@raishin/vanguard-frontier-agentic 2.2.0 → 2.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "2.2.0",
+  "version": "2.5.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -65,6 +65,7 @@
     "cursor-plugin:write": "node scripts/generate-cursor-plugin.mjs",
     "kiro-powers:write": "node scripts/generate-kiro-powers.mjs",
     "asset-integrity:write": "python3 tests/validate-asset-integrity.py --write",
+    "manifest:write:all": "npm run manifest:write & npm run plugin-manifest:write & npm run cursor-plugin:write & npm run kiro-powers:write & npm run asset-integrity:write & npm run readme-counts:write & wait",
     "test:copilot-bundling": "python3 tests/test-copilot-skill-bundling.py",
     "test:gemini-bundling": "python3 tests/test-gemini-skill-bundling.py",
     "test:cursor-kiro-notices": "node tests/export-cursor-kiro-skill-notice.test.mjs",
@@ -81,7 +82,7 @@
     "@semantic-release/exec": "7.1.0",
     "@semantic-release/git": "10.0.1",
     "@semantic-release/github": "12.0.8",
-    "@semantic-release/npm": "13.1.5",
+    "@semantic-release/npm": "^13.1.5",
     "@semantic-release/release-notes-generator": "14.1.1",
     "conventional-changelog-conventionalcommits": "9.3.1",
     "fast-check": "^4.7.0",

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.2.0",
+  "version": "2.5.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "Raishin",

package/powers/vanguard-salesforce/POWER.md

@@ -0,0 +1,42 @@
+---
+name: "vanguard-salesforce"
+displayName: "Vanguard Frontier — Salesforce"
+description: "Curated Salesforce agents for admin review, development, security, integration, revenue ops, service ops, marketing ops, Agentforce/AI risk, and compliance — static review only, no org mutations. Routes via salesforce-maestro to specialist agents covering Sales Cloud, Service Cloud, Experience Cloud, Marketing Cloud, MuleSoft, Tableau, and industry verticals. All Salesforce terminology and API surfaces are drift-prone; agents always verify against current official documentation before rendering findings."
+keywords: ["salesforce", "agentforce", "crm", "apex", "lwc", "mulesoft", "compliance", "static-review"]
+author: "Raishin"
+---
+# Vanguard Frontier — Salesforce
+
+Curated Salesforce agents for admin review, development, security, integration, revenue ops, service ops, marketing ops, Agentforce/AI risk, and compliance — static review only, no org mutations. Routes via salesforce-maestro to specialist agents covering Sales Cloud, Service Cloud, Experience Cloud, Marketing Cloud, MuleSoft, Tableau, and industry verticals. All Salesforce terminology and API surfaces are drift-prone; agents always verify against current official documentation before rendering findings.
+
+## When to engage this Power
+
+Activate when the task references Salesforce services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`salesforce-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- `salesforce-live-guard-agent` — never auto-dispatched; gate_mode only
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Static review only — agents never request org credentials, session tokens, or user PII, and never mutate a Salesforce org.
+- Salesforce API versions and feature availability vary by org edition and release; verify org context (edition, API version, enabled features) before applying any recommendation.
+- Agentforce and Einstein AI configurations are adversarially reviewed for prompt-injection risk, ungrounded automation, and missing human-handoff controls before any approve-or-merge decision.
+- Live-guard agent (salesforce-live-guard-agent) must never be auto-dispatched; require explicit approval, target org confirmation, and rollback plan.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/salesforce/` in that repository. All 30 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider salesforce --repo .`

package/schemas/agent.schema.json

@@ -49,7 +49,11 @@
         "kubernetes",
         "terraform",
         "multi-cloud",
-        "generic"
+        "generic",
+        "dotnet",
+        "hr",
+        "legal",
+        "salesforce"
       ]
     },
     "harnesses": {

