@raishin/vanguard-frontier-agentic 3.6.1 → 3.8.0

package/catalog/skills.json

@@ -19637,6 +19637,84 @@
     "version": "0.1.0",
     "author": "github: VincentChuWaiChow"
   },
+  {
+    "id": "typescript-async-contract-reliability",
+    "name": "typescript-async-contract-reliability",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of server-side TypeScript async reliability: floating and ignored promises, AbortSignal cancellation plumbing, unhandled-rejection posture and process-exit behavior, stream/async-iterable backpressure, concurrency bounds, cleanup, and typed error channels. Reads source and Node/lint configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://typescript-eslint.io/packages/parser/",
+      "https://nodejs.org/api/process.html",
+      "https://nodejs.org/api/stream.html"
+    ],
+    "security_notes": "Static review only — reads TypeScript/JavaScript source, the declared Node version, and lint configuration; never runs, builds, deploys, or publishes the code, never contacts a live process or system, and never requests secrets, credentials, or customer data. A process-exit-behavior verdict made without a confirmed Node version is labelled inference, not confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-async-contract-reliability",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-build-graph-performance",
+    "name": "typescript-build-graph-performance",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review, from supplied measurement evidence only, of what in a TypeScript program graph costs measured build or editor time: project references, composite/incremental/.tsbuildinfo behavior, generated-code volume, pathological type instantiation, and duplicated checking across lint, test, and build. Reads measurement output and configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://github.com/microsoft/TypeScript/wiki/Performance",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/",
+      "https://www.typescriptlang.org/docs/handbook/project-references.html"
+    ],
+    "security_notes": "Static review of supplied measurement evidence only — reads `--diagnostics`/`--extendedDiagnostics` output, `--generateTrace` traces, `tsconfig.json` files, and package topology; never invokes the compiler, runs a build, or measures a live system, and never requests secrets, credentials, or customer data. Never prescribes a restructuring without a supplied measurement, and always records which compiler binary produced it.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-build-graph-performance",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-business-critical-automation-governance",
+    "name": "typescript-business-critical-automation-governance",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of whether a privileged TypeScript automation (backfill, migration, reconciliation script) may run and under what controls: dry-run coverage of the write path, technical and business idempotency, blast-radius bounds, checkpoint/resume, rollback and reconciliation evidence, audit trail, and a named inverse operation. Never executes anything; reads script source and declared credential scope by name only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nodejs.org/api/typescript.html",
+      "https://nodejs.org/learn/typescript/run-natively",
+      "https://typescript-eslint.io/packages/parser/"
+    ],
+    "security_notes": "Static review only — reads script source, the run command, credential scope by name only (never a value), scheduler/CI configuration, an existing runbook, and the reconciliation method; never executes, deploys, or migrates anything, and never requests a credential value, secret, or connection string.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-business-critical-automation-governance",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
   {
     "id": "typescript-contracts-review",
     "name": "TypeScript Contracts Review",
@@ -19666,6 +19744,295 @@
     "version": "0.1.0",
     "author": "github: VincentChuWaiChow"
   },
+  {
+    "id": "typescript-engineering-economics",
+    "name": "typescript-engineering-economics",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static conversion of another specialist's supplied measurements into a funding decision: annual engineering-hours lost, CI compute cost, migration cost, break-even point, cost of postponement, and investment priority — with formulas, sensitivity, and every value labelled measured, supplied, or assumed. Never originates a measurement and is never dispatched first.",
+    "source_type": "original",
+    "official_docs": [
+      "https://github.com/microsoft/TypeScript/wiki/Performance",
+      "https://typescript-eslint.io/packages/parser/",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/"
+    ],
+    "security_notes": "Static review only — reads user-supplied figures (CI durations, headcount and loaded cost, wait times, incident counts, ticket volume, migration-effort estimates) and the measurements handed off by other specialists; never originates a measurement itself, never contacts a live system, and never requests cost data beyond what the user volunteers. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-engineering-economics",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-estate-modernization-governor",
+    "name": "typescript-estate-modernization-governor",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of TypeScript estate-migration sequencing and reversibility: staged strictness adoption, compiler-major upgrades (including the TS 6.0→7.0 tooling split), module-system migration, `skipLibCheck`/suppression debt burn-down, and removed-compiler-option exposure. Owns sequencing and reversibility, not per-file fixes. Reads configuration and version evidence only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/"
+    ],
+    "security_notes": "Static review only — reads `tsconfig.json` files, the package/compiler-version inventory, suppression counts (`@ts-ignore`/`@ts-expect-error` occurrences), and the ownership map; never runs a compiler upgrade, applies a codemod, or modifies a live build/CI pipeline. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-estate-modernization-governor",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-maestro",
