diff --git a/.github/agents/custom-code.agent.md b/.github/agents/custom-code.agent.md
new file mode 100644
index 00000000000..4674af599db
--- /dev/null
+++ b/.github/agents/custom-code.agent.md
@@ -0,0 +1,30 @@
+---
+name: custom-code-agent
+description: "Use when adding or modifying Azure CLI command module custom code, including AAZ subclass custom, legacy SDK-backed custom, and legacy non-SDK custom."
+---
+
+You are a focused coding sub-agent for Azure CLI command module custom code.
+
+Goals:
+- Add or modify command logic in custom.py.
+- Register commands in commands.py.
+- Update argument definitions in _params.py.
+- Keep command help in _help.py consistent.
+
+Rules:
+- Prefer small, targeted edits.
+- Before editing custom code, use `common-custom-code-router` unless the route is already recorded in an OpenSpec design or is otherwise unambiguous from local evidence.
+- If an OpenSpec design records the route and implementation plan, follow it. Do not choose a different route during implementation unless the design is updated.
+- Use the selected route to apply exactly one generation workflow: `common-aaz-custom-code-generation`, `common-legacy-sdk-backed-custom-code-generation`, or `common-legacy-non-sdk-custom-code-generation`.
+- Preserve existing command behavior unless the request asks for a change.
+- For any behavior change, perform a consistency pass over the affected command surface and update related implementation, argument definitions, user-facing help, validation/errors, examples, and focused tests as needed.
+- When updating tests, do not treat existing recordings as the source of truth for expected response values or response shape. Use recordings only as historical evidence to locate affected scenarios, understand previous responses, and identify existing assertions. Expected values and response structure must come from the current product/API specification and the requested custom code change; treat documentation as supporting context only, especially when the API behavior is changing. If existing recordings disagree with the new specification, update tests to the specification and expect recordings to be re-recorded rather than relaxing assertions to old values or old structures.
+- Treat `_params.py` argument help as user-facing command help, the same as authored help in `_help.py`.
+- Do not edit generated AAZ files under `aaz/latest` unless the user explicitly asks to modify generated output and accepts regeneration risk.
+- Ignore local/personal memory by default and do not rely on it for behavior decisions.
+- Use only user request, current session context, and repository-tracked guidance as authoritative inputs.
+- Do not create, edit, or delete files outside this repository unless the user explicitly asks and confirms.
+- When creating skills in this workflow, only add module-specific skills.
+- Module skill names must follow `module-<module-name>`.
+- Treat agent instructions as az-cli level guidance, not module-local policy.
+- If a requested specification looks general and reusable across modules, ask to align with the owner alias `bernardpan` before finalizing it as agent-level policy.
diff --git a/.github/instructions/agent-safety.instructions.md b/.github/instructions/agent-safety.instructions.md
new file mode 100644
index 00000000000..36ba635ed63
--- /dev/null
+++ b/.github/instructions/agent-safety.instructions.md
@@ -0,0 +1,13 @@
+---
+applyTo: "**"
+description: "Global safety and scope rules for all agents in this repository."
+---
+
+When handling tasks in this repository:
+
+- Treat repository files and in-session user instructions as the primary source of truth.
+- Ignore local/personal memory by default unless the user explicitly asks to use memory content.
+- Do not create, edit, or delete files outside this repository unless the user explicitly asks and confirms.
+- Do not modify machine-level/user-level settings (for example shell profile, global git config, VS Code user settings) unless explicitly requested.
+- Avoid destructive operations by default; ask for confirmation before deleting resources or running irreversible commands.
+- Keep edits minimal and scoped to the user request.
diff --git a/.github/instructions/custom-code.instructions.md b/.github/instructions/custom-code.instructions.md
new file mode 100644
index 00000000000..406c1480ca5
--- /dev/null
+++ b/.github/instructions/custom-code.instructions.md
@@ -0,0 +1,23 @@
+---
+applyTo: "src/azure-cli/azure/cli/command_modules/**/{custom.py,commands.py,_params.py,_help.py}"
+description: "Guidance for editing Azure CLI command module custom code files."
+---
+
+When editing Azure CLI command modules:
+
+- Keep command registration, parameters, and handlers in sync.
+- If a new command is added, wire it in commands.py and define args in _params.py.
+- Keep return shapes compatible with existing CLI output patterns.
+- Keep help/examples aligned with command behavior.
+- Prefer concise error messages through CLIError when user input is invalid.
+- Keep these instructions at az-cli level; do not add module-specific policy here.
+- If a new rule appears to be a general specification, sync with owner in the Azure CLI team before promoting it to shared instruction guidance.
+
+Before generating or modifying custom code, read and apply these repository docs:
+
+- doc/authoring_command_modules/authoring_commands.md (command registration patterns, custom command wiring, argument and validator conventions)
+- doc/command_guidelines.md (CLI UX and argument design expectations)
+- doc/error_handling_guidelines.md (preferred Azure CLI error types and patterns)
+- doc/authoring_help.md (help authoring format in _help.py/help.yaml)
+- doc/reference_doc_guidelines.md (example quality and formatting requirements)
+- doc/authoring_tests.md (test coverage and scenario test expectations)
diff --git a/.github/prompts/opsx-apply.prompt.md b/.github/prompts/opsx-apply.prompt.md
new file mode 100644
index 00000000000..c83b479f783
--- /dev/null
+++ b/.github/prompts/opsx-apply.prompt.md
@@ -0,0 +1,153 @@
+---
+description: Implement tasks from an OpenSpec change (Experimental)
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue`
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! You can archive this change with `/opsx:archive`.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- For implementation tasks that add or update Azure CLI command module custom code, classify the work with `common-custom-code-router` before editing code. Use the router result to select exactly one generation skill: `common-aaz-custom-code-generation`, `common-legacy-sdk-backed-custom-code-generation`, or `common-legacy-non-sdk-custom-code-generation`.
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.github/prompts/opsx-archive.prompt.md b/.github/prompts/opsx-archive.prompt.md
new file mode 100644
index 00000000000..f9ba89d8ae4
--- /dev/null
+++ b/.github/prompts/opsx-archive.prompt.md
@@ -0,0 +1,157 @@
+---
+description: Archive a completed change in the experimental workflow
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Spec sync status (synced / sync skipped / no delta specs)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success (No Delta Specs)**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** No delta specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success With Warnings**
+
+```
+## Archive Complete (with warnings)
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** Sync skipped (user chose to skip)
+
+**Warnings:**
+- Archived with 2 incomplete artifacts
+- Archived with 3 incomplete tasks
+- Delta spec sync was skipped (user chose to skip)
+
+Review the archive if this was not intentional.
+```
+
+**Output On Error (Archive Exists)**
+
+```
+## Archive Failed
+
+**Change:** <change-name>
+**Target:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+
+Target archive directory already exists.
+
+**Options:**
+1. Rename the existing archive
+2. Delete the existing archive if it's a duplicate
+3. Wait until a different date to archive
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.github/prompts/opsx-explore.prompt.md b/.github/prompts/opsx-explore.prompt.md
new file mode 100644
index 00000000000..856001a643d
--- /dev/null
+++ b/.github/prompts/opsx-explore.prompt.md
@@ -0,0 +1,171 @@
+---
+description: Enter explore mode - think through ideas, investigate problems, clarify requirements
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
+- A vague idea: "real-time collaboration"
+- A specific problem: "the auth system is getting unwieldy"
+- A change name: "add-dark-mode" (to explore in context of that change)
+- A comparison: "postgres vs sqlite for this"
+- Nothing (just enter explore mode)
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+If the user mentioned a specific change name, read its artifacts for context.
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.github/prompts/opsx-propose.prompt.md b/.github/prompts/opsx-propose.prompt.md
new file mode 100644
index 00000000000..fde349a603f
--- /dev/null
+++ b/.github/prompts/opsx-propose.prompt.md
@@ -0,0 +1,106 @@
+---
+description: Propose a new change - create it and generate all artifacts in one step
+---
+
+Propose a new change - create the change and generate all artifacts in one step.
+
+I'll create a change with artifacts:
+- proposal.md (what & why)
+- design.md (how)
+- tasks.md (implementation steps)
+
+When ready to implement, run /opsx:apply
+
+---
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx:propose` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` to start implementing."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.github/prompts/opsx-sync.prompt.md b/.github/prompts/opsx-sync.prompt.md
new file mode 100644
index 00000000000..961aa409b21
--- /dev/null
+++ b/.github/prompts/opsx-sync.prompt.md
@@ -0,0 +1,140 @@
+---
+description: Sync delta specs from a change to main specs
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:sync` (e.g., `/opsx:sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.github/prompts/opsx-update.prompt.md b/.github/prompts/opsx-update.prompt.md
new file mode 100644
index 00000000000..5b316d4d6db
--- /dev/null
+++ b/.github/prompts/opsx-update.prompt.md
@@ -0,0 +1,78 @@
+---
+description: Update a change - revise existing planning artifacts and keep them coherent (Experimental)
+---
+
+Revise a change's existing planning artifacts and keep them coherent. Never edit code.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:update` (e.g., `/opsx:update add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to update.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to update.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Get the change's artifacts**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+   The artifact ids and paths come from the active schema - do NOT assume them, and do NOT branch on hardcoded artifact names. Custom schemas must work unchanged.
