@raishin/vanguard-frontier-agentic 1.6.0 → 1.7.1

package/README.md

@@ -181,7 +181,7 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 
 ## 🤖 Agents
 
-**289 agents** matching the skill catalog — each agent ships 7 harness adapters and a hardened permission model.
+**319 agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
 
 | Provider           | Count | Specialisations                                                                     |
 | ------------------ | ----: | ----------------------------------------------------------------------------------- |
@@ -191,6 +191,11 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 | 🟦 Azure            |    36 | advisory, live-guard operators                                                      |
 | 🟠 Alibaba Cloud    |    43 | advisory, live-guard operators, maestro router                                      |
 | 🔴 Huawei Cloud     |    43 | advisory, live-guard operators, maestro router                                      |
+| ☁️ OVHcloud         |     6 | advisory, live KMS guard, maestro router                                            |
+| 🌐 IONOS Cloud      |     6 | advisory, live DB lifecycle guard, maestro router                                   |
+| 🇫🇷 Scaleway        |     6 | advisory, live Kapsule rollout guard, maestro router                                |
+| 🇩🇪 Hetzner Cloud   |     6 | advisory, live firewall + server lifecycle guards, maestro router                   |
+| 💰 Contabo          |     6 | advisory, live instance + storage guards, maestro router                            |
 | ☸️ Kubernetes       |    15 | RBAC review, workload identity, PSA, 5 live-guard operators, maestro router         |
 | 🛡️ Kyverno          |     1 | Admission policy review                                                             |
 | 🔄 Argo CD          |     2 | GitOps review, live sync guard                                                      |
@@ -203,7 +208,7 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 Every agent ships:
 - 📄 `AGENT.md` — harness-neutral contract with guarded response shape
 - 🗂️ `metadata.json` — schema-validated catalog entry
-- 🔌 7 harness adapters — claude-code, codex, copilot, cursor, gemini, kiro-ide, kiro-cli
+- 🔌 Harness adapters — claude-code + codex (EU providers); all 7 adapters for established providers
 
 ```text
 agents/
@@ -214,17 +219,22 @@ agents/
 ├── backstage/        (1 agent — IDP scaffolder review)
 ├── cert-manager/     (1 agent — PKI cert lifecycle review)
 ├── cilium/           (1 agent — network policy review)
+├── contabo/          (6 agents — advisory, live instance + storage guards, maestro)
 ├── falco/            (1 agent — runtime threat detection)
 ├── finops/           (1 agent — cross-cloud price advisor)
 ├── fluxcd/           (1 agent — GitOps Kustomization/HelmRelease review)
 ├── gcp/              (51 agents — advisory, live-guard operators, maestro)
+├── hetzner/          (6 agents — advisory, live firewall + server lifecycle guards, maestro)
 ├── huawei/           (43 agents — advisory, live-guard operators, maestro)
+├── ionos/            (6 agents — advisory, live DB lifecycle guard, maestro)
 ├── istio/            (1 agent — ambient mesh review)
 ├── kubernetes/       (15 agents — RBAC, workload identity, PSA, pod-spec, ESO, Kubecost, live-guards, maestro)
 ├── kyverno/          (1 agent — admission policy review)
 ├── oci/              (39 agents)
 ├── opentelemetry/    (1 agent — collector config review)
+├── ovhcloud/         (6 agents — advisory, live KMS guard, maestro)
 ├── prometheus/       (1 agent — alerting and cardinality review)
+├── scaleway/         (6 agents — advisory, live Kapsule rollout guard, maestro)
 ├── sigstore/         (1 agent — supply chain security)
 ├── terraform/        (2 agents)
 └── velero/           (1 agent — backup and restore)
@@ -262,7 +272,7 @@ Everything you can install, and exactly how to install it. One section, no hunti
 | `--role`       | see role table below                                  | pick one ↓                              | Install all agents for a job role                    |
 | `--agents`     | comma-separated agent IDs                             | pick one ↓                              | Install specific agents by ID                        |
 | `--all`        | —                                                     | pick one ↓                              | Install every agent for the platform                 |
-| `--provider`   | `aws` `azure` `oci` `gcp` `alibaba` `huawei` `kubernetes` `terraform` `finops` `kyverno` `argocd` `istio` `cilium` `opentelemetry` | ➕ optional | Narrow `--role` results to one provider |
+| `--provider`   | `aws` `azure` `oci` `gcp` `alibaba` `huawei` `ovhcloud` `ionos` `scaleway` `hetzner` `contabo` `kubernetes` `terraform` `finops` `kyverno` `argocd` `istio` `cilium` `opentelemetry` | ➕ optional | Narrow `--role` results to one provider |
 | `--repo`       | path                                                  | ➕ optional                              | Target repo root (defaults to current directory)     |
 | `--force`      | —                                                     | ➕ optional                              | Overwrite files that already exist                   |
 | `--list`       | —                                                     | 🔍 standalone                            | Print all agent IDs, providers, and names; then exit |
@@ -293,14 +303,14 @@ Each platform writes agent files to a different folder in your repo.
