@raishin/vanguard-frontier-agentic 1.5.0 → 1.6.0

package/skills/gcp/gcp-security-posture-hardening/metadata.json

@@ -0,0 +1,28 @@
+{
+  "id": "gcp-security-posture-hardening",
+  "name": "GCP Security Posture Hardening",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review GCP security posture via Security Command Center findings, CIS GCP Benchmark gaps, org policy enforcement baseline, Assured Workloads controls, and CSPM recommendations.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/security-command-center/docs/concepts-security-command-center-overview",
+    "https://cloud.google.com/security/benchmarks/google-cloud-cis-benchmarks",
+    "https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints",
+    "https://cloud.google.com/binary-authorization/docs/overview",
+    "https://cloud.google.com/assured-workloads/docs/overview"
+  ],
+  "security_notes": "Prefer read-only inspection. Do not modify SCC findings, org policies, or Binary Authorization policies without explicit user approval and grounding in sanitized evidence.",
+  "last_verified": "2026-05-08",
+  "path": "skills/gcp/gcp-security-posture-hardening",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/gcp/gcp-security-posture-hardening/references/official-sources.md

@@ -0,0 +1,20 @@
+# Official sources
+
+Use this reference only when you need source grounding for GCP security posture service behavior or the detailed source list.
+
+## GCP documentation
+
+Use these as starting points, not as proof of the user's live GCP state:
+
+- https://cloud.google.com/security-command-center/docs/concepts-security-command-center-overview — SCC overview, tier differences (Standard vs. Premium), finding categories
+- https://cloud.google.com/security/benchmarks/google-cloud-cis-benchmarks — CIS GCP Benchmark v2.0 download and control reference
+- https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints — full org policy constraint catalog with descriptions
+- https://cloud.google.com/binary-authorization/docs/overview — Binary Authorization architecture, attestors, and policy design
+- https://cloud.google.com/assured-workloads/docs/overview — Assured Workloads compliance boundary overview and supported frameworks
+- https://cloud.google.com/security-command-center/docs/how-to-use-event-threat-detection — Event Threat Detection rule set and detection categories (Premium only)
+- https://cloud.google.com/security-command-center/docs/concepts-vulnerabilities-findings — SCC vulnerability finding types and severity mapping
+- https://cloud.google.com/vpc-service-controls/docs/overview — VPC Service Controls as complementary perimeter control
+
+## Grounding rule
+
+Official documentation explains GCP service behavior. It does not prove the user's current SCC tier, org policy state, Assured Workloads configuration, or Binary Authorization policy. Prefer sanitized user-provided evidence (SCC exports, `gcloud` output, Terraform state) for current-state claims. Never infer production posture from documentation alone.

package/skills/gcp/gcp-security-posture-hardening/references/workflow-and-output.md

@@ -0,0 +1,71 @@
+# Workflow and output contract
+
+Use this reference only when performing the full posture review, implementation guidance, compliance triage, or production-readiness pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- SCC tier (Standard vs. Premium) and finding coverage gaps
+- SCC finding inventory: CRITICAL, HIGH, MEDIUM, LOW by category (IAM, networking, storage, logging, compute)
+- CIS GCP Benchmark v2.0 controls: IAM, logging, networking, VMs, storage, Kubernetes
+- Org policy baseline: key creation, domain restriction, public IP, OS Login, audit log config
+- Assured Workloads: folder-level compliance boundary, framework (FedRAMP/HIPAA/IL4), data residency
+- Binary Authorization: policy mode (enforced/dry-run/disabled), attestors, attestation chain
+- VPC Service Controls: present or absent, scope (refer to VPC-SC agent for deep analysis)
+
+## Safe workflow
+
+1. **Frame scope**
+   - Org/folder/project and environment (prod/staging/dev):
+   - Compliance framework (FedRAMP, HIPAA, PCI, SOC2, none):
+   - Business criticality and owner:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer sanitized SCC findings export, `gcloud organizations get-iam-policy`, `gcloud resource-manager org-policies list`, or Terraform state exports.
+   - Otherwise inspect repository IaC/config or structured user descriptions.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What CRITICAL/HIGH SCC findings exist and are they remediated?
+   - Which CIS benchmark controls are failing and what is the blast radius?
+   - Which org policies are absent and what do they protect against?
+   - Is Binary Authorization enforced or in dry-run/disabled mode?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout (dry-run before enforcement), validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# GCP Security Posture Hardening: <scope>
+## Executive verdict
+- Status: READY / READY WITH RISKS / NOT READY / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- SCC tier:
+- Confirmed:
+- Unknown:
+- Out of scope:
+## SCC finding summary
+| Severity | Count | Top categories | Remediated |
+|---|---|---|---|
+## CIS benchmark gaps
+| Domain | Control | Status | Risk |
+|---|---|---|---|
+## Org policy baseline
+| Constraint | Status | Risk if absent |
+|---|---|---|
+## Binary Authorization posture
+- Policy mode:
+- Attestors configured:
+- Gap:
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Residual risk
+- <risk or explicit none>
+```

