@raishin/vanguard-frontier-agentic 2.8.0 → 2.9.0

package/skills/oci/oci-live-iam-policy-compartment-guard/references/permission-model.md

@@ -1,71 +0,0 @@
-# Permission Model: OCI Live IAM Policy Compartment Guard
-
-## OCI verb hierarchy
-
-```
-inspect  = ListXxx APIs only. No resource content.
-read     = GetXxx + inspect. Can see resource details.
-use      = read + limited mutation (no create/terminate).
-manage   = full CRUD. Always scope to compartment, never tenancy for broad resources.
-```
-
-## 3-tier separation
-
-| Tier | Group | Scope | Activation |
-|------|-------|-------|-----------|
-| Auditor | `<iam-auditors>` | tenancy (read-only) | Standing |
-| Operator | `<iam-operators>` | compartment + name pattern | Standing (restricted) |
-| Tenancy-root admin | `<iam-tenancy-admins>` | tenancy | Break-glass only, MFA-TOTP gated |
-
-## Audit-only policy
-
-```
-Allow group <iam-auditors> to inspect policies in tenancy
-Allow group <iam-auditors> to read policies in tenancy
-Allow group <iam-auditors> to inspect dynamic-groups in tenancy
-Allow group <iam-auditors> to read dynamic-groups in tenancy
-Allow group <iam-auditors> to inspect groups in tenancy
-Allow group <iam-auditors> to read users in tenancy
-```
-
-## Policy operator (compartment-scoped, name-pattern restricted)
-
-```
-Allow group <iam-operators> to manage policies in compartment <iam-compartment>
-  where target.policy.name = /iam-managed-*/
-Allow group <iam-operators> to manage dynamic-groups in tenancy
-  where target.dynamicGroup.name = /iam-managed-*/
-```
-
-`dynamic-groups` are tenancy-scoped in OCI — compartment scope is not supported. The
-`where target.dynamicGroup.name = /iam-managed-*/` name-pattern condition prevents
-privilege escalation through creation of an unrestricted dynamic group.
-
-**Critical syntax**: OCI IAM uses **forward-slash regex** `/pattern*/`, **not** quoted strings,
-for wildcard matching. `= 'iam-managed-*'` would only match the literal string
-`iam-managed-*` (one specific name with a literal asterisk) — the operator could
-create any other dynamic group and bypass the guard entirely. Always use `/.../`
-slashes for pattern conditions. Reference: Oracle policy conditions docs at
-`https://docs.oracle.com/en-us/iaas/Content/Identity/policysyntax/conditions.htm`.
-
-## Tenancy-root admin (break-glass only, MFA-TOTP gated)
-
-```
-Allow group <iam-tenancy-admins> to manage policies in tenancy
-  where request.user.mfaTotpVerified = 'true'
-Allow group <iam-tenancy-admins> to manage groups in tenancy
-  where target.group.name != 'Administrators'
-```
-
-- MFA-TOTP gate is enforced at policy-evaluation time, not just login.
-- Cannot modify the `Administrators` group — requires the bootstrap tenancy admin.
-- Membership must be empty by default; add only during an approved change window.
-
-## Do not use
-
-```
-# FORBIDDEN
-Allow any-group to manage policies in tenancy
-Allow group <iam-operators> to manage policies in tenancy
-Allow any-user to inspect all-resources in tenancy
-```

package/skills/oci/oci-live-iam-policy-compartment-guard/references/preflight-commands.md

