herosjourney · Oct 15, 2026 · Oct 15, 2026 · Oct 19, 2026 · Oct 19, 2026 · Oct 20, 2026
@@ -20,10 +20,10 @@ The twelve skills below are the catalog. Install them together.
 | 1 | `architect-for-startups` | Stage-aware AWS architecture guidance for non-agent workloads, tuned to team size, runway, and credits — advice rather than code changes. An AI agent as the workload goes to `agent-advisor` | [SKILL.md](skills/architect-for-startups/SKILL.md) |
 | 2 | `start-building-for-startups` | Interactive discovery flow that gathers requirements, scans the codebase, then writes an AWS scaffold and implementation into the project | [SKILL.md](skills/start-building-for-startups/SKILL.md) |
 | 3 | `agent-advisor` | Runtime selection, migration planning, and an executable proof of concept for AI-agent workloads on AWS | [SKILL.md](skills/agent-advisor/SKILL.md) |
-| 4 | `azure-to-aws` | Six-phase Microsoft Azure to AWS migration. Discovery reads Terraform (`azurerm_*`), a live `az` CLI capture (read-only, consent-gated), a customer-supplied RDfA report (read-only, file-only), and application code — not Bicep, ARM templates, or Azure billing exports. Direct OpenAI, OpenRouter, and Anthropic usage-API discovery (read-only, consent-gated) supplement real AI spend. Generate is opt-in, and the what-if workshop is optional | [SKILL.md](skills/azure-to-aws/SKILL.md) |
+| 4 | `azure-to-aws` | Six-phase Microsoft Azure to AWS migration. Discovery reads Terraform (`azurerm_*`), a live `az` CLI capture (read-only, consent-gated), a customer-supplied RDfA report archive (read-only, file-only), and application code — not Bicep, ARM templates, or Azure billing exports. Direct OpenAI, OpenRouter, and Anthropic usage-API discovery (read-only, consent-gated) can supplement AI spend; user-stated Azure spend can supply the infrastructure baseline. Generate is opt-in, and the what-if workshop is optional | [SKILL.md](skills/azure-to-aws/SKILL.md) |
 | 5 | `gcp-to-aws` | Six-phase Google Cloud to AWS migration. Discovery reads Terraform, a live `gcloud` capture (read-only, consent-gated), application code, and billing exports. Direct OpenAI, OpenRouter, and Anthropic usage-API discovery (read-only, consent-gated) supplement real AI spend. Generate is opt-in. BigQuery is not mapped to an AWS analytics service | [SKILL.md](skills/gcp-to-aws/SKILL.md) |
 | 6 | `heroku-to-aws` | Six-phase Heroku to AWS migration with deterministic add-on mapping and an optional what-if repricing workshop | [SKILL.md](skills/heroku-to-aws/SKILL.md) |
-| 7 | `llm-to-bedrock` | Rewrite OpenAI, Gemini, or Anthropic API call sites to Amazon Bedrock, evaluate quality, and deliver a git branch. The full migration requires `gcp-to-aws` or `azure-to-aws` alongside it (`gcp-to-aws` preferred when both are installed). Access-only mode (enable model access, no rewrite) does not | [SKILL.md](skills/llm-to-bedrock/SKILL.md) |
+| 7 | `llm-to-bedrock` | Rewrite OpenAI, Gemini, or Anthropic API call sites to Amazon Bedrock, evaluate quality, and deliver a git branch. A Fresh standalone full migration surfaces this offer: Complete your migration assessment to see whether you qualify for AWS migration credits. Final eligibility is determined by AWS. This LLM-only flow creates no uploadable `plan.json`. The full migration requires `gcp-to-aws` or `azure-to-aws` alongside it (`gcp-to-aws` preferred when both are installed). Access-only mode (enable model access, no rewrite) does not | [SKILL.md](skills/llm-to-bedrock/SKILL.md) |
 | 8 | `tf-best-practices` | AWS Terraform authoring posture, security-baseline spec, and a read-only policy gate over generated Terraform | [SKILL.md](skills/tf-best-practices/SKILL.md) |
 | 9 | `operate-on-aws` | Incident investigation, root-cause analysis, and release-readiness review with AWS DevOps Agent, with cost, access, and code-egress disclosed up front | [SKILL.md](skills/operate-on-aws/SKILL.md) |
