feat(advisor): port migration-to-aws skills into aws-startup-advisor

.agents/scratchpad/h1-relabels-before.txt

@@ -0,0 +1,20 @@
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:39:# Terraform) handed off to the migration skill. AgentCore, Lambda MicroVMs, and
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:41:# Runtimes that hand the compute layer to the migration skill (their service cards say so):
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:74:    the migration skill — i.e. is in HANDOFF_RUNTIMES. Mirrors the single-unit path's handoff node so
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:75:    a multi-unit ECS/EKS/Fargate/Batch system shows the same 'configured by the migration skill'
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:123:        lines.append('    handoff["Compute configured by the migration skill"]')
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:149:        lines.append("Note: compute configured by the migration skill")
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:292:    # HANDOFF_RUNTIME (ecs/eks/fargate/batch) has its compute configured by the migration skill.
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:295:        lines.append('    handoff["Compute configured by the migration skill"]')
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:378:    # any unit on a HANDOFF_RUNTIME has its compute configured by the migration skill.
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/scripts/build_diagram.py:382:        lines.append("Note: compute configured by the migration skill — " +
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/decision-refs/batch.md:36:Hands off to the source-platform migration skill (`gcp-to-aws` or `heroku-to-aws`) for compute-layer config.
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/decision-refs/ecs.md:27:Hands off to the source-platform migration skill (`gcp-to-aws` or `heroku-to-aws`) for compute-layer config.
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/decision-refs/eks.md:27:Hands off to the source-platform migration skill (`gcp-to-aws` or `heroku-to-aws`) for compute-layer config.
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/decision-refs/lambda.md:27:Hands off to the source-platform migration skill (`gcp-to-aws` or `heroku-to-aws`) for compute-layer config.
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/design/design.md:323:primary unit's winning runtime. These runtimes hand the compute layer to the source-platform migration skill — `gcp-to-aws` or `heroku-to-aws` (their
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/estimate/estimate.md:39:reaches here. Magnitude only — NOT precise estimation (that's the migration skills' job). Mirrors
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/estimate/estimate.md:40:the migration skills' pricing pattern.
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/estimate/estimate.md:48:## Step 2 — Pricing source (layered, same as the migration skills)
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/estimate/estimate.md:181:> the migration skills, which also estimate in-skill). It is the one output that is NOT
+advisor/plugins/aws-startup-advisor/skills/agent-advisor/references/phases/estimate/estimate.md:286:  "note": "Order-of-magnitude only. For a precise estimate use the migration skills (gcp-to-aws or heroku-to-aws)."

.checkov.yaml

@@ -16,3 +16,8 @@ skip-path:
   # drift vs the canned gcloud captures is the test — sanitizing it to satisfy
   # Checkov would change the source-provider state the fixture exists to model.
   - migrate/plugins/migration-to-aws/fixtures/gcp-live-capture/workspace-terraform
+  # Same fixtures, consolidated into the aws-startup-advisor plugin (the migration
+  # skills were merged in). Identical rationale — intentionally non-compliant test
+  # data that is never deployed.
+  - advisor/plugins/aws-startup-advisor/skills/tf-best-practices/fixtures/terraform-policy
+  - advisor/plugins/aws-startup-advisor/fixtures/gcp-live-capture/workspace-terraform

.claude-plugin/marketplace.json

@@ -14,8 +14,8 @@
     {
       "name": "aws-startup-advisor",
       "source": "./advisor/plugins/aws-startup-advisor",
-      "version": "1.5.4",
-      "description": "Personalized AWS guidance built on patterns from 350,000+ startups—architecture, cost, security, and migration, from day-one account setup to production-ready infrastructure. Includes AWS Activate credits eligibility and 60+ exclusive startup offers. Built by AWS Startup Solutions Architects, with multi-account, multi-region support."
+      "version": "2.0.0",
+      "description": "Personalized AWS guidance built on patterns from 350,000+ startups—architecture, cost, security, and migration, now including the full migration toolkit. Build on AWS (day-one setup, security baselines, production architecture, cost optimization) and migrate to AWS from GCP, Heroku, or other providers: infrastructure (Cloud Run/Dynos → Fargate, databases → RDS/Aurora), OpenAI/Gemini workloads to Amazon Bedrock, agentic systems (LangChain, CrewAI, AutoGen), and Temporal workers. Plus knowledge-base-for-startups (Activate FAQ, credits, offers, sample architectures, learn articles), prompt-library-for-startups (copy-paste prompts + installable agents), start-building-for-startups (interactive scaffolding), and agent-advisor (agent runtime selection). Includes AWS Activate credits eligibility and 60+ exclusive startup offers. Built by AWS Startup Solutions Architects, with multi-account, multi-region support."
     },
     {
       "name": "aws-dev-toolkit",

