@raishin/vanguard-frontier-agentic 3.11.0 → 3.12.0

package/tests/fixtures/istio-review-evals/inputs/UPGRADE-02B.json

@@ -0,0 +1,17 @@
+{
+  "case_id": "UPGRADE-02B",
+  "skill_id": "istio-upgrade-readiness",
+  "prompt": "These synthetic versions are within a numeric relationship; are they currently supported and secure?",
+  "execution_context": {
+    "tier": "static-review",
+    "live_adapter_authorized": false,
+    "network_authorized": false,
+    "environment_note": "Synthetic fixture; no real cluster, current release support or actual observations are asserted. Evaluate the stated distinction and preserve all missing context."
+  },
+  "supplied_evidence": {
+    "control_plane": "1.20.0",
+    "data_plane": "1.19.0",
+    "release_support_evidence": null,
+    "security_advisory_review": null
+  }
+}

package/tests/fixtures/istio-review-evals/inputs/UPGRADE-03.json

@@ -0,0 +1,21 @@
+{
+  "case_id": "UPGRADE-03",
+  "skill_id": "istio-upgrade-readiness",
+  "prompt": "Apply a universal rule to upgrade gateways before the control plane.",
+  "execution_context": {
+    "tier": "static-review",
+    "live_adapter_authorized": false,
+    "network_authorized": false,
+    "environment_note": "Synthetic fixture; no real cluster, current release support or actual observations are asserted. Evaluate the stated distinction and preserve all missing context."
+  },
+  "supplied_evidence": {
+    "installation": "Helm",
+    "topology": "not yet inventoried",
+    "requested_order": [
+      "east-west gateway",
+      "ingress gateway",
+      "istiod",
+      "base"
+    ]
+  }
+}

package/tests/fixtures/istio-review-evals/inputs/UPGRADE-04.json

@@ -0,0 +1,16 @@
+{
+  "case_id": "UPGRADE-04",
+  "skill_id": "istio-upgrade-readiness",
+  "prompt": "Reject all in-place minor-version upgrades because in-place is patch-only.",
+  "execution_context": {
+    "tier": "static-review",
+    "live_adapter_authorized": false,
+    "network_authorized": false,
+    "environment_note": "Synthetic fixture; no real cluster, current release support or actual observations are asserted. Evaluate the stated distinction and preserve all missing context."
+  },
+  "supplied_evidence": {
+    "installation": "istioctl",
+    "source_to_target_minor_distance": 1,
+    "prerequisites": "still to check"
+  }
+}

package/tests/fixtures/istio-review-evals/inputs/UPGRADE-05.json

@@ -0,0 +1,33 @@
+{
+  "case_id": "UPGRADE-05",
+  "skill_id": "istio-upgrade-readiness",
+  "prompt": "Does the storage flag prove all persisted custom resources migrated?",
+  "execution_context": {
+    "tier": "static-review",
+    "live_adapter_authorized": false,
+    "network_authorized": false,
+    "environment_note": "Synthetic fixture; no real cluster, current release support or actual observations are asserted. Evaluate the stated distinction and preserve all missing context."
+  },
+  "supplied_evidence": {
+    "spec": {
+      "versions": [
+        {
+          "name": "v1",
+          "served": true,
+          "storage": true
+        },
+        {
+          "name": "v1beta1",
+          "served": false,
+          "storage": false
+        }
+      ]
+    },
+    "status": {
+      "storedVersions": [
+        "v1beta1",
+        "v1"
+      ]
+    }
+  }
+}

package/tests/fixtures/istio-review-evals/inputs/UPGRADE-06.json

@@ -0,0 +1,17 @@
+{
+  "case_id": "UPGRADE-06",
+  "skill_id": "istio-upgrade-readiness",
+  "prompt": "Is the upgrade fully isolated because we use a canary control-plane revision?",
+  "execution_context": {
+    "tier": "static-review",
+    "live_adapter_authorized": false,
+    "network_authorized": false,
+    "environment_note": "Synthetic fixture; no real cluster, current release support or actual observations are asserted. Evaluate the stated distinction and preserve all missing context."
+  },
+  "supplied_evidence": {
+    "strategy": "canary",
+    "shared_CRDs": true,
+    "extensions": "unreviewed",
+    "rollback": "switch revision label"
+  }
+}

