@raishin/vanguard-frontier-agentic 2.3.0 → 2.6.0

package/powers/vanguard-legal/POWER.md

@@ -0,0 +1,41 @@
+---
+name: "vanguard-legal"
+displayName: "Vanguard Frontier — Legal"
+description: "Curated Legal agents for contract, counsel, employment law risk, ethics investigations. Routes via legal-maestro-agent to specialist agents based on task scope. Static review only; no live mutations."
+keywords: ["legal-risk", "contract-review", "privacy-compliance", "regulatory"]
+author: "Raishin"
+---
+# Vanguard Frontier — Legal
+
+Curated Legal agents for contract, counsel, employment law risk, ethics investigations. Routes via legal-maestro-agent to specialist agents based on task scope. Static review only; no live mutations.
+
+## When to engage this Power
+
+Activate when the task references Legal services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`legal-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- *(none — this provider has no live-mutation guards in the catalog)*
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Route all tasks through legal-maestro-agent for proper classification and dispatch.
+- Static review only -- agents analyze configuration and provide findings without mutating live systems.
+- Agents provide risk-flagging only; output is not legal advice and does not create attorney-client privilege.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/legal/` in that repository. All 13 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider legal --repo .`

package/powers/vanguard-marketing/POWER.md

@@ -0,0 +1,41 @@
+---
+name: "vanguard-marketing"
+displayName: "Vanguard Frontier — Marketing"
+description: "Curated Marketing agents for ai advertising targeting fairness, analytics data minimization, email sender authentication, eu ai act marketing system. Routes via marketing-maestro-agent to specialist agents based on task scope. Static review only; no live mutations."
+keywords: ["marketing-governance", "consent-compliance", "advertising-fairness", "email-authentication"]
+author: "Raishin"
+---
+# Vanguard Frontier — Marketing
+
+Curated Marketing agents for ai advertising targeting fairness, analytics data minimization, email sender authentication, eu ai act marketing system. Routes via marketing-maestro-agent to specialist agents based on task scope. Static review only; no live mutations.
+
+## When to engage this Power
+
+Activate when the task references Marketing services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`marketing-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- *(none — this provider has no live-mutation guards in the catalog)*
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Route all tasks through marketing-maestro-agent for proper classification and dispatch.
+- Static review only -- agents analyze configuration and provide findings without mutating live systems.
+- Review covers consent, privacy, fairness, and regulatory compliance for marketing systems.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/marketing/` in that repository. All 14 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider marketing --repo .`

package/powers/vanguard-multi-cloud/POWER.md

@@ -0,0 +1,41 @@
+---
+name: "vanguard-multi-cloud"
+displayName: "Vanguard Frontier — Multi-Cloud"
+description: "Curated Multi-Cloud agents for ai economist, cloud price advisor. Routes via finops-maestro-agent to specialist agents based on task scope. Static review only; no live mutations."
+keywords: ["finops", "cloud-pricing", "cost-optimization", "reserved-instances"]
+author: "Raishin"
+---
+# Vanguard Frontier — Multi-Cloud
+
+Curated Multi-Cloud agents for ai economist, cloud price advisor. Routes via finops-maestro-agent to specialist agents based on task scope. Static review only; no live mutations.
+
+## When to engage this Power
+
+Activate when the task references Multi-Cloud services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`finops-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- *(none — this provider has no live-mutation guards in the catalog)*
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Route all tasks through finops-maestro-agent for proper classification and dispatch.
+- Static review only -- agents analyze configuration and provide findings without mutating live systems.
+- Cost recommendations are estimates based on public pricing; verify against actual billing before acting.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/multi-cloud/` in that repository. All 3 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider multi-cloud --repo .`