 
 A role installs the curated set of agents a practitioner in that job function needs, across all cloud providers. Roles overlap intentionally — one agent may appear in multiple roles.
 
-| `--role` value                               | 👤 Who it is for                                                         | 🔢 Agents | ☁️ What it covers                                                                                                                          |
-| -------------------------------------------- | ------------------------------------------------------------------------ | -------: | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| `cloud-security-engineer`                    | 🔐 Security engineers, compliance teams, IAM owners                       |       26 | IAM/RBAC review, secrets lifecycle, identity governance, live guards for access and key mutations — AWS · Azure · OCI · Kubernetes        |
-| `cloud-platform-engineer`                    | 🏗️ Infrastructure/SRE, IaC owners, Kubernetes platform teams              |       25 | IaC safety review, container platform operators, networking, landing zones, live deployment guards — AWS · Azure · OCI · Terraform        |
-| `cloud-dba`                                  | 🗄️ Database administrators, data platform engineers                       |       13 | RDS/Aurora, DynamoDB, CosmosDB, OCI Autonomous/Exadata/MySQL HeatWave, replication, live DB lifecycle guards                              |
-| `cloud-finops-analyst`                       | 💰 FinOps leads, cost governance teams                                    |        9 | Cost optimization governors, anomaly watch, budget runaway guards, capacity planning — AWS · Azure · OCI                                  |
-| `cloud-solutions-architect`                  | 🏛️ Cloud architects, migration leads, AI/generative engineers             |       20 | Solution architecture, migration cutover, resilience/BCDR, event-driven design, multi-cloud, AI/generative — AWS · Azure · OCI            |
-| `cloud-devops-engineer`                      | 🚀 CI/CD engineers, release managers, SRE ops                             |       25 | CI/CD, pipeline approval gates, live rollout guards, deployment hotfix operators, serverless readiness, observability — AWS · Azure · OCI |
+| `--role` value                               | 👤 Who it is for                                                         | 🔢 Agents | ☁️ What it covers                                                                                                                                                     |
+| -------------------------------------------- | ------------------------------------------------------------------------ | -------: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `cloud-security-engineer`                    | 🔐 Security engineers, compliance teams, IAM owners                       |       51 | IAM/RBAC review, secrets lifecycle, identity governance, live guards for access and key mutations — AWS · Azure · OCI · GCP · Alibaba · Huawei · OVHcloud · Scaleway · Contabo · K8s |
+| `cloud-platform-engineer`                    | 🏗️ Infrastructure/SRE, IaC owners, Kubernetes platform teams              |       58 | IaC safety review, container platform operators, networking, landing zones, live deployment guards — AWS · Azure · OCI · GCP · Alibaba · Huawei · EU providers · Terraform |
+| `cloud-dba`                                  | 🗄️ Database administrators, data platform engineers                       |       20 | RDS/Aurora, DynamoDB, CosmosDB, OCI Autonomous/Exadata/MySQL HeatWave, IONOS DBaaS, replication, live DB lifecycle guards                                             |
+| `cloud-finops-analyst`                       | 💰 FinOps leads, cost governance teams                                    |       25 | Cost optimization governors, anomaly watch, budget runaway guards, capacity planning — AWS · Azure · OCI · GCP · Alibaba · Huawei · EU providers                      |
+| `cloud-solutions-architect`                  | 🏛️ Cloud architects, migration leads, AI/generative engineers             |       38 | Solution architecture, migration cutover, resilience/BCDR, event-driven design, multi-cloud, AI/generative — AWS · Azure · OCI · GCP · Alibaba · Huawei               |
+| `cloud-devops-engineer`                      | 🚀 CI/CD engineers, release managers, SRE ops                             |       49 | CI/CD, pipeline approval gates, live rollout guards, deployment hotfix operators, serverless readiness, observability — AWS · Azure · OCI · GCP · Alibaba · Huawei    |
 | `kubernetes-admission-security-engineer`     | 🛡️ Platform security, policy engineers, admission control owners          |        6 | Kyverno policy review, K8s workload identity, PSA profiles, live admission-policy guard, live RBAC guard                                  |
 | `kubernetes-network-engineer`                | 🐝 Network engineers, platform SREs, zero-trust mesh owners               |        5 | Cilium/NetworkPolicy review, Istio ambient mesh review, live network-policy and mesh-policy guards                                        |
 | `kubernetes-application-platform-engineer`   | 🔄 Platform engineers, GitOps owners, ArgoCD operators                    |        3 | Argo CD GitOps review, live ArgoCD sync guard, kubernetes-maestro router                                                                  |
@@ -340,6 +350,11 @@ Use `--provider` with `--role` to narrow the install to one cloud.
