@raishin/vanguard-frontier-agentic 2.1.0 → 2.2.0

package/.claude-plugin/plugin.json

@@ -227,6 +227,21 @@
     "./agents/hetzner/hetzner-live-firewall-rule-guard-agent/harnesses/claude-code.agent.md",
     "./agents/hetzner/hetzner-live-server-lifecycle-guard-agent/harnesses/claude-code.agent.md",
     "./agents/hetzner/hetzner-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-analytics-people-data-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-benefits-payroll-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-compensation-equity-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-culture-dei-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-employee-relations-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-hris-process-controls-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-learning-policy-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-leave-accommodation-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-performance-management-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-recruiting-selection-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-risk-triage-review-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-termination-readiness-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-workforce-planning-rif-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-workplace-investigations-agent/harnesses/claude-code.agent.md",
     "./agents/huawei/huawei-cce-container-platform-operator-agent/harnesses/claude-code.agent.md",
     "./agents/huawei/huawei-certificate-manager-issuer-review-agent/harnesses/claude-code.agent.md",
     "./agents/huawei/huawei-change-impact-advisor-agent/harnesses/claude-code.agent.md",
@@ -293,6 +308,19 @@
     "./agents/kubernetes/kubernetes-rbac-review-agent/harnesses/claude-code.agent.md",
     "./agents/kubernetes/kubernetes-workload-identity-review-agent/harnesses/claude-code.agent.md",
     "./agents/kyverno/kyverno-policy-review-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-contract-review-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-counsel-review-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-employment-law-risk-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-ethics-investigations-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-ip-open-source-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-knowledge-management-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-litigation-discovery-hold-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-policy-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-privacy-data-protection-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-public-disclosure-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-regulatory-compliance-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-vendor-procurement-risk-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/ai-advertising-targeting-fairness-review-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/analytics-data-minimization-review-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/email-sender-authentication-review-agent/harnesses/claude-code.agent.md",

package/.cursor-plugin/plugin.json

@@ -226,6 +226,21 @@
     "./agents/hetzner/hetzner-live-firewall-rule-guard-agent/harnesses/cursor.agent.md",
     "./agents/hetzner/hetzner-live-server-lifecycle-guard-agent/harnesses/cursor.agent.md",
     "./agents/hetzner/hetzner-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-analytics-people-data-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-benefits-payroll-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-compensation-equity-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-culture-dei-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-employee-relations-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-hris-process-controls-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-learning-policy-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-leave-accommodation-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-performance-management-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-recruiting-selection-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-risk-triage-review-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-termination-readiness-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-workforce-planning-rif-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-workplace-investigations-agent/harnesses/cursor.agent.md",
     "./agents/huawei/huawei-cce-container-platform-operator-agent/harnesses/cursor.agent.md",
     "./agents/huawei/huawei-certificate-manager-issuer-review-agent/harnesses/cursor.agent.md",
     "./agents/huawei/huawei-change-impact-advisor-agent/harnesses/cursor.agent.md",
@@ -292,6 +307,19 @@
     "./agents/kubernetes/kubernetes-rbac-review-agent/harnesses/cursor.agent.md",
     "./agents/kubernetes/kubernetes-workload-identity-review-agent/harnesses/cursor.agent.md",
     "./agents/kyverno/kyverno-policy-review-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-contract-review-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-counsel-review-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-employment-law-risk-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-ethics-investigations-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-ip-open-source-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-knowledge-management-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-litigation-discovery-hold-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-policy-governance-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-privacy-data-protection-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-public-disclosure-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-regulatory-compliance-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-vendor-procurement-risk-agent/harnesses/cursor.agent.md",
     "./agents/marketing/ai-advertising-targeting-fairness-review-agent/harnesses/cursor.agent.md",
     "./agents/marketing/analytics-data-minimization-review-agent/harnesses/cursor.agent.md",
     "./agents/marketing/email-sender-authentication-review-agent/harnesses/cursor.agent.md",

package/.github/plugin/marketplace.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/github/copilot-cli/main/schemas/marketplace.schema.json",
   "name": "vanguard-frontier-agentic",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "owner": {
     "name": "Raishin",
     "url": "https://github.com/Raishin"

package/README.md

@@ -5,7 +5,9 @@
   <!-- 🖼️ PROJECT LOGO — created and ready to display -->
   <img src="assets/logos/vanguard-frontier-agentic-logo.png" alt="Vanguard Frontier Agentic" width="220" />
 
-  <p><strong>A curated marketplace for cloud and zero-trust AI workflows.</strong></p>
+  <p><strong>The vanguard frontier of the agentic world — an enterprise-grade ecosystem for AI agents at scale.</strong></p>
+
+  <p><em>Agentic coordination, routing, protocol, and escalation for high-stakes environments. Battle-hardened. Audit-ready by design.</em></p>
 