.github/workflows/pricing-staleness.yml

@@ -1,4 +1,4 @@
-# Scheduled freshness gate for the migration-to-aws pricing caches.
+# Scheduled freshness gate for the migration-to-aws and aws-startup-advisor pricing caches.
 #
 # The estimate phases price from vendored caches whose freshness contracts
 # (_meta.last_updated + staleness_days, or a "Last updated" line with a
@@ -27,5 +27,10 @@ jobs:
         with:
           node-version: 24
       # Zero-dep TS tool (Node 24 native type-stripping) — no install step.
-      - name: Check pricing cache freshness (strict)
+      # Two separate steps so a stale cache in one plugin doesn't mask the other
+      # (default shell is `bash -e`; a failing first command would skip the second
+      # in a single run block). Each plugin's caches get their own strict gate.
+      - name: Check migration-to-aws pricing cache freshness (strict)
         run: node migrate/plugins/migration-to-aws/tools/pricing-staleness.ts --strict
+      - name: Check aws-startup-advisor pricing cache freshness (strict)
+        run: node advisor/plugins/aws-startup-advisor/tools/pricing-staleness.ts advisor/plugins/aws-startup-advisor --strict

.github/workflows/security-scanners.yml

@@ -68,31 +68,36 @@ jobs:
           python-version: '3.x'
       - name: Run bandit
         id: bandit
-        # Two-pass scan so per-plugin skips don't leak elsewhere in the repo.
+        # Three-pass scan so per-plugin skips don't leak elsewhere in the repo.
         # Pass 1: migration-to-aws scripts with the plugin's own config (B101/B105 skipped — see bandit.yml).
-        # Pass 2: everything else with no skips, so future Python anywhere gets full bandit strictness.
-        # migrate/plugins/migration-to-aws/tests/ is additionally excluded from pass 2: it is a
-        # pytest suite (assert is the assertion mechanism, not a guard) that also contains a test
-        # fixture string starting with "pass" (false-positive B105) and a subprocess.run() call with
-        # a fixed arg list and no shell=True (the secure form, not the risky one — B404/B603). The
-        # production script it tests (scripts/validate-migration-report.py) is NOT excluded and stays
-        # under full strictness.
-        # The two SARIF outputs are merged into one for upload.
+        # Pass 2: aws-startup-advisor scripts with its own config (same skips — the migration skills
+        #         were consolidated into this plugin, carrying the same pytest suites).
+        # Pass 3: everything else with no skips, so future Python anywhere gets full bandit strictness.
+        # Each plugin's tests/ is additionally excluded from pass 3: they are pytest suites (assert is
+        # the assertion mechanism, not a guard) that also contain a test fixture string starting with
+        # "pass" (false-positive B105) and a subprocess.run() call with a fixed arg list and no
+        # shell=True (the secure form, not the risky one — B404/B603). The production script each tests
+        # (scripts/validate-migration-report.py) is NOT excluded and stays under full strictness.
+        # The three SARIF outputs are merged into one for upload.
         run: |
           pip install "bandit[sarif]==1.9.3"
           PLUGIN_DIR=migrate/plugins/migration-to-aws
           PLUGIN_CFG=$PLUGIN_DIR/bandit.yml
+          ADVISOR_DIR=advisor/plugins/aws-startup-advisor
+          ADVISOR_CFG=$ADVISOR_DIR/bandit.yml
           set +e
           bandit -r "$PLUGIN_DIR" -c "$PLUGIN_CFG" -x "$PLUGIN_DIR/tests" -f sarif -o bandit-plugin.sarif
           PLUGIN_EXIT=$?
-          bandit -r . --exclude "./$PLUGIN_DIR,./migrate/plugins/migration-to-aws/tests" -f sarif -o bandit-other.sarif
+          bandit -r "$ADVISOR_DIR" -c "$ADVISOR_CFG" -x "$ADVISOR_DIR/tests" -f sarif -o bandit-advisor.sarif
+          ADVISOR_EXIT=$?
+          bandit -r . --exclude "./$PLUGIN_DIR,./$PLUGIN_DIR/tests,./$ADVISOR_DIR,./$ADVISOR_DIR/tests" -f sarif -o bandit-other.sarif
           OTHER_EXIT=$?
           set -e
-          # Merge: keep pass-1 envelope, concatenate results from pass-2.
-          jq -s '.[0] as $p | .[1] as $o | $p | .runs[0].results += $o.runs[0].results' \
-            bandit-plugin.sarif bandit-other.sarif > bandit-report.sarif
-          # Surface non-zero from either pass.
-          if [ "$PLUGIN_EXIT" -ne 0 ] || [ "$OTHER_EXIT" -ne 0 ]; then
+          # Merge: keep pass-1 envelope, concatenate results from passes 2 and 3.
+          jq -s '.[0] as $p | .[1] as $a | .[2] as $o | $p | .runs[0].results += ($a.runs[0].results + $o.runs[0].results)' \
+            bandit-plugin.sarif bandit-advisor.sarif bandit-other.sarif > bandit-report.sarif
+          # Surface non-zero from any pass.
+          if [ "$PLUGIN_EXIT" -ne 0 ] || [ "$ADVISOR_EXIT" -ne 0 ] || [ "$OTHER_EXIT" -ne 0 ]; then
             BANDIT_EXIT=1
           else
             BANDIT_EXIT=0