 | `gcp`               | 🟩 Google Cloud Platform                  |                  51 |
 | `alibaba`           | 🟠 Alibaba Cloud                          |                  43 |
 | `huawei`            | 🔴 Huawei Cloud                           |                  43 |
+| `ovhcloud`          | ☁️ OVHcloud                               |                   6 |
+| `ionos`             | 🌐 IONOS Cloud                            |                   6 |
+| `scaleway`          | 🇫🇷 Scaleway                             |                   6 |
+| `hetzner`           | 🇩🇪 Hetzner Cloud                        |                   6 |
+| `contabo`           | 💰 Contabo                                |                   6 |
 | `kubernetes`        | ☸️ Kubernetes (cross-cloud)               |                  15 |
 | `kyverno`           | 🛡️ Kyverno (admission policy)            |                   1 |
 | `argocd`            | 🔄 Argo CD + Argo Rollouts (GitOps)       |                   2 |
@@ -519,6 +534,28 @@ Use these principles when creating or reviewing assets:
 
 ---
 
+## ✅ Eval-driven development
+
+This repository uses **eval-driven development (EDD)** to ensure quality and consistency.
+
+Before implementing any new feature, agents, or skills:
+
+1. **Define evals first** — What must pass? (capability evals + regression evals)
+2. **Implement** — Build agents, skills, or features
+3. **Validate** — Run the test suite and evals
+4. **Report** — Document results in `.claude/evals/<feature>.md`
+
+**Example:** The [EU cloud providers feature](https://github.com/raishin/vanguard-frontier-agentic/pull/18) was built using EDD:
+
+- **CE-1 to CE-6**: Capability evals (filesystem layout, companion skills, security, schema, docs, content quality)
+- **CE-7 to CE-8**: Post-implementation evals (role-based install coverage, taxonomy/docs updates)
+- **Regression evals**: All 7 validation gates (catalog, skill schema, allowed-tools, agent schema, manifest, links)
+- **Result**: 30 agents + 30 skills across 5 EU providers, all validation gates passing
+
+See the `/eval-harness` skill for the full EDD framework and `docs/CODEMAPS/` for live inventory.
+
+---
+
 ## 🧭 Quick map
 
 | Folder                     | What lives here                                                               | Easy memory hook                      |
@@ -531,6 +568,7 @@ Use these principles when creating or reviewing assets:
 | [`schemas/`](schemas/)     | Metadata validation contracts                                                 | ✅ "What fields are required?"         |
 | [`templates/`](templates/) | Starter templates for new assets                                              | 🧱 "How do I add one?"                 |
 | [`docs/`](docs/)           | Quality rules, taxonomy, compliance evidence spec, CI/CD enforcement patterns | 📚 "How should this repo work?"        |
+| [`.claude/evals/`](.claude/evals/)  | Eval-driven development (EDD) definitions and test reports                 | ✅ "How are features validated?"       |
 | [`assets/`](assets/)       | Logos and visual assets                                                       | 🎨 "What images can docs use?"         |
 
 ---

package/agents/AGENTS.md

@@ -97,6 +97,89 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
+## ☁️ OVHcloud — 6 agents → [`agents/ovhcloud/README.md`](ovhcloud/README.md)
+
+**Entry point:** load `agents/ovhcloud/ovhcloud-maestro-agent/AGENT.md` for any OVHcloud task.
+
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `ovhcloud-maestro-agent` | Any OVHcloud task without a known specialist |
+| **IAM** | `ovhcloud-iam-policy-review-agent` | IAM policy conditions, identity groups, OAuth2 access |
+| **Cost / FinOps** | `ovhcloud-cost-finops-analyst-agent` | Public Cloud cost, commitments, idle waste |
+| **Kubernetes** | `ovhcloud-kubernetes-platform-operator-agent` | MCK lifecycle, node pools, workload placement |
+| **Networking** | `ovhcloud-network-architect-agent` | vRack design, network isolation, connectivity |
+| **Live-guard (1)** | `ovhcloud-live-kms-key-destruction-guard-agent` | KMS key destruction; approval-gated, never auto-dispatched |
+
+> Conditional IAM policies (IP, tag, expiration) are unique — always audit policy scope before approval.
+
+---
+
+## 🌐 IONOS Cloud — 6 agents → [`agents/ionos/README.md`](ionos/README.md)
+
+**Entry point:** load `agents/ionos/ionos-maestro-agent/AGENT.md` for any IONOS Cloud task.