@@ -1,49 +0,0 @@
-# Preflight Commands: OCI Live IAM Policy Compartment Guard
-
-Run these before any IAM policy modification. Paste sanitized output as evidence.
-
-## 1. Confirm identity and tenancy
-
-```bash
-oci iam user list --query "data[?contains(\"defined-tags\".keys(@), 'Operations')].{name:name,id:id}" 2>/dev/null | head -20
-# Or check active session
-oci iam region-subscription list
-```
-
-## 2. List policies in target compartment
-
-```bash
-oci iam policy list \
-  --compartment-id <COMPARTMENT_OCID> \
-  --query "data[].{id:id,name:name,lifecycleState:\"lifecycle-state\",statements:statements}"
-```
-
-## 3. Inspect a specific policy
-
-```bash
-oci iam policy get --policy-id <POLICY_OCID> \
-  --query "data.{name:name,statements:statements,versionDate:\"version-date\",freeformTags:\"freeform-tags\"}"
-```
-
-## 4. List dynamic groups and their matching rules
-
-```bash
-oci iam dynamic-group list \
-  --query "data[].{name:name,id:id,matchingRule:\"matching-rule\",lifecycleState:\"lifecycle-state\"}"
-```
-
-## 5. Audit recent policy changes (Activity log)
-
-```bash
-oci audit event list \
-  --compartment-id <TENANCY_OCID> \
-  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
-  --query "data[?\"event-type\"=='com.oraclecloud.identitycontrolplane.updatepolicy'].{time:\"event-time\",user:data.\"request.headers\".\"opc-principal\"[0],policyId:data.\"request.path\"}"
-```
-
-## 6. Check for overly broad existing policies (anti-pattern scan)
-
-```bash
-oci iam policy list --compartment-id <TENANCY_OCID> --all \
-  --query "data[?contains(to_string(statements), 'manage all-resources') || contains(to_string(statements), 'any-user')].{name:name,statements:statements}"
-```

package/skills/oci/oci-live-iam-policy-compartment-guard/references/rollback-playbook.md

@@ -1,62 +0,0 @@
-# Rollback Playbook: OCI Live IAM Policy Compartment Guard
-
-## Revert to a previous policy version
-
-OCI does not natively version policies, but you can restore from the prior statements.
-
-```bash
-# Get current policy statements
-oci iam policy get --policy-id <POLICY_OCID> --query "data.statements"
-
-# Update the policy with the previous statements
-oci iam policy update \
-  --policy-id <POLICY_OCID> \
-  --statements '["Allow group <previous-group> to <verb> <resource> in <scope>", ...]' \
-  --version-date $(date +%Y-%m-%d) \
-  --force
-```
-
-## Delete an accidentally created policy
-
-> ⚠️ **IRREVERSIBILITY WARNING — IAM blast radius**
->
-> Deleting an IAM policy is **immediate** (eventual consistency: 10–30 seconds globally) and
-> may revoke access to running production workloads before any operator can react.
-> The `--force` flag below suppresses the OCI CLI's interactive confirmation prompt.
->
-> **Required pre-delete confirmation steps** — do not skip:
->
-> 1. Run `oci iam policy get --policy-id <POLICY_OCID>` and inspect the statements.
-> 2. Confirm the displayed `name` and `compartment-id` match the policy you intend to delete.
-> 3. Confirm in writing (chat, ticket, change record) that the policy is not in active use:
->    `oci search resource structured-search --query-text "query policy resources where compartmentId = '<compartment>'"`
-> 4. If unsure, prefer `oci iam policy update` to empty the `statements` array first
->    (reversible) before issuing the `delete` command.
->
-> Only after all four steps are complete should the `delete --force` command be executed.
-
-```bash
-# Step 1: Confirm the target policy
-oci iam policy get --policy-id <POLICY_OCID> --query "data.{name:name,compartment:\"compartment-id\",statements:statements}"
-
-# Step 2: Only after operator confirmation — delete
-oci iam policy delete --policy-id <POLICY_OCID> --force
-```
-
-## Remove a group member added by mistake (privilege de-escalation)
-
-```bash
-# Find the user's group membership
-oci iam group list-users --group-id <GROUP_OCID> \
-  --query "data[?name=='<USERNAME>'].id"
-
-# Remove from group
-oci iam group remove-user --group-id <GROUP_OCID> --user-id <USER_OCID>
-```
-
-## Rollback limitations
-
-- OCI IAM has eventual consistency — policy changes may take up to 10–30 seconds to propagate globally.
-- There is no automated version history for policies — maintain external backups of policy statements.
-- Removing a policy statement may immediately break running workloads that depend on that grant.
-- Break-glass tenancy-root admin changes require emptying the `<iam-tenancy-admins>` group immediately after use.

package/skills/oci/oci-live-network-security-rule-guard/references/permission-model.md

