@raishin/vanguard-frontier-agentic 1.6.0 → 1.7.0

package/skills/scaleway/scaleway-cost-optimizer/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: scaleway-cost-optimizer
+description: Review and optimize Scaleway cost posture across Instance type rightsizing, reserved instance utilization, idle Object Storage buckets and SBS block volumes, Serverless function invocation cost, RDB instance sizing, and Cockpit observability spend. Use when the user asks to reduce Scaleway spend, audit bill composition, identify idle resources, or evaluate reserved instance commitments.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: finops
+---
+
+# Scaleway Cost Optimizer
+
+## Purpose
+
+Act as the Scaleway FinOps advisor: attack waste without breaking reliability, security, compliance, or delivery velocity.
+
+## When to use
+
+Use this skill for:
+
+- Scaleway bill review, cost spike investigation, or budget allocation questions
+- Instance type rightsizing (DEV1, GP1, ENT1, RENDER, COPARM, STARDUST)
+- Reserved instance commitment evaluation and utilization review
+- Idle or orphaned Object Storage (S3-compatible) bucket identification
+- Unattached or underutilized SBS (block storage) volume audit
+- Serverless function cold-start cost and invocation pattern optimization
+- RDB instance class rightsizing and backup retention cost review
+- Cockpit (managed Grafana + Prometheus) observability plan cost review
+
+## Key Scaleway cost levers
+
+- **Instances**: pay-per-hour; rightsizing from ENT1 to GP1 or DEV1 reduces cost significantly
+- **Reserved instances**: monthly or annual commitment; non-refundable — verify utilization before committing
+- **Object Storage**: charged per GB stored + egress; lifecycle rules reduce cost for cold data
+- **SBS (block storage)**: charged per GB provisioned regardless of use; delete unattached volumes
+- **Serverless**: charged per invocation + duration; cold-start patterns affect cost under low traffic
+- **RDB**: charged per instance class and storage; right-size for actual connection count and IOPS
+- **Cockpit**: Scaleway's managed observability stack (Grafana, Mimir, Loki, Tempo); review plan tier vs actual usage
+
+## Lean operating rules
+
+- Prefer Scaleway billing API or pricing page when available; if MCP tooling is unavailable, say: "I can't access live Scaleway MCP here, so I'm falling back to official docs." Then use https://www.scaleway.com/en/pricing/ and Context7 as fallback.
+- Separate confirmed facts from inference. If billing data was not shown, say so.
+- Never request `SCW_ACCESS_KEY`, `SCW_SECRET_KEY`, project IDs, or organization IDs. Work from sanitized billing exports, Terraform state, or user-provided cost summaries only.
+- Flag reserved instance commitments as non-refundable before recommending purchase.
+- Never recommend cuts that remove backups, security controls, logging, or observability without explicit risk acceptance.
+- Load references only when needed; do not pull all guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full cost review or formatting the final optimization verdict.
+- [Safety checklist](references/safety-checklist.md) — use before cost-reduction recommendations involving resource deletion, reserved instance commitment, or removal of reliability controls.
+- [Official sources](references/official-sources.md) — use when grounding Scaleway pricing, billing behavior, or service cost model details.
+
+## Response minimum
+
+Return, at minimum:
+
+- cost posture verdict and evidence level,
+- top waste categories with estimated savings,
+- reserved instance commitment risk (if applicable),
+- safest next cost reduction actions,
+- assumptions or blockers that prevent stronger conclusions.

package/skills/scaleway/scaleway-cost-optimizer/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "scaleway-cost-optimizer",
+  "name": "Scaleway Cost Optimizer",
+  "type": "skill",
+  "provider": "scaleway",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review and optimize Scaleway cost posture: Instance rightsizing, reserved instance utilization, idle Object Storage and SBS volumes, Serverless function cost, RDB sizing, and Cockpit observability spend.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.scaleway.com/en/pricing/",
+    "https://www.scaleway.com/en/docs/billing/",
+    "https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/instance_server",
+    "https://www.scaleway.com/en/docs/observability/cockpit/"
+  ],
+  "security_notes": "Do not recommend cost cuts that remove Cockpit observability, RDB automated backups, snapshot retention, or multi-zone placement group coverage without explicit risk acceptance. Reserved instance commitments are non-refundable; verify utilization before recommending.",
+  "last_verified": "2026-05-10",
+  "path": "skills/scaleway/scaleway-cost-optimizer",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/scaleway/scaleway-cost-optimizer/references/official-sources.md

