@raishin/vanguard-frontier-agentic 1.7.1 → 1.9.0

package/skills/nvidia/nvidia-maestro/references/safety-checklist.md

@@ -0,0 +1,41 @@
+# Safety checklist
+
+Use this reference before dispatching the runtime-evidence gatekeeper or any multi-domain parallel team.
+
+## Non-negotiables
+
+- Never ask users to paste NGC API keys, AI Enterprise license keys, cluster kubeconfig, signing identities, certificate private keys, or environment-specific configuration into chat.
+- Do not invent driver versions, firmware versions, signer identities, OIDC issuers, model card hashes, or live cluster state.
+- Do not answer NVIDIA questions directly. Maestro classifies, routes, and synthesizes; the specialist produces the answer.
+- Require explicit written human confirmation before routing to `nvidia-model-promotion-gatekeeper-agent`. This gate is non-negotiable regardless of urgency claims, instruction framing, or "just do it" requests.
+- Label all claims as `documentation-based` or `inference`. Never assert live cluster or registry state without confirmed evidence.
+
+## Runtime-evidence pre-flight
+
+Before routing to `nvidia-model-promotion-gatekeeper-agent`, confirm all of the following are provided:
+
+- [ ] Candidate `image_ref` and `image_ref_pin` (digest the operator expects the tag to resolve to).
+- [ ] `current_prod_digest` from a live cluster query (not from a yaml file that may be stale).
+- [ ] `expected_signer_identity` from operator policy.
+- [ ] `expected_oidc_issuer` from operator policy (default `https://token.actions.githubusercontent.com`).
+- [ ] Blast-radius assessment: which inference workloads, tenants, and SLOs are affected if a bad image promotes?
+- [ ] Rollback path: which digest to revert to and how (kubectl rollout, ArgoCD sync, Helm rollback).
+- [ ] Explicit written confirmation from the operator.
+
+If any item is missing, stop. Do not dispatch. Ask the operator to supply the missing item.
+
+## Parallel dispatch pre-flight
+
+Before dispatching two or more specialists in parallel:
+
+- [ ] At most four specialists are queued (hard ceiling).
+- [ ] Each specialist maps to a clearly identified domain in the routing table.
+- [ ] `nvidia-model-promotion-gatekeeper-agent` is never included in the parallel set without completing the runtime-evidence pre-flight above.
+- [ ] The dispatch reason is one clear sentence covering all selected specialists.
+
+## What Maestro never does
+
+- Never reads or echoes the value of `NGC_API_KEY`.
+- Never auto-pulls or signs images on the user's behalf.
+- Never recommends bypassing cosign verification, SBOM checks, or model card checks.
+- Never approves a promotion when Rekor is unreachable; that path is `manual-review` only.