+
+   The files to edit are `artifactPaths.<id>.existingOutputPaths` - the concrete files that exist on disk, already glob-expanded for glob artifacts (e.g. `specs/**/*.md`). Do NOT write to `resolvedOutputPath`: for a glob artifact it is still the glob pattern, not a real file.
+
+3. **Understand the request**
+   - If the user asked for a specific revision ("the design now uses X"), that is the starting edit.
+   - If they only said "update" / "make this coherent", treat it as a coherence review: read the existing artifacts and check them against each other for contradictions, gaps, and duplication.
+
+4. **Read and reconcile**
+   - Read the artifact(s) the request touches and the change's other existing artifacts.
+   - Apply the requested edit. Then check every other existing artifact against it - in ANY direction: an edit to a later artifact may require revising an earlier one, not only the other way around. Build order is a useful reading order, not a constraint on which artifacts may be revised.
+   - Note everything that is now inconsistent, missing, or contradictory.
+   - Revise only files that already exist (`existingOutputPaths`). Do NOT create artifacts that don't exist yet, and do NOT invent new files under a glob artifact - note them and point the user to `/opsx:continue` to create them.
+   - If the change is already coherent, say so and make no edits.
+
+5. **Confirm and apply, one artifact at a time**
+   - Show each proposed revision and why. Write only after the user confirms.
+   - If the user rejects a revision, do not write it - leave that artifact unchanged.
+   - When a substantial rewrite is needed, get that artifact's rules and template first:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+
+6. **Point to the next step (guidance only - NEVER act on it)**
+   - Artifacts still missing -> suggest `/opsx:continue` to create them.
+   - Change already implemented (tasks checked off / already applied) -> the code may no longer match the revised plan; suggest `/opsx:apply` to carry the delta into code.
+   - Everything done and implemented -> suggest `/opsx:archive`.
+
+**Output**
+
+After each invocation, show:
+- Which artifacts were revised (and which proposed revisions were rejected)
+- Anything deferred to `/opsx:continue` (not-yet-created artifacts or files)
+- Where the change stands and the recommended next command
+
+**Guardrails**
+- Planning artifacts only - NEVER edit implementation code. If the revised plan implies code changes, stop and point to `/opsx:apply`.
+- Use the artifact ids and paths reported by `openspec status`; never branch on hardcoded artifact names.
+- Edit only the concrete files in `existingOutputPaths`; never write to a glob `resolvedOutputPath`.
+- Do not advance the build frontier: no new artifacts, no new files under glob artifacts - that is `/opsx:continue`'s job.
+- Confirm every edit with the user before writing.
+- If the request changes the change's *intent* rather than refining it, recommend starting fresh with `/opsx:new` (the "Update vs. Start Fresh" heuristic).
diff --git a/.github/skills/common-aaz-custom-code-generation/SKILL.md b/.github/skills/common-aaz-custom-code-generation/SKILL.md
new file mode 100644
index 00000000000..4950dab5b79
--- /dev/null
+++ b/.github/skills/common-aaz-custom-code-generation/SKILL.md
@@ -0,0 +1,275 @@
+---
+name: common-aaz-custom-code-generation
+description: "Use after routing to AAZ subclass custom, or when adding/updating Azure CLI AAZ generated command customization. Generates custom classes that subclass AAZ generated commands while limiting uncertainty with required slots, templates, and validation gates."
+argument-hint: "Provide module, command group, command verb, generated AAZ command path/class, and intended customization if known."
+---
+
+# Common AAZ Custom Code Generation
+
+Use this workflow to generate or update hand-written custom code for Azure CLI commands whose primary implementation is an AAZ generated command.
+
+This skill starts after the route is known or strongly suspected to be `aaz-subclass-custom`. If the route is unclear, use `common-custom-code-router` first.
+
+## Scope
+
+This is module-general and applies across Azure CLI command modules under `src/azure-cli/azure/cli/command_modules`.
+
+Use this skill for:
+
+- subclassing generated AAZ command classes such as `Create`, `Show`, `List`, `Update`, `Delete`, or `Wait`
+- changing generated command argument UX through `_build_arguments_schema`
+- normalizing or validating CLI arguments before generated operations run
+- adding resource or operation guard checks around a generated command, such as existence checks or dependency checks
+- shaping generated command output when local module patterns support it
+- replacing a generated command table entry with a hand-written subclass
+
+Do not use this skill for:
+
+- legacy SDK-backed custom functions using `CliCommandType(..., client_factory=...)`
+- Legacy Non-SDK Custom: local tool, subprocess, data-plane, raw HTTP, or diagnostic workflows whose public command is not an AAZ subclass
+- editing generated files under `aaz/latest` unless the user explicitly asks to modify generated output and accepts regeneration risk
+
+## Slots To Resolve
+
+Resolve these slots before editing the related code. Prefer repository evidence over asking the user. These are not all user-provided inputs; some are derived or conditional.
+
+```yaml
+module_name: "<module under command_modules>"
+command_group: "<az command group, e.g. network vnet or aks safeguards>"
+command_verb_or_action: "<CLI verb/action used to locate the generated file, e.g. create/show/wait or custom action>"
+generated_module_import: "<relative import from .aaz.latest...>"
+generated_base_class: "<Python class imported from the generated module and inherited by the custom class, e.g. Create/Show/Wait>"
+custom_class_name: "<ModuleResourceVerbCustom>"
+manual_code_file: "<custom.py or module-local manual file>"
+command_table_key: "<full command name; required only when replacing a command_table entry; derive from @register_command(...) when possible>"
+registration_file: "<commands.py or loader file; required only when adding/updating a command_table override>"
+customization_goals: "<schema-extension | argument-normalization | argument-validation | resource-guard | operation-guard | output-shaping | wait-customization>"
+validation_command: "<narrow command-load/help/test command or unknown>"
+```
+
+`command_verb_or_action` and `generated_base_class` often correspond for standard commands, but they are not the same slot. The verb/action helps locate generated files such as `_show.py` or `_wait.py`; the base class is the concrete Python class the custom class will inherit.
+
+If `generated_module_import` or `generated_base_class` cannot be resolved, stop and ask one focused question or ask for the generated command path. Do not guess an AAZ import path. If `command_table_key` cannot be resolved but no command table override is needed, set it to `not-needed`. If an override is needed and the key cannot be derived, ask one focused question.
+
+## Evidence To Gather
+
+Gather only the evidence needed for the slots.
+
+1. Confirm the generated command exists under `src/azure-cli/azure/cli/command_modules/<module>/aaz/latest/...`.
+2. Read the generated `_create.py`, `_show.py`, `_list.py`, `_update.py`, `_delete.py`, or `_wait.py` enough to confirm:
+   - command name in `_aaz_info` or examples
+   - generated class name
+   - argument names in `_build_arguments_schema`
+   - operation hooks available in the class
+3. Search the target module for existing `class XxxCustom(GeneratedClass)` patterns.
+4. Search `commands.py` or the module loader for existing command table replacement style.
+5. Inspect the nearest sibling command with the same verb or resource family.
+
+## Uncertainty Gates
+
+Before generating code, reduce uncertainty with these gates:
+
+- If the generated command path is missing, do not create an AAZ subclass. Route back to SDK or non-SDK evaluation.
+- If the requested behavior requires a new REST operation not present in generated AAZ code, do not invent `AAZHttpOperation` by hand in custom code.
+- If the behavior can be expressed as schema customization, argument normalization/validation, or resource/operation guard checks, subclass the generated command instead of copying generated code.
+- If multiple customization goals apply, keep one custom class and combine the smallest necessary hooks.
+- If a guard check requires raw HTTP or a secondary command invocation, keep it isolated in `pre_operations` or `post_operations` and validate inputs before constructing URLs.
+- If the module already has a local helper for shared schema or validation, reuse it instead of duplicating logic.
+
+## Implementation Workflow
+
+1. Add imports in the manual code file:
+   - AAZ argument helpers from `azure.cli.core.aaz` only when needed.
+   - The generated base class from `.aaz.latest...`.
+   - Existing local validators/helpers when available.
+2. Add helper functions only when shared by multiple custom classes or when they reduce repeated validation/schema code.
+3. Add a custom class that subclasses the generated base class.
+4. Override only the hooks needed for the requested behavior.
+5. Register the custom class by replacing the generated command table entry in the module's command registration file.
+6. Update parameters/help/tests only if the module's AAZ/manual help pattern requires it or the user requested examples/tests.
+7. Run the narrowest validation available: command load, help for the target command, a focused unit test, or a targeted scenario test.
+
+## Hook Templates
+
+Use only the templates needed by the requested behavior. Treat templates as patterns, not fixed implementations. Replace every placeholder and every example argument with names found in the generated AAZ schema or the target module's local conventions. Never leave angle-bracket placeholders such as `<AAZArgType>` or `<generated_arg_name>` in generated code.