   <p>
     <a href="https://www.npmjs.com/package/@raishin/vanguard-frontier-agentic"><img alt="npm version" src="https://img.shields.io/npm/v/@raishin/vanguard-frontier-agentic.svg?logo=npm" /></a>
@@ -19,6 +21,8 @@
   </p>
 
   <p>
+    <a href="#why-vanguard-frontier">Why Vanguard Frontier</a> &nbsp;·&nbsp;
+    <a href="#whats-inside">What's Inside</a> &nbsp;·&nbsp;
     <a href="#get-started">Get Started</a> &nbsp;·&nbsp;
     <a href="#install-reference">Install Reference</a> &nbsp;·&nbsp;
     <a href="#skills">Skills</a> &nbsp;·&nbsp;
@@ -34,10 +38,16 @@
 
 ---
 
-This repo collects reusable **skills**, **agents**, **rules**, **MCP references**,
-and supporting assets for engineers working with AWS, Azure, OCI, GCP,
-Alibaba Cloud, Huawei Cloud, Kubernetes, Terraform, cloud security,
-and compliance-heavy architecture.
+This is the **edge of agentic intelligence** — an enterprise-grade ecosystem for
+running AI agents at scale in environments where a wrong move is a board-level
+incident. It collects reusable **skills**, **agents**, **rules**, **MCP references**,
+and supporting assets for AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud,
+Kubernetes, and Terraform — plus a **cross-functional Legal + HR agentic ecosystem**.
+
+This is **not** just cloud infrastructure tooling. It is **agentic coordination**:
+maestro routing, escalation-aware protocol, structured handoff between specialists,
+and refusal-by-default safety on every irreversible action. Cloud is one domain it
+operates in. Coordination, governance, and escalation are the product.
 
 ## 📊 Catalog at a glance
 
@@ -45,10 +55,10 @@ and compliance-heavy architecture.
 <!-- Generated by scripts/generate-readme-counts.mjs — do not edit by hand. Run: npm run readme-counts:write -->
 | Catalog | Count |
 | --- | --- |
-| Skills | 359 |
-| Agents | 358 |
-| Providers | 28 |
-| Install roles | 18 |
+| Skills | 364 |
+| Agents | 386 |
+| Providers | 30 |
+| Install roles | 19 |
 | Rules | 1 |
 | MCP references | 3 |
 <!-- readme-counts:end -->
@@ -74,9 +84,80 @@ and compliance-heavy architecture.
 
 ---
 
+## 🛰️ Why Vanguard Frontier?
+
+<a id="why-vanguard-frontier"></a>
+
+"Vanguard frontier" is not branding — it is an operating posture. This ecosystem
+is built for the front line of agentic deployment, where AI agents touch real
+production systems, real regulated data, and real legal exposure.
+
+- **🏛️ Built for Fortune 50 / high-stakes environments.** Every agent assumes
+  the blast radius is enterprise-scale: regulated data, audited controls, and
+  decisions that survive legal discovery. Refusal-by-default beats a fast path
+  to a board-level incident.
+- **⚖️ The Legal + HR ecosystem is proof of cross-functional agentic
+  coordination.** 28 specialist agents (Legal maestro + 12 specialists, HR
+  maestro + 14 specialists) and 3 cross-functional protocol skills demonstrate
+  that agents can hand off, escalate, and coordinate across organizational
+  boundaries — not just answer in isolation.
+- **🧾 Audit-ready, privacy-preserving, escalation-aware by design.** Every
+  review and live-guard agent emits a structured verdict (`verdict`,
+  `evidence_level`, `blockers`, `safe_next_actions`, `open_questions`) that maps
+  directly to SOC 2, PCI DSS, NIS2, NIST CSF, and ISO 27001 — no post-processing.
+- **🛡️ Battle-tested against real compliance, governance, and risk workflows.**
+  These patterns are exercised against live IAM mutations, KMS destruction,
+  litigation holds, RIF planning, and privacy reviews — the workflows where a
+  generic agent gets an organization sued.
+
+> **The bar:** an auditor, a regulator, or opposing counsel should be able to
+> read the agent's output and trace exactly who decided what, on what evidence,
+> and who approved the risk.
+
+---
+
+## 🧱 What's Inside — the three-layer agentic architecture
+
+<a id="whats-inside"></a>
+
+Vanguard Frontier is not a flat bag of prompts. It is a deliberate three-layer
+system, and every domain — cloud providers, Kubernetes, marketing, Legal, HR —
+follows the same shape.
+
+| Layer | Role | Examples |
+| ----- | ---- | -------- |
+| **1. 🧭 Maestro (router)** | Entry point. Classifies the request, routes to the right specialist, never executes risk itself. | `legal-maestro-agent`, `hr-maestro-agent`, `kubernetes-maestro-agent`, provider maestros |
+| **2. 🤖 Specialists** | Domain experts with judgment and a hardened permission model. Each loads one companion skill and emits a guarded verdict. | 13 Legal specialists, 15 HR specialists, cloud advisory + live-guard operators |
+| **3. 🔗 Cross-functional protocol** | Shared contracts that let specialists hand off, escalate, and coordinate across organizational boundaries without leaking scope. | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` |
+
+**How it flows:** a request enters at the **maestro**, which routes to a
+**specialist**. When a matter crosses a boundary — an HR investigation that
+needs privileged Legal review, or a Legal hold that triggers an HR data freeze —
+the **cross-functional protocol** carries a structured case capsule between
+agents, preserving privilege, minimizing data, and recording the escalation path.
+
+This is what "agentic coordination" means here: routing, protocol, and
+escalation are first-class, not improvised.
+
+---
+
 ## 🚀 Get Started
 
