@raishin/vanguard-frontier-agentic 3.2.0 → 3.4.0

package/catalog/skills.json

@@ -4294,6 +4294,33 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "composer-audit-supply-chain-review",
+    "name": "Composer Audit & Supply-Chain Review",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing Composer dependency supply-chain posture: composer audit advisory scanning and CI exit-code gating, config.policy advisory/abandoned settings, and composer.lock integrity and drift, so a vulnerable or abandoned Packagist dependency cannot reach production ungated.",
+    "source_type": "original",
+    "official_docs": [
+      "https://getcomposer.org/doc/03-cli.md",
+      "https://getcomposer.org/doc/06-config.md",
+      "https://getcomposer.org/doc/01-basic-usage.md",
+      "https://owasp.org/www-project-top-ten/"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no network mutation. Never installs, updates, or requires packages. Reports composer audit posture from configuration and lockfile evidence, never fabricates advisory identifiers, and treats any credential in auth.json or configuration as a redact-and-flag finding.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/composer-audit-supply-chain-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "consolidation-intercompany-advisor",
     "name": "Consolidation & Intercompany Advisor",
@@ -9700,6 +9727,410 @@
     "author": "github: Raishin",
     "version": "0.1.0"
   },
+  {
+    "id": "java-application-server-exit",
+    "name": "java-application-server-exit",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Board-legible replatform-vs-renew exit call for a proprietary Java app-server and Oracle-JDK estate: synthesizes specialist findings (JDK lifecycle, jakarta debt, EJB/JAX-WS/SOAP, container-readiness) and user costs into per-component modernize/rehost/replatform/retire decisions plus a wave plan; refuses payback without supplied costs. Reads reports and sanitized costs only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.oracle.com/middleware/weblogic/",
+      "https://www.ibm.com/support/pages/lifecycle",
+      "https://access.redhat.com/support/policy/updates/jboss_notes",
+      "https://jakarta.ee/about/faq/"
+    ],
+    "security_notes": "Static review only — reads inventory exports, specialist agent reports, sanitized configuration, and user-supplied cost figures; never builds, runs, invokes a JDK, or contacts a live application server, license-management system, or vendor account. Never requests or embeds licence pricing, subscription tiers, contract terms, or customer/tenant headcount — those are user-supplied inputs only, never assumed or hardcoded.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-application-server-exit",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-concurrency-and-virtual-thread",
+    "name": "java-concurrency-and-virtual-thread",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of virtual-thread adoption correctness at scale: pooling/capping anti-patterns, a VT migration that strips a downstream resource bound without re-imposing a Semaphore, JDK-version-gated carrier pinning (JEP 444 vs JEP 491), ThreadLocal cost at scale, StructuredTaskScope preview status, and classic executor/visibility hygiene. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://openjdk.org/jeps/444",
+      "https://openjdk.org/jeps/491",
+      "https://openjdk.org/jeps/0",
+      "https://docs.oracle.com/en/java/javase/"
+    ],
+    "security_notes": "Static review only — reads Java source (Thread.ofVirtual/newVirtualThreadPerTaskExecutor call sites, ExecutorService construction, synchronized blocks, ThreadLocal usage) and sanitized configuration (pool-size properties, rate-limiter config, any JFR/trace text the user pastes as plain text); never runs a build, invokes a JDK, attaches a profiler or JFR recorder, or opens a live thread dump/DB/broker connection. Never requests connection strings, credentials, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-concurrency-and-virtual-thread",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-container-and-kubernetes-readiness",
+    "name": "java-container-and-kubernetes-readiness",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Statically reviews JVM-in-container ergonomics for Kubernetes workloads — heap-to-limit sizing and off-heap headroom, ActiveProcessorCount vs CPU limits, and GC-pause-vs-probe-timeout interaction that a generic pod-spec review misses. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.oracle.com/en/java/javase/21/gctuning/index.html",
+      "https://docs.oracle.com/en/java/javase/",
+      "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
+      "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/"
+    ],
