@raishin/vanguard-frontier-agentic 1.7.1 → 1.9.0

package/README.md

@@ -55,29 +55,217 @@ and compliance-heavy architecture.
 *and any other coding agent.*
 
 > 📦 **Available on npm:** `@raishin/vanguard-frontier-agentic` is published on the public npm registry.
+>
+> ⚠️ **ALPHA FINOPS BUNDLE**: As of v1.8.0, this package includes 4 new experimental FinOps agents and 7 skills for cloud cost optimization, AI economics modeling, Kubernetes rightsizing, and FOCUS-spec normalization. All are marked `lifecycle: experimental`. [See the board readiness memo](docs/strategy/finops-maestro-board-memo.md) for known limitations, risk mitigation, and 30-day diligence closure requirements. Use at your own risk in pre-production environments. Production deployment requires signed design-partner SOWs, Big 4 accounting validation, and SOC 2 Type II observation (≥150 days).
 
 ---
 
 ## 🚀 Get Started
 
+Pick the install path for your coding agent. Each dropdown is one-click plug-and-play where the harness supports it; the npm/export path works for everything else.
+
+<details>
+<summary><strong>🤖 Claude Code (Anthropic)</strong> &nbsp;—&nbsp; <em>one-command plugin install</em></summary>
+
+<br>
+
+```bash
+/plugin marketplace add Raishin/vanguard-frontier-agentic
+/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic
+```
+
+Or wire it into `~/.claude/settings.json` (or your project's `.claude/settings.json`) for team-wide trust:
+
+```json
+{
+  "extraKnownMarketplaces": {
+    "vanguard-frontier-agentic": {
+      "source": { "source": "github", "repo": "Raishin/vanguard-frontier-agentic" }
+    }
+  },
+  "enabledPlugins": {
+    "vanguard-frontier-agentic@vanguard-frontier-agentic": true
+  }
+}
+```
+
+Pin to a tag for reproducible installs: `Raishin/vanguard-frontier-agentic@v1.7.1`.
+
+- **Bundled:** all 331 cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
+- **Spec:** [`.claude-plugin/marketplace.json`](.claude-plugin/marketplace.json) + [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) (canonical Claude Code plugin layout)
+- **Not bundled:** skills, rules, MCP references — use the npm path for those
+- **Docs:** [code.claude.com/docs/en/plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces)
+
+</details>
+
+<details>
+<summary><strong>🐙 GitHub Copilot CLI</strong> &nbsp;—&nbsp; <em>one-command marketplace install</em></summary>
+
+<br>
+
+```bash
+# Add the marketplace, then install
+copilot plugin marketplace add Raishin/vanguard-frontier-agentic
+/plugin install vanguard-frontier-agentic
+```
+
+Or in `.github/copilot/settings.json` for repo-wide trust:
+
+```json
+{
+  "extraKnownMarketplaces": [
+    "https://raw.githubusercontent.com/Raishin/vanguard-frontier-agentic/master/.github/plugin/marketplace.json"
+  ]
+}
+```
+
+- **Marketplace manifest:** [`.github/plugin/marketplace.json`](.github/plugin/marketplace.json) declares this repo as a single-plugin marketplace
+- **Source path:** `./` (the repo root is the plugin root)
+- **Bundled:** 331 Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
+- **Docs:** [github.com/github/copilot-cli](https://github.com/github/copilot-cli) (`/plugin marketplace add`)
+
+</details>
+
+<details>
+<summary><strong>🖱️ Cursor</strong> &nbsp;—&nbsp; <em>plugin manifest at repo root</em></summary>
+
+<br>
+
+```bash
+# Clone the repo, then register it as a plugin directory in Cursor:
+git clone https://github.com/Raishin/vanguard-frontier-agentic
+```
+
+In Cursor: **Settings → Plugins → Add Plugin Directory** → pick the cloned repo path. Or via the Cursor Extension API:
+
+```ts
+vscode.cursor.plugins.registerPath("/absolute/path/to/vanguard-frontier-agentic");
+```
+
+- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **331 Cursor agent adapters** explicitly via the `agents` field
+- **Bundled:** all agents from `agents/<provider>/<agent>/harnesses/cursor.agent.md`
+- **Rules:** existing `rules/` directory at repo root is auto-discovered by Cursor
+- **Docs:** [cursor.com/docs/plugins](https://cursor.com/docs/plugins) · [cursor.com/docs/reference/plugins](https://cursor.com/docs/reference/plugins)
+
+</details>
+
+<details>
+<summary><strong>🔮 Kiro (Powers + agents)</strong> &nbsp;—&nbsp; <em>14 ready-to-add Powers</em></summary>
+
+<br>
+
+Kiro Powers UI is per-Power directory add — there is no single-command marketplace flow. This repo ships **14 Powers** under `powers/`, one per provider, so Kiro users can add only what they need.
+
+```bash
+# 1. Clone this repo
+git clone https://github.com/Raishin/vanguard-frontier-agentic
+cd vanguard-frontier-agentic
