@raishin/vanguard-frontier-agentic 2.7.1 → 2.9.0

package/skills/azure/azure-live-arm-deployment-stack-guard/metadata.json

@@ -11,17 +11,18 @@
     "kiro",
     "other"
   ],
-  "summary": "Guard live ARM, Bicep, and Deployment Stack changes with what-if evidence, denySettings review, changeset diff, rollback posture, and approval gates.",
+  "summary": "Guard live ARM, Bicep, and Deployment Stack changes with what-if evidence, deny-settings review, action-on-unmanage safety, managed-resource diff, rollback posture, and approval gates.",
   "source_type": "original",
   "official_docs": [
-    "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if",
-    "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks",
-    "https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments",
-    "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/best-practices"
+    "https://learn.microsoft.com/azure/azure-resource-manager/templates/deploy-what-if",
+    "https://learn.microsoft.com/azure/azure-resource-manager/bicep/deployment-stacks",
+    "https://learn.microsoft.com/azure/templates/microsoft.resources/deploymentstacks",
+    "https://learn.microsoft.com/azure/role-based-access-control/deny-assignments",
+    "https://learn.microsoft.com/azure/azure-resource-manager/templates/best-practices"
   ],
-  "security_notes": "Never execute an ARM or Deployment Stack change without what-if evidence, confirmed target scope, denySettings review, and explicit human approval. Repo write access does not authorize live Azure mutations.",
-  "last_verified": "2026-04-30",
+  "security_notes": "Never execute an ARM, Bicep, or Deployment Stack change without confirmed scope, template/parameter provenance, what-if or managed-resource diff, deny-settings review, action-on-unmanage review, rollback constraints, and explicit human approval.",
+  "last_verified": "2026-06-05",
   "path": "skills/azure/azure-live-arm-deployment-stack-guard",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.5"
 }

package/skills/azure/azure-live-arm-deployment-stack-guard/references/deployment-stack-operations.md

@@ -0,0 +1,68 @@
+# Azure ARM Deployment Stack Operations
+
+Use this reference for current, source-grounded service behavior and the hard live-operation gates that the lean `SKILL.md` intentionally does not carry.
+
+## What people get wrong
+
+- Treating what-if as optional because the template is in source control.
+- Using deleteAll or deleteResources without listing every managed resource and dependency.
+- Ignoring deny settings exclusions and assuming they protect data-plane child objects.
+- Bypassing stack-out-of-sync warnings by default.
+- Claiming rollback when the change deletes or mutates stateful resources.
+
+## Officially grounded service shape
+
+Microsoft Learn evidence says Deployment Stacks manage a group of resources as one unit, can detach or delete resources removed from the template through actionOnUnmanage, and can protect managed resources with deny settings. Documentation also calls out limitations: stacks do not manage implicitly created resources, deny settings apply to control plane only, some portal support is absent, and out-of-sync warnings require managed-resource review before bypass.
+
+- ARM/Bicep deployments and Deployment Stacks are live control-plane changes.
+- Deployment Stacks add lifecycle ownership, managed-resource tracking, action-on-unmanage behavior, and deny settings.
+- Deny settings can block write/delete control-plane actions but not all data-plane operations or implicit resources.
+- Action-on-unmanage determines whether removed template resources detach or delete.
+- Deployment-stack commands can create or update existing stacks, so idempotency assumptions must be verified.
+
+## Non-negotiable design rules
+
+- Confirm deployment scope: resource group, subscription, or management group.
+- Require exact template, parameters, target scope, and current stack resource list before mutation.
+- Default action-on-unmanage to detach unless deletion is explicitly approved and proven safe.
+- Review deny-settings mode, child-scope behavior, excluded actions, and excluded principals.
+- Never bypass out-of-sync warnings without reviewing managed resources.
+
+## Minimal safe implementation flow
+
+- Scope deployment, stack, template, parameters, active principal, and approval owner.
+- Collect what-if output where supported, existing deployments, stack resources, deny settings, locks, and stateful resources.
+- Classify each change as create, modify, delete, detach, or protection change.
+- Gate execution on rollback limitations and explicit approval.
+- After action, verify provisioning state, managed-resource list, deny settings, and drift indicators.
+
+## High-risk assumptions to kill
+
+- Source-controlled Bicep does not prove safe live state; deployment stacks can delete, detach, or lock resources based on current managed-resource tracking.
+- Deny settings are not a universal lock. Microsoft Learn documents control-plane limits, implicit-resource gaps, data-plane exclusions, and current portal limitations.
+- `deleteAll` or `deleteResources` is not cleanup; it is destructive lifecycle ownership and needs an explicit managed-resource inventory.
+- A stack-out-of-sync bypass is not a normal retry flag. It is only defensible after reviewing the managed resources the service believes it controls.
+- Rollback is not credible for deleted resource groups, networking, identity, Key Vault, or stateful resources without separate recovery evidence.
+
+## Safe command/code verification targets
+
+- Capture stack scope, template source, parameters, deny settings, action-on-unmanage, and managed-resource list before mutation.
+- Run what-if or an equivalent reviewed diff where supported; if unavailable, label that gap and require stronger human approval.
+- Search proposed commands/templates for destructive flags and deny-setting exclusions before execution.
+- Verify provisioning state, synchronized managed-resource list, deny assignments, and locks after action.
+- Treat bypass flags and delete flags as high-risk findings unless approval and recovery evidence are attached.
+
+## Safe verification targets
+
+- What-if or equivalent managed-resource diff is attached and reviewed.
+- No unmanaged deletion is hidden behind action-on-unmanage.
+- Deny settings match intended protection and do not lock out operators unexpectedly.
+- Stateful resources have backup/restore or detach-first plan.
+- Stack status and managed-resource list are synchronized after change.
+
+## When to push back
+
+- The user asks to run deployment without what-if or equivalent diff.
+- Template provenance or parameters are unknown.
+- The change deletes resource groups, Key Vault objects, databases, networking, or identity resources without recovery evidence.
+- A bypass flag is requested as routine behavior.