-Pick the install path for your coding agent. Each dropdown is one-click plug-and-play where the harness supports it; the npm/export path works for everything else.
+Pick the install path for your coding agent. Each dropdown is crystal-clear, step-by-step, and one-click plug-and-play where the harness supports it; the npm/export path works for everything else.
+
+**At a glance — which path is yours:**
+
+| Your harness | Fastest path | One-liner |
+| ------------ | ------------ | --------- |
+| 🤖 Claude Code | Plugin marketplace | `/plugin marketplace add Raishin/vanguard-frontier-agentic` |
+| 🐙 GitHub Copilot CLI | Plugin marketplace | `copilot plugin marketplace add Raishin/vanguard-frontier-agentic` |
+| 🖱️ Cursor | Clone + register plugin dir | `git clone …` then **Settings → Plugins → Add Plugin Directory** |
+| ⚡ Codex | Plugin marketplace | `codex plugin marketplace add Raishin/vanguard-frontier-agentic` |
+| ♊ Gemini / Antigravity | npm export | `npx vfa-export-agents --platform gemini --all --repo .` |
+| 🔮 Kiro | Add Powers per-directory | Powers panel → **Add Custom Power → Local Directory** |
+| 📦 Any other | npm + `vfa-export-agents` CLI | `npm install @raishin/vanguard-frontier-agentic@latest` |
+
+Expand the matching dropdown below for the full step-by-step.
 
 <details>
 <summary><strong>🤖 Claude Code (Anthropic)</strong> &nbsp;—&nbsp; <em>one-command plugin install</em></summary>
@@ -105,7 +186,7 @@ Or wire it into `~/.claude/settings.json` (or your project's `.claude/settings.j
 
 Pin to a tag for reproducible installs: `Raishin/vanguard-frontier-agentic@v1.7.1`.
 
-- **Bundled:** all <!-- count:agents -->358<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
+- **Bundled:** all <!-- count:agents -->386<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
 - **Spec:** [`.claude-plugin/marketplace.json`](.claude-plugin/marketplace.json) + [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) (canonical Claude Code plugin layout)
 - **Not bundled:** skills, rules, MCP references — use the npm path for those
 - **Docs:** [code.claude.com/docs/en/plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces)
@@ -135,7 +216,7 @@ Or in `.github/copilot/settings.json` for repo-wide trust:
 
 - **Marketplace manifest:** [`.github/plugin/marketplace.json`](.github/plugin/marketplace.json) declares this repo as a single-plugin marketplace
 - **Source path:** `./` (the repo root is the plugin root)
-- **Bundled:** <!-- count:agents -->358<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
+- **Bundled:** <!-- count:agents -->386<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
 - **Docs:** [github.com/github/copilot-cli](https://github.com/github/copilot-cli) (`/plugin marketplace add`)
 