package/powers/vanguard-opentelemetry/POWER.md

@@ -0,0 +1,40 @@
+---
+name: "vanguard-opentelemetry"
+displayName: "Vanguard Frontier — OpenTelemetry"
+description: "Reviews openTelemetry Collector pipeline configuration — receiver/processor/exporter ordering, memory_limiter placement,... Static review only; no live mutations."
+keywords: ["opentelemetry", "otel-collector", "tracing", "observability-pipeline"]
+author: "Raishin"
+---
+# Vanguard Frontier — OpenTelemetry
+
+Reviews openTelemetry Collector pipeline configuration — receiver/processor/exporter ordering, memory_limiter placement,... Static review only; no live mutations.
+
+## When to engage this Power
+
+Activate when the task references OpenTelemetry services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- *(no maestro for this provider; reference agents directly under `agents/opentelemetry/`)*
+
+Reference agents directly from agents/opentelemetry/ without maestro-based routing.
+
+## Live-guard agents (gate_mode only)
+
+- *(none — this provider has no live-mutation guards in the catalog)*
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Static review only -- agents analyze configuration and provide findings without mutating live systems.
+- Collector pipeline changes affect observability for all instrumented services; review cardinality impact.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/opentelemetry/` in that repository. The single agent in this provider ships a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider opentelemetry --repo .`

package/powers/vanguard-prometheus/POWER.md

@@ -0,0 +1,40 @@
+---
+name: "vanguard-prometheus"
+displayName: "Vanguard Frontier — Prometheus"
+description: "Reviews prometheus and AlertManager configuration for cardinality risks, alert correctness, scrape security, routing safety,... Static review only; no live mutations."
+keywords: ["prometheus", "alertmanager", "metrics-cardinality", "scrape-config"]
+author: "Raishin"
+---
+# Vanguard Frontier — Prometheus
+
+Reviews prometheus and AlertManager configuration for cardinality risks, alert correctness, scrape security, routing safety,... Static review only; no live mutations.
+
+## When to engage this Power
+
+Activate when the task references Prometheus services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- *(no maestro for this provider; reference agents directly under `agents/prometheus/`)*
+
+Reference agents directly from agents/prometheus/ without maestro-based routing.
+
+## Live-guard agents (gate_mode only)
+
+- *(none — this provider has no live-mutation guards in the catalog)*
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Static review only -- agents analyze configuration and provide findings without mutating live systems.
+- Alerting rule and scrape config changes affect monitoring coverage; review for metric-name collisions.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/prometheus/` in that repository. The single agent in this provider ships a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider prometheus --repo .`

package/powers/vanguard-salesforce/POWER.md

@@ -0,0 +1,42 @@
+---
+name: "vanguard-salesforce"
+displayName: "Vanguard Frontier — Salesforce"
+description: "Curated Salesforce agents for admin review, development, security, integration, revenue ops, service ops, marketing ops, Agentforce/AI risk, and compliance — static review only, no org mutations. Routes via salesforce-maestro to specialist agents covering Sales Cloud, Service Cloud, Experience Cloud, Marketing Cloud, MuleSoft, Tableau, and industry verticals. All Salesforce terminology and API surfaces are drift-prone; agents always verify against current official documentation before rendering findings."
+keywords: ["salesforce", "agentforce", "crm", "apex", "lwc", "mulesoft", "compliance", "static-review"]
+author: "Raishin"
+---
+# Vanguard Frontier — Salesforce
+
+Curated Salesforce agents for admin review, development, security, integration, revenue ops, service ops, marketing ops, Agentforce/AI risk, and compliance — static review only, no org mutations. Routes via salesforce-maestro to specialist agents covering Sales Cloud, Service Cloud, Experience Cloud, Marketing Cloud, MuleSoft, Tableau, and industry verticals. All Salesforce terminology and API surfaces are drift-prone; agents always verify against current official documentation before rendering findings.
+
+## When to engage this Power
+
+Activate when the task references Salesforce services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`salesforce-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- `salesforce-live-guard-agent` — never auto-dispatched; gate_mode only
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Static review only — agents never request org credentials, session tokens, or user PII, and never mutate a Salesforce org.
+- Salesforce API versions and feature availability vary by org edition and release; verify org context (edition, API version, enabled features) before applying any recommendation.
+- Agentforce and Einstein AI configurations are adversarially reviewed for prompt-injection risk, ungrounded automation, and missing human-handoff controls before any approve-or-merge decision.
+- Live-guard agent (salesforce-live-guard-agent) must never be auto-dispatched; require explicit approval, target org confirmation, and rollback plan.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/salesforce/` in that repository. All 30 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider salesforce --repo .`

