@raishin/vanguard-frontier-agentic 2.9.0 → 2.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "2.9.0",
+  "version": "2.11.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -89,7 +89,7 @@
     "@semantic-release/release-notes-generator": "14.1.1",
     "conventional-changelog-conventionalcommits": "9.3.1",
     "fast-check": "^4.7.0",
-    "semantic-release": "25.0.3"
+    "semantic-release": "25.0.5"
   },
   "publishConfig": {
     "access": "public",

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.9.0",
+  "version": "2.11.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "Raishin",

package/powers/README.md

@@ -1,6 +1,6 @@
 # `powers/` — Kiro Powers
 
-This directory holds **34 Kiro Powers** for `vanguard-frontier-agentic`, one
+This directory holds **38 Kiro Powers** for `vanguard-frontier-agentic`, one
 per cloud/platform/IaC provider. Each Power is a directory containing a
 `POWER.md` file with strict-5 frontmatter and steering content.
 
@@ -17,6 +17,7 @@ powers/
 ├── vanguard-cert-manager/POWER.md
 ├── vanguard-cilium/POWER.md
 ├── vanguard-contabo/POWER.md
+├── vanguard-databricks/POWER.md
 ├── vanguard-dotnet/POWER.md
 ├── vanguard-falco/POWER.md
 ├── vanguard-finance/POWER.md
@@ -32,7 +33,9 @@ powers/
 ├── vanguard-kyverno/POWER.md
 ├── vanguard-legal/POWER.md
 ├── vanguard-marketing/POWER.md
+├── vanguard-microsoft/POWER.md
 ├── vanguard-multi-cloud/POWER.md
+├── vanguard-netsuite/POWER.md
 ├── vanguard-nvidia/POWER.md
 ├── vanguard-oci/POWER.md
 ├── vanguard-opentelemetry/POWER.md
@@ -41,6 +44,7 @@ powers/
 ├── vanguard-salesforce/POWER.md
 ├── vanguard-scaleway/POWER.md
 ├── vanguard-sigstore/POWER.md
+├── vanguard-snowflake/POWER.md
 └── vanguard-terraform/POWER.md
 ```
 
@@ -78,7 +82,7 @@ cd vanguard-frontier-agentic
 ## How to update
 
 ```bash
-# Regenerate the 34 Powers from catalog/agents.json + per-provider config:
+# Regenerate the 38 Powers from catalog/agents.json + per-provider config:
 npm run kiro-powers:write
 
 # Then verify everything is in sync:

package/powers/vanguard-accounting/POWER.md

@@ -1,13 +1,13 @@
 ---
 name: "vanguard-accounting"
 displayName: "Vanguard Frontier — Accounting"
-description: "Curated Accounting agents for accounting revenue recognition advisor, accounting close cycle advisor, accounting tax provision advisor, accounting lease accounting advisor. Routes via accounting-maestro-agent to specialist agents based on task scope. Static review only; no live mutations."
+description: "Curated Accounting agents for accounting business combinations advisor, accounting close cycle advisor, accounting consolidation intercompany advisor, accounting equity compensation advisor. Routes via accounting-maestro-agent to specialist agents based on task scope. Static review only; no live mutations."
 keywords: ["accounting", "static-review", "configuration-audit", "best-practices"]
 author: "Raishin"
 ---
 # Vanguard Frontier — Accounting
 
-Curated Accounting agents for accounting revenue recognition advisor, accounting close cycle advisor, accounting tax provision advisor, accounting lease accounting advisor. Routes via accounting-maestro-agent to specialist agents based on task scope. Static review only; no live mutations.
+Curated Accounting agents for accounting business combinations advisor, accounting close cycle advisor, accounting consolidation intercompany advisor, accounting equity compensation advisor. Routes via accounting-maestro-agent to specialist agents based on task scope. Static review only; no live mutations.
 
