@raishin/vanguard-frontier-agentic 2.2.0 → 2.5.0

package/skills/salesforce/salesforce-field-mapping-skill/references/picklist-value-mapping.md

@@ -0,0 +1,245 @@
+# Picklist Value Mapping Reference
+
+## Key Rules
+
+1. **Case-sensitive:** `"Closed Won"` ≠ `"closed won"` in Data Loader
+2. **API value vs. display label:** These can differ in custom picklists;
+   always use the API value (also called the "internal value")
+3. **Multi-select separator:** Semicolon (`;`) in Data Loader imports
+4. **Inactive values:** Existing records with inactive picklist values retain
+   them, but new records cannot be assigned inactive values
+
+---
+
+## Standard Picklist Values by Field
+
+### LeadSource (Contact, Lead, Opportunity)
+
+```
+Cold Call
+Web
+Phone Inquiry
+Partner Referral
+Purchased List
+Other
+Word of mouth
+Employee
+Internal
+Partner
+```
+
+### StageName (Opportunity)
+
+Default Salesforce values (orgs commonly customize these):
+```
+Prospecting
+Qualification
+Needs Analysis
+Value Proposition
+Id. Decision Makers
+Perception Analysis
+Proposal/Price Quote
+Negotiation/Review
+Closed Won
+Closed Lost
+```
+
+### Industry (Account, Lead)
+
+```
+Agriculture
+Apparel
+Banking
+Biotechnology
+Chemicals
+Communications
+Construction
+Consulting
+Education
+Electronics
+Energy
+Engineering
+Entertainment
+Environmental
+Finance
+Food & Beverage
+Government
+Healthcare
+Hospitality
+Insurance
+Machinery
+Manufacturing
+Media
+Not For Profit
+Recreation
+Retail
+Shipping
+Technology
+Telecommunications
+Transportation
+Utilities
+Other
+```
+
+### Rating (Lead, Account)
+
+```
+Hot
+Warm
+Cold
+```
+
+### Lead Status (Lead)
+
+```
+Open - Not Contacted
+Working - Contacted
+Closed - Converted
+Closed - Not Converted
+```
+
+### Account Type (Account)
+
+```
+Prospect
+Customer - Direct
+Customer - Channel
+Channel Partner / Reseller
+Installation Partner
+Technology Partner
+Other
+```
+
+### Case Status (Case)
+
+```
+New
+Working
+Escalated
+Closed
+```
+
+### Case Priority (Case)
+
+```
+Low
+Medium
+High
+```
+
+### Case Origin (Case)
+
+```
+Phone
+Email
+Web
+```
+
+### Salutation (Contact, Lead)
+
+```
+Mr.
+Ms.
+Mrs.
+Dr.
+Prof.
+```
+
+---
+
+## Dependent Picklist Concepts
+
+A **dependent picklist** shows only the values valid for the currently
+selected controlling field value. When mapping:
+
+1. Identify if the source system has both controlling and dependent values
+2. Map controlling field first, then dependent field
+3. Verify that source dependent values are valid for the controlling value
+   in the target org — invalid combinations are silently blanked or rejected
+
+**Example:** Type = "Partner" controls Subtype picklist. If source has
+Type = "Reseller" (valid in source, invalid in target), the Subtype
+value will also be invalid.
+
+---
+
+## Multi-Select Picklist Value Normalization
+
+### Separator Conversion
+
+| Source separator | Action |
+|---|---|
+| Comma (`,`) | Replace with semicolon (`;`) |
+| Pipe (`\|`) | Replace with semicolon (`;`) |
+| Semicolon (`;`) | Already correct for Data Loader |
+| Space-separated | Ambiguous — check if values contain spaces; use manual review |
+
+### Value Case Normalization Table (example)
+
+| Source value | Salesforce API value |
+|---|---|
+| `technology` | `Technology` |
+| `TECHNOLOGY` | `Technology` |
+| `Financial Services` | May be `Financial Services` — verify against org picklist |
+| `fin-serv` | Unknown — requires business mapping decision |
+
+---
+
+## Mapping Source CRM Values to Salesforce Picklists
+
+### HubSpot Lead Status → Salesforce Lead Status
+
+| HubSpot | Salesforce |
+|---|---|
+| `new` | `Open - Not Contacted` |
+| `open` | `Open - Not Contacted` |
+| `in_progress` | `Working - Contacted` |
+| `qualified` | `Working - Contacted` |
+| `unqualified` | `Closed - Not Converted` |
+| `connected` | `Working - Contacted` |
+| `bad_timing` | `Closed - Not Converted` |
+
+### Pipedrive Stage → Salesforce Stage
+
+Pipedrive stages are org-specific — no universal mapping. Establish a
+manual mapping table from the Pipedrive admin's stage list to Salesforce
+`StageName` values. Flag this as a REQUIRED business decision in the output.
