@raishin/vanguard-frontier-agentic 3.0.0-alpha.1 → 3.0.0-alpha.2

package/.claude-plugin/marketplace.json

@@ -6,13 +6,13 @@
   },
   "metadata": {
     "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
-    "version": "2.9.0"
+    "version": "3.0.0-alpha.2"
   },
   "plugins": [
     {
       "name": "vanguard-frontier-agentic",
       "source": "./",
-      "description": "All 448 cloud, security, compliance, platform, accounting, and finance agents in one install. Includes maestros, advisory reviewers, and live-mutation guards across 34 providers.",
+      "description": "All 473 cloud, security, compliance, platform, accounting, and finance agents in one install. Includes maestros, advisory reviewers, and live-mutation guards across 35 providers.",
       "category": "cloud",
       "tags": [
         "agents",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.9.0",
+  "version": "3.0.0-alpha.2",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "Raishin",
@@ -367,6 +367,31 @@
     "./agents/marketing/marketing-pixel-data-leakage-review-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/martech-access-governance-review-agent/harnesses/claude-code.agent.md",
     "./agents/marketing/programmatic-supply-chain-integrity-review-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-administrator-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-ai-connector-mcp-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-ai-foundations-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-application-developer-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-audit-controls-sox-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-bi-reporting-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-data-governance-privacy-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-enterprise-architecture-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-erp-consultant-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-evidence-release-drift-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-financial-foundations-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-identity-access-role-permission-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-integration-migration-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-live-org-mutation-guard-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-oneworld-multisubsidiary-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-sandbox-nonproduction-governance-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-saved-searches-workbook-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-sdf-devops-release-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-sso-oauth-tba-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-suitecloud-developer-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-suiteflow-automation-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-suitefoundation-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-suitescript-secure-code-review-agent/harnesses/claude-code.agent.md",
+    "./agents/netsuite/netsuite-web-services-integration-agent/harnesses/claude-code.agent.md",
     "./agents/nvidia/nvidia-agentic-ai-platform-review-agent/harnesses/claude-code.agent.md",
     "./agents/nvidia/nvidia-ai-infrastructure-operations-agent/harnesses/claude-code.agent.md",
     "./agents/nvidia/nvidia-ai-networking-fabric-review-agent/harnesses/claude-code.agent.md",

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "2.9.0",
+  "version": "3.0.0-alpha.2",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "Raishin",
@@ -366,6 +366,31 @@
     "./agents/marketing/marketing-pixel-data-leakage-review-agent/harnesses/cursor.agent.md",
     "./agents/marketing/martech-access-governance-review-agent/harnesses/cursor.agent.md",
     "./agents/marketing/programmatic-supply-chain-integrity-review-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-administrator-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-ai-connector-mcp-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-ai-foundations-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-application-developer-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-audit-controls-sox-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-bi-reporting-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-data-governance-privacy-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-enterprise-architecture-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-erp-consultant-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-evidence-release-drift-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-financial-foundations-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-identity-access-role-permission-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-integration-migration-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-live-org-mutation-guard-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-oneworld-multisubsidiary-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-sandbox-nonproduction-governance-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-saved-searches-workbook-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-sdf-devops-release-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-sso-oauth-tba-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-suitecloud-developer-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-suiteflow-automation-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-suitefoundation-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-suitescript-secure-code-review-agent/harnesses/cursor.agent.md",
+    "./agents/netsuite/netsuite-web-services-integration-agent/harnesses/cursor.agent.md",
     "./agents/nvidia/nvidia-agentic-ai-platform-review-agent/harnesses/cursor.agent.md",
     "./agents/nvidia/nvidia-ai-infrastructure-operations-agent/harnesses/cursor.agent.md",
     "./agents/nvidia/nvidia-ai-networking-fabric-review-agent/harnesses/cursor.agent.md",