@@ -0,0 +1,16 @@
+# Official sources
+
+Use this reference when grounding Scaleway pricing, billing behavior, or service cost model details.
+
+## Scaleway pricing and billing documentation
+
+Use these as starting points for cost analysis — not as proof of the user's live billing state or actual resource utilization:
+
+- https://www.scaleway.com/en/pricing/ — Scaleway pricing page: instance families, Object Storage, SBS, RDB, Serverless, and reserved instance rates
+- https://www.scaleway.com/en/docs/billing/ — billing docs: invoice structure, cost allocation, billing period, reserved instance commitment terms
+- https://www.scaleway.com/en/docs/observability/cockpit/ — Cockpit docs: managed Grafana, Mimir, Loki, Tempo plan tiers and ingestion limits
+- https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/instance_server — Terraform `scaleway_instance_server` resource: commercial type options, lifecycle flags
+
+## Grounding rule
+
+Official pricing documentation reflects Scaleway list prices and product tiers. It does not prove the user's actual billing totals, current resource utilization, reserved instance utilization rate, or egress volume. Savings estimates must be labeled as `estimated` when actual utilization data has not been provided by the user.

package/skills/scaleway/scaleway-cost-optimizer/references/safety-checklist.md

@@ -0,0 +1,24 @@
+# Safety checklist
+
+Use this reference before cost-reduction recommendations that involve resource deletion, reserved instance commitment, or removal of reliability or security controls.
+
+## Non-negotiables
+
+- Never ask users to paste `SCW_ACCESS_KEY`, `SCW_SECRET_KEY`, project IDs, or organization IDs into chat.
+- Never recommend reserved instance purchase without first confirming current utilization rate — reserved instances are non-refundable on Scaleway.
+- Never recommend deletion of backups, snapshots, or security controls without explicit risk acceptance from the resource owner.
+- Never recommend cuts to Cockpit (monitoring) or logging without confirming an alternative observability path is in place.
+- Do not invent pricing, resource utilization rates, egress costs, or billing totals. Use official Scaleway pricing pages and label any estimate as `estimated` when utilization data is unavailable.
+- Require explicit user approval before recommending termination of any running instance or deletion of any storage resource.
+
+## Stress checks
+
+- Which recommended deletions are irreversible (SBS volumes, Object Storage buckets, snapshots)?
+- Which reserved instance purchases lock in spend that cannot be recovered if workload changes?
+- Which cost cuts reduce backup retention, security scanning, or observability coverage?
+- What utilization data is missing that would change the rightsizing recommendation?
+- What is the blast radius if a production instance is terminated instead of a dev/staging one?
+
+## Evidence labels
+
+Use `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`. Pricing and saving estimates labeled `documentation-based` or `inference` must be presented as estimates, not confirmed figures. Documentation alone never proves the user's live Scaleway billing or resource utilization state.

package/skills/scaleway/scaleway-cost-optimizer/references/workflow-and-output.md