+
+### Pipedrive Priority → Salesforce Priority/Rating
+
+| Pipedrive | Salesforce |
+|---|---|
+| `3` (high) | `Hot` |
+| `2` (medium) | `Warm` |
+| `1` (low) | `Cold` |
+
+---
+
+## Inactive Picklist Values
+
+When source data contains values that exist in Salesforce but are marked
+inactive:
+
+1. Flag the inactive values in the mapping output
+2. Options:
+   - Reactivate the value before import
+   - Map to a currently active equivalent value
+   - Import with a custom `Other` or catch-all value and note for review
+
+Inactive picklist values will cause Data Loader validation errors on
+insert/upsert operations if the field has "Restrict picklist to the values
+defined in the value set" enabled.
+
+---
+
+## Custom Picklist Field Values
+
+For custom picklist fields, the admin must provide the exact API values
+from Setup → Object Manager → Fields → Picklist Options. Labels and API
+values may differ.
+
+When custom picklist values are unknown:
+1. Note in `unmapped_source_columns` with reason `"custom picklist values unknown"`
+2. Recommend using `salesforce-metadata-fetcher-skill` to retrieve the
+   picklist value set from a live org
+3. Provide a placeholder mapping with a `<!-- verify-values -->` annotation

package/skills/salesforce/salesforce-field-mapping-skill/references/type-mismatch-detection.md

@@ -0,0 +1,187 @@
+# Type Mismatch Detection Reference
+
+## Risk Levels
+
+| Risk | Meaning |
+|---|---|
+| HIGH | Import will fail or corrupt data without a transform step |
+| MEDIUM | Import may succeed but data may be inaccurate or truncated |
+| LOW | Import will succeed; minor precision or formatting concern |
+
+---
+
+## Common Type Mismatches
+
+### String → Date (HIGH)
+
+**Scenario:** Source contains date strings like `"01/15/2026"` or
+`"Jan 15, 2026"` targeting a Salesforce Date field.
+
+**Why it fails:** Salesforce Data Loader requires ISO 8601 date format
+(`YYYY-MM-DD`). Non-ISO formats cause import failure or null values.
+
+**Transform required:**
+- Excel: Use formula `=TEXT(A1,"YYYY-MM-DD")`
+- Python: `pd.to_datetime(df['col']).dt.strftime('%Y-%m-%d')`
+- Salesforce Dataflows: `DATEVALUE(TEXT(date_field))`
+- Common non-ISO formats to flag: `MM/DD/YYYY`, `DD/MM/YYYY`,
+  `Month DD, YYYY`, `YYYY/MM/DD`
+
+---
+
+### String → Number / Currency (HIGH)
+
+**Scenario:** Source contains values like `"$1,234.56"`, `"1 500"`,
+`"1.5M"` targeting a Number or Currency field.
+
+**Why it fails:** Data Loader cannot parse currency symbols, thousand
+separators, or shorthand.
+
+**Transform required:**
+- Strip currency symbol: `$1,234.56` → `1234.56`
+- Remove thousand separator: `1,234` → `1234`
+- Expand shorthand: `1.5M` → `1500000`
+- Set decimal precision — Salesforce Currency fields have a max 18 digits
+  with up to 2 decimal places by default
+
+---
+
+### Multi-Value String → Single Picklist (HIGH)
+
+**Scenario:** Source column contains `"Technology; Financial Services"` but
+the target is a single-select picklist.
+
+**Why it fails:** Single picklist accepts exactly one value. Multi-value
+strings do not map automatically.
+
+**Options:**
+1. Use only the first value: `Technology`
+2. Create a multi-select picklist field instead
+3. Use the most specific/relevant value (requires business decision)
+
+---
+
+### String → Boolean / Checkbox (MEDIUM)
+
+**Scenario:** Source contains `"Yes"`, `"No"`, `"1"`, `"0"`, `"TRUE"`,
+`"FALSE"`, `"X"` targeting a Salesforce Checkbox.
