@raishin/vanguard-frontier-agentic 3.10.0 → 3.11.1

package/.claude-plugin/marketplace.json

@@ -6,13 +6,13 @@
   },
   "metadata": {
     "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
-    "version": "3.10.0"
+    "version": "3.11.1"
   },
   "plugins": [
     {
       "name": "vanguard-frontier-agentic",
       "source": "./",
-      "description": "All 712 cloud, security, compliance, platform, accounting, and finance agents in one install. Includes maestros, advisory reviewers, and live-mutation guards across 45 providers.",
+      "description": "All 729 cloud, security, compliance, platform, accounting, and finance agents in one install. Includes maestros, advisory reviewers, and live-mutation guards across 45 providers.",
       "category": "cloud",
       "tags": [
         "agents",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "3.10.0",
+  "version": "3.11.1",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "VincentChuWaiChow",
@@ -179,9 +179,26 @@
     "./agents/contabo/contabo-maestro-agent/harnesses/claude-code.agent.md",
     "./agents/contabo/contabo-security-hardening-agent/harnesses/claude-code.agent.md",
     "./agents/cross-functional/revenue-critical-journey-integrity-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-ai-bi-genie-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-data-protection-privacy-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-data-quality-observability-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-developer-platform-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-finops-cost-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-genai-agent-engineering-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-genai-evaluation-observability-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-identity-network-security-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-lakeflow-pipeline-engineering-agent/harnesses/claude-code.agent.md",
     "./agents/databricks/databricks-lakehouse-engineering-at-azure-agent/harnesses/claude-code.agent.md",
     "./agents/databricks/databricks-live-unity-catalog-grant-guard-at-azure-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-maestro-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-mlops-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-platform-architecture-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-platform-reliability-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-sql-performance-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-streaming-reliability-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-unity-catalog-governance-agent/harnesses/claude-code.agent.md",
     "./agents/databricks/databricks-unity-catalog-governance-at-azure-agent/harnesses/claude-code.agent.md",
+    "./agents/databricks/databricks-value-realization-agent/harnesses/claude-code.agent.md",
     "./agents/dotnet/dotnet-aspire-cloud-native-review-agent/harnesses/claude-code.agent.md",
     "./agents/dotnet/dotnet-aspnetcore-api-review-agent/harnesses/claude-code.agent.md",
     "./agents/dotnet/dotnet-aspnetcore-identity-authz-review-agent/harnesses/claude-code.agent.md",

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "3.10.0",
+  "version": "3.11.1",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "author": {
     "name": "VincentChuWaiChow",
@@ -178,9 +178,26 @@
     "./agents/contabo/contabo-maestro-agent/harnesses/cursor.agent.md",
     "./agents/contabo/contabo-security-hardening-agent/harnesses/cursor.agent.md",
     "./agents/cross-functional/revenue-critical-journey-integrity-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-ai-bi-genie-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-data-protection-privacy-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-data-quality-observability-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-developer-platform-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-finops-cost-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-genai-agent-engineering-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-genai-evaluation-observability-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-identity-network-security-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-lakeflow-pipeline-engineering-agent/harnesses/cursor.agent.md",
     "./agents/databricks/databricks-lakehouse-engineering-at-azure-agent/harnesses/cursor.agent.md",
     "./agents/databricks/databricks-live-unity-catalog-grant-guard-at-azure-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-mlops-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-platform-architecture-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-platform-reliability-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-sql-performance-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-streaming-reliability-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-unity-catalog-governance-agent/harnesses/cursor.agent.md",
     "./agents/databricks/databricks-unity-catalog-governance-at-azure-agent/harnesses/cursor.agent.md",
+    "./agents/databricks/databricks-value-realization-agent/harnesses/cursor.agent.md",
     "./agents/dotnet/dotnet-aspire-cloud-native-review-agent/harnesses/cursor.agent.md",
     "./agents/dotnet/dotnet-aspnetcore-api-review-agent/harnesses/cursor.agent.md",
     "./agents/dotnet/dotnet-aspnetcore-identity-authz-review-agent/harnesses/cursor.agent.md",
@@ -355,6 +372,12 @@
     "./agents/huawei/huawei-waf-cost-optimization-review-agent/harnesses/cursor.agent.md",
     "./agents/huawei/huawei-waf-reliability-review-agent/harnesses/cursor.agent.md",
     "./agents/huawei/huawei-waf-security-review-agent/harnesses/cursor.agent.md",
+    "./agents/ionos/ionos-cost-optimization-analyst-agent/harnesses/cursor.agent.md",
+    "./agents/ionos/ionos-datacenter-designer-reviewer-agent/harnesses/cursor.agent.md",
+    "./agents/ionos/ionos-kubernetes-platform-operator-agent/harnesses/cursor.agent.md",
+    "./agents/ionos/ionos-live-database-lifecycle-guard-agent/harnesses/cursor.agent.md",
+    "./agents/ionos/ionos-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/ionos/ionos-security-compliance-reviewer-agent/harnesses/cursor.agent.md",
     "./agents/istio/istio-ambient-mesh-review-agent/harnesses/cursor.agent.md",
     "./agents/java/java-application-server-exit-agent/harnesses/cursor.agent.md",
     "./agents/java/java-concurrency-and-virtual-thread-agent/harnesses/cursor.agent.md",
@@ -547,6 +570,12 @@
     "./agents/oci/oci-waf-reliability-review-agent/harnesses/cursor.agent.md",
     "./agents/oci/oci-waf-security-review-agent/harnesses/cursor.agent.md",
     "./agents/opentelemetry/opentelemetry-collector-config-review-agent/harnesses/cursor.agent.md",
+    "./agents/ovhcloud/ovhcloud-cost-finops-analyst-agent/harnesses/cursor.agent.md",
+    "./agents/ovhcloud/ovhcloud-iam-policy-review-agent/harnesses/cursor.agent.md",
+    "./agents/ovhcloud/ovhcloud-kubernetes-platform-operator-agent/harnesses/cursor.agent.md",
+    "./agents/ovhcloud/ovhcloud-live-kms-key-destruction-guard-agent/harnesses/cursor.agent.md",
+    "./agents/ovhcloud/ovhcloud-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/ovhcloud/ovhcloud-network-architect-agent/harnesses/cursor.agent.md",
     "./agents/php/composer-supply-chain-agent/harnesses/cursor.agent.md",
     "./agents/php/php-application-security-agent/harnesses/cursor.agent.md",
     "./agents/php/php-maestro-agent/harnesses/cursor.agent.md",
@@ -668,6 +697,12 @@
     "./agents/sap/sap-testing-quality-gate-agent/harnesses/cursor.agent.md",
     "./agents/sap/sap-transformation-portfolio-triage-agent/harnesses/cursor.agent.md",
     "./agents/sap/sap-treasury-cash-risk-agent/harnesses/cursor.agent.md",
+    "./agents/scaleway/scaleway-cost-optimizer-agent/harnesses/cursor.agent.md",
+    "./agents/scaleway/scaleway-iam-policy-review-agent/harnesses/cursor.agent.md",
+    "./agents/scaleway/scaleway-kapsule-platform-operator-agent/harnesses/cursor.agent.md",
+    "./agents/scaleway/scaleway-live-kapsule-rollout-guard-agent/harnesses/cursor.agent.md",
+    "./agents/scaleway/scaleway-maestro-agent/harnesses/cursor.agent.md",
+    "./agents/scaleway/scaleway-network-architect-agent/harnesses/cursor.agent.md",
     "./agents/sigstore/sigstore-cosign-supply-chain-review-agent/harnesses/cursor.agent.md",
     "./agents/snowflake/snowflake-analytics-semantic-data-product-agent/harnesses/cursor.agent.md",
     "./agents/snowflake/snowflake-bcdr-resilience-agent/harnesses/cursor.agent.md",