+
+### Fallback: Unmatched Business Logic
+
+If no template matches the requested business logic, do not force the request into one of these examples. First identify the smallest AAZ hook that can express the behavior:
+
+- `_build_arguments_schema` for CLI argument surface changes
+- `pre_operations` for validation, normalization, or checks before generated operations
+- `post_operations` for checks or output changes after generated operations
+- `_output` only when local module patterns support custom output shaping
+- another generated lifecycle hook only after reading the generated base class and confirming the hook exists
+
+Then generate the smallest subclass that overrides only that hook. If the behavior requires replacing the generated REST operation itself, route back to evaluation instead of stretching these templates.
+
+### Template: Schema Extension
+
+Use this when generated arguments need aliases, relaxed required flags, additional CLI-only arguments, or hidden generated arguments.
+
+```python
+from azure.cli.core.aaz import <AAZArgType>
+from .aaz.latest.<resource_path>._<verb> import <GeneratedBase>
+
+
+def _add_<resource>_args(args_schema):
+    args_schema.<new_cli_arg_name> = <AAZArgType>(
+        options=["--<option-name>"],
+        required=<TrueOrFalse>,
+        help="<help text>",
+    )
+    args_schema.<generated_arg_name>._required = False  # pylint: disable=protected-access
+    return args_schema
+
+
+class <CustomClassName>(<GeneratedBase>):
+    @classmethod
+    def _build_arguments_schema(cls, *args, **kwargs):
+        args_schema = super()._build_arguments_schema(*args, **kwargs)
+        return _add_<resource>_args(args_schema)
+```
+
+Replace placeholder argument names with real generated argument names. Do not add `resource_group`, `name`, `resource_id`, or any other example argument unless it matches the command's UX and generated schema.
+
+### Template: Argument Normalization Or Validation
+
+Use this when user-friendly CLI arguments must be converted into the generated AAZ argument shape before the HTTP operation runs.
+
+```python
+from azure.cli.core.aaz import has_value
+from azure.cli.core.azclierror import ArgumentUsageError
+
+
+def _validate_and_set_<resource>_argument(ctx):
+    args = ctx.args
+    has_generated_arg = has_value(args.<generated_arg_name>)
+    has_cli_arg_set = has_value(args.<cli_arg_name>)
+
+    if has_generated_arg == has_cli_arg_set:
+        raise ArgumentUsageError(
+            "Provide either '<generated option>' or '<friendly option set>', but not both."
+        )
+
+    if not has_generated_arg:
+        args.<generated_arg_name> = <normalize_cli_args_to_generated_value>(ctx, args)
+
+
+class <CustomClassName>(<GeneratedBase>):
+    def pre_operations(self):
+        _validate_and_set_<resource>_argument(self.ctx)
+```
+
+Use `azure.mgmt.core.tools.is_valid_resource_id` when accepting resource IDs. Normalize and validate resource IDs before using them in URLs. For non-resource-ID arguments, use the generated schema and neighboring command behavior to choose validation rules.
+
+### Template: Resource Or Operation Guard Check
+
+Use this when create/update/delete must check resource existence, dependencies, or state before or after the generated operation.
+
+```python
+class <CustomClassName>(<GeneratedBase>):
+    def pre_operations(self):
+        super().pre_operations()
+        _check_<condition>(self.ctx)
+```
+
+Call an argument normalization helper first only if the guard check depends on the normalized argument value.
+
+When using `send_raw_request`, keep URL construction explicit and validate any resource URI before concatenating it. Use raw HTTP only as a small guard around an AAZ subclass; if raw HTTP is the primary command implementation, route to legacy non-SDK custom instead.
+
+```python
+def _check_<condition>(ctx):
+    from azure.cli.core.azclierror import HTTPError
+    from azure.cli.core.util import send_raw_request
+    from knack.util import CLIError
+
+    resource_uri = ctx.args.<resource_id_arg>.to_serialized_data()
+    if not resource_uri.startswith("/subscriptions/"):
+        raise CLIError(f"Invalid resource ID format: {resource_uri}")
+
+    url = f"https://management.azure.com{resource_uri}/providers/<Provider>/<childType>/default?api-version=<api-version>"
+    try:
+        response = send_raw_request(ctx.cli_ctx, "GET", url)
+    except HTTPError as ex:
+        if ex.response.status_code == 404:
+            return
+        raise
+
+    if response.status_code == 200:
+        raise CLIError("The resource already exists. Use update to modify it or delete it before creating a new one.")
+```
+
+Prefer generated AAZ operations or existing SDK helpers over raw HTTP when a local pattern exists.
+
+### Template: Combined Schema And Pre-Operation Custom Class
+
+Use this when the command needs both CLI-friendly arguments and generated argument normalization.
+
+```python
+class <CustomClassName>(<GeneratedBase>):
+    @classmethod
+    def _build_arguments_schema(cls, *args, **kwargs):
+        args_schema = super()._build_arguments_schema(*args, **kwargs)
+        return _add_<resource>_args(args_schema)
+
+    def pre_operations(self):
+        _validate_and_set_<resource>_argument(self.ctx)
+```
+
+### Template: Command Table Override
+
+Use this when replacing the generated AAZ command class with the custom subclass.
+
+```python
+with self.command_group('<command_group>'):
+    from .custom import <CustomClassName>
+
+    self.command_table["<full command name>"] = <CustomClassName>(loader=self)
+```
+
+If the module already uses a different manual registration style for AAZ custom classes, follow that local style exactly.
+
+## Output Expectations
+
+Before editing, report:
+
+```yaml
+route: aaz-subclass-custom
+module_name: "..."
+command_verb_or_action: "..."
+generated_module_import: "..."
+generated_base_class: "..."
+custom_class_name: "..."
+command_table_key: "... | not-needed"
+registration_file: "... | not-needed"
+customization_goals: "..."
+planned_hooks:
+  - "_build_arguments_schema"
+  - "pre_operations"
+blocked_on: []
+```
+
+If `blocked_on` is non-empty, ask a focused question instead of generating code.
+
+After editing, report the files changed and the validation command/result.
+
+## Validation
+
+Prefer the narrowest validation available:
+
+1. `az <target command> -h` or the repo's equivalent command-load/help test command.
+2. A focused existing unit test for the target module.
+3. A command table import/load check for the target module.
+4. `git status --short` and a diff review only when executable validation is unavailable.
+
+If the generated command cannot be loaded because dependencies are unavailable in the local environment, state that clearly and provide the attempted command.
+
+## Common Mistakes To Avoid
+
+- Do not edit generated AAZ files under `aaz/latest` for manual customization.
+- Do not copy generated operation classes into `custom.py`.
+- Do not invent argument names; read the generated argument schema first.
+- Do not assume every AAZ custom needs `resource_group` and `name` aliases.
+- Do not overwrite command table entries before confirming the full command key.
+- Do not swallow non-404 HTTP errors in pre-operation checks.
diff --git a/.github/skills/common-custom-code-router/SKILL.md b/.github/skills/common-custom-code-router/SKILL.md
new file mode 100644
index 00000000000..59f43c238b9
--- /dev/null
+++ b/.github/skills/common-custom-code-router/SKILL.md
@@ -0,0 +1,137 @@
+---
+name: common-custom-code-router
+description: "Use when adding or updating Azure CLI command module custom code and deciding whether the requested work should use AAZ subclass custom, legacy SDK-backed custom, or legacy non-SDK custom before generating code."
+argument-hint: "Describe the module, command group, command/action, and intended behavior if known."
+---
+
+# Common Custom Code Router
+
+Use this workflow before generating Azure CLI command module custom code when the requested change may fit more than one authoring pattern.
+
+The router classifies the work into exactly one primary route:
+
+1. `aaz-subclass-custom`
+2. `legacy-sdk-backed-custom`
+3. `legacy-non-sdk-custom`
+
+This skill is a classifier. Do not implement the command while routing unless the route is already clear and the user asked for implementation.
+
+## Module-General Scope
+
+Apply this classification across all Azure CLI command modules under `src/azure-cli/azure/cli/command_modules`. Module names such as `acr`, `acs`, or command groups such as `aks safeguards` are examples only. Do not treat any example module as the scope of this skill.
+
+Always classify by the requested behavior and local evidence in the target module: generated AAZ assets, command registration style, available client factories, handler shape, and neighboring command patterns.
+
+## Inputs
+
+Start with the information available in the prompt and editor context:
+
+- target module, such as `acr` or `acs`
+- target command group, such as `acr`, `acr helm`, `aks safeguards`, or any other module command group
+- target command or action, such as `show`, `create`, `login`, `check-health`, or a new action name
+- intended behavior or service operation
+- current file path, if the user is editing one
+
+If a required input is missing, infer it from the current file path or nearest existing module pattern. Ask the user only when the missing input is a product or API decision, not when it can be discovered from the repository.
+
+## Evidence To Gather
+
+Use narrow searches and nearby reads. Prefer the target module only.
+
+1. Locate the module root under `src/azure-cli/azure/cli/command_modules/<module>/`.
+2. Read or search the module's `__init__.py` for `load_aaz_command_table`.
+3. Search `aaz/latest` for generated files matching the target resource/action, such as `_create.py`, `_show.py`, `_list.py`, `_delete.py`, `_update.py`, or `_wait.py`.
+4. Search `commands.py` for the target command group and nearby `CliCommandType` definitions.
+5. Search `custom.py` and neighboring files for existing custom classes inheriting generated AAZ command classes.
