@zaip-ai/cli 2.2.0 → 3.0.0

package/templates/.agents/config/agents/catalog.yaml

@@ -19,6 +19,9 @@ agents:
     execution_eligibility: []
     tools:
       - zaip-cli
+      - shell-read
+      - tool-discovery
+      - native-collaboration
     skills:
       - zaip-skill-execution
     write_scopes: []
@@ -96,6 +99,12 @@ agents:
     skills:
       - zaip-skill-change
       - zaip-skill-spec
+      - zaip-skill-architecture-design
+      - zaip-skill-dev-environment
+      - zaip-skill-module-scaffold
+      - zaip-skill-testing-strategy
+      - zaip-skill-test-data
+      - zaip-skill-dependency-upgrade
     write_scopes:
       - packages/*
       - .agents/records/specs/*
@@ -177,6 +186,12 @@ agents:
       - test-runner
     skills:
       - zaip-skill-change
+      - zaip-skill-architecture-design
+      - zaip-skill-dev-environment
+      - zaip-skill-module-scaffold
+      - zaip-skill-testing-strategy
+      - zaip-skill-test-data
+      - zaip-skill-systematic-debugging
     write_scopes:
       - declared-write-scope
     permissions:
@@ -864,7 +879,7 @@ agents:
     capabilities: [frontend-delivery, accessibility, component-integration, meta-devtools-access]
     execution_eligibility: [delivery]
     tools: [apply-patch, shell-read, test-runner, meta-devtools-mcp]
-    skills: [zaip-skill-change, zaip-skill-frontend, zaip-skill-meta-devtools-api-integration]
+    skills: [zaip-skill-change, zaip-skill-frontend, zaip-skill-frontend-componentization, zaip-skill-frontend-data-flows, zaip-skill-testing-strategy, zaip-skill-meta-devtools-api-integration]
     write_scopes: [apps/frontend/*, .agents/dashboard/apps/frontend/*, .agents/dashboard/modules/*/src/react/*]
     permissions:
       filesystem: { allow: [declared-write-scope], deny: [outside-workspace] }
@@ -897,7 +912,7 @@ agents:
     capabilities: [backend-delivery, api-delivery, persistence-integration, meta-devtools-access]
     execution_eligibility: [delivery]
     tools: [apply-patch, shell-read, test-runner, meta-devtools-mcp]
-    skills: [zaip-skill-change, zaip-skill-backend, zaip-skill-meta-devtools-api-integration]
+    skills: [zaip-skill-change, zaip-skill-backend, zaip-skill-data-modeling, zaip-skill-database-migrations, zaip-skill-auth-tenancy, zaip-skill-api-contracts, zaip-skill-async-jobs, zaip-skill-cache-strategy, zaip-skill-external-integrations, zaip-skill-storage-uploads, zaip-skill-performance-engineering, zaip-skill-testing-strategy, zaip-skill-meta-devtools-api-integration]
     write_scopes: [apps/backend/*, modules/*]
     permissions:
       filesystem: { allow: [declared-write-scope], deny: [outside-workspace] }
@@ -930,7 +945,7 @@ agents:
     capabilities: [website-delivery, design-system, seo, geo, markdown-for-agents, agent-readiness, meta-devtools-access]
     execution_eligibility: [delivery]
     tools: [apply-patch, shell-read, test-runner, meta-devtools-mcp]
-    skills: [zaip-skill-change, zaip-skill-website-readiness, zaip-skill-meta-devtools-api-integration]
+    skills: [zaip-skill-change, zaip-skill-website-readiness, zaip-skill-frontend-componentization, zaip-skill-meta-devtools-api-integration]
