@raishin/vanguard-frontier-agentic 2.1.0 → 2.3.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "Raishin",
@@ -164,6 +164,16 @@
     "./agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/claude-code.agent.md",
     "./agents/contabo/contabo-maestro-agent/harnesses/claude-code.agent.md",
     "./agents/contabo/contabo-security-hardening-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-aspire-cloud-native-review-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-aspnetcore-api-review-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-aspnetcore-identity-authz-review-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-csharp-runtime-review-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-efcore-data-access-review-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-observability-otel-review-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-performance-aot-review-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-supply-chain-review-agent/harnesses/claude-code.agent.md",
+    "./agents/dotnet/dotnet-testing-quality-review-agent/harnesses/claude-code.agent.md",
     "./agents/falco/falco-runtime-threat-rules-review-agent/harnesses/claude-code.agent.md",
     "./agents/finops/finops-ai-economist-agent/harnesses/claude-code.agent.md",
     "./agents/finops/finops-cloud-price-advisor-agent/harnesses/claude-code.agent.md",
@@ -227,6 +237,21 @@
     "./agents/hetzner/hetzner-live-firewall-rule-guard-agent/harnesses/claude-code.agent.md",
     "./agents/hetzner/hetzner-live-server-lifecycle-guard-agent/harnesses/claude-code.agent.md",
     "./agents/hetzner/hetzner-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-analytics-people-data-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-benefits-payroll-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-compensation-equity-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-culture-dei-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-employee-relations-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-hris-process-controls-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-learning-policy-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-leave-accommodation-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-performance-management-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-recruiting-selection-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-risk-triage-review-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-termination-readiness-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-workforce-planning-rif-agent/harnesses/claude-code.agent.md",
+    "./agents/hr/hr-workplace-investigations-agent/harnesses/claude-code.agent.md",
     "./agents/huawei/huawei-cce-container-platform-operator-agent/harnesses/claude-code.agent.md",
     "./agents/huawei/huawei-certificate-manager-issuer-review-agent/harnesses/claude-code.agent.md",
     "./agents/huawei/huawei-change-impact-advisor-agent/harnesses/claude-code.agent.md",
@@ -293,6 +318,19 @@
     "./agents/kubernetes/kubernetes-rbac-review-agent/harnesses/claude-code.agent.md",
     "./agents/kubernetes/kubernetes-workload-identity-review-agent/harnesses/claude-code.agent.md",
     "./agents/kyverno/kyverno-policy-review-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-contract-review-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-counsel-review-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-employment-law-risk-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-ethics-investigations-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-ip-open-source-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-knowledge-management-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-litigation-discovery-hold-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-policy-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-privacy-data-protection-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-public-disclosure-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-regulatory-compliance-agent/harnesses/claude-code.agent.md",
+    "./agents/legal/legal-vendor-procurement-risk-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/ai-advertising-targeting-fairness-review-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/analytics-data-minimization-review-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/email-sender-authentication-review-agent/harnesses/claude-code.agent.md",

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "Raishin",
@@ -163,6 +163,16 @@
     "./agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/cursor.agent.md",
     "./agents/contabo/contabo-maestro-agent/harnesses/cursor.agent.md",
     "./agents/contabo/contabo-security-hardening-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-aspire-cloud-native-review-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-aspnetcore-api-review-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-aspnetcore-identity-authz-review-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-csharp-runtime-review-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-efcore-data-access-review-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-observability-otel-review-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-performance-aot-review-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-supply-chain-review-agent/harnesses/cursor.agent.md",
+    "./agents/dotnet/dotnet-testing-quality-review-agent/harnesses/cursor.agent.md",
     "./agents/falco/falco-runtime-threat-rules-review-agent/harnesses/cursor.agent.md",
     "./agents/finops/finops-ai-economist-agent/harnesses/cursor.agent.md",
     "./agents/finops/finops-cloud-price-advisor-agent/harnesses/cursor.agent.md",
@@ -226,6 +236,21 @@
     "./agents/hetzner/hetzner-live-firewall-rule-guard-agent/harnesses/cursor.agent.md",
     "./agents/hetzner/hetzner-live-server-lifecycle-guard-agent/harnesses/cursor.agent.md",
     "./agents/hetzner/hetzner-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-analytics-people-data-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-benefits-payroll-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-compensation-equity-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-culture-dei-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-employee-relations-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-hris-process-controls-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-learning-policy-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-leave-accommodation-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-performance-management-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-recruiting-selection-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-risk-triage-review-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-termination-readiness-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-workforce-planning-rif-agent/harnesses/cursor.agent.md",
+    "./agents/hr/hr-workplace-investigations-agent/harnesses/cursor.agent.md",
     "./agents/huawei/huawei-cce-container-platform-operator-agent/harnesses/cursor.agent.md",
     "./agents/huawei/huawei-certificate-manager-issuer-review-agent/harnesses/cursor.agent.md",
     "./agents/huawei/huawei-change-impact-advisor-agent/harnesses/cursor.agent.md",
@@ -292,6 +317,19 @@
     "./agents/kubernetes/kubernetes-rbac-review-agent/harnesses/cursor.agent.md",
     "./agents/kubernetes/kubernetes-workload-identity-review-agent/harnesses/cursor.agent.md",
     "./agents/kyverno/kyverno-policy-review-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-contract-review-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-counsel-review-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-employment-law-risk-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-ethics-investigations-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-ip-open-source-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-knowledge-management-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-litigation-discovery-hold-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-policy-governance-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-privacy-data-protection-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-public-disclosure-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-regulatory-compliance-agent/harnesses/cursor.agent.md",
+    "./agents/legal/legal-vendor-procurement-risk-agent/harnesses/cursor.agent.md",
     "./agents/marketing/ai-advertising-targeting-fairness-review-agent/harnesses/cursor.agent.md",
     "./agents/marketing/analytics-data-minimization-review-agent/harnesses/cursor.agent.md",
     "./agents/marketing/email-sender-authentication-review-agent/harnesses/cursor.agent.md",

