@raishin/vanguard-frontier-agentic 2.8.0 → 2.10.0

package/skills/netsuite/netsuite-live-operation-safety-skill/metadata.json

@@ -0,0 +1,38 @@
+{
+  "id": "netsuite-live-operation-safety-skill",
+  "name": "NetSuite Live Operation Safety Skill",
+  "type": "skill",
+  "provider": "netsuite",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Evaluates live NetSuite mutation requests against a structured authorization checklist covering blast-radius, rollback, human decision ownership, and integration posture. T0 static evaluation — no org connection required. TRIGGER when: a request involves activating a workflow, deploying an SDF proje",
+  "source_type": "original",
+  "category": "security",
+  "execution_tier": "static-review",
+  "oauth_scopes": [],
+  "mcp_servers": [],
+  "run_as_permissions": {},
+  "sandbox_only": false,
+  "production_allowed": true,
+  "official_docs": [
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_2104046421.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1532968056.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1515446005.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157771979135.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162686838198.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_4247329078.html"
+  ],
+  "security_notes": "Static review only. The live guard never executes mutations in NetSuite. It operates from sanitized text inputs and never requests, stores, echoes, or logs credentials, OAuth tokens, TBA token values, client secrets, or session cookies. Default posture is refusal absent a fully documented authorized live-op protocol. All clearances require a named human decision owner and a documented rollback path.",
+  "last_verified": "2026-06-09",
+  "path": "skills/netsuite/netsuite-live-operation-safety-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/netsuite/netsuite-live-operation-safety-skill/references/blast-radius-guide.md

@@ -0,0 +1,14 @@
+# Blast Radius Guide
+
+Blast-radius assessment framework for multi-subsidiary and multi-integration change scopes
+
+Scope: Act as the mandatory approval gate for all live-org mutation paths in the NetSuite domain. Evaluate the proposed change against the authorized live-op protocol, document the blast-radius, identify the named human decision owner, and either clear the change for execution by a qualified human or issue a structured refusal with remediation steps.
+
+- SuiteCloud Development Framework (SDF) project deploys to any NetSuite environment
+- SuiteFlow / workflow activation, deactivation, and state transitions in live accounts
+- Direct data mutations: record create/edit/delete via UI, SuiteScript, RESTlet, or REST web services
+- Saved-search and workbook publication that exposes data to additional roles or subsidiaries
+- Role, permission, and custom-role assignment changes in production or sandbox
+- OAuth 2.0 application authorization, client credentials setup, and certificate rotation
+- TBA token issuance and revocation for production integrations
+- Release-preview to production promotion decisions

package/skills/netsuite/netsuite-live-operation-safety-skill/references/least-privilege.md

@@ -0,0 +1,65 @@
+# Least-privilege NetSuite posture for NetSuite Live Org Mutation Guard Agent
+
+## Execution tier
+
+**T0 — Static Review**
+
+Rationale: `execution_tier: "static-review"` declared in `metadata.json`. This agent reviews sanitized configuration excerpts and never holds a live NetSuite session.
+
+## Identity model
+
+No live NetSuite identity is required for the agent itself. When a human operator acts on this agent's review, they SHOULD use the least-privilege custom role below — never the Administrator role.
+
+## Recommended custom role
+
+- **Custom role name:** NetSuite Live Guard Reviewer (custom)
+- **Copy from standard role:** No live identity required for guard evaluation; if future read-only audit logging access is provisioned, base on a custom copy of the standard Auditor role (NetSuite guidance: start from a copy of a standard role, then remove unneeded permissions).
+- **Modules in scope:** scoped to remit
+- **Two-Factor Authentication required:** Yes
+
+### Minimal permissions
+
+- **Log (Setup)** (View) — Required only if guard needs to inspect SuiteScript execution logs for change evidence; View only
+
+## Forbidden
+
+- Administrator role
+- Access Token Management
+- OAuth 2.0 Authorized Applications Management
+- Core Administration Permissions
+- View Unencrypted Credit Cards
+- View Unencrypted ACH Account Numbers
+- Any permission level of Full on any module
+
+## Blast-radius bound
+
+Even if fully compromised, this agent cannot mutate a NetSuite account: it has no live session, no API tokens, and no SDF deploy rights. It can only produce review text.
+
+## Refusal triggers
+
+- Request supplies credentials, tokens, OAuth client secrets, TBA token values, or session cookies — hard refuse, do not echo or log
+- Request asks for or implies use of the Administrator role for any automated or scripted operation
+- No authorized live-op protocol or change-management ticket reference is present
+- No named human decision owner is identified
+- No rollback plan is provided for production-bound changes
+- Request proposes building a new SOAP integration after the 2026.1 release (REST+OAuth2 is required for new builds per evidence item 2a)
+- Request proposes new TBA for SOAP, REST, or RESTlets after 2027.1 (hard block per evidence item 4d)
+- Proposed change would grant permissions that mandate 2FA (Access Token Management, OAuth 2.0 Authorized Applications Management, Core Administration Permissions, View Unencrypted Credit Cards, View Unencrypted ACH Account Numbers) without confirming 2FA enrollment
+- Coming-soon certifications (AI Specialist, AI Professional, BI & Reporting Professional) cited as available in the change justification
+
+## Escalation path
+
+Route all live-account changes to `netsuite-live-org-mutation-guard-agent` with a named human decision owner and a structured case capsule.
+
+## Role creation steps
+
+1. In the target SANDBOX, copy the standard role named above to a new custom role.
+2. Remove every permission not listed under Minimal permissions.
+3. Add only the listed permissions at the stated access level.
+4. Confirm the role is NOT Administrator and grants no global/cross-subsidiary access beyond remit.
+5. Enable 2FA enforcement if the role touches privileged permissions.
+6. Test in sandbox, then assign to the integration/review user; monitor for least-privilege drift.
+
+## Companion skill
+
+`netsuite-live-operation-safety-skill` — NetSuite Live Operation Safety Skill

