@raishin/vanguard-frontier-agentic 3.11.0 → 3.12.0

package/tests/validate-catalog.py

@@ -342,6 +342,154 @@ def validate_guarded_live_kubernetes_agents() -> None:
             )
 
 
+# Adapter files that prove a harness actually ships, mapped to the `harnesses` value
+# that must then be declared.
+HARNESS_ADAPTER_FILES = {
+    "codex.toml": "codex",
+    "copilot.agent.md": "copilot",
+    "claude-code.agent.md": "claude-code",
+    "cursor.agent.md": "cursor",
+    "gemini.agent.md": "gemini",
+    "kiro-ide.agent.md": "kiro",
+    "kiro-cli.agent.json": "kiro",
+}
+
+# Kiro is the one harness whose single `harnesses` value covers TWO adapter files, and the
+# exporter emits both. Collapsing them into one set member would let a half-shipped Kiro
+# adapter pass: with only kiro-ide.agent.md present, `kiro` is still in the on-disk set, the
+# declaration matches, and the export later fails on the missing kiro-cli.agent.json. So the
+# pair is checked explicitly rather than through the collapsed mapping.
+KIRO_REQUIRED_FILES = ("kiro-ide.agent.md", "kiro-cli.agent.json")
+
+
+def validate_harness_declarations() -> None:
+    """Every agent's `harnesses` must match the adapters it ships AND the catalog entry.
+
+    Three independent failures, each of which has actually happened or was one edit away:
+
+      * UNDER-declared (adapter on disk, harness absent from `harnesses`) makes a shipped
+        adapter invisible to everything that filters on the catalog. ionos, ovhcloud, and
+        scaleway each shipped all seven adapter files while declaring only codex and
+        claude-code, so generate-cursor-plugin.mjs omitted 18 real cursor adapters and
+        generate-kiro-powers.mjs dropped three real Kiro Powers.
+
+      * OVER-declared (harness claimed, no adapter file) promises an install path that does
+        not exist, failing at the user's `vfa-export-agents` rather than here.
+
+      * CATALOG DRIFT (metadata.json and catalog/agents.json disagree). catalog/agents.json
+        has no full regenerator — only an upsert — so fixing metadata.json does NOT update
+        it, and the catalog is what every generator actually reads. Checking metadata
+        against disk alone would report success while the original user-facing breakage
+        remained. This is not hypothetical: resyncing those 18 catalog entries was a
+        separate manual step from fixing their metadata.
+    """
+    problems: list[str] = []
+
+    catalog_harnesses: dict[str, list] = {}
+    catalog_agents = load_json(ROOT / "catalog" / "agents.json")
+    if isinstance(catalog_agents, dict):
+        catalog_agents = catalog_agents.get("agents", [])
+    for entry in catalog_agents:
+        if isinstance(entry, dict) and entry.get("type") == "agent":
+            catalog_harnesses[entry["id"]] = entry.get("harnesses") or []
+
+    for metadata_path in sorted(ROOT.glob("agents/*/*/metadata.json")):
+        data = load_json(metadata_path)
+        agent_id = data.get("id", metadata_path.parent.name)
+        declared = set(data.get("harnesses") or [])
+        harness_dir = metadata_path.parent / "harnesses"
+        present_files = (
+            {entry.name for entry in harness_dir.iterdir() if entry.is_file()}
+            if harness_dir.is_dir()
+            else set()
+        )
+        on_disk = {
+            HARNESS_ADAPTER_FILES[name]
+            for name in present_files
+            if name in HARNESS_ADAPTER_FILES
+        }
+        # "other" is a catalog-only escape hatch with no adapter file of its own.
+        declared.discard("other")
+
+        if on_disk - declared:
+            problems.append(
+                f"{agent_id}: ships adapters for {sorted(on_disk - declared)} "
+                f"but does not declare them in harnesses"
+            )
+        if declared - on_disk:
+            problems.append(
+                f"{agent_id}: declares harnesses {sorted(declared - on_disk)} "
+                f"with no matching adapter file"
+            )