package/.github/plugin/marketplace.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/github/copilot-cli/main/schemas/marketplace.schema.json",
   "name": "vanguard-frontier-agentic",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "owner": {
     "name": "Raishin",
     "url": "https://github.com/Raishin"

package/README.md

@@ -5,7 +5,9 @@
   <!-- 🖼️ PROJECT LOGO — created and ready to display -->
   <img src="assets/logos/vanguard-frontier-agentic-logo.png" alt="Vanguard Frontier Agentic" width="220" />
 
-  <p><strong>A curated marketplace for cloud and zero-trust AI workflows.</strong></p>
+  <p><strong>The vanguard frontier of the agentic world — an enterprise-grade ecosystem for AI agents at scale.</strong></p>
+
+  <p><em>Agentic coordination, routing, protocol, and escalation for high-stakes environments. Battle-hardened. Audit-ready by design.</em></p>
 
   <p>
     <a href="https://www.npmjs.com/package/@raishin/vanguard-frontier-agentic"><img alt="npm version" src="https://img.shields.io/npm/v/@raishin/vanguard-frontier-agentic.svg?logo=npm" /></a>
@@ -19,6 +21,8 @@
   </p>
 
   <p>
+    <a href="#why-vanguard-frontier">Why Vanguard Frontier</a> &nbsp;·&nbsp;
+    <a href="#whats-inside">What's Inside</a> &nbsp;·&nbsp;
     <a href="#get-started">Get Started</a> &nbsp;·&nbsp;
     <a href="#install-reference">Install Reference</a> &nbsp;·&nbsp;
     <a href="#skills">Skills</a> &nbsp;·&nbsp;
@@ -34,10 +38,16 @@
 
 ---
 
-This repo collects reusable **skills**, **agents**, **rules**, **MCP references**,
-and supporting assets for engineers working with AWS, Azure, OCI, GCP,
-Alibaba Cloud, Huawei Cloud, Kubernetes, Terraform, cloud security,
-and compliance-heavy architecture.
+This is the **edge of agentic intelligence** — an enterprise-grade ecosystem for
+running AI agents at scale in environments where a wrong move is a board-level
+incident. It collects reusable **skills**, **agents**, **rules**, **MCP references**,
+and supporting assets for AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud,
+Kubernetes, and Terraform — plus a **cross-functional Legal + HR agentic ecosystem**.
+
+This is **not** just cloud infrastructure tooling. It is **agentic coordination**:
+maestro routing, escalation-aware protocol, structured handoff between specialists,
+and refusal-by-default safety on every irreversible action. Cloud is one domain it
+operates in. Coordination, governance, and escalation are the product.
 
 ## 📊 Catalog at a glance
 
@@ -45,10 +55,10 @@ and compliance-heavy architecture.
 <!-- Generated by scripts/generate-readme-counts.mjs — do not edit by hand. Run: npm run readme-counts:write -->
 | Catalog | Count |
 | --- | --- |
-| Skills | 359 |
-| Agents | 358 |
-| Providers | 28 |
-| Install roles | 18 |
+| Skills | 374 |
+| Agents | 396 |
+| Providers | 31 |
+| Install roles | 20 |
 | Rules | 1 |
 | MCP references | 3 |
 <!-- readme-counts:end -->
@@ -74,9 +84,80 @@ and compliance-heavy architecture.
 