package/schemas/skill.frontmatter.schema.json

@@ -82,7 +82,10 @@
             "architecture",
             "messaging",
             "serverless",
-            "cost-management"
+            "cost-management",
+            "operational",
+            "generation",
+            "devsecops"
           ]
         },
         "lifecycle": {
@@ -104,8 +107,35 @@
       "description": "Optional fields for live-execution skills (e.g. read-only-runtime gates). Declared at the metadata block level. See docs/live-agents/ for the full contract.",
       "properties": {
         "execution_tier": {
-          "enum": ["static-review", "read-only-runtime", "mutating-runtime"],
-          "description": "Trust posture: static-review (no execution), read-only-runtime (allowlisted Bash, no mutation), mutating-runtime (changes external state)."
+          "enum": ["static-review", "read-only-runtime", "sandbox-mutating", "mutating-runtime"],
+          "description": "Trust posture: static-review (no execution), read-only-runtime (allowlisted Bash, no mutation), sandbox-mutating (dry-run or sandbox-only changes, never production), mutating-runtime (changes external state — gated by additional human-in-the-loop controls)."
+        },
+        "mcp_servers": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Optional. List of MCP server identifiers this skill targets. Empty array means no MCP integration (CLI-only or static-review)."
+        },
+        "oauth_scopes": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Optional. Explicit list of OAuth scopes required for live execution. Empty array means no OAuth scopes needed (static-review or local-only operations). For Salesforce: minimum scopes only — never request 'full' or 'web'."
+        },
+        "run_as_permissions": {
+          "type": "object",
+          "description": "Optional. Documents the 'Run As' service account permission posture for runtime tiers.",
+          "properties": {
+            "required": {
+              "type": "array",
+              "items": { "type": "string", "minLength": 1 },
+              "description": "Minimum permission set or profile permissions required on the Run As account."
+            },
+            "denied": {
+              "type": "array",
+              "items": { "type": "string", "minLength": 1 },
+              "description": "Permissions that MUST be explicitly denied on the Run As account. For Salesforce T1: ModifyAllData, ViewAllData, ViewEncryptedData, ModifyMetadata are typical denies."
+            }
+          },
+          "additionalProperties": true
         },
         "required_egress": {
           "type": "array",

package/schemas/skill.schema.json

@@ -42,7 +42,11 @@
         "kubernetes",
         "terraform",
         "multi-cloud",
-        "generic"
+        "generic",
+        "dotnet",
+        "hr",
+        "legal",
+        "salesforce"
       ]
     },
     "harnesses": {

package/scripts/export-marketplace-agents.mjs

@@ -304,8 +304,20 @@ function loadSkills() {
     for (const skill of fs.readdirSync(providerDir, { withFileTypes: true })) {
       if (!skill.isDirectory()) continue;
       const skillDir = path.join(providerDir, skill.name);
+      const metaFile = path.join(skillDir, "metadata.json");
       if (fs.existsSync(path.join(skillDir, "SKILL.md"))) {
-        byName.set(skill.name, { dir: skillDir, provider: provider.name });
+        let skillProvider = provider.name;
+        if (fs.existsSync(metaFile)) {
+          try {
+            const meta = JSON.parse(fs.readFileSync(metaFile, "utf8"));
+            if (meta.provider) {
+              skillProvider = meta.provider;
+            }
+          } catch (err) {
+            // Fall back to directory name if metadata.json is invalid.
+          }
+        }
+        byName.set(skill.name, { dir: skillDir, provider: skillProvider });
       }
     }
   }
@@ -554,7 +566,23 @@ function main() {
       throw new Error(`No agents found for --provider '${args.provider}'.`);
     }
   } else if (args.all) {
-    selectedAgents = agents;
+    // --all targets every catalog agent, but only those that actually
+    // declare harness variants for the requested platform can be exported.
+    // Agents authored without per-harness adapter files (e.g., declaring
+    // harnesses: ["other"] as a Wave-1 placeholder) are silently skipped
+    // with a stderr notice so smoke tests don't fail on incomplete portfolios.
+    const platformConfig = PLATFORM_CONFIG[platform];
+    const requiredVariants = platformConfig.variants.map(([variantKey]) => variantKey);
+    const supports = (agent) =>
+      requiredVariants.every((variantKey) => agent.harness_variants?.[variantKey]);
+    selectedAgents = agents.filter(supports);
+    const skipped = agents.length - selectedAgents.length;
+    if (skipped > 0) {
+      process.stderr.write(
+        `[vfa] --all on platform '${platform}': skipped ${skipped} agent(s) ` +
+        `without ${requiredVariants.join("+")} harness variant(s).\n`
+      );
+    }
   } else {
     selectedAgents = args.agents.map((agentId) => {
       const agent = byId.get(agentId);

