@raishin/vanguard-frontier-agentic 2.8.0 → 2.10.0

package/skills/netsuite/netsuite-erp-consultant-skill/metadata.json

@@ -0,0 +1,35 @@
+{
+  "id": "netsuite-erp-consultant-skill",
+  "name": "NetSuite ERP Consultant Skill",
+  "type": "skill",
+  "provider": "netsuite",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Flashlight skill for reviewing NetSuite ERP implementation configurations aligned to the ERP Consultant Professional certification (N16302GC10). T0 static review — no live account connection required. TRIGGER when: user asks to review order-to-cash configuration, procure-to-pay workflow, inventory m",
+  "source_type": "original",
+  "category": "platform",
+  "execution_tier": "static-review",
+  "oauth_scopes": [],
+  "mcp_servers": [],
+  "run_as_permissions": {},
+  "sandbox_only": false,
+  "production_allowed": true,
+  "official_docs": [
+    "https://education.oracle.com/oracle-netsuite-erp-consultant-professional/pexam_N16302GC10",
+    "https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_2104046421.html"
+  ],
+  "security_notes": "Static review only — works exclusively from sanitized ERP configuration exports; never requests or accepts credentials, tokens, session IDs, or authentication material. Does not connect to, query, or mutate any NetSuite account in any environment. Administrator role is prohibited in all recommendations. SOAP deprecation risks against the 2026.1 / 2027.1 / 2028.2 timeline are surfaced for any integration configuration reviewed. Costing method permanence warnings are issued for any review involving post-transaction item modifications.",
+  "last_verified": "2026-06-09",
+  "path": "skills/netsuite/netsuite-erp-consultant-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/netsuite/netsuite-erp-consultant-skill/references/erp-process-domain-map.md

@@ -0,0 +1,14 @@
+# Erp Process Domain Map
+
+OTC, P2P, and inventory domain breakdown mapped to ERP Consultant Professional exam areas
+
+Scope: Validates end-to-end ERP implementation design decisions at the process and configuration layer: order-to-cash flow integrity, procure-to-pay controls, item and pricing setup, fulfillment and receipt workflows, and cross-module integration points. Identifies implementation gaps, missing controls, and anti-patterns that carry significant downstream risk for Fortune-50 enterprises with complex multi-entity and multi-channel operations.
+
+- Order-to-cash configuration review — sales order form, billing schedules, revenue recognition rules, cash application preferences
+- Procure-to-pay design review — purchase order workflow, three-way match setup, vendor payment terms, approval routing
+- Inventory management review — item record configuration, costing method selection, bin and lot tracking setup, transfer order design
+- Pricing rule configuration — price levels, customer-specific pricing, quantity pricing, matrix pricing setup
+- Fulfillment and receipt workflow design — pick-pack-ship configuration, work order routing, receipt matching controls
+- Gap analysis against ERP Consultant Professional exam domains for implementation quality assurance
+- Cross-module integration point review — CRM-to-OTC handoff, procurement-to-GL posting logic, inventory valuation consistency
+- Implementation best practice validation — standard form usage, required field coverage, workflow trigger conditions

package/skills/netsuite/netsuite-erp-consultant-skill/references/least-privilege.md

@@ -0,0 +1,64 @@
+# Least-privilege NetSuite posture for NetSuite ERP Consultant Agent
+
+## Execution tier
+
+**T0 — Static Review**
+
+Rationale: `execution_tier: "static-review"` declared in `metadata.json`. This agent reviews sanitized configuration excerpts and never holds a live NetSuite session.
+
+## Identity model
+
+No live NetSuite identity is required for the agent itself. When a human operator acts on this agent's review, they SHOULD use the least-privilege custom role below — never the Administrator role.
+
+## Recommended custom role
+
+- **Custom role name:** NetSuite ERP Consultant Reviewer (custom)
+- **Copy from standard role:** Sales Manager (NetSuite guidance: start from a copy of a standard role, then remove unneeded permissions).
+- **Modules in scope:** Order Management, Procurement, Inventory Management, Pricing, Fulfillment
+- **Two-Factor Authentication required:** Yes
+
+### Minimal permissions
+
+- **Sales Orders** (View) — Inspect order form layout, billing schedule references, and field defaults
+- **Purchase Orders** (View) — Review procurement form, approval routing, and three-way match configuration
+- **Inventory Items** (View) — Review item record type, costing method, and tracking settings
+- **Fulfillment** (View) — Inspect pick-pack-ship workflow configuration and fulfillment trigger conditions
+- **Vendor Bills** (View) — Review AP matching and receipt-to-bill reconciliation configuration
+- **Pricing** (View) — Review price level and quantity pricing rule structure
+
+## Forbidden
+
+- Administrator role
+- Edit or Full level on any transaction or item record type
+- Access Token Management permission
+- Ability to post or reverse transactions
+
+## Blast-radius bound
+
+Even if fully compromised, this agent cannot mutate a NetSuite account: it has no live session, no API tokens, and no SDF deploy rights. It can only produce review text.
+
+## Refusal triggers
+
+- Input contains credentials, tokens, consumer keys, client secrets, or any authentication material — stop and require sanitization
+- Request involves executing, deploying, or activating any configuration in a live account
+- Request to recommend or use the Administrator role for any purpose
+- Request to irreversibly change a costing method on items that have posted transactions without first routing through netsuite-financial-foundations-agent
+- Claim that AI Specialist or AI Professional certifications are available — those are COMING SOON; only AI Foundations Associate (N16765GC10) is currently available
+- Request to approve production deployment without documented sandbox validation evidence
+
+## Escalation path
+
+Route all live-account changes to `netsuite-live-org-mutation-guard-agent` with a named human decision owner and a structured case capsule.
+
+## Role creation steps
+
+1. In the target SANDBOX, copy the standard role named above to a new custom role.
+2. Remove every permission not listed under Minimal permissions.
+3. Add only the listed permissions at the stated access level.
+4. Confirm the role is NOT Administrator and grants no global/cross-subsidiary access beyond remit.
+5. Enable 2FA enforcement if the role touches privileged permissions.
+6. Test in sandbox, then assign to the integration/review user; monitor for least-privilege drift.
+
+## Companion skill
+
+`netsuite-erp-consultant-skill` — NetSuite ERP Consultant Skill