 ---
 
+## 🛰️ Why Vanguard Frontier?
+
+<a id="why-vanguard-frontier"></a>
+
+"Vanguard frontier" is not branding — it is an operating posture. This ecosystem
+is built for the front line of agentic deployment, where AI agents touch real
+production systems, real regulated data, and real legal exposure.
+
+- **🏛️ Built for Fortune 50 / high-stakes environments.** Every agent assumes
+  the blast radius is enterprise-scale: regulated data, audited controls, and
+  decisions that survive legal discovery. Refusal-by-default beats a fast path
+  to a board-level incident.
+- **⚖️ The Legal + HR ecosystem is proof of cross-functional agentic
+  coordination.** 28 specialist agents (Legal maestro + 12 specialists, HR
+  maestro + 14 specialists) and 3 cross-functional protocol skills demonstrate
+  that agents can hand off, escalate, and coordinate across organizational
+  boundaries — not just answer in isolation.
+- **🧾 Audit-ready, privacy-preserving, escalation-aware by design.** Every
+  review and live-guard agent emits a structured verdict (`verdict`,
+  `evidence_level`, `blockers`, `safe_next_actions`, `open_questions`) that maps
+  directly to SOC 2, PCI DSS, NIS2, NIST CSF, and ISO 27001 — no post-processing.
+- **🛡️ Battle-tested against real compliance, governance, and risk workflows.**
+  These patterns are exercised against live IAM mutations, KMS destruction,
+  litigation holds, RIF planning, and privacy reviews — the workflows where a
+  generic agent gets an organization sued.
+
+> **The bar:** an auditor, a regulator, or opposing counsel should be able to
+> read the agent's output and trace exactly who decided what, on what evidence,
+> and who approved the risk.
+
+---
+
+## 🧱 What's Inside — the three-layer agentic architecture
+
+<a id="whats-inside"></a>
+
+Vanguard Frontier is not a flat bag of prompts. It is a deliberate three-layer
+system, and every domain — cloud providers, Kubernetes, marketing, Legal, HR —
+follows the same shape.
+
+| Layer | Role | Examples |
+| ----- | ---- | -------- |
+| **1. 🧭 Maestro (router)** | Entry point. Classifies the request, routes to the right specialist, never executes risk itself. | `legal-maestro-agent`, `hr-maestro-agent`, `kubernetes-maestro-agent`, provider maestros |
+| **2. 🤖 Specialists** | Domain experts with judgment and a hardened permission model. Each loads one companion skill and emits a guarded verdict. | 13 Legal specialists, 15 HR specialists, cloud advisory + live-guard operators |
+| **3. 🔗 Cross-functional protocol** | Shared contracts that let specialists hand off, escalate, and coordinate across organizational boundaries without leaking scope. | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` |
+
+**How it flows:** a request enters at the **maestro**, which routes to a
+**specialist**. When a matter crosses a boundary — an HR investigation that
+needs privileged Legal review, or a Legal hold that triggers an HR data freeze —
+the **cross-functional protocol** carries a structured case capsule between
+agents, preserving privilege, minimizing data, and recording the escalation path.
+
+This is what "agentic coordination" means here: routing, protocol, and
+escalation are first-class, not improvised.
+
+---
+
 ## 🚀 Get Started
 
-Pick the install path for your coding agent. Each dropdown is one-click plug-and-play where the harness supports it; the npm/export path works for everything else.
+Pick the install path for your coding agent. Each dropdown is crystal-clear, step-by-step, and one-click plug-and-play where the harness supports it; the npm/export path works for everything else.
+
+**At a glance — which path is yours:**
+
+| Your harness | Fastest path | One-liner |
+| ------------ | ------------ | --------- |
+| 🤖 Claude Code | Plugin marketplace | `/plugin marketplace add Raishin/vanguard-frontier-agentic` |
+| 🐙 GitHub Copilot CLI | Plugin marketplace | `copilot plugin marketplace add Raishin/vanguard-frontier-agentic` |
+| 🖱️ Cursor | Clone + register plugin dir | `git clone …` then **Settings → Plugins → Add Plugin Directory** |
+| ⚡ Codex | Plugin marketplace | `codex plugin marketplace add Raishin/vanguard-frontier-agentic` |
+| ♊ Gemini / Antigravity | npm export | `npx vfa-export-agents --platform gemini --all --repo .` |
+| 🔮 Kiro | Add Powers per-directory | Powers panel → **Add Custom Power → Local Directory** |
+| 📦 Any other | npm + `vfa-export-agents` CLI | `npm install @raishin/vanguard-frontier-agentic@latest` |
+
+Expand the matching dropdown below for the full step-by-step.
 
 <details>
 <summary><strong>🤖 Claude Code (Anthropic)</strong> &nbsp;—&nbsp; <em>one-command plugin install</em></summary>
@@ -105,7 +186,7 @@ Or wire it into `~/.claude/settings.json` (or your project's `.claude/settings.j
 
 Pin to a tag for reproducible installs: `Raishin/vanguard-frontier-agentic@v1.7.1`.
 
-- **Bundled:** all <!-- count:agents -->358<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
+- **Bundled:** all <!-- count:agents -->396<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
 - **Spec:** [`.claude-plugin/marketplace.json`](.claude-plugin/marketplace.json) + [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) (canonical Claude Code plugin layout)
 - **Not bundled:** skills, rules, MCP references — use the npm path for those
 - **Docs:** [code.claude.com/docs/en/plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces)
@@ -135,7 +216,7 @@ Or in `.github/copilot/settings.json` for repo-wide trust:
 
 - **Marketplace manifest:** [`.github/plugin/marketplace.json`](.github/plugin/marketplace.json) declares this repo as a single-plugin marketplace
 - **Source path:** `./` (the repo root is the plugin root)
-- **Bundled:** <!-- count:agents -->358<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
+- **Bundled:** <!-- count:agents -->396<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
 - **Docs:** [github.com/github/copilot-cli](https://github.com/github/copilot-cli) (`/plugin marketplace add`)
 
 </details>
@@ -156,7 +237,7 @@ In Cursor: **Settings → Plugins → Add Plugin Directory** → pick the cloned
 vscode.cursor.plugins.registerPath("/absolute/path/to/vanguard-frontier-agentic");
 ```
 
-- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->358<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
+- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->396<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
 - **Bundled:** all agents from `agents/<provider>/<agent>/harnesses/cursor.agent.md`
 - **Rules:** existing `rules/` directory at repo root is auto-discovered by Cursor
 - **Docs:** [cursor.com/docs/plugins](https://cursor.com/docs/plugins) · [cursor.com/docs/reference/plugins](https://cursor.com/docs/reference/plugins)
@@ -247,7 +328,7 @@ enabled = true
 - **Bundled plugins:**
   - `vanguard-frontier-agentic` — the main plugin, manifest at [`plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json`](plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json)
   - `cross-platform-agent-template` — scaffold for new cross-platform agents
-- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->358<!-- /count --> agent adapters into your repo
+- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->396<!-- /count --> agent adapters into your repo
 - **Other commands:** `codex plugin marketplace upgrade vanguard-frontier-agentic`, `codex plugin marketplace remove vanguard-frontier-agentic`
 - **Docs:** [github.com/openai/codex](https://github.com/openai/codex) · [Codex plugin spec](https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md)
 
@@ -289,7 +370,7 @@ npm install @raishin/vanguard-frontier-agentic@latest
 
 ## 🧠 Skills
 
-**<!-- count:skills -->359<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
+**<!-- count:skills -->374<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
 
 | Domain             | Count | What they cover                                                                                   |
 | ------------------ | ----: | ------------------------------------------------------------------------------------------------- |
@@ -385,30 +466,54 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 
 ## 🤖 Agents
 
-**<!-- count:agents -->358<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
+**<!-- count:agents -->396<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
 
 | Provider           | Count | Specialisations                                                                     |
 | ------------------ | ----: | ----------------------------------------------------------------------------------- |
-| 🟧 AWS              |    47 | advisory, execution, live-guard operators                                           |
-| 🟥 OCI              |    39 | advisory, live-guard operators                                                      |
 | 🟩 GCP              |    51 | advisory, live-guard operators, maestro router                                      |
-| 🟦 Azure            |    36 | advisory, live-guard operators                                                      |
+| 🟧 AWS              |    47 | advisory, execution, live-guard operators                                           |
 | 🟠 Alibaba Cloud    |    43 | advisory, live-guard operators, maestro router                                      |
 | 🔴 Huawei Cloud     |    43 | advisory, live-guard operators, maestro router                                      |
+| 🟥 OCI              |    39 | advisory, live-guard operators                                                      |
+| 🟦 Azure            |    36 | advisory, live-guard operators                                                      |
+| ☸️ Kubernetes       |    15 | RBAC review, workload identity, PSA, 5 live-guard operators, maestro router         |
 | ☁️ OVHcloud         |     6 | advisory, live KMS guard, maestro router                                            |
 | 🌐 IONOS Cloud      |     6 | advisory, live DB lifecycle guard, maestro router                                   |
 | 🇫🇷 Scaleway        |     6 | advisory, live Kapsule rollout guard, maestro router                                |
 | 🇩🇪 Hetzner Cloud   |     6 | advisory, live firewall + server lifecycle guards, maestro router                   |
 | 💰 Contabo          |     6 | advisory, live instance + storage guards, maestro router                            |
-| ☸️ Kubernetes       |    15 | RBAC review, workload identity, PSA, 5 live-guard operators, maestro router         |
 | 🛡️ Kyverno          |     1 | Admission policy review                                                             |
 | 🔄 Argo CD          |     2 | GitOps review, live sync guard                                                      |
 | 🕸️ Istio            |     1 | Ambient mesh review                                                                 |
 | 🐝 Cilium           |     1 | Network policy review                                                               |
 | 📡 OpenTelemetry    |     1 | Collector config review                                                             |
-| 💰 Multi-cloud      |     1 | FinOps Cloud Price Advisor                                                          |
+| 💡 Backstage        |     1 | IDP scaffolder review                                                               |
+| 🔐 cert-manager     |     1 | PKI certificate lifecycle review                                                    |
+| 🦅 Falco            |     1 | runtime threat detection review                                                     |
+| 🔁 Flux CD          |     1 | GitOps Kustomization/HelmRelease review                                             |
+| 📊 Prometheus       |     1 | alerting and cardinality review                                                     |
+| 🔏 Sigstore         |     1 | supply-chain security review                                                        |
 | 🟩 Terraform        |     2 | IaC review, maestro                                                                 |
+| 💸 FinOps           |     4 | cross-cloud price advisor + experimental cost/economics agents                      |
+| 🟣 .NET             |    10 | C#/runtime, ASP.NET Core API & identity, EF Core data access, testing, NuGet supply chain, performance/AOT, OpenTelemetry, Aspire — static-review specialists + maestro router |
+| 🟤 NVIDIA           |    12 | CUDA/GPU infrastructure, TensorRT/TensorRT-LLM, Triton serving, NeMo/NIM generative AI, agentic-AI platform, NGC supply chain, AI networking fabric, day-2 operations, GPU Operator on Kubernetes, model promotion gatekeeper — advisory + live-runtime gate + maestro router |
 | 📣 Marketing        |    14 | 13 governance review agents + maestro router                                        |
+| ⚖️ Legal            |    13 | contract review, employment law risk, privacy & data protection, regulatory compliance, IP & open source, litigation & discovery hold, ethics & investigations, vendor/procurement risk, policy governance, public disclosure, counsel review, knowledge management |
+| 👥 HR               |    15 | employee relations, workplace investigations, performance management, compensation & equity, benefits & payroll, recruiting & selection, workforce planning & RIF, leave & accommodation, learning policy, culture & DEI, people analytics, HRIS process controls, termination readiness, risk triage |
+| 🧪 QA               |    10 | Playwright E2E review + execution, flakiness triage, coverage quality, CI test pipeline review, PLC control-logic safety, RPA workflow resilience — static-review + opt-in execution |
+| 🔗 Cross-functional skills |     3 | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` (protocol skills, not agents) |
+
+### ⚖️ The Legal + HR cross-functional agentic ecosystem
+
+Beyond cloud and platform agents, Vanguard Frontier ships a **28-agent cross-functional Legal + HR ecosystem** plus **3 cross-functional protocol skills** — proof that agentic coordination works across organizational boundaries, not just inside one cloud account.
+
+Every Legal and HR agent is **escalation-aware** (knows when a matter must go to privileged counsel or a human owner), **privacy-preserving** (minimizes personal and sensitive data in every handoff), and **audit-ready** (emits the same structured verdict shape as the cloud live-guard agents). These agents advise on process and risk posture — they **do not** replace licensed legal counsel or qualified HR professionals, and they say so.
+
+### 🟣 The .NET application review board
+
+.NET is a free, cross-platform, open-source developer platform — runtime, libraries, and languages (C# is the most popular) — with ASP.NET Core as its lean, modular framework for modern cloud-based web services and EF Core as its lightweight, extensible data-access layer. The board is a `dotnet-maestro` router plus nine **static-review** specialists covering C#/runtime correctness, ASP.NET Core API architecture, identity and authorization, EF Core data access, test quality, CI/NuGet supply chain, performance/AOT/trimming, in-app OpenTelemetry wiring, and .NET Aspire cloud-native readiness — every agent reads source and sanitized configuration only and never builds, runs, migrates, or contacts a live system. These agents use `provider: generic` with a `dotnet-` ID prefix because .NET is a language/runtime, not a cloud provider — mirroring the existing non-cloud boards.
+
+---
 
 Every agent ships:
 - 📄 `AGENT.md` — harness-neutral contract with guarded response shape
@@ -417,33 +522,37 @@ Every agent ships:
 