package/skills/netsuite/netsuite-live-operation-safety-skill/references/official-sources.md

@@ -0,0 +1,14 @@
+# Official Sources
+
+Oracle/NetSuite official documentation URLs for authentication, role management, SOAP removal plans, and 2FA requirements
+
+Verified 2026-06-09 against official Oracle/NetSuite documentation:
+
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_2104046421.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1532968056.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1515446005.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157771979135.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162686838198.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_4247329078.html

package/skills/netsuite/netsuite-live-operation-safety-skill/references/release-drift.md

@@ -0,0 +1,11 @@
+# Release Drift
+
+SOAP removal timeline (2026.1, 2027.1, 2028.2) and TBA deprecation milestones for integration posture checks
+
+NetSuite releases biannually. Content verified 2026-06-09.
+
+Release-sensitive items to re-verify each release:
+
+- SOAP web services removal timeline (REST + OAuth 2.0 recommended for new integrations from 2026.1; new SOAP integrations blocked at 2027.1).
+- Certification availability (AI Specialist/Professional and BI & Reporting Professional are Coming Soon — re-check status).
+- AI Connector / MCP permission names and role restrictions.

package/skills/netsuite/netsuite-live-operation-safety-skill/references/safety-checklist.md

@@ -0,0 +1,24 @@
+# Safety Checklist
+
+Expanded live-op authorization checklist with per-change-type decision trees
+
+- No credentials, tokens, or secrets were supplied in the request input
+- Administrator role is not required by the proposed change
+- Authorized live-op protocol reference is present and cites a named human decision owner
+- Rollback plan is documented and a rollback owner is named
+- For SDF deploys: sandbox validation evidence is present
+- For OAuth/TBA changes: confirms REST+OAuth2 path (not new SOAP TBA post-2027.1)
+- For permission changes: target role is a custom copy of a standard role, not Administrator
+- For AI Connector changes: confirms account is not a healthcare BAA-restricted account
+
+## Refusal triggers
+
+- Request supplies credentials, tokens, OAuth client secrets, TBA token values, or session cookies — hard refuse, do not echo or log
+- Request asks for or implies use of the Administrator role for any automated or scripted operation
+- No authorized live-op protocol or change-management ticket reference is present
+- No named human decision owner is identified
+- No rollback plan is provided for production-bound changes
+- Request proposes building a new SOAP integration after the 2026.1 release (REST+OAuth2 is required for new builds per evidence item 2a)
+- Request proposes new TBA for SOAP, REST, or RESTlets after 2027.1 (hard block per evidence item 4d)
+- Proposed change would grant permissions that mandate 2FA (Access Token Management, OAuth 2.0 Authorized Applications Management, Core Administration Permissions, View Unencrypted Credit Cards, View Unencrypted ACH Account Numbers) without confirming 2FA enrollment
+- Coming-soon certifications (AI Specialist, AI Professional, BI & Reporting Professional) cited as available in the change justification