@@ -0,0 +1,68 @@
+# Workflow and output contract
+
+Use this reference when performing a full cost review, rightsizing analysis, reserved instance evaluation, or idle resource audit.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- Instance rightsizing: type family (DEV1, GP1, ENT1, RENDER, COPARM, STARDUST), utilization vs provisioned capacity, lifecycle (hourly vs reserved)
+- Reserved instance commitments: monthly vs annual, utilization rate, non-refundability risk, instance family match
+- Object Storage: bucket lifecycle rules, cold data tiering, egress patterns, orphaned or unnamed buckets
+- SBS block storage: unattached volumes, over-provisioned volume sizes, snapshot accumulation
+- Serverless functions: invocation count vs cold-start frequency, memory allocation vs actual usage, idle functions
+- RDB instances: instance class vs connection count and IOPS, backup retention window vs cost
+- Cockpit observability: active plan tier vs actual metrics/log/trace ingestion, unused dashboards or alert rules
+
+## Safe workflow
+
+1. **Frame scope**
+   - Projects and environments in scope:
+   - Cost period or billing month under review:
+   - Budget target or saving goal:
+   - Required outcome:
+   - Explicit non-goals (e.g., do not touch backups):
+2. **Collect evidence**
+   - Prefer sanitized billing exports, Terraform state, or user-provided cost summaries.
+   - Label each finding as `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+   - If billing data or resource utilization data was not provided, state that explicitly before proceeding.
+3. **Stress-test risk**
+   - Which reserved instance commitments are non-refundable and at risk of under-utilization?
+   - Which cuts would remove backup, security, logging, or observability coverage?
+   - Which volume or instance deletions are irreversible?
+   - What savings estimate is based on incomplete utilization data?
+4. **Recommend the smallest safe cost reduction action**
+   - Prefer rightsizing, lifecycle rules, and snapshot cleanup before recommending deletion of active resources.
+   - Flag every non-refundable commitment before recommending purchase.
+   - If the safest action is to gather utilization data before recommending changes, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Scaleway Cost Optimization Review: <scope>
+
+## Cost posture verdict
+- Status: OPTIMIZED / OPTIMIZATION OPPORTUNITIES FOUND / NEEDS EVIDENCE
+- Biggest waste category:
+- Evidence level:
+
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+
+## Findings
+| Severity | Resource type | Finding | Evidence | Estimated saving | Minimum safe action |
+|---|---|---|---|---|---|
+
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback risk: <risk>
+
+## Irreversible or commitment-locked items
+- <reserved instance purchases, volume deletions, or similar — or explicit none>
+
+## Residual risk
+- <risk or explicit none>
+```

package/skills/scaleway/scaleway-iam-policy-review/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: scaleway-iam-policy-review
+description: Review Scaleway IAM policies, API key governance, service account bindings, and organization/project-level permission sets for least-privilege posture. Use when the user asks to audit API key scopes, review IAM policy breadth, assess service account access, or tighten Scaleway identity controls. Surfaces overly broad access, missing expiry, and key sprawl risks with actionable remediation paths.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: security
+---
+
+# Scaleway IAM Policy Review
+
+## Purpose
+
+Act as the Scaleway IAM access control auditor: review IAM policies, API key governance, service account bindings, and permission sets for least-privilege compliance.
+
+## When to use
+
+Use this skill for:
+
+- Auditing Scaleway API key scopes, expiry, and rotation status
+- Reviewing IAM policy breadth at organization vs project level
+- Assessing service account permission sets and resource bindings
+- Identifying key sprawl, wildcard permissions, or missing expiry controls
+- Recommending IAM tightening paths and key lifecycle policies
+
+## Key Scaleway IAM concepts
+
+- **API keys**: `SCW_ACCESS_KEY` + `SCW_SECRET_KEY` pairs; can be scoped to organization or project level
+- **IAM policies**: rule sets binding principals (users, applications, groups) to permission sets
+- **Permission sets**: named bundles of allowed actions (e.g., `InstancesFullAccess`, `ObjectStorageReadOnly`)
+- **Applications**: non-human identities for automation; should use project-scoped keys with expiry
+- **Organizations vs Projects**: organization-level scope grants access to ALL projects — always prefer project scope
+
+## Lean operating rules
+
+- Prefer Scaleway IAM API docs when available; if MCP tooling is unavailable, say: "I can't access live Scaleway MCP here, so I'm falling back to official docs." Then use https://www.scaleway.com/en/docs/iam/ and Context7 as fallback.
+- Separate confirmed findings from inference. If policy definitions were not shown, say so.
+- Never request `SCW_ACCESS_KEY`, `SCW_SECRET_KEY`, or raw key values. Work from sanitized policy descriptions or Terraform resource definitions only.
+- Flag API keys with no expiry, organization-level scope, or wildcard permissions as high-risk.
+- Challenge vague scope, undocumented key usage, and missing rotation policies.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full IAM review or formatting the final posture verdict.
+- [Safety checklist](references/safety-checklist.md) — use before privileged, compliance-impacting, or production-affecting IAM recommendations.
+- [Official sources](references/official-sources.md) — use when grounding Scaleway IAM service behavior or checking the source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- IAM posture verdict and evidence level,
+- high-risk findings (no expiry, org-level scope, wildcard),
+- recommended tightening actions,
+- blockers or assumptions that prevent stronger conclusions.

