@raishin/vanguard-frontier-agentic 2.3.0 → 2.6.0

package/skills/azure/azure-ai-foundry-ops-governor/references/workflow-and-output.md

@@ -80,10 +80,10 @@
 3.
 
 ## Rollout blockers
-- 
+-
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-aks-platform-operator/references/workflow-and-output.md

@@ -104,7 +104,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-app-service-production-readiness/references/workflow-and-output.md

@@ -108,7 +108,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-cosmosdb-application-developer/references/official-sources.md

@@ -4,30 +4,30 @@ Use this reference only when you need the detailed source list or need to ground
 
 ## Azure MCP
 
-- Azure MCP overview  
+- Azure MCP overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview
-- Azure MCP concepts  
+- Azure MCP concepts
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/concepts
-- Azure MCP tools overview  
+- Azure MCP tools overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/
 
 ## Azure Cosmos DB
 
-- Partitioning and horizontal scaling in Azure Cosmos DB  
+- Partitioning and horizontal scaling in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/partitioning
-- Data modeling in Azure Cosmos DB for NoSQL  
+- Data modeling in Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/cosmos-db/modeling-data
-- Consistency levels in Azure Cosmos DB  
+- Consistency levels in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/consistency-levels
-- Manage consistency levels in Azure Cosmos DB  
+- Manage consistency levels in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-manage-consistency
-- Tuning query performance with Azure Cosmos DB  
+- Tuning query performance with Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/query-metrics
-- Architecture best practices for Azure Cosmos DB for NoSQL  
+- Architecture best practices for Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/well-architected/service-guides/cosmos-db
-- Transactional batch in Azure Cosmos DB  
+- Transactional batch in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/transactional-batch
-- Find request unit charge in Azure Cosmos DB  
+- Find request unit charge in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/find-request-unit-charge
 
 ## Grounded insights used by this skill

package/skills/azure/azure-cosmosdb-performance-investigator/references/official-sources.md

@@ -4,30 +4,30 @@ Use this reference only when you need the detailed source list or need to ground
 
 ## Azure MCP
 
-- Azure MCP overview  
+- Azure MCP overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview
-- Azure MCP concepts  
+- Azure MCP concepts
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/concepts
-- Azure MCP tools overview  
+- Azure MCP tools overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/
 
 ## Azure Cosmos DB performance and profiling
 
-- Troubleshoot query issues when using Azure Cosmos DB  
+- Troubleshoot query issues when using Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/troubleshoot-query-performance
-- Tuning query performance with Azure Cosmos DB  
+- Tuning query performance with Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/query-metrics
-- Indexing metrics in Azure Cosmos DB  
+- Indexing metrics in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/index-metrics
-- Monitor and debug with insights in Azure Cosmos DB  
+- Monitor and debug with insights in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/use-metrics
-- Redistribute throughput across partitions in Azure Cosmos DB  
+- Redistribute throughput across partitions in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-redistribute-throughput-across-partitions
-- Performance tips for Azure Cosmos DB and .NET  
+- Performance tips for Azure Cosmos DB and .NET
   https://learn.microsoft.com/en-us/azure/cosmos-db/performance-tips-dotnet-sdk-v3
-- Partitioning and horizontal scaling in Azure Cosmos DB  
+- Partitioning and horizontal scaling in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/partitioning
-- Architecture best practices for Azure Cosmos DB for NoSQL  
+- Architecture best practices for Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/well-architected/service-guides/cosmos-db
 
 ## Grounded insights used by this skill

package/skills/azure/azure-cosmosdb-platform-operator/references/official-sources.md

@@ -4,28 +4,28 @@ Use this reference only when you need the detailed source list or need to ground
 
 ## Azure MCP
 
-- Azure MCP overview  
+- Azure MCP overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview
-- Azure MCP concepts  
+- Azure MCP concepts
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/concepts
-- Azure MCP tools overview  
+- Azure MCP tools overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/
 
 ## Azure Cosmos DB
 
-- Partitioning and horizontal scaling in Azure Cosmos DB  
+- Partitioning and horizontal scaling in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/partitioning
-- Data modeling in Azure Cosmos DB for NoSQL  
+- Data modeling in Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/cosmos-db/modeling-data
-- Consistency levels in Azure Cosmos DB  
+- Consistency levels in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/consistency-levels
-- Manage consistency levels in Azure Cosmos DB  
+- Manage consistency levels in Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-manage-consistency
-- Tuning query performance with Azure Cosmos DB  
+- Tuning query performance with Azure Cosmos DB
   https://learn.microsoft.com/en-us/azure/cosmos-db/query-metrics
-- Architecture best practices for Azure Cosmos DB for NoSQL  
+- Architecture best practices for Azure Cosmos DB for NoSQL
   https://learn.microsoft.com/en-us/azure/well-architected/service-guides/cosmos-db
-- Hierarchical partition keys  
+- Hierarchical partition keys
   https://learn.microsoft.com/en-us/azure/cosmos-db/hierarchical-partition-keys
 
 ## Grounded insights used by this skill

package/skills/azure/azure-cost-estimation-review/references/workflow-and-output.md

@@ -59,7 +59,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-cost-optimization-governor/references/workflow-and-output.md

@@ -58,7 +58,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-entra-id-specialist/references/official-sources.md

@@ -4,67 +4,67 @@ Use this reference only when you need the detailed source list or need to ground
 
 ## Azure MCP
 
-- Azure MCP overview  
+- Azure MCP overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/overview
-- Azure MCP concepts  
+- Azure MCP concepts
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/concepts
-- Azure MCP tools overview  
+- Azure MCP tools overview
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/
 
 ## Microsoft Entra ID
 
-- What is Microsoft Entra?  
+- What is Microsoft Entra?
   https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra
-- What is Microsoft Entra ID Governance?  
+- What is Microsoft Entra ID Governance?
   https://learn.microsoft.com/en-us/entra/id-governance/identity-governance-overview
-- What is Microsoft Entra Privileged Identity Management?  
+- What is Microsoft Entra Privileged Identity Management?
   https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure
-- Protect security info registration with Conditional Access policy  
+- Protect security info registration with Conditional Access policy
   https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-security-info-registration
-- Conditional Access: Users, groups, agents, and workload identities  
+- Conditional Access: Users, groups, agents, and workload identities
   https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups
-- What are workload identities?  
+- What are workload identities?
   https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-overview
-- Securing workload identities  
+- Securing workload identities
   https://learn.microsoft.com/en-us/entra/id-protection/concept-workload-identity-risk
-- Conditional Access for Agent ID (Preview)  
+- Conditional Access for Agent ID (Preview)
   https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-id
-- Manage agent identities in your organization  
+- Manage agent identities in your organization
   https://learn.microsoft.com/en-us/entra/agent-id/manage-agent-identities-admin
-- Microsoft Entra security for AI overview  
+- Microsoft Entra security for AI overview
   https://learn.microsoft.com/en-us/entra/agent-id/security-for-ai-overview
-- Microsoft Entra ID Governance licensing fundamentals  
+- Microsoft Entra ID Governance licensing fundamentals
   https://learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals
-- Microsoft Entra licensing  
+- Microsoft Entra licensing
   https://learn.microsoft.com/en-us/entra/fundamentals/licensing
-- What is Conditional Access?  
+- What is Conditional Access?
   https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
-- Features and licenses for Microsoft Entra multifactor authentication  
+- Features and licenses for Microsoft Entra multifactor authentication
   https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-licensing
-- What is Microsoft Entra ID Protection?  
+- What is Microsoft Entra ID Protection?
   https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection
-- Microsoft Entra service description  
+- Microsoft Entra service description
   https://learn.microsoft.com/en-us/office365/servicedescriptions/azure-active-directory
 
 ## Cross-service licensing examples
 
-- Azure integration with Microsoft 365  
+- Azure integration with Microsoft 365
   https://learn.microsoft.com/en-us/microsoft-365/enterprise/azure-integration
-- Understand Microsoft Fabric licenses  
+- Understand Microsoft Fabric licenses
   https://learn.microsoft.com/en-us/fabric/enterprise/licenses
-- Buy a Microsoft Fabric subscription  
+- Buy a Microsoft Fabric subscription
   https://learn.microsoft.com/en-us/fabric/enterprise/buy-subscription
-- Learn about Conditional Access and Intune  
+- Learn about Conditional Access and Intune
   https://learn.microsoft.com/en-us/intune/device-security/conditional-access-integration/overview
-- Require device compliance with Conditional Access  
+- Require device compliance with Conditional Access
   https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-compliance
-- Microsoft Defender service description  
+- Microsoft Defender service description
   https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description
-- Microsoft Entra External ID overview  
+- Microsoft Entra External ID overview
   https://learn.microsoft.com/en-us/entra/external-id/external-identities-overview
-- What are workload identities?  
+- What are workload identities?
   https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-overview
-- What is Microsoft Entra?  
+- What is Microsoft Entra?
   https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra
 
 ## Grounded insights used by this skill

package/skills/azure/azure-identity-governance-review/references/official-sources.md

@@ -4,25 +4,25 @@
 
 Load only what is needed:
 
-- Azure identity and access management design area  
+- Azure identity and access management design area
   https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access
-- Landing zone identity and access management  
+- Landing zone identity and access management
   https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones
-- Microsoft Entra roles best practices  
+- Microsoft Entra roles best practices
   https://learn.microsoft.com/en-us/azure/active-directory/roles/best-practices
-- Privileged Identity Management documentation  
+- Privileged Identity Management documentation
   https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/
-- Assign Azure resource roles in Privileged Identity Management  
+- Assign Azure resource roles in Privileged Identity Management
   https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-resource-roles-assign-roles
-- Access reviews overview  
+- Access reviews overview
   https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview
-- Manage access with access reviews  
+- Manage access with access reviews
   https://learn.microsoft.com/en-us/entra/id-governance/manage-access-review
-- Perform access reviews for Azure resource and Microsoft Entra roles in PIM  
+- Perform access reviews for Azure resource and Microsoft Entra roles in PIM
   https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-perform-roles-and-resource-roles-review
-- Entitlement management overview  
+- Entitlement management overview
   https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-overview
-- Create an access review of an access package in entitlement management  
+- Create an access review of an access package in entitlement management
   https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-reviews-create
-- Azure MCP tool inventory  
+- Azure MCP tool inventory
   https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/tools/

package/skills/azure/azure-identity-governance-review/references/workflow-and-output.md

@@ -63,7 +63,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-key-vault-secret-lifecycle-auditor/references/workflow-and-output.md

@@ -88,7 +88,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-migrate-landing-zone-cutover/references/workflow-and-output.md

@@ -104,7 +104,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-platform-automation-devops/references/workflow-and-output.md

@@ -95,7 +95,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-private-endpoint-adoption-planner/references/workflow-and-output.md

@@ -87,7 +87,7 @@
 3.
 
 ## Open questions
-- 
+-
 ```
 
 ## Red Flags

package/skills/azure/azure-resource-health-incident-triage/references/workflow-and-output.md

@@ -2,17 +2,17 @@
 
 ## Safe Workflow
 
-1. **Frame the incident**  
+1. **Frame the incident**
    Confirm exact symptom, affected resource or workload, incident start time, environment, subscription or resource-group boundary, region, and current customer impact.
-2. **Check platform-health signals first**  
+2. **Check platform-health signals first**
    Review Resource Health status for the named resource or scoped set of resources. Check whether the signal is `Available`, `Unavailable`, `Degraded`, or `Unknown`, and capture reason/details if present.
-3. **Check broader service-impact signals**  
+3. **Check broader service-impact signals**
    Review Service Health events relevant to the subscription, services, region, and time window. Distinguish active issues, planned maintenance, advisories, and resolved history.
-4. **Correlate with Activity Log and alert evidence**  
+4. **Correlate with Activity Log and alert evidence**
    Check recent activity-log events, Resource Health notifications, and Service Health or activity-log alert behavior to see whether the timeline matches a platform event, a user or automation change, or neither.
-5. **Classify the likely failure domain**  
+5. **Classify the likely failure domain**
    Put the incident in one of these bins: `likely provider incident`, `likely tenant misconfiguration or change`, `resource-local issue with no broad Azure evidence`, or `unresolved`.
-6. **Return bounded next actions**  
+6. **Return bounded next actions**
    Recommend the next safest move: monitor, escalate to Microsoft, inspect specific tenant changes, hand off to application/SRE owners, or collect missing evidence.
 
 ## Role-Specific Stress Checks

package/skills/azure/azure-subscription-resource-organization/references/workflow-and-output.md

@@ -83,7 +83,7 @@
 3.
 
 ## Assumptions and unknowns
-- 
+-
 ```
 
