@raishin/vanguard-frontier-agentic 2.8.0 → 2.9.0

package/skills/aws/aws-s3-data-perimeter-governor/references/safety-checklist.md

@@ -5,10 +5,10 @@ Use this reference before privileged, destructive, traffic-changing, cost-changi
 ## Non-negotiables
 
 - Never ask users to paste secrets, access keys, session tokens, private keys, customer identifiers, or sensitive account data into chat.
-- Prefer official AWS MCP tools when exposed by the active runtime. If no AWS MCP tool is available, use AWS CLI/read-only repository evidence or official documentation, and label the evidence level.
+- Use read-only AWS MCP or read-only AWS CLI evidence for live state when available; otherwise use repository evidence, sanitized user evidence, or official documentation and label the evidence level.
 - Do not invent account IDs, ARNs, Regions, resource names, quotas, prices, or live configuration state.
 - Require explicit user approval before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting actions.
-- Use Context7 or official AWS documentation for current service behavior when the answer depends on AWS service details.
+- Use current official AWS documentation for service behavior when the answer depends on AWS service details.
 - Keep remediation least-privilege, reversible, and scoped to the requested workload or account boundary.
 
 ## Stress checks

package/skills/aws/aws-s3-data-perimeter-governor/references/workflow-and-output.md

@@ -19,7 +19,7 @@ Check these areas before giving a verdict:
    - Required outcome:
    - Explicit non-goals:
 2. **Collect evidence**
-   - Prefer live AWS MCP read-only evidence if available.
+   - Prefer read-only AWS MCP or read-only AWS CLI evidence for current-state claims when available.
    - Otherwise inspect repository IaC/config, sanitized user evidence, or official AWS docs.
    - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
 3. **Stress-test risk**

package/skills/aws/aws-security-posture-hardening/SKILL.md

@@ -4,8 +4,8 @@ description: Review broad AWS security posture across Security Hub CSPM, GuardDu
 allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
-  version: "0.1.2"
-  updated: "2026-05-05"
+  version: "0.1.4"
+  updated: "2026-06-02"
   category: security
 ---
 
@@ -26,7 +26,7 @@ Use this skill for:
 
 ## Lean operating rules
 
-- Prefer `AwsDocumentationMcpServer` when available via `uvx awslabs.aws-documentation-mcp-server@latest`; if `uvx` cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
+- Prefer current AWS documentation tools for service behavior. Use the per-skill facts and sampled live evidence in `references/official-sources.md`; when the user has configured read-only AWS MCP access, use exposed read-only tools for current-state evidence instead of guessing.
 - Separate confirmed facts from inference. If state was not queried or shown, say so.
 - Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
 - Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
@@ -39,6 +39,7 @@ Load these only when needed:
 - [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
 - [Safety checklist](references/safety-checklist.md) — use before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting recommendations.
 - [Official sources](references/official-sources.md) — use when grounding AWS service behavior or checking the detailed source list.
+- [Security Posture Prioritization Guide](references/security-posture-prioritization.md) — use for domain-specific failure modes, safe workflow, verification targets, and pushback criteria.
 
 ## Response minimum
 

package/skills/aws/aws-security-posture-hardening/metadata.json

@@ -14,14 +14,14 @@
   "summary": "Harden AWS security posture across Security Hub CSPM, GuardDuty, Inspector, Macie, Config, IAM, logging, encryption, public exposure, and remediation workflow.",
   "source_type": "original",
   "official_docs": [
-    "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-v2-recommendations.html",
-    "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html",
-    "https://docs.aws.amazon.com/securityhub/latest/userguide/enable-standards.html",
-    "https://docs.aws.amazon.com/securityhub/latest/userguide/guardduty-controls.html"
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub-v2.html",
+    "https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html",
+    "https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html"
   ],
   "security_notes": "Do not treat a green dashboard as proof of security. Verify service coverage, Regions, delegated admin, Config recording, suppressions, public exposure, and remediation evidence.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-security-posture-hardening",
   "author": "github: Raishin",
-  "version": "0.1.2"
+  "version": "0.1.4"
 }

package/skills/aws/aws-security-posture-hardening/references/official-sources.md

@@ -5,11 +5,25 @@ Use this reference only when you need source grounding for AWS service behavior
 ## AWS documentation
 
