@raishin/vanguard-frontier-agentic 2.10.0 → 2.13.0

package/.claude-plugin/marketplace.json

@@ -6,13 +6,13 @@
   },
   "metadata": {
     "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
-    "version": "2.9.0"
+    "version": "2.13.0"
   },
   "plugins": [
     {
       "name": "vanguard-frontier-agentic",
       "source": "./",
-      "description": "All 473 cloud, security, compliance, platform, accounting, and finance agents in one install. Includes maestros, advisory reviewers, and live-mutation guards across 35 providers.",
+      "description": "All 559 cloud, security, compliance, platform, accounting, and finance agents in one install. Includes maestros, advisory reviewers, and live-mutation guards across 39 providers.",
       "category": "cloud",
       "tags": [
         "agents",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.9.0",
+  "version": "2.13.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "Raishin",
@@ -178,6 +178,9 @@
     "./agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/claude-code.agent.md",
     "./agents/contabo/contabo-maestro-agent/harnesses/claude-code.agent.md",
     "./agents/contabo/contabo-security-hardening-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-lakehouse-engineering-at-azure-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-live-unity-catalog-grant-guard-at-azure-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-unity-catalog-governance-at-azure-agent/harnesses/claude-code.agent.md",
     "./agents/dotnet/dotnet-aspire-cloud-native-review-agent/harnesses/claude-code.agent.md",
     "./agents/dotnet/dotnet-aspnetcore-api-review-agent/harnesses/claude-code.agent.md",
     "./agents/dotnet/dotnet-aspnetcore-identity-authz-review-agent/harnesses/claude-code.agent.md",
@@ -367,6 +370,46 @@
     "./agents/marketing/marketing-pixel-data-leakage-review-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/martech-access-governance-review-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/programmatic-supply-chain-integrity-review-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/copilot-governance-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/copilot-studio-agent-governance-alm-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-commerce-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-customer-insights-journeys-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-customer-service-contact-center-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-data-migration-cutover-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-field-service-to-cash-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-finance-close-to-report-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-fno-developer-extension-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-integration-dual-write-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-live-record-field-update-guard-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-live-security-role-guard-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-project-operations-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-sales-revenue-operations-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-security-sod-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-success-by-design-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/d365-supply-chain-plan-to-produce-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/fabric-analytics-engineering-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/fabric-data-engineering-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/fabric-power-bi-business-insights-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-backup-bcdr-data-resilience-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-copilot-readiness-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-defender-xdr-security-operations-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-exchange-sharepoint-information-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-identity-zero-trust-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-intune-endpoint-management-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-licensing-ea-optimization-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-live-identity-posture-guard-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-live-sensitivity-label-apply-guard-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-purview-data-security-compliance-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-teams-collaboration-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/m365-tenant-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/microsoft-business-impact-value-realization-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/microsoft-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/power-automate-automation-risk-review-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/power-platform-alm-pipelines-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/power-platform-governance-dataverse-security-agent/harnesses/claude-code.agent.md",
+    "./agents/microsoft/power-platform-maestro-agent/harnesses/claude-code.agent.md",
     "./agents/netsuite/netsuite-administrator-agent/harnesses/claude-code.agent.md",
     "./agents/netsuite/netsuite-ai-connector-mcp-agent/harnesses/claude-code.agent.md",
     "./agents/netsuite/netsuite-ai-foundations-agent/harnesses/claude-code.agent.md",
@@ -491,6 +534,46 @@
     "./agents/salesforce/salesforce-service-field-service-agent/harnesses/claude-code.agent.md",
     "./agents/salesforce/salesforce-session-governance-agent/harnesses/claude-code.agent.md",
     "./agents/salesforce/salesforce-slack-collaboration-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-abap-cloud-rap-reviewer-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-ai-core-genai-hub-governance-reviewer-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-analytics-cloud-planning-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-audit-evidence-packager-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-btp-account-entitlement-governance-reviewer-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-btp-entitlement-guarded-operator-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-cap-architecture-reviewer-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-clean-core-debt-reviewer-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-cloud-alm-sre-incident-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-custom-code-remediation-reviewer-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-data-migration-cutover-readiness-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-datasphere-data-product-architect-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-ewm-tm-logistics-execution-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-finance-fico-controls-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-fiori-ui5-ux-reviewer-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-guarded-transport-import-operator-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-hana-cloud-performance-cost-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-hypercare-incident-commander-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-integration-flow-guarded-operator-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-integration-suite-reviewer-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-joule-governance-adoption-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-license-btp-consumption-finops-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-live-readonly-identity-trust-discovery-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-live-readonly-landscape-discovery-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-manufacturing-execution-risk-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-mdg-master-data-quality-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-order-to-cash-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-procurement-ariba-value-leakage-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-release-change-collision-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-rise-sla-vendor-risk-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-role-assignment-guarded-operator-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-s4hana-transformation-architect-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-security-iam-grc-sod-reviewer-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-signavio-process-mining-value-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-successfactors-hr-process-risk-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-supply-chain-ibp-resilience-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-testing-quality-gate-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-transformation-portfolio-triage-agent/harnesses/claude-code.agent.md",
+    "./agents/sap/sap-treasury-cash-risk-agent/harnesses/claude-code.agent.md",
     "./agents/scaleway/scaleway-cost-optimizer-agent/harnesses/claude-code.agent.md",
     "./agents/scaleway/scaleway-iam-policy-review-agent/harnesses/claude-code.agent.md",
     "./agents/scaleway/scaleway-kapsule-platform-operator-agent/harnesses/claude-code.agent.md",
@@ -498,6 +581,9 @@
     "./agents/scaleway/scaleway-maestro-agent/harnesses/claude-code.agent.md",
     "./agents/scaleway/scaleway-network-architect-agent/harnesses/claude-code.agent.md",
     "./agents/sigstore/sigstore-cosign-supply-chain-review-agent/harnesses/claude-code.agent.md",
+    "./agents/snowflake/snowflake-data-platform-engineering-at-azure-agent/harnesses/claude-code.agent.md",
+    "./agents/snowflake/snowflake-live-rbac-grant-guard-at-azure-agent/harnesses/claude-code.agent.md",
+    "./agents/snowflake/snowflake-rbac-access-governance-at-azure-agent/harnesses/claude-code.agent.md",
     "./agents/terraform/terraform-maestro-agent/harnesses/claude-code.agent.md",
     "./agents/terraform/terraform-reviewer/harnesses/claude-code.agent.md"
   ]