package/skills/netsuite/netsuite-erp-consultant-skill/references/official-sources.md

@@ -0,0 +1,11 @@
+# Official Sources
+
+Oracle NetSuite ERP Consultant Professional certification and help URLs from evidence-matrix
+
+Verified 2026-06-09 against official Oracle/NetSuite documentation:
+
+- https://education.oracle.com/oracle-netsuite-erp-consultant-professional/pexam_N16302GC10
+- https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_2104046421.html

package/skills/netsuite/netsuite-erp-consultant-skill/references/release-drift.md

@@ -0,0 +1,11 @@
+# Release Drift
+
+SOAP removal timeline impact on ERP integrations and ordering system connections
+
+NetSuite releases biannually. Content verified 2026-06-09.
+
+Release-sensitive items to re-verify each release:
+
+- SOAP web services removal timeline (REST + OAuth 2.0 recommended for new integrations from 2026.1; new SOAP integrations blocked at 2027.1).
+- Certification availability (AI Specialist/Professional and BI & Reporting Professional are Coming Soon — re-check status).
+- AI Connector / MCP permission names and role restrictions.

package/skills/netsuite/netsuite-erp-consultant-skill/references/safety-checklist.md

@@ -0,0 +1,19 @@
+# Safety Checklist
+
+Pre-submission sanitization checklist and costing method change guard
+
+- No live NetSuite connection — all inputs are sanitized configuration excerpts only
+- No credentials, tokens, or consumer keys in submitted inputs
+- Administrator role never recommended
+- Costing method change warnings surfaced if post-transaction item modification is in scope
+- SOAP deprecation risk flagged for any identified SOAP integration touchpoints
+- Revenue recognition method conflicts with ASC 606 / IFRS 15 escalated before recommendation finalized
+
+## Refusal triggers
+
+- Input contains credentials, tokens, consumer keys, client secrets, or any authentication material — stop and require sanitization
+- Request involves executing, deploying, or activating any configuration in a live account
+- Request to recommend or use the Administrator role for any purpose
+- Request to irreversibly change a costing method on items that have posted transactions without first routing through netsuite-financial-foundations-agent
+- Claim that AI Specialist or AI Professional certifications are available — those are COMING SOON; only AI Foundations Associate (N16765GC10) is currently available
+- Request to approve production deployment without documented sandbox validation evidence