 Use these as starting points, not as proof of the user's live AWS state:
-- https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-v2-recommendations.html
-- https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html
-- https://docs.aws.amazon.com/securityhub/latest/userguide/enable-standards.html
-- https://docs.aws.amazon.com/securityhub/latest/userguide/guardduty-controls.html
+- https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub-v2.html
+- https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html
+- https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html
+- https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html
 
 ## Grounding rule
 
-Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, or operational state. Prefer live AWS MCP/CLI evidence or sanitized user-provided evidence for current-state claims.
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, entitlement, or operational state. Prefer read-only AWS MCP or CLI evidence, repository evidence, or sanitized user-provided evidence for current-state claims.
+
+## Current MCP/documentation refresh (2026-06-02)
+
+Service facts from official docs:
+- Security Hub unifies cloud security signals, exposure detection, automated response paths, and third-party integrations.
+- IAM Access Analyzer can identify external/internal access, unused IAM access, validate policies, and generate policies from CloudTrail activity.
+
+Sampled live evidence:
+- Read-only regional availability sampling reported Security Hub and GuardDuty as `isAvailableIn` in `us-east-1`, `us-west-2`, `eu-west-1`, and `ap-southeast-1`.
+- Sampled APIs `SecurityHub+GetFindings`, `GuardDuty+ListDetectors`, and `AccessAnalyzer+ListFindings` were reported `isAvailableIn` in those regions.
+
+Review implications:
+- Hardening requires enabled-service coverage, org aggregation, finding severity/age, exceptions, IAM exposure, public access, encryption/logging gaps, and remediation ownership.
+- Security tool availability does not prove detectors are enabled, findings are triaged, or controls are enforced.

package/skills/aws/aws-security-posture-hardening/references/safety-checklist.md

@@ -5,10 +5,10 @@ Use this reference before privileged, destructive, traffic-changing, cost-changi
 ## Non-negotiables
 
 - Never ask users to paste secrets, access keys, session tokens, private keys, customer identifiers, or sensitive account data into chat.
-- Prefer official AWS MCP tools when exposed by the active runtime. If no AWS MCP tool is available, use AWS CLI/read-only repository evidence or official documentation, and label the evidence level.
+- Use read-only AWS MCP or read-only AWS CLI evidence for live state when available; otherwise use repository evidence, sanitized user evidence, or official documentation and label the evidence level.
 - Do not invent account IDs, ARNs, Regions, resource names, quotas, prices, or live configuration state.
 - Require explicit user approval before privileged, destructive, traffic-changing, cost-changing, or production-impacting actions.
-- Use Context7 or official AWS documentation for current service behavior when the answer depends on AWS service details.
+- Use current official AWS documentation for service behavior when the answer depends on AWS service details.
 - Keep remediation least-privilege, reversible, and scoped to the requested workload or account boundary.
 
 ## Stress checks

package/skills/aws/aws-security-posture-hardening/references/security-posture-prioritization.md

