feat: sync aws-transform skill from internal mainline; bump to 1.5.0 (#247)

Update the aws-transform continuous-modernization reference docs and bump
the plugin version from 1.4.0 to 1.5.0.

Reference doc changes:
- Restore CLI-first schedule skill corrected to the shipped surface:
  cadence is --recurrence (not raw cron), --type is singular, scheduled
  remediations removed, schedule delete also removes the anchor analysis,
  and adds the anchor/shared-child record model.
- Update security-agent skill for CFN-native agent space: new stack
  prefix (AtxSecurityAgentStack-), bucket prefix (atx-security-agent-),
  remove manual policy/SSM/config steps, simplify executor flow.
- Singular --type + per-job cancel in batch/EC2 execution skills.
- Route scheduling intent in SKILL.md and guide so agent never denies
  or offers local cron as a substitute.

Version bump applied in:
- plugins/aws-transform/.claude-plugin/plugin.json
- plugins/aws-transform/.codex-plugin/plugin.json
- .claude-plugin/marketplace.json

Co-authored-by: Alex Tsang <tsangale@amazon.com>

Author: AlexmTsang

.claude-plugin/marketplace.json

@@ -133,7 +133,7 @@
         "transform",
         "continuous modernization"
       ],
-      "version": "1.4.0"
+      "version": "1.5.0"
     },
     {
       "category": "development",

plugins/aws-transform/.claude-plugin/plugin.json

@@ -31,5 +31,5 @@
   "license": "Apache-2.0",
   "name": "aws-transform",
   "repository": "https://github.com/awslabs/agent-plugins",
-  "version": "1.4.0"
+  "version": "1.5.0"
 }

plugins/aws-transform/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-transform",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Migrate, modernize, and upgrade codebases to AWS. Transforms .NET Framework to .NET 8/10, mainframe COBOL to Java, VMware VMs to EC2, SQL Server to Aurora, and upgrades Java/Python/Node.js versions and AWS SDKs. AWS Transform - continuous modernization analyzes codebases for tech debt, security issues, and upgrade opportunities, then remediates them.",
   "author": {
     "name": "Amazon Web Services",

plugins/aws-transform/skills/aws-transform/SKILL.md

@@ -88,7 +88,7 @@ If the user's workload-unspecified request matches any of these intents, route t
 
 7. Ensure a supported region has been selected (see [continuous-modernization-setup.md](references/continuous-modernization-setup.md) "Choose your region") and prefixed inline (`AWS_REGION=$ATX_REGION`) on every `atx ct` command.
 
-8. Then use the appropriate continuous modernization skill — see [continuous-modernization](references/continuous-modernization.md)
+8. Then use the appropriate continuous modernization skill — see [continuous-modernization](references/continuous-modernization.md). Recurring/scheduled intent ("weekly scan", "every Monday", "on a schedule", "cron") routes to [continuous-modernization-schedule](references/continuous-modernization-schedule.md): scheduling is a real, shipped capability (`atx ct schedule create/list/get/enable/disable/delete`) that runs on remote infrastructure ONLY — never claim it doesn't exist, and never offer a local cron/systemd/launchd entry as a substitute or fallback.
 
 **When in doubt for a workload-unspecified request → continuous modernization.** This default applies ONLY after Step B has cleared — VMware, SQL, and mainframe never fall through to continuous modernization regardless of how the question is phrased; .NET only routes to continuous modernization after the user picks "analyze for tech debt / security / CVEs" in Step B's intent question (both "modernize" and "assessment for modernization" stay in the .NET workload). Once routed, do NOT manually read source files to find issues — that's what `atx ct analysis run` does.
 

plugins/aws-transform/skills/aws-transform/references/continuous-modernization-batch-execution.md

@@ -1,11 +1,11 @@
 ---
 name: remote-batch
-description: Run analysis or remediation at scale on AWS Batch (Fargate) using `atx ct remote` CLI commands. One container per (type x repo). Covers provisioning, job submission, status, cancel, and teardown.
+description: Run analysis or remediation at scale on AWS Batch (Fargate) using `atx ct remote` CLI commands. Exactly one --type per run; one container per repo. Covers provisioning, job submission, status, cancel, and teardown.
 ---
 
 # Remote Batch Execution
 
-Run analysis or remediation at scale on AWS Batch (Fargate). Each job runs in its own container — fan-out is `types x repos = N containers`. All orchestration is handled by the CLI (`atx ct remote ...`); no raw AWS commands needed.
+Run analysis or remediation at scale on AWS Batch (Fargate). Each job runs in its own container — one container per repo (exactly one --type per run). All orchestration is handled by the CLI (`atx ct remote ...`); no raw AWS commands needed.
 