+
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `ionos-maestro-agent` | Any IONOS Cloud task without a known specialist |
+| **DCD topology** | `ionos-datacenter-designer-reviewer-agent` | Data Center Designer review, multi-AZ placement, blast radius |
+| **Compliance** | `ionos-security-compliance-reviewer-agent` | GDPR posture, data residency, encryption audit |
+| **Kubernetes** | `ionos-kubernetes-platform-operator-agent` | Managed K8s, node pools, workload placement |
+| **Cost / FinOps** | `ionos-cost-optimization-analyst-agent` | Cost analysis, resource utilization |
+| **Live-guard (1)** | `ionos-live-database-lifecycle-guard-agent` | DBaaS failover/scaling/backup; approval-gated |
+
+> DCD changes have multi-AZ topology blast radius; live-guards must snapshot current state before any mutation.
+
+---
+
+## 🇫🇷 Scaleway — 6 agents → [`agents/scaleway/README.md`](scaleway/README.md)
+
+**Entry point:** load `agents/scaleway/scaleway-maestro-agent/AGENT.md` for any Scaleway task.
+
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `scaleway-maestro-agent` | Any Scaleway task without a known specialist |
+| **IAM** | `scaleway-iam-policy-review-agent` | IAM bindings, service accounts, API key governance |
+| **Kapsule (K8s)** | `scaleway-kapsule-platform-operator-agent` | Managed K8s readiness, node pools, CNI choice, placement |
+| **Cost / FinOps** | `scaleway-cost-optimizer-agent` | Instance type review, reserved utilization, rightsizing |
+| **Networking** | `scaleway-network-architect-agent` | VPC, security groups, placement groups for HA |
+| **Live-guard (1)** | `scaleway-live-kapsule-rollout-guard-agent` | Kapsule cluster + node pool mutations; approval-gated |
+
+> Placement groups orchestrate HA; Kapsule control-plane and CNI choice are immutable post-creation.
+
+---
+
+## 🇩🇪 Hetzner Cloud — 6 agents → [`agents/hetzner/README.md`](hetzner/README.md)
+
+**Entry point:** load `agents/hetzner/hetzner-maestro-agent/AGENT.md` for any Hetzner Cloud task.
+
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `hetzner-maestro-agent` | Any Hetzner Cloud task without a known specialist |
+| **Cost / FinOps** | `hetzner-cost-optimization-analyst-agent` | Instance type review, resource utilization, cost savings |
+| **Infra review** | `hetzner-infrastructure-reviewer-agent` | Firewall rules, LB config, network design, public-IP exposure |
+| **Capacity** | `hetzner-capacity-planner-agent` | Resource limits, quota, growth planning, region distribution |
+| **Live-guard (2)** | `hetzner-live-firewall-rule-guard-agent`, `hetzner-live-server-lifecycle-guard-agent` | Firewall rule + server lifecycle mutations; approval-gated |
+
+> No official Terraform provider — agents recommend REST API / hcloud-python over community Terraform.
+
+---
+
+## 💰 Contabo — 6 agents → [`agents/contabo/README.md`](contabo/README.md)
+
+**Entry point:** load `agents/contabo/contabo-maestro-agent/AGENT.md` for any Contabo task.
+
+| Category | Agents | Load when |
+|---|---|---|
+| **Router** | `contabo-maestro-agent` | Any Contabo task without a known specialist |
+| **Cost / FinOps** | `contabo-cost-optimization-analyst-agent` | Contract period analysis, VPS sizing, addon utilization |
+| **Capacity** | `contabo-capacity-planner-agent` | Resource planning, region coverage, instance sizing |
+| **Security** | `contabo-security-hardening-agent` | SSH key management, default user policy, firewall posture |
+| **Live-guard (2)** | `contabo-live-instance-lifecycle-guard-agent`, `contabo-live-storage-operations-guard-agent` | VPS/VDS + Object Storage mutations; approval-gated |
+
+> Contractual periods (1/3/6/12 months) drive billing; live-guards demand explicit period acknowledgment before any lifecycle change. No official Terraform/SDK — automation via `cntb` CLI or REST API.
+
+---
+
 ## ☸️ Kubernetes — 13 agents → [`agents/kubernetes/README.md`](kubernetes/README.md)
 
 **Entry point:** load `agents/kubernetes/kubernetes-maestro-agent/AGENT.md` — routes to all K8s specialists (including CNCF domain agents below) and enforces the live-guard gate.

