@raishin/vanguard-frontier-agentic 1.5.0 → 1.7.0

package/skills/gcp/gcp-live-cloud-run-traffic-migration-guard/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: gcp-live-cloud-run-traffic-migration-guard
+description: Gate Cloud Run traffic percentage migrations, min-instances changes, and revision deletions against revision health verification and rollback posture assessment. Migrating 100% traffic to a broken revision causes complete service unavailability with no automatic rollback — this guard enforces health checks, gradual canary splits, and explicit approval before any production traffic change is executed.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: delivery
+---
+
+# GCP Live Cloud Run Traffic Migration Guard
+
+## Purpose
+
+Act as the guarded live GCP operator for gcp-live-cloud-run-traffic-migration-guard work. Gate every Cloud Run traffic migration, min-instances change, and revision deletion with revision health verification and a documented rollback plan. Cloud Run has no automatic rollback — every traffic migration must be treated as a production outage risk until the target revision is verified healthy.
+
+## When to Use
+
+Use this skill when:
+
+- A Cloud Run traffic percentage is being migrated to a new revision (canary, gradual, or full cut-over)
+- A revision is being deleted and the rollback implications need to be assessed
+- Min-instances settings are being changed for a production service
+- An immediate rollback of a broken traffic migration is needed
+- A traffic split between two revisions needs to be configured or modified
+- An operator needs to audit the current revision inventory and health before any change
+
+## When NOT to Use
+
+Do not use this skill when:
+
+- The target is a development or staging Cloud Run service with no production traffic
+- The task is deploying a new revision without changing traffic allocation (safe — new revisions default to 0% traffic)
+- The task is read-only service inspection with no mutation intent
+- The task involves GKE, App Engine, or other non-Cloud Run compute
+
+## Pre-Flight Checklist
+
+Before executing any Cloud Run traffic mutation, verify all of the following:
+
+1. **Service identity confirmed** — run `gcloud run services describe <SERVICE> --region=<REGION> --project=<PROJECT>` and confirm the service name, region, and current traffic allocation match the intended target.
+2. **Revision inventory captured** — list all revisions with their traffic allocations and creation timestamps.
+3. **Target revision health assessed** — confirm the target revision has an acceptable error rate (typically < 1%) and latency p99 below the SLO threshold. If the revision is new, check container startup logs for errors.
+4. **Current traffic split documented** — record the exact current traffic percentages for all revisions before any change; this is the rollback target if needed.
+5. **Min-instances impact assessed** — if changing min-instances, document the cost impact and cold-start behavior change before proceeding.
+6. **Revision deletion safety confirmed** — if deleting a revision, confirm it holds no traffic allocation and is not the only known-good revision available for rollback.
+7. **Canary strategy agreed** — for untested revisions, confirm the operator agrees to start at ≤10% traffic rather than an immediate 100% cut-over.
+
+## Required Confirmation
+
+The operator must explicitly state all of the following before any traffic mutation is executed:
+
+- "I confirm the service is `<SERVICE_NAME>` in project `<PROJECT_ID>`, region `<REGION>`."
+- "I confirm the target revision is `<REVISION_NAME>` and it has passed health checks."
+- "I understand there is no automatic rollback — if the migration fails, I must manually re-split traffic."
+- "I approve this traffic migration to `<X>%` for revision `<REVISION_NAME>`."
+- For revision deletion: "I confirm revision `<REVISION_NAME>` holds no traffic and is not needed for rollback, and I approve its deletion."
+
+## Execution Steps
+
+1. Capture current traffic split and revision health metrics.
+2. Confirm active principal has `roles/run.developer` for the target service.
+3. Present the planned migration, revision health findings, and rollback target to the operator for explicit approval.
+4. Execute the mutation:
+   - Gradual migration (recommended): `gcloud run services update-traffic <SERVICE> --region=<REGION> --to-revisions=<REVISION>=<PERCENT> --project=<PROJECT>`
+   - Full cut-over to latest: `gcloud run services update-traffic <SERVICE> --region=<REGION> --to-latest --project=<PROJECT>`
+   - Update min-instances: `gcloud run services update <SERVICE> --region=<REGION> --min-instances=<N> --project=<PROJECT>`
+   - Delete revision: `gcloud run revisions delete <REVISION> --region=<REGION> --project=<PROJECT>`
+5. Monitor the service for errors and latency in the 5-15 minutes following the traffic change.
+
+## Rollback Procedure
+
+- **Traffic migration rollback** (always possible while the prior revision still exists): Re-split traffic back to the previous revision:
+  ```
+  gcloud run services update-traffic <SERVICE> --region=<REGION> \
+    --to-revisions=<PRIOR_REVISION>=100 --project=<PROJECT>
+  ```
+- **If prior revision was deleted**: Deploy a new revision from the last-known-good container image and migrate traffic to it.
+- **Min-instances rollback**: Revert to previous min-instances value with the same update command.
+- After rollback, investigate the failed revision's startup logs and error metrics before attempting another migration.
+
+## Post-Change Verification
+
+1. Run `gcloud run services describe <SERVICE> --region=<REGION>` — confirm traffic allocation shows the expected percentages.
+2. Check Cloud Run request logs in Cloud Logging for error rates in the 15 minutes following migration:
+   ```
+   gcloud logging read \
+     'resource.type="cloud_run_revision" AND resource.labels.service_name="<SERVICE>"' \
+     --limit=50 --project=<PROJECT>
+   ```
+3. Check Cloud Monitoring for the service's error rate and latency p99 metrics.
+4. For min-instances changes, confirm new instance count is reflected in the Cloud Run console.
+5. Confirm the rollback revision still exists (has not been deleted) and is available if needed.
+
+## Response Shape
+
+1. Service and region identity confirmation
+2. Current revision inventory and traffic splits
+3. Target revision health (error rate, latency p99)
+4. Min-instances and concurrency settings
+5. Approval status
+6. Proposed or executed traffic migration
+7. Post-migration health check and rollback verification

