@raishin/vanguard-frontier-agentic 2.11.0 → 2.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "2.11.0",
+  "version": "2.13.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.11.0",
+  "version": "2.13.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "Raishin",

package/powers/README.md

@@ -1,6 +1,6 @@
 # `powers/` — Kiro Powers
 
-This directory holds **38 Kiro Powers** for `vanguard-frontier-agentic`, one
+This directory holds **39 Kiro Powers** for `vanguard-frontier-agentic`, one
 per cloud/platform/IaC provider. Each Power is a directory containing a
 `POWER.md` file with strict-5 frontmatter and steering content.
 
@@ -42,6 +42,7 @@ powers/
 ├── vanguard-ovhcloud/POWER.md
 ├── vanguard-prometheus/POWER.md
 ├── vanguard-salesforce/POWER.md
+├── vanguard-sap/POWER.md
 ├── vanguard-scaleway/POWER.md
 ├── vanguard-sigstore/POWER.md
 ├── vanguard-snowflake/POWER.md
@@ -82,7 +83,7 @@ cd vanguard-frontier-agentic
 ## How to update
 
 ```bash
-# Regenerate the 38 Powers from catalog/agents.json + per-provider config:
+# Regenerate the 39 Powers from catalog/agents.json + per-provider config:
 npm run kiro-powers:write
 
 # Then verify everything is in sync:

package/powers/vanguard-sap/POWER.md

@@ -0,0 +1,43 @@
+---
+name: "vanguard-sap"
+displayName: "Vanguard Frontier — SAP"
+description: "Curated SAP agents for S/4HANA, BTP, Integration Suite, ABAP Cloud, and transport management with clean-core review and guarded mutation gates. Routes via sap-maestro to specialist agents for landscape discovery, clean-core debt review, and guarded transport imports. Transport mutations require named approver, change ticket, target-system confirmation, and completed SoD check before dispatch."
+keywords: ["sap", "s4hana", "btp", "abap", "clean-core", "transport-management", "live-guard"]
+author: "Raishin"
+---
+# Vanguard Frontier — SAP
+
+Curated SAP agents for S/4HANA, BTP, Integration Suite, ABAP Cloud, and transport management with clean-core review and guarded mutation gates. Routes via sap-maestro to specialist agents for landscape discovery, clean-core debt review, and guarded transport imports. Transport mutations require named approver, change ticket, target-system confirmation, and completed SoD check before dispatch.
+
+## When to engage this Power
+
+Activate when the task references SAP services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`sap-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- `sap-live-readonly-identity-trust-discovery-agent` — never auto-dispatched; gate_mode only
+- `sap-live-readonly-landscape-discovery-agent` — never auto-dispatched; gate_mode only
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Never auto-dispatch the transport-import operator agent — require explicit approval, change ticket, named approver, and completed SoD check before any tp or CTS import command.
+- Clean-core debt review is static only — never connects to a live SAP system and never accepts embedded credentials or production system IDs.
+- Landscape discovery agents use read-only roles only (BTP subaccount viewer, CF SpaceAuditor/OrgAuditor, ABAP display user) — refuse any request that maps to a create/update/delete/deploy/assign/rotate action.
+- All SAP API surfaces and release contracts drift between versions; verify current SAP API Business Hub documentation before applying any remediation recommendation.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/sap/` in that repository. All 40 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider sap --repo .`

package/schemas/agent.schema.json

@@ -57,6 +57,7 @@
         "netsuite",
         "accounting",
         "finance",
+        "sap",
         "microsoft",
         "databricks",
         "snowflake"

package/schemas/skill.schema.json

@@ -48,6 +48,7 @@
         "legal",
         "salesforce",
         "netsuite",
+        "sap",
         "microsoft",
         "databricks",
         "snowflake"

package/scripts/generate-docs-data.mjs

@@ -56,7 +56,7 @@ const taxonomy = [
   { category: 'Infrastructure as Code', providers: ['terraform'] },
   { category: 'AI & Compute', providers: ['nvidia'] },
   { category: 'Developer Platforms', providers: ['backstage', 'dotnet', 'generic', 'multi-cloud'] },
-  { category: 'ERP & Finance', providers: ['netsuite', 'accounting', 'finance'] },
+  { category: 'ERP & Finance', providers: ['netsuite', 'accounting', 'finance', 'sap'] },
   { category: 'Business Functions', providers: ['salesforce', 'legal', 'hr', 'marketing'] },
   { category: 'Microsoft 365 & Dynamics 365', providers: ['microsoft'] },
   { category: 'Data & Analytics Platforms', providers: ['databricks', 'snowflake'] },

package/scripts/generate-kiro-powers.mjs

@@ -208,6 +208,18 @@ const PROVIDERS = {
       "Live-guard agent (salesforce-live-guard-agent) must never be auto-dispatched; require explicit approval, target org confirmation, and rollback plan.",
     ],
   },
+  sap: {
+    displayName: "Vanguard Frontier — SAP",