package/skills/netsuite/netsuite-oneworld-multisubsidiary-skill/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: netsuite-oneworld-multisubsidiary-skill
+description: "Flashlight skill for reviewing NetSuite OneWorld multi-entity configurations: subsidiary hierarchies, intercompany account boundaries, cross-subsidiary visibility restrictions, multi-currency settings, and tax-jurisdiction nexus alignment. T0 static review — no live account connection required. TRIGGER when: user asks to review subsidiary structure, audit intercompany accounts, check cross-subsidiary role scoping, validate tax nexus coverage, assess consolidation configuration, or diagnose OneWorld hierarchy issues. Trigger phrases: subsidiary hierarchy, intercompany elimination, cross-subsidiary access, multi-currency consolidation, tax nexus, due-to due-from, legal entity registration, OneWorld configuration. DO NOT TRIGGER when: the user needs authentication or OAuth/TBA token review (use netsuite-sso-oauth-tba-skill), role/permission assignment analysis beyond subsidiary scoping (use netsuite-identity-access-role-permission-skill), SOX audit evidence generation (use netsuite-audit-controls-sox-skill), or SDF deployment of subsidiary changes (use netsuite-sdf-devops-release-skill)."
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-09"
+  category: compliance
+  lifecycle: experimental
+  execution_tier: static-review
+  mcp_servers: []
+  oauth_scopes: []
+  run_as_permissions:
+    required: []
+    denied: []
+---
+
+# NetSuite OneWorld Multi-Subsidiary Skill
+
+## Purpose
+
+Audits OneWorld multi-subsidiary configurations for boundary integrity, intercompany elimination correctness, currency/tax-jurisdiction alignment, and cross-subsidiary role scoping. Identifies misconfigured subsidiary access, missing intercompany accounts, and jurisdiction gaps. T0 static review — no NetSuite account connection required; output is a draft for human review.
+
+## When This Skill Owns the Task
+
+- Reviewing a multi-subsidiary NetSuite setup for structural completeness and intercompany correctness
+- Auditing cross-subsidiary role scoping to verify users cannot see data outside their legal entity
+- Validating tax nexus and jurisdiction alignment for a new country or subsidiary
+- Diagnosing consolidation discrepancies caused by missing intercompany elimination accounts
+- Assessing multi-currency configuration and exchange-rate type assignments across subsidiaries
+
+## Recommended Workflow
+
+1. Step 1 — Gather inputs: request subsidiary hierarchy export, intercompany account mapping, role restriction excerpts, tax nexus config, and currency settings
+2. Step 2 — Map the hierarchy: identify parent/child subsidiary relationships, legal-entity registrations, base currencies, and countries; flag any subsidiary missing a country or currency assignment
+3. Step 3 — Review intercompany boundaries: verify each intercompany transaction type has a matching due-to/due-from account pair and an elimination journal entry; flag gaps as High
+4. Step 4 — Audit cross-subsidiary visibility: review role configurations for subsidiary restrictions; flag any role granting broader access than the user's legal entity as High
+5. Step 5 — Assess tax jurisdiction coverage: map each subsidiary's country to its configured nexus; flag missing nexus registrations as High
+6. Step 6 — Review multi-currency settings: verify exchange-rate types and revaluation rules per subsidiary; flag currency mismatches as Medium or High depending on consolidation impact
+7. Step 7 — Emit structured findings report: verdict, Critical/High/Medium/Low findings table, safe next actions, and escalation triggers
+
+## Evidence Hierarchy
+
+LIVE_EVIDENCE > REPOSITORY_EVIDENCE > USER_PROVIDED > OFFICIAL_DOCUMENTATION > INFERENCE > UNVERIFIED > BLOCKED
+
+## Safety Checklist
+
+- No live NetSuite credentials, tokens, or session cookies accepted — reject and ask for sanitized exports
+- Tax registration numbers (VAT/GST IDs) must be redacted before submission
+- No live mutations recommended — all changes must go through netsuite-live-org-mutation-guard-agent
+- All findings labeled [FACT], [ASSUMPTION], or [INFERENCE] with source config reference
+- Cross-subsidiary data exposure findings escalated as Critical minimum
+
+## Rules — Hard-Stop Constraints
+
+- Static review only; never connect to a live NetSuite account or invoke APIs/SuiteScript/SDF.
+- Never request or accept credentials, tokens, or secrets.
+- Never depend on the Administrator role; recommend least-privilege custom roles (note 2FA).
+- Prefer OAuth 2.0 (REST/RESTlets/SuiteAnalytics Connect) over SOAP; treat SOAP as a migration risk.
+- Never claim a Coming-Soon certification is available.
+
+## Refusal Triggers
+
+- Request provides live NetSuite credentials, session tokens, TBA tokens, OAuth client secrets, or admin passwords — refuse immediately, do not log or echo
+- Request asks the agent to use the Administrator role or any role with full account permissions
+- Request asks the agent to directly create, edit, or delete subsidiaries, legal entities, or intercompany accounts in a live account
+- Request provides unredacted tax registration numbers, VAT/GST IDs, or legal-entity bank account data — flag and ask for redacted version
+- Request claims a coming-soon NetSuite certification (AI Specialist, AI Professional, BI & Reporting Professional) is currently available
+
+## T0 Contract
+
+No account connection, no OAuth, no secrets. Output is draft review text for a human owner.
+
+## Security Notes
+
+Static review only. This agent never requests, stores, echoes, or logs NetSuite credentials, OAuth tokens, TBA tokens, client secrets, or session cookies. Tax registration numbers and legal-entity bank data must be redacted before submission. All live-mutation paths are hard-routed to netsuite-live-org-mutation-guard-agent. No org connection is established at any point.
+
+## Reference File Index
+
+- [official-sources.md](references/official-sources.md) — Oracle NetSuite OneWorld and multi-currency documentation URLs
+- [safety-checklist.md](references/safety-checklist.md) — Pre-review sanitization steps for subsidiary and tax configuration exports
+- [least-privilege.md](references/least-privilege.md) — Custom reviewer role specification for OneWorld configurations
+- [release-drift.md](references/release-drift.md) — OneWorld feature changes by release that may affect subsidiary or intercompany behavior
+- [intercompany-patterns.md](references/intercompany-patterns.md) — Reference patterns for intercompany account pairing and elimination journal configurations

