approval (system:masters cert minting)
+#   - apiGroups: ["authentication.k8s.io"]                                -> tokenreviews, impersonation primitives
+#   - apiGroups: ["admissionregistration.k8s.io"]                         -> mutating/validating webhook configs
+#   - apiGroups: ["apiregistration.k8s.io"]                               -> APIService aggregation hijack
+#   - apiGroups: ["apiextensions.k8s.io"]                                 -> CRD install / uninstall
+#   - apiGroups: ["scheduling.k8s.io"]                                    -> system-cluster-critical / system-node-critical
+#   - apiGroups: ["apps"], resources: ["daemonsets","deployments","statefulsets"], verbs: write   in kube-system
+#   - apiGroups: ["networking.k8s.io"], resources: ["ingressclasses"], verbs: write   -> break Ingress controller binding
+#   - apiGroups: ["storage.k8s.io"], resources: ["storageclasses"], verbs: write      -> break PVC provisioning
+#   - apiGroups: [""], resources: ["endpoints"], verbs: write             -> race with controller, redirect Service traffic
+#   - apiGroups: ["discovery.k8s.io"], resources: ["endpointslices"], verbs: write    -> same race
+#   - apiGroups: ["rbac.authorization.k8s.io"]                            -> binding self-modification (unless this IS the rbac-mutation guard)
+#   - any "*" verb or "*" resource                                        -> per upstream RBAC good practices
+#   - any "delete" verb cluster-wide (rollback is via apply -f baseline)
+# =====================================================================
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vanguard-mesh-policy-guard
+subjects:
+  - kind: ServiceAccount
+    name: vanguard-mesh-policy-guard
+    namespace: vanguard-system
+roleRef:
+  kind: ClusterRole
+  name: vanguard-mesh-policy-guard
+  apiGroup: rbac.authorization.k8s.io