 ## When to engage this Power
 

package/powers/vanguard-databricks/POWER.md

@@ -0,0 +1,42 @@
+---
+name: "vanguard-databricks"
+displayName: "Vanguard Frontier — Databricks (Azure)"
+description: "Curated Azure Databricks agents for Unity Catalog governance and lakehouse engineering — static review only, no workspace or production mutations. Covers Unity Catalog securables and schema-scoped least-privilege grants, identity federation and account groups, account/workspace/metastore admin separation, run-production-as-service-principal, Entra ID managed identities, Access Connector + ADLS Gen2 external locations, cluster policies, and audit logs. Databricks and Azure surfaces are drift-prone; agents always verify against current Databricks and Microsoft Learn documentation before rendering findings."
+keywords: ["databricks", "azure", "unity-catalog", "lakehouse", "least-privilege", "data-engineering", "static-review"]
+author: "Raishin"
+---
+# Vanguard Frontier — Databricks (Azure)
+
+Curated Azure Databricks agents for Unity Catalog governance and lakehouse engineering — static review only, no workspace or production mutations. Covers Unity Catalog securables and schema-scoped least-privilege grants, identity federation and account groups, account/workspace/metastore admin separation, run-production-as-service-principal, Entra ID managed identities, Access Connector + ADLS Gen2 external locations, cluster policies, and audit logs. Databricks and Azure surfaces are drift-prone; agents always verify against current Databricks and Microsoft Learn documentation before rendering findings.
+
+## When to engage this Power
+
+Activate when the task references Databricks (Azure) services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- *(no maestro for this provider; reference agents directly under `agents/databricks/`)*
+
+Reference agents directly from agents/databricks/ without maestro-based routing.
+
+## Live-guard agents (gate_mode only)
+
+- `databricks-live-unity-catalog-grant-guard-at-azure-agent` — never auto-dispatched; gate_mode only
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Static review only — agents never request workspace tokens, service-principal secrets, storage keys, or customer data, and never mutate a Databricks workspace, Unity Catalog, or Azure resource.
+- Enforce least privilege: schema-scoped grants (CREATE TABLE/VOLUME/FUNCTION at schema level), no broad ALL PRIVILEGES, assign access to account groups not individuals, separate account/workspace/metastore admin roles.
+- Prefer Azure managed identities over service principals for storage access; production data is operated by service principals, not interactive users.
+- Production grant/role/policy/cluster changes are live-guard gated — never auto-dispatched; require explicit approval, scope confirmation, and rollback plan.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/databricks/` in that repository. All 3 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider databricks --repo .`

package/powers/vanguard-finance/POWER.md

@@ -1,13 +1,13 @@
 ---
 name: "vanguard-finance"
 displayName: "Vanguard Frontier — Finance"
-description: "Curated Finance agents for finance variance analysis advisor, finance treasury liquidity advisor, finance capital allocation advisor, finance transfer pricing pillar two advisor. Routes via finance-maestro-agent to specialist agents based on task scope. Static review only; no live mutations."
+description: "Curated Finance agents for finance capital allocation advisor, finance debt capital structure advisor, finance fpa forecasting advisor, finance transfer pricing pillar two advisor. Routes via finance-maestro-agent to specialist agents based on task scope. Static review only; no live mutations."
 keywords: ["finance", "static-review", "configuration-audit", "best-practices"]
 author: "Raishin"
 ---
 # Vanguard Frontier — Finance
 
-Curated Finance agents for finance variance analysis advisor, finance treasury liquidity advisor, finance capital allocation advisor, finance transfer pricing pillar two advisor. Routes via finance-maestro-agent to specialist agents based on task scope. Static review only; no live mutations.
+Curated Finance agents for finance capital allocation advisor, finance debt capital structure advisor, finance fpa forecasting advisor, finance transfer pricing pillar two advisor. Routes via finance-maestro-agent to specialist agents based on task scope. Static review only; no live mutations.
 