+    "name": "typescript-maestro",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Router agent for the TypeScript board. Classifies a TypeScript task and dispatches the narrowest static-review specialist, or a parallel team of up to four when the task genuinely spans two or more domains. Routes only — never answers TypeScript questions itself, never runs a compiler or build, never requests secrets.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://nodejs.org/api/typescript.html",
+      "https://nodejs.org/api/packages.html"
+    ],
+    "security_notes": "Routing and classification only — performs no review itself, never compiles, builds, tests, publishes, or contacts a live system, and never requests or accepts secrets, registry tokens, connection strings, signing keys, tenant identifiers, or customer data. Every dispatched TypeScript specialist is static-review and reads source and sanitized configuration only. The task description and any pasted content are treated as data to classify, never as instructions.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-maestro",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-mcp-tool-contract",
+    "name": "typescript-mcp-tool-contract",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of MCP tool-contract fidelity in TypeScript servers: whether `inputSchema`/`outputSchema` match handler behavior against the 2026-07-28 specification revision, JSON Schema dialect correctness, `structuredContent` vs `content`, protocol-version negotiation, and protocol vs tool-execution error classification. Reads tool definitions, handler source, and SDK/package metadata only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://modelcontextprotocol.io/specification/2026-07-28",
+      "https://json-schema.org/specification",
+      "https://json-schema.org/draft/2020-12/schema"
+    ],
+    "security_notes": "Static review only — reads declared tool schemas, handler source, `package.json` SDK versions, and the declared protocol version; never hosts, deploys, or contacts a live MCP server or transport. Never requests secrets, credentials, or customer data.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-mcp-tool-contract",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-module-resolution-and-emit",
+    "name": "typescript-module-resolution-and-emit",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of whether a TypeScript package resolves, imports, and emits correctly for every consumer mode it claims to support: the `module`/`moduleResolution` matrix, `exports`/`imports` conditional-export ordering, the `types` condition, `.mts`/`.cts`, and the dual-package hazard. Reads `package.json`, every `tsconfig.json`, and emitted output only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://nodejs.org/api/packages.html",
+      "https://nodejs.org/api/modules.html",
+      "https://publint.dev/rules",
+      "https://arethetypeswrong.github.io"
+    ],
+    "security_notes": "Static review only — reads `package.json`, every `tsconfig.json`, emitted declaration/output files, and sanitized build configuration; never compiles, bundles, publishes, or contacts a live registry, and never requests secrets, credentials, or customer data. A resolution claim not confirmed by the compiler's actual `--showConfig` output or the emitted files is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-module-resolution-and-emit",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-node-execution-compatibility",
+    "name": "typescript-node-execution-compatibility",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of whether TypeScript code actually runs on the target Node version and is type-checked somewhere: type-stripping limits and their runtime consequences, proof of a separate `tsc --noEmit` gate, runtime-unsupported syntax, import-extension requirements, and Node version/API gating. Reads source, the run command, CI configuration, and every `tsconfig.json` only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://nodejs.org/api/typescript.html",
+      "https://nodejs.org/learn/typescript/run-natively",
+      "https://github.com/nodejs/Release",
+      "https://nodejs.org/api/packages.html"
+    ],
+    "security_notes": "Static review only — reads source, the exact run command and flags, CI job definitions, every `tsconfig.json`, and the container entrypoint; never executes the code, never invokes Node or `tsc`, never contacts a live system, and never requests secrets, credentials, or customer data. A claim about a Node version not stated by the user is labelled assumption, never confirmed — the agent asks for the version rather than guessing.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-node-execution-compatibility",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-package-publication-integrity",
+    "name": "typescript-package-publication-integrity",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of npm package publication integrity: publish identity and authority (trusted publishing/OIDC versus long-lived tokens), provenance attestation, the release-automation trust path, tarball contents, and registry/scope configuration. Reads the publish workflow and sanitized package configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://docs.npmjs.com/generating-provenance-statements",
+      "https://publint.dev/rules",
+      "https://arethetypeswrong.github.io"
+    ],
+    "security_notes": "Static review only — reads the release-automation workflow definition, `.npmrc`/`publishConfig`, the packed file list (e.g. `npm pack --dry-run` output), and registry/scope settings; never runs `npm publish`, signs an artifact, rotates or issues a token, or contacts a live registry. Never requests secrets, registry tokens, signing keys, or customer data.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-package-publication-integrity",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-public-api-and-declaration-governance",