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.9.0",
+  "version": "2.13.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "Raishin",
@@ -177,6 +177,9 @@
     "./agents/contabo/contabo-live-storage-operations-guard-agent/harnesses/cursor.agent.md",
     "./agents/contabo/contabo-maestro-agent/harnesses/cursor.agent.md",
     "./agents/contabo/contabo-security-hardening-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-lakehouse-engineering-at-azure-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-live-unity-catalog-grant-guard-at-azure-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-unity-catalog-governance-at-azure-agent/harnesses/cursor.agent.md",
     "./agents/dotnet/dotnet-aspire-cloud-native-review-agent/harnesses/cursor.agent.md",
     "./agents/dotnet/dotnet-aspnetcore-api-review-agent/harnesses/cursor.agent.md",
     "./agents/dotnet/dotnet-aspnetcore-identity-authz-review-agent/harnesses/cursor.agent.md",
@@ -366,6 +369,46 @@
     "./agents/marketing/marketing-pixel-data-leakage-review-agent/harnesses/cursor.agent.md",
     "./agents/marketing/martech-access-governance-review-agent/harnesses/cursor.agent.md",
     "./agents/marketing/programmatic-supply-chain-integrity-review-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/copilot-governance-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/copilot-studio-agent-governance-alm-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-commerce-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-customer-insights-journeys-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-customer-service-contact-center-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-data-migration-cutover-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-field-service-to-cash-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-finance-close-to-report-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-fno-developer-extension-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-integration-dual-write-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-live-record-field-update-guard-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-live-security-role-guard-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-project-operations-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-sales-revenue-operations-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-security-sod-governance-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-success-by-design-governance-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/d365-supply-chain-plan-to-produce-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/fabric-analytics-engineering-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/fabric-data-engineering-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/fabric-power-bi-business-insights-governance-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-backup-bcdr-data-resilience-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-copilot-readiness-governance-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-defender-xdr-security-operations-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-exchange-sharepoint-information-governance-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-identity-zero-trust-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-intune-endpoint-management-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-licensing-ea-optimization-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-live-identity-posture-guard-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-live-sensitivity-label-apply-guard-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-purview-data-security-compliance-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-teams-collaboration-governance-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/m365-tenant-governance-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/microsoft-business-impact-value-realization-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/microsoft-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/power-automate-automation-risk-review-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/power-platform-alm-pipelines-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/power-platform-governance-dataverse-security-agent/harnesses/cursor.agent.md",
+    "./agents/microsoft/power-platform-maestro-agent/harnesses/cursor.agent.md",
     "./agents/netsuite/netsuite-administrator-agent/harnesses/cursor.agent.md",
     "./agents/netsuite/netsuite-ai-connector-mcp-agent/harnesses/cursor.agent.md",
     "./agents/netsuite/netsuite-ai-foundations-agent/harnesses/cursor.agent.md",
@@ -490,6 +533,46 @@
     "./agents/salesforce/salesforce-service-field-service-agent/harnesses/cursor.agent.md",
     "./agents/salesforce/salesforce-session-governance-agent/harnesses/cursor.agent.md",
     "./agents/salesforce/salesforce-slack-collaboration-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-abap-cloud-rap-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-ai-core-genai-hub-governance-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-analytics-cloud-planning-governance-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-audit-evidence-packager-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-btp-account-entitlement-governance-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-btp-entitlement-guarded-operator-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-cap-architecture-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-clean-core-debt-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-cloud-alm-sre-incident-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-custom-code-remediation-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-data-migration-cutover-readiness-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-datasphere-data-product-architect-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-ewm-tm-logistics-execution-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-finance-fico-controls-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-fiori-ui5-ux-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-guarded-transport-import-operator-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-hana-cloud-performance-cost-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-hypercare-incident-commander-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-integration-flow-guarded-operator-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-integration-suite-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-joule-governance-adoption-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-license-btp-consumption-finops-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-live-readonly-identity-trust-discovery-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-live-readonly-landscape-discovery-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-manufacturing-execution-risk-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-mdg-master-data-quality-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-order-to-cash-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-procurement-ariba-value-leakage-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-release-change-collision-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-rise-sla-vendor-risk-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-role-assignment-guarded-operator-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-s4hana-transformation-architect-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-security-iam-grc-sod-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-signavio-process-mining-value-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-successfactors-hr-process-risk-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-supply-chain-ibp-resilience-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-testing-quality-gate-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-transformation-portfolio-triage-agent/harnesses/cursor.agent.md",
+    "./agents/sap/sap-treasury-cash-risk-agent/harnesses/cursor.agent.md",
     "./agents/scaleway/scaleway-cost-optimizer-agent/harnesses/cursor.agent.md",
     "./agents/scaleway/scaleway-iam-policy-review-agent/harnesses/cursor.agent.md",
     "./agents/scaleway/scaleway-kapsule-platform-operator-agent/harnesses/cursor.agent.md",
@@ -497,6 +580,9 @@
     "./agents/scaleway/scaleway-maestro-agent/harnesses/cursor.agent.md",
     "./agents/scaleway/scaleway-network-architect-agent/harnesses/cursor.agent.md",
     "./agents/sigstore/sigstore-cosign-supply-chain-review-agent/harnesses/cursor.agent.md",
+    "./agents/snowflake/snowflake-data-platform-engineering-at-azure-agent/harnesses/cursor.agent.md",
+    "./agents/snowflake/snowflake-live-rbac-grant-guard-at-azure-agent/harnesses/cursor.agent.md",
+    "./agents/snowflake/snowflake-rbac-access-governance-at-azure-agent/harnesses/cursor.agent.md",
     "./agents/terraform/terraform-maestro-agent/harnesses/cursor.agent.md",
     "./agents/terraform/terraform-reviewer/harnesses/cursor.agent.md"
   ]