+
+        # Kiro's two adapter files are checked as a pair, not through the collapsed value.
+        kiro_missing = [f for f in KIRO_REQUIRED_FILES if f not in present_files]
+        if "kiro" in declared and kiro_missing:
+            problems.append(
+                f"{agent_id}: declares the kiro harness but is missing {sorted(kiro_missing)} "
+                f"— both Kiro adapter files are required"
+            )
+        if kiro_missing and len(kiro_missing) == 1:
+            problems.append(
+                f"{agent_id}: ships a partial Kiro adapter — has "
+                f"{sorted(set(KIRO_REQUIRED_FILES) - set(kiro_missing))}, missing {kiro_missing}"
+            )
+
+        # The catalog is what the generators read; metadata alone proves nothing about them.
+        if agent_id in catalog_harnesses:
+            if sorted(catalog_harnesses[agent_id]) != sorted(data.get("harnesses") or []):
+                problems.append(
+                    f"{agent_id}: catalog/agents.json declares "
+                    f"{sorted(catalog_harnesses[agent_id])} but metadata.json declares "
+                    f"{sorted(data.get('harnesses') or [])} — resync the catalog entry"
+                )
+
+    assert_true(
+        not problems,
+        "harness declarations disagree with shipped adapters or the catalog:\n  - "
+        + "\n  - ".join(problems),
+    )
+
+
+def validate_tui_provider_enum() -> None:
+    """Every catalog provider must have a variant in the vfa-tui `Provider` enum.
+
+    tools/vfa-tui deserializes catalog/agents.json into a serde enum with
+    `deny_unknown_fields`, so a provider the enum does not know makes the whole catalog
+    fail to load and the TUI unusable. A Rust test already asserts this — but CI's
+    vfa-tui workflow is path-filtered to `tools/vfa-tui/**` (see
+    .github/workflows/vfa-tui-ci.yml), so a catalog-only PR that adds a provider never
+    triggers it and merges green while leaving the TUI broken. CLAUDE.md documents that
+    trap and asks contributors to remember `cargo test`; this makes remembering
+    unnecessary, because `npm run validate` is not path-filtered.
+
+    Parsed, never executed: variant names are read with a regex and converted to the
+    kebab-case slugs serde produces via `rename_all`, plus any explicit `rename = "..."`.
+    """
+    enum_path = ROOT / "tools" / "vfa-tui" / "src" / "models" / "provider.rs"
+    if not enum_path.exists():
+        # The TUI is optional to the catalog's correctness; absence is not a catalog error.
+        return
+    source = enum_path.read_text(encoding="utf8")
+    variants = re.findall(r"^\s{4}([A-Z][A-Za-z0-9]*),\s*$", source, re.MULTILINE)
+    slugs = {re.sub(r"(?<!^)(?=[A-Z])", "-", v).lower() for v in variants}
+    slugs |= set(re.findall(r'rename\s*=\s*"([a-z0-9-]+)"', source))
+
+    providers = set()
+    for entry in load_json(ROOT / "catalog" / "agents.json"):
+        if isinstance(entry, dict) and entry.get("provider"):
+            providers.add(entry["provider"])
+
+    missing = sorted(providers - slugs)
+    assert_true(
+        not missing,
+        "catalog providers with no variant in tools/vfa-tui/src/models/provider.rs: "
+        + f"{missing}. The TUI deserializes catalog/agents.json with a strict enum, so "
+        + "the catalog will fail to load entirely. Add the variant (kebab-case serde) and "
+        + "run `cargo test` in tools/vfa-tui.",
+    )
+
+
 def main() -> int:
     errors: list[str] = []
     seen_ids: set[str] = set()
@@ -364,6 +512,14 @@ def main() -> int:
         validate_codex_harness_adapters()
     except AssertionError as exc:
         errors.append(str(exc))
+    try:
+        validate_harness_declarations()
+    except AssertionError as exc:
+        errors.append(str(exc))
+    try:
+        validate_tui_provider_enum()
+    except AssertionError as exc:
+        errors.append(str(exc))
     try:
         validate_markdown_agent_templates()
     except AssertionError as exc:

