@raishin/vanguard-frontier-agentic 3.9.0 → 3.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raishin/vanguard-frontier-agentic",
-  "version": "3.9.0",
+  "version": "3.10.0",
   "description": "Cloud and zero-trust agentic workflow marketplace for skills, agents, rules, MCP references, and compliance-aware architecture.",
   "license": "Apache-2.0",
   "repository": {
@@ -62,11 +62,13 @@
     "test:codex-plugin-marketplace-install": "node tests/test-codex-plugin-marketplace-install.test.mjs",
     "validate:finops-fixtures": "python3 tests/validate-finops-price-fixtures.py",
     "validate:readme-counts": "node tests/validate-readme-counts.mjs && node scripts/generate-readme-counts.mjs --check",
+    "validate:board-counts": "node scripts/generate-board-counts.mjs --check",
     "validate:qa-cluster": "node tests/eval-qa-cluster.mjs",
     "validate:frontend-security-detection": "python3 tests/validate-frontend-security-detection.py",
     "validate:agent-tool-tiers": "python3 tests/validate-agent-tool-tiers.py",
     "agent-tool-tiers:write": "python3 tests/validate-agent-tool-tiers.py --write",
     "readme-counts:write": "node scripts/generate-readme-counts.mjs",
+    "board-counts:write": "node scripts/generate-board-counts.mjs",
     "test:marketplace-validators": "python3 tests/test-marketplace-validators.py",
     "maestro-routing:write": "python3 tests/_generate_maestro_routing_fixtures.py",
     "plugin-manifest:write": "node scripts/generate-plugin-manifest.mjs",
@@ -76,12 +78,12 @@
     "model-policy:check": "node scripts/model-policy.mjs check",
     "model-policy:apply": "node scripts/model-policy.mjs apply",
     "model-policy:report": "node scripts/model-policy.mjs report",
-    "manifest:write:all": "npm run manifest:write & npm run plugin-manifest:write & npm run cursor-plugin:write & npm run kiro-powers:write & npm run asset-integrity:write & npm run readme-counts:write & npm run workflow-catalog:write & wait",
+    "manifest:write:all": "npm run manifest:write & npm run plugin-manifest:write & npm run cursor-plugin:write & npm run kiro-powers:write & npm run asset-integrity:write & npm run readme-counts:write & npm run board-counts:write & npm run workflow-catalog:write & wait",
     "test:copilot-bundling": "python3 tests/test-copilot-skill-bundling.py",
     "test:gemini-bundling": "python3 tests/test-gemini-skill-bundling.py",
     "test:cursor-kiro-notices": "node tests/export-cursor-kiro-skill-notice.test.mjs",
     "test:fuzz": "node tests/fuzz-properties.test.mjs",
-    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-coherence && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:model-policy && npm run validate:links && npm run validate:asset-integrity && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures && npm run validate:readme-counts && npm run validate:qa-cluster && npm run validate:frontend-security-detection && npm run validate:agent-tool-tiers && npm run validate:workflow-catalog",
+    "validate": "npm run validate:catalog && npm run validate:aws && npm run manifest:check && npm run validate:allowed-tools && npm run validate:skill-coherence && npm run validate:skill-schema && npm run validate:agent-schema && npm run validate:model-policy && npm run validate:links && npm run validate:asset-integrity && npm run validate:mcp-trust-matrix && npm run validate:no-lifecycle-scripts && npm run validate:promotion-gatekeeper && npm run validate:install-coverage && npm run validate:maestro-routing && npm run validate:plugin-manifest && npm run validate:kiro-powers && npm run validate:multi-harness-marketplace && npm run validate:codex-marketplace && npm run validate:finops-fixtures && npm run validate:readme-counts && npm run validate:board-counts && npm run validate:qa-cluster && npm run validate:frontend-security-detection && npm run validate:agent-tool-tiers && npm run validate:workflow-catalog",
     "release:sbom": "command -v syft >/dev/null 2>&1 && syft scan dir:. -o spdx-json=sbom.spdx.json || echo 'syft not installed; SBOM is generated in CI by anchore/sbom-action'",
     "lint:md": "npx --yes markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.git\" \"#.code-review-graph\" \"#CHANGELOG.md\"",
     "lint:spell": "codespell",
@@ -97,7 +99,7 @@
     "@semantic-release/github": "12.0.9",
     "@semantic-release/npm": "^13.1.5",
     "@semantic-release/release-notes-generator": "14.1.1",
-    "conventional-changelog-conventionalcommits": "10.2.1",
+    "conventional-changelog-conventionalcommits": "10.3.0",
     "fast-check": "^4.7.0",
     "semantic-release": "25.0.9"
   },

package/plugins/vanguard-frontier-agentic/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-frontier-agentic",
-  "version": "3.9.0",
+  "version": "3.10.0",
   "description": "Curated marketplace for cloud and zero-trust AI workflows. 331 agents, 286 skills, and rules across AWS, Azure, OCI, GCP, Alibaba Cloud, Huawei Cloud, Kubernetes, and Terraform.",
   "author": {
     "name": "VincentChuWaiChow",

package/powers/README.md

@@ -1,6 +1,6 @@
 # `powers/` — Kiro Powers
 
-This directory holds **45 Kiro Powers** for `vanguard-frontier-agentic`, one
+This directory holds **42 Kiro Powers** for `vanguard-frontier-agentic`, one
 per cloud/platform/IaC provider. Each Power is a directory containing a
 `POWER.md` file with strict-5 frontmatter and steering content.
 