package/.github/plugin/marketplace.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/github/copilot-cli/main/schemas/marketplace.schema.json",
   "name": "vanguard-frontier-agentic",
   "description": "Curated marketplace for cloud, zero-trust, and compliance-aware AI workflows — agents, skills, and rules spanning cloud, security, ERP, and platform providers.",
-  "version": "2.10.0",
+  "version": "2.13.0",
   "owner": {
     "name": "Raishin",
     "url": "https://github.com/Raishin"

package/README.md

@@ -45,7 +45,8 @@ running AI agents at scale in environments where a wrong move is a board-level
 incident. It collects reusable **skills**, **agents**, **rules**, **MCP references**,
 and supporting assets for AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud,
 Kubernetes, and Terraform — plus cross-functional **Legal, HR, Marketing, Salesforce,
-.NET, FinOps, Accounting, Finance, and Oracle NetSuite ERP** agentic ecosystems.
+.NET, FinOps, Accounting, Finance, Oracle NetSuite ERP, Microsoft 365 / Dynamics 365, and Azure-ecosystem Databricks and Snowflake data-platform**
+agentic ecosystems.
 
 This is **not** just cloud infrastructure tooling. It is **agentic coordination**:
 maestro routing, escalation-aware protocol, structured handoff between specialists,
@@ -58,10 +59,10 @@ operates in. Coordination, governance, and escalation are the product.
 <!-- Generated by scripts/generate-readme-counts.mjs — do not edit by hand. Run: npm run readme-counts:write -->
 | Catalog | Count |
 | --- | --- |
-| Skills | 451 |
-| Agents | 473 |
-| Providers | 35 |
-| Install roles | 23 |
+| Skills | 558 |
+| Agents | 559 |
+| Providers | 39 |
+| Install roles | 30 |
 | Rules | 1 |
 | MCP references | 3 |
 <!-- readme-counts:end -->
@@ -189,7 +190,7 @@ Or wire it into `~/.claude/settings.json` (or your project's `.claude/settings.j
 
 Pin to a tag for reproducible installs: pick any [released tag](https://github.com/Raishin/vanguard-frontier-agentic/releases) for stable versions, or use `@latest` for the current release.
 
-- **Bundled:** all <!-- count:agents -->473<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
+- **Bundled:** all <!-- count:agents -->559<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
 - **Spec:** [`.claude-plugin/marketplace.json`](.claude-plugin/marketplace.json) + [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) (canonical Claude Code plugin layout)
 - **Not bundled:** skills, rules, MCP references — use the npm path for those
 - **Docs:** [code.claude.com/docs/en/plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces)
@@ -219,7 +220,7 @@ Or in `.github/copilot/settings.json` for repo-wide trust:
 
 - **Marketplace manifest:** [`.github/plugin/marketplace.json`](.github/plugin/marketplace.json) declares this repo as a single-plugin marketplace
 - **Source path:** `./` (the repo root is the plugin root)
-- **Bundled:** <!-- count:agents -->473<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
+- **Bundled:** <!-- count:agents -->559<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
 - **Docs:** [github.com/github/copilot-cli](https://github.com/github/copilot-cli) (`/plugin marketplace add`)
 
 </details>
@@ -240,7 +241,7 @@ In Cursor: **Settings → Plugins → Add Plugin Directory** → pick the cloned
 vscode.cursor.plugins.registerPath("/absolute/path/to/vanguard-frontier-agentic");
 ```
 
-- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->473<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
+- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->559<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
 - **Bundled:** all agents from `agents/<provider>/<agent>/harnesses/cursor.agent.md`
 - **Rules:** existing `rules/` directory at repo root is auto-discovered by Cursor
 - **Docs:** [cursor.com/docs/plugins](https://cursor.com/docs/plugins) · [cursor.com/docs/reference/plugins](https://cursor.com/docs/reference/plugins)
@@ -252,7 +253,7 @@ vscode.cursor.plugins.registerPath("/absolute/path/to/vanguard-frontier-agentic"
 
 <br>
 
-Kiro Powers UI is per-Power directory add — there is no single-command marketplace flow. This repo ships **35 Powers** under `powers/`, one per provider, so Kiro users can add only what they need.
+Kiro Powers UI is per-Power directory add — there is no single-command marketplace flow. This repo ships **38 Powers** under `powers/`, one per provider, so Kiro users can add only what they need.
 