README.md

@@ -4,11 +4,11 @@ AI agent plugins, tools, and resources for startup builders on AWS.
 
 ## Plugins
 
-| Plugin                                        | Description                                                                                                                                                                                                                                                                                                                    | Status    |
-| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- |
-| **[aws-startup-advisor](advisor/)**           | Personalized AWS guidance built on patterns from 350,000+ startups — architecture, cost, security, and migration, from day-one account setup to production-ready infrastructure                                                                                                                                                | Available |
-| **[migration-to-aws](migrate/)**              | Assess, plan & execute: migrate GCP/Heroku infrastructure and AI workloads to AWS (discovery, architecture mapping, cost analysis, Terraform), rewrite LLM SDK calls to Amazon Bedrock, and select an AWS runtime + build a POC for AI agents. Bundles the gcp-to-aws, heroku-to-aws, llm-to-bedrock, and agent-advisor skills | Available |
-| **[aws-dev-toolkit](solution-architecture/)** | AWS development toolkit — 35 skills, 11 agents, and 3 MCP servers for building, migrating, and architecture reviews on AWS                                                                                                                                                                                                     | Available |
+| Plugin                                        | Description                                                                                                                                                                                                                                                                                                                                                                          | Status    |
+| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- |
+| **[aws-startup-advisor](advisor/)**           | Startup-focused build + migrate guidance built on patterns from 350,000+ startups: AWS Activate credits & offers, a knowledge base (sample architectures, learn articles), a copy-paste prompt library, stage-aware architecture advice, and interactive scaffolding — plus the full migration toolkit (gcp-to-aws, heroku-to-aws, llm-to-bedrock, agent-advisor, tf-best-practices) | Available |
+| **[migration-to-aws](migrate/)**              | Assess, plan & execute: migrate GCP/Heroku infrastructure and AI workloads to AWS (discovery, architecture mapping, cost analysis, Terraform), rewrite LLM SDK calls to Amazon Bedrock, and select an AWS runtime + build a POC for AI agents. Bundles the gcp-to-aws, heroku-to-aws, llm-to-bedrock, and agent-advisor skills                                                       | Available |
+| **[aws-dev-toolkit](solution-architecture/)** | AWS development toolkit — 35 skills, 11 agents, and 3 MCP servers for building, migrating, and architecture reviews on AWS                                                                                                                                                                                                                                                           | Available |
 
 ## Installation
 

advisor/AGENTS.md

@@ -51,18 +51,42 @@ Sibling skills, each with its own SKILL.md and (where applicable) `references/`
 - A SOP-style SKILL.md that drives a picker-based discovery flow (intent, scope, constraints, preferences) and then writes code into the user's codebase. No `references/` content — it's pure workflow.
 - Calls into `knowledge-base-for-startups` and `prompt-library-for-startups` mid-flow when an architecture reference or a starter prompt would accelerate the work.
 