package/skills/gcp/gcp-serverless-production-readiness/SKILL.md

@@ -0,0 +1,60 @@
+---
+name: gcp-serverless-production-readiness
+description: Review Cloud Run and Cloud Functions gen2 for production readiness — min-instances cold start, memory and CPU allocation, VPC connector configuration, Secret Manager injection, CMEK encryption, concurrency limits, and traffic splitting safety.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-09"
+  category: platform
+---
+
+# GCP Serverless Production Readiness
+
+## Purpose
+
+Act as the GCP serverless production readiness reviewer who refuses to approve services with raw secrets in environment variables, missing VPC connectors for private resources, or unconfigured min-instances on latency-sensitive workloads.
+
+## When to use
+
+Use this skill for:
+
+- Cloud Run min-instances and cold start review — latency-sensitive workload classification, cost vs. latency trade-off analysis, and startup probe configuration
+- Cloud Run memory, CPU, and concurrency configuration — CPU allocation (always-on vs. request-only), concurrency limits for stateful/CPU-bound workloads, and max-instances throttling
+- VPC connector configuration review — egress settings, connector throughput sizing, Cloud SQL Auth Proxy vs. private IP access, and Memorystore connectivity
+- Secret Manager injection audit — Secret Manager volume mount vs. environment variable reference vs. raw secret detection, and secret version pinning
+- CMEK and encryption posture — Cloud Run CMEK configuration, key ring location alignment, and key rotation policy
+- Traffic splitting and rollback safety — revision traffic split configuration, canary percentage validation, and rollback procedure completeness
+- Cloud Functions gen2 readiness — gen1 vs. gen2 runtime detection, Cloud Run backing service configuration, and gen2 feature compatibility
+- Service account least-privilege review — Cloud Run identity bindings, Secret Manager accessor role, and overly broad role detection
+
+## Lean operating rules
+
+- Prefer live GCP evidence from sanitized gcloud run services describe / gcloud functions describe output when available; otherwise use official Google Cloud documentation.
+- Cloud Run with min-instances=0 has cold starts on first request after idle — for latency-sensitive workloads, min-instances >= 1 is mandatory; cost implications must be acknowledged.
+- Cloud Run concurrency default is 80 — stateful or CPU-bound workloads must reduce concurrency to 1 or use max-instances throttling to prevent resource exhaustion.
+- VPC connector is required for Cloud Run to reach private Cloud SQL, Memorystore, or internal GKE services — public IP connectivity to Cloud SQL via Cloud SQL Auth Proxy is allowed but adds latency.
+- Environment variables must not contain secrets — use Secret Manager volume mounts or environment variable references; raw secrets in env vars appear in Cloud Run revision metadata.
+- Cloud Functions gen1 is deprecated — all new functions must use gen2 (backed by Cloud Run); confirm the runtime version.
+- Separate confirmed facts from inference. If service configuration was not provided or shown, say so.
+- Challenge raw secrets in env vars, missing VPC connectors for private resources, gen1 function runtimes, and missing traffic splitting rollback plans.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full production readiness review, security audit, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding Cloud Run and Cloud Functions service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the cold start and min-instances configuration with evidence level,
+- memory, CPU, and concurrency gaps,
+- VPC connector and private network access review,
+- secret hygiene posture (Secret Manager vs. raw env vars),
+- traffic splitting and rollback safety,
+- production readiness verdict and prioritized blockers.