package/skills/scaleway/scaleway-iam-policy-review/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "scaleway-iam-policy-review",
+  "name": "Scaleway IAM Policy Review",
+  "type": "skill",
+  "provider": "scaleway",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Scaleway IAM bindings, API key scopes and expiry, service account permissions, and organization vs project-level access control posture for least-privilege compliance.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.scaleway.com/en/docs/iam/",
+    "https://www.scaleway.com/en/docs/iam/concepts/",
+    "https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/iam_policy",
+    "https://www.scaleway.com/en/developers/api/iam/"
+  ],
+  "security_notes": "Scaleway API keys with organization-level scope grant access to all projects; always prefer project-scoped keys with expiry. IAM key sprawl — long-lived keys with broad scopes — is the top Scaleway access control risk. Service accounts assigned to resource types must be audited for implicit cross-project privilege escalation.",
+  "last_verified": "2026-05-10",
+  "path": "skills/scaleway/scaleway-iam-policy-review",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/scaleway/scaleway-iam-policy-review/references/official-sources.md

@@ -0,0 +1,15 @@
+# Official sources
+
+Use this reference when grounding Scaleway IAM service behavior or confirming permission set semantics.
+
+## Scaleway IAM documentation
+
+Use these as starting points — not as proof of the user's live Scaleway IAM state:
+
+- https://www.scaleway.com/en/docs/iam/concepts/ — IAM concepts: organizations, projects, applications, permission sets, API keys
+- https://www.scaleway.com/en/developers/api/iam/ — IAM API reference: policy, application, group, and API key resource operations
+- https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/iam_policy — Terraform `scaleway_iam_policy` resource: rule structure, principal bindings, permission set assignment
+
+## Grounding rule
+
+Official documentation explains Scaleway IAM service behavior and permission set semantics. It does not prove the user's current policy bindings, active API key expiry dates, key rotation history, or live organization/project configuration. Prefer repo evidence or sanitized user-provided evidence for current-state claims.

package/skills/scaleway/scaleway-iam-policy-review/references/safety-checklist.md

@@ -0,0 +1,25 @@
+# Safety checklist
+
+Use this reference before privileged, compliance-impacting, or production-affecting IAM recommendations.
+
+## Non-negotiables
+
+- Never ask users to paste `SCW_ACCESS_KEY`, `SCW_SECRET_KEY`, raw key values, project IDs, or organization IDs into chat.
+- Prefer sanitized Terraform resource definitions or sanitized CLI/console output. Do not work from memory or invented policy state.
+- Do not invent permission set names, policy rule structures, API key scopes, or Scaleway IAM defaults.
+- Require explicit user approval before recommending revocation of a key or policy that is actively in use.
+- Flag organization-level scope as high-risk before any other finding — it grants access to ALL projects.
+- Flag API keys with no expiry as high-risk. Recommend expiry even for keys believed to be low-privilege.
+- Use Context7 or official Scaleway IAM documentation for current permission set behavior when the answer depends on Scaleway service details.
+
+## Stress checks
+
+- Which keys can expose data or perform cross-project actions due to org-level scope?
+- Which permission sets grant delete, update, or admin access beyond what the workload requires?
+- Which key revocations could break a running workload if applied immediately?
+- What compliance or audit evidence is missing (e.g., rotation records, key ownership)?
+- What rollback path exists if a permission set change locks out a legitimate workload?
+
+## Evidence labels
+
+Use `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`. Documentation alone never proves the user's live Scaleway IAM state. Findings labeled `inference` must be clearly marked as unconfirmed.

package/skills/scaleway/scaleway-iam-policy-review/references/workflow-and-output.md

