npm - @raishin/vanguard-frontier-agentic - Versions diffs - 1.5.0 → 1.7.0 - Mend

@raishin/vanguard-frontier-agentic 1.5.0 → 1.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2337) hide show

package/README.md CHANGED Viewed

@@ -36,7 +36,8 @@
 This repo collects reusable **skills**, **agents**, **rules**, **MCP references**,
 and supporting assets for engineers working with AWS, Azure, OCI, GCP,
-Kubernetes, Terraform, cloud security, and compliance-heavy architecture.
+Alibaba Cloud, Huawei Cloud, Kubernetes, Terraform, cloud security,
+and compliance-heavy architecture.
 - 🧠 **Skills** = step-by-step workflows an AI assistant can follow.
 - 🤖 **Agents** = reusable expert roles for review, architecture, and operations.
@@ -86,16 +87,19 @@ npm install @raishin/vanguard-frontier-agentic@latest
 ## 🧠 Skills
-**138 skills** across AWS, Azure, OCI, Kubernetes, CNCF ecosystem, Terraform, and more.
+**286 skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, and more.
 | Domain             | Count | What they cover                                                                                   |
 | ------------------ | ----: | ------------------------------------------------------------------------------------------------- |
-| 🟧 AWS              |    43 | IAM, EKS, ECS, Lambda, RDS, S3, Cost, DevOps, Bedrock, Security, Live Guards                      |
-| 🟦 Azure            |    32 | AKS, App Service, ARM/Bicep, Key Vault, PIM, Cost, Entra ID, CosmosDB, Live Guards                |
-| 🟥 OCI              |    37 | ADB, OKE, IAM, Vault, Resource Manager, Cost, Networking, Live Guards                             |
-| ☸️ Kubernetes       |     5 | RBAC review, workload identity, PSA, live RBAC/admission/mesh/network/ArgoCD guards, maestro      |
+| 🟧 AWS              |    47 | IAM, EKS, ECS, Lambda, RDS, S3, Cost, DevOps, Bedrock, Security, WAF reviews, Live Guards         |
+| 🟥 OCI              |    41 | ADB, OKE, IAM, Vault, Resource Manager, Cost, Networking, WAF reviews, Live Guards                |
+| 🟩 GCP              |    51 | GKE, BigQuery, Vertex AI, Cloud Run, AlloyDB, Firebase, Gemini API, WAF reviews, Live Guards      |
+| 🟦 Azure            |    36 | AKS, App Service, ARM/Bicep, Key Vault, PIM, Cost, Entra ID, CosmosDB, WAF reviews, Live Guards   |
+| 🟠 Alibaba Cloud    |    43 | ACK, ECS, PolarDB, MaxCompute, RAM, OSS, MLPS 2.0, WAF reviews, Live Guards                       |
+| 🔴 Huawei Cloud     |    43 | CCE, GaussDB, ModelArts, DEW, SecMaster, OBS, MLPS 2.0, WAF reviews, Live Guards                  |
+| ☸️ Kubernetes       |    10 | RBAC review, workload identity, PSA, live RBAC/admission/mesh/network/ArgoCD guards, maestro      |
 | 🛡️ Kyverno          |     1 | ClusterPolicy/Policy, PolicyException, failureAction, background scan                             |
-| 🔄 Argo CD          |     1 | AppProject blast-radius, sync impersonation, RollingSync, sync-window                             |
+| 🔄 Argo CD          |     2 | AppProject blast-radius, sync impersonation, RollingSync, sync-window                             |
 | 🕸️ Istio            |     1 | Ambient mesh, ztunnel L4 vs waypoint L7, PeerAuthentication, mTLS posture                        |
 | 🐝 Cilium           |     1 | CiliumNetworkPolicy, ClusterMesh trust, 169.254.169.254 egress, WireGuard encryption              |
 | 📡 OpenTelemetry    |     1 | Collector pipeline, memory_limiter, receiver exposure, exporter cardinality, credential handling  |
@@ -105,6 +109,37 @@ npm install @raishin/vanguard-frontier-agentic@latest
 Live-guard skills enforce approval gates and rollback posture for irreversible operations:
+**🟧 AWS (5):**
+- `aws-live-deployment-guarded-operator` — approval-gated generic live deployment actions with account/region confirmation
+- `aws-live-iac-change-guard` — CloudFormation/SAM/CDK/Terraform change set + drift + rollback posture enforcement
+- `aws-live-pipeline-approval-operator` — CodePipeline approval gating with exact stage and approver scope
+- `aws-live-serverless-release-guard` — Lambda alias/canary/linear rollout with alarm + rollback required
+- `aws-live-ecs-rollout-guard` — ECS/Fargate deployment circuit breaker, health check evidence, rollback path
+**🟩 GCP (6):**
+- `gcp-live-gke-rollout-guard` — GKE deployment and node pool mutations, control-plane version gating
+- `gcp-live-iam-policy-change-guard` — IAM binding mutations, org policy changes, SA key creation — org-wide blast radius
+- `gcp-live-kms-key-destruction-guard` — Cloud KMS key version destruction — CMEK data permanently unrecoverable
+- `gcp-live-cost-budget-action-guard` — budget thresholds, CUD commitments, quota increases — financial authority gate
+- `gcp-live-bigquery-dataset-deletion-guard` — dataset deletion, table truncation, authorized view changes — irreversible data loss
+- `gcp-live-cloud-run-traffic-migration-guard` — Cloud Run revision traffic shifts, min-instances changes — production traffic blast radius
+**🟠 Alibaba Cloud (6):**
+- `alibaba-live-ack-rollout-guard` — ACK deployment mutations, node pool scaling, cluster version upgrades
+- `alibaba-live-ram-policy-change-guard` — RAM policy/role mutations — account-wide blast radius, privilege escalation risk
+- `alibaba-live-kms-key-mutation-guard` — KMS key deletion/disable — encrypted data permanently inaccessible
+- `alibaba-live-cost-budget-action-guard` — budget threshold changes, Savings Plan purchases, RI commitments — financial authority gate
+- `alibaba-live-oss-bucket-policy-guard` — OSS bucket ACL/policy changes — public exposure or China data-residency violation
+- `alibaba-live-rds-polardb-mutation-guard` — RDS/PolarDB instance deletion, spec downgrade, backup policy removal — data loss risk
+**🔴 Huawei Cloud (6):**
+- `huawei-live-cce-rollout-guard` — CCE deployment mutations, node pool upgrades, cluster version changes
+- `huawei-live-iam-policy-change-guard` — IAM policy/SCP mutations — account-wide blast radius, privilege escalation
+- `huawei-live-kms-key-destruction-guard` — DEW/KMS key deletion — CSMS secrets and DBSS-encrypted data permanently lost
+- `huawei-live-cost-budget-action-guard` — budget threshold changes, RI purchases, CUD commitments — financial authority gate
+- `huawei-live-obs-bucket-policy-guard` — OBS bucket ACL/policy changes — public exposure or data residency violation
+- `huawei-live-gaussdb-mutation-guard` — GaussDB/RDS instance deletion, spec downgrade, backup policy changes — data loss
 **🟦 Azure (7):**
 - `azure-live-aks-rollout-guard` — PDB audit, rollout pause/undo, post-rollout health
 - `azure-live-arm-deployment-stack-guard` — what-if evidence, denySettings, PIM-gated delete
@@ -135,6 +170,9 @@ Live-guard skills enforce approval gates and rollback posture for irreversible o
 - 🔐 [`skills/aws/aws-iam-least-privilege-review`](skills/aws/aws-iam-least-privilege-review/) — Review AWS IAM policies and reduce unnecessary access.