+    "name": "typescript-public-api-and-declaration-governance",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of a published TypeScript type surface: `.d.ts` correctness and emit strategy, public-versus-accidental exports, breaking-change classification and the semver decision, the consumer compilation matrix, and compile-time type-contract tests. Reads declarations, API reports, and configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/docs/handbook/modules/appendices/esm-cjs-interop.html",
+      "https://api-extractor.com/",
+      "https://vitest.dev/guide/testing-types"
+    ],
+    "security_notes": "Static review only — reads declaration files (`.d.ts`), API reports/rollups, `package.json`, consumer `tsconfig.json` files, and Vitest type-test source; never compiles, builds, runs, publishes, or executes the package, never contacts a live registry or consumer, and never requests secrets, credentials, registry tokens, or customer data. A breaking-change classification made without a supplied baseline surface is labelled inference, not confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-public-api-and-declaration-governance",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-runtime-boundary-contract",
+    "name": "typescript-runtime-boundary-contract",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of runtime trust-boundary handling in TypeScript: whether every value entering the program (HTTP, queue, environment/configuration, database reads, third-party SDKs, webhooks, `JSON.parse`, files, agent/tool calls) is parsed against a schema rather than merely asserted, `unknown`-first ingestion, one source of truth between a schema and its TypeScript type, and generated-type drift. Reads source and sanitized configuration/schema files only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://json-schema.org/specification",
+      "https://zod.dev",
+      "https://ajv.js.org/"
+    ],
+    "security_notes": "Static review only — reads TypeScript source, declared schemas, and sanitized configuration or lockfile snippets showing the installed validator and version; never compiles, builds, runs, or contacts a live system, and never requests secrets, credentials, connection strings, or customer data. A runtime-behavior or data-shape claim not confirmed by the visible schema or source is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-runtime-boundary-contract",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-static-enforcement-policy",
+    "name": "typescript-static-enforcement-policy",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of what 'it passes' must mean for each TypeScript package and what proving it costs: strict-family flag policy and silent loosening, typed-lint rule selection and Project Service configuration, editor-versus-CI parity, and suppression policy. Reads tsconfig, lint, and CI job configuration only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/",
+      "https://typescript-eslint.io/packages/parser/"
+    ],
+    "security_notes": "Static review only — reads every `tsconfig.json` and its effective (resolved) configuration, lint configuration, and CI job definitions; never runs the compiler, the linter, a build, or a test, never contacts a live CI system, and never requests secrets, credentials, or customer data. A configuration finding made without the effective (extends-resolved) file is labelled inference, not confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-static-enforcement-policy",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
+  {
+    "id": "typescript-type-soundness",
+    "name": "typescript-type-soundness",
+    "type": "skill",
+    "provider": "typescript",
+    "harnesses": [
+      "codex",
+      "claude-code",
+      "cursor",
+      "gemini",
+      "kiro",
+      "other"
+    ],
+    "summary": "Static review of type-level soundness in shared or published TypeScript code: generic variance, conditional and mapped type correctness, type predicates that assert more than they check, unsound narrowing, `satisfies` versus an explicit annotation, branded and nominal modelling, and `unknown`-first discipline. Reads source and sanitized `tsconfig.json` only.",
+    "source_type": "original",
+    "official_docs": [
+      "https://www.typescriptlang.org/tsconfig",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/",
+      "https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/"
+    ],
+    "security_notes": "Static review only — reads TypeScript/JavaScript source and sanitized `tsconfig.json`; never compiles, type-checks, builds, runs, publishes, or contacts a live system, and never requests secrets, credentials, tokens, or customer data. A claim about the installed compiler version or actual runtime behavior not shown in the supplied artifacts is labelled assumption, never confirmed.",
+    "last_verified": "2026-08-13",
+    "path": "skills/typescript/typescript-type-soundness",
+    "version": "0.1.0",
+    "author": "github: VincentChuWaiChow"
+  },
   {
     "id": "variance-analysis-advisor",
     "name": "Variance Analysis Advisor",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "3.6.1",
+  "version": "3.8.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -61,7 +61,7 @@
     "validate:codex-marketplace": "python3 tests/validate-codex-marketplace.py",
     "test:codex-plugin-marketplace-install": "node tests/test-codex-plugin-marketplace-install.test.mjs",
     "validate:finops-fixtures": "python3 tests/validate-finops-price-fixtures.py",
-    "validate:readme-counts": "node tests/validate-readme-counts.mjs",
+    "validate:readme-counts": "node tests/validate-readme-counts.mjs && node scripts/generate-readme-counts.mjs --check",
     "validate:qa-cluster": "node tests/eval-qa-cluster.mjs",
     "validate:frontend-security-detection": "python3 tests/validate-frontend-security-detection.py",
     "validate:agent-tool-tiers": "python3 tests/validate-agent-tool-tiers.py",
@@ -97,7 +97,7 @@
     "@semantic-release/release-notes-generator": "14.1.1",
     "conventional-changelog-conventionalcommits": "10.2.1",
     "fast-check": "^4.7.0",
-    "semantic-release": "25.0.8"
+    "semantic-release": "25.0.9"
   },
   "publishConfig": {
     "access": "public",