package/tests/validate-model-params.py

@@ -0,0 +1,161 @@
+#!/usr/bin/env python3
+"""Gate: Cursor per-model parameter groups are accepted or rejected correctly.
+
+`scripts/model-policy.mjs` accepts Cursor's documented per-model parameter
+group appended to a model id in square brackets, e.g.
+
+    claude-opus-5[effort=high,context=300k]
+
+The registry namespace pattern only shapes that group (a nested-quantifier
+regex is rejected by the registry's own ReDoS guard), so the structure — the
+documented keys, the key=value shape, and no duplicates — is enforced
+semantically inside the script. `validate:model-policy` only runs `check`
+against the committed policy, which exercises the accepting path alone; this
+gate pins the rejecting paths too, so the semantic validation cannot quietly
+stop working.
+
+Every case runs through `set --dry-run`, which validates the resulting policy
+without writing anything.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+ENGINE = REPO / "scripts" / "model-policy.mjs"
+POLICY_SCHEMA = REPO / "schemas" / "model-policy.schema.json"
+
+# (model value, should_be_accepted, why)
+CASES: list[tuple[str, bool, str]] = [
+    ("composer-2.5", True, "bare registered id, no parameter group"),
+    ("claude-opus-5[effort=high]", True, "single documented key"),
+    ("gpt-5.6-sol[effort=high,context=300k]", True, "two documented keys"),
+    ("composer-2[fast=false]", True, "the fast key, boolean-ish value"),
+    ("claude-opus-5[bogus=1]", False, "undocumented key"),
+    ("claude-opus-5[effort=high,bogus=1]", False, "one good key, one undocumented"),
+    ("claude-opus-5[effort]", False, "missing =value"),
+    ("claude-opus-5[=high]", False, "missing key"),
+    ("claude-opus-5[effort=]", False, "empty value"),
+    ("claude-opus-5[]", False, "empty parameter group"),
+    ("claude-opus-5[effort=high,effort=low]", False, "duplicate key"),
+    ("claude-opus-5[effort=high=low]", False, "two separators in one pair"),
+    ("claude-opus-5[effort=high,context=300k=x]", False, "two separators in the second pair"),
+    ("claude-opus-5[=]", False, "separator with neither key nor value"),
+    ("not-a-registered-model[effort=high]", False, "base id absent from the allowlist"),
+    ("claude-opus-5[a=1][b=2]", False, "two groups"),
+    ("claude-opus-5[effort=high]trailing", False, "group not at the end"),
+]
+
+
+def pick_agent_id() -> str:
+    """An agent id that exists in the catalog, so the scope resolves."""
+    agents = json.loads((REPO / "catalog" / "agents.json").read_text(encoding="utf-8"))
+    if not agents:
+        raise SystemExit("ERROR: catalog/agents.json is empty; cannot scope the probe")
+    return sorted(a["id"] for a in agents)[0]
+
+
+def accepted(agent_id: str, model: str) -> tuple[bool, str]:
+    proc = subprocess.run(
+        [
+            "node",
+            str(ENGINE),
+            "set",
+            "--scope",
+            f"agent={agent_id}",
+            "--harness",
+            "cursor",
+            "--model",
+            model,
+            "--dry-run",
+        ],
+        cwd=REPO,
+        capture_output=True,
+        text=True,
+    )
+    return proc.returncode == 0, (proc.stdout + proc.stderr).strip()
+
+
+def schema_model_pattern() -> str:
+    """The `model` pattern the policy schema declares for a rule."""
+    schema = json.loads(POLICY_SCHEMA.read_text(encoding="utf-8"))
+    return schema["properties"]["rules"]["items"]["properties"]["model"]["pattern"]
+
+
+def check_schema_agrees(accepted_models: list[str]) -> list[str]:
+    """The script and the schema must agree on what a rule may contain.
+
+    A non-dry-run `set` writes the model value straight into
+    `catalog/model-policy.json`. If the script accepts a value the schema's
+    `model` pattern rejects, every policy using it is invalid under its own
+    declared contract and a schema-aware consumer will refuse it — a mismatch
+    the script's own validator can never surface, which is why it is asserted
+    here rather than left to the engine.
+    """
+    problems: list[str] = []
+    pattern = schema_model_pattern()
+    compiled = re.compile(pattern)
+    for model in accepted_models:
+        if not compiled.match(model):
+            problems.append(
+                f"schemas/model-policy.schema.json rejects {model!r}, which "
+                f"scripts/model-policy.mjs accepts (schema pattern: {pattern})"
+            )
+    # Values from other harnesses must keep working under the same pattern.
+    for model in ("qwen3:32b", "anthropic/claude-sonnet-4.5", "gpt-5.5", "auto", "inherit"):
+        if not compiled.match(model):
+            problems.append(
+                f"schemas/model-policy.schema.json rejects {model!r}, a value other "
+                f"harnesses rely on (schema pattern: {pattern})"
+            )
+    return problems
+
+
+def main() -> int:
+    agent_id = pick_agent_id()
+    failures: list[str] = []
+
+    for model, want_ok, why in CASES:
+        got_ok, output = accepted(agent_id, model)
+        if got_ok == want_ok:
+            verdict = "accepted" if got_ok else "rejected"
+            print(f"OK   {verdict:8} {model}  ({why})")
+            continue
+        wanted = "accepted" if want_ok else "rejected"
+        got = "accepted" if got_ok else "rejected"
+        failures.append(
+            f"{model!r} should have been {wanted} ({why}) but was {got}\n"
+            f"      engine output: {output.splitlines()[-1] if output else '(none)'}"
+        )
+
+    # A rejection must say why, not just fail: an operator needs to know which
+    # key was wrong.
+    _, msg = accepted(agent_id, "claude-opus-5[bogus=1]")
+    if "bogus" not in msg or "parameter" not in msg:
+        failures.append(
+            "the rejection message for an undocumented key must name the key and "
+            f"mention the parameter group; got: {msg!r}"
+        )
+
+    failures.extend(check_schema_agrees([m for m, ok, _ in CASES if ok]))
+
+    if failures:
+        print("\nFAIL: model parameter-group validation drifted:", file=sys.stderr)
+        for f in failures:
+            print(f"  - {f}", file=sys.stderr)
+        return 1
+
+    print(
+        f"\nOK: {len(CASES)} model parameter-group cases behave as documented, "
+        "and the policy schema accepts every value the script does"
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/tests/validate-readme-counts.mjs