 ## Telemetry
 
@@ -23,7 +23,7 @@ If the user explicitly opts out of telemetry, omit `--telemetry` for the rest of
 ## When to Use
 
 - Analyzing or remediating many repos in parallel (one container per repo)
-- Running multiple analysis types across sources (fan-out: types x repos)
+- Analyzing one type across many sources or repos in a single run (to run multiple types, submit once per type)
 - One-shot batch jobs with no persistent infrastructure between runs
 - Customer wants AWS-managed compute (no EC2 instance to manage)
 
@@ -142,11 +142,11 @@ Without `--execute`, the command prints the CFN template (dry-run preview).
 
 ### 3. Submit Analysis
 
-Requires Executor credentials. One container per (type x repo).
+Requires Executor credentials. Exactly one --type per run; one container per repo.
 
 ```bash
 atx ct remote analysis \
-  --types rapid-techdebt-analysis \
+  --type rapid-techdebt-analysis \
   --sources <src> \
   --mode batch \
   --stack-name <stack> \
@@ -156,11 +156,11 @@ atx ct remote analysis \
 
 Fan-out options:
 
-- `--types type1,type2` — multiple analysis types (rapid-techdebt-analysis, tech-debt-comprehensive, security, agentic-readiness, modernization-readiness, custom)
+- `--type <type>` — exactly ONE analysis type per run (rapid-techdebt-analysis, tech-debt-comprehensive, security, agentic-readiness, modernization-readiness, custom); to run multiple types, submit once per type
 - `--sources src1,src2` — multiple sources
 - `--repos src::repo1,src::repo2` — specific repos (fully qualified)
 - `--labels java,spring` — filter repos by labels (AND semantics)
-- `--transformation-name <name>` — required when `--types custom`
+- `--transformation-name <name>` — required when `--type custom`
 - `-g key=value` — configuration for custom transformations
 
 Stack targeting (choose one):
@@ -198,10 +198,12 @@ Re-submits only the non-completed jobs from the original batch.
 # Cancel all jobs in a batch
 atx ct remote cancel --batch <batch-name> --stack-name <stack>
 
-# Cancel a single job
-atx ct remote cancel --job <job-id> --stack-name <stack>
+# Cancel a single job (jobName, Batch job id, or remediation id from `remote status`)
+atx ct remote cancel --batch <batch-name> --job <job-id> --stack-name <stack>
 ```
 
+`--job` requires `--batch`. It kills only that job's container and marks only that repo's slot cancelled — sibling repos sharing the analysis id keep running, and the aggregate settles once every slot is terminal.
+
 ### 7. Submit Remediation
 
 Requires completed analysis with findings.
@@ -265,7 +267,7 @@ S3 buckets (source code, outputs) and Secrets Manager tokens are preserved. VPC/
 | ---------------------------------------------- | ----------------------------------------- | ---------------------------------------------------------------------------------------------- |
 | `Stack not deployed`                           | No Batch infra                            | Run `atx ct remote provision --mode batch ...`                                                 |
 | `Token invalid for source`                     | Expired/revoked SCM token                 | Run `atx ct remote credentials --source <src> --token <new> --ack`                             |
-| `Job count exceeds Lambda batch limit of 250`  | Too many type x repo combinations         | Split into multiple submissions                                                                |
+| `Job count exceeds Lambda batch limit of 250`  | Too many repos in one run                 | Split into multiple submissions                                                                |
 | `Batch name already exists`                    | Duplicate batch name                      | Use a unique `--batch-name` or omit for auto-generated                                         |
 | `No repos resolved`                            | Source has no repos or labels don't match | Check `atx ct repository list --source <src>`                                                  |
 | `No deployed stack found for tags`             | `--tags` matched no deployed stack        | Verify tags with `atx ct remote detect --mode batch --tags <k=v>`, or target by `--stack-name` |

plugins/aws-transform/skills/aws-transform/references/continuous-modernization-ec2-execution.md

@@ -76,13 +76,13 @@ atx ct discovery scan --source <src>
 
 EC2 supports 1-5 parallel workers (containers) on a single instance. Jobs are distributed round-robin across workers.
 