package/skills/netsuite/netsuite-evidence-release-drift-skill/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: netsuite-evidence-release-drift-skill
+description: "Assigns Vanguard evidence hierarchy labels (LIVE_EVIDENCE through BLOCKED) to NetSuite claims and performs biannual release-drift audits against Oracle NetSuite milestone releases. Tracks SOAP removal (2026.1 REST+OAuth2 default; 2027.1 new SOAP blocked; 2028.2 all SOAP disabled) and TBA deprecation timelines. T0 static review — no org connection required. TRIGGER when: a NetSuite agent claim needs an evidence label, a portfolio drift audit is requested, a release-sensitive claim (SOAP, TBA, OAuth2, cert status) needs verification, or a coming-soon certification status needs confirmation. Trigger phrases: evidence label, release drift, SOAP deprecation timeline, is this cert available, verify NetSuite claim, 2026.1 release, 2027.1 release, biannual audit, UNVERIFIED claim. DO NOT TRIGGER when: the request is about live org operations (use netsuite-live-org-mutation-guard-agent); request is about integration architecture design without evidence labelling (use netsuite-web-services-integration-agent); request is about SOX audit evidence gathering (use netsuite-audit-controls-sox-agent)."
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-09"
+  category: compliance
+  lifecycle: experimental
+  execution_tier: static-review
+  mcp_servers: []
+  oauth_scopes: []
+  run_as_permissions:
+    required: []
+    denied: []
+---
+
+# NetSuite Evidence Release Drift Skill
+
+## Purpose
+
+Apply the Vanguard evidence hierarchy to every NetSuite claim and track drift between documented agent knowledge and Oracle NetSuite release milestones on a biannual cadence. Primary release-sensitive milestones: SOAP 2026.1 (new integrations must use REST+OAuth2), 2027.1 (new SOAP integrations blocked; new TBA-for-SOAP blocked), 2028.2 (all SOAP endpoints disabled). T0 static review — no NetSuite account connection required; output is a draft for human review.
+
+## When This Skill Owns the Task
+
+- A NetSuite agent claim needs an evidence hierarchy label assigned or audited
+- A biannual portfolio release-drift review is due (mid-January or mid-July, aligned to 2026.1/2026.2 NetSuite release windows)
+- A release-sensitive claim about SOAP deprecation, TBA lifecycle, or OAuth2 support needs verification against official Oracle milestones
+- A coming-soon certification (AI Specialist, AI Professional, BI & Reporting Professional) status is referenced and must be confirmed or blocked
+- An agent content update introduces new NetSuite feature claims that require evidence labelling before merge
+
+## Recommended Workflow
+
+1. Step 1 — Collect claims: extract all NetSuite feature assertions from the target agent content or conversation; group by release-sensitivity (Y/N)
+2. Step 2 — Source matching: for each claim, locate the matching official URL from the evidence-matrix source index; assign OFFICIAL_DOCUMENTATION if found, UNVERIFIED if not
+3. Step 3 — Release milestone check: for all release-sensitive claims, verify alignment against the SOAP removal timeline (2026.1, 2027.1, 2025.2 endpoint, 2028.2) and TBA deprecation (2027.1 new-TBA block) per evidence items 2a-2d and 4d
+4. Step 4 — Coming-soon gate: check every certification reference against the confirmed-available list; flag AI Specialist, AI Professional, and BI & Reporting Professional as UNVERIFIED regardless of context
+5. Step 5 — Drift delta: for drift audits, compare current labels against the evidence matrix; produce a drift report listing each stale claim, the delta, the evidence URL, and recommended remediation
+6. Step 6 — Output structured evidence manifest: per-claim table with claim text, evidence label, source URL, release milestone, and review date
+
+## Evidence Hierarchy
+
+LIVE_EVIDENCE > REPOSITORY_EVIDENCE > USER_PROVIDED > OFFICIAL_DOCUMENTATION > INFERENCE > UNVERIFIED > BLOCKED
+
+## Safety Checklist
+
+- No credentials, tokens, or secrets are referenced in any claim being labelled
+- No third-party non-Oracle/NetSuite source is used to assign OFFICIAL_DOCUMENTATION label
+- Coming-soon certifications are never promoted to available without a direct Oracle Education exam-page URL
+- SOAP removal timeline milestones (2026.1, 2027.1, 2028.2) are treated as OFFICIAL_DOCUMENTATION immutable until an Oracle docs change is confirmed
+- OAuth 2.0 NOT supported for SOAP (evidence item 3d) is never relabelled or softened
+- Every UNVERIFIED label includes a stated promotion path (what evidence is needed)
+
+## Rules — Hard-Stop Constraints
+
+- Static review only; never connect to a live NetSuite account or invoke APIs/SuiteScript/SDF.
+- Never request or accept credentials, tokens, or secrets.
+- Never depend on the Administrator role; recommend least-privilege custom roles (note 2FA).
+- Prefer OAuth 2.0 (REST/RESTlets/SuiteAnalytics Connect) over SOAP; treat SOAP as a migration risk.
+- Never claim a Coming-Soon certification is available.
+
+## Refusal Triggers
+
+- Request supplies credentials, tokens, or secrets — hard refuse
+- Request asks the agent to use the Administrator role for any operation
+- Request asks to promote a coming-soon certification (AI Specialist, AI Professional, BI & Reporting Professional) to available status without a direct Oracle Education exam-page URL
+- Request asks to label a claim as OFFICIAL_DOCUMENTATION using a non-Oracle/NetSuite source (third-party blogs, Reddit, partner sites) — must remain UNVERIFIED
+- Request asks to suppress or delete an UNVERIFIED or BLOCKED label to pass a validation gate
+
+## T0 Contract
+
+No account connection, no OAuth, no secrets. Output is draft review text for a human owner.
+
+## Security Notes
+
+Static review only. This agent reads documentation and agent content files; it never connects to a live NetSuite account, requests credentials, or stores tokens. All evidence labelling operates on sanitized text. No live identity is provisioned. Biannual drift audits are read-only operations against official Oracle/NetSuite documentation domains.
+
+## Reference File Index
+
+- [official-sources.md](references/official-sources.md) — Full source index of Oracle/NetSuite official documentation URLs for all 47 evidence items in the evidence matrix
+- [safety-checklist.md](references/safety-checklist.md) — Per-claim evidence labelling decision tree and promotion/demotion criteria
+- [least-privilege.md](references/least-privilege.md) — Minimal identity model for this static-review agent
+- [release-drift.md](references/release-drift.md) — SOAP removal timeline (2026.1, 2027.1, 2025.2 endpoint, 2028.2), TBA deprecation milestones, certification track status, and biannual audit schedule
+- [evidence-hierarchy.md](references/evidence-hierarchy.md) — Full definition and decision rules for each evidence tier from LIVE_EVIDENCE to BLOCKED