package/.github/plugin/marketplace.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/github/copilot-cli/main/schemas/marketplace.schema.json",
   "name": "vanguard-frontier-agentic",
   "description": "Curated marketplace for cloud, zero-trust, and compliance-aware AI workflows — agents, skills, and rules spanning cloud, security, ERP, and platform providers.",
-  "version": "3.10.0",
+  "version": "3.11.1",
   "owner": {
     "name": "VincentChuWaiChow",
     "url": "https://github.com/VincentChuWaiChow"

package/README.md

@@ -45,7 +45,7 @@ running AI agents at scale in environments where a wrong move is a board-level
 incident. It collects reusable **skills**, **agents**, **rules**, **MCP references**,
 and supporting assets for AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud,
 Kubernetes, and Terraform — plus cross-functional **Legal, HR, Marketing, Salesforce,
-.NET, Java, Kotlin, PHP, Python, TypeScript, FinOps, Accounting, Finance, Oracle NetSuite ERP, SAP S/4HANA + BTP ERP, Microsoft 365 / Dynamics 365, and Azure-ecosystem Databricks and Snowflake data-platform**
+.NET, Java, Kotlin, PHP, Python, TypeScript, FinOps, Accounting, Finance, Oracle NetSuite ERP, SAP S/4HANA + BTP ERP, Microsoft 365 / Dynamics 365, a cloud-neutral Databricks lakehouse/AI board, and a cloud-neutral Snowflake data-platform board**
 agentic ecosystems.
 
 This is **not** just cloud infrastructure tooling. It is **agentic coordination**:
@@ -59,10 +59,10 @@ operates in. Coordination, governance, and escalation are the product.
 <!-- Generated by scripts/generate-readme-counts.mjs — do not edit by hand. Run: npm run readme-counts:write -->
 | Catalog | Count |
 | --- | --- |
-| Skills | 737 |
-| Agents | 712 |
+| Skills | 754 |
+| Agents | 729 |
 | Providers | 45 |
-| Install roles | 67 |
+| Install roles | 76 |
 | Rules | 1 |
 | MCP references | 3 |
 <!-- readme-counts:end -->
@@ -201,7 +201,7 @@ Or wire it into `~/.claude/settings.json` (or your project's `.claude/settings.j
 
 Pin to a tag for reproducible installs: pick any [released tag](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic/releases) for stable versions, or use `@latest` for the current release.
 