package/skills/gcp/gcp-live-cloud-run-traffic-migration-guard/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "gcp-live-cloud-run-traffic-migration-guard",
+  "name": "GCP Live Cloud Run Traffic Migration Guard",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
+  ],
+  "summary": "Gate Cloud Run traffic percentage migrations, min-instances changes, and revision deletions \u2014 production traffic blast radius with no automatic rollback.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/run/docs/rollouts-rollbacks-traffic-migration",
+    "https://cloud.google.com/run/docs/configuring/min-instances",
+    "https://cloud.google.com/run/docs/managing/revisions"
+  ],
+  "last_verified": "2026-05-08",
+  "path": "skills/gcp/gcp-live-cloud-run-traffic-migration-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "security_notes": "Cloud Run traffic percentage changes take effect immediately. Zero percent traffic to a revision does not stop it but removes user traffic. Min-instance changes affect billing immediately. Rollback requires manual traffic re-assignment."
+}

package/skills/gcp/gcp-live-cloud-run-traffic-migration-guard/references/official-sources.md

@@ -0,0 +1,29 @@
+# Official Sources — GCP Live Cloud Run Traffic Migration Guard
+
+Authoritative GCP documentation for Cloud Run traffic management, revision lifecycle, and instance configuration.
+
+## Core References
+
+- **Rollouts, Rollbacks, and Traffic Migration** — https://cloud.google.com/run/docs/rollouts-rollbacks-traffic-migration
+  How to split traffic between revisions, perform gradual rollouts, and manually roll back to a prior revision.
+
+- **Configuring Min Instances** — https://cloud.google.com/run/docs/configuring/min-instances
+  How min-instances settings affect cold-start behavior, cost, and availability; guidance for production traffic patterns.
+
+- **Managing Revisions** — https://cloud.google.com/run/docs/managing/revisions
+  How to list, describe, and delete Cloud Run revisions; restrictions on deleting revisions that hold traffic.
+
+- **Gradual Rollouts** — https://cloud.google.com/run/docs/deploying#gradual-rollouts
+  Step-by-step guidance for canary deployments and progressive traffic migration using percentage splits.
+
+- **Configuring Concurrency** — https://cloud.google.com/run/docs/configuring/concurrency
+  How concurrency settings interact with traffic volume and cold-start behavior during traffic migrations.
+
+- **Viewing Logs for Cloud Run** — https://cloud.google.com/run/docs/logging
+  How to view request logs, container logs, and audit logs for Cloud Run services in Cloud Logging.
+
+- **Cloud Run Metrics** — https://cloud.google.com/run/docs/monitoring
+  Available metrics for Cloud Run (request count, latency, instance count) and how to use them for post-migration health checks in Cloud Monitoring.
+
+- **Cloud Run IAM** — https://cloud.google.com/run/docs/securing/managing-access
+  IAM roles for Cloud Run (`run.viewer`, `run.developer`, `run.admin`) and how to configure service-level access control.