 - 🟦 [`skills/azure/azure-rbac-review`](skills/azure/azure-rbac-review/) — Review Azure RBAC assignments, scopes, and custom roles.
 - 🟥 [`skills/oci/oci-autonomous-database-architect`](skills/oci/oci-autonomous-database-architect/) — Design and review Oracle Autonomous Database across OCI and multicloud options.
+- 🟩 [`skills/gcp/gcp-gke-platform-operator`](skills/gcp/gcp-gke-platform-operator/) — GKE Standard/Autopilot design with Day-0/Day-1 decisions, Workload Identity, and AI inference quickstart.
+- 🟠 [`skills/alibaba/alibaba-china-compliance`](skills/alibaba/alibaba-china-compliance/) — MLPS 2.0, DSL, PIPL, and ICP filing compliance review for workloads in Alibaba Cloud China regions.
+- 🔴 [`skills/huawei/huawei-secmaster-security-operations`](skills/huawei/huawei-secmaster-security-operations/) — Huawei SecMaster SIEM/SOAR, HSS, CFW, WAF posture hardening and incident triage.
 - 💰 [`skills/finops/finops-cloud-price-advisor`](skills/finops/finops-cloud-price-advisor/) — Fetch live prices from AWS, Azure, and OCI public pricing APIs; estimate costs for live environments or prototypes.
 Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a skill.
@@ -143,16 +181,24 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 ## 🤖 Agents
-**141 agents** matching the skill catalog — each agent ships 7 harness adapters and a hardened permission model.
+**319 agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
 | Provider           | Count | Specialisations                                                                     |
 | ------------------ | ----: | ----------------------------------------------------------------------------------- |
-| 🟧 AWS              |    43 | advisory, execution, live-guard operators                                           |
-| 🟦 Azure            |    32 | advisory, live-guard operators                                                      |
-| 🟥 OCI              |    35 | advisory, live-guard operators                                                      |
-| ☸️ Kubernetes       |     9 | RBAC review, workload identity, PSA, 4 live-guard operators, maestro router         |
+| 🟧 AWS              |    47 | advisory, execution, live-guard operators                                           |
+| 🟥 OCI              |    39 | advisory, live-guard operators                                                      |
+| 🟩 GCP              |    51 | advisory, live-guard operators, maestro router                                      |
+| 🟦 Azure            |    36 | advisory, live-guard operators                                                      |
+| 🟠 Alibaba Cloud    |    43 | advisory, live-guard operators, maestro router                                      |
+| 🔴 Huawei Cloud     |    43 | advisory, live-guard operators, maestro router                                      |
+| ☁️ OVHcloud         |     6 | advisory, live KMS guard, maestro router                                            |
+| 🌐 IONOS Cloud      |     6 | advisory, live DB lifecycle guard, maestro router                                   |
+| 🇫🇷 Scaleway        |     6 | advisory, live Kapsule rollout guard, maestro router                                |
+| 🇩🇪 Hetzner Cloud   |     6 | advisory, live firewall + server lifecycle guards, maestro router                   |
+| 💰 Contabo          |     6 | advisory, live instance + storage guards, maestro router                            |
+| ☸️ Kubernetes       |    15 | RBAC review, workload identity, PSA, 5 live-guard operators, maestro router         |
 | 🛡️ Kyverno          |     1 | Admission policy review                                                             |
-| 🔄 Argo CD          |     1 | GitOps review                                                                       |
+| 🔄 Argo CD          |     2 | GitOps review, live sync guard                                                      |
 | 🕸️ Istio            |     1 | Ambient mesh review                                                                 |
 | 🐝 Cilium           |     1 | Network policy review                                                               |
 | 📡 OpenTelemetry    |     1 | Collector config review                                                             |
@@ -162,21 +208,36 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 Every agent ships:
 - 📄 `AGENT.md` — harness-neutral contract with guarded response shape
 - 🗂️ `metadata.json` — schema-validated catalog entry
-- 🔌 7 harness adapters — claude-code, codex, copilot, cursor, gemini, kiro-ide, kiro-cli
+- 🔌 Harness adapters — claude-code + codex (EU providers); all 7 adapters for established providers
 ```text
 agents/
-├── aws/              (43 agents)
-├── azure/            (32 agents)
-├── argocd/           (1 agent — GitOps review)
+├── aws/              (47 agents)
+├── alibaba/          (43 agents — advisory, live-guard operators, maestro)
+├── argocd/           (2 agents — GitOps review, live sync guard)
+├── azure/            (36 agents)
+├── backstage/        (1 agent — IDP scaffolder review)
+├── cert-manager/     (1 agent — PKI cert lifecycle review)
 ├── cilium/           (1 agent — network policy review)
+├── contabo/          (6 agents — advisory, live instance + storage guards, maestro)
+├── falco/            (1 agent — runtime threat detection)
 ├── finops/           (1 agent — cross-cloud price advisor)
+├── fluxcd/           (1 agent — GitOps Kustomization/HelmRelease review)
+├── gcp/              (51 agents — advisory, live-guard operators, maestro)
+├── hetzner/          (6 agents — advisory, live firewall + server lifecycle guards, maestro)
+├── huawei/           (43 agents — advisory, live-guard operators, maestro)
+├── ionos/            (6 agents — advisory, live DB lifecycle guard, maestro)
 ├── istio/            (1 agent — ambient mesh review)
-├── kubernetes/       (13 agents — RBAC, workload identity, PSA, pod-spec, ESO, Kubecost, live-guards, maestro)
+├── kubernetes/       (15 agents — RBAC, workload identity, PSA, pod-spec, ESO, Kubecost, live-guards, maestro)
 ├── kyverno/          (1 agent — admission policy review)
-├── oci/              (35 agents)
+├── oci/              (39 agents)
 ├── opentelemetry/    (1 agent — collector config review)
-└── terraform/        (2 agents)
+├── ovhcloud/         (6 agents — advisory, live KMS guard, maestro)
+├── prometheus/       (1 agent — alerting and cardinality review)
+├── scaleway/         (6 agents — advisory, live Kapsule rollout guard, maestro)
+├── sigstore/         (1 agent — supply chain security)
+├── terraform/        (2 agents)
+└── velero/           (1 agent — backup and restore)
 ```
 Example:
@@ -211,7 +272,7 @@ Everything you can install, and exactly how to install it. One section, no hunti
 | `--role`       | see role table below                                  | pick one ↓                              | Install all agents for a job role                    |