-- **Bundled:** all <!-- count:agents -->712<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
+- **Bundled:** all <!-- count:agents -->729<!-- /count --> cloud, security, compliance, Kubernetes, Terraform agents (incl. provider maestros and live-guard agents)
 - **Spec:** [`.claude-plugin/marketplace.json`](.claude-plugin/marketplace.json) + [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) (canonical Claude Code plugin layout)
 - **Not bundled:** skills, rules, MCP references — use the npm path for those
 - **Docs:** [code.claude.com/docs/en/plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces)
@@ -231,7 +231,7 @@ Or in `.github/copilot/settings.json` for repo-wide trust:
 
 - **Marketplace manifest:** [`.github/plugin/marketplace.json`](.github/plugin/marketplace.json) declares this repo as a single-plugin marketplace
 - **Source path:** `./` (the repo root is the plugin root)
-- **Bundled:** <!-- count:agents -->712<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
+- **Bundled:** <!-- count:agents -->729<!-- /count --> Copilot agent adapters under `agents/<provider>/<agent>/harnesses/copilot.agent.md`
 - **Docs:** [github.com/github/copilot-cli](https://github.com/github/copilot-cli) (`/plugin marketplace add`)
 
 </details>
@@ -252,7 +252,7 @@ In Cursor: **Settings → Plugins → Add Plugin Directory** → pick the cloned
 vscode.cursor.plugins.registerPath("/absolute/path/to/vanguard-frontier-agentic");
 ```
 
-- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->712<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
+- **Plugin manifest:** [`.cursor-plugin/plugin.json`](.cursor-plugin/plugin.json) enumerates all **<!-- count:agents -->729<!-- /count --> Cursor agent adapters** explicitly via the `agents` field
 - **Bundled:** all agents from `agents/<provider>/<agent>/harnesses/cursor.agent.md`
 - **Rules:** existing `rules/` directory at repo root is auto-discovered by Cursor
 - **Docs:** [cursor.com/docs/plugins](https://cursor.com/docs/plugins) · [cursor.com/docs/reference/plugins](https://cursor.com/docs/reference/plugins)
@@ -343,7 +343,7 @@ enabled = true
 - **Bundled plugins:**
   - `vanguard-frontier-agentic` — the main plugin, manifest at [`plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json`](plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json)
   - `cross-platform-agent-template` — scaffold for new cross-platform agents
-- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->712<!-- /count --> agent adapters into your repo
+- **For agent adapter files** (`.codex/agents/*.toml`): after enabling the plugin, run `npx vfa-export-agents --platform codex --all --repo .` to write the <!-- count:agents -->729<!-- /count --> agent adapters into your repo
 - **Other commands:** `codex plugin marketplace upgrade vanguard-frontier-agentic`, `codex plugin marketplace remove vanguard-frontier-agentic`
 - **Docs:** [github.com/openai/codex](https://github.com/openai/codex) · [Codex plugin spec](https://github.com/openai/codex/blob/main/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md)
 
@@ -425,7 +425,7 @@ vfa-tui                                      # installed via cargo or prebuilt b
 
 ## 🧠 Skills
 
-**<!-- count:skills -->737<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
+**<!-- count:skills -->754<!-- /count --> skills** across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, CNCF ecosystem, Terraform, marketing governance, and more.
 
 | Domain             | Count | What they cover                                                                                   |
 | ------------------ | ----: | ------------------------------------------------------------------------------------------------- |
@@ -445,8 +445,8 @@ vfa-tui                                      # installed via cargo or prebuilt b
 | 📣 Marketing        |    14 | Consent, pixel-leakage, martech access, GPC, email auth, ads.txt, targeting fairness, EU AI Act, audience uploads, list retention, influencer, dark patterns, analytics, maestro |
 | ☁️ Salesforce       |    25 | Org assessment, metadata review, permissions audit, Flow automation, Apex/LWC code review, release readiness, integration, marketing consent, Agentforce risk review, zero-trust maturity, DevSecOps pipeline, SOQL generation, Apex generation and test generation, operational T1/T2 runtime skills |
 | Ⓜ️ Microsoft 365 / D365 |    38 | Maestro routing (microsoft/m365/d365/Power Platform/Copilot), Entra Zero Trust & Conditional Access, Microsoft 365 Copilot readiness, Purview data security & compliance, Defender XDR SecOps, Intune endpoints, Teams collaboration, Exchange/SharePoint information governance, tenant governance, backup/BCDR & data resilience, licensing/EA optimization, Dataverse/DLP security, Power Platform ALM, Power Automate risk review, Copilot Studio governance, Fabric/Power BI governance, Fabric data engineering, Fabric analytics engineering, D365 Success by Design, SoD, data migration/cutover, finance close-to-report, supply chain, field service, customer service, sales ops, Customer Insights – Journeys, F&O developer/extensions, dual-write integration, Project Operations, Commerce, value realization, live-guard identity posture + Dataverse security role (read-only-runtime, Phase A), live-guard Dataverse record field update + sensitivity label apply (mutating-runtime, Phase B) |
-| 🧱 Databricks (Azure) |     3 | Azure Databricks Unity Catalog governance (least-privilege grants, admin separation) + lakehouse engineering (medallion, managed-identity storage, cluster policies) — static review; + Unity Catalog schema-scoped grant guard (mutating-runtime live-guard, Phase B) |
-| ❄️ Snowflake (Azure) |     3 | Snowflake-on-Azure RBAC governance (SoD, ACCOUNTADMIN restriction, network policies) + data-platform engineering (Private Link, masking/row-access governance) — static review; + RBAC grant guard (mutating-runtime live-guard, Phase B) |
+| 🧱 Databricks | <!-- count:provider:databricks -->20<!-- /count --> | Cloud-neutral lakehouse/AI board — maestro routing plus specialists for platform architecture, Unity Catalog governance, identity/network security, data protection & privacy, Lakeflow pipelines, streaming reliability, data quality & observability, SQL performance, AI/BI Genie, MLOps, GenAI agent engineering, GenAI evaluation & observability, developer platform (bundles/CI-CD), platform reliability, FinOps cost, and value realization — all static review. Plus the hand-authored `-at-azure` assets that predate the board: Unity Catalog governance, lakehouse engineering, and a Unity Catalog schema-scoped grant guard (mutating-runtime live-guard, Phase B) |
