plugin: add cloud deployment routing skills

.agents/plugins/marketplace.json

@@ -53,6 +53,18 @@
       },
       "category": "Productivity"
     },
+    {
+      "name": "cloud-deployment-skills",
+      "source": {
+        "source": "local",
+        "path": "./plugins/cloud-deployment-skills"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    },
     {
       "name": "dotnet-skills",
       "source": {

README.md

@@ -86,6 +86,7 @@ Currently available from the catalog:
 - `android-dev-skills`
 - `apple-dev-skills`
 - `cardhop-app`
+- `cloud-deployment-skills`
 - `codex-utilities`
 - `dotnet-skills`
 - `game-dev-skills`
@@ -111,6 +112,7 @@ Current Socket catalog shape:
 - `android-dev-skills`: Android, Kotlin, Java, Gradle, Android Gradle Plugin, Compose/XML UI, testing, lint, emulator-aware validation handoff, and release-readiness workflow guidance
 - `apple-dev-skills`: Apple, Swift, SwiftUI animation and architecture, Core Animation, Apple typography, SF Symbols, AppKit, Xcode, strict media type selection for AVFoundation, AVFAudio, Core Media, Core Audio, Audio Toolbox, Swift OpenAPI client, Safari, DocC workflows, and the source-bundled `swift-steward` custom-agent definition with its own roadmap
 - `cardhop-app`: mixed skill plus bundled MCP server for Cardhop.app contact workflows
+- `cloud-deployment-skills`: cloud provider deployment routing, official provider plugin selection, credential and mutation boundary checks, and AWS handoff to the official AWS Agent Toolkit rather than duplicated AWS MCP, CLI, or SAM setup
 - `codex-utilities`: local Codex runtime utilities, starting with hooks that prefix generated Codex thread titles with the project directory name
 - `dotnet-skills`: .NET, F#, and C# project-shape, bootstrap, implementation, test, package, diagnostics, ASP.NET Core, interop, CI, upgrade, and tooling guidance
 - `game-dev-skills`: Apple platform game development workflows for SpriteKit, SceneKit, GameplayKit simulation, Game Controller input, Core Haptics feedback, Xcode game profiling, game-stack routing, and device-aware validation handoffs

ROADMAP.md

@@ -21,6 +21,7 @@
 - [Milestone 18: Swift Lang shared language plugin](#milestone-18-swift-lang-shared-language-plugin)
 - [Milestone 19: Project audit skills plugin](#milestone-19-project-audit-skills-plugin)
 - [Milestone 20: Game Dev Skills plugin](#milestone-20-game-dev-skills-plugin)
+- [Milestone 21: Cloud Deployment Skills plugin](#milestone-21-cloud-deployment-skills-plugin)
 - [Small Tickets](#small-tickets)
 - [Backlog Candidates](#backlog-candidates)
 - [History](#history)
@@ -55,6 +56,7 @@
 - Milestone 18: Swift Lang shared language plugin - Completed
 - Milestone 19: Project audit skills plugin - Planned
 - Milestone 20: Game Dev Skills plugin - Completed
+- Milestone 21: Cloud Deployment Skills plugin - Completed
 
 ## Milestone 5: SwiftASB skills plugin
 
@@ -630,6 +632,37 @@ Completed
 
 Completed Milestone 20 by adding the `game-dev-skills` child plugin, shipping the Apple-platform game-development workflow slices, wiring the Socket marketplace entry, documenting the plugin boundary, and validating skill metadata, plugin metadata, and root marketplace wiring. Metal rendering and shader architecture remain planned as a later dedicated slice.
 
+## Milestone 21: Cloud Deployment Skills plugin
+
+### Status
+
+Completed
+
+### Scope
+
+- [x] Add a thin Socket-hosted `cloud-deployment-skills` child plugin for cloud provider routing, official provider plugin selection, credential and mutation boundary checks, and cross-provider deployment handoffs.
+- [x] Delegate AWS MCP configuration, AWS CLI setup, AWS SAM setup, and curated AWS skill content to the official [`aws/agent-toolkit-for-aws`](https://github.com/aws/agent-toolkit-for-aws) marketplace and its `aws-core` plugin.
+- [x] Keep framework-specific deployment implementation in the owning stack plugins, such as Server-Side Swift Fly.io deployment guidance.
+- [x] Keep the first Socket slice guidance-only: do not bundle AWS MCP config, copied AWS skills, credential setup scripts, provider templates, or local cloud state.
+
+### Tickets
+
+- [x] Record the detailed plan in [`docs/maintainers/cloud-deployment-skills-plugin-plan.md`](./docs/maintainers/cloud-deployment-skills-plugin-plan.md).
+- [x] Create `plugins/cloud-deployment-skills/` with `.codex-plugin/plugin.json`, `AGENTS.md`, an icon asset, and authored `skills/` source.
+- [x] Add `cloud-deployment-skills:cloud-deployment-routing-workflow` for provider routing, AWS Agent Toolkit handoff, mutation boundaries, and validation choices.
+- [x] Wire `cloud-deployment-skills` into the root Socket marketplace as an installable child plugin.
+- [x] Update root README and ROADMAP so users understand the new plugin surface and the AWS delegation decision.
+- [x] Run root metadata validation with `uv run scripts/validate_socket_metadata.py`.
+
+### Exit Criteria
+
+- [x] The Socket marketplace exposes `cloud-deployment-skills` as an installable child plugin.
+- [x] AWS work routes to the official AWS Agent Toolkit for AWS by default instead of duplicated Socket-owned AWS MCP, AWS CLI, or AWS SAM setup guidance.
+- [x] The plugin boundary is clear enough for future provider slices without absorbing framework-specific deployment workflows.
+- [x] Root Socket docs, marketplace wiring, and validation agree on the exported cloud-deployment skill surface.
+
+Completed Milestone 21 by adding the `cloud-deployment-skills` child plugin, shipping the provider-routing workflow, wiring the Socket marketplace entry, documenting the AWS Agent Toolkit delegation, and keeping future provider expansion scoped to small official-tool routing slices.
+
 ## Small Tickets
 