package/skills/gcp/gcp-live-cloud-run-traffic-migration-guard/references/workflow-and-output.md

@@ -0,0 +1,155 @@
+# Workflow and Output — GCP Live Cloud Run Traffic Migration Guard
+
+## Step-by-Step Workflow
+
+### Phase 1: Identity and Service Confirmation
+
+1. Confirm active gcloud identity and project:
+   ```
+   gcloud auth list
+   gcloud config get-value project
+   ```
+2. Describe the target Cloud Run service:
+   ```
+   gcloud run services describe <SERVICE_NAME> \
+     --region=<REGION> \
+     --project=<PROJECT> \
+     --format=json
+   ```
+3. Confirm service name, region, URL, and current traffic allocation from the output.
+
+### Phase 2: Revision Inventory and Health Assessment
+
+4. List all revisions for the service:
+   ```
+   gcloud run revisions list \
+     --service=<SERVICE_NAME> \
+     --region=<REGION> \
+     --project=<PROJECT> \
+     --format="table(metadata.name,status.conditions[0].status,metadata.creationTimestamp,spec.containers[0].image)"
+   ```
+5. Get traffic split for the service:
+   ```
+   gcloud run services describe <SERVICE_NAME> \
+     --region=<REGION> --project=<PROJECT> \
+     --format="value(spec.traffic)"
+   ```
+6. Check Cloud Monitoring for the target revision's error rate and latency p99:
+   ```
+   # Via gcloud CLI metrics query or Cloud Console > Cloud Run > <service> > Metrics
+   # Key metrics: run.googleapis.com/request_count (filter by response_code_class!=2xx)
+   # run.googleapis.com/request_latencies (p99)
+   ```
+7. Check container startup logs for errors in the target revision:
+   ```
+   gcloud logging read \
+     'resource.type="cloud_run_revision" AND resource.labels.service_name="<SERVICE>" AND resource.labels.revision_name="<REVISION>"' \
+     --limit=20 --project=<PROJECT>
+   ```
+
+### Phase 3: Min-Instances Review (if applicable)
+
+8. View current min-instances setting:
+   ```
+   gcloud run services describe <SERVICE_NAME> \
+     --region=<REGION> --project=<PROJECT> \
+     --format="value(spec.template.metadata.annotations['autoscaling.knative.dev/minScale'])"
+   ```
+9. Estimate cost impact: min-instances × instance idle cost per hour × 730 hours/month.
+
+### Phase 4: Approval Gate
+
+10. Present all findings: current revision inventory, traffic splits, target revision health, rollback target.
+11. Require explicit written approval with all required confirmations.
+12. Do not proceed until approval is received.
+
+### Phase 5: Execution
+
+13. Execute the approved migration:
+    ```
+    # Split to canary (recommended first step):
+    gcloud run services update-traffic <SERVICE_NAME> \