package/skills/azure/azure-live-arm-deployment-stack-guard/references/mcp-and-evidence.md

@@ -0,0 +1,26 @@
+# Documentation and Evidence Path
+
+## Preferred evidence order
+
+1. Microsoft Learn documentation through the user's configured documentation MCP for documented Azure behavior.
+2. Sampled read-only Azure evidence, when safely available, for current configured-environment observations.
+3. Sanitized user-provided evidence.
+4. Clearly labeled inference.
+
+## What each evidence type can prove
+
+- Microsoft Learn documentation can prove documented service behavior, supported concepts, limitations, and recommended patterns.
+- Sampled read-only evidence can prove the sampled configured state at the time observed.
+- Sanitized user evidence can prove only what the snippet shows.
+- None of these alone prove broad regional availability, future success, full account posture, or production readiness.
+
+## Safe usage pattern
+
+- State whether each claim is documentation-based, sampled-current-state, user-provided, or inference.
+- Use read-only queries before recommending changes.
+- Do not include sensitive internal identifiers, tenant identifiers, subscription identifiers, or secrets in committed docs or final findings.
+- If no sampled evidence is available, say the review is documentation-based and list the exact evidence still needed.
+
+## Live-operation rule
+
+For live operations, documentation is never enough. Require target confirmation, current-state evidence, explicit approval, rollback constraints, and post-action verification.

package/skills/azure/azure-live-arm-deployment-stack-guard/references/official-sources.md

@@ -1,17 +1,34 @@
-# Official Sources: Azure Live ARM Deployment Stack Guard
+# Official Sources
 
-## ARM and Bicep deployments
+Use these sources to ground the skill. Microsoft Learn documentation proves documented Azure behavior; it does not prove the user's tenant, subscription, RBAC, quota, deployed resources, current cost, vault state, app health, or production readiness.
 
-- https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/best-practices
-- https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if
-- https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/rollback-on-error
+## Primary Microsoft Learn sources
 
-## Deployment Stacks
+- https://learn.microsoft.com/azure/azure-resource-manager/templates/deploy-what-if
+- https://learn.microsoft.com/azure/azure-resource-manager/bicep/deployment-stacks
+- https://learn.microsoft.com/azure/templates/microsoft.resources/deploymentstacks
+- https://learn.microsoft.com/azure/role-based-access-control/deny-assignments
+- https://learn.microsoft.com/azure/azure-resource-manager/templates/best-practices
 
-- https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks
-- https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks-scenarios
+## Grounding notes
 