@@ -10,6 +10,8 @@
  *   roles     = number of keys under .roles in catalog/install-roles.json
  *   rules     = length of JSON array in catalog/rules.json
  *   mcp       = length of JSON array in catalog/mcp-references.json
+ *   provider agents = metadata provider values under agents/
+ *   domain skills   = SKILL.md files under each skills/<domain>/ directory
  *
  * Run: node tests/validate-readme-counts.mjs
  */
@@ -45,19 +47,27 @@ function findFiles(dir, basename) {
 
 const skillFiles = findFiles(path.join(repoRoot, "skills"), "SKILL.md");
 const computedSkills = skillFiles.length;
+const skillsPerDirectory = new Map();
+for (const f of skillFiles) {
+  const directory = path.relative(path.join(repoRoot, "skills"), f).split(path.sep)[0];
+  skillsPerDirectory.set(directory, (skillsPerDirectory.get(directory) ?? 0) + 1);
+}
 
 const agentMetaFiles = findFiles(path.join(repoRoot, "agents"), "metadata.json");
 const computedAgents = agentMetaFiles.length;
 
 const providerSet = new Set();
+const agentsPerProvider = new Map();
 for (const f of agentMetaFiles) {
   try {
     const data = JSON.parse(fs.readFileSync(f, "utf8"));
     if (typeof data.provider === "string" && data.provider.length > 0) {
       providerSet.add(data.provider);
+      agentsPerProvider.set(data.provider, (agentsPerProvider.get(data.provider) ?? 0) + 1);
     }
-  } catch {
-    // malformed metadata — skip silently
+  } catch (error) {
+    process.stderr.write(`FAIL [readme-counts] malformed agent metadata ${f}: ${error.message}\n`);
+    process.exit(1);
   }
 }
 const computedProviders = providerSet.size;
@@ -126,6 +136,22 @@ const labelToKey = {
 
 const failures = [];
 
