@raishin/vanguard-frontier-agentic 3.2.0 → 3.4.0

package/catalog/agents.json

@@ -4534,6 +4534,35 @@
     "version": "0.1.0",
     "companion_skills": null
   },
+  {
+    "id": "composer-supply-chain-agent",
+    "name": "Composer Supply-Chain Agent",
+    "type": "agent",
+    "provider": "php",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static-review agent for Composer dependency supply-chain risk: composer audit advisory and exit-code gating in CI, abandoned-package and advisory policy, and composer.lock integrity and drift — blocking when a vulnerable or abandoned dependency can reach production ungated.",
+    "source_type": "original",
+    "official_docs": [
+      "https://getcomposer.org/doc/03-cli.md",
+      "https://getcomposer.org/doc/06-config.md",
+      "https://getcomposer.org/doc/01-basic-usage.md",
+      "https://owasp.org/www-project-top-ten/"
+    ],
+    "security_notes": "Static/read-only review only; never installs, updates, or requires packages and never makes network mutations. Reports composer audit posture from configuration and lockfile evidence, never fabricates advisory identifiers, and treats any credential found in configuration or auth files as a redact-and-flag finding.",
+    "last_verified": "2026-07-16",
+    "path": "agents/php/composer-supply-chain-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "composer-audit-supply-chain-review"
+    ]
+  },
   {
     "id": "contabo-capacity-planner-agent",
     "name": "Contabo Capacity Planner",
@@ -10335,6 +10364,440 @@
     "version": "0.1.0",
     "companion_skills": null
   },
+  {
+    "id": "java-application-server-exit-agent",
+    "name": "Java Application Server Exit Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Board-legible replatform-vs-renew exit call for a proprietary Java app-server and Oracle-JDK estate: synthesizes specialist findings (JDK lifecycle, jakarta debt, EJB/JAX-WS/SOAP, container-readiness) and user costs into per-component modernize/rehost/replatform/retire decisions plus a wave plan; refuses payback without supplied costs. Reads reports and sanitized costs only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.oracle.com/middleware/weblogic/",
+      "https://www.ibm.com/support/pages/lifecycle",
+      "https://access.redhat.com/support/policy/updates/jboss_notes",
+      "https://jakarta.ee/about/faq/"
+    ],
+    "security_notes": "Static review only — reads inventory exports, specialist agent reports, sanitized configuration, and user-supplied cost figures; never builds, runs, invokes a JDK, or contacts a live application server, license-management system, or vendor account. Never requests or embeds licence pricing, subscription tiers, contract terms, or customer/tenant headcount — those are user-supplied inputs only, never assumed or hardcoded.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-application-server-exit-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-application-server-exit"
+    ]
+  },
+  {
+    "id": "java-concurrency-and-virtual-thread-agent",
+    "name": "Java Concurrency and Virtual Thread Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review of virtual-thread adoption correctness at scale: pooling/capping anti-patterns, a VT migration that strips a downstream resource bound without re-imposing a Semaphore, JDK-version-gated carrier pinning (JEP 444 vs JEP 491), ThreadLocal cost at scale, StructuredTaskScope preview status, and classic executor/visibility hygiene. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://openjdk.org/jeps/444",
+      "https://openjdk.org/jeps/491",
+      "https://openjdk.org/jeps/0",
+      "https://docs.oracle.com/en/java/javase/"
+    ],
+    "security_notes": "Static review only — reads Java source (Thread.ofVirtual/newVirtualThreadPerTaskExecutor call sites, ExecutorService construction, synchronized blocks, ThreadLocal usage) and sanitized configuration (pool-size properties, rate-limiter config, any JFR/trace text the user pastes as plain text); never runs a build, invokes a JDK, attaches a profiler or JFR recorder, or opens a live thread dump/DB/broker connection. Never requests connection strings, credentials, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-concurrency-and-virtual-thread-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-concurrency-and-virtual-thread"
+    ]
+  },
+  {
+    "id": "java-container-and-kubernetes-readiness-agent",
+    "name": "Java Container and Kubernetes Readiness Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Statically reviews JVM-in-container ergonomics for Kubernetes workloads — heap-to-limit sizing and off-heap headroom, ActiveProcessorCount vs CPU limits, and GC-pause-vs-probe-timeout interaction that a generic pod-spec review misses. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.oracle.com/en/java/javase/21/gctuning/index.html",
+      "https://docs.oracle.com/en/java/javase/",
+      "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