 ## When to engage this Power
 

package/powers/vanguard-microsoft/POWER.md

@@ -0,0 +1,45 @@
+---
+name: "vanguard-microsoft"
+displayName: "Vanguard Frontier — Microsoft"
+description: "Curated Microsoft 365 and Dynamics 365 agents for tenant governance, Entra identity and Conditional Access, Intune endpoints, Purview data security and compliance, Defender XDR, Teams/SharePoint/Exchange collaboration, Microsoft 365 Copilot readiness, Power Platform governance, and Dynamics 365 ERP/CRM (Finance, Supply Chain, Business Central, Sales, Customer Service, Field Service) — static review only, no tenant or production mutations. Routes via microsoft-maestro to M365, D365, Power Platform, and Copilot specialist agents. Microsoft licensing, certification, and API surfaces are drift-prone; agents always verify against current Microsoft Learn documentation before rendering findings."
+keywords: ["microsoft", "m365", "d365", "entra", "purview", "copilot", "power-platform", "static-review"]
+author: "Raishin"
+---
+# Vanguard Frontier — Microsoft
+
+Curated Microsoft 365 and Dynamics 365 agents for tenant governance, Entra identity and Conditional Access, Intune endpoints, Purview data security and compliance, Defender XDR, Teams/SharePoint/Exchange collaboration, Microsoft 365 Copilot readiness, Power Platform governance, and Dynamics 365 ERP/CRM (Finance, Supply Chain, Business Central, Sales, Customer Service, Field Service) — static review only, no tenant or production mutations. Routes via microsoft-maestro to M365, D365, Power Platform, and Copilot specialist agents. Microsoft licensing, certification, and API surfaces are drift-prone; agents always verify against current Microsoft Learn documentation before rendering findings.
+
+## When to engage this Power
+
+Activate when the task references Microsoft services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`copilot-governance-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- `d365-live-record-field-update-guard-agent` — never auto-dispatched; gate_mode only
+- `d365-live-security-role-guard-agent` — never auto-dispatched; gate_mode only
+- `m365-live-identity-posture-guard-agent` — never auto-dispatched; gate_mode only
+- `m365-live-sensitivity-label-apply-guard-agent` — never auto-dispatched; gate_mode only
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Static review only — agents never request tenant credentials, tokens, customer data, or PII, and never mutate a Microsoft 365 tenant or Dynamics 365 environment.
+- Apply Zero Trust by default: verify explicitly, least privilege (JIT/JEA), assume breach; confirm tenant, environment, and data classification before any recommendation.
+- Microsoft 365 Copilot and Copilot Studio configurations are adversarially reviewed for oversharing, ungrounded Graph exposure, and missing human-handoff controls before any approve decision.
+- Production-impacting actions (Conditional Access changes, D365 cutover, Power Platform prod deploy, MFA changes) are live-guard gated — never auto-dispatched; require explicit approval, scope confirmation, and rollback plan.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/microsoft/` in that repository. All 40 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider microsoft --repo .`

package/powers/vanguard-netsuite/POWER.md

@@ -0,0 +1,41 @@
+---
+name: "vanguard-netsuite"
+displayName: "Vanguard Frontier — Netsuite"
+description: "Curated Netsuite agents for netsuite administrator, netsuite ai connector mcp, netsuite ai foundations, netsuite application developer. Routes via netsuite-maestro-agent to specialist agents based on task scope. Static review only; no live mutations."
+keywords: ["netsuite", "static-review", "configuration-audit", "best-practices"]
+author: "Raishin"
+---
+# Vanguard Frontier — Netsuite
+
+Curated Netsuite agents for netsuite administrator, netsuite ai connector mcp, netsuite ai foundations, netsuite application developer. Routes via netsuite-maestro-agent to specialist agents based on task scope. Static review only; no live mutations.
+
+## When to engage this Power
+
+Activate when the task references Netsuite services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`netsuite-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- `netsuite-live-org-mutation-guard-agent` — never auto-dispatched; gate_mode only
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Live-guard agents (netsuite-live-*) must never be auto-dispatched; require explicit approval and rollback plan.
+- Route all tasks through netsuite-maestro-agent for proper classification and dispatch.
+- Static review only -- agents analyze configuration and provide findings without mutating live systems.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/netsuite/` in that repository. All 25 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider netsuite --repo .`

