devops-ops

> Agent for `aws-ci-cd-release-engineer`. Review AWS release pipelines, deployment gates, artifact provenance, CodePipeline/CodeBuild/CodeDeploy, GitHub/GitLab integrations, rollback, change correlation, and incident prevention.

> Agent for `aws-data-protection-backup-steward`. Review AWS backup and data protection across AWS Backup, snapshots, vaults, restore testing, retention, encryption, immutability, cross-account copy, and recovery evidence.

> Agent for `aws-devops-agent-skill-designer`. Design AWS DevOps Agent-compatible skills, investigation workflows, learned skills, tool-use best practices, agent targeting, frontmatter triggers, and operational output contracts.

> Agent for `aws-event-driven-architecture-review`. Review AWS EventBridge, SQS, SNS, Step Functions, Pipes, event schemas, retries, DLQs, idempotency, cross-account routing, monitoring, and event-loop risk.

> Agent for `aws-iac-patch-executor`. Edit AWS IaC files such as CloudFormation, SAM, CDK config, and Terraform configuration in a bounded, non-destructive way with validation-first discipline.

> Agent for `aws-iam-least-privilege-review`. Review AWS IAM policies, trust policies, resource policies, permission boundaries, SCPs, and role design for least-privilege risks with Access Analyzer validation discipline.

> Agent for `aws-live-deployment-guarded-operator`. Operate guarded live AWS deployment changes only after explicit target confirmation, approval checkpoints, dry-run or preview evidence, rollback readiness, and post-change verification.

> Agent for `aws-live-iac-change-guard`. Guard live CloudFormation, SAM, CDK, and Terraform-backed AWS infrastructure changes with change sets or plans, rollback triggers, stack policies, drift checks, and explicit approval.

> Agent for `aws-migration-cutover-architect`. Plan and review AWS migrations and cutovers across discovery, wave planning, Application Migration Service, Migration Hub, testing, rollback, downtime, and acceptance evidence.

> Agent for `aws-network-architect`. Design and review AWS VPC, Transit Gateway, Direct Connect, VPN, Cloud WAN, Route 53 Resolver, private DNS, routing, private endpoints, segmentation, ingress, egress, inspection, and hybrid/multi-cloud connectivity patterns.

> Agent for `aws-non-destructive-task-automation-advisor`. Design AWS-native, non-destructive automation for reporting, notification, evidence gathering, approvals, and workflow coordination using serverless and event-driven services.

> Agent for `aws-rds-aurora-performance-investigator`. Investigate Amazon RDS and Aurora latency, connection exhaustion, slow queries, lock waits, replica lag, storage pressure, failover, Performance Insights, and database capacity risk.

> Agent for `aws-resilience-bcdr-review`. Review AWS resilience and business continuity across RTO/RPO, backup, multi-AZ, multi-Region, failover, game days, runbooks, drift, and recovery validation.

> Agent for `aws-serverless-rollout-corrector`. Patch serverless deployment definitions, Lambda rollout settings, event wiring, and alias/version configuration in-repo while keeping live rollout actions out of scope by default.

> Agent for `gcp-alloydb-ai-developer`. Design and build AI-powered applications on AlloyDB for PostgreSQL using vector search, hybrid search, AI SQL functions, and model endpoint management.

> Agent for `gcp-alloydb-cloudsql-dba`. Operate AlloyDB clusters and Cloud SQL instances — HA configuration, read replicas, connection pooling, maintenance windows, backup strategy, and performance diagnostics.

> Agent for gcp-anthos-multicloud-architect. Design and operate Anthos / GKE Enterprise fleet management, Config Management (GitOps with Policy Controller), multi-cloud Kubernetes across GCP, AWS, and Azure.

> Agent for gcp-certificate-manager-issuer-review. Review GCP Certificate Manager and classic Google-managed TLS certificates — certificate map configuration, DNS authorization, CAA record validation, certificate rotation automation, wildcard vs SAN design, and expiry monitoring.

> Agent for `gcp-cloud-auth-advisor`. Advise on Google Cloud authentication and authorization patterns — ADC, Workload Identity Federation, service account best practices, and keyless auth migration.

> Agent for `gcp-cloud-run-functions-operator`. Deploy and operate Cloud Run services, Cloud Functions gen2, Eventarc triggers, traffic splitting for progressive delivery, and cold-start optimization strategies.

> Agent for `gcp-data-pipeline-engineer`. Design and troubleshoot data pipelines using Dataflow (Apache Beam), Pub/Sub messaging, Dataproc (Spark/Hadoop), Cloud Composer (Apache Airflow), and Dataplex data governance.

> Agent for `gcp-firebase-developer`. Build, configure, and operate Firebase-powered web and mobile applications across Firestore, Auth, Hosting, Cloud Functions, Storage, App Check, and more.

> Agent for gcp-iac-change-safety-review. Review Terraform and Deployment Manager changes targeting GCP — blast radius analysis, destroy-operation detection, cross-project impact, state file conflicts, org policy drift, and rollback plan completeness.

> Agent for `gcp-live-cloud-run-traffic-migration-guard`. Gate Cloud Run traffic percentage migrations, min-instances changes, and revision deletions — production traffic blast radius with no automatic rollback.

> Agent for `gcp-live-kms-key-destruction-guard`. Gate Cloud KMS key version destruction and key ring deletion — CMEK-encrypted data becomes permanently and irrecoverably inaccessible once a key version is destroyed.