+
+# 2. In Kiro:
+#    Open the Powers panel → "Add Custom Power" → "Local Directory"
+#    Paste the absolute path to the Power(s) you need, one at a time:
+#       /absolute/path/to/vanguard-frontier-agentic/powers/vanguard-aws
+#       /absolute/path/to/vanguard-frontier-agentic/powers/vanguard-kubernetes
+#       /absolute/path/to/vanguard-frontier-agentic/powers/vanguard-terraform
+```
+
+- **Powers available:** `vanguard-aws`, `vanguard-azure`, `vanguard-gcp`, `vanguard-oci`, `vanguard-alibaba`, `vanguard-huawei`, `vanguard-ovhcloud`, `vanguard-scaleway`, `vanguard-hetzner`, `vanguard-contabo`, `vanguard-ionos`, `vanguard-kubernetes`, `vanguard-terraform`, `vanguard-nvidia`
+- **Each Power ships:** routing pattern (maestro entry), live-mutation discipline, provider invariants (account-ID/region, MLPS 2.0, EU sovereignty, etc.)
+- **Frontmatter:** strict-5 fields (`name`, `displayName`, `description`, `keywords`, `author`) per Kiro spec
+- **For Kiro agent adapter files** (`.kiro/agents/*.md`, `.kiro/agents/*.json`): use the npm-export path below
+- **Docs:** [github.com/kirodotdev/powers](https://github.com/kirodotdev/powers)
+
+</details>
+
+<details>
+<summary><strong>♊ Gemini CLI &amp; Google Antigravity</strong> &nbsp;—&nbsp; <em>skills framework via npm export</em></summary>
+
+<br>
+
+Antigravity reads skills from `.agent/skills/<name>/SKILL.md` (workspace) or `~/.gemini/antigravity/skills/<name>/` (global). There is no first-party marketplace install command — use the npm export to write skills + adapters into the right paths:
+
+```bash
+# Install the package
+npm install @raishin/vanguard-frontier-agentic@latest
+
+# Export agents + companion skills for Gemini Antigravity
+npx vfa-export-agents --platform gemini --all --repo .
+```
+
+Or for a single provider:
+
+```bash
+npx vfa-export-agents --platform gemini --provider aws --repo .
+```
+
+- **Workspace skills install to:** `.agent/skills/<name>/SKILL.md`
+- **Global rules:** `~/.gemini/GEMINI.md`
+- **MCP servers:** configure via Antigravity's MCP Store UI → `mcp_config.json`
+- **Docs:** [antigravity.google](https://antigravity.google) · [github.com/google-gemini/gemini-cli](https://github.com/google-gemini/gemini-cli)
+
+</details>
+
+<details>
+<summary><strong>⚡ Codex (OpenAI)</strong> &nbsp;—&nbsp; <em>one-command marketplace install</em></summary>
+
+<br>
+
+```bash
+# Add the marketplace, then enable the bundled plugin
+codex plugin marketplace add Raishin/vanguard-frontier-agentic
+/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic
+```
+
+`codex plugin marketplace add` writes the marketplace into your `~/.codex/config.toml`. The resulting block looks like this (the screenshot pattern):
+
+```toml
+[marketplaces.vanguard-frontier-agentic]
+last_updated = "2026-05-11T06:46:00Z"
+last_revision = "<sha>"
+source_type = "git"
+source = "https://github.com/Raishin/vanguard-frontier-agentic.git"
+
+[plugins."vanguard-frontier-agentic@vanguard-frontier-agentic"]
+enabled = true
+```
+
+- **Marketplace registry:** [`.agents/plugins/marketplace.json`](.agents/plugins/marketplace.json) at repo root (canonical Codex location per [codex-rs plugin-json-spec](https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md))
+- **Bundled plugins:**
+  - `vanguard-frontier-agentic` — the main plugin, manifest at [`plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json`](plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json)
+  - `cross-platform-agent-template` — scaffold for new cross-platform agents
+- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the 331 agent adapters into your repo
+- **Other commands:** `codex plugin marketplace upgrade vanguard-frontier-agentic`, `codex plugin marketplace remove vanguard-frontier-agentic`
+- **Docs:** [github.com/openai/codex](https://github.com/openai/codex) · [Codex plugin spec](https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md)
+
+</details>
+
+<details>
+<summary><strong>📦 Any other harness</strong> &nbsp;—&nbsp; <em>npm package + vfa-export-agents CLI</em></summary>
+
+<br>
+
 **Prerequisite:** [Node.js](https://nodejs.org/) 18+
 
 ```bash
 # 1️⃣ Install the package
 npm install @raishin/vanguard-frontier-agentic@latest
 
-# 2️⃣ Export agents for your job role into your repo
+# 2️⃣ Export agents for your role into your repo (claude-code shown — swap platform)
 npx vfa-export-agents --platform claude-code --role cloud-security-engineer --repo .
 
 # 3️⃣ Open your coding agent and reference the exported agent
 #    "Use kubernetes-rbac-review-agent to audit this RBAC change."
 ```
 