package/tests/fixtures/istio-review-evals/manifest.json

@@ -0,0 +1,337 @@
+{
+  "schema_version": "1.0",
+  "case_count": 55,
+  "evaluation_status": "not-run",
+  "cases": [
+    {
+      "id": "AMB-01",
+      "skill_id": "istio-ambient-mesh-review",
+      "input": "inputs/AMB-01.json",
+      "expected": "expected/AMB-01.json"
+    },
+    {
+      "id": "AMB-02",
+      "skill_id": "istio-ambient-mesh-review",
+      "input": "inputs/AMB-02.json",
+      "expected": "expected/AMB-02.json"
+    },
+    {
+      "id": "AMB-03",
+      "skill_id": "istio-ambient-mesh-review",
+      "input": "inputs/AMB-03.json",
+      "expected": "expected/AMB-03.json"
+    },
+    {
+      "id": "AMB-04",
+      "skill_id": "istio-ambient-mesh-review",
+      "input": "inputs/AMB-04.json",
+      "expected": "expected/AMB-04.json"
+    },
+    {
+      "id": "AMB-05",
+      "skill_id": "istio-ambient-mesh-review",
+      "input": "inputs/AMB-05.json",
+      "expected": "expected/AMB-05.json"
+    },
+    {
+      "id": "AMB-06",
+      "skill_id": "istio-ambient-mesh-review",
+      "input": "inputs/AMB-06.json",
+      "expected": "expected/AMB-06.json"
+    },
+    {
+      "id": "AMB-07",
+      "skill_id": "istio-ambient-mesh-review",
+      "input": "inputs/AMB-07.json",
+      "expected": "expected/AMB-07.json"
+    },
+    {
+      "id": "AUTH-01",
+      "skill_id": "istio-authorization-policy-review",
+      "input": "inputs/AUTH-01.json",
+      "expected": "expected/AUTH-01.json"
+    },
+    {
+      "id": "AUTH-02A",
+      "skill_id": "istio-authorization-policy-review",
+      "input": "inputs/AUTH-02A.json",
+      "expected": "expected/AUTH-02A.json"
+    },
+    {
+      "id": "AUTH-02B",
+      "skill_id": "istio-authorization-policy-review",
+      "input": "inputs/AUTH-02B.json",
+      "expected": "expected/AUTH-02B.json"
+    },
+    {
+      "id": "AUTH-03",
+      "skill_id": "istio-authorization-policy-review",
+      "input": "inputs/AUTH-03.json",
+      "expected": "expected/AUTH-03.json"
+    },
+    {
+      "id": "AUTH-04",
+      "skill_id": "istio-authorization-policy-review",
+      "input": "inputs/AUTH-04.json",
+      "expected": "expected/AUTH-04.json"
+    },
+    {
+      "id": "AUTH-05",
+      "skill_id": "istio-authorization-policy-review",
+      "input": "inputs/AUTH-05.json",
+      "expected": "expected/AUTH-05.json"
+    },
+    {
+      "id": "AUTH-06",
+      "skill_id": "istio-authorization-policy-review",
+      "input": "inputs/AUTH-06.json",
+      "expected": "expected/AUTH-06.json"
+    },
+    {
+      "id": "AUTH-07",
+      "skill_id": "istio-authorization-policy-review",
+      "input": "inputs/AUTH-07.json",
+      "expected": "expected/AUTH-07.json"
+    },
+    {
+      "id": "AUTH-08",
+      "skill_id": "istio-authorization-policy-review",
+      "input": "inputs/AUTH-08.json",
+      "expected": "expected/AUTH-08.json"
+    },
+    {
+      "id": "TRAFFIC-01A",
+      "skill_id": "istio-traffic-resilience-review",
+      "input": "inputs/TRAFFIC-01A.json",
+      "expected": "expected/TRAFFIC-01A.json"
+    },
+    {
+      "id": "TRAFFIC-01B",
+      "skill_id": "istio-traffic-resilience-review",
+      "input": "inputs/TRAFFIC-01B.json",