package/scripts/generate-kiro-powers.mjs

@@ -196,6 +196,18 @@ const PROVIDERS = {
       "Driver and CUDA version changes have node-wide blast radius — review compatibility matrix first.",
     ],
   },
+  salesforce: {
+    displayName: "Vanguard Frontier — Salesforce",
+    description:
+      "Curated Salesforce agents for admin review, development, security, integration, revenue ops, service ops, marketing ops, Agentforce/AI risk, and compliance — static review only, no org mutations. Routes via salesforce-maestro to specialist agents covering Sales Cloud, Service Cloud, Experience Cloud, Marketing Cloud, MuleSoft, Tableau, and industry verticals. All Salesforce terminology and API surfaces are drift-prone; agents always verify against current official documentation before rendering findings.",
+    keywords: ["salesforce", "agentforce", "crm", "apex", "lwc", "mulesoft", "compliance", "static-review"],
+    invariants: [
+      "Static review only — agents never request org credentials, session tokens, or user PII, and never mutate a Salesforce org.",
+      "Salesforce API versions and feature availability vary by org edition and release; verify org context (edition, API version, enabled features) before applying any recommendation.",
+      "Agentforce and Einstein AI configurations are adversarially reviewed for prompt-injection risk, ungrounded automation, and missing human-handoff controls before any approve-or-merge decision.",
+      "Live-guard agent (salesforce-live-guard-agent) must never be auto-dispatched; require explicit approval, target org confirmation, and rollback plan.",
+    ],
+  },
 };
 
 const catalog = JSON.parse(readFileSync(catalogPath, "utf8"));

package/scripts/release-prepare.mjs

@@ -53,6 +53,13 @@ const VERSION_PINNED_PLUGINS = [
   ".github/plugin/marketplace.json",
 ];
 
+// Plugin manifests whose version lives under a nested key (not top-level).
+// Each entry declares the relative path and the dot-path to the version field.
+const VERSION_PINNED_NESTED = [
+  // Claude Code marketplace catalog — version sits under metadata.version.
+  { path: ".claude-plugin/marketplace.json", key: "metadata.version" },
+];
+
 function syncPluginVersion(relPath) {
   const abs = join(REPO, relPath);
   const data = JSON.parse(readFileSync(abs, "utf8"));
@@ -64,6 +71,28 @@ function syncPluginVersion(relPath) {
   return true;
 }
 
+function syncNestedPluginVersion({ path: relPath, key }) {
+  const abs = join(REPO, relPath);
+  const data = JSON.parse(readFileSync(abs, "utf8"));
+  const segments = key.split(".");
+  let cursor = data;
+  for (let i = 0; i < segments.length - 1; i += 1) {
+    if (cursor[segments[i]] === undefined) {
+      // Hard-fail so a schema drift (e.g. metadata.version renamed) is caught
+      // immediately and cannot silently skip the marketplace version sync.
+      throw new Error(`[release-prepare] missing nested key path "${key}" in ${relPath} — schema drift detected`);
+    }
+    cursor = cursor[segments[i]];
+  }
+  const last = segments[segments.length - 1];
+  if (cursor[last] === NEXT_VERSION) {
+    return false;
+  }
+  cursor[last] = NEXT_VERSION;
+  writeFileSync(abs, JSON.stringify(data, null, 2) + "\n", "utf8");
+  return true;
+}
+
 // Sync the "current published version" banner and supported-version table in
 // SECURITY.md from package.json. Keeps the security policy credible without
 // requiring a manual edit on every release.
@@ -156,6 +185,12 @@ for (const rel of VERSION_PINNED_PLUGINS) {
     touched += 1;
   }
 }
+for (const entry of VERSION_PINNED_NESTED) {
+  if (syncNestedPluginVersion(entry)) {
+    console.log(`[release-prepare] updated ${entry.path} (${entry.key})`);
+    touched += 1;
+  }
+}
 
 if (syncSecurityMd(NEXT_VERSION)) {
   console.log("[release-prepare] updated SECURITY.md");

package/skills/aws/aws-agentcore/references/official-sources.md

@@ -4,43 +4,43 @@ Use this reference when grounding current Amazon Bedrock AgentCore behavior.
 