-**🗺️ Not sure which role or agent you need?** Jump to the [Install Reference](#install-reference) for the full map.
+Supports `--platform`: `claude-code`, `codex`, `copilot`, `cursor`, `gemini`, `kiro`, `kiro-ide`, `kiro-cli`. Supports `--role`, `--agents`, `--all`, `--provider` filters. See the [Install Reference](#install-reference) for the full argument matrix.
+
+</details>
+
+---
 
 ### Install paths
 
-There are three supported install paths — npm package, `vfa-export-agents` CLI, and the third-party `skills` CLI — each with different versioning, trust, and scope characteristics. See [`docs/integrations/skills-cli.md`](docs/integrations/skills-cli.md) for the full trust matrix, verified flag syntax, pinning guidance, and pre-install inspection steps.
+There are now **eight** supported install paths — Claude Code plugin marketplace, GitHub Copilot CLI marketplace, Cursor plugin, Codex plugin marketplace, Kiro Powers, Gemini Antigravity skills, npm package + `vfa-export-agents` CLI, and the third-party `skills` CLI — each with different versioning, trust, and scope characteristics. See [`docs/integrations/skills-cli.md`](docs/integrations/skills-cli.md) for the full trust matrix, verified flag syntax, pinning guidance, and pre-install inspection steps.
 
 ```bash
 npm install @raishin/vanguard-frontier-agentic@latest
@@ -769,3 +957,113 @@ Rules   = always-on        📏   harness-specific operating guidance
 MCP     = real connections 🔌   AWS · Azure · Oracle official servers
 Catalog = searchable index 🗂️   machine-readable, hash-verified
 ```
+
+---
+
+## ❤️ Sponsors
+
+### Why Sponsor
+
+Vanguard Frontier Agentic is a free, open-source marketplace of AI skills and agents for cloud operators — built on 70+ certifications across providers and 3 years of real enterprise architecture work across AWS, Azure, and OCI.
+
+**No VC funding. No company backing. One engineer, building in public.**
+
+In two weeks on npm: ~900 downloads. Socket.dev scores: Vulnerability 100, Quality 100, License 100. Every release ships through 17 validation gates, adversarial security audits, and property-based fuzz tests.
+
+Your sponsorship directly funds the compute, API time, and research hours that turn new cloud providers, compliance frameworks, and security patterns into production-ready agents — free for everyone.
+
+Current catalog: **331 agents · 286 skills · 12 cloud/platform providers**
+
+---
+
+### What Your Sponsorship Funds
+
+Every dollar maps to something concrete:
+
+- → **New cloud provider suites** — each provider costs ~8–12 hours of research, agent design, security audit, and validation across 17 gates
+- → **Compliance coverage** — GDPR, MLPS 2.0, FedRAMP, ISO 27001, SOC 2 mapped into agent guardrails and live-guard hard-stop conditions
+- → **Security audit cycles** — adversarial multi-persona review, fuzz testing, OWASP / LLM Top 10 validation before every merge
+- → **New harness support** — as AI coding tools evolve, agents stay current across Claude Code, Copilot, Codex, Cursor, Gemini, Kiro
+- → **Infrastructure** — npm publishing, CI/CD, OpenSSF Scorecard, SLSA attestations, SBOM signing on every release
+
+---
+
+### Sponsorship Tiers
+
+#### ☕ Cloud Supporter — $5/month
+
+You believe free cloud tooling matters. Your name in the `SPONSORS.md` wall of thanks. Every contribution keeps the lights on.
+
+---
+
+#### 🛡️ Agent Backer — $15/month
+
+You use the agents and want to see them grow.
+
+- Name + link in `SPONSORS.md`
+- Priority response on GitHub Issues you open
+- Early access to release notes before they go public
+
+---
+
+#### 🔧 Provider Sponsor — $50/month
+
+You want a specific cloud or compliance gap closed faster.
+
+- Everything in Agent Backer
+- Vote on the next cloud provider or compliance framework to be added to the roadmap
+- Your GitHub handle credited in the provider README you helped fund
+
+---
+
+#### 🏗️ Architecture Patron — $100/month
+
+You run cloud workloads and this saves your team real time.
+
+- Everything in Provider Sponsor
+- One dedicated GitHub Discussion per month — ask me anything about cloud architecture, agent design, or compliance strategy
+- Logo / link in root README (individual or company)
+
+---
+
+#### 🌐 Enterprise Tier — $500/month
+
+You want coverage your team can rely on.
+
+- Everything in Architecture Patron
+- Direct input on the quarterly roadmap
+- Priority build of one cloud provider suite or compliance framework per quarter
+- Company logo in root README with featured placement
+- Private Slack / Discord channel access for your team
+
+---
+
+### The Honest Version
+
+This project is built in the hours before and after a full-time architecture role. Sponsorship doesn't make me rich — it covers API costs, compute time, and the research hours that keep the catalog growing past what I could sustain alone.
+
+If you've installed the package, opened an agent, or just found value in knowing this exists — **thank you**. That's already enough.
+
+If you want to accelerate it: **<https://github.com/sponsors/Raishin>**
+
+---
+
+## 🤝 Community Projects
+
+Projects built on, inspired by, or extending the Vanguard Frontier Agentic marketplace:
+
+| Project | Description |
+|---------|-------------|
+| *(your project here)* | Built something with VFA? [Open a PR](https://github.com/Raishin/vanguard-frontier-agentic/pulls) to add it to this list. |
+
+---
+
+## ⭐ Star History
+
+<a href="https://www.star-history.com/?repos=Raishin%2Fvanguard-frontier-agentic&type=date&legend=top-left">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=Raishin/vanguard-frontier-agentic&type=date&theme=dark&legend=bottom-right" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=Raishin/vanguard-frontier-agentic&type=date&legend=bottom-right" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=Raishin/vanguard-frontier-agentic&type=date&legend=bottom-right" />
+ </picture>
+</a>