+      --region=<REGION> \
+      --to-revisions=<NEW_REVISION>=10,<OLD_REVISION>=90 \
+      --project=<PROJECT>
+
+    # After canary validation, full cut-over:
+    gcloud run services update-traffic <SERVICE_NAME> \
+      --region=<REGION> \
+      --to-revisions=<NEW_REVISION>=100 \
+      --project=<PROJECT>
+
+    # OR migrate to latest directly (skip canary only if previously tested):
+    gcloud run services update-traffic <SERVICE_NAME> \
+      --region=<REGION> --to-latest \
+      --project=<PROJECT>
+    ```
+
+### Phase 6: Post-Migration Health Check
+
+14. Confirm new traffic allocation:
+    ```
+    gcloud run services describe <SERVICE_NAME> \
+      --region=<REGION> --format="value(spec.traffic)"
+    ```
+15. Monitor error rate and latency for 15 minutes in Cloud Monitoring.
+16. Confirm the rollback revision still exists and holds a traffic allocation or is available.
+
+### Rollback (if needed)
+
+17. Immediately re-split traffic to the prior known-good revision:
+    ```
+    gcloud run services update-traffic <SERVICE_NAME> \
+      --region=<REGION> \
+      --to-revisions=<PRIOR_REVISION>=100 \
+      --project=<PROJECT>
+    ```
+
+## Expected Output Format
+
+```
+SERVICE IDENTITY
+  Project:        <project-id>
+  Service:        <service-name>
+  Region:         <region>
+  URL:            https://<service-hash>-<region>.run.app
+
+CURRENT TRAFFIC SPLIT
+  <revision-name-1>: <percent>% (ACTIVE)
+  <revision-name-2>: <percent>% (STABLE)
+
+REVISION HEALTH — TARGET
+  Revision:       <target-revision-name>
+  Created:        <date>
+  Image:          <image-uri>
+  Error Rate:     <pct>% (last 30m)
+  Latency p99:    <ms>ms (last 30m)
+  Health:         [PASS | WARN | FAIL — reason]
+
+MIN-INSTANCES
+  Current:        <N>
+  Proposed:       <N>
+  Cost delta:     ~$<amount>/month
+
+APPROVAL STATUS
+  Operator:       <identity>
+  Approved:       [YES / NO / PENDING]
+  Canary strategy: [YES — starting at <pct>% | FULL — acknowledged risk]
+  No-auto-rollback acknowledged: [YES / NO]
+
+ACTION
+  [BLOCKED — reason]
+  OR [EXECUTED — traffic split: <revision>=<pct>%, <revision>=<pct>%]
+  OR [EXECUTED — revision <name> deleted]
+
+ROLLBACK POSTURE
+  Rollback revision: <prior-revision-name>
+  Still exists:    [YES | NO — deleted, redeploy required]
+  Rollback command: gcloud run services update-traffic ... --to-revisions=<prior>=100
+
+POST-MIGRATION
+  Error rate:     <pct>% (15m post-change)
+  Latency p99:    <ms>ms (15m post-change)
+  Health:         [PASS | DEGRADED | ROLLED BACK]
+  Audit log:      [FOUND — insertId: <id>]
+```