package/powers/vanguard-snowflake/POWER.md

@@ -0,0 +1,42 @@
+---
+name: "vanguard-snowflake"
+displayName: "Vanguard Frontier — Snowflake (Azure)"
+description: "Curated Snowflake-on-Azure agents for RBAC access governance and data-platform engineering — static review only, no account or production mutations. Covers role hierarchy and least privilege, ACCOUNTADMIN restriction, SECURITYADMIN/SYSADMIN separation of duties, future grants and managed-access schemas, network policies, key-pair/Entra OAuth/SSO/SCIM authentication, Azure Private Link and storage integration, and masking/row-access/tagging governance. Snowflake and Azure surfaces are drift-prone; agents always verify against current Snowflake and Microsoft Learn documentation before rendering findings."
+keywords: ["snowflake", "azure", "rbac", "least-privilege", "data-governance", "private-link", "static-review"]
+author: "Raishin"
+---
+# Vanguard Frontier — Snowflake (Azure)
+
+Curated Snowflake-on-Azure agents for RBAC access governance and data-platform engineering — static review only, no account or production mutations. Covers role hierarchy and least privilege, ACCOUNTADMIN restriction, SECURITYADMIN/SYSADMIN separation of duties, future grants and managed-access schemas, network policies, key-pair/Entra OAuth/SSO/SCIM authentication, Azure Private Link and storage integration, and masking/row-access/tagging governance. Snowflake and Azure surfaces are drift-prone; agents always verify against current Snowflake and Microsoft Learn documentation before rendering findings.
+
+## When to engage this Power
+
+Activate when the task references Snowflake (Azure) services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- *(no maestro for this provider; reference agents directly under `agents/snowflake/`)*
+
+Reference agents directly from agents/snowflake/ without maestro-based routing.
+
+## Live-guard agents (gate_mode only)
+
+- `snowflake-live-rbac-grant-guard-at-azure-agent` — never auto-dispatched; gate_mode only
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Static review only — agents never request account credentials, key-pair private keys, OAuth secrets, or customer data, and never mutate a Snowflake account or Azure resource.
+- Enforce least privilege: custom business-function roles under SYSADMIN, restrict ACCOUNTADMIN to a minimum of controlled users, never grant sensitive privileges to PUBLIC, separate SECURITYADMIN (grants) from SYSADMIN (objects).
+- Service accounts use key-pair or Entra OAuth (never passwords); enforce network policies and MFA for human users.
+- Production role/grant/policy/warehouse changes are live-guard gated — never auto-dispatched; require explicit approval, scope confirmation, and rollback plan.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/Raishin/vanguard-frontier-agentic) marketplace. For this provider, see `agents/snowflake/` in that repository. All 3 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add Raishin/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider snowflake --repo .`

package/schemas/agent.schema.json

@@ -54,8 +54,12 @@
         "hr",
         "legal",
         "salesforce",
+        "netsuite",
         "accounting",
-        "finance"
+        "finance",
+        "microsoft",
+        "databricks",
+        "snowflake"
       ]
     },
     "harnesses": {

package/schemas/mcp-reference.schema.json

@@ -42,7 +42,10 @@
         "kubernetes",
         "terraform",
         "multi-cloud",
-        "generic"
+        "generic",
+        "microsoft",
+        "databricks",
+        "snowflake"
       ]
     },
     "harnesses": {

package/schemas/rule.schema.json

@@ -37,7 +37,10 @@
         "kubernetes",
         "terraform",
         "multi-cloud",
-        "generic"
+        "generic",
+        "microsoft",
+        "databricks",
+        "snowflake"
       ]
     },
     "harnesses": {

package/schemas/skill.schema.json

@@ -46,7 +46,11 @@
         "dotnet",
         "hr",
         "legal",
-        "salesforce"
+        "salesforce",
+        "netsuite",
+        "microsoft",
+        "databricks",
+        "snowflake"
       ]
     },
     "harnesses": {