+    "security_notes": "Static review of source, Dockerfiles, JVM flags/env, GC logs, and sanitized Kubernetes manifests or Helm values only; never opens a JDK, runs or profiles the workload, or reads live /proc or cgroup filesystem state. Never requests or accepts connection strings, credentials, tenant identifiers, cluster kubeconfigs, or customer data — ask for sanitized excerpts with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-container-and-kubernetes-readiness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-database-migration-safety",
+    "name": "java-database-migration-safety",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Flyway/Liquibase migration PRs for rolling/blue-green deploy safety — immutable applied-migration discipline, expand-contract phasing for drops/renames, destructive DDL landing in the same release that stops using it, long-locking DDL on large tables, and out-of-order/non-idempotent migration hazards. Reads migration files and sanitized schema/config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://flywaydb.org/documentation/",
+      "https://flywaydb.org/documentation/concepts/migrations",
+      "https://docs.liquibase.com/",
+      "https://docs.liquibase.com/concepts/changelogs/home.html"
+    ],
+    "security_notes": "Static review only — reads migration scripts (Flyway versioned/repeatable SQL or Java migrations) or Liquibase changelogs (XML/YAML/JSON/SQL), sanitized DDL/schema snapshots, and the application source that reads or writes the affected columns; never opens a database connection, runs a migration, or queries live schema state. Never requests connection strings, database credentials, tenant identifiers, or customer data — ask for migration files and schema snapshots with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-database-migration-safety",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-deserialization-and-parser-security",
+    "name": "Java Deserialization and Parser Security Review",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of untrusted-deserialization and parser RCE surface on the JVM — Java native ObjectInputStream gadget chains, SnakeYAML bare Constructor, Jackson polymorphic default typing without a validator, and XML external-entity (XXE) exposure. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data",
+      "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html",
+      "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html",
+      "https://github.com/FasterXML/jackson-databind/wiki/JacksonPolymorphicDeserialization"
+    ],
+    "security_notes": "Static review only — reads source, deserialization/parsing call sites, and sanitized configuration; never executes code, deserializes a payload, or contacts a live system. Never requests secrets, tokens, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-deserialization-and-parser-security",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-framework-production-readiness",
+    "name": "java-framework-production-readiness",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review issuing a single ship / do-not-ship production-readiness verdict for a Spring Boot, Quarkus, or Micronaut service against a framework-specific checklist (config, health/liveness/readiness, graceful shutdown, jakarta namespace + JDK floor, build-time DI/AOT safety, config validation, BOM alignment). Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.spring.io/spring-boot/",
+      "https://quarkus.io/guides/",
+      "https://docs.micronaut.io/latest/guide/",
+      "https://jakarta.ee/specifications/"
+    ],
+    "security_notes": "Static review only — reads build files (pom.xml/build.gradle), application.properties/application.yml and profile variants, source annotations, and CI/Dockerfile config; never builds, runs, invokes a JDK, opens a database/broker connection, or contacts a live health endpoint. Never requests live secret values, connection strings, credentials, tenant identifiers, or customer data — ask for sanitized files with values redacted/placeholdered. Framework EOL/support-window facts are fail-closed: cited from the companion skill's verified reference or marked unknown, never asserted from memory.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-framework-production-readiness",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-jdk-lifecycle-and-upgrade",
+    "name": "Java JDK Lifecycle and Upgrade Review",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of a Java estate's JDK lifecycle and upgrade posture — vendor/version identification, support and license-boundary exposure (cited from verified reference data, never memory), language/API upgrade blockers, and a phased, evidence-gated upgrade path. Reads build files and source only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.oracle.com/java/technologies/java-se-support-roadmap.html",