@@ -0,0 +1,59 @@
+# Security Posture Prioritization Guide
+
+Use this reference when prioritizing AWS Security Hub CSPM, GuardDuty, Inspector, Macie, Config, CloudTrail, IAM, public exposure, vulnerability, and compliance posture findings.
+
+## What people get wrong
+
+The lazy story is:
+
+> Sort Security Hub findings by severity and fix the highs first.
+
+Wrong. Finding severity is an input, not a priority model. Real risk depends on exploitability, exposure, asset criticality, compensating controls, account scope, and remediation blast radius.
+
+Common bad assumptions:
+
+- Security Hub enabled means all relevant controls are covered.
+- GuardDuty finding absence means no threat activity.
+- Inspector vulnerability severity equals business priority.
+- Public exposure findings are all equally urgent.
+- CloudTrail configured in one account/Region proves audit coverage.
+- Auto-remediation is safe for posture hardening.
+
+## Security-posture failure modes
+
+- Delegated administrator and organization coverage miss member accounts or Regions.
+- Security Hub standards are enabled but findings are suppressed, stale, or unowned.
+- GuardDuty, Inspector, Macie, Config, or CloudTrail are partially deployed or not routed to responders.
+- IAM findings are remediated with broad deny/allow changes that break workloads.
+- Public S3, security group, ALB, API Gateway, or CloudFront exposure lacks data classification context.
+- Remediation deletes evidence, disables logging, rotates secrets without consumers, or changes KMS policies unsafely.
+
+## Minimum safe workflow
+
+1. Confirm organization/account/Region scope and which services are actually enabled.
+2. Normalize findings by resource, owner, business criticality, exposure path, data sensitivity, and active threat evidence.
+3. Separate detection gaps from resource misconfigurations and vulnerability remediation.
+4. Prioritize by risk: internet exposure plus sensitive data, identity escalation, logging gaps, exploitable vulnerabilities, and active GuardDuty signals.
+5. Recommend least-privilege, reversible remediation with validation and rollback notes.
+6. Track exceptions, suppressions, compensating controls, and due dates explicitly.
+7. Do not execute auto-remediation from this review skill.
+
+## Verification targets
+
+- Security Hub/CSPM standards, finding workflow status, suppression rules, and delegated admin/account coverage
+- GuardDuty detectors, findings, malware protection, trusted/threat lists, and alert routing
+- Inspector coverage for EC2/ECR/Lambda and vulnerable package/resource context
+- Macie jobs/classification findings for sensitive data exposure
+- Config recorders, conformance packs, aggregators, and CloudTrail organization trails/log integrity
+- IAM Access Analyzer, public access findings, security group exposure, S3 Block Public Access, KMS key policy, and secret rotation evidence
+
+## When to push back
+
+Push back if the user asks to:
+
+- treat compliance score as actual security risk
+- suppress findings without owner, reason, expiry, and compensating control
+- run broad auto-remediation on production resources
+- widen IAM/network access to clear a finding
+- claim organization coverage from a single account sample
+- remove logs/evidence while remediating

package/skills/aws/aws-security-posture-hardening/references/workflow-and-output.md

@@ -19,7 +19,7 @@ Check these areas before giving a verdict:
    - Required outcome:
    - Explicit non-goals:
 2. **Collect evidence**
-   - Prefer live AWS MCP read-only evidence if available.
+   - Prefer read-only AWS MCP or read-only AWS CLI evidence for current-state claims when available.
    - Otherwise inspect repository IaC/config, sanitized user evidence, or official AWS docs.
    - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
 3. **Stress-test risk**

package/skills/aws/aws-serverless-production-readiness/SKILL.md

@@ -4,8 +4,8 @@ description: Review AWS Lambda-centered serverless workloads for production read
 allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
-  version: "0.1.2"
-  updated: "2026-05-05"
+  version: "0.1.4"
+  updated: "2026-06-02"
   category: platform
 ---
 
@@ -26,7 +26,7 @@ Use this skill for:
 
 ## Lean operating rules
 
-- Prefer `AwsDocumentationMcpServer` when available via `uvx awslabs.aws-documentation-mcp-server@latest`; if `uvx` cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
+- Prefer current AWS documentation tools for service behavior. Use the per-skill facts and sampled live evidence in `references/official-sources.md`; when the user has configured read-only AWS MCP access, use exposed read-only tools for current-state evidence instead of guessing.
 - Separate confirmed facts from inference. If state was not queried or shown, say so.
 - Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
 - Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
@@ -39,6 +39,7 @@ Load these only when needed:
 - [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
 - [Safety checklist](references/safety-checklist.md) — use before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting recommendations.
 - [Official sources](references/official-sources.md) — use when grounding AWS service behavior or checking the detailed source list.
+- [Lambda Event Production Readiness Guide](references/lambda-event-production-readiness.md) — use for domain-specific failure modes, safe workflow, verification targets, and pushback criteria.
 
 ## Response minimum
 

package/skills/aws/aws-serverless-production-readiness/metadata.json

@@ -14,14 +14,14 @@
   "summary": "Review AWS Lambda and serverless workloads for IAM, concurrency, event sources, retries, DLQs, observability, secrets, performance, cost, and rollback readiness.",
   "source_type": "original",
   "official_docs": [
+    "https://docs.aws.amazon.com/lambda/latest/dg/durable-execution-sdk-retries.html",
+    "https://docs.aws.amazon.com/lambda/latest/dg/governance-observability.html",
     "https://docs.aws.amazon.com/lambda/latest/dg/best-practices.html",
-    "https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html",
-    "https://docs.aws.amazon.com/lambda/latest/operatorguide/monitoring-observability.html",
-    "https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics.html"
+    "https://docs.aws.amazon.com/serverless/latest/devguide/serverless-samples.html"
   ],
   "security_notes": "Do not approve serverless workloads that lack least-privilege execution roles, retry/DLQ semantics, concurrency controls, observability, idempotency, and rollback evidence.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-serverless-production-readiness",
   "author": "github: Raishin",
-  "version": "0.1.2"
+  "version": "0.1.4"
 }

package/skills/aws/aws-serverless-production-readiness/references/lambda-event-production-readiness.md

@@ -0,0 +1,59 @@
+# Lambda Event Production Readiness Guide
+
+Use this reference for production readiness reviews of Lambda-centered serverless workloads, event source mappings, retries, DLQs/destinations, concurrency, idempotency, observability, API Gateway, EventBridge, SQS/SNS, Step Functions, and DynamoDB stream integrations.
+
+## What people get wrong
+
+The lazy story is:
+
+> Lambda scales and retries automatically, so production readiness is mostly IAM and monitoring.
+
+Wrong. Serverless failures come from event semantics: duplicate delivery, poison messages, hot partitions, retry amplification, timeout mismatch, concurrency starvation, and silent data loss.
+
+Common bad assumptions:
+
+- At-least-once delivery can be ignored if the function is fast.
+- DLQ presence proves recoverability.
+- Reserved concurrency is only a cost control.
+- API Gateway timeout and Lambda timeout can be tuned independently without user impact.
+- EventBridge/SNS/SQS retries are harmless.
+- CloudWatch logs are enough observability.
+
+## Serverless failure modes
+
+- Non-idempotent handlers double-charge, duplicate writes, or corrupt state during retry.
+- SQS visibility timeout, batch size, partial batch response, and function timeout are inconsistent.
+- Async Lambda destinations or DLQs are absent, unmonitored, or unreadable by responders.
+- Reserved/provisioned concurrency starves critical functions or allows noisy neighbors to dominate.
+- EventBridge rule pattern is too broad, causing fanout storms or unexpected consumers.
+- Step Functions retry/catch hides failed business states or creates unbounded downstream calls.
+
+## Minimum safe workflow
+
+1. Map every trigger, event schema, retry policy, destination, DLQ, and downstream dependency.
+2. Confirm idempotency key, deduplication behavior, ordering needs, and poison-message handling.
+3. Check timeout and concurrency alignment across API Gateway, Lambda, SQS visibility, Step Functions, and downstream services.
+4. Verify observability: RED/USE metrics, structured logs, traces, alarms, DLQ depth, throttles, iterator age, and business KPIs.
+5. Review deployment safety: versions, aliases, CodeDeploy/SAM traffic shifting, rollback alarms, and previous version target.
+6. Identify cost and quota risks: concurrency, payload size, retention, logs, retries, and downstream throttling.
+7. Return readiness gaps with evidence level and approval-gated remediation.
+
+## Verification targets
+
+- Lambda timeout, memory, ephemeral storage, architecture, environment, layers, versions, aliases, and concurrency settings
+- event source mapping: batch size, max batching window, filters, partial batch response, enabled state, and starting position
+- SQS/SNS/EventBridge retry, DLQ, destination, archive/replay, and fanout configuration
+- Step Functions state machine retries, catches, timeouts, task tokens, and compensation paths
+- IAM execution role, resource policies, KMS, VPC config, and secrets access
+- CloudWatch metrics/alarms for Errors, Throttles, Duration, IteratorAge, ConcurrentExecutions, DLQ depth, and custom business metrics
+
+## When to push back
+
+Push back if the user asks to:
+
+- declare production-ready without idempotency and retry evidence
+- remove DLQs or alarms to simplify deployment
+- raise concurrency limits without downstream capacity proof
+- ignore duplicate/out-of-order event handling
+- log raw event payloads containing sensitive data
+- deploy alias/version changes without rollback target and alarms

