ivegamsft

Use when defining or validating BOM schemas, resource ID formats, required cells, or naming conventions. USE FOR: JSON schema for BOM validation, required-field checks, and template creation. DO NOT USE FOR: unrelated app schemas or general data-model design.

Config and secret exposure audit skill for repository and IaC config files. USE FOR: scanning Azure Key Vault references, hardcoded connection strings, GitHub Actions env secrets, .env/YAML/Bicep/Terraform parameter secrets, severity scoring, and SARIF output generation. DO NOT USE FOR: runtime penetration testing, live incident response, or deploying remediation changes.

Use when defining factory state transitions, reading or writing .github/factory-state.json, or orchestrating workcell workflow gates. USE FOR: intake/complete/pending transitions, auto-proceed rules, escalation checks, and state validation. DO NOT USE FOR: general app state management or unrelated workflow docs.

Use when refreshing a consumer repository to the latest BaseCoat build or a pinned BaseCoat release tag. USE FOR: refresh basecoat, update basecoat in a consumer repo, run sync.ps1 or sync.sh with .basecoat.yml defaults, verify installed basecoat version after sync, recover when rollout-basecoat skill invocation fails. DO NOT USE FOR: editing BaseCoat framework internals, designing new agents or skills, running unrelated CI/CD deployments.

Use when an approved feature or fix should progress to production through governed automation with minimal human intervention. USE FOR: approve-once delivery orchestration, deterministic dry-run rehearsal of status/merge/escalation logic, and policy-aligned remediation payload generation for blocked stages. DO NOT USE FOR: bypassing branch protection or approval boundaries, replacing implementation agents for code changes, or manual one-off deployment operations.

Structured guidance for assessing and executing modernization from .NET Framework or older .NET targets to modern .NET. USE FOR: inventory a legacy .NET solution, plan phased .NET upgrade, review NuGet and framework compatibility, define modernization test and release gates, remediate breaking changes during migration. DO NOT USE FOR: brand-new .NET app scaffolding, non-.NET platform migrations, day-to-day feature development unrelated to upgrades.

Use when modernizing legacy Entity Framework data layers to EF Core with help for model mapping, DbContext refactors, phased cutovers, and migration risk review. USE FOR: migrate EF6 to EF Core, refactor DbContext configuration, convert model mappings and conventions, plan phased database cutover, validate query compatibility after migration. DO NOT USE FOR: greenfield ORM selection, raw SQL tuning only, non-.NET data pipelines.

Root cause analysis for incidents, failures, and unexpected behavior. USE FOR: post-incident RCA, workflow/build failure analysis, 5-why investigation, tracing production outages to contributing factors, generating prevention recommendations. DO NOT USE FOR: live incident command and containment, general performance tuning, feature implementation.

Use when designing Copilot agents, authoring agent definitions, creating skill folders, or scaffolding instruction files. Provides templates and conventions for the agent ecosystem.

Use when designing, reviewing, or evolving API contracts. Provides OpenAPI templates, breaking-change checklists, versioning decision trees, and governance checklists.

API authentication, authorization, input validation, rate limiting, and protection patterns

Scan legacy applications to discover project structure, NuGet/npm dependencies, database connection strings, external service bindings, framework versions, and migration complexity scores. Produces structured JSON, YAML, or Markdown inventory reports.

Use when designing systems, recording architecture decisions, evaluating technologies, or assessing architectural risks. Provides C4 diagram templates, ADR format, technology selection matrices, and risk registers.

Deploy, scale, and manage containerized applications on Azure Container Apps with Dapr, revision management, and advanced networking

Azure DevOps REST API patterns — authentication, scopes, pagination, throttling, and endpoint taxonomy for work items, pipelines, repos, and artifacts.

Use when designing Azure identity architectures — RBAC role assignments, managed identities, Entra ID app registrations, conditional access policies, or workload identity federation for CI/CD. Covers zero trust patterns, PIM, and GitHub OIDC.