+    description:
+      "Curated SAP agents for S/4HANA, BTP, Integration Suite, ABAP Cloud, and transport management with clean-core review and guarded mutation gates. Routes via sap-maestro to specialist agents for landscape discovery, clean-core debt review, and guarded transport imports. Transport mutations require named approver, change ticket, target-system confirmation, and completed SoD check before dispatch.",
+    keywords: ["sap", "s4hana", "btp", "abap", "clean-core", "transport-management", "live-guard"],
+    invariants: [
+      "Never auto-dispatch the transport-import operator agent — require explicit approval, change ticket, named approver, and completed SoD check before any tp or CTS import command.",
+      "Clean-core debt review is static only — never connects to a live SAP system and never accepts embedded credentials or production system IDs.",
+      "Landscape discovery agents use read-only roles only (BTP subaccount viewer, CF SpaceAuditor/OrgAuditor, ABAP display user) — refuse any request that maps to a create/update/delete/deploy/assign/rotate action.",
+      "All SAP API surfaces and release contracts drift between versions; verify current SAP API Business Hub documentation before applying any remediation recommendation.",
+    ],
+  },
   microsoft: {
     displayName: "Vanguard Frontier — Microsoft",
     description:

package/skills/claude/add-educational-comments/metadata.json

@@ -2,7 +2,7 @@
   "id": "add-educational-comments",
   "name": "Add Educational Comments",
   "type": "skill",
-  "provider": "claude",
+  "provider": "generic",
   "harnesses": [
     "claude-code",
     "cursor",

package/skills/sap/sap-abap-cloud-rap-review/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: sap-abap-cloud-rap-review
+description: Review ABAP Cloud and RESTful ABAP Programming Model (RAP) artifacts for clean-core compliance, released API usage, behavior definition and implementation correctness, CDS view design, BDEF modeling quality, authorization object coverage, and ABAP unit test completeness. Use when assessing RAP business objects on S/4HANA Cloud or BTP ABAP Environment. Does not touch live systems.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: architecture
+  lifecycle: experimental
+---
+
+# SAP ABAP Cloud RAP Review
+
+## Purpose
+
+Assess the design, correctness, and clean-core compliance of ABAP Cloud and RESTful ABAP Programming Model (RAP) artifacts. Review CDS view hierarchies for correct view type usage (interface, projection, consumption). Review Behavior Definition (BDEF) design for correct implementation type selection (managed vs. unmanaged), draft enablement, authorization master/dependent assignment, and association exposure. Review Behavior Implementation (ABAP classes) for authorization object checks, action implementations, validation completeness, and forbidden language constructs. Assess released API consumption: confirm only C1/C2 released objects are used. Review ABAP unit tests for behavior test double usage, test isolation, and rollback patterns. Does not connect to or mutate any live ABAP system.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review CDS view definitions for correct view type (data definition, projection, consumption) and annotation completeness (metadata extensions, UI, search, access control),
+- assess Behavior Definition (BDEF) design: managed vs. unmanaged selection, draft enablement, alias assignment, feature control, action and function declarations, association exposure,
+- review Behavior Implementation classes (ZBP_*) for authorization object checks (`AUTHORITY-CHECK`), action method completeness, validation messages, and determination logic,
+- verify released API compliance: confirm only objects with C1 or C2 release contracts are used; flag any consumption of NOT_RELEASED or DEPRECATED SAP objects,
+- assess ABAP Cloud tier compliance: identify forbidden language constructs (dynamic SQL, classic OPEN SQL with client-dependent access, direct access to SAP internal tables),
+- review ABAP unit test quality: behavior test doubles (`if_abap_behv_test_environment`), CDS test environment (`if_cds_test_environment`), test class isolation, and `ROLLBACK ENTITIES` teardown,
+- evaluate RAP business object composition: root vs. child entity hierarchy, composition relationships, UUID-based key design, ETag handling, and total ETag vs. field-level ETag selection.
+
+## When not to use
+
+- When the request is about CAP (Node.js/Java) side-by-side extensions on BTP — use `sap-cap-architecture-review`.
+- When the request is about legacy ABAP custom code (Z/Y programs, function modules, classic user exits) rather than RAP objects — use `sap-clean-core-debt-review`.
+- When the request requires live ABAP system access, SE80 navigation, or ABAP Test Cockpit execution — this skill accepts only user-provided ABAP source code, CDS DDL files, BDEF definitions, or written descriptions.