+6. Search `_client_factory.py` and nearby command registrations for reusable `cf_*` client factories.
+7. Inspect neighboring commands with the same resource family or command group.
+
+For new commands, do not require an existing exact command. Use the nearest command group, nearest resource family, generated AAZ assets, and intended service operation as evidence.
+
+## Route Decision
+
+### Route 1: AAZ Subclass Custom
+
+Choose `aaz-subclass-custom` when the requested work customizes or wraps an AAZ generated command.
+
+Strong signals:
+
+- Matching generated command exists under `aaz/latest/.../_<verb>.py`.
+- Generated file contains `# Code generated by aaz-dev-tools` and `class <Verb>(AAZCommand)`.
+- Existing nearby custom code imports from `.aaz.latest...` and defines `class XxxCustom(Create|Show|List|Update|Delete|Wait)`.
+- The requested change is mainly argument UX, argument schema, pre-validation, post-processing, lifecycle hooks, or a small behavior override around an existing generated operation.
+- Code would naturally use `self.ctx.args`, `has_value`, `AAZStrArg`, `AAZResourceGroupNameArg`, `pre_operations`, `post_operations`, or `_build_arguments_schema`.
+
+Do not choose this route just because the module has an `aaz/` directory. The generated command must match the requested resource/action or the command group must already be AAZ-first.
+
+### Route 2: Legacy SDK-Backed Custom
+
+Choose `legacy-sdk-backed-custom` when the command should be a hand-written function that calls an Azure Python SDK client.
+
+Strong signals:
+
+- Existing command group uses `CliCommandType(..., client_factory=cf_xxx)`.
+- Command registration uses `g.command(...)`, `g.show_command(...)`, or `g.generic_update_command(...)` with an `operations_tmpl` pointing to a module function.
+- Handler is or should be a `def` function in `custom.py` or another module file.
+- The handler takes `client` or can reuse a `cf_*` client factory.
+- Main behavior is `client.get(...)`, `client.list(...)`, `client.list_by_resource_group(...)`, `client.begin_create...`, `client.begin_update...`, `client.begin_delete...`, or similar SDK methods.
+- Code constructs SDK models through `cmd.get_models(...)`.
+- The change is CRUD, update, action-on-resource, identity/encryption/network policy, LRO, or `generic_update_command` style behavior.
+
+If both AAZ and SDK are viable, prefer the existing command group's dominant style. If the group is mixed and both implementations are equally plausible, ask one question about the intended API source.
+
+### Route 3: Legacy Non-SDK Custom
+
+Choose `legacy-non-sdk-custom` when the command is hand-written but the main behavior is not a simple SDK resource operation.
+
+Strong signals:
+
+- Main behavior uses local tools or subprocesses, such as `docker`, `podman`, `kubectl`, `helm`, `notary`, `Popen`, `subprocess.run`, or `subprocess.check_output`.
+- Main behavior uses raw HTTP, data-plane APIs, custom REST calls, external downloads, or `send_raw_request`, `requests`, `urlopen`, or generated AAZ commands only as internal helpers.
+- Main behavior orchestrates multiple services, local files, environment variables, credentials, diagnostics, install flows, archive packaging, kubeconfig, or browser/proxy behavior.
+- The command may still be registered through `CliCommandType`, but a SDK CRUD/action template would not describe the implementation.
+
+Examples include login, check-health, install-cli, browse, repository/data-plane operations, import/export helpers, and local packaging flows.
+
+## Tie Breakers
+
+Use these tie breakers in order:
+
+1. Prefer the dominant style of the target command group.
+2. Prefer the nearest sibling command that uses the same resource family and verb.
+3. Prefer AAZ subclass custom only when matching generated AAZ command assets already exist and the customization is around that operation.
+4. Prefer legacy SDK-backed custom when the SDK operation/client factory is the primary service interface.
+5. Prefer legacy non-SDK custom when the behavior is a workflow, local-tool operation, data-plane operation, or diagnostic flow.
+6. If still ambiguous, ask one concise question that names the two plausible routes and the missing decision.
+
+## Output Format
+
+Return a compact routing result before implementation:
+
+```yaml
+route: aaz-subclass-custom | legacy-sdk-backed-custom | legacy-non-sdk-custom
+confidence: high | medium | low
+evidence:
+  - "Concrete repo signal, file, symbol, or pattern."
+  - "Concrete repo signal, file, symbol, or pattern."
+resolved_slots:
+  module_name: "<module or unknown>"
+  command_group: "<group or unknown>"
+  operation_module: "<module path or unknown>"
+  generated_aaz_base: "<class import or not-applicable>"
+  client_factory: "<cf_xxx or not-applicable>"
+  primary_service_interface: "aaz | sdk | non-sdk | unknown"
+open_questions:
+  - "Only include if required to proceed."
+next_skill: "common-aaz-custom-code-generation | common-legacy-sdk-backed-custom-code-generation | common-legacy-non-sdk-custom-code-generation"
+```
+
+Keep `evidence` grounded in existing files or in the user's stated intended behavior. Do not claim an exact route based only on module name.
+
+## Common Mistakes To Avoid
+
+- Do not classify a whole module as AAZ just because `aaz/latest` exists.
+- Do not classify every non-AAZ custom function as SDK-backed.
+- Do not classify commands that call `docker`, `kubectl`, `helm`, raw HTTP, or data-plane APIs as SDK-backed just because they live in `custom.py`.
+- Do not require an exact existing command when the user is adding a new command. Use command group style, generated assets, SDK availability, and requested behavior.
+- Do not edit generated AAZ files under `aaz/latest` unless the user explicitly asks to modify generated output and understands regeneration risk.
\ No newline at end of file
diff --git a/.github/skills/common-legacy-non-sdk-custom-code-generation/SKILL.md b/.github/skills/common-legacy-non-sdk-custom-code-generation/SKILL.md
new file mode 100644
index 00000000000..5a57f94d5d6
--- /dev/null
+++ b/.github/skills/common-legacy-non-sdk-custom-code-generation/SKILL.md
@@ -0,0 +1,244 @@
+---
+name: common-legacy-non-sdk-custom-code-generation
+description: "Use after routing to legacy non-SDK custom, or when adding/updating Azure CLI legacy custom command functions whose main behavior is local tools, subprocesses, data-plane APIs, raw HTTP, diagnostics, install flows, file/environment orchestration, or generated AAZ commands used only as helpers."
+argument-hint: "Provide module, command group, command/action, primary workflow type, external tool/API, and intended behavior if known."
+---
+
+# Common Legacy Non-SDK Custom Code Generation
+
+Use this workflow to generate or update hand-written Azure CLI custom command code whose primary behavior is not a simple Azure Python SDK resource operation and not an AAZ subclass customization.
+
+This skill starts after the route is known or strongly suspected to be `legacy-non-sdk-custom`. If the route is unclear, use `common-custom-code-router` first.
+
+## Scope
+
+This is module-general and applies across Azure CLI command modules under `src/azure-cli/azure/cli/command_modules`.
+
+Use this skill for:
+
+- local tools and subprocesses such as `docker`, `podman`, `kubectl`, `helm`, `notary`, `Popen`, `subprocess.run`, or `subprocess.check_output`
+- data-plane APIs, custom REST calls, raw HTTP, `send_raw_request`, `requests`, or `urlopen` as the primary behavior
+- diagnostics, install flows, archive packaging, browser/proxy behavior, kubeconfig, local files, environment variables, or credential workflows
+- multi-service orchestration where no single SDK CRUD/action handler describes the command
+- generated AAZ commands used only as internal helpers inside a legacy custom workflow
+
+Do not use this skill for:
+
+- AAZ Subclass Custom (`aaz-subclass-custom`): public commands implemented by subclassing generated AAZ command classes
+- Legacy SDK-Backed Custom (`legacy-sdk-backed-custom`): public commands whose main behavior is an Azure Python SDK client CRUD/action call
+- editing generated files under `aaz/latest`
+
+## Slots To Resolve
+
+Resolve these slots before editing the related code. Prefer repository evidence over asking the user. These are not all user-provided inputs; some are derived or conditional.
+
+```yaml
+module_name: "<module under command_modules>"
+command_group: "<az command group>"
+command_verb_or_action: "<CLI verb/action>"
+registration_file: "<commands.py or module loader file>"
+command_type_name: "<local CliCommandType variable or new variable name>"
+operations_tmpl: "<azure.cli.command_modules.<module>.<file>#{}>"
+handler_file: "<custom.py or another manual module file>"
+handler_name: "<Python function registered by the command>"
+primary_workflow_type: "<local-tool | subprocess | data-plane | raw-http | diagnostic | install | file-workflow | multi-service-orchestration | aaz-helper>"
+external_dependencies: "<tool/module/service names or not-needed>"
+credential_source: "<CLI profile | AAD token | username/password | environment | not-needed>"
+endpoint_or_target: "<URL/resource/tool target or derived>"
+confirmation_required: "<true | false | not-needed>"
+output_shape: "<plain result | dict | list | warning-only | delegated tool output | local pattern>"
+validation_command: "<narrow command-load/help/test command or unknown>"
+```
+
+If the primary workflow type cannot be identified, stop and ask one focused question. Do not turn an unknown workflow into SDK-backed or AAZ custom only to fit a template.