+      "https://openjdk.org/projects/jdk/",
+      "https://adoptium.net/support/",
+      "https://docs.oracle.com/en/java/javase/"
+    ],
+    "security_notes": "Static review only — reads build files, toolchain/CI config, Dockerfile base images, and source; never runs a build, invokes a JDK, or contacts a live system. Never requests license keys, account identifiers, or contract/pricing data. Vendor lifecycle dates are cited from the verified reference (primary source = the vendor roadmap), never asserted from memory.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-jdk-lifecycle-and-upgrade",
+    "version": "0.2.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-jpa-hibernate-performance",
+    "name": "Java JPA/Hibernate Performance Review",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of JPA/Hibernate data access for fetch-strategy correctness and reliability — N+1 exposure, JOIN FETCH vs @EntityGraph vs @BatchSize vs DTO projection, LazyInitializationException and open-in-view misuse, pagination-with-fetch cartesian products, and HikariCP pool sizing. Reads source and mapping only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.jboss.org/hibernate/orm/current/userguide/html_single/Hibernate_User_Guide.html",
+      "https://jakarta.ee/specifications/persistence/",
+      "https://docs.spring.io/spring-data/jpa/reference/",
+      "https://github.com/brettwooldridge/HikariCP/wiki/About-Pool-Sizing"
+    ],
+    "security_notes": "Static review only — reads entity classes, mappings, repository/query code, and sanitized configuration; never opens a database connection, runs a query, or executes migrations. Never requests connection strings, database credentials, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-jpa-hibernate-performance",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-jvm-performance-and-gc",
+    "name": "java-jvm-performance-and-gc",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of proposed JVM GC/performance changes for evidence — collector selection (G1/ZGC/Generational ZGC/Shenandoah/Parallel), allocation pressure, heap-sizing flags, and OOM/leak triage from user-supplied GC logs, JFR, and heap-dump analysis output. Refuses GC-switch recommendations without pause-time evidence. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.oracle.com/en/java/javase/",
+      "https://openjdk.org/jeps/248",
+      "https://openjdk.org/jeps/439",
+      "https://openjdk.org/projects/shenandoah/"
+    ],
+    "security_notes": "Static review only — reads Java/Kotlin source, JVM startup-flag configuration (launch scripts, Dockerfiles, systemd units, K8s manifests), and user-supplied GC logs, JFR recordings, and heap-dump analysis output (dominator-tree/leak-suspects text, not a raw .hprof binary). Never opens a live process, attaches a profiler or debugger, invokes a JDK tool against a running JVM, or requests/opens a live heap dump. Never requests credentials, connection strings, tenant identifiers, or customer data — ask for sanitized excerpts with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-jvm-performance-and-gc",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-kafka-reliability",
+    "name": "Java Kafka Reliability Review",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Statically reviews whether a Kafka pipeline delivers the semantics it claims — idempotence-vs-exactly-once conflation, exactly-once wiring, at-least-once with(out) idempotent consumers, commit ordering, in-flight ordering, consumer lag as the SLA signal, rebalance stalls, DLQ/retry design, and acks/min.insync.replicas durability. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://kafka.apache.org/documentation/",
+      "https://kafka.apache.org/documentation/#semantics",
+      "https://docs.spring.io/spring-kafka/reference/"
+    ],
+    "security_notes": "Static review only — reads producer/consumer code, Kafka client configuration (acks, enable.idempotence, transactional.id, isolation.level, max.poll.* settings), topic durability settings, and sanitized application config; never opens a broker connection, produces/consumes a live message, creates/alters/deletes a topic, or runs a consumer group against a live cluster. Never requests broker bootstrap credentials, SASL/mTLS secrets, tenant identifiers, or customer data — ask for source and config with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-kafka-reliability",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-maestro",
+    "name": "Java Maestro",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Java Maestro routing skill. Classifies a Java/JVM task and dispatches the narrowest static-review specialist from the Java board, or a parallel team of up to four for multi-domain tasks. Routes only — never answers Java questions, never runs code, never requests secrets.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.oracle.com/en/java/",