+      "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/"
+    ],
+    "security_notes": "Static review of source, Dockerfiles, JVM flags/env, GC logs, and sanitized Kubernetes manifests or Helm values only; never opens a JDK, runs or profiles the workload, or reads live /proc or cgroup filesystem state. Never requests or accepts connection strings, credentials, tenant identifiers, cluster kubeconfigs, or customer data — ask for sanitized excerpts with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-container-and-kubernetes-readiness-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-container-and-kubernetes-readiness"
+    ]
+  },
+  {
+    "id": "java-database-migration-safety-agent",
+    "name": "Java Database Migration Safety Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review of Flyway/Liquibase migration PRs for rolling/blue-green deploy safety — immutable applied-migration discipline, expand-contract phasing for drops/renames, destructive DDL landing in the same release that stops using it, long-locking DDL on large tables, and out-of-order/non-idempotent migration hazards. Reads migration files and sanitized schema/config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://flywaydb.org/documentation/",
+      "https://flywaydb.org/documentation/concepts/migrations",
+      "https://docs.liquibase.com/",
+      "https://docs.liquibase.com/concepts/changelogs/home.html"
+    ],
+    "security_notes": "Static review only — reads migration scripts (Flyway versioned/repeatable SQL or Java migrations) or Liquibase changelogs (XML/YAML/JSON/SQL), sanitized DDL/schema snapshots, and the application source that reads or writes the affected columns; never opens a database connection, runs a migration, or queries live schema state. Never requests connection strings, database credentials, tenant identifiers, or customer data — ask for migration files and schema snapshots with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-database-migration-safety-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-database-migration-safety"
+    ]
+  },
+  {
+    "id": "java-deserialization-and-parser-security-agent",
+    "name": "Java Deserialization and Parser Security Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review of untrusted-deserialization and parser RCE surface on the JVM — Java native ObjectInputStream gadget chains, SnakeYAML bare Constructor, Jackson polymorphic default typing without a validator, and XML external-entity (XXE) exposure. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data",
+      "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html",
+      "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html",
+      "https://github.com/FasterXML/jackson-databind/wiki/JacksonPolymorphicDeserialization"
+    ],
+    "security_notes": "Static review only — reads source, deserialization/parsing call sites, and sanitized configuration; never executes code, never deserializes a payload, never contacts a live system. Never requests secrets, tokens, or customer data. This agent owns the untrusted-deserialization/parser RCE verdict for the board; the Spring Security agent may reference these findings but does not own them.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-deserialization-and-parser-security-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-deserialization-and-parser-security"
+    ]
+  },
+  {
+    "id": "java-framework-production-readiness-agent",
+    "name": "Java Framework Production Readiness Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review issuing a single ship / do-not-ship production-readiness verdict for a Spring Boot, Quarkus, or Micronaut service against a framework-specific checklist (config, health/liveness/readiness, graceful shutdown, jakarta namespace + JDK floor, build-time DI/AOT safety, config validation, BOM alignment). Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.spring.io/spring-boot/",
+      "https://quarkus.io/guides/",
+      "https://docs.micronaut.io/latest/guide/",
+      "https://jakarta.ee/specifications/"
+    ],
+    "security_notes": "Static review only — reads build files (pom.xml/build.gradle), application.properties/application.yml and profile variants, source annotations, and CI/Dockerfile config; never builds, runs, invokes a JDK, opens a database/broker connection, or contacts a live health endpoint. Never requests live secret values, connection strings, credentials, tenant identifiers, or customer data — ask for sanitized files with values redacted/placeholdered. Framework EOL/support-window facts are fail-closed: cited from the companion skill's verified reference or marked unknown, never asserted from memory.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-framework-production-readiness-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-framework-production-readiness"
+    ]
+  },
+  {
+    "id": "java-jdk-lifecycle-and-upgrade-agent",