package/.github/plugin/marketplace.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://raw.githubusercontent.com/github/copilot-cli/main/schemas/marketplace.schema.json",
   "name": "vanguard-frontier-agentic",
-  "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
-  "version": "3.0.0-alpha.1",
+  "description": "Curated marketplace for cloud, zero-trust, and compliance-aware AI workflows — agents, skills, and rules spanning cloud, security, ERP, and platform providers.",
+  "version": "3.0.0-alpha.2",
   "owner": {
     "name": "Raishin",
     "url": "https://github.com/Raishin"
@@ -11,7 +11,7 @@
     {
       "id": "vanguard-frontier-agentic",
       "source": "./",
-      "description": "All 331 cloud, security, compliance, and platform agents in one install. Includes provider maestros (routing agents) and live-mutation guards. Requires approval-gated, target-confirmed mutations on real cloud environments."
+      "description": "All cloud, security, compliance, and platform agents in one install. Includes provider maestros (routing agents) and live-mutation guards. Requires approval-gated, target-confirmed mutations on real cloud environments."
     }
   ]
 }

package/README.md

@@ -45,7 +45,7 @@ running AI agents at scale in environments where a wrong move is a board-level
 incident. It collects reusable **skills**, **agents**, **rules**, **MCP references**,
 and supporting assets for AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud,
 Kubernetes, and Terraform — plus cross-functional **Legal, HR, Marketing, Salesforce,
-.NET, and FinOps** agentic ecosystems.
+.NET, FinOps, Accounting, Finance, and Oracle NetSuite ERP** agentic ecosystems.
 
 This is **not** just cloud infrastructure tooling. It is **agentic coordination**:
 maestro routing, escalation-aware protocol, structured handoff between specialists,
@@ -58,10 +58,10 @@ operates in. Coordination, governance, and escalation are the product.
 <!-- Generated by scripts/generate-readme-counts.mjs — do not edit by hand. Run: npm run readme-counts:write -->
 | Catalog | Count |
 | --- | --- |
-| Skills | 426 |
-| Agents | 448 |
-| Providers | 34 |
-| Install roles | 22 |
+| Skills | 451 |
+| Agents | 473 |
+| Providers | 35 |
+| Install roles | 23 |
 | Rules | 1 |
 | MCP references | 3 |
 <!-- readme-counts:end -->
@@ -187,9 +187,9 @@ Or wire it into `~/.claude/settings.json` (or your project's `.claude/settings.j
 }
 ```
 
-Pin to a tag for reproducible installs: `Raishin/vanguard-frontier-agentic@v2.3.0` (or pick any [released tag](https://github.com/Raishin/vanguard-frontier-agentic/releases)).
+Pin to a tag for reproducible installs: pick any [released tag](https://github.com/Raishin/vanguard-frontier-agentic/releases) for stable versions, or use `@latest` for the current release.
 
-- **Bundled:** all <!-- count:agents -->448<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
+- **Bundled:** all <!-- count:agents -->473<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
 - **Spec:** [`.claude-plugin/marketplace.json`](.claude-plugin/marketplace.json) + [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) (canonical Claude Code plugin layout)
 - **Not bundled:** skills, rules, MCP references — use the npm path for those
 - **Docs:** [code.claude.com/docs/en/plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces)
@@ -219,7 +219,7 @@ Or in `.github/copilot/settings.json` for repo-wide trust:
 
 - **Marketplace manifest:** [`.github/plugin/marketplace.json`](.github/plugin/marketplace.json) declares this repo as a single-plugin marketplace
 - **Source path:** `./` (the repo root is the plugin root)
-- **Bundled:** <!-- count:agents -->448<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
+- **Bundled:** <!-- count:agents -->473<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
 - **Docs:** [github.com/github/copilot-cli](https://github.com/github/copilot-cli) (`/plugin marketplace add`)
 
 </details>
@@ -240,7 +240,7 @@ In Cursor: **Settings → Plugins → Add Plugin Directory** → pick the cloned
 vscode.cursor.plugins.registerPath("/absolute/path/to/vanguard-frontier-agentic");
 ```
 
-- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->448<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
+- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->473<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
 - **Bundled:** all agents from `agents/<provider>/<agent>/harnesses/cursor.agent.md`
 - **Rules:** existing `rules/` directory at repo root is auto-discovered by Cursor
 - **Docs:** [cursor.com/docs/plugins](https://cursor.com/docs/plugins) · [cursor.com/docs/reference/plugins](https://cursor.com/docs/reference/plugins)
@@ -248,11 +248,11 @@ vscode.cursor.plugins.registerPath("/absolute/path/to/vanguard-frontier-agentic"
 </details>
 