 ## Red Flags

package/skills/cross-functional/salesforce-case-capsule/SKILL.md

@@ -0,0 +1,164 @@
+---
+name: salesforce-case-capsule
+description: Use this skill when a Salesforce specialist agent must hand a matter to another agent and the context, uncertainty, evidence quality, privilege posture, and privacy posture must survive the handoff intact. Defines the shared salesforce-case-capsule — a controlled, auditable exchange record with redacted identifiers, risk labels, privilege and privacy labels, a decision-owner field, and an explicit do-not-do list. Trigger phrases: "create a handoff capsule for this Salesforce matter", "structure this Salesforce handoff", "prepare a Salesforce case capsule". Do not use when you only need to classify a matter (use salesforce-routing-protocol), when you need to assess live-mutation risk (use salesforce-live-change-approval-protocol), or when you need to escalate a data exposure event (use salesforce-data-exposure-escalation-protocol). Does not give Salesforce or business advice and does not authorize any action.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-20"
+  category: platform
+  lifecycle: experimental
+---
+
+# Salesforce Case Capsule
+
+## Purpose
+This skill defines the **salesforce-case-capsule** — the single structured
+record that Salesforce specialist agents exchange when a matter crosses an agent
+boundary. The capsule exists so that no agent works in a silo, no context is
+lost in a handoff, and every cross-domain exchange is auditable. It is a data
+contract, not a decision: a capsule never approves, denies, or directs an
+action. It carries facts, uncertainty, risk posture, and an explicit decision
+owner.
+
+## When to use
+- A maestro agent routes a Salesforce matter to one or more specialist agents.
+- A specialist agent escalates a matter that has crossed into another domain.
+- Any matter touches multiple Salesforce risk domains and must be reviewed
+  in parallel.
+- A matter must be paused and escalated to a human owner.
+
+## When not to use
+- You only need to classify a matter — use `salesforce-routing-protocol`.
+- A live org mutation is being proposed — use `salesforce-live-change-approval-protocol`.
+- A data exposure event has been triggered — use `salesforce-data-exposure-escalation-protocol`.
+- The handoff is within the same agent session without domain crossing.
+
+## Minimum payload (required inputs)
+- Description of the Salesforce matter in plain language (sanitized, no credentials or PII).
+- Matter type (from salesforce-risk-taxonomy).
+- Risk tier (Critical / High / Medium / Low / Unknown).
+- Originating agent or human invoker.
+- Intended receiving agent(s).
+
+## Core rules
+- Every cross-agent handoff MUST be expressed as a capsule. No free-form
+  agent-to-agent chatter.
+- Every capsule MUST name exactly one `decision_owner` (an accountable human)
+  and exactly one `primary_agent`.
+- Every capsule MUST carry a `do_not_do_list`. An empty list is not acceptable;
+  if nothing is prohibited, the capsule is not ready to send.
+- Every capsule MUST label `privilege_sensitivity` and `privacy_sensitivity`.
+- Identifiers MUST be redacted to the minimum necessary. Replace org IDs, user
+  IDs, customer names, and tenant IDs with placeholders.
+- A capsule records uncertainty honestly: `assumptions`, `inferences`, and
+  `missing_evidence` are mandatory fields, not optional.
+- A capsule never states "this is compliant", "this is approved", or "this
+  configuration is safe". `risk_rating` uses risk language only.
+- High-risk cross-domain capsules MUST set `escalation_required: true` and
+  `recommended_next_action` to a pause-and-escalate posture unless documented
+  controls already exist.
+
+## Capsule field set
+
+### Identity and routing
+- `matter_id` — unique identifier (generated, never a real org ID)
+- `matter_type` — from salesforce-risk-taxonomy matter type list
+- `source_agent` — agent or human invoker creating the capsule
+- `receiving_agent` — primary receiving agent
+- `secondary_agents` — list of parallel-review agents if any
+- `primary_agent` — agent with primary accountability
+- `decision_owner` — named accountable human
+- `org_environment_type` — sandbox / scratch / staging / production (placeholder, not real ID)
+- `business_unit` — redacted business unit reference
+- `timeline` — relevant dates and deadlines (no PII)
+
+### Evidence discipline
+- `facts` — confirmed facts from sanitized inputs
+- `assumptions` — inferences the agent made without direct evidence
+- `inferences` — derived conclusions labeled as such
+- `missing_evidence` — what is unknown and needed
+- `evidence_quality` — High / Medium / Low / Insufficient
+
+### Risk posture
+- `risk_rating` — Critical / High / Medium / Low / Unknown per salesforce-risk-taxonomy
+- `matter_type_flags` — relevant escalation gates from salesforce-risk-taxonomy
+- `privilege_sensitivity` — None / Advisory / Legal-Privilege
+- `privacy_sensitivity` — None / Internal / PII / Regulated-Data
+- `data_exposure_risk` — boolean + description if true
+- `guest_user_risk` — boolean
+- `autonomous_ai_risk` — boolean
+- `finance_revenue_risk` — boolean