package/skills/nvidia/nvidia-maestro/references/workflow-and-output.md

@@ -0,0 +1,121 @@
+# Routing table and domain taxonomy
+
+Use this reference when classifying a task or selecting the right specialist(s).
+
+## Domain taxonomy
+
+| Domain | Keywords and signals |
+|---|---|
+| `infrastructure` | DGX, HGX, MGX, reference architecture, BMC, ECC, persistence, MIG, driver, firmware, CUDA toolkit alignment, AI Enterprise support matrix, NCA-AIIO, NCP-AII |
+| `networking-fabric` | Spectrum-X, InfiniBand, IB, NCCL, RoCEv2, lossless, congestion control, east-west, AR, NDR, HDR, NCP-AIN, fabric topology |
+| `day2-ops` | DCGM, dcgm-exporter, MIG lifecycle, Xid, runbook, driver upgrade, firmware upgrade, fleet health, GPU monitoring, NCP-AIO |
+| `kubernetes` | GPU Operator, device plugin, NFD, MIG manager, time-sliced GPU, container toolkit, securityContext, namespace tenancy, multi-tenant GPU |
+| `cuda-perf` | CUDA kernel, .cu, coalescing, bank conflict, occupancy, register pressure, Nsight Compute, shared memory, stream concurrency, launch parameters |
+| `inference-trt` | TensorRT, TRT, TensorRT-LLM, ONNX, precision, calibration, INT8, FP8, FP4, dynamic shapes, plugin, engine cache |
+| `inference-triton` | Triton, model repository, dynamic batching, ensemble, custom backend, gRPC, response cache, rate limit |
+| `genai-platform` | NeMo, NIM, generative AI, model card, weights provenance, evaluation harness, guardrails, NCA-GENL, NCA-GENM, NCP-GENL |
+| `agentic-ai` | NeMo Agent Toolkit, agentic AI, NIM-as-tool, retrieval pipeline, tool-use safety, agent memory, audit log, NCP-AAI |
+| `supply-chain` | NGC, NIM container, cosign, model card provenance, weights provenance, AI Enterprise license, air-gap mirror, API key scope |
+| `runtime-evidence` | promote NIM to production, signed attestation, runtime-evidence verdict, promote / block / manual-review, image promotion gate |
+
+## Full routing table
+
+### Infrastructure (DGX / HGX / MGX)
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-ai-infrastructure-operations-agent` | infrastructure | Reviewing DGX/HGX/MGX posture against NVIDIA reference architectures and the AI Enterprise support matrix — driver/firmware/CUDA alignment, BMC segmentation, ECC, persistence, MIG posture |
+
+### Networking fabric
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-ai-networking-fabric-review-agent` | networking-fabric | Reviewing Spectrum-X / InfiniBand topology, NCCL collective tuning, RoCEv2 lossless config, congestion control, east-west isolation between training jobs |
+
+### Day-2 operations
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-ai-operations-day2-agent` | day2-ops | Reviewing DCGM exporter coverage, MIG lifecycle, Xid-signature-to-runbook mapping, and gated driver/firmware upgrade discipline |
+
+### Kubernetes (GPU Operator)
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-gpu-operator-kubernetes-hardening-agent` | kubernetes | Reviewing GPU Operator on Kubernetes — device plugin, MIG manager, NFD, time-sliced GPUs, container toolkit, securityContext, namespace tenancy |
+
+### CUDA performance
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-cuda-kernel-performance-review-agent` | cuda-perf | Doc-anchored static review of CUDA C/C++ kernels — coalescing, bank conflicts, occupancy, register pressure, stream concurrency, launch parameters |
+
+### TensorRT / TensorRT-LLM
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-tensorrt-llm-deployment-review-agent` | inference-trt | Reviewing TensorRT / TensorRT-LLM pipelines — ONNX / PyTorch export, precision selection, calibration integrity, dynamic shapes, plugin trust boundaries, engine cache provenance |
+
+### Triton inference serving
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-triton-inference-serving-review-agent` | inference-triton | Reviewing Triton deployments — model repository layout, dynamic batching, ensemble pipelines, custom backend trust, gRPC/HTTP auth, response cache, rate-limit and metrics endpoints |
+
+### Generative AI platform
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-generative-ai-platform-review-agent` | genai-platform | Reviewing NeMo training and customization, NIM inference microservices, model card and weights provenance, evaluation harness, guardrails posture |
+
+### Agentic AI platform
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-agentic-ai-platform-review-agent` | agentic-ai | Reviewing agentic-AI platforms on the NVIDIA stack — NeMo Agent Toolkit, NIM-as-tool, retrieval pipelines, tool-use safety, agent memory boundaries, audit logging |
+
+### Supply chain
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-ngc-nim-supply-chain-governor-agent` | supply-chain | Reviewing NGC org/team boundaries, API-key scope and rotation, NIM cosign verification, model card + weights provenance, AI Enterprise license posture, air-gap mirror integrity |
+
+### Runtime-evidence gate
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `nvidia-model-promotion-gatekeeper-agent` | runtime-evidence | A NIM container is moving from staging to production and you need a runtime-evidence promote / block / manual-review verdict with a cosign-signable attestation. **Requires explicit human confirmation before dispatch.** |
+
+## Dispatch examples
+
+### Single-domain
+
+> "Review our DCGM exporter coverage."
+
+```
+Route: nvidia-ai-operations-day2-agent
+Reason: pure day-2 operational posture review.
+Mode: single
+```
+
+### Multi-domain (parallel)
+
+> "We are bringing up a new DGX H200 cluster with Spectrum-X fabric and want a Day-1 review."
+
+```
+Route: nvidia-ai-infrastructure-operations-agent, nvidia-ai-networking-fabric-review-agent, nvidia-gpu-operator-kubernetes-hardening-agent
+Reason: infrastructure posture, fabric tuning, and GPU Operator hardening all in scope.
+Mode: parallel (3)
+```
+
+### Runtime-evidence gate
+
+> "Promote `nvcr.io/nim/meta/llama-3.3-70b:1.5.0` to production."
+
+```
+Route: nvidia-model-promotion-gatekeeper-agent
+Reason: runtime-evidence promotion decision with signed attestation required.
+Mode: runtime-evidence-gate
+```
+
+Before dispatching the gatekeeper, surface: candidate digest, current-prod digest, expected signer identity, expected OIDC issuer, attestation TTL, rollback path. Require explicit written confirmation from the operator. Never auto-dispatch.

