@raishin/vanguard-frontier-agentic 3.8.0 → 3.10.0

package/catalog/workflows.json

@@ -0,0 +1,50 @@
+{
+  "version": "0.1.0",
+  "description": "Workflow definitions discovered in .claude/workflows/. Generated from each script's meta block by scripts/generate-workflow-catalog.mjs — never hand-edited.",
+  "workflows": [
+    {
+      "id": "agentic-delegation",
+      "name": "agentic-delegation",
+      "path": ".claude/workflows/agentic-delegation.js",
+      "description": "Context7-grounded delegation: Haiku recon, orchestrator-tier spec, Sonnet implementation, adversarial claim verification, then the repo gate suite.",
+      "when_to_use": "Multi-step work in this repo that decomposes into cheap parallel recon plus a small amount of genuine judgment — especially anything that encodes external technical facts (model names, API behaviour, version-specific semantics) that must be grounded in primary sources before they ship.",
+      "phases": [
+        {
+          "title": "Resolve sources",
+          "detail": "Resolve Context7 library IDs once, centrally",
+          "model": "haiku"
+        },
+        {
+          "title": "Recon",
+          "detail": "Parallel Haiku sweeps, one narrow question each, citations required",
+          "model": "haiku"
+        },
+        {
+          "title": "Spec",
+          "detail": "Orchestrator-tier file-scoped specs — architecture stays here",
+          "model": ""
+        },
+        {
+          "title": "Implement",
+          "detail": "Sonnet writes against an exact spec",
+          "model": "sonnet"
+        },
+        {
+          "title": "Regenerate",
+          "detail": "Settle generated output before verification, when generators are declared",
+          "model": "haiku"
+        },
+        {
+          "title": "Verify",
+          "detail": "Adversarial Context7-grounded check of every factual claim written",
+          "model": "sonnet"
+        },
+        {
+          "title": "Gate",
+          "detail": "Repo gate suite in documented order, asset-integrity last",
+          "model": "haiku"
+        }
+      ]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "3.8.0",
+  "version": "3.10.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -62,11 +62,13 @@
     "test:codex-plugin-marketplace-install": "node tests/test-codex-plugin-marketplace-install.test.mjs",
     "validate:finops-fixtures": "python3 tests/validate-finops-price-fixtures.py",
     "validate:readme-counts": "node tests/validate-readme-counts.mjs && node scripts/generate-readme-counts.mjs --check",
+    "validate:board-counts": "node scripts/generate-board-counts.mjs --check",
     "validate:qa-cluster": "node tests/eval-qa-cluster.mjs",
     "validate:frontend-security-detection": "python3 tests/validate-frontend-security-detection.py",
     "validate:agent-tool-tiers": "python3 tests/validate-agent-tool-tiers.py",
     "agent-tool-tiers:write": "python3 tests/validate-agent-tool-tiers.py --write",
     "readme-counts:write": "node scripts/generate-readme-counts.mjs",
+    "board-counts:write": "node scripts/generate-board-counts.mjs",