package/skills/netsuite/netsuite-oneworld-multisubsidiary-skill/metadata.json

@@ -0,0 +1,33 @@
+{
+  "id": "netsuite-oneworld-multisubsidiary-skill",
+  "name": "NetSuite OneWorld Multi-Subsidiary Skill",
+  "type": "skill",
+  "provider": "netsuite",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Flashlight skill for reviewing NetSuite OneWorld multi-entity configurations: subsidiary hierarchies, intercompany account boundaries, cross-subsidiary visibility restrictions, multi-currency settings, and tax-jurisdiction nexus alignment. T0 static review — no live account connection required. TRIG",
+  "source_type": "original",
+  "category": "compliance",
+  "execution_tier": "static-review",
+  "oauth_scopes": [],
+  "mcp_servers": [],
+  "run_as_permissions": {},
+  "sandbox_only": false,
+  "production_allowed": true,
+  "official_docs": [
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1532968056.html"
+  ],
+  "security_notes": "Static review only. This agent never requests, stores, echoes, or logs NetSuite credentials, OAuth tokens, TBA tokens, client secrets, or session cookies. Tax registration numbers and legal-entity bank data must be redacted before submission. All live-mutation paths are hard-routed to netsuite-live-org-mutation-guard-agent. No org connection is established at any point.",
+  "last_verified": "2026-06-09",
+  "path": "skills/netsuite/netsuite-oneworld-multisubsidiary-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/netsuite/netsuite-oneworld-multisubsidiary-skill/references/intercompany-patterns.md

@@ -0,0 +1,12 @@
+# Intercompany Patterns
+
+Reference patterns for intercompany account pairing and elimination journal configurations
+
+Scope: Audits OneWorld multi-subsidiary configurations for boundary integrity, intercompany elimination correctness, currency/tax-jurisdiction alignment, and cross-subsidiary role scoping. Identifies misconfigured subsidiary access, missing intercompany accounts, and jurisdiction gaps.
+
+- OneWorld subsidiary hierarchy review: parent/child relationships, legal-entity registrations, base-currency assignments, and country/tax-jurisdiction alignment
+- Intercompany boundary review: intercompany account pairings, elimination journal configuration, intercompany transaction type coverage, and due-to/due-from balance symmetry
+- Cross-subsidiary visibility restrictions: role-level subsidiary restrictions, subsidiary-specific record access, and saved-search/report scope scoping
+- Multi-currency configuration: exchange-rate types, revaluation rules, and currency consolidation settings per subsidiary
+- Tax-jurisdiction mapping: nexus configuration, tax registration alignment to subsidiary country, and multi-jurisdiction VAT/GST exposure
+- Legal-entity boundary review: ensuring each legal entity has a corresponding subsidiary with correct country, currency, and tax profile

package/skills/netsuite/netsuite-oneworld-multisubsidiary-skill/references/least-privilege.md