+| ❄️ Snowflake | <!-- count:provider:snowflake -->28<!-- /count --> | Cloud-neutral data-platform board — router plus review specialists across identity/access, governance & privacy, compliance evidence, Cortex AI security, BCDR resilience, and business value; plus `snowflake-live-*` mutating-runtime guards, each a single approved mutation behind a human gate. The Azure-scoped predecessors remain as deprecated assets |
 
 ### 🛡️ Live Guard skills — stop before you break prod
 
@@ -525,7 +525,7 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 
 ## 🤖 Agents
 
-**<!-- count:agents -->712<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
+**<!-- count:agents -->729<!-- /count --> agents** matching the skill catalog — agents ship harness adapters and a hardened permission model.
 
 | Provider           | Count | Specialisations                                                                     |
 | ------------------ | ----: | ----------------------------------------------------------------------------------- |
@@ -568,8 +568,8 @@ Rule of thumb: if the asset teaches **how to do a repeatable task**, it is a ski
 | ☁️ Salesforce       |    30 | 20 Wave 1 domain specialists (admin, dev, security, integration, Sales/Service/Marketing/Industry clouds, Agentforce, analytics, compliance) + 10 Wave 3 infrastructure security + DevSecOps agents — maestro router + live-guard authority gate |
 | 🔷 SAP              |    40 | maestro + 39 specialists: S/4HANA transformation architecture, BTP account/entitlement governance, ABAP Cloud/RAP & CAP code review, Fiori/UI5 UX, finance FI-CO controls, supply chain IBP resilience, manufacturing execution risk, SuccessFactors HR process risk, MDG master data quality, custom-code remediation, Cloud ALM SRE, transport/release governance, read-only landscape + identity discovery; + 4 guarded-mutating-runtime live-guard operators (BTP entitlement, integration flow, role assignment, transport import) — advisory + live-guard-gated execution + maestro router |
 | Ⓜ️ Microsoft 365 / D365 |    40 | 5 maestro routers (microsoft, m365, d365, Power Platform, Copilot governance) + 31 static-review specialists + 2 read-only-runtime live-guards (Phase A: identity posture, Dataverse security role) + 2 mutating-runtime live-guards (Phase B: Dataverse record field update, sensitivity label apply) across M365 (Entra identity/Zero Trust, Copilot readiness, Purview data security & compliance, Defender XDR SecOps, Intune endpoints, Teams collaboration, Exchange/SharePoint information governance, tenant governance, backup/BCDR & data resilience, licensing/EA optimization), Power Platform (Dataverse security, ALM pipelines, automation risk, Copilot Studio governance), Fabric/Power BI (governance, data engineering, analytics engineering), D365 (Success by Design, SoD, data migration/cutover, finance, supply chain, field service, customer service, sales, Customer Insights – Journeys, F&O developer/extensions, dual-write integration, Project Operations, Commerce, value realization), and live-guard runtime (Phase A: identity posture, Dataverse security role; Phase B: Dataverse record field update guard, sensitivity label apply guard) |
-| 🧱 Databricks (Azure) |     3 | 2 static-review specialists (Phase A): Unity Catalog governance (metastore→catalog→schema→table, least-privilege grants, account/workspace/metastore admin separation, run-as-service-principal) + lakehouse engineering (medallion architecture, ADLS Gen2 via Access Connector managed identity, cluster policies, AKV-backed secret scopes, VNet/Private Link); + 1 mutating-runtime live-guard (Phase B): Unity Catalog schema-scoped grant guard (single GRANT to one principal, REVOKE rollback, written approval token + PREFLIGHT required) |
-| ❄️ Snowflake (Azure) |     3 | 2 static-review specialists (Phase A): RBAC governance (ACCOUNTADMIN/SECURITYADMIN/SYSADMIN separation, custom least-privilege roles, SoD, network policies, Entra OAuth/SSO/SCIM) + data-platform engineering (warehouses, Azure Private Link, storage integration to ADLS Gen2/Blob, dynamic masking/row-access/tagging, ACCESS_HISTORY); + 1 mutating-runtime live-guard (Phase B): Snowflake RBAC grant guard (single GRANT to one grantee, REVOKE rollback, written approval token + PREFLIGHT required, ACCOUNTADMIN/SECURITYADMIN/SYSADMIN escalation denied) |
+| 🧱 Databricks | <!-- count:provider:databricks -->20<!-- /count --> | **Cloud-neutral board (static review):** `databricks-maestro-agent` routes on seven axes (intent, business context, artifact type, blast radius, required evidence, implied runtime authority, specialist ownership) to platform architecture (account/workspace topology, metastore-per-region, serverless vs classic), Unity Catalog governance (three-level namespace, GRANT model, workspace-catalog binding, governed tags), identity/network security (SCIM, service principals, OAuth vs PAT, IP access lists, serverless egress, secret scopes), data protection & privacy (row filters, column masks, ABAC, classification, GDPR erasure via REORG/VACUUM, Delta Sharing egress, residency, CMK), Lakeflow pipeline engineering (Lakeflow Spark Declarative Pipelines, medallion, liquid clustering, Auto Loader), streaming reliability (checkpoints, state schema, watermarks, exactly-once, RocksDB), data quality & observability (expectations, Lakehouse Monitoring, drift, freshness), SQL performance (warehouse sizing, Photon, cache tiers, query profile), AI/BI Genie (Genie Agents, metric views, trusted assets), MLOps (MLflow 3, models in Unity Catalog, alias promotion, Model Serving, inference tables), GenAI agent engineering (Agent Framework, Databricks AI Search, MCP, Unity AI Gateway), GenAI evaluation & observability (MLflow Tracing, built-in judges, regression detection), developer platform (Declarative Automation Bundles, run-as, CLI/OAuth, Terraform, Git flows), platform reliability (system tables, job retries/timeouts, cluster policies, managed DR), FinOps cost (billing system tables, tag attribution, DBU uptime, budgets), and value realization (baseline-or-no-number, attribution limits, kill conditions). **Azure-specific `-at-azure` agents** that predate the board and remain alongside it: Unity Catalog governance and lakehouse engineering (ADLS Gen2 / Access Connector / VNet), both static review, plus 1 mutating-runtime live-guard (Phase B): a Unity Catalog schema-scoped grant guard (single GRANT to one principal, REVOKE rollback, written approval token + PREFLIGHT required) |