+      "https://spring.io/projects/spring-boot",
+      "https://jakarta.ee/specifications/"
+    ],
+    "security_notes": "Routing only — performs no review, never runs code, never requests secrets, connection strings, tokens, keystores, tenant identifiers, or customer data. Every dispatched Java specialist is static-review.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-resilience-pattern",
+    "name": "java-resilience-pattern",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of resilience4j + Spring composition correctness on a Java code path — decorator/aspect order, non-idempotent-write retry safety, TimeLimiter/timeout budgets, Bulkhead isolation, RateLimiter, and fallback correctness. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://resilience4j.readme.io/docs/getting-started",
+      "https://resilience4j.readme.io/docs/getting-started-3",
+      "https://resilience4j.readme.io/docs/circuitbreaker",
+      "https://resilience4j.readme.io/docs/retry",
+      "https://github.com/resilience4j/resilience4j"
+    ],
+    "security_notes": "Static review only — reads Java/Kotlin source, resilience4j annotations and Decorators functional-chaining code, and sanitized resilience4j.* application.yml/properties configuration; never builds, runs, invokes a JDK, opens a database/broker connection, or calls a live circuit-breaker, metrics, or actuator endpoint. Never requests credentials, connection strings, tenant identifiers, or customer data.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-resilience-pattern",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-spring-security",
+    "name": "java-spring-security",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of Spring Security 6 filter-chain authorization posture and Spring Boot Actuator exposure — SecurityFilterChain matcher ordering, authorizeHttpRequests precedence, method-security (@PreAuthorize/@PostAuthorize) interaction, AuthorizationManager fail-closed behavior, CSRF on state-changing endpoints, and actuator endpoint exposure. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.spring.io/spring-security/reference/",
+      "https://docs.spring.io/spring-boot/reference/actuator/",
+      "https://spring.io/projects/spring-security"
+    ],
+    "security_notes": "Static review only — reads Java/Kotlin source, SecurityFilterChain bean definitions, and sanitized application.yml/properties; never builds, runs, or invokes a JDK, never opens a live HTTP/DB/broker connection, and never authenticates against a running application or calls a live /actuator endpoint. Never requests secrets, credentials, tokens, or customer data. This agent owns the Spring Security filter-chain and endpoint-exposure verdict for the board; it references but does not own untrusted-deserialization/parser RCE findings.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-spring-security",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-test-architecture",
+    "name": "java-test-architecture",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of JVM test suite architecture and non-flakiness — JUnit 5 lifecycle/isolation, Testcontainers discipline (singleton reuse vs per-test, Wait strategies vs sleep), ArchUnit rules with FreezingArchRule, and test-quality smells via AssertJ/Mockito. Absorbs JVM flaky-test triage. Reads source and sanitized config only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://junit.org/junit5/docs/current/user-guide/",
+      "https://java.testcontainers.org/",
+      "https://www.archunit.org/userguide/html/000_Index.html",
+      "https://assertj.github.io/doc/",
+      "https://site.mockito.org/"
+    ],
+    "security_notes": "Static review only — reads JUnit 5 test source, Testcontainers module usage, ArchUnit rule definitions, and sanitized build/test configuration (pom.xml/build.gradle test blocks, junit-platform.properties, ~/.testcontainers.properties excerpts); never invokes a JDK, runs mvn/gradle test, starts a JUnit runner, opens a Docker/Testcontainers daemon connection, hits a database or broker, or contacts any live system. Never requests connection strings, database credentials, tenant identifiers, or customer data — ask for source with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-test-architecture",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "java-transaction-and-consistency",
+    "name": "java-transaction-and-consistency",
+    "type": "skill",
+    "provider": "java",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Statically reviews Spring @Transactional boundary correctness — propagation, isolation, readOnly, rollbackFor, proxy self-invocation, and boundary width — plus cross-resource consistency, flagging the save()-then-send() dual-write anti-pattern, missing outbox/relay, and post-commit side effects that skip TransactionSynchronization or REQUIRES_NEW. Reads source and sanitized configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.spring.io/spring-framework/reference/data-access/transaction.html",