+
+## Evidence To Gather
+
+Gather only the evidence needed for the slots.
+
+1. Read the target module's `commands.py` around the command group and nearby `CliCommandType` definitions.
+2. Read the nearest non-SDK handler in `custom.py` or sibling manual files.
+3. Search for local helpers for tool discovery, subprocess execution, credential acquisition, endpoint construction, errors, and formatting.
+4. Read `_params.py` only if new or changed CLI parameters are required.
+5. Read `_help.py` or generated help only if examples/help need updates.
+6. Read tests only when the workflow has existing test patterns or high behavioral risk.
+
+## Uncertainty Gates
+
+Before generating code, reduce uncertainty with these gates:
+
+- If the command can be implemented as an AAZ subclass around a matching generated operation, route to `aaz-subclass-custom` instead.
+- If the primary behavior is a single Azure Python SDK client CRUD/action call, route to `legacy-sdk-backed-custom` instead.
+- If using raw HTTP only as a small guard around an AAZ subclass, route to `aaz-subclass-custom` instead.
+- If a local tool is required, resolve how the module discovers that tool and how it reports missing tools.
+- If subprocess is required, pass arguments as a list and avoid `shell=True` unless an existing local pattern requires it.
+- If credentials, tokens, passwords, or connection strings are involved, never log them and never include them in errors.
+- If the workflow reaches an external endpoint, use existing cloud suffix, profile, proxy, verification, retry, and error-handling patterns.
+- If behavior is destructive, interactive, or expensive, follow local `--yes`/confirmation patterns.
+
+## Implementation Workflow
+
+1. Add or reuse a `CliCommandType` in the registration file. Non-SDK custom command types often have no `client_factory`.
+2. Register the command with the local style: `g.command`, `g.show_command`, or another existing module pattern.
+3. Add or update parameters in `_params.py` only when the command UX changes require it.
+4. Add the handler function in the manual code file.
+5. Keep workflow-specific logic in small helpers: tool discovery, command execution, endpoint building, credential acquisition, response parsing, and error mapping.
+6. Reuse local error classes, validators, formatters, and logging style.
+7. Sanitize logs and exceptions before surfacing subprocess commands, HTTP headers, request bodies, credentials, or tokens.
+8. Update help/tests only when examples, parameters, or behavior changed.
+9. Run the narrowest validation available.
+
+## Templates
+
+Treat templates as patterns, not fixed implementations. Replace every placeholder with names found in the target module. Never leave angle-bracket placeholders such as `<handler_name>` in generated code.
+
+### Template: Command Registration Without SDK Client
+
+Use this when registering a non-SDK custom handler.
+
+```python
+<command_type_name> = CliCommandType(
+    operations_tmpl='azure.cli.command_modules.<module>.<handler_file>#{}',
+    table_transformer=<table_transformer>,
+)
+
+with self.command_group('<command_group>', <command_type_name>) as g:
+    g.command('<verb-or-action>', '<handler_name>')
+```
+
+Omit `table_transformer` when not used by neighboring commands. Add `client_factory` only when a secondary SDK helper is truly part of the existing local pattern, not because the command is registered through `CliCommandType`.
+
+### Template: Local Tool Or Subprocess Workflow
+
+Use this when the primary behavior invokes a local executable.
+
+```python
+def _get_<tool>_command():
+    import shutil
+    from knack.util import CLIError
+
+    command = '<tool>'
+    if not shutil.which(command):
+        raise CLIError("'<tool>' is required for this command. Install it and try again.")
+    return command
+
+
+def _run_<tool>_command(command_parts):
+    from subprocess import PIPE, Popen
+    from knack.util import CLIError
+
+    process = Popen(command_parts, stdout=PIPE, stderr=PIPE)
+    stdout, stderr = process.communicate()
+    if process.returncode != 0:
+        raise CLIError(stderr.decode().strip() or "Command failed.")
+    return stdout.decode().strip()
+
+
+def <handler_name>(cmd, <args>):
+    tool_command = _get_<tool>_command()
+    return _run_<tool>_command([tool_command, '<subcommand>', <arg_values>])
+```
+
+Follow existing module patterns for tool fallback, platform-specific behavior, prompts, warning text, and diagnostics context.
+
+### Template: Raw HTTP Or Data-Plane Workflow
+
+Use this when the primary behavior calls an HTTP endpoint or data-plane API and no SDK-backed or AAZ subclass route fits.
+
+```python
+def <handler_name>(cmd, <args>):
+    from azure.cli.core.util import send_raw_request
+
+    url = <build_url_from_cloud_profile_and_args>(cmd, <args>)
+    headers = <build_headers_without_logging_secrets>(cmd, <args>)
+    response = send_raw_request(cmd.cli_ctx, '<METHOD>', url, headers=headers, body=<body_or_none>)
+    return <deserialize_or_shape_response>(response)
+```
+
+Use existing auth helpers, cloud suffixes, request verification, and error mapping from the target module. If the API is data-plane and uses `requests`, follow neighboring module patterns for token acquisition and SSL/proxy handling.
+
+### Template: Diagnostic Workflow
+
+Use this when the command runs checks and reports pass/fail results.
+
+```python
+def <handler_name>(cmd, <args>, yes=False):
+    results = []
+    results.append(_check_<dependency>(<args>))
+    results.append(_check_<connectivity>(cmd, <args>))
+    return <format_diagnostic_results>(results)
+```
+
+Keep diagnostic checks independently testable. For expensive or destructive checks, follow local confirmation patterns.
+
+### Template: AAZ Command As Internal Helper
+
+Use this only when a legacy custom workflow calls a generated AAZ command internally but the public command remains legacy non-SDK custom.
+
+```python
+def <handler_name>(cmd, <args>):
+    from .aaz.latest.<resource_path>._show import Show as <AAZShow>
+
+    result = <AAZShow>(cli_ctx=cmd.cli_ctx)(command_args={
+        '<arg-name>': <arg-value>,
+    })
+    return <continue_legacy_workflow>(cmd, result, <args>)
+```
+
+Do not confuse this with AAZ subclass custom. If the public command itself should be an AAZ subclass, route to `aaz-subclass-custom`.
+
+### Fallback: Unmatched Non-SDK Business Logic
+
+If no template matches the requested workflow, do not force it into local tool, raw HTTP, or diagnostics. First identify:
+
+- the workflow boundary and primary side effect
+- external dependencies and how the module already discovers or authenticates them
+- whether the handler needs `cmd`, CLI context, profile/cloud data, credentials, confirmation, or local files
+- output shape and error behavior
+- the smallest helper functions needed to isolate risky operations
+
+Then generate the smallest legacy handler and helpers that match the local module pattern. If the primary service interface becomes SDK or AAZ, route back to evaluation.
+
+## Output Expectations
+
+Before editing, report:
+
+```yaml
+route: legacy-non-sdk-custom
+module_name: "..."
+command_group: "..."
+command_verb_or_action: "..."
+handler_file: "..."
+handler_name: "..."
+primary_workflow_type: "..."
+external_dependencies: "... | not-needed"
+credential_source: "... | not-needed"
+registration_file: "..."
+customization_goals: "..."
+blocked_on: []
+```
+
+If `blocked_on` is non-empty, ask a focused question instead of generating code.
+
+After editing, report the files changed and the validation command/result.
+
+## Validation
+
+Prefer the narrowest validation available:
+
+1. `az <target command> -h` or the repo's equivalent command-load/help test command.
+2. A focused existing unit test for the target module.
+3. A command table import/load check for the target module.
+4. For local-tool commands, a dry-run, mockable helper test, or help/load check rather than invoking destructive external effects.
+5. `git status --short` and a diff review only when executable validation is unavailable.
+
+If dependencies are unavailable in the local environment, state that clearly and provide the attempted command.
+
+## Common Mistakes To Avoid
+
+- Do not choose this skill just because code lives in `custom.py`.
+- Do not classify SDK CRUD/action handlers as non-SDK because they include local validation helpers.
+- Do not use `shell=True` unless a local pattern requires it and inputs are controlled.
+- Do not log secrets, tokens, passwords, credentials, or full commands containing sensitive values.
+- Do not run destructive local tools or external operations during validation.
+- Do not edit generated AAZ files under `aaz/latest`.
\ No newline at end of file
diff --git a/.github/skills/common-legacy-sdk-backed-custom-code-generation/SKILL.md b/.github/skills/common-legacy-sdk-backed-custom-code-generation/SKILL.md
new file mode 100644
index 00000000000..6c676b2381e
--- /dev/null
+++ b/.github/skills/common-legacy-sdk-backed-custom-code-generation/SKILL.md
@@ -0,0 +1,239 @@
+---
+name: common-legacy-sdk-backed-custom-code-generation
+description: "Use after routing to legacy SDK-backed custom, or when adding/updating Azure CLI legacy custom command functions that call Azure Python SDK clients through CliCommandType, client_factory, cmd.get_models, g.command, g.show_command, or generic_update_command."
+argument-hint: "Provide module, command group, command/action, SDK client/factory, SDK operation, and intended behavior if known."
+---
+
+# Common Legacy SDK-Backed Custom Code Generation
+
+Use this workflow to generate or update hand-written Azure CLI custom command code whose primary implementation calls an Azure Python SDK client.
