SafeguardCustomPlatform

Use when the agent must drive a live SPP appliance through safeguard-ps to validate, import, trigger, and inspect a custom platform script. Covers Connect-Safeguard -DeviceCode (preferred) / -Browser (fallback) auth, the cmdlet menu (Test- / Import- / Export- / asset / account / trigger), idempotency, extended-logging triggers, task-log JSON retrieval, and how to call tools/Invoke-PlatformDevLoop.ps1 instead of re-implementing the loop. All cmdlet syntax must be sourced from Get-Help <Cmdlet> -Full against the installed module, never paraphrased from memory.

Use when drafting or revising the custom-platform JSON itself. Four pattern recipes (ssh-interactive, ssh-batch, http-api, http-form-fill) cite schema, samples, and templates and cover Do blocks, status messages, custom parameters, and reserved variables. The http-api recipe spans every auth shape the API documents — Basic/Digest via HttpAuth, or Bearer / custom Authorization scheme / custom-header API key via script-built Headers — plus one-step vs two-step token fetch. Mandates the fast inner loop: local schema validation against schema/ before any appliance round-trip. SchemaOnly green is necessary but not sufficient — cross-reference samples for analogous patterns before declaring ready.

Use when the agent must learn how a live target system actually behaves before authoring or revising a custom platform script. Covers per-protocol recon recipes (SSH and HTTP) run from the operator's local shell with a service-account credential, the probe-safety contract (read-only by default, per-probe consent for destructive probes, rate limits, no-production guard), and the structured evidence artifact consumed by strategy-selection and script-authoring.

Use when an operation has run and produced an extended task log that must be classified and turned into a next step. Pulls or accepts the extended task-log JSON, classifies the failure phase (connect / auth / parse / operation / unknown), extracts actionable signals, and recommends the next iteration. Backed by the failure-pattern catalog at docs/agent-reference/failure-patterns.md, which ships empty and is grown only from real runs.

Use to decide the implementation approach for a custom platform from protocol, vendor documentation, and probe evidence. Maps inputs to a recommendation across SSH (interactive vs batch) and HTTP (form-fill vs api). For http-api, also picks the auth shape — HttpAuth-managed (Basic, Digest) vs script-managed header (Bearer, custom Authorization scheme, custom-header API key) — and one-step vs two-step token fetch. Plus credential intent (password / SSH key / API key / bearer token) and self-managed vs service-account. Accepts both fetched URLs and vendor-doc excerpts the user pasted into the conversation.