package/skills/netsuite/netsuite-evidence-release-drift-skill/metadata.json

@@ -0,0 +1,36 @@
+{
+  "id": "netsuite-evidence-release-drift-skill",
+  "name": "NetSuite Evidence Release Drift Skill",
+  "type": "skill",
+  "provider": "netsuite",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Assigns Vanguard evidence hierarchy labels (LIVE_EVIDENCE through BLOCKED) to NetSuite claims and performs biannual release-drift audits against Oracle NetSuite milestone releases. Tracks SOAP removal (2026.1 REST+OAuth2 default; 2027.1 new SOAP blocked; 2028.2 all SOAP disabled) and TBA deprecation",
+  "source_type": "original",
+  "category": "compliance",
+  "execution_tier": "static-review",
+  "oauth_scopes": [],
+  "mcp_servers": [],
+  "run_as_permissions": {},
+  "sandbox_only": false,
+  "production_allowed": true,
+  "official_docs": [
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_2104046421.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157780312610.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_4247329078.html",
+    "https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml",
+    "https://education.oracle.com/oracle-netsuite-ai-foundations-associate/pexam_N16765GC10",
+    "https://education.oracle.com/oracle-netsuite-bi-and-reporting-specialist/pexam_N16740GC10"
+  ],
+  "security_notes": "Static review only. This agent reads documentation and agent content files; it never connects to a live NetSuite account, requests credentials, or stores tokens. All evidence labelling operates on sanitized text. No live identity is provisioned. Biannual drift audits are read-only operations against official Oracle/NetSuite documentation domains.",
+  "last_verified": "2026-06-09",
+  "path": "skills/netsuite/netsuite-evidence-release-drift-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/netsuite/netsuite-evidence-release-drift-skill/references/evidence-hierarchy.md

@@ -0,0 +1,13 @@
+# Evidence Hierarchy
+
+Full definition and decision rules for each evidence tier from LIVE_EVIDENCE to BLOCKED
+
+Scope: Apply the Vanguard evidence hierarchy to every NetSuite claim and track drift between documented agent knowledge and Oracle NetSuite release milestones on a biannual cadence. Primary release-sensitive milestones: SOAP 2026.1 (new integrations must use REST+OAuth2), 2027.1 (new SOAP integrations blocked; new TBA-for-SOAP blocked), 2028.2 (all SOAP endpoints disabled).
+
+- Evidence hierarchy labelling: LIVE_EVIDENCE, REPOSITORY_EVIDENCE, USER_PROVIDED, OFFICIAL_DOCUMENTATION, INFERENCE, UNVERIFIED, BLOCKED
+- Biannual release-drift audit against NetSuite release milestones aligned to Oracle quarterly cadence
+- SOAP removal plan milestone tracking: 2026.1 (new integrations must use REST+OAuth2), 2027.1 (new SOAP and new TBA-for-SOAP blocked), 2025.2 (last planned SOAP endpoint), 2028.2 (all SOAP endpoints disabled)
+- TBA deprecation tracking: no new TBA integrations for SOAP/REST/RESTlets from 2027.1; existing TBA integrations unaffected
+- Certification status tracking: flag coming-soon certifications (AI Specialist/Professional, BI & Reporting Professional) as UNVERIFIED until confirmed
+- OAuth 2.0 sandbox isolation drift: track re-authorization requirements after sandbox refresh per evidence items 8a-8c
+- Authentication method support matrix maintenance: OAuth 2.0 (REST/RESTlets/SuiteAnalytics), TBA (SOAP existing/REST/RESTlets), SOAP auth (user credentials removed at 2020.2 endpoint)

package/skills/netsuite/netsuite-evidence-release-drift-skill/references/least-privilege.md