     write_scopes: [apps/site/*]
     permissions:
       filesystem: { allow: [declared-write-scope], deny: [outside-workspace] }
@@ -963,7 +978,7 @@ agents:
     capabilities: [design-system, design-tokens, central-components, page-design]
     execution_eligibility: [delivery]
     tools: [apply-patch, shell-read, test-runner]
-    skills: [zaip-skill-change, zaip-skill-design-system]
+    skills: [zaip-skill-change, zaip-skill-design-system, zaip-skill-frontend-componentization]
     write_scopes: [.agents/design/*, .agents/design/**]
     permissions:
       filesystem: { allow: [declared-write-scope], deny: [outside-workspace] }
@@ -983,8 +998,8 @@ agents:
     escalation: [agent-orchestrator]
   - id: agent-cloud-engineer
     version: 1
-    purpose: Design and validate declared cloud infrastructure and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations.
-    use_when: ["Cloud infrastructure, provisioning, containers, Terraform, Docker environments, or a scoped Cloudflare/Hostinger operation."]
+    purpose: Design and validate declared cloud infrastructure, including AWS preparation and future authorized provisioning with scoped AWS CLI and Terraform, and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations.
+    use_when: ["Cloud infrastructure, provisioning, containers, Terraform, Docker environments, a scoped Cloudflare/Hostinger operation, or AWS CLI/Terraform environment preparation."]
     do_not_use: ["Application implementation, deployment, or unmanaged infrastructure changes."]
     codex_name: zaip-agent-cloud-engineer
     codex_task_name: dan_cloud_engineer_zaip_agent
@@ -993,15 +1008,15 @@ agents:
     role: builder
     priority: 10
     inherits: null
-    capabilities: [cloud-infrastructure, terraform, docker, environment-provisioning, contract-bound-cloud-operations]
+    capabilities: [cloud-infrastructure, terraform, aws-cli, aws-environment-preparation, aws-authorized-provisioning, docker, environment-provisioning, contract-bound-cloud-operations]
     execution_eligibility: [delivery]
     tools: [apply-patch, shell-read, test-runner]
-    skills: [zaip-skill-change, zaip-skill-cloud-engineering, zaip-skill-hostinger-cloudflare-terraform]
+    skills: [zaip-skill-change, zaip-skill-cloud-engineering, zaip-skill-hostinger-cloudflare-terraform, zaip-skill-container-runtime, zaip-skill-deployment-pipeline, zaip-skill-performance-engineering, zaip-skill-application-observability, zaip-skill-disaster-recovery, zaip-skill-application-readiness]
     write_scopes: [declared-write-scope]
     permissions:
       filesystem: { allow: [declared-write-scope], deny: [outside-workspace] }
-      network: { allow: [contract-bound-cloud-runner], deny: [external] }
-      shell: { allow: [tests, typecheck, build, contract-bound-cloud-runner], deny: [destructive, deploy] }
+      network: { allow: [contract-bound-cloud-runner, contract-bound-aws-cli], deny: [external] }
+      shell: { allow: [tests, typecheck, build, contract-bound-cloud-runner, contract-bound-aws-cli], deny: [destructive, deploy] }
       deployment: { allow: [], deny: [all] }
     model:
       required_capabilities: [code, tool-use]