+- When the request is about Integration Suite or API Management configuration — use `sap-integration-suite-review`.
+
+## Does not touch live systems
+
+This skill operates on user-provided ABAP source code snippets, CDS DDL source, BDEF source, metadata extension files, access control definitions, or written descriptions of the RAP object model. It does not connect to any ABAP system, ABAP Development Tools (ADT), SAP S/4HANA system, or BTP ABAP Environment tenant. All live inspection is out of scope.
+
+## Lean operating rules
+
+- Classify findings before recommending. Every finding must be assigned to a review domain (CDS Views / BDEF / Behavior Implementation / Released API Compliance / ABAP Unit Tests / Object Composition) before remediation is proposed.
+- Released API compliance is non-negotiable in ABAP Cloud. Any ABAP Cloud object that consumes a NOT_RELEASED SAP object is non-compliant. This is a `high` finding with upgrade-blocking risk.
+- Authorization checks must be implemented in the authorization master. For a RAP business object with `authorization master ( global )`, the `CHECK_AUTHORIZATION` method in the behavior implementation class must perform `AUTHORITY-CHECK` for every relevant operation. An absent or pass-through `AUTHORITY-CHECK` simulation left from development is a `critical` finding in production-bound code.
+- Managed RAP is preferred for greenfield transactional objects. An unmanaged RAP implementation for a new transactional business object without explicit justification (e.g., wrapping a legacy function module) is a `medium` finding.
+- Draft must be explicitly enabled in the BDEF. A RAP business object that requires Fiori Elements draft editing but lacks `with draft;` in the BDEF and `draft table` configuration in the CDS view is a `high` finding for UI correctness.
+- ABAP unit tests must use test doubles, not live data. Test methods that execute `MODIFY ENTITIES` or `READ ENTITIES` against a live ABAP system database without a test double environment are `high` findings for test isolation.
+- `ROLLBACK ENTITIES` is required in test teardown. An ABAP unit test class for a RAP business object that modifies test data without `ROLLBACK ENTITIES` in `teardown` is a `medium` finding.
+- Evidence from official SAP ABAP Cloud and RAP documentation takes precedence over inference.
+- Load only the reference needed for the component in scope.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in official SAP ABAP Cloud docs, SAP RAP documentation (help.sap.com/docs/abap-cloud), or SAP Help Portal
+- `user-provided evidence` — ABAP source code, CDS DDL definitions, BDEF source, access control definitions, or written descriptions provided by the user
+- `context7-supplementary` — grounded in RAP openSAP sample code from Context7 (supplementary to official SAP docs; applies for authorization implementation patterns and ABAP unit test patterns)
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence
+
+## Live-environment rules
+
+**This skill does not touch live systems.** There is no ABAP system RFC connection, ADT API call, SAP S/4HANA OData service call, or BTP ABAP Environment tenant access in this skill's execution path. Users must supply ABAP source code, CDS DDL source, BDEF definitions, or written descriptions for this skill to review.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — review domain taxonomy, severity classification, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common RAP mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP ABAP Cloud docs, RAP documentation, released API references, ABAP unit testing.
+- [Context7 framework docs](references/context7-framework-docs.md) — RAP authorization implementation and ABAP unit test patterns (supplementary; applies for behavior implementation and test design).
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: review domain(s) in scope and specific finding(s) per domain.
+- **Evidence used**: documentation-based / user-provided evidence / context7-supplementary / inference.
+- **Risk level**: critical (security or data integrity risk) / high (correctness, upgrade-blocking, or operational risk) / medium (governance or maintainability gap) / low (best practice deviation).
+- **Recommended action**: specific remediation per finding (add `AUTHORITY-CHECK`, add `with draft;` to BDEF, replace NOT_RELEASED object with C1 equivalent, add `ROLLBACK ENTITIES` to teardown, etc.).
+- **Refusal / escalation triggers**: if live ABAP system access, ATC execution, or ADT navigation is required to complete the review, state that clearly and do not proceed.
+- **Business impact**: upgrade-blocking risk, security exposure, Fiori UI correctness failure, or test reliability gap.
+- **Next verification step**: validate released API candidates against current SAP API Business Hub release contracts; validate forbidden construct findings against the ABAP Cloud 2.0 tier list for the target system version.