package/agents/alibaba/README.md

@@ -48,6 +48,23 @@ Alibaba Cloud agent catalog for this marketplace. 😄
 | `alibaba-ticket-triage-escalation-coordinator-agent` | P0/P1/P2/P3 triage, SLA enforcement, DingTalk war room coordination |
 | `alibaba-support-incident-coordinator-agent` | severity mapping 紧急/高/中/低, account manager escalation, evidence scrub |
 | `alibaba-daily-operations-briefing-coordinator-agent` | cost delta, ActionTrail anomalies, ACK health, quota warnings, Security Center |
+| `alibaba-actiontrail-audit-analyst-agent` | ActionTrail management API events, SLS-based compliance evidence trails, anomalous admin activity detection |
+| `alibaba-analyticdb-realtime-agent` | AnalyticDB for MySQL/PG, Hologres real-time analytics, DAS OLAP diagnostics |
+| `alibaba-devops-cicd-operator-agent` | RDC (Yunxiao DevOps), Flow pipelines, ACR image lifecycle, Cloud Build, environment promotion |
+| `alibaba-ecs-compute-operator-agent` | ECS instance lifecycle, Auto Scaling, ECI serverless containers, Cloud Assistant O&M, Deployment Set placement |
+| `alibaba-function-serverless-operator-agent` | Function Compute 3.0 event triggers, SAE, EDAS microservice apps, cold-start and concurrency tuning |
+| `alibaba-kms-secret-lifecycle-steward-agent` | KMS key lifecycle, Certificate Manager, SSM Secrets Manager, HSM operations, rotation compliance |
+| `alibaba-landing-zone-architect-agent` | Resource Management org tree, Cloud SSO, Control Policy (SCP-equivalent) baseline, multi-account governance |
+| `alibaba-maxcompute-dataworks-analyst-agent` | MaxCompute CU governance, DataWorks scheduling health, Quick BI, PAI ML integration, query cost optimization |
+| `alibaba-migration-architect-agent` | SMC server migration, DTS database migration/sync, OSSImport, cutover sequencing |
+| `alibaba-mse-microservice-engine-agent` | MSE Nacos (discovery + config), Sentinel (rate limiting + circuit breaking), Seata (distributed tx), ARMS APM |
+| `alibaba-network-architect-agent` | VPC topology, CEN inter-region connectivity, Express Connect hybrid, CLB/ALB/NLB selection, Smart Access Gateway |
+| `alibaba-observability-incident-responder-agent` | CloudMonitor, SLS log analytics, ARMS APM, Distributed Tracing, incident response |
+| `alibaba-oss-storage-steward-agent` | OSS lifecycle policies, bucket ACL/policy, NAS/CPFS file storage, DBFS, cross-region replication |
+| `alibaba-solution-architect-agent` | product selection (PolarDB/RDS, ACK/ASK/SAE, MaxCompute/AnalyticDB), landing zone, HA patterns, migration planning |
+| `alibaba-waf-cost-optimization-review-agent` | ECS rightsizing, Savings Plans/RI coverage, Preemptible Instances, cost tagging, OSS tiering, idle resource elimination |
+| `alibaba-waf-reliability-review-agent` | multi-AZ ECS topology, SLB/ALB/NLB, Auto Scaling, RDS/PolarDB HA failover, backup DR, CloudMonitor/ARMS coverage |
+| `alibaba-waf-security-review-agent` | RAM least-privilege, VPC isolation, KMS/HSM encryption, Security Center, ActionTrail, WAF/Anti-DDoS, MLPS 2.0/DSL/PIPL |
 