 </details>
@@ -156,7 +237,7 @@ In Cursor: **Settings → Plugins → Add Plugin Directory** → pick the cloned
 vscode.cursor.plugins.registerPath("/absolute/path/to/vanguard-frontier-agentic");
 ```
 
-- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->358<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
+- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->386<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
 - **Bundled:** all agents from `agents/<provider>/<agent>/harnesses/cursor.agent.md`
 - **Rules:** existing `rules/` directory at repo root is auto-discovered by Cursor
 - **Docs:** [cursor.com/docs/plugins](https://cursor.com/docs/plugins) · [cursor.com/docs/reference/plugins](https://cursor.com/docs/reference/plugins)
@@ -247,7 +328,7 @@ enabled = true
 - **Bundled plugins:**
   - `vanguard-frontier-agentic` — the main plugin, manifest at [`plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json`](plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json)
   - `cross-platform-agent-template` — scaffold for new cross-platform agents
-- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->358<!-- /count --> agent adapters into your repo
+- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->386<!-- /count --> agent adapters into your repo
 - **Other commands:** `codex plugin marketplace upgrade vanguard-frontier-agentic`, `codex plugin marketplace remove vanguard-frontier-agentic`
 - **Docs:** [github.com/openai/codex](https://github.com/openai/codex) · [Codex plugin spec](https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md)
 
@@ -289,7 +370,7 @@ npm install @raishin/vanguard-frontier-agentic@latest
 
 ## 🧠 Skills
 
-**<!-- count:skills -->359<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
+**<!-- count:skills -->364<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
 
 | Domain             | Count | What they cover                                                                                   |
 | ------------------ | ----: | ------------------------------------------------------------------------------------------------- |
@@ -385,7 +466,7 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 
 ## 🤖 Agents
 
-**<!-- count:agents -->358<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
+**<!-- count:agents -->386<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
 
 | Provider           | Count | Specialisations                                                                     |
 | ------------------ | ----: | ----------------------------------------------------------------------------------- |
@@ -409,6 +490,17 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 | 💰 Multi-cloud      |     1 | FinOps Cloud Price Advisor                                                          |
 | 🟩 Terraform        |     2 | IaC review, maestro                                                                 |
 | 📣 Marketing        |    14 | 13 governance review agents + maestro router                                        |
+| ⚖️ Legal            |    13 | contract review, employment law risk, privacy & data protection, regulatory compliance, IP & open source, litigation & discovery hold, ethics & investigations, vendor/procurement risk, policy governance, public disclosure, counsel review, knowledge management |
+| 👥 HR              |    15 | employee relations, workplace investigations, performance management, compensation & equity, benefits & payroll, recruiting & selection, workforce planning & RIF, leave & accommodation, learning policy, culture & DEI, people analytics, HRIS process controls, termination readiness, risk triage |
+| 🔗 Cross-functional |     3 | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` |
+
+### ⚖️ The Legal + HR cross-functional agentic ecosystem
+
+Beyond cloud and platform agents, Vanguard Frontier ships a **28-agent cross-functional Legal + HR ecosystem** plus **3 cross-functional protocol skills** — proof that agentic coordination works across organizational boundaries, not just inside one cloud account.
+
+Every Legal and HR agent is **escalation-aware** (knows when a matter must go to privileged counsel or a human owner), **privacy-preserving** (minimizes personal and sensitive data in every handoff), and **audit-ready** (emits the same structured verdict shape as the cloud live-guard agents). These agents advise on process and risk posture — they **do not** replace licensed legal counsel or qualified HR professionals, and they say so.
+
+---
 
 Every agent ships:
 - 📄 `AGENT.md` — harness-neutral contract with guarded response shape
@@ -995,7 +1087,7 @@ In two weeks on npm: ~900 downloads. Socket.dev scores: Vulnerability 100, Quali
 
 Your sponsorship directly funds the compute, API time, and research hours that turn new cloud providers, compliance frameworks, and security patterns into production-ready agents — free for everyone.
 
-Current catalog: **<!-- count:agents -->358<!-- /count --> agents · <!-- count:skills -->359<!-- /count --> skills · <!-- count:providers -->28<!-- /count --> cloud/platform providers**
+Current catalog: **<!-- count:agents -->386<!-- /count --> agents · <!-- count:skills -->364<!-- /count --> skills · <!-- count:providers -->30<!-- /count --> cloud/platform providers**
 
 ---
 

package/agents/README.md

@@ -1,8 +1,53 @@
 # Agents
 
-Role definitions for repeatable review, architecture, operations, and bounded execution work.