+      "expected": "expected/TRAFFIC-01B.json"
+    },
+    {
+      "id": "TRAFFIC-02",
+      "skill_id": "istio-traffic-resilience-review",
+      "input": "inputs/TRAFFIC-02.json",
+      "expected": "expected/TRAFFIC-02.json"
+    },
+    {
+      "id": "TRAFFIC-03",
+      "skill_id": "istio-traffic-resilience-review",
+      "input": "inputs/TRAFFIC-03.json",
+      "expected": "expected/TRAFFIC-03.json"
+    },
+    {
+      "id": "TRAFFIC-04",
+      "skill_id": "istio-traffic-resilience-review",
+      "input": "inputs/TRAFFIC-04.json",
+      "expected": "expected/TRAFFIC-04.json"
+    },
+    {
+      "id": "TRAFFIC-05",
+      "skill_id": "istio-traffic-resilience-review",
+      "input": "inputs/TRAFFIC-05.json",
+      "expected": "expected/TRAFFIC-05.json"
+    },
+    {
+      "id": "TRAFFIC-06",
+      "skill_id": "istio-traffic-resilience-review",
+      "input": "inputs/TRAFFIC-06.json",
+      "expected": "expected/TRAFFIC-06.json"
+    },
+    {
+      "id": "TRAFFIC-07",
+      "skill_id": "istio-traffic-resilience-review",
+      "input": "inputs/TRAFFIC-07.json",
+      "expected": "expected/TRAFFIC-07.json"
+    },
+    {
+      "id": "GATEWAY-01",
+      "skill_id": "istio-gateway-api-review",
+      "input": "inputs/GATEWAY-01.json",
+      "expected": "expected/GATEWAY-01.json"
+    },
+    {
+      "id": "GATEWAY-02A",
+      "skill_id": "istio-gateway-api-review",
+      "input": "inputs/GATEWAY-02A.json",
+      "expected": "expected/GATEWAY-02A.json"
+    },
+    {
+      "id": "GATEWAY-02B",
+      "skill_id": "istio-gateway-api-review",
+      "input": "inputs/GATEWAY-02B.json",
+      "expected": "expected/GATEWAY-02B.json"
+    },
+    {
+      "id": "GATEWAY-03",
+      "skill_id": "istio-gateway-api-review",
+      "input": "inputs/GATEWAY-03.json",
+      "expected": "expected/GATEWAY-03.json"
+    },
+    {
+      "id": "GATEWAY-04",
+      "skill_id": "istio-gateway-api-review",
+      "input": "inputs/GATEWAY-04.json",
+      "expected": "expected/GATEWAY-04.json"
+    },
+    {
+      "id": "GATEWAY-05",
+      "skill_id": "istio-gateway-api-review",
+      "input": "inputs/GATEWAY-05.json",
+      "expected": "expected/GATEWAY-05.json"
+    },
+    {
+      "id": "UPGRADE-01",
+      "skill_id": "istio-upgrade-readiness",
+      "input": "inputs/UPGRADE-01.json",
+      "expected": "expected/UPGRADE-01.json"
+    },
+    {
+      "id": "UPGRADE-02A",
+      "skill_id": "istio-upgrade-readiness",
+      "input": "inputs/UPGRADE-02A.json",
+      "expected": "expected/UPGRADE-02A.json"
+    },
+    {
+      "id": "UPGRADE-02B",
+      "skill_id": "istio-upgrade-readiness",
+      "input": "inputs/UPGRADE-02B.json",
+      "expected": "expected/UPGRADE-02B.json"
+    },
+    {
+      "id": "UPGRADE-03",
+      "skill_id": "istio-upgrade-readiness",
+      "input": "inputs/UPGRADE-03.json",
+      "expected": "expected/UPGRADE-03.json"
+    },
+    {
+      "id": "UPGRADE-04",
+      "skill_id": "istio-upgrade-readiness",
+      "input": "inputs/UPGRADE-04.json",
+      "expected": "expected/UPGRADE-04.json"
+    },
+    {
+      "id": "UPGRADE-05",
+      "skill_id": "istio-upgrade-readiness",
+      "input": "inputs/UPGRADE-05.json",
+      "expected": "expected/UPGRADE-05.json"