 | `--agents`     | comma-separated agent IDs                             | pick one ↓                              | Install specific agents by ID                        |
 | `--all`        | —                                                     | pick one ↓                              | Install every agent for the platform                 |
-| `--provider`   | `aws` `azure` `oci` `kubernetes` `terraform` `finops` `kyverno` `argocd` `istio` `cilium` `opentelemetry` | ➕ optional | Narrow `--role` results to one provider |
+| `--provider`   | `aws` `azure` `oci` `gcp` `alibaba` `huawei` `ovhcloud` `ionos` `scaleway` `hetzner` `contabo` `kubernetes` `terraform` `finops` `kyverno` `argocd` `istio` `cilium` `opentelemetry` | ➕ optional | Narrow `--role` results to one provider |
 | `--repo`       | path                                                  | ➕ optional                              | Target repo root (defaults to current directory)     |
 | `--force`      | —                                                     | ➕ optional                              | Overwrite files that already exist                   |
 | `--list`       | —                                                     | 🔍 standalone                            | Print all agent IDs, providers, and names; then exit |
@@ -242,14 +303,14 @@ Each platform writes agent files to a different folder in your repo.
 A role installs the curated set of agents a practitioner in that job function needs, across all cloud providers. Roles overlap intentionally — one agent may appear in multiple roles.
-| `--role` value                               | 👤 Who it is for                                                         | 🔢 Agents | ☁️ What it covers                                                                                                                          |
-| -------------------------------------------- | ------------------------------------------------------------------------ | -------: | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| `cloud-security-engineer`                    | 🔐 Security engineers, compliance teams, IAM owners                       |       26 | IAM/RBAC review, secrets lifecycle, identity governance, live guards for access and key mutations — AWS · Azure · OCI · Kubernetes        |
-| `cloud-platform-engineer`                    | 🏗️ Infrastructure/SRE, IaC owners, Kubernetes platform teams              |       25 | IaC safety review, container platform operators, networking, landing zones, live deployment guards — AWS · Azure · OCI · Terraform        |
-| `cloud-dba`                                  | 🗄️ Database administrators, data platform engineers                       |       13 | RDS/Aurora, DynamoDB, CosmosDB, OCI Autonomous/Exadata/MySQL HeatWave, replication, live DB lifecycle guards                              |
-| `cloud-finops-analyst`                       | 💰 FinOps leads, cost governance teams                                    |        9 | Cost optimization governors, anomaly watch, budget runaway guards, capacity planning — AWS · Azure · OCI                                  |
-| `cloud-solutions-architect`                  | 🏛️ Cloud architects, migration leads, AI/generative engineers             |       20 | Solution architecture, migration cutover, resilience/BCDR, event-driven design, multi-cloud, AI/generative — AWS · Azure · OCI            |
-| `cloud-devops-engineer`                      | 🚀 CI/CD engineers, release managers, SRE ops                             |       25 | CI/CD, pipeline approval gates, live rollout guards, deployment hotfix operators, serverless readiness, observability — AWS · Azure · OCI |
+| `--role` value                               | 👤 Who it is for                                                         | 🔢 Agents | ☁️ What it covers                                                                                                                                                     |
+| -------------------------------------------- | ------------------------------------------------------------------------ | -------: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `cloud-security-engineer`                    | 🔐 Security engineers, compliance teams, IAM owners                       |       51 | IAM/RBAC review, secrets lifecycle, identity governance, live guards for access and key mutations — AWS · Azure · OCI · GCP · Alibaba · Huawei · OVHcloud · Scaleway · Contabo · K8s |
+| `cloud-platform-engineer`                    | 🏗️ Infrastructure/SRE, IaC owners, Kubernetes platform teams              |       58 | IaC safety review, container platform operators, networking, landing zones, live deployment guards — AWS · Azure · OCI · GCP · Alibaba · Huawei · EU providers · Terraform |
+| `cloud-dba`                                  | 🗄️ Database administrators, data platform engineers                       |       20 | RDS/Aurora, DynamoDB, CosmosDB, OCI Autonomous/Exadata/MySQL HeatWave, IONOS DBaaS, replication, live DB lifecycle guards                                             |
+| `cloud-finops-analyst`                       | 💰 FinOps leads, cost governance teams                                    |       25 | Cost optimization governors, anomaly watch, budget runaway guards, capacity planning — AWS · Azure · OCI · GCP · Alibaba · Huawei · EU providers                      |
+| `cloud-solutions-architect`                  | 🏛️ Cloud architects, migration leads, AI/generative engineers             |       38 | Solution architecture, migration cutover, resilience/BCDR, event-driven design, multi-cloud, AI/generative — AWS · Azure · OCI · GCP · Alibaba · Huawei               |
+| `cloud-devops-engineer`                      | 🚀 CI/CD engineers, release managers, SRE ops                             |       49 | CI/CD, pipeline approval gates, live rollout guards, deployment hotfix operators, serverless readiness, observability — AWS · Azure · OCI · GCP · Alibaba · Huawei    |
 | `kubernetes-admission-security-engineer`     | 🛡️ Platform security, policy engineers, admission control owners          |        6 | Kyverno policy review, K8s workload identity, PSA profiles, live admission-policy guard, live RBAC guard                                  |
 | `kubernetes-network-engineer`                | 🐝 Network engineers, platform SREs, zero-trust mesh owners               |        5 | Cilium/NetworkPolicy review, Istio ambient mesh review, live network-policy and mesh-policy guards                                        |
 | `kubernetes-application-platform-engineer`   | 🔄 Platform engineers, GitOps owners, ArgoCD operators                    |        3 | Argo CD GitOps review, live ArgoCD sync guard, kubernetes-maestro router                                                                  |
@@ -283,10 +344,18 @@ Use `--provider` with `--role` to narrow the install to one cloud.