 ```bash
 # 1. Clone this repo
@@ -267,7 +268,7 @@ cd vanguard-frontier-agentic
 #       /absolute/path/to/vanguard-frontier-agentic/powers/vanguard-terraform
 ```
 
-- **Powers available:** `vanguard-accounting`, `vanguard-alibaba`, `vanguard-argocd`, `vanguard-aws`, `vanguard-azure`, `vanguard-backstage`, `vanguard-cert-manager`, `vanguard-cilium`, `vanguard-contabo`, `vanguard-dotnet`, `vanguard-falco`, `vanguard-finance`, `vanguard-fluxcd`, `vanguard-gcp`, `vanguard-generic`, `vanguard-hetzner`, `vanguard-hr`, `vanguard-huawei`, `vanguard-ionos`, `vanguard-istio`, `vanguard-kubernetes`, `vanguard-kyverno`, `vanguard-legal`, `vanguard-marketing`, `vanguard-multi-cloud`, `vanguard-netsuite`, `vanguard-nvidia`, `vanguard-oci`, `vanguard-opentelemetry`, `vanguard-ovhcloud`, `vanguard-prometheus`, `vanguard-salesforce`, `vanguard-scaleway`, `vanguard-sigstore`, `vanguard-terraform`
+- **Powers available:** `vanguard-accounting`, `vanguard-alibaba`, `vanguard-argocd`, `vanguard-aws`, `vanguard-azure`, `vanguard-backstage`, `vanguard-cert-manager`, `vanguard-cilium`, `vanguard-contabo`, `vanguard-databricks`, `vanguard-dotnet`, `vanguard-falco`, `vanguard-finance`, `vanguard-fluxcd`, `vanguard-gcp`, `vanguard-generic`, `vanguard-hetzner`, `vanguard-hr`, `vanguard-huawei`, `vanguard-ionos`, `vanguard-istio`, `vanguard-kubernetes`, `vanguard-kyverno`, `vanguard-legal`, `vanguard-marketing`, `vanguard-microsoft`, `vanguard-multi-cloud`, `vanguard-netsuite`, `vanguard-nvidia`, `vanguard-oci`, `vanguard-opentelemetry`, `vanguard-ovhcloud`, `vanguard-prometheus`, `vanguard-salesforce`, `vanguard-scaleway`, `vanguard-sigstore`, `vanguard-snowflake`, `vanguard-terraform`
 - **Each Power ships:** routing pattern (maestro entry), live-mutation discipline, provider invariants (account-ID/region, MLPS 2.0, EU sovereignty, etc.)
 - **Frontmatter:** strict-5 fields (`name`, `displayName`, `description`, `keywords`, `author`) per Kiro spec
 - **For Kiro agent adapter files** (`.kiro/agents/*.md`, `.kiro/agents/*.json`): use the npm-export path below
@@ -331,7 +332,7 @@ enabled = true
 - **Bundled plugins:**
   - `vanguard-frontier-agentic` — the main plugin, manifest at [`plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json`](plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json)
   - `cross-platform-agent-template` — scaffold for new cross-platform agents
-- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->473<!-- /count --> agent adapters into your repo
+- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->559<!-- /count --> agent adapters into your repo
 - **Other commands:** `codex plugin marketplace upgrade vanguard-frontier-agentic`, `codex plugin marketplace remove vanguard-frontier-agentic`
 - **Docs:** [github.com/openai/codex](https://github.com/openai/codex) · [Codex plugin spec](https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md)
 
@@ -373,7 +374,7 @@ npm install @raishin/vanguard-frontier-agentic@latest
 
 ## 🧠 Skills
 
-**<!-- count:skills -->451<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
+**<!-- count:skills -->558<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
 
 | Domain             | Count | What they cover                                                                                   |
 | ------------------ | ----: | ------------------------------------------------------------------------------------------------- |
@@ -392,6 +393,9 @@ npm install @raishin/vanguard-frontier-agentic@latest
 | 🟩 Terraform        |     1 | IaC review and plan safety                                                                        |
 | 📣 Marketing        |    14 | Consent, pixel-leakage, martech access, GPC, email auth, ads.txt, targeting fairness, EU AI Act, audience uploads, list retention, influencer, dark patterns, analytics, maestro |
 | ☁️ Salesforce       |    25 | Org assessment, metadata review, permissions audit, Flow automation, Apex/LWC code review, release readiness, integration, marketing consent, Agentforce risk review, zero-trust maturity, DevSecOps pipeline, SOQL generation, Apex generation and test generation, operational T1/T2 runtime skills |
+| Ⓜ️ Microsoft 365 / D365 |    38 | Maestro routing (microsoft/m365/d365/Power Platform/Copilot), Entra Zero Trust & Conditional Access, Microsoft 365 Copilot readiness, Purview data security & compliance, Defender XDR SecOps, Intune endpoints, Teams collaboration, Exchange/SharePoint information governance, tenant governance, backup/BCDR & data resilience, licensing/EA optimization, Dataverse/DLP security, Power Platform ALM, Power Automate risk review, Copilot Studio governance, Fabric/Power BI governance, Fabric data engineering, Fabric analytics engineering, D365 Success by Design, SoD, data migration/cutover, finance close-to-report, supply chain, field service, customer service, sales ops, Customer Insights – Journeys, F&O developer/extensions, dual-write integration, Project Operations, Commerce, value realization, live-guard identity posture + Dataverse security role (read-only-runtime, Phase A), live-guard Dataverse record field update + sensitivity label apply (mutating-runtime, Phase B) |
+| 🧱 Databricks (Azure) |     3 | Azure Databricks Unity Catalog governance (least-privilege grants, admin separation) + lakehouse engineering (medallion, managed-identity storage, cluster policies) — static review; + Unity Catalog schema-scoped grant guard (mutating-runtime live-guard, Phase B) |
+| ❄️ Snowflake (Azure) |     3 | Snowflake-on-Azure RBAC governance (SoD, ACCOUNTADMIN restriction, network policies) + data-platform engineering (Private Link, masking/row-access governance) — static review; + RBAC grant guard (mutating-runtime live-guard, Phase B) |
 