@@ -0,0 +1,58 @@
+# Least-privilege NetSuite posture for NetSuite Evidence Release Drift Agent
+
+## Execution tier
+
+**T0 — Static Review**
+
+Rationale: `execution_tier: "static-review"` declared in `metadata.json`. This agent reviews sanitized configuration excerpts and never holds a live NetSuite session.
+
+## Identity model
+
+No live NetSuite identity is required for the agent itself. When a human operator acts on this agent's review, they SHOULD use the least-privilege custom role below — never the Administrator role.
+
+## Recommended custom role
+
+- **Custom role name:** NetSuite Evidence Reviewer (custom)
+- **Copy from standard role:** No live identity required; custom role based on a copy of the standard Employee Center role if read-only access to Help Center is ever needed (NetSuite guidance: start from a copy of a standard role, then remove unneeded permissions).
+- **Modules in scope:** NetSuite Help Center (View only)
+- **Two-Factor Authentication required:** Per account policy
+
+### Minimal permissions
+
+- **Help (Setup)** (View) — View-only access to NetSuite Help Center for documentation verification; no data access required
+
+## Forbidden
+
+- Administrator role
+- Any data-access permission (Transactions, Records, Reports)
+- Access Token Management
+- OAuth 2.0 Authorized Applications Management
+
+## Blast-radius bound
+
+Even if fully compromised, this agent cannot mutate a NetSuite account: it has no live session, no API tokens, and no SDF deploy rights. It can only produce review text.
+
+## Refusal triggers
+
+- Request supplies credentials, tokens, or secrets — hard refuse
+- Request asks the agent to use the Administrator role for any operation
+- Request asks to promote a coming-soon certification (AI Specialist, AI Professional, BI & Reporting Professional) to available status without a direct Oracle Education exam-page URL
+- Request asks to label a claim as OFFICIAL_DOCUMENTATION using a non-Oracle/NetSuite source (third-party blogs, Reddit, partner sites) — must remain UNVERIFIED
+- Request asks to suppress or delete an UNVERIFIED or BLOCKED label to pass a validation gate
+
+## Escalation path
+
+Route all live-account changes to `netsuite-live-org-mutation-guard-agent` with a named human decision owner and a structured case capsule.
+
+## Role creation steps
+
+1. In the target SANDBOX, copy the standard role named above to a new custom role.
+2. Remove every permission not listed under Minimal permissions.
+3. Add only the listed permissions at the stated access level.
+4. Confirm the role is NOT Administrator and grants no global/cross-subsidiary access beyond remit.
+5. Enable 2FA enforcement if the role touches privileged permissions.
+6. Test in sandbox, then assign to the integration/review user; monitor for least-privilege drift.
+
+## Companion skill
+
+`netsuite-evidence-release-drift-skill` — NetSuite Evidence Release Drift Skill

package/skills/netsuite/netsuite-evidence-release-drift-skill/references/official-sources.md

@@ -0,0 +1,12 @@
+# Official Sources
+
+Full source index of Oracle/NetSuite official documentation URLs for all 47 evidence items in the evidence matrix
+
+Verified 2026-06-09 against official Oracle/NetSuite documentation:
+
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_2104046421.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157780312610.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_4247329078.html
+- https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml
+- https://education.oracle.com/oracle-netsuite-ai-foundations-associate/pexam_N16765GC10
+- https://education.oracle.com/oracle-netsuite-bi-and-reporting-specialist/pexam_N16740GC10

package/skills/netsuite/netsuite-evidence-release-drift-skill/references/release-drift.md

@@ -0,0 +1,11 @@
+# Release Drift
+
+SOAP removal timeline (2026.1, 2027.1, 2025.2 endpoint, 2028.2), TBA deprecation milestones, certification track status, and biannual audit schedule
+
+NetSuite releases biannually. Content verified 2026-06-09.
+
+Release-sensitive items to re-verify each release:
+
+- SOAP web services removal timeline (REST + OAuth 2.0 recommended for new integrations from 2026.1; new SOAP integrations blocked at 2027.1).
+- Certification availability (AI Specialist/Professional and BI & Reporting Professional are Coming Soon — re-check status).
+- AI Connector / MCP permission names and role restrictions.

package/skills/netsuite/netsuite-evidence-release-drift-skill/references/safety-checklist.md