+
+**Data Loader behavior:** Accepts only `true` or `false` (case-insensitive).
+Other values may be treated as `false`.
+
+**Normalization map:**
+| Source value | Map to |
+|---|---|
+| `Yes`, `yes`, `Y`, `y`, `1`, `TRUE`, `true`, `X` | `true` |
+| `No`, `no`, `N`, `n`, `0`, `FALSE`, `false`, blank | `false` |
+
+---
+
+### String → Lookup (Record ID) (HIGH)
+
+**Scenario:** Source contains a related record name or external ID but the
+target Salesforce field requires an 18-character Salesforce ID.
+
+**Why it fails:** Lookup fields store the related record's Salesforce ID,
+not its name.
+
+**Options:**
+1. **Upsert by external ID:** Set an external ID field on the related object
+   and use `RelationshipFieldName:ExternalIdField` syntax in Data Loader.
+   Example: `Account:External_ID__c` to resolve AccountId.
+2. **Pre-query IDs:** Run a SOQL query to build a name-to-ID mapping before
+   import.
+3. **Upsert by Email on Contact/Lead:** Salesforce supports
+   `AccountId:Account:Name` for Account lookups when Name is unique.
+
+---
+
+### Integer → Currency (LOW)
+
+**Scenario:** Source column contains integers (`1234`) targeting a
+Currency field (`1234.00`).
+
+**Risk:** Low — Salesforce accepts integers for currency fields and stores
+as `1234.00`. Verify that the source column is not storing values in
+whole-dollar amounts while the business expects cents.
+
+---
+
+### Mixed Case String → Picklist (MEDIUM)
+
+**Scenario:** Source has `"closed won"` or `"CLOSED WON"` but Salesforce
+picklist value is `"Closed Won"`.
+
+**Why it fails:** Picklist values in Data Loader are **case-sensitive**.
+`"closed won"` ≠ `"Closed Won"` and will import as a blank picklist value
+or trigger a validation error.
+
+**Transform required:** Normalize source values to exact Salesforce picklist
+API value casing before import.
+
+---
+
+### DateTime → Date (MEDIUM)
+
+**Scenario:** Source contains `"2026-01-15 14:30:00"` targeting a Date field
+(not DateTime).
+
+**Risk:** Data Loader will reject the value or strip the time component
+inconsistently depending on locale settings.
+
+**Transform required:** Strip time component: `2026-01-15 14:30:00` → `2026-01-15`
+
+---
+
+### String → Email (LOW)
+
+**Scenario:** Source column is plain text but target is Email field type.
+
+**Risk:** Low if values are already valid email format. Data Loader validates
+email format — invalid emails will be rejected.
+
+**Check:** Scan source column for values not matching `*@*.*` pattern.
+
+---
+
+### Long Text → Standard Text (MEDIUM)
+
+**Scenario:** Source column contains values exceeding 255 characters targeting
+a standard Text field (255 char limit).
+
+**Risk:** Values exceeding the limit will be truncated or cause import failure.
+
+**Fix:** Map to a LongTextArea or RichTextArea field, or add a pre-import
+truncation step.
+
+---
+
+## Encrypted Field Handling
+
+Fields with Salesforce Shield Platform Encryption (PMLE or Classic) have
+additional import constraints:
+
+- **Data Loader** can import into encrypted fields but requires the user
+  running the import to have `View Encrypted Data` permission
+- **PMLE-encrypted fields** cannot be used as upsert external ID keys
+- **Classic encryption** masks values even for users with View access unless
+  the user also has Manage Encryption Keys
+
+Always flag encrypted target fields in the mapping output.
+
+---
+
+## Multi-Select Picklist Handling
+
+Salesforce multi-select picklist fields use semicolon (`;`) as the value
+separator in Data Loader imports.
+
+| Source | Transform | Target |
+|---|---|---|
+| `"Value1,Value2"` | Replace `,` with `;` | `Value1;Value2` |
+| `"Value1\|Value2"` | Replace `\|` with `;` | `Value1;Value2` |
+| `"Value1"` (single) | No change | `Value1` |
+
+**Warning:** Values must match the picklist exactly (case-sensitive).
+Invalid values in multi-select imports are silently dropped in some
+Data Loader versions.