@@ -28,7 +28,6 @@ powers/
 ├── vanguard-hetzner/POWER.md
 ├── vanguard-hr/POWER.md
 ├── vanguard-huawei/POWER.md
-├── vanguard-ionos/POWER.md
 ├── vanguard-istio/POWER.md
 ├── vanguard-java/POWER.md
 ├── vanguard-kotlin/POWER.md
@@ -42,13 +41,11 @@ powers/
 ├── vanguard-nvidia/POWER.md
 ├── vanguard-oci/POWER.md
 ├── vanguard-opentelemetry/POWER.md
-├── vanguard-ovhcloud/POWER.md
 ├── vanguard-php/POWER.md
 ├── vanguard-prometheus/POWER.md
 ├── vanguard-python/POWER.md
 ├── vanguard-salesforce/POWER.md
 ├── vanguard-sap/POWER.md
-├── vanguard-scaleway/POWER.md
 ├── vanguard-sigstore/POWER.md
 ├── vanguard-snowflake/POWER.md
 ├── vanguard-terraform/POWER.md
@@ -89,7 +86,7 @@ cd vanguard-frontier-agentic
 ## How to update
 
 ```bash
-# Regenerate the 45 Powers from catalog/agents.json + per-provider config:
+# Regenerate the 42 Powers from catalog/agents.json + per-provider config:
 npm run kiro-powers:write
 
 # Then verify everything is in sync:

package/powers/vanguard-cilium/POWER.md

@@ -1,13 +1,13 @@
 ---
 name: "vanguard-cilium"
 displayName: "Vanguard Frontier — Cilium"
-description: "Reviews cilium CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy, standard NetworkPolicy, ClusterMesh cross-cluster policy... Static review only; no live mutations."
+description: "Reviews ciliumNetworkPolicy, CiliumClusterwideNetworkPolicy, NetworkPolicy, ClusterMesh cross-cluster policy semantics, and... Static review only; no live mutations."
 keywords: ["cilium", "network-policy", "ebpf", "cluster-mesh"]
 author: "VincentChuWaiChow"
 ---
 # Vanguard Frontier — Cilium
 
-Reviews cilium CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy, standard NetworkPolicy, ClusterMesh cross-cluster policy... Static review only; no live mutations.
+Reviews ciliumNetworkPolicy, CiliumClusterwideNetworkPolicy, NetworkPolicy, ClusterMesh cross-cluster policy semantics, and... Static review only; no live mutations.
 
 ## When to engage this Power
 

package/powers/vanguard-microsoft/POWER.md

@@ -22,8 +22,6 @@ Use the maestro as the entry point: classify the task, then dispatch to one spec
 ## Live-guard agents (gate_mode only)
 
 - `d365-live-record-field-update-guard-agent` — never auto-dispatched; gate_mode only
-- `d365-live-security-role-guard-agent` — never auto-dispatched; gate_mode only
-- `m365-live-identity-posture-guard-agent` — never auto-dispatched; gate_mode only
 - `m365-live-sensitivity-label-apply-guard-agent` — never auto-dispatched; gate_mode only
 
 Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.

package/powers/vanguard-snowflake/POWER.md

@@ -1,40 +1,46 @@
 ---
 name: "vanguard-snowflake"
-displayName: "Vanguard Frontier — Snowflake (Azure)"
-description: "Curated Snowflake-on-Azure agents for RBAC access governance and data-platform engineering — static review only, no account or production mutations. Covers role hierarchy and least privilege, ACCOUNTADMIN restriction, SECURITYADMIN/SYSADMIN separation of duties, future grants and managed-access schemas, network policies, key-pair/Entra OAuth/SSO/SCIM authentication, Azure Private Link and storage integration, and masking/row-access/tagging governance. Snowflake and Azure surfaces are drift-prone; agents always verify against current Snowflake and Microsoft Learn documentation before rendering findings."
-keywords: ["snowflake", "azure", "rbac", "least-privilege", "data-governance", "private-link", "static-review"]
+displayName: "Vanguard Frontier — Snowflake"
+description: "A cloud-neutral Snowflake board routed by snowflake-maestro: architecture and account topology, platform administration, identity and effective access, network and private connectivity, governance and privacy controls, independent compliance evidence, FinOps unit economics, query performance, batch pipelines, streaming ingestion reliability, analytical semantics, ML lifecycle, Cortex AI agent security, Native Apps and Marketplace, BCDR, DevOps/IaC, migration, and business value. Review agents are read-only; six approval-gated live guards each execute exactly one mutation behind an explicit written human gate. Snowflake surfaces are drift-prone — agents re-verify GA/preview status, deprecations, edition/cloud/region availability, and provider resource stability against current Snowflake documentation before rendering findings."
+keywords: ["snowflake", "rbac", "least-privilege", "data-governance", "finops", "cortex-ai", "bcdr", "live-guard"]
 author: "VincentChuWaiChow"
 ---
-# Vanguard Frontier — Snowflake (Azure)
+# Vanguard Frontier — Snowflake
 
-Curated Snowflake-on-Azure agents for RBAC access governance and data-platform engineering — static review only, no account or production mutations. Covers role hierarchy and least privilege, ACCOUNTADMIN restriction, SECURITYADMIN/SYSADMIN separation of duties, future grants and managed-access schemas, network policies, key-pair/Entra OAuth/SSO/SCIM authentication, Azure Private Link and storage integration, and masking/row-access/tagging governance. Snowflake and Azure surfaces are drift-prone; agents always verify against current Snowflake and Microsoft Learn documentation before rendering findings.