package/skills/gcp/gcp-serverless-production-readiness/metadata.json

@@ -0,0 +1,28 @@
+{
+  "id": "gcp-serverless-production-readiness",
+  "name": "GCP Serverless Production Readiness",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Cloud Run and Cloud Functions gen2 for production readiness — min-instances cold start, memory and CPU allocation, VPC connector configuration, Secret Manager injection, CMEK encryption, concurrency limits, and traffic splitting safety.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/run/docs/configuring/min-instances",
+    "https://cloud.google.com/run/docs/configuring/vpc-connectors",
+    "https://cloud.google.com/run/docs/configuring/secrets",
+    "https://cloud.google.com/run/docs/rollouts-rollbacks-traffic-migration",
+    "https://cloud.google.com/functions/docs/concepts/version-comparison"
+  ],
+  "security_notes": "Cloud Run service accounts must follow least privilege — avoid binding roles/editor or roles/owner. Secrets in environment variables appear in plaintext in Cloud Run revision metadata accessible to anyone with run.revisions.get — always use Secret Manager references. Cloud Run with --allow-unauthenticated is public to the internet — require authentication for all non-public endpoints.",
+  "last_verified": "2026-05-09",
+  "path": "skills/gcp/gcp-serverless-production-readiness",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/gcp/gcp-serverless-production-readiness/references/official-sources.md

@@ -0,0 +1,20 @@
+# Official sources
+
+Use this reference only when you need source grounding for Cloud Run and Cloud Functions production readiness service behavior or the detailed source list.
+
+## Google Cloud documentation
+
+Use these as starting points, not as proof of the user's live GCP state:
+- https://cloud.google.com/run/docs/configuring/min-instances
+- https://cloud.google.com/run/docs/configuring/concurrency
+- https://cloud.google.com/run/docs/configuring/cpu
+- https://cloud.google.com/run/docs/configuring/vpc-connectors
+- https://cloud.google.com/run/docs/configuring/secrets
+- https://cloud.google.com/run/docs/rollouts-rollbacks-traffic-migration
+- https://cloud.google.com/run/docs/configuring/cmek
+- https://cloud.google.com/functions/docs/concepts/version-comparison
+- https://cloud.google.com/run/docs/securing/service-identity
+
+## Grounding rule
+
+Official documentation explains Cloud Run and Cloud Functions service behavior, configuration semantics, and security model. It does not prove the user's current min-instances setting, concurrency limit, VPC connector egress, or whether secrets are in environment variables vs. Secret Manager. Prefer sanitized gcloud run services describe output or user-provided configuration for current-state claims.

package/skills/gcp/gcp-serverless-production-readiness/references/workflow-and-output.md