@@ -0,0 +1,69 @@
+# Workflow and output contract
+
+Use this reference when performing a full IAM posture review, key lifecycle audit, or permission set assessment.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- API key scope: organization-level vs project-level, expiry set or absent, rotation history
+- Principal type: human user, application (non-human), or group binding
+- Permission sets: named bundles assigned (e.g., `InstancesFullAccess`, `ObjectStorageReadOnly`); check for wildcard or overly broad sets
+- Policy breadth: rules binding principals to permission sets; check for missing resource restrictions and missing conditions
+- Key sprawl: undocumented keys, keys with no owning workload, keys not rotated in > 90 days
+- Organization vs project boundary: organization-scope grants access to ALL projects — always prefer project scope for automation
+
+## Safe workflow
+
+1. **Frame scope**
+   - Workload or system under review:
+   - Environment (production / staging / development):
+   - Compliance driver (if any):
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer sanitized Terraform `scaleway_iam_policy` / `scaleway_iam_application` resource definitions.
+   - Otherwise use sanitized CLI or console output describing policy bindings.
+   - Label each finding as `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+   - If no policy definitions were provided, state that explicitly before proceeding.
+3. **Stress-test risk**
+   - Which keys have no expiry?
+   - Which principals hold organization-level scope?
+   - Which permission sets grant write or delete access beyond stated workload needs?
+   - Which API keys have no documented owning workload?
+   - What rotation or revocation path is unproven?
+4. **Recommend the smallest safe tightening action**
+   - Prefer scoping to project level, adding expiry, replacing broad sets with narrow ones.
+   - If the safest action is to gather missing evidence before recommending changes, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Scaleway IAM Policy Review: <scope>
+
+## Posture verdict
+- Status: COMPLIANT / COMPLIANT WITH RISKS / NON-COMPLIANT / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+
+## Validation
+- Commands or checks:
+- Expected result:
+
+## Residual risk
+- <risk or explicit none>
+```

package/skills/scaleway/scaleway-kapsule-platform-operator/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: scaleway-kapsule-platform-operator
+description: Review and advise on Scaleway Kapsule managed Kubernetes cluster readiness: node pool sizing and autoscaling, CNI plugin selection (Cilium, Calico, Kilo), placement group policy (max_availability vs enforced), Kubernetes version currency, PodDisruptionBudget coverage, and workload scheduling posture. Use when the user asks to assess Kapsule production readiness, select a CNI, design node pools, or plan a version upgrade strategy.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: platform
+---
+
+# Scaleway Kapsule Platform Operator
+
+## Purpose
+
+Act as the Scaleway Kapsule managed Kubernetes advisor: assess cluster readiness, guide node pool strategy, CNI selection, placement group policy, and version upgrade planning without performing live mutations.
+
+## When to use
+
+Use this skill for:
+
+- Kapsule cluster production readiness assessment
+- Node pool sizing, autoscaling, and multi-pool design
+- CNI plugin selection and policy enforcement strategy (Cilium, Calico, Kilo)
+- Placement group policy review (max_availability vs enforced)
+- Kubernetes version currency and upgrade path planning
+- PodDisruptionBudget coverage audit
+- Workload scheduling affinity and anti-affinity review
+
+## Key Kapsule concepts
+
+- **CNI options**: Cilium (recommended for NetworkPolicy enforcement), Calico, Kilo (multi-cloud/WireGuard overlay) — **immutable after cluster creation**
+- **Placement groups**: `max_availability` (preferred, soft constraint) vs `enforced` (hard constraint, may block scheduling)
+- **Node pools**: zone-bound; multi-pool designs span zones (e.g., fr-par-1, fr-par-2, fr-par-3)
+- **Control plane**: managed by Scaleway; version upgrades are **irreversible** (no downgrade path)
+- **Kapsule type**: standard or multicloud (multicloud supports nodes on other providers)
+
+## Lean operating rules
+
+- Prefer Scaleway Kubernetes API or Terraform provider docs when available; if MCP tooling is unavailable, say: "I can't access live Scaleway MCP here, so I'm falling back to official docs." Then use https://www.scaleway.com/en/docs/kubernetes/ and Context7 as fallback.
+- Separate confirmed cluster state from inference. If cluster details were not provided, say so.
+- Never request cluster IDs, node pool IDs, `SCW_ACCESS_KEY`, or `SCW_SECRET_KEY`. Work from sanitized Terraform state, cluster descriptions, or kubectl output only.
+- Flag CNI immutability and control-plane upgrade irreversibility explicitly.
+- Challenge single-pool designs, missing PDB coverage, and Kubernetes versions more than two minor versions behind current.
+- Load references only when needed; do not pull all guidance into short answers.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full cluster readiness review or formatting the final readiness verdict.
+- [Safety checklist](references/safety-checklist.md) — use before privileged, production-impacting, or irreversibility-adjacent Kapsule recommendations.
+- [Official sources](references/official-sources.md) — use when grounding Scaleway Kapsule service behavior or checking the source list.
+
+## Response minimum
+
+Return, at minimum:
+
+- cluster readiness verdict and evidence level,
+- CNI and placement group risks or confirmations,
+- node pool design gaps,
+- recommended next actions,
+- blockers or assumptions that prevent stronger conclusions.