-## Source-grounding rule
+- Documentation-based claim: Microsoft Learn evidence says Deployment Stacks manage a group of resources as one unit, can detach or delete resources removed from the template through actionOnUnmanage, and can protect managed resources with deny settings. Documentation also calls out limitations: stacks do not manage implicitly created resources, deny settings apply to control plane only, some portal support is absent, and out-of-sync warnings require managed-resource review before bypass.
+- Current-state claim: requires sampled read-only Azure evidence or sanitized user-provided evidence.
+- Live-operation claim: requires target, principal, approval, preflight evidence, rollback constraints, and post-action verification.
+- Inference: allowed only when labeled and tied to observed fields or documented behavior.
+- Do not include sensitive internal identifiers or secret material in findings.
+
+## Source use rules
+
+- Prefer Microsoft Learn documentation through the user's configured documentation MCP for current Azure service behavior.
+- Use sampled read-only Azure evidence only to validate current configured-environment observations.
+- If documentation and sampled evidence appear to conflict, report both and stop short of a production-ready verdict.
+- Re-check official sources before changing high-risk guidance, because cloud behavior and feature availability can change.
+
+## Current Microsoft Learn deltas checked on 2026-06-05
+
+- Deployment Stacks manage resources through Microsoft.Resources/deploymentStacks and action-on-unmanage choices; delete behavior must be explicit before execution.
+- Microsoft Learn still distinguishes ARM/Bicep deployment what-if from Deployment Stack limitations; do not overclaim native stack what-if coverage.
+- Deny settings protect control-plane operations, not data-plane content, and do not cover implicitly created resources.
+- denyDelete, denyWriteAndDelete, exclusions, and deleteAll are governance decisions with materially different blast radius.
 
-Use official Microsoft Learn documentation as source of truth for ARM and Bicep behavior.
-Always verify what-if output against live resource state, not just template assumptions.

package/skills/azure/azure-live-arm-deployment-stack-guard/references/permission-model.md

@@ -13,6 +13,7 @@
     "Microsoft.Resources/deployments/whatIf/action",
     "Microsoft.Resources/deploymentStacks/read",
     "Microsoft.Resources/deploymentStacks/write",
+    "Microsoft.Resources/deploymentStacks/manageDenySetting/action",
     "Microsoft.Resources/subscriptions/resourceGroups/read"
   ],
   "NotActions": [
@@ -21,7 +22,7 @@
   "DataActions": [],
   "NotDataActions": [],
   "AssignableScopes": [
-    "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<TARGET_RG>"
+    "$APPROVED_RESOURCE_GROUP_SCOPE"
   ]
 }
 ```
@@ -42,11 +43,13 @@ PIM-eligible role activated only for confirmed decommission windows (see below).
   ],
   "NotActions": [],
   "AssignableScopes": [
-    "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<TARGET_RG>"
+    "$APPROVED_RESOURCE_GROUP_SCOPE"
   ]
 }
 ```
 
+$APPROVED_RESOURCE_GROUP_SCOPE is a local placeholder for the approved resource group scope from the change record. Do not paste raw subscription or resource identifiers into chat or committed docs.
+
 Assign as **PIM-eligible only**. Require manager approval. Maximum 2-hour activation.
 
 ## Deployment Stacks denySettings recommendation
@@ -66,3 +69,10 @@ Use `denyWriteAndDelete` for compliance-mandated immutable resources.
 - `Contributor` at management-group scope
 - `Microsoft.Resources/*` wildcards
 - `Microsoft.Authorization/roleAssignments/write` (privilege escalation risk)
+
+
+## Deny-setting permission caveat
+
+Microsoft Learn documents dedicated deployment stack roles and a separate `Microsoft.Resources/deploymentStacks/manageDenySetting/action` permission for managing deny settings. If the operator cannot prove this permission with sampled read-only evidence or an approved eligible role activation, do not change deny settings.
+
+Use exact resource scopes from approved change records; do not paste raw subscription identifiers into chat.

package/skills/azure/azure-live-arm-deployment-stack-guard/references/preflight-commands.md

@@ -1,12 +1,18 @@
 # Preflight Commands: Azure Live ARM Deployment Stack Guard
 
+Use shell variables for examples instead of raw identifiers. Populate them from an approved change record or already configured shell context; never paste tenant, subscription, resource, or secret values into chat.
+
+## Evidence-variable convention
+
+Variables such as $AZURE_RESOURCE_GROUP_NAME, $APP_SERVICE_APP_NAME, or $KEY_VAULT_NAME are local operator placeholders. Do not commit real values, and redact them from shared evidence unless the change record explicitly allows disclosure.
+
 Run these before any ARM or Deployment Stack mutation. Paste sanitized output as evidence.
 
 ## 1. Confirm identity and subscription target
 
 ```bash
 az account show --query "{subscription:id, name:name, user:user.name}"
-az group show -n <RESOURCE_GROUP> --query "{name:name, location:location, provisioningState:properties.provisioningState}"
+az group show -n $AZURE_RESOURCE_GROUP_NAME --query "{name:name, location:location, provisioningState:properties.provisioningState}"
 ```
 
 ## 2. Run what-if before any deployment
@@ -14,15 +20,15 @@ az group show -n <RESOURCE_GROUP> --query "{name:name, location:location, provis
 ```bash
 # ARM template what-if
 az deployment group what-if \
-  -g <RESOURCE_GROUP> \
-  --template-file <TEMPLATE.json> \
-  --parameters @<PARAMS.json>
+  -g $AZURE_RESOURCE_GROUP_NAME \
+  --template-file $ARM_TEMPLATE_FILE \
+  --parameters @$ARM_PARAMETERS_FILE
 
 # Bicep what-if
 az deployment group what-if \
-  -g <RESOURCE_GROUP> \
-  --template-file <TEMPLATE.bicep> \
-  --parameters @<PARAMS.bicepparam>
+  -g $AZURE_RESOURCE_GROUP_NAME \
+  --template-file $BICEP_TEMPLATE_FILE \
+  --parameters @$BICEP_PARAMETERS_FILE
 ```
 
 Review the what-if output for resource replacements (marked with `~` or `-/+`).
@@ -33,15 +39,15 @@ explicitly approved before proceeding.
 
 ```bash
 az deployment-stack group show \
-  -n <STACK_NAME> \
-  -g <RESOURCE_GROUP> \
+  -n $DEPLOYMENT_STACK_NAME \
+  -g $AZURE_RESOURCE_GROUP_NAME \
   --query "{provisioningState:provisioningState, denySettings:properties.denySettings, resources:properties.resources[].id}"
 ```
 
 ## 4. List managed resources and their protection status
 
 ```bash
-az deployment-stack group show -n <STACK_NAME> -g <RESOURCE_GROUP> \
+az deployment-stack group show -n $DEPLOYMENT_STACK_NAME -g $AZURE_RESOURCE_GROUP_NAME \
   --query "properties.resources[].{id:id, denyStatus:denyStatus}"
 ```
 
@@ -49,7 +55,12 @@ az deployment-stack group show -n <STACK_NAME> -g <RESOURCE_GROUP> \
 
 ```bash
 az deployment group validate \
-  -g <RESOURCE_GROUP> \
-  --template-file <TEMPLATE.json> \
-  --parameters @<PARAMS.json>
+  -g $AZURE_RESOURCE_GROUP_NAME \
+  --template-file $ARM_TEMPLATE_FILE \
+  --parameters @$ARM_PARAMETERS_FILE
 ```
+
+
+## Deployment Stack what-if caveat
+
+Microsoft Learn currently documents that what-if support is not yet available for Deployment Stacks. Use ARM/Bicep what-if for the underlying deployment where available, then explicitly label any stack-level delete/detach and deny-setting risk that what-if does not prove.

package/skills/azure/azure-live-arm-deployment-stack-guard/references/rollback-playbook.md

@@ -1,14 +1,18 @@
 # Rollback Playbook: Azure Live ARM Deployment Stack Guard
 
+## Evidence-variable convention
+
+Variables such as $AZURE_RESOURCE_GROUP_NAME, $APP_SERVICE_APP_NAME, $DEPLOYMENT_NAME, or $DEPLOYMENT_STACK_NAME are local operator placeholders. Do not commit real values, and redact them from shared evidence unless the change record explicitly allows disclosure.
+
 ## Cancel an in-progress deployment
 
 ```bash
 # List recent deployments to find the in-flight one
-az deployment group list -g <RESOURCE_GROUP> \
+az deployment group list -g $AZURE_RESOURCE_GROUP_NAME \
   --query "[?properties.provisioningState=='Running'].{name:name, timestamp:properties.timestamp}"
 
 # Cancel by name
-az deployment group cancel -g <RESOURCE_GROUP> -n <DEPLOYMENT_NAME>
+az deployment group cancel -g $AZURE_RESOURCE_GROUP_NAME -n $DEPLOYMENT_NAME
 ```
 
 Cancellation is best-effort. Resources already provisioned before cancel are NOT torn down.
@@ -17,19 +21,19 @@ Cancellation is best-effort. Resources already provisioned before cancel are NOT
 
 ```bash
 # List deployment history to find the target
-az deployment group list -g <RESOURCE_GROUP> \
+az deployment group list -g $AZURE_RESOURCE_GROUP_NAME \
   --query "[].{name:name, state:properties.provisioningState, timestamp:properties.timestamp}" \
   --output table
 
 # Export the template from a prior successful deployment
-az deployment group export -g <RESOURCE_GROUP> -n <GOOD_DEPLOYMENT_NAME> \
+az deployment group export -g $AZURE_RESOURCE_GROUP_NAME -n $KNOWN_GOOD_DEPLOYMENT_NAME \
   --output json > rollback-template.json
 
 # Redeploy
 az deployment group create \
-  -g <RESOURCE_GROUP> \
+  -g $AZURE_RESOURCE_GROUP_NAME \
   --template-file rollback-template.json \
-  --parameters @<PARAMS.json>
+  --parameters @$ARM_PARAMETERS_FILE
 ```
 
 ## Deployment Stack — update back to previous config
@@ -37,10 +41,10 @@ az deployment group create \
 ```bash
 # Re-apply the previous stack config (update, not recreate)
 az deployment-stack group create \
-  -n <STACK_NAME> \
-  -g <RESOURCE_GROUP> \
+  -n $DEPLOYMENT_STACK_NAME \
+  -g $AZURE_RESOURCE_GROUP_NAME \
   --template-file rollback-template.json \
-  --parameters @<PARAMS.json> \
+  --parameters @$ARM_PARAMETERS_FILE \
   --action-on-unmanage deleteResources \
   --deny-settings-mode denyDelete
 ```

package/skills/azure/azure-live-arm-deployment-stack-guard/references/safety-checklist.md

@@ -0,0 +1,29 @@
+# Safety Checklist
+
+## Evidence labels
+
+- `documentation-based`: grounded in Microsoft Learn or listed official documentation.
+- `sampled-current-state`: grounded in read-only Azure or Kubernetes observations from the user's configured tools.
+- `user-provided`: grounded in sanitized snippets supplied by the user.
+- `inference`: reasoned from evidence but not directly proven.
+
+## Mutation boundary
+
+- Default to read-only review.
+- Do not perform create, update, delete, rotate, purge, recover, apply, swap, reset, complete, deploy, assign, revoke, deallocate, quota, budget, or policy changes unless the user explicitly asks and approval is clear.
+- Prefer preview, what-if, dry-run, status, describe, list, show, diff, activity-log, and policy evaluation evidence before any mutation.
+
+## Credential and data boundary
+
+- Never ask users to paste credentials, tokens, tenant IDs, subscription IDs, customer data, private keys, kubeconfig contents, CA requester credentials, secret values, connection strings, or raw environment dumps.
+- Summarize sensitive evidence by field presence, control state, and risk; do not reproduce secret material.
+
+## Risk gates
+
+- Stop on ambiguous target, ambiguous principal, missing approval, missing rollback, missing financial owner, or missing asset owner for high-impact assets.
+- Treat broad permissions, permanent privileged access, public exposure, purge authority, destructive deployment behavior, quota increases, budget automation, and production slot swaps as high-risk.
+- Separate documented product behavior from sampled configured-environment evidence.
+
+## Asset-specific hard line
+
+Never execute an ARM, Bicep, or Deployment Stack change without confirmed scope, template/parameter provenance, what-if or managed-resource diff, deny-settings review, action-on-unmanage review, rollback constraints, and explicit human approval.

package/skills/azure/azure-live-arm-deployment-stack-guard/references/workflow-and-output.md

@@ -0,0 +1,33 @@
+# Workflow and Output Contract
+
+## Execution flow
+
+1. Scope the exact target, environment boundary, owner, requested operation, approval state, and rollback owner.
+2. Load `official-sources.md`, then the component operations guide for service behavior and risk gates.
+3. Gather sampled read-only evidence only when available and safe.
+4. Compare observed posture against documented behavior, least-privilege expectations, and live-operation safety rules.
+5. Refuse or defer mutation if target, approval, rollback, or evidence is incomplete.
+6. Return a verdict with evidence level, blockers, safe next actions, and open questions.
+
+## Required output
+
+- `verdict`: pass, warn, fail, or blocked.
+- `evidence_level`: documentation-based, sampled-current-state, user-provided, inference, or mixed.
+- `scope`: what was reviewed and what was not reviewed.
+- `approval_status`: explicit approval, missing approval, or not applicable for read-only review.
+- `blockers`: issues that prevent a safe or production-ready conclusion.
+- `findings`: severity-labeled risks with source labels.
+- `rollback_posture`: exact rollback path or explicit non-reversibility caveat.
+- `safe_next_actions`: reversible actions first; mutation only with explicit approval.
+- `open_questions`: missing facts that would change the verdict.
+
+## Stress checks
+
+- What assumption would make this recommendation unsafe?
+- Which role, policy, budget, quota, deployment, swap, or purge action has the largest blast radius?
+- What evidence would disprove the claimed readiness?
+- Is the answer accidentally treating documentation as environment-specific proof?
+
+## Response discipline
+
+Use Microsoft Learn documentation through the user's configured documentation MCP for documented Azure behavior. Use sampled read-only Azure evidence only for current configured-environment observations and label it as sampled evidence.

package/skills/azure/azure-live-cost-budget-action-guard/SKILL.md

@@ -4,8 +4,8 @@ description: Gate Azure budget action changes and GPU/HPC SKU provisioning again
 allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
-  version: "0.1.0"
-  updated: "2026-05-05"
+  version: 0.1.7
+  updated: "2026-06-05"
   category: finops
 ---
 
@@ -25,7 +25,7 @@ Use this skill when:
 
 ## Lean operating rules
 
-- Prefer Azure CLI (`az`) official documentation when available; fall back to Microsoft Learn docs and sanitized user evidence.
+- Prefer Microsoft Learn documentation through the user's configured documentation MCP; use sampled read-only Azure evidence when available, then sanitized user evidence.
 - Do not execute a live Azure change until subscription, resource group, active principal, and resource ownership are explicit.
 - Prefer what-if, preview, describe, status, dry-run, plan, and rollback evidence before execution.
 - If the request skips preview or rollback design, push back.
@@ -36,9 +36,13 @@ Use this skill when:
 
 Load these only when needed:
 
+- [Azure Cost Budget and Quota Operations](references/budget-quota-operations.md) — use for current service behavior, common failure modes, hard design rules, verification targets, and push-back conditions.
 - [Preflight commands](references/preflight-commands.md) — CLI commands to run before any mutation.
 - [Rollback playbook](references/rollback-playbook.md) — concrete rollback steps for this service.
 - [Permission model](references/permission-model.md) — RBAC role definitions and PIM guidance.
+- [MCP and evidence path](references/mcp-and-evidence.md) — use when choosing documentation-based evidence, sampled read-only evidence, or sanitized user evidence.
+- [Safety checklist](references/safety-checklist.md) — use for evidence labels, budget thresholds, action groups, data latency, quota/spend approval, and runaway-cost rollback limits.
+- [Workflow and output contract](references/workflow-and-output.md) — execution flow and final response contract.
 - [Official sources](references/official-sources.md) — authoritative Azure documentation links.
 
 ## Response minimum

package/skills/azure/azure-live-cost-budget-action-guard/metadata.json

@@ -11,17 +11,19 @@
     "kiro",
     "other"
   ],
-  "summary": "Gate Azure budget action changes and GPU/HPC SKU provisioning against approved spend limits, with quota audits and emergency spend-stop playbooks.",
+  "summary": "Gate Azure budget action changes, cost-alert automation, and quota-sensitive GPU/HPC provisioning against approved spend limits, cost data latency, action-group behavior, and emergency spend-stop playbooks.",
   "source_type": "original",
   "official_docs": [
-    "https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-acm-create-budgets",
-    "https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits",
-    "https://learn.microsoft.com/en-us/azure/quotas/quickstart-increase-quota-portal",
-    "https://learn.microsoft.com/en-us/azure/cost-management-billing/finops/overview-finops"
+    "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets",
+    "https://learn.microsoft.com/azure/cost-management-billing/costs/cost-mgt-alerts-monitor-usage-spending",
+    "https://learn.microsoft.com/azure/cost-management-billing/costs/cost-mgt-best-practices",
+    "https://learn.microsoft.com/cloud-computing/finops/framework/quantify/budgeting",
+    "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal",
+    "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits"
   ],
-  "security_notes": "GPU/HPC SKUs (NDv5, H100, A100) can generate $50K+ daily costs. Never approve quota increases or budget threshold raises without explicit spend-approval sign-off from a financial authority.",
-  "last_verified": "2026-04-30",
+  "security_notes": "Never approve quota increases, budget threshold raises, automated cost actions, or high-cost SKU provisioning without explicit financial owner approval, cost data latency caveat, rollback or stop action, and scope confirmation.",
+  "last_verified": "2026-06-05",
   "path": "skills/azure/azure-live-cost-budget-action-guard",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.7"
 }

package/skills/azure/azure-live-cost-budget-action-guard/references/budget-quota-operations.md

@@ -0,0 +1,68 @@
+# Azure Cost Budget and Quota Operations
+
+Use this reference for current, source-grounded service behavior and the hard live-operation gates that the lean `SKILL.md` intentionally does not carry.
+
+## What people get wrong
+
+- Assuming a budget alert stops Azure spend.
+- Approving GPU/HPC quota because current spend is low, while ignoring delayed cost data.
+- Creating action groups with no owner or runbook.
+- Raising budget thresholds without financial authority and expiry.
+- Using quota increase as capacity planning rather than explicit spend-risk acceptance.
+
+## Officially grounded service shape
+
+Microsoft Learn evidence says Cost Management budgets monitor spending and trigger notifications or action groups, but budget alerts do not stop resources or consumption. Cost and usage data is typically delayed, and budgets are evaluated on a schedule. Budgeting guidance recommends alerts, anomaly detection, stakeholder ownership, and automation only with clear accountable response paths.
+
+- Budgets can be scoped and filtered, and can alert on actual or forecast cost.
+- Budget alerts notify stakeholders and can integrate action groups at supported scopes.
+- Cost data is not real time; budget evaluations lag consumption.
+- Quota controls capacity but is not a budget by itself.
+- Emergency spend-stop actions can be disruptive and need owner approval and rollback criteria.
+
+## Non-negotiable design rules
+
+- Confirm billing/subscription/resource-group scope and financial owner before changes.
+- State that budgets do not stop consumption unless paired with separate approved automation.
+- Review actual, forecast, data freshness, threshold, recipients, action groups, and anomaly coverage.
+- Treat GPU/HPC quota and high-cost scale-up as high-risk financial mutations.
+- Prefer lower-risk alerts and temporary quotas before permanent threshold increases.
+
+## Minimal safe implementation flow
+
+- Scope cost owner, subscription/resource group, workload, SKU, quota, and budget action.
+- Collect current budget definitions, alert thresholds, action groups, current/forecast costs, data freshness, and quota state.
+- Classify proposed change as alert-only, automation, quota increase, deallocation, or spend-stop.
+- Gate mutation on explicit financial approval and rollback/restore plan.
+- Verify alert/action configuration and document residual spend risk.
+
+## High-risk assumptions to kill
+
+- A budget alert is not a spending stop. Microsoft Learn states resources are not affected and consumption is not stopped when thresholds are exceeded.
+- Cost evidence is delayed; budget decisions based on current totals can be wrong because cost and usage data is typically available hours later and evaluated on a schedule.
+- Action groups can trigger automation, but automation without an owner, runbook, and rollback path is an outage mechanism, not FinOps control.
+- Quota increases authorize capacity to spend faster; they are financial-risk approvals even when no resource is created immediately.
+- Forecast alerts are predictions, not guarantees; they must be labeled separately from actual-cost evidence.
+
+## Safe command/code verification targets
+
+- Verify budget scope, filters, reset period, amount, expiration, actual thresholds, forecast thresholds, recipients, and action groups.
+- Confirm cost-data freshness and label actual versus forecast evidence in the final verdict.
+- Inspect action-group receivers and automation targets without exposing secrets or customer data.
+- Require business owner, duration, and spend ceiling for high-cost quota or budget-threshold increases.
+- Verify post-change budget/action configuration and document that residual consumption can continue after alerting.
+
+## Safe verification targets
+
+- Budget thresholds and recipients match accountable stakeholders.
+- Action group behavior and automation runbooks are tested and reversible where possible.
+- Cost data freshness and forecast uncertainty are explicitly stated.
+- Quota increase request has business justification, expiry/review, and spend ceiling.
+- Emergency deallocation or quota reduction has owner approval and service-impact assessment.
+
+## When to push back
+
+- The user treats budget alerting as a hard spending stop.
+- Financial approval is missing or vague.
+- High-cost quota request lacks workload, duration, and maximum-spend boundary.
+- Automation could deallocate production without an incident commander and rollback plan.