+    "name": "Java JDK Lifecycle and Upgrade Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review of a Java estate's JDK lifecycle and upgrade posture — vendor/version identification, support and license-boundary exposure, language/API compatibility blockers, and a prioritized, evidence-gated upgrade path. Reads build files and source only; never asserts vendor dates from memory.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.oracle.com/java/technologies/java-se-support-roadmap.html",
+      "https://openjdk.org/projects/jdk/",
+      "https://adoptium.net/support/",
+      "https://docs.oracle.com/en/java/javase/"
+    ],
+    "security_notes": "Static review only — reads `pom.xml`/`build.gradle`, toolchain and CI config, `Dockerfile` base images, and source; never runs a build, invokes a JDK, or contacts a live system. Never requests license keys, Oracle account identifiers, contract/pricing data, or customer data. Time-sensitive vendor lifecycle facts are cited from the companion skill's verified reference (primary source = the vendor roadmap page) and are never asserted from memory — an out-of-date date produces confidently-wrong upgrade advice.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-jdk-lifecycle-and-upgrade-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-jdk-lifecycle-and-upgrade"
+    ]
+  },
+  {
+    "id": "java-jpa-hibernate-performance-agent",
+    "name": "Java JPA/Hibernate Performance Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review of JPA/Hibernate data access for fetch-strategy correctness and reliability — N+1 exposure, JOIN FETCH vs @EntityGraph vs @BatchSize vs DTO projection, LazyInitializationException and open-in-view misuse, pagination-with-fetch cartesian products, and JDBC connection-pool (HikariCP) sizing. Reads source and mapping only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.jboss.org/hibernate/orm/current/userguide/html_single/Hibernate_User_Guide.html",
+      "https://jakarta.ee/specifications/persistence/",
+      "https://docs.spring.io/spring-data/jpa/reference/",
+      "https://github.com/brettwooldridge/HikariCP/wiki/About-Pool-Sizing"
+    ],
+    "security_notes": "Static review only — reads entity classes, mappings/annotations, repository and query code, and sanitized `application.properties`/`application.yml`; never opens a database connection, runs a query, or executes migrations. Never requests connection strings, database credentials, tenant identifiers, or customer data; ask for source with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-jpa-hibernate-performance-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-jpa-hibernate-performance"
+    ]
+  },
+  {
+    "id": "java-jvm-performance-and-gc-agent",
+    "name": "Java JVM Performance and GC Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review of proposed JVM GC/performance changes for evidence — collector selection (G1/ZGC/Generational ZGC/Shenandoah/Parallel), allocation pressure, heap-sizing flags, and OOM/leak triage from user-supplied GC logs, JFR, and heap-dump analysis output. Refuses GC-switch recommendations without pause-time evidence. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.oracle.com/en/java/javase/",
+      "https://openjdk.org/jeps/248",
+      "https://openjdk.org/jeps/439",
+      "https://openjdk.org/projects/shenandoah/"
+    ],
+    "security_notes": "Static review only — reads Java/Kotlin source, JVM startup-flag configuration (launch scripts, Dockerfiles, systemd units, K8s manifests), and user-supplied GC logs, JFR recordings, and heap-dump analysis output (dominator-tree/leak-suspects text, not a raw .hprof binary). Never opens a live process, attaches a profiler or debugger, invokes a JDK tool against a running JVM, or requests/opens a live heap dump. Never requests credentials, connection strings, tenant identifiers, or customer data — ask for sanitized excerpts with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-jvm-performance-and-gc-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-jvm-performance-and-gc"
+    ]
+  },
+  {
+    "id": "java-kafka-reliability-agent",
+    "name": "Java Kafka Reliability Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Statically reviews whether a Kafka pipeline delivers the semantics it claims — idempotence-vs-exactly-once conflation, exactly-once wiring, at-least-once with(out) idempotent consumers, commit ordering, in-flight ordering, consumer lag as the SLA signal, rebalance stalls, DLQ/retry design, and acks/min.insync.replicas durability. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kafka.apache.org/documentation/",
+      "https://kafka.apache.org/documentation/#semantics",
+      "https://docs.spring.io/spring-kafka/reference/"
+    ],