@@ -0,0 +1,64 @@
+# Least-privilege NetSuite posture for NetSuite OneWorld Multi-Subsidiary Agent
+
+## Execution tier
+
+**T0 — Static Review**
+
+Rationale: `execution_tier: "static-review"` declared in `metadata.json`. This agent reviews sanitized configuration excerpts and never holds a live NetSuite session.
+
+## Identity model
+
+No live NetSuite identity is required for the agent itself. When a human operator acts on this agent's review, they SHOULD use the least-privilege custom role below — never the Administrator role.
+
+## Recommended custom role
+
+- **Custom role name:** NetSuite OneWorld Reviewer (custom)
+- **Copy from standard role:** Accountant (standard role — copy and restrict) (NetSuite guidance: start from a copy of a standard role, then remove unneeded permissions).
+- **Modules in scope:** General Ledger, Multi-Currency, Tax, OneWorld
+- **Two-Factor Authentication required:** Yes
+
+### Minimal permissions
+
+- **Subsidiaries** (View) — Required to inspect subsidiary hierarchy and configuration
+- **Intercompany Journal Entries** (View) — Required to review intercompany elimination account coverage
+- **Currency** (View) — Required to review base-currency assignments and exchange-rate types
+- **Tax Schedules** (View) — Required to review nexus and tax-jurisdiction configurations
+- **General Ledger** (View) — Required to review intercompany due-to/due-from account pairings
+- **Roles** (View) — Required to review cross-subsidiary role restrictions
+
+## Forbidden
+
+- Administrator role
+- Full access to any transaction entry type
+- Access Token Management permission
+- OAuth 2.0 Authorized Applications Management permission
+- Edit or Create level on Subsidiaries or Intercompany records
+
+## Blast-radius bound
+
+Even if fully compromised, this agent cannot mutate a NetSuite account: it has no live session, no API tokens, and no SDF deploy rights. It can only produce review text.
+
+## Refusal triggers
+
+- Request provides live NetSuite credentials, session tokens, TBA tokens, OAuth client secrets, or admin passwords — refuse immediately, do not log or echo
+- Request asks the agent to use the Administrator role or any role with full account permissions
+- Request asks the agent to directly create, edit, or delete subsidiaries, legal entities, or intercompany accounts in a live account
+- Request provides unredacted tax registration numbers, VAT/GST IDs, or legal-entity bank account data — flag and ask for redacted version
+- Request claims a coming-soon NetSuite certification (AI Specialist, AI Professional, BI & Reporting Professional) is currently available
+
+## Escalation path
+
+Route all live-account changes to `netsuite-live-org-mutation-guard-agent` with a named human decision owner and a structured case capsule.
+
+## Role creation steps
+
+1. In the target SANDBOX, copy the standard role named above to a new custom role.
+2. Remove every permission not listed under Minimal permissions.
+3. Add only the listed permissions at the stated access level.
+4. Confirm the role is NOT Administrator and grants no global/cross-subsidiary access beyond remit.
+5. Enable 2FA enforcement if the role touches privileged permissions.
+6. Test in sandbox, then assign to the integration/review user; monitor for least-privilege drift.
+
+## Companion skill
+
+`netsuite-oneworld-multisubsidiary-skill` — NetSuite OneWorld Multi-Subsidiary Skill

package/skills/netsuite/netsuite-oneworld-multisubsidiary-skill/references/official-sources.md

@@ -0,0 +1,9 @@
+# Official Sources
+
+Oracle NetSuite OneWorld and multi-currency documentation URLs
+
+Verified 2026-06-09 against official Oracle/NetSuite documentation:
+
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1532968056.html

package/skills/netsuite/netsuite-oneworld-multisubsidiary-skill/references/release-drift.md

@@ -0,0 +1,11 @@
+# Release Drift
+
+OneWorld feature changes by release that may affect subsidiary or intercompany behavior
+
+NetSuite releases biannually. Content verified 2026-06-09.
+
+Release-sensitive items to re-verify each release:
+
+- SOAP web services removal timeline (REST + OAuth 2.0 recommended for new integrations from 2026.1; new SOAP integrations blocked at 2027.1).
+- Certification availability (AI Specialist/Professional and BI & Reporting Professional are Coming Soon — re-check status).
+- AI Connector / MCP permission names and role restrictions.

package/skills/netsuite/netsuite-oneworld-multisubsidiary-skill/references/safety-checklist.md