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "3.6.1",
+  "version": "3.8.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "VincentChuWaiChow",

package/powers/README.md

@@ -1,6 +1,6 @@
 # `powers/` — Kiro Powers
 
-This directory holds **44 Kiro Powers** for `vanguard-frontier-agentic`, one
+This directory holds **45 Kiro Powers** for `vanguard-frontier-agentic`, one
 per cloud/platform/IaC provider. Each Power is a directory containing a
 `POWER.md` file with strict-5 frontmatter and steering content.
 
@@ -51,7 +51,8 @@ powers/
 ├── vanguard-scaleway/POWER.md
 ├── vanguard-sigstore/POWER.md
 ├── vanguard-snowflake/POWER.md
-└── vanguard-terraform/POWER.md
+├── vanguard-terraform/POWER.md
+└── vanguard-typescript/POWER.md
 ```
 
 Each `POWER.md` declares:
@@ -88,7 +89,7 @@ cd vanguard-frontier-agentic
 ## How to update
 
 ```bash
-# Regenerate the 44 Powers from catalog/agents.json + per-provider config:
+# Regenerate the 45 Powers from catalog/agents.json + per-provider config:
 npm run kiro-powers:write
 
 # Then verify everything is in sync:

package/powers/vanguard-typescript/POWER.md

@@ -0,0 +1,43 @@
+---
+name: "vanguard-typescript"
+displayName: "Vanguard Frontier — TypeScript"
+description: "Curated TypeScript agents for the TypeScript program and the published package — type soundness in shared code, runtime boundary contracts, module resolution and emit, Node execution compatibility, declaration governance, build-graph cost, static enforcement policy, async contract reliability, publication integrity, estate modernization, and MCP tool contracts. Routes via typescript-maestro to specialist agents based on task scope. Static review only; no live mutations."
+keywords: ["typescript", "tsconfig", "tsc", "declaration-emit", "module-resolution", "type-safety", "npm-publish", "static-review"]
+author: "VincentChuWaiChow"
+---
+# Vanguard Frontier — TypeScript
+
+Curated TypeScript agents for the TypeScript program and the published package — type soundness in shared code, runtime boundary contracts, module resolution and emit, Node execution compatibility, declaration governance, build-graph cost, static enforcement policy, async contract reliability, publication integrity, estate modernization, and MCP tool contracts. Routes via typescript-maestro to specialist agents based on task scope. Static review only; no live mutations.
+
+## When to engage this Power
+
+Activate when the task references TypeScript services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+
+## Routing pattern
+
+- **`typescript-maestro-agent`** — classifies and routes the task to the right specialist
+
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
+
+## Live-guard agents (gate_mode only)
+
+- *(none — this provider has no live-mutation guards in the catalog)*
+
+Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
+
+## Invariants
+
+- Static review only — agents read source and sanitized configuration, and never compile, build, test, publish, deploy, sign, or contact a live system.
+- Never request or accept secrets, npm or registry tokens, signing keys, connection strings, tenant identifiers, or customer data.
+- This repository contains no TypeScript program of its own, so no verdict may be grounded in an assumed compiler, tsconfig, or Node version — a version-gated conclusion requires evidence the user supplies, and its absence is a refuse-and-ask.