@@ -1,65 +0,0 @@
-# Permission Model: OCI Live Network Security Rule Guard
-
-## Least-privilege IAM policy for network rule read (preflight only)
-
-```
-Allow group NetworkAuditors to read virtual-network-family in compartment <compartment>
-Allow group NetworkAuditors to read vcns in compartment <compartment>
-Allow group NetworkAuditors to read security-lists in compartment <compartment>
-Allow group NetworkAuditors to read network-security-groups in compartment <compartment>
-Allow group NetworkAuditors to read subnets in compartment <compartment>
-Allow group NetworkAuditors to read db-systems in compartment <compartment>
-Allow group NetworkAuditors to read autonomous-databases in compartment <compartment>
-```
-
-Read-only audit: use `inspect` or `read` verbs only. Never `manage` for auditors.
-
-## Least-privilege IAM policy for network rule mutation (guarded operator only)
-
-```
-Allow group NetworkOperators to manage security-lists in compartment <compartment>
-Allow group NetworkOperators to manage network-security-groups in compartment <compartment>
-Allow group NetworkOperators to read vcns in compartment <compartment>
-Allow group NetworkOperators to read subnets in compartment <compartment>
-```
-
-Do **not** grant `manage virtual-network-family` — that is broader than needed and includes VCN, route tables, internet gateways, and peering.
-
-## Risk classification by rule type
-
-| Rule | Risk | Reason |
-|---|---|---|
-| Ingress `0.0.0.0/0` any protocol | Critical | Open internet access to entire subnet |
-| Ingress `0.0.0.0/0` port 22 | Critical | SSH from internet — never acceptable in production |
-| Ingress `0.0.0.0/0` port 3389 | Critical | RDP from internet — never acceptable in production |
-| Ingress `0.0.0.0/0` port 1521/1522 | Critical | Oracle DB from internet — data exfiltration path |
-| Ingress `0.0.0.0/0` port 3306/5432 | Critical | MySQL/PostgreSQL from internet |
-| Ingress from VCN CIDR, specific port | Low | Internal only — verify VCN CIDR is not transit-routed |
-| Egress `0.0.0.0/0` all | Medium | Standard but verify no data-loss risk for DB subnets |
-| Stateless rule on DB subnet | High | No connection tracking — asymmetric TCP risk |
-
-## Stateful vs stateless
-
-- **Stateful** (default, `stateless: false`): OCI tracks connection state and automatically allows return traffic. Use for all production workloads.
-- **Stateless** (`stateless: true`): Higher performance, but return traffic requires an explicit rule in the opposite direction. A missing return rule silently drops responses. Only use when performance benchmarked at scale.
-
-## Subnet criticality classification
-
-| Subnet pattern | Classification |
-|---|---|
-| Hosts Autonomous DB, DB System, Exadata | Database — highest protection |
-| Hosts compute instances with public IP | Public compute — ingress rules must be minimal |
-| Private subnet (`prohibit-public-ip: true`) | Internal — `0.0.0.0/0` still covers all VCN-routed traffic |
-| Bastion subnet | Bastion — SSH/RDP ingress from known CIDRs only |
-
-## OCI Network Path Analyzer — preferred verification tool
-
-Before approving a connectivity change, use Path Analyzer to simulate the traffic path:
-```bash
-oci network path-analyzer-test create \
-  --compartment-id <COMPARTMENT_OCID> \
-  --protocol-parameters '{"type":"TCP","destinationPort":<PORT>}' \
-  --source-endpoint '{"type":"COMPUTE_INSTANCE","instanceId":"<INSTANCE_OCID>"}' \
-  --destination-endpoint '{"type":"IP_ADDRESS","address":"<DEST_IP>"}'
-```
-Path Analyzer respects Security Lists, NSGs, route tables, and service gateways — use it as the final approval gate for any rule change.

package/skills/oci/oci-live-network-security-rule-guard/references/preflight-commands.md