package/skills/nvidia/nvidia-model-promotion-gatekeeper/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: nvidia-model-promotion-gatekeeper
+description: Use this skill when an operator is about to promote an NVIDIA NIM container from staging to production and needs a runtime-evidence go/no-go decision. The skill executes a fixed allowlist of cosign/crane/oras/grype commands against the candidate image, then emits a signed attestation JSON whose verdict is one of promote, block, or manual-review. Trigger when the user asks "is this NIM safe to promote", "verify this container before deploy", or hands the agent a `nvcr.io/...` image reference and a current-prod digest. Live tier counterpart to `nvidia-ngc-nim-supply-chain-governor` (which is static-review only).
+allowed-tools: Read Grep Glob Bash(cosign verify --certificate-identity=* --certificate-oidc-issuer=* nvcr.io/*) Bash(cosign verify-attestation --type=spdxjson nvcr.io/*) Bash(cosign verify-attestation --type=cyclonedx nvcr.io/*) Bash(cosign download attestation nvcr.io/*) Bash(crane digest nvcr.io/*) Bash(crane manifest nvcr.io/*) Bash(crane config nvcr.io/*) Bash(oras discover --format json nvcr.io/*) Bash(oras manifest fetch nvcr.io/*) Bash(grype nvcr.io/* --output json --fail-on never) Bash(grype sha256:* --output json --fail-on never)
+# Security note — cosign identity wildcard: The harness tool-allowlist uses
+# --certificate-identity=* and --certificate-oidc-issuer=* because the exact
+# NVIDIA GitHub Actions identity URL (issuer) and signer identity vary per
+# NIM image family and release pipeline. Runtime enforcement is LOAD-BEARING:
+# the evaluate() function in tests/validate-nvidia-promotion-gatekeeper.py
+# compares the identity/issuer returned by cosign against operator-supplied
+# expected_signer_identity and expected_oidc_issuer inputs; a mismatch adds
+# wrong_identity / wrong_issuer to verdict_reasons and blocks promotion.
+# Operators MUST supply non-empty expected_signer_identity / expected_oidc_issuer
+# in runtime mode; missing values trigger inputs_incomplete → manual-review.
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-11"
+  category: security
+  lifecycle: experimental
+  execution_tier: read-only-runtime
+  required_egress:
+    - nvcr.io
+    - rekor.sigstore.dev
+    - fulcio.sigstore.dev
+    - tuf-repo-cdn.sigstore.dev
+  requires_credentials:
+    - NGC_API_KEY
+  output_attestation:
+    schema: schemas/attestation.schema.json
+    signed_with: cosign-blob
+  eval_fixtures: tests/fixtures/nvidia-model-promotion-gatekeeper/
+---
+
+# NVIDIA Model Promotion Gatekeeper
+
+## Purpose
+
+Before a NIM container moves from staging to production, prove four things with **runtime evidence**, then emit a tamper-evident attestation:
+
+1. **Signature is valid and from the expected NVIDIA identity** — keyless cosign verify against the expected `--certificate-identity` and `--certificate-oidc-issuer`.
+2. **Tag has not drifted** — `crane digest` resolution matches the operator-supplied `image_ref@sha256:...` pin.
+3. **SBOM and model card are present and pinned** — SPDX or CycloneDX SBOM attestation present; model card present as a fetched OCI referrer with a recorded sha256. A documentation label alone is not enough.
+4. **No CVE regression vs current-prod** — `grype` delta against the current production digest; new critical or high CVEs block promotion.
+
+The skill never mutates: no `docker pull`, no `kubectl apply`, no registry write. It reads, verifies, and emits a JSON attestation the operator signs with `cosign sign-blob` and hands to audit.
+
+## Default mode is dry-run
+
+If the operator does not pass `--mode runtime`, the skill stays in `static` mode: it reads supplied fixture or sanitized JSON, runs the gate evaluator, but does not contact any registry or Sigstore endpoint. `evidence_level` is then `documentation-only` and `verdict` defaults to `manual-review`.
+
+`--mode runtime` opt-in is per-session, never per-skill-default. The operator must hand the skill an explicit image reference plus a current-prod digest.
+
+## Operating rules
+
+- Resolve `image_ref` → `digest` via `crane digest` first. If the operator-supplied pin (`image_ref@sha256:...`) does not match the resolved digest, emit `verdict: block` with reason `digest_drift`.
+- The signer identity and OIDC issuer to expect must be supplied as inputs (never defaulted), so a future change in NVIDIA's signing posture cannot silently be auto-accepted.
+- Treat any registry prefix other than `nvcr.io/` as `verdict: block` with reason `unknown_registry`. The allowlist regex enforces this; the skill must also assert it explicitly so the failure mode is auditable.
+- Treat a Fulcio cert with `notAfter < now` as `verdict: block` with reason `expired_cert`. A valid-looking signature on an expired cert is a replay artifact.
+- Treat missing SBOM attestation as `verdict: block` with reason `missing_sbom`. Treat a missing model-card OCI referrer, a label-only model-card reference, or a model-card record without a `sha256:...` digest as `verdict: block` with reason `missing_model_card`.
+- Treat a Grype delta showing one or more new CRITICAL or HIGH CVEs vs `current_prod_digest` as `verdict: block` with reason `cve_regression`.
+- If Rekor or Fulcio is unreachable (air-gapped or transient), do **not** auto-block. Emit `evidence_level: partial` and `verdict: manual-review` with reason `rekor_unreachable`. Air-gapped deployments must promote on operator override, not on automatic ignore.
+- The attestation must include `provenance.executed_commands` (exact argv, no env), `provenance.egress_hosts_contacted`, `provenance.runtime_mode`, and a 16+ char `nonce` whenever `runtime_mode=runtime`. Anti-replay is the operator's responsibility downstream, but the gatekeeper provides the field.
+- Never write credentials. Never echo `$NGC_API_KEY`. The attestation `provenance.executed_commands` array must scrub any flag values that resemble secrets (no equals-form value capture for `--password`, `--token`, `--auth`).
+
+## Required inputs
+
+| Field | Required | Example |
+|---|---|---|
+| `image_ref` | yes | `nvcr.io/nim/meta/llama-3.3-70b:1.5.0` |
+| `image_ref_pin` | yes (runtime mode) | `sha256:abc123...` (operator-supplied expected digest) |
+| `current_prod_digest` | yes | `sha256:def456...` |
+| `expected_signer_identity` | yes | `https://github.com/nvidia/nim-builder/.github/workflows/release.yml@refs/tags/v1.5.0` |
+| `expected_oidc_issuer` | yes | `https://token.actions.githubusercontent.com` |
+| `mode` | optional | `static` (default) \| `runtime` |
+
+## Response shape
+
+The attestation JSON is the canonical response. The agent additionally surfaces, in plain text:
+
+1. **Verdict** — `promote` \| `block` \| `manual-review`
+2. **Evidence level** — `live` \| `partial` \| `documentation-only`
+3. **Top reasons** — verbatim from `verdict_reasons[]`
+4. **Next action** — `cosign sign-blob --bundle attestation.bundle attestation.json` for `promote`; remediation hints for `block`; explicit operator decision request for `manual-review`
+5. **Attestation path** — where the JSON was written
+
+## References
+
+- `references/allowlist-commands.md` — exact argv catalog with rationale per command
+- `references/attestation-format.md` — attestation schema walk-through with a worked example