+const requiredIstioMarkers = [
+  ["Istio agent provider", /<!--\s*count:provider:istio\s*-->\d+<!--\s*\/count\s*-->/g],
+  [
+    "Istio skill directory",
+    /<!--\s*count:skill-directory:istio\s*-->\d+<!--\s*\/count\s*-->/g,
+  ],
+];
+for (const [label, marker] of requiredIstioMarkers) {
+  const occurrences = readme.match(marker)?.length ?? 0;
+  if (occurrences !== 1) {
+    failures.push(
+      `FAIL [readme-counts] README must contain exactly one ${label} count marker; found ${occurrences}`
+    );
+  }
+}
+
 // Parse table rows: | Label | Number |
 // Tolerate extra whitespace around cell content.
 const tableRowRe = /\|\s*([^|]+?)\s*\|\s*(\d+)\s*\|/g;
@@ -161,6 +187,36 @@ while ((spanMatch = spanRe.exec(readme)) !== null) {
   }
 }
 
+const providerSpanRe =
+  /<!--\s*count:provider:([a-z0-9-]+)\s*-->(\d+)<!--\s*\/count\s*-->/g;
+while ((spanMatch = providerSpanRe.exec(readme)) !== null) {
+  const slug = spanMatch[1];
+  const shownValue = parseInt(spanMatch[2], 10);
+  const computedValue = agentsPerProvider.get(slug);
+  if (computedValue === undefined) {
+    failures.push(`FAIL [readme-counts] unknown agent provider marker: ${slug}`);
+  } else if (shownValue !== computedValue) {
+    failures.push(
+      `FAIL [readme-counts] provider ${slug}: README shows ${shownValue}, computed ${computedValue}`
+    );
+  }
+}
+
+const skillDirectorySpanRe =
+  /<!--\s*count:skill-directory:([a-z0-9-]+)\s*-->(\d+)<!--\s*\/count\s*-->/g;
+while ((spanMatch = skillDirectorySpanRe.exec(readme)) !== null) {
+  const slug = spanMatch[1];
+  const shownValue = parseInt(spanMatch[2], 10);
+  const computedValue = skillsPerDirectory.get(slug);
+  if (computedValue === undefined) {
+    failures.push(`FAIL [readme-counts] unknown skill directory marker: ${slug}`);
+  } else if (shownValue !== computedValue) {
+    failures.push(
+      `FAIL [readme-counts] skill directory ${slug}: README shows ${shownValue}, computed ${computedValue}`
+    );
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Report
 // ---------------------------------------------------------------------------

package/tests/validate-release-notes.mjs

@@ -0,0 +1,35 @@
+import { createRequire } from "node:module";
+import { generateNotes } from "@semantic-release/release-notes-generator";
+
+const require = createRequire(import.meta.url);
+const config = require("../.releaserc.js");
+const pluginConfig = config.plugins.find(
+  ([name]) => name === "@semantic-release/release-notes-generator",
+)?.[1];
+
+if (!pluginConfig) {
+  throw new Error("release-notes-generator configuration is missing");
+}
+
+const notes = await generateNotes(pluginConfig, {
+  commits: [
+    {
+      hash: "1234567890abcdef",
+      message: "feat(istio): add evidence-bounded review suite",
+    },
+  ],
+  lastRelease: { gitTag: "v3.11.1", gitHead: "old" },
+  nextRelease: { version: "3.12.0", gitTag: "v3.12.0", gitHead: "new" },
+  options: {
+    repositoryUrl:
+      "https://github.com/VincentChuWaiChow/vanguard-frontier-agentic.git",
+  },
+  cwd: process.cwd(),
+  logger: console,
+});
+
+if (!notes.includes("v3.12.0") || !notes.includes("evidence-bounded review suite")) {
+  throw new Error("release notes are missing the expected version or feature");
+}
+
+console.log("OK: semantic-release notes generated with the configured preset");