@@ -1,69 +0,0 @@
-# Preflight Commands: OCI Live Network Security Rule Guard
-
-Run all of these before adding, modifying, or removing any Security List or NSG rule.
-
-## 1. Confirm active OCI profile and tenancy
-
-```bash
-oci iam region list --output table   # confirms CLI auth works
-oci iam tenancy get --tenancy-id $(oci iam user get --user-id $(oci iam user list --query 'data[0].id' --raw-output) --query 'data."compartment-id"' --raw-output) 2>/dev/null || echo "Use: oci iam user list --all"
-```
-
-Simpler identity check:
-```bash
-oci iam user list --all --query 'data[0].{name:name, description:description}' --output table
-```
-
-## 2. Capture current Security List rules (CRITICAL — save as rollback baseline)
-
-```bash
-# Get current ingress and egress rules — save this output BEFORE any mutation
-oci network security-list get \
-  --security-list-id <SECURITY_LIST_OCID> \
-  --query 'data.{"display-name":"display-name", "ingress-security-rules":"ingress-security-rules", "egress-security-rules":"egress-security-rules"}'
-```
-
-## 3. Capture current NSG rules (CRITICAL — save as rollback baseline)
-
-```bash
-oci network nsg rules list \
-  --nsg-id <NSG_OCID> \
-  --all \
-  --query 'data[].{id:id, direction:direction, protocol:protocol, source:source, destination:destination, "source-type":"source-type", "tcp-options":"tcp-options", "udp-options":"udp-options", stateless:stateless}'
-```
-
-## 4. List Security Lists in a VCN to identify the target
-
-```bash
-oci network security-list list \
-  --compartment-id <COMPARTMENT_OCID> \
-  --vcn-id <VCN_OCID> \
-  --query 'data[].{"display-name":"display-name", id:id, "lifecycle-state":"lifecycle-state"}'
-```
-
-## 5. Identify subnets attached to the Security List (blast radius)
-
-```bash
-oci network subnet list \
-  --compartment-id <COMPARTMENT_OCID> \
-  --vcn-id <VCN_OCID> \
-  --query 'data[].{"display-name":"display-name", "cidr-block":"cidr-block", "security-list-ids":"security-list-ids", "prohibit-public-ip-on-vnic":"prohibit-public-ip-on-vnic"}'
-```
-
-`prohibit-public-ip-on-vnic: true` = private subnet. Ingress from 0.0.0.0/0 on a private subnet still allows internal CIDR access — confirm VCN CIDR scope.
-
-## 6. Check if DB System or Autonomous DB is in the affected subnet
-
-```bash
-# List DB systems in compartment
-oci db system list \
-  --compartment-id <COMPARTMENT_OCID> \
-  --query 'data[].{"display-name":"display-name", "subnet-id":"subnet-id", "lifecycle-state":"lifecycle-state"}'
-
-# List Autonomous DBs
-oci db autonomous-database list \
-  --compartment-id <COMPARTMENT_OCID> \
-  --query 'data[].{"db-name":"db-name", "subnet-id":"subnet-id", "lifecycle-state":"lifecycle-state"}'
-```
-
-If the affected subnet hosts a DB workload, classify the change as **critical** and require explicit DBA approval.

package/skills/oci/oci-live-network-security-rule-guard/references/rollback-playbook.md

