OneIdentity

Use when working on Azure Pipelines builds, version stamping, signing, publishing, or release artifacts for safeguard-ps.

Use when making Safeguard API calls, working with Invoke-SafeguardMethod, using filters or query parameters, exploring the API via Swagger, or troubleshooting API errors. Covers REST conventions, cmdlet preference, query/filter syntax, and common pitfalls.

Use when setting up test objects on a Safeguard appliance for integration testing. Covers the creation sequence for users, assets, accounts, certificates, A2A registrations, and cleanup.

Use when working on safeguard-ps A2A registrations, certificate authentication, credential retrieval, brokering, or A2A event listeners.

Use when working on module internals, understanding the module manifest, SignalR event listeners, dynamic groups, custom platform scripts, or tracing how feature modules interact with the root module and global state.

Use when creating a new PowerShell feature module (.psm1), adding new exported cmdlets, or extending the module manifest. Includes step-by-step checklists, file templates, and manifest update procedures.

Use when running tests, writing tests, investigating test failures, or setting up a test environment against a live Safeguard appliance. Covers the integration test framework, test runner commands, suite structure, assertion patterns, and module-to-suite mapping.

Use when making Safeguard API calls, working with invoke-safeguard-method.sh, using SCIM filters or query parameters, creating users/assets/accounts, or understanding Safeguard API conventions and gotchas.

Use when understanding how safeguard-bash is organized, how scripts share authentication and session state, how the utils library fits together, or how to add new commands safely.

Use when working on safeguard-bash Azure Pipelines, Docker packaging, version derivation, GitHub releases, or Docker Hub publishing.

Use when working on A2A (application-to-application) scripts, certificate authentication, credential retrieval, access request brokering, A2A service management, event subscriptions, or event discovery.

Use when creating a new CLI script in src/, adding a new command to safeguard-bash, or extending an existing script with new functionality. Covers the full script template, flag conventions, login file integration, and how to add a corresponding test suite.

Use when running tests, writing tests, investigating test failures, or setting up a test environment against a live Safeguard appliance. Covers the test framework API, suite lifecycle, assertion patterns, and the test runner.

Use when running tests, writing tests, investigating test failures, setting up a test environment against a live Safeguard appliance, or working with the PowerShell integration test framework. Covers live appliance workflow, PKCE vs ROG, running test suites, writing new suites, assertion functions, TOTP generation, and module-to-suite mapping.

Use when working with Safeguard A2A certificate auth, credential retrieval, brokering, or A2A event listeners.

Use when making standard Safeguard Web API calls with ISafeguardConnection and related SDK helpers.

Use when working on SDK internals, authentication mechanisms, connection classes, PKCE login flow, rSTS protocol details, event listeners, A2A integration, SPS integration, or exploring the Safeguard API via Swagger. Covers the entry point, auth strategy pattern, decorator pattern, rSTS step flow, and SignalR event architecture.

Use when reproducing SafeguardDotNet CI/CD, version stamping, signing, packaging, or release publishing.

Use when the agent must drive a live SPP appliance through safeguard-ps to validate, import, trigger, and inspect a custom platform script. Covers Connect-Safeguard -DeviceCode (preferred) / -Browser (fallback) auth, the cmdlet menu (Test- / Import- / Export- / asset / account / trigger), idempotency, extended-logging triggers, task-log JSON retrieval, and how to call tools/Invoke-PlatformDevLoop.ps1 instead of re-implementing the loop. All cmdlet syntax must be sourced from Get-Help <Cmdlet> -Full against the installed module, never paraphrased from memory.

Use when drafting or revising the custom-platform JSON itself. Four pattern recipes (ssh-interactive, ssh-batch, http-api, http-form-fill) cite schema, samples, and templates and cover Do blocks, status messages, custom parameters, and reserved variables. The http-api recipe spans every auth shape the API documents — Basic/Digest via HttpAuth, or Bearer / custom Authorization scheme / custom-header API key via script-built Headers — plus one-step vs two-step token fetch. Mandates the fast inner loop: local schema validation against schema/ before any appliance round-trip. SchemaOnly green is necessary but not sufficient — cross-reference samples for analogous patterns before declaring ready.

Use when the agent must learn how a live target system actually behaves before authoring or revising a custom platform script. Covers per-protocol recon recipes (SSH and HTTP) run from the operator's local shell with a service-account credential, the probe-safety contract (read-only by default, per-probe consent for destructive probes, rate limits, no-production guard), and the structured evidence artifact consumed by strategy-selection and script-authoring.

Use when an operation has run and produced an extended task log that must be classified and turned into a next step. Pulls or accepts the extended task-log JSON, classifies the failure phase (connect / auth / parse / operation / unknown), extracts actionable signals, and recommends the next iteration. Backed by the failure-pattern catalog at docs/agent-reference/failure-patterns.md, which ships empty and is grown only from real runs.

Use to decide the implementation approach for a custom platform from protocol, vendor documentation, and probe evidence. Maps inputs to a recommendation across SSH (interactive vs batch) and HTTP (form-fill vs api). For http-api, also picks the auth shape — HttpAuth-managed (Basic, Digest) vs script-managed header (Bearer, custom Authorization scheme, custom-header API key) — and one-step vs two-step token fetch. Plus credential intent (password / SSH key / API key / bearer token) and self-managed vs service-account. Accepts both fetched URLs and vendor-doc excerpts the user pasted into the conversation.

Use when working with SafeguardJava application-to-application credential retrieval, brokering, or A2A events.

Use when making standard Safeguard REST API calls through SafeguardJava connections.

Use when modifying Azure Pipelines, build templates, signing configuration, Maven Central publishing, GitHub Packages publishing, or release process. Covers GPG signing, JAR code signing, version strategy, and critical pipeline pitfalls.

Use when working on SDK internals, authentication flows, connection classes, event listeners, A2A contexts, SPS integration, or adding new authentication methods. Covers the rSTS token exchange, strategy pattern, and SignalR event system.

Use when running tests, writing tests, investigating test failures, or setting up a test environment against a live Safeguard appliance. Covers the PowerShell test framework, CLI test tool, test suites, module-to-suite mapping, and writing new suites.

Use when working on PySafeguard module internals, adding new auth strategies, extending the client, working with the event system (SignalR), or understanding internal patterns like PKCE, HiddenString, or async lazy imports.

Use when running tests, writing tests, investigating test failures, or setting up a test environment against a live Safeguard appliance. Covers pytest configuration, pytest-asyncio, integration test setup, environment variables, and the preflight fixture.

Use when making Safeguard API calls via SafeguardClient, working with HTTP methods, streaming, error handling, A2A credential retrieval, or managing token lifecycle. Covers method signatures, parameter conventions, and common patterns.

Use when setting up or troubleshooting Safeguard A2A certificate registrations, API keys, credential retrieval, brokering, or A2A-backed event listeners.

Use when changing Azure Pipelines, reproducing CI locally, or validating PySafeguard version stamping and publishing.

Use when making Safeguard API calls, wiring auth strategies, or following SDK request and response patterns.

Use when wiring certificate-based A2A retrieval, brokering, or related Safeguard event listeners in Node.js.

Use when changing module structure, auth internals, conditional exports, or the HTTP and storage layers.

Use when changing tsdown config, Azure Pipelines, publishing flow, or version derivation.

Use when working on Vitest configuration, appliance-backed tests, fixtures, or debugging test failures.

Use when understanding safeguard-ansible's repository layout, Ansible entry points, authentication flows, and the boundary between the collection, credential type plugin, and PySafeguard.

Use when preparing a release, modifying CI/CD pipelines, or working with version management. Covers Azure Pipelines structure, tag-based releases, version stamping, and publishing to Ansible Galaxy and PyPI.

Use when working on plugin source code, understanding PySafeguard SDK usage, or debugging credential retrieval. Covers A2AContext, SafeguardClient, PkceAuth, the verify parameter, HiddenString, and CheckOut response formats.

Use when running tests, writing tests, investigating test failures, or setting up a test environment. Covers both the Ansible collection tests (32 unit + 21 integration) and the credential type plugin tests (15 unit + 4 integration), including live appliance setup with SPP_HOST.