package/powers/vanguard-sigstore/POWER.md

@@ -0,0 +1,40 @@
+---
+name: "vanguard-sigstore"
+displayName: "Vanguard Frontier — Sigstore"
+description: "Reviews cosign image signing, Kyverno imageVerify policy identity constraints, SBOM and SLSA provenance attestations, Rekor... Static review only; no live mutations."
+keywords: ["sigstore", "cosign", "supply-chain-integrity", "image-signing"]
+author: "Raishin"
+---
+# Vanguard Frontier — Sigstore
+
+Reviews cosign image signing, Kyverno imageVerify policy identity constraints, SBOM and SLSA provenance attestations, Rekor... Static review only; no live mutations.
+
+## When to engage this Power
+
+Activate when the task references Sigstore services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- *(no maestro for this provider; reference agents directly under `agents/sigstore/`)*
+
+Reference agents directly from agents/sigstore/ without maestro-based routing.
+
+## Live-guard agents (gate_mode only)
+
+- *(none — this provider has no live-mutation guards in the catalog)*
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Static review only -- agents analyze configuration and provide findings without mutating live systems.
+- Supply-chain policy changes can block valid deployments; verify cosign keyless trust roots before enforcement.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/sigstore/` in that repository. The single agent in this provider ships a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider sigstore --repo .`

package/schemas/agent.schema.json

@@ -52,7 +52,8 @@
         "generic",
         "dotnet",
         "hr",
-        "legal"
+        "legal",
+        "salesforce"
       ]
     },
     "harnesses": {

package/schemas/skill.frontmatter.schema.json

@@ -82,7 +82,10 @@
             "architecture",
             "messaging",
             "serverless",
-            "cost-management"
+            "cost-management",
+            "operational",
+            "generation",
+            "devsecops"
           ]
         },
         "lifecycle": {
@@ -104,8 +107,35 @@
       "description": "Optional fields for live-execution skills (e.g. read-only-runtime gates). Declared at the metadata block level. See docs/live-agents/ for the full contract.",
       "properties": {
         "execution_tier": {
-          "enum": ["static-review", "read-only-runtime", "mutating-runtime"],
-          "description": "Trust posture: static-review (no execution), read-only-runtime (allowlisted Bash, no mutation), mutating-runtime (changes external state)."
+          "enum": ["static-review", "read-only-runtime", "sandbox-mutating", "mutating-runtime"],
+          "description": "Trust posture: static-review (no execution), read-only-runtime (allowlisted Bash, no mutation), sandbox-mutating (dry-run or sandbox-only changes, never production), mutating-runtime (changes external state — gated by additional human-in-the-loop controls)."
+        },
+        "mcp_servers": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Optional. List of MCP server identifiers this skill targets. Empty array means no MCP integration (CLI-only or static-review)."
+        },
+        "oauth_scopes": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Optional. Explicit list of OAuth scopes required for live execution. Empty array means no OAuth scopes needed (static-review or local-only operations). For Salesforce: minimum scopes only — never request 'full' or 'web'."
+        },
+        "run_as_permissions": {
+          "type": "object",
+          "description": "Optional. Documents the 'Run As' service account permission posture for runtime tiers.",
+          "properties": {
+            "required": {
+              "type": "array",
+              "items": { "type": "string", "minLength": 1 },
+              "description": "Minimum permission set or profile permissions required on the Run As account."
+            },
+            "denied": {
+              "type": "array",
+              "items": { "type": "string", "minLength": 1 },
+              "description": "Permissions that MUST be explicitly denied on the Run As account. For Salesforce T1: ModifyAllData, ViewAllData, ViewEncryptedData, ModifyMetadata are typical denies."
+            }
+          },
+          "additionalProperties": true
         },
         "required_egress": {
           "type": "array",