 <details>
-<summary><strong>🔮 Kiro (Powers + agents)</strong> &nbsp;—&nbsp; <em>14 ready-to-add Powers</em></summary>
+<summary><strong>🔮 Kiro (Powers + agents)</strong> &nbsp;—&nbsp; <em>35 ready-to-add Powers</em></summary>
 
 <br>
 
-Kiro Powers UI is per-Power directory add — there is no single-command marketplace flow. This repo ships **14 Powers** under `powers/`, one per provider, so Kiro users can add only what they need.
+Kiro Powers UI is per-Power directory add — there is no single-command marketplace flow. This repo ships **35 Powers** under `powers/`, one per provider, so Kiro users can add only what they need.
 
 ```bash
 # 1. Clone this repo
@@ -267,7 +267,7 @@ cd vanguard-frontier-agentic
 #       /absolute/path/to/vanguard-frontier-agentic/powers/vanguard-terraform
 ```
 
-- **Powers available:** `vanguard-aws`, `vanguard-azure`, `vanguard-gcp`, `vanguard-oci`, `vanguard-alibaba`, `vanguard-huawei`, `vanguard-ovhcloud`, `vanguard-scaleway`, `vanguard-hetzner`, `vanguard-contabo`, `vanguard-ionos`, `vanguard-kubernetes`, `vanguard-terraform`, `vanguard-nvidia`
+- **Powers available:** `vanguard-accounting`, `vanguard-alibaba`, `vanguard-argocd`, `vanguard-aws`, `vanguard-azure`, `vanguard-backstage`, `vanguard-cert-manager`, `vanguard-cilium`, `vanguard-contabo`, `vanguard-dotnet`, `vanguard-falco`, `vanguard-finance`, `vanguard-fluxcd`, `vanguard-gcp`, `vanguard-generic`, `vanguard-hetzner`, `vanguard-hr`, `vanguard-huawei`, `vanguard-ionos`, `vanguard-istio`, `vanguard-kubernetes`, `vanguard-kyverno`, `vanguard-legal`, `vanguard-marketing`, `vanguard-multi-cloud`, `vanguard-netsuite`, `vanguard-nvidia`, `vanguard-oci`, `vanguard-opentelemetry`, `vanguard-ovhcloud`, `vanguard-prometheus`, `vanguard-salesforce`, `vanguard-scaleway`, `vanguard-sigstore`, `vanguard-terraform`
 - **Each Power ships:** routing pattern (maestro entry), live-mutation discipline, provider invariants (account-ID/region, MLPS 2.0, EU sovereignty, etc.)
 - **Frontmatter:** strict-5 fields (`name`, `displayName`, `description`, `keywords`, `author`) per Kiro spec
 - **For Kiro agent adapter files** (`.kiro/agents/*.md`, `.kiro/agents/*.json`): use the npm-export path below
@@ -331,7 +331,7 @@ enabled = true
 - **Bundled plugins:**
   - `vanguard-frontier-agentic` — the main plugin, manifest at [`plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json`](plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json)
   - `cross-platform-agent-template` — scaffold for new cross-platform agents
-- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->448<!-- /count --> agent adapters into your repo
+- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->473<!-- /count --> agent adapters into your repo
 - **Other commands:** `codex plugin marketplace upgrade vanguard-frontier-agentic`, `codex plugin marketplace remove vanguard-frontier-agentic`
 - **Docs:** [github.com/openai/codex](https://github.com/openai/codex) · [Codex plugin spec](https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md)
 
@@ -402,7 +402,7 @@ cd tools/vfa-tui && cargo build --release
 
 ## 🧠 Skills
 
-**<!-- count:skills -->426<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
+**<!-- count:skills -->451<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
 
 | Domain             | Count | What they cover                                                                                   |
 | ------------------ | ----: | ------------------------------------------------------------------------------------------------- |
@@ -499,7 +499,7 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 
 ## 🤖 Agents
 