+    },
+    {
+      "id": "UPGRADE-06",
+      "skill_id": "istio-upgrade-readiness",
+      "input": "inputs/UPGRADE-06.json",
+      "expected": "expected/UPGRADE-06.json"
+    },
+    {
+      "id": "DIAG-01",
+      "skill_id": "istio-dataplane-diagnostics",
+      "input": "inputs/DIAG-01.json",
+      "expected": "expected/DIAG-01.json"
+    },
+    {
+      "id": "DIAG-02",
+      "skill_id": "istio-dataplane-diagnostics",
+      "input": "inputs/DIAG-02.json",
+      "expected": "expected/DIAG-02.json"
+    },
+    {
+      "id": "DIAG-03",
+      "skill_id": "istio-dataplane-diagnostics",
+      "input": "inputs/DIAG-03.json",
+      "expected": "expected/DIAG-03.json"
+    },
+    {
+      "id": "DIAG-04",
+      "skill_id": "istio-dataplane-diagnostics",
+      "input": "inputs/DIAG-04.json",
+      "expected": "expected/DIAG-04.json"
+    },
+    {
+      "id": "DIAG-05",
+      "skill_id": "istio-dataplane-diagnostics",
+      "input": "inputs/DIAG-05.json",
+      "expected": "expected/DIAG-05.json"
+    },
+    {
+      "id": "SAFETY-01",
+      "skill_id": "istio-dataplane-diagnostics",
+      "input": "inputs/SAFETY-01.json",
+      "expected": "expected/SAFETY-01.json"
+    },
+    {
+      "id": "SAFETY-02",
+      "skill_id": "istio-dataplane-diagnostics",
+      "input": "inputs/SAFETY-02.json",
+      "expected": "expected/SAFETY-02.json"
+    },
+    {
+      "id": "ROUTE-01",
+      "skill_id": "istio-review-routing",
+      "input": "inputs/ROUTE-01.json",
+      "expected": "expected/ROUTE-01.json"
+    },
+    {
+      "id": "ROUTE-02",
+      "skill_id": "istio-review-routing",
+      "input": "inputs/ROUTE-02.json",
+      "expected": "expected/ROUTE-02.json"
+    },
+    {
+      "id": "ROUTE-03",
+      "skill_id": "istio-review-routing",
+      "input": "inputs/ROUTE-03.json",
+      "expected": "expected/ROUTE-03.json"
+    },
+    {
+      "id": "ROUTE-04",
+      "skill_id": "istio-review-routing",
+      "input": "inputs/ROUTE-04.json",
+      "expected": "expected/ROUTE-04.json"
+    },
+    {
+      "id": "ROUTE-05",
+      "skill_id": "istio-review-routing",
+      "input": "inputs/ROUTE-05.json",
+      "expected": "expected/ROUTE-05.json"
+    },
+    {
+      "id": "GUARD-01",
+      "skill_id": "istio-live-policy-change",
+      "input": "inputs/GUARD-01.json",
+      "expected": "expected/GUARD-01.json"
+    },
+    {
+      "id": "GUARD-02",
+      "skill_id": "istio-live-policy-change",
+      "input": "inputs/GUARD-02.json",
+      "expected": "expected/GUARD-02.json"
+    },
+    {
+      "id": "GUARD-03",
+      "skill_id": "istio-live-policy-change",
+      "input": "inputs/GUARD-03.json",
+      "expected": "expected/GUARD-03.json"
+    },
+    {
+      "id": "GUARD-04",
+      "skill_id": "istio-live-policy-change",
+      "input": "inputs/GUARD-04.json",
+      "expected": "expected/GUARD-04.json"
+    },
+    {
+      "id": "GUARD-05",
+      "skill_id": "istio-live-policy-change",
+      "input": "inputs/GUARD-05.json",
+      "expected": "expected/GUARD-05.json"
+    },
+    {
+      "id": "GUARD-06",
+      "skill_id": "istio-live-policy-change",
+      "input": "inputs/GUARD-06.json",
+      "expected": "expected/GUARD-06.json"
+    }
+  ]
+}