 ## Amazon Bedrock AgentCore
 
-- Get started with Amazon Bedrock AgentCore CLI  
+- Get started with Amazon Bedrock AgentCore CLI
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agentcore-get-started-cli.md
-- Available interfaces for using Amazon Bedrock AgentCore  
+- Available interfaces for using Amazon Bedrock AgentCore
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/develop-agents.html
-- AgentCore harness overview  
+- AgentCore harness overview
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness.html
-- Get started with the harness  
+- Get started with the harness
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-get-started.html
-- Environment and Skills  
+- Environment and Skills
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-environment.html
-- Security and access control  
+- Security and access control
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-security.html
-- What is Amazon Bedrock AgentCore  
+- What is Amazon Bedrock AgentCore
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/what-is-bedrock-agentcore.html
-- Runtime getting started  
+- Runtime getting started
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-get-started.html
-- AgentCore Memory  
+- AgentCore Memory
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory.html
-- AgentCore Gateway  
+- AgentCore Gateway
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html
-- AgentCore Identity  
+- AgentCore Identity
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity.html
-- AgentCore Observability  
+- AgentCore Observability
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-configure.html
-- Browser tool  
+- Browser tool
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-tool.html
-- Code Interpreter  
+- Code Interpreter
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter.html
-- AgentCore tools configuration  
+- AgentCore tools configuration
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-tools.html
-- Policy in AgentCore  
+- Policy in AgentCore
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html
-- Create a policy  
+- Create a policy
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-create-policies.html
-- Core concepts for policy  
+- Core concepts for policy
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-core-concepts.html
-- Harness operations  
+- Harness operations
   https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-operations.html
 
 ## Grounded notes from Context7

package/skills/aws/aws-generative-ai-developer/references/official-sources.md

@@ -4,28 +4,28 @@ Use this reference when grounding current AWS generative AI developer guidance.
 
 ## Amazon Bedrock
 
-- What is Amazon Bedrock  
+- What is Amazon Bedrock
   https://docs.aws.amazon.com/bedrock/latest/userguide/what-is-bedrock.html
-- Amazon Bedrock security overview  
+- Amazon Bedrock security overview
   https://docs.aws.amazon.com/bedrock/latest/userguide/security-overview.html
-- Security best practices for Amazon Bedrock Agents  
+- Security best practices for Amazon Bedrock Agents
   https://docs.aws.amazon.com/bedrock/latest/userguide/security-best-practice-agents.html
-- Prompt injection  
+- Prompt injection
   https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html
-- Serverless prompt chaining example  
+- Serverless prompt chaining example
   https://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-example-cross-serverless-prompt-chaining-section.html
 
 ## AWS serverless foundations
 
-- AWS Lambda best practices  
+- AWS Lambda best practices
   https://docs.aws.amazon.com/lambda/latest/dg/best-practices.html
-- AWS Lambda with Step Functions  
+- AWS Lambda with Step Functions
   https://docs.aws.amazon.com/lambda/latest/dg/with-step-functions.html
-- AWS Lambda observability  
+- AWS Lambda observability
   https://docs.aws.amazon.com/lambda/latest/operatorguide/monitoring-observability.html
-- Amazon API Gateway security best practices  
+- Amazon API Gateway security best practices
   https://docs.aws.amazon.com/apigateway/latest/developerguide/security-best-practices.html
-- Event-driven architecture on AWS  
+- Event-driven architecture on AWS
   https://docs.aws.amazon.com/wellarchitected/latest/serverless-applications-lens/event-driven-architecture.html
 
 ## Grounding rule

package/skills/azure/azure-ai-foundry-ops-governor/references/workflow-and-output.md

@@ -80,10 +80,10 @@
 3.
 