+      "https://jakarta.ee/specifications/transactions/",
+      "https://microservices.io/patterns/data/transactional-outbox.html",
+      "https://microservices.io/patterns/data/saga.html"
+    ],
+    "security_notes": "Static review only — reads Spring @Transactional-annotated classes, service/repository call graphs, and sanitized transaction-manager/datasource/broker configuration; never opens a database or broker connection, starts or commits a transaction, or executes code. Never requests connection strings, credentials, tenant identifiers, or customer data; ask for source with placeholders.",
+    "last_verified": "2026-07-17",
+    "path": "skills/java/java-transaction-and-consistency",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "javascript-runtime-async-review",
     "name": "JavaScript Runtime & Async Correctness Review",
@@ -13606,6 +14037,86 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "php-maestro",
+    "name": "PHP Maestro",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Routing skill for the PHP board: classifies an incoming PHP task and dispatches to the narrowest specialist (application security, Composer supply-chain, runtime/EOL and OPcache/FPM, or WordPress security), caps parallel dispatch, enforces the blocking hard-gate taxonomy, and refuses live-mutation requests.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.php.net/docs.php",
+      "https://www.php.net/supported-versions.php",
+      "https://getcomposer.org/doc/03-cli.md",
+      "https://developer.wordpress.org/apis/security/"
+    ],
+    "security_notes": "Routing only; performs no review and makes no code changes. Refuses destructive/live-mutation requests and requires human confirmation. Never fabricates a routing target outside the registered PHP board, preserves specialist evidence labels, and never requests or echoes secrets or customer data.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/php-maestro",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "php-runtime-eol-opcache-fpm-review",
+    "name": "PHP Runtime EOL, OPcache & PHP-FPM Review",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing PHP runtime upgrade readiness and production hardening: EOL and security-only version exposure against php.net's four-year support lifecycle, OPcache production configuration (validate_timestamps, memory sizing), and PHP-FPM pool tuning (pm, max_children, max_requests), treating an EOL runtime as a blocking finding.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.php.net/supported-versions.php",
+      "https://www.php.net/manual/en/opcache.configuration.php",
+      "https://www.php.net/manual/en/install.fpm.configuration.php"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no configuration changes. PHP version lifecycle dates are encoded only from php.net's supported-versions page as fixed ground truth (never invented, rounded, or extrapolated); a version's current lifecycle phase is determined by comparing those published dates against the review date.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/php-runtime-eol-opcache-fpm-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
+  {
+    "id": "php-session-upload-deserialization-review",
+    "name": "PHP Session, Upload & Deserialization Security Review",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing PHP application-security seams: user-reachable unserialize() object injection (allowed_classes is insufficient), session fixation/hijacking hardening (session_regenerate_id, use_strict_mode, cookie flags), and unsafe file-upload handling, each mapped to an OWASP category and the php.net-documented fix.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.php.net/manual/en/function.unserialize.php",
+      "https://www.php.net/manual/en/session.security.php",
+      "https://www.php.net/manual/en/features.file-upload.common-pitfalls.php",
+      "https://owasp.org/www-project-top-ten/"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no network. Never runs deserialization payloads, uploads, or exploits against any live or staging system. Any credential- or PII-shaped string is a redact-and-flag finding, never echoed. Every unserialize()/session/upload claim is grounded in current php.net documentation, not memory.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/php-session-upload-deserialization-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "playwright-e2e-execution-run",
     "name": "Playwright E2E Execution Run",
@@ -14062,6 +14573,35 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "revenue-critical-journey-integrity-review",