+    "security_notes": "Static review only — reads producer/consumer code, Kafka client configuration (acks, enable.idempotence, transactional.id, isolation.level, max.poll.* settings), topic durability settings, and sanitized application config; never opens a broker connection, produces/consumes a live message, creates/alters/deletes a topic, or runs a consumer group against a live cluster. Never requests broker bootstrap credentials, SASL/mTLS secrets, tenant identifiers, or customer data — ask for source and config with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-kafka-reliability-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-kafka-reliability"
+    ]
+  },
+  {
+    "id": "java-maestro-agent",
+    "name": "Java Maestro",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Router agent for the Java board. Classifies a Java/JVM task and dispatches the narrowest static-review specialist, or a parallel team of up to four for multi-domain tasks. Routes only — never answers Java questions itself.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.oracle.com/en/java/",
+      "https://spring.io/projects/spring-boot",
+      "https://jakarta.ee/specifications/"
+    ],
+    "security_notes": "Routing only — performs no review itself, never runs code, never requests secrets, connection strings, tokens, keystores, tenant identifiers, or customer data. Every dispatched Java specialist is static-review (reads source and sanitized configuration only).",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-maestro-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-maestro"
+    ]
+  },
+  {
+    "id": "java-resilience-pattern-agent",
+    "name": "Java Resilience Pattern Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review of resilience4j + Spring composition correctness on a Java code path — decorator/aspect order, non-idempotent-write retry safety, TimeLimiter/timeout budgets, Bulkhead isolation, RateLimiter, and fallback correctness. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://resilience4j.readme.io/docs/getting-started",
+      "https://resilience4j.readme.io/docs/getting-started-3",
+      "https://resilience4j.readme.io/docs/circuitbreaker",
+      "https://resilience4j.readme.io/docs/retry",
+      "https://github.com/resilience4j/resilience4j"
+    ],
+    "security_notes": "Static review only — reads Java/Kotlin source, resilience4j annotations and Decorators functional-chaining code, and sanitized resilience4j.* application.yml/properties configuration; never builds, runs, invokes a JDK, opens a database/broker connection, or calls a live circuit-breaker, metrics, or actuator endpoint. Never requests credentials, connection strings, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-resilience-pattern-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-resilience-pattern"
+    ]
+  },
+  {
+    "id": "java-spring-security-agent",
+    "name": "Java Spring Security Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review of Spring Security 6 filter-chain authorization posture and Spring Boot Actuator exposure — SecurityFilterChain matcher ordering, authorizeHttpRequests precedence, method-security (@PreAuthorize/@PostAuthorize) interaction, AuthorizationManager fail-closed behavior, CSRF on state-changing endpoints, and actuator endpoint exposure. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.spring.io/spring-security/reference/",
+      "https://docs.spring.io/spring-boot/reference/actuator/",
+      "https://spring.io/projects/spring-security"
+    ],
+    "security_notes": "Static review only — reads Java/Kotlin source, SecurityFilterChain bean definitions, and sanitized application.yml/properties; never builds, runs, or invokes a JDK, never opens a live HTTP/DB/broker connection, and never authenticates against a running application or calls a live /actuator endpoint. Never requests secrets, credentials, tokens, or customer data. This agent owns the Spring Security filter-chain and endpoint-exposure verdict for the board; it references but does not own untrusted-deserialization/parser RCE findings.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-spring-security-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-spring-security"
+    ]
+  },
+  {
+    "id": "java-test-architecture-agent",
+    "name": "Java Test Architecture Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static review of JVM test suite architecture and non-flakiness — JUnit 5 lifecycle/isolation, Testcontainers discipline (singleton reuse vs per-test, Wait strategies vs sleep), ArchUnit rules with FreezingArchRule, and test-quality smells via AssertJ/Mockito. Absorbs JVM flaky-test triage. Reads source and sanitized config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://junit.org/junit5/docs/current/user-guide/",
+      "https://java.testcontainers.org/",
+      "https://www.archunit.org/userguide/html/000_Index.html",
+      "https://assertj.github.io/doc/",
+      "https://site.mockito.org/"
+    ],