+- Compile-time is not runtime: types are erased, so a passing build is evidence about the source and never about the payload crossing an I/O boundary.
+- Frontend application diffs, framework specifics, bundler configuration, dependency intake, and the monorepo task graph belong to the frontend board — hand them off rather than absorbing them.
+
+## Where the agents live
+
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/typescript/` in that repository. All 14 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+
+## Companion install paths
+
+- **Claude Code:** `/plugin marketplace add VincentChuWaiChow/vanguard-frontier-agentic` then `/plugin install vanguard-frontier-agentic@vanguard-frontier-agentic`
+- **Codex / Copilot / Cursor / Gemini CLI / Kiro (file export):** `npx vfa-export-agents --platform <harness> --provider typescript --repo .`

package/schemas/agent.schema.json

@@ -80,7 +80,8 @@
         "nvidia",
         "claude",
         "marketing",
-        "python"
+        "python",
+        "typescript"
       ]
     },
     "harnesses": {

package/schemas/skill.schema.json

@@ -80,7 +80,8 @@
         "marketing",
         "accounting",
         "finance",
-        "python"
+        "python",
+        "typescript"
       ]
     },
     "harnesses": {

package/scripts/gen_kotlin_agents.py

@@ -19,7 +19,7 @@ the whole board stays consistent and reproducible (behaviour changes only when t
 committed data changes).
 
 Run:  python3 scripts/gen_kotlin_agents.py
-Then: python3 scripts/update-catalog-new-agents.py && npm run manifest:write:all
+Then: python3 scripts/update-catalog-new-agents.py --provider kotlin && npm run manifest:write:all
       && npm run docs-data:write && npm run model-policy:apply
       && npm run asset-integrity:write && npm run validate
 

package/scripts/gen_netsuite_agents.py

@@ -17,7 +17,7 @@ static-review (T0) house style:
   skills/netsuite/<skill-id>/references/*.md
 
 Run:  python3 scripts/gen_netsuite_agents.py
-Then: python3 scripts/update-catalog-new-agents.py && npm run manifest:write:all
+Then: python3 scripts/update-catalog-new-agents.py --provider netsuite && npm run manifest:write:all
       && python3 tests/validate-asset-integrity.py --write && npm run validate
 """
 from __future__ import annotations

package/scripts/gen_python_agents.py

@@ -19,7 +19,7 @@ the whole board stays consistent and reproducible (behaviour changes only when t
 committed data changes).
 
 Run:  python3 scripts/gen_python_agents.py
-Then: python3 scripts/update-catalog-new-agents.py && npm run manifest:write:all
+Then: python3 scripts/update-catalog-new-agents.py --provider python && npm run manifest:write:all
       && npm run docs-data:write && npm run model-policy:apply
       && npm run asset-integrity:write && npm run validate
 

package/scripts/gen_python_live_agents.py

@@ -17,7 +17,7 @@ static generator, with three live-plane differences:
   3. Live skills declare allowed-tools `Read Grep Glob WebSearch WebFetch Bash`.
 
 Run:  python3 scripts/gen_python_live_agents.py
-Then: python3 scripts/update-catalog-new-agents.py && npm run manifest:write:all
+Then: python3 scripts/update-catalog-new-agents.py --provider python && npm run manifest:write:all
       && npm run docs-data:write && npm run model-policy:apply
       && npm run asset-integrity:write && npm run validate
 """