package/skills/nvidia/nvidia-model-promotion-gatekeeper/metadata.json

@@ -0,0 +1,30 @@
+{
+  "id": "nvidia-model-promotion-gatekeeper",
+  "name": "NVIDIA Model Promotion Gatekeeper",
+  "type": "skill",
+  "provider": "nvidia",
+  "harnesses": [
+    "claude-code",
+    "cursor"
+  ],
+  "summary": "Runtime-evidence go/no-go gate for promoting an NVIDIA NIM container from staging to production. Verifies cosign signature against expected NVIDIA identity, asserts tag-to-digest pin, asserts SBOM and model card presence, computes CVE delta vs current-prod, and emits a cosign-signable attestation JSON.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.nvidia.com/nim/",
+    "https://docs.nvidia.com/ai-enterprise/",
+    "https://docs.sigstore.dev/cosign/verifying/verify/",
+    "https://docs.sigstore.dev/cosign/key_management/",
+    "https://github.com/google/go-containerregistry/tree/main/cmd/crane",
+    "https://oras.land/docs/category/oras-commands",
+    "https://github.com/anchore/grype"
+  ],
+  "security_notes": "Live-execution skill. Allowlist locks every Bash invocation to nvcr.io/* targets and to a fixed argv shape (no shell metacharacters). Egress restricted to nvcr.io and Sigstore endpoints (rekor, fulcio, tuf). Reads $NGC_API_KEY from environment but never echoes it; attestation provenance scrubs --password/--token/--auth flag values. Default mode is static (no egress); runtime mode is per-session opt-in. Rekor unreachable degrades to manual-review rather than auto-pass to prevent quiet bypass in air-gapped environments. Skill is read-only — no docker pull, no kubectl, no registry write.",
+  "last_verified": "2026-05-11",
+  "path": "skills/nvidia/nvidia-model-promotion-gatekeeper/",
+  "category": "security",
+  "lifecycle": "experimental",
+  "execution_tier": "read-only-runtime",
+  "certifications": [],
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/nvidia/nvidia-model-promotion-gatekeeper/references/allowlist-commands.md

