@raishin/vanguard-frontier-agentic 2.9.0 → 2.11.0

package/skills/microsoft/copilot-governance-maestro/references/workflow-and-output.md

@@ -0,0 +1,78 @@
+# Routing table and domain taxonomy
+
+Use this reference when classifying a task or selecting the right specialist(s).
+
+## Domain taxonomy
+
+| Domain | Keywords and signals |
+|---|---|
+| `copilot-readiness` | Copilot readiness, oversharing, SharePoint permissions, sensitivity labels, DSPM for AI, data access governance, restricted SharePoint search, restricted content discovery, Copilot exposure, Purview DLP for Copilot |
+| `graph-data-exposure` | Graph exposure, Graph API, Microsoft Graph, oversharing, SharePoint Advanced Management, SAM, site access review, broken inheritance, EEEU, Everyone except external users, site ownership, SharePoint governance |
+| `agent-governance` | Copilot Studio agent, agent governance, agent registry, Entra Agent ID, agent identity, connector permissions, agent publishing, agent lifecycle, ALM for agents, agent catalog, Teams app store approval |
+| `plugin-connector-risk` | plugin, connector, connector action, Advanced Connector Policies, ACP, DLP for agents, HTTP connector, skill connector, channel connector, connector scope, API permission, token, connector governance |
+| `copilot-studio-alm` | Copilot Studio ALM, agent environment, agent pipeline, dev environment, test environment, production agent, agent versioning, solution export, agent deployment, managed solution for agents |
+| `identity-access` | Conditional Access, Entra, MFA, identity, access policy, Zero Trust identity, JEA, JIT, privileged access, Entra agent identity, Conditional Access for agents |
+| `live-guard` | publish agent broadly, org-wide agent publishing, Teams app store publish, grant connector access, plugin access grant, requires human gate |
+
+## Full routing table
+
+### Copilot Readiness / Data Exposure
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `m365-copilot-readiness-data-exposure-governor` | copilot-readiness, graph-data-exposure | Assessing or remediating Copilot readiness: oversharing, data access governance reports, DSPM for AI, sensitivity labels, SharePoint Advanced Management, Purview DLP for Copilot |
+| `purview-data-security-compliance-officer` | copilot-readiness, graph-data-exposure | Applying Microsoft Purview capabilities for Copilot: DLP policies, sensitivity labels, DSPM for AI, compliance manager, data lifecycle, eDiscovery for Copilot interactions |
+
+### Agent Governance
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `copilot-studio-agent-governance-architect` | agent-governance, plugin-connector-risk, copilot-studio-alm | Designing or reviewing Copilot Studio agent governance: Entra Agent IDs, connector permissions, DLP for agents, advanced connector policies, agent lifecycle, publishing controls |
+| `purview-data-security-compliance-officer` | agent-governance | Applying Purview audit logs, compliance policies, and retention to Copilot Studio agents and interactions |
+
+### Plugin / Connector Risk
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `copilot-studio-agent-governance-architect` | plugin-connector-risk, agent-governance | Reviewing connector and plugin risk for Copilot Studio agents: ACP, DLP policy, connector scope, HTTP connector blocking, channel publishing restrictions |
+| `entra-identity-conditional-access-architect` | plugin-connector-risk, identity-access | Reviewing Entra Conditional Access policies targeting agent identities, connector resource policies, or token issuance conditions for agent connectors |
+
+### Copilot Studio ALM
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `copilot-studio-agent-governance-architect` | copilot-studio-alm, agent-governance | Designing or reviewing ALM for Copilot Studio agents: environment strategy, solution packaging, deployment pipelines, versioning, rollback |
+
+### Identity and Access
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `entra-identity-conditional-access-architect` | identity-access, agent-governance | Reviewing Entra identity and access policies for Copilot scenarios: Conditional Access, MFA, JEA, Entra Agent IDs, scope review |
+| `m365-copilot-readiness-data-exposure-governor` | identity-access, copilot-readiness | Reviewing JEA/JIT access scoping to prevent data oversharing through Copilot |
+
+### Live-guard (ALWAYS requires human gate)
+
+| Agent | Domain(s) | Use when… |
+|---|---|---|
+| `copilot-studio-agent-governance-architect` | live-guard, agent-governance | Publishing or broadly sharing a Copilot Studio agent (Teams app store, org-wide) — requires blast-radius assessment, rollback path, and explicit human confirmation |
+| `copilot-studio-agent-governance-architect` | live-guard, plugin-connector-risk | Granting connector or plugin access to a Copilot Studio agent — requires blast-radius assessment, rollback path, and explicit human confirmation |
+
+## Live-guard gate protocol
+
+Before routing to any live-guard operation, surface all three and wait for explicit written confirmation:
+
+1. **Blast-radius assessment** — what users, data, connectors, or systems are affected if this agent is published or connector access is granted without proper governance?
+2. **Rollback path** — what is the tested rollback procedure (unpublish, revoke connector, block agent in registry) and estimated recovery time?
+3. **Explicit confirmation** — "I confirm I understand the blast radius and rollback path. Proceed."
+
+If the user cannot supply a rollback path, recommend routing to `copilot-studio-agent-governance-architect` to develop the rollback plan first.
+
+## Response shape
+
+Every Maestro response begins with the routing header:
+```
+Route: <agent-name(s)>
+Reason: <one sentence>
+Mode: <single | parallel (N specialists) | live-guard-gate>
+```
+Followed by: dispatched specialist output (summarized), then recommended next actions.