package/skills/salesforce/salesforce-flow-automation-review-skill/SKILL.md

@@ -0,0 +1,163 @@
+---
+name: salesforce-flow-automation-review-skill
+description: Use this skill when Salesforce Flow XML, validation rules, approval processes, or record-triggered automation must be reviewed for correctness, safety, and maintainability. Flags recursion, ungoverned bypass flags, brittle null handling, missing fault paths, hardcoded recipients, before-save vs after-save misuse, and mixed Process Builder plus Flow plus Apex on same object. Trigger phrases: "review this Flow", "check this automation for recursion", "review this approval process", "is this validation rule safe", "review this record-triggered automation". Do not use when Apex code is the primary subject (use salesforce-apex-lwc-code-review-skill), when metadata quality (not logic) is the focus (use salesforce-metadata-review-skill), or when a live automation activation is proposed (use salesforce-live-change-approval-protocol). Works from pasted or exported automation definitions only; never requests live org access.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-20"
+  category: platform
+  lifecycle: experimental
+---
+
+# Salesforce Flow Automation Review Skill
+
+## Purpose
+This skill reviews Salesforce Flow XML, validation rules, approval processes,
+and record-triggered automation for correctness, safety, and maintainability.
+It flags patterns that cause data corruption, runaway governor-limit
+consumption, incorrect execution order, and logic errors. It does not access
+live orgs and does not authorize automation activation.
+
+## When to use
+- A Flow is being reviewed before activation in production.
+- A record-triggered automation has caused unexpected behavior and must be analyzed.
+- An automation inventory contains mixed automation types on the same object.
+- An approval process or validation rule needs pre-release safety review.
+
+## When not to use
+- Apex code is the primary subject — use `salesforce-apex-lwc-code-review-skill`.
+- Metadata quality (field definitions, layouts) — use `salesforce-metadata-review-skill`.
+- Live automation activation proposal — use `salesforce-live-change-approval-protocol`.
+- Full org automation inventory — use `salesforce-org-assessment-skill`.
+
+## Minimum payload (required inputs)
+- Flow XML (or equivalent exported Flow definition) or automation description.
+- Automation type: record-triggered, screen, scheduled, autolaunched, or subflow.
+- Object(s) the automation acts on.
+- Whether other automation types (Apex triggers, Process Builder
+,
+  validation rules) are active on the same object.
+
+## Workflow
+
+### 1. Recursion detection
+- Identify flows that update the same object that triggered them.
+- Check for recursion prevention mechanisms: `$Flow.CurrentStage`, custom boolean
+  field as recursion guard, or explicit entry condition excluding re-triggered records.
+- Flag flows that could recursively fire without a guard.
+
+### 2. Bypass flags
+- Flag flows that check custom bypass permissions or hierarchy settings to skip
+  execution (e.g., `Bypass_All_Flows__c` custom field or permission set bypass).
+- Determine whether bypass is documented, scoped, and auditable.
+- Flag ungoverned bypass: bypass that has no associated approval process or
+  documentation.
+
+### 3. Null handling
+- Review Decision elements for null-check branches.
+- Flag formulas or conditions that will throw errors on null values.
+- Flag flows that access lookup fields without a null guard on the lookup itself.
+- Flag `Get Records` elements whose output is used without a null check after
+  the element.
+
+### 4. Fault paths
+- Verify that every element that can fail (DML, invocable actions, callouts,
+  platform events) has a connected Fault path.
+- Flag flows where a Fault path is missing entirely.
+- Flag Fault paths that silently swallow errors (no logging, no notification).
+
+### 5. Before-save vs after-save misuse
+- Record-triggered flows operating before-save: flag if they make DML operations
+  (not allowed in before-save context).
+- Record-triggered flows operating after-save: flag if they could be moved to
+  before-save for efficiency (field updates only, no related-record operations).
+- Flag after-save flows that cause cascading DML triggering Apex triggers.
+
+### 6. Hardcoded recipients and IDs
+- Flag hardcoded email addresses in Send Email elements.
+- Flag hardcoded user IDs or group IDs in assignment or notification elements.
+- Recommend: Custom Metadata, Custom Labels, or hierarchy settings instead.
+
+### 7. Mixed automation on same object
+- Identify if Process Builder
+(deprecated),
+  Apex triggers, and Flows are all active on the same object.
+- Flag execution order risks: trigger order between Apex and Flows is not always
+  deterministic; flag if both Fire at the same DML moment.
+- Recommend: migration plan to consolidate to a single automation layer.