 ```text
 agents/
-├── aws/              (47 agents)
 ├── alibaba/          (43 agents — advisory, live-guard operators, maestro)
 ├── argocd/           (2 agents — GitOps review, live sync guard)
-├── azure/            (36 agents)
+├── aws/              (47 agents — advisory, execution, live-guard operators)
+├── azure/            (36 agents — advisory, live-guard operators)
 ├── backstage/        (1 agent — IDP scaffolder review)
-├── cert-manager/     (1 agent — PKI cert lifecycle review)
+├── cert-manager/     (1 agent — PKI certificate lifecycle review)
 ├── cilium/           (1 agent — network policy review)
 ├── contabo/          (6 agents — advisory, live instance + storage guards, maestro)
-├── falco/            (1 agent — runtime threat detection)
-├── finops/           (1 agent — cross-cloud price advisor)
+├── dotnet/           (10 agents — C#/runtime, ASP.NET Core, EF Core, testing, NuGet supply chain, performance/AOT, OpenTelemetry, Aspire — maestro + 9 specialists)
+├── falco/            (1 agent — runtime threat detection review)
+├── finops/           (4 agents — cross-cloud price advisor + experimental cost/economics agents)
 ├── fluxcd/           (1 agent — GitOps Kustomization/HelmRelease review)
 ├── gcp/              (51 agents — advisory, live-guard operators, maestro)
 ├── hetzner/          (6 agents — advisory, live firewall + server lifecycle guards, maestro)
+├── hr/               (15 agents — employee relations, investigations, performance, compensation, benefits, recruiting, workforce planning, learning, culture & DEI, analytics, HRIS, termination readiness, maestro)
 ├── huawei/           (43 agents — advisory, live-guard operators, maestro)
 ├── ionos/            (6 agents — advisory, live DB lifecycle guard, maestro)
 ├── istio/            (1 agent — ambient mesh review)
 ├── kubernetes/       (15 agents — RBAC, workload identity, PSA, pod-spec, ESO, Kubecost, live-guards, maestro)
 ├── kyverno/          (1 agent — admission policy review)
+├── legal/            (13 agents — contract review, employment law, privacy & data protection, regulatory compliance, IP & open source, litigation hold, ethics & investigations, vendor risk, policy governance, public disclosure, counsel review, knowledge management)
 ├── marketing/        (14 agents — 13 governance review agents + maestro router)
-├── oci/              (39 agents)
+├── nvidia/           (12 agents — GPU infrastructure, TensorRT/TensorRT-LLM, Triton serving, NeMo/NIM, agentic AI, NGC supply chain, AI networking, day-2 ops, GPU Operator on Kubernetes, model promotion gatekeeper — maestro + advisory + live-runtime gate)
+├── oci/              (39 agents — advisory, live-guard operators)
 ├── opentelemetry/    (1 agent — collector config review)
 ├── ovhcloud/         (6 agents — advisory, live KMS guard, maestro)
 ├── prometheus/       (1 agent — alerting and cardinality review)
+├── qa/               (10 agents — Playwright E2E review + execution, flakiness triage, coverage quality, CI pipeline review, PLC control-logic safety, RPA workflow resilience)
 ├── scaleway/         (6 agents — advisory, live Kapsule rollout guard, maestro)
-├── sigstore/         (1 agent — supply chain security)
-├── terraform/        (2 agents)
-└── velero/           (1 agent — backup and restore)
+├── sigstore/         (1 agent — supply-chain security review)
+└── terraform/        (2 agents — IaC review, maestro)
 ```
 
 Example:
@@ -995,7 +1104,7 @@ In two weeks on npm: ~900 downloads. Socket.dev scores: Vulnerability 100, Quali
 
 Your sponsorship directly funds the compute, API time, and research hours that turn new cloud providers, compliance frameworks, and security patterns into production-ready agents — free for everyone.
 
-Current catalog: **<!-- count:agents -->358<!-- /count --> agents · <!-- count:skills -->359<!-- /count --> skills · <!-- count:providers -->28<!-- /count --> cloud/platform providers**
+Current catalog: **<!-- count:agents -->396<!-- /count --> agents · <!-- count:skills -->374<!-- /count --> skills · <!-- count:providers -->31<!-- /count --> cloud/platform providers**
 
 ---
 

package/agents/README.md

@@ -1,8 +1,53 @@
 # Agents
 
-Role definitions for repeatable review, architecture, operations, and bounded execution work.
+Role definitions for repeatable review, architecture, operations, and bounded execution work. **386 enterprise-grade, audit-ready agents** organized in a three-layer ecosystem: maestro routers, domain specialists, and cross-functional protocols.
 