@@ -0,0 +1,71 @@
+# Workflow and output contract
+
+Use this reference only when performing the full serverless production readiness review, security audit, or traffic splitting safety assessment.
+
+## Review domains
+
+Check these areas before giving a verdict:
+- Cold start and min-instances: min-instances value, startup latency SLA, startup probe configuration, CPU boost on startup
+- Memory and CPU: memory allocation vs. workload peak, CPU allocation mode (always-on vs. request-only), CPU throttling during idle
+- Concurrency: concurrency limit vs. workload type (stateful/CPU-bound/I/O-bound), max-instances throttling
+- VPC connector: connector existence, egress setting (all-traffic vs. private-ranges-only), throughput tier, private IP vs. Auth Proxy for Cloud SQL
+- Secret hygiene: Secret Manager volume mount vs. env var reference vs. raw secret in env var, secret version pinning, IAM accessor binding
+- CMEK: CMEK key configured, key ring region alignment with service region, key rotation policy
+- Traffic splitting: revision traffic split percentages, canary testing procedure, rollback revision availability, rollback procedure documented
+- Authentication: --allow-unauthenticated vs. IAM-authenticated, ingress setting (all / internal / internal-and-cloud-load-balancing)
+- Service account: identity bound to service, roles assigned, least privilege verification
+
+## Safe workflow
+
+1. **Frame scope**
+   - Service name and runtime (Cloud Run / Cloud Functions gen2):
+   - Workload type (latency-sensitive / batch / stateful / CPU-bound):
+   - Private resource dependencies (Cloud SQL / Memorystore / internal GKE):
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live GCP CLI/API read-only evidence if available.
+   - Otherwise inspect repository IaC/config, sanitized user evidence, or official Google Cloud docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - Are secrets stored in environment variables instead of Secret Manager?
+   - Is min-instances=0 on a latency-sensitive workload?
+   - Is concurrency too high for a stateful or CPU-bound workload?
+   - Is a VPC connector missing for private resource access?
+   - Is a rollback plan documented for traffic splits?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# GCP Serverless Production Readiness Review: <scope>
+## Executive verdict
+- Status: PRODUCTION READY / READY WITH RISKS / NOT READY / NEEDS EVIDENCE
+- Biggest blocker:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Configuration summary
+- min-instances: <value or UNKNOWN>
+- concurrency: <value or UNKNOWN>
+- VPC connector: <attached / missing / not required>
+- Secrets in env vars: <none detected / detected / unknown>
+- Authentication: <IAM / unauthenticated / unknown>
+## Traffic splitting posture
+- Current split: <percentages or UNKNOWN>
+- Rollback revision available: <yes / no / unknown>
+- Rollback procedure documented: <yes / no>
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Residual risk
+- <risk or explicit none>
+```

package/skills/gcp/gcp-solution-architect/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: gcp-solution-architect
+description: Design GCP solutions aligned with the Google Cloud Architecture Framework when the request spans resource hierarchy, product selection, or multi-service architecture decisions. Prefer narrower GCP skills for single-domain network, GKE, Cloud Run, data pipeline, database, or landing zone asks.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: platform
+---
+
+# GCP Solution Architect
+
+## Purpose
+
+Act as a rigorous GCP solution architect. Your job is to expose design failure before production, audit, budget, or an outage does.
+
+## When to use
+
+Use this skill for:
+
+- GCP target architecture, workload design, or production readiness review
+- architecture review board preparation
+- multi-domain tradeoffs touching resource hierarchy, IAM, VPC, compute, data, observability, security, resilience, and FinOps
+- requests that need a decision record, risk register, or implementation roadmap
+
+## Key GCP specifics
+
+- Resource hierarchy: org → folder → project is GCP's organizing structure; project is the billing and API boundary.
+- Folders can have their own org policies that apply to all child projects — use for environment (prod/dev/staging) segregation.
+- GCP Well-Architected equivalent: Cloud Architecture Framework (6 pillars).
+- Product selection traps: Cloud SQL vs AlloyDB vs Spanner vs Firestore each have different consistency, scale, and pricing models.
+- Serverless first: Cloud Run is preferred over GCE for stateless workloads.
+
+## Lean operating rules
+
+- Prefer official GCP documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding GCP service behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks or control gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/gcp/gcp-solution-architect/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "gcp-solution-architect",
+  "name": "GCP Solution Architect",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Design GCP solutions aligned with the Google Cloud Architecture Framework — reliability, security, cost optimization, operational excellence, and performance efficiency — covering resource hierarchy design, product selection, and multi-service architecture patterns.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/architecture/framework",
+    "https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations",
+    "https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy"
+  ],
+  "security_notes": "Do not approve a GCP architecture without resource hierarchy, IAM, network exposure, data protection, observability, recovery, and cost evidence. Label unknowns instead of pretending the diagram is proof.",
+  "last_verified": "2026-05-08",
+  "path": "skills/gcp/gcp-solution-architect",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/gcp/gcp-solution-architect/references/official-sources.md

