feat: add database-migration-reviewer skill and database-migration-specialist agent

agents/database-migration-specialist.agent.md

@@ -0,0 +1,31 @@
+---
+name: 'database-migration-specialist'
+description: 'Database schema migration specialist for zero-downtime changes, migration review, rollback strategy, and safe data backfills across PostgreSQL, MySQL, and SQL Server'
+tools: ['codebase', 'edit/editFiles', 'search', 'runCommands', 'terminalCommand']
+---
+
+# Database Migration Specialist
+
+You are a database migration specialist. You help teams evolve relational schemas without downtime, data loss, or surprise table locks.
+
+## Core Expertise
+
+- **Zero-downtime patterns**: expand/contract, dual writes, batched backfills, shadow columns
+- **Lock analysis**: which DDL takes ACCESS EXCLUSIVE vs. lighter locks per engine and version
+- **Rollback strategy**: reversible vs. irreversible migrations, down-migration correctness, point-in-time recovery as last resort
+- **Migration tooling**: Flyway, Liquibase, Alembic, Prisma Migrate, EF Core, Rails Active Record, golang-migrate
+- **Data backfills**: batching, throttling, idempotency, progress tracking for large UPDATE jobs
+
+## Working Method
+
+1. Ask for (or locate) the migration files, target engine and version, and rough table sizes before judging risk.
+2. Treat every migration as if it runs against the largest production table during peak traffic.
+3. Sequence risky changes across releases: schema expand → code deploy → backfill → contract.
+4. Always produce the down path, and say plainly when data loss makes true rollback impossible.
+5. Prefer engine-native safety features: `CREATE INDEX CONCURRENTLY`, `NOT VALID` constraints + `VALIDATE`, `ALGORITHM=INPLACE` (MySQL), online index operations (SQL Server).
+
+## Response Style
+
+- Give runnable SQL or tool-specific migration code, split per release step.
+- Label each step with its lock impact and expected duration class (instant / brief / proportional to table size).
+- Refuse to bless a destructive migration without an explicit backup or deprecation confirmation.

docs/README.agents.md

@@ -75,6 +75,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-agents) for guidelines on how to
 | [Create PRD Chat Mode](../agents/prd.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fprd.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fprd.agent.md) | Generate a comprehensive Product Requirements Document (PRD) in Markdown, detailing user stories, acceptance criteria, technical considerations, and metrics. Optionally create GitHub issues upon user confirmation. |  |
 | [Critical thinking mode instructions](../agents/critical-thinking.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fcritical-thinking.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fcritical-thinking.agent.md) | Challenge assumptions and encourage critical thinking to ensure the best possible solution and outcomes. |  |
 | [Custom Agent Foundry](../agents/custom-agent-foundry.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fcustom-agent-foundry.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fcustom-agent-foundry.agent.md) | Expert at designing and creating VS Code custom agents with optimal configurations |  |
+| [Database Migration Specialist](../agents/database-migration-specialist.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fdatabase-migration-specialist.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fdatabase-migration-specialist.agent.md) | Database schema migration specialist for zero-downtime changes, migration review, rollback strategy, and safe data backfills across PostgreSQL, MySQL, and SQL Server |  |
 | [Debian Linux Expert](../agents/debian-linux-expert.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fdebian-linux-expert.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fdebian-linux-expert.agent.md) | Debian Linux specialist focused on stable system administration, apt-based package management, and Debian policy-aligned practices. |  |
 | [Debug Mode Instructions](../agents/debug.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fdebug.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fdebug.agent.md) | Debug your application to find and fix a bug |  |
 | [Declarative Agents Architect](../agents/declarative-agents-architect.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fdeclarative-agents-architect.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fdeclarative-agents-architect.agent.md) |  |  |

docs/README.skills.md

@@ -132,6 +132,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to
 | [csharp-xunit](../skills/csharp-xunit/SKILL.md)<br />`gh skills install github/awesome-copilot csharp-xunit` | Get best practices for XUnit unit testing, including data-driven tests | None |
 | [daily-prep](../skills/daily-prep/SKILL.md)<br />`gh skills install github/awesome-copilot daily-prep` | Prepare for tomorrow's meetings and tasks. Pulls calendar from Outlook via WorkIQ, cross-references open tasks and workspace context, classifies meetings, detects conflicts and day-fit issues, finds learning and deep-work slots, and generates a structured HTML prep file with productivity recommendations. | None |
 | [data-breach-blast-radius](../skills/data-breach-blast-radius/SKILL.md)<br />`gh skills install github/awesome-copilot data-breach-blast-radius` | Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a regulatory blast radius report with fine ranges sourced verbatim from GDPR Art. 83, CCPA § 1798.155(a), and HIPAA 45 CFR § 160.404. Cost benchmarks from IBM Cost of a Data Breach Report (annually updated). All citations in references/SOURCES.md for verification. Use when asked: "assess breach impact", "what data could be exposed", "calculate blast radius", "data exposure analysis", "how bad would a breach be", "quantify data risk", "sensitive data inventory", "data flow security audit", "pre-breach assessment", "worst-case breach scenario", "breach readiness", "data risk report", "/data-breach-blast-radius". For any stack handling user data, health records, or financial information. Output labels law-sourced figures (exact) vs heuristic estimates (planning only). Does not replace legal counsel. | `references/SOURCES.md`<br />`references/blast-radius-calculator.md`<br />`references/data-classification.md`<br />`references/hardening-playbook.md`<br />`references/regulatory-impact.md`<br />`references/report-format.md` |
+| [database-migration-reviewer](../skills/database-migration-reviewer/SKILL.md)<br />`gh skills install github/awesome-copilot database-migration-reviewer` | Review database schema migrations for destructive operations, locking risks, and rollback safety before they reach production. Use when the user asks to review a migration file, mentions ALTER TABLE safety, zero-downtime schema changes, or migrations from tools like Flyway, Liquibase, Alembic, Prisma, EF Core, or Rails. | None |
 | [datanalysis-credit-risk](../skills/datanalysis-credit-risk/SKILL.md)<br />`gh skills install github/awesome-copilot datanalysis-credit-risk` | Credit risk data cleaning and variable screening pipeline for pre-loan modeling. Use when working with raw credit data that needs quality assessment,  missing value analysis, or variable selection before modeling. it covers data loading and formatting, abnormal period filtering, missing rate calculation, high-missing variable removal,low-IV variable filtering, high-PSI variable removal, Null Importance denoising, high-correlation variable removal, and cleaning report generation. Applicable scenarios arecredit risk data cleaning, variable screening, pre-loan modeling preprocessing. | `references/analysis.py`<br />`references/func.py`<br />`scripts/example.py` |
 | [dataverse-python-advanced-patterns](../skills/dataverse-python-advanced-patterns/SKILL.md)<br />`gh skills install github/awesome-copilot dataverse-python-advanced-patterns` | Generate production code for Dataverse SDK using advanced patterns, error handling, and optimization techniques. | None |
 | [dataverse-python-production-code](../skills/dataverse-python-production-code/SKILL.md)<br />`gh skills install github/awesome-copilot dataverse-python-production-code` | Generate production-ready Python code using Dataverse SDK with error handling, optimization, and best practices | None |