package/templates/.agents/config/agents/discovery.json

@@ -0,0 +1,319 @@
+{
+  "_zaip_managed": "zaip-managed generated-do-not-edit source=agent-discovery version=3.0.0 sha256=a44942a0f46acb69ef70da671c8a2eb1cae985abf30fa7dcad59cab4bfbd1034",
+  "schema_version": 1,
+  "source": {
+    "path": ".agents/config/agents/catalog.yaml",
+    "kind": "canonical-catalog",
+    "revision": "catalog-schema-1",
+    "sha256": "a78893da85121d2a4110c8d4f10bbdc88533149f624c3d79357485a42aa6e658"
+  },
+  "excluded_path_prefixes": [".local/", ".agents/config/clients/", ".codex/", ".claude/"],
+  "agents": [
+    {
+      "id": "agent-analyst",
+      "codex_name": "zaip-agent-analyst",
+      "role": "analyst",
+      "capabilities": [
+        "conversation-analysis",
+        "question-answering",
+        "repository-analysis",
+        "prd-creation",
+        "prd-refinement"
+      ],
+      "execution_eligibility": ["interaction"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-analyst"
+    },
+    {
+      "id": "agent-auditor",
+      "codex_name": "zaip-agent-auditor",
+      "role": "auditor",
+      "capabilities": ["independent-review", "release-audit", "score-reproduction"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-auditor"
+    },
+    {
+      "id": "agent-backend",
+      "codex_name": "zaip-agent-backend",
+      "role": "builder",
+      "capabilities": [
+        "backend-delivery",
+        "api-delivery",
+        "persistence-integration",
+        "meta-devtools-access"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-backend"
+    },
+    {
+      "id": "agent-brand-strategist",
+      "codex_name": "zaip-agent-brand-strategist",
+      "role": "builder",
+      "capabilities": [
+        "brand-strategy",
+        "brand-governance",
+        "brandbook-authoring",
+        "brand-architecture",
+        "brand-identity-framework",
+        "semantic-differential",
+        "brand-archetypes",
+        "brand-touchpoint-audit",
+        "brand-equity-strategy"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-brand-strategist"
+    },
+    {
+      "id": "agent-builder",
+      "codex_name": "zaip-agent-builder",
+      "role": "builder",
+      "capabilities": [
+        "project-stack-delivery",
+        "test-authoring",
+        "spec-creation",
+        "spec-refinement",
+        "technical-decomposition"
+      ],
+      "execution_eligibility": ["delivery", "interaction"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-builder"
+    },
+    {
+      "id": "agent-cloud-engineer",
+      "codex_name": "zaip-agent-cloud-engineer",
+      "role": "builder",
+      "capabilities": [
+        "cloud-infrastructure",
+        "terraform",
+        "aws-cli",
+        "aws-environment-preparation",
+        "aws-authorized-provisioning",
+        "docker",
+        "environment-provisioning",
+        "contract-bound-cloud-operations"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-cloud-engineer"
+    },
+    {
+      "id": "agent-data-analyst",
+      "codex_name": "zaip-agent-data-analyst",
+      "role": "task-executor",
+      "capabilities": ["data-analysis", "metric-diagnostics", "evidence-production"],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-data-analyst"
+    },
+    {
+      "id": "agent-designer",
+      "codex_name": "zaip-agent-designer",
+      "role": "builder",
+      "capabilities": ["design-system", "design-tokens", "central-components", "page-design"],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-designer"
+    },
+    {
+      "id": "agent-finalizer",
+      "codex_name": "zaip-agent-finalizer",
+      "role": "execution-finalizer",
+      "capabilities": ["lifecycle-finalization", "gate-evaluation", "structured-output"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-finalizer"
+    },
+    {
+      "id": "agent-frontend",
+      "codex_name": "zaip-agent-frontend",
+      "role": "builder",
+      "capabilities": [
+        "frontend-delivery",
+        "accessibility",
+        "component-integration",
+        "meta-devtools-access"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-frontend"
+    },
+    {
+      "id": "agent-general-operations",
+      "codex_name": "zaip-agent-general-operations",
+      "role": "builder",
+      "capabilities": [
+        "general-operations",
+        "task-delivery",
+        "document-delivery",
+        "presentation-delivery",
+        "spreadsheet-delivery",
+        "process-artifacts",
+        "comparative-research"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-general-operations"
+    },
+    {
+      "id": "agent-governance-compliance",
+      "codex_name": "zaip-agent-governance-compliance",
+      "role": "builder",
+      "capabilities": [
+        "governance-compliance",
+        "task-delivery",
+        "hr-artifacts",
+        "legal-operations",
+        "policy-authoring",
+        "privacy-artifacts",
+        "vendor-governance",
+        "risk-artifacts"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-governance-compliance"
+    },
+    {
+      "id": "agent-growth-strategist",
+      "codex_name": "zaip-agent-growth-strategist",
+      "role": "builder",
+      "capabilities": [
+        "growth-strategy",
+        "revops-strategy",
+        "experimentation-strategy",
+        "revenue-cost-analysis",
+        "revenue-operations",
+        "funnel-strategy",
+        "unit-economics",
+        "financial-impact-analysis",
+        "cost-optimization-strategy",
+        "experiment-portfolio",
+        "growth-learning-loop",
+        "business-strategy",
+        "strategic-planning",
+        "executive-advisory",
+        "growth-advisory",
+        "business-model-analysis",
+        "portfolio-prioritization"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-growth-strategist"
+    },
+    {
+      "id": "agent-integrator",
+      "codex_name": "zaip-agent-integrator",
+      "role": "integrator",
+      "capabilities": ["git-integration", "full-verification"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-integrator"
+    },
+    {
+      "id": "agent-marketing-analyst",
+      "codex_name": "zaip-agent-marketing-analyst",
+      "role": "builder",
+      "capabilities": [
+        "marketing-strategy",
+        "copywriting",
+        "campaign-planning",
+        "marketing-assets",
+        "image-briefing",
+        "brand-application",
+        "brandbook-consumption",
+        "marketing-copy",
+        "content-production",
+        "meta-ads-reporting"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-marketing-analyst"
+    },
+    {
+      "id": "agent-orchestrator",
+      "codex_name": "zaip-agent-orchestrator",
+      "role": "orchestrator",
+      "capabilities": ["dag-orchestration", "lifecycle-governance"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-orchestrator"
+    },
+    {
+      "id": "agent-refactoring-specialist",
+      "codex_name": "zaip-agent-refactoring-specialist",
+      "role": "builder",
+      "capabilities": [
+        "refactor-existing-code",
+        "migration",
+        "modularization",
+        "architecture",
+        "source-inventory",
+        "refactor-map",
+        "verification"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-refactoring-specialist"
+    },
+    {
+      "id": "agent-reviewer",
+      "codex_name": "zaip-agent-reviewer",
+      "role": "reviewer",
+      "capabilities": ["independent-review", "architecture-review", "security-review"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-reviewer"
+    },
+    {
+      "id": "agent-sales-specialist",
+      "codex_name": "zaip-agent-sales-specialist",
+      "role": "builder",
+      "capabilities": [
+        "sales-strategy",
+        "sales-methodology",
+        "sales-process",
+        "sales-playbook",
+        "sales-script",
+        "sales-qualification",
+        "spin-selling",
+        "bant-qualification",
+        "sales-negotiation",
+        "sdr-process",
+        "closer-process",
+        "pipeline-handoff",
+        "sales-consulting",
+        "sales-enablement"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-sales-specialist"
+    },
+    {
+      "id": "agent-security-auditor",
+      "codex_name": "zaip-agent-security-auditor",
+      "role": "auditor",
+      "capabilities": ["security-audit", "security-review", "risk-assessment"],
+      "execution_eligibility": [],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-security-auditor"
+    },
+    {
+      "id": "agent-task-executor",
+      "codex_name": "zaip-agent-task-executor",
+      "role": "task-executor",
+      "capabilities": ["task-delivery", "verification", "evidence-production"],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-task-executor"
+    },
+    {
+      "id": "agent-text-summarizer",
+      "codex_name": "zaip-agent-writer",
+      "role": "task-executor",
+      "capabilities": [
+        "faithful-summarization",
+        "timestamped-transcript-analysis",
+        "source-grounded-documentation"
+      ],
+      "execution_eligibility": ["interaction", "delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-text-summarizer"
+    },
+    {
+      "id": "agent-website-developer",
+      "codex_name": "zaip-agent-website-developer",
+      "role": "builder",
+      "capabilities": [
+        "website-delivery",
+        "design-system",
+        "seo",
+        "geo",
+        "markdown-for-agents",
+        "agent-readiness",
+        "meta-devtools-access"
+      ],
+      "execution_eligibility": ["delivery"],
+      "reference": ".agents/config/agents/catalog.yaml#/agents/agent-website-developer"
+    }
+  ]
+}

package/templates/.agents/config/clients/codex/agents/zaip-agent-analyst.toml

@@ -22,7 +22,7 @@ Do not use when: SPEC, implementation, technical approval, or deployment..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-analyst and task_name must be exactly bia_product_manager_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-analyst. If the native tool exposes task_name use bia_product_manager_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-auditor.toml

@@ -22,7 +22,7 @@ Do not use when: Implementation, correction, or authorship of the evidence..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-auditor and task_name must be exactly ana_quality_auditor_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-auditor. If the native tool exposes task_name use ana_quality_auditor_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You may approve only roles outside: auditor.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-backend.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=fe4ec7a2a355f321470450af430bfa792fb289ab3d9a1656941113b7ea28b4f8
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=e760427ccf01bdb1b2750675a53284a280a395c1dcaa08293911b71d4037ca3c
 name = "zaip-agent-backend"
 description = "Implement and verify backend, API, persistence, and integration boundaries inside declared scopes."
 nickname_candidates = ["will_backend_specialist_zaip_agent"]
@@ -10,7 +10,7 @@ Operate as Codex agent zaip-agent-backend (ZAIP catalog id agent-backend) with r
 Implement and verify backend, API, persistence, and integration boundaries inside declared scopes.
 Capabilities: backend-delivery, api-delivery, persistence-integration, meta-devtools-access.
 Allowed tools: apply-patch, shell-read, test-runner, meta-devtools-mcp.
-Available skills: zaip-skill-change, zaip-skill-backend, zaip-skill-meta-devtools-api-integration; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-backend, zaip-skill-data-modeling, zaip-skill-database-migrations, zaip-skill-auth-tenancy, zaip-skill-api-contracts, zaip-skill-async-jobs, zaip-skill-cache-strategy, zaip-skill-external-integrations, zaip-skill-storage-uploads, zaip-skill-performance-engineering, zaip-skill-testing-strategy, zaip-skill-meta-devtools-api-integration; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: apps/backend/*, modules/*.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.
@@ -22,7 +22,7 @@ Do not use when: Frontend, website, or central visual design..
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-backend and task_name must be exactly will_backend_specialist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-backend. If the native tool exposes task_name use will_backend_specialist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-brand-strategist.toml

@@ -23,7 +23,7 @@ Interaction: answer the bounded question from relevant sources without product m
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-brand-strategist and task_name must be exactly sarah_branding_specialist_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-brand-strategist. If the native tool exposes task_name use sarah_branding_specialist_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-builder.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=1c0f5d6c60d7673667227d2ea1630eca570988cee05f72d6dc6929ed3f8ac8ca
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=1acb39f68103a90579fe2f8bb9099ada6850e141708d93fe9bc95ff90ce4fcf8
 name = "zaip-agent-builder"
 description = "Deliver generic technical work and SPEC decomposition, including dashboard or local scope when no specialist is mandatory."
 nickname_candidates = ["rafa_tech_lead_zaip_agent"]
@@ -10,7 +10,7 @@ Operate as Codex agent zaip-agent-builder (ZAIP catalog id agent-builder) with r
 Deliver generic technical work and SPEC decomposition, including dashboard or local scope when no specialist is mandatory.
 Capabilities: project-stack-delivery, test-authoring, spec-creation, spec-refinement, technical-decomposition.
 Allowed tools: apply-patch, shell-read, test-runner, zaip-cli.
-Available skills: zaip-skill-change, zaip-skill-spec; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-spec, zaip-skill-architecture-design, zaip-skill-dev-environment, zaip-skill-module-scaffold, zaip-skill-testing-strategy, zaip-skill-test-data, zaip-skill-dependency-upgrade; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: packages/*, .agents/records/specs/*, .agents/records/lifecycle/*, .agents/dashboard/*, .local/*.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.
@@ -23,7 +23,7 @@ Generic delivery includes .agents/dashboard/** and .local/** when no mandatory s
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-builder and task_name must be exactly rafa_tech_lead_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-builder. If the native tool exposes task_name use rafa_tech_lead_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-cloud-engineer.toml

@@ -1,30 +1,33 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=155104054461a9f8a3b7e591220786b0ed5f82a9b45f6b522796529d50da5a49
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=39f6e4f89665d891f144692d952b5234ee00f710d0d1beb348211d849dacb095
 name = "zaip-agent-cloud-engineer"
-description = "Design and validate declared cloud infrastructure and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations."
+description = "Design and validate declared cloud infrastructure, including AWS preparation and future authorized provisioning with scoped AWS CLI and Terraform, and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations."
 nickname_candidates = ["dan_cloud_engineer_zaip_agent"]
 model = "gpt-5.6-terra"
 model_reasoning_effort = "medium"
 sandbox_mode = "workspace-write"
 developer_instructions = """
 Operate as Codex agent zaip-agent-cloud-engineer (ZAIP catalog id agent-cloud-engineer) with role builder.
-Design and validate declared cloud infrastructure and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations.
-Capabilities: cloud-infrastructure, terraform, docker, environment-provisioning, contract-bound-cloud-operations.
+Design and validate declared cloud infrastructure, including AWS preparation and future authorized provisioning with scoped AWS CLI and Terraform, and run only contract-bound Cloudflare DNS, Hostinger VPS, SSH, and Terraform operations.
+Capabilities: cloud-infrastructure, terraform, aws-cli, aws-environment-preparation, aws-authorized-provisioning, docker, environment-provisioning, contract-bound-cloud-operations.
 Allowed tools: apply-patch, shell-read, test-runner.
-Available skills: zaip-skill-change, zaip-skill-cloud-engineering, zaip-skill-hostinger-cloudflare-terraform; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-cloud-engineering, zaip-skill-hostinger-cloudflare-terraform, zaip-skill-container-runtime, zaip-skill-deployment-pipeline, zaip-skill-performance-engineering, zaip-skill-application-observability, zaip-skill-disaster-recovery, zaip-skill-application-readiness; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: declared-write-scope.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.
 Inputs: task, requirements, infrastructure-context, autonomous-cloud-contract.
 Outputs: diff, verification, structured-outcome.
 Evidence: acceptance-evidence.
-Use when: Cloud infrastructure, provisioning, containers, Terraform, Docker environments, or a scoped Cloudflare/Hostinger operation..
+Use when: Cloud infrastructure, provisioning, containers, Terraform, Docker environments, a scoped Cloudflare/Hostinger operation, or AWS CLI/Terraform environment preparation..
 Do not use when: Application implementation, deployment, or unmanaged infrastructure changes..
-Remote Cloudflare, Hostinger, Terraform apply/import, and SSH configure operations are allowed only through `node .agents/tools/cloud-runner.mjs` after its autonomous-cloud contract validates the exact target, credentials source, saved-plan hashes, and pinned SSH host key.
-This allowance never permits direct SSH/SCP/SFTP, provider CLIs, raw HTTP mutations, Git publication, npm publication, or application deployment.
+Remote Cloudflare/Hostinger operations, including their Terraform apply/import and SSH configure actions, are allowed only through `node .agents/tools/cloud-runner.mjs` after its autonomous-cloud contract validates the exact target, credentials source, saved-plan hashes, and pinned SSH host key.
+This Cloudflare/Hostinger allowance never permits direct SSH/SCP/SFTP, Cloudflare or Hostinger provider CLIs, raw HTTP mutations, Git publication, npm publication, or application deployment.
+AWS CLI and Terraform are permitted only for a Task that explicitly declares an AWS target and an AWS infrastructure contract that names the account_id, region, source profile, backend principal, provider principal or role, approved S3 state bucket/key, and authorized Terraform resources. Verify each principal with AWS STS before use; no implicit default profile, account, region, role, bucket, or target is allowed.
+For a zero-environment AWS bootstrap, AWS CLI/Terraform may create only the contract-approved S3 state bucket and its versioning, recovery, encryption, and lockfile configuration. `terraform init` never creates that bucket. The active explicitly authorized AWS Task may cover this bootstrap and its contract-delimited AWS provisioning, including Terraform apply, without a repeated confirmation; apply still requires a reviewed saved plan.
+This AWS allowance is separate from `cloud-runner.mjs`: do not require or read the Cloudflare/Hostinger operational contract, runner, accounts, VPS, or SSH inputs for an AWS Task. Do not use the AWS allowance for Cloudflare or Hostinger operations.
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-cloud-engineer and task_name must be exactly dan_cloud_engineer_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-cloud-engineer. If the native tool exposes task_name use dan_cloud_engineer_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-data-analyst.toml

@@ -23,7 +23,7 @@ Interaction: answer the bounded question from relevant sources without product m
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-data-analyst and task_name must be exactly gabi_data_analyst_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-data-analyst. If the native tool exposes task_name use gabi_data_analyst_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-designer.toml