 ### 🛡️ Live Guard skills — stop before you break prod
 
@@ -470,7 +474,7 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 
 ## 🤖 Agents
 
-**<!-- count:agents -->473<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
+**<!-- count:agents -->559<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
 
 | Provider           | Count | Specialisations                                                                     |
 | ------------------ | ----: | ----------------------------------------------------------------------------------- |
@@ -506,6 +510,9 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 | 👥 HR               |    15 | employee relations, workplace investigations, performance management, compensation & equity, benefits & payroll, recruiting & selection, workforce planning & RIF, leave & accommodation, learning policy, culture & DEI, people analytics, HRIS process controls, termination readiness, risk triage |
 | 🧪 QA               |    10 | Playwright E2E review + execution, flakiness triage, coverage quality, CI test pipeline review, PLC control-logic safety, RPA workflow resilience — static-review + opt-in execution |
 | ☁️ Salesforce       |    30 | 20 Wave 1 domain specialists (admin, dev, security, integration, Sales/Service/Marketing/Industry clouds, Agentforce, analytics, compliance) + 10 Wave 3 infrastructure security + DevSecOps agents — maestro router + live-guard authority gate |
+| Ⓜ️ Microsoft 365 / D365 |    40 | 5 maestro routers (microsoft, m365, d365, Power Platform, Copilot governance) + 31 static-review specialists + 2 read-only-runtime live-guards (Phase A: identity posture, Dataverse security role) + 2 mutating-runtime live-guards (Phase B: Dataverse record field update, sensitivity label apply) across M365 (Entra identity/Zero Trust, Copilot readiness, Purview data security & compliance, Defender XDR SecOps, Intune endpoints, Teams collaboration, Exchange/SharePoint information governance, tenant governance, backup/BCDR & data resilience, licensing/EA optimization), Power Platform (Dataverse security, ALM pipelines, automation risk, Copilot Studio governance), Fabric/Power BI (governance, data engineering, analytics engineering), D365 (Success by Design, SoD, data migration/cutover, finance, supply chain, field service, customer service, sales, Customer Insights – Journeys, F&O developer/extensions, dual-write integration, Project Operations, Commerce, value realization), and live-guard runtime (Phase A: identity posture, Dataverse security role; Phase B: Dataverse record field update guard, sensitivity label apply guard) |
+| 🧱 Databricks (Azure) |     3 | 2 static-review specialists (Phase A): Unity Catalog governance (metastore→catalog→schema→table, least-privilege grants, account/workspace/metastore admin separation, run-as-service-principal) + lakehouse engineering (medallion architecture, ADLS Gen2 via Access Connector managed identity, cluster policies, AKV-backed secret scopes, VNet/Private Link); + 1 mutating-runtime live-guard (Phase B): Unity Catalog schema-scoped grant guard (single GRANT to one principal, REVOKE rollback, written approval token + PREFLIGHT required) |
+| ❄️ Snowflake (Azure) |     3 | 2 static-review specialists (Phase A): RBAC governance (ACCOUNTADMIN/SECURITYADMIN/SYSADMIN separation, custom least-privilege roles, SoD, network policies, Entra OAuth/SSO/SCIM) + data-platform engineering (warehouses, Azure Private Link, storage integration to ADLS Gen2/Blob, dynamic masking/row-access/tagging, ACCESS_HISTORY); + 1 mutating-runtime live-guard (Phase B): Snowflake RBAC grant guard (single GRANT to one grantee, REVOKE rollback, written approval token + PREFLIGHT required, ACCOUNTADMIN/SECURITYADMIN/SYSADMIN escalation denied) |
 | 🔗 Cross-functional skills |     3 | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` (protocol skills, not agents) |
 
 ### ⚖️ The Legal + HR cross-functional agentic ecosystem
@@ -518,6 +525,17 @@ Every Legal and HR agent is **escalation-aware** (knows when a matter must go to
 
 .NET is a free, cross-platform, open-source developer platform — runtime, libraries, and languages (C# is the most popular) — with ASP.NET Core as its lean, modular framework for modern cloud-based web services and EF Core as its lightweight, extensible data-access layer. The board is a `dotnet-maestro` router plus nine **static-review** specialists covering C#/runtime correctness, ASP.NET Core API architecture, identity and authorization, EF Core data access, test quality, CI/NuGet supply chain, performance/AOT/trimming, in-app OpenTelemetry wiring, and .NET Aspire cloud-native readiness — every agent reads source and sanitized configuration only and never builds, runs, migrates, or contacts a live system. These agents use `provider: generic` with a `dotnet-` ID prefix because .NET is a language/runtime, not a cloud provider — mirroring the existing non-cloud boards.
 
+### Ⓜ️ The Microsoft 365 / Dynamics 365 board
+
+A maestro-routed board for the Microsoft business cloud (M365, Dynamics 365, Power Platform, and Copilot) — the SaaS surface, distinct from Azure infrastructure. A top-level `microsoft-maestro` routes to four sub-maestros (`m365`, `d365`, `power-platform`, `copilot-governance`) and refuses Azure-IaaS / cross-cloud work, deflecting it to the Azure/AWS/GCP maestros. Under them sit **31 static-review specialists + 2 read-only-runtime live-guards (Phase A) + 2 mutating-runtime live-guards (Phase B)** organized into categories:
+
+- **M365 — identity & Copilot:** Entra Conditional Access / Zero Trust and Microsoft 365 Copilot readiness & data-exposure governance (the Copilot Zero Trust 7-layer / oversharing model).