-**<!-- count:agents -->448<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
+**<!-- count:agents -->473<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
 
 | Provider           | Count | Specialisations                                                                     |
 | ------------------ | ----: | ----------------------------------------------------------------------------------- |
@@ -556,6 +556,7 @@ Every agent ships:
 
 ```text
 agents/
+├── accounting/       (14 agents — maestro + corporate accounting specialists: revenue recognition (ASC 606/IFRS 15), close cycle, consolidation/intercompany, fixed assets, lease accounting (ASC 842), hedge accounting, FX translation, tax provision, payroll, procure-to-pay, equity compensation, indirect tax/e-invoicing, business combinations — all advisory, no ledger writes)
 ├── alibaba/          (43 agents — advisory, live-guard operators, maestro)
 ├── argocd/           (2 agents — GitOps review, live sync guard)
 ├── aws/              (47 agents — advisory, execution, live-guard operators)
@@ -566,6 +567,7 @@ agents/
 ├── contabo/          (6 agents — advisory, live instance + storage guards, maestro)
 ├── dotnet/           (10 agents — C#/runtime, ASP.NET Core, EF Core, testing, NuGet supply chain, performance/AOT, OpenTelemetry, Aspire — maestro + 9 specialists)
 ├── falco/            (1 agent — runtime threat detection review)
+├── finance/          (8 agents — maestro + corporate finance specialists: variance analysis, FP&A forecasting, treasury/liquidity, working capital, debt/capital structure, capital allocation, transfer pricing/Pillar Two — all advisory, no ERP writes)
 ├── finops/           (4 agents — cross-cloud price advisor + experimental cost/economics agents)
 ├── fluxcd/           (1 agent — GitOps Kustomization/HelmRelease review)
 ├── gcp/              (51 agents — advisory, live-guard operators, maestro)
@@ -578,6 +580,7 @@ agents/
 ├── kyverno/          (1 agent — admission policy review)
 ├── legal/            (13 agents — contract review, employment law, privacy & data protection, regulatory compliance, IP & open source, litigation hold, ethics & investigations, vendor risk, policy governance, public disclosure, counsel review, knowledge management)
 ├── marketing/        (14 agents — 13 governance review agents + maestro router)
+├── netsuite/         (25 agents — Oracle NetSuite ERP — maestro router, live-org mutation guard, evidence/release-drift + enterprise-architecture + SOX audit governance, plus 20 domain specialists: financial foundations, SuiteScript secure code review, SDF DevOps, OneWorld multi-subsidiary, identity/RBAC, OAuth/TBA/SSO, AI Connector/MCP, data governance, integration migration, and more — all static-review tier)
 ├── nvidia/           (12 agents — GPU infrastructure, TensorRT/TensorRT-LLM, Triton serving, NeMo/NIM, agentic AI, NGC supply chain, AI networking, day-2 ops, GPU Operator on Kubernetes, model promotion gatekeeper — maestro + advisory + live-runtime gate)
 ├── oci/              (39 agents — advisory, live-guard operators)
 ├── opentelemetry/    (1 agent — collector config review)
@@ -1139,7 +1142,7 @@ In two weeks on npm: ~900 downloads. Socket.dev scores: Vulnerability 100, Quali
 
 Your sponsorship directly funds the compute, API time, and research hours that turn new cloud providers, compliance frameworks, and security patterns into production-ready agents — free for everyone.
 
-Current catalog: **<!-- count:agents -->448<!-- /count --> agents · <!-- count:skills -->426<!-- /count --> skills · <!-- count:providers -->34<!-- /count --> cloud/platform providers**
+Current catalog: **<!-- count:agents -->473<!-- /count --> agents · <!-- count:skills -->451<!-- /count --> skills · <!-- count:providers -->35<!-- /count --> cloud/platform providers**
 
 ---
 

package/agents/netsuite/AGENTS.md

@@ -0,0 +1,183 @@
+# Oracle NetSuite Agents
+
+Enterprise-grade Oracle NetSuite advisor roles with judgment for architecture, operations, and compliance review. Static review only—no live mutations without separate authorization.
+
+## Portfolio Overview
+
+**25 agents across 3 layers:**
+- **Layer 1:** Maestro routing, governance, and live-mutation gates (5 agents)