-| Customer intent              | Workers           | Instance type |
-| ---------------------------- | ----------------- | ------------- |
-| Single analysis / default    | 1                 | m5.2xlarge    |
-| 2 analysis types in parallel | 2                 | m5.4xlarge    |
-| 3-4 parallel jobs            | 3-4               | m5.4xlarge    |
-| 5 parallel jobs (max)        | 5                 | m5.8xlarge    |
-| 6+ parallel jobs             | Use Batch instead | —             |
+| Customer intent                               | Workers           | Instance type |
+| --------------------------------------------- | ----------------- | ------------- |
+| Single analysis / default                     | 1                 | m5.2xlarge    |
+| 2 parallel analyses (e.g. 2 repos, or 2 runs) | 2                 | m5.4xlarge    |
+| 3-4 parallel jobs                             | 3-4               | m5.4xlarge    |
+| 5 parallel jobs (max)                         | 5                 | m5.8xlarge    |
+| 6+ parallel jobs                              | Use Batch instead | —             |
 
 WorkerCount is fixed at stack-create time. Changing it requires a destructive redeploy (`teardown` + `provision`).
 
@@ -162,7 +162,7 @@ Requires Executor credentials. Jobs are distributed round-robin across workers.
 
 ```bash
 atx ct remote analysis \
-  --types rapid-techdebt-analysis \
+  --type rapid-techdebt-analysis \
   --sources <src> \
   --mode ec2 \
   --stack-name <stack-name> \
@@ -171,11 +171,11 @@ atx ct remote analysis \
 
 Fan-out options:
 
-- `--types type1,type2` — multiple analysis types
+- `--type <type>` — exactly ONE analysis type per run (to run multiple types, submit once per type)
 - `--sources src1,src2` — multiple sources
 - `--repos src::repo1,src::repo2` — specific repos (fully qualified)
 - `--labels java,spring` — filter repos by labels (AND semantics)
-- `--transformation-name <name>` — for `--types custom`
+- `--transformation-name <name>` — for `--type custom`
 - `-g key=value` — configuration for custom transformations
 
 Stack targeting (choose one):
@@ -204,10 +204,12 @@ Shows per-job status with completion counts.
 # Cancel all jobs in a group
 atx ct remote cancel --group <ec2-group-id>
 
-# Cancel a single job
+# Cancel a single job (a job key `repo#type` / `repo#findingId`, or its result ULID)
 atx ct remote cancel --group <ec2-group-id> --job <repo#type>
 ```
 
+`--job` kills only that job's in-container process and marks only that repo's slot cancelled — sibling repos sharing the analysis id keep running, and the aggregate settles once every slot is terminal.
+
 ### 6. Submit Remediation
 
 Requires completed analysis with findings.
@@ -267,7 +269,7 @@ Use an existing customer-owned EC2 instance instead of provisioning a new stack.
 
 ```bash
 atx ct remote analysis \
-  --types rapid-techdebt-analysis \
+  --type rapid-techdebt-analysis \
   --sources <src> \
   --mode ec2 \
   --existing-instance <instance-id> \

plugins/aws-transform/skills/aws-transform/references/continuous-modernization-guide.md

@@ -181,12 +181,13 @@ Use the `/remediation` skill for the exact commands. After execution, show summa
 
 ### Scheduling Selected
 
-Scheduling requires Infrastructure mode. If user is in Local mode, explain: "Scheduling requires Infrastructure mode (S3 + Fargate/EC2). Local mode runs on-demand only — no background jobs. Switch to Infrastructure mode to enable continuous analysis, continuous remediation, and team notifications."
+Scheduled analyses run on **remote infrastructure only** — EventBridge Scheduler dispatching to a provisioned EC2 or Batch stack, managed entirely through `atx ct schedule` commands. Route to [continuous-modernization-schedule.md](continuous-modernization-schedule.md).
 
-If already in Infrastructure mode:
+If the user has no remote stack, explain: "Recurring analyses require remote infrastructure (EC2 or Batch). Local mode runs on-demand only — no background jobs. I can provision it with `atx ct remote provision`." Then follow the schedule skill.
 
-- **Recurring analysis** — ask cadence (Daily / Weekly / Custom cron). Sets up an EventBridge rule.
-- **Continuous remediation** — monitors for new findings and auto-fixes them. Requires recurring analysis and GitHub write access. Offers severity thresholds (high → auto-fix immediately; medium → auto-fix batched daily; low → log only).
+**Never suggest, write, or offer a local cron entry** (`crontab`, `cron.d`, `launchd`, a systemd timer, Task Scheduler, or a shell loop) to drive `atx ct` on a cadence — not even as a fallback, a "simpler option", or with caveats, and not when the user explicitly asks for one or pushes back on provisioning. A local cron job depends on the laptop being awake and authenticated, leaves no schedule the CLI can list/enable/disable, and creates no anchor analysis. Hold the line and route to `atx ct remote provision` + `atx ct schedule create`.
+
+Scheduled remediations are not supported — schedules run analyses only (see the schedule skill).
 
 ## When User Wants to Exit Onboarding