 | `--provider` value  | Domain                                   | 🔢 Agents in catalog |
 | ------------------- | ---------------------------------------- | ------------------: |
-| `aws`               | 🟧 Amazon Web Services                    |                  44 |
-| `azure`             | 🟦 Microsoft Azure                        |                  33 |
-| `oci`               | 🟥 Oracle Cloud Infrastructure            |                  36 |
-| `kubernetes`        | ☸️ Kubernetes (cross-cloud)               |                  13 |
+| `aws`               | 🟧 Amazon Web Services                    |                  47 |
+| `azure`             | 🟦 Microsoft Azure                        |                  36 |
+| `oci`               | 🟥 Oracle Cloud Infrastructure            |                  39 |
+| `gcp`               | 🟩 Google Cloud Platform                  |                  51 |
+| `alibaba`           | 🟠 Alibaba Cloud                          |                  43 |
+| `huawei`            | 🔴 Huawei Cloud                           |                  43 |
+| `ovhcloud`          | ☁️ OVHcloud                               |                   6 |
+| `ionos`             | 🌐 IONOS Cloud                            |                   6 |
+| `scaleway`          | 🇫🇷 Scaleway                             |                   6 |
+| `hetzner`           | 🇩🇪 Hetzner Cloud                        |                   6 |
+| `contabo`           | 💰 Contabo                                |                   6 |
+| `kubernetes`        | ☸️ Kubernetes (cross-cloud)               |                  15 |
 | `kyverno`           | 🛡️ Kyverno (admission policy)            |                   1 |
 | `argocd`            | 🔄 Argo CD + Argo Rollouts (GitOps)       |                   2 |
 | `istio`             | 🕸️ Istio (service mesh)                  |                   1 |
@@ -300,7 +369,7 @@ Use `--provider` with `--role` to narrow the install to one cloud.
 | `cert-manager`      | 🔐 cert-manager (PKI / cert lifecycle)    |                   1 |
 | `fluxcd`            | 🔄 FluxCD (GitOps)                        |                   1 |
 | `backstage`         | 🎭 Backstage (IDP / developer platform)   |                   1 |
-| `velero`            | 💾 Velero (backup + restore)              |                   0 |
+| `velero`            | 💾 Velero (backup + restore)              |                   1 |
 ```bash
 # 🟥 Install every OCI agent for a cloud-platform-engineer (OCI-only team)
@@ -465,6 +534,28 @@ Use these principles when creating or reviewing assets:
 ---
+## ✅ Eval-driven development
+This repository uses **eval-driven development (EDD)** to ensure quality and consistency.
+Before implementing any new feature, agents, or skills:
+1. **Define evals first** — What must pass? (capability evals + regression evals)
+2. **Implement** — Build agents, skills, or features
+3. **Validate** — Run the test suite and evals
+4. **Report** — Document results in `.claude/evals/<feature>.md`
+**Example:** The [EU cloud providers feature](https://github.com/raishin/vanguard-frontier-agentic/pull/18) was built using EDD:
+- **CE-1 to CE-6**: Capability evals (filesystem layout, companion skills, security, schema, docs, content quality)
+- **CE-7 to CE-8**: Post-implementation evals (role-based install coverage, taxonomy/docs updates)
+- **Regression evals**: All 7 validation gates (catalog, skill schema, allowed-tools, agent schema, manifest, links)
+- **Result**: 30 agents + 30 skills across 5 EU providers, all validation gates passing
+See the `/eval-harness` skill for the full EDD framework and `docs/CODEMAPS/` for live inventory.
