@raishin/vanguard-frontier-agentic 2.10.0 → 2.13.0

package/tests/fixtures/sap-maestro-routing/taxonomy.json

@@ -0,0 +1,509 @@
+{
+  "provider": "sap",
+  "domains": {
+    "clean-core-debt": {
+      "keywords": [
+        "clean core",
+        "clean-core",
+        "ABAP Cloud",
+        "RAP",
+        "BAdI",
+        "modification debt",
+        "custom code",
+        "released API",
+        "key-user extensibility",
+        "side-by-side extensibility",
+        "ABAP upgrade",
+        "adaptation transport"
+      ],
+      "agent": "sap-clean-core-debt-reviewer-agent"
+    },
+    "landscape-discovery": {
+      "keywords": [
+        "BTP subaccount",
+        "landscape discovery",
+        "entitlements",
+        "service instances",
+        "destinations",
+        "integration flows",
+        "role collections",
+        "btp list",
+        "btp get",
+        "subaccount inventory",
+        "ABAP system",
+        "Cloud Foundry space"
+      ],
+      "agent": "sap-live-readonly-landscape-discovery-agent"
+    },
+    "btp-governance": {
+      "keywords": [
+        "btp account model",
+        "global account",
+        "subaccount entitlement",
+        "entitlement sprawl",
+        "quota allocation",
+        "directory governance",
+        "role collection governance",
+        "btp guardrail",
+        "over-provisioned subscription",
+        "entitlement governance"
+      ],
+      "agent": "sap-btp-account-entitlement-governance-reviewer-agent"
+    },
+    "integration-suite": {
+      "keywords": [
+        "integration flow",
+        "iflow",
+        "cloud integration",
+        "api management",
+        "event mesh",
+        "integration suite",
+        "cpi",
+        "odata adapter",
+        "idempotency",
+        "integration error handling"
+      ],
+      "agent": "sap-integration-suite-reviewer-agent"
+    },
+    "security-iam-grc-sod": {
+      "keywords": [
+        "segregation of duties",
+        "sod conflict",
+        "xsuaa role collection",
+        "grc access control",
+        "identity authentication",
+        "identity provisioning",
+        "excessive privilege",
+        "authorization review",
+        "trust configuration",
+        "sap security review"
+      ],
+      "agent": "sap-security-iam-grc-sod-reviewer-agent"
+    },
+    "cap-architecture": {
+      "keywords": [
+        "cap application",
+        "cloud application programming model",
+        "cds model",
+        "cds modeling",
+        "@requires",
+        "@restrict",
+        "service authorization",
+        "multitenancy",
+        "draft handling",
+        "cap service layer"
+      ],
+      "agent": "sap-cap-architecture-reviewer-agent"
+    },
+    "abap-cloud-rap": {
+      "keywords": [
+        "abap cloud",
+        "rap",
+        "restful abap",
+        "behavior definition",
+        "bdef",
+        "released api",
+        "abap unit test",
+        "behavior implementation",
+        "rap business object",
+        "clean core abap"
+      ],
+      "agent": "sap-abap-cloud-rap-reviewer-agent"
+    },
+    "ai-governance": {
+      "keywords": [
+        "ai core",
+        "ai launchpad",
+        "generative ai hub",
+        "rag pipeline",
+        "embeddings",
+        "prompt injection",
+        "grounding data",
+        "model access control",
+        "ai output auditability",
+        "genai governance"
+      ],
+      "agent": "sap-ai-core-genai-hub-governance-reviewer-agent"
+    },
+    "datasphere": {
+      "keywords": [
+        "datasphere",
+        "data product",
+        "data flow",
+        "replication flow",
+        "semantic model",
+        "datasphere space",
+        "cross-space sharing",
+        "data access control",
+        "data builder"
+      ],
+      "agent": "sap-datasphere-data-product-architect-agent"
+    },
+    "analytics-cloud": {
+      "keywords": [
+        "analytics cloud",
+        "sac story",
+        "planning model",
+        "data action",
+        "allocation step",
+        "live connection",
+        "import connection",
+        "analytic model",
+        "sac performance"
+      ],
+      "agent": "sap-analytics-cloud-planning-governance-agent"
+    },
+    "hana-cloud": {
+      "keywords": [
+        "hana cloud",
+        "hana sizing",
+        "table partitioning",