@@ -0,0 +1,44 @@
+# Allowlist commands — exact argv and rationale
+
+Every Bash invocation the gatekeeper makes must match one of these patterns. The Claude Code `allowed-tools` field encodes the same allowlist. Anything outside this list is denied at the harness layer.
+
+## Signature verification
+
+### `cosign verify --certificate-identity=<id> --certificate-oidc-issuer=<issuer> <image>`
+Keyless verification against an expected signer identity and OIDC issuer. Both flags are mandatory — never call `cosign verify` without them in runtime mode. Without `--certificate-identity` and `--certificate-oidc-issuer`, cosign accepts any valid Sigstore signature, which defeats the gate.
+
+### `cosign verify-attestation --type=spdxjson <image>` and `--type=cyclonedx <image>`
+Asserts the presence and integrity of an SBOM attestation in SPDX-JSON or CycloneDX form. The gatekeeper accepts either format. Missing SBOM → `block` with reason `missing_sbom`.
+
+### `cosign download attestation <image>`
+Fetches the raw attestation envelope so the gatekeeper can hash it into the output `claims.sbom.sha256` field. This is the artifact audit downstream-verifies independently.
+
+## Digest pinning
+
+### `crane digest <image>`
+Resolves a tag like `nvcr.io/nim/meta/llama-3.3-70b:1.5.0` to its current `sha256:...`. The result is compared against the operator-supplied `image_ref_pin`. Mismatch → `block` with reason `digest_drift`. This is the primary defense against tag mutability between staging-time and promote-time.
+
+### `crane manifest <image>` and `crane config <image>`
+Reads the OCI manifest and image config for diagnostic context only. The `org.opencontainers.image.documentation` label is not accepted as the model-card proof because it is only a pointer, not a fetched, hashed artifact.
+
+## Model card and referrers
+
+### `oras discover --format json <image>`
+Lists OCI referrers attached to the image manifest. The gatekeeper looks for a referrer with `artifactType: application/vnd.nvidia.model-card+json` (or the equivalent NVIDIA-published media type). Missing referrer, label-only reference, or missing referrer sha256 → `block` with reason `missing_model_card`.
+
+### `oras manifest fetch <image>`
+Fetches a specific referrer manifest by digest so the gatekeeper can compute and record the model-card sha256.
+
+## CVE delta
+
+### `grype <image> --output json --fail-on never` and `grype sha256:<digest> --output json --fail-on never`
+Scans the candidate image and the current-prod digest. The gatekeeper computes the delta (`new_critical`, `new_high`, `fixed_critical`). `--fail-on never` is mandatory: the gatekeeper makes the verdict, not Grype. New critical or high CVEs → `block` with reason `cve_regression`.
+
+## Forbidden
+
+- `docker pull` — would mutate local image cache.
+- `kubectl apply` — would mutate cluster state. The gatekeeper is read-only.
+- `cosign sign` / `cosign sign-blob` — signing is the **operator's** action after they accept the verdict, not the agent's.
+- `curl`, `wget`, `git push` — out of allowlist; egress is via cosign/crane/oras only so the egress hosts are knowable up front.
+- Any command containing `|`, `;`, `&`, `$()`, backticks, or redirections — argv allowlist enforcement at the harness layer rejects shell metacharacters.
+- Any registry prefix other than `nvcr.io/` — explicit `block` verdict, recorded reason `unknown_registry`.

package/skills/nvidia/nvidia-model-promotion-gatekeeper/references/attestation-format.md

@@ -0,0 +1,84 @@
+# Attestation format — walk-through
+
+The gatekeeper emits a JSON document conforming to `schemas/attestation.schema.json`. The operator signs the file with `cosign sign-blob --bundle attestation.bundle attestation.json` and hands the bundle to audit.
+
+## Worked example (verdict: promote)
+
+```json
+{
+  "attestation_version": "1.0.0",
+  "agent": {
+    "id": "nvidia-model-promotion-gatekeeper-agent",
+    "version": "0.1.0",
+    "execution_tier": "read-only-runtime"
+  },
+  "subject": {
+    "image_ref": "nvcr.io/nim/meta/llama-3.3-70b:1.5.0",
+    "resolved_digest": "sha256:5f5fbd7a6e9b0c3a2e1d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8a7f",
+    "registry": "nvcr.io",
+    "current_prod_digest": "sha256:9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b"
+  },
+  "claims": {
+    "signature": {
+      "verified": true,
+      "signer_identity": "https://github.com/nvidia/nim-builder/.github/workflows/release.yml@refs/tags/v1.5.0",
+      "issuer": "https://token.actions.githubusercontent.com",
+      "cert_not_after": "2027-01-15T00:00:00Z",
+      "rekor_log_index": 134567890
+    },
+    "sbom": {
+      "present": true,
+      "format": "spdx",
+      "sha256": "sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b"
+    },
+    "model_card": {
+      "present": true,
+      "sha256": "sha256:0f1e2d3c4b5a6978a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1",
+      "source": "oci-referrer"
+    },
+    "cve_delta": {
+      "vs_digest": "sha256:9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b",
+      "new_critical": 0,
+      "new_high": 0,
+      "fixed_critical": 2,
+      "regressed": false
+    }
+  },
+  "evidence_level": "live",
+  "verdict": "promote",
+  "verdict_reasons": ["all_gates_passed"],
+  "provenance": {
+    "executed_commands": [
+      "crane digest nvcr.io/nim/meta/llama-3.3-70b:1.5.0",
+      "cosign verify --certificate-identity=https://github.com/nvidia/nim-builder/.github/workflows/release.yml@refs/tags/v1.5.0 --certificate-oidc-issuer=https://token.actions.githubusercontent.com nvcr.io/nim/meta/llama-3.3-70b@sha256:5f5fbd7a...",
+      "cosign verify-attestation --type=spdxjson nvcr.io/nim/meta/llama-3.3-70b@sha256:5f5fbd7a...",
+      "oras discover --format json nvcr.io/nim/meta/llama-3.3-70b@sha256:5f5fbd7a...",
+      "grype nvcr.io/nim/meta/llama-3.3-70b@sha256:5f5fbd7a... --output json --fail-on never",
+      "grype sha256:9a8b7c6d... --output json --fail-on never"
+    ],
+    "egress_hosts_contacted": ["nvcr.io", "rekor.sigstore.dev", "fulcio.sigstore.dev"],
+    "runtime_mode": "runtime",
+    "harness": "claude-code",
+    "operator": "alice@example.com"
+  },
+  "timestamp": "2026-05-11T10:42:17Z",
+  "nonce": "5b3f7a91c2d8e4f60a1b2c3d4e5f6a7b",
+  "expires_at": "2026-05-12T10:42:17Z"
+}
+```
+
+## Field rules
+
+- `verdict` is one of `promote | block | manual-review`. Never any other value.
+- `verdict_reasons[]` enumerates every reason — if `verdict=block` due to both `digest_drift` and `cve_regression`, both are listed.
+- `evidence_level: live` requires runtime mode plus successful Sigstore reach. Sigstore unreachable → `partial`. Static-mode replay → `documentation-only`.
+- `nonce` is required when `runtime_mode=runtime`. 16+ characters, operator-controlled, included so the attestation is non-replayable downstream.
+- `expires_at` is operator policy — default 24h. Audit may reject attestations older than this on intake.
+- `provenance.executed_commands[]` is the exact argv string, but with any flag value matching `(?i)(--password|--token|--auth)=\S+` rewritten to `--<flag>=<REDACTED>`.
+
+## Audit verification flow
+
+1. `cosign verify-blob --bundle attestation.bundle attestation.json` — proves the operator signed it.
+2. Schema-validate against `schemas/attestation.schema.json`.
+3. Re-resolve `subject.image_ref` and confirm `subject.resolved_digest` still matches (catches post-attestation tag mutation).
+4. Confirm `timestamp` is within `expires_at` window and `nonce` has not been seen before.