package/skills/gcp/gcp-live-cost-budget-action-guard/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: gcp-live-cost-budget-action-guard
+description: Gate Cloud Billing budget threshold changes, committed-use discount (CUD) purchases, and quota increase requests with explicit financial-authority approval. CUD contracts are 1-3 year financial commitments that cannot be cancelled — this guard ensures every billing action is backed by spend-impact assessment, budget inventory review, and confirmed financial authority before execution.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-08"
+  category: finops
+---
+
+# GCP Live Cost Budget Action Guard
+
+## Purpose
+
+Act as the guarded live GCP operator for gcp-live-cost-budget-action-guard work. Gate every Cloud Billing budget change, CUD purchase, and quota increase with a full financial-impact assessment and explicit financial-authority approval. Treat CUD contracts as the highest-risk financial action — they are multi-year, non-cancellable commitments.
+
+## When to Use
+
+Use this skill when:
+
+- A Cloud Billing budget alert threshold needs to be increased or decreased
+- A committed-use discount (CUD) contract purchase is being requested
+- A service quota increase is being submitted to GCP Support
+- An operator needs to audit current budgets, alert thresholds, and CUD commitments
+- A budget anomaly or unexpected billing spike needs investigation and remediation
+- Programmatic budget actions (Cloud Functions triggered by budget alerts) need to be reviewed
+
+## When NOT to Use
+
+Do not use this skill when:
+
+- The task is a read-only cost report review with no billing mutation intent
+- The task involves resource rightsizing or scheduling that does not touch billing account settings
+- The task is unrelated to GCP billing, quotas, or committed-use discounts
+- The task involves AWS Cost Explorer, Azure Cost Management, or other non-GCP billing systems
+
+## Pre-Flight Checklist
+
+Before executing any billing or quota mutation, verify all of the following:
+
+1. **Billing account identity confirmed** — run `gcloud billing accounts list` and confirm the billing account ID and display name match the intended target.
+2. **Active principal confirmed** — run `gcloud auth list` and confirm the identity has `roles/billing.admin` (for mutations) or `roles/billing.viewer` (for reads).
+3. **Current budget inventory captured** — list all budgets for the billing account and document current thresholds and alert rules before any change.
+4. **CUD commitment inventory captured** — list all active committed-use discounts, their resource types, commitment amounts, and expiry dates.
+5. **Quota usage vs. limits assessed** — for quota increase requests, document current usage, current limit, and the requested new limit; estimate the maximum spend impact at the requested limit.
+6. **Financial authority confirmed** — the approver must have explicit financial authority (billing account owner, VP Engineering, CFO-delegate, or equivalent); document their identity and approval.
+7. **Service suspension risk assessed** — for budget threshold reductions, confirm the new threshold is above the minimum operational spend to avoid unexpected service suspension.
+
+## Required Confirmation
+
+The operator must explicitly state all of the following before any mutation is executed:
+
+- "I confirm the billing account is `<BILLING_ACCOUNT_ID>` and the project is `<PROJECT_ID>`."
+- "I have reviewed the current budget inventory and the proposed change is `<SPECIFIC_CHANGE>`."
+- "I have financial authority for this change (or I confirm that `<APPROVER_NAME>` has provided written approval)."
+- "I approve this billing/quota action."
+- For CUD purchases: "I understand this is a `<1/3>`-year non-cancellable commitment of approximately `<$AMOUNT>` and I approve the purchase."
+
+## Execution Steps
+
+1. Capture pre-change billing state: budget list, CUD inventory, quota usage.
+2. Confirm active principal has `roles/billing.admin` (for billing changes) or the appropriate project-level role (for quota requests).
+3. Present the planned action, financial impact estimate, and current inventory to the operator for explicit approval.
+4. Execute the mutation:
+   - Update budget: Use Cloud Console or Billing API (no direct gcloud budget mutation CLI; use `gcloud billing budgets update` if available or Billing API).
+   - Purchase CUD: Via Cloud Console > Committed Use Discounts or via `gcloud compute commitments create`.
+   - Request quota increase: Via GCP Console > IAM & Admin > Quotas, or `gcloud alpha services quota update` (where available).
+5. Confirm the action is reflected in the billing account or quota system.
+
+## Rollback Procedure
+
+- **Budget threshold change** (reversible): Update the budget back to the previous threshold using the same method.
+- **CUD commitment purchase** (NOT reversible): CUD contracts cannot be cancelled. If a CUD was purchased in error, open a GCP Support P1 case immediately — Google may be able to reverse within a very short window, but this is not guaranteed.
+- **Quota increase** (reversible): Quota increases can be reversed by submitting a quota decrease request. However, any spend incurred while the quota was elevated cannot be reversed.
+- For budget alert reductions that caused service suspension: restore the threshold and check for suspended services in Cloud Console.
+
+## Post-Change Verification
+
+1. List budgets to confirm the change is reflected: verify via Cloud Billing console or API.
+2. Confirm Cloud Monitoring budget alert notifications are still configured correctly.
+3. For CUD purchases: confirm the new commitment appears in the CUD inventory with the correct resource type and term.
+4. For quota increases: verify the new limit is visible via `gcloud compute project-info describe` or the Quotas page in Cloud Console.
+5. Check Cloud Audit Logs for the billing action: `gcloud logging read 'resource.type="billing_account"' --limit=5`.
+
+## Response Shape
+
+1. Billing account and project identity confirmation
+2. Current budget inventory and alert thresholds
+3. CUD commitment inventory and expiry
+4. Quota usage vs. limits for affected services
+5. Financial authority approval status
+6. Proposed or executed financial action
+7. Post-change alert and monitoring confirmation