+| ❄️ Snowflake | <!-- count:provider:snowflake -->28<!-- /count --> | **Review board (static review):** `snowflake-maestro-agent` routes to specialists for effective access computed transitively across grants and ownership, governance/privacy controls, independent compliance-evidence assurance, Cortex AI agent trust boundaries, BCDR (requested vs feasible vs proven RPO/RTO), and economic justification with veto authority. **Live guards (mutating-runtime):** the `snowflake-live-*` guards — RBAC grant, auth/network policy, warehouse cost, data-protection policy, pipeline/streaming change, and failover promotion — each one operation behind a written human gate with preflight, prior-state capture, verification, and rollback; never auto-dispatched. Azure-scoped predecessors are retained as deprecated |
 | 🔗 Cross-functional skills |     3 | `legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy` (protocol skills, not agents) |
 
 ### ⚖️ The Legal + HR cross-functional agentic ecosystem
@@ -631,6 +631,8 @@ Every agent ships:
 - 🗂️ `metadata.json` — schema-validated catalog entry
 - 🔌 Harness adapters — claude-code + codex (EU providers); all 7 adapters for established providers
 
+<!-- agent-tree:start -->
+<!-- Counts generated by scripts/generate-readme-counts.mjs — do not edit by hand. Run: npm run readme-counts:write -->
 ```text
 agents/
 ├── accounting/       (14 agents — maestro + corporate accounting specialists: revenue recognition (ASC 606/IFRS 15), close cycle, consolidation/intercompany, fixed assets, lease accounting (ASC 842), hedge accounting, FX translation, tax provision, payroll, procure-to-pay, equity compensation, indirect tax/e-invoicing, business combinations — all advisory, no ledger writes)
@@ -642,7 +644,8 @@ agents/
 ├── cert-manager/     (1 agent — PKI certificate lifecycle review)
 ├── cilium/           (1 agent — network policy review)
 ├── contabo/          (6 agents — advisory, live instance + storage guards, maestro)
-├── databricks/       (3 agents — Azure Databricks: Unity Catalog governance + lakehouse engineering — static review, -at-azure; + Unity Catalog schema-scoped grant guard — mutating-runtime live-guard, Phase B)
+├── cross-functional/ (1 agent — revenue-critical journey integrity review, spanning the checkout/billing path that no single provider board owns)
+├── databricks/       (20 agents — cloud-neutral board: maestro + 16 static-review specialists across platform architecture, Unity Catalog governance, identity/network security, data protection & privacy, Lakeflow pipelines, streaming reliability, data quality, SQL performance, AI/BI Genie, MLOps, GenAI agent engineering, GenAI evaluation, developer platform, platform reliability, FinOps, value realization; + 2 Azure-specific static-review agents and 1 Unity Catalog schema-scoped grant guard — mutating-runtime live-guard, Phase B, -at-azure)
 ├── dotnet/           (10 agents — C#/runtime, ASP.NET Core, EF Core, testing, NuGet supply chain, performance/AOT, OpenTelemetry, Aspire — maestro + 9 specialists)
 ├── falco/            (1 agent — runtime threat detection review)
 ├── finance/          (8 agents — maestro + corporate finance specialists: variance analysis, FP&A forecasting, treasury/liquidity, working capital, debt/capital structure, capital allocation, transfer pricing/Pillar Two — all advisory, no ERP writes)
@@ -679,6 +682,7 @@ agents/
 ├── sigstore/         (1 agent — supply-chain security review)
 └── terraform/        (9 agents — engine-shared Terraform/OpenTofu board: plan blast radius, state reliability, estate reconciliation, supply-chain integrity, engine compatibility, policy evidence, execution governance, module contract, maestro)
 ```
+<!-- agent-tree:end -->
 
 Example:
 
@@ -803,6 +807,7 @@ Use `--provider` with `--role` to narrow the install to one cloud.
 | `salesforce` | ☁️ Salesforce | 30 |
 | `snowflake` | ❄️ Snowflake | 28 |
 | `netsuite` | 🟫 Oracle NetSuite ERP | 25 |
+| `databricks` | 🧱 Databricks | 20 |
 | `kotlin` | 🟧 Kotlin | 16 |
 | `kubernetes` | ☸️ Kubernetes (cross-cloud) | 16 |
 | `hr` | 👥 HR | 15 |
@@ -822,7 +827,6 @@ Use `--provider` with `--role` to narrow the install to one cloud.
 | `ovhcloud` | ☁️ OVHcloud | 6 |
 | `scaleway` | 🇫🇷 Scaleway | 6 |
 | `php` | 🐘 PHP | 5 |
-| `databricks` | 🧱 Databricks | 3 |
 | `multi-cloud` | 💰 FinOps / multi-cloud | 3 |
 | `argocd` | 🔄 Argo CD + Argo Rollouts (GitOps) | 2 |
 | `backstage` | 🎭 Backstage (IDP / developer platform) | 1 |
@@ -1291,7 +1295,7 @@ In two weeks on npm: ~900 downloads. Socket.dev scores: Vulnerability 100, Quali
 
 Your sponsorship directly funds the compute, API time, and research hours that turn new cloud providers, compliance frameworks, and security patterns into production-ready agents — free for everyone.
 
-Current catalog: **<!-- count:agents -->712<!-- /count --> agents · <!-- count:skills -->737<!-- /count --> skills · <!-- count:providers -->45<!-- /count --> cloud/platform providers**
+Current catalog: **<!-- count:agents -->729<!-- /count --> agents · <!-- count:skills -->754<!-- /count --> skills · <!-- count:providers -->45<!-- /count --> cloud/platform providers**
 
 ---
 

package/agents/AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md — Navigation Compass
 
-141 agents across 18 providers. This file is the index; load provider files on demand.
+<!-- count:global:agents -->729<!-- /count --> agents across <!-- count:global:providers -->45<!-- /count --> providers. This file is the index; load provider files on demand.
 
 ## File structure
 
@@ -9,7 +9,7 @@ agents/<provider>/<agent-id>/AGENT.md          ← harness-neutral role contract
 agents/<provider>/<agent-id>/harnesses/        ← 7 adapters: codex, copilot, claude-code,
                                                   cursor, gemini, kiro-ide, kiro-cli
 agents/<provider>/<agent-id>/metadata.json     ← catalog mirror
-catalog/agents.json                            ← machine-readable index of all 127 agents
+catalog/agents.json                            ← machine-readable index of every agent
 ```
 