 | 10 | `knowledge-base-for-startups` | AWS Activate FAQ, credits guide, programs, partner offers, sample architectures, and AWS-curated learn articles | [SKILL.md](skills/knowledge-base-for-startups/SKILL.md) |
@@ -133,13 +133,13 @@ The `azure-to-aws`, `gcp-to-aws`, and `heroku-to-aws` skills run the same six-ph
 
 ### How It Works
 
-- **Discover** — `azure-to-aws` reads Terraform (`azurerm_*`) and application code, can capture a live subscription through the `az` CLI (read-only, consent-gated), and can parse a customer-supplied Resource Discovery for Azure (RDfA) report (read-only, file-only). It does not read Bicep or ARM templates or Azure billing exports. `gcp-to-aws` reads Terraform, application code, and billing exports, and can capture a live project through `gcloud` (read-only, consent-gated). BigQuery is recorded and left for a specialist; the skill does not pick an AWS analytics service for it. `azure-to-aws` and `gcp-to-aws` can also read aggregate AI spend when the app calls OpenAI directly, calls it through OpenRouter, or calls the Anthropic API — from the OpenAI Admin API (Usage Read), the OpenRouter API, or the Anthropic Admin API. Each is consent-gated and optional, and none replaces the code scan. `heroku-to-aws` discovers through the authenticated Heroku CLI (read-only, consent-gated) or from `Procfile` and `app.json`.
+- **Discover** — `azure-to-aws` reads Terraform (`azurerm_*`) and application code, can capture a live subscription through the `az` CLI (read-only, consent-gated), and can parse a customer-supplied Resource Discovery for Azure (RDfA) report archive (read-only, file-only). It does not read Bicep or ARM templates or Azure billing exports; user-stated Azure spend can establish the infrastructure baseline. `gcp-to-aws` reads Terraform, application code, and billing exports, and can capture a live project through `gcloud` (read-only, consent-gated). BigQuery is recorded and left for a specialist; the skill does not pick an AWS analytics service for it. `azure-to-aws` and `gcp-to-aws` can also read aggregate AI spend when the app calls OpenAI directly, calls it through OpenRouter, or calls the Anthropic API — from the OpenAI Admin API (Usage Read), the OpenRouter API, or the Anthropic Admin API. Each is consent-gated and optional, and none replaces the code scan. `heroku-to-aws` discovers through the authenticated Heroku CLI (read-only, consent-gated) or from `Procfile` and `app.json`.
 - **Clarify** — Resolves the requirements that change the target architecture: availability, compliance, data residency, cutover tolerance, and team capacity.
 - **Design** — Maps source resources to AWS services using deterministic mapping tables — for example Heroku dynos to AWS Elastic Beanstalk, Heroku Postgres to Amazon RDS or Aurora, Heroku Redis to Amazon ElastiCache, Heroku Kafka to Amazon MSK, Cloud SQL to Amazon RDS, GKE to Amazon EKS, Cloud Run to AWS Fargate, Azure App Service to AWS Elastic Beanstalk, AKS to Amazon EKS, Azure SQL to Amazon RDS, and Cosmos DB to Amazon DynamoDB or DocumentDB.
 - **Estimate** — Costs the target architecture from the plugin's bundled rate reference data and a documented cost algorithm, with an estimation schema and complexity tiers so two runs of the same workload agree. Estimates are planning figures; confirm them against the [AWS Pricing Calculator](https://calculator.aws/) before committing budget.
 - **Generate** — Emits migration artifacts, including Terraform, gated by the `tf-best-practices` policy check and a validated migration report. On the infrastructure route, `heroku-to-aws`, `gcp-to-aws`, and `azure-to-aws` also emit `baseline.tf` — an account-wide security baseline (GuardDuty, CloudTrail, IMDSv2, EBS encryption, budget alerts) — with AWS Config and Security Hub controls added when the declared compliance set includes SOC 2, PCI, HIPAA, or FedRAMP. `gcp-to-aws`'s AI-only and billing-only routes emit monitoring or skeleton Terraform instead and skip the baseline.
 - **Workshop mode** — After estimate, `azure-to-aws`, `gcp-to-aws`, and `heroku-to-aws` can reprice region, high-availability, compute, and AWS Graviton scenarios without repeating discovery.
-- **Credits handoff** — When estimate finishes, `gcp-to-aws` and `heroku-to-aws` can write `plan.json` and offer a link to apply for up to $1,500 in AWS migration credits. Generate writes the same file again when it completes. `azure-to-aws` does not yet — the import contract's accepted `sourcePlatform` values are not confirmed to include Azure.
+- **Credits handoff** — Complete your migration assessment to see whether you qualify for AWS migration credits. Final eligibility is determined by AWS. At the start of an infrastructure or mixed GCP or Heroku assessment, the skill explains that completion can produce `plan.json`, which can be uploaded to [AWS Startups Migrate](https://startups.aws.com/startups/en-US/migrate/credits?source=plugin). GCP and Heroku currently write importable plans at Estimate when the user chooses done-for-now and again after Generate completes. Azure keeps the same fail-open handoff gates, but its writer returns `PLAN_SKIP` until the downstream importer accepts Azure plans.
 
 ### Examples
 
@@ -153,6 +153,8 @@ The `azure-to-aws`, `gcp-to-aws`, and `heroku-to-aws` skills run the same six-ph
 
 The `llm-to-bedrock` skill is a focused model and SDK rewrite. It assesses the codebase, rewrites OpenAI, Gemini, or Anthropic API call sites to Amazon Bedrock, evaluates the rewritten behavior against a golden prompt set, and delivers a ready-to-review git branch with a migration report.
 
+At the beginning of a Fresh standalone full migration, the skill surfaces the AWS Startups Migrate offer. Complete your migration assessment to see whether you qualify for AWS migration credits. Final eligibility is determined by AWS. Visit [AWS Startups Migrate](https://startups.aws.com/startups/en-US/migrate/credits?source=plugin) to get started. Unlike infrastructure or mixed assessments, this standalone LLM migration currently creates no uploadable `plan.json`; the offer is a link, not a plan-file handoff. It is not shown for Resume, access-only, or delegated journeys.
+
 **A full migration requires `gcp-to-aws` or `azure-to-aws` installed alongside it.** Assess runs whichever sibling is present's discover, clarify, design, and estimate phases in the same session (`gcp-to-aws` preferred when both are installed), and installing `llm-to-bedrock` on its own stops there. Access-only mode does not need either sibling: it checks the models you name, walks the access step for each, and stops, with no rewrite and no branch. Install the pair for a migration:
 
 ```bash

@@ -66,12 +66,6 @@
 # sourcePlatform. Not generated data: each skill records its own id at _init and
 # never changes it. LLM_TO_BEDROCK (OpenAI) is intentionally absent — it has no
 # persisted cost artifact to copy, so it is a follow-up.
-# AZURE_TO_AWS is intentionally absent: the import contract's accepted sourcePlatform
-# values are not confirmed to include AZURE (see PR #435 review, databaseId
-# 4240400316). Re-add once the web consumer confirms AZURE support; the AZURE
-# mapping stays elsewhere in this file (PLATFORM_SOURCE_FIELD,
-# VALID_SCOPES_BY_PLATFORM) so turning it back on is a one-line change, not a
-# rewrite.
 SKILL_TO_PLATFORM = {
     "GCP_TO_AWS": "GCP",
     "HEROKU_TO_AWS": "HEROKU",

@@ -10,10 +10,12 @@ skills, and the rationale source for Stage 2's injection context block.