package/skills/aws/aws-serverless-production-readiness/references/official-sources.md

@@ -5,11 +5,25 @@ Use this reference only when you need source grounding for AWS service behavior
 ## AWS documentation
 
 Use these as starting points, not as proof of the user's live AWS state:
+- https://docs.aws.amazon.com/lambda/latest/dg/durable-execution-sdk-retries.html
+- https://docs.aws.amazon.com/lambda/latest/dg/governance-observability.html
 - https://docs.aws.amazon.com/lambda/latest/dg/best-practices.html
-- https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html
-- https://docs.aws.amazon.com/lambda/latest/operatorguide/monitoring-observability.html
-- https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics.html
+- https://docs.aws.amazon.com/serverless/latest/devguide/serverless-samples.html
 
 ## Grounding rule
 
-Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, or operational state. Prefer live AWS MCP/CLI evidence or sanitized user-provided evidence for current-state claims.
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, entitlement, or operational state. Prefer read-only AWS MCP or CLI evidence, repository evidence, or sanitized user-provided evidence for current-state claims.
+
+## Current MCP/documentation refresh (2026-06-02)
+
+Service facts from official docs:
+- Lambda durable function retry guidance covers step retries, invocation retries, backend retries, exponential backoff, CloudWatch monitoring, and retry best practices.
+- Lambda governance/observability guidance covers visibility into configurations, compliance, function boundaries through Security Hub CSPM, dashboards, tagging, and owner outreach.
+
+Sampled live evidence:
+- Read-only regional availability sampling reported Lambda, API Gateway, and Step Functions as `isAvailableIn` in `us-east-1`, `us-west-2`, `eu-west-1`, and `ap-southeast-1`.
+- Sampled APIs `Lambda+GetFunction` and `SFN+DescribeStateMachine` were reported `isAvailableIn` in those regions.
+
+Review implications:
+- Production readiness requires concurrency, timeout/memory, retry/DLQ/destination behavior, idempotency, observability, IAM, secrets, deployment/rollback, cost guardrails, and failure-mode tests.
+- Serverless service availability does not prove workload readiness or correct event-source semantics.

package/skills/aws/aws-serverless-production-readiness/references/safety-checklist.md

@@ -5,10 +5,10 @@ Use this reference before privileged, destructive, traffic-changing, cost-changi
 ## Non-negotiables
 
 - Never ask users to paste secrets, access keys, session tokens, private keys, customer identifiers, or sensitive account data into chat.
-- Prefer official AWS MCP tools when exposed by the active runtime. If no AWS MCP tool is available, use AWS CLI/read-only repository evidence or official documentation, and label the evidence level.
+- Use read-only AWS MCP or read-only AWS CLI evidence for live state when available; otherwise use repository evidence, sanitized user evidence, or official documentation and label the evidence level.
 - Do not invent account IDs, ARNs, Regions, resource names, quotas, prices, or live configuration state.
 - Require explicit user approval before privileged, destructive, traffic-changing, cost-changing, or production-impacting actions.
-- Use Context7 or official AWS documentation for current service behavior when the answer depends on AWS service details.
+- Use current official AWS documentation for service behavior when the answer depends on AWS service details.
 - Keep remediation least-privilege, reversible, and scoped to the requested workload or account boundary.
 