+        "execution plan",
+        "native storage extension",
+        "workload management",
+        "compute cost",
+        "auto-stop",
+        "sqlscript performance"
+      ],
+      "agent": "sap-hana-cloud-performance-cost-agent"
+    },
+    "s4hana-transformation": {
+      "keywords": [
+        "s4hana transformation",
+        "brownfield conversion",
+        "greenfield implementation",
+        "selective data transition",
+        "sap activate",
+        "readiness check",
+        "fit-to-standard",
+        "deployment model",
+        "rise with sap"
+      ],
+      "agent": "sap-s4hana-transformation-architect-agent"
+    },
+    "custom-code-remediation": {
+      "keywords": [
+        "custom code remediation",
+        "simplification item",
+        "abap test cockpit",
+        "atc readiness",
+        "custom code migration",
+        "deprecated api",
+        "release contract",
+        "sycm",
+        "custom code adaptation"
+      ],
+      "agent": "sap-custom-code-remediation-reviewer-agent"
+    },
+    "data-migration-cutover": {
+      "keywords": [
+        "data migration readiness",
+        "migration cockpit",
+        "cutover readiness",
+        "mock run",
+        "go-live readiness",
+        "data reconciliation",
+        "ltmc",
+        "migration object",
+        "cutover plan"
+      ],
+      "agent": "sap-data-migration-cutover-readiness-agent"
+    },
+    "finance-fico": {
+      "keywords": [
+        "fi-co",
+        "finance controls",
+        "document posting control",
+        "validation and substitution",
+        "period-end close",
+        "financial closing cockpit",
+        "parallel ledger",
+        "intercompany reconciliation",
+        "fico"
+      ],
+      "agent": "sap-finance-fico-controls-agent"
+    },
+    "mdg-master-data": {
+      "keywords": [
+        "master data governance",
+        "mdg",
+        "data model governance",
+        "brfplus validation",
+        "governance workflow",
+        "master data consolidation",
+        "data quality kpi",
+        "key mapping",
+        "master data quality"
+      ],
+      "agent": "sap-mdg-master-data-quality-agent"
+    },
+    "signavio-process-mining": {
+      "keywords": [
+        "signavio",
+        "process mining",
+        "process intelligence",
+        "conformance checking",
+        "bottleneck analysis",
+        "variant analysis",
+        "value realization",
+        "process discovery"
+      ],
+      "agent": "sap-signavio-process-mining-value-agent"
+    },
+    "procurement-ariba": {
+      "keywords": [
+        "ariba",
+        "procurement value leakage",
+        "source-to-pay",
+        "maverick spend",
+        "contract compliance",
+        "guided buying",
+        "three-way match",
+        "supplier risk",
+        "off-contract spend"
+      ],
+      "agent": "sap-procurement-ariba-value-leakage-agent"
+    },
+    "supply-chain-ibp": {
+      "keywords": [
+        "ibp",
+        "integrated business planning",
+        "demand planning",
+        "supply planning",
+        "s&op",
+        "inventory optimization",
+        "supply chain control tower",
+        "forecast accuracy",
+        "supply chain resilience"
+      ],
+      "agent": "sap-supply-chain-ibp-resilience-agent"
+    },
+    "order-to-cash": {
+      "keywords": [
+        "order-to-cash",
+        "otc",
+        "sales order",
+        "credit management",
+        "billing",
+        "pricing condition",
+        "dso",
+        "availability check",
+        "fulfillment exception"
+      ],
+      "agent": "sap-order-to-cash-agent"
+    },
+    "treasury-cash-risk": {
+      "keywords": [
+        "treasury",
+        "cash management",
+        "liquidity management",
+        "bank account management",
+        "in-house cash",
+        "hedge management",
+        "payment factory",
+        "financial instruments",
+        "treasury risk"
+      ],
+      "agent": "sap-treasury-cash-risk-agent"
+    },
+    "ewm-tm-logistics": {
+      "keywords": [
+        "extended warehouse management",
+        "ewm",
+        "transportation management",
+        "wave management",
+        "warehouse slotting",
+        "freight order",
+        "dock and yard",
+        "warehouse process type",
+        "logistics execution"
+      ],