+- **Power Platform & Copilot Studio:** environment + DLP + Dataverse security, ALM pipelines, automation (Power Automate) risk review, and Copilot Studio agent governance / ALM.
+- **Analytics:** Microsoft Fabric / Power BI semantic-model trust, RLS/OLS, and workspace governance.
+- **Dynamics 365:** Success by Design implementation governance, Finance & Operations segregation-of-duties, data migration & cutover, finance close-to-report, supply chain plan-to-produce, field service-to-cash, customer service & contact center, sales revenue operations, and license-to-value realization.
+
+Static-review agents produce no tenant mutations; every verdict requires explicit human approval. The board also ships **Phase A read-only-runtime live-guards** (`m365-live-identity-posture-guard-agent`, `d365-live-security-role-guard-agent`) that read live tenant state without writing, and **Phase B mutating-runtime live-guards** (`d365-live-record-field-update-guard-agent`, `m365-live-sensitivity-label-apply-guard-agent`) that execute exactly one controlled WRITE operation (a named Dataverse field PATCH or a Graph sensitivity-label assignment to one driveItem) only after a written approval token, PREFLIGHT dry-run, and inverse-rollback path are confirmed — bulk edits, DELETE, ownerid/security-role fields, label-policy writes, and broad directory permissions are unconditionally denied. The board is grounded on Microsoft Learn and ships alongside **15 cross-functional protocol skills** (`provider: generic`, recommendation-only) that orchestrate it across business processes — lead-to-cash, procure-to-pay, close-to-report, copilot-data-readiness, erp-crm-cutover, identity-to-data-access, and more.
+
 ---
 
 Every agent ships:
@@ -536,6 +554,7 @@ agents/
 ├── cert-manager/     (1 agent — PKI certificate lifecycle review)
 ├── cilium/           (1 agent — network policy review)
 ├── contabo/          (6 agents — advisory, live instance + storage guards, maestro)
+├── databricks/       (3 agents — Azure Databricks: Unity Catalog governance + lakehouse engineering — static review, -at-azure; + Unity Catalog schema-scoped grant guard — mutating-runtime live-guard, Phase B)
 ├── dotnet/           (10 agents — C#/runtime, ASP.NET Core, EF Core, testing, NuGet supply chain, performance/AOT, OpenTelemetry, Aspire — maestro + 9 specialists)
 ├── falco/            (1 agent — runtime threat detection review)
 ├── finance/          (8 agents — maestro + corporate finance specialists: variance analysis, FP&A forecasting, treasury/liquidity, working capital, debt/capital structure, capital allocation, transfer pricing/Pillar Two — all advisory, no ERP writes)
@@ -551,6 +570,7 @@ agents/
 ├── kyverno/          (1 agent — admission policy review)
 ├── legal/            (13 agents — contract review, employment law, privacy & data protection, regulatory compliance, IP & open source, litigation hold, ethics & investigations, vendor risk, policy governance, public disclosure, counsel review, knowledge management)
 ├── marketing/        (14 agents — 13 governance review agents + maestro router)
+├── microsoft/        (40 agents — Microsoft 365 / Dynamics 365 / Power Platform / Copilot — microsoft maestro + m365/d365/power-platform/copilot-governance sub-maestros, plus 31 static-review specialists: Entra Zero Trust, Copilot readiness, Purview data security & compliance, Defender XDR SecOps, Intune endpoints, Teams collaboration, Exchange/SharePoint information governance, tenant governance, backup/BCDR & data resilience, licensing/EA optimization, Dataverse/DLP security, Power Platform ALM, Power Automate risk, Copilot Studio governance, Fabric/Power BI governance, Fabric data engineering, Fabric analytics engineering, D365 Success by Design, SoD, data migration/cutover, finance, supply chain, field service, customer service, sales, Customer Insights – Journeys, F&O developer/extensions, dual-write integration, Project Operations, Commerce, value realization — all static-review, live-guard-gated; +2 read-only-runtime live-guard agents (Phase A): identity posture, Dataverse security role; +2 mutating-runtime live-guard agents (Phase B): Dataverse record field update guard, sensitivity label apply guard)
 ├── netsuite/         (25 agents — Oracle NetSuite ERP — maestro router, live-org mutation guard, evidence/release-drift + enterprise-architecture + SOX audit governance, plus 20 domain specialists: financial foundations, SuiteScript secure code review, SDF DevOps, OneWorld multi-subsidiary, identity/RBAC, OAuth/TBA/SSO, AI Connector/MCP, data governance, integration migration, and more — all static-review tier)
 ├── nvidia/           (12 agents — GPU infrastructure, TensorRT/TensorRT-LLM, Triton serving, NeMo/NIM, agentic AI, NGC supply chain, AI networking, day-2 ops, GPU Operator on Kubernetes, model promotion gatekeeper — maestro + advisory + live-runtime gate)
 ├── oci/              (39 agents — advisory, live-guard operators)
@@ -560,6 +580,7 @@ agents/
 ├── qa/               (10 agents — Playwright E2E review + execution, flakiness triage, coverage quality, CI pipeline review, PLC control-logic safety, RPA workflow resilience)
 ├── salesforce/       (30 agents — 20 Wave 1 domain specialists + 10 Wave 3 infrastructure security/DevSecOps agents, maestro router, live-guard authority gate)
 ├── scaleway/         (6 agents — advisory, live Kapsule rollout guard, maestro)
+├── snowflake/        (3 agents — Snowflake on Azure: RBAC governance + data-platform engineering — static review, -at-azure; + RBAC grant guard — mutating-runtime live-guard, Phase B)
 ├── sigstore/         (1 agent — supply-chain security review)
 └── terraform/        (2 agents — IaC review, maestro)
 ```
@@ -1113,7 +1134,7 @@ In two weeks on npm: ~900 downloads. Socket.dev scores: Vulnerability 100, Quali
 