package/skills/sap/sap-abap-cloud-rap-review/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP ABAP Cloud RAP Review"
+  short_description: "Review ABAP Cloud and RAP artifacts for clean-core compliance, released API usage, BDEF/CDS correctness, authorization checks, and ABAP unit test quality"
+  default_prompt: "Use $sap-abap-cloud-rap-review to assess the provided ABAP Cloud or RAP artifacts. Classify findings by domain (CDS Views / BDEF / Behavior Implementation / Released API Compliance / ABAP Unit Tests / Object Composition), assign severity (critical / high / medium / low), state evidence level (documentation-based / user-provided evidence / context7-supplementary / inference), and recommend specific remediation per finding. Flag any pass-through AUTHORITY-CHECK simulations or NOT_RELEASED API consumption as critical or high."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://api.sap.com/"
+      description: "SAP API Business Hub — verify release contracts (C1/C2) for ABAP objects proposed as replacement targets in released API compliance findings"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-abap-cloud-rap-review/metadata.json

@@ -0,0 +1,34 @@
+{
+  "id": "sap-abap-cloud-rap-review",
+  "name": "SAP ABAP Cloud RAP Review",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review ABAP Cloud and RAP artifacts for clean-core compliance, released API usage, behavior definition and implementation correctness, CDS view design, BDEF modeling quality, authorization object coverage, and ABAP unit test completeness. Does not access live systems.",
+  "source_type": "original",
+  "category": "architecture",
+  "official_docs": [
+    "https://help.sap.com/docs/abap-cloud/abap-rap/abap-restful-application-programming-model",
+    "https://help.sap.com/docs/abap-cloud/abap-cloud/what-is-abap-cloud",
+    "https://help.sap.com/docs/abap-cloud/abap-rap/behavior-definition",
+    "https://help.sap.com/docs/abap-cloud/abap-rap/cds-data-model",
+    "https://help.sap.com/docs/abap-cloud/abap-rap/authorization-control",
+    "https://help.sap.com/docs/abap-cloud/abap-rap/draft-handling",
+    "https://help.sap.com/docs/abap-cloud/abap-rap/abap-unit-tests-for-rap-business-objects",
+    "https://help.sap.com/docs/abap-cloud/abap-cloud/released-abap-object-types",
+    "https://api.sap.com/products/SAPS4HANACloud/overview"
+  ],
+  "security_notes": "Does not access live ABAP systems, SAP S/4HANA tenants, BTP ABAP Environment tenants, or ADT. Accepts only user-provided ABAP source code, CDS DDL definitions, BDEF source, or written descriptions. Never request or accept system credentials, RFC destinations, BTP service keys, or client secrets. Authorization findings (missing AUTHORITY-CHECK, pass-through simulation) must be validated in context of the target system's authorization objects before production deployment.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-abap-cloud-rap-review",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-abap-cloud-rap-review/references/context7-framework-docs.md

@@ -0,0 +1,126 @@
+# Context7 framework docs — SAP ABAP Cloud RAP Review
+
+**Role**: supplementary. Official SAP ABAP Cloud and RAP documentation (help.sap.com/docs/abap-cloud) is the primary source for all RAP architecture guidance. Context7-sourced RAP openSAP sample code supplements with implementation-level patterns for authorization checks and ABAP unit testing.
+
+**Library used**: ABAP RESTful Application Programming Model openSAP Samples
+Context7 library ID: `/sap-samples/abap-platform-rap-opensap`
+Lookup target: RAP behavior definition authorization checks, AUTHORITY-CHECK implementation, ABAP unit test patterns, CDS test environment, ROLLBACK ENTITIES
+Skill: `sap-abap-cloud-rap-review`
+Classification: supplementary
+
+---
+
+## RAP authorization — AUTHORITY-CHECK for update operations (supplementary)
+
+Source: sap-samples/abap-platform-rap-opensap (Context7 `/sap-samples/abap-platform-rap-opensap`)
+Reference: https://github.com/sap-samples/abap-platform-rap-opensap/blob/main/week3/sources/W3U7_CLAS_ZBP_I_RAP_TRAVEL.txt
+
+```abap
+METHOD is_update_granted.
+    IF has_before_image = abap_true.
+      AUTHORITY-CHECK OBJECT 'ZOSTAT####'
+        ID 'ZOSTAT####' FIELD travel_status
+        ID 'ACTVT' FIELD '02'.
+    ELSE.
+      AUTHORITY-CHECK OBJECT 'ZOSTAT####'
+        ID 'ZOSTAT####' DUMMY
+        ID 'ACTVT' FIELD '02'.
+    ENDIF.
+    update_granted = COND #( WHEN sy-subrc = 0 THEN abap_true ELSE abap_false ).
+
+    " Simulate full access - for testing purposes only! Needs to be removed for a productive implementation.
+    update_granted = abap_true.
+  ENDMETHOD.
+```
+
+**Relevance**: The `update_granted = abap_true` line is a documented development-only simulation. Any production-bound behavior implementation containing this line without removal is a `critical` finding. The correct production pattern is `AUTHORITY-CHECK` with `sy-subrc = 0` evaluation only — no pass-through override.
