🛡️ v3.8.0 — Provenance · Policy · Portability

🛡️ v3.8.0 — Provenance · Policy · Portability

Released 2026-08-15

Curated multi-cloud, zero-trust agent marketplace — AWS · Azure · OCI · GCP · Terraform.
Least privilege, live evidence, safe rollback paths.

Release type: New capabilities — review the sections below before upgrading.

• typescript: ship the TypeScript program and package board (18b627c)
  Builds the 14-agent TypeScript board designed in
  .claude/workflow/typescript-board/: a maestro router plus 13 static-review
  specialists, each with a companion skill and lazy-loaded references, rendered
  from scripts/typescript_data/agents/*.json by a new data-driven generator.

The board's unit of analysis is the TypeScript program and the published
package — compiler configuration, module resolution and emit, the declaration
surface, program-graph cost, Node execution, and the runtime boundaries that
type erasure leaves undefended. It is deliberately not a second frontend board:
the split with agents/frontend/ is drawn on artifact scope (application diff
vs shared/published program) and written into both boards' refusal lists.

Every agent is static-review only. All 14 copilot adapters grant read/search
alone, no SKILL.md carries a bash fence, and all 13 specialists close their
operating rules with "Static review only: never compile, build, run, deploy,
sign, publish, or contact a live system — route any such request to the named
human owner."

Two plan decisions were proved wrong during implementation and are corrected
in place in the design record rather than quietly rewritten:

• The maestro skill ships a references/routing-taxonomy.md (kotlin's shape),
  not an inline routing table (java's). The boundary rules separating thirteen
  domains are what a lazy-load reference is for, and keeping them out of
  SKILL.md holds it to 58 lines against the 90-line limit.
• The routing taxonomy ships no live_guard_intent. The plan's rule — the
  gate regex may hold destructive verbs but never a domain noun — was right and
  incomplete: the default's bare verbs are this board's own vocabulary.
  delete is a TypeScript operator, so a type-soundness question black-holed
  to an empty route. Anchoring the verbs to operational objects only moves the
  black hole onto "review the workflow that runs npm publish". The gate exists
  to stop auto-dispatch to a live-mutating agent and this board registers none,
  so it is omitted, as hr/legal/netsuite already omit it.

Generator changes, both scoped to their designed extension points:

• GATE_INTENT is now actually consulted per provider — its own comment
  promised an override but build_taxonomy() read ["default"] unconditionally,
  so no override could ever have taken effect. Key order is preserved for every
  other provider.
• and and never join STOPWORDS. The IDF filter cannot catch them (too few
  domains to cross the 25% threshold) yet they appear in nearly every real task,
  handing a free point to whichever domains carry them. Also removes two
  meaningless Never keywords from microsoft's taxonomy.

Also fixes agents/frontend/browser-compatibility-agent/metadata.json, whose
harnesses listed the invalid kiro-cli/kiro-ide split instead of kiro,
and drops ROADMAP's hardcoded catalog counts in favour of a pointer to the
generated docs/_data/catalog.yml.

Gates: npm run validate, lint:spell, markdownlint (7670 files), the routing
grader (751 scenarios across 32 maestros), and cargo fmt/clippy/test
(1053 tests) all green.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session:

• docs: generate the provider-reference table and repair stale provider listings (8c6566b)
  An audit of every count and provider listing in the repo, prompted by the new
  TypeScript board. The counts were all correct — readme-counts was green and
  re-running the generators produced a zero diff. The listings were not.

The provider-reference table in README.md is now generated, not hand-written.
It had drifted badly while nobody was watching: 27 of 45 providers, kubernetes
understated as 15, multi-cloud as 1, and a velero row claiming one agent for
a provider that has skills but no agents at all. Its counts summed to 334
against a real 680. scripts/generate-readme-counts.mjs now emits it between
provider-table:* markers, using the same marker contract the counts block
already used, sorted by agent count then slug for a stable diff.

validate:readme-counts now also runs the generator in --check mode, so this
class of drift fails CI instead of accumulating. The gate's own logic is not
duplicated — it shells out to the generator. Probed both ways: an injected wrong
count exits 1 naming the line, a clean tree exits 0.

Provider display labels live in the generator with a title-cased fallback, so
adding a provider never breaks the build. CLAUDE.md already lists eight places a
new provider must be registered; this is deliberately not a ninth.

Other listings repaired:

• README's opening paragraph named every language board except TypeScript.
• The --provider CLI flag row listed 19 of 45 values and included finops,
  which is not in the provider enum at all — --provider finops would be
  rejected. It now points at vfa-export-agents --list-providers, verified to
  exist and to print all 45 including typescript 14 agent(s).
• CONTRIBUTING.md pinned a 13-value provider list against a 48-value enum. It
  now points at the enum in schemas/skill.schema.json as the contract.
• The ## Agents table understated kubernetes as 15. Its FinOps, QA, and
  cross-functional rows are hand-curated aggregates with no provider slug and
  were deliberately left alone.
• docs/roadmap.md hardcoded the MCP-reference count in prose while the same
  file already used the Liquid variable two dozen lines above.

Verified unchanged and correct: the provider invariant holds exactly
(taxonomy.md bullets == catalog.yml provider_list == providers with >=1 agent,
45 each, typescript in all three), and velero is correctly absent from all
three since it is skill-only.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session:

• typescript: address five Codex review findings on the TypeScript board (44909d8)
  All five reproduced against the tree before being fixed; each fix carries a
  positive and a negative probe.

P1 — the documented regeneration path corrupted unrelated providers.
scripts/update-catalog-new-agents.py gains --provider <id> (repeatable), and
every board generator now documents the scoped invocation. Unscoped, the upsert
walks every provider and its merge is {**catalog_entry, **projected_metadata}
— projected keys win, which is wrong whenever metadata.json is the older
side. It is here: the ionos, ovhcloud, and scaleway agents each declare two
harnesses in metadata while all seven adapter files sit beside them on disk, so
an unscoped run silently rewrote 18 catalog entries from the stale side and
dropped three providers out of the Kiro Powers set. No gate caught it. The
unscoped path still exists for deliberate reconciliation but now prints a
warning naming the hazard. Probed both ways: scoped run is a clean no-op;
unscoped run still reproduces the harness downgrade.

The same trap was documented in four sibling generators (kotlin, netsuite,
python, python-live); all four now document the scoped command too. Docstring
only, no behaviour change.

P2 — declared routing vocabulary was dead data. Each specialist's data file
declared routing_keywords (118 terms across the board) that no generator ever
read, so the taxonomy was mined from agent ids and summaries alone. Mining
recovers what an agent is called, never the constructs it owns, and the gap
showed: Is satisfies safer than an annotation here? and a floating-promise /
cancellation review both returned unclassified, and "our package exports and
types conditions are wrong for ESM consumers" routed to publication-integrity
because the mined token package outweighed every resolution signal.

build_taxonomy() now reads routing_keywords from each agent's
metadata.json and ranks it ahead of the mined tokens; agents that declare none
behave exactly as before. Read from disk rather than the catalog on purpose —
the catalog projection carries a fixed key allowlist, so this vocabulary never
reaches catalog/agents.json and the TUI's deny_unknown_fields structs are
untouched. Verified: zero occurrences of the field in the catalog, and all four
of the reviewer's examples now reach the right specialist.

P2 — a release date became a routing signal. The miner's \w+-\w+ arm
matched the MCP protocol revision quoted in a summary, and because keywords
containing a non-word character match as substrings, 2026-07 then captured any
task mentioning that year-month: "Assess our TypeScript 7.0 migration planned
for 2026-07" routed to the MCP specialist. Date-shaped tokens are now filtered
out of mined keywords, and validate-maestro-routing.py rejects a date-shaped
keyword in any provider's committed taxonomy so one cannot re-enter by hand.
Only typescript was affected across all 32 maestros. Probed both ways: clean
tree passes 751 scenarios; an injected 2026-07 fails with the intended message
and exit 1.

P2 — the Kiro Power activated on generic prompts. The board took the
generator's derived fallback, which produced configuration-audit and
best-practices as activation keywords — enough for a database or Terraform
review with no TypeScript signal to pull in the TypeScript Power — plus a
truncated ...

🛡️ v3.7.0 — Provenance · Policy · Portability

🛡️ v3.7.0 — Provenance · Policy · Portability

Released 2026-08-13

Curated multi-cloud, zero-trust agent marketplace — AWS · Azure · OCI · GCP · Terraform.
Least privilege, live evidence, safe rollback paths.

Release type: New capabilities — review the sections below before upgrading.

• schemas: register the typescript provider across all code registration points (2ff7461)
  Phase 0 of .claude/workflow/typescript-board/06, steps 0.1-0.5. Registers the
  provider value only; no TypeScript agent or skill asset is added.

• schemas/agent.schema.json, schemas/skill.schema.json: add "typescript" to the
  provider enums.
• tests/validate-catalog.py: add "typescript" to ALLOWED_PROVIDERS (a separate
  hardcoded set from the schemas).
• scripts/generate-docs-data.mjs: add typescript to the Developer Platforms
  taxonomy row. The generator filters on providerCounts[p] > 0, so it emits
  nothing until the first agent lands.
• tools/vfa-tui/src/models/provider.rs: add the Typescript variant. The TUI
  deserializes the catalog with a strict enum, so a missing variant breaks
  cargo test once an asset exists.
• tools/vfa-tui/src/federation/coverage.rs: add the "typescript" arm to
  infer_provider, plus a path-mapping test. This is the half that fails
  SILENTLY — the _ => Provider::Generic fallback would group the whole board
  under Generic with every gate green. The test is the only thing that catches
  it, which is why it ships with the arm.

Also regenerates docs/_data/catalog.yml, which was stale on version
(3.6.0 -> 3.6.1) from the last release, and refreshes the asset-integrity
manifest for the touched trees.

Deliberately NOT included: the hand-written provider lists in docs/taxonomy.md
and docs/language-stack-boards.md, and the README board table. provider_list in
docs/_data/catalog.yml is derived from agent metadata
(scripts/generate-docs-data.mjs:27), so adding a bullet while zero TypeScript
agents exist would break CLAUDE.md's provider invariant — and nothing
machine-checks that equality, so the drift would be silent. Those land with the
first agent.

Verified: npm run validate exit 0; codespell clean; markdownlint clean across
7525 files; cargo fmt --check, cargo clippy --all-targets -- -D warnings, and
cargo test (777 unit + 276 integration/property) all pass on rustc 1.97.1.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session:

• workflow: correct eight findings from the second Codex review (e1287d4)
  All eight verified against the repo before fixing. Three were P1.

• Catalog upsert was missing from the generator chain. npm run manifest:write
  rebuilds skill-manifest.json from entries ALREADY in catalog/skills.json; it
  never adds an agent or skill to catalog/agents.json or skills.json. The upsert
  path is scripts/update-catalog-new-agents.py, which is not an npm script and
  appears in no contributor doc. Without it the fixture generator prints
  "SKIP typescript (no agents in catalog)" and every downstream generator omits
  the board — with npm run validate still green, because an empty catalog has
  nothing to fail on. Added as the first step in 06 §6 and 04 §5.5.
• The provider-invariant window was moved, not closed. Deferring the docs to
  Phase 10 while Phase 7 lands all 13 agents leaves the invariant false for three
  phases. The invariant breaks in both directions; docs now land in the same
  commit as the first agent (Phase 7), atomically.
• WebFetch removed from all three skills that had it. docs/execution-tiers.md:15
  defines T0 static-review as "No network egress", and 05 §3 is this plan's own
  rule that a skill's grant must agree with its agent's tier. Writing that rule
  and breaking it in the next table is worse than not having it. Version
  sensitivity stays in committed official-sources.md references and the operator
  -side Context7 protocol.
• Taxonomy domain keys did not match the generator. build_taxonomy() derives each
  key from the agent id minus the typescript- prefix and -agent suffix, so
  "runtime-boundary" is really "runtime-boundary-contract", and so on for 11 of
  13. Template G and the anchors table now carry the derived keys; the short
  names elsewhere are labelled as shorthand.
• Template F was 110 lines with no lazy-load marker, violating two board rules it
  is supposed to demonstrate. Trimmed to 89 lines, and 05 §1 now exempts
  reference-free router skills from the marker (a marker indexing an empty set
  advertises material that does not exist).
• 04 §5's layout block still labelled taxonomy.json "authored (SOURCE)" after the
  earlier fix corrected the procedure; now marked GENERATED.
• README executive verdict still said the provider was unregistered, contradicting
  the landed commit and its own status banner.
• Phase 10 deliverables now name the README board table and the hand-written
  Powers table in docs/integrations/installation-guide.md; neither is produced by
  readme-counts:write or kiro-powers:write.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session:

• workflow: correct four defective instructions in the TypeScript board plan (9a20abc)
  Automated review found seven issues; all seven verified against the repo and
  fixed. Four were defects in load-bearing instructions an implementer would have
  executed verbatim.

• taxonomy.json is GENERATED, not authored. _generate_maestro_routing_fixtures.py:308
  overwrites it on every run, so the old procedure ("author it, then run the
  generator") destroyed the artifact it had just created — and the regenerated
  expected/ files kept the gate green over the loss. Keywords are now driven
  through agent summaries (making summary wording a routing input); durable
  curation requires a generator change in its own commit.
• live_guard_intent must contain destructive verbs only, never a domain noun.
  The old regex carried publish|migrate|backfill, which are anchors for three
  domains on this board; validate-maestro-routing.py:100 returns an empty route
  before domain scoring when live_guards is empty, so those three specialists
  were unreachable. Now uses the generator's own default, as java and php do.
• The hand-written docs provider lists move out of Phase 0 into Phase 10.
  generate-docs-data.mjs:27 derives provider_list from agent metadata, so a
  taxonomy.md bullet added at the zero-asset exit criterion made CLAUDE.md's
  provider invariant false by construction.
• Phase 0 step 0.4 is two Rust edits: the provider.rs enum plus the
  infer_provider arm in federation/coverage.rs, whose _ => Provider::Generic
  fallback silently groups the whole board under Generic with every gate green.
  Step 0.4b now requires a path-mapping test.

Also: the ROADMAP entry no longer hardcodes agent/skill counts; official-sources.md
is permitted in six skills (runtime-boundary's library facts are version-gated),
reconciling the anti-landfill rule with the inventory and template; and the
economics agent's contract now carries all three binding acceptance conditions
including the re-prosecution deadline.

Recorded as findings 14-18 in 07-red-team-and-acceptance-gates.md rather than
fixed quietly, and added to the gate-blind acceptance checklist.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session:

• workflow: add TypeScript board authoring templates (ca2cb69)
  Copy-ready templates for phases 7-9: the maestro and a specialist AGENT.md
  with metadata.json, all seven harness adapters (Copilot tools block, Codex
  sandbox_mode and developer_instructions, the shared Markdown-family body,
  Kiro CLI JSON), a companion SKILL.md under the 90-line board rule with no
  bash fence, one complete reference file, the maestro routing skill with the
  13-row table, the routing taxonomy.json with per-domain anchors and an empty
  live_guards set, the four install-role entries, and a per-file authoring
  checklist. Model and effort keys are deliberately omitted so the policy
  engine writes them.

Completes the plan document set. Repo gates verified green: npm run validate,
codespell, and markdownlint across 7525 files.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session:

• workflow: add TypeScript board prosecution scorecard and board contracts (ce292c7)

• 02: all 19 candidates scored across seven dimensions with the acceptance rule
  (>=26 and Non-overlap >=3) and the disqualifying rule (Non-overlap <=2 fails
  regardless of total). Per-candidate prosecution states the strongest case
  against each agent before any rebuttal. Rejects the five generic agent names
  and gives each accepted agent's single bounded decision.
• 03: the accepted 14 with owns/refuses/hands-off, adversarial hypotheses and
  refusal triggers; the frontend artifact-scope boundary contract; the
  static-review-only tier decision with the five controls a mutating tier would
  cost; the ten-boundary cross-domain handoff matrix; and three concerns the
  board explicitly refuses to claim.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session:

• workflow: add TypeScript board reconnaissance and pain register (d2c215d)
  Start the ultracode workflow plan for a TypeScript agent/skill board under
  .claude/workflow/typescript-board/, following the .claude/workflow/m365-d365
  plan-on...

v0.0.10

Added

• (schemas) register the typescript provider across all code registration points

v0.0.9

Fixed

• (repo) update GitHub owner references to VincentChuWaiChow

Other

• (cargo) bump toml in /tools/vfa-tui in the cargo group

🛡️ v3.6.1 — Provenance · Policy · Portability

🛡️ v3.6.1 — Provenance · Policy · Portability

Released 2026-07-31

Curated multi-cloud, zero-trust agent marketplace — AWS · Azure · OCI · GCP · Terraform.
Least privilege, live evidence, safe rollback paths.

Release type: Maintenance & hardening.

• agents: align Copilot tool grants with declared execution tiers (c25e738)
  Agent tool permissions were not precise: the Copilot adapter is the one place in this
  catalog that carries a per-agent tool grant, and it had drifted in both directions
  relative to the tier each agent declares.

Two opposite failures, both fixed:

• 38 agents declaring static-review or read-only-runtime were granted
  execute/runInTerminal / execute/getTerminalOutput — contradicting the tier's own
  definition in schemas/agent.schema.json ("static-review (no Bash)") and the agents'
  own contracts. Example: d365-finance-close-to-report-agent is static-review and its
  security notes route production changes to live-guards, yet it could run a terminal.
• 95 agents declaring a tier carried no tools: block at all. That is not "no
  permissions" — it inherits every tool the harness offers, an implicit grant strictly
  wider than any tier permits.

Fixed surgically: only the offending execution entries were removed and a
tier-appropriate block inserted where none existed. Tools that merely READ terminal
state (read/terminalLastCommand, read/terminalSelection) are not execution and were
kept. No hand-tuned grant that already satisfied the rules was rewritten; the diff
touches tool lines only.

Result across the 317 tiered agents that ship a Copilot adapter: 261 static-review and
42 read-only-runtime now carry explicit non-executing grants; 6 mutating-runtime keep
execution.

New gate validate:agent-tool-tiers (tests/validate-agent-tool-tiers.py, wired into
npm run validate) makes this permanent, with agent-tool-tiers:write to apply the
minimal fix. Verified with negative probes: adding execute to a static-review agent
fails, and stripping a tools block fails.

Deliberate boundaries, because not every agent needs the same permissions:

• mutating-runtime MAY carry execution tools; the gate permits but does not require
  them. 8 mutating operators mutate through an API rather than a shell and were NOT
  handed a terminal to satisfy a rule — widening a grant needs a per-agent
  justification just as narrowing one does.
• read-only-runtime gets an EXEC_ALLOWLIST for agents whose documented job is to run
  a read-only command (playwright-e2e-execution-run-agent, whose runtime execution is a
  per-session opt-in). Routers and advisors do not qualify: frontend-maestro and
  marketing-maestro classify and dispatch, and finops-cloud-price-advisor fetches public
  pricing over HTTP — none needs a terminal, so all three lost execute.
• Agents that declare no execution_tier (347, mostly the cloud boards) are reported
  but not policed. Assigning those tiers is a per-agent judgement call and a separate
  change; the gate does not guess a tier in order to enforce one.

Docs: documented the tool-grant contract and which harness surfaces actually enforce
posture (Codex sandbox_mode, Copilot tools, SKILL.md allowed-tools) versus which carry
it by contract only (the Markdown-family adapters and kiro-cli, which declare no tools
at all), and made the corresponding claim in language-stack-boards.md precise.

Gates: npm run validate exit 0 (incl. the new gate), codespell and markdownlint clean.
tools/vfa-tui untouched.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• agents: close a parser bypass and stop --write widening grants (7b7b75e)
  Addresses four review findings on the new tool-tier gate. Two were real defects in
  the gate itself — including one that let the exact violation it polices slip through.

Parser bypass (the serious one):

• The tools block was matched with a regex that only consumed a leading run of
  double-quoted entries. A perfectly valid YAML block that then used an unquoted
  scalar had its tail silently ignored, so an agent holding
  - execute/runInTerminal passed the gate with exit 0. Confirmed by probe before
  fixing. Parsing now fails closed: every entry must be the canonical - "tool"
  form, and a block with a comment, an unquoted or single-quoted scalar, or a nested
  map is rejected rather than half-read. Probed all four variants — each now exits 1,
  and a clean tree still exits 0.

--write no longer widens any grant:

• It previously synthesized execute/runInTerminal for a mutating-runtime adapter
  that had no block, which contradicted this PR's own stated policy that a mutating
  operator working through an API must not be handed a shell without per-agent
  justification. The synthesized default is now identical for every tier and contains
  no terminal.
• It also synthesized web/fetch, contradicting the T0 contract in
  docs/execution-tiers.md ("No network egress"). The default is now network-free
  (read, search, search/codebase), and the 91 blocks this branch synthesized were
  realigned to it. Four salesforce agents keep network because their own contracts
  require checking current vendor documentation; the 38 execute-removals on
  pre-existing hand-authored blocks are untouched.

Network egress is reported, not failed. 139 static-review agents still declare a
network tool deliberately — revoking that across the catalog is a contract decision
for those boards, not a side effect of this gate, so the count is surfaced instead.

Not changed: read-only-runtime still refuses terminal tools outside EXEC_ALLOWLIST.
Copilot's execute/runInTerminal is unrestricted and cannot express T1's required
command allowlist, so granting it to a T1 agent violates "never Bash(*)" rather than
satisfying T1. The agent cited in review (python-live-runtime-control-agent) already
carries no execute and passes today — this branch touches no python agent — so no CI
breakage exists; adding a justified T1 executor remains a deliberate, reviewed edit.

Gates: npm run validate exit 0, codespell and markdownlint clean.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• repo: update GitHub owner references to VincentChuWaiChow (e5f8521)
  The account was renamed from Raishin to VincentChuWaiChow, which broke the
  release workflow: @semantic-release/github compares the repositoryUrl it
  derives from package.json against the repo's clone_url and aborted
  verifyConditions with EMISMATCHGITHUBURL (run 30602915639).

Renames every GitHub-owner reference across the tree — package.json
repository/homepage/bugs, CODEOWNERS routing, the plugin/cursor/Kiro manifest
generators and their generated output, Cargo metadata, docs, install commands,
and the author: "github: ..." attribution carried by every agent and skill.
A stale handle is not cosmetic here: CODEOWNERS silently stops requesting
reviews, and a released username can be claimed by someone else.

Deliberately NOT renamed, because they are a different namespace that did not
change with the account:

• the npm scope @raishin/vanguard-frontier-agentic — the published package
  name, the @raishin:registry config, @raishin%2F registry paths, and the
  npm-pack tarball name raishin-vanguard-frontier-agentic-<version>.tgz.
  Renaming these would break publishing and every install instruction.
• CHANGELOG.md and tools/vfa-tui/CHANGELOG.md — generated release history;
  their commit links and co-author trailers are a record of what happened.

Lowercase owner references were rewritten only where anchored to a GitHub
meaning (OIDC repository_owner, npm trusted-publisher owner=, the github.io
Pages URL, the vfa-tui contact address), never by blanket match.

Generated files regenerated and the integrity manifest refreshed last.

• readme: note the owner rename and that the npm name is unchanged (caf24b3)
  The account rename from Raishin to VincentChuWaiChow is visible to anyone
  reading install instructions, and the natural inference — that the npm package
  was renamed too — is wrong. Says so directly next to the existing npm callout:
  GitHub redirects the old URLs, remotes and pinned marketplace sources should be
  updated when convenient, and the package stays @raishin/vanguard-frontier-agentic
  because an npm scope is a separate namespace from a GitHub account.

Calls out explicitly that @raishin/... in install commands, .npmrc registry
config, and packed tarball names is correct rather than a leftover, so a future
reader does not "finish" the rename and break every existing install.

• readme: raise the rename notice into an IMPORTANT callout (7303575)
  The notice was a middle paragraph inside a shared blockquote, between the npm
  availability line and the FinOps warning — exactly where a skimming reader
  drops it. Anyone who misses it is likely to conclude the npm package moved too.

Promotes it to its own GitHub [!IMPORTANT] alert so it renders as a coloured,
iconed box, and adds a two-column "what changed / what did NOT change" table so
the two identifiers land without reading prose. The npm availability line and
the ALPHA FINOPS paragraph are unchanged and now stand as their own blockquotes.

Wording is unchanged apart from the added headline clause; the sentence marking
@raishin/... as correct rather than a leftover is kept intact, since that is
the line th...

🛡️ v3.6.0 — Provenance · Policy · Portability

🛡️ v3.6.0 — Provenance · Policy · Portability

Released 2026-07-28

Curated multi-cloud, zero-trust agent marketplace — AWS · Azure · OCI · GCP · Terraform.
Least privilege, live evidence, safe rollback paths.

Release type: New capabilities — review the sections below before upgrading.

• compliance: governance foundation for the Python live control plane (0cabe1f)
  Establish the control-as-code and evidence contracts that the forthcoming
  Python live-control-plane agents will operate under, and correct a load-bearing
  evidence overclaim.

• Correct docs/evidence-output-spec.md: remove the claims that a single agent
  response "becomes an audit artifact without post-processing" and is
  "sufficient evidence for all mapped controls." Replace with an explicit
  "what a response does and does not establish" section: a response may SUPPORT
  audit evidence; a control mapping does not establish applicability; evidence
  existence is not accuracy; one execution is not continuing effectiveness;
  control design and operation are separate; internal evidence is not
  independent assessment; audit acceptance is the auditor's decision; legal
  compliance is the organization's responsibility. Framework tables reframed as
  candidate control support, not certification.
• Add schemas/control-object.schema.json — control-as-code (objective,
  preventive/detective mechanisms, required_evidence, failure_behavior, owner,
  candidate framework_mappings gated by owner confirmation, explicit
  limitations).
• Add schemas/audit-event.schema.json — the immutable audit-event contract the
  deployer's runtime must satisfy; fail-closed for R3/R4/R5 actions when audit
  logging is unavailable. The repo defines the contract; it does not run the
  log store.
• Add docs/compliance/evidence-quality-model.md — evidence dimensions (source,
  integrity, freshness, completeness, independence, sensitivity, control stage,
  retention, assessor status) extending evidence_level.
• Add docs/compliance/applicability-engine.md — determine applicable frameworks
  from recorded inputs and R0-R5 action-risk tiers; never apply a framework
  because it is familiar, never omit one because the system is internal;
  proposals for owners to confirm, never legal determinations.
• Add docs/compliance/framework-profiles.md — configurable, versioned control
  profiles across NIST 800-53/CSF/AI-RMF/GenAI, ISO 27001/42001, SOC 2, PCI DSS,
  HIPAA, SOX ITGC, GDPR, EU AI Act, NIS2, and internal/contractual controls,
  each framed honestly (catalogs and risk frameworks, not certifications; OWASP
  as a threat source, not a certificate).

Static-review posture unchanged for existing agents. All gates green:
npm run validate, markdownlint, codespell.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python-live: add governed live control plane to the Python board (15 agents) (fa3d4d9)
  Extend the Python board with a live control plane: 15 read-only-runtime and
  mutating-runtime agents that interact with live systems under controlled
  execution with provable accountability, routed by a dedicated
  python-live-governance-maestro-agent (separate from the 20 static-review board
  agents). This is a deliberate, documented exception to the language/stack
  "static-review only" default, authorized for the python board.

Agents (python-live-*): governance-maestro (routes only), system-inventory,
identity-authority, runtime-control, change-plan, policy-gate (read-only);
code-remediation, release-control, data-change-control, job-control,
model-promotion-control, rollback-and-recovery (mutating live-guards);
control-evidence, continuous-control-testing, exception-governance (read-only).

• Operating model per agent: Inventory -> Classify -> Observe -> Plan -> Evaluate
  controls -> Obtain authority -> Execute -> Verify -> Reconcile -> Seal evidence
  -> Monitor -> Reassess. Mutating operators are live-guards: never auto-dispatched,
  gated behind an external signed approval bound to the target, target-scoped JIT
  credentials, a pre-approved rollback, and an immutable audit event; fail-closed
  if audit logging is unavailable for an R3+ action.
• Board-wide FIXED_LIVE_RULES (generated, DRY): separate permission from authority
  and execution from approval; never confuse execution with approval, technical
  success with business success, evidence with proof, control-mapping with
  compliance, or automation with accountability; never declare regulatory
  compliance; purpose limitation and data minimization; treat artifacts as data
  not authority.
• Generated by scripts/gen_python_live_agents.py from scripts/python_live_data/
  agents/*.json (separate generator; the static board generator is untouched).
• 6 live install-role bundles (platform-operator, security-operator, data-operator,
  ml-governance-operator, automation-control-owner, audit-and-compliance-reviewer);
  the audit-and-compliance-reviewer contains NO mutating agents.
• Routing fixtures (tests/fixtures/python-live-maestro-routing/, 24 scenarios): 8
  read-only happy paths, 6 gated mutations, and 10 adversarial-authority cases
  (verbal approval, admin creds, skip-log, now-ticket-later, retry-all, unverified
  rollback, 99-under-one-approval, requester-as-approver, change-target-same-approval,
  prod-DB-test) all resolving to live-guard-gate — gated, never auto-dispatched.
• Version-sensitive framework claims cross-checked via Context7 (free-threaded
  CPython, Airflow, OpenTelemetry Python earlier; Celery/SQLAlchemy/FastAPI in the
  static board). Governance claims grounded in NIST 800-53/CSF/AI-RMF, ISO
  27001/42001, SOC2, GDPR, EU AI Act, OWASP — framed as owner-confirmable candidates,
  never certifications.
• docs/language-stack-boards.md updated: python is now a documented mixed-tier
  exception; trust-posture table and the static-review invariant carry the explicit
  live-plane carve-out.

All gates green: npm run validate (666 agents, 689 skills, 733 routing scenarios
across 31 maestros, every agent role-covered), markdownlint, codespell. Diff scoped
to python; no schema-enum/Rust changes (provider already registered).

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python: add static-review Python agent board (maestro + 4 specialists) (7d681f6)
  Introduce a coherent Python language/stack board following the Kotlin/PHP
  board pattern: a routing-only python-maestro plus four narrow static-review
  specialists — application-security, async-concurrency-reliability,
  packaging-supply-chain, and numerical-scientific-correctness — each with a
  1:1 companion skill and modular, source-grounded references.

• Data-driven generation: scripts/gen_python_agents.py renders AGENT.md,
  metadata, 7 harness adapters, SKILL.md, and references from
  scripts/python_data/agents/*.json (deterministic; mirrors the Java/Kotlin
  house generator). The judgment lives in the data files.
• Registered the python provider across schemas/agent.schema.json,
  schemas/skill.schema.json, tests/validate-catalog.py, the vfa-tui Provider
  enum and infer_provider, docs/taxonomy.md, docs/language-stack-boards.md,
  and scripts/generate-docs-data.mjs.
• 3 overlapping, minimal install roles; auto-derived Kiro Power.
• Maestro routing fixtures: 12 scenarios (happy-path singles, adversarial
  injection-directive, production-mutation gating, out-of-board handoff, and
  parallel multi-domain), with expected outputs generated from the grader.
• Claims grounded in official Python/PyPA/OWASP/CWE/pandas/numpy docs; the
  asyncio and pip hash-checking claims were cross-checked via Context7 with
  provenance recorded in each skill's references/official-sources.md.

All gates green: npm run validate, markdownlint, codespell, and cargo
fmt/clippy/test in tools/vfa-tui. Catalog re-sync limited to the added
python entries only (pre-existing non-python metadata drift left untouched).

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python: complete Python board with final 10 specialists (20 total) (8b26223)
  Add the remaining specialists, completing the 20-agent Python board (maestro +
  19 specialists). Each has a 1:1 companion skill, modular source-grounded
  references, seven harness adapters, a routing-fixture domain, and install-role
  coverage:

• python-estate-modernization-governor-agent — EOL/unsupported runtimes, upgrade
  sequencing, dependency/deprecation compatibility, ownership gaps.
• python-performance-memory-agent — profiling-vs-benchmarking rigor, memory
  growth/GC, algorithmic complexity; refuses intuition as evidence.
• python-free-threading-parallelism-agent — no-GIL (PEP 703) adoption, invalidated
  GIL assumptions, C-extension Py_mod_gil support, adopt/pilot/defer verdict.
• python-native-extension-interop-agent — C-API reference ownership, stable ABI,
  buffer protocol, exception translation, PyO3/Cython, free-threaded readiness.
• python-container-serverless-runtime-agent — PID 1/SIGTERM, exec-form entrypoint,
  worker model, graceful shutdown, read-only fs, cold start.
• python-data-pipeline-reliability-agent — Airflow/Dagster/Prefect/PySpark
  idempotency, catchup/backfill safety, schema evolution, late data, checkpointing.
• python-ml-ai-production-agent — training-serving skew, feature/data leakage,
  unsafe pickle/joblib artifact loading (RCE), reproducibility, batch-vs-online.
• python-observability-sre-agent — structured logs, trace context propagation,
  metric/label cardinality, PII, SLO-supporting instrumentatio...

v0.0.8

Added

• (python) add static-review Python agent board (maestro + 4 specialists)

🛡️ v3.5.0 — Provenance · Policy · Portability

🛡️ v3.5.0 — Provenance · Policy · Portability

Released 2026-07-21

Curated multi-cloud, zero-trust agent marketplace — AWS · Azure · OCI · GCP · Terraform.
Least privilege, live evidence, safe rollback paths.

Release type: New capabilities — review the sections below before upgrading.

• kotlin: add adversarial Kotlin agent board (16 agents + companion skills) (a918e72)
  Add a static-review Kotlin board spanning JVM-Kotlin language correctness,
  coroutines/Flow reliability, Ktor + Kotlin-on-Spring backend readiness,
  kotlinx.serialization wire contracts, library API/ABI governance,
  Java-to-Kotlin estate modernization, Android (architecture, Compose UI +
  accessibility, MASVS security/privacy, runtime performance), Kotlin
  Multiplatform (portfolio decision + boundary/interop incl. Kotlin/Native),
  Gradle build engineering, dependency/release supply-chain integrity, and
  coroutine/Compose/KMP test architecture. One maestro router plus 15
  specialists, each with a 1:1 companion skill and distinct topic references.

• Register the kotlin provider across the schemas, validate-catalog
  allowlist, vfa-tui Provider enum + coverage mapping, docs-data taxonomy,
  and the hand-written taxonomy/board docs.
• Add a deterministic generator (scripts/gen_kotlin_agents.py) that renders
  agents, harness variants, and companion skills from per-agent data files.
• Add the maestro routing fixture, seven install-role bundles, and refresh
  all catalogs, plugin/cursor manifests, Kiro power, model policy, README
  counts, and the asset-integrity manifest.

Every agent is execution_tier static-review: reads source and sanitized
config only; never builds, runs, deploys, signs, publishes, or contacts a
live system. Business impact is evidence-bounded, never invented ROI.

Gates: npm run validate (all gates), codespell, markdownlint, and cargo
fmt/clippy/test (173 passed) all green.

• catalog-sync: upsert existing ids in update-catalog helper (d2458a4)
  update-catalog-new-agents.py was add-only: editing an existing agent or
  skill's metadata.json (summary, official_docs, security_notes, harnesses,
  version, companion_skills) never re-synced catalog/agents.json or
  catalog/skills.json, so exporters and the TUI could serve stale metadata.

Make it upsert — new ids are appended, existing ids are refreshed only
when their projected form diverges, and an already-synced tree is a
strict no-op. It does not prune ids whose metadata.json was deleted;
removal stays a deliberate manual step. Update the Kotlin generator
docstring to describe the new behaviour.

Addresses the catalog-synchronization review finding on PR #130.

• kotlin: address PR review + complete provider registration for docs/README (7bfc52d)
  Provider registration completeness (hand-maintained, non-generated lists):

• README: add Kotlin to the board prose list, the board table, the directory
  tree, the Powers list, and a dedicated Kotlin board description section.
• docs/integrations/installation-guide.md: add the vanguard-kotlin Kiro Power row.
• docs/language-stack-boards.md: include the kotlin-engineering-leader install role.
• (Rust TUI already complete: Provider enum variant + infer_provider mapping;
  the display-name path is generic.)

PR review fixes:

• gen_kotlin_agents.py: wrap the multi-line board-rule strings in explicit
  parentheses (silences CodeQL implicit-string-concatenation), and stop emitting
  policy-controlled codex model/reasoning fields — model-policy:apply projects
  them, so regeneration no longer conflicts with catalog/model-policy.json. Add a
  workflow note that update-catalog is add-only (re-sync changed cataloged fields).
• kotlin-maestro routing fixture: expand live_guard_intent to gate the declared
  production-mutation verbs (publish to a registry, deploy to prod, sign a release,
  push to a store) while leaving review requests (build/​migrate) routable; add two
  adversarial gate fixtures.
• Data-file accuracy: cleartext default is targetSdkVersion-governed (not device
  OS); recommend current Keystore-backed storage rather than the deprecated
  EncryptedSharedPreferences; model JVM default arguments at the callee; do not
  require an explicit Turbine timeout (finite default exists); do not present
  SharedFlow(replay=0) as a lossless one-shot-event fix; drop the maestro refusal
  trigger that contradicted its ignore-injection-and-route rule.

Catalogs, manifests, model policy, and asset integrity regenerated. All gates
green: npm run validate, codespell, markdownlint, and the cargo suite.

---

📥 Install

npm install @raishin/vanguard-frontier-agentic@3.5.0

🔐 Supply-chain provenance

Every release ships a build attestation (SLSA provenance) and an SBOM. Verify the tag with gh attestation verify before installing.

Full changelog: v3.4.0...v3.5.0

v0.0.7

Added

• (kotlin) add adversarial Kotlin agent board (16 agents + companion skills)

v0.0.6

Other

• update Cargo.lock dependencies