+    "name": "Revenue-Critical Journey Integrity Review",
+    "type": "skill",
+    "provider": "generic",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing the cross-tier seams of revenue-critical journeys (checkout, payment, account creation, login): idempotency of money-moving and account-creating requests, server-side re-validation of client-enforced rules, webhook duplicate/out-of-order handling, retry-storm safeguards, and advisory PCI DSS SAQ-scope judgment for the integration model in use.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.stripe.com/api/idempotent_requests",
+      "https://docs.stripe.com/webhooks/best-practices",
+      "https://www.pcisecuritystandards.org/faqs/1443/",
+      "https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a",
+      "https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/rel_mitigate_interaction_failure_limit_retries.html",
+      "https://baymard.com/lists/cart-abandonment-rate"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no network egress to any payment system. Never requests, transmits, stores, or reproduces cardholder data (PAN/CVV), API keys, session tokens, or webhook signing secrets — any such string is a redact-and-flag finding, never echoed. PCI DSS SAQ-scope output is an advisory scoping opinion to inform a Qualified Security Assessor or the merchant's own validation, never a compliance attestation or assessment of record. Never executes payment flows or replays webhooks against live, sandbox, or staging systems.",
+    "last_verified": "2026-07-16",
+    "path": "skills/cross-functional/revenue-critical-journey-integrity-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "revenue-recognition-advisor",
     "name": "Revenue Recognition Advisor",
@@ -17996,6 +18536,33 @@
     "version": "0.1.0",
     "author": "github: Raishin"
   },
+  {
+    "id": "wordpress-rest-block-security-review",
+    "name": "WordPress REST & Block Security Review",
+    "type": "skill",
+    "provider": "php",
+    "harnesses": [
+      "claude-code",
+      "cursor",
+      "codex",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Skill for reviewing WordPress plugin and theme security: REST register_rest_route permission_callback enforcement (required since WordPress 5.5) and nonce/capability checks, dynamic-block render_callback output escaping, and the validate-on-input, escape-on-output discipline behind the plugin-dominated WordPress CVE surface.",
+    "source_type": "original",
+    "official_docs": [
+      "https://developer.wordpress.org/apis/security/",
+      "https://developer.wordpress.org/rest-api/extending-the-rest-api/routes-and-endpoints/",
+      "https://developer.wordpress.org/block-editor/getting-started/fundamentals/static-dynamic-rendering/",
+      "https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/"
+    ],
+    "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no live WordPress access. Flags missing permission_callback, unescaped output, and missing nonce/capability checks from source only; treats any credential- or PII-shaped string as a redact-and-flag finding; grounds REST and block-editor API claims in current developer.wordpress.org documentation.",
+    "last_verified": "2026-07-16",
+    "path": "skills/php/wordpress-rest-block-security-review",
+    "version": "0.1.0",
+    "author": "github: Raishin"
+  },
   {
     "id": "working-capital-advisor",
     "name": "Finance Working Capital Advisor",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "3.2.0",
+  "version": "3.4.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "3.2.0",
+  "version": "3.4.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "Raishin",

package/powers/README.md

@@ -1,6 +1,6 @@
 # `powers/` — Kiro Powers
 
-This directory holds **40 Kiro Powers** for `vanguard-frontier-agentic`, one
+This directory holds **42 Kiro Powers** for `vanguard-frontier-agentic`, one
 per cloud/platform/IaC provider. Each Power is a directory containing a
 `POWER.md` file with strict-5 frontmatter and steering content.
 
@@ -30,6 +30,7 @@ powers/
 ├── vanguard-huawei/POWER.md
 ├── vanguard-ionos/POWER.md
 ├── vanguard-istio/POWER.md
+├── vanguard-java/POWER.md
 ├── vanguard-kubernetes/POWER.md
 ├── vanguard-kyverno/POWER.md
 ├── vanguard-legal/POWER.md
@@ -41,6 +42,7 @@ powers/
 ├── vanguard-oci/POWER.md
 ├── vanguard-opentelemetry/POWER.md
 ├── vanguard-ovhcloud/POWER.md
+├── vanguard-php/POWER.md
 ├── vanguard-prometheus/POWER.md
 ├── vanguard-salesforce/POWER.md
 ├── vanguard-sap/POWER.md
@@ -84,7 +86,7 @@ cd vanguard-frontier-agentic
 ## How to update
 
 ```bash
-# Regenerate the 40 Powers from catalog/agents.json + per-provider config:
+# Regenerate the 42 Powers from catalog/agents.json + per-provider config:
 npm run kiro-powers:write
 
 # Then verify everything is in sync: