docs(aws-startup-advisor): name RDfA as an Azure discovery source

plugins/aws-startup-advisor/README.md

@@ -20,7 +20,7 @@ The twelve skills below are the catalog. Install them together.
 | 1 | `architect-for-startups` | Stage-aware AWS architecture guidance for non-agent workloads, tuned to team size, runway, and credits — advice rather than code changes. An AI agent as the workload goes to `agent-advisor` | [SKILL.md](skills/architect-for-startups/SKILL.md) |
 | 2 | `start-building-for-startups` | Interactive discovery flow that gathers requirements, scans the codebase, then writes an AWS scaffold and implementation into the project | [SKILL.md](skills/start-building-for-startups/SKILL.md) |
 | 3 | `agent-advisor` | Runtime selection, migration planning, and an executable proof of concept for AI-agent workloads on AWS | [SKILL.md](skills/agent-advisor/SKILL.md) |
-| 4 | `azure-to-aws` | Six-phase Microsoft Azure to AWS migration. Discovery reads Terraform (`azurerm_*`), a live `az` CLI capture (read-only, consent-gated), application code, and billing exports — not Bicep or ARM templates. Direct OpenAI, OpenRouter, and Anthropic usage-API discovery (read-only, consent-gated) supplement real AI spend. Generate is opt-in, and the what-if workshop is optional | [SKILL.md](skills/azure-to-aws/SKILL.md) |
+| 4 | `azure-to-aws` | Six-phase Microsoft Azure to AWS migration. Discovery reads Terraform (`azurerm_*`), a live `az` CLI capture (read-only, consent-gated), a customer-supplied RDfA report (read-only, file-only), and application code — not Bicep, ARM templates, or Azure billing exports. Direct OpenAI, OpenRouter, and Anthropic usage-API discovery (read-only, consent-gated) supplement real AI spend. Generate is opt-in, and the what-if workshop is optional | [SKILL.md](skills/azure-to-aws/SKILL.md) |
 | 5 | `gcp-to-aws` | Six-phase Google Cloud to AWS migration. Discovery reads Terraform, a live `gcloud` capture (read-only, consent-gated), application code, and billing exports. Direct OpenAI, OpenRouter, and Anthropic usage-API discovery (read-only, consent-gated) supplement real AI spend. Generate is opt-in. BigQuery is not mapped to an AWS analytics service | [SKILL.md](skills/gcp-to-aws/SKILL.md) |
 | 6 | `heroku-to-aws` | Six-phase Heroku to AWS migration with deterministic add-on mapping and an optional what-if repricing workshop | [SKILL.md](skills/heroku-to-aws/SKILL.md) |
 | 7 | `llm-to-bedrock` | Rewrite OpenAI, Gemini, or Anthropic API call sites to Amazon Bedrock, evaluate quality, and deliver a git branch. The full migration requires `gcp-to-aws` or `azure-to-aws` alongside it (`gcp-to-aws` preferred when both are installed). Access-only mode (enable model access, no rewrite) does not | [SKILL.md](skills/llm-to-bedrock/SKILL.md) |
@@ -133,7 +133,7 @@ The `azure-to-aws`, `gcp-to-aws`, and `heroku-to-aws` skills run the same six-ph
 
 ### How It Works
 
-- **Discover** — `azure-to-aws` reads Terraform (`azurerm_*`), application code, and billing exports, and can capture a live subscription through the `az` CLI (read-only, consent-gated). It does not read Bicep or ARM templates. `gcp-to-aws` reads Terraform, application code, and billing exports, and can capture a live project through `gcloud` (read-only, consent-gated). BigQuery is recorded and left for a specialist; the skill does not pick an AWS analytics service for it. `azure-to-aws` and `gcp-to-aws` can also read aggregate AI spend when the app calls OpenAI directly, calls it through OpenRouter, or calls the Anthropic API — from the OpenAI Admin API (Usage Read), the OpenRouter API, or the Anthropic Admin API. Each is consent-gated and optional, and none replaces the code scan. `heroku-to-aws` discovers through the authenticated Heroku CLI (read-only, consent-gated) or from `Procfile` and `app.json`.
+- **Discover** — `azure-to-aws` reads Terraform (`azurerm_*`) and application code, can capture a live subscription through the `az` CLI (read-only, consent-gated), and can parse a customer-supplied Resource Discovery for Azure (RDfA) report (read-only, file-only). It does not read Bicep or ARM templates or Azure billing exports. `gcp-to-aws` reads Terraform, application code, and billing exports, and can capture a live project through `gcloud` (read-only, consent-gated). BigQuery is recorded and left for a specialist; the skill does not pick an AWS analytics service for it. `azure-to-aws` and `gcp-to-aws` can also read aggregate AI spend when the app calls OpenAI directly, calls it through OpenRouter, or calls the Anthropic API — from the OpenAI Admin API (Usage Read), the OpenRouter API, or the Anthropic Admin API. Each is consent-gated and optional, and none replaces the code scan. `heroku-to-aws` discovers through the authenticated Heroku CLI (read-only, consent-gated) or from `Procfile` and `app.json`.
 - **Clarify** — Resolves the requirements that change the target architecture: availability, compliance, data residency, cutover tolerance, and team capacity.
 - **Design** — Maps source resources to AWS services using deterministic mapping tables — for example Heroku dynos to AWS Elastic Beanstalk, Heroku Postgres to Amazon RDS or Aurora, Heroku Redis to Amazon ElastiCache, Heroku Kafka to Amazon MSK, Cloud SQL to Amazon RDS, GKE to Amazon EKS, Cloud Run to AWS Fargate, Azure App Service to AWS Elastic Beanstalk, AKS to Amazon EKS, Azure SQL to Amazon RDS, and Cosmos DB to Amazon DynamoDB or DocumentDB.
 - **Estimate** — Costs the target architecture from the plugin's bundled rate reference data and a documented cost algorithm, with an estimation schema and complexity tiers so two runs of the same workload agree. Estimates are planning figures; confirm them against the [AWS Pricing Calculator](https://calculator.aws/) before committing budget.

plugins/aws-startup-advisor/skills/azure-to-aws/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: azure-to-aws
-description: "Migrate workloads from Microsoft Azure to AWS. Triggers on: migrate from Azure, Azure to AWS, move off Azure, migrate AKS to EKS, migrate App Service or Azure VMs to AWS compute, migrate Azure SQL or Azure Database to RDS, migrate Cosmos DB to DynamoDB, migrate Azure OpenAI to Bedrock, move Azure AI or agentic workloads to AWS, estimate AWS costs for my Azure infrastructure, what-if workshop. Runs a 6-phase process: discover Azure resources from Terraform, the live `az` CLI, app code, and billing exports, then clarify, design, estimate costs, optionally reprice scenarios, generate artifacts, and collect feedback. Clarify gates Design, Estimate, and Generate; Generate is opt-in at the post-Estimate decision gate. Bicep/ARM discovery is not yet implemented; a Bicep/ARM-only workspace halts. Do not use for: GCP migrations (see gcp-to-aws), Heroku migrations (see heroku-to-aws), general AWS architecture advice (see architect-for-startups), AWS-to-Azure reverse migration, or Azure-to-Azure refactoring."
+description: "Migrate workloads from Microsoft Azure to AWS. Triggers on: migrate from Azure, Azure to AWS, migrate AKS to EKS, migrate App Service or Azure VMs to AWS compute, migrate Azure SQL or Azure Database to RDS, migrate Cosmos DB to DynamoDB, migrate Azure OpenAI to Bedrock, estimate AWS costs for Azure, what-if workshop. Runs a 6-phase process: discover Azure resources from Terraform, the live `az` CLI, a customer-supplied Resource Discovery for Azure (RDfA) report, and app code, then clarify, design, estimate, optionally reprice, generate artifacts, and collect feedback. Clarify gates Design, Estimate, and Generate; Generate is opt-in at the post-Estimate gate. Bicep/ARM discovery is not yet implemented; a Bicep/ARM-only workspace halts. Azure Cost Management billing-export discovery is not implemented. Do not use for: GCP (see gcp-to-aws) or Heroku (see heroku-to-aws) migrations, general AWS architecture advice (see architect-for-startups), AWS-to-Azure reverse migration, or Azure-to-Azure refactoring."
 ---
 
 # Azure-to-AWS Migration Skill
@@ -263,7 +263,7 @@ phase contract. Both are `_kind: sidebar` — off-backbone, trigger-entered, nev
 - **Region**: `us-east-1` unless the user specifies otherwise; Azure regions are mapped, not assumed
 - **Sizing**: Development tier, upgraded from measured utilization when RDfA or `az monitor` metrics are available
 - **CPU architecture**: `x86_64` (see Philosophy — Graviton is an offered optimization here, not the default)
-- **Migration mode**: adapts to available inputs — Terraform (`azurerm_*`) IaC, live `az` capture (read-only, consent-gated), RDfA archive parsing (read-only, file-only), and application code are supported today, with billing exports as a fallback. OpenAI, OpenRouter, and Anthropic usage-API discovery (read-only, consent-gated) are available supplements for real AI spend and token volumes when the app calls those APIs directly. Bicep and ARM templates are planned follow-ups, not yet available.
+- **Migration mode**: adapts to available inputs — Terraform (`azurerm_*`) IaC, live `az` capture (read-only, consent-gated), RDfA archive parsing (read-only, file-only), and application code are supported today. Azure Cost Management billing exports are not implemented; user-stated spend is the infrastructure baseline when no measured cost source exists. OpenAI, OpenRouter, and Anthropic usage-API discovery (read-only, consent-gated) are available supplements for real AI spend and token volumes when the app calls those APIs directly. Bicep and ARM templates are planned follow-ups, not yet available.
 - **Cost currency**: USD
 - **Timeline assumption**: 2–18 weeks depending on complexity. Tiers per `references/vendored/estimate/complexity-tiers.json`.
 

plugins/aws-startup-advisor/tests/test_azure_discovery_source_guidance.py

@@ -0,0 +1,44 @@
+"""The public Azure discovery summary must match the sources Discover actually reads.
+
+PR #458 made a customer-supplied RDfA report a real Discover producer and stated
+that Azure Cost Management billing-export discovery is not implemented. The
+skill description and the plugin README still described the old set (Terraform,
+live `az`, app code, and billing exports) and never named RDfA.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+PLUGIN_ROOT = Path(__file__).resolve().parent.parent
+SKILL = PLUGIN_ROOT / "skills" / "azure-to-aws" / "SKILL.md"
+README = PLUGIN_ROOT / "README.md"
+
+
+def test_skill_summary_names_rdfa_and_not_billing_exports() -> None:
+    text = SKILL.read_text(encoding="utf-8")
+    description = text.split("---", 2)[1]
+    defaults = text[text.index("## Defaults"):text.index("## Scope Notes")]
+
+    assert "RDfA" in description
+    assert "app code, and billing exports" not in description
+    assert "billing-export discovery is not implemented" in description
+    assert "RDfA archive parsing" in defaults
+    assert "billing exports as a fallback" not in defaults
+    assert "billing exports are not implemented" in defaults
+
+
+def test_plugin_readme_names_rdfa_for_azure_only() -> None:
+    text = README.read_text(encoding="utf-8")
+    azure_row = next(
+        line for line in text.splitlines() if line.startswith("| 4 | `azure-to-aws` |")
+    )
+    discover = text[text.index("- **Discover** —"):text.index("- **Clarify** —")]
+    azure_clause = discover.split("`gcp-to-aws`", 1)[0]
+
+    assert "RDfA" in azure_row
+    assert "and billing exports" not in azure_row
+    assert "not Bicep, ARM templates, or Azure billing exports" in azure_row
+    assert "RDfA" in azure_clause
+    assert "billing exports" not in azure_clause.replace("Azure billing exports", "")
+    # GCP still reads billing exports. Only the Azure clause changed.
+    assert "`gcp-to-aws` reads Terraform, application code, and billing exports" in discover