@@ -1,79 +0,0 @@
-# Rollback Playbook: OCI Live Network Security Rule Guard
-
-OCI Security List and NSG rule changes take effect immediately with no native undo operation. The only rollback path is restoring the previous rule set from a captured baseline. **Capture current rules before every mutation — no exceptions.**
-
-## Pre-mutation capture (mandatory)
-
-```bash
-# Security List — save to file before any change
-oci network security-list get \
-  --security-list-id <SECURITY_LIST_OCID> \
-  --query 'data.{"ingress-security-rules":"ingress-security-rules","egress-security-rules":"egress-security-rules"}' \
-  > securitylist-backup-$(date +%Y%m%d-%H%M%S).json
-
-# NSG — save to file before any change
-oci network nsg rules list \
-  --nsg-id <NSG_OCID> --all \
-  > nsg-backup-$(date +%Y%m%d-%H%M%S).json
-```
-
-## Restore Security List rules from backup
-
-Security List update is a **full replace** — the update command overwrites the entire rule set. Pass the exact previous rules from the backup file.
-
-```bash
-# Restore ingress rules
-INGRESS=$(cat securitylist-backup-<TIMESTAMP>.json | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps(d['ingress-security-rules']))")
-oci network security-list update \
-  --security-list-id <SECURITY_LIST_OCID> \
-  --ingress-security-rules "$INGRESS" \
-  --force
-
-# Restore egress rules (same file, egress key)
-EGRESS=$(cat securitylist-backup-<TIMESTAMP>.json | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps(d['egress-security-rules']))")
-oci network security-list update \
-  --security-list-id <SECURITY_LIST_OCID> \
-  --egress-security-rules "$EGRESS" \
-  --force
-```
-
-## Restore NSG rules from backup
-
-NSG rule updates require rule IDs. To restore, remove new rules and re-add the old ones.
-
-```bash
-# List current rule IDs to identify added rules
-oci network nsg rules list --nsg-id <NSG_OCID> --all --query 'data[].id'
-
-# Remove a specific rule that was incorrectly added
-oci network nsg rules remove \
-  --nsg-id <NSG_OCID> \
-  --security-rule-ids '["<RULE_ID_TO_REMOVE>"]'
-```
-
-## Verify restoration
-
-```bash
-# Confirm rules match the backup
-oci network security-list get \
-  --security-list-id <SECURITY_LIST_OCID> \
-  --query 'data.{"ingress-security-rules":"ingress-security-rules","egress-security-rules":"egress-security-rules"}'
-```
-
-## Connectivity verification after rollback
-
-```bash
-# Check if affected instance can still reach expected endpoints
-# (Run from inside the VCN or use OCI Network Path Analyzer)
-oci network path-analyzer-test create \
-  --compartment-id <COMPARTMENT_OCID> \
-  --protocol-parameters '{"type":"TCP","destinationPort":<PORT>}' \
-  --source-endpoint '{"type":"COMPUTE_INSTANCE","instanceId":"<INSTANCE_OCID>"}' \
-  --destination-endpoint '{"type":"IP_ADDRESS","address":"<DEST_IP>"}'
-```
-
-## What cannot be rolled back
-
-- Traffic that flowed through an incorrectly open rule during the window cannot be recalled.
-- Data exfiltrated or connections established during the exposure window must be investigated separately via VCN Flow Logs.
-- Enable Flow Logs on affected subnets before and after any security rule change for forensic coverage.

package/skills/oci/oci-live-oke-rollout-guard/references/permission-model.md

@@ -1,80 +0,0 @@
-# Permission Model: OCI Live OKE Rollout Guard
-
-## 3-tier IAM separation
-
-| Tier | Group/Principal | Verb | Scope |
-|------|----------------|------|-------|
-| Audit | `<oke-auditors>` | read | `<prod-compartment>` |
-| Operator | `<oke-operators>` | read + use devops | `<prod-compartment>` |
-| Admin | `<oke-admins>` | use cluster + manage node-pools | `<prod-compartment>` |
-| Pipeline | `<devops-pipeline-runners>` (dynamic group) | use cluster + manage node-pools | `<prod-compartment>` |
-
-## OKE cluster read (no deploy rights)
-
-```
-Allow group <oke-auditors> to read clusters in compartment <prod-compartment>
-Allow group <oke-auditors> to read cluster-node-pools in compartment <prod-compartment>
-```
-
-## DevOps pipeline read + deployment use
-
-```
-Allow group <oke-operators> to read devops-pipelines in compartment <prod-compartment>
-Allow group <oke-operators> to read devops-deployments in compartment <prod-compartment>
-Allow group <oke-operators> to use devops-deployments in compartment <prod-compartment>
-```
-
-## OKE admin (use, NOT manage — cannot delete clusters)
-
-```
-Allow group <oke-admins> to use clusters in compartment <prod-compartment>
-Allow group <oke-admins> to manage cluster-node-pools in compartment <prod-compartment>
-```
-
-## DevOps pipeline dynamic group
-
-```
-Allow dynamic-group <devops-pipeline-runners> to use cluster in compartment <prod-compartment>
-Allow dynamic-group <devops-pipeline-runners> to manage cluster-node-pools in compartment <prod-compartment>
-```
-
-`use cluster` (not `manage cluster`) for the pipeline: `manage` grants cluster termination rights.
-
-## Service-principal policies (required for OKE and DevOps services)
-
-```
-Allow service OKE to manage cluster-node-pools in compartment <prod-compartment>
-Allow service OKE to use virtual-network-family in compartment <prod-compartment>
-Allow service OKE to manage instance-family in compartment <prod-compartment>
-  where target.resource.tag.Operations.OkeManaged.value = 'true'
-
-Allow service devops to use ons-topics in compartment <prod-compartment>
-Allow service devops to manage repos in compartment <prod-compartment>
-Allow service devops to read secret-family in compartment <prod-compartment>
-```
-
-The `OkeManaged = 'true'` tag prevents the OKE service principal from acting on
-instances outside of managed node pools.
-
-## Do not use
-
-```
-# FORBIDDEN
-Allow group <oke-operators> to manage clusters in compartment prod
-Allow dynamic-group <all-instances> to manage all-resources in compartment prod
-```
-
-## Kubernetes RBAC (in-cluster, namespace-scoped)
-
-```yaml
-rules:
-- apiGroups: ["apps"]
-  resources: ["deployments", "replicasets"]
-  verbs: ["get", "list", "watch", "patch", "update"]
-- apiGroups: [""]
-  resources: ["pods", "pods/log", "services"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["policy"]
-  resources: ["poddisruptionbudgets"]
-  verbs: ["get", "list"]
-```