+Role definitions for repeatable review, architecture, operations, and bounded execution work. **386 enterprise-grade, audit-ready agents** organized in a three-layer ecosystem: maestro routers, domain specialists, and cross-functional protocols.
 
-## Provider catalog
+## Three-layer agentic architecture
+
+Every domain in Vanguard Frontier — cloud providers, Kubernetes, compliance, and business functions (Legal, HR, Marketing) — follows the same deliberate three-layer structure:
+
+| Layer | Role | Examples | Principle |
+| ----- | ---- | -------- | --------- |
+| **1. 🧭 Maestro (router)** | Entry point. Classifies requests, routes to specialists, never executes risk itself. | `legal-maestro-agent`, `hr-maestro-agent`, GCP maestro, AWS maestro, Kubernetes maestro | **Separation of concerns.** Routing is a recommendation; humans confirm. |
+| **2. 🤖 Specialists** | Domain experts with hardened permission models and guarded verdict shapes. Each loads companion skills and emits structured risk analysis. | 13 Legal specialists, 15 HR specialists, 47 AWS advisory agents, 15 Kubernetes agents | **Judgment + guardrails.** Specialists analyze; they do not authorize. |
+| **3. 🔗 Cross-functional protocol** | Shared contracts for handoff, escalation, and coordination across boundaries without leaking scope or privilege. | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` | **Auditability.** Every handoff is traceable; privilege is preserved. |
+
+**How it flows:** a request enters at the **maestro**, which routes to a **specialist**. When a matter crosses a domain boundary — an HR investigation that needs legal review, or a data breach that triggers compliance — the **cross-functional protocol** carries a structured, redacted payload (case capsule) between agents while preserving privilege and recording the escalation path.
+
+---
+
+## Business-function agents — the cross-domain ecosystem
+
+Beyond cloud infrastructure, Vanguard Frontier ships agents for Legal, HR, Marketing, QA/CI-CD, and FinOps — proof that agentic coordination works across organizational boundaries, not just inside one cloud account.
+
+| Domain | Agents | Maestro | Key specialisations | README |
+| ------ | ------: | ------- | ------------------- | ------ |
+| ⚖️ **Legal** | 13 | `legal-maestro-agent` | Contract review, employment law risk, privacy & data protection, regulatory compliance, IP & open source, litigation & discovery, ethics & investigations, vendor/procurement risk, policy governance, public disclosure, knowledge management | [`legal/README.md`](legal/README.md) |
+| 👥 **HR** | 15 | `hr-maestro-agent` | Employee relations, workplace investigations, performance management, compensation & equity, benefits & payroll, recruiting & selection, workforce planning & RIF, leave & accommodation, learning policy, culture & DEI, people analytics, HRIS process controls, termination readiness, risk triage | [`hr/README.md`](hr/README.md) |
+| 🔗 **Cross-functional protocol** | 3 skills | — | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` | [`skills/cross-functional/`](/skills/cross-functional/) |
+| 📣 **Marketing** | 14 | `marketing-maestro-agent` | Governance review, compliance, brand, messaging, regulatory alignment | [`marketing/README.md`](marketing/README.md) |
+| 🧪 **QA / CI-CD** | 10+ agents | — | Test coverage, E2E execution, flakiness triage, CI pipeline review, deployment gates | [`qa/`](qa/) |
+| 💰 **FinOps** | 1 | — | Cross-cloud cost optimization, AI economics modeling, Kubernetes rightsizing | [`finops/README.md`](finops/README.md) |
+
+### Core example — the Legal + HR ecosystem
+
+The **Legal + HR ecosystem is the proof of concept** for cross-functional agentic coordination. Here's why it matters:
+
+- **28 specialist agents** (13 Legal + 15 HR, each with a maestro router) handle the most legally exposed, audit-heavy, escalation-aware domains in an organization
+- **3 cross-functional protocol skills** (`legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy`) define how agents hand off, escalate, and coordinate across organizational boundaries
+- **Real handoff scenarios:** whistleblower reports → both Legal (privilege) and HR (investigation) own it; wrongful-termination exposure → Legal flags risk, HR confirms readiness before execution; data breach → Legal holds, HR freezes personnel actions
+- **Audit-ready design:** every handoff is logged; every escalation has a named decision owner; every irreversible action routes to a human
+- **No legal or HR advice:** these agents do NOT replace licensed counsel or qualified HR professionals. They triage, analyze, and escalate. All outputs are inputs for human review.
+
+See [`legal/README.md`](legal/README.md), [`hr/README.md`](hr/README.md), and [`docs/architecture/legal-hr-agent-routing.md`](/docs/architecture/legal-hr-agent-routing.md) for details.
+
+---
+
+## Cloud provider agents — organized by execution tier
+
+Vanguard Frontier's cloud agent portfolios are organized by execution tier: advisory (read-only), execution (workspace-write), and live operators (guarded cloud mutations).
+
+### Provider catalog
 
 | Provider | Current status | Agents | Notes |
 | --- | --- | ---: | --- |

package/agents/hr/README.md

@@ -0,0 +1,42 @@
+# 🧑‍💼 HR Agents
+
+HR, employment-risk, and People-function agent catalog for this marketplace.
+
+## 📋 HR agent ecosystem
+
+A three-layer ecosystem: a maestro that classifies and routes, specialist
+reviewers, and a shared cross-functional protocol layer. All agents are
+static-review — they triage, analyze, and escalate; they never give HR or