     "test:marketplace-validators": "python3 tests/test-marketplace-validators.py",
     "maestro-routing:write": "python3 tests/_generate_maestro_routing_fixtures.py",
     "plugin-manifest:write": "node scripts/generate-plugin-manifest.mjs",
@@ -76,16 +78,18 @@
     "model-policy:check": "node scripts/model-policy.mjs check",
     "model-policy:apply": "node scripts/model-policy.mjs apply",
     "model-policy:report": "node scripts/model-policy.mjs report",
-    "manifest:write:all": "npm run manifest:write & npm run plugin-manifest:write & npm run cursor-plugin:write & npm run kiro-powers:write & npm run asset-integrity:write & npm run readme-counts:write & wait",
+    "manifest:write:all": "npm run manifest:write & npm run plugin-manifest:write & npm run cursor-plugin:write & npm run kiro-powers:write & npm run asset-integrity:write & npm run readme-counts:write & npm run board-counts:write & npm run workflow-catalog:write & wait",
     "test:copilot-bundling": "python3 tests/test-copilot-skill-bundling.py",
     "test:gemini-bundling": "python3 tests/test-gemini-skill-bundling.py",
     "test:cursor-kiro-notices": "node tests/export-cursor-kiro-skill-notice.test.mjs",
     "test:fuzz": "node tests/fuzz-properties.test.mjs",
-    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-coherence && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:model-policy && npm run validate:links && npm run validate:asset-integrity && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures && npm run validate:readme-counts && npm run validate:qa-cluster && npm run validate:frontend-security-detection && npm run validate:agent-tool-tiers",
+    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-coherence && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:model-policy && npm run validate:links && npm run validate:asset-integrity && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures && npm run validate:readme-counts && npm run validate:board-counts && npm run validate:qa-cluster && npm run validate:frontend-security-detection && npm run validate:agent-tool-tiers && npm run validate:workflow-catalog",
     "release:sbom": "command -v syft >/dev/null 2>&1 && syft scan dir:. -o spdx-json=sbom.spdx.json || echo 'syft not installed; SBOM is generated in CI by anchore/sbom-action'",
     "lint:md": "npx --yes markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#.code-review-graph\" \"#CHANGELOG.md\"",
     "lint:spell": "codespell",
-    "lint:docs": "npm run lint:md && npm run lint:spell"
+    "lint:docs": "npm run lint:md && npm run lint:spell",
+    "workflow-catalog:write": "node scripts/generate-workflow-catalog.mjs",
+    "validate:workflow-catalog": "node scripts/generate-workflow-catalog.mjs --check"
   },
   "devDependencies": {
     "@semantic-release/changelog": "7.0.0",
@@ -95,7 +99,7 @@
     "@semantic-release/github": "12.0.9",
     "@semantic-release/npm": "^13.1.5",
     "@semantic-release/release-notes-generator": "14.1.1",
-    "conventional-changelog-conventionalcommits": "10.2.1",
+    "conventional-changelog-conventionalcommits": "10.3.0",
     "fast-check": "^4.7.0",
     "semantic-release": "25.0.9"
   },

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "3.8.0",
+  "version": "3.10.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "VincentChuWaiChow",

package/powers/README.md

@@ -1,6 +1,6 @@
 # `powers/` — Kiro Powers
 
-This directory holds **45 Kiro Powers** for `vanguard-frontier-agentic`, one
+This directory holds **42 Kiro Powers** for `vanguard-frontier-agentic`, one
 per cloud/platform/IaC provider. Each Power is a directory containing a
 `POWER.md` file with strict-5 frontmatter and steering content.
 
@@ -28,7 +28,6 @@ powers/
 ├── vanguard-hetzner/POWER.md
 ├── vanguard-hr/POWER.md
 ├── vanguard-huawei/POWER.md
-├── vanguard-ionos/POWER.md
 ├── vanguard-istio/POWER.md
 ├── vanguard-java/POWER.md
 ├── vanguard-kotlin/POWER.md
@@ -42,13 +41,11 @@ powers/
 ├── vanguard-nvidia/POWER.md
 ├── vanguard-oci/POWER.md
 ├── vanguard-opentelemetry/POWER.md
-├── vanguard-ovhcloud/POWER.md
 ├── vanguard-php/POWER.md
 ├── vanguard-prometheus/POWER.md
 ├── vanguard-python/POWER.md
 ├── vanguard-salesforce/POWER.md
 ├── vanguard-sap/POWER.md
-├── vanguard-scaleway/POWER.md
 ├── vanguard-sigstore/POWER.md
 ├── vanguard-snowflake/POWER.md
 ├── vanguard-terraform/POWER.md
@@ -89,7 +86,7 @@ cd vanguard-frontier-agentic
 ## How to update
 
 ```bash
-# Regenerate the 45 Powers from catalog/agents.json + per-provider config:
+# Regenerate the 42 Powers from catalog/agents.json + per-provider config:
 npm run kiro-powers:write
 
 # Then verify everything is in sync:

package/powers/vanguard-cilium/POWER.md

@@ -1,13 +1,13 @@
 ---
 name: "vanguard-cilium"
 displayName: "Vanguard Frontier — Cilium"
-description: "Reviews cilium CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy, standard NetworkPolicy, ClusterMesh cross-cluster policy... Static review only; no live mutations."
+description: "Reviews ciliumNetworkPolicy, CiliumClusterwideNetworkPolicy, NetworkPolicy, ClusterMesh cross-cluster policy semantics, and... Static review only; no live mutations."
 keywords: ["cilium", "network-policy", "ebpf", "cluster-mesh"]
 author: "VincentChuWaiChow"
 ---
 # Vanguard Frontier — Cilium
 
-Reviews cilium CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy, standard NetworkPolicy, ClusterMesh cross-cluster policy... Static review only; no live mutations.
+Reviews ciliumNetworkPolicy, CiliumClusterwideNetworkPolicy, NetworkPolicy, ClusterMesh cross-cluster policy semantics, and... Static review only; no live mutations.
 
 ## When to engage this Power
 

package/powers/vanguard-microsoft/POWER.md

@@ -22,8 +22,6 @@ Use the maestro as the entry point: classify the task, then dispatch to one spec
 ## Live-guard agents (gate_mode only)
 
 - `d365-live-record-field-update-guard-agent` — never auto-dispatched; gate_mode only
-- `d365-live-security-role-guard-agent` — never auto-dispatched; gate_mode only
-- `m365-live-identity-posture-guard-agent` — never auto-dispatched; gate_mode only
 - `m365-live-sensitivity-label-apply-guard-agent` — never auto-dispatched; gate_mode only
 
 Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.

package/powers/vanguard-snowflake/POWER.md

@@ -1,40 +1,46 @@
 ---
 name: "vanguard-snowflake"
-displayName: "Vanguard Frontier — Snowflake (Azure)"
-description: "Curated Snowflake-on-Azure agents for RBAC access governance and data-platform engineering — static review only, no account or production mutations. Covers role hierarchy and least privilege, ACCOUNTADMIN restriction, SECURITYADMIN/SYSADMIN separation of duties, future grants and managed-access schemas, network policies, key-pair/Entra OAuth/SSO/SCIM authentication, Azure Private Link and storage integration, and masking/row-access/tagging governance. Snowflake and Azure surfaces are drift-prone; agents always verify against current Snowflake and Microsoft Learn documentation before rendering findings."
-keywords: ["snowflake", "azure", "rbac", "least-privilege", "data-governance", "private-link", "static-review"]
+displayName: "Vanguard Frontier — Snowflake"
+description: "A cloud-neutral Snowflake board routed by snowflake-maestro: architecture and account topology, platform administration, identity and effective access, network and private connectivity, governance and privacy controls, independent compliance evidence, FinOps unit economics, query performance, batch pipelines, streaming ingestion reliability, analytical semantics, ML lifecycle, Cortex AI agent security, Native Apps and Marketplace, BCDR, DevOps/IaC, migration, and business value. Review agents are read-only; six approval-gated live guards each execute exactly one mutation behind an explicit written human gate. Snowflake surfaces are drift-prone — agents re-verify GA/preview status, deprecations, edition/cloud/region availability, and provider resource stability against current Snowflake documentation before rendering findings."
+keywords: ["snowflake", "rbac", "least-privilege", "data-governance", "finops", "cortex-ai", "bcdr", "live-guard"]
 author: "VincentChuWaiChow"
 ---
-# Vanguard Frontier — Snowflake (Azure)
+# Vanguard Frontier — Snowflake
 
