gaelic-ghost · gaelic-ghost · Jul 23, 2026 · Jul 23, 2026 · Jul 23, 2026
diff --git a/README.md b/README.md
@@ -150,13 +150,13 @@ Current Socket catalog shape:
 - `apple-creator-studio-skills`: source-preserving Final Cut Pro editing, Motion template, Compressor delivery, Logic Pro production, MainStage concert, and GarageBand project workflows with local Help Viewer discovery, explicit Computer Use safeguards, and artifact or rehearsal verification
 - `apple-dev-skills`: Apple, Swift, SwiftPM, macOS-hosted boundary selection, custom Virtualization framework hosts, persistent Linux development guests, clean macOS development guests, imaging, Vision/Core ML, camera, spatial sensing, media/audio, SwiftUI, AppKit, Xcode, Safari, OpenAPI, and DocC workflows, plus the source-bundled `swift-steward` custom-agent definition with its own roadmap
 - `cardhop-app`: mixed skill plus bundled MCP server for Cardhop.app contact workflows
-- `cloud-deployment-skills`: cloud provider deployment routing, official provider plugin selection, credential and mutation boundary checks, and AWS handoff to the official AWS Agent Toolkit rather than duplicated AWS MCP, CLI, or SAM setup
+- `cloud-deployment-skills`: cloud provider deployment routing, official provider plugin selection, credential and mutation boundary checks, AWS handoff to the official AWS Agent Toolkit, and Azure handoff to Microsoft's Azure Skills plugin rather than duplicated provider MCP or CLI setup
 - `cloud-inference-skills`: cloud AI inference, training, model conversion, and GPU infrastructure routing for Runpod, Hugging Face, AWS, Vast.ai, CoreWeave, and similar providers, with bundled Runpod MCP server configuration, upstream Runpod skill mirrors, and first-party Hugging Face/AWS handoffs
 - `cybersecurity-skills`: suspicious-content triage, evidence preservation, isolation selection, disposable Linux and macOS analysis-lab preparation, malware analysis, agentic security-tool controls, macOS investigation and defense, vulnerability validation, authorized testing, incident response, threat hunting, detection content, and clear non-specialist advice
 - `messaging-collaboration-skills`: chat-app, bot, business-messaging, meeting-collaboration, iMessage collaboration, Communication Notifications, Push to Talk, VoIP/SIP, documented iOS/iPadOS default communication roles, and app-owned macOS client workflows for Discord, Telegram, Slack, Teams, WhatsApp Business, SMS/MMS/RCS, Google Meet, and Apple communication surfaces, with explicit Signal and Mac operator-automation boundaries
 - `model-lab-skills`: reproducible language-model experiment design, dataset preparation, fine-tuning, evaluation, checkpoint comparison, representation and steering research, refusal ablation, authorized jailbreak and tool-calling evaluation, runtime benchmarking, and current-source routing across Core AI, Core ML, MLX, ExecuTorch, and Foundation Models
 - `agentdeck`: local Codex runtime utilities, starting with hooks that prefix generated Codex thread titles with the project directory name
-- `dotnet-skills`: .NET, F#, and C# project-shape, bootstrap, implementation, test, package, diagnostics, ASP.NET Core, interop, CI, upgrade, and tooling guidance
+- `dotnet-skills`: .NET, F#, and C# project-shape, bootstrap, implementation, test, package, diagnostics, ASP.NET Core, Giraffe, Falco, Oxpecker, interop, CI, upgrade, and tooling guidance
 - `game-dev-skills`: Apple platform game development workflows for native Metal and Metal 4 renderers, GPTK 3/4 routing, MetalFX, GPU asset streaming, experimental neural rendering, SpriteKit, SceneKit, GameplayKit simulation, Game Controller input, Core Haptics feedback, Xcode profiling, game-stack routing, and device-aware validation handoffs
 - `network-protocol-skills`: modern networking and application-protocol workflows for transport selection, HTTP/3 and QUIC planning, Media over QUIC draft-aware guidance, WebRTC signaling/media/data-channel work, and protocol diagnostics with stack-plugin handoffs
 - `productivity-skills`: general-purpose maintainer, documentation, Dice MCP job-search with bundled remote MCP config, Codex GUI worktree workflow, and automation-design workflows plus source-bundled docs-audit and code-tracing custom-agent definitions