 ## Stress checks

package/skills/aws/aws-serverless-production-readiness/references/workflow-and-output.md

@@ -19,7 +19,7 @@ Check these areas before giving a verdict:
    - Required outcome:
    - Explicit non-goals:
 2. **Collect evidence**
-   - Prefer live AWS MCP read-only evidence if available.
+   - Prefer read-only AWS MCP or read-only AWS CLI evidence for current-state claims when available.
    - Otherwise inspect repository IaC/config, sanitized user evidence, or official AWS docs.
    - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
 3. **Stress-test risk**

package/skills/aws/aws-serverless-rollout-corrector/SKILL.md

@@ -4,8 +4,8 @@ description: Patch AWS serverless rollout definitions across Lambda, API Gateway
 allowed-tools: Read Edit Write MultiEdit Grep Glob
 metadata:
   author: "github: Raishin"
-  version: "0.1.0"
-  updated: "2026-05-05"
+  version: "0.1.2"
+  updated: "2026-06-02"
   category: delivery
 ---
 
@@ -25,7 +25,7 @@ Use this skill for:
 
 ## Lean operating rules
 
-- Prefer `AwsDocumentationMcpServer` when available via `uvx awslabs.aws-documentation-mcp-server@latest`; if `uvx` cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
+- Prefer current AWS documentation tools for service behavior. Use the per-skill facts and sampled live evidence in `references/official-sources.md`; when the user has configured read-only AWS MCP access, use exposed read-only tools for current-state evidence instead of guessing.
 - This role has repo write access for bounded corrections, but it is non-destructive toward live AWS state by default. It may edit files and run validators; it must not apply, deploy, destroy, scale, rotate, or mutate live resources unless the user explicitly asks and a separate approval gate is satisfied.
 - Separate confirmed facts from inference. If state was not queried or shown, say so.
 - Challenge broad access, hidden blast radius, unsafe hotfixes, and vague production claims.
@@ -39,6 +39,7 @@ Load these only when needed:
 - [Workflow and output contract](references/workflow-and-output.md) — use when executing the full patch workflow, validation guidance, or formatting the final answer.
 - [Safety checklist](references/safety-checklist.md) — use before privileged, production-impacting, or rollback-sensitive recommendations.
 - [Official sources](references/official-sources.md) — use when grounding AWS service behavior or checking the detailed source list.
+- [Lambda Rollout Correction Guide](references/lambda-rollout-correction.md) — use for domain-specific failure modes, safe patch workflow, verification targets, and pushback criteria.
 
 ## Response minimum
 

package/skills/aws/aws-serverless-rollout-corrector/metadata.json

@@ -14,13 +14,14 @@
   "summary": "Patch serverless deployment definitions, Lambda rollout settings, event wiring, and alias/version configuration in-repo while keeping live rollout actions out of scope by default.",
   "source_type": "original",
   "official_docs": [
+    "https://docs.aws.amazon.com/codedeploy/latest/userguide/welcome.html",
+    "https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-example.html",
     "https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html",
-    "https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html",
-    "https://docs.aws.amazon.com/lambda/latest/dg/best-practices.html"
+    "https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html"
   ],
   "security_notes": "Can edit serverless rollout definitions in repo files only. Must not invoke live deploys, traffic shifts, or destructive remediation without separate explicit approval.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-serverless-rollout-corrector",
   "author": "github: Raishin",
-  "version": "0.1.0"
+  "version": "0.1.2"
 }

package/skills/aws/aws-serverless-rollout-corrector/references/lambda-rollout-correction.md