package/skills/istio/istio-ambient-mesh-review/references/mcp-and-evidence.md

@@ -1,59 +0,0 @@
-# Evidence Path and Tooling
-
-## Evidence path
-
-1. Prefer live cluster evidence when a Kubernetes MCP server, `kubectl`, and `istioctl` are available against the mesh's primary cluster.
-2. Fall back to the official Istio documentation (istio.io) for ambient/sidecar architecture, policy semantics, and CRD schema when live inspection is unavailable.
-3. Ask only for sanitized YAML for the affected resources (`PeerAuthentication`, `AuthorizationPolicy`, `RequestAuthentication`, `Gateway`, `VirtualService`, `DestinationRule`, `Sidecar`, namespace labels) when current-state proof matters.
-4. Label conclusions as `live evidence`, `documentation-based`, `sanitized user evidence`, or `inference`.
-
-## Useful live-evidence commands
-
-```shell
-# All Istio security and traffic policies across the cluster
-kubectl get peerauthentication,authorizationpolicy,requestauthentication,gateway,virtualservice,destinationrule,sidecar -A -o yaml
-
-# Confirm mesh mode (ambient vs sidecar) — namespace labels
-kubectl get namespaces --show-labels | grep -E 'istio.io/dataplane-mode|istio-injection'
-
-# Ambient: list waypoint deployments and bindings
-kubectl get gateways.gateway.networking.k8s.io -A -l istio.io/waypoint-for
-kubectl get pods -A -l gateway.networking.k8s.io/gateway-name
-
-# Inspect ztunnel state on each node
-kubectl -n istio-system get daemonset ztunnel
-istioctl x ztunnel-config workload      # what ztunnel sees as in-mesh workloads
-istioctl x ztunnel-config policies      # what L4 policies ztunnel is enforcing
-istioctl x ztunnel-config services      # service-to-workload mapping
-
-# Validate proposed changes before applying
-istioctl analyze -n <namespace>
-istioctl analyze --recursive .
-
-# For sidecar mode: which workloads have sidecars injected
-kubectl get pods -A -o jsonpath='{range .items[?(@.metadata.annotations.sidecar\.istio\.io/inject!="false")]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}'
-
-# Inspect effective policy at a specific workload
-istioctl proxy-config listener <pod>.<namespace>
-istioctl proxy-config cluster <pod>.<namespace>
-istioctl authz check <pod>.<namespace>
-
-# Mesh control-plane state
-kubectl -n istio-system get deploy istiod -o yaml
-istioctl version
-istioctl proxy-status
-```
-
-## Mesh state to confirm before review
-
-- **Mesh mode per namespace** — sidecar (`istio-injection=enabled`), ambient (`istio.io/dataplane-mode=ambient`), or none. A single mesh can mix modes; conclusions differ.
-- **Waypoint deployment for ambient namespaces** — `kubectl get gateways.gateway.networking.k8s.io -n <namespace> -l istio.io/waypoint-for`. Without a waypoint, L7 AuthorizationPolicy rules in that namespace are not enforced.
-- **Istio version** (`istioctl version`) — ambient went GA in 1.24; older versions have different semantics.
-- **Whether `PeerAuthentication` exists in the mesh root namespace** (default `istio-system` or whatever `meshConfig.rootNamespace` points to). Mesh-wide policies live there.
-- **Whether multi-cluster (multi-primary or primary-remote)** is in use — `AuthorizationPolicy` evaluation crosses cluster boundaries when mesh networking is configured.
-
-## Sanitization rules
-
-- Never request kubeconfig contents, mesh root CA private keys, JWKs private keys, or workload service-account tokens.
-- Replace identifiable cluster URLs, JWT issuer URLs (when sensitive), and namespace names with placeholders unless the user provides them.
-- Do not print Istio root CA certificates beyond their public certificate body.