diff --git a/ROADMAP.md b/ROADMAP.md
@@ -130,6 +130,8 @@ Completed
 - [x] Update `plugins/dotnet-skills/.codex-plugin/plugin.json` so plugin metadata includes F# and avoids C#-only wording.
 - [x] Add first-slice skills for project-shape choice, solution bootstrap, F# project implementation, C# project implementation, and test workflow.
 - [x] Add second-slice skills for package workflow, diagnostics, ASP.NET Core services, F#/C# interop, CI, upgrades, and tooling/style alignment.
+- [x] Add F# web-framework selection plus focused Giraffe, Falco, and Oxpecker workflows; keep Saturn and browser-client frameworks as explicit selection boundaries until a project needs deeper coverage.
+- [x] Route F# web application Azure work through Microsoft's official Azure Skills plugin rather than duplicating Azure MCP, Azure CLI, Azure Developer CLI, or deployment guidance in Socket.
 - [x] Switch the root marketplace entry for `dotnet-skills` from placeholder to installable only after real skill content exists.
 - [x] Update root README and maintainer docs so users understand the new installable child plugin surface.
 - [x] Run root metadata validation with `uv run scripts/validate_socket_metadata.py` and any child-plugin checks added by the new plugin.
@@ -140,6 +142,7 @@ Completed
 - [x] The new skills can help an agent choose a `.NET` project shape before implementation.
 - [x] The new skills guide F# and C# implementation without making either language a secondary path.
 - [x] The testing guidance uses `dotnet test` as the stable command surface while respecting repo-local test framework choices.
+- [x] The F# web guidance distinguishes Giraffe, Falco, and Oxpecker contracts while preserving ordinary ASP.NET Core and F# domain boundaries.
 - [x] Root Socket docs, marketplace wiring, and validation agree on the plugin's install surface.
 
 ## Milestone 7: Python skills plugin expansion
@@ -686,6 +689,7 @@ Completed
 
 - [x] Add a thin Socket-hosted `cloud-deployment-skills` child plugin for cloud provider routing, official provider plugin selection, credential and mutation boundary checks, and cross-provider deployment handoffs.
 - [x] Delegate AWS MCP configuration, AWS CLI setup, AWS SAM setup, and curated AWS skill content to the official [`aws/agent-toolkit-for-aws`](https://github.com/aws/agent-toolkit-for-aws) marketplace and its `aws-core` plugin.
+- [x] Delegate Azure MCP, Foundry MCP, Azure CLI and Azure Developer CLI workflows, and Azure provider guidance to Microsoft's official [`microsoft/azure-skills`](https://github.com/microsoft/azure-skills) marketplace and its `azure` plugin.
 - [x] Keep framework-specific deployment implementation in the owning stack plugins, such as Server-Side Swift Fly.io deployment guidance.
 - [x] Keep the first Socket slice guidance-only: do not bundle AWS MCP config, copied AWS skills, credential setup scripts, provider templates, or local cloud state.
 
@@ -696,12 +700,14 @@ Completed
 - [x] Add `cloud-deployment-skills:cloud-deployment-routing-workflow` for provider routing, AWS Agent Toolkit handoff, mutation boundaries, and validation choices.
 - [x] Wire `cloud-deployment-skills` into the root Socket marketplace as an installable child plugin.
 - [x] Update root README and ROADMAP so users understand the new plugin surface and the AWS delegation decision.
+- [x] Update root README and maintainer guidance so users understand the Azure Skills delegation decision and F# web-framework handoff.
 - [x] Run root metadata validation with `uv run scripts/validate_socket_metadata.py`.
 
 ### Exit Criteria
 
 - [x] The Socket marketplace exposes `cloud-deployment-skills` as an installable child plugin.
 - [x] AWS work routes to the official AWS Agent Toolkit for AWS by default instead of duplicated Socket-owned AWS MCP, AWS CLI, or AWS SAM setup guidance.
+- [x] Azure work routes to Microsoft's official Azure Skills plugin by default instead of duplicated Socket-owned Azure MCP, CLI, or Azure Developer CLI setup guidance.
 - [x] The plugin boundary is clear enough for future provider slices without absorbing framework-specific deployment workflows.
 - [x] Root Socket docs, marketplace wiring, and validation agree on the exported cloud-deployment skill surface.
 