+    "security_notes": "Static review only — reads JUnit 5 test source, Testcontainers module usage, ArchUnit rule definitions, and sanitized build/test configuration (pom.xml/build.gradle test blocks, junit-platform.properties, ~/.testcontainers.properties excerpts); never invokes a JDK, runs mvn/gradle test, starts a JUnit runner, opens a Docker/Testcontainers daemon connection, hits a database or broker, or contacts any live system. Never requests connection strings, database credentials, tenant identifiers, or customer data — ask for source with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-test-architecture-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-test-architecture"
+    ]
+  },
+  {
+    "id": "java-transaction-and-consistency-agent",
+    "name": "Java Transaction and Consistency Agent",
+    "type": "agent",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Statically reviews Spring @Transactional boundary correctness — propagation, isolation, readOnly, rollbackFor, proxy self-invocation, and boundary width — plus cross-resource consistency, flagging the save()-then-send() dual-write anti-pattern, missing outbox/relay, and post-commit side effects that skip TransactionSynchronization or REQUIRES_NEW. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.spring.io/spring-framework/reference/data-access/transaction.html",
+      "https://jakarta.ee/specifications/transactions/",
+      "https://microservices.io/patterns/data/transactional-outbox.html",
+      "https://microservices.io/patterns/data/saga.html"
+    ],
+    "security_notes": "Static review only — reads Spring @Transactional-annotated classes, service/repository call graphs, and sanitized transaction-manager/datasource/broker configuration; never opens a database or broker connection, starts or commits a transaction, or executes code. Never requests connection strings, credentials, tenant identifiers, or customer data; ask for source with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "agents/java/java-transaction-and-consistency-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "java-transaction-and-consistency"
+    ]
+  },
   {
     "id": "javascript-runtime-agent",
     "name": "JavaScript Runtime & Async Correctness",
@@ -14514,6 +14977,92 @@
       "monorepo-package-governance-review"
     ]
   },
+  {
+    "id": "php-application-security-agent",
+    "name": "PHP Application Security Agent",
+    "type": "agent",
+    "provider": "php",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static-review agent for PHP application security: user-reachable unserialize() object injection, session fixation/hijacking (session_regenerate_id, use_strict_mode, cookie hardening), and unsafe file-upload handling, mapping each finding to an OWASP category and the exact php.net-documented mitigation.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.php.net/manual/en/function.unserialize.php",
+      "https://www.php.net/manual/en/session.security.php",
+      "https://www.php.net/manual/en/features.file-upload.common-pitfalls.php",
+      "https://owasp.org/www-project-top-ten/"
+    ],
+    "security_notes": "Static/read-only review only; never executes deserialization payloads, uploads, or exploits against any live or staging system. Treats any credential- or PII-shaped string found in code as a redact-and-flag finding, never echoed. Grounds every unserialize(), session, and file-upload claim in current php.net documentation rather than memory.",
+    "last_verified": "2026-07-16",
+    "path": "agents/php/php-application-security-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "php-session-upload-deserialization-review"
+    ]
+  },
+  {
+    "id": "php-maestro-agent",
+    "name": "PHP Maestro Agent",
+    "type": "agent",
+    "provider": "php",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "PHP board router that classifies a task and dispatches to the narrowest specialist — PHP application security (unserialize/session/upload), Composer dependency supply-chain, PHP runtime version/EOL and OPcache/PHP-FPM hardening, or WordPress plugin/theme/REST/block security — never performing specialist review itself, capping parallel dispatch, and refusing live-mutation requests.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.php.net/docs.php",
+      "https://www.php.net/supported-versions.php",
+      "https://getcomposer.org/doc/03-cli.md",
+      "https://developer.wordpress.org/apis/security/"
+    ],
+    "security_notes": "Routing and classification only; performs no specialist review and issues no code changes. Refuses live-mutation/destructive requests (production deploys, database migrations, force-push to main) and requires explicit human confirmation. Preserves each specialist's evidence labels, never fabricates a routing target that is not a registered PHP board agent, and never asks for or echoes secrets, tokens, or customer data.",
+    "last_verified": "2026-07-16",
+    "path": "agents/php/php-maestro-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "php-maestro"
+    ]
+  },
+  {
+    "id": "php-runtime-upgrade-readiness-agent",
+    "name": "PHP Runtime Upgrade Readiness Agent",
+    "type": "agent",