+
+This skill starts after the route is known or strongly suspected to be `legacy-sdk-backed-custom`. If the route is unclear, use `common-custom-code-router` first.
+
+## Scope
+
+This is module-general and applies across Azure CLI command modules under `src/azure-cli/azure/cli/command_modules`.
+
+Use this skill for:
+
+- command handlers registered through `CliCommandType`, `g.command`, `g.show_command`, or `g.generic_update_command`
+- handler functions in `custom.py` or another manual module file
+- SDK client calls such as `client.get`, `client.list`, `client.list_by_resource_group`, `client.begin_create_or_update`, `client.begin_create`, `client.begin_update`, `client.begin_delete`, or action methods
+- SDK model construction with `cmd.get_models(...)`
+- command-specific validation, normalization, model shaping, LRO handling, and output shaping around SDK operations
+
+Do not use this skill for:
+
+- AAZ Subclass Custom (`aaz-subclass-custom`): generated AAZ command subclasses, `self.ctx.args`, `_build_arguments_schema`, `pre_operations`, or `post_operations`
+- Legacy Non-SDK Custom (`legacy-non-sdk-custom`): local tools, subprocesses, data-plane workflows, raw HTTP as the primary implementation, diagnostics, installs, file/environment orchestration, or browser/proxy workflows
+- editing generated files under `aaz/latest`
+
+## Slots To Resolve
+
+Resolve these slots before editing the related code. Prefer repository evidence over asking the user. These are not all user-provided inputs; some are derived or conditional.
+
+```yaml
+module_name: "<module under command_modules>"
+command_group: "<az command group>"
+command_verb_or_action: "<CLI verb/action>"
+registration_file: "<commands.py or module loader file>"
+command_type_name: "<local CliCommandType variable or new variable name>"
+operations_tmpl: "<azure.cli.command_modules.<module>.<file>#{}>"
+handler_file: "<custom.py or another manual module file>"
+handler_name: "<Python function registered by the command>"
+client_factory: "<cf_xxx or not-needed>"
+sdk_client_methods: "<client method or methods used as primary service interface>"
+sdk_model_names: "<cmd.get_models names or not-needed>"
+table_transformer: "<existing transformer or not-needed>"
+supports_no_wait: "<true | false | not-needed>"
+customization_goals: "<crud | action | generic-update | validation | model-shaping | lro | output-shaping>"
+validation_command: "<narrow command-load/help/test command or unknown>"
+```
+
+If `client_factory` or the SDK operation cannot be resolved, do not invent them. Search the module's `_client_factory.py`, neighboring command registrations, and SDK-backed sibling handlers first. Ask one focused question only when the SDK/API choice is a product decision.
+
+## Evidence To Gather
+
+Gather only the evidence needed for the slots.
+
+1. Read the target module's `commands.py` around the command group and nearby `CliCommandType` definitions.
+2. Read `_client_factory.py` for reusable `cf_*` factories and client shapes.
+3. Read the nearest SDK-backed handler in `custom.py` or a sibling manual module.
+4. Read `_params.py` when the change affects command behavior or argument UX for an existing or new parameter.
+5. Read `_help.py` or generated help when user-facing help or examples may need to stay aligned with the behavior.
+6. Inspect local validators, `_utils.py`, `_validators.py`, `_format.py`, and tests only when the target command needs those patterns.
+
+## Uncertainty Gates
+
+Before generating code, reduce uncertainty with these gates:
+
+- If matching AAZ generated assets already implement the command and the work is only an AAZ wrapper/customization, route to `aaz-subclass-custom` instead.
+- If local tools, subprocesses, data-plane calls, raw HTTP, diagnostics, install flows, or file/environment orchestration are the main behavior, route to `legacy-non-sdk-custom` instead.
+- If no SDK client factory or SDK operation can be identified, stop and ask or route back to evaluation.
+- If the command group already has a dominant SDK-backed style, follow its registration and handler style.
+- If the command group is mixed, prefer the nearest sibling command with the same resource family and verb.
+- Do not add broad abstractions unless the module already uses them or the new command shares real logic with existing handlers.
+
+## Implementation Workflow
+
+1. Add or reuse a `CliCommandType` in the registration file.
+2. Register the command with the local style: `g.command`, `g.show_command`, or `g.generic_update_command`.
+3. Add or update parameters in `_params.py` when the handler signature, command behavior, or argument UX changes require it.
+4. Add the handler function in the manual code file.
+5. Keep the handler signature aligned with registration: include `cmd` when using CLI context/models, include `client` when using a `client_factory`.
+6. Reuse local validators/helpers for resource group resolution, resource ID parsing, SKU checks, confirmation prompts, or cloud-specific behavior.
+7. Construct SDK models with `cmd.get_models(...)` only for model types actually needed.
+8. Return SDK pollers directly for LRO commands unless neighboring code wraps them with `LongRunningOperation` for a reason.
+9. For behavior changes, do a consistency pass over the affected command surface and update related params, help/examples, validation/errors, output expectations, and focused tests as needed.
+10. Run the narrowest validation available.
+
+## Templates
+
+Treat templates as patterns, not fixed implementations. Replace every placeholder with names found in the target module. Never leave angle-bracket placeholders such as `<handler_name>` in generated code.
+
+### Template: Command Registration
+
+Use this when adding or wiring a SDK-backed handler.
+
+```python
+<command_type_name> = CliCommandType(
+    operations_tmpl='azure.cli.command_modules.<module>.<handler_file>#{}',
+    client_factory=<client_factory>,
+    table_transformer=<table_transformer>,
+)
+
+with self.command_group('<command_group>', <command_type_name>) as g:
+    g.command('<verb-or-action>', '<handler_name>', supports_no_wait=<TrueOrFalse>)
+```
+
+Omit `table_transformer` or `supports_no_wait` when not used by neighboring commands.
+
+### Template: List Or Show Handler
+
+Use this when the primary behavior is an SDK read operation.
+
+```python
+def <handler_name>(cmd, client, <resource_args>):
+    <normalized_args> = <normalize_or_validate_args>(cmd, <resource_args>)
+    return client.<get_or_list_method>(<normalized_args>)
+```
+
+### Template: Create Or Update Handler
+
+Use this when the command builds a SDK model and sends it through a create/update SDK method.
+
+```python
+def <handler_name>(cmd, client, <resource_args>, <option_args>):
+    <ModelName>, <NestedModelName> = cmd.get_models('<ModelName>', '<NestedModelName>')
+
+    parameters = <ModelName>(
+        <property_name>=<value>,
+        <nested_property>=<NestedModelName>(<nested_values>),
+    )
+
+    <apply_optional_fields>(cmd, parameters, <option_args>)
+    return client.<begin_create_or_update_method>(<resource_args>, parameters)
+```
+
+Use the exact SDK method name from the SDK client. Do not guess `begin_create_or_update` if the client uses a different method.
+
+### Template: Delete Handler
+
+Use this when the command deletes a resource through the SDK.
+
+```python
+def <handler_name>(cmd, client, <resource_args>, yes=False):
+    from azure.cli.core.util import user_confirmation
+
+    user_confirmation("Are you sure you want to delete '<resource display>'?", yes)
+    <normalized_args> = <normalize_or_validate_args>(cmd, <resource_args>)
+    return client.<begin_delete_method>(<normalized_args>)
+```
+
+Follow neighboring command behavior for `--yes` prompts and LRO return handling.
+
+### Template: Generic Update
+
+Use this when the module uses `g.generic_update_command` for read-modify-write behavior.
+
+```python
+with self.command_group('<command_group>', <command_type_name>) as g:
+    g.generic_update_command(
+        '<verb-or-action>',
+        getter_name='<getter_handler_name>',
+        setter_name='<setter_handler_name>',
+        custom_func_name='<custom_update_function_name>',
+        custom_func_type=<command_type_name>,
+        client_factory=<client_factory>,
+    )
+
+
+def <getter_handler_name>(cmd, client, <resource_args>):
+    return client.<get_method>(<resource_args>)
+
+
+def <custom_update_function_name>(cmd, instance, <option_args>):
+    if <option_arg> is not None:
+        instance.<sdk_property> = <option_arg>
+    return instance
+
+
+def <setter_handler_name>(cmd, client, <resource_args>, parameters):
+    return client.<begin_update_method>(<resource_args>, parameters)
+```
+
+Only use this template when the command group already uses generic update or when read-modify-write semantics are required.
+
+### Fallback: Unmatched SDK Business Logic
+
+If no template matches the requested SDK-backed behavior, do not force it into CRUD. First identify:
+
+- the SDK client method or method sequence
+- the SDK model inputs and return value
+- whether the behavior is a single SDK action, read-modify-write, LRO, or multi-step SDK workflow
+- whether command UX needs parameters, validators, confirmation, or output shaping
+
+Then generate the smallest handler and helpers that express that SDK interaction. If the primary behavior stops being SDK-backed, route back to evaluation.
+
+## Output Expectations
+
+Before editing, report:
+
+```yaml
+route: legacy-sdk-backed-custom
+module_name: "..."
+command_group: "..."
+command_verb_or_action: "..."
+handler_file: "..."
+handler_name: "..."
+client_factory: "... | not-needed"
+sdk_client_methods: "..."
+sdk_model_names: "... | not-needed"
+registration_file: "..."
+customization_goals: "..."
+blocked_on: []
+```
+
+If `blocked_on` is non-empty, ask a focused question instead of generating code.
+
+After editing, report the files changed and the validation command/result.
+
+## Validation
+
+Prefer the narrowest validation available:
+
+1. `az <target command> -h` or the repo's equivalent command-load/help test command.
+2. A focused existing unit test for the target module.
+3. A command table import/load check for the target module.
+4. `git status --short` and a diff review only when executable validation is unavailable.
+
+If dependencies are unavailable in the local environment, state that clearly and provide the attempted command.
+
+## Common Mistakes To Avoid
+
+- Do not choose this skill just because code lives in `custom.py`.
+- Do not invent SDK method names, model names, or client factories.
+- Do not ignore the command group's existing registration style.
+- Do not use SDK-backed templates for data-plane, subprocess, raw HTTP, or diagnostic workflows.
+- Do not edit generated AAZ files under `aaz/latest`.
+- Do not log secrets, tokens, credentials, or full request bodies containing sensitive fields.
\ No newline at end of file
diff --git a/.github/skills/common-live-test-from-help/SKILL.md b/.github/skills/common-live-test-from-help/SKILL.md
new file mode 100644
index 00000000000..c2ec1e561d0
--- /dev/null
+++ b/.github/skills/common-live-test-from-help/SKILL.md
@@ -0,0 +1,49 @@
+---
+name: common-live-test-from-help
+description: "Use when creating or updating Azure CLI live tests from module help examples. Resolve generated vs manual help precedence, detect missing examples, scaffold scenario tests, and enforce 80% command-level coverage checks."
+---
+
+# Common Live Test From Help
+
+Generate consistent live test scaffolding from effective command help.
+
+## Inputs
+- Module path, e.g. `src/azure-cli/azure/cli/command_modules/<module-name>`
+- Existing help files (`generated/_help.py`, `manual/_help.py`, and top-level `_help.py`)
+- Existing tests under `tests/latest/`
+
+## Procedure
+1. Resolve final help examples.
+- Read top-level `_help.py` for import precedence.
+- Read `generated/_help.py` first.
+- Read `manual/_help.py` second and treat overlapping entries as overrides.
+
+2. Build command/example inventory.
+- Keep only commands with executable `az ...` examples.
+- Record commands with missing examples.
+
+3. Ask before manual completion.
+- If missing examples exist, ask whether to continue with manual additions.
+- Provide the missing command list in the question.
+
+4. Generate or update live test files.
+- Update `tests/latest/example_steps.py` with `step_<name>` functions.
+- Update `tests/latest/test_<module>_scenario.py` to call all steps.
+- Keep or add coverage hooks: `calc_coverage(__file__)` and `raise_if()`.
+
+5. Ask before running tests.
+- Prompt user whether to run live tests.
+- If yes, run `azdev test <module> --live --no-exitfirst`.
+
+6. Evaluate coverage.
+- Parse `tests/latest/*_coverage.md` for command-level coverage.
+- If coverage < 80%, warn and recommend adding help examples and corresponding live test steps.
+
+## Output
+- Effective help mapping (command -> example source: generated/manual)
+- Missing example command list
+- Updated test files
+- Coverage summary and action items
+
+## Template
+- Use [live test template](./references/live-test-template.md) as the base structure.
diff --git a/.github/skills/common-live-test-from-help/references/live-test-template.md b/.github/skills/common-live-test-from-help/references/live-test-template.md
new file mode 100644
index 00000000000..3d7a37c9cf2
--- /dev/null
+++ b/.github/skills/common-live-test-from-help/references/live-test-template.md
@@ -0,0 +1,87 @@
+# Live Test Template (Help-driven)
+
+Use this template for codegen-style modules that organize tests under `tests/latest/`.
+
+## 1) `tests/latest/example_steps.py`
+
+```python
+from .. import try_manual
+
+
+@try_manual
+def step_<command_a>(test, checks=None):
+    if checks is None:
+        checks = []
+    test.cmd(
+        'az <group> <command-a> <args-from-help>',
+        checks=checks + [
+            # add stable checks
+        ]
+    )
+
+
+@try_manual
+def step_<command_b>(test, checks=None):
+    if checks is None:
+        checks = []
+    test.cmd(
+        'az <group> <command-b> <args-from-help>',
+        checks=checks + [
+            # add stable checks
+        ]
+    )
+```
+
+## 2) `tests/latest/test_<module>_scenario.py`
+
+```python
+import os
+from azure.cli.testsdk import ScenarioTest
+from .example_steps import step_<command_a>, step_<command_b>
+from .. import try_manual, raise_if, calc_coverage
+
+
+TEST_DIR = os.path.abspath(os.path.join(os.path.abspath(__file__), '..'))
+
+
+@try_manual
+def setup_scenario(test):
+    pass
+
+
+@try_manual
+def cleanup_scenario(test):
+    pass
+
+
+@try_manual
+def call_scenario(test):
+    setup_scenario(test)
+    step_<command_a>(test, checks=[])
+    step_<command_b>(test, checks=[])
+    cleanup_scenario(test)
+
+
+@try_manual
+class <ModuleName>ScenarioTest(ScenarioTest):
+
+    def test_<module>_scenario(self):
+        call_scenario(self)
+        calc_coverage(__file__)
+        raise_if()
+```
+
+## 3) Coverage Gate
+
+- Coverage file path usually becomes: `tests/latest/test_<module>_scenario_coverage.md`
+- Expected format includes `Coverage: covered/total`
+- Command-level coverage rule:
+  - if `covered/total < 0.8`, remind user to add missing help examples and corresponding step functions.
+
+## 4) Missing Example Prompt
+
+When missing examples are detected, ask the user:
+
+- "These commands have no usable help examples: <list>. Continue and add manual examples for them?"
+
+If user declines, continue only with commands that have usable examples and mark skipped commands in output.
diff --git a/.github/skills/openspec-apply-change/SKILL.md b/.github/skills/openspec-apply-change/SKILL.md
new file mode 100644
index 00000000000..f9df89a4e1e
--- /dev/null
+++ b/.github/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,161 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- For implementation tasks that add or update Azure CLI command module custom code, classify the work with `common-custom-code-router` before editing code. Use the router result to select exactly one generation skill: `common-aaz-custom-code-generation`, `common-legacy-sdk-backed-custom-code-generation`, or `common-legacy-non-sdk-custom-code-generation`.
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.github/skills/openspec-archive-change/SKILL.md b/.github/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 00000000000..c0c169d14f0
--- /dev/null
+++ b/.github/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,118 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+
+All artifacts complete. All tasks complete.
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.github/skills/openspec-explore/SKILL.md b/.github/skills/openspec-explore/SKILL.md
new file mode 100644
index 00000000000..771271a8fdb
--- /dev/null
+++ b/.github/skills/openspec-explore/SKILL.md
@@ -0,0 +1,290 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /opsx:explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │          CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change proposal
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.github/skills/openspec-propose/SKILL.md b/.github/skills/openspec-propose/SKILL.md
new file mode 100644
index 00000000000..716d2d3d39a
--- /dev/null
+++ b/.github/skills/openspec-propose/SKILL.md
@@ -0,0 +1,114 @@
+---
+name: openspec-propose
+description: Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Propose a new change - create the change and generate all artifacts in one step.
+
+I'll create a change with artifacts:
+- proposal.md (what & why)
+- design.md (how)
+- tasks.md (implementation steps)
+
+When ready to implement, run /opsx:apply
+
+---
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.github/skills/openspec-sync-specs/SKILL.md b/.github/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 00000000000..b6aad67abff
--- /dev/null
+++ b/.github/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,148 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.github/skills/openspec-update-change/SKILL.md b/.github/skills/openspec-update-change/SKILL.md
new file mode 100644
index 00000000000..3e1c931d27a
--- /dev/null
+++ b/.github/skills/openspec-update-change/SKILL.md
@@ -0,0 +1,86 @@
+---
+name: openspec-update-change
+description: Update an OpenSpec change by revising its existing planning artifacts and keeping them coherent with one another. Use when the user wants to revise a change's plan, fold new decisions into it, or reconcile its artifacts after an edit. Never edits code.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.6.0"
+---
+
+Revise a change's existing planning artifacts and keep them coherent. Never edit code.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to update.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to update.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Get the change's artifacts**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+   The artifact ids and paths come from the active schema - do NOT assume them, and do NOT branch on hardcoded artifact names. Custom schemas must work unchanged.
+
+   The files to edit are `artifactPaths.<id>.existingOutputPaths` - the concrete files that exist on disk, already glob-expanded for glob artifacts (e.g. `specs/**/*.md`). Do NOT write to `resolvedOutputPath`: for a glob artifact it is still the glob pattern, not a real file.
+
+3. **Understand the request**
+   - If the user asked for a specific revision ("the design now uses X"), that is the starting edit.
+   - If they only said "update" / "make this coherent", treat it as a coherence review: read the existing artifacts and check them against each other for contradictions, gaps, and duplication.
+
+4. **Read and reconcile**
+   - Read the artifact(s) the request touches and the change's other existing artifacts.
+   - Apply the requested edit. Then check every other existing artifact against it - in ANY direction: an edit to a later artifact may require revising an earlier one, not only the other way around. Build order is a useful reading order, not a constraint on which artifacts may be revised.
+   - Note everything that is now inconsistent, missing, or contradictory.
+   - Revise only files that already exist (`existingOutputPaths`). Do NOT create artifacts that don't exist yet, and do NOT invent new files under a glob artifact - note them and point the user to `/opsx:continue` to create them.
+   - If the change is already coherent, say so and make no edits.
+
+5. **Confirm and apply, one artifact at a time**
+   - Show each proposed revision and why. Write only after the user confirms.
+   - If the user rejects a revision, do not write it - leave that artifact unchanged.
+   - When a substantial rewrite is needed, get that artifact's rules and template first:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+
+6. **Point to the next step (guidance only - NEVER act on it)**
+   - Artifacts still missing -> suggest `/opsx:continue` to create them.
+   - Change already implemented (tasks checked off / already applied) -> the code may no longer match the revised plan; suggest `/opsx:apply` to carry the delta into code.
+   - Everything done and implemented -> suggest `/opsx:archive`.
+
+**Output**
+
+After each invocation, show:
+- Which artifacts were revised (and which proposed revisions were rejected)
+- Anything deferred to `/opsx:continue` (not-yet-created artifacts or files)
+- Where the change stands and the recommended next command
+
+**Guardrails**
+- Planning artifacts only - NEVER edit implementation code. If the revised plan implies code changes, stop and point to `/opsx:apply`.
+- Use the artifact ids and paths reported by `openspec status`; never branch on hardcoded artifact names.
+- Edit only the concrete files in `existingOutputPaths`; never write to a glob `resolvedOutputPath`.
+- Do not advance the build frontier: no new artifacts, no new files under glob artifacts - that is `/opsx:continue`'s job.
+- Confirm every edit with the user before writing.
+- If the request changes the change's *intent* rather than refining it, recommend starting fresh with `/opsx:new` (the "Update vs. Start Fresh" heuristic).
diff --git a/.gitignore b/.gitignore
index 28b786e6297..329fdbc1087 100644
--- a/.gitignore
+++ b/.gitignore
@@ -116,6 +116,10 @@ pip.log
 # exe
 *.exe
 
+# OpenSpec local change workspaces
+openspec/changes/*
+!openspec/changes/.gitkeep
+
 az_command_coverage.txt
 
 #cmd coverage
diff --git a/doc/ai_custom_code.md b/doc/ai_custom_code.md
new file mode 100644
index 00000000000..24ca861ef7f
--- /dev/null
+++ b/doc/ai_custom_code.md
@@ -0,0 +1,78 @@
+# AI-Assisted Custom Code Authoring
+
+This guide explains how Azure CLI contributors can use Copilot custom agents and OpenSpec to add or update command module custom code.
+
+## Summary
+
+Use `@custom-code-agent` for small, clear implementation tasks that do not need a durable spec record. Use OpenSpec for larger or user-facing behavior changes where proposal, design, tasks, and final specs should be reviewed and preserved.
+
+## Available Custom Code Agent
+
+- [custom-code.agent.md](../.github/agents/custom-code.agent.md): Focused on Azure CLI command module custom code changes, including AAZ subclass custom, legacy SDK-backed custom, and legacy non-SDK custom.
+
+<!-- Hidden for now.
+- live-test.agent.md: Generates or updates live tests from effective help content.
+- pr-generation.agent.md: Generates PR title and description with the `[AI][<module-name>]` title prefix.
+-->
+
+## How To Use Agents
+
+Call an agent explicitly from Copilot Chat when the change is small, local, and does not need an OpenSpec record:
+
+```text
+@custom-code-agent
+
+Module: <module-name>
+Command: az <module> <command-group> <command-or-action>
+Action: <add validation | update behavior | add parameter | fix bug | other>
+Business logic: <what should change, including important conditions and expected errors/output>
+```
+
+Required inputs are the module name, related command, intended action, and business logic. Add file paths, API versions, SDK readiness, examples, or links when they are relevant.
+
+Use `custom-code-agent` for implementation-focused changes where the requirement is already clear and the expected edit area is limited to Azure CLI command module custom code.
+
+## OpenSpec Workflow
+
+Use OpenSpec when a change should have a durable proposal, design, task list, and spec delta before implementation. This is the preferred path for larger changes, public command behavior changes, parameter or validation changes, and work that needs reviewable design context.
+
+Common entry points:
+
+- Propose a change with [/opsx:propose](../.github/prompts/opsx-propose.prompt.md).
+- Implement a proposed change with [/opsx:apply](../.github/prompts/opsx-apply.prompt.md).
+- Revise an existing change with [/opsx:update](../.github/prompts/opsx-update.prompt.md).
+- Archive a completed change with [/opsx:archive](../.github/prompts/opsx-archive.prompt.md).
+
+Local OpenSpec configuration and examples:
+
+- [openspec/config.yaml](../openspec/config.yaml)
+
+The `openspec/changes/` folder is a local development workspace for in-progress proposals, designs, tasks, and archived change artifacts. Keep the folder in the repository, but ignore its contents in git. The repository should keep final specs under `openspec/specs/`.
+
+The `openspec/specs/` folder is reserved for final specs that should be committed after a change is accepted or archived. Keep the folder in the repository with `.gitkeep` until there are real specs to track.
+
+## OpenSpec And Agents
+
+OpenSpec and agents are complementary:
+
+- OpenSpec records what should change, why it should change, the selected design, tasks, and acceptance criteria.
+- Agents execute focused implementation work, such as editing custom command code.
+- Small, obvious edits can go directly to `@custom-code-agent` without creating a spec.
+- Larger or user-facing behavior changes should start with `/opsx:propose`, then use `/opsx:apply` to implement the recorded plan.
+- If an OpenSpec design already records the custom-code route, agents should follow that route instead of re-deciding it during implementation.
+
+## When To Use Agents vs Skills vs Instructions
+
+- Agents: Isolated, focused workflow or specialized mode
+- Skills: Reusable task playbooks loaded on demand
+- Instructions: Always-on or file-scoped coding rules
+
+## Governance
+
+- Common skills are owned by the Azure CLI team.
+- If the common skills are not sufficient, service teams and developers are welcome to add module-level skills for their own workflows.
+- Module skill names must follow: `module-<module-name>`.
+- The Azure CLI team may selectively generalize module-level skills into common skills when they prove useful across modules.
+- We expect sub-agents to provide generalized capabilities instead of module-specific behavior.
+- Agent instructions are expected to be at az-cli level, not module-local policy.
+- If a specification is general and reusable across modules, align with owner before promoting it to shared instruction guidance.
diff --git a/openspec/changes/.gitkeep b/openspec/changes/.gitkeep
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/openspec/config.yaml b/openspec/config.yaml
new file mode 100644
index 00000000000..8fa1389dae8
--- /dev/null
+++ b/openspec/config.yaml
@@ -0,0 +1,37 @@
+schema: spec-driven
+
+context: |
+  Repository: Azure CLI.
+  Use Azure CLI command module names as OpenSpec spec domains for module-specific behavior.
+  Module-specific behavior belongs under openspec/specs/<module-name>/spec.md.
+  Shared custom code authoring and agent workflow rules belong under openspec/specs/custom-code-authoring/spec.md.
+
+  Custom code changes must first be routed as exactly one of:
+  - aaz-subclass-custom
+  - legacy-sdk-backed-custom
+  - legacy-non-sdk-custom
+
+  Use repository evidence before asking the user. Prefer current file context, nearby command registration, generated AAZ assets, client factories, handler shapes, and neighboring command patterns.
+  Do not edit generated AAZ files under aaz/latest unless explicitly requested and regeneration risk is accepted.
+  Prefer existing command group style, local validators/helpers, table transformers, and narrow validation commands.
+
+rules:
+  proposal:
+    - Include target module, command group, command/action, intended behavior, and known API/source constraints.
+    - State whether the change affects user-facing CLI behavior, custom-code authoring workflow, or both.
+    - Keep scope explicit and list non-goals when the request could be mistaken for another custom-code route.
+  specs:
+    - Use Azure CLI command module names as spec domains.
+    - For module-specific behavior, write delta specs under specs/<module-name>/spec.md within the change.
+    - For shared custom code authoring behavior, write delta specs under specs/custom-code-authoring/spec.md.
+    - Use SHALL requirements with concrete scenarios.
+    - Specify externally observable behavior, not incidental implementation details, unless the spec is for agent workflow behavior.
+  design:
+    - Include router output: route, evidence, next_skill, resolved slots, and open questions.
+    - Explain why the selected route is not one of the other two routes.
+    - Identify generated files, manual files, command registration files, client factories, or external tools involved.
+    - Identify the narrowest validation command before implementation.
+  tasks:
+    - Include command registration, handler/custom class edits, parameter/help updates, and tests only when needed.
+    - Keep tasks grouped by affected file or workflow step.
+    - Include a focused validation task for the touched behavior.
diff --git a/openspec/specs/.gitkeep b/openspec/specs/.gitkeep
new file mode 100644
index 00000000000..e69de29bb2d