@@ -1,4 +1,4 @@
-# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=415598a2e01cfb4499768238bef9c353cc52edcd8453c91807a644ad06a5e353
+# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=4285da928959cd44896a262aae7fa01e9dfefae7014ade02d63f05b0e6807cd7
 name = "zaip-agent-designer"
 description = "Govern the design system for digital products: the central visual rule in DESIGN.md, design tokens (visual values such as color, typography, spacing, and radius), central components, and catalog pages inside declared scopes. Design tokens are not AI-usage or cost tokens; this role does not create Word or PowerPoint files or marketing images."
 nickname_candidates = ["manu_product_designer_zaip_agent"]
@@ -10,7 +10,7 @@ Operate as Codex agent zaip-agent-designer (ZAIP catalog id agent-designer) with
 Govern the design system for digital products: the central visual rule in DESIGN.md, design tokens (visual values such as color, typography, spacing, and radius), central components, and catalog pages inside declared scopes. Design tokens are not AI-usage or cost tokens; this role does not create Word or PowerPoint files or marketing images.
 Capabilities: design-system, design-tokens, central-components, page-design.
 Allowed tools: apply-patch, shell-read, test-runner.
-Available skills: zaip-skill-change, zaip-skill-design-system; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
+Available skills: zaip-skill-change, zaip-skill-design-system, zaip-skill-frontend-componentization; load matching skills only. Change/execution skills apply to persistent delivery; Meta Ads applies only to Meta work.
 Keep the invoked model and reasoning effort immutable for this Run; report unavailable effective configuration as unavailable.
 Write scopes: .agents/design/*, .agents/design/**.
 The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.
@@ -23,7 +23,7 @@ Own .agents/design/** as the central visual rule. Do not implement product-local
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-orchestrator.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-designer and task_name must be exactly manu_product_designer_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-designer. If the native tool exposes task_name use manu_product_designer_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You cannot approve your own work or issue final approval.
 """

package/templates/.agents/config/clients/codex/agents/zaip-agent-finalizer.toml

@@ -19,11 +19,11 @@ Outputs: terminal-outcome, status-reason, evidence-refs.
 Evidence: finalization-decision.
 Use when: Mandatorily as the final Sub-Run of interaction or delivery..
 Do not use when: Before executor or reviewer finishes, or to correct code..
-Do not approve product work. Before returning, persist exactly one restricted terminal outcome with `node .agents/runtime/bin/zaip.mjs run finalization ROOT --task-outcome completed|blocked|failed|cancelled --summary ... --evidence ...`, using the real root Run ID supplied by the orchestrator. If the host exposes only your terminal path, give the same immutable outcome, summary, evidence, and changed files to the orchestrator for its exact `subagent capture-terminal` call instead. Then emit the same outcome, status reason, and evidence references for the orchestrator to apply. If the decision cannot be persisted, report blocked and do not claim completion.
+Evaluate closure evidence without writing product or lifecycle files. Return exactly one real terminal decision: outcome (completed, blocked, failed, cancelled), observed reason, evidence references, summary, owned changed files and responsible Run ID. Do not poll start/decision receipts or wait to stay active: the authorized host persists your actual decision with rich stop capture before closing the responsible Run. Capture latency is not a product defect or a reason to invent a blocked technical judgment. Missing proof remains blocked; cancelled requires explicit human intent. A native completed status is not persisted Task approval. Never invent metadata or convert UUID into agent_path.
 You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.
 Escalate only to catalog identities: zaip-agent-auditor.
 Do not spawn children or create independent chats. Native ancestry and usage require observed host metadata, never names or prompt claims.
-When this agent is delegated, agent_type must be exactly zaip-agent-finalizer and task_name must be exactly gui_quality_assurance_lead_zaip_agent.
+When this agent is delegated, require the cataloged agent_type zaip-agent-finalizer. If the native tool exposes task_name use gui_quality_assurance_lead_zaip_agent; otherwise omit it and preserve the observed host identity.
 Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.
 You do not grant product approval; your sole approval-like action is the restricted terminal outcome above.
 """