+
+Activity codes: `'02'` = Update, `'06'` = Delete, `'01'` = Create.
+
+---
+
+## RAP authorization — operation-level result mapping (supplementary)
+
+Source: sap-samples/abap-platform-rap-opensap (Context7 `/sap-samples/abap-platform-rap-opensap`)
+Reference: https://github.com/sap-samples/abap-platform-rap-opensap/blob/main/week3/unit6.md
+
+```abap
+APPEND VALUE #( %tky = travel-%tky
+                %update              = COND #( WHEN update_granted = abap_true THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized )
+                %action-acceptTravel = COND #( WHEN update_granted = abap_true THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized )
+                %action-rejectTravel = COND #( WHEN update_granted = abap_true THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized )
+                %assoc-_Booking      = COND #( WHEN update_granted = abap_true THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized )
+                %delete              = COND #( WHEN delete_granted = abap_true THEN if_abap_behv=>auth-allowed ELSE if_abap_behv=>auth-unauthorized )
+              )
+  TO result.
+```
+
+**Relevance**: The `result` table in `CHECK_AUTHORIZATION` must enumerate all operations (`%update`, `%delete`, `%action-*`, `%assoc-*`) and assign `if_abap_behv=>auth-allowed` or `if_abap_behv=>auth-unauthorized` for each. A missing operation entry results in the RAP framework defaulting to `auth-allowed` for that operation — a silent authorization bypass.
+
+---
+
+## RAP unit testing — integration test class structure (supplementary)
+
+Source: sap-samples/abap-platform-rap-opensap (Context7 `/sap-samples/abap-platform-rap-opensap`)
+Reference: https://github.com/sap-samples/abap-platform-rap-opensap/blob/main/week4/unit3.md
+
+```abap
+CLASS ltcl_integration_test DEFINITION FINAL FOR TESTING
+     DURATION SHORT
+     RISK LEVEL HARMLESS.
+
+     PRIVATE SECTION.
+        CLASS-DATA:
+         cds_test_environment TYPE REF TO if_cds_test_environment.
+
+        CLASS-METHODS:
+         class_setup,
+         class_teardown.
+        METHODS:
+         setup,
+         teardown.
+        METHODS:
+         create_travel FOR TESTING RAISING cx_static_check.
+    ENDCLASS.
+
+    CLASS ltcl_integration_test IMPLEMENTATION.
+      METHOD class_setup.
+        cds_test_environment = cl_cds_test_environment=>create_for_multiple_cds(
+            i_for_entities = VALUE #( ( i_for_entity = 'zi_rap_travel_u_####' )
+                                    ( i_for_entity = 'zi_rap_booking_u_####' ) )
+                                  ).
+      ENDMETHOD.
+
+      METHOD class_teardown.
+        cds_test_environment->destroy( ).
+      ENDMETHOD.
+
+      METHOD teardown.
+        ROLLBACK ENTITIES.
+        cds_test_environment->clear_doubles( ).
+      ENDMETHOD.
+    ENDCLASS.
+```
+
+**Relevance**: Required structural pattern for RAP integration tests:
+- `cl_cds_test_environment=>create_for_multiple_cds()` creates CDS test doubles to avoid live data access.
+- `cds_test_environment->destroy()` in `class_teardown` is mandatory to clean up test doubles.
+- `ROLLBACK ENTITIES` in `teardown` is mandatory to roll back any entity modifications between test methods.
+- Missing any of these constitutes a test isolation finding.
+
+---
+
+## Scope boundaries for Context7 usage
+
+Context7 RAP openSAP sample documentation applies to:
+
+- **Authorization implementation**: `AUTHORITY-CHECK` patterns, operation-level result mapping in `CHECK_AUTHORIZATION`
+- **ABAP unit tests**: CDS test environment setup, test class structure, `ROLLBACK ENTITIES` teardown
+
+It does not replace official SAP Help Portal guidance for:
+- BDEF syntax and keyword reference (use help.sap.com/docs/abap-cloud/abap-rap/behavior-definition)
+- CDS view type definitions and access control (use help.sap.com/docs/abap-cloud/abap-rap/cds-data-model)
+- Released API release contract verification (use api.sap.com)
+- ABAP Cloud tier-2 forbidden construct list (use help.sap.com/docs/abap-cloud/abap-cloud/what-is-abap-cloud)
+
+Always label Context7-sourced guidance as `context7-supplementary` in responses.