package/skills/nvidia/nvidia-ngc-nim-supply-chain-governor/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: nvidia-ngc-nim-supply-chain-governor
+description: Use this skill when reviewing NVIDIA NGC and NIM supply chain posture — NGC org and team boundaries, API key scope and rotation, NIM container cosign verification against NVIDIA's published identity, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity. Trigger when the user asks whether NIM images are verified before deployment, whether NGC keys are scoped per environment, or whether the deployment is procurement-defensible for a regulated tenant.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: security
+---
+
+# NVIDIA NGC and NIM Supply Chain Governor
+
+## Purpose
+
+Review supply chain posture for NGC (NVIDIA GPU Cloud) registry consumption and NIM (NVIDIA Inference Microservices) deployment: NGC org/team boundaries, API key scope and rotation, NIM container signature verification, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity for sovereign deployments.
+
+> **Static review only.** This skill reads configuration and emits findings. It does not execute `cosign verify` or contact registries. For a runtime-evidence go/no-go decision on a single candidate NIM image moving staging → production, route to the live-tier counterpart `nvidia-model-promotion-gatekeeper`, which executes an allowlisted set of cosign/crane/oras/grype commands and emits a cosign-signable attestation JSON.
+
+## Lean operating rules
+
+- Prefer live evidence (`cosign verify nvcr.io/nim/...`, NGC org/team listings, key creation timestamps and scopes, AI Enterprise license metadata, mirror manifest digests) when the active client exposes it; otherwise fall back to NVIDIA NGC and NIM documentation and sanitized configuration.
+- Separate confirmed facts from inference. If image signature verification, key scope, or mirror integrity was not directly queried, say so.
+- Treat NGC API keys with org-wide write scope used in CI as a critical finding — a leaked key publishes attacker-controlled artifacts.
+- Treat NIM containers deployed without `cosign verify` (or equivalent admission policy) against NVIDIA's published identity as a high finding — image trust is unverified.
+- Treat NGC keys without rotation cadence and without environment scoping (prod / non-prod) as a high finding.
+- Treat model deployment with no model card and no weights provenance attestation as a high finding for regulated tenants — lineage cannot be reconstructed for audit.
+- Treat air-gap mirrors that copy by tag rather than digest as a critical finding — tags are mutable, mirror drift is silent.
+- Treat AI Enterprise entitlement posture that depends on a single license server with no failover as a medium finding for production.
+- Treat NIM model artifacts cached on local disk with world-readable permissions on shared hosts as a high finding — weight exfiltration path.
+
+## Response minimum
+
+Return, at minimum:
+- the scoped target (NGC org/team, NIM image set, AI Enterprise license set) and evidence level,
+- NGC key scope and rotation posture,
+- NIM signature verification posture,
+- model card / weights provenance posture,
+- air-gap mirror integrity posture (digest-pinned vs tag-pinned),
+- AI Enterprise entitlement posture,
+- safe next actions and assumptions or blockers.