+      "agent": "sap-ewm-tm-logistics-execution-agent"
+    },
+    "manufacturing-execution": {
+      "keywords": [
+        "manufacturing execution",
+        "production order",
+        "capacity planning",
+        "mrp exception",
+        "shop floor",
+        "digital manufacturing",
+        "backflush",
+        "production planning",
+        "manufacturing risk"
+      ],
+      "agent": "sap-manufacturing-execution-risk-agent"
+    },
+    "successfactors-hr": {
+      "keywords": [
+        "successfactors",
+        "employee central",
+        "role-based permissions",
+        "rbp",
+        "position management",
+        "hire-to-retire",
+        "joiner mover leaver",
+        "hr process risk",
+        "hcm permissions"
+      ],
+      "agent": "sap-successfactors-hr-process-risk-agent"
+    },
+    "joule-governance": {
+      "keywords": [
+        "joule",
+        "joule governance",
+        "joule adoption",
+        "joule security",
+        "copilot governance",
+        "joule data access",
+        "generative ai copilot",
+        "joule skill"
+      ],
+      "agent": "sap-joule-governance-adoption-agent"
+    },
+    "cloud-alm-sre": {
+      "keywords": [
+        "cloud alm",
+        "health monitoring",
+        "incident management",
+        "business process monitoring",
+        "exception monitoring",
+        "sre operations",
+        "alerting",
+        "alm"
+      ],
+      "agent": "sap-cloud-alm-sre-incident-agent"
+    },
+    "transformation-portfolio-triage": {
+      "keywords": [
+        "transformation portfolio",
+        "program triage",
+        "workstream prioritization",
+        "raid log",
+        "value vs effort",
+        "readiness gate",
+        "transformation program",
+        "portfolio triage"
+      ],
+      "agent": "sap-transformation-portfolio-triage-agent"
+    },
+    "rise-sla-vendor-risk": {
+      "keywords": [
+        "rise with sap",
+        "sla credits",
+        "vendor risk",
+        "shared responsibility model",
+        "data residency",
+        "exit provision",
+        "cloud contract",
+        "availability commitment",
+        "cloud service agreement"
+      ],
+      "agent": "sap-rise-sla-vendor-risk-agent"
+    },
+    "license-finops": {
+      "keywords": [
+        "sap license",
+        "btp consumption",
+        "cpea",
+        "fue",
+        "digital access",
+        "license audit",
+        "entitlement consumption",
+        "license finops",
+        "commercial model"
+      ],
+      "agent": "sap-license-btp-consumption-finops-agent"
+    },
+    "testing-quality-gate": {
+      "keywords": [
+        "test strategy",
+        "quality gate",
+        "test management",
+        "test automation",
+        "regression testing",
+        "defect management",
+        "entry and exit criteria",
+        "risk-based testing",
+        "cbta"
+      ],
+      "agent": "sap-testing-quality-gate-agent"
+    },
+    "release-change-collision": {
+      "keywords": [
+        "change collision",
+        "overtake and overwrite",
+        "downgrade protection",
+        "retrofit",
+        "dual landscape",
+        "charm governance",
+        "transport sequencing dependency",
+        "change collision risk"
+      ],
+      "agent": "sap-release-change-collision-agent"
+    },
+    "hypercare-incident": {
+      "keywords": [
+        "hypercare",
+        "incident command",
+        "go-live stabilization",
+        "severity triage",
+        "war room",
+        "exit from hypercare",
+        "problem management",
+        "stabilization"
+      ],
+      "agent": "sap-hypercare-incident-commander-agent"
+    },
+    "identity-trust-discovery": {
+      "keywords": [
+        "identity authentication ias",
+        "identity provisioning ips",
+        "trust federation",
+        "identity provider configuration",
+        "read-only identity inspection",
+        "role collection inventory",
+        "ias configuration",
+        "ips connector"
+      ],
+      "agent": "sap-live-readonly-identity-trust-discovery-agent"
+    },
+    "fiori-ui5-ux": {
+      "keywords": [
+        "fiori",
+        "sapui5",
+        "ui5",
+        "fiori design guidelines",
+        "fiori launchpad",
+        "ui5 accessibility",
+        "fiori elements",
+        "ux review",
+        "manifest.json"
+      ],