package/agents/README.md

@@ -12,6 +12,11 @@ Role definitions for repeatable review, architecture, operations, and bounded ex
 | 🟦 Azure | active | 36 | advisory and guarded live-Azure operator agents |
 | 🟠 Alibaba Cloud | active | 30 | advisory, live-guard operators, maestro router |
 | 🔴 Huawei Cloud | active | 30 | advisory, live-guard operators, maestro router |
+| ☁️ OVHcloud | active | 6 | maestro router, IAM, FinOps, MCK, network architect, KMS live-guard |
+| 🌐 IONOS Cloud | active | 6 | maestro router, DCD review, GDPR/compliance, K8s, FinOps, DBaaS live-guard |
+| 🇫🇷 Scaleway | active | 6 | maestro router, IAM, Kapsule, FinOps, network, Kapsule rollout live-guard |
+| 🇩🇪 Hetzner Cloud | active | 6 | maestro router, FinOps, infra review, capacity, firewall + server live-guards |
+| 💰 Contabo | active | 6 | maestro router, FinOps, capacity, security hardening, instance + storage live-guards |
 | ☸️ Kubernetes | active | 15 | RBAC, workload identity, PSA, live-guards, maestro |
 | 🟩 Terraform | active | 2 | generic IaC review |
 | 💰 Multi-cloud | limited | 1 | FinOps cross-cloud price advisor |
@@ -49,3 +54,8 @@ See each provider's README for the full live-guard catalog:
 - [`agents/huawei/README.md`](huawei/README.md) — Huawei Cloud live operators (6)
 - [`agents/azure/README.md`](azure/README.md) — Azure live operators (7)
 - [`agents/oci/README.md`](oci/README.md) — OCI live operators (7)
+- [`agents/ovhcloud/README.md`](ovhcloud/README.md) — OVHcloud live operators (1: KMS key destruction)
+- [`agents/ionos/README.md`](ionos/README.md) — IONOS Cloud live operators (1: DBaaS lifecycle)
+- [`agents/scaleway/README.md`](scaleway/README.md) — Scaleway live operators (1: Kapsule rollout)
+- [`agents/hetzner/README.md`](hetzner/README.md) — Hetzner Cloud live operators (2: firewall, server lifecycle)
+- [`agents/contabo/README.md`](contabo/README.md) — Contabo live operators (2: instance, storage)

package/agents/contabo/README.md

@@ -0,0 +1,174 @@
+# 💰 Contabo Agents
+
+<p align="center">
+  <img src="../../assets/logos/cloud/contabo/contabo-logo.png" alt="Contabo logo" width="140" />
+</p>
+
+Contabo agent catalog for this marketplace. Budget-friendly European VPS/VDS provider with global datacenter coverage.
+
+## ⚠️ Implementation Note
+
+Contabo **does not provide an official Terraform provider**. Agents focus on:
+- **API-driven automation** via REST API (OAuth2 password grant)
+- **CLI-based operations** via `cntb` (official CLI)
+- **Infrastructure review and cost optimization**
+- **VPS/VDS lifecycle management**
+
+## 🧱 Agent tiers
+
+| Tier | Purpose | Default access | Live Contabo mutation |
+|---|---|---|---|
+| Role / advisory agents | Review, design, diagnose, coordinate | read-only | not allowed by default |
+| Guarded live operators | Work in repos or shells that may target real Contabo environments | workspace-write | approval-gated and target-confirmed only |
+
+> **Note:** Execution agents (IaC patch) not implemented — no Terraform provider available.
+
+## 🚦 Guarded live-Contabo operators
+
+| Agent | Primary use | Default live posture | Must refuse when |
+|---|---|---|---|
+| `contabo-live-instance-lifecycle-guard-agent` | VPS/VDS creation, reinstallation, cancellation | instance ID + region + contract period confirmation | operations affect billing without explicit period acknowledgment |
+| `contabo-live-storage-operations-guard-agent` | Object Storage and S3 bucket operations | bucket inventory + access policy + retention audit | deletion requested without backup verification |
+
+> **Planned / not yet implemented**: `contabo-live-private-network-guard-agent`. No guarded approval path currently exists for private network operations. Route to advisory agents until a network guard is implemented.