+- **Layer 2:** Domain specialists with cert alignment and enterprise roles (20 agents)
+
+## Operating Principles
+
+- **Least privilege by default:** Custom roles derived from standard roles, never Administrator
+- **Static review only:** No live NetSuite mutations, workflow activation, data edits, or permission changes absent separate authorization
+- **Evidence-based:** Official documentation and live evidence only—no fabricated facts
+- **OAuth2 priority:** OAuth2 over legacy TBA; SOAP marked as deprecation risk (timeline: 2026.1 for defaults, 2028.2 for sunset)
+- **Cross-domain coordination:** Maestro and netsuite-routing-protocol coordinate multi-domain matters
+
+## Routing Reference
+
+See `skills/cross-functional/netsuite-routing-protocol/SKILL.md` for:
+- 12+ routing domains with keywords
+- Cross-domain overlap matrix (7 scenarios)
+- Conflict-resolution protocol
+- Stop conditions for live mutations, credentials, and regulated data
+
+## Key Safety Gates
+
+| Gate | Trigger | Handler |
+|------|---------|---------|
+| **Live mutation** | Workflow, deploy, data edit, permission change | netsuite-live-org-mutation-guard-agent (refuse by default) |
+| **Credential request** | Agent asks for tokens/credentials | ALL agents refuse; stop and escalate |
+| **Administrator role** | Agent recommends or depends on Administrator | Refusal trigger; mark as high-privilege violation |
+| **Cross-subsidiary data** | Report/search exposes multiple subsidiaries | Parallel: saved-searches + oneworld + data-governance |
+| **SOAP deprecation** | New SOAP integration proposed | Escalate timeline: 2026.1 (defaults to REST), 2028.2 (SOAP sunset) |
+
+## Layer 1: Governance & Routing (5 agents)
+
+### netsuite-maestro-agent
+Classify incoming NetSuite matters and dispatch to specialists. Routes via `netsuite-routing-protocol`.
+
+### netsuite-live-org-mutation-guard-agent
+Gate for any live-account action: deploy, workflow activation, data edits, permission changes. Refuse by default; requires explicit separate authorization.
+
+### netsuite-evidence-release-drift-agent
+Biannual release drift analysis, evidence labeling, certification-sensitive claims. Tracks NetSuite's 5 certification tracks and release timelines.
+
+### netsuite-enterprise-architecture-agent
+Multi-account/OneWorld topology, solution design, platform strategy, scalability.
+
+### netsuite-audit-controls-sox-agent
+Segregation of duties, posting, period close, revenue recognition, audit workflows, compliance.
+
+## Layer 2: Domain Specialists (20 agents)
+
+### Foundation & Administration (3)
+- **netsuite-suitefoundation-agent** – SuiteFoundation setup and governance
+- **netsuite-administrator-agent** – General administration and configuration
+- **netsuite-erp-consultant-agent** – ERP consulting and implementation
+
+### Finance & Reporting (4)
+- **netsuite-financial-foundations-agent** – AP/AR, accounting setup (escalates close-impacting to audit-sox)
+- **netsuite-bi-reporting-agent** – Reports, dashboards, KPIs, analytics
+- **netsuite-saved-searches-workbook-agent** – Saved searches, SuiteAnalytics Workbooks, PII-in-export
+- **netsuite-ai-foundations-agent** – AI-powered analytics and insights
+
+### Development (4)
+- **netsuite-application-developer-agent** – SuiteScript records, UIF, SPA
+- **netsuite-suitecloud-developer-agent** – SDF, SuiteScript upgrade
+- **netsuite-suitescript-secure-code-review-agent** – Static security review of SuiteScript
+- **netsuite-suiteflow-automation-agent** – SuiteFlow workflow design and review
+
+### Identity & Integration (4)
+- **netsuite-identity-access-role-permission-agent** – Roles, permissions, segregation of duties
+- **netsuite-sso-oauth-tba-agent** – OAuth2, TBA, SSO, SAML authentication (OAuth2 preferred)
+- **netsuite-web-services-integration-agent** – SuiteTalk REST/SOAP APIs
+- **netsuite-integration-migration-agent** – SOAP→REST migration, integration architecture
+
+### Governance & Deployment (5)
+- **netsuite-oneworld-multisubsidiary-agent** – Subsidiary boundaries, currency, legal entities
+- **netsuite-data-governance-privacy-agent** – PII, retention, field-level access, export controls