+      "agent": "sap-fiori-ui5-ux-reviewer-agent"
+    },
+    "audit-evidence": {
+      "keywords": [
+        "audit evidence",
+        "evidence packaging",
+        "control evidence",
+        "chain of custody",
+        "soc 2",
+        "iso 27001",
+        "sox itgc",
+        "audit readiness",
+        "gxp evidence"
+      ],
+      "agent": "sap-audit-evidence-packager-agent"
+    }
+  },
+  "live_guards": [
+    "sap-guarded-transport-import-operator-agent",
+    "sap-role-assignment-guarded-operator-agent",
+    "sap-integration-flow-guarded-operator-agent",
+    "sap-btp-entitlement-guarded-operator-agent"
+  ],
+  "live_guard_intent": "\\b(import|release|promote|deploy)\\b[^.]*\\btransport\\b|\\btransport\\b[^.]*\\b(import|release|promote|deploy)\\b|\\bimport\\b[^.]*\\binto\\b[^.]*\\b(prd|prod|production)\\b|\\btp import\\b|\\bCTS\\b[^.]*\\bimport\\b|\\b(assign|revoke|grant)\\b[^.]*\\brole\\b|\\bdeploy\\b[^.]*\\b(iflow|integration flow|integration artifact)\\b|\\b(modify|change|update)\\b[^.]*\\b(iflow|integration flow|integration artifact)\\b|\\b(increase|change|modify|add|reduce|update)\\b[^.]*\\b(entitlement|quota)\\b",
+  "gate_mode": "live-guard-gate",
+  "parallel_threshold": 0.6
+}

package/tests/test-vfa-export-coverage.test.mjs

@@ -467,6 +467,142 @@ function findLeakedSkills(skillNames, expectedProvider) {
   }
 }
 
+// ── D-matrix completeness: identity + count, not just leak-absence ───────────
+//
+// D14b/D14c/D14d prove "no rival skill leaks" and "invalid combos rejected",
+// but a combo could silently export the WRONG set of agents (e.g. drop one,
+// or export 0) and still pass a leak-only check. The blocks below close the
+// remaining permutation dimensions by asserting the EXACT exported agent
+// identity, driven entirely from the catalog (no hardcoded lists).
+
+const ccCapable = (id) => {
+  const a = byId.get(id);
+  return Array.isArray(a?.harnesses) && a.harnesses.includes("claude-code");
+};
+const onDiskSkillNames = new Set(skillProviderByName.keys());
+
+// A5: Role-standalone agent identity — for EVERY role, `--role <r>` (no provider)
+// exports exactly the claude-code-capable agents declared in that role.
+{
+  let passed = 0;
+  const failed = [];
+  for (const [roleId, role] of Object.entries(rolesDoc.roles)) {
+    const expected = new Set((role.agents || []).filter(ccCapable));
+    const r = run(["--platform", "claude-code", "--role", roleId, "--dry-run"]);
+    const got = new Set(extractAgentIds(r.stdout));
+    const missing = [...expected].filter((id) => !got.has(id));
+    const extra = [...got].filter((id) => !expected.has(id));
+    if (r.exitCode === 0 && missing.length === 0 && extra.length === 0) {
+      passed++;
+    } else {
+      failed.push(`${roleId}(missing:[${missing.join(",")}] extra:[${extra.join(",")}] exit=${r.exitCode})`);
+    }
+  }
+  if (failed.length === 0) {
+    ok(`A5 role-standalone agent identity: ${passed}/${Object.keys(rolesDoc.roles).length} roles export exactly their claude-code agents`);
+  } else {
+    fail(`A5 ${failed.length} role(s) export wrong agent set:\n  ${failed.join("\n  ")}`);
+  }
+}
+
+// A6: Role-standalone skill completeness — for EVERY role, every declared
+// role.skills id that exists on disk is actually exported (no silent drop).
+{
+  let passed = 0;
+  const failed = [];
+  for (const [roleId, role] of Object.entries(rolesDoc.roles)) {
+    const expectedSkills = (role.skills || []).filter((s) => onDiskSkillNames.has(s));
+    const r = run(["--platform", "claude-code", "--role", roleId, "--dry-run"]);
+    const got = new Set(extractSkillNames(r.stdout));
+    const missing = expectedSkills.filter((s) => !got.has(s));
+    if (r.exitCode === 0 && missing.length === 0) {
+      passed++;
+    } else {
+      failed.push(`${roleId}(missing:[${missing.join(",")}] exit=${r.exitCode})`);
+    }
+  }
+  if (failed.length === 0) {
+    ok(`A6 role-standalone skill completeness: ${passed}/${Object.keys(rolesDoc.roles).length} roles export all on-disk role skills`);
+  } else {
+    fail(`A6 ${failed.length} role(s) drop declared skills:\n  ${failed.join("\n  ")}`);
+  }
+}
+
+// D14f: Valid role×provider identity — for every valid combo, the exported
+// agent set equals exactly {role agents whose provider==p AND claude-code-capable}.
+// Strengthens D14c (which only checked leak-absence) with count + identity.
+{
+  const combos = [];
+  for (const [roleId, role] of Object.entries(rolesDoc.roles)) {
+    const provs = new Set((role.agents || []).map((id) => byId.get(id)?.provider).filter(Boolean));
+    for (const prov of provs) combos.push({ roleId, prov });
+  }
+  let passed = 0;
+  const failed = [];
+  for (const { roleId, prov } of combos) {
+    const role = rolesDoc.roles[roleId];
+    const expected = new Set(
+      (role.agents || []).filter((id) => byId.get(id)?.provider === prov && ccCapable(id))
+    );
+    const r = run(["--platform", "claude-code", "--role", roleId, "--provider", prov, "--dry-run"]);
+    const got = new Set(extractAgentIds(r.stdout));
+    const missing = [...expected].filter((id) => !got.has(id));
+    const extra = [...got].filter((id) => !expected.has(id));
+    // A combo can be "valid" in D14c terms (has agents from prov) yet have zero
+    // claude-code-capable ones; in that case the CLI rejects it (No agents found).
+    if (expected.size === 0) {
+      if (r.exitCode !== 0) { passed++; continue; }
+      failed.push(`${roleId}+${prov}(expected reject, exit=${r.exitCode})`);
+      continue;
+    }
+    if (r.exitCode === 0 && missing.length === 0 && extra.length === 0) {
+      passed++;
+    } else {
+      failed.push(`${roleId}+${prov}(missing:[${missing.join(",")}] extra:[${extra.join(",")}] exit=${r.exitCode})`);
+    }
+  }
+  if (failed.length === 0) {
+    ok(`D14f valid role×provider identity: ${passed}/${combos.length} combos export exactly the expected agent set`);
+  } else {
+    fail(`D14f ${failed.length}/${combos.length} combo(s) export wrong agent set:\n  ${failed.join("\n  ")}`);
+  }
+}
+
+// D14e: Provider-standalone identity — for EVERY provider, `--provider <p> --all`
+// exports exactly the claude-code-capable agents whose provider==p (count +
+// identity). Strengthens D14b (leak-only) and generalizes B5/B6 (nvidia-only).
+{
+  const r0 = run(["--list-providers"]);
+  const allProviders = r0.stdout.trim().split("\n").map((l) => l.split(/\s/)[0]).filter(Boolean);
+  let passed = 0;
+  const failed = [];
+  for (const prov of allProviders) {
+    const expected = new Set(
+      agents.filter((a) => a.provider === prov && Array.isArray(a.harnesses) && a.harnesses.includes("claude-code")).map((a) => a.id)
+    );
+    const r = run(["--platform", "claude-code", "--provider", prov, "--all", "--dry-run"]);
+    const got = new Set(extractAgentIds(r.stdout));
+    const missing = [...expected].filter((id) => !got.has(id));
+    const extra = [...got].filter((id) => !expected.has(id));
+    if (expected.size === 0) {
+      // provider exists in catalog but has no claude-code-capable agent → reject
+      if (r.exitCode !== 0) { passed++; continue; }
+      failed.push(`${prov}(expected reject for 0 cc-agents, exit=${r.exitCode})`);
+      continue;
+    }
+    if (r.exitCode === 0 && missing.length === 0 && extra.length === 0) {
+      passed++;
+    } else {
+      failed.push(`${prov}(missing:[${missing.join(",")}] extra:[${extra.join(",")}] exit=${r.exitCode})`);
+    }
+  }
+  if (failed.length === 0) {
+    ok(`D14e provider-standalone identity: ${passed}/${allProviders.length} providers export exactly their claude-code agents`);
+  } else {
+    fail(`D14e ${failed.length}/${allProviders.length} provider(s) export wrong agent set:\n  ${failed.join("\n  ")}`);
+  }
+}
+
 // D15: --provider "" (empty string) is rejected with a provider-specific error message.
 // Regression guard — empty string was falsy in JS and bypassed all provider validation,
 // exporting ALL providers' content. Guard also checks error message so an unrelated

package/tests/validate-catalog.py

@@ -57,6 +57,10 @@ ALLOWED_PROVIDERS = {
     "netsuite",
     "accounting",
     "finance",
+    "sap",
+    "microsoft",
+    "databricks",
+    "snowflake",
 }
 ALLOWED_HARNESSES = {"codex", "copilot", "claude-code", "cursor", "gemini", "kiro", "other"}
 ALLOWED_SOURCE_TYPES = {"original", "adapted", "reference-only"}