package/skills/istio/istio-ambient-mesh-review/references/workflow-and-output.md

@@ -1,128 +0,0 @@
-# Workflow and Output Contract
-
-## Workflow
-
-### Step 1 — Identify mesh mode for the affected namespaces
-
-Istio supports three deployment modes that can coexist in one mesh. The review path differs based on mode.
-
-1. **Sidecar mode** — pods have an Envoy sidecar injected. Namespace labeled `istio-injection=enabled`. All policy is enforced at the sidecar.
-2. **Ambient mode** — no sidecars; ztunnel runs as a per-node DaemonSet for L4 zero-trust + optional waypoint proxies for L7. Namespace labeled `istio.io/dataplane-mode=ambient`.
-3. **Mixed** — some workloads in a namespace use sidecars, others use ambient. Verify per-pod with annotations.
-
-Reference: [Choosing between sidecar and ambient](https://istio.io/latest/docs/overview/dataplane-modes/) and [Ambient mode overview](https://istio.io/latest/docs/ambient/overview/).
-
-### Step 2 — Confirm waypoint deployment for ambient namespaces (the L7 trap)
-
-This is the most important ambient-specific check. Without a waypoint, L7 `AuthorizationPolicy` rules are silently ignored.
-
-1. List waypoints: `kubectl get gateways.gateway.networking.k8s.io -n <namespace> -l istio.io/waypoint-for`.
-2. Confirm the waypoint binding label on the namespace, ServiceAccount, or workload (`istio.io/use-waypoint: <waypoint-name>`).
-3. Cross-reference any `AuthorizationPolicy` that uses L7 fields (`to.operation.methods`, `to.operation.paths`, `to.operation.hosts`, `when` keys for `request.headers`, `request.auth.claims`) — if no waypoint is bound to the workload, **the L7 rules are accepted by the API server but never enforced**.
-
-The L4 fields that ztunnel enforces without a waypoint:
-
-- `from.source.principals` (SPIFFE identities — the workload's ServiceAccount mTLS identity)
-- `from.source.namespaces`
-- `to.operation.ports`
-- `when` keys: `source.principal`, `source.namespace`, `destination.port`, `connection.sni`
-
-Reference: [L4 Authorization Policy in ambient](https://istio.io/latest/docs/ambient/usage/l4-policy/) and [Waypoint configuration](https://istio.io/latest/docs/ambient/usage/waypoint/).
-
-### Step 3 — Audit `PeerAuthentication`
-
-`PeerAuthentication` controls workload-to-workload mTLS. Three modes exist with very different security properties:
-
-1. **`STRICT`** — all peer connections must use mTLS. Plaintext connections are rejected. Production target.
-2. **`PERMISSIVE`** — accepts both mTLS and plaintext. Useful only during migration.
-3. **`DISABLE`** — disables mTLS. Plaintext only.
-
-Stress-tests:
-
-- **Mesh-wide PeerAuthentication** lives in the mesh root namespace (default `istio-system`). A change here affects every workload in every namespace simultaneously. Treat as critical-blast-radius.
-- **Namespace-scoped PeerAuthentication** with `mode: PERMISSIVE` in production is a finding — there is no migration in progress; this is technical debt.
-- **Workload-scoped PeerAuthentication** with `mode: DISABLE` for a specific port (e.g., a health-check port) is sometimes legitimate but always requires justification.
-- A namespace with **no `PeerAuthentication`** inherits mesh-wide. If mesh-wide is `PERMISSIVE`, the namespace is also `PERMISSIVE`.
-
-Reference: [PeerAuthentication API](https://istio.io/latest/docs/reference/config/security/peer_authentication/).
-
-### Step 4 — Audit `AuthorizationPolicy`
-
-`AuthorizationPolicy` controls who can talk to whom. Default action when no policy exists is **ALLOW** — there is no implicit deny. Zero-trust requires explicit deny policies or explicit narrow ALLOW policies that combine to leave nothing reachable by default.
-
-Three actions: `ALLOW`, `DENY`, `CUSTOM`, `AUDIT`.
-
-1. **`DENY` policies are evaluated first**, then `ALLOW`. If multiple match, DENY wins.
-2. **Empty `rules` with `action: DENY`** denies everything — total lockdown.
-3. **`action: ALLOW` with no `from` block** allows from anywhere — only useful for narrowing by `to`.
-4. **`action: ALLOW` with `from.source.principals: ['*']`** is also "anywhere" — no practical narrowing.
-
-Stress-tests:
-
-- An `AuthorizationPolicy` with `action: ALLOW` and `from.source.namespaces: ['*']` is a documentation-only deny — it allows all and denies none.