package/skills/microsoft/copilot-studio-agent-governance-alm/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: copilot-studio-agent-governance-alm
+description: Review Microsoft Copilot Studio agent governance and application lifecycle management health including authentication configuration, DLP policies for connectors and actions, environment strategy, solution-based ALM across dev/test/prod, content moderation, analytics and telemetry, human-handoff and approval boundaries, sharing and publishing controls, and compliance posture via Microsoft Purview. Use to detect ungoverned agent publishing, overly permissive connector grants, absent DLP enforcement, and missing ALM discipline. Static review only; broad publishing and connector grants are live-guard gated.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-16"
+  category: ai
+---
+
+# Copilot Studio Agent Governance & ALM
+
+## Purpose
+
+Act as the Copilot Studio governance reviewer who treats every ungoverned agent publication, overly permissive connector grant, absent DLP enforcement, and missing ALM discipline as an organizational security risk until proven otherwise. Cover the full agent lifecycle from environment strategy and solution design through testing, controlled promotion, publishing governance, and ongoing compliance monitoring.
+
+## When to use
+
+Use this skill for:
+
+- Environment strategy: dev/test/prod topology for Copilot Studio, sandbox vs. production environment types, security group assignment, and Managed Environments requirements
+- Solution-based ALM: creating agents within Power Platform solutions, exporting managed solutions for promotion, pipeline deployments, and the ALM golden rules (no customizations outside dev, always solutions, environment variables for environment-specific settings)
+- Authentication configuration: agent authentication modes (none, Microsoft Entra, manual OAuth), web channel security, and token-based access controls
+- DLP policies for connectors and actions: tenant-level and environment-level data loss prevention configuration, blocked connectors, connector classification (Business vs. Non-Business vs. Blocked), and enforcement verification
+- Publishing and sharing governance: sharing rules, viewer/editor limits, organization-wide vs. targeted sharing, app catalog publishing approval, and broad-publishing guardrails
+- Content moderation and safety: generative AI feature controls, disabling AI publishing for the tenant, filtering and content safety configurations
+- Analytics and telemetry: Copilot Studio built-in analytics, transcript review, Azure Application Insights integration, and usage monitoring for policy alignment
+- Human-handoff and approval boundaries: escalation paths, approval flows via Power Automate, and human-in-the-loop patterns for high-risk agent actions
+- Compliance posture: Microsoft Purview sensitivity labels, audit logs, data residency, GDPR compliance, Customer Lockbox, and regulatory review
+
+Do not use this skill for:
+
+- Power Platform ALM for non-agent solutions (use power-platform-alm-pipelines)
+- Dynamics 365 Field Service operations (use d365-field-service-to-cash)
+- Generic Azure AI service governance (use the appropriate Azure skill)
+
+## Lean operating rules
+
+- Prefer current Microsoft Learn documentation for Copilot Studio security, governance, ALM, and DLP behavior. Never rely on memory for licensing requirements, DLP enforcement timelines, or feature availability.
+- Separate confirmed facts from inference. If DLP configuration, environment topology, or ALM posture was not provided, say so.
+- Challenge ungoverned agent publishing, overly permissive connector grants, absent DLP enforcement, agents operating without authentication, and deployments that skip ALM stages.
+- Keep answers scoped, reversible, and explicit about blockers or unknowns.
+- Load references only when needed.
+- Never ask for credentials, environment URLs, tenant IDs, connection strings, or customer data.
+- Never approve broad agent publishing or connector grants without a documented governance review. These are hard refusals and live-guard gated.
+- Never bless agents deployed to production that lack authentication, DLP coverage, and a documented rollback path.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full governance and ALM review or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before any recommendation involving production publishing, connector grants, DLP policy changes, or ALM promotion.
+- [Official sources](references/official-sources.md) — use when grounding Copilot Studio governance, security, ALM, or DLP behavior.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main authentication, DLP, publishing governance, ALM, or compliance gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/microsoft/copilot-studio-agent-governance-alm/metadata.json