package/skills/oci/oci-live-oke-rollout-guard/references/preflight-commands.md

@@ -1,55 +0,0 @@
-# Preflight Commands: OCI Live OKE Rollout Guard
-
-Run these before any OKE rollout mutation. Paste sanitized output as evidence.
-
-## 1. Confirm identity and compartment target
-
-```bash
-oci iam region-subscription list
-oci ce cluster list \
-  --compartment-id <COMPARTMENT_OCID> \
-  --query "data[].{name:name,id:id,lifecycleState:\"lifecycle-state\",kubernetesVersion:\"kubernetes-version\"}"
-```
-
-## 2. Get cluster kubeconfig
-
-```bash
-oci ce cluster create-kubeconfig \
-  --cluster-id <CLUSTER_OCID> \
-  --file ~/.kube/config \
-  --region <REGION> \
-  --token-version 2.0.0
-kubectl config current-context
-```
-
-## 3. Check node pool health
-
-```bash
-oci ce node-pool list \
-  --cluster-id <CLUSTER_OCID> \
-  --compartment-id <COMPARTMENT_OCID> \
-  --query "data[].{name:name,id:id,lifecycleState:\"lifecycle-state\",quantityPerSubnet:\"quantity-per-subnet\"}"
-kubectl get nodes -o wide
-```
-
-## 4. Check PodDisruptionBudgets
-
-```bash
-kubectl get pdb -n <NAMESPACE> -o wide
-```
-
-## 5. Check current deployment rollout status
-
-```bash
-kubectl rollout status deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
-kubectl get deployment <DEPLOYMENT_NAME> -n <NAMESPACE> \
-  -o jsonpath='{.spec.strategy.rollingUpdate}'
-```
-
-## 6. Verify DevOps pipeline approval stage is configured
-
-```bash
-oci devops deployment-pipeline list \
-  --project-id <PROJECT_OCID> \
-  --query "data[].{displayName:\"display-name\",id:id,lifecycleState:\"lifecycle-state\"}"
-```