 ## 🛡️ Operating note
 

package/agents/contabo/contabo-capacity-planner-agent/metadata.json

@@ -6,7 +6,11 @@
   "version": "0.1.0",
   "harnesses": [
     "codex",
-    "claude-code"
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
   ],
   "summary": "Advisory agent for Contabo resource planning: region coverage analysis, instance sizing across VPS/VDS/Storage VPS tiers, Cloud-Init userData strategy, and multi-region deployment patterns.",
   "source_type": "original",
@@ -15,13 +19,20 @@
     "https://docs.contabo.com/",
     "https://contabo.com/en/vps/"
   ],
-  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — never cache or log them. Credentials must remain in environment variables. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual periods (1, 3, 6, 12 months) are binding at instance creation — capacity plans must declare the period and its billing impact before execution. SSH keys are managed as secret IDs; never expose raw key material in plans.",
+  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes \u2014 never cache or log them. Credentials must remain in environment variables. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual periods (1, 3, 6, 12 months) are binding at instance creation \u2014 capacity plans must declare the period and its billing impact before execution. SSH keys are managed as secret IDs; never expose raw key material in plans.",
   "last_verified": "2026-05-10",
   "path": "agents/contabo/contabo-capacity-planner-agent",
   "author": "github: Raishin",
-  "companion_skills": ["contabo-capacity-planner"],
+  "companion_skills": [
+    "contabo-capacity-planner"
+  ],
   "harness_variants": {
     "codex": "agents/contabo/contabo-capacity-planner-agent/harnesses/codex.toml",
-    "claude-code": "agents/contabo/contabo-capacity-planner-agent/harnesses/claude-code.agent.md"
+    "copilot": "agents/contabo/contabo-capacity-planner-agent/harnesses/copilot.agent.md",
+    "claude-code": "agents/contabo/contabo-capacity-planner-agent/harnesses/claude-code.agent.md",
+    "cursor": "agents/contabo/contabo-capacity-planner-agent/harnesses/cursor.agent.md",
+    "gemini": "agents/contabo/contabo-capacity-planner-agent/harnesses/gemini.agent.md",
+    "kiro-ide": "agents/contabo/contabo-capacity-planner-agent/harnesses/kiro-ide.agent.md",
+    "kiro-cli": "agents/contabo/contabo-capacity-planner-agent/harnesses/kiro-cli.agent.json"
   }
 }

package/agents/contabo/contabo-cost-optimization-analyst-agent/metadata.json

@@ -6,7 +6,11 @@
   "version": "0.1.0",
   "harnesses": [
     "codex",
-    "claude-code"
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
   ],
   "summary": "Advisory agent for Contabo cost posture: contract period analysis, VPS/VDS sizing recommendations, addon utilization review, and billing-impact assessment.",
   "source_type": "original",
@@ -15,13 +19,20 @@
     "https://docs.contabo.com/",
     "https://contabo.com/en/vps/"
   ],
-  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — never cache or log them. Store CONTABO_CLIENT_ID, CONTABO_CLIENT_SECRET, CONTABO_API_USER, CONTABO_API_PASSWORD in environment variables only. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual billing periods (1, 3, 6, 12 months) create irreversible obligations — always surface billing impact before any sizing or period recommendation.",
+  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes \u2014 never cache or log them. Store CONTABO_CLIENT_ID, CONTABO_CLIENT_SECRET, CONTABO_API_USER, CONTABO_API_PASSWORD in environment variables only. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual billing periods (1, 3, 6, 12 months) create irreversible obligations \u2014 always surface billing impact before any sizing or period recommendation.",
   "last_verified": "2026-05-10",
   "path": "agents/contabo/contabo-cost-optimization-analyst-agent",
   "author": "github: Raishin",
-  "companion_skills": ["contabo-cost-optimization-analyst"],
+  "companion_skills": [
+    "contabo-cost-optimization-analyst"
+  ],
   "harness_variants": {
     "codex": "agents/contabo/contabo-cost-optimization-analyst-agent/harnesses/codex.toml",
-    "claude-code": "agents/contabo/contabo-cost-optimization-analyst-agent/harnesses/claude-code.agent.md"
+    "copilot": "agents/contabo/contabo-cost-optimization-analyst-agent/harnesses/copilot.agent.md",
+    "claude-code": "agents/contabo/contabo-cost-optimization-analyst-agent/harnesses/claude-code.agent.md",
+    "cursor": "agents/contabo/contabo-cost-optimization-analyst-agent/harnesses/cursor.agent.md",
+    "gemini": "agents/contabo/contabo-cost-optimization-analyst-agent/harnesses/gemini.agent.md",
+    "kiro-ide": "agents/contabo/contabo-cost-optimization-analyst-agent/harnesses/kiro-ide.agent.md",
+    "kiro-cli": "agents/contabo/contabo-cost-optimization-analyst-agent/harnesses/kiro-cli.agent.json"
   }
 }

package/agents/contabo/contabo-live-instance-lifecycle-guard-agent/metadata.json

@@ -6,7 +6,11 @@
   "version": "0.1.0",
   "harnesses": [
     "codex",
-    "claude-code"
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
   ],
   "summary": "Live-guard agent for Contabo VPS/VDS lifecycle operations: instance creation, reinstallation, and cancellation with mandatory contract period acknowledgment, billing impact confirmation, and rollback plan before any mutation.",
   "source_type": "original",
@@ -14,13 +18,20 @@
     "https://api.contabo.com/",
     "https://docs.contabo.com/"
   ],
-  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — refresh handling must not log token values. Credentials must remain in environment variables. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API with curl + jq. Contractual periods (1, 3, 6, 12 months) are binding at creation — cancellation may incur early-termination billing. x-request-id (UUIDv4) is mandatory for all mutation calls to enable support traceability. Hard-stop on any lifecycle action without explicit period acknowledgment and rollback plan.",
+  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes \u2014 refresh handling must not log token values. Credentials must remain in environment variables. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API with curl + jq. Contractual periods (1, 3, 6, 12 months) are binding at creation \u2014 cancellation may incur early-termination billing. x-request-id (UUIDv4) is mandatory for all mutation calls to enable support traceability. Hard-stop on any lifecycle action without explicit period acknowledgment and rollback plan.",
   "last_verified": "2026-05-10",
   "path": "agents/contabo/contabo-live-instance-lifecycle-guard-agent",
   "author": "github: Raishin",
-  "companion_skills": ["contabo-live-instance-lifecycle-guard"],
+  "companion_skills": [
+    "contabo-live-instance-lifecycle-guard"
+  ],
   "harness_variants": {
     "codex": "agents/contabo/contabo-live-instance-lifecycle-guard-agent/harnesses/codex.toml",
-    "claude-code": "agents/contabo/contabo-live-instance-lifecycle-guard-agent/harnesses/claude-code.agent.md"
+    "copilot": "agents/contabo/contabo-live-instance-lifecycle-guard-agent/harnesses/copilot.agent.md",
+    "claude-code": "agents/contabo/contabo-live-instance-lifecycle-guard-agent/harnesses/claude-code.agent.md",
+    "cursor": "agents/contabo/contabo-live-instance-lifecycle-guard-agent/harnesses/cursor.agent.md",
+    "gemini": "agents/contabo/contabo-live-instance-lifecycle-guard-agent/harnesses/gemini.agent.md",
+    "kiro-ide": "agents/contabo/contabo-live-instance-lifecycle-guard-agent/harnesses/kiro-ide.agent.md",
+    "kiro-cli": "agents/contabo/contabo-live-instance-lifecycle-guard-agent/harnesses/kiro-cli.agent.json"
   }
 }

package/agents/contabo/contabo-live-storage-operations-guard-agent/metadata.json

@@ -6,7 +6,11 @@
   "version": "0.1.0",
   "harnesses": [
     "codex",
-    "claude-code"
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
   ],
   "summary": "Live-guard agent for Contabo Object Storage and S3-compatible bucket operations: inventory audit, access policy review, retention policy enforcement, and deletion with backup verification before any destructive mutation.",
   "source_type": "original",
@@ -14,13 +18,20 @@
     "https://api.contabo.com/",
     "https://docs.contabo.com/"
   ],
-  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — refresh handling must not log token values. Credentials must remain in environment variables. Contabo Object Storage is S3-compatible — access key and secret key for S3 API must be stored as environment variables, never hardcoded. x-request-id (UUIDv4) is mandatory for Contabo REST API calls. Hard-stop on any bucket deletion without verified backup evidence. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API with curl + jq and S3-compatible tools (aws cli with custom endpoint) for Object Storage.",
+  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes \u2014 refresh handling must not log token values. Credentials must remain in environment variables. Contabo Object Storage is S3-compatible \u2014 access key and secret key for S3 API must be stored as environment variables, never hardcoded. x-request-id (UUIDv4) is mandatory for Contabo REST API calls. Hard-stop on any bucket deletion without verified backup evidence. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API with curl + jq and S3-compatible tools (aws cli with custom endpoint) for Object Storage.",
   "last_verified": "2026-05-10",
   "path": "agents/contabo/contabo-live-storage-operations-guard-agent",
   "author": "github: Raishin",
-  "companion_skills": ["contabo-live-storage-operations-guard"],
+  "companion_skills": [
+    "contabo-live-storage-operations-guard"
+  ],
   "harness_variants": {
     "codex": "agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/codex.toml",
-    "claude-code": "agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/claude-code.agent.md"
+    "copilot": "agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/copilot.agent.md",
+    "claude-code": "agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/claude-code.agent.md",
+    "cursor": "agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/cursor.agent.md",
+    "gemini": "agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/gemini.agent.md",
+    "kiro-ide": "agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/kiro-ide.agent.md",
+    "kiro-cli": "agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/kiro-cli.agent.json"
   }
 }

package/agents/contabo/contabo-maestro-agent/metadata.json

@@ -6,7 +6,11 @@
   "version": "0.1.0",
   "harnesses": [
     "codex",
-    "claude-code"
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
   ],
   "summary": "Router agent that classifies Contabo tasks and delegates to the narrowest specialist for cost analysis, capacity planning, security hardening, or live-guard operations.",
   "source_type": "original",
@@ -14,13 +18,20 @@
     "https://api.contabo.com/",
     "https://docs.contabo.com/"
   ],
-  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — never cache or log them. Credentials must remain in environment variables. The x-request-id UUIDv4 header is mandatory for support traceability. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual periods (1, 3, 6, 12 months) create billing obligations — never route lifecycle changes without explicit period acknowledgment.",
+  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes \u2014 never cache or log them. Credentials must remain in environment variables. The x-request-id UUIDv4 header is mandatory for support traceability. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. Contractual periods (1, 3, 6, 12 months) create billing obligations \u2014 never route lifecycle changes without explicit period acknowledgment.",
   "last_verified": "2026-05-10",
   "path": "agents/contabo/contabo-maestro-agent",
   "author": "github: Raishin",
-  "companion_skills": ["contabo-maestro"],
+  "companion_skills": [
+    "contabo-maestro"
+  ],
   "harness_variants": {
     "codex": "agents/contabo/contabo-maestro-agent/harnesses/codex.toml",
-    "claude-code": "agents/contabo/contabo-maestro-agent/harnesses/claude-code.agent.md"
+    "copilot": "agents/contabo/contabo-maestro-agent/harnesses/copilot.agent.md",
+    "claude-code": "agents/contabo/contabo-maestro-agent/harnesses/claude-code.agent.md",
+    "cursor": "agents/contabo/contabo-maestro-agent/harnesses/cursor.agent.md",
+    "gemini": "agents/contabo/contabo-maestro-agent/harnesses/gemini.agent.md",
+    "kiro-ide": "agents/contabo/contabo-maestro-agent/harnesses/kiro-ide.agent.md",
+    "kiro-cli": "agents/contabo/contabo-maestro-agent/harnesses/kiro-cli.agent.json"
   }
 }

package/agents/contabo/contabo-security-hardening-agent/metadata.json

@@ -6,7 +6,11 @@
   "version": "0.1.0",
   "harnesses": [
     "codex",
-    "claude-code"
+    "copilot",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro"
   ],
   "summary": "Advisory agent for Contabo security posture: SSH key management via secret IDs, default user policy review, firewall configuration, OAuth2 credential hygiene, and x-request-id traceability enforcement.",
   "source_type": "original",
@@ -14,13 +18,20 @@
     "https://api.contabo.com/",
     "https://docs.contabo.com/"
   ],
-  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes — short TTL reduces exposure window but refresh logic must not log tokens. Credentials (CONTABO_CLIENT_ID, CONTABO_CLIENT_SECRET, CONTABO_API_USER, CONTABO_API_PASSWORD) must never be hardcoded. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. SSH keys are referenced via secret IDs — raw private key material must never appear in API payloads, scripts, or recommendations. The x-request-id UUIDv4 header is mandatory for audit traceability.",
+  "security_notes": "OAuth2 password grant tokens expire in ~5 minutes \u2014 short TTL reduces exposure window but refresh logic must not log tokens. Credentials (CONTABO_CLIENT_ID, CONTABO_CLIENT_SECRET, CONTABO_API_USER, CONTABO_API_PASSWORD) must never be hardcoded. Contabo has no official Terraform provider or SDK; recommend cntb CLI or REST API. SSH keys are referenced via secret IDs \u2014 raw private key material must never appear in API payloads, scripts, or recommendations. The x-request-id UUIDv4 header is mandatory for audit traceability.",
   "last_verified": "2026-05-10",
   "path": "agents/contabo/contabo-security-hardening-agent",
   "author": "github: Raishin",
-  "companion_skills": ["contabo-security-hardening"],
+  "companion_skills": [
+    "contabo-security-hardening"
+  ],
   "harness_variants": {
     "codex": "agents/contabo/contabo-security-hardening-agent/harnesses/codex.toml",
-    "claude-code": "agents/contabo/contabo-security-hardening-agent/harnesses/claude-code.agent.md"
+    "copilot": "agents/contabo/contabo-security-hardening-agent/harnesses/copilot.agent.md",
+    "claude-code": "agents/contabo/contabo-security-hardening-agent/harnesses/claude-code.agent.md",
+    "cursor": "agents/contabo/contabo-security-hardening-agent/harnesses/cursor.agent.md",
+    "gemini": "agents/contabo/contabo-security-hardening-agent/harnesses/gemini.agent.md",
+    "kiro-ide": "agents/contabo/contabo-security-hardening-agent/harnesses/kiro-ide.agent.md",
+    "kiro-cli": "agents/contabo/contabo-security-hardening-agent/harnesses/kiro-cli.agent.json"
   }
 }