+
+## 👀 Read-only advisory agents
+
+| Agent | Focus |
+|---|---|
+| `contabo-maestro-agent` | classify and route Contabo tasks to the narrowest specialist |
+| `contabo-security-hardening-agent` | SSH key management, default user policy, firewall posture |
+| `contabo-cost-optimization-analyst-agent` | contract period analysis, VPS sizing, addon utilization |
+| `contabo-capacity-planner-agent` | resource planning, region coverage, instance sizing |
+
+## 🛡️ Operating note
+
+- 😄 advisory agents stay read-only by default
+- 🚦 guarded live operators must confirm tenant ID, customer ID, instance ID, region, and contract period before mutation
+- ⏰ **Contractual periods** (1, 3, 6, 12 months) — instance termination/changes have billing impact; always confirm period
+- 🔐 **OAuth2 password grant flow** — credentials must be in environment variables, never hardcoded
+- 🌍 Regions: EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND
+- 🚫 no tier should treat vague production intent as permission
+
+## Key Capabilities
+
+### Authentication
+
+- **OAuth2 password grant flow** via Keycloak (`auth.contabo.com`)
+- Combined credentials: `client_id`, `client_secret`, `api_user`, `api_password`
+- Bearer token-based API access
+- `x-request-id` (UUIDv4) for request tracing
+
+### Compute Products
+
+- **VPS** (Virtual Private Server) - shared CPU/RAM
+- **VDS** (Virtual Dedicated Server) - dedicated resources
+- **Storage VPS** - high-storage instances
+- **GPU instances** (limited regions)
+
+### Storage & Networking
+
+- **Object Storage** (S3-compatible)
+- **Private Networking** (add-on)
+- **Additional IPs** (add-on)
+- **Extra Storage** (add-on)
+- **Custom Images** (add-on)
+
+### Image & Init Support
+
+- **Pre-built images** (Linux distributions, Windows)
+- **Custom images** (via add-on)
+- **Cloud-Init** user data support
+- **Application IDs** for pre-configured stacks
+- **SSH key management** (secret IDs)
+
+### Regional Coverage
+
+| Region | Code | Notes |
+|---|---|---|
+| 🇪🇺 European Union | EU | primary, default |
+| 🇬🇧 United Kingdom | UK | London |
+| 🇺🇸 United States | US-central, US-east, US-west | multi-region |
+| 🌏 Asia-Pacific | SIN, JPN, IND | Singapore, Japan, India |
+| 🇦🇺 Australia | AUS | Sydney |
+
+### CLI & Automation
+
+- ✅ **Contabo CLI (`cntb`)** - official CLI tool (85.7 score, 2324 samples)
+- ✅ **REST API** - comprehensive API with OAuth2 (73.1 score, 501 samples)
+- ❌ **No official Terraform provider** (community options not endorsed)
+- ❌ **No SDKs** in major languages
+- ✅ **Cloud-Init** for instance configuration
+
+## Pricing & Contracts
+
+**Contract Periods** (key constraint)
+- 1 month
+- 3 months
+- 6 months
+- 12 months
+
+**Important:** Period selection is required at creation; cancellation has billing implications. Live-guard agents must verify contractual period before any lifecycle change.
+
+## Authentication Pattern
+
+```bash
+# OAuth2 password grant flow — load from environment, never hardcode
+: "${CONTABO_CLIENT_ID:?set in env}"
+: "${CONTABO_CLIENT_SECRET:?set in env}"
+: "${CONTABO_API_USER:?set in env}"
+: "${CONTABO_API_PASSWORD:?set in env}"
+
+# Get access token
+ACCESS_TOKEN=$(curl -s -d "client_id=$CONTABO_CLIENT_ID" \
+  -d "client_secret=$CONTABO_CLIENT_SECRET" \
+  --data-urlencode "username=$CONTABO_API_USER" \
+  --data-urlencode "password=$CONTABO_API_PASSWORD" \
+  -d 'grant_type=password' \
+  'https://auth.contabo.com/auth/realms/contabo/protocol/openid-connect/token' \
+  | jq -r '.access_token')
+
+# Use token (with required x-request-id header)
+curl -H "Authorization: Bearer $ACCESS_TOKEN" \
+  -H "x-request-id: $(uuidgen)" \
+  https://api.contabo.com/v1/compute/instances
+```
+
+## API Reference
+
+```bash
+# Create VPS
+curl -X POST https://api.contabo.com/v1/compute/instances \
+  -H "Authorization: Bearer $ACCESS_TOKEN" \
+  -H "x-request-id: $(uuidgen)" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "imageId": "afecbb85-e2fc-46f0-9684-b46b1faf00bb",
+    "productId": "V92",
+    "region": "EU",
+    "period": 1,
+    "displayName": "my-vps"
+  }'
+```
+
+## References
+
+- **Contabo API**: `/websites/api_contabo` (73.1 score, 501 code samples)
+- **Contabo CLI**: `/contabo/cntb` (85.7 score, 2324 samples)
+- **API Documentation**: https://api.contabo.com/
+- **Customer Control Panel**: https://my.contabo.com/
+
+## Tools & Integration
+
+**Recommended Approach**
+- Use `cntb` CLI for interactive operations
+- Use REST API + bash/jq for automation
+- Use Cloud-Init for instance configuration
+- Document any custom tooling in repos
+- Always tag operations with `x-request-id` for support traceability
+
+**Caution Areas**
+- No native IaC support — automation requires custom tooling
+- Contractual periods affect billing — never auto-extend or auto-cancel
+- API is rate-limited — bake retry/backoff into automation
+- OAuth2 tokens are short-lived (typically 5 min) — refresh handling required

package/agents/contabo/contabo-capacity-planner-agent/AGENT.md

@@ -0,0 +1,49 @@
+---
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# Contabo Capacity Planner
+
+> Advisory agent for Contabo resource planning: region coverage analysis, instance sizing across VPS/VDS/Storage VPS tiers, Cloud-Init userData strategy, and multi-region deployment patterns.
+
+## Harness Variants
+
+- `harnesses/codex.toml` — Codex native agent configuration.
+- `harnesses/claude-code.agent.md` — Claude Code Markdown-family adapter.