 - [ ] Record issue-sized fixes, TODO/FIXME imports, and cleanup work that is too small or too unplanned for a milestone.

docs/maintainers/cloud-deployment-skills-plugin-plan.md

@@ -0,0 +1,34 @@
+# Cloud Deployment Skills Plugin Plan
+
+## Purpose
+
+Add a thin Socket-owned cloud deployment routing plugin without duplicating first-party provider agent tooling.
+
+The first practical use case is AWS. AWS now publishes the official [`aws/agent-toolkit-for-aws`](https://github.com/aws/agent-toolkit-for-aws) Codex marketplace, and its `aws-core` plugin bundles AWS MCP Server configuration plus curated AWS skills. Socket should route users there instead of carrying copied AWS CLI, AWS SAM CLI, or AWS MCP setup guidance.
+
+## Ownership
+
+- `cloud-deployment-skills` owns provider selection, official-tool routing, credential and mutation boundary checks, and cross-provider deployment handoffs.
+- AWS owns the AWS Agent Toolkit, AWS MCP Server configuration, and AWS skill content.
+- Stack plugins keep framework-specific deployment details, such as Server-Side Swift Fly.io deploy workflows.
+
+## First Slice
+
+- Add `plugins/cloud-deployment-skills/`.
+- Add one skill: `cloud-deployment-routing-workflow`.
+- Wire the plugin into the root Socket marketplace.
+- Update root README and ROADMAP so the install surface is visible and the AWS delegation decision is durable.
+- Keep the plugin guidance-only. Do not bundle `.mcp.json` for AWS.
+
+## Future Slices
+
+- Add Cloudflare deployment routing if Socket needs guidance beyond existing Cloudflare docs and tooling.
+- Add Vercel deployment routing if web project handoffs need a first-party Socket decision layer.
+- Add Fly.io provider-neutral routing only if the existing Server-Side Swift workflow is too narrow for non-Swift projects.
+- Add Terraform, Pulumi, CDK, Azure, or GCP slices only after concrete project use proves that official provider docs or plugins are not enough.
+
+## Validation
+
+- Run root metadata validation with `uv run scripts/validate_socket_metadata.py`.
+- Run `git diff --check`.
+- For release, follow the standard Socket release mode because this is a monorepo-owned child plugin with no subtree synchronization requirement.

plugins/agent-portability-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-portability-skills",
-  "version": "7.9.0",
+  "version": "7.10.0",
   "description": "Maintainer skills for Socket-owned agent skill portability, Codex plugin surfaces, and host adapter guidance.",
   "author": {
     "name": "Gale",

plugins/agent-portability-skills/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agent-portability-skills-maintenance"
-version = "7.9.0"
+version = "7.10.0"
 description = "Maintainer-only Python tooling baseline for Agent Portability Skills."
 requires-python = ">=3.11"
 dependencies = []

plugins/android-dev-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "android-dev-skills",
-  "version": "7.9.0",
+  "version": "7.10.0",
   "description": "Android, Kotlin, Java, Gradle, Android Gradle Plugin, testing, lint, UI implementation, and release-readiness workflow skills.",
   "author": {
     "name": "Gale",

plugins/apple-dev-skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-dev-skills",
-  "version": "7.9.0",
+  "version": "7.10.0",
   "description": "Apple development workflows for Codex, including media and audio repair, Xcode coding intelligence, SwiftUI animation and architecture, Core Animation, Apple typography, SF Symbols, AppKit architecture, Icon Composer app icons, Safari extensions, DeviceCheck/App Attest, Swift OpenAPI clients, and DocC authoring guidance.",
   "author": {
     "name": "Gale",

plugins/apple-dev-skills/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "apple-dev-skills-maintainer"
-version = "7.9.0"
+version = "7.10.0"
 description = "Maintainer tooling for the apple-dev-skills repository"
 requires-python = ">=3.10"
 dependencies = []

plugins/cardhop-app/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cardhop-app",
-  "version": "7.9.0",
+  "version": "7.10.0",
   "description": "Cardhop.app workflow guidance plus a bundled local MCP server for contact capture and updates on macOS.",
   "author": {
     "name": "Gale",

plugins/cardhop-app/mcp/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cardhop-app-mcp"
-version = "7.9.0"
+version = "7.10.0"
 requires-python = ">=3.13"
 dependencies = [
     "fastmcp>=3.0.2",

plugins/cloud-deployment-skills/.codex-plugin/plugin.json

@@ -0,0 +1,46 @@
+{
+  "name": "cloud-deployment-skills",
+  "version": "7.10.0",
+  "description": "Codex skills for routing cloud deployment work through official provider plugins, MCP servers, CLIs, and Socket-owned deployment guidance.",
+  "author": {
+    "name": "Gale",
+    "email": "mail@galewilliams.com",
+    "url": "https://github.com/gaelic-ghost"
+  },
+  "homepage": "https://github.com/gaelic-ghost/socket/tree/main/plugins/cloud-deployment-skills",
+  "repository": "https://github.com/gaelic-ghost/socket",
+  "license": "PolyForm-Noncommercial-1.0.0",
+  "keywords": [
+    "codex",
+    "plugin",
+    "skills",
+    "cloud",
+    "deployment",
+    "aws",
+    "agent-toolkit",
+    "mcp",
+    "cloudflare",
+    "vercel",
+    "fly.io"
+  ],
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "Cloud Deployment Skills",
+    "shortDescription": "Cloud provider and deployment routing guidance for Codex.",
+    "longDescription": "Guide Codex agents through cloud deployment routing, official provider plugin selection, credential and mutation safety checks, and provider handoffs. The first slice delegates AWS work to the official AWS Agent Toolkit for AWS and keeps Socket focused on thin cross-provider deployment decisions instead of duplicating AWS MCP, AWS CLI, or AWS SAM setup.",
+    "developerName": "gaelic-ghost",
+    "category": "Developer Tools",
+    "capabilities": [
+      "Read",
+      "Write"
+    ],
+    "websiteURL": "https://github.com/gaelic-ghost/socket/tree/main/plugins/cloud-deployment-skills",
+    "defaultPrompt": [
+      "Choose the right cloud deployment path and route AWS work through the official AWS Agent Toolkit when appropriate.",
+      "Decide whether this deployment should use an official provider plugin, provider CLI, MCP server, framework-owned deploy workflow, or a Socket-owned provider skill."
+    ],
+    "brandColor": "#22D3EE",
+    "composerIcon": "./assets/cloud-deployment-icon.svg",
+    "logo": "./assets/cloud-deployment-icon.svg"
+  }
+}

plugins/cloud-deployment-skills/AGENTS.md

@@ -0,0 +1,22 @@
+# AGENTS.md
+
+This file is the Cloud Deployment Skills child-repo override for work done from `socket`. Follow the root `socket` guidance for general git, docs, release, branch, dependency-provenance, and maintainer workflow rules.
+
+## Scope
+
+- `cloud-deployment-skills` is a monorepo-owned Socket child and the canonical source of truth for shipped cloud-provider deployment routing skills.
+- Root [`skills/`](./skills/) is the authored workflow surface.
+- The repo root is the Codex plugin root through [`.codex-plugin/plugin.json`](./.codex-plugin/plugin.json).
+- Keep this plugin focused on provider selection, official-tool routing, deployment readiness, and cross-provider handoffs.
+- Keep framework-specific application implementation in the owning stack plugins such as `server-side-swift`, `web-dev-skills`, `python-skills`, `dotnet-skills`, `rust-skills`, and `server-side-jvm`.
+
+## Local Rules
+
+- Match the `socket` shared semantic version exactly; use the Socket root release workflow for version inventory and bumps.
+- Prefer official provider plugins, MCP servers, CLIs, and docs before adding Socket-authored setup guidance.
+- For AWS work, route Codex users to the official `aws/agent-toolkit-for-aws` marketplace and its `aws-core` plugin before considering Socket-owned AWS guidance.
+- Do not bundle AWS MCP configuration, AWS CLI setup instructions, AWS SAM setup instructions, or copied AWS Agent Toolkit skills in this plugin while the official AWS plugin owns that surface.
+- Treat provider credentials, account configuration, API mutation, billing, and production deployment as high-impact operations. Verify the target account, region, profile, project, and intended mutation before taking action.
+- Keep provider-specific skills small and explicit. Add a new provider workflow only when it removes real routing ambiguity or covers a provider that does not already offer a first-party agent plugin.
+- Do not commit machine-local credentials, profiles, `.env` files, cloud state, generated deployment artifacts, or local cache paths.
+- Use repo-local files, checked-out provider config, provider CLIs, and official provider documentation before making claims about current deployment behavior.