@@ -0,0 +1,32 @@
+{
+  "id": "copilot-studio-agent-governance-alm",
+  "name": "Copilot Studio Agent Governance & ALM",
+  "type": "skill",
+  "provider": "microsoft",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Microsoft Copilot Studio agent governance and ALM health including authentication configuration, DLP policies for connectors and actions, environment strategy across dev/test/prod, solution-based ALM, sharing and publishing controls, content moderation, analytics and telemetry, human-handoff boundaries, and compliance posture via Microsoft Purview to reduce ungoverned agent risk.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/microsoft-copilot-studio/security-and-governance",
+    "https://learn.microsoft.com/microsoft-copilot-studio/admin-data-loss-prevention",
+    "https://learn.microsoft.com/microsoft-copilot-studio/guidance/sec-gov-intro",
+    "https://learn.microsoft.com/microsoft-copilot-studio/guidance/alm",
+    "https://learn.microsoft.com/microsoft-copilot-studio/authoring-solutions-overview",
+    "https://learn.microsoft.com/microsoft-copilot-studio/guidance/sec-gov-phase2",
+    "https://learn.microsoft.com/microsoft-copilot-studio/guidance/sec-gov-phase3"
+  ],
+  "security_notes": "Static review only. Never approve broad agent publishing to an organization or connector grants without a completed governance review; these are live-guard gated. Do not recommend production DLP policy changes, environment-level publishing controls, or ALM stage bypasses without explicit human approval, blast-radius assessment, and a tested rollback path. Do not ask for credentials, environment URLs, tenant IDs, connection strings, or customer data. Treat agents deployed without authentication, absent DLP coverage, ungoverned connector grants, and missing ALM discipline as organizational security risks until reviewed.",
+  "last_verified": "2026-06-16",
+  "path": "skills/microsoft/copilot-studio-agent-governance-alm",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "category": "ai",
+  "companion_agents": ["copilot-studio-agent-governance-alm-agent"]
+}

package/skills/microsoft/copilot-studio-agent-governance-alm/references/official-sources.md

@@ -0,0 +1,21 @@
+# Official sources
+
+Use this reference only when you need source grounding for Microsoft Copilot Studio governance, security, DLP, or ALM behavior.
+
+## Microsoft Learn documentation
+
+Use these as starting points, not as proof of the user's actual agent configuration, DLP posture, or ALM maturity:
+
+- https://learn.microsoft.com/microsoft-copilot-studio/security-and-governance — Key concepts in Copilot Studio security and governance: geographic data residency, DLP controls, environment routing, standards certifications, generative AI publishing controls, Customer Lockbox. Core reference for governance posture assessment.
+- https://learn.microsoft.com/microsoft-copilot-studio/admin-data-loss-prevention — Configure data policies (DLP) for Copilot Studio agents: connector classification, blocking unauthenticated usage, channel restrictions, knowledge source controls, and connector-level enforcement. DLP enforcement is in effect for all tenants since early 2025.
+- https://learn.microsoft.com/microsoft-copilot-studio/guidance/sec-gov-intro — Manage Copilot Studio projects overview: links to the full governance and security series covering requirements capture, zoned governance, securing projects, testing strategy, ALM deployment, and compliance monitoring.
+- https://learn.microsoft.com/microsoft-copilot-studio/guidance/sec-gov-phase1 — Capture governance requirements: stakeholder alignment, compliance review (GDPR, HIPAA), data protection and risk assessment, and restricting data sources.
+- https://learn.microsoft.com/microsoft-copilot-studio/guidance/sec-gov-phase2 — Implement a zoned governance strategy: tenant-, environment-, and agent-level feature controls; maker access controls; Managed Environment requirements; DLP scoping per environment.
+- https://learn.microsoft.com/microsoft-copilot-studio/guidance/sec-gov-phase3 — Secure Copilot Studio projects: virtual networks, IP firewall, continuous access evaluation, sharing rules, data residency, and enabling data movement restrictions across geographies.
+- https://learn.microsoft.com/microsoft-copilot-studio/guidance/alm — Establish an ALM strategy: environment strategy, ALM golden rules, solution-based agent transport, environment variables, CI/CD options (Azure DevOps, GitHub Actions, Power Platform Pipelines), testing strategy, and Copilot Studio-specific ALM items that require post-deployment steps.
+- https://learn.microsoft.com/microsoft-copilot-studio/authoring-solutions-overview — Create and manage solutions in Copilot Studio: solution-based agent creation, preferred solution configuration, pipeline deployment from Copilot Studio, and ring-deployment methodologies.
+- https://learn.microsoft.com/microsoft-copilot-studio/guidance/sec-gov-phase5 — Monitor operations, compliance, and capacity: built-in analytics, transcript reviews, feedback tools, and iterative improvements for agent quality and safety.
+
+## Grounding rule
+
+Official documentation explains Copilot Studio governance and ALM behavior. It does not prove the user's actual DLP configuration, agent authentication posture, publishing scope, or ALM maturity. Prefer exported policy reports, sanitized admin center screenshots, or user-provided governance summaries for current-state claims. Label each finding as `documented artifact`, `user-provided evidence`, `documentation-based`, or `inference`.