package/skills/gcp/gcp-live-cost-budget-action-guard/metadata.json

@@ -0,0 +1,26 @@
+{
+  "id": "gcp-live-cost-budget-action-guard",
+  "name": "GCP Live Cost Budget Action Guard",
+  "type": "skill",
+  "provider": "gcp",
+  "harnesses": [
+    "codex",
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
+  ],
+  "summary": "Gate Cloud Billing budget threshold changes, committed-use discount purchases, and quota increase requests \u2014 financial authority gate.",
+  "source_type": "original",
+  "official_docs": [
+    "https://cloud.google.com/billing/docs/how-to/budgets",
+    "https://cloud.google.com/docs/cuds",
+    "https://cloud.google.com/compute/resource-usage#request_quotas"
+  ],
+  "last_verified": "2026-05-08",
+  "path": "skills/gcp/gcp-live-cost-budget-action-guard",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "security_notes": "Budget threshold reduction can trigger service suspension if current spend exceeds the new threshold. CUD and SUD commitments are non-refundable. Quota increase requests may affect billing tier."
+}

package/skills/gcp/gcp-live-cost-budget-action-guard/references/official-sources.md

@@ -0,0 +1,29 @@
+# Official Sources — GCP Live Cost Budget Action Guard
+
+Authoritative GCP documentation for Cloud Billing, budgets, committed-use discounts, and quota management.
+
+## Core References
+
+- **Cloud Billing Budgets** — https://cloud.google.com/billing/docs/how-to/budgets
+  How to create, configure, and manage budgets with alert thresholds and programmatic notifications via Pub/Sub.
+
+- **Committed Use Discounts (CUDs)** — https://cloud.google.com/docs/cuds
+  Overview of resource-based and spend-based CUD contracts, commitment terms, and how to purchase and view commitments.
+
+- **Requesting Quota Increases** — https://cloud.google.com/compute/resource-usage#request_quotas
+  How to view current quota usage and submit quota increase requests through Cloud Console or the Quotas API.
+
+- **Cloud Billing IAM Roles** — https://cloud.google.com/billing/docs/how-to/billing-access
+  Complete reference for billing IAM roles including `billing.admin`, `billing.viewer`, and `billing.costsManager`.
+
+- **Budget Notifications via Pub/Sub** — https://cloud.google.com/billing/docs/how-to/budgets-programmatic-notifications
+  How to configure programmatic budget alerts and automated responses using Cloud Functions.
+
+- **Cloud Billing Reports** — https://cloud.google.com/billing/docs/how-to/view-invoice
+  How to view cost reports, export billing data to BigQuery, and analyze spending trends.
+
+- **Service Usage and Quotas API** — https://cloud.google.com/service-usage/docs/access-control
+  IAM roles and API reference for managing quotas programmatically.
+
+- **CUD Analysis and Recommendations** — https://cloud.google.com/billing/docs/how-to/cud-analysis-resource-based
+  How to use the CUD Analysis tool to evaluate commitment efficiency and identify over- or under-commitment.

package/skills/gcp/gcp-live-cost-budget-action-guard/references/workflow-and-output.md