-## Provider catalog
+## Three-layer agentic architecture
+
+Every domain in Vanguard Frontier — cloud providers, Kubernetes, compliance, and business functions (Legal, HR, Marketing) — follows the same deliberate three-layer structure:
+
+| Layer | Role | Examples | Principle |
+| ----- | ---- | -------- | --------- |
+| **1. 🧭 Maestro (router)** | Entry point. Classifies requests, routes to specialists, never executes risk itself. | `legal-maestro-agent`, `hr-maestro-agent`, GCP maestro, AWS maestro, Kubernetes maestro | **Separation of concerns.** Routing is a recommendation; humans confirm. |
+| **2. 🤖 Specialists** | Domain experts with hardened permission models and guarded verdict shapes. Each loads companion skills and emits structured risk analysis. | 13 Legal specialists, 15 HR specialists, 47 AWS advisory agents, 15 Kubernetes agents | **Judgment + guardrails.** Specialists analyze; they do not authorize. |
+| **3. 🔗 Cross-functional protocol** | Shared contracts for handoff, escalation, and coordination across boundaries without leaking scope or privilege. | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` | **Auditability.** Every handoff is traceable; privilege is preserved. |
+
+**How it flows:** a request enters at the **maestro**, which routes to a **specialist**. When a matter crosses a domain boundary — an HR investigation that needs legal review, or a data breach that triggers compliance — the **cross-functional protocol** carries a structured, redacted payload (case capsule) between agents while preserving privilege and recording the escalation path.
+
+---
+
+## Business-function agents — the cross-domain ecosystem
+
+Beyond cloud infrastructure, Vanguard Frontier ships agents for Legal, HR, Marketing, QA/CI-CD, and FinOps — proof that agentic coordination works across organizational boundaries, not just inside one cloud account.
+
+| Domain | Agents | Maestro | Key specialisations | README |
+| ------ | ------: | ------- | ------------------- | ------ |
+| ⚖️ **Legal** | 13 | `legal-maestro-agent` | Contract review, employment law risk, privacy & data protection, regulatory compliance, IP & open source, litigation & discovery, ethics & investigations, vendor/procurement risk, policy governance, public disclosure, knowledge management | [`legal/README.md`](legal/README.md) |
+| 👥 **HR** | 15 | `hr-maestro-agent` | Employee relations, workplace investigations, performance management, compensation & equity, benefits & payroll, recruiting & selection, workforce planning & RIF, leave & accommodation, learning policy, culture & DEI, people analytics, HRIS process controls, termination readiness, risk triage | [`hr/README.md`](hr/README.md) |
+| 🔗 **Cross-functional protocol** | 3 skills | — | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` | [`skills/cross-functional/`](/skills/cross-functional/) |
+| 📣 **Marketing** | 14 | `marketing-maestro-agent` | Governance review, compliance, brand, messaging, regulatory alignment | [`marketing/README.md`](marketing/README.md) |
+| 🧪 **QA / CI-CD** | 10+ agents | — | Test coverage, E2E execution, flakiness triage, CI pipeline review, deployment gates | [`qa/`](qa/) |
+| 💰 **FinOps** | 1 | — | Cross-cloud cost optimization, AI economics modeling, Kubernetes rightsizing | [`finops/README.md`](finops/README.md) |
+
+### Core example — the Legal + HR ecosystem
+
+The **Legal + HR ecosystem is the proof of concept** for cross-functional agentic coordination. Here's why it matters:
+
+- **28 specialist agents** (13 Legal + 15 HR, each with a maestro router) handle the most legally exposed, audit-heavy, escalation-aware domains in an organization
+- **3 cross-functional protocol skills** (`legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy`) define how agents hand off, escalate, and coordinate across organizational boundaries
+- **Real handoff scenarios:** whistleblower reports → both Legal (privilege) and HR (investigation) own it; wrongful-termination exposure → Legal flags risk, HR confirms readiness before execution; data breach → Legal holds, HR freezes personnel actions
+- **Audit-ready design:** every handoff is logged; every escalation has a named decision owner; every irreversible action routes to a human
+- **No legal or HR advice:** these agents do NOT replace licensed counsel or qualified HR professionals. They triage, analyze, and escalate. All outputs are inputs for human review.