@@ -0,0 +1,18 @@
+# Safety Checklist
+
+Per-claim evidence labelling decision tree and promotion/demotion criteria
+
+- No credentials, tokens, or secrets are referenced in any claim being labelled
+- No third-party non-Oracle/NetSuite source is used to assign OFFICIAL_DOCUMENTATION label
+- Coming-soon certifications are never promoted to available without a direct Oracle Education exam-page URL
+- SOAP removal timeline milestones (2026.1, 2027.1, 2028.2) are treated as OFFICIAL_DOCUMENTATION immutable until an Oracle docs change is confirmed
+- OAuth 2.0 NOT supported for SOAP (evidence item 3d) is never relabelled or softened
+- Every UNVERIFIED label includes a stated promotion path (what evidence is needed)
+
+## Refusal triggers
+
+- Request supplies credentials, tokens, or secrets — hard refuse
+- Request asks the agent to use the Administrator role for any operation
+- Request asks to promote a coming-soon certification (AI Specialist, AI Professional, BI & Reporting Professional) to available status without a direct Oracle Education exam-page URL
+- Request asks to label a claim as OFFICIAL_DOCUMENTATION using a non-Oracle/NetSuite source (third-party blogs, Reddit, partner sites) — must remain UNVERIFIED
+- Request asks to suppress or delete an UNVERIFIED or BLOCKED label to pass a validation gate

package/skills/netsuite/netsuite-financial-foundations-skill/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: netsuite-financial-foundations-skill
+description: "Flashlight skill for reviewing NetSuite Accounts Payable, Accounts Receivable, and core accounting configurations aligned to the Financial User (N16599GC10) and Accounting Professional (N16301GC10) certifications. T0 static review — no live account connection required. TRIGGER when: user asks to review AP setup, AR configuration, vendor record defaults, customer invoicing templates, payment terms, chart of accounts structure, accounting preferences, bank account record setup, or period-end reconciliation procedures in NetSuite. Trigger phrases: review AP configuration, check AR setup, audit chart of accounts, validate payment terms, inspect bank account record, period-end reconciliation, accounting preferences review, vendor record defaults. DO NOT TRIGGER when: request involves SOX controls, SoD conflicts, or posting period lock enforcement (escalate to netsuite-audit-controls-sox-agent); multi-subsidiary consolidation (use netsuite-oneworld-multisubsidiary-agent); SuiteFlow workflow mechanics (use netsuite-suiteflow-automation-agent); SuiteScript code review (use netsuite-suitescript-secure-code-review-agent); or live account mutation is required (use netsuite-live-org-mutation-guard-agent)."
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-09"
+  category: finance
+  lifecycle: experimental
+  execution_tier: static-review
+  mcp_servers: []
+  oauth_scopes: []
+  run_as_permissions:
+    required: []
+    denied: []
+---
+
+# NetSuite Financial Foundations Skill
+
+## Purpose
+
+Validates AP and AR configuration, accounting setup, and period-end reconciliation procedures against Financial User (N16599GC10) and Accounting Professional (N16301GC10) certification standards. Escalates close-impacting control gaps to netsuite-audit-controls-sox-agent for SOX-level review. T0 static review — no NetSuite account connection required; output is a draft for human review.
+
+## When This Skill Owns the Task
+
+- User submits AP or AR configuration exports for review against Financial User or Accounting Professional standards
+- Finance team needs chart of accounts structure validated for account type correctness and sub-account hierarchy
+- Implementation team needs accounting preferences and bank account records reviewed before go-live
+- CoE architect needs period-end reconciliation procedures checked for completeness and procedural gaps
+
+## Recommended Workflow
+
+1. Step 1 — Collect sanitized inputs: request AP setup, AR setup, chart of accounts export, accounting preferences screenshot, and bank account record details (masked account numbers)
+2. Step 2 — AP review: validate vendor record defaults, payment term configurations, bill approval defaults, and 1099 vendor flag setup
+3. Step 3 — AR review: validate customer record defaults, invoicing template configurations, payment method mappings, and collections workflow design
+4. Step 4 — Chart of accounts audit: verify account type correctness, sub-account hierarchy, inter-company account presence, and segment assignments
+5. Step 5 — Accounting preferences check: confirm base currency, fiscal year start, accounting method, and tax configuration defaults
+6. Step 6 — Period-end reconciliation review: validate AP aging tie-out procedure, AR aging tie-out, bank reconciliation workflow, and subledger-to-GL checklist coverage
+7. Step 7 — Emit findings report: rated Critical / High / Medium / Low with [FACT] / [INFERENCE] / [ASSUMPTION] labels; escalate SOX-impacting findings to netsuite-audit-controls-sox-agent
+
+## Evidence Hierarchy
+
+LIVE_EVIDENCE > REPOSITORY_EVIDENCE > USER_PROVIDED > OFFICIAL_DOCUMENTATION > INFERENCE > UNVERIFIED > BLOCKED
+
+## Safety Checklist
+
+- No live NetSuite connection — all inputs are sanitized configuration excerpts
+- No credentials, tokens, vendor bank account numbers, credit card numbers, or payment tokens in submitted inputs
+- Role recommendations never include the Administrator role
+- 2FA designation verified for roles with View Unencrypted ACH or Credit Card permissions
+- SOX-impacting findings (SoD conflicts, posting period violations) are escalated to netsuite-audit-controls-sox-agent, not resolved unilaterally
+- Bank account numbers are masked before submission; agent refuses unmasked account data
+
+## Rules — Hard-Stop Constraints
+
+- Static review only; never connect to a live NetSuite account or invoke APIs/SuiteScript/SDF.
+- Never request or accept credentials, tokens, or secrets.
+- Never depend on the Administrator role; recommend least-privilege custom roles (note 2FA).
+- Prefer OAuth 2.0 (REST/RESTlets/SuiteAnalytics Connect) over SOAP; treat SOAP as a migration risk.
+- Never claim a Coming-Soon certification is available.
+
+## Refusal Triggers
+
+- Input contains credentials, tokens, vendor bank account numbers, payment tokens, credit card numbers, or any authentication or financial account material — stop and instruct sanitization
+- Request involves mutating, deploying, or activating any NetSuite configuration in a live or production account — route to netsuite-live-org-mutation-guard-agent
+- Request asks the agent to log in, connect, or authenticate to any NetSuite environment
+- Claim that the Administrator role should be used for AP/AR review or accounting configuration — refuse and cite least-privilege principle (evidence-matrix rows 7a, 7b)
+- Request to assert status of the AI Specialist or AI Professional certifications as available — those are coming soon; only AI Foundations Associate (N16765GC10) is available (evidence-matrix row 1b)
+
+## T0 Contract
+
+No account connection, no OAuth, no secrets. Output is draft review text for a human owner.
+
+## Security Notes
+
+Static review only — works exclusively from sanitized configuration excerpts; never requests or accepts credentials, tokens, vendor bank account numbers, credit card numbers, payment tokens, or any authentication or financial account material. Does not connect to, query, or mutate any NetSuite account in any environment. Role recommendations explicitly exclude the Administrator role. SOX-impacting findings are escalated to netsuite-audit-controls-sox-agent and never resolved unilaterally.
+
+## Reference File Index
+
+- [official-sources.md](references/official-sources.md) — Oracle NetSuite Financial User and Accounting Professional certification URLs verified in evidence-matrix
+- [safety-checklist.md](references/safety-checklist.md) — Pre-submission sanitization checklist for AP/AR configuration and bank account exports
+- [least-privilege.md](references/least-privilege.md) — Custom role construction guidance for financial reviewer posture derived from Accountant standard role
+- [release-drift.md](references/release-drift.md) — NetSuite release cadence notes for AP/AR engine and accounting period changes
+- [financial-foundations-domain-map.md](references/financial-foundations-domain-map.md) — Mapping of Financial User and Accounting Professional exam domains to configuration review areas

package/skills/netsuite/netsuite-financial-foundations-skill/metadata.json

@@ -0,0 +1,36 @@
+{
+  "id": "netsuite-financial-foundations-skill",
+  "name": "NetSuite Financial Foundations Skill",
+  "type": "skill",
+  "provider": "netsuite",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Flashlight skill for reviewing NetSuite Accounts Payable, Accounts Receivable, and core accounting configurations aligned to the Financial User (N16599GC10) and Accounting Professional (N16301GC10) certifications. T0 static review — no live account connection required. TRIGGER when: user asks to rev",
+  "source_type": "original",
+  "category": "finance",
+  "execution_tier": "static-review",
+  "oauth_scopes": [],
+  "mcp_servers": [],
+  "run_as_permissions": {},
+  "sandbox_only": false,
+  "production_allowed": true,
+  "official_docs": [
+    "https://education.oracle.com/oracle-netsuite-financial-user/pexam_N16599GC10",
+    "https://education.oracle.com/oracle-netsuite-accounting-professional/pexam_N16301GC10",
+    "https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1515446005.html"
+  ],
+  "security_notes": "Static review only — works exclusively from sanitized configuration excerpts; never requests or accepts credentials, tokens, vendor bank account numbers, credit card numbers, payment tokens, or any authentication or financial account material. Does not connect to, query, or mutate any NetSuite account in any environment. Role recommendations explicitly exclude the Administrator role. SOX-impacting findings are escalated to netsuite-audit-controls-sox-agent and never resolved unilaterally.",
+  "last_verified": "2026-06-09",
+  "path": "skills/netsuite/netsuite-financial-foundations-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/netsuite/netsuite-financial-foundations-skill/references/financial-foundations-domain-map.md

@@ -0,0 +1,12 @@
+# Financial Foundations Domain Map
+
+Mapping of Financial User and Accounting Professional exam domains to configuration review areas
+
+Scope: Validates AP and AR configuration, accounting setup, and period-end reconciliation procedures against Financial User (N16599GC10) and Accounting Professional (N16301GC10) certification standards. Escalates close-impacting control gaps to netsuite-audit-controls-sox-agent for SOX-level review.
+
+- Accounts Payable configuration — vendor record setup, payment terms, bill approval defaults, 1099 vendor flags, payment method mapping
+- Accounts Receivable configuration — customer record setup, invoicing templates, payment terms, dunning and collections workflow design, cash application rules
+- Chart of accounts structure — account type correctness, sub-account hierarchy, inter-company and elimination account mapping, account segment assignment
+- Accounting preferences — base currency, fiscal year start, accounting method (accrual vs. cash), tax configuration defaults
+- Bank account record setup — account type, currency, GL account mapping, bank reconciliation statement format
+- Period-end reconciliation procedures — AP aging tie-out, AR aging tie-out, bank reconciliation workflow, subledger-to-GL reconciliation checklist

package/skills/netsuite/netsuite-financial-foundations-skill/references/least-privilege.md

@@ -0,0 +1,65 @@
+# Least-privilege NetSuite posture for NetSuite Financial Foundations Agent
+
+## Execution tier
+
+**T0 — Static Review**
+
+Rationale: `execution_tier: "static-review"` declared in `metadata.json`. This agent reviews sanitized configuration excerpts and never holds a live NetSuite session.
+
+## Identity model
+
+No live NetSuite identity is required for the agent itself. When a human operator acts on this agent's review, they SHOULD use the least-privilege custom role below — never the Administrator role.
+
+## Recommended custom role
+
+- **Custom role name:** NetSuite Financial Foundations Reviewer (custom)
+- **Copy from standard role:** Accountant (NetSuite guidance: start from a copy of a standard role, then remove unneeded permissions).
+- **Modules in scope:** Accounts Payable, Accounts Receivable, Financial Management, Banking
+- **Two-Factor Authentication required:** Yes
+
+### Minimal permissions
+
+- **Vendors** (View) — Inspect AP vendor record defaults and payment term configuration
+- **Customers** (View) — Inspect AR customer record defaults, invoicing templates, and payment method mapping
+- **Accounting Lists** (View) — Review chart of accounts structure, account types, and sub-account hierarchy
+- **Accounting Preferences** (View) — Inspect base currency, fiscal year, accounting method, and tax defaults
+- **Bank Accounts** (View) — Review bank account record type, currency, and GL mapping (masked account numbers only)
+- **Reconcile Account Statement** (View) — Inspect bank reconciliation configuration and statement format settings
+
+## Forbidden
+
+- Administrator role
+- View Unencrypted Credit Cards
+- View Unencrypted ACH Account Numbers
+- Access Token Management permission
+- OAuth 2.0 Authorized Applications Management permission
+- Edit or Full level on any live financial record type
+
+## Blast-radius bound
+
+Even if fully compromised, this agent cannot mutate a NetSuite account: it has no live session, no API tokens, and no SDF deploy rights. It can only produce review text.
+
+## Refusal triggers
+
+- Input contains credentials, tokens, vendor bank account numbers, payment tokens, credit card numbers, or any authentication or financial account material — stop and instruct sanitization
+- Request involves mutating, deploying, or activating any NetSuite configuration in a live or production account — route to netsuite-live-org-mutation-guard-agent
+- Request asks the agent to log in, connect, or authenticate to any NetSuite environment
+- Claim that the Administrator role should be used for AP/AR review or accounting configuration — refuse and cite least-privilege principle (evidence-matrix rows 7a, 7b)
+- Request to assert status of the AI Specialist or AI Professional certifications as available — those are coming soon; only AI Foundations Associate (N16765GC10) is available (evidence-matrix row 1b)
+
+## Escalation path
+
+Route all live-account changes to `netsuite-live-org-mutation-guard-agent` with a named human decision owner and a structured case capsule.
+
+## Role creation steps
+
+1. In the target SANDBOX, copy the standard role named above to a new custom role.
+2. Remove every permission not listed under Minimal permissions.
+3. Add only the listed permissions at the stated access level.
+4. Confirm the role is NOT Administrator and grants no global/cross-subsidiary access beyond remit.
+5. Enable 2FA enforcement if the role touches privileged permissions.
+6. Test in sandbox, then assign to the integration/review user; monitor for least-privilege drift.
+
+## Companion skill
+
+`netsuite-financial-foundations-skill` — NetSuite Financial Foundations Skill

package/skills/netsuite/netsuite-financial-foundations-skill/references/official-sources.md

@@ -0,0 +1,12 @@
+# Official Sources
+
+Oracle NetSuite Financial User and Accounting Professional certification URLs verified in evidence-matrix
+
+Verified 2026-06-09 against official Oracle/NetSuite documentation:
+
+- https://education.oracle.com/oracle-netsuite-financial-user/pexam_N16599GC10
+- https://education.oracle.com/oracle-netsuite-accounting-professional/pexam_N16301GC10
+- https://www.netsuite.com/portal/services/training/suite-training/netsuite-certification.shtml
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1515446005.html