@@ -0,0 +1,130 @@
+# Workflow and Output — GCP Live Cost Budget Action Guard
+
+## Step-by-Step Workflow
+
+### Phase 1: Identity and Billing Account Confirmation
+
+1. Confirm active gcloud identity:
+   ```
+   gcloud auth list
+   gcloud config get-value account
+   ```
+2. List billing accounts accessible to the active principal:
+   ```
+   gcloud billing accounts list
+   ```
+3. Confirm the target billing account ID and its associated projects:
+   ```
+   gcloud billing projects list --billing-account=<BILLING_ACCOUNT_ID>
+   ```
+
+### Phase 2: Current Budget Inventory
+
+4. List all budgets for the billing account (via Cloud Console or Billing Budgets API):
+   ```
+   # Via gcloud (if available):
+   gcloud billing budgets list --billing-account=<BILLING_ACCOUNT_ID>
+   ```
+5. For each budget, capture: display name, amount, alert threshold percentages, notification channels, and programmatic notification Pub/Sub topics.
+
+### Phase 3: CUD Commitment Inventory
+
+6. List active committed-use discount commitments:
+   ```
+   gcloud compute commitments list --project=<PROJECT>
+   ```
+7. For each commitment, capture: resource type, region, plan (1-year or 3-year), status, start date, end date, and estimated monthly value.
+
+### Phase 4: Quota Audit (for quota increase requests)
+
+8. View current quotas for the target service and region:
+   ```
+   gcloud compute project-info describe --project=<PROJECT>
+   # Or for specific quota:
+   gcloud alpha services quota list --service=<SERVICE> --project=<PROJECT>
+   ```
+9. Calculate current utilization percentage and estimated spend at the new quota limit.
+
+### Phase 5: Financial Authority Confirmation
+
+10. Identify the financial authority approver (billing account owner, VP Engineering, or CFO-delegate).
+11. Document their written approval, including: approver identity, date, action being approved, and acknowledged financial impact.
+12. Do not proceed without confirmed financial authority.
+
+### Phase 6: Execution
+
+13. Execute the approved action:
+    - Budget update: Via Cloud Console > Billing > Budgets & alerts > Edit, or Billing Budgets API.
+    - CUD purchase:
+      ```
+      gcloud compute commitments create <COMMITMENT_NAME> \
+        --project=<PROJECT> \
+        --region=<REGION> \
+        --resources=vcpu=<N>,memory=<N>GB \
+        --plan=<TWELVE_MONTH|THIRTY_SIX_MONTH>
+      ```
+    - Quota increase: Via Cloud Console > IAM & Admin > Quotas > select quota > Edit Quotas.
+
+### Phase 7: Post-Change Verification
+
+14. Confirm the new budget threshold is reflected in the billing account.
+15. For CUD purchases, confirm the new commitment appears:
+    ```
+    gcloud compute commitments describe <COMMITMENT_NAME> --project=<PROJECT> --region=<REGION>
+    ```
+16. Verify Cloud Monitoring budget alert channels are still active.
+17. Check Cloud Audit Logs for the billing action.
+
+## Expected Output Format
+
+```
+BILLING IDENTITY
+  Billing Account: <billing-account-id>
+  Display Name:   <account-name>
+  Project:        <project-id>
+
+ACTIVE PRINCIPAL
+  Account:        <email>
+  Billing Role:   [billing.admin | billing.viewer | MISSING]
+
+BUDGET INVENTORY
+  Budget count:   <N>
+  Budget name:    <name>
+  Amount:         $<amount> [monthly | annual]
+  Alert levels:   <50% / 90% / 100% of actual spend>
+  Pubsub topic:   [CONFIGURED | NOT CONFIGURED]
+
+CUD INVENTORY
+  Active CUDs:    <count>
+  CUD #1:         <resource-type>, <region>, <plan>, expires <date>, ~$<monthly-value>/mo
+  [additional CUDs...]
+
+QUOTA AUDIT (if applicable)
+  Service:        <service-name>
+  Quota metric:   <metric>
+  Current limit:  <N>
+  Current usage:  <N> (<pct>%)
+  Requested limit: <N>
+  Max spend impact: ~$<estimate>/month at new limit
+
+FINANCIAL AUTHORITY
+  Approver:       <name / email>
+  Authority:      [billing-owner | VP-Eng | CFO-delegate]
+  Approved:       [YES / NO / PENDING]
+  CUD non-cancellable acknowledged: [YES / NO / N/A]
+
+ACTION
+  [BLOCKED — reason]
+  OR [EXECUTED — budget updated to $<amount> with alerts at <thresholds>]
+  OR [EXECUTED — CUD commitment <name> purchased: <term>, ~$<value>/year]
+  OR [SUBMITTED — quota increase request for <quota> to <N>]
+
+ROLLBACK POSTURE
+  Budget change:  [REVERSIBLE — restore to $<previous-amount>]
+  CUD purchase:   [NOT REVERSIBLE — contact GCP Support P1 if in error]
+  Quota increase: [REVERSIBLE — submit decrease request]
+
+MONITORING
+  Budget alerts:  [ACTIVE | CHECK REQUIRED]
+  Audit log:      [FOUND — insertId: <id>]
+```