 ## Rollout blockers
-- 
+-
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-aks-platform-operator/references/workflow-and-output.md

@@ -104,7 +104,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-app-service-production-readiness/references/workflow-and-output.md

@@ -108,7 +108,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-cosmosdb-application-developer/references/official-sources.md

@@ -4,30 +4,30 @@ Use this reference only when you need the detailed source list or need to ground
 
 ## Azure MCP
 
-- Azure MCP overview  
+- Azure MCP overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview
-- Azure MCP concepts  
+- Azure MCP concepts
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/concepts
-- Azure MCP tools overview  
+- Azure MCP tools overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/
 
 ## Azure Cosmos DB
 
-- Partitioning and horizontal scaling in Azure Cosmos DB  
+- Partitioning and horizontal scaling in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/partitioning
-- Data modeling in Azure Cosmos DB for NoSQL  
+- Data modeling in Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/cosmos-db/modeling-data
-- Consistency levels in Azure Cosmos DB  
+- Consistency levels in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/consistency-levels
-- Manage consistency levels in Azure Cosmos DB  
+- Manage consistency levels in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-manage-consistency
-- Tuning query performance with Azure Cosmos DB  
+- Tuning query performance with Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/query-metrics
-- Architecture best practices for Azure Cosmos DB for NoSQL  
+- Architecture best practices for Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/well-architected/service-guides/cosmos-db
-- Transactional batch in Azure Cosmos DB  
+- Transactional batch in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/transactional-batch
-- Find request unit charge in Azure Cosmos DB  
+- Find request unit charge in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/find-request-unit-charge
 
 ## Grounded insights used by this skill

package/skills/azure/azure-cosmosdb-performance-investigator/references/official-sources.md

@@ -4,30 +4,30 @@ Use this reference only when you need the detailed source list or need to ground
 
 ## Azure MCP
 
-- Azure MCP overview  
+- Azure MCP overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview
-- Azure MCP concepts  
+- Azure MCP concepts
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/concepts
-- Azure MCP tools overview  
+- Azure MCP tools overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/
 
 ## Azure Cosmos DB performance and profiling
 
-- Troubleshoot query issues when using Azure Cosmos DB  
+- Troubleshoot query issues when using Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/troubleshoot-query-performance
-- Tuning query performance with Azure Cosmos DB  
+- Tuning query performance with Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/query-metrics
-- Indexing metrics in Azure Cosmos DB  
+- Indexing metrics in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/index-metrics
-- Monitor and debug with insights in Azure Cosmos DB  
+- Monitor and debug with insights in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/use-metrics
-- Redistribute throughput across partitions in Azure Cosmos DB  
+- Redistribute throughput across partitions in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-redistribute-throughput-across-partitions
-- Performance tips for Azure Cosmos DB and .NET  
+- Performance tips for Azure Cosmos DB and .NET
   https://learn.microsoft.com/en-us/azure/cosmos-db/performance-tips-dotnet-sdk-v3
-- Partitioning and horizontal scaling in Azure Cosmos DB  
+- Partitioning and horizontal scaling in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/partitioning
-- Architecture best practices for Azure Cosmos DB for NoSQL  
+- Architecture best practices for Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/well-architected/service-guides/cosmos-db
 
 ## Grounded insights used by this skill

package/skills/azure/azure-cosmosdb-platform-operator/references/official-sources.md

@@ -4,28 +4,28 @@ Use this reference only when you need the detailed source list or need to ground
 
 ## Azure MCP
 
-- Azure MCP overview  
+- Azure MCP overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview
-- Azure MCP concepts  
+- Azure MCP concepts
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/concepts
-- Azure MCP tools overview  
+- Azure MCP tools overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/
 
 ## Azure Cosmos DB
 
-- Partitioning and horizontal scaling in Azure Cosmos DB  
+- Partitioning and horizontal scaling in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/partitioning
-- Data modeling in Azure Cosmos DB for NoSQL  
+- Data modeling in Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/cosmos-db/modeling-data
-- Consistency levels in Azure Cosmos DB  
+- Consistency levels in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/consistency-levels
-- Manage consistency levels in Azure Cosmos DB  
+- Manage consistency levels in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-manage-consistency
-- Tuning query performance with Azure Cosmos DB  
+- Tuning query performance with Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/query-metrics
-- Architecture best practices for Azure Cosmos DB for NoSQL  
+- Architecture best practices for Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/well-architected/service-guides/cosmos-db
-- Hierarchical partition keys  
+- Hierarchical partition keys
   https://learn.microsoft.com/en-us/azure/cosmos-db/hierarchical-partition-keys
 
 ## Grounded insights used by this skill

package/skills/azure/azure-cost-estimation-review/references/workflow-and-output.md

@@ -59,7 +59,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-cost-optimization-governor/references/workflow-and-output.md

@@ -58,7 +58,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags