@raishin/vanguard-frontier-agentic 2.8.0 → 2.10.0

package/skills/aws/aws-landing-zone-governor/SKILL.md

@@ -4,8 +4,8 @@ description: Review and design AWS landing zones, AWS Control Tower environments
 allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
-  version: "0.1.2"
-  updated: "2026-05-05"
+  version: "0.1.4"
+  updated: "2026-06-02"
   category: compliance
 ---
 
@@ -26,7 +26,7 @@ Use this skill for:
 
 ## Lean operating rules
 
-- Prefer `AwsDocumentationMcpServer` when available via `uvx awslabs.aws-documentation-mcp-server@latest`; if `uvx` cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
+- Prefer current AWS documentation tools for service behavior. Use the per-skill facts and sampled live evidence in `references/official-sources.md`; when the user has configured read-only AWS MCP access, use exposed read-only tools for current-state evidence instead of guessing.
 - Separate confirmed facts from inference. If state was not queried or shown, say so.
 - Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
 - Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
@@ -39,6 +39,7 @@ Load these only when needed:
 - [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
 - [Safety checklist](references/safety-checklist.md) — use before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting recommendations.
 - [Official sources](references/official-sources.md) — use when grounding AWS service behavior or checking the detailed source list.
+- [Landing Zone Governance Controls Guide](references/landing-zone-governance-controls.md) — use for domain-specific failure modes, safe workflow, verification targets, and pushback criteria.
 
 ## Response minimum
 

package/skills/aws/aws-landing-zone-governor/metadata.json

@@ -14,14 +14,14 @@
   "summary": "Review AWS multi-account landing zones, Control Tower posture, Organizations structure, OUs, guardrails, logging, audit accounts, and account vending decisions.",
   "source_type": "original",
   "official_docs": [
+    "https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html",
     "https://docs.aws.amazon.com/controltower/latest/userguide/aws-multi-account-landing-zone.html",
-    "https://docs.aws.amazon.com/controltower/latest/userguide/lz-update-best-practices.html",
-    "https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-aws-environment/understanding-landing-zones.html",
-    "https://docs.aws.amazon.com/prescriptive-guidance/latest/designing-control-tower-landing-zone/introduction.html"
+    "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html",
+    "https://docs.aws.amazon.com/controltower/latest/controlreference/control-reference.html"
   ],
   "security_notes": "Do not collapse environments into one account for convenience. Treat weak OU design, missing centralized logging, unmanaged SCPs, and unclear account ownership as governance risks.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-landing-zone-governor",
   "author": "github: Raishin",
-  "version": "0.1.2"
+  "version": "0.1.4"
 }

package/skills/aws/aws-landing-zone-governor/references/landing-zone-governance-controls.md

@@ -0,0 +1,59 @@
+# Landing Zone Governance Controls Guide
+
+Use this reference for AWS landing zone, Control Tower, Organizations, OU, account vending, guardrail, delegated admin, centralized logging, and audit/security account reviews.
+
+## What people get wrong
+
+The lazy story is:
+
+> Control Tower deployed successfully, so the landing zone is governed.
+
+Wrong. Landing-zone governance fails through account sprawl, OU drift, missing delegated-admin scope, weak SCPs, logging gaps, and unclear account lifecycle ownership.
+
+Common bad assumptions:
+
+- OUs mirror the org chart safely.
+- SCPs are complete guardrails rather than coarse permission boundaries.
+- Centralized logging exists because an audit account exists.
+- Account vending is safe without lifecycle, budget, and ownership controls.
+- Sandbox accounts are low risk.
+- Control Tower drift is only an operational nuisance.
+
+## Landing-zone failure modes
+
+- Workloads are placed in OUs with wrong controls, data residency, or production isolation.
+- SCPs block break-glass or deployments, or fail to prevent risky services/Regions.
+- CloudTrail, Config, Security Hub, GuardDuty, Macie, IAM Access Analyzer, and log archive coverage differ across accounts/Regions.
+- Account factory/vending lacks owner, cost center, environment, network, identity, and decommission metadata.
+- Delegated administrator roles create hidden privilege concentration.
+- Shared network/log/security accounts become single points of governance failure.
+
+## Minimum safe workflow
+
+1. Identify organization scope, management account constraints, Control Tower state, OUs, Regions, and account inventory.
+2. Classify accounts by environment, data sensitivity, workload criticality, ownership, and lifecycle stage.
+3. Review preventive controls: SCPs, Control Tower controls, Region restrictions, IAM boundaries, and break-glass path.
+4. Review detective controls: organization trails, Config aggregators, Security Hub, GuardDuty, Macie, log archive, and alert routing.
+5. Check account vending and decommission workflow for owner, budget, network, identity, tagging, and closure criteria.
+6. Return governance gaps with blast radius, evidence level, owner, and staged remediation.
+7. Do not recommend management-account or SCP changes without explicit approval and rollback plan.
+
+## Verification targets
+
+- AWS Organizations OUs, accounts, delegated admins, SCPs, tag policies, backup policies, and Region restrictions
+- AWS Control Tower landing-zone version, enabled controls, drift status, Account Factory/account vending process
+- log archive/audit/security account design, CloudTrail organization trail, Config aggregator, and S3/KMS log protection
+- identity center/federation, break-glass, permission sets, and management-account access controls
+- shared networking accounts, VPC sharing, Transit Gateway ownership, and account baseline templates
+- account owner metadata, budgets, tags, support model, and decommission evidence
+
+## When to push back
+
+Push back if the user asks to:
+
+- flatten OUs for convenience without blast-radius analysis
+- deploy SCPs without testing break-glass and pipeline impact
+- call Control Tower deployment proof of full governance
+- skip centralized logs or delegated-admin coverage checks
+- create accounts without owner, budget, lifecycle, and data classification
+- mutate management-account controls from advisory review alone

package/skills/aws/aws-landing-zone-governor/references/official-sources.md

@@ -5,11 +5,25 @@ Use this reference only when you need source grounding for AWS service behavior
 ## AWS documentation
 
 Use these as starting points, not as proof of the user's live AWS state:
+- https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html
 - https://docs.aws.amazon.com/controltower/latest/userguide/aws-multi-account-landing-zone.html
-- https://docs.aws.amazon.com/controltower/latest/userguide/lz-update-best-practices.html
-- https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-aws-environment/understanding-landing-zones.html
-- https://docs.aws.amazon.com/prescriptive-guidance/latest/designing-control-tower-landing-zone/introduction.html
+- https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html
+- https://docs.aws.amazon.com/controltower/latest/controlreference/control-reference.html
 
 ## Grounding rule
 
-Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, or operational state. Prefer live AWS MCP/CLI evidence or sanitized user-provided evidence for current-state claims.
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, entitlement, or operational state. Prefer read-only AWS MCP or CLI evidence, repository evidence, or sanitized user-provided evidence for current-state claims.
+
+## Current MCP/documentation refresh (2026-06-02)
+
+Service facts from official docs:
+- AWS Control Tower automates multi-account governance with controls, account provisioning, and drift prevention/detection around a landing zone.
+- AWS multi-account landing-zone guidance emphasizes OU structure, workload isolation, and separating production from non-production environments.
+
+Sampled live evidence:
+- Read-only regional availability sampling reported AWS Control Tower and AWS Organizations as `isAvailableIn` in `us-east-1`, `us-west-2`, `eu-west-1`, and `ap-southeast-1`.
+- Sampled product availability is not proof that a landing zone is enabled, healthy, drift-free, or compliant in the user's organization.
+
+Review implications:
+- Require evidence for organization structure, OUs/accounts, SCPs, delegated admin, controls/guardrails, identity center, logging/audit accounts, network boundaries, and drift.
+- Do not infer landing-zone health from service availability; inspect Control Tower state, Organizations policy attachments, Config/CloudTrail coverage, and exceptions.

package/skills/aws/aws-landing-zone-governor/references/safety-checklist.md

@@ -5,10 +5,10 @@ Use this reference before privileged, destructive, traffic-changing, cost-changi
 ## Non-negotiables
 
 - Never ask users to paste secrets, access keys, session tokens, private keys, customer identifiers, or sensitive account data into chat.
-- Prefer official AWS MCP tools when exposed by the active runtime. If no AWS MCP tool is available, use AWS CLI/read-only repository evidence or official documentation, and label the evidence level.
+- Use read-only AWS MCP or read-only AWS CLI evidence for live state when available; otherwise use repository evidence, sanitized user evidence, or official documentation and label the evidence level.
 - Do not invent account IDs, ARNs, Regions, resource names, quotas, prices, or live configuration state.
 - Require explicit user approval before privileged, destructive, traffic-changing, cost-changing, or production-impacting actions.
-- Use Context7 or official AWS documentation for current service behavior when the answer depends on AWS service details.
+- Use current official AWS documentation for service behavior when the answer depends on AWS service details.
 - Keep remediation least-privilege, reversible, and scoped to the requested workload or account boundary.
 
 ## Stress checks

package/skills/aws/aws-landing-zone-governor/references/workflow-and-output.md

@@ -19,7 +19,7 @@ Check these areas before giving a verdict:
    - Required outcome:
    - Explicit non-goals:
 2. **Collect evidence**
-   - Prefer live AWS MCP read-only evidence if available.
+   - Prefer read-only AWS MCP or read-only AWS CLI evidence for current-state claims when available.
    - Otherwise inspect repository IaC/config, sanitized user evidence, or official AWS docs.
    - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
 3. **Stress-test risk**

package/skills/aws/aws-live-deployment-guarded-operator/SKILL.md

@@ -4,8 +4,8 @@ description: Operate guarded live AWS deployment changes with explicit account,
 allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
-  version: "0.1.0"
-  updated: "2026-05-05"
+  version: "0.1.3"
+  updated: "2026-06-02"
   category: delivery
 ---
 

package/skills/aws/aws-live-deployment-guarded-operator/metadata.json

@@ -14,14 +14,14 @@
   "summary": "Operate guarded live AWS deployment changes only after explicit target confirmation, approval checkpoints, dry-run or preview evidence, rollback readiness, and post-change verification.",
   "source_type": "original",
   "official_docs": [
-    "https://docs.aws.amazon.com/cli/v1/reference/sts/get-caller-identity.html",
+    "https://docs.aws.amazon.com/codedeploy/latest/userguide/welcome.html",
+    "https://docs.aws.amazon.com/config/latest/developerguide/codedeploy-deployment-group-auto-rollback-enabled.html",
     "https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals.html",
-    "https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-change-calendar.html",
-    "https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/welcome.html"
+    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/drift-aware-change-sets.html"
   ],
   "security_notes": "This role may work in repos connected to live AWS credentials. Never run live deployment mutations without explicit target confirmation, preview evidence, approval, rollback readiness, and post-change verification.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-live-deployment-guarded-operator",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.3"
 }

package/skills/aws/aws-live-deployment-guarded-operator/references/official-sources.md

@@ -1,12 +1,29 @@
 # Official sources
 
-Primary AWS documentation used to shape this guarded live-AWS role:
+Use this reference only when you need source grounding for AWS service behavior or the detailed source list.
 
-- https://docs.aws.amazon.com/cli/v1/reference/sts/get-caller-identity.html
+## AWS documentation
+
+Use these as starting points, not as proof of the user's live AWS state:
+- https://docs.aws.amazon.com/codedeploy/latest/userguide/welcome.html
+- https://docs.aws.amazon.com/config/latest/developerguide/codedeploy-deployment-group-auto-rollback-enabled.html
 - https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals.html
-- https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-change-calendar.html
-- https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/welcome.html
+- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/drift-aware-change-sets.html
+
+## Grounding rule
+
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, entitlement, or operational state. Prefer read-only AWS MCP or CLI evidence, repository evidence, or sanitized user-provided evidence for current-state claims.
+
+## Current MCP/documentation refresh (2026-06-02)
+
+Service facts from official docs:
+- CodeDeploy automates deployments for EC2, Lambda, and ECS and supports deployment types such as rolling and blue/green traffic shifting depending on compute platform.
+- AWS Config has a managed rule checking whether CodeDeploy deployment groups have auto rollback enabled.
 
-## Source-grounding rule
+Sampled live evidence:
+- Read-only regional availability sampling reported AWS CodeDeploy and AWS CloudFormation as `isAvailableIn` in `us-east-1`, `us-west-2`, `eu-west-1`, and `ap-southeast-1`.
+- Sampled APIs `CodeDeploy+GetDeployment`, `CodePipeline+GetPipelineState`, and `CloudFormation+CreateChangeSet` were reported `isAvailableIn` in those regions.
 
-Use official AWS documentation as the source of truth for service behavior. Use Context7 only as a supplementary guideline for agent-guardrail design when it helps clarify stricter instruction patterns; do not let secondary examples override AWS service docs.
+Review implications:
+- Live deployment operation must be approval-gated and evidence-driven: current deployment state, rollback trigger, health alarms, blast radius, change set/diff, and stop/rollback command path.
+- Do not perform or recommend live mutation from stale docs or repo-only evidence.

package/skills/aws/aws-live-ecs-rollout-guard/SKILL.md

@@ -4,8 +4,8 @@ description: Guard live Amazon ECS and Fargate rollout actions with ecs service,
 allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
-  version: "0.1.0"
-  updated: "2026-05-05"
+  version: "0.1.3"
+  updated: "2026-06-02"
   category: delivery
 ---
 

package/skills/aws/aws-live-ecs-rollout-guard/metadata.json

@@ -14,14 +14,14 @@
   "summary": "Guard live Amazon ECS and Fargate rollout actions with service targeting, deployment circuit breaker or alarm checks, rollback posture, and explicit approval before mutation.",
   "source_type": "original",
   "official_docs": [
-    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-circuit-breaker.html",
-    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-alarm-failure.html",
-    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-failure-detection.html",
-    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_service_deployment_events.html"
+    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-deployment.html",
+    "https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-steps-ecs.html",
+    "https://docs.aws.amazon.com/whitepapers/latest/overview-deployment-options/bluegreen-deployments.html",
+    "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/troubleshooting.html"
   ],
   "security_notes": "Live ECS rollout actions require exact service targeting, health evidence, rollback posture, and explicit approval. Never treat force-new-deployment as a harmless default.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-live-ecs-rollout-guard",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.3"
 }

package/skills/aws/aws-live-ecs-rollout-guard/references/official-sources.md

@@ -1,12 +1,29 @@
 # Official sources
 
-Primary AWS documentation used to shape this guarded live-AWS role:
+Use this reference only when you need source grounding for AWS service behavior or the detailed source list.
 
-- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-circuit-breaker.html
-- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-alarm-failure.html
-- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-failure-detection.html
-- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_service_deployment_events.html
+## AWS documentation
 
-## Source-grounding rule
+Use these as starting points, not as proof of the user's live AWS state:
+- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-deployment.html
+- https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-steps-ecs.html
+- https://docs.aws.amazon.com/whitepapers/latest/overview-deployment-options/bluegreen-deployments.html
+- https://docs.aws.amazon.com/AmazonECS/latest/developerguide/troubleshooting.html
 
-Use official AWS documentation as the source of truth for service behavior. Use Context7 only as a supplementary guideline for agent-guardrail design when it helps clarify stricter instruction patterns; do not let secondary examples override AWS service docs.
+## Grounding rule
+
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, entitlement, or operational state. Prefer read-only AWS MCP or CLI evidence, repository evidence, or sanitized user-provided evidence for current-state claims.
+
+## Current MCP/documentation refresh (2026-06-02)
+
+Service facts from official docs:
+- ECS service deployment history tracks lifecycle states, circuit breaker failures, CloudWatch alarms, rollbacks, and recent deployment history.
+- ECS blue/green deployments with CodeDeploy shift traffic between replacement task sets and can use lifecycle hooks; rollback depends on deployment configuration and health signals.
+
+Sampled live evidence:
+- Read-only regional availability sampling reported Amazon ECS, AWS Fargate, and AWS CodeDeploy as `isAvailableIn` in `us-east-1`, `us-west-2`, `eu-west-1`, and `ap-southeast-1`.
+- Sampled APIs `ECS+DescribeServices`, `ECS+DescribeTasks`, `CloudWatch+DescribeAlarms`, and `CodeDeploy+GetDeployment` were reported `isAvailableIn` in those regions.
+
+Review implications:
+- Guard live ECS rollout with current service/deployment state, stopped-task reasons, target health, alarms, deployment controller, desired/running counts, and rollback/stop path.
+- Regional/API availability does not prove a service is safe to roll forward.

package/skills/aws/aws-live-iac-change-guard/SKILL.md

@@ -4,8 +4,8 @@ description: Guard live CloudFormation, SAM, CDK, and Terraform-backed AWS infra
 allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
-  version: "0.1.0"
-  updated: "2026-05-05"
+  version: "0.1.3"
+  updated: "2026-06-02"
   category: delivery
 ---
 

package/skills/aws/aws-live-iac-change-guard/metadata.json

@@ -14,15 +14,14 @@
   "summary": "Guard live CloudFormation, SAM, CDK, and Terraform-backed AWS infrastructure changes with change sets or plans, rollback triggers, stack policies, drift checks, and explicit approval.",
   "source_type": "original",
   "official_docs": [
+    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/drift-aware-change-sets.html",
     "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html",
-    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html",
-    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-rollback-triggers.html",
-    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html",
-    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html"
+    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-policy.html",
+    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-rollback-triggers.html"
   ],
   "security_notes": "Live IaC execution only with explicit preview evidence, confirmed targets, rollback triggers or equivalent safeguards, and human approval before execute. Never treat repo write access as enough authority for live infrastructure mutation.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-live-iac-change-guard",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.3"
 }

package/skills/aws/aws-live-iac-change-guard/references/official-sources.md

@@ -1,13 +1,29 @@
 # Official sources
 
-Primary AWS documentation used to shape this guarded live-AWS role:
+Use this reference only when you need source grounding for AWS service behavior or the detailed source list.
 
+## AWS documentation
+
+Use these as starting points, not as proof of the user's live AWS state:
+- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/drift-aware-change-sets.html
 - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html
-- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html
+- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-policy.html
 - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-rollback-triggers.html
-- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html
-- https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html
 
-## Source-grounding rule
+## Grounding rule
+
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, entitlement, or operational state. Prefer read-only AWS MCP or CLI evidence, repository evidence, or sanitized user-provided evidence for current-state claims.
+
+## Current MCP/documentation refresh (2026-06-02)
+
+Service facts from official docs:
+- CloudFormation best practices include creating change sets before updating stacks, stack policies, CloudTrail logging, regular drift detection, rollback triggers, and least-privilege IAM.
+- Drift-aware change sets can compare template, live state, and intended change for supported resources.
+
+Sampled live evidence:
+- Read-only regional availability sampling reported AWS CloudFormation as `isAvailableIn` in `us-east-1`, `us-west-2`, `eu-west-1`, and `ap-southeast-1`.
+- Sampled APIs `CloudFormation+CreateChangeSet` and `CloudFormation+DetectStackDrift` were reported `isAvailableIn` in those regions.
 
-Use official AWS documentation as the source of truth for service behavior. Use Context7 only as a supplementary guideline for agent-guardrail design when it helps clarify stricter instruction patterns; do not let secondary examples override AWS service docs.
+Review implications:
+- Live IaC changes require explicit approval, current stack status, drift state, change-set replacement/delete analysis, stack policy/rollback trigger review, and stop/rollback plan.
+- Never equate template validity with safe live execution.

package/skills/aws/aws-live-pipeline-approval-operator/SKILL.md

@@ -4,8 +4,8 @@ description: Handle live CodePipeline approval and gated resume decisions with p
 allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
-  version: "0.1.0"
-  updated: "2026-05-05"
+  version: "0.1.3"
+  updated: "2026-06-02"
   category: delivery
 ---
 

package/skills/aws/aws-live-pipeline-approval-operator/metadata.json

@@ -15,13 +15,13 @@
   "source_type": "original",
   "official_docs": [
     "https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals.html",
-    "https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals-action-add.html",
-    "https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals-iam-permissions.html",
-    "https://docs.aws.amazon.com/codepipeline/latest/userguide/actions.html"
+    "https://docs.aws.amazon.com/codepipeline/latest/userguide/actions-invoke-lambda-function.html",
+    "https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-four-stage-pipeline.html",
+    "https://docs.aws.amazon.com/codedeploy/latest/userguide/deployments-rollback-and-redeploy.html"
   ],
   "security_notes": "This role may interact with real pipeline approvals. Never approve, reject, or resume the wrong execution. Require exact targeting, approver authority, evidence review, and post-action verification.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-live-pipeline-approval-operator",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.3"
 }

package/skills/aws/aws-live-pipeline-approval-operator/references/official-sources.md

@@ -1,12 +1,29 @@
 # Official sources
 
-Primary AWS documentation used to shape this guarded live-AWS role:
+Use this reference only when you need source grounding for AWS service behavior or the detailed source list.
 
+## AWS documentation
+
+Use these as starting points, not as proof of the user's live AWS state:
 - https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals.html
-- https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals-action-add.html
-- https://docs.aws.amazon.com/codepipeline/latest/userguide/approvals-iam-permissions.html
-- https://docs.aws.amazon.com/codepipeline/latest/userguide/actions.html
+- https://docs.aws.amazon.com/codepipeline/latest/userguide/actions-invoke-lambda-function.html
+- https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-four-stage-pipeline.html
+- https://docs.aws.amazon.com/codedeploy/latest/userguide/deployments-rollback-and-redeploy.html
+
+## Grounding rule
+
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, entitlement, or operational state. Prefer read-only AWS MCP or CLI evidence, repository evidence, or sanitized user-provided evidence for current-state claims.
+
+## Current MCP/documentation refresh (2026-06-02)
+
+Service facts from official docs:
+- CodePipeline supports manual approval actions and pipeline stages; approvals are a release gate, not evidence that the release is safe.
+- Lambda invoke actions in CodePipeline use execution roles, continuation tokens, and JSON parameters; custom approval automation can fail independently of the deployment target.
 
-## Source-grounding rule
+Sampled live evidence:
+- Read-only regional availability sampling reported AWS CodePipeline and AWS CodeDeploy as `isAvailableIn` in `us-east-1`, `us-west-2`, `eu-west-1`, and `ap-southeast-1`.
+- Sampled APIs `CodePipeline+GetPipelineState`, `CodePipeline+ListActionExecutions`, and `CodeDeploy+GetDeployment` were reported `isAvailableIn` in those regions.
 
-Use official AWS documentation as the source of truth for service behavior. Use Context7 only as a supplementary guideline for agent-guardrail design when it helps clarify stricter instruction patterns; do not let secondary examples override AWS service docs.
+Review implications:
+- Do not approve a pipeline without current pipeline execution state, artifact/revision identity, test/security gate results, deployment target, rollback path, owner approval, and incident/change-calendar context.
+- Approval is mutation-enabling; require explicit user authorization before approving or rejecting live actions.

package/skills/aws/aws-live-serverless-release-guard/SKILL.md

@@ -4,8 +4,8 @@ description: Guard live Lambda and serverless release actions with lambda alias,
 allowed-tools: Read Grep Glob WebFetch
 metadata:
   author: "github: Raishin"
-  version: "0.1.0"
-  updated: "2026-05-05"
+  version: "0.1.3"
+  updated: "2026-06-02"
   category: delivery
 ---
 

package/skills/aws/aws-live-serverless-release-guard/metadata.json

@@ -14,14 +14,14 @@
   "summary": "Guard live Lambda and serverless release actions with alias targeting, canary or linear rollout discipline, alarms, rollback hooks, and explicit production approval.",
   "source_type": "original",
   "official_docs": [
-    "https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html",
-    "https://docs.aws.amazon.com/lambda/latest/dg/configuring-alias-routing.html",
     "https://docs.aws.amazon.com/codedeploy/latest/userguide/welcome.html",
-    "https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-configurations.html"
+    "https://docs.aws.amazon.com/codedeploy/latest/userguide/tutorial-lambda-sam-template.html",
+    "https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html",
+    "https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html"
   ],
   "security_notes": "Live serverless rollout actions require exact alias or deployment targeting, explicit approval, alarms, rollback posture, and post-change observation. Never shift traffic casually in a live environment.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-live-serverless-release-guard",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.3"
 }

package/skills/aws/aws-live-serverless-release-guard/references/official-sources.md

@@ -1,12 +1,29 @@
 # Official sources
 
-Primary AWS documentation used to shape this guarded live-AWS role:
+Use this reference only when you need source grounding for AWS service behavior or the detailed source list.
 
-- https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html
-- https://docs.aws.amazon.com/lambda/latest/dg/configuring-alias-routing.html
+## AWS documentation
+
+Use these as starting points, not as proof of the user's live AWS state:
 - https://docs.aws.amazon.com/codedeploy/latest/userguide/welcome.html
-- https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-configurations.html
+- https://docs.aws.amazon.com/codedeploy/latest/userguide/tutorial-lambda-sam-template.html
+- https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html
+- https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html
+
+## Grounding rule
+
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, entitlement, or operational state. Prefer read-only AWS MCP or CLI evidence, repository evidence, or sanitized user-provided evidence for current-state claims.
+
+## Current MCP/documentation refresh (2026-06-02)
+
+Service facts from official docs:
+- CodeDeploy supports Lambda deployments and traffic shifting; SAM templates can configure CodeDeploy hooks, aliases, linear deployment, and lifecycle validation.
+- Lambda versions and aliases separate immutable published code/config snapshots from traffic-routing names used by release workflows.
 
-## Source-grounding rule
+Sampled live evidence:
+- Read-only regional availability sampling reported AWS Lambda and AWS CodeDeploy as `isAvailableIn` in `us-east-1`, `us-west-2`, `eu-west-1`, and `ap-southeast-1`.
+- Sampled APIs `Lambda+GetFunction` and `CodeDeploy+GetDeployment` were reported `isAvailableIn` in those regions.
 
-Use official AWS documentation as the source of truth for service behavior. Use Context7 only as a supplementary guideline for agent-guardrail design when it helps clarify stricter instruction patterns; do not let secondary examples override AWS service docs.
+Review implications:
+- Serverless release safety requires version/alias state, traffic-shift config, lifecycle hook results, alarms, concurrency/error/latency signals, rollback alias target, and blast-radius evidence.
+- Do not infer rollback readiness from SAM/CodeDeploy syntax alone.

package/skills/aws/aws-maestro/SKILL.md

@@ -4,8 +4,8 @@ description: Route AWS tasks to the narrowest specialist or team of specialists
 allowed-tools: Agent Skill Read Grep Glob
 metadata:
   author: "github: Raishin"
-  version: "0.1.0"
-  updated: "2026-05-05"
+  version: "0.1.4"
+  updated: "2026-06-02"
   category: ai
 ---
 
@@ -48,3 +48,4 @@ Load these only when needed:
 - [Full routing table and dispatch examples](references/workflow-and-output.md) — use when classifying a specific task and selecting specialists.
 - [Official sources](references/official-sources.md) — use when grounding AWS service behavior or confirming catalog agent names.
 - [Safety checklist](references/safety-checklist.md) — use before any live-guard routing or when blast-radius assessment is required.
+- [Routing Quality and Safety Guide](references/routing-quality-and-safety.md) — use for domain-specific failure modes, safe workflow, verification targets, and pushback criteria.

package/skills/aws/aws-maestro/metadata.json

@@ -14,15 +14,14 @@
   "summary": "Route AWS tasks to the narrowest specialist or team of specialists from the 42-agent catalog. Classifies by domain, dispatches single or parallel (max 4), and enforces live-guard gate for production-change agents.",
   "source_type": "adapted",
   "official_docs": [
-    "https://docs.aws.amazon.com/",
-    "https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html",
-    "https://docs.aws.amazon.com/bedrock/latest/userguide/agents.html",
-    "https://docs.aws.amazon.com/bedrock/latest/userguide/agentcore.html",
-    "https://docs.aws.amazon.com/bedrock/latest/userguide/what-is-bedrock.html"
+    "https://docs.aws.amazon.com/wellarchitected/latest/operational-excellence-pillar/welcome.html",
+    "https://docs.aws.amazon.com/wellarchitected/latest/framework/ops_model_ops_model.html",
+    "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html",
+    "https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor.html"
   ],
   "security_notes": "Live-guard gate is non-negotiable: never auto-dispatch aws-live-deployment-guarded-operator-agent, aws-live-ecs-rollout-guard-agent, aws-live-iac-change-guard-agent, aws-live-pipeline-approval-operator-agent, or aws-live-serverless-release-guard-agent without explicit human confirmation, blast-radius assessment, and rollback path. Do not ask for secrets, account IDs, or environment-specific values.",
-  "last_verified": "2026-04-30",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-maestro",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.4"
 }