-### `migration-to-aws` — GCP-to-AWS migration workflow
+### `architect-for-startups` — stage-aware AWS architecture guidance
+
+- Stage-aware architecture advice that adjusts recommendations based on startup stage (pre-revenue, seed, Series A, Series B+), team size, runway, credits, and timeline. Consulted for architecture questions that aren't a full build (`start-building-for-startups`) or a migration.
+
+### `gcp-to-aws` — Google Cloud → AWS migration workflow
 
 - A SOP-style SKILL.md that runs a structured 6-phase migration (discover → clarify → design → estimate → generate → feedback), with a `references/` tree of phase guides, design refs, and shared schemas. Clarify must complete before Design, Estimate, or Generate.
 - Also migrates AI / agentic workloads (OpenAI / Gemini → Amazon Bedrock; LangChain / CrewAI / AutoGen → AWS-native frameworks).
-- **Depends on MCP servers** declared in the plugin's `.mcp.json`: `awsknowledge` (HTTP) and `awspricing` (stdio via `uvx`). These are provisioned when the plugin is installed; the AWS Pricing server needs `uv`/`uvx` on the machine.
 - Triggered by migration intent — _"migrate from GCP"_, _"move off OpenAI to Bedrock"_, _"GCP to AWS"_, etc.
 
+### `heroku-to-aws` — Heroku → AWS migration workflow
+
+- A DSL-driven SKILL.md running the same 6-phase backbone (Dynos → Fargate/Elastic Beanstalk, Postgres → RDS/Aurora, Redis → ElastiCache, Kafka → MSK), with an optional what-if repricing workshop after Estimate.
+- Triggered by _"migrate from Heroku"_, _"Heroku to AWS"_, _"move off Heroku"_, etc.
+
+### `llm-to-bedrock` — OpenAI/Gemini/Anthropic → Amazon Bedrock SDK rewrite
+
+- Executes a pure model/SDK migration: assess the codebase, rewrite call sites, evaluate output quality against Bedrock, and deliver a ready-to-merge git branch. Delegates its Assess phase to the `gcp-to-aws` skill.
+- Triggered by _"rewrite my OpenAI calls for Bedrock"_, _"migrate LangChain to Bedrock"_, etc.
+
+### `agent-advisor` — AI-agent runtime advisor + migration plan + POC
+
+- A DSL-driven skill that picks an AWS runtime for AI agents (AgentCore vs ECS/EKS/Lambda vs Lambda MicroVMs), can generate a full migration plan (reusing the `gcp-to-aws` engine in-skill), and optionally builds a deployable POC. Also handles Temporal workers.
+- Triggered by _"which runtime for my agent"_, _"AgentCore vs Lambda"_, _"deploy an AI agent on AWS"_, _"migrate Temporal workers to AWS"_, etc.
+
+### `tf-best-practices` — Terraform authoring guidance + policy gate
+
+- Best-practice authoring rules and a read-only policy gate for the AWS Terraform generated by the migration skills. Never edits `.tf` files or decides phase completion.
+
+- **The migration skills depend on MCP servers** declared in the plugin's `.mcp.json`: `awsknowledge` (HTTP), `awspricing` (stdio via `uvx`), `aws-pricing-calculator` (stdio via `npx`), and `temporal-docs` (HTTP, for `agent-advisor`). Provisioned when the plugin is installed; the AWS Pricing server needs `uv`/`uvx` on the machine.
+
 ### Cross-skill behavior
 
 - Every reference file in `knowledge-base-for-startups/` and `prompt-library-for-startups/` carries a `source_url` in frontmatter — quote that, don't invent URLs.
 - Boundary queries (a user message that fits two skills) — invoke both. Example: _"how do I start with RAG on Bedrock?"_ → `knowledge-base-for-startups` for the learn article + `prompt-library-for-startups` for the starter prompt.
-- Migration intent (GCP → AWS, OpenAI/Gemini → Bedrock) routes to `migration-to-aws`.
+- Migration intent routes to the matching skill: GCP → `gcp-to-aws`, Heroku → `heroku-to-aws`, OpenAI/Gemini/Anthropic SDK rewrite → `llm-to-bedrock`, AI-agent runtime/architecture → `agent-advisor`.
 
 ## Known limitations