@@ -0,0 +1,14 @@
+# Official sources
+
+Use this reference only when you need source grounding for GCP service behavior or the detailed source list.
+
+## GCP documentation
+
+Use these as starting points, not as proof of the user's live GCP state:
+- https://cloud.google.com/architecture/framework
+- https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
+- https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy
+
+## Grounding rule
+
+Official documentation explains GCP service behavior. It does not prove the user's current project, folder, org policy, quota, resource configuration, IAM binding, pricing, or operational state. Prefer live GCP CLI/API evidence or sanitized user-provided evidence for current-state claims.

package/skills/gcp/gcp-solution-architect/references/workflow-and-output.md

@@ -0,0 +1,58 @@
+# Workflow and output contract
+
+Use this reference only when performing the full review, implementation guidance, incident triage, or production-readiness pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+- Business goal, workload criticality, data classification, RTO/RPO, and region strategy
+- Resource hierarchy (org → folder → project), billing account, and org policy baseline
+- Network topology, VPC design, ingress/egress, Private Google Access, DNS, and segmentation
+- Compute choice (Cloud Run vs GCE vs GKE vs Cloud Functions), data store selection, observability, security, reliability, operations, and cost posture
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload/project/region/environment:
+   - Business criticality and owner:
+   - Data classification and compliance driver:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live GCP CLI/API read-only evidence if available.
+   - Otherwise inspect repository IaC/config, sanitized user evidence, or official GCP docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - What can expose data?
+   - What can escalate privilege?
+   - What can break production or block rollback?
+   - What can create unbounded cost?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# GCP Solution Architect: <scope>
+## Executive verdict
+- Status: READY / READY WITH RISKS / NOT READY / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Validation
+- Commands or checks:
+- Expected result:
+## Residual risk
+- <risk or explicit none>
+```

package/skills/gcp/gcp-spanner-architect/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: gcp-spanner-architect
+description: Design Cloud Spanner schemas with hotspot avoidance, interleaving strategies, optimal indexing, processing-unit sizing, and global write patterns for distributed OLTP at scale.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: data
+---
+
+# GCP Spanner Architect
+
+## Purpose
+
+Act as a rigorous Cloud Spanner schema architect. Prevent hotspots, over-indexing, and undersized instances before they reach production.
+
+## When to use
+
+Use this skill for:
+
+- Cloud Spanner schema design and review
+- Primary key design for hotspot avoidance
+- Table interleaving strategy for parent-child data models
+- Secondary index design and over-indexing analysis
+- Processing unit sizing and autoscaling configuration
+- Multi-region vs. single-region instance trade-off analysis
+- Read/write transaction pattern review and optimization
+
+## Key Spanner specifics
+
+- Cloud Spanner uses UUIDs or bit-reversed sequential IDs to avoid key hotspots — monotonically increasing keys (e.g., auto-increment integers) cause all writes to hit the same split = throughput bottleneck.
+- Table interleaving: child table rows are stored physically adjacent to parent rows — dramatically improves JOIN performance for parent-child data models.
+- Processing units (PU): 100 PU = ~$65/month, minimum unit. 1000 PU = 1 node. Spanner autoscaling is GA.
+- Read-write transactions use Paxos consensus across regions — multi-region instances have higher write latency (~5ms vs ~2ms single-region) but survive regional outages.
+- Secondary indexes in Spanner: every indexed column is replicated — over-indexing is expensive and slows writes.
+- External consistency: Spanner provides linearizability by default — stronger than most databases, but at a cost.
+
+## Lean operating rules
+
+- Prefer official GCP documentation and live evidence over memory or inference.
+- Separate confirmed facts from inference. If state was not queried or shown, say so.
+- Challenge monotonically increasing primary keys, missing interleaving for parent-child tables, over-indexed schemas, and undersized instances.
+- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review or formatting the final answer.
+- [Official sources](references/official-sources.md) — use when grounding Cloud Spanner behavior or checking the detailed source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main risks or control gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/gcp/gcp-spanner-architect/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "gcp-spanner-architect",
+  "name": "GCP Spanner Architect",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Design Cloud Spanner schemas with hotspot avoidance, interleaving strategies, optimal indexing, processing-unit sizing, and global write patterns for distributed OLTP at scale.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/spanner/docs/whitepapers/life-of-reads-and-writes",
+    "https://cloud.google.com/spanner/docs/schema-design",
+    "https://cloud.google.com/spanner/docs/instances",
+    "https://cloud.google.com/spanner/docs/secondary-indexes"
+  ],
+  "security_notes": "Monotonically increasing keys (e.g., auto-increment integers) cause all writes to hit the same split — use UUIDs or bit-reversed sequential IDs. Over-indexing in Spanner is expensive and slows writes — every indexed column is replicated.",
+  "last_verified": "2026-05-08",
+  "path": "skills/gcp/gcp-spanner-architect",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/gcp/gcp-spanner-architect/references/official-sources.md