package/skills/azure/azure-live-cost-budget-action-guard/references/mcp-and-evidence.md

@@ -0,0 +1,26 @@
+# Documentation and Evidence Path
+
+## Preferred evidence order
+
+1. Microsoft Learn documentation through the user's configured documentation MCP for documented Azure behavior.
+2. Sampled read-only Azure evidence, when safely available, for current configured-environment observations.
+3. Sanitized user-provided evidence.
+4. Clearly labeled inference.
+
+## What each evidence type can prove
+
+- Microsoft Learn documentation can prove documented service behavior, supported concepts, limitations, and recommended patterns.
+- Sampled read-only evidence can prove the sampled configured state at the time observed.
+- Sanitized user evidence can prove only what the snippet shows.
+- None of these alone prove broad regional availability, future success, full account posture, or production readiness.
+
+## Safe usage pattern
+
+- State whether each claim is documentation-based, sampled-current-state, user-provided, or inference.
+- Use read-only queries before recommending changes.
+- Do not include sensitive internal identifiers, tenant identifiers, subscription identifiers, or secrets in committed docs or final findings.
+- If no sampled evidence is available, say the review is documentation-based and list the exact evidence still needed.
+
+## Live-operation rule
+
+For live operations, documentation is never enough. Require target confirmation, current-state evidence, explicit approval, rollback constraints, and post-action verification.

package/skills/azure/azure-live-cost-budget-action-guard/references/official-sources.md

@@ -1,17 +1,27 @@
-# Official Sources: Azure Live Cost Budget Action Guard
+# Official Sources
 
-## Azure Cost Management budgets
+Use these sources to ground the skill. Microsoft Learn documentation proves documented Azure behavior; it does not prove the user's tenant, subscription, RBAC, quota, deployed resources, current cost, vault state, app health, or production readiness.
 
-- https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-acm-create-budgets
-- https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/manage-automation
-- https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/cost-analysis-common-uses
+## Primary Microsoft Learn sources
 
-## Azure Quotas and limits
+- https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets
+- https://learn.microsoft.com/azure/cost-management-billing/costs/cost-mgt-alerts-monitor-usage-spending
+- https://learn.microsoft.com/azure/cost-management-billing/costs/cost-mgt-best-practices
+- https://learn.microsoft.com/cloud-computing/finops/framework/quantify/budgeting
+- https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal
+- https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits
 
-- https://learn.microsoft.com/en-us/azure/quotas/quotas-overview
-- https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits
+## Grounding notes
 
-## Source-grounding rule
+- Documentation-based claim: Microsoft Learn evidence says Cost Management budgets monitor spending and trigger notifications or action groups, but budget alerts do not stop resources or consumption. Cost and usage data is typically delayed, and budgets are evaluated on a schedule. Budgeting guidance recommends alerts, anomaly detection, stakeholder ownership, and automation only with clear accountable response paths.
+- Current-state claim: requires sampled read-only Azure evidence or sanitized user-provided evidence.
+- Live-operation claim: requires target, principal, approval, preflight evidence, rollback constraints, and post-action verification.
+- Inference: allowed only when labeled and tied to observed fields or documented behavior.
+- Do not include sensitive internal identifiers or secret material in findings.
 
-Use official Microsoft Learn documentation as the source of truth.
-Budget and quota behavior changes with service versions — verify current API behavior against docs.
+## Source use rules
+
+- Prefer Microsoft Learn documentation through the user's configured documentation MCP for current Azure service behavior.
+- Use sampled read-only Azure evidence only to validate current configured-environment observations.
+- If documentation and sampled evidence appear to conflict, report both and stop short of a production-ready verdict.
+- Re-check official sources before changing high-risk guidance, because cloud behavior and feature availability can change.

package/skills/azure/azure-live-cost-budget-action-guard/references/permission-model.md

@@ -26,7 +26,7 @@
     "Microsoft.CostManagement/budgets/delete"
   ],
   "AssignableScopes": [
-    "/subscriptions/<SUBSCRIPTION_ID>"
+    "$APPROVED_AZURE_SCOPE"
   ]
 }
 ```
@@ -64,3 +64,5 @@ Deny GPU VM SKU provisioning without an approved budget tag:
 - `Cost Management Contributor` at management-group scope
 - `Billing Account Contributor`
 - `Microsoft.Compute/virtualMachines/write` to this role
+
+Use exact resource scopes from approved change records; do not paste raw subscription identifiers into chat.