@@ -0,0 +1,17 @@
+# Safety Checklist
+
+Pre-review sanitization steps for subsidiary and tax configuration exports
+
+- No live NetSuite credentials, tokens, or session cookies accepted — reject and ask for sanitized exports
+- Tax registration numbers (VAT/GST IDs) must be redacted before submission
+- No live mutations recommended — all changes must go through netsuite-live-org-mutation-guard-agent
+- All findings labeled [FACT], [ASSUMPTION], or [INFERENCE] with source config reference
+- Cross-subsidiary data exposure findings escalated as Critical minimum
+
+## Refusal triggers
+
+- Request provides live NetSuite credentials, session tokens, TBA tokens, OAuth client secrets, or admin passwords — refuse immediately, do not log or echo
+- Request asks the agent to use the Administrator role or any role with full account permissions
+- Request asks the agent to directly create, edit, or delete subsidiaries, legal entities, or intercompany accounts in a live account
+- Request provides unredacted tax registration numbers, VAT/GST IDs, or legal-entity bank account data — flag and ask for redacted version
+- Request claims a coming-soon NetSuite certification (AI Specialist, AI Professional, BI & Reporting Professional) is currently available

package/skills/netsuite/netsuite-sandbox-nonproduction-governance-skill/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: netsuite-sandbox-nonproduction-governance-skill
+description: "Static-review flashlight for NetSuite sandbox, Release Preview, and non-production environment governance. Enforces the confirmed isolation facts: OAuth 2.0 authorized apps and client credentials flow setup in production are NOT copied to sandbox or Release Preview (and are cleared on each sandbox refresh); TBA tokens created in production are NOT copied to sandbox or Release Preview. Enforces that sandbox success does not equal production readiness without explicit re-authorization. TRIGGER when: user asks about sandbox governance, OAuth app re-authorization after sandbox refresh, TBA token management across environments, Release Preview usage policies, environment isolation between production and sandbox, sandbox-to-production promotion readiness, or sandbox refresh impact on integration testing. Trigger phrases: sandbox refresh, OAuth re-authorize sandbox, Release Preview isolation, sandbox governance, non-production environment, sandbox success production readiness, TBA token sandbox. DO NOT TRIGGER when: the question is about OAuth 2.0 or TBA auth flow mechanics (use netsuite-sso-oauth-tba-agent), integration API endpoint design (use netsuite-web-services-integration-agent), SDF release pipeline automation (use netsuite-sdf-devops-release-agent), or role and permission SoD design (use netsuite-identity-access-role-permission-agent)."
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-09"
+  category: operational
+  lifecycle: experimental
+  execution_tier: static-review
+  mcp_servers: []
+  oauth_scopes: []
+  run_as_permissions:
+    required: []
+    denied: []
+---
+
+# NetSuite Sandbox and Non-Production Governance Skill
+
+## Purpose
+
+Sandbox and non-production environment separation, OAuth 2.0 app re-authorization requirements per environment, TBA token isolation, sandbox refresh cycles, and Release Preview usage governance. Enforces the principle that authorized applications and tokens are not copied between environments and must be explicitly re-authorized after each sandbox refresh. T0 static review — no NetSuite account connection required; output is a draft for human review.
+
+## When This Skill Owns the Task
+
+- User needs to review or design OAuth 2.0 re-authorization procedures for sandbox and Release Preview environments
+- User is planning a sandbox refresh and needs to assess impact on active OAuth apps and TBA tokens
+- User needs to assess whether their sandbox test results are sufficient evidence of production readiness
+- User needs to establish environment separation policies between production, sandbox, and Release Preview
+- User needs to design a sandbox-to-production promotion checklist that includes OAuth and TBA re-authorization steps
+
+## Recommended Workflow
+
+1. Step 1 — Gather inputs: environment inventory, OAuth 2.0 re-authorization processes, sandbox refresh schedule, TBA token management procedures, integration test suite scope
+2. Step 2 — Verify environment separation: confirm distinct OAuth 2.0 authorized apps, client credentials flow setups, and TBA tokens per environment; flag any assumption that production config copies to sandbox
+3. Step 3 — Assess post-refresh re-authorization coverage: identify which OAuth apps and TBA tokens require explicit re-authorization or re-creation after each sandbox refresh
+4. Step 4 — Evaluate sandbox-to-production promotion readiness checklist: verify OAuth re-authorization step is present before smoke-test; flag its absence as High governance gap
+5. Step 5 — Review Release Preview governance: confirm it is not used for production-equivalent load testing or treated as production fallback without explicit re-authorization
+6. Step 6 — Rate all governance gaps Critical/High/Medium/Low/Unknown; produce structured finding table with evidence labels [FACT], [ASSUMPTION], [INFERENCE]
+7. Step 7 — Emit T0 static review output: governance gap report with re-authorization checklist, sandbox refresh impact assessment, and escalation routing
+
+## Evidence Hierarchy
+
+LIVE_EVIDENCE > REPOSITORY_EVIDENCE > USER_PROVIDED > OFFICIAL_DOCUMENTATION > INFERENCE > UNVERIFIED > BLOCKED
+
+## Safety Checklist
+
+- No credentials, tokens, or secrets present in inputs — refuse and instruct user to redact if found
+- Core isolation fact enforced: OAuth 2.0 authorized apps and client credentials flow NOT copied to sandbox/Release Preview; TBA tokens NOT copied (evidence-matrix rows 8a-8d)
+- Sandbox success != production readiness principle enforced — re-authorization step required in promotion checklist
+- Custom reviewer role recommendation never uses Administrator role
+- All official_docs URLs traceable to evidence-matrix.md
+
+## Rules — Hard-Stop Constraints
+
+- Static review only; never connect to a live NetSuite account or invoke APIs/SuiteScript/SDF.
+- Never request or accept credentials, tokens, or secrets.
+- Never depend on the Administrator role; recommend least-privilege custom roles (note 2FA).
+- Prefer OAuth 2.0 (REST/RESTlets/SuiteAnalytics Connect) over SOAP; treat SOAP as a migration risk.
+- Never claim a Coming-Soon certification is available.
+
+## Refusal Triggers
+
+- Request includes credentials, tokens, secrets, client secrets, or API keys — refuse and instruct user to redact
+- Request asks agent to use the Administrator role or roles with full permissions
+- Request asks agent to access a live NetSuite account, execute environment changes, or mutate any account
+- User asserts that OAuth 2.0 authorized apps are automatically copied to sandbox — correct this with evidence-matrix row 8a citation
+- User asserts that sandbox success proves production readiness without explicit re-authorization step — flag as governance gap
+
+## T0 Contract
+
+No account connection, no OAuth, no secrets. Output is draft review text for a human owner.
+
+## Security Notes
+
+Static review only — never accesses live NetSuite accounts, never executes environment changes, never requests or stores credentials, tokens, client secrets, or org IDs. Works exclusively from sanitized environment documentation. Enforces confirmed isolation facts: OAuth 2.0 authorized apps and client credentials flow setup are NOT copied to sandbox or Release Preview (cleared on refresh); TBA tokens are NOT copied. Enforces that sandbox success does not equal production readiness. Never recommends Administrator role for sandbox governance roles. Custom reviewer role requires 2FA when permissions include OAuth 2.0 Authorized Applications Management or Access Token Management.
+
+## Reference File Index
+
+- [official-sources.md](references/official-sources.md) — Confirmed Oracle/NetSuite official documentation URLs for OAuth 2.0 environment isolation and sandbox governance
+- [safety-checklist.md](references/safety-checklist.md) — Pre-review checklist: redaction verification, environment isolation facts, re-authorization coverage checks
+- [least-privilege.md](references/least-privilege.md) — Custom role design for sandbox governance reviewers — permissions, 2FA triggers, forbidden roles
+- [release-drift.md](references/release-drift.md) — Environment-specific OAuth 2.0 and TBA isolation facts — evidence-matrix rows 8a-8d
+- [sandbox-promotion-checklist.md](references/sandbox-promotion-checklist.md) — Sandbox-to-production promotion checklist including OAuth re-authorization and smoke-test steps