package/schemas/skill.schema.json

@@ -45,7 +45,8 @@
         "generic",
         "dotnet",
         "hr",
-        "legal"
+        "legal",
+        "salesforce"
       ]
     },
     "harnesses": {

package/scripts/export-marketplace-agents.mjs

@@ -45,6 +45,7 @@ const PLATFORM_ALIASES = {
 };
 
 const SKILLS_PLATFORM_CONFIG = {
+  codex: ".codex/skills",
   "claude-code": ".claude/skills",
   copilot: ".github/skills",
   gemini: ".gemini/skills",
@@ -332,6 +333,14 @@ function copySkillTree(sourceDir, destDir, force) {
     if (entry.isSymbolicLink()) {
       throw new Error(`Refusing to copy symbolic link in skill tree: ${src}`);
     }
+    let dstLstat = null;
+    try { dstLstat = fs.lstatSync(dst); } catch { /* dst does not exist – fine */ }
+    if (dstLstat && dstLstat.isSymbolicLink()) {
+      throw new Error(
+        `Refusing to write to symbolic link destination in skill tree: ${dst}. ` +
+        `Remove the symlink and retry.`
+      );
+    }
     if (entry.isDirectory()) {
       copySkillTree(src, dst, force);
       continue;
@@ -420,6 +429,20 @@ function copyFile(source, destination, force) {
   fs.copyFileSync(source, destination);
 }
 
+function rewriteCodexAgentSkillPaths(agentFile, targetRoot) {
+  const text = fs.readFileSync(agentFile, "utf8");
+  const rewritten = text.replace(
+    /^path = "skills\/[^"\n]+\/([^/"\n]+)\/SKILL\.md"$/gm,
+    (_match, skillName) => {
+      const skillDir = path.join(targetRoot, SKILLS_PLATFORM_CONFIG.codex, skillName);
+      return `path = ${JSON.stringify(skillDir)}`;
+    }
+  );
+  if (rewritten !== text) {
+    fs.writeFileSync(agentFile, rewritten);
+  }
+}
+
 function loadRoles() {
   const rolesPath = path.join(repoRoot, "catalog", "install-roles.json");
   if (!fs.existsSync(rolesPath)) {
@@ -566,7 +589,23 @@ function main() {
       throw new Error(`No agents found for --provider '${args.provider}'.`);
     }
   } else if (args.all) {
-    selectedAgents = agents;
+    // --all targets every catalog agent, but only those that actually
+    // declare harness variants for the requested platform can be exported.
+    // Agents authored without per-harness adapter files (e.g., declaring
+    // harnesses: ["other"] as a Wave-1 placeholder) are silently skipped
+    // with a stderr notice so smoke tests don't fail on incomplete portfolios.
+    const platformConfig = PLATFORM_CONFIG[platform];
+    const requiredVariants = platformConfig.variants.map(([variantKey]) => variantKey);
+    const supports = (agent) =>
+      requiredVariants.every((variantKey) => agent.harness_variants?.[variantKey]);
+    selectedAgents = agents.filter(supports);
+    const skipped = agents.length - selectedAgents.length;
+    if (skipped > 0) {
+      process.stderr.write(
+        `[vfa] --all on platform '${platform}': skipped ${skipped} agent(s) ` +
+        `without ${requiredVariants.join("+")} harness variant(s).\n`
+      );
+    }
   } else {
     selectedAgents = args.agents.map((agentId) => {
       const agent = byId.get(agentId);
@@ -624,6 +663,9 @@ function main() {
   for (const operation of operations) {
     assertWithin(args.repo, operation.dest, "write destination");
     copyFile(operation.source, operation.dest, args.force);
+    if (platform === "codex") {
+      rewriteCodexAgentSkillPaths(operation.dest, args.repo);
+    }
     console.log(
       `installed\t${operation.agentId}\t${operation.variantKey}\t${path.relative(args.repo, operation.dest)}`
     );