 Your sponsorship directly funds the compute, API time, and research hours that turn new cloud providers, compliance frameworks, and security patterns into production-ready agents — free for everyone.
 
-Current catalog: **<!-- count:agents -->473<!-- /count --> agents · <!-- count:skills -->451<!-- /count --> skills · <!-- count:providers -->35<!-- /count --> cloud/platform providers**
+Current catalog: **<!-- count:agents -->559<!-- /count --> agents · <!-- count:skills -->558<!-- /count --> skills · <!-- count:providers -->39<!-- /count --> cloud/platform providers**
 
 ---
 

package/agents/databricks/README.md

@@ -0,0 +1,84 @@
+# 🧱 Databricks (Azure) Agents
+
+## Overview
+
+Two **static-review** agents and one **mutating-runtime live-guard** agent for Azure Databricks workloads — scoped to Unity Catalog governance, lakehouse engineering, and controlled privilege grants. The static-review agents never write to live workspaces; every verdict is an evidence-backed recommendation requiring human approval before any change reaches a production environment. The Phase B live-guard agent executes a single, narrowly scoped GRANT against a live Unity Catalog instance only after written approval token, PREFLIGHT dry-run, and REVOKE rollback path are confirmed.
+
+## 🧱 Agent tiers
+
+| Tier | Purpose | Default access | Live Databricks mutation |
+|---|---|---|---|
+| Static-review agents | Review, design, diagnose | read-only | not allowed |
+| Live-guard (mutating-runtime) | Apply one schema-scoped GRANT to one principal; REVOKE rollback | written approval token + PREFLIGHT dry-run required | single scoped GRANT only — bulk/wildcard/admin-role grants denied |
+
+## 🗂️ Agents in this provider
+
+| Agent | Tier | Primary use |
+|---|---|---|
+| `databricks-unity-catalog-governance-at-azure-agent` | Static-review | Unity Catalog privilege review — metastore → catalog → schema → table hierarchy, schema-scoped least-privilege grants, account/workspace/metastore admin separation, run-as-service-principal enforcement |
+| `databricks-lakehouse-engineering-at-azure-agent` | Static-review | Lakehouse architecture review — medallion (Bronze/Silver/Gold) design, ADLS Gen2 external locations via Access Connector managed identity, cluster policies, AKV-backed secret scopes, VNet injection/Private Link posture |
+| `databricks-live-unity-catalog-grant-guard-at-azure-agent` | Live-guard (mutating-runtime) | Apply one Unity Catalog schema-scoped GRANT to one principal via SQL API; REVOKE rollback; written approval token + PREFLIGHT diff required; denies metastore/catalog-wide ALL PRIVILEGES, admin-role grants, and bulk operations |
+
+## 🔒 Unity Catalog governance agent
+
+The `databricks-unity-catalog-governance-at-azure-agent` reviews Unity Catalog configurations for:
+
+- **Privilege hierarchy:** correct grant scope at metastore, catalog, schema, and table/volume level; no over-broad `ALL PRIVILEGES` on high-level objects
+- **Admin separation:** account admin, workspace admin, and metastore admin roles kept distinct; no single principal holds all three
+- **Least-privilege grants:** schema-scoped grants preferred over catalog-scoped; `SELECT`/`MODIFY` separated from `CREATE`/`USAGE`
+- **Service principal execution:** interactive user principals not used for production job runs; service principals hold only the grants required for their job clusters
+- **Data lineage and auditing:** Unity Catalog audit log coverage confirmed; column-level lineage enabled where required for data-product governance
+
+## 🏗️ Lakehouse engineering agent
+
+The `databricks-lakehouse-engineering-at-azure-agent` reviews lakehouse architectures for:
+
+- **Medallion design:** Bronze → Silver → Gold separation; schema enforcement at Silver; no direct consumer access to Bronze
+- **ADLS Gen2 storage access:** external locations defined via Access Connector managed identity (not storage account keys or service principal secrets); Databricks-managed vs. external table classification reviewed
+- **Cluster policies:** all-purpose and job clusters governed by policy; no unrestricted `spark.executor.memory` or instance-type overrides in production
+- **Secret management:** Azure Key Vault-backed secret scopes used for all credentials; no secrets in notebook code, job parameters, or init scripts
+- **Network posture:** VNet injection confirmed; Private Link enabled for workspace front-end and back-end where Business Critical tier is required; no public endpoint exposure without compensating control
+
+## 🔐 Unity Catalog grant guard agent (live-guard — mutating-runtime, Phase B)
+
+The `databricks-live-unity-catalog-grant-guard-at-azure-agent` is a **controlled WRITE** agent that applies exactly one Unity Catalog schema-scoped GRANT to exactly one principal on a live Azure Databricks workspace. It is a Phase B mutating-runtime guard — distinct from the Phase A static-review agents above, which never touch a live workspace.
+
+**Execution conditions — all must be met before any GRANT is issued:**
+- Written approval token provided by an authorized human approver
+- PREFLIGHT dry-run (`SHOW GRANTS ON SCHEMA <schema>`) executed and diff reviewed
+- Target table/schema, principal (service principal or group), and privilege explicitly named
+- REVOKE rollback command staged and confirmed
+
+**What it grants:** a single `USAGE`, `SELECT`, `MODIFY`, or `CREATE` privilege on one named schema to one principal — the minimum required for the stated purpose, using least-privilege `prvWrite` equivalent on that schema only.
+
+**Azure scope:** ADLS Gen2 external location access controlled via Access Connector managed identity; AKV-backed secret scopes; Entra-integrated service principals.
+
+**Hard denials (agent refuses regardless of approval):**
+- `ALL PRIVILEGES` on a metastore, catalog, or multi-schema target
+- Account-admin, workspace-admin, or metastore-admin role grants
+- Bulk or wildcard grants (more than one principal or more than one object per operation)
+- Any `DELETE`, `EXECUTE`, or governance-role privilege escalation
+
+## 🎓 Certification anchors
+
+These agents are grounded in the following certification domains (verify current exam availability before citing):
+
+- **DP-700** — Implementing Data Engineering Solutions Using Microsoft Fabric (Microsoft; adjacent data-engineering domain)
+- **DP-750** — Implementing Data Engineering Solutions Using Azure Databricks (Microsoft; "Secure and govern Unity Catalog objects" is ~15–20% of the exam)
+- **Databricks Certified Data Engineer Associate / Professional** (Databricks)
+
+## 📛 Naming rationale (`-at-azure`)
+
+All agents in this provider use the `-at-azure` suffix to make the deployment target unambiguous. Databricks is a multi-cloud platform; these agents are scoped exclusively to Azure Databricks (VNet injection, ADLS Gen2 storage, AKV secret scopes, Entra-integrated service principals). Behaviour specific to AWS or GCP deployments is out of scope.
+
+## 🛡️ Operating note
+
+- **Phase A (static-review) agents** read configuration artefacts, Terraform plans, ARM/Bicep templates, and notebook exports; they do not connect to live workspaces
+- Production-impacting recommendations (privilege revocations, cluster policy enforcement, storage credential rotation) require explicit human approval and must follow a tested rollback path
+- **Phase B (live-guard) agent** — `databricks-live-unity-catalog-grant-guard-at-azure-agent` — now exists and is gated: it requires a written approval token, PREFLIGHT dry-run output, principal-type audit (service principal or group only), and a staged REVOKE rollback path before any GRANT is issued to a live Unity Catalog workspace
+
+## 📦 Install
+
+```bash
+npx vfa-export-agents --platform claude-code --provider databricks --repo .
+```