@@ -0,0 +1,64 @@
+# Lambda Rollout Correction Guide
+
+Use this reference when fixing Lambda aliases, versions, CodeDeploy/SAM traffic shifting, event-source mappings, destinations, DLQs, or serverless rollout wiring in repository files.
+
+## What people get wrong
+
+The lazy story is:
+
+> It is just a Lambda config fix; update the template and redeploy.
+
+Wrong. Serverless rollout defects often hide in alias/version traffic, event-source semantics, retries, and alarms. A repo patch can make the next deployment worse if it ignores those boundaries.
+
+Common bad assumptions:
+
+- `$LATEST` is acceptable in production rollout wiring.
+- Alias changes are harmless because code is immutable.
+- Event-source mapping changes are not production-impacting.
+- CodeDeploy hooks are optional ceremony.
+- DLQ/destination changes do not affect audit or replay.
+- A SAM/AppSpec diff proves runtime rollback readiness.
+
+## Service-specific failure modes
+
+- Alias points to the wrong published version or shifts traffic to unvalidated code.
+- Provisioned concurrency is attached to the wrong alias/version.
+- CodeDeploy deployment preference lacks alarms or lifecycle validation hooks.
+- Event source mapping batch size, maximum batching window, filter criteria, or starting position changes replay/latency behavior.
+- SQS/Lambda partial batch response settings are missing or inconsistent.
+- Async destinations or DLQs are removed during a hotfix.
+- IAM permission changes break event-source polling, log writes, or downstream calls.
+
+## Minimum safe workflow
+
+1. Identify the rollout mechanism: SAM, CloudFormation, CDK, Terraform, Serverless Framework, or raw config.
+2. Identify the release primitive: Lambda version, alias, CodeDeploy deployment group, event source mapping, API stage, or EventBridge rule.
+3. Patch the smallest repo field that corrects the defect.
+4. Preserve existing rollback path: previous alias target, previous mapping config, previous deployment preference, or previous template version.
+5. Run local validators for the IaC/framework in use.
+6. State what the patch changes at runtime and what it does not execute.
+7. Require explicit approval before deploy, rollback, publish-version, alias update, or event-source mutation.
+
+## Verification targets
+
+Use repo and read-only evidence where available:
+
+- Lambda alias/version references in templates
+- CodeDeploy deployment preference, alarms, and lifecycle hooks
+- event-source mapping config: source ARN, batch size, filters, enabled state, destinations
+- function timeout, memory, reserved/provisioned concurrency
+- DLQ and async destination configuration
+- IAM permissions for invoke, poll, log, and downstream calls
+- validation commands such as `sam validate`, `cfn-lint`, `cdk synth`, `terraform validate`, or project tests
+
+## When to push back
+
+Push back if the user asks to:
+
+- patch rollout config and immediately deploy without approval
+- remove alarms/hooks to make a deployment pass
+- point production aliases at `$LATEST`
+- disable event-source mappings without a replay plan
+- “fix” retries by dropping failures silently
+- claim rollback is safe without a previous alias/version target
+

package/skills/aws/aws-serverless-rollout-corrector/references/official-sources.md