package/skills/oci/oci-live-oke-rollout-guard/references/rollback-playbook.md

@@ -1,45 +0,0 @@
-# Rollback Playbook: OCI Live OKE Rollout Guard
-
-## Rollback a Kubernetes deployment to the previous revision
-
-```bash
-# Pause rollout immediately
-kubectl rollout pause deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
-
-# Check rollout history
-kubectl rollout history deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
-
-# Undo to previous revision
-kubectl rollout undo deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
-
-# Or undo to a specific revision
-kubectl rollout undo deployment/<DEPLOYMENT_NAME> -n <NAMESPACE> --to-revision=<N>
-
-# Verify
-kubectl rollout status deployment/<DEPLOYMENT_NAME> -n <NAMESPACE>
-```
-
-## Cancel an in-flight DevOps pipeline deployment
-
-```bash
-oci devops deployment list \
-  --deployment-pipeline-id <PIPELINE_OCID> \
-  --query "data[?\"lifecycle-state\"=='IN_PROGRESS'].{id:id,displayName:\"display-name\"}"
-
-oci devops deployment cancel --deployment-id <DEPLOYMENT_OCID> --force
-```
-
-## Rollback a node pool version upgrade
-
-```bash
-oci ce node-pool update \
-  --node-pool-id <NODE_POOL_OCID> \
-  --kubernetes-version <PREVIOUS_VERSION>
-```
-
-## Rollback limitations
-
-- `kubectl rollout undo` reverts the pod template spec only — does not revert ConfigMaps, Secrets, or database schema migrations.
-- DevOps pipeline deployment cancellation stops future stages but does not undo already-applied Kubernetes resources.
-- Node pool version downgrade is not supported by OCI — you can only go to an equal or newer Kubernetes version.
-- If the cluster upgrade (control plane version) was applied, it cannot be rolled back.

package/skills/oci/oci-live-resource-manager-stack-guard/references/permission-model.md

@@ -1,70 +0,0 @@
-# Permission Model: OCI Live Resource Manager Stack Guard
-
-## OCI verb hierarchy reminder
-
-`inspect` ⊂ `read` ⊂ `use` ⊂ `manage`
-
-## 3-tier separation
-
-| Tier | Group | Verb | Scope |
-|------|-------|------|-------|
-| Auditor | `<rms-auditors>` | inspect / read | `<prod-compartment>` |
-| Planner | `<rms-planners>` | use | `<prod-compartment>` |
-| Operator | `<rms-operators>` | manage | `<prod-compartment>` |
-
-## Baseline read policy (auditors — no mutation)
-
-```
-Allow group <rms-auditors> to inspect orm-stacks in compartment <prod-compartment>
-Allow group <rms-auditors> to read orm-stacks in compartment <prod-compartment>
-Allow group <rms-auditors> to inspect orm-jobs in compartment <prod-compartment>
-Allow group <rms-auditors> to read orm-jobs in compartment <prod-compartment>
-```
-
-## Plan-only policy (create plan jobs, cannot apply or destroy)
-
-```
-Allow group <rms-planners> to use orm-stacks in compartment <prod-compartment>
-Allow group <rms-planners> to use orm-jobs in compartment <prod-compartment>
-```
-
-## Full operator policy (apply + destroy — gate with approval workflow)
-
-```
-Allow group <rms-operators> to manage orm-stacks in compartment <prod-compartment>
-Allow group <rms-operators> to manage orm-jobs in compartment <prod-compartment>
-```
-
-## Dynamic group for CI/CD instance principal
-
-```
-Any {instance.compartment.id = '<compartment_ocid>', tag.Operations.Role.value = 'rms-runner'}
-
-Allow dynamic-group <rms-runners> to manage orm-stacks in compartment <prod-compartment>
-Allow dynamic-group <rms-runners> to manage orm-jobs in compartment <prod-compartment>
-```
-
-## Service-principal policies (Resource Manager service itself)
-
-```
-Allow service ResourceManager to manage orm-stacks in compartment <prod-compartment>
-Allow service ResourceManager to read secret-family in compartment <prod-compartment>
-Allow service ResourceManager to use tag-namespaces in tenancy
-```
-
-Add resource-type rights for whatever the stack provisions, e.g.
-`Allow service ResourceManager to manage instance-family in compartment <X>`.
-Do not grant `manage all-resources` even to the service principal.
-
-## Platform concurrency note
-
-OCI Resource Manager allows only one running job at a time per stack.
-This is platform-enforced — no additional concurrency control is needed.
-
-## Do not use
-
-```
-# FORBIDDEN
-Allow any-user to manage all-resources in tenancy
-Allow group <rms-operators> to manage all-resources in compartment prod
-```