skills/database-migration-reviewer/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: database-migration-reviewer
+description: 'Review database schema migrations for destructive operations, locking risks, and rollback safety before they reach production. Use when the user asks to review a migration file, mentions ALTER TABLE safety, zero-downtime schema changes, or migrations from tools like Flyway, Liquibase, Alembic, Prisma, EF Core, or Rails.'
+license: MIT
+---
+
+# Database Migration Reviewer
+
+Review schema migration files and classify each operation by risk, so destructive or table-locking changes are caught before deployment.
+
+## When to Use This Skill
+
+Use this skill when you need to:
+- Review a new migration file before merging
+- Audit a migrations folder for unsafe patterns
+- Plan a zero-downtime schema change (expand/contract)
+- Write or verify a rollback (down) migration
+
+## Review Workflow
+
+1. **Identify the engine and tool** (PostgreSQL/MySQL/SQL Server; Flyway, Liquibase, Alembic, Prisma, EF Core, Rails, raw SQL).
+2. **Classify every statement** using the risk table below.
+3. **Check rollback**: does a down migration exist, and can the up migration's data loss actually be reversed?
+4. **Check lock impact**: estimate table size sensitivity; long locks on hot tables are release blockers.
+5. **Report** findings ordered by severity, each with a concrete safer rewrite.
+
+## Risk Classification
+
+| Severity | Operations |
+|---|---|
+| 🔴 Blocker | `DROP TABLE`/`DROP COLUMN` without prior deprecation, `TRUNCATE`, type changes that rewrite the table, renaming columns/tables still used by running code |
+| 🟠 High | Adding `NOT NULL` without default on a populated table, `CREATE INDEX` without `CONCURRENTLY` (PostgreSQL) on large tables, adding a foreign key with immediate validation, `UPDATE`/`DELETE` without `WHERE` |
+| 🟡 Medium | Wide `ALTER TABLE` on hot tables during peak hours, missing down migration, mixing DDL and data backfill in one transaction |
+| 🟢 Safe | `CREATE TABLE`, adding a nullable column, adding a column with a non-volatile default (PostgreSQL 11+), `CREATE INDEX CONCURRENTLY` |
+
+## Safer Rewrites
+
+### Adding a NOT NULL column (PostgreSQL)
+
+```sql
+-- Instead of: ALTER TABLE orders ADD COLUMN status text NOT NULL;
+ALTER TABLE orders ADD COLUMN status text;                 -- 1. nullable, instant
+UPDATE orders SET status = 'pending' WHERE status IS NULL; -- 2. backfill in batches
+ALTER TABLE orders ALTER COLUMN status SET NOT NULL;       -- 3. brief validation lock
+```
+
+### Renaming a column with zero downtime (expand/contract)
+
+1. Add the new column; deploy code writing to **both** columns.
+2. Backfill old rows in batches.
+3. Deploy code reading from the new column only.
+4. Drop the old column in a later release.
+
+### Index creation on a large table (PostgreSQL)
+
+```sql
+-- Instead of: CREATE INDEX idx_orders_user ON orders(user_id);
+CREATE INDEX CONCURRENTLY idx_orders_user ON orders(user_id);
+-- Note: cannot run inside a transaction block; configure the migration tool accordingly.
+```
+
+## Output Format
+
+For each finding report: **severity**, **file/statement**, **why it is risky**, and a **safer rewrite**. End with a verdict: `APPROVE`, `APPROVE WITH CHANGES`, or `BLOCK`.
+
+## Guidelines
+
+1. **Assume production-sized tables** - a migration that is instant in dev can lock a 100M-row table for minutes.
+2. **One concern per migration** - flag migrations mixing unrelated schema changes; they complicate rollback.
+3. **Down migrations must restore data shape, not data** - be explicit when dropped data is unrecoverable.
+4. **Respect the tool's transaction model** - e.g. MySQL DDL is not transactional; a mid-migration failure leaves partial state.
+
+## Limitations
+
+- Cannot know actual table sizes or traffic; ask the user when severity depends on it.
+- NoSQL schema-on-read migrations (Mongo, Dynamo) need application-level review instead.