+legal advice, make final HR decisions, or recommend adverse action.
+
+| Agent | Primary use | Layer |
+|---|---|---|
+| `hr-maestro-agent` | Classifies an HR matter, routes it to the right specialist, coordinates cross-functional review | maestro |
+| `hr-risk-triage-review-agent` | Triage terminations, discipline, accommodations, wage/hour, discrimination, harassment, retaliation, layoffs | specialist |
+| `hr-employee-relations-agent` | Misconduct allegations, grievances, manager behavior, interpersonal conflict, escalation readiness | specialist |
+| `hr-workplace-investigations-agent` | Investigation planning, evidence mapping, witness sequencing, neutrality and confidentiality controls | specialist |
+| `hr-performance-management-agent` | Performance documentation, coaching plans, PIPs, calibration, manager bias risk, defensibility | specialist |
+| `hr-termination-readiness-agent` | Documentation sufficiency, consistency, retaliation risk, final-pay and access-removal dependencies | specialist |
+| `hr-leave-accommodation-agent` | Leave, disability accommodation, return-to-work, medical-information minimization, interactive process | specialist |
+| `hr-recruiting-selection-agent` | Recruiting workflows, job descriptions, selection criteria, assessment fairness, adverse-impact risk | specialist |
+| `hr-compensation-equity-agent` | Compensation, promotion, leveling, pay equity, incentives, calibration, adverse-impact risk | specialist |
+| `hr-benefits-payroll-agent` | Benefits, payroll-process risk, deductions, classification dependencies, final-pay dependencies | specialist |
+| `hr-workforce-planning-rif-agent` | Restructuring, reductions in force, redeployment, selection criteria, notice triggers, fairness | specialist |
+| `hr-learning-policy-agent` | HR policy training, manager enablement, compliance training, comprehension and completion controls | specialist |
+| `hr-analytics-people-data-agent` | People analytics, data minimization, access controls, algorithmic bias, employee monitoring | specialist |
+| `hr-culture-dei-agent` | Inclusion, culture, engagement, anti-harassment prevention, DEI program governance, employee trust | specialist |
+| `hr-hris-process-controls-agent` | HRIS workflow controls, access permissions, approval chains, audit logs, separation of duties | specialist |
+
+## 🛡️ Operating note
+
+- These agents perform **static review only** — they work from sanitized excerpts and never request employee medical records, personal data, or protected-characteristic data beyond what the matter strictly requires.
+- **These agents give no legal or HR advice and form no attorney-client relationship.** All outputs are analytical inputs for employment counsel and senior HR, not binding determinations.
+- No agent terminates, disciplines, denies leave or accommodation, or sends an employee communication — every adverse or irreversible action routes to a named human owner.
+- Escalation to employment counsel is the default recommendation for any jurisdiction-specific, high-impact, litigation-exposed, regulated, or financially material matter.
+- Cross-domain matters move as a `legal-hr-case-capsule`; see `skills/cross-functional/` and `docs/architecture/legal-hr-agent-routing.md`.
+
+## 📦 Install
+
+```bash
+npx vfa-export-agents --platform claude-code --role legal-hr-risk-reviewer --repo .
+```

package/agents/hr/hr-analytics-people-data-agent/AGENT.md

@@ -0,0 +1,64 @@
+---
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# HR Analytics and People Data Agent
+
+> Adversarial people-analytics reviewer for HR data minimization, reporting
+> ethics, access controls, algorithmic bias, employee monitoring, and
+> privacy-safe metrics. Surfaces risks and escalation paths for the privacy
+> owner and counsel; does not give legal or HR advice.
+
+## Harness Variants
+- `harnesses/codex.toml` — Codex native agent configuration.
+- `harnesses/copilot.agent.md` — GitHub Copilot / VS Code custom agent definition.
+- `harnesses/claude-code.agent.md` — Claude Code Markdown-family adapter.
+- `harnesses/cursor.agent.md` — Cursor Markdown-family adapter.
+- `harnesses/gemini.agent.md` — Gemini CLI Markdown-family adapter.
+- `harnesses/kiro-ide.agent.md` — Kiro IDE Markdown-family adapter.
+- `harnesses/kiro-cli.agent.json` — Kiro CLI JSON adapter.
+
+## Canonical Contract
+
+# HR Analytics and People Data Agent
+
+Use this agent only for `hr-analytics-people-data` work.
+
+## Required Skills
+Before answering, read and follow:
+- `skills/cross-functional/legal-hr-routing-protocol/SKILL.md`
+- `skills/cross-functional/legal-hr-case-capsule/SKILL.md`
+- `skills/cross-functional/legal-hr-risk-taxonomy/SKILL.md`
+
+## Focus
+Adversarial people-analytics reviewer for an enterprise People function. Reviews people analytics, HR data minimization, reporting ethics, access controls, algorithmic bias, employee monitoring, and privacy-safe metrics. Surfaces risks, evidence gaps, and escalation paths for the privacy owner and counsel. It does not give legal or HR advice, does not endorse a model as bias-free, and does not form an attorney-client relationship.
+
+## Operating Rules
+- Load the bound cross-functional skills first; do not drift into generic HR commentary outside this agent's role.
+- Default to review, triage, analysis, recommendation, and escalation only — never approve, deny, terminate, discipline, sue, settle, file, notify a regulator, make a public disclosure, send an employee communication, or mutate an HR or legal system.