package/skills/netsuite/netsuite-sandbox-nonproduction-governance-skill/metadata.json

@@ -0,0 +1,37 @@
+{
+  "id": "netsuite-sandbox-nonproduction-governance-skill",
+  "name": "NetSuite Sandbox and Non-Production Governance Skill",
+  "type": "skill",
+  "provider": "netsuite",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Static-review flashlight for NetSuite sandbox, Release Preview, and non-production environment governance. Enforces the confirmed isolation facts: OAuth 2.0 authorized apps and client credentials flow setup in production are NOT copied to sandbox or Release Preview (and are cleared on each sandbox r",
+  "source_type": "original",
+  "category": "operational",
+  "execution_tier": "static-review",
+  "oauth_scopes": [],
+  "mcp_servers": [],
+  "run_as_permissions": {},
+  "sandbox_only": false,
+  "production_allowed": true,
+  "official_docs": [
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157771979135.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162686838198.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4254801119.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1532968056.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1515446005.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html",
+    "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html"
+  ],
+  "security_notes": "Static review only — never accesses live NetSuite accounts, never executes environment changes, never requests or stores credentials, tokens, client secrets, or org IDs. Works exclusively from sanitized environment documentation. Enforces confirmed isolation facts: OAuth 2.0 authorized apps and client credentials flow setup are NOT copied to sandbox or Release Preview (cleared on refresh); TBA tokens are NOT copied. Enforces that sandbox success does not equal production readiness. Never recommends Administrator role for sandbox governance roles. Custom reviewer role requires 2FA when permissions include OAuth 2.0 Authorized Applications Management or Access Token Management.",
+  "last_verified": "2026-06-09",
+  "path": "skills/netsuite/netsuite-sandbox-nonproduction-governance-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/netsuite/netsuite-sandbox-nonproduction-governance-skill/references/least-privilege.md

