feat(advanced-workflows): pilot ticket-triage-agent as a vendor-generic skill

.claude-plugin/marketplace.json

@@ -2,7 +2,7 @@
   "$schema": "https://www.schemastore.org/claude-code-marketplace.json",
   "name": "msp-claude-plugins",
   "description": "Community-driven Claude Code plugins for Managed Service Providers. Integrates with PSA, RMM, and documentation tools.",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "owner": {
     "name": "WYRE Technology",
     "email": "aaron@sachshaus.net"
@@ -35,6 +35,13 @@
         "msp"
       ]
     },
+    {
+      "name": "advanced-workflows",
+      "source": "./msp-claude-plugins/advanced-workflows/advanced-workflows",
+      "description": "Vendor-generic MSP automation workflows that adapt to the customer's connected stack.",
+      "category": "automation",
+      "tags": ["workflows", "automation", "msp"]
+    },
     {
       "name": "atera",
       "source": "./msp-claude-plugins/atera/atera",

msp-claude-plugins/advanced-workflows/advanced-workflows/.claude-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "advanced-workflows",
+  "version": "1.0.0",
+  "description": "Vendor-generic MSP automation workflows: ticket triage, patch drift reporting, QBR prep, and more — each detects the customer's connected PSA/RMM/chat stack and adapts.",
+  "author": { "name": "WYRE Technology" }
+}

msp-claude-plugins/advanced-workflows/advanced-workflows/README.md

@@ -0,0 +1,12 @@
+# Advanced Workflows
+
+Vendor-generic MSP automation skills. Each workflow detects which PSA/RMM/
+chat-delivery vendor a customer has connected and adapts — see the
+`*-tool-map` skills for exactly which vendors are curated per role.
+
+**Access note:** this plugin has no single vendor to "follow" for access
+gating (that's the point — it's vendor-generic), so on Conduit's catalog
+it defaults open to every member of every connected org, the same
+fallback every other vendor-less catalog pack uses. Org admins who want
+tighter control can add an explicit grant/deny the same way they would
+for any catalog pack.

msp-claude-plugins/advanced-workflows/advanced-workflows/_capability-map-template.md

@@ -0,0 +1,35 @@
+---
+name: "<Role> Tool Map"
+description: >
+  Maps abstract <role> operations to concrete Conduit tool names per curated
+  vendor, for use by advanced-workflow skills that need <role> access.
+when_to_use: >-
+  Fetched by another skill in this plugin, never used standalone. Use when:
+  <role> tool names, <role> vendor gotchas.
+---
+
+## Curated vendors
+
+This role is curated for every vendor `agent-routine-catalog.astro` lists with
+an Archetype-A or -B agent for this job (not a fixed top-N — read the catalog,
+list what it actually shows): <vendor 1>, <vendor 2>[, <vendor 3>, ...]. Each
+row's tool names are verified against that vendor's real subagent file
+(`<plugin>/<plugin>/agents/<agent-name>.md`), never invented. A connected
+vendor the catalog doesn't cover at all needs guided discovery: inspect the
+org's available tools for this connector, reason from naming and shape, and
+tell the human this vendor isn't fully vetted yet — don't present it as
+equally reliable.
+
+## Operation map
+
+| Abstract operation | <Vendor 1> tool | <Vendor 2> tool | <Vendor 3> tool |
+|---|---|---|---|
+| <op 1> | `<tool>` | `<tool>` | `<tool>` |
+
+## Vendor-specific gotchas
+
+### <Vendor 1>
+- <gotcha>
+
+### <Vendor 2>
+- <gotcha>

msp-claude-plugins/advanced-workflows/advanced-workflows/_workflow-skill-template.md

@@ -0,0 +1,48 @@
+---
+name: "<Workflow Name>"
+description: >
+  <One or two sentences: what this workflow does and what it produces.>
+when_to_use: >-
+  Use when [specific trigger]. Use when: keyword one, keyword two, keyword three.
+---
+
+## What this does
+
+<1 paragraph, generalized to role language — never name one vendor as if it's the only option.>
+
+## Source
+
+<Which msp-claude-plugins subagent(s) + plugin(s) this generalizes, per `agent-routine-catalog.astro` — e.g. "Generalizes the `ticket-dispatcher` agent (autotask, Archetype B) plus the equivalent triage-shaped agents the catalog lists for other connected PSAs." If this workflow has no catalog entry (i.e. it's one of the 3 conduit-only workflows with no msp-claude-plugins precedent), say so explicitly instead of inventing a provenance.>
+
+## Prerequisites
+
+| Requirement | Notes |
+|-------------|-------|
+| **A connected <role> connector** | One of: <curated vendor list for this role>. See the `<role>-tool-map` skill for the exact tool names once connected. |
+| **A connected chat-delivery connector** | Slack (shipped) or Microsoft Teams (blocked — see `chat-delivery-adapters`). |
+
+## Detecting the customer's stack
+
+1. Check which <role> vendor is connected (via the org's active Conduit vendor connections). If more than one match, ask the human which to use. If none, tell the human what's needed — never guess, never fail silently.
+2. Fetch `skill://advanced-workflows/<role>-tool-map/SKILL.md` for that vendor's concrete tool names and gotchas.
+3. Fetch `skill://advanced-workflows/chat-delivery-adapters/SKILL.md` for the connected delivery target's adapter contract.
+
+## Run it now
+
+<The routine prompt's logic, generalized: numbered steps using the abstract operation names from the tool-map skill (e.g. "list new tickets," not a hardcoded tool name), executed immediately as a one-off in the current conversation.>
+
+## Set up as a recurring routine
+
+<The existing "build prompt" content, reworded to first person / imperative — this skill's own instructions for creating a Claude-managed scheduled routine, not "paste this to Claude" copy-paste framing.>
+
+## Known gotchas
+
+<Platform-level gotchas only (e.g. one-hour minimum routine cadence, permitted_tools must be populated per connector). Vendor-specific gotchas live in the tool-map skill instead.>
+
+## How it works
+
+<Idempotency / failure-escalation rationale, kept from the source doc.>
+
+## Extending it
+
+<What's deliberately out of scope and how to extend, kept from the source doc.>

msp-claude-plugins/advanced-workflows/advanced-workflows/skills/chat-delivery-adapters/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: "Chat Delivery Adapters"
+description: >
+  The delivery-adapter contract every advanced-workflow skill uses to post
+  its finished report somewhere a human will see it — Slack, an IT Glue
+  document, or (blocked) Microsoft Teams.
+when_to_use: >-
+  Fetched by another advanced-workflow skill once it has a finished report
+  to deliver, never used standalone. Use when: delivery adapter, Slack
+  delivery, Teams delivery, IT Glue document delivery, report delivery.
+---
+
+## The contract
+
+Every workflow's body produces a **report payload**; a delivery adapter
+takes that payload and writes it somewhere a human will see it. Detect
+which delivery target is connected the same way you detect a data-role
+vendor: if more than one is connected, ask the human which to use; if
+none is connected, tell the human what's needed — don't guess, don't fail
+silently.
+
+## Shipped adapters
+
+### Slack summary
+- **Connector**: Slack (first-party claude.ai connector, not Conduit-routed).
+- **permitted_tools**: `slack_send_message`.
+- **Write snippet**: post a one-paragraph summary to the destination channel.
+- **Limits**: plain text, no rich layout — best for a short result.
+
+### Slack canvas
+- **Connector**: Slack.
+- **permitted_tools**: `slack_create_canvas`, `slack_send_message`.
+- **Write snippet**: create a canvas titled `<report name> — <date>` with
+  the full report; post a summary message linking it.
+- **Limits**: one canvas per run — each run leaves its own dated artefact
+  rather than updating a single document in place.
+
+### IT Glue document
+- **Connector**: Conduit (`itglue` vendor connection).
+- **permitted_tools**: `itglue__search_documents`, `itglue__create_document`,
+  `itglue__update_document_section`, `itglue__publish_document`.
+- **Write snippet**: search for an existing document named `<report name>`
+  in the target IT Glue org; if found, update its section, else create it;
+  then call `itglue__publish_document` — section edits are invisible to a
+  human until the document is published.
+- **Limits**: needs a target org ID baked in. Updates in place, so reruns
+  converge on a single document rather than accumulating artefacts.
+  Conduit prefixes every served tool name with `{vendor}__` at the gateway
+  (`itglue__` here) regardless of what the vendor's own internal
+  classification table calls it — the `itglue` plugin's `GOVERNANCE.md`
+  documents bare names like `create_document` for its internal
+  permission-tier lookup, but the servable/callable name always carries
+  the `itglue__` prefix, same as every other vendor.
+
+## Blocked
+
+### Microsoft Teams
+**Blocked — do not use.** Conduit's `m365` vendor Chat/Team Graph scopes
+are a documented phase-2 addition and are not live yet (the vendor is
+currently `hidden` pending `--org-mode` on its sidecar). If a workflow's
+prerequisites mention Teams as a delivery target, mark it explicitly as
+"coming soon, not yet available" rather than instructing an agent to
+attempt it — there is no working send-to-Teams tool today.
+
+## Documented but not shipped
+
+- **Notion** — the first-party Notion connector (`notion-create-pages`,
+  `notion-update-page`) or the Conduit `notion` vendor connection would
+  both work; deferred only because Slack and IT Glue cover current need.
+- **Hudu** — an IT-Glue-like documentation target; whether the Conduit
+  `hudu` connection exposes a write tool is unverified. Confirm before
+  treating it as an adapter.
+- **SharePoint** — blocked. The available Microsoft 365 connector is
+  search/read only.
+- **Email** — deferred, no adapter built yet.
+
+## Adding a new adapter
+
+Pick a connector that can write to the target, confirm it exposes a write
+tool (don't assume), and document: Connector, permitted_tools, write
+snippet, limits. The workflow body producing the report never changes.

msp-claude-plugins/advanced-workflows/advanced-workflows/skills/psa-tool-map/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: "PSA Tool Map"
+description: >
+  Maps abstract PSA/ticketing operations (list new tickets, get ticket
+  detail, update priority + status, list statuses, list priorities) to
+  concrete Conduit tool names for Autotask, HaloPSA, and ConnectWise PSA.
+when_to_use: >-
+  Fetched by another advanced-workflow skill that needs PSA access, never
+  used standalone. Use when: PSA tool names, Autotask tools, HaloPSA tools,
+  ConnectWise PSA tools, ticket status IDs, ticket priority IDs.
+---
+
+## Curated vendors
+
+This role is curated for: Autotask, HaloPSA, ConnectWise PSA. A connected
+PSA not listed here needs guided discovery: inspect the org's available
+tools for that connector, reason from naming and shape, and tell the human
+this vendor isn't fully vetted yet.
+
+## Operation map
+
+| Abstract operation | Autotask | HaloPSA | ConnectWise PSA |
+|---|---|---|---|
+| List new/untriaged tickets | `autotask__autotask_search_tickets` | `halopsa__halopsa_tickets_list` | `connectwise-psa__cw_search_tickets` |
+| Get ticket detail | `autotask__autotask_get_ticket_details` | `halopsa__halopsa_tickets_get` | `connectwise-psa__cw_get_ticket` |
+| Update ticket (priority/status/etc.) | `autotask__autotask_update_ticket` | `halopsa__halopsa_tickets_update` | `connectwise-psa__cw_update_ticket` |
+| Add a ticket note/action | `autotask__autotask_create_ticket_note` | `halopsa__halopsa_tickets_add_action` | `connectwise-psa__cw_add_ticket_note` |
+| List valid ticket statuses (discover once, don't call per-run) | `autotask__autotask_list_ticket_statuses` | no dedicated list tool observed — confirm via `halopsa__halopsa_tickets_list` field values before baking in IDs | `connectwise-psa__cw_list_statuses` |
+| List valid ticket priorities (discover once, don't call per-run) | `autotask__autotask_list_ticket_priorities` | no dedicated list tool observed — confirm via ticket field values before baking in IDs | `connectwise-psa__cw_list_priorities` |
+
+## Vendor-specific gotchas
+
+### Autotask
+- Priority IDs are typically **not** ordered by severity — discover them
+  by name, never assume numeric ordering.
+- Status/priority/queue IDs are tenant-specific — always discover once at
+  build time, never hardcode across tenants.
+- Don't call `list_*` discovery tools on every routine run — it's slow
+  enough to hit the 60-second tool timeout. Discover once, bake the IDs
+  into the routine prompt.
+
+### HaloPSA
+- No dedicated "list statuses"/"list priorities" tool was found in this
+  vendor's observed tool surface — confirm the actual field values by
+  reading a sample ticket via `halopsa_tickets_get` before baking any ID
+  into a routine, don't assume symmetry with Autotask's shape.
+
+### ConnectWise PSA
+- Tool names are `cw_`-prefixed, not `connectwise_manage_`-prefixed —
+  verified against `connectwise/manage/GOVERNANCE.md`'s `VENDOR_TOOL_CONFIG`
+  listing, registered under the gateway slug `connectwise-psa` (so gateway
+  names are `connectwise-psa__cw_*`, e.g. `connectwise-psa__cw_search_tickets`).
+- `cw_add_ticket_note` writes a **customer-visible** note by default —
+  pass `internalAnalysisFlag: true` explicitly for an internal-only note,
+  or an agent's internal analysis gets emailed to the contact immediately.
+  There is no delete-note tool to undo a mistaken send.
+- `cw_update_ticket` is the **only** route to closing a ticket (it takes
+  raw JSON Patch, so `op: "remove"` can strip a field outright). Closing
+  stops the SLA clock and can fire close notifications/satisfaction
+  surveys, and Conduit's access tiers gate the whole tool at `write`
+  regardless of which field the patch touches — there's no way to allow
+  priority/owner patches while blocking status/closure patches at the
+  gateway level. Treat `cw_update_ticket` as requiring a named human
+  approver per invocation; never grant it to unattended/nightly
+  automation.
+- Closure must pass through `Completed` before `Closed`, with a populated
+  `resolution` field, or the patch fails with an error that reads like a
+  permissions failure rather than a workflow-ordering one.
+- The 60-requests/minute rate limit is shared across all operators on the
+  same ConnectWise API member — a wide `cw_search_*` discovery sweep by
+  one routine can 429 everyone else's concurrent calls.