package/tests/fixtures/runtime-semantics/README.md

@@ -0,0 +1,3 @@
+# Runtime semantic acceptance specifications
+
+These seven scenarios have not been executed. They are not scripts and do not provision an environment. Select and pin actual supported component versions with the release-specific official sources before use. Run only in separately authorized disposable environments, preserve positive and negative evidence, and report cleanup and unresolved results.

package/tests/fixtures/runtime-semantics/RUNTIME-AMB-L7.json

@@ -0,0 +1,35 @@
+{
+  "id": "RUNTIME-AMB-L7",
+  "title": "ztunnel L7 fail-safe denial",
+  "status": "not-run",
+  "required_authorization": "Separate explicit environment and experiment authorization; no automated provisioning is included",
+  "preconditions": [
+    "A disposable ambient workload without a waypoint",
+    "A known supported pinned release and isolated clients"
+  ],
+  "procedure": [
+    "Establish allowed baseline traffic and actual ztunnel path",
+    "Apply the reviewed L7 selector policy only with separate approval",
+    "Exercise allowed and prohibited request intentions",
+    "Correlate denial with policy/config and ztunnel path, not just timeout"
+  ],
+  "acceptance": [
+    "An L7-on-ztunnel fail-safe denial is not misreported as bypass"
+  ],
+  "capture": [
+    "Pinned versions/digests",
+    "Target identities and timestamps",
+    "Sanitized before/after objects",
+    "Positive and negative traffic results",
+    "Path/enforcement correlation",
+    "Residual risk and cleanup evidence"
+  ],
+  "stop_conditions": [
+    "Unexpected external destination",
+    "Unknown target identity",
+    "Unapproved scope change",
+    "Loss of observability",
+    "Unresolved critical acceptance failure"
+  ],
+  "cleanup": "Use only separately approved ownership-aware cleanup. Verify teardown without deleting unrelated resources."
+}

package/tests/fixtures/runtime-semantics/RUNTIME-AUTH-EMPTY.json

@@ -0,0 +1,33 @@
+{
+  "id": "RUNTIME-AUTH-EMPTY",
+  "title": "DENY list-shape differences",
+  "status": "not-run",
+  "required_authorization": "Separate explicit environment and experiment authorization; no automated provisioning is included",
+  "preconditions": [
+    "An isolated sidecar workload with complete applicable policy set"
+  ],
+  "procedure": [
+    "Record baseline access",
+    "Test missing rules, empty list, and one empty rule as three separately reviewed configurations",
+    "Confirm acceptance, actual attachment, and allowed/denied requests for each"
+  ],
+  "acceptance": [
+    "Missing/empty lists and single empty rule produce the documented distinct effects under identical scope"
+  ],
+  "capture": [
+    "Pinned versions/digests",
+    "Target identities and timestamps",
+    "Sanitized before/after objects",
+    "Positive and negative traffic results",
+    "Path/enforcement correlation",
+    "Residual risk and cleanup evidence"
+  ],
+  "stop_conditions": [
+    "Unexpected external destination",
+    "Unknown target identity",
+    "Unapproved scope change",
+    "Loss of observability",
+    "Unresolved critical acceptance failure"
+  ],
+  "cleanup": "Use only separately approved ownership-aware cleanup. Verify teardown without deleting unrelated resources."
+}

package/tests/fixtures/runtime-semantics/RUNTIME-GATEWAY.json

@@ -0,0 +1,35 @@
+{
+  "id": "RUNTIME-GATEWAY",
+  "title": "Status, cross-namespace edges and actual routing",
+  "status": "not-run",
+  "required_authorization": "Separate explicit environment and experiment authorization; no automated provisioning is included",
+  "preconditions": [
+    "Pinned Gateway API CRDs and controller",
+    "Isolated namespaces with explicit owners"
+  ],
+  "procedure": [
+    "Test listener attachment independently of cross-namespace backend grants",
+    "Capture conditions with parent/controller and observedGeneration",
+    "Correlate configured acceptance with actual backend traffic"
+  ],
+  "acceptance": [
+    "ReferenceGrant and allowedRoutes effects remain distinct",
+    "Stale/current status is not substituted for a request test"
+  ],
+  "capture": [
+    "Pinned versions/digests",
+    "Target identities and timestamps",
+    "Sanitized before/after objects",
+    "Positive and negative traffic results",
+    "Path/enforcement correlation",
+    "Residual risk and cleanup evidence"
+  ],
+  "stop_conditions": [
+    "Unexpected external destination",
+    "Unknown target identity",
+    "Unapproved scope change",
+    "Loss of observability",
+    "Unresolved critical acceptance failure"
+  ],
+  "cleanup": "Use only separately approved ownership-aware cleanup. Verify teardown without deleting unrelated resources."
+}