+A cloud-neutral Snowflake board routed by snowflake-maestro: architecture and account topology, platform administration, identity and effective access, network and private connectivity, governance and privacy controls, independent compliance evidence, FinOps unit economics, query performance, batch pipelines, streaming ingestion reliability, analytical semantics, ML lifecycle, Cortex AI agent security, Native Apps and Marketplace, BCDR, DevOps/IaC, migration, and business value. Review agents are read-only; six approval-gated live guards each execute exactly one mutation behind an explicit written human gate. Snowflake surfaces are drift-prone — agents re-verify GA/preview status, deprecations, edition/cloud/region availability, and provider resource stability against current Snowflake documentation before rendering findings.
 
 ## When to engage this Power
 
-Activate when the task references Snowflake (Azure) services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
+Activate when the task references Snowflake services, resources, or operations. Do not activate on unrelated requests — narrow keyword matching is required to avoid false activations (Kiro Powers convention).
 
 ## Routing pattern
 
-- *(no maestro for this provider; reference agents directly under `agents/snowflake/`)*
+- **`snowflake-maestro-agent`** — classifies and routes the task to the right specialist
 
-Reference agents directly from agents/snowflake/ without maestro-based routing.
+Use the maestro as the entry point: classify the task, then dispatch to one specialist or a parallel team of specialists. Never have the maestro itself execute a live mutation.
 
 ## Live-guard agents (gate_mode only)
 
+- `snowflake-live-auth-network-policy-guard-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-data-protection-policy-guard-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-failover-promotion-guard-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-pipeline-streaming-change-guard-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-rbac-grant-guard-agent` — never auto-dispatched; gate_mode only
 - `snowflake-live-rbac-grant-guard-at-azure-agent` — never auto-dispatched; gate_mode only
+- `snowflake-live-warehouse-cost-change-guard-agent` — never auto-dispatched; gate_mode only
 
 Live-guard agents enforce approval, target confirmation, evidence capture, and rollback plans before executing a mutation. They are never auto-dispatched — the maestro must place them in `live-guard-gate` or `runtime-evidence-gate` mode.
 
 ## Invariants
 
-- Static review only — agents never request account credentials, key-pair private keys, OAuth secrets, or customer data, and never mutate a Snowflake account or Azure resource.
-- Enforce least privilege: custom business-function roles under SYSADMIN, restrict ACCOUNTADMIN to a minimum of controlled users, never grant sensitive privileges to PUBLIC, separate SECURITYADMIN (grants) from SYSADMIN (objects).
-- Service accounts use key-pair or Entra OAuth (never passwords); enforce network policies and MFA for human users.
-- Production role/grant/policy/warehouse changes are live-guard gated — never auto-dispatched; require explicit approval, scope confirmation, and rollback plan.
+- Review agents are static review only — they never request account credentials, private keys, OAuth or programmatic access tokens, account locators, or customer data, and never mutate a Snowflake account.
+- Documentation proves supported platform behaviour, never configured account behaviour: edition, region, enabled bundles, authentication enforcement, and policy attachment are UNKNOWN until account evidence establishes them.
+- Enforce least privilege: narrow custom roles, ACCOUNTADMIN forbidden for automation without exception, no GRANT ALL PRIVILEGES, no grants to PUBLIC, no unbounded future grants, and no password authentication for non-human identities.
+- Live guards are never auto-dispatched: each executes exactly one mutation after explicit written human approval naming account, environment, target, mutation, and accepted blast radius, with prior-state capture, preflight, verification, and a rollback path.
 
 ## Where the agents live
 
-Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/snowflake/` in that repository. All 3 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
+Agent specs and adapters are part of the [Vanguard Frontier Agentic](https://github.com/VincentChuWaiChow/vanguard-frontier-agentic) marketplace. For this provider, see `agents/snowflake/` in that repository. All 28 agents in this provider ship a Kiro adapter (`harnesses/kiro-ide.agent.md`, `kiro-cli.agent.json`).
 
 ## Companion install paths