@@ -0,0 +1,60 @@
+# Least-privilege NetSuite posture for NetSuite Sandbox and Non-Production Governance Agent
+
+## Execution tier
+
+**T0 — Static Review**
+
+Rationale: `execution_tier: "static-review"` declared in `metadata.json`. This agent reviews sanitized configuration excerpts and never holds a live NetSuite session.
+
+## Identity model
+
+No live NetSuite identity is required for the agent itself. When a human operator acts on this agent's review, they SHOULD use the least-privilege custom role below — never the Administrator role.
+
+## Recommended custom role
+
+- **Custom role name:** NetSuite Sandbox Governance Reviewer (custom)
+- **Copy from standard role:** Administrator Professional (copy; restrict to non-production environment management scope only) (NetSuite guidance: start from a copy of a standard role, then remove unneeded permissions).
+- **Modules in scope:** OAuth 2.0, Token-Based Authentication, Setup and Administration
+- **Two-Factor Authentication required:** Yes
+
+### Minimal permissions
+
+- **OAuth 2.0 Authorized Applications Management** (View) — Required to review authorized application re-authorization status per environment — triggers mandatory 2FA per evidence-matrix row 5c
+- **Access Token Management** (View) — Required to review TBA token records per environment — triggers mandatory 2FA per evidence-matrix row 5c
+- **Setup** (View) — Required to review environment configuration settings
+- **Integration Record** (View) — Required to review integration record configuration in sandbox vs. production
+
+## Forbidden
+
+- Administrator role
+- Full permission roles
+- Any role with Edit/Full on OAuth 2.0 Authorized Applications Management or Access Token Management
+
+## Blast-radius bound
+
+Even if fully compromised, this agent cannot mutate a NetSuite account: it has no live session, no API tokens, and no SDF deploy rights. It can only produce review text.
+
+## Refusal triggers
+
+- Request includes credentials, tokens, secrets, client secrets, or API keys — refuse and instruct user to redact
+- Request asks agent to use the Administrator role or roles with full permissions
+- Request asks agent to access a live NetSuite account, execute environment changes, or mutate any account
+- User asserts that OAuth 2.0 authorized apps are automatically copied to sandbox — correct this with evidence-matrix row 8a citation
+- User asserts that sandbox success proves production readiness without explicit re-authorization step — flag as governance gap
+
+## Escalation path
+
+Route all live-account changes to `netsuite-live-org-mutation-guard-agent` with a named human decision owner and a structured case capsule.
+
+## Role creation steps
+
+1. In the target SANDBOX, copy the standard role named above to a new custom role.
+2. Remove every permission not listed under Minimal permissions.
+3. Add only the listed permissions at the stated access level.
+4. Confirm the role is NOT Administrator and grants no global/cross-subsidiary access beyond remit.
+5. Enable 2FA enforcement if the role touches privileged permissions.
+6. Test in sandbox, then assign to the integration/review user; monitor for least-privilege drift.
+
+## Companion skill
+
+`netsuite-sandbox-nonproduction-governance-skill` — NetSuite Sandbox and Non-Production Governance Skill

package/skills/netsuite/netsuite-sandbox-nonproduction-governance-skill/references/official-sources.md

@@ -0,0 +1,13 @@
+# Official Sources
+
+Confirmed Oracle/NetSuite official documentation URLs for OAuth 2.0 environment isolation and sandbox governance
+
+Verified 2026-06-09 against official Oracle/NetSuite documentation:
+
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157771979135.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162686838198.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4254801119.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1532968056.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1515446005.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N285436.html
+- https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N295396.html

package/skills/netsuite/netsuite-sandbox-nonproduction-governance-skill/references/release-drift.md

@@ -0,0 +1,11 @@
+# Release Drift
+
+Environment-specific OAuth 2.0 and TBA isolation facts — evidence-matrix rows 8a-8d
+
+NetSuite releases biannually. Content verified 2026-06-09.
+
+Release-sensitive items to re-verify each release:
+
+- SOAP web services removal timeline (REST + OAuth 2.0 recommended for new integrations from 2026.1; new SOAP integrations blocked at 2027.1).
+- Certification availability (AI Specialist/Professional and BI & Reporting Professional are Coming Soon — re-check status).
+- AI Connector / MCP permission names and role restrictions.