package/skills/sap/sap-abap-cloud-rap-review/references/official-sources.md

@@ -0,0 +1,95 @@
+# Official sources — SAP ABAP Cloud RAP Review
+
+Use this reference when grounding RAP behavior definition design, CDS view modeling, authorization control, draft handling, ABAP unit testing, and released API compliance.
+
+**Evidence level**: documentation-based (SAP Help Portal — help.sap.com/docs/abap-cloud, SAP API Business Hub). No live-system evidence is collected by this skill.
+
+## RAP core documentation
+
+- ABAP RESTful Application Programming Model (RAP) — overview
+  https://help.sap.com/docs/abap-cloud/abap-rap/abap-restful-application-programming-model
+  source_owner: SAP SE
+  topic_supported: RAP programming model overview, business object layers, OData service generation, RAP on S/4HANA and BTP ABAP Environment
+  why_needed: Primary taxonomy for RAP artifact classification and component role assignment
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- What is ABAP Cloud
+  https://help.sap.com/docs/abap-cloud/abap-cloud/what-is-abap-cloud
+  source_owner: SAP SE
+  topic_supported: ABAP Cloud programming model tiers, tier-2 compliance rules, forbidden language constructs, object release status
+  why_needed: Defines the ABAP Cloud tier compliance rules that govern what is and is not permitted in clean-core RAP objects
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Behavior Definition (BDEF)
+
+- RAP Behavior Definition
+  https://help.sap.com/docs/abap-cloud/abap-rap/behavior-definition
+  source_owner: SAP SE
+  topic_supported: BDEF syntax, managed vs. unmanaged implementation type, draft enablement (with draft), authorization master/dependent, alias, feature control, action and function declarations, association exposure
+  why_needed: Authoritative reference for BDEF correctness review; defines required keywords and their semantics
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## CDS data model
+
+- RAP CDS Data Model
+  https://help.sap.com/docs/abap-cloud/abap-rap/cds-data-model
+  source_owner: SAP SE
+  topic_supported: Interface CDS views (data definitions), projection CDS views, consumption views, CDS metadata extensions, access control (DCL), draft table configuration, UUID key design
+  why_needed: Defines the three-layer CDS view hierarchy (interface / projection / consumption) and access control (DCL) patterns; used to classify view type misuse and annotation gaps
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Authorization control
+
+- RAP Authorization Control
+  https://help.sap.com/docs/abap-cloud/abap-rap/authorization-control
+  source_owner: SAP SE
+  topic_supported: Authorization master and dependent assignment in BDEF, CHECK_AUTHORIZATION method implementation, AUTHORITY-CHECK for RAP operations, instance-based authorization
+  why_needed: Defines the RAP authorization model; used to classify missing or pass-through authorization checks
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Draft handling
+
+- RAP Draft Handling
+  https://help.sap.com/docs/abap-cloud/abap-rap/draft-handling
+  source_owner: SAP SE
+  topic_supported: Draft-enabled entities, draft table configuration, draftActivate action, BeforeSave validation, lock expiry, draft discard, ETag handling
+  why_needed: Defines RAP draft implementation requirements; used to identify incomplete draft configuration and missing validation handlers
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## ABAP unit testing for RAP
+
+- ABAP Unit Tests for RAP Business Objects
+  https://help.sap.com/docs/abap-cloud/abap-rap/abap-unit-tests-for-rap-business-objects
+  source_owner: SAP SE
+  topic_supported: if_abap_behv_test_environment, if_cds_test_environment, test class structure, MODIFY ENTITIES test calls, ROLLBACK ENTITIES teardown, test double creation
+  why_needed: Defines correct RAP unit test patterns; used to classify missing test doubles and absent teardown methods
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Released API compliance
+
+- Released ABAP Object Types
+  https://help.sap.com/docs/abap-cloud/abap-cloud/released-abap-object-types
+  source_owner: SAP SE
+  topic_supported: C1/C2 release contract definitions, object release status (RELEASED, NOT_RELEASED, DEPRECATED), what is permitted in ABAP Cloud tier-1 and tier-2
+  why_needed: Defines the release contract taxonomy used for classifying NOT_RELEASED API consumption findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- SAP API Business Hub — SAP S/4HANA Cloud product overview and released APIs
+  https://api.sap.com/products/SAPS4HANACloud/overview
+  source_owner: SAP SE
+  topic_supported: C1/C2 released API catalog for S/4HANA and BTP ABAP Environment; used to verify replacement candidates for NOT_RELEASED objects
+  why_needed: Authoritative source for confirming which ABAP objects carry a release contract; must be used to validate any proposed replacement API
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Help Portal documentation describes design intent, required patterns, and release contracts. It does not prove which objects exist in the user's ABAP system, what their release status is in a specific system version, or whether SAP notes have been applied. Users must supply ABAP source code, CDS DDL definitions, BDEF source, or written descriptions of their RAP object model for concrete assessment.