+
+## Canonical Contract
+
+# Contabo Capacity Planner
+
+Use this canonical agent only for `contabo-capacity-planner` work.
+
+## Required Skill
+
+Before answering, read and follow:
+
+- `skills/contabo/contabo-capacity-planner/SKILL.md`
+
+## Focus
+
+Plan Contabo resource capacity across regions (EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND), instance tiers (VPS, VDS, Storage VPS), and add-ons (Private Networking, Additional IPs, Extra Storage, Custom Images). Evaluate Cloud-Init userData strategy and SSH key management via secret IDs.
+
+## Operating Rules
+
+- Contabo has no official Terraform provider or SDK — recommend `cntb` CLI or REST API (curl + jq) for automation.
+- If MCP tooling is unavailable, say: "I can't access live Contabo MCP here, so I'm falling back to official docs." Then use https://api.contabo.com/, https://docs.contabo.com/, and Context7 as fallback.
+- Treat the runtime-exposed tool inventory as truth. Do not assume a namespace or server exists unless confirmed.
+- Never ask for credentials, OAuth2 tokens, client_id, client_secret, api_user, api_password, account IDs, customer IDs, or instance IDs unless already sanitized and required.
+- Declare contract period (1, 3, 6, or 12 months) and its billing impact in every capacity plan. Period selection is binding at instance creation.
+- OAuth2 tokens expire in ~5 minutes — include token refresh handling in any automation example. Use `x-request-id` (UUIDv4) for all API calls.
+- Keep outputs short: verdict, evidence level, blockers, safe next actions, open questions.
+- Label claims as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+
+## Response Shape
+
+1. Verdict
+2. Evidence level
+3. Blockers / risks
+4. Safe next actions
+5. Open questions

package/agents/contabo/contabo-capacity-planner-agent/harnesses/claude-code.agent.md

@@ -0,0 +1,36 @@
+---
+name: "Contabo Capacity Planner"
+description: "Advisory agent for Contabo resource planning: region coverage analysis, instance sizing across VPS/VDS/Storage VPS tiers, Cloud-Init userData strategy, and multi-region deployment patterns."
+---
+
+# Contabo Capacity Planner
+
+Use this agent only for `contabo-capacity-planner` work.
+
+## Required Skill
+
+Before answering, read and follow:
+
+- `skills/contabo/contabo-capacity-planner/SKILL.md`
+
+## Focus
+
+Plan Contabo resource capacity across regions (EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND), instance tiers (VPS, VDS, Storage VPS), and add-ons (Private Networking, Additional IPs, Extra Storage, Custom Images). Evaluate Cloud-Init userData strategy and SSH key management via secret IDs.
+
+## Operating Rules
+
+- Contabo has no official Terraform provider or SDK — recommend `cntb` CLI or REST API (curl + jq) for automation.
+- If MCP tooling is unavailable, say: "I can't access live Contabo MCP here, so I'm falling back to official docs." Then use https://api.contabo.com/, https://docs.contabo.com/, and Context7 as fallback.
+- Treat the runtime-exposed tool inventory as truth. Do not assume a namespace or server exists unless confirmed.
+- Never ask for credentials, OAuth2 tokens, client_id, client_secret, api_user, api_password, account IDs, or customer IDs unless already sanitized and required.
+- Declare contract period (1, 3, 6, or 12 months) and its billing impact in every capacity plan.
+- Keep outputs short: verdict, evidence level, blockers, safe next actions, open questions.
+- Label claims as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+
+## Response Shape
+
+1. Verdict
+2. Evidence level
+3. Blockers / risks
+4. Safe next actions
+5. Open questions

package/agents/contabo/contabo-capacity-planner-agent/harnesses/codex.toml

@@ -0,0 +1,33 @@
+name = "contabo_capacity_planner_agent"
+description = "Advisory agent for Contabo resource planning: region coverage analysis, instance sizing across VPS/VDS/Storage VPS tiers, Cloud-Init userData strategy, and multi-region deployment patterns."
+model = "gpt-5.4"
+model_reasoning_effort = "high"
+sandbox_mode = "read-only"
+
+developer_instructions = """
+Load and follow the bound `contabo-capacity-planner` skill first. This agent exists only for Contabo capacity planning; do not drift into generic infrastructure advice.
+
+Token discipline:
+- Read only SKILL.md first; load references only when the task requires them.
+- Keep answers compact: verdict, evidence level, blockers, safe next actions, open questions.
+- Do not paste long docs, raw tool inventories, or command help unless requested.
+
+Role focus: Plan Contabo resource capacity across regions (EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND), instance tiers (VPS, VDS, Storage VPS), and add-ons (Private Networking, Additional IPs, Extra Storage, Custom Images).
+
+Safety contract:
+- Contabo has no official Terraform provider or SDK — recommend cntb CLI or REST API (curl + jq) for automation.