+- **netsuite-ai-connector-mcp-agent** – AI Connector & MCP governance, tool allowlists
+- **netsuite-sandbox-nonproduction-governance-agent** – Sandbox isolation, OAuth re-auth
+- **netsuite-sdf-devops-release-agent** – SDF project structure, deployment controls, environment promotion
+
+## Companion Skills
+
+Each agent has a 1:1 companion skill under `skills/netsuite/<agent-id>-skill/`:
+- `SKILL.md` – procedure and decision logic
+- `metadata.json` – catalog metadata
+- `references/*.md` – official sources, safety checklists, least-privilege notes, release drift, topic-specific guides
+
+## Escalation Flow
+
+```
+matter arrives
+  ↓
+netsuite-maestro-agent (classify via routing-protocol)
+  ↓
+[ specialist agent(s) ]
+  ↓
+[if live mutation?] → netsuite-live-org-mutation-guard-agent (refuse by default)
+[if cross-domain?] → parallel review + conflict-resolution protocol
+[if escalation gate?] → pause and escalate to human owner
+[if cred/admin requested?] → STOP and REFUSE
+```
+
+## Least-Privilege Role Template
+
+All agents operate with least-privilege custom roles:
+1. Start with a standard role (e.g., Administrator for initial scoping)
+2. Remove unnecessary permissions
+3. Add only required modules (e.g., Financial, Accounting)
+4. Enable 2FA for privileged roles
+5. Document in agent's `LEAST-PRIVILEGES.md`
+
+Standard roles: Administrator, SuiteFlex, System Administrator, Accounting Manager, Finance Manager, VP Sales, IT Administrator, Operations Manager.
+
+## Certification Alignment
+
+NetSuite maintains 5 certification tracks:
+- SuiteFoundation (entry-level platform)
+- NetSuite Administrator (org setup, users, roles, permissions)
+- NetSuite Developer (SuiteScript, SDF, APIs)
+- NetSuite OpenAir (project accounting)
+- NetSuite Advanced Developer (advanced SuiteScript, integration, performance)
+
+Agents map to tracks where applicable; certification "Coming Soon" items are blocked (no assumed availability).
+
+## Release Sensitivity
+
+NetSuite ships biannual releases (2026.1, 2026.2, 2027.1, 2027.2, etc.). Key dates:
+- **2026.1** – OAuth 2.0 becomes default auth; SOAP marks as deprecated
+- **2027.1** – New SOAP integrations disabled
+- **2028.2** – SOAP API sunset (estimated)
+
+Evidence-release-drift-agent tracks these; all agents must label claims as "release-sensitive" where applicable.
+
+## No Live Mutations
+
+Static review / advisory ONLY. This portfolio does NOT:
+- Deploy SDF changes
+- Activate workflows
+- Edit data
+- Modify permissions
+- Publish saved searches
+- Rotate certificates
+
+Those require `netsuite-live-org-mutation-guard-agent` + separate human authorization via an out-of-band protocol.
+
+## Refusal Triggers
+
+All agents refuse:
+1. Requests for account credentials, API tokens, OAuth tokens
+2. Requests to assume Administrator role or bypass permission checks
+3. Requests for live-account mutations without explicit separate authorization
+4. Certification claims marked "Coming Soon" in official docs
+5. Requests involving regulated PII without known jurisdiction
+6. Requests to export broad MCP tool scopes
+
+## Security Posture
+
+- **Authentication:** OAuth2 default for REST/RESTlets/SuiteAnalytics Connect; TBA only as fallback
+- **No user credentials:** Never accept end-user passwords; always use service accounts with OAuth2
+- **2FA:** Required for Administrator and all privileged custom roles
+- **Least privilege:** Start from zero, add only necessary permissions per agent role
+- **MCP governance:** AI Connector never under Administrator; tool allowlists reviewed per escalation gate
+- **Data classification:** All data is PII until proven otherwise; export requires data-governance review
+
+## Supporting Files
+
+- `AGENTS.md` – this document (agent portfolio overview)
+- `README.md` – netsuite provider overview
+- `skills/netsuite/README.md` – skills portfolio
+- `skills/cross-functional/netsuite-routing-protocol/SKILL.md` – routing and conflict resolution
+- `catalog/agents.json` – machine-readable agent manifest
+- `catalog/skills.json` – machine-readable skills manifest
+
+---
+
+**Last updated:** 2026-06-09  
+**Source:** github: Raishin  
+**Version:** 0.1.0