package/skills/sap/sap-abap-cloud-rap-review/references/safety-checklist.md

@@ -0,0 +1,37 @@
+# Safety checklist — SAP ABAP Cloud RAP Review
+
+Use before making any finding or remediation recommendation, especially for authorization and released API compliance findings.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live ABAP system, SAP S/4HANA tenant, or BTP ABAP Environment. This skill reviews artifacts only.
+- Do not accept or request system credentials, RFC connection parameters, logon data, BTP service keys, or client secrets.
+- Do not classify `update_granted = abap_true` (simulated full access) as acceptable in production-bound code. This pattern is explicitly documented as a development-only simulation that must be removed before production deployment.
+- Do not validate release contract status from memory alone. Direct the user to verify proposed C1/C2 alternatives on SAP API Business Hub (api.sap.com) for the specific S/4HANA or BTP ABAP Environment version in scope.
+- Do not recommend consuming NOT_RELEASED SAP internal objects as a remediation step, even if they are technically functional. Only C1/C2 released objects are clean-core compliant in ABAP Cloud.
+- Do not classify a RAP business object's authorization coverage as complete without reviewing the `CHECK_AUTHORIZATION` method implementation. A BDEF with `authorization master ( global )` is meaningless if the method contains pass-through logic.
+- Do not confuse RAP managed and unmanaged implementation types. Managed RAP uses the RAP framework for persistence; unmanaged RAP delegates to custom code. The wrong selection affects OData behavior, draft support, and lock handling.
+
+## What people get wrong
+
+- **Leaving AUTHORITY-CHECK simulation in production**: The `update_granted = abap_true` simulation pattern is a documented development shortcut from openSAP exercises. Any behavior implementation containing this in a production-bound branch is a critical security finding.
+- **Treating `authorization master ( global )` as sufficient**: Declaring `authorization master ( global )` in the BDEF is a structural declaration, not an authorization guarantee. The `CHECK_AUTHORIZATION` method must implement actual `AUTHORITY-CHECK` statements for it to be meaningful.
+- **Assuming draft works without draft table**: `with draft;` in the BDEF requires a matching `draft table` definition in the CDS interface view. Missing the CDS-side draft table causes a runtime error on activation.
+- **Using interface views directly in service bindings**: Interface views should not appear directly in service bindings. The correct pattern is: interface view → projection view → service definition → service binding.
+- **Confusing ROLLBACK WORK and ROLLBACK ENTITIES**: In RAP unit tests, `ROLLBACK ENTITIES` is the correct teardown mechanism, not `ROLLBACK WORK`. Using `ROLLBACK WORK` does not clean up the RAP buffer.
+- **Asserting only initial result in unit tests**: A test that only asserts `assert_initial( failed-travel )` without asserting expected field values provides weak coverage — the test passes even if the result is empty.
+
+## When to push back
+
+- Push back when the user asks for an authorization compliance ruling without providing the behavior implementation class source code for `CHECK_AUTHORIZATION`.
+- Push back when the user proposes to keep a `update_granted = abap_true` simulation in code that will go to production.
+- Push back when released API compliance is in scope but no ABAP source code or object list is provided for review.
+- Push back when the request involves live ABAP system access, ATC execution, or object navigation — redirect to SAP ABAP Test Cockpit or `sap-clean-core-debt-review` for live object enumeration first.
+- Push back when the user proposes consuming a NOT_RELEASED SAP object as a workaround and presents performance or convenience as justification.
+
+## Evidence labels
+
+- `documentation-based` — grounded in official SAP ABAP Cloud docs (help.sap.com/docs/abap-cloud) or SAP Help Portal RAP documentation
+- `user-provided evidence` — ABAP source code, CDS DDL, BDEF source, metadata extensions, or written descriptions provided by the user
+- `context7-supplementary` — RAP authorization and unit test patterns from Context7 openSAP sample repository (supplementary to official SAP docs)
+- `inference` — derived reasoning not directly confirmed; must always be labeled as such

package/skills/sap/sap-abap-cloud-rap-review/references/workflow-and-output.md

@@ -0,0 +1,76 @@
+# Workflow and output contract — SAP ABAP Cloud RAP Review
+
+Use this reference for all classification, severity assignment, and output formatting.