@@ -1,5 +1,29 @@
 # Official sources
 
+Use this reference only when you need source grounding for AWS service behavior or the detailed source list.
+
+## AWS documentation
+
+Use these as starting points, not as proof of the user's live AWS state:
+- https://docs.aws.amazon.com/codedeploy/latest/userguide/welcome.html
+- https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-example.html
 - https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html
 - https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html
-- https://docs.aws.amazon.com/lambda/latest/dg/best-practices.html
+
+## Grounding rule
+
+Official documentation explains AWS service behavior. It does not prove the user's current account, Region, quota, resource configuration, IAM boundary, pricing, entitlement, or operational state. Prefer read-only AWS MCP or CLI evidence, repository evidence, or sanitized user-provided evidence for current-state claims.
+
+## Current MCP/documentation refresh (2026-06-02)
+
+Service facts from official docs:
+- CodeDeploy can automate Lambda deployments with traffic shifting, AppSpec files, lifecycle hooks, and rollback behavior depending on deployment configuration.
+- Lambda versions and aliases are release-control primitives; aliases can route traffic to published versions while function code/config versions remain immutable.
+
+Sampled live evidence:
+- Read-only regional availability sampling reported Lambda, CodeDeploy, and CloudFormation as `isAvailableIn` in `us-east-1`, `us-west-2`, `eu-west-1`, and `ap-southeast-1`.
+- Sampled APIs `Lambda+GetFunction` and `CodeDeploy+GetDeployment` were reported `isAvailableIn` in those regions.
+
+Review implications:
+- Repo-side rollout correction must identify alias/version, traffic shift, lifecycle hook, alarm, and rollback target; it must not execute live rollback/deploy unless explicitly approved.
+- Syntax-correct SAM/AppSpec is not proof of safe rollout behavior.

package/skills/aws/aws-solution-architect/SKILL.md

@@ -4,8 +4,8 @@ description: Design and stress-test AWS cross-domain solution architectures when
 allowed-tools: Read Grep Glob
 metadata:
   author: "github: Raishin"
-  version: "0.1.2"
-  updated: "2026-05-05"
+  version: "0.1.4"
+  updated: "2026-06-02"
   category: platform
 ---
 
@@ -26,7 +26,7 @@ Use this skill for:
 
 ## Lean operating rules
 
-- Prefer `AwsDocumentationMcpServer` when available via `uvx awslabs.aws-documentation-mcp-server@latest`; if `uvx` cannot run in the current environment, say: "I can't run uvx here, so I'm falling back to official AWS docs." Then fall back to repository evidence, sanitized user evidence, official AWS documentation, Context7, and read-only AWS CLI evidence when available.
+- Prefer current AWS documentation tools for service behavior. Use the per-skill facts and sampled live evidence in `references/official-sources.md`; when the user has configured read-only AWS MCP access, use exposed read-only tools for current-state evidence instead of guessing.
 - Separate confirmed facts from inference. If state was not queried or shown, say so.
 - Challenge broad access, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
 - Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
@@ -39,6 +39,7 @@ Load these only when needed:
 - [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, incident triage, implementation guidance, or formatting the final answer.
 - [Safety checklist](references/safety-checklist.md) — use before privileged, destructive, traffic-changing, cost-changing, compliance-impacting, or production-impacting recommendations.
 - [Official sources](references/official-sources.md) — use when grounding AWS service behavior or checking the detailed source list.
+- [Architecture Decision Stress-Test Guide](references/architecture-decision-stress-test.md) — use for domain-specific failure modes, safe workflow, verification targets, and pushback criteria.
 
 ## Response minimum
 

package/skills/aws/aws-solution-architect/metadata.json

@@ -14,15 +14,14 @@
   "summary": "Design and stress-test AWS solution architectures across identity, networking, compute, data, security, resilience, operations, and cost with Well-Architected evidence discipline.",
   "source_type": "original",
   "official_docs": [
-    "https://docs.aws.amazon.com/wellarchitected/latest/framework/definitions.html",
     "https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html",
-    "https://docs.aws.amazon.com/wellarchitected/latest/framework/operational-excellence.html",
     "https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html",
-    "https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/welcome.html"
+    "https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/welcome.html",
+    "https://docs.aws.amazon.com/wellarchitected/latest/cost-optimization-pillar/welcome.html"
   ],
   "security_notes": "Do not approve an AWS architecture without account-boundary, IAM, network exposure, data protection, observability, recovery, and cost evidence. Label unknowns instead of pretending the diagram is proof.",
-  "last_verified": "2026-04-29",
+  "last_verified": "2026-06-02",
   "path": "skills/aws/aws-solution-architect",
   "author": "github: Raishin",
-  "version": "0.1.2"
+  "version": "0.1.4"
 }