 ## Agent tiers
@@ -24,7 +24,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🟧 AWS — 43 agents → [`agents/aws/AGENTS.md`](aws/AGENTS.md)
+## 🟧 AWS — <!-- count:dir:aws:agents -->47<!-- /count --> agents → [`agents/aws/AGENTS.md`](aws/AGENTS.md)
 
 **Entry point:** load `agents/aws/aws-maestro-agent/AGENT.md` for any AWS task; it routes to the right specialist and back.
 
@@ -49,7 +49,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🟦 Azure — 32 agents → [`agents/azure/AGENTS.md`](azure/AGENTS.md)
+## 🟦 Azure — <!-- count:dir:azure:agents -->36<!-- /count --> agents → [`agents/azure/AGENTS.md`](azure/AGENTS.md)
 
 **Entry point:** load `agents/azure/azure-maestro-agent/AGENT.md` for any Azure task.
 
@@ -74,7 +74,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🟥 OCI — 35 agents → [`agents/oci/AGENTS.md`](oci/AGENTS.md)
+## 🟥 OCI — <!-- count:dir:oci:agents -->39<!-- /count --> agents → [`agents/oci/AGENTS.md`](oci/AGENTS.md)
 
 **Entry point:** load `agents/oci/oci-maestro-agent/AGENT.md` for any OCI task.
 
@@ -97,7 +97,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## ☁️ OVHcloud — 6 agents → [`agents/ovhcloud/README.md`](ovhcloud/README.md)
+## ☁️ OVHcloud — <!-- count:dir:ovhcloud:agents -->6<!-- /count --> agents → [`agents/ovhcloud/README.md`](ovhcloud/README.md)
 
 **Entry point:** load `agents/ovhcloud/ovhcloud-maestro-agent/AGENT.md` for any OVHcloud task.
 
@@ -114,7 +114,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🌐 IONOS Cloud — 6 agents → [`agents/ionos/README.md`](ionos/README.md)
+## 🌐 IONOS Cloud — <!-- count:dir:ionos:agents -->6<!-- /count --> agents → [`agents/ionos/README.md`](ionos/README.md)
 
 **Entry point:** load `agents/ionos/ionos-maestro-agent/AGENT.md` for any IONOS Cloud task.
 
@@ -131,7 +131,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🇫🇷 Scaleway — 6 agents → [`agents/scaleway/README.md`](scaleway/README.md)
+## 🇫🇷 Scaleway — <!-- count:dir:scaleway:agents -->6<!-- /count --> agents → [`agents/scaleway/README.md`](scaleway/README.md)
 
 **Entry point:** load `agents/scaleway/scaleway-maestro-agent/AGENT.md` for any Scaleway task.
 
@@ -148,7 +148,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🇩🇪 Hetzner Cloud — 6 agents → [`agents/hetzner/README.md`](hetzner/README.md)
+## 🇩🇪 Hetzner Cloud — <!-- count:dir:hetzner:agents -->6<!-- /count --> agents → [`agents/hetzner/README.md`](hetzner/README.md)
 
 **Entry point:** load `agents/hetzner/hetzner-maestro-agent/AGENT.md` for any Hetzner Cloud task.
 
@@ -164,7 +164,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 💰 Contabo — 6 agents → [`agents/contabo/README.md`](contabo/README.md)
+## 💰 Contabo — <!-- count:dir:contabo:agents -->6<!-- /count --> agents → [`agents/contabo/README.md`](contabo/README.md)
 
 **Entry point:** load `agents/contabo/contabo-maestro-agent/AGENT.md` for any Contabo task.
 
@@ -180,7 +180,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## ☸️ Kubernetes — 13 agents → [`agents/kubernetes/README.md`](kubernetes/README.md)
+## ☸️ Kubernetes — <!-- count:dir:kubernetes:agents -->15<!-- /count --> agents → [`agents/kubernetes/README.md`](kubernetes/README.md)
 
 **Entry point:** load `agents/kubernetes/kubernetes-maestro-agent/AGENT.md` — routes to all K8s specialists (including CNCF domain agents below) and enforces the live-guard gate.
 
@@ -202,7 +202,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 📊 Prometheus — 1 agent → [`agents/prometheus/README.md`](prometheus/README.md)
+## 📊 Prometheus — <!-- count:dir:prometheus:agents -->1<!-- /count --> agents → [`agents/prometheus/README.md`](prometheus/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -210,7 +210,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🦅 Falco — 1 agent → [`agents/falco/README.md`](falco/README.md)
+## 🦅 Falco — <!-- count:dir:falco:agents -->1<!-- /count --> agents → [`agents/falco/README.md`](falco/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -218,7 +218,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🔏 Sigstore — 1 agent → [`agents/sigstore/README.md`](sigstore/README.md)
+## 🔏 Sigstore — <!-- count:dir:sigstore:agents -->1<!-- /count --> agents → [`agents/sigstore/README.md`](sigstore/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -226,7 +226,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🔐 cert-manager — 4 agents → [`agents/cert-manager/README.md`](cert-manager/README.md)
+## 🔐 cert-manager — <!-- count:dir:cert-manager:agents -->1<!-- /count --> agents → [`agents/cert-manager/README.md`](cert-manager/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -237,7 +237,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🔄 FluxCD — 1 agent → [`agents/fluxcd/README.md`](fluxcd/README.md)
+## 🔄 FluxCD — <!-- count:dir:fluxcd:agents -->1<!-- /count --> agents → [`agents/fluxcd/README.md`](fluxcd/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -245,7 +245,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🎭 Backstage — 1 agent → [`agents/backstage/README.md`](backstage/README.md)
+## 🎭 Backstage — <!-- count:dir:backstage:agents -->1<!-- /count --> agents → [`agents/backstage/README.md`](backstage/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -263,7 +263,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🛡️ Kyverno — 1 agent → [`agents/kyverno/README.md`](kyverno/README.md)
+## 🛡️ Kyverno — <!-- count:dir:kyverno:agents -->1<!-- /count --> agents → [`agents/kyverno/README.md`](kyverno/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -273,7 +273,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🔄 Argo CD — 2 agents → [`agents/argocd/README.md`](argocd/README.md)
+## 🔄 Argo CD — <!-- count:dir:argocd:agents -->2<!-- /count --> agents → [`agents/argocd/README.md`](argocd/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -284,7 +284,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🕸️ Istio — 1 agent → [`agents/istio/README.md`](istio/README.md)
+## 🕸️ Istio — <!-- count:dir:istio:agents -->1<!-- /count --> agents → [`agents/istio/README.md`](istio/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -294,7 +294,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🐝 Cilium — 1 agent → [`agents/cilium/README.md`](cilium/README.md)
+## 🐝 Cilium — <!-- count:dir:cilium:agents -->1<!-- /count --> agents → [`agents/cilium/README.md`](cilium/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -304,7 +304,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 📡 OpenTelemetry — 1 agent → [`agents/opentelemetry/README.md`](opentelemetry/README.md)
+## 📡 OpenTelemetry — <!-- count:dir:opentelemetry:agents -->1<!-- /count --> agents → [`agents/opentelemetry/README.md`](opentelemetry/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|
@@ -312,7 +312,7 @@ Live-guard agents refuse to proceed without: target confirmation (cluster/accoun
 
 ---
 
-## 🟩 Terraform / OpenTofu — 9 agents → [`agents/terraform/README.md`](terraform/README.md)
+## 🟩 Terraform / OpenTofu — <!-- count:dir:terraform:agents -->9<!-- /count --> agents → [`agents/terraform/README.md`](terraform/README.md)
 
 Engine-shared board: one provider covers Terraform and OpenTofu, and every specialist
 names the engine behind any version-sensitive claim. See
@@ -334,7 +334,7 @@ agent after a human gate.
 
 ---
 
-## 💰 FinOps / Multi-cloud — 1 agent → [`agents/finops/README.md`](finops/README.md)
+## 💰 FinOps / Multi-cloud — <!-- count:dir:finops:agents -->4<!-- /count --> agents → [`agents/finops/README.md`](finops/README.md)
 
 | Agent | Tier | Load when |
 |---|---|---|

package/agents/README.md

@@ -1,6 +1,6 @@
 # Agents
 
-Role definitions for repeatable review, architecture, operations, and bounded execution work. **386 enterprise-grade, audit-ready agents** organized in a three-layer ecosystem: maestro routers, domain specialists, and cross-functional protocols.
+Role definitions for repeatable review, architecture, operations, and bounded execution work. **<!-- count:global:agents -->729<!-- /count --> enterprise-grade, audit-ready agents** organized in a three-layer ecosystem: maestro routers, domain specialists, and cross-functional protocols.
 
 ## Three-layer agentic architecture
 
@@ -33,7 +33,7 @@ Beyond cloud infrastructure, Vanguard Frontier ships agents for Legal, HR, Marke
 
 The **Legal + HR ecosystem is the proof of concept** for cross-functional agentic coordination. Here's why it matters:
 
-- **28 specialist agents** (13 Legal + 15 HR, each with a maestro router) handle the most legally exposed, audit-heavy, escalation-aware domains in an organization
+- **<!-- count:board:legal+hr:agents -->28<!-- /count --> specialist agents** (<!-- count:board:legal:agents -->13<!-- /count --> Legal + <!-- count:board:hr:agents -->15<!-- /count --> HR, each with a maestro router) handle the most legally exposed, audit-heavy, escalation-aware domains in an organization
 - **3 cross-functional protocol skills** (`legal-hr-routing-protocol`, `legal-hr-case-capsule`, `legal-hr-risk-taxonomy`) define how agents hand off, escalate, and coordinate across organizational boundaries
 - **Real handoff scenarios:** whistleblower reports → both Legal (privilege) and HR (investigation) own it; wrongful-termination exposure → Legal flags risk, HR confirms readiness before execution; data breach → Legal holds, HR freezes personnel actions
 - **Audit-ready design:** every handoff is logged; every escalation has a named decision owner; every irreversible action routes to a human
@@ -51,21 +51,21 @@ Vanguard Frontier's cloud agent portfolios are organized by execution tier: advi
 
 | Provider | Current status | Agents | Notes |
 | --- | --- | ---: | --- |
-| 🟧 AWS | active | 47 | advisory, repo-write execution, and guarded live-AWS operator agents |
-| 🟥 OCI | active | 39 | advisory and guarded live-OCI operator agents |
-| 🟩 GCP | active | 39 | advisory, live-guard operators, maestro router |
-| 🟦 Azure | active | 36 | advisory and guarded live-Azure operator agents |
-| 🟠 Alibaba Cloud | active | 30 | advisory, live-guard operators, maestro router |
-| 🔴 Huawei Cloud | active | 30 | advisory, live-guard operators, maestro router |
-| ☁️ OVHcloud | active | 6 | maestro router, IAM, FinOps, MCK, network architect, KMS live-guard |
-| 🌐 IONOS Cloud | active | 6 | maestro router, DCD review, GDPR/compliance, K8s, FinOps, DBaaS live-guard |
-| 🇫🇷 Scaleway | active | 6 | maestro router, IAM, Kapsule, FinOps, network, Kapsule rollout live-guard |
-| 🇩🇪 Hetzner Cloud | active | 6 | maestro router, FinOps, infra review, capacity, firewall + server live-guards |
-| 💰 Contabo | active | 6 | maestro router, FinOps, capacity, security hardening, instance + storage live-guards |
-| ☸️ Kubernetes | active | 15 | RBAC, workload identity, PSA, live-guards, maestro |
-| 🟩 Terraform | active | 2 | generic IaC review |
-| 💰 Multi-cloud | limited | 1 | FinOps cross-cloud price advisor |
-| CNCF ecosystem | active | 14 | Kyverno, Argo CD, Istio, Cilium, OTEL, Prometheus, Falco, Sigstore, cert-manager, FluxCD, Backstage, Velero |
+| 🟧 AWS | active | <!-- count:board:aws:agents -->47<!-- /count --> | advisory, repo-write execution, and guarded live-AWS operator agents |
+| 🟥 OCI | active | <!-- count:board:oci:agents -->39<!-- /count --> | advisory and guarded live-OCI operator agents |
+| 🟩 GCP | active | <!-- count:board:gcp:agents -->51<!-- /count --> | advisory, live-guard operators, maestro router |
+| 🟦 Azure | active | <!-- count:board:azure:agents -->36<!-- /count --> | advisory and guarded live-Azure operator agents |
+| 🟠 Alibaba Cloud | active | <!-- count:board:alibaba:agents -->43<!-- /count --> | advisory, live-guard operators, maestro router |
+| 🔴 Huawei Cloud | active | <!-- count:board:huawei:agents -->43<!-- /count --> | advisory, live-guard operators, maestro router |
+| ☁️ OVHcloud | active | <!-- count:board:ovhcloud:agents -->6<!-- /count --> | maestro router, IAM, FinOps, MCK, network architect, KMS live-guard |
+| 🌐 IONOS Cloud | active | <!-- count:board:ionos:agents -->6<!-- /count --> | maestro router, DCD review, GDPR/compliance, K8s, FinOps, DBaaS live-guard |
+| 🇫🇷 Scaleway | active | <!-- count:board:scaleway:agents -->6<!-- /count --> | maestro router, IAM, Kapsule, FinOps, network, Kapsule rollout live-guard |
+| 🇩🇪 Hetzner Cloud | active | <!-- count:board:hetzner:agents -->6<!-- /count --> | maestro router, FinOps, infra review, capacity, firewall + server live-guards |
+| 💰 Contabo | active | <!-- count:board:contabo:agents -->6<!-- /count --> | maestro router, FinOps, capacity, security hardening, instance + storage live-guards |
+| ☸️ Kubernetes | active | <!-- count:board:kubernetes:agents -->16<!-- /count --> | RBAC, workload identity, PSA, live-guards, maestro |
+| 🟩 Terraform | active | <!-- count:board:terraform:agents -->9<!-- /count --> | generic IaC review |
+| 💰 Multi-cloud | limited | <!-- count:board:multi-cloud:agents -->3<!-- /count --> | FinOps cross-cloud price advisor |
+| CNCF ecosystem | active | <!-- count:board:kyverno+argocd+istio+cilium+opentelemetry+prometheus+falco+sigstore+cert-manager+fluxcd+backstage:agents -->12<!-- /count --> | Kyverno, Argo CD, Istio, Cilium, OTEL, Prometheus, Falco, Sigstore, cert-manager, FluxCD, Backstage. Velero ships skills only — no agents — so it is not counted here |
 
 ## Agent tiers