package/agents/finops/AGENTS.md

@@ -15,22 +15,32 @@
 
 ## FinOps Agents
 
-| Agent | Purpose | Skill |
-|-------|---------|-------|
+| Agent | Purpose | Companion skill(s) |
+|-------|---------|--------------------|
+| [finops-maestro-agent](finops-maestro-agent/) | Route FinOps tasks to the narrowest specialist or parallel team (max 4); FOCUS-aware classification; never auto-dispatches mutating specialists | [finops-maestro](../../skills/finops/finops-maestro/) |
+| [finops-ai-economist-agent](finops-ai-economist-agent/) | AI workload economics across foundation-model providers and GPU instance families: token economics, $/GPU-hour-utilized, cross-provider comparison, training-vs-inference TCO | [fetch-foundation-model-pricing](../../skills/finops/fetch-foundation-model-pricing/), [carbon-cost-pair](../../skills/finops/carbon-cost-pair/) |
+| [finops-kubernetes-rightsizer-agent](finops-kubernetes-rightsizer-agent/) | Pod request/limit recommendations from supplied p50/p95/p99 metrics, idle scan, Karpenter consolidation eligibility, OpenCost-compatible allocation mapped to FOCUS | [rightsize-recommendation](../../skills/finops/rightsize-recommendation/), [kubernetes-allocation-report](../../skills/finops/kubernetes-allocation-report/), [carbon-cost-pair](../../skills/finops/carbon-cost-pair/) |
 | [finops-cloud-price-advisor-agent](finops-cloud-price-advisor-agent/) | Fetch live public prices from AWS, Azure, and OCI pricing APIs; produce cost estimates for live environments and prototypes; default currency USD | [finops-cloud-price-advisor](../../skills/finops/finops-cloud-price-advisor/) |
 
-### FinOps price advisor posture
+### Shared posture
 
-The FinOps Cloud Price Advisor operates in read-only mode only:
+All FinOps agents operate in read-only mode:
 
-- **All three pricing APIs are public and unauthenticated.** No cloud credentials, billing account IDs, or cost management access are required or accepted.
-- **Two modes**: live-environment (enumerate running resources → line-item estimate) and prototype (planned architecture spec → pre-provisioning estimate).
-- **Currency**: USD by default; other currencies available via public exchange rate APIs (no auth required).
-- **On-demand list prices only** unless the user explicitly requests committed/reserved pricing.
-- **Label every value**: `live-price` (fetched this session), `documentation-based` (fallback), `assumed` (user did not specify), `excluded` (out of scope).
+- **Public unauthenticated pricing APIs only.** No cloud credentials, billing account IDs, API keys, kubeconfig, bearer tokens, service-account JWTs, or cost-management access are accepted. Refusal is unconditional.
+- **Provenance labels mandatory**: every numeric output is labeled `live-price` / `live-evidence` / `documentation-based` / `assumed` / `excluded` with source URL + ISO 8601 timestamp where applicable.
+- **FOCUS v1.2-mapped output** where the domain admits it (BilledCost, EffectiveCost, ServiceCategory, ServiceName, ChargeCategory, SkuPriceId, ResourceId, etc.).
+- **Currency**: USD by default; other currencies on explicit request via public exchange rate APIs (no auth required).
+- **On-demand list prices only** unless the user explicitly requests committed, reserved, or savings-plan pricing.
+- **Carbon pairing** available via `carbon-cost-pair` for CSRD/SEC climate disclosure (Scope 2 market-based default).
+- **No auto-mutation**: the maestro never dispatches a mutating specialist without an explicit human approval gate and handoff packet (specialist name, blast-radius, rollback path).
+
+### Maestro routing
+
+The maestro routes across three specialists today. Fixture set: `tests/fixtures/finops-maestro-routing/`. Validation gate: `npm run validate:maestro-routing`. No live-guard agents exist in v1; future mutating specialists must be added to `live_guards` in `taxonomy.json` before dispatch is permitted.
 
 ## Rules
 - Keep skill links pointed at `skills/finops/<skill-id>/SKILL.md`.
 - Keep agent catalog IDs suffixed with `-agent`.
 - Do not invent authentication requirements for public pricing APIs.
+- Do not introduce mutating specialists without wiring the live-guard gate in the maestro taxonomy.
 - Run `npm run validate` after changes.