+
+## Review domain taxonomy
+
+| Domain | Scope |
+|--------|-------|
+| `CDS Views` | View type selection (interface/projection/consumption), annotation completeness, metadata extensions, access control (DCL), UUID key design, draft table configuration |
+| `BDEF` | Implementation type (managed/unmanaged), draft enablement, authorization master/dependent, alias, feature control, action/function declarations, association exposure |
+| `Behavior Implementation` | AUTHORITY-CHECK coverage, action method completeness, validation message patterns, determination logic, forbidden language constructs |
+| `Released API Compliance` | C1/C2 contract verification, NOT_RELEASED consumption, DEPRECATED object usage, tier-2 compliance |
+| `ABAP Unit Tests` | Test double usage (if_abap_behv_test_environment / if_cds_test_environment), test class structure, ROLLBACK ENTITIES teardown, CREATE ENTITIES test correctness |
+| `Object Composition` | Root vs. child entity hierarchy, composition relationship completeness, ETag strategy, UUID vs. semantic key trade-offs |
+
+## Severity classification
+
+| Severity | Meaning | Examples |
+|----------|---------|---------|
+| `critical` | Security breach or data integrity loss risk | AUTHORITY-CHECK simulation left active in production-bound code; authorization master method returning allowed without any check |
+| `high` | Functional, correctness, or upgrade-blocking risk | NOT_RELEASED API consumption; missing `with draft;` on a BO requiring Fiori draft editing; missing draftActivate method; unmanaged RAP with no justification |
+| `medium` | Governance, maintainability, or test isolation gap | ROLLBACK ENTITIES missing in test teardown; CDS metadata extension annotations on wrong view layer; unmanaged implementation where managed would suffice |
+| `low` | Best practice deviation or code quality concern | Inconsistent CDS naming conventions; missing alias in BDEF; action not declared as static where appropriate |
+
+## Common finding patterns
+
+### BDEF
+- `with draft;` absent on a root entity that requires Fiori Elements draft editing (high)
+- `authorization master ( global )` declared but CHECK_AUTHORIZATION never implemented in the behavior implementation class (critical)
+- `authorization dependent by _ParentAssociation` incorrectly used on the root entity (high — only valid for child entities)
+- Unmanaged BDEF without documented justification on a greenfield BO (medium)
+
+### Behavior Implementation
+- `update_granted = abap_true` or `delete_granted = abap_true` hard-coded without actual `AUTHORITY-CHECK` — simulation left from development (critical)
+- `AUTHORITY-CHECK OBJECT` used for update but not for delete (high — asymmetric authorization check)
+- Missing `APPEND VALUE #(...) TO reported-travel` for unauthorized operations — authorization failure not surfaced to the caller (high)
+- Validation method that returns without any `APPEND TO failed` or `APPEND TO reported` (high — silent failure)
+
+### CDS Views
+- Interface view directly used in service binding instead of projection view (medium — bypass of projection separation)
+- Access control (DCL) missing on interface view (high for sensitive entities)
+- Draft table not defined on the root CDS interface view while `with draft;` is in the BDEF (high — runtime error)
+- Metadata extension annotations placed on interface view instead of projection view (medium)
+
+### Released API Compliance
+- Direct SELECT from SAP standard database table without C1 released CDS view equivalent (high)
+- Consumption of a function module or BAPI with no C1/C2 release contract in ABAP Cloud context (high)
+- Use of DEPRECATED released objects without noting migration path (medium)
+
+### ABAP Unit Tests
+- Test class uses `MODIFY ENTITIES` against live data without `cl_cds_test_environment` or `cl_abap_behv_test_environment` double (high)
+- `ROLLBACK ENTITIES` absent in `teardown` method (medium)
+- `cds_test_environment->destroy()` absent in `class_teardown` (medium)
+- Test method asserts only initial result without asserting expected field values (low)
+
+## Workflow
+
+1. **Receive artifacts** — ABAP source code, CDS DDL files, BDEF source, metadata extensions, access control definitions, or user descriptions.
+2. **Classify each finding** by review domain above.
+3. **Assign severity** (critical / high / medium / low).
+4. **Identify evidence level** (documentation-based / user-provided evidence / context7-supplementary / inference).
+5. **Recommend specific remediation** — ABAP code pattern to apply, BDEF keyword to add, DCL source to create, API Business Hub check to perform.
+6. **Prioritize** — critical and high severity first; released API compliance and authorization before structural findings; test isolation before style.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Artifacts reviewed and domains in scope
+2. Finding(s) per domain with severity and evidence label
+3. Specific remediation recommendation per finding (with code-level detail from user-provided evidence where available)
+4. Released API compliance summary — list any NOT_RELEASED or DEPRECATED objects with recommended C1/C2 alternatives (to be verified on API Business Hub)
+5. Authorization coverage summary — AUTHORITY-CHECK status for each operation (create/update/delete) per reviewed behavior implementation
+6. Prioritized remediation sequence (critical → high → medium → low)
+7. Escalation trigger if live ABAP system access or ATC execution is required before proceeding