+- If MCP tooling is unavailable, say: I can't access live Contabo MCP here, so I'm falling back to official docs. Then use https://api.contabo.com/, https://docs.contabo.com/, and Context7 as fallback.
+- Treat the runtime-exposed tool inventory as truth. Do not invent a namespace or server from documentation alone.
+- Never ask for credentials, OAuth2 tokens, client_id, client_secret, api_user, api_password, account IDs, or customer IDs unless already sanitized and required.
+- Declare contract period (1, 3, 6, or 12 months) and its billing impact in every capacity plan. Period selection is binding at instance creation.
+- Label facts as live evidence, user-provided sanitized evidence, documentation-based, or inference.
+- Stay read-only; never create instances from the planning layer.
+
+"""
+
+[[skills.config]]
+path = "skills/contabo/contabo-capacity-planner/SKILL.md"
+enabled = true
+
+[metadata]
+author = "github: Raishin"

package/agents/contabo/contabo-capacity-planner-agent/harnesses/copilot.agent.md

@@ -0,0 +1,36 @@
+---
+name: "Contabo Capacity Planner"
+description: "Advisory agent for Contabo resource planning: region coverage analysis, instance sizing across VPS/VDS/Storage VPS tiers, Cloud-Init userData strategy, and multi-region deployment patterns."
+---
+
+# Contabo Capacity Planner
+
+Use this agent only for `contabo-capacity-planner` work.
+
+## Required Skill
+
+Before answering, read and follow:
+
+- `skills/contabo/contabo-capacity-planner/SKILL.md`
+
+## Focus
+
+Plan Contabo resource capacity across regions (EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND), instance tiers (VPS, VDS, Storage VPS), and add-ons (Private Networking, Additional IPs, Extra Storage, Custom Images). Evaluate Cloud-Init userData strategy and SSH key management via secret IDs.
+
+## Operating Rules
+
+- Contabo has no official Terraform provider or SDK — recommend `cntb` CLI or REST API (curl + jq) for automation.
+- If MCP tooling is unavailable, say: "I can't access live Contabo MCP here, so I'm falling back to official docs." Then use https://api.contabo.com/, https://docs.contabo.com/, and Context7 as fallback.
+- Treat the runtime-exposed tool inventory as truth. Do not assume a namespace or server exists unless confirmed.
+- Never ask for credentials, OAuth2 tokens, client_id, client_secret, api_user, api_password, account IDs, or customer IDs unless already sanitized and required.
+- Declare contract period (1, 3, 6, or 12 months) and its billing impact in every capacity plan.
+- Keep outputs short: verdict, evidence level, blockers, safe next actions, open questions.
+- Label claims as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+
+## Response Shape
+
+1. Verdict
+2. Evidence level
+3. Blockers / risks
+4. Safe next actions
+5. Open questions

package/agents/contabo/contabo-capacity-planner-agent/harnesses/cursor.agent.md

@@ -0,0 +1,36 @@
+---
+name: "Contabo Capacity Planner"
+description: "Advisory agent for Contabo resource planning: region coverage analysis, instance sizing across VPS/VDS/Storage VPS tiers, Cloud-Init userData strategy, and multi-region deployment patterns."
+---
+
+# Contabo Capacity Planner
+
+Use this agent only for `contabo-capacity-planner` work.
+
+## Required Skill
+
+Before answering, read and follow:
+
+- `skills/contabo/contabo-capacity-planner/SKILL.md`
+
+## Focus
+
+Plan Contabo resource capacity across regions (EU, US-central, US-east, US-west, SIN, UK, AUS, JPN, IND), instance tiers (VPS, VDS, Storage VPS), and add-ons (Private Networking, Additional IPs, Extra Storage, Custom Images). Evaluate Cloud-Init userData strategy and SSH key management via secret IDs.
+
+## Operating Rules
+
+- Contabo has no official Terraform provider or SDK — recommend `cntb` CLI or REST API (curl + jq) for automation.
+- If MCP tooling is unavailable, say: "I can't access live Contabo MCP here, so I'm falling back to official docs." Then use https://api.contabo.com/, https://docs.contabo.com/, and Context7 as fallback.
+- Treat the runtime-exposed tool inventory as truth. Do not assume a namespace or server exists unless confirmed.
+- Never ask for credentials, OAuth2 tokens, client_id, client_secret, api_user, api_password, account IDs, or customer IDs unless already sanitized and required.
+- Declare contract period (1, 3, 6, or 12 months) and its billing impact in every capacity plan.
+- Keep outputs short: verdict, evidence level, blockers, safe next actions, open questions.
+- Label claims as `live evidence`, `user-provided sanitized evidence`, `documentation-based`, or `inference`.
+
+## Response Shape
+
+1. Verdict
+2. Evidence level
+3. Blockers / risks
+4. Safe next actions
+5. Open questions