+- `irreversible_change_risk` — boolean
+
+### Ownership and action
+- `human_approval_required` — boolean
+- `escalation_required` — boolean
+- `escalation_gate_fired` — name of gate from salesforce-risk-taxonomy or null
+- `recommended_next_action` — pause-and-escalate / proceed-with-approval / proceed-with-review / blocked
+- `do_not_do_list` — explicit list of actions the receiving agent must not take
+- `open_questions` — questions that must be answered before the matter can proceed
+- `blockers` — conditions that prevent forward progress
+- `approval_state` — draft / pending-human-review / approved / rejected
+- `audit_log_summary` — one-line summary of routing decision and rationale
+
+## Workflow
+1. Receive matter description and classify using salesforce-risk-taxonomy.
+2. Assign matter_id (generated placeholder), matter_type, risk_rating.
+3. Identify decision_owner, primary_agent, receiving_agent.
+4. Populate facts, assumptions, inferences, missing_evidence honestly.
+5. Assess risk posture flags (data exposure, guest user, AI, finance, irreversible).
+6. Set privilege_sensitivity and privacy_sensitivity.
+7. Populate do_not_do_list — must not be empty.
+8. Set escalation_required and escalation_gate_fired if applicable.
+9. Set recommended_next_action.
+10. Output the complete capsule.
+
+## Evidence requirements
+- Sanitized matter description (no credentials, tokens, PII, org IDs).
+- Matter type classification with basis stated.
+- Risk rating with evidence basis stated.
+- Named decision owner.
+
+## Output format
+Produce a structured capsule with all fields from the field set above.
+Label each section clearly. Every `assumptions` entry must state its basis.
+Every `do_not_do_list` entry must state the reason.
+
+## Redaction rules
+- Never request secrets, credentials, OAuth tokens, refresh tokens, session IDs, MFA seeds, customer PII.
+- Sanitize org IDs, user IDs (replace with placeholders such as `[ORG-ID]`, `[USER-ID]`) before including in capsule.
+- Never carry privileged email text, legal hold communications, or medical data.
+
+## Privilege / data handling rules
+- The capsule is a minimum-necessary record. Do not widen it to carry full
+  configuration exports, debug logs with PII, or production data samples.
+- A capsule that would extend circulation of privileged or investigation material
+  must be narrowed before it is sent.
+- Privacy_sensitivity = Regulated-Data requires escalation_required = true.
+
+## Handoff rules
+- Capsule hands off to: salesforce-org-assessment-skill, salesforce-metadata-review-skill,
+  salesforce-permission-model-review-skill, salesforce-flow-automation-review-skill,
+  salesforce-apex-lwc-code-review-skill, salesforce-release-readiness-skill,
+  salesforce-integration-review-skill, salesforce-marketing-consent-review-skill,
+  salesforce-agentforce-risk-review-skill (per matter_type routing).
+- Required handoff fields: matter_id, matter_type, risk_rating, decision_owner,
+  do_not_do_list, escalation_required, recommended_next_action.
+
+## Audit log fields
+- matter_id, skill_id, skill_version, invoked_by, input_hash, evidence_quality, output_verdict, escalation_fired, timestamp
+
+## Stop conditions
+- do_not_do_list cannot be populated — capsule is not ready; gather more context first.
+- decision_owner is unknown — stop and ask the invoker to name an accountable human.
+- Matter involves regulated personal data and privacy_sensitivity cannot be determined — stop and escalate.
+- Capsule would require carrying production credentials or PII — stop and refuse.
+
+## Security notes
+- The capsule is a minimum-necessary record. Never authorize action. Any field
+  that reads as a directive to deploy, configure, or modify production is a
+  defect — rewrite as a recommendation with a named human owner.
+- Org IDs and user IDs are always replaced with placeholders before inclusion.
+- Capsules with escalation_gate_fired set must be reviewed by a human before
+  any downstream agent acts.

package/skills/cross-functional/salesforce-case-capsule/metadata.json

@@ -0,0 +1,19 @@
+{
+  "id": "salesforce-case-capsule",
+  "name": "Salesforce Case Capsule",
+  "type": "skill",
+  "provider": "generic",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Shared, auditable handoff contract for Salesforce specialist agents — a redacted case capsule carrying facts, uncertainty, evidence quality, risk labels, privilege and privacy posture, a named decision owner, and an explicit do-not-do list. Does not give Salesforce or business advice and does not authorize any action.",
+  "source_type": "original",
+  "official_docs": [
+    "https://help.salesforce.com/",
+    "https://trailhead.salesforce.com/",
+    "https://developer.salesforce.com/docs"
+  ],
+  "security_notes": "Defines a minimum-necessary handoff record; never carries org credentials, session IDs, OAuth tokens, customer PII, or regulated data beyond what the matter requires. Never authorizes action; flags privilege and privacy posture and routes decisions to a named human owner.",
+  "last_verified": "2026-05-20",
+  "path": "skills/cross-functional/salesforce-case-capsule",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}