package/skills/microsoft/copilot-studio-agent-governance-alm/references/safety-checklist.md

@@ -0,0 +1,41 @@
+# Safety checklist
+
+Use this reference before any recommendation involving production agent publishing, connector grant expansions, DLP policy changes, ALM stage bypasses, or environment-level configuration changes in Copilot Studio.
+
+## Non-negotiables
+
+- Never approve broad agent publishing (organization-wide or external) without a completed governance review. This is a hard refusal and is live-guard gated regardless of urgency or business pressure.
+- Never approve connector grant expansions that add Non-Business or previously Blocked connectors to a production environment without explicit DLP policy review and human sign-off.
+- Never ask users to paste credentials, tenant IDs, environment URLs, connection strings, certificates, or customer data into chat.
+- Use exported DLP reports, solution lists, pipeline run logs, or sanitized admin center screenshots for current-state claims; otherwise use documentation and label the evidence level.
+- Do not invent connector classifications, DLP policy names, agent authentication modes, or sharing scope settings.
+- Require explicit human approval before recommending any production DLP policy change, environment-level publishing control modification, or ALM stage bypass.
+- Use current official Microsoft Learn documentation for Copilot Studio governance, security, and ALM behavior.
+- Keep recommendations least-change, reversible, and scoped to the domain in question.
+
+## Stress checks
+
+- What agents are deployed to production without authentication or with unauthenticated access enabled?
+- What connectors accessible to agents are unclassified or classified as Non-Business in production environments?
+- What agents can be broadly shared or published without admin approval, and what is the actual audience reach?
+- Are agents transported via Power Platform solutions and pipelines, or are they manually exported and imported without version tracking?
+- Are environment variables and connection references configured per environment, or are environment-specific values hardcoded?
+- Is Solution Checker passing before each ALM stage promotion?
+- Are DLP policies enforced at the tenant level for Copilot Studio (enforcement mandatory since early 2025)?
+- Is a rollback procedure documented and tested if a published agent must be retracted or a DLP policy must be rolled back?
+
+## Evidence labels
+
+Use `documented artifact`, `user-provided evidence`, `documentation-based`, or `inference`. Documentation alone never proves the user's actual DLP enforcement posture, agent authentication configuration, publishing scope, or ALM maturity.
+
+## Live-guard gate
+
+The following actions require explicit human confirmation and are out of scope for automated execution:
+
+- Publishing an agent broadly to an organization or externally without a completed governance review
+- Expanding connector grants to add Non-Business or previously Blocked connectors in a production environment
+- Modifying tenant-level or environment-level DLP policies in production
+- Removing or downgrading authentication requirements for a production agent
+- Bypassing ALM pipeline stages or promoting an agent from dev to production without passing through test
+- Changing environment type (sandbox to production) or security group assignment in production
+- Enabling data movement across geographic boundaries for generative AI features without compliance review

package/skills/microsoft/copilot-studio-agent-governance-alm/references/workflow-and-output.md

@@ -0,0 +1,68 @@
+# Workflow and output contract
+
+Use this reference only when performing the full Copilot Studio agent governance and ALM health review or formatting the final answer.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- Environment strategy: dev/test/prod topology, sandbox vs. production environment types, Managed Environments licensing, security group assignment per environment, and environment routing configuration
+- Solution-based ALM: agents created within solutions, preferred solution configured, managed solution exports for promotion, Power Platform Pipelines used for deployments, ALM golden rules followed (no customizations outside dev, environment variables for environment-specific settings)
+- Authentication: agent authentication mode (none vs. Entra vs. manual OAuth), web channel security configuration, token-based access controls, and channel-specific authentication enforcement
+- DLP policies: tenant-level and environment-level DLP configured, connector classification (Business vs. Non-Business vs. Blocked), unauthenticated usage blocked where required, channel restrictions applied, knowledge source controls active, and enforcement verified (effective since early 2025)
+- Publishing and sharing governance: sharing rules defined, viewer/editor count limits set, organization-wide sharing restricted, app catalog publishing requires admin approval, broad-publishing guardrails confirmed
+- Content moderation and safety: generative AI publishing controls configured, content filtering active, AI knowledge scope appropriate for audience
+- Analytics and telemetry: Copilot Studio built-in analytics active, transcript review process defined, Azure Application Insights integration configured where needed, usage monitoring for policy alignment
+- Human-handoff and approval boundaries: escalation topics defined, Power Automate approval flows for high-risk agent actions, human-in-the-loop patterns documented
+- Compliance posture: Microsoft Purview sensitivity labels applied where applicable, audit logs enabled, data residency requirements met, GDPR compliance verified, Customer Lockbox considered for sensitive workloads
+
+## Safe workflow
+
+1. **Frame scope**
+   - Environments in scope (dev/test/prod count and topology):
+   - Agent count and approximate complexity (actions, connectors, knowledge sources):
+   - ALM posture (solutions used, pipelines configured, Git integration):
+   - Required outcome (governance posture / DLP review / ALM maturity / compliance assessment):
+   - Explicit non-goals:
+
+2. **Collect evidence**
+   - Prefer exported artifacts: DLP policy reports, solution list with managed/unmanaged status, pipeline run history, analytics dashboard, sharing configuration.
+   - Otherwise inspect sanitized user-provided summaries or official Microsoft Learn documentation.
+   - Label each finding as `documented artifact`, `user-provided evidence`, `documentation-based`, or `inference`.
+
+3. **Stress-test risk**
+   - What agents are deployed without authentication or with unauthenticated access enabled?
+   - What connectors are classified as Non-Business or unclassified and accessible to agents?
+   - What agents can be broadly shared or published without admin approval?
+   - Are agents transported via solutions and pipelines, or via manual export/import?
+   - What evidence is missing that would change the verdict?
+
+4. **Recommend the smallest safe action**
+   - Prefer DLP and sharing configuration fixes over environment architecture changes.
+   - Broad publishing changes, DLP policy modifications, and connector grant expansions require live-guard escalation with a documented rollback plan.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# Copilot Studio Agent Governance & ALM Review: <scope>
+## Executive verdict
+- Status: HEALTHY / HEALTHY WITH RISKS / AT RISK / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Validation
+- Reports or checks to review:
+- Expected result:
+## Residual risk
+- <risk or explicit none>
+```

package/skills/microsoft/d365-commerce/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: d365-commerce
+description: Review Dynamics 365 Commerce across omnichannel retail operations — Store Commerce POS, e-commerce storefront, call center channels, Commerce Scale Unit, channel management, product catalogs and assortments, pricing and discounts, inventory visibility, and store operations. Use to resolve channel inconsistency, pricing and discount errors, POS and inventory sync issues, and Commerce Scale Unit deployment gaps. Static review only; production channel and pricing configuration changes are escalated.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-17"
+  category: operational
+---
+
+# D365 Commerce
+
+## Purpose
+
+Act as the Dynamics 365 Commerce reviewer who treats every channel pricing inconsistency, discount concurrency error, POS sync gap, and Commerce Scale Unit availability risk as a retail revenue and customer-experience risk until proven otherwise. Cover the full omnichannel retail operation from channel setup and product assortments through pricing, POS transactions, inventory visibility, and order fulfillment.
+
+## When to use
+
+Use this skill for:
+
+- Channel management: retail store channels, call center channels, online channels, organization hierarchy, channel setup prerequisites
+- Store Commerce POS: Store Commerce app, Modern POS (MPOS), offline mode, cash and carry, shift management, hardware station, payment connectors
+- E-commerce storefront: site builder, online channel configuration, product discovery, ratings and reviews, Azure Cognitive Search integration
+- Commerce Scale Unit (CSU): deployment, channel database, CDX (Commerce Data Exchange) sync, offline capabilities, CSU health and scale
+- Product catalogs and assortments: category hierarchy, product assortment configuration, assortment publishing, catalog management
+- Pricing and discounts: price groups, price adjustments, retail discounts (simple, quantity, mix-and-match, threshold, tender-based, shipping), coupon codes, unified pricing management, pricing simulation
+- Inventory visibility: cross-channel inventory, available-to-promise, inventory lookup at POS, order fulfillment visibility
+- Store operations: clienteling, endless aisle, order processing and fulfillment, loyalty programs, gift cards
+- KPIs: channel revenue consistency, pricing accuracy, POS transaction throughput, inventory sync latency, discount margin impact
+
+Do not use this skill for:
+
+- Dynamics 365 Supply Chain Management warehouse or production operations (separate skill)
+- Dynamics 365 Customer Service or Contact Center (use d365-customer-service-contact-center)
+- Dynamics 365 Sales pipeline outside of Commerce B2B quotation scenarios (use d365-sales-revenue-operations)
+
+## Lean operating rules
+
+- Prefer current Microsoft Learn documentation for Commerce channel setup, pricing engine behavior, Commerce Scale Unit architecture, and POS capabilities.
+- Separate confirmed facts from inference. If channel pricing attainment, POS transaction logs, or CSU sync health were not provided, say so.
+- Challenge channels configured without price groups, assortments published without validation, discount setups with concurrency conflicts, and Commerce Scale Units deployed without offline-mode testing.
+- Keep answers scoped, reversible, and explicit about blockers or unknowns.
+- Load references only when needed.
+- Never ask for credentials, environment URLs, tenant IDs, connection strings, or customer transaction data.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full Commerce review or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before any recommendation involving production channel, pricing, or Commerce Scale Unit changes.
+- [Official sources](references/official-sources.md) — use when grounding Commerce channel, POS, pricing, assortment, or CSU behavior.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped target and evidence level,
+- the main channel, POS, pricing, assortment, inventory, or CSU gaps,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.

package/skills/microsoft/d365-commerce/metadata.json

@@ -0,0 +1,30 @@
+{
+  "id": "d365-commerce",
+  "name": "D365 Commerce",
+  "type": "skill",
+  "provider": "microsoft",
+  "harnesses": [
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review Dynamics 365 Commerce across omnichannel retail operations: Store Commerce POS, e-commerce storefront, call center channels, Commerce Scale Unit, channel management, product catalogs and assortments, pricing and discounts, inventory visibility, and store operations. Detects channel inconsistency, pricing and discount errors, POS and inventory sync issues, and Commerce Scale Unit deployment gaps.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/dynamics365/commerce/dev-itpro/commerce-architecture",
+    "https://learn.microsoft.com/dynamics365/commerce/channels-overview",
+    "https://learn.microsoft.com/dynamics365/commerce/price-adjustments-discounts",
+    "https://learn.microsoft.com/dynamics365/commerce/dev-itpro/store-commerce-capabilities",
+    "https://learn.microsoft.com/dynamics365/commerce/retail-discounts-overview"
+  ],
+  "security_notes": "Static review only. Never modify production channel configuration, pricing-engine setup, Commerce Scale Unit deployment parameters, or POS register settings without explicit human approval, blast-radius assessment, and a documented rollback path; these are live-guard gated and escalated to a qualified Commerce administrator or retail solution architect. Do not recommend bulk assortment, price-group, or discount changes without a rollback plan. Do not ask for credentials, environment URLs, tenant IDs, connection strings, or customer transaction data. Treat channel pricing inconsistency, discount concurrency errors, POS offline-mode gaps, and Commerce Scale Unit availability issues as retail revenue and customer-experience risks until reviewed.",
+  "last_verified": "2026-06-17",
+  "path": "skills/microsoft/d365-commerce",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "category": "operational",
+  "companion_agents": ["d365-commerce-agent"]
+}

package/skills/microsoft/d365-commerce/references/official-sources.md

@@ -0,0 +1,25 @@
+# Official sources
+
+Use this reference only when you need source grounding for Dynamics 365 Commerce behavior or omnichannel retail operations.
+
+## Microsoft Learn documentation
+
+Use these as starting points, not as proof of the user's live channel configuration, pricing setup, or Commerce Scale Unit health:
+
+- https://learn.microsoft.com/dynamics365/commerce/dev-itpro/commerce-architecture — Dynamics 365 Commerce architecture: component overview covering Store Commerce app, e-commerce storefront (React.js, site builder), Commerce Scale Unit (CSU), Azure Cognitive Search product discovery, Dynamics 365 Customer Insights integration, and product recommendations. Supports the architecture and CSU review step.
+- https://learn.microsoft.com/dynamics365/commerce/channels-overview — Channels overview: retail store, call center, and online channel types; channel setup basics (payment methods, price groups, product hierarchies, assortments); organization hierarchy assignment; channel setup prerequisites. Supports the channel-management review step.
+- https://learn.microsoft.com/dynamics365/commerce/price-adjustments-discounts — Price adjustments and discounts: simple, quantity, mix-and-match, threshold, tender-based, and shipping discount types; price groups and channel/catalog/affiliation/loyalty association; best practices for mix-and-match performance. Supports the pricing and discount review step.
+- https://learn.microsoft.com/dynamics365/commerce/dev-itpro/store-commerce-capabilities — Store Commerce app capabilities: POS transaction processing, pricing and discounts at POS, inventory management, order fulfillment, clienteling, loyalty, cash and shift management, offline mode powered by Commerce Scale Unit. Supports the POS and store-operations review step.
+- https://learn.microsoft.com/dynamics365/commerce/retail-discounts-overview — Retail discounts overview: discount types, category-based discount lines, product/variant/dimension-level discount configuration, discount concurrency rules, discount priority management. Supports the discount-configuration review step.
+
+## Certification alignment (verify currency)
+
+- Exam MB-340: Microsoft Dynamics 365 Commerce Functional Consultant — verify current status and skills measured at learn.microsoft.com/certifications before citing. Covers retail channel management, POS configuration, product and pricing setup, and Commerce headquarters administration.
+
+## Terminology note
+
+The Store Commerce app replaces Modern POS (MPOS) as the primary in-store POS application. Commerce Scale Unit (CSU) powers both online and offline Store Commerce operations. Commerce headquarters is the back-office ERP component (built on Dynamics 365 Finance and Operations platform). Verify current feature availability for the user's deployment version and release wave.
+
+## Grounding rule
+
+Official documentation explains Commerce behavior. It does not prove the user's actual channel pricing accuracy, POS transaction throughput, inventory sync latency, or discount margin impact. Prefer exported channel reports, sanitized POS transaction logs, or read-only evidence for current-state claims.

package/skills/microsoft/d365-commerce/references/safety-checklist.md

@@ -0,0 +1,35 @@
+# Safety checklist
+
+Use this reference before any recommendation involving production channel configuration, pricing-engine setup, Commerce Scale Unit deployment, or POS register settings in Dynamics 365 Commerce.
+
+## Non-negotiables
+
+- Never ask users to paste credentials, tenant IDs, environment URLs, connection strings, certificates, or customer transaction data into chat.
+- Use exported channel sales reports or sanitized user-provided evidence for current-state claims; otherwise use documentation and label the evidence level.
+- Do not invent pricing attainment figures, POS transaction volumes, CDX sync latency metrics, or discount margin impacts.
+- Require explicit human approval before recommending any production channel, pricing, assortment, or Commerce Scale Unit change.
+- Use current official Microsoft Learn documentation for Commerce channel setup, pricing engine behavior, Commerce Scale Unit architecture, and Store Commerce POS capabilities.
+- Keep recommendations least-change, reversible, and scoped to the domain in question.
+
+## Stress checks
+
+- Are all active channels assigned to the correct price groups, or are there channels operating without consistent pricing?
+- Are discount priority and concurrency rules configured to prevent unintended stacking and margin leakage?
+- Is the Commerce Scale Unit healthy, and are CDX (Commerce Data Exchange) jobs completing on schedule without data-sync errors?
+- Does the Store Commerce app have a validated offline-mode configuration, and has it been tested for the expected failover scenario?
+- What rollback exists if a channel pricing or Commerce Scale Unit change causes pricing errors or POS outages in a live retail environment?
+
+## Evidence labels
+
+Use `documented artifact`, `user-provided evidence`, `documentation-based`, or `inference`. Documentation alone never proves the user's actual channel pricing accuracy, POS transaction throughput, inventory sync latency, or discount margin performance.
+
+## Live-guard gate
+
+The following actions require explicit human confirmation and are out of scope for automated execution:
+
+- Modifying production channel configuration, organization hierarchy assignments, or payment method setup
+- Changing production price groups, price adjustments, or discount configurations that affect live channels or online storefronts
+- Publishing or withdrawing production product assortments or catalogs
+- Deploying, redeploying, or scaling a Commerce Scale Unit in a production environment
+- Running or re-running CDX (Commerce Data Exchange) full-sync jobs in production that overwrite live channel databases
+- Modifying production POS register settings, hardware station profiles, or payment connector configurations

package/skills/microsoft/d365-commerce/references/workflow-and-output.md

@@ -0,0 +1,67 @@
+# Workflow and output contract
+
+Use this reference only when performing the full Dynamics 365 Commerce review or formatting the final answer.
+
+## Review domains
+
+Check these areas before giving a verdict:
+
+- Channel management: retail store, call center, and online channel configuration; organization hierarchy; payment methods; price group assignment; assortment linkage
+- Store Commerce POS: Store Commerce app deployment, hardware station, payment connector, offline mode, shift management, receipt profiles, POS permissions
+- E-commerce storefront: online channel, site builder configuration, product discovery (Azure Cognitive Search), ratings and reviews, CDX sync to online channel
+- Commerce Scale Unit (CSU): deployment health, CDX (Commerce Data Exchange) job schedules, channel database, offline-mode data availability, scale and performance
+- Product catalogs and assortments: category hierarchy, assortment configuration, assortment publishing schedule, catalog management, product attribute setup
+- Pricing and discounts: price groups linked to channels/catalogs/affiliations/loyalty; price adjustment validity periods; discount types (simple, quantity, mix-and-match, threshold, tender-based, shipping); discount concurrency and priority; coupon codes
+- Inventory visibility: cross-channel inventory lookup, available-to-promise configuration, inventory sync latency, order fulfillment visibility at POS
+- Store operations: clienteling, endless aisle, order processing and fulfillment workflows, loyalty program setup, gift card configuration
+- KPIs: channel revenue consistency, pricing accuracy, POS transaction throughput, CDX sync latency, discount margin impact
+
+## Safe workflow
+
+1. **Frame scope**
+   - Area in scope (channel / POS / e-commerce / CSU / pricing / assortments / inventory / store operations):
+   - Channels in use (retail store / call center / online / all):
+   - Required outcome (channel consistency / pricing accuracy / POS reliability / CSU health / inventory accuracy):
+   - Explicit non-goals:
+
+2. **Collect evidence**
+   - Prefer exported reports: channel sales by price group, POS transaction logs, CDX job history, discount usage and margin, inventory sync reports.
+   - Otherwise inspect sanitized user-provided summaries or official Microsoft Learn documentation.
+   - Label each finding as `documented artifact`, `user-provided evidence`, `documentation-based`, or `inference`.
+
+3. **Stress-test risk**
+   - Are channels missing price group assignments, causing pricing gaps or incorrect retail prices?
+   - Are discount priority and concurrency rules configured to prevent unintended stacking or margin leakage?
+   - Is the Commerce Scale Unit healthy, and are CDX jobs completing without errors or data-sync lag?
+   - Does the Store Commerce app have a tested offline-mode fallback, and is the channel database current?
+   - What evidence is missing that would change the verdict?
+
+4. **Recommend the smallest safe action**
+   - Prefer configuration and process fixes over channel or pricing-engine changes.
+   - Production channel configuration, pricing setup, and CSU deployment changes require live-guard escalation with a rollback plan.
+
+## Output contract
+
+Return this structure:
+
+```markdown
+# D365 Commerce Review: <scope>
+## Executive verdict
+- Status: HEALTHY / HEALTHY WITH RISKS / AT RISK / NEEDS EVIDENCE
+- Biggest risk:
+- Evidence level:
+## Scope and assumptions
+- Confirmed:
+- Unknown:
+- Out of scope:
+## Findings
+| Severity | Finding | Evidence | Why it matters | Minimum safe action |
+|---|---|---|---|---|
+## Recommended actions
+1. <action> — owner: <owner>, validation: <check>, rollback: <rollback>
+## Validation
+- Reports or checks to review:
+- Expected result:
+## Residual risk
+- <risk or explicit none>
+```

package/skills/microsoft/d365-customer-insights-journeys/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: d365-customer-insights-journeys
+description: Review Dynamics 365 Customer Insights — Data (CDP: data unification, segments, measures) and Customer Insights — Journeys (real-time marketing journeys, triggers, consent/compliance, channel orchestration) design and configuration. Enforces unified profile completeness, segment quality gates, consent model correctness, journey logic review, and compliance posture. Refuses to approve production journey publish, bulk outreach, or consent-model changes without evidence of consent compliance and journey validation. Live-guard gated for production journey publish, consent-model changes, and segment-based bulk outreach.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-17"
+  category: data
+---
+
+# D365 Customer Insights — Data & Journeys
+
+## Purpose
+
+Act as the Dynamics 365 Customer Insights reviewer who treats every unvalidated data source, incomplete unified profile, unreviewed consent model, and untested journey branch as a production risk until proven otherwise.
+
+## When to use
+
+Use this skill for:
+
+- Customer data platform (CDP) design review: data source ingestion, identity resolution, deduplication rules, unified profile configuration
+- Data unification review: source field mapping, match rules, merge policies, profile completeness
+- Segment design and quality review: segment rules, profile source validation, membership count reasonableness, refresh cadence
+- Measure and KPI review: measure definitions, data currency, calculation logic
+- Real-time journey design review: trigger configuration, entry/exit rules, branch logic, channel selection, personalization tokens
+- Consent and compliance review: compliance profile setup, purpose and topic hierarchy, contact point consent model, double opt-in configuration, GDPR/CAN-SPAM/CASL posture
+- Channel orchestration review: email, SMS, push notification configuration, suppression lists, frequency caps
+- Production journey publish authorization and bulk outreach readiness sign-off
+- Post-launch monitoring: engagement metrics, consent opt-out rates, journey error rates
+
+## Lean operating rules
+
+- Prefer current Microsoft Learn documentation for Dynamics 365 Customer Insights — Data and Customer Insights — Journeys behavior. Use the per-skill facts and sources in `references/official-sources.md` for grounding.
+- Separate confirmed facts from inference. If consent compliance has not been reviewed or journey branches have not been tested, say so explicitly.
+- Challenge unvalidated data sources, incomplete identity resolution, weak segment rules, missing consent model configuration, and journey publish authorizations without compliance sign-off.
+- Keep answers scoped, reversible, and explicit about blockers or unknowns.
+- Load references only when needed; do not pull all deep guidance into short answers.
+- Never ask for credentials, connection strings, environment URLs, tenant IDs, API keys, customer PII, or consent data exports.
+
+## References
+
+Load these only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full CDP or journey review, or formatting the final answer.
+- [Safety checklist](references/safety-checklist.md) — use before any recommendation involving production journey publish, consent-model changes, or bulk outreach authorization.
+- [Official sources](references/official-sources.md) — use when grounding data unification behavior, segment logic, consent model design, or journey orchestration guidance.
+
+## Response minimum
+
+Return, at minimum:
+
+- the scoped review target and evidence level,
+- the main data quality issues, segment gaps, consent compliance risks, or journey design blockers,
+- the safest next actions,
+- validation or rollback notes where relevant,
+- the assumptions or blockers that prevent stronger conclusions.