package/skills/nvidia/nvidia-ngc-nim-supply-chain-governor/metadata.json

@@ -0,0 +1,32 @@
+{
+  "id": "nvidia-ngc-nim-supply-chain-governor",
+  "name": "NVIDIA NGC and NIM Supply Chain Governor",
+  "type": "skill",
+  "provider": "nvidia",
+  "harnesses": [
+    "codex",
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
+  ],
+  "summary": "Review NGC and NIM supply chain posture \u2014 NGC org/team boundaries, API key scope and rotation, NIM container cosign verification, model card and weights provenance, AI Enterprise license posture, and air-gap mirror integrity.",
+  "source_type": "original",
+  "official_docs": [
+    "https://www.nvidia.com/en-us/learn/certification/",
+    "https://docs.nvidia.com/ai-enterprise/",
+    "https://docs.nvidia.com/datacenter/cloud-native/gpu-operator/latest/",
+    "https://docs.nvidia.com/nim/",
+    "https://docs.nvidia.com/dcgm/",
+    "https://docs.nvidia.com/networking/",
+    "https://docs.nvidia.com/nemo-framework/"
+  ],
+  "security_notes": "NGC keys with org-wide write scope are publish-anywhere primitives if leaked. Air-gap mirrors copying by tag rather than digest drift silently. NIM model artifacts world-readable on shared hosts are a weight exfiltration path.",
+  "last_verified": "2026-05-10",
+  "path": "skills/nvidia/nvidia-ngc-nim-supply-chain-governor/",
+  "category": "security",
+  "certifications": [],
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/nvidia/nvidia-tensorrt-llm-deployment-review/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: nvidia-tensorrt-llm-deployment-review
+description: Use this skill when reviewing TensorRT or TensorRT-LLM deployment artifacts statically — ONNX/PyTorch export pipelines, precision selection (FP16/BF16/INT8/FP8/INT4), calibration cache integrity, dynamic shape profiles, custom plugin loading, engine cache and serialized engine provenance, runtime memory pool sizing. Trigger when the user asks whether a TensorRT build script, calibration pipeline, or trtexec invocation follows NVIDIA's published guidance.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: platform
+---
+
+# NVIDIA TensorRT-LLM Deployment Review
+
+## Purpose
+
+Static review of TensorRT and TensorRT-LLM deployment pipelines against NVIDIA's TensorRT Developer Guide — ONNX/PyTorch export, FP16/INT8/FP8/INT4 precision, calibration data integrity, dynamic shape profiles, plugin trust boundaries, engine cache provenance. This skill is doc-anchored: it grounds review findings in NVIDIA's published documentation rather than in a certification blueprint, because no NVIDIA certification currently covers this developer-facing surface as a standalone exam objective.
+
+## Lean operating rules
+
+- Prefer the user's actual TensorRT build scripts, ONNX export code, and calibration pipelines as evidence; otherwise fall back to documentation-based inference.
+- Treat custom TensorRT plugins loaded from non-pinned sources or unsigned object files as a critical finding — native-code execution surface inside the inference engine.
+- Treat serialized engines (`.engine`, `.plan`) distributed without sha256 verification or provenance attestation as a high finding — silent model substitution.
+- Treat INT8 / FP8 calibration data containing production user traffic without redaction or retention controls as a high finding — confidentiality and PII surface.
+- Treat absence of `optimization_profiles` for variable input shapes as a medium finding — builds either fail at runtime or fall back to padded inference.
+- Treat hardcoded `--workspace` or `--memory-pool-size` values that exceed the deployment GPU's free memory as a medium finding — engine build will OOM in CI.
+- Treat use of `--strict-types` without explicit precision tagging on every layer as a low finding — actual precision drifts from intent.
+- Always emit the exact `trtexec`, `polygraphy run`, or `tensorrt_llm/build.py` commands the user should run — do not execute them.
+
+## Response minimum
+
+Return, at minimum:
+- the scoped target (model source and export pipeline, precision selection and calibration posture, dynamic shape and profile posture, plugin and engine provenance posture, runtime memory and concurrency posture, recommended trtexec/polygraphy invocations) and evidence level,
+- findings labelled critical / high / medium / low,
+- recommended NVIDIA-tooling invocations the user should run themselves,
+- safe next actions and assumptions or blockers.