 ## Step 1 — Write the handoff summary
 
 Write `$RUN_DIR/handoff-summary.md` (a compact, machine-readable companion to
-`recommendation.md` for the downstream plugins) containing: recommended runtime + deployment
-model + services, coarse model family mapping (the source model from the user's `current_model`
-answer → the Bedrock family per `model-selection.md`; no prices), and the rationale (top scoring
-signals + eliminations, from design.json's `scores`/`eliminated`).
+`recommendation.md` for the downstream plugins) with `initiated_by: AGENT_ADVISOR` as its first
+line, followed by: recommended runtime + deployment model + services, coarse model family
+mapping (the source model from the user's `current_model` answer → the Bedrock family per
+`model-selection.md`; no prices), and the rationale (top scoring signals + eliminations, from
+design.json's `scores`/`eliminated`). The first-line marker is the durable downstream origin
+signal; preserve it when pointing either downstream skill at this file.
 
 ## Step 2 — Check downstream availability
 

@@ -126,17 +126,62 @@ resumes at migration-plan.md rather than at generate.md.
 
 ## Step 1 — Resolve the target repo and set $MIGRATION_DIR
 
-The plan needs the repo containing the workload to migrate. If Discover ran (`phases.discover
-== "completed"`), reuse the repo path the user gave then (from `context-notes.md` or
-`context-signals.json`). Otherwise ask for it now. Resolve to an absolute path (`$REPO`).
+Read agent-advisor's `$RUN_DIR/.phase-status.json` before selecting a provider run.
+
+- If it already carries a schema-valid `migration_plan_ctx` object with absolute `repo` and
+  `migration_dir` paths, reuse those exact paths on re-entry. Do not derive a directory from
+  the current minute, mint another UUID, or rewrite the provider envelope.
+- Otherwise resolve the target repo. If Discover ran (`phases.discover == "completed"`), reuse
+  the repo path the user gave then (from `context-notes.md` or `context-signals.json`); otherwise
+  ask for it now. Resolve to an absolute path (`$REPO`). If the user has no code (idea-only
+  migrate), STOP: tell them a migration plan needs an existing workload, set
+  `phases.migration_plan = "not_applicable"`, and continue to the Gate 2 branch in generate.md
+  Step 7.
+- For a first entry, choose an UNUSED `$REPO/.migration/<MMDD-HHMM>/` directory. If that name
+  already exists, choose a collision-suffixed unused directory; never claim or overwrite an
+  occupied path. Immediately read-merge-write agent-advisor's state with
+  `migration_plan_ctx = {"repo": "<abs $REPO>", "migration_dir": "<abs $MIGRATION_DIR>"}`
+  before creating provider state or loading any gcp-to-aws phase. This durable pointer must
+  survive interruption and is the sole path selected on every re-entry.
+
+Create `$MIGRATION_DIR` and `.migration/.gitignore` (`*\n!.gitignore`) only after the advisor
+pointer is durable. Then inspect `$MIGRATION_DIR/.phase-status.json`:
+
+- If it exists, validate it before doing anything else. It must parse, satisfy the provider
+  state schema, and carry `owning_skill: GCP_TO_AWS` plus `initiated_by: AGENT_ADVISOR`.
+  Reuse the envelope unchanged, including `migration_id`, `run_id`, `current_phase`, and the
+  complete phase map. A mismatch or invalid state is an occupied-directory conflict: halt and
+  inform rather than overwriting it. **This completes provider initialization:** continue to
+  Step 2 without executing the no-state creation branch below.
+- If it does not exist, require the selected directory to be otherwise empty. **Only in this
+  no-state branch**, mint a fresh `run_id` with `uuidgen` (or an equivalent random UUID source)
+  and write one schema-valid provider
+state envelope (this write belongs only to the no-state branch):
 
-If the user has no code (idea-only migrate), STOP: tell them a migration plan needs an
-existing workload, set `phases.migration_plan = "not_applicable"`, and continue to the Gate
-2 branch in generate.md Step 7.