package/agents/databricks/databricks-lakehouse-engineering-at-azure-agent/AGENT.md

@@ -0,0 +1,54 @@
+---
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+---
+
+# Databricks Lakehouse Engineering at Azure
+
+> Agent for databricks-lakehouse-engineering-at-azure. Review and guide medallion architecture design, Delta Lake pipelines, ADLS Gen2 access via Unity Catalog storage credentials and Access Connector managed identity, cluster access mode enforcement, AKV-backed secret scopes, VNet injection, Private Link isolation, and credential passthrough deprecation.
+
+## Harness Variants
+
+- `harnesses/codex.toml` — Codex native agent configuration.
+- `harnesses/copilot.md` — GitHub Copilot / VS Code custom agent definition.
+- `harnesses/claude-code.md` — Claude Code Markdown-family adapter.
+- `harnesses/cursor.md` — Cursor Markdown-family adapter.
+- `harnesses/gemini.md` — Gemini CLI Markdown-family adapter.
+- `harnesses/kiro-cli.agent.json` — Kiro CLI JSON adapter.
+
+## Canonical Contract
+
+# Databricks Lakehouse Engineering at Azure
+
+Use this canonical agent only for `databricks-lakehouse-engineering-at-azure` work.
+
+## Required Skill
+
+Before answering, read and follow:
+
+- `skills/databricks/databricks-lakehouse-engineering-at-azure/SKILL.md`
+
+Load files under `skills/databricks/databricks-lakehouse-engineering-at-azure/references/` only when the task needs that reference. Do not dump reference text into the response.
+
+## Focus
+
+Review and guide medallion architecture design, Delta Lake pipelines, ADLS Gen2 access via Unity Catalog storage credentials and Access Connector managed identity, cluster access mode enforcement, AKV-backed secret scopes, VNet injection and Private Link network isolation, and credential passthrough deprecation migration.
+
+## Operating Rules
+
+- Prefer Databricks and Microsoft Learn documentation through the user's configured documentation MCP for platform service behavior.
+- Use read-only workspace evidence only when available and label it as sampled evidence.
+- Never ask for credentials, tokens, workspace URLs, storage account keys, SAS tokens, service principal secrets, or customer data.
+- Require explicit approval before recommending or executing mutations, cluster changes, storage credential creation, external location changes, or production-impacting operations.
+- Static review only: never execute cluster create/edit, storage credential create, or external location changes against live infrastructure. Production infrastructure changes are live-guard gated (escalate).
+- State what is unknown; documentation proves service behavior, not the user's deployed state.
+- Challenge credential passthrough usage, Standard cluster mode on Unity Catalog workloads, unvalidated HNS settings, and open storage container ACLs.
+
+## Response Shape
+
+1. Verdict
+2. Evidence level
+3. Blockers / risks
+4. Safe next actions
+5. Open questions