package/skills/nvidia/nvidia-tensorrt-llm-deployment-review/metadata.json

@@ -0,0 +1,30 @@
+{
+  "id": "nvidia-tensorrt-llm-deployment-review",
+  "name": "NVIDIA TensorRT-LLM Deployment Review",
+  "type": "skill",
+  "provider": "nvidia",
+  "harnesses": [
+    "codex",
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
+  ],
+  "summary": "Doc-anchored static review of TensorRT and TensorRT-LLM deployment pipelines against the NVIDIA TensorRT Developer Guide and TensorRT-LLM documentation — ONNX/PyTorch export, precision selection, calibration integrity, dynamic shapes, plugin trust boundaries, engine cache provenance.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.nvidia.com/deeplearning/tensorrt/developer-guide/",
+    "https://docs.nvidia.com/deeplearning/tensorrt/quick-start-guide/",
+    "https://docs.nvidia.com/deeplearning/tensorrt/best-practices/",
+    "https://docs.nvidia.com/deeplearning/tensorrt-llm/",
+    "https://docs.nvidia.com/deeplearning/tensorrt/api/"
+  ],
+  "security_notes": "TensorRT custom plugins load arbitrary native code into the inference process; any plugin pulled from a non-vetted source is an RCE primitive. Serialized TensorRT engines (`.engine`, `.plan`) are not signed by default — silent substitution of an engine yields silent model substitution. INT8 calibration data is unredacted production traffic by definition and is a confidentiality risk if it leaks. The skill never executes `trtexec`, `polygraphy`, or `tensorrt_llm/build.py` — it outputs the recommended invocation as text.",
+  "last_verified": "2026-05-10",
+  "path": "skills/nvidia/nvidia-tensorrt-llm-deployment-review/",
+  "category": "platform",
+  "certifications": [],
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/nvidia/nvidia-triton-inference-serving-review/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: nvidia-triton-inference-serving-review
+description: Use this skill when reviewing Triton Inference Server deployments statically — `model_repository/` layout and `config.pbtxt` files, dynamic batching configuration, ensemble and BLS pipelines, custom backend (Python, C++, ONNX, OpenVINO, vLLM) trust posture, gRPC and HTTP endpoint authentication, response cache configuration, rate-limit and metrics exposure. Trigger when the user asks whether a Triton model repository or `tritonserver` invocation follows NVIDIA's published guidance and security expectations.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-10"
+  category: platform
+---
+
+# NVIDIA Triton Inference Server Review
+
+## Purpose
+
+Static review of Triton Inference Server deployments against NVIDIA's Triton documentation — model repository layout, dynamic batching, ensemble pipelines, custom backend trust, gRPC/HTTP authentication, model encryption at rest, response cache poisoning surface. This skill is doc-anchored: it grounds review findings in NVIDIA's published documentation rather than in a certification blueprint, because no NVIDIA certification currently covers this developer-facing surface as a standalone exam objective.
+
+## Lean operating rules
+
+- Prefer the user's actual `model_repository/` tree and `config.pbtxt` files as evidence; otherwise fall back to documentation-based inference.
+- Treat custom Python or C++ backends loaded from non-pinned sources or without code review as a critical finding — in-process RCE.
+- Treat gRPC or HTTP endpoints exposed without authentication, mTLS, or a restricted-protocol gateway as a critical finding for multi-tenant deployments.
+- Treat model repository directories with world-writable permissions or a writable `--model-repository` mount as a high finding — silent model substitution.
+- Treat response caching enabled across tenants without per-request cache-key partitioning as a high finding — cross-tenant cache poisoning.
+- Treat ensemble or BLS pipelines that pass user-supplied tensors directly to a Python backend without input validation as a medium finding — deserialization surface.
+- Treat metrics endpoints (`:8002`) exposed to the public network without scraping ACLs as a medium finding — model name and shape leakage.
+- Treat dynamic batching `max_queue_delay_microseconds` left at default with latency SLOs in the millisecond range as a low finding — throughput-vs-latency tuning is wrong by default.
+- Always emit the exact `tritonserver` and `perf_analyzer` commands the user should run — do not execute them.
+
+## Response minimum
+
+Return, at minimum:
+- the scoped target (model repository layout and provenance, backend trust posture, endpoint and auth posture, batching and ensemble posture, response cache and metrics posture, recommended tritonserver/perf_analyzer invocations) and evidence level,
+- findings labelled critical / high / medium / low,
+- recommended NVIDIA-tooling invocations the user should run themselves,
+- safe next actions and assumptions or blockers.

package/skills/nvidia/nvidia-triton-inference-serving-review/metadata.json

@@ -0,0 +1,30 @@
+{
+  "id": "nvidia-triton-inference-serving-review",
+  "name": "NVIDIA Triton Inference Server Review",
+  "type": "skill",
+  "provider": "nvidia",
+  "harnesses": [
+    "codex",
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
+  ],
+  "summary": "Doc-anchored static review of Triton Inference Server deployments against the NVIDIA Triton Inference Server documentation — model repository layout, dynamic batching, ensemble pipelines, custom backend trust, gRPC/HTTP auth, response cache, rate-limit and metrics endpoints.",
+  "source_type": "original",
+  "official_docs": [
+    "https://docs.nvidia.com/deeplearning/triton-inference-server/user-guide/docs/",
+    "https://docs.nvidia.com/deeplearning/triton-inference-server/user-guide/docs/user_guide/model_configuration.html",
+    "https://docs.nvidia.com/deeplearning/triton-inference-server/user-guide/docs/customization_guide/build.html",
+    "https://github.com/triton-inference-server/server/blob/main/docs/customization_guide/inference_protocols.md",
+    "https://github.com/triton-inference-server/server/blob/main/docs/user_guide/architecture.md"
+  ],
+  "security_notes": "Triton custom Python and C++ backends execute arbitrary code in the server process — any backend pulled from a non-vetted source is an RCE primitive. Default gRPC and HTTP endpoints are anonymous; auth is the operator's responsibility via reverse-proxy or `--grpc-restricted-protocol`. Model files in `model_repository/` are unsigned at rest. The response cache, when enabled, can be poisoned across tenants if requests are not partitioned. The skill never starts `tritonserver` or sends inference requests — it outputs `tritonserver` and `perf_analyzer` invocations as text.",
+  "last_verified": "2026-05-10",
+  "path": "skills/nvidia/nvidia-triton-inference-serving-review/",
+  "category": "platform",
+  "certifications": [],
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}