+```json
+{
+  "migration_id": "[MMDD-HHMM]",
+  "run_id": "[fresh random UUID from uuidgen]",
+  "owning_skill": "GCP_TO_AWS",
+  "last_updated": "[ISO 8601 timestamp]",
+  "current_phase": "discover",
+  "initiated_by": "AGENT_ADVISOR",
+  "phases": {
+    "discover": "in_progress",
+    "clarify": "pending",
+    "design": "pending",
+    "estimate": "pending",
+    "workshop": "pending",
+    "generate": "pending",
+    "feedback": "pending"
+  }
+}
+```
 
-Set `$MIGRATION_DIR` using the gcp-to-aws convention: `$REPO/.migration/<MMDD-HHMM>/`
-(current timestamp). Create the directory and `.migration/.gitignore` (`*\n!.gitignore`).
-All gcp-to-aws artifacts are written here.
+This durable origin signal suppresses standalone migration promotions that do not apply to
+agent-advisor's AI-only planning engine, while leaving a normal, resume-routable GCP state if
+the session is interrupted. GCP Discover reuses this initialized envelope without recreating
+it or changing `migration_id` or `run_id`. All gcp-to-aws artifacts are written here.
 
 ## Step 2 — Assemble the injection context
 
@@ -288,9 +333,10 @@ relative references in those files resolve from `$GCP_BASE`.
 
 **Two separate state files — do NOT mix them up:**
 
-- `$MIGRATION_DIR/.phase-status.json` — gcp-to-aws's own state. Each phase file
-  (discover.md, clarify.md, etc.) writes and reads this file itself per its own protocol.
-  migration-plan.md does NOT touch it — let each phase file manage it.
+- `$MIGRATION_DIR/.phase-status.json` — gcp-to-aws's own state. migration-plan.md
+  creates its initial delegated envelope in Step 1. Discover reuses that envelope, and
+  each gcp-to-aws phase thereafter reads and advances it per its own protocol; do not
+  recreate it or perform extra provider-state writes from migration-plan.md.
 - `$RUN_DIR/.phase-status.json` — agent-advisor's state. Already set to
   `current_phase = "migration_plan"` in Step 0 and NOT touched again until Step 5.
   gcp-to-aws's files never read or write this file (they only know about `$MIGRATION_DIR`).
@@ -304,10 +350,13 @@ Read and execute: `$GCP_BASE/references/phases/discover/discover.md`
 
 Key behaviors:
 
-- `$MIGRATION_DIR` is already created (Step 1) — when discover.md Step 0 checks for
-  existing runs, the directory exists but has no `.phase-status.json` yet → treat as
-  fresh run (skip the resume/fresh/cancel prompt)
-- discover.md writes its own `.phase-status.json` to `$MIGRATION_DIR` — let it do so
+- `$MIGRATION_DIR` is already created (Step 1) with a schema-valid `.phase-status.json`
+  envelope containing `owning_skill: GCP_TO_AWS`, `initiated_by: AGENT_ADVISOR`,
+  `current_phase: discover`, and `phases.discover: in_progress` → treat it as an already
+  initialized delegated run (skip the resume/fresh/cancel prompt), reuse it without changing
+  `migration_id` or `run_id`, and suppress the standalone migration-credit notice
+- if interruption occurs, normal GCP Resume uses `current_phase: discover` and the phase map
+  to route back here
 - Injection context is NOT applied at this stage; it's carried as live context for Clarify
 - On `HANDOFF_OK`: `ai-workload-profile.json` (and/or IaC artifacts) present in `$MIGRATION_DIR`
 
@@ -444,7 +493,8 @@ files present in `$MIGRATION_DIR`.
 Read-merge-write `$RUN_DIR/.phase-status.json`:
 
 - `phases.migration_plan` = `"completed"`
-- `migration_plan_ctx` = `{"repo": "<abs $REPO>", "migration_dir": "<abs $MIGRATION_DIR>"}`
+- preserve the existing `migration_plan_ctx` unchanged; it was persisted before provider
+  initialization in Step 1 and is the durable resume pointer
 
 Verify `$MIGRATION_DIR/aws-design-ai.json` exists and has a non-empty `ai_architecture`.
 If missing → AI path did not complete; show the error, set `phases.migration_plan =