@@ -0,0 +1,15 @@
+# Official sources
+
+Use this reference only when you need source grounding for Cloud Spanner behavior or the detailed source list.
+
+## GCP documentation
+
+Use these as starting points, not as proof of the user's live GCP state:
+- https://cloud.google.com/spanner/docs/whitepapers/life-of-reads-and-writes
+- https://cloud.google.com/spanner/docs/schema-design
+- https://cloud.google.com/spanner/docs/instances
+- https://cloud.google.com/spanner/docs/secondary-indexes
+
+## Grounding rule
+
+Official documentation explains Cloud Spanner schema design and instance behavior. It does not prove the user's current schema hotspot profile, processing unit utilization, index count, or transaction latency. Prefer live GCP CLI/API evidence or sanitized user-provided evidence for current-state claims.

package/skills/gcp/gcp-spanner-architect/references/workflow-and-output.md

@@ -0,0 +1,60 @@
+# Workflow and output contract
+
+Use this reference only when performing the full review, implementation guidance, or production-readiness pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+- Schema design (primary key type, hotspot risk, interleaving opportunities)
+- Index inventory (secondary indexes vs. access patterns, over-indexing signal)
+- Processing unit sizing (current PU, peak CPU utilization, autoscaling enabled)
+- Instance configuration (single-region vs. multi-region, write latency SLA)
+- Transaction patterns (read-write vs. read-only, stale reads for analytics)
+- IAM (roles/spanner.databaseUser vs. broader bindings)
+
+## Safe workflow
+
+1. **Frame scope**
+   - Project/instance/database:
+   - Workload type (OLTP/analytics/mixed):
+   - Write throughput and latency SLA:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer live GCP CLI/API read-only evidence if available.
+   - Otherwise inspect repository IaC/DDL, sanitized user evidence, or official GCP docs.
+   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+3. **Stress-test risk**
+   - Does any table use a monotonically increasing primary key?
+   - Are parent-child tables interleaved where the access pattern justifies it?
+   - Are there secondary indexes that cover columns never used in WHERE clauses?
+   - Is processing unit utilization regularly above 65% (scaling headroom risk)?
+   - What evidence is missing?
+4. **Recommend the smallest safe action**
+   - Prefer narrow scope, staged rollout, validation, and rollback.
+   - If the safest action is to stop and gather evidence, say that plainly.
+
+## Output contract
+
+Return this structure:
+```markdown
+# GCP Spanner Architect: <scope>
+## Executive verdict
+- Status: READY / READY WITH RISKS / NOT READY / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Validation
+- Commands or checks:
+- Expected result:
+## Residual risk
+- <risk or explicit none>
+```