+---
 ## 🧭 Quick map
 | Folder                     | What lives here                                                               | Easy memory hook                      |
@@ -477,6 +568,7 @@ Use these principles when creating or reviewing assets:
 | [`schemas/`](schemas/)     | Metadata validation contracts                                                 | ✅ "What fields are required?"         |
 | [`templates/`](templates/) | Starter templates for new assets                                              | 🧱 "How do I add one?"                 |
 | [`docs/`](docs/)           | Quality rules, taxonomy, compliance evidence spec, CI/CD enforcement patterns | 📚 "How should this repo work?"        |
+| [`.claude/evals/`](.claude/evals/)  | Eval-driven development (EDD) definitions and test reports                 | ✅ "How are features validated?"       |
 | [`assets/`](assets/)       | Logos and visual assets                                                       | 🎨 "What images can docs use?"         |
 ---
@@ -671,8 +763,8 @@ See:
 ---
 ```text
-Skills  = workflows        🧠   138 across AWS · Azure · OCI · Kubernetes · CNCF · Terraform
-Agents  = expert roles     🤖   141 with 7 harness adapters each
+Skills  = workflows        🧠   286 across AWS · Azure · OCI · GCP · Alibaba · Huawei · Kubernetes · CNCF · Terraform
+Agents  = expert roles     🤖   289 with 7 harness adapters each
 Rules   = always-on        📏   harness-specific operating guidance
 MCP     = real connections 🔌   AWS · Azure · Oracle official servers
 Catalog = searchable index 🗂️   machine-readable, hash-verified

package/agents/AGENTS.md CHANGED Viewed

@@ -97,6 +97,89 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 ---
+## ☁️ OVHcloud — 6 agents → [`agents/ovhcloud/README.md`](ovhcloud/README.md)
+**Entry point:** load `agents/ovhcloud/ovhcloud-maestro-agent/AGENT.md` for any OVHcloud task.
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `ovhcloud-maestro-agent` | Any OVHcloud task without a known specialist |
+| **IAM** | `ovhcloud-iam-policy-review-agent` | IAM policy conditions, identity groups, OAuth2 access |
+| **Cost / FinOps** | `ovhcloud-cost-finops-analyst-agent` | Public Cloud cost, commitments, idle waste |
+| **Kubernetes** | `ovhcloud-kubernetes-platform-operator-agent` | MCK lifecycle, node pools, workload placement |
+| **Networking** | `ovhcloud-network-architect-agent` | vRack design, network isolation, connectivity |
+| **Live-guard (1)** | `ovhcloud-live-kms-key-destruction-guard-agent` | KMS key destruction; approval-gated, never auto-dispatched |
+> Conditional IAM policies (IP, tag, expiration) are unique — always audit policy scope before approval.
+---
+## 🌐 IONOS Cloud — 6 agents → [`agents/ionos/README.md`](ionos/README.md)
+**Entry point:** load `agents/ionos/ionos-maestro-agent/AGENT.md` for any IONOS Cloud task.
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `ionos-maestro-agent` | Any IONOS Cloud task without a known specialist |
+| **DCD topology** | `ionos-datacenter-designer-reviewer-agent` | Data Center Designer review, multi-AZ placement, blast radius |
+| **Compliance** | `ionos-security-compliance-reviewer-agent` | GDPR posture, data residency, encryption audit |
+| **Kubernetes** | `ionos-kubernetes-platform-operator-agent` | Managed K8s, node pools, workload placement |
+| **Cost / FinOps** | `ionos-cost-optimization-analyst-agent` | Cost analysis, resource utilization |
+| **Live-guard (1)** | `ionos-live-database-lifecycle-guard-agent` | DBaaS failover/scaling/backup; approval-gated |
+> DCD changes have multi-AZ topology blast radius; live-guards must snapshot current state before any mutation.
+---
+## 🇫🇷 Scaleway — 6 agents → [`agents/scaleway/README.md`](scaleway/README.md)
+**Entry point:** load `agents/scaleway/scaleway-maestro-agent/AGENT.md` for any Scaleway task.
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `scaleway-maestro-agent` | Any Scaleway task without a known specialist |
+| **IAM** | `scaleway-iam-policy-review-agent` | IAM bindings, service accounts, API key governance |
+| **Kapsule (K8s)** | `scaleway-kapsule-platform-operator-agent` | Managed K8s readiness, node pools, CNI choice, placement |
+| **Cost / FinOps** | `scaleway-cost-optimizer-agent` | Instance type review, reserved utilization, rightsizing |
+| **Networking** | `scaleway-network-architect-agent` | VPC, security groups, placement groups for HA |
+| **Live-guard (1)** | `scaleway-live-kapsule-rollout-guard-agent` | Kapsule cluster + node pool mutations; approval-gated |
+> Placement groups orchestrate HA; Kapsule control-plane and CNI choice are immutable post-creation.
+---
+## 🇩🇪 Hetzner Cloud — 6 agents → [`agents/hetzner/README.md`](hetzner/README.md)
+**Entry point:** load `agents/hetzner/hetzner-maestro-agent/AGENT.md` for any Hetzner Cloud task.
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `hetzner-maestro-agent` | Any Hetzner Cloud task without a known specialist |
+| **Cost / FinOps** | `hetzner-cost-optimization-analyst-agent` | Instance type review, resource utilization, cost savings |
+| **Infra review** | `hetzner-infrastructure-reviewer-agent` | Firewall rules, LB config, network design, public-IP exposure |
+| **Capacity** | `hetzner-capacity-planner-agent` | Resource limits, quota, growth planning, region distribution |
+| **Live-guard (2)** | `hetzner-live-firewall-rule-guard-agent`, `hetzner-live-server-lifecycle-guard-agent` | Firewall rule + server lifecycle mutations; approval-gated |
+> No official Terraform provider — agents recommend REST API / hcloud-python over community Terraform.
+---
+## 💰 Contabo — 6 agents → [`agents/contabo/README.md`](contabo/README.md)
+**Entry point:** load `agents/contabo/contabo-maestro-agent/AGENT.md` for any Contabo task.
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `contabo-maestro-agent` | Any Contabo task without a known specialist |
+| **Cost / FinOps** | `contabo-cost-optimization-analyst-agent` | Contract period analysis, VPS sizing, addon utilization |
+| **Capacity** | `contabo-capacity-planner-agent` | Resource planning, region coverage, instance sizing |
+| **Security** | `contabo-security-hardening-agent` | SSH key management, default user policy, firewall posture |
+| **Live-guard (2)** | `contabo-live-instance-lifecycle-guard-agent`, `contabo-live-storage-operations-guard-agent` | VPS/VDS + Object Storage mutations; approval-gated |
+> Contractual periods (1/3/6/12 months) drive billing; live-guards demand explicit period acknowledgment before any lifecycle change. No official Terraform/SDK — automation via `cntb` CLI or REST API.