-Curated Snowflake-on-Azure agents for RBAC access governance and data-platform engineering — static review only, no account or production mutations. Covers role hierarchy and least privilege, ACCOUNTADMIN restriction, SECURITYADMIN/SYSADMIN separation of duties, future grants and managed-access schemas, network policies, key-pair/Entra OAuth/SSO/SCIM authentication, Azure Private Link and storage integration, and masking/row-access/tagging governance. Snowflake and Azure surfaces are drift-prone; agents always verify against current Snowflake and Microsoft Learn documentation before rendering findings.
+A cloud-neutral Snowflake board routed by snowflake-maestro: architecture and account topology, platform administration, identity and effective access, network and private connectivity, governance and privacy controls, independent compliance evidence, FinOps unit economics, query performance, batch pipelines, streaming ingestion reliability, analytical semantics, ML lifecycle, Cortex AI agent security, Native Apps and Marketplace, BCDR, DevOps/IaC, migration, and business value. Review agents are read-only; six approval-gated live guards each execute exactly one mutation behind an explicit written human gate. Snowflake surfaces are drift-prone — agents re-verify GA/preview status, deprecations, edition/cloud/region availability, and provider resource stability against current Snowflake documentation before rendering findings.
 
 ## When to engage this Power
 
-Activate when the task references Snowflake (Azure) services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+Activate when the task references Snowflake services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
 
 ## Routing pattern
 
-- *(no maestro for this provider; reference agents directly under `agents/snowflake/`)*
+- **`snowflake-maestro-agent`** — classifies and routes the task to the right specialist
 
-Reference agents directly from agents/snowflake/ without maestro-based routing.
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
 
 ## Live-guard agents (gate_mode only)
 
+- `snowflake-live-auth-network-policy-guard-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-data-protection-policy-guard-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-failover-promotion-guard-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-pipeline-streaming-change-guard-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-rbac-grant-guard-agent` — never auto-dispatched; gate_mode only
 - `snowflake-live-rbac-grant-guard-at-azure-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-warehouse-cost-change-guard-agent` — never auto-dispatched; gate_mode only
 
 Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
 
 ## Invariants
 
-- Static review only — agents never request account credentials, key-pair private keys, OAuth secrets, or customer data, and never mutate a Snowflake account or Azure resource.
-- Enforce least privilege: custom business-function roles under SYSADMIN, restrict ACCOUNTADMIN to a minimum of controlled users, never grant sensitive privileges to PUBLIC, separate SECURITYADMIN (grants) from SYSADMIN (objects).
-- Service accounts use key-pair or Entra OAuth (never passwords); enforce network policies and MFA for human users.
-- Production role/grant/policy/warehouse changes are live-guard gated — never auto-dispatched; require explicit approval, scope confirmation, and rollback plan.
+- Review agents are static review only — they never request account credentials, private keys, OAuth or programmatic access tokens, account locators, or customer data, and never mutate a Snowflake account.
+- Documentation proves supported platform behaviour, never configured account behaviour: edition, region, enabled bundles, authentication enforcement, and policy attachment are UNKNOWN until account evidence establishes them.
+- Enforce least privilege: narrow custom roles, ACCOUNTADMIN forbidden for automation without exception, no GRANT ALL PRIVILEGES, no grants to PUBLIC, no unbounded future grants, and no password authentication for non-human identities.
+- Live guards are never auto-dispatched: each executes exactly one mutation after explicit written human approval naming account, environment, target, mutation, and accepted blast radius, with prior-state capture, preflight, verification, and a rollback path.
 
 ## Where the agents live
 
-Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/snowflake/` in that repository. All 3 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/snowflake/` in that repository. All 28 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
 
 ## Companion install paths
 

package/powers/vanguard-terraform/POWER.md

@@ -34,7 +34,7 @@ Live-guard agents enforce approval, target confirmation, evidence capture, and r
 
 ## Where the agents live
 
-Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/terraform/` in that repository. All 2 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/terraform/` in that repository. All 9 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
 
 ## Companion install paths