@raishin/vanguard-frontier-agentic 2.3.0 → 2.6.0

package/skills/salesforce/salesforce-zero-trust-maturity-skill/references/maturity-scoring-rubric.md

@@ -0,0 +1,179 @@
+# Maturity Scoring Rubric Reference
+
+Scoring matrix for assessing Zero Trust maturity in Salesforce orgs across
+five NIST SP 800-207 pillars with gap analysis template.
+
+---
+
+## Maturity Level Definitions
+
+| Level | Label | Description |
+|-------|-------|-------------|
+| 0 | None | No controls in place for this area |
+| 1 | Initial | Ad hoc controls; inconsistently applied |
+| 2 | Developing | Defined controls; applied to most cases; manual processes |
+| 3 | Established | Defined, documented, and consistently applied; some automation |
+| 4 | Advanced | Automated, measured, and continuously improved |
+| 5 | Optimized | Predictive and adaptive controls; industry-leading posture |
+
+---
+
+## Pillar 1: Identity Maturity
+
+| Check | Level 0 | Level 1 | Level 2 | Level 3 | Level 4 | Level 5 |
+|-------|---------|---------|---------|---------|---------|---------|
+| MFA enforcement | No MFA | MFA optional | MFA required for some users | MFA required for all internal | MFA + risk-adaptive step-up | Biometric + hardware key everywhere |
+| SSO integration | Username/password only | SSO available but not required | SSO required for most | SSO required for all; JIT provisioning | SSO with device signal | Continuous posture evaluation |
+| Session management | Default (8h) timeout | Timeouts configured | IP-locked sessions | High Assurance for admin ops | Adaptive timeout by risk | Continuous session re-evaluation |
+| Privileged access | Shared admin accounts | Named admin accounts | Named + IP restricted | Named + IP + audit alerts | Just-in-time privilege elevation | Full PAM with recorded sessions |
+| Identity governance | No review process | Annual review | Quarterly review | Automated drift detection | Real-time anomaly alerts | ML-driven identity behavior baseline |
+
+**Target minimum for production orgs: Level 3**
+
+### Level 3 Requirements for Identity
+
+- [ ] MFA required for all active internal users via org-wide setting.
+- [ ] SSO configured; username/password login disabled for internal users (if possible).
+- [ ] Admin accounts named, IP-restricted, and documented.
+- [ ] High Assurance required for: Manage Users, Connected Apps, Certificates.
+- [ ] Permission set assignments reviewed quarterly.
+- [ ] Login History exported to SIEM.
+
+---
+
+## Pillar 2: Device Maturity
+
+| Check | Level 0 | Level 1 | Level 2 | Level 3 | Level 4 | Level 5 |
+|-------|---------|---------|---------|---------|---------|---------|
+| Device trust | No controls | IP restrictions on profiles | MDM enrollment required | MDM compliance gates SSO | Device posture in IdP token | Continuous device health |
+| Mobile access | Unrestricted | Mobile app configured | MDM PIN/encrypt required | App wrapping via MDM | Container isolation | Biometric device access |
+| Network access | Any network | VPN recommended | VPN required for sensitive | VPN + IP restrictions | Zero Trust Network Access (ZTNA) | Software-defined perimeter |
+
+**Target minimum for production orgs: Level 2**
+
+---
+
+## Pillar 3: Network Maturity
+
+| Check | Level 0 | Level 1 | Level 2 | Level 3 | Level 4 | Level 5 |
+|-------|---------|---------|---------|---------|---------|---------|
+| Transport security | HTTP allowed | HTTPS enforced | TLS 1.2+ enforced | HSTS + pinning | Private Connect/PrivateLink | Full mTLS everywhere |
+| Egress control | Open callouts | Remote Site Settings managed | Named Credentials only | Named Credentials + IP allowlist | Outbound proxy filtering | Micro-segmented egress |
+| CSP | No CSP | Basic CSP Trusted Sites | CSP for all Salesforce pages | CSP + Report-URI monitoring | Real-time CSP violation alerting | Adaptive CSP |
+
+**Target minimum for production orgs: Level 2-3**
+
+### Level 3 Requirements for Network
+
+- [ ] All callout endpoints use Named Credentials (no hardcoded URLs).
+- [ ] All Remote Site Settings reviewed; none have DisableProtocolSecurity=true.
+- [ ] CSP Trusted Sites contain only HTTPS origins; no wildcards.
+- [ ] HSTS confirmed on custom domain.
+- [ ] Private Connect evaluated for regulated data integrations.
+
+---
+
+## Pillar 4: Application Maturity
+
+| Check | Level 0 | Level 1 | Level 2 | Level 3 | Level 4 | Level 5 |
+|-------|---------|---------|---------|---------|---------|---------|
+| Object CRUD | Default profiles | CRUD on profiles | CRUD via Permission Sets | Least-privilege Permission Sets | Automated access review | Dynamic permission grant |
+| FLS enforcement | No FLS controls | FLS on standard objects | FLS on custom sensitive fields | FLS + Apex enforcement | Automated FLS coverage scan | Real-time FLS anomaly detection |
+| API access | API Enabled broadly | API limited by license | API only for named roles | API + IP restrictions | API + JWT Bearer only | Zero standing API access |
+| Code security | No static analysis | Manual review | PMD/ESLint in CI | SCA gates blocking deployment | DAST + runtime monitoring | Self-healing security controls |
+
+**Target minimum for production orgs: Level 3**
+
+---
+
+## Pillar 5: Data Maturity
+
+| Check | Level 0 | Level 1 | Level 2 | Level 3 | Level 4 | Level 5 |
+|-------|---------|---------|---------|---------|---------|---------|
+| Data classification | No classification | Some fields labeled | All PII fields classified | Classification drives FLS | Automated classification | Dynamic classification at ingest |
+| Encryption at rest | No encryption | Salesforce default encryption | Shield Encryption on PII fields | Shield + BYOK | EKM with HSM | Post-quantum key management |
+| Data masking | No masking | Manual masking | Partial automated masking | Full automated post-refresh masking | Continuous masking monitoring | Synthetic data generation |
+| Data residency | Unknown | Data center known | Contract specifies region | Hyperforce + DPA executed | Customer Trust Access Management | Dedicated infrastructure |
+| DLP monitoring | No monitoring | Manual data export review | Event Monitoring for exports | CASB integration | Real-time DLP alerts | Behavioral DLP |
+
+**Target minimum for production orgs: Level 2-3**
+
+---
+
+## Composite Scoring
+
+### Per-Pillar Score
+
+Average the maturity levels across all checks within each pillar:
+
+```
+Pillar Score = Sum of check levels / Number of checks
+```
+
+### Weighted Composite Score
+
+| Pillar | Weight | Your Score (0-5) | Weighted Score |
+|--------|--------|-----------------|---------------|
+| Identity | 30% | ___ | ___ |
+| Device | 15% | ___ | ___ |
+| Network | 20% | ___ | ___ |
+| Application | 25% | ___ | ___ |
+| Data | 10% | ___ | ___ |
+| **Composite** | 100% | — | ___ |
+
+### Rating Bands
+
+| Composite Score | Rating | Recommended Action |
+|----------------|--------|--------------------|
+| 4.0 - 5.0 | Advanced/Optimized | Maintain; focus on continuous improvement |
+| 3.0 - 3.9 | Established | Close specific gaps; automate manual controls |
+| 2.0 - 2.9 | Developing | Prioritize Identity and Application pillars first |
+| 1.0 - 1.9 | Initial | Emergency remediation plan; executive escalation |
+| 0.0 - 0.9 | None | Immediate stop-gap controls; full remediation program |
+
+---
+
+## Gap Analysis Template
+
+For each pillar where the current level is below the target:
+
+```
+PILLAR: [Identity / Device / Network / Application / Data]
+CURRENT LEVEL: [0-5]
+TARGET LEVEL: [0-5]
+GAP: [Target - Current]
+
+KEY GAPS:
+1. [Specific control that is missing or incomplete]
+2. [...]
+
+REMEDIATION ACTIONS:
+Priority 1 (< 30 days):
+  - Action: [Specific action]
+  - Owner: [Team or role]
+  - Effort: [Hours / Days / Weeks]
+  - Success Metric: [How to verify completion]
+
+Priority 2 (30-90 days):
+  - Action: [...]
+
+Priority 3 (90-180 days):
+  - Action: [...]
+
+BLOCKERS:
+  - [Budget / Resource / Technical dependency]
+
+NEXT ASSESSMENT DATE: [Date 6-12 months from now]
+```
+
+---
+
+## Maturity Assessment Cadence
+
+| Assessment Type | Frequency | Scope |
+|----------------|-----------|-------|
+| Self-assessment | Quarterly | All five pillars |
+| Internal audit | Annually | All five pillars + evidence |
+| Third-party assessment | Bi-annually or for compliance | All five pillars |
+| Post-incident review | After any security incident | Affected pillars |
+| Post-major-change review | After significant org changes | Affected pillars |

package/skills/salesforce/salesforce-zero-trust-maturity-skill/references/nist-zta-pillars.md

@@ -0,0 +1,194 @@
+# NIST ZTA Pillars Reference
+
+NIST SP 800-207 Zero Trust Architecture pillars mapped to Salesforce controls,
+configurations, and implementation guidance.
+
+NIST SP 800-207 was published August 2020.
+Verify against any superseding NIST publications.
+
+---
+
+## Zero Trust Core Tenets (NIST SP 800-207)
+
+1. All data sources and computing services are considered resources.
+2. All communication is secured regardless of network location.
+3. Access to individual enterprise resources is granted on a per-session basis.
+4. Access is determined by dynamic policy including client identity, application,
+   and observable state.
+5. The enterprise monitors and measures the integrity and security posture
+   of all owned and associated assets.
+6. All resource authentication and authorization is dynamic and strictly enforced.
+7. The enterprise collects information about assets, network infrastructure,
+   and communications to improve security posture.
+
+---
+
+## Pillar 1: Identity
+
+**Core question:** Is this user who they claim to be, and are they authorized
+for this specific request at this moment?
+
+### Salesforce Controls for Identity Pillar
+
+| Control | Salesforce Feature | Maturity Level |
+|---------|------------------|----------------|
+| MFA enforcement | Setup > Identity > MFA | Required (Level 1) |
+| Single Sign-On (SSO) | Auth. Provider + My Domain | Level 2 |
+| Adaptive authentication | High Assurance sessions | Level 2 |
+| Continuous session validation | Session timeout + IP lock | Level 2 |
+| Privileged access management | Named admin accounts + IP restrictions | Level 3 |
+| Just-in-time (JIT) provisioning | SSO JIT SAML provisioning | Level 3 |
+| Identity governance | Quarterly permission reviews | Level 3 |
+
+### Implementation Reference
+
+```
+My Domain:  Required prerequisite for SSO and Modern Auth.
+Path: Setup > Company Settings > My Domain
+
+Auth. Provider (OIDC/SAML):
+Path: Setup > Identity > Auth. Providers
+
+MFA:
+Path: Setup > Identity > Identity Verification
+Setting: Multi-Factor Authentication for User Interface Logins = Required
+
+Session Security Level for High Assurance:
+Path: Setup > Security > Session Settings > Session Security Levels
+Operations requiring High Assurance: Manage Users, Connected Apps, Certificates
+```
+
+---
+
+## Pillar 2: Device
+
+**Core question:** Is the device used to access Salesforce healthy and trusted?
+
+### Salesforce Controls for Device Pillar
+
+| Control | Salesforce Feature | Maturity Level |
+|---------|------------------|----------------|
+| Trusted IP ranges | Network Access + Profile Login IPs | Level 1 |
+| Device posture enforcement (MDM) | Salesforce Authenticator + MDM integration | Level 2 |
+| Certificate-based device auth | Client certificates in Connected Apps | Level 3 |
+| Mobile Device Management | Salesforce Mobile App MDM policies | Level 2 |
+
+### Note on Salesforce's Position
+
+Salesforce is a SaaS platform — direct device health attestation (TPM, secure
+boot validation) must be implemented at the identity provider layer (your IdP /
+MDM solution). Salesforce receives the result of device trust evaluation via
+SSO claims or network-level controls.
+
+```
+Example pattern:
+1. MDM marks device as compliant.
+2. IdP (Okta/Azure AD/Ping) receives device compliance signal from MDM.
+3. IdP issues SAML assertion with device-compliance claim.
+4. Salesforce Auth. Provider validates assertion.
+5. If device non-compliant: Auth. Provider denies session or downgrades
+   to Standard session (blocking High Assurance operations).
+```
+
+---
+
+## Pillar 3: Network
+
+**Core question:** Is network traffic protected in transit and origin-verified?
+
+### Salesforce Controls for Network Pillar
+
+| Control | Salesforce Feature | Maturity Level |
+|---------|------------------|----------------|
+| TLS enforcement | Salesforce enforces TLS 1.2+ by default | Level 1 |
+| IP allowlists | Trusted IP Ranges + Profile Login IP Ranges | Level 1 |
+| HSTS | Salesforce enforces HSTS on all prod orgs | Level 1 |
+| CSP enforcement | CSP Trusted Sites | Level 2 |
+| Private Connect / PrivateLink | Salesforce Private Connect (Hyperforce) | Level 3 |
+| Micro-segmentation | Named Credential per endpoint + IP restriction | Level 2 |
+
+### Private Connect / AWS PrivateLink
+
+Salesforce Private Connect allows connections between Salesforce and AWS VPCs
+(and other cloud resources) over AWS PrivateLink — traffic never traverses the
+public internet.
+
+```
+Path: Setup > Integrations > Private Connect
+Requirements:
+  - Salesforce on Hyperforce (AWS)
+  - AWS VPC with PrivateLink endpoint configured
+  - Matching region between Salesforce instance and AWS VPC
+```
+
+---
+
+## Pillar 4: Application
+
+**Core question:** Is the user authorized for this specific application action?
+
+### Salesforce Controls for Application Pillar
+
+| Control | Salesforce Feature | Maturity Level |
+|---------|------------------|----------------|
+| Object-level CRUD | Profile + Permission Set permissions | Level 1 |
+| Field-Level Security | FLS configuration | Level 1 |
+| Record-level sharing | OWD + Sharing Rules + Role Hierarchy | Level 2 |
+| Apex FLS enforcement | `WITH SECURITY_ENFORCED` / `stripInaccessible` | Level 2 |
+| High Assurance for sensitive ops | Session Security Levels | Level 3 |
+| Agentforce action safety tiers | Action confirmation + human handoff | Level 3 |
+
+### Per-Request Authorization Check
+
+In a mature ZTA Salesforce implementation, every API request should be
+authorized on the following dimensions:
+1. User identity (valid session, MFA verified)
+2. User permission (CRUD, FLS on requested object/field)
+3. Record access (sharing model permits access to this specific record)
+4. Action safety (is this action in the user's permitted action tier)
+
+---
+
+## Pillar 5: Data
+
+**Core question:** Is data protected at rest, in transit, and in use?
+
+### Salesforce Controls for Data Pillar
+
+| Control | Salesforce Feature | Maturity Level |
+|---------|------------------|----------------|
+| Data classification | Custom field: DataClassification__c | Level 1 |
+| Encryption at rest | Shield Platform Encryption | Level 2 |
+| Customer-managed keys | Bring Your Own Key (BYOK) / EKM | Level 3 |
+| Data masking in non-prod | Sandbox Data Masking | Level 2 |
+| Data Loss Prevention | DLP via Event Monitoring + CASB | Level 3 |
+| Data residency | Hyperforce region selection | Level 2 |
+
+---
+
+## Zero Trust Mapping to Salesforce Audit Trail
+
+Every relevant access event in a ZTA posture should be captured and monitored.
+
+| Event Type | Salesforce Source | ZTA Pillar |
+|------------|------------------|-----------|
+| Login events | LoginHistory | Identity |
+| Failed login | LoginHistory (Status = Failed) | Identity |
+| Permission change | SetupAuditTrail | Identity, Application |
+| Record access | EventMonitoring: ReportEvent, ListViewEvent | Data |
+| API access | EventMonitoring: ApiEvent | Identity, Network |
+| Data export | EventMonitoring: ReportExport | Data |
+| Sensitive field view | EventMonitoring: FieldHistoryTracking | Data |
+| Admin configuration | SetupAuditTrail | Application |
+
+```bash
+# Query Login History for failed logins (Identity pillar monitoring)
+sf data query \
+  --query "SELECT UserId, LoginTime, SourceIp, Status, Browser \
+           FROM LoginHistory \
+           WHERE Status != 'Success' \
+             AND LoginTime = LAST_N_DAYS:7 \
+           ORDER BY LoginTime DESC \
+           LIMIT 1000" \
+  -o prod-alias
+```

package/tests/fixtures/salesforce-maestro-routing/expected/001-happy-platform-admin-review.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-platform-admin-review-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/002-happy-business-analyst.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-business-analyst-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/003-happy-app-builder-automation.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-app-builder-automation-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/004-happy-development.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-development-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/005-happy-devops-release.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-devops-release-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/006-happy-security-identity-access.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-security-identity-access-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/007-happy-data-architecture.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-data-architecture-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/008-happy-integration-mulesoft.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-integration-mulesoft-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/009-happy-sales-cloud-revenue.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-sales-cloud-revenue-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/010-happy-marketing-cloud.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-marketing-cloud-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/011-happy-agentforce-ai.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-agentforce-ai-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/012-happy-analytics-tableau.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-analytics-tableau-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/013-happy-compliance-privacy.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-compliance-privacy-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/014-happy-network-policy-architect.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-network-policy-architect-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/015-happy-hyperforce-security.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-hyperforce-security-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/016-happy-sandbox-isolation.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-sandbox-isolation-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/017-happy-session-governance.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-session-governance-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/018-happy-continuous-verification.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-continuous-verification-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/019-happy-certificate-lifecycle.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-certificate-lifecycle-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/020-happy-adaptive-access.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-adaptive-access-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/021-happy-code-analyzer-orchestrator.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-code-analyzer-orchestrator-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/022-happy-sandbox-governance.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-sandbox-governance-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/023-happy-change-impact-analyst.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-change-impact-analyst-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/adv-ambiguous.json

@@ -0,0 +1,4 @@
+{
+  "route": [],
+  "mode": "unclassified"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/adv-instruction-injection.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-agentforce-ai-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/adv-liveguard-01-live-org-deploy-guard.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-live-guard-agent"
+  ],
+  "mode": "live-guard-gate"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/adv-liveguard-02-live-mass-delete-guard.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-live-guard-agent"
+  ],
+  "mode": "live-guard-gate"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/adv-liveguard-03-live-release-to-prod-guard.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-live-guard-agent"
+  ],
+  "mode": "live-guard-gate"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/adv-persona-replacement.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-agentforce-ai-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/expected/adv-secrets-bait.json

@@ -0,0 +1,6 @@
+{
+  "route": [
+    "salesforce-security-identity-access-agent"
+  ],
+  "mode": "single"
+}

package/tests/fixtures/salesforce-maestro-routing/inputs/001-happy-platform-admin-review.json

@@ -0,0 +1,7 @@
+{
+  "name": "001-happy-platform-admin-review",
+  "task": "Review our Salesforce org configuration including profiles, permission sets, and org-wide defaults for sharing rules.",
+  "tags": [
+    "happy-path"
+  ]
+}

package/tests/fixtures/salesforce-maestro-routing/inputs/002-happy-business-analyst.json

@@ -0,0 +1,7 @@
+{
+  "name": "002-happy-business-analyst",
+  "task": "Map our business process requirements and user stories for the new lead management workflow in Salesforce.",
+  "tags": [
+    "happy-path"
+  ]
+}

package/tests/fixtures/salesforce-maestro-routing/inputs/003-happy-app-builder-automation.json

@@ -0,0 +1,7 @@
+{
+  "name": "003-happy-app-builder-automation",
+  "task": "Review our Salesforce flow and automation configuration using the lightning app builder and validation rules.",
+  "tags": [
+    "happy-path"
+  ]
+}

package/tests/fixtures/salesforce-maestro-routing/inputs/004-happy-development.json

@@ -0,0 +1,7 @@
+{
+  "name": "004-happy-development",
+  "task": "Review our Apex trigger and LWC lightning web component code for the custom opportunity scoring feature.",
+  "tags": [
+    "happy-path"
+  ]
+}

package/tests/fixtures/salesforce-maestro-routing/inputs/005-happy-devops-release.json

@@ -0,0 +1,7 @@
+{
+  "name": "005-happy-devops-release",
+  "task": "Review our Salesforce devops release pipeline and CI CD configuration for sandbox to sandbox metadata deployment.",
+  "tags": [
+    "happy-path"
+  ]
+}

package/tests/fixtures/salesforce-maestro-routing/inputs/006-happy-security-identity-access.json

@@ -0,0 +1,7 @@
+{
+  "name": "006-happy-security-identity-access",
+  "task": "Audit our Salesforce security posture including SSO SAML configuration, MFA enforcement, and field level security settings.",
+  "tags": [
+    "happy-path"
+  ]
+}