+---
 ## ☸️ Kubernetes — 13 agents → [`agents/kubernetes/README.md`](kubernetes/README.md)
 **Entry point:** load `agents/kubernetes/kubernetes-maestro-agent/AGENT.md` — routes to all K8s specialists (including CNCF domain agents below) and enforces the live-guard gate.

package/agents/README.md CHANGED Viewed

@@ -4,44 +4,58 @@ Role definitions for repeatable review, architecture, operations, and bounded ex
 ## Provider catalog
-| Provider | Current status | Notes |
-| --- | --- | --- |
-| AWS | active | includes advisory, repo-write execution, and guarded live-AWS operator agents |
-| Azure | active | read-only role agents |
-| OCI | active | read-only role agents |
-| Terraform | active | generic IaC review |
-| GCP | reserved | no provider portfolio yet |
-| Multi-cloud | limited | generic architecture roles |
-| Security | limited | generic domain roles |
-## AWS first: easy catalog
-### AWS advisory agents
+| Provider | Current status | Agents | Notes |
+| --- | --- | ---: | --- |
+| 🟧 AWS | active | 47 | advisory, repo-write execution, and guarded live-AWS operator agents |
+| 🟥 OCI | active | 39 | advisory and guarded live-OCI operator agents |
+| 🟩 GCP | active | 39 | advisory, live-guard operators, maestro router |
+| 🟦 Azure | active | 36 | advisory and guarded live-Azure operator agents |
+| 🟠 Alibaba Cloud | active | 30 | advisory, live-guard operators, maestro router |
+| 🔴 Huawei Cloud | active | 30 | advisory, live-guard operators, maestro router |
+| ☁️ OVHcloud | active | 6 | maestro router, IAM, FinOps, MCK, network architect, KMS live-guard |
+| 🌐 IONOS Cloud | active | 6 | maestro router, DCD review, GDPR/compliance, K8s, FinOps, DBaaS live-guard |
+| 🇫🇷 Scaleway | active | 6 | maestro router, IAM, Kapsule, FinOps, network, Kapsule rollout live-guard |
+| 🇩🇪 Hetzner Cloud | active | 6 | maestro router, FinOps, infra review, capacity, firewall + server live-guards |
+| 💰 Contabo | active | 6 | maestro router, FinOps, capacity, security hardening, instance + storage live-guards |
+| ☸️ Kubernetes | active | 15 | RBAC, workload identity, PSA, live-guards, maestro |
+| 🟩 Terraform | active | 2 | generic IaC review |
+| 💰 Multi-cloud | limited | 1 | FinOps cross-cloud price advisor |
+| CNCF ecosystem | active | 14 | Kyverno, Argo CD, Istio, Cilium, OTEL, Prometheus, Falco, Sigstore, cert-manager, FluxCD, Backstage, Velero |
-Read-only by default. Use for review, diagnosis, planning, briefing, triage, and non-destructive coordination.
+## Agent tiers
-### AWS execution agents
+All provider portfolios follow the same three-tier model:
-Workspace-write in Codex, but still non-destructive toward live AWS by default.
+### Advisory agents (read-only by default)
-| Agent | Type | Default access | Intended use |
-| --- | --- | --- | --- |
-| `aws-deployment-hotfix-operator-agent` | execution | workspace-write | rapid repo-side deployment corrections |
-| `aws-iac-patch-executor-agent` | execution | workspace-write | bounded IaC patching |
-| `aws-pipeline-fix-operator-agent` | execution | workspace-write | CI/CD config fixes |
-| `aws-serverless-rollout-corrector-agent` | execution | workspace-write | serverless rollout file corrections |
-| `aws-ecs-service-remediation-operator-agent` | execution | workspace-write | ECS/Fargate config remediation |
+Use for review, diagnosis, planning, briefing, triage, and non-destructive coordination. These never write to live cloud environments.
-### AWS guarded live operators
+### Execution agents (workspace-write)
-Workspace-write in Codex, but these roles are designed for repos or shells that may be connected to real AWS credentials or real deployment authority. They must confirm target identity, require explicit approval, prefer preview or dry-run evidence, and define rollback plus post-change verification before mutation.
+Workspace-write in Codex but still non-destructive toward live cloud by default. Used for patching repo files — manifests, IaC, CI/CD configs, rollout definitions.
-| Agent | Type | Default access | Intended use |
-| --- | --- | --- | --- |
-| `aws-live-deployment-guarded-operator-agent` | guarded-live | workspace-write | generic live deployment actions with approval gates |
-| `aws-live-iac-change-guard-agent` | guarded-live | workspace-write | live IaC preview and execution discipline |
-| `aws-live-pipeline-approval-operator-agent` | guarded-live | workspace-write | live pipeline approval and gated resume handling |
-| `aws-live-serverless-release-guard-agent` | guarded-live | workspace-write | live Lambda/serverless release actions |
-| `aws-live-ecs-rollout-guard-agent` | guarded-live | workspace-write | live ECS/Fargate rollout actions |
-See `agents/aws/README.md` for the AWS-specific catalog.
+| Agent | Provider | Primary use |
+| --- | --- | --- |
+| `aws-deployment-hotfix-operator-agent` | AWS | rapid repo-side deployment corrections |
+| `aws-iac-patch-executor-agent` | AWS | bounded IaC patching |
+| `aws-pipeline-fix-operator-agent` | AWS | CI/CD config fixes |
+| `aws-serverless-rollout-corrector-agent` | AWS | serverless rollout file corrections |
+| `aws-ecs-service-remediation-operator-agent` | AWS | ECS/Fargate config remediation |
+### Guarded live operators
+Workspace-write in Codex, but designed for repos or shells connected to real cloud credentials or deployment authority. They must confirm target identity, require explicit approval, prefer preview or dry-run evidence, and define rollback plus post-change verification before mutation.
