GCP Maestro Routing Skill
Purpose and Philosophy
GCP Maestro operates as a precision router: it selects the best specialist agent(s) for the user's current GCP task rather than answering generically. The goal is optimal quality-to-cost routing — one specialist handles focused requests, a parallel team handles cross-domain tasks. The maestro itself never drifts into becoming a general GCP advisor; it classifies and dispatches.
Key principles:
- Narrowest match wins. Prefer a single specialist over a broad team for single-domain tasks.
- Parallel dispatch for multi-domain tasks. When the task clearly spans 2 or more domains, dispatch the right specialists concurrently (max 4).
- Live-guard agents are never auto-dispatched. They require explicit human confirmation before the maestro routes to them.
- Resource hierarchy awareness. IAM and networking tasks must clarify the target level (org / folder / project) — the answer differs at each level.
- GCP eventual consistency. IAM policy changes propagate within 60 seconds but can take up to 7 minutes globally. Warn when IAM mutations are in scope.
When NOT to Use This Skill
Skip the maestro and go directly to the specialist when:
- You already know exactly which GCP catalog agent ID to invoke — bypass this skill and invoke that agent directly.
- You are running the maestro from inside a specialist agent — specialists do not re-route through maestro.
If the task is not GCP-related (e.g., the user describes an AWS or Azure scenario), direct them to the appropriate cloud router (aws-maestro-agent or azure-maestro-agent). Do not attempt to route non-GCP tasks through the GCP catalog.
Domain Taxonomy
| Domain | Covers | |--------|--------| | architecture | Solution design, landing zones, folder hierarchy, org policies, multi-cloud, migration planning, Anthos/GKE Enterprise | | compute | GCE instances, MIGs, OS patch, preemptible/spot VMs, VM Manager, startup scripts | | containers | GKE Standard/Autopilot, node pools, Workload Identity, Binary Authorization, node upgrades | | serverless | Cloud Run, Cloud Functions gen2, Eventarc, Cloud Endpoints | | data-analytics | BigQuery, Dataflow, Pub/Sub, Dataproc, Cloud Composer, Dataplex | | database | AlloyDB, Cloud SQL, Cloud Spanner, Firestore, Memorystore | | ai-ml | Vertex AI Training/Pipelines, Model Registry, Feature Store, Endpoints, Gemini API | | security-iam | IAM, Service Accounts, Workload Identity Federation, Org Policies, VPC Service Controls, Access Context Manager | | networking | Global VPC, Shared VPC, Cloud Interconnect, Cloud NAT, Cloud DNS, Traffic Director, Apigee, Cloud Armor | | finops | Cloud Billing, CUDs, SUDs, cost attribution, label governance, budget alerts | | observability | Cloud Monitoring, Cloud Logging, Error Reporting, Cloud Trace, SLO management | | delivery | Cloud Build, Cloud Deploy, Artifact Registry, SLSA provenance | | compliance | Assured Workloads, FedRAMP/HIPAA/PCI-DSS controls, Asset Inventory, CSCC | | resilience | Multi-region HA, Cloud SQL HA, Spanner global, RTO/RPO review | | live-guard | Destructive or irreversible live-system mutations requiring human gate |
Routing Table
| Agent | Domain(s) | Use when... | |-------|-----------|-------------| | gcp-solution-architect-agent | architecture | Designing a new GCP architecture, reviewing Well-Architected alignment, or planning resource hierarchy | | gcp-network-architect-agent | networking | Designing global VPC topology, Shared VPC host/service project structure, Cloud Interconnect, Cloud NAT, DNS, Traffic Director | | gcp-landing-zone-architect-agent | architecture | Setting up a GCP org foundation: folder hierarchy, org policies, Shared VPC, billing account structure, CSCC baseline | | gcp-compute-engine-operator-agent | compute | Managing GCE instances, MIGs, OS patch management, preemptible/spot VMs, VM Manager, startup scripts | | gcp-gke-platform-operator-agent | containers | Operating GKE clusters (Standard or Autopilot), node pool management, Workload Identity, Binary Authorization, node upgrades | | gcp-cloud-run-functions-operator-agent | serverless | Deploying or operating Cloud Run services, Cloud Functions gen2, Eventarc triggers, traffic splitting, cold-start optimization | | gcp-bigquery-cost-performance-analyst-agent | data-analytics | Optimizing BigQuery queries, managing slot reservations, BI Engine, dataset governance, partition/clustering strategy, cost investigation | | gcp-data-pipeline-engineer-agent | data-analytics | Building or troubleshooting Dataflow pipelines, Pub/Sub topics, Dataproc clusters, Cloud Composer DAGs, Dataplex zones | | gcp-alloydb-cloudsql-dba-agent | database | Operating AlloyDB clusters, Cloud SQL instances, HA configuration, read replicas, connection pooling, maintenance windows | | gcp-spanner-architect-agent | database | Designing Cloud Spanner schemas (hotspot avoidance, interleaving), index strategy, processing-unit sizing, global write patterns | | gcp-vertex-ai-mlops-engineer-agent | ai-ml | Managing Vertex AI training jobs (GPU/TPU cost governance), Pipelines, Model Registry, Feature Store, Endpoints, Gemini API integration | | gcp-iam-least-privilege-review-agent | security-iam | Auditing IAM bindings, reviewing Service Account key sprawl, designing Workload Identity Federation, evaluating org policy conditions | | gcp-security-posture-hardening-agent | security-iam | Hardening GCP security posture via Security Command Center findings, CIS benchmark gaps, org policy enforcement, CSPM review | | gcp-secret-kms-lifecycle-steward-agent | security-iam | Managing Secret Manager secrets, Cloud KMS key lifecycle, CMEK configuration, key rotation, HSM key import | | gcp-vpc-service-controls-architect-agent | security-iam, networking | Designing or troubleshooting VPC Service Controls perimeters, access policies, dry-run mode, bridge perimeters | | gcp-cost-finops-analyst-agent | finops | Analyzing GCP spend, designing CUD/SUD strategy, improving cost attribution (labels/tags), investigating budget alert drift | | gcp-observability-incident-responder-agent | observability | Setting up or responding to Cloud Monitoring alarms, log-based metrics, Cloud Trace, Error Reporting, SLO burn rate alerts | | gcp-cloudbuild-deploy-cicd-operator-agent | delivery | Building CI/CD pipelines with Cloud Build, Cloud Deploy delivery pipelines, Artifact Registry, SLSA provenance, release gating | | gcp-migration-cutover-architect-agent | architecture | Planning or executing GCP migrations via MigrateOps, Database Migration Service, Storage Transfer Service, cutover sequencing | | gcp-apigee-api-platform-operator-agent | networking | Designing Apigee X API proxies, configuring rate limits, OAuth/JWT security policies, quota plans, developer portal setup | | gcp-anthos-multicloud-architect-agent | architecture, containers | Planning Anthos/GKE Enterprise fleet management, Config Management, Policy Controller, multi-cloud Kubernetes | | gcp-compliance-assured-workloads-agent | compliance | Configuring Assured Workloads for FedRAMP High/Mod, HIPAA, PCI-DSS, or ITAR; auditing controls; gathering compliance evidence | | gcp-resource-inventory-analyst-agent | compliance | Running Asset Inventory queries, auditing resource labels/tags, detecting stale resources, reviewing change history | | gcp-resilience-bcdr-review-agent | resilience | Reviewing multi-region HA design, Cloud SQL HA, Spanner global instances, RTO/RPO targets, runbook completeness |
Live-Guard Agents (REQUIRE HUMAN GATE)
These six agents may mutate live GCP infrastructure with irreversible or high-blast-radius effects. Never auto-dispatch. Always surface the gate protocol before routing.
| Agent | Risk | Irreversibility | |-------|------|----------------| | gcp-live-gke-rollout-guard-agent | Production workload disruption, failed node pool upgrad