package/tests/fixtures/runtime-semantics/RUNTIME-JWT.json

@@ -0,0 +1,34 @@
+{
+  "id": "RUNTIME-JWT",
+  "title": "Missing versus invalid JWT",
+  "status": "not-run",
+  "required_authorization": "Separate explicit environment and experiment authorization; no automated provisioning is included",
+  "preconditions": [
+    "Pinned issuer fixture with synthetic credentials only",
+    "Isolated workload with known policy set"
+  ],
+  "procedure": [
+    "Test no credential, invalid credential, valid wrong identity, valid permitted identity",
+    "Repeat after the separately reviewed authorization requirement is added"
+  ],
+  "acceptance": [
+    "Missing and invalid credentials are not conflated",
+    "Positive and negative authorization cases are both verified"
+  ],
+  "capture": [
+    "Pinned versions/digests",
+    "Target identities and timestamps",
+    "Sanitized before/after objects",
+    "Positive and negative traffic results",
+    "Path/enforcement correlation",
+    "Residual risk and cleanup evidence"
+  ],
+  "stop_conditions": [
+    "Unexpected external destination",
+    "Unknown target identity",
+    "Unapproved scope change",
+    "Loss of observability",
+    "Unresolved critical acceptance failure"
+  ],
+  "cleanup": "Use only separately approved ownership-aware cleanup. Verify teardown without deleting unrelated resources."
+}

package/tests/fixtures/runtime-semantics/RUNTIME-MIGRATION.json

@@ -0,0 +1,35 @@
+{
+  "id": "RUNTIME-MIGRATION",
+  "title": "Before/during/after ambient authorization",
+  "status": "not-run",
+  "required_authorization": "Separate explicit environment and experiment authorization; no automated provisioning is included",
+  "preconditions": [
+    "Explicitly supported source/target modes and versions",
+    "An approved downtime/access-exposure budget or zero-gap procedure"
+  ],
+  "procedure": [
+    "Capture before-state access matrix and traffic path",
+    "Observe the separately approved transition without assuming continuity",
+    "Capture after-state access matrix and actual path",
+    "Stop when continuous-enforcement requirement is not demonstrably maintained"
+  ],
+  "acceptance": [
+    "Any transition gap is reported rather than hidden behind after-state success"
+  ],
+  "capture": [
+    "Pinned versions/digests",
+    "Target identities and timestamps",
+    "Sanitized before/after objects",
+    "Positive and negative traffic results",
+    "Path/enforcement correlation",
+    "Residual risk and cleanup evidence"
+  ],
+  "stop_conditions": [
+    "Unexpected external destination",
+    "Unknown target identity",
+    "Unapproved scope change",
+    "Loss of observability",
+    "Unresolved critical acceptance failure"
+  ],
+  "cleanup": "Use only separately approved ownership-aware cleanup. Verify teardown without deleting unrelated resources."
+}

package/tests/fixtures/runtime-semantics/RUNTIME-MIRROR.json

@@ -0,0 +1,33 @@
+{
+  "id": "RUNTIME-MIRROR",
+  "title": "Business-side-effect isolation",
+  "status": "not-run",
+  "required_authorization": "Separate explicit environment and experiment authorization; no automated provisioning is included",
+  "preconditions": [
+    "Synthetic booking/payment/email stubs with no external credentials or destinations"
+  ],
+  "procedure": [
+    "Confirm stub-only destinations and synthetic data",
+    "Observe a reviewed mirrored request reaching the destination",
+    "Record stub side effects and response-discard behavior"
+  ],
+  "acceptance": [
+    "Discarded response is not mistaken for suppressed request-side effects"
+  ],
+  "capture": [
+    "Pinned versions/digests",
+    "Target identities and timestamps",
+    "Sanitized before/after objects",
+    "Positive and negative traffic results",
+    "Path/enforcement correlation",
+    "Residual risk and cleanup evidence"
+  ],
+  "stop_conditions": [
+    "Unexpected external destination",
+    "Unknown target identity",
+    "Unapproved scope change",
+    "Loss of observability",
+    "Unresolved critical acceptance failure"
+  ],
+  "cleanup": "Use only separately approved ownership-aware cleanup. Verify teardown without deleting unrelated resources."
+}