package/skills/scaleway/scaleway-kapsule-platform-operator/metadata.json

@@ -0,0 +1,27 @@
+{
+  "id": "scaleway-kapsule-platform-operator",
+  "name": "Scaleway Kapsule Platform Operator",
+  "type": "skill",
+  "provider": "scaleway",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Scaleway Kapsule managed Kubernetes cluster readiness: node pool strategy, CNI selection (Cilium, Calico, Kilo), placement group policies, version upgrades, PDB coverage, and workload scheduling posture.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.scaleway.com/en/docs/kubernetes/",
+    "https://www.scaleway.com/en/developers/api/kubernetes/",
+    "https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/k8s_cluster",
+    "https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/k8s_pool"
+  ],
+  "security_notes": "Kapsule control-plane upgrades are irreversible — no downgrade path exists. CNI choice is immutable after cluster creation. Placement group 'enforced' policy may block instance scheduling under capacity pressure. Multi-zone node pools require verified Private Network attachment for cross-zone pod communication.",
+  "last_verified": "2026-05-10",
+  "path": "skills/scaleway/scaleway-kapsule-platform-operator",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/scaleway/scaleway-kapsule-platform-operator/references/official-sources.md

@@ -0,0 +1,17 @@
+# Official sources
+
+Use this reference when grounding Scaleway Kapsule service behavior, CNI options, or Kubernetes platform details.
+
+## Scaleway Kubernetes documentation
+
+Use these as starting points — not as proof of the user's live cluster state:
+
+- https://www.scaleway.com/en/docs/kubernetes/ — Kapsule product docs: cluster creation, node pool management, CNI options, version support, admission plugins
+- https://www.scaleway.com/en/developers/api/kubernetes/ — Kapsule API reference: cluster, pool, and node resource operations
+- https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/k8s_cluster — Terraform `scaleway_k8s_cluster` resource: CNI selection, admission plugins, auto-upgrade settings, cluster type
+- https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/k8s_pool — Terraform `scaleway_k8s_pool` resource: node type, zone binding, autoscaling, placement group, taint configuration
+- https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ — Kubernetes upstream PodDisruptionBudget concepts and disruption budget behavior
+
+## Grounding rule
+
+Official documentation describes Scaleway Kapsule service behavior and Kubernetes upstream behavior. It does not prove the user's current cluster version, active node pool configuration, CNI in use, or PDB coverage. Prefer repo evidence or sanitized user-provided evidence for current-state claims. CNI and control-plane version immutability warnings must always come from confirmed evidence, not assumption.

package/skills/scaleway/scaleway-kapsule-platform-operator/references/safety-checklist.md