+
+### 8. Approval process review
+- Flag approval processes without email templates (hardcoded notification text).
+- Flag approval processes where the final approver is a specific user ID.
+- Flag approval processes with no rejection branch behavior defined.
+- Flag approval processes on objects also governed by Flow with duplicate logic.
+
+### 9. Validation rule review
+- Flag validation rules with no descriptive error message.
+- Flag validation rules that reference fields not on the current object without
+  a VLOOKUP — this can cause silent failures.
+- Flag validation rules that fire on all events when they should be
+  conditioned on specific record types or entry points.
+
+## Evidence requirements
+- Exported Flow XML or detailed automation description; no credentials, no session tokens.
+- Object name(s) and list of other active automation on the same object.
+- If the automation accesses external systems (callouts), note the endpoint category.
+
+## Output format
+```
+flow_automation_findings:
+  recursion_risks:
+    - finding: [description]
+      severity: Critical | High | Medium | Low
+      evidence: [element name or condition]
+      recommendation: [brief]
+  bypass_flag_risks: [same structure]
+  null_handling_risks: [same structure]
+  fault_path_gaps: [same structure]
+  before_after_save_issues: [same structure]
+  hardcoded_values: [same structure]
+  mixed_automation_risks: [same structure]
+  approval_process_findings: [same structure]
+  validation_rule_findings: [same structure]
+
+summary:
+  total_findings: [count]
+  critical_count: [count]
+  high_count: [count]
+escalation_gates_fired: [from salesforce-risk-taxonomy, or "none"]
+assumptions: [list]
+missing_evidence: [what would improve the review]
+```
+
+## Redaction rules
+- Never request secrets, credentials, OAuth tokens, refresh tokens, session IDs, MFA seeds, customer PII.
+- Sanitize org IDs, user IDs (replace with placeholders) before sharing in outputs.
+- Do not repeat hardcoded email addresses or user IDs from Flow XML in output; describe pattern and location.
+
+## Privilege / data handling rules
+- Automation review is logic-level only; do not carry record data from Flow outputs.
+- Findings involving data exposure patterns escalate to salesforce-permission-model-review-skill.
+
+## Handoff rules
+- Hands off to: salesforce-apex-lwc-code-review-skill (if Apex triggers are involved),
+  salesforce-permission-model-review-skill (if permission bypass is found),
+  salesforce-org-assessment-skill (if mixed automation is systemic).
+- If escalation gate fires: salesforce-case-capsule with escalation_required = true.
+- Required handoff fields: matter_id, automation_type, object_name, escalation_gates_fired,
+  critical_count.
+
+## Audit log fields
+- matter_id, skill_id, skill_version, invoked_by, input_hash, evidence_quality, output_verdict, escalation_fired, timestamp
+
+## Stop conditions
+- Flow XML contains live credentials, callout secrets, or PII — stop and ask for sanitized version.
+- Recursion without guard detected in a production-active flow — output Critical finding and recommend immediate deactivation review with human authorization.
+- Ungoverned bypass flag grants admin-level access to non-admin users — escalate to salesforce-permission-model-review-skill.
+
+## Security notes
+- Read-only static review of exported automation definitions; never requests live org access.
+- Hardcoded recipient values must not be repeated in output.
+- Automation activation or deactivation decisions require human-authorized change management.
+- Process Builder deprecation status should be verified against current Salesforce release notes.

package/skills/salesforce/salesforce-flow-automation-review-skill/metadata.json

@@ -0,0 +1,18 @@
+{
+  "id": "salesforce-flow-automation-review-skill",
+  "name": "Salesforce Flow Automation Review Skill",
+  "type": "skill",
+  "provider": "salesforce",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Reviews Salesforce Flow XML, validation rules, approval processes, and record-triggered automation for recursion, ungoverned bypass flags, brittle null handling, missing fault paths, hardcoded recipients, before-save vs after-save misuse, and mixed Process Builder plus Flow plus Apex on the same object.",
+  "source_type": "original",
+  "official_docs": [
+    "https://help.salesforce.com/",
+    "https://developer.salesforce.com/docs"
+  ],
+  "security_notes": "Read-only static review; sanitized exports only; never requests live org credentials or API access. Hardcoded recipient values not repeated in output. Automation activation decisions require human-authorized change management.",
+  "last_verified": "2026-05-20",
+  "path": "skills/salesforce/salesforce-flow-automation-review-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}