-- L7 fields (`to.operation.methods`, `request.auth.claims`) in ambient mode without a waypoint are silently bypassed.
-- `action: AUDIT` is a logging-only mode that does not enforce — use only for migration.
-- Multi-cluster mesh: `AuthorizationPolicy` in one cluster can affect workloads called from another cluster; verify mesh networking topology.
-
-Reference: [AuthorizationPolicy API](https://istio.io/latest/docs/reference/config/security/authorization-policy/).
-
-### Step 5 — Audit `RequestAuthentication`
-
-`RequestAuthentication` defines JWT validation — `jwksUri`, `issuer`, `audiences`, `forwardOriginalToken`. Key concerns:
-
-1. **JWKs URI rotation** — if the issuer rotates signing keys, Istio caches the JWKs response. The `jwksUri` URL must remain reachable; outages here cause every JWT to fail.
-2. **`forwardOriginalToken: true`** with sensitive JWTs forwards the bearer token to backend services — they must be trusted.
-3. **`audiences: []` or missing** — accepts JWTs intended for any audience. Cross-service token replay risk.
-4. **Multiple `RequestAuthentication` for the same workload** — Istio combines them. A misconfigured second one can weaken a strict first one.
-
-Reference: [RequestAuthentication API](https://istio.io/latest/docs/reference/config/security/request_authentication/).
-
-### Step 6 — Audit `Gateway`, `VirtualService`, `DestinationRule`, `Sidecar`
-
-Traffic routing concerns:
-
-- **`Gateway` with `tls.mode: SIMPLE` and no `credentialName`** — broken or insecure TLS termination.
-- **`Gateway` with `tls.mode: PASSTHROUGH`** plus L7 routing in `VirtualService` — incompatible (passthrough cannot be inspected).
-- **`VirtualService.http.route` with `weight`-based traffic split** — verify total weights sum to 100; otherwise traffic is dropped.
-- **`DestinationRule.trafficPolicy.tls.mode: DISABLE`** on production destinations — disables Istio-side mTLS to the destination.
-- **`Sidecar` resource with `egress.hosts: ['*/*']`** — disables egress restriction.
-
-Reference: [Gateway API](https://istio.io/latest/docs/reference/config/networking/gateway/), [VirtualService API](https://istio.io/latest/docs/reference/config/networking/virtual-service/), [DestinationRule API](https://istio.io/latest/docs/reference/config/networking/destination-rule/), [Sidecar API](https://istio.io/latest/docs/reference/config/networking/sidecar/).
-
-### Step 7 — Validate with `istioctl analyze`
-
-`istioctl analyze` runs the same checks the control plane runs and surfaces structural problems. Run it on the proposed YAML before applying:
-
-```shell
-istioctl analyze -n <namespace>            # one namespace
-istioctl analyze --all-namespaces          # whole mesh
-istioctl analyze --recursive ./manifests/  # offline against files
-```
-
-Common findings:
-
-- `IST0101` — referenced resource not found (e.g., `VirtualService` references a missing host).
-- `IST0118` — port name not following Istio's protocol convention (e.g., `tcp` vs `tcp-mysql`).
-- `IST0127` — namespace not labeled for injection.
-
-## Output
-
-Return:
-
-- **target**: the resource and its scope (mesh-wide, namespace, workload),
-- **evidence level**: `live evidence` / `documentation-based` / `sanitized user evidence` / `inference`,
-- **mesh mode**: sidecar, ambient, or mixed for the affected workloads,
-- **waypoint state**: deployed and bound, missing, or not applicable (sidecar mode),
-- **L7 enforcement assessment**: whether L7 fields will actually run, with explicit "silently ignored" callouts where applicable,
-- **mTLS posture**: `STRICT` / `PERMISSIVE` / `DISABLE` per workload / namespace / mesh,
-- **risk findings** (with severity: high / medium / low),
-- **safest next actions** with sample manifest changes and `istioctl analyze` output,
-- **rollback plan**: how to revert the change without breaking mesh traffic mid-flight,
-- **assumptions and missing facts**.
-
-## Security notes
-
-- Never recommend `PeerAuthentication` `mode: PERMISSIVE` or `DISABLE` for production without a documented mTLS migration plan with a date.
-- Never recommend a mesh-wide root-namespace policy change without staged rollout (single namespace first, observe, expand).
-- Never recommend disabling waypoint enforcement for an ambient namespace if any L7 `AuthorizationPolicy` exists for that namespace.
-- Do not print Istio root CA private keys or JWKs private keys.