diff --git a/docs/maintainers/cloud-deployment-skills-plugin-plan.md b/docs/maintainers/cloud-deployment-skills-plugin-plan.md
@@ -10,6 +10,7 @@ The first practical use case is AWS. AWS now publishes the official [`aws/agent-
 
 - `cloud-deployment-skills` owns provider selection, official-tool routing, credential and mutation boundary checks, and cross-provider deployment handoffs.
 - AWS owns the AWS Agent Toolkit, AWS MCP Server configuration, and AWS skill content.
+- Microsoft owns Azure Skills, Azure MCP and Foundry MCP configuration, and Azure provider workflows.
 - Stack plugins keep framework-specific deployment details, such as Server-Side Swift Fly.io deploy workflows.
 
 ## First Slice
@@ -25,7 +26,8 @@ The first practical use case is AWS. AWS now publishes the official [`aws/agent-
 - Add Cloudflare deployment routing if Socket needs guidance beyond existing Cloudflare docs and tooling.
 - Add Vercel deployment routing if web project handoffs need a first-party Socket decision layer.
 - Add Fly.io provider-neutral routing only if the existing Server-Side Swift workflow is too narrow for non-Swift projects.
-- Add Terraform, Pulumi, CDK, Azure, or GCP slices only after concrete project use proves that official provider docs or plugins are not enough.
+- Use the official Microsoft Azure Skills plugin for Azure. Add a Socket Azure slice only after a concrete project proves that the official provider plugin cannot cover a provider-neutral routing or repository-boundary need.
+- Add Terraform, Pulumi, CDK, or GCP slices only after concrete project use proves that official provider docs or plugins are not enough.
 
 ## Validation
 

diff --git a/docs/maintainers/dotnet-skills-plugin-plan.md b/docs/maintainers/dotnet-skills-plugin-plan.md
@@ -292,6 +292,31 @@ The second slice broadens the plugin from core project/test guidance into packag
 - [x] `dotnet:tooling-style-workflow`.
 - [ ] install testing with a temporary `CODEX_HOME`.
 
+## Third Implementation Slice: F# Web Frameworks
+
+This slice makes the existing ASP.NET Core service workflow actionable for the
+F# frameworks that have distinct handler and routing contracts. It is a durable
+building-block change: it removes the current ambiguity between generic ASP.NET
+Core guidance and framework-specific F# code, while keeping cloud operations in
+Microsoft's official Azure Skills plugin.
+
+- [x] `dotnet:choose-fsharp-web-framework` selects Minimal APIs, Giraffe,
+  Falco, Oxpecker, or Saturn from the application's actual HTTP and ownership
+  needs.
+- [x] `dotnet:build-giraffe-web-app` covers composable `HttpHandler` work.
+- [x] `dotnet:build-falco-web-app` covers functional routes, response helpers,
+  and ASP.NET Core integration.
+- [x] `dotnet:build-oxpecker-web-app` covers endpoint routing,
+  `EndpointHandler`, and `EndpointMiddleware` contracts.
+- [x] Keep Saturn, SAFE Stack, Fable, Bolero, and WebSharper as explicit
+  selection or handoff boundaries until a concrete project requires deeper
+  framework-specific workflows.
+- [x] Export the new portable instructions through the Hermes tap; do not claim
+  that the Codex plugin manifest itself is a Hermes plugin.
+- [x] Route Azure infrastructure, diagnostics, and deployment work to the
+  official Microsoft Azure Skills plugin rather than adding an Azure MCP server
+  or duplicated IaC workflow to `dotnet-skills`.
+
 ## Deferred Scope
 
 After the first two slices prove useful, consider deeper specialized workflows. These are useful but should not block the current installable plugin:
@@ -305,6 +330,10 @@ After the first two slices prove useful, consider deeper specialized workflows.
 - custom project template generation
 - bundled MCP servers or app connectors
 
+The F# web-framework slice intentionally does not add a new runtime plugin,
+framework template feed, browser-client framework implementation, or Azure
+adapter. Those would broaden the architecture beyond the shared guidance need.
+
 ## Open Decisions Before Implementation
 
 ### Skill Names

diff --git a/docs/maintainers/hermes-compatibility.md b/docs/maintainers/hermes-compatibility.md
@@ -105,6 +105,13 @@ It resolves operator-installed Swiftly and Xcode tools and plans SwiftPM plugin,
 macro, trait, generated-source, and permission work without bundling a compiler,
 plugin runtime, MCP server, or native Hermes extension.
 
+The exported F# web-framework workflows are portable instruction contracts. They
+use the operator's .NET SDK and project dependencies but bundle no runtime,
+framework package, MCP server, hook, or native Hermes extension. The cloud
+deployment routing workflow is also portable guidance: it routes Azure work to
+Microsoft's official Azure Skills plugin but does not claim that Azure MCP is
+automatically installed or configured in Hermes.
+
 The exported macOS platform-security workflows are portable instruction contracts. Public app permission, sandbox file-access, and entitlement diagnosis remain in Apple Dev Skills; exact-build private-control research remains in Reverse Engineering Skills; defensive host investigation remains in Cybersecurity Skills. Hermes does not receive a TCC database tool, permission grant service, privileged helper, protection bypass, or native runtime plugin from this work.
 
 ## Maintainer Workflow

diff --git a/plugins/agent-portability-skills/.codex-plugin/plugin.json b/plugins/agent-portability-skills/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-portability-skills",
-  "version": "9.21.0",
+  "version": "9.22.0",
   "description": "Maintainer skills for Socket-owned agent skill portability, Codex plugin surfaces, and host adapter guidance.",
   "author": {
     "name": "Gale",

diff --git a/plugins/agent-portability-skills/pyproject.toml b/plugins/agent-portability-skills/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "agent-portability-skills-maintenance"
-version = "9.21.0"
+version = "9.22.0"
 description = "Maintainer-only Python tooling baseline for Agent Portability Skills."
 requires-python = ">=3.11"
 dependencies = []

diff --git a/plugins/agent-portability-skills/uv.lock b/plugins/agent-portability-skills/uv.lock
diff --git a/plugins/agentdeck/.codex-plugin/plugin.json b/plugins/agentdeck/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agentdeck",
-  "version": "9.21.0",
+  "version": "9.22.0",
   "description": "Local Codex runtime utilities for thread, hook, and app-server workflows.",
   "author": {
     "name": "Gale",

diff --git a/plugins/android-dev-skills/.codex-plugin/plugin.json b/plugins/android-dev-skills/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "android-dev-skills",
-  "version": "9.21.0",
+  "version": "9.22.0",
   "description": "Android, Kotlin, Java, Gradle, Android Gradle Plugin, testing, lint, UI implementation, and release-readiness workflow skills.",
   "author": {
     "name": "Gale",

diff --git a/plugins/apple-creator-studio-skills/.codex-plugin/plugin.json b/plugins/apple-creator-studio-skills/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "apple-creator-studio-skills",
-  "version": "9.21.0",
+  "version": "9.22.0",
   "description": "Human-facing and Computer Use-aware Apple Creator Studio workflows for Final Cut Pro editing, Motion templates, Compressor delivery, Logic Pro production, MainStage concert preparation, and GarageBand projects.",
   "author": {
     "name": "Gale",

diff --git a/plugins/apple-dev-skills/.codex-plugin/plugin.json b/plugins/apple-dev-skills/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "apple-dev-skills",
-  "version": "9.21.0",
+  "version": "9.22.0",
   "description": "Apple development workflows for Codex, including macOS privacy permissions, sandbox file access, entitlement diagnosis, virtualization, SwiftPM, Xcode, app extensions, media, provisioning, SwiftUI, AppKit, Safari, security, OpenAPI, and DocC.",
   "author": {
     "name": "Gale",

diff --git a/plugins/apple-dev-skills/pyproject.toml b/plugins/apple-dev-skills/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "apple-dev-skills-maintainer"
-version = "9.21.0"
+version = "9.22.0"
 description = "Maintainer tooling for the apple-dev-skills repository"
 requires-python = ">=3.10"
 dependencies = []

diff --git a/plugins/apple-dev-skills/uv.lock b/plugins/apple-dev-skills/uv.lock
diff --git a/plugins/cardhop-app/.codex-plugin/plugin.json b/plugins/cardhop-app/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "cardhop-app",
-  "version": "9.21.0",
+  "version": "9.22.0",
   "description": "Cardhop.app workflow guidance plus a bundled local MCP server for contact capture and updates on macOS.",
   "author": {
     "name": "Gale",

diff --git a/plugins/cardhop-app/mcp/pyproject.toml b/plugins/cardhop-app/mcp/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "cardhop-app-mcp"
-version = "9.21.0"
+version = "9.22.0"
 requires-python = ">=3.13"
 dependencies = [
     "fastmcp>=3.0.2",

diff --git a/plugins/cardhop-app/mcp/uv.lock b/plugins/cardhop-app/mcp/uv.lock
diff --git a/plugins/cloud-deployment-skills/.codex-plugin/plugin.json b/plugins/cloud-deployment-skills/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "cloud-deployment-skills",
-  "version": "9.21.0",
+  "version": "9.22.0",
   "description": "Codex skills for routing cloud deployment work through official provider plugins, MCP servers, CLIs, and Socket-owned deployment guidance.",
   "author": {
     "name": "Gale",
@@ -18,6 +18,8 @@
     "deployment",
     "aws",
     "agent-toolkit",
+    "azure",
+    "azure-mcp",
     "mcp",
     "cloudflare",
     "vercel",
@@ -27,7 +29,7 @@
   "interface": {
     "displayName": "Cloud Deployment Skills",
     "shortDescription": "Cloud provider and deployment routing guidance for Codex.",
-    "longDescription": "Guide Codex agents through cloud deployment routing, official provider plugin selection, credential and mutation safety checks, and provider handoffs. The first slice delegates AWS work to the official AWS Agent Toolkit for AWS and keeps Socket focused on thin cross-provider deployment decisions instead of duplicating AWS MCP, AWS CLI, or AWS SAM setup.",
+    "longDescription": "Guide Codex agents through cloud deployment routing, official provider plugin selection, credential and mutation safety checks, and provider handoffs. Socket delegates AWS work to the official AWS Agent Toolkit and Azure work to Microsoft's Azure Skills plugin, keeping Socket focused on thin cross-provider decisions instead of duplicating provider MCP, CLI, or deployment workflows.",
     "developerName": "gaelic-ghost",
     "category": "Developer Tools",
     "capabilities": [
@@ -36,7 +38,7 @@
     ],
     "websiteURL": "https://github.com/gaelic-ghost/socket/tree/main/plugins/cloud-deployment-skills",
     "defaultPrompt": [
-      "Choose the right cloud deployment path and route AWS work through the official AWS Agent Toolkit when appropriate.",
+      "Choose the right cloud deployment path and route AWS or Azure work through the applicable official provider plugin when appropriate.",
       "Decide whether this deployment should use an official provider plugin, provider CLI, MCP server, framework-owned deploy workflow, or a Socket-owned provider skill."
     ],
     "brandColor": "#22D3EE",

diff --git a/plugins/cloud-deployment-skills/AGENTS.md b/plugins/cloud-deployment-skills/AGENTS.md
@@ -15,7 +15,9 @@ This file is the Cloud Deployment Skills child-repo override for work done from
 - Match the `socket` shared semantic version exactly; use the Socket root release workflow for version inventory and bumps.
 - Prefer official provider plugins, MCP servers, CLIs, and docs before adding Socket-authored setup guidance.
 - For AWS work, route Codex users to the official `aws/agent-toolkit-for-aws` marketplace and its `aws-core` plugin before considering Socket-owned AWS guidance.
+- For Azure work, route Codex users to the official `microsoft/azure-skills` marketplace and its `azure` plugin before considering Socket-owned Azure guidance.
 - Do not bundle AWS MCP configuration, AWS CLI setup instructions, AWS SAM setup instructions, or copied AWS Agent Toolkit skills in this plugin while the official AWS plugin owns that surface.
+- Do not bundle Azure MCP configuration, Azure CLI or Azure Developer CLI setup instructions, or copied Azure Skills content while the official Microsoft plugin owns that surface.
 - Treat provider credentials, account configuration, API mutation, billing, and production deployment as high-impact operations. Verify the target account, region, profile, project, and intended mutation before taking action.
 - Keep provider-specific skills small and explicit. Add a new provider workflow only when it removes real routing ambiguity or covers a provider that does not already offer a first-party agent plugin.
 - Do not commit machine-local credentials, profiles, `.env` files, cloud state, generated deployment artifacts, or local cache paths.