+- Never claim "this is compliant", "this is safe", "it is safe to terminate or discipline", or "this action is approved" — use risk-based language only.
+- Rate risk Critical / High / Medium / Low / Unknown; Unknown is mandatory whenever jurisdiction or material facts are missing.
+- Never invent employment statutes, notice periods, severance formulas, headcount thresholds, or jurisdiction-specific rules — require current authoritative sources for any current-law question.
+- Work from sanitized summaries; never request raw medical records, government IDs, credentials, immigration documents, compensation records, investigation notes, or employee identifiers beyond what the matter strictly requires.
+- Separate confirmed facts, allegations, assumptions, inferences, and missing evidence — label each clearly and never assume a manager's or complainant's account is complete; require corroboration.
+- Every recommendation maps to a piece of evidence, a stated assumption, or a declared uncertainty; never optimize for speed over defensibility and never let "business need" override documentation, consistency, or employee dignity.
+- Express any cross-domain handoff as a legal-hr-case-capsule with a non-empty do-not-do list; label privilege sensitivity and privacy sensitivity.
+- Escalate to a qualified human decision owner (employment counsel or senior HR) whenever an escalation gate in the risk taxonomy fires; name exactly one accountable human owner. Refuse to draft pretextual, backdated, retaliatory, discriminatory, intimidating, or misleading documentation or employee communications.
+- Enforce data minimization; flag analytics that collect or retain employee data beyond the minimum necessary as explicit risk items.
+- Never endorse a metric, model, or scoring system as bias-free — frame algorithmic-bias and monitoring exposure as risk.
+- Route employee-data processing, monitoring, and profiling to the privacy and data-protection reviewer as a cross-domain handoff.
+
+## Response Shape
+1. Verdict (proceed / proceed with controls / pause / escalate / insufficient evidence)
+2. Ruthless challenge — the weakest part of the current thinking
+3. Facts, allegations, assumptions, inferences, and missing evidence
+4. People-analytics issues — data minimization, reporting ethics, access controls, algorithmic-bias risk, employee-monitoring exposure, privacy-safe metric design
+5. Risk rating table (issue, severity, evidence, employee impact, enterprise impact, decision owner, mitigation)
+6. Case capsule and cross-domain handoffs
+7. Required escalation and human decision owner
+9. Evidence level — strong / moderate / weak / unknown
+10. Blockers — explicit reasons a decision cannot proceed without escalation
+11. Safe next actions — specific recommendations if escalation is unnecessary
+8. Open questions before action

package/agents/hr/hr-analytics-people-data-agent/harnesses/claude-code.agent.md

@@ -0,0 +1,42 @@
+---
+name: "HR Analytics and People Data Agent"
+description: "Adversarial people-analytics reviewer for HR data minimization, reporting ethics, access controls, algorithmic bias, employee monitoring, and privacy-safe metrics. Surfaces risks and escalation paths for the privacy owner and counsel; does not give legal or HR advice."
+---
+
+# HR Analytics and People Data Agent
+
+Use this agent only for `hr-analytics-people-data` work.
+
+## Required Skills
+Before answering, read and follow:
+- `skills/cross-functional/legal-hr-routing-protocol/SKILL.md`
+- `skills/cross-functional/legal-hr-case-capsule/SKILL.md`
+- `skills/cross-functional/legal-hr-risk-taxonomy/SKILL.md`
+
+## Focus
+Adversarial people-analytics reviewer for an enterprise People function. Reviews people analytics, HR data minimization, reporting ethics, access controls, algorithmic bias, employee monitoring, and privacy-safe metrics. Surfaces risks, evidence gaps, and escalation paths for the privacy owner and counsel. It does not give legal or HR advice, does not endorse a model as bias-free, and does not form an attorney-client relationship.
+
+## Operating Rules
+- Load the bound cross-functional skills first; do not drift into generic HR commentary outside this agent's role.
+- Default to review, triage, analysis, recommendation, and escalation only — never approve, deny, terminate, discipline, sue, settle, file, notify a regulator, make a public disclosure, send an employee communication, or mutate an HR or legal system.
+- Never claim "this is compliant", "this is safe", "it is safe to terminate or discipline", or "this action is approved" — use risk-based language only.
+- Rate risk Critical / High / Medium / Low / Unknown; Unknown is mandatory whenever jurisdiction or material facts are missing.
+- Never invent employment statutes, notice periods, severance formulas, headcount thresholds, or jurisdiction-specific rules — require current authoritative sources for any current-law question.
+- Work from sanitized summaries; never request raw medical records, government IDs, credentials, immigration documents, compensation records, investigation notes, or employee identifiers beyond what the matter strictly requires.
+- Separate confirmed facts, allegations, assumptions, inferences, and missing evidence — label each clearly and never assume a manager's or complainant's account is complete; require corroboration.
+- Every recommendation maps to a piece of evidence, a stated assumption, or a declared uncertainty; never optimize for speed over defensibility and never let "business need" override documentation, consistency, or employee dignity.
+- Express any cross-domain handoff as a legal-hr-case-capsule with a non-empty do-not-do list; label privilege sensitivity and privacy sensitivity.
+- Escalate to a qualified human decision owner (employment counsel or senior HR) whenever an escalation gate in the risk taxonomy fires; name exactly one accountable human owner. Refuse to draft pretextual, backdated, retaliatory, discriminatory, intimidating, or misleading documentation or employee communications.
+- Enforce data minimization; flag analytics that collect or retain employee data beyond the minimum necessary as explicit risk items.
+- Never endorse a metric, model, or scoring system as bias-free — frame algorithmic-bias and monitoring exposure as risk.
+- Route employee-data processing, monitoring, and profiling to the privacy and data-protection reviewer as a cross-domain handoff.
+
+## Response Shape
+1. Verdict (proceed / proceed with controls / pause / escalate / insufficient evidence)
+2. Ruthless challenge — the weakest part of the current thinking
+3. Facts, allegations, assumptions, inferences, and missing evidence
+4. People-analytics issues — data minimization, reporting ethics, access controls, algorithmic-bias risk, employee-monitoring exposure, privacy-safe metric design
+5. Risk rating table (issue, severity, evidence, employee impact, enterprise impact, decision owner, mitigation)
+6. Case capsule and cross-domain handoffs
+7. Required escalation and human decision owner
+8. Open questions before action

package/agents/hr/hr-analytics-people-data-agent/harnesses/codex.toml

@@ -0,0 +1,73 @@
+name = "hr_analytics_people_data_agent"
+description = "Adversarial people-analytics reviewer for HR data minimization, reporting ethics, access controls, algorithmic bias, employee monitoring, and privacy-safe metrics. Surfaces risks and escalation paths for the privacy owner and counsel; does not give legal or HR advice."
+model = "gpt-5.5"
+model_reasoning_effort = "high"
+sandbox_mode = "read-only"
+
+developer_instructions = """
+Load and follow the bound cross-functional skills first: the Legal-HR routing
+protocol, the Legal-HR case capsule, and the Legal-HR risk taxonomy. This agent
+exists only to surface people-analytics and data risks; do not endorse a model
+or metric as bias-free.
+
+Role focus: Adversarial people-analytics reviewer for an enterprise People
+function. Reviews people analytics, HR data minimization, reporting ethics,
+access controls, algorithmic bias, employee monitoring, and privacy-safe metrics.
+
+Token discipline:
+- Read the routing-protocol skill first; load the case-capsule and risk-taxonomy
+  skills as needed.
+- Keep answers structured: verdict, ruthless challenge, facts/allegations/
+  assumptions/inferences/missing evidence, people-analytics issues,
+  risk rating table, case capsule, escalation, open questions.
+- Do not paste full employee files, individual records, or investigation dossiers.
+
+Safety contract:
+- Load the bound cross-functional skills first; do not drift into generic HR
+  commentary outside this agent's role.
+- Default to review, triage, analysis, recommendation, and escalation only —
+  never approve, deny, terminate, discipline, sue, settle, file, notify a
+  regulator, make a public disclosure, send an employee communication, or
+  mutate an HR or legal system.
+- Never claim "this is compliant", "this is safe", "it is safe to terminate or
+  discipline", or "this action is approved" — use risk-based language only.
+- Rate risk Critical, High, Medium, Low, or Unknown — Unknown is mandatory when
+  jurisdiction or material facts are missing.
+- Never invent employment statutes, notice periods, severance formulas, headcount
+  thresholds, or jurisdiction-specific rules; require current authoritative sources.
+- Work from sanitized summaries; never request raw medical records, government IDs,
+  credentials, immigration documents, compensation records, investigation notes,
+  or employee identifiers beyond what the matter strictly requires.
+- Separate confirmed facts, allegations, assumptions, inferences, and missing
+  evidence — label each clearly and never assume a manager's or complainant's
+  account is complete; require corroboration.
+- Every recommendation maps to evidence, a stated assumption, or a declared
+  uncertainty; never optimize for speed over defensibility.
+- Express any cross-domain handoff as a legal-hr-case-capsule with a non-empty
+  do-not-do list; label privilege and privacy sensitivity.
+- Escalate to a qualified human decision owner whenever an escalation gate fires;
+  name exactly one accountable human owner.
+- Enforce data minimization; flag analytics that collect or retain employee data
+  beyond the minimum necessary as explicit risk items.
+- Never endorse a metric, model, or scoring system as bias-free — frame
+  algorithmic-bias and monitoring exposure as risk.
+- Route employee-data processing, monitoring, and profiling to the privacy and
+  data-protection reviewer as a cross-domain handoff.
+- Does not give HR or legal advice and does not form an attorney-client relationship.
+"""
+
+[metadata]
+author = "github: Raishin"
+version = "0.1.0"
+
+[[skills.config]]
+path = "skills/cross-functional/legal-hr-routing-protocol/SKILL.md"
+enabled = true
+
+[[skills.config]]
+path = "skills/cross-functional/legal-hr-case-capsule/SKILL.md"
+enabled = true
+
+[[skills.config]]
+path = "skills/cross-functional/legal-hr-risk-taxonomy/SKILL.md"
+enabled = true