+See each provider's README for the full live-guard catalog:
+- [`agents/aws/README.md`](aws/README.md) — AWS live operators (5)
+- [`agents/gcp/README.md`](gcp/README.md) — GCP live operators (6)
+- [`agents/alibaba/README.md`](alibaba/README.md) — Alibaba Cloud live operators (6)
+- [`agents/huawei/README.md`](huawei/README.md) — Huawei Cloud live operators (6)
+- [`agents/azure/README.md`](azure/README.md) — Azure live operators (7)
+- [`agents/oci/README.md`](oci/README.md) — OCI live operators (7)
+- [`agents/ovhcloud/README.md`](ovhcloud/README.md) — OVHcloud live operators (1: KMS key destruction)
+- [`agents/ionos/README.md`](ionos/README.md) — IONOS Cloud live operators (1: DBaaS lifecycle)
+- [`agents/scaleway/README.md`](scaleway/README.md) — Scaleway live operators (1: Kapsule rollout)
+- [`agents/hetzner/README.md`](hetzner/README.md) — Hetzner Cloud live operators (2: firewall, server lifecycle)
+- [`agents/contabo/README.md`](contabo/README.md) — Contabo live operators (2: instance, storage)

package/agents/alibaba/AGENTS.md ADDED Viewed

@@ -0,0 +1,54 @@
+# AGENTS.md
+## Purpose
+Store Alibaba Cloud marketplace agents with canonical identity and harness-specific variants.
+## Patterns
+- `agents/alibaba/<skill-id>-agent/AGENT.md` is the harness-neutral contract.
+- `agents/alibaba/<skill-id>-agent/harnesses/codex.toml` is the Codex native variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/copilot.agent.md` is the GitHub Copilot / VS Code variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/claude-code.agent.md` is the Claude Code Markdown-family variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/cursor.agent.md` is the Cursor Markdown-family variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/gemini.agent.md` is the Gemini CLI Markdown-family variant.
+- `agents/alibaba/<skill-id>-agent/harnesses/kiro-ide.agent.md` and `harnesses/kiro-cli.agent.json` are the split Kiro variants; do not pretend IDE Markdown and CLI JSON are interchangeable.
+- `agents/alibaba/<skill-id>-agent/metadata.json` mirrors `catalog/agents.json`.
+## Alibaba Cloud Region and Compliance Notes
+Alibaba Cloud operates **China mainland regions** (CN-*) and **international regions** (AP-*, EU-*, US-*) as distinct environments with different regulatory obligations:
+- **China mainland regions** are subject to the PRC Cybersecurity Law, Data Security Law (DSL), Personal Information Protection Law (PIPL), and MLPS 2.0. Workloads here require ICP filing for internet-facing services and must meet MLPS 2.0 grading requirements.
+- **International regions** follow the laws of the jurisdiction in which the region operates (e.g., Singapore MAS TRM, Germany GDPR, US SOC 2). Cross-border data transfers between China and international regions are restricted by DSL Article 31.
+All agents serving China-based workloads must explicitly identify the target region and applicable regulatory framework before making recommendations.
+## RAM and Resource Directory Notes
+Alibaba Cloud identity has two levels that are frequently confused:
+- **Resource Directory (RD)**: The org-level account hierarchy (master account → member accounts). Control Policy (SCP equivalent) is applied at the RD level.
+- **RAM (Resource Access Management)**: Per-account IAM (users, groups, roles, policies, STS). RAM operates within a single account.
+Cross-account access uses RAM role assumption + STS tokens. RAM AdministratorAccess is the most dangerous RAM policy — widespread assignment is the #1 Alibaba Cloud security debt pattern.
+## Live Guard Agents
+Six live-guard agents enforce approval gates and rollback posture for high-risk Alibaba Cloud mutations.
+| Agent | Purpose | Skill |
+|-------|---------|-------|
+| [alibaba-live-ack-rollout-guard-agent](alibaba-live-ack-rollout-guard-agent/) | Gate ACK deployment mutations, node pool scaling, and cluster version upgrades against rollback posture | [alibaba-live-ack-rollout-guard](../../skills/alibaba/alibaba-live-ack-rollout-guard/) |
+| [alibaba-live-ram-policy-change-guard-agent](alibaba-live-ram-policy-change-guard-agent/) | Gate RAM policy and role mutations — account-wide blast radius, privilege escalation risk | [alibaba-live-ram-policy-change-guard](../../skills/alibaba/alibaba-live-ram-policy-change-guard/) |
+| [alibaba-live-kms-key-mutation-guard-agent](alibaba-live-kms-key-mutation-guard-agent/) | Gate KMS key deletion and disable operations — encrypted data becomes permanently inaccessible | [alibaba-live-kms-key-mutation-guard](../../skills/alibaba/alibaba-live-kms-key-mutation-guard/) |
+| [alibaba-live-cost-budget-action-guard-agent](alibaba-live-cost-budget-action-guard-agent/) | Gate budget threshold changes, Savings Plan purchases, and RI commitments — financial authority gate | [alibaba-live-cost-budget-action-guard](../../skills/alibaba/alibaba-live-cost-budget-action-guard/) |
+| [alibaba-live-oss-bucket-policy-guard-agent](alibaba-live-oss-bucket-policy-guard-agent/) | Gate OSS bucket ACL and policy changes — public exposure or access denial blast radius | [alibaba-live-oss-bucket-policy-guard](../../skills/alibaba/alibaba-live-oss-bucket-policy-guard/) |
+| [alibaba-live-rds-polardb-mutation-guard-agent](alibaba-live-rds-polardb-mutation-guard-agent/) | Gate RDS/PolarDB instance deletion, spec downgrades, and backup policy removal — data loss risk | [alibaba-live-rds-polardb-mutation-guard](../../skills/alibaba/alibaba-live-rds-polardb-mutation-guard/) |
+### Live guard permission model
+Alibaba Cloud RAM uses policy statements with Effect/Action/Resource/Condition structure similar to AWS IAM.
+- **RAM AdministratorAccess** is a system policy granting full account control — never auto-approved for any mutation.
+- **STS AssumeRole** tokens have maximum 12-hour TTL; live-guard agents must confirm the active STS token expiry before long-running operations.
+- **OSS bucket ACL = public-read or public-read-write** is irreversible in effect (data may be indexed by crawlers within seconds of exposure). Require explicit confirmation of public vs. private intent.
+- **PolarDB/RDS deletion** with backup retention disabled is permanent. Always confirm backup policy status before any instance deletion.