+    "provider": "php",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static-review agent for PHP runtime upgrade readiness: flags EOL and security-only PHP versions against php.net's published four-year support lifecycle, and reviews OPcache (validate_timestamps) and PHP-FPM (pm.max_children, pm.max_requests) production hardening — treating an EOL runtime as a blocking finding.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.php.net/supported-versions.php",
+      "https://www.php.net/manual/en/opcache.configuration.php",
+      "https://www.php.net/manual/en/install.fpm.configuration.php"
+    ],
+    "security_notes": "Static/read-only review only; recommends an upgrade path but never modifies runtime configuration or application code. Encodes PHP version lifecycle dates only from php.net's supported-versions page as fixed ground truth (never invented, rounded, or extrapolated), and determines a version's current lifecycle phase by comparing those published dates against the review date.",
+    "last_verified": "2026-07-16",
+    "path": "agents/php/php-runtime-upgrade-readiness-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "php-runtime-eol-opcache-fpm-review"
+    ]
+  },
   {
     "id": "playwright-e2e-execution-run-agent",
     "name": "Playwright E2E Execution Run Agent",
@@ -14878,6 +15427,37 @@
       "react-state-effects-review"
     ]
   },
+  {
+    "id": "revenue-critical-journey-integrity-agent",
+    "name": "Revenue-Critical Journey Integrity Agent",
+    "type": "agent",
+    "provider": "generic",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static-review agent for the cross-tier seams of revenue-critical journeys (checkout, payment submission, account creation, login) — idempotency of money-moving and account-creating requests, server-side re-validation of client-enforced rules, webhook duplicate/out-of-order handling, retry-storm safeguards, and PCI DSS SAQ-scope judgment — catching cross-tier failures no single-tier frontend, backend, or mobile reviewer owns.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.stripe.com/api/idempotent_requests",
+      "https://docs.stripe.com/webhooks/best-practices",
+      "https://www.pcisecuritystandards.org/faqs/1443/",
+      "https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a",
+      "https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/rel_mitigate_interaction_failure_limit_retries.html",
+      "https://baymard.com/lists/cart-abandonment-rate"
+    ],
+    "security_notes": "Static/read-only review only. Reviews source, configuration, and API contracts for cross-tier journey-integrity gaps; never transmits, requests, stores, or reproduces cardholder data (PAN/CVV), API keys, session tokens, or webhook signing secrets — any credential- or PAN-shaped string is a finding to redact-and-flag, never to echo. PCI DSS SAQ-scope output is an advisory scoping opinion to inform a Qualified Security Assessor or the merchant's own validation, never a compliance attestation or an assessment of record. Never executes payment flows, replays webhooks, or issues requests against any live, sandbox, or staging payment system.",
+    "last_verified": "2026-07-16",
+    "path": "agents/cross-functional/revenue-critical-journey-integrity-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "revenue-critical-journey-integrity-review"
+    ]
+  },
   {
     "id": "routing-navigation-agent",
     "name": "Routing & Navigation",
@@ -18152,5 +18732,34 @@
     "path": "agents/frontend/web-platform-foundation-agent",
     "version": "0.1.0",
     "companion_skills": []
+  },
+  {
+    "id": "wordpress-security-agent",
+    "name": "WordPress Security Agent",
+    "type": "agent",
+    "provider": "php",
+    "harnesses": [
+      "codex",
+      "copilot",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro"
+    ],
+    "summary": "Static-review agent for WordPress plugin and theme security: missing REST register_rest_route permission_callback (required since WordPress 5.5), unescaped dynamic-block render_callback output, and input-validation, output-escaping, and nonce gaps — the plugin-dominated attack surface behind most WordPress CVEs.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.wordpress.org/apis/security/",
+      "https://developer.wordpress.org/rest-api/extending-the-rest-api/routes-and-endpoints/",
+      "https://developer.wordpress.org/block-editor/getting-started/fundamentals/static-dynamic-rendering/",
+      "https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/"
+    ],
+    "security_notes": "Static/read-only review only; never runs against a live WordPress install and never executes payloads. Flags missing permission_callback, unescaped output, and missing nonce/capability checks from source; treats any credential- or PII-shaped string as a redact-and-flag finding, and grounds REST and block-editor API claims in current developer.wordpress.org documentation.",
+    "last_verified": "2026-07-16",
+    "path": "agents/php/wordpress-security-agent",
+    "version": "0.1.0",
+    "companion_skills": [
+      "wordpress-rest-block-security-review"
+    ]
   }
 ]