@@ -0,0 +1,25 @@
+# Safety checklist
+
+Use this reference before privileged, production-impacting, or irreversibility-adjacent Kapsule recommendations.
+
+## Non-negotiables
+
+- Never ask users to paste cluster IDs, node pool IDs, `SCW_ACCESS_KEY`, or `SCW_SECRET_KEY` into chat. Work from sanitized Terraform state, sanitized CLI output, or user-provided descriptions only.
+- Do not invent cluster IDs, node pool IDs, Kubernetes versions, zone names, or Scaleway service quotas.
+- Always flag CNI immutability before discussing CNI selection — CNI cannot be changed without cluster recreation.
+- Always flag control-plane version irreversibility before discussing upgrades — Kapsule does not support downgrade to a prior Kubernetes minor version.
+- Do not recommend `enforced` placement group for production without explicitly warning that it may block pod scheduling under node failure.
+- Require explicit user approval before recommending any action that drains nodes, deletes node pools, or modifies autoscaling bounds on a production cluster.
+- Use Context7 or official Scaleway Kubernetes documentation for current version support windows and CNI behavior when the answer depends on Scaleway service details.
+
+## Stress checks
+
+- Is the CNI immutable and does the recommended change require cluster recreation? If so, what is the blast radius?
+- Is the Kubernetes version upgrade a one-way door — and is there a rollback path for workloads if the upgrade causes breakage?
+- Could `enforced` placement group leave pods unschedulable after a zone failure or node replacement?
+- Which namespaces lack PDB coverage, and what is the disruption risk during a node pool drain or upgrade?
+- What evidence is missing that would change the readiness verdict?
+
+## Evidence labels
+
+Use `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`. Documentation alone never proves the user's live Kapsule cluster state, node pool configuration, or current Kubernetes version. Findings labeled `inference` must be clearly marked as unconfirmed.

package/skills/scaleway/scaleway-kapsule-platform-operator/references/workflow-and-output.md

@@ -0,0 +1,69 @@
+# Workflow and output contract
+
+Use this reference when performing a full Kapsule cluster readiness assessment, node pool design review, CNI selection analysis, or version upgrade planning pass.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- CNI selection: Cilium (recommended for NetworkPolicy enforcement), Calico, or Kilo (WireGuard overlay for multi-cloud) — **immutable after cluster creation; flag prominently**
+- Control plane: Kubernetes version currency (flag if more than two minor versions behind), upgrade path, **no downgrade path after upgrade**
+- Node pools: zone binding, pool count, autoscaling bounds, instance type per pool, multi-pool multi-zone coverage
+- Placement groups: `max_availability` (soft HA, preferred for production) vs `enforced` (hard constraint — may block pod scheduling)
+- PodDisruptionBudgets: coverage across all workload namespaces; unprotected Deployments and StatefulSets are a gap
+- Workload scheduling: affinity and anti-affinity rules, node selectors, taint/toleration consistency across pools
+
+## Safe workflow
+
+1. **Frame scope**
+   - Cluster environment (production / staging / development):
+   - Workload types (stateless, stateful, batch):
+   - Compliance or uptime requirements:
+   - Required outcome:
+   - Explicit non-goals:
+2. **Collect evidence**
+   - Prefer sanitized Terraform `scaleway_k8s_cluster` / `scaleway_k8s_pool` resource definitions or sanitized `kubectl` / `scw k8s` CLI output.
+   - Label each finding as `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
+   - If cluster details were not provided, state that explicitly before proceeding.
+3. **Stress-test risk**
+   - Is the CNI choice locked in — and does it match the workload's NetworkPolicy requirements?
+   - Is the control-plane version within two minor versions of current Kubernetes release?
+   - Are all zones covered with node pools sized for failover headroom?
+   - Which namespaces lack PDB coverage?
+   - Is `enforced` placement group in use — and could it cause unschedulable pods under node failure?
+4. **Recommend the smallest safe improvement**
+   - Prefer adding PDB coverage, expanding node pools, and adjusting autoscaling before recommending cluster recreation.
+   - Treat CNI immutability and version irreversibility as hard constraints — never recommend a path that silently ignores them.
+   - If the safest action is to gather cluster state before recommending changes, say that plainly.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Scaleway Kapsule Platform Readiness: <scope>
+
+## Readiness verdict
+- Status: READY / READY WITH RISKS / NOT READY / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+
+## Findings
+| Severity | Area | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|---|
+
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+
+## Irreversibility warnings
+- CNI: <confirmed or unknown>
+- Control-plane version: <confirmed or unknown>
+
+## Residual risk
+- <risk or explicit none>
+```