+
+See [`legal/README.md`](legal/README.md), [`hr/README.md`](hr/README.md), and [`docs/architecture/legal-hr-agent-routing.md`](/docs/architecture/legal-hr-agent-routing.md) for details.
+
+---
+
+## Cloud provider agents — organized by execution tier
+
+Vanguard Frontier's cloud agent portfolios are organized by execution tier: advisory (read-only), execution (workspace-write), and live operators (guarded cloud mutations).
+
+### Provider catalog
 
 | Provider | Current status | Agents | Notes |
 | --- | --- | ---: | --- |

package/agents/dotnet/README.md

@@ -0,0 +1,57 @@
+# .NET Agents
+
+Role-based agent board for reviewing **.NET / C#** codebases — ASP.NET Core,
+EF Core, identity and authorization, testing, supply chain, performance, and
+cloud-native posture.
+
+## Taxonomy note
+
+`.NET` is a language/runtime, not a cloud provider, but it is a shipped topical
+board and therefore has its own dedicated `provider` value: every asset uses
+`provider: dotnet` with a shared `dotnet-` ID prefix. This mirrors the other
+non-cloud topical boards (`hr`, `legal`, `marketing`), each of which carries
+its own `provider` value. See `docs/taxonomy.md` and
+`docs/language-stack-boards.md`.
+
+## Agent tiers
+
+| Tier | Purpose | Default access | Live execution |
+|---|---|---|---|
+| Router | Classifies a .NET task and dispatches the narrowest specialist set | read-only | not allowed |
+| Review agents | Audit C#, ASP.NET Core, EF Core, tests, CI/NuGet, performance, telemetry, and Aspire posture | read-only | not allowed |
+
+Every agent in this board is **static-review** — it reads source and sanitized
+configuration only. No agent runs `dotnet build`, `dotnet test`, `dotnet ef`,
+contacts a live system, mutates a NuGet feed, or edits project files.
+
+## Router
+
+| Agent | Primary use |
+|---|---|
+| `dotnet-maestro-agent` | Classify a .NET task; dispatch one specialist (focused) or a parallel team of up to four (multi-domain). Routes only — never answers .NET questions itself. |
+
+## Review agents
+
+| Agent | Primary use | Must refuse when |
+|---|---|---|
+| `dotnet-csharp-runtime-review-agent` | C#/runtime correctness: nullable reference types, async/await, cancellation, disposal, allocations, AOT/trim hazards | asked to compile or run code |
+| `dotnet-aspnetcore-api-review-agent` | ASP.NET Core API architecture: middleware order, DI lifetimes, CORS, validation, versioning, health boundaries | asked to run the app or call endpoints |
+| `dotnet-aspnetcore-identity-authz-review-agent` | Authentication, authorization, token validation, cookie/session security, tenant isolation | asked for secrets, signing keys, or tokens |
+| `dotnet-efcore-data-access-review-agent` | EF Core: DbContext lifetime, N+1, raw SQL safety, concurrency tokens, migrations, multi-tenant query filters | asked for a connection string or to run migrations |
+| `dotnet-testing-quality-review-agent` | .NET test quality: assertion-free tests, over-mocking, coverage theater, isolation, missing negative tests | asked to run the suite or a coverage tool |
+| `dotnet-supply-chain-review-agent` | .NET CI/CD and NuGet supply chain: SDK pinning, package locking, feed trust, fork-PR secret exposure, vulnerability scanning | asked for CI secrets or feed credentials |
+| `dotnet-performance-aot-review-agent` | Performance, Native AOT, and trimming readiness — evidence-gated on benchmark artifacts | asked to accept a perf claim with no benchmark |
+| `dotnet-observability-otel-review-agent` | ASP.NET Core OpenTelemetry wiring, structured logging, trace propagation, PII in telemetry | asked to design Collector/backend infrastructure |
+| `dotnet-aspire-cloud-native-review-agent` | .NET Aspire AppHost and service-defaults review for cloud-native readiness | asked to treat Aspire as the production runtime |
+
+## Operating notes
+
+- Sync-over-async on a request path, a swallowed `catch {}`, disabled JWT
+  validation, an interpolated raw SQL string, a missing multi-tenant query
+  filter, and a fork-PR secret exposure are the highest-impact defects this
+  board exists to catch.
+- The observability agent is scoped to **in-application** OpenTelemetry wiring.
+  Collector topology, exporters, and dashboard infrastructure belong to the
+  `opentelemetry` provider board — route there.
+- A performance claim with no `BenchmarkDotNet` artifact is downgraded to
+  `inference` and flagged; "it's faster" is not evidence.