+- **China mainland OSS** cross-border data transfer requires data export compliance review under DSL Article 31 — flag before any replication configuration change.

package/agents/alibaba/README.md ADDED Viewed

@@ -0,0 +1,58 @@
+# 🟠 Alibaba Cloud Agents
+<p align="center">
+  <img src="../../assets/logos/cloud/alibaba/alibaba-cloud.svg" alt="Alibaba Cloud logo" width="140" />
+</p>
+Alibaba Cloud agent catalog for this marketplace. 😄
+## 🧱 Agent tiers
+| Tier | Purpose | Default access | Live Alibaba Cloud mutation |
+|---|---|---|---|
+| Role / advisory agents | Review, design, diagnose, coordinate | read-only | not allowed by default |
+| Guarded live operators | Work in repos or shells that may target real Alibaba Cloud environments | workspace-write | approval-gated and target-confirmed only |
+## 🚦 Guarded live-Alibaba Cloud operators
+| Agent | Primary use | Default live posture | Must refuse when |
+|---|---|---|---|
+| `alibaba-live-ack-rollout-guard-agent` | live ACK deployment mutations and node pool scaling | health signals + PDB audit + rollback required | cluster version upgrade or node pool deletion lacks preflight evidence |
+| `alibaba-live-ram-policy-change-guard-agent` | live RAM policy and role mutations | current policy snapshot + privilege-escalation check + approval required | account-wide policy change lacks dual approval or Resource Directory scope is unclear |
+| `alibaba-live-kms-key-mutation-guard-agent` | KMS key deletion and disable operations | key usage audit + rotation-vs-deletion separation + waiting period | key is actively used for envelope encryption and no backup key exists |
+| `alibaba-live-cost-budget-action-guard-agent` | live budget threshold changes and Savings Plan purchases | budget baseline + alert thresholds + RI/SP commitment review | budget action removes cost controls or Savings Plan purchase lacks financial approval |
+| `alibaba-live-oss-bucket-policy-guard-agent` | OSS bucket ACL and policy mutations | current ACL/policy capture + public-exposure check + MLPS 2.0 residency review | policy change would make bucket public or violate China data-residency requirements |
+| `alibaba-live-rds-polardb-mutation-guard-agent` | RDS and PolarDB instance deletion and spec changes | instance snapshot + backup policy check + downgrade impact review | instance deletion has no recent backup or spec downgrade breaches SLA |
+## 👀 Read-only advisory agents
+| Agent | Focus |
+|---|---|
+| `alibaba-maestro-agent` | classify and route Alibaba Cloud tasks; China-region aware |
+| `alibaba-ram-iam-review-agent` | RAM users/groups/roles/policies, STS token lifecycle, Resource Directory |
+| `alibaba-security-center-hardening-agent` | Security Center, WAF, Anti-DDoS Pro, Cloud Firewall posture hardening |
+| `alibaba-cost-finops-analyst-agent` | Cost Manager, Savings Plans, Reserved Instances, budget drift |
+| `alibaba-china-compliance-agent` | MLPS 2.0 Level 3, DSL, PIPL, ICP filing, data residency controls |
+| `alibaba-polardb-rds-dba-agent` | PolarDB MySQL/PG/Oracle, RDS, DAS autonomous, Global Database Network |
+| `alibaba-ack-container-platform-operator-agent` | ACK managed/dedicated/serverless, ACR, ASM Service Mesh |
+| `alibaba-resilience-bcdr-review-agent` | RDS/PolarDB/ACK/HBR BCDR designs, RTO/RPO, multi-AZ, runbook review |
+| `alibaba-iac-change-safety-review-agent` | Terraform/ROS blast radius, deletion protection, state drift, plan safety |
+| `alibaba-event-driven-architecture-review-agent` | EventBridge/MNS/RocketMQ/MSE dead-letter, ordering, idempotency, lag |
+| `alibaba-load-balancer-traffic-engineer-agent` | CLB/ALB/NLB/GA type selection, health checks, WAF integration, TLS policy |
+| `alibaba-serverless-production-readiness-agent` | FC3/SAE/EDAS VPC config, concurrency, cold-start, SLS log observability |
+| `alibaba-certificate-manager-issuer-review-agent` | SSL Certificate Manager lifecycle, SLB binding, renewal automation, expiry |
+| `alibaba-cost-anomaly-watch-coordinator-agent` | Cost Manager delta, MaxCompute CU anomalies, ECS spot cost, CDN/OSS spikes |
+| `alibaba-change-impact-advisor-agent` | pre-change blast radius: Resource Directory OU scope, CEN route propagation |
+| `alibaba-registry-artifact-governor-agent` | ACR Enterprise/Personal, image scanning, tag immutability, pull IAM review |
+| `alibaba-oss-data-perimeter-governor-agent` | OSS bucket ACL/BPA, WORM Object Lock, MLPS 2.0 compliance, public exposure |
+| `alibaba-ticket-triage-escalation-coordinator-agent` | P0/P1/P2/P3 triage, SLA enforcement, DingTalk war room coordination |
+| `alibaba-support-incident-coordinator-agent` | severity mapping 紧急/高/中/低, account manager escalation, evidence scrub |
+| `alibaba-daily-operations-briefing-coordinator-agent` | cost delta, ActionTrail anomalies, ACK health, quota warnings, Security Center |
+## 🛡️ Operating note
+- 😄 advisory agents stay read-only by default
+- 🚦 guarded live operators must confirm account ID, region (CN-* vs international), principal, approval, rollback, and verification before mutation
+- ⚠️ China mainland regions (cn-hangzhou, cn-beijing, etc.) and international regions have **separate billing accounts and different regulatory scope** — always confirm which context applies before any cost or compliance action
+- 🇨🇳 MLPS 2.0 Level 3 mandates specific Alibaba Cloud service configurations — `alibaba-china-compliance-agent` flags gaps; live guards check residency before OSS/KMS mutations
+- 🧾 all live-guard agents produce a structured verdict response — see [`docs/evidence-output-spec.md`](../../docs/evidence-output-spec.md)