Add aws-routing skill

[midakin]

Add aws-routing skill

Summary

Adds aws-routing, a read-only AWS routing subject-matter-expert skill for path selection, BGP
traffic engineering, and route evaluation across AWS networking services (Cloud WAN, Direct Connect,
Transit Gateway, VPC, VPN). It traces the end-to-end traffic path, applies the documented
route-evaluation order for each construct, flags non-deterministic path selection, and recommends
deterministic alternatives — grounded in public AWS documentation and field-proven patterns. It is
strictly advisory: analysis, recommendations, and read-only validation commands
(describe-* / get-* / list-*) only, never mutating actions.

What gap it fills

DevOps Agent can reason about individual routing facts but, in baseline testing, missed several
routing-specific determinants: the Cloud WAN CNE "deterministically random" final tiebreaker, the
DX-location-to-region association nuance, native Cloud WAN DX-attachment filtering behavior, and
TGW-to-VPN scaling paths. This skill encodes that route-evaluation logic so answers are deterministic
and correctly scoped.

What's included

skills/aws-routing/
├── SKILL.md            # activation metadata + route-evaluation instructions
├── README.md           # usage + non-production disclaimer
├── CHANGELOG.md        # version history
├── references/         # Cloud WAN/DX, DX, TGW, VPN+DX, strategic-questions patterns
└── evals/              # evals.json, eval_queries.json

Testing

• Manually validated in AWS DevOps Agent (skill activates from natural-language routing prompts;
  reasoning trace confirms invocation). Baseline vs with-skill comparison captured.
• Agent Skill Eval (aws-samples/sample-agent-skill-eval): Audit A (98/100, 0 critical / 0 warning),
  Functional A (0.972), Trigger 100% (14/14, standalone run). Run artifacts are regenerated locally;
  the submission ships the spec-required evals.json + eval_queries.json.

Checklist

• Follows the Agent Skills specification
• SKILL.md has version and author in metadata
• name frontmatter matches directory name (aws-routing)
• description states what the skill does and when to activate
• README.md includes the non-production disclaimer
• CHANGELOG.md present
• Tested in DevOps Agent — activates consistently
• Agent Skill Eval passing
• No internal Amazon tool names, wiki links, or SIM tickets in submitted content
• No customer data, account IDs, or credentials
• Rebased on latest upstream/main

[ddericco]

Domain SME review complete. One minor wording change and a suggestion re: documented values. Otherwise verified for accuracy, safety, and structure.

[ddericco]

Domain SME review complete, recommended changes have been incorporated. Verified for accuracy, safety, and structure.

[midakin]

Thanks for the review, @ddericco. Both items are addressed in bb758ff (v1.2.2):

• tgw-routing-patterns.md — clarified the wording to "both a static VPN and DX advertising the same prefix," to distinguish from dynamic VPN behavior.
• dx-routing-patterns.md — the specific internal LOCAL_PREF values (3000/2500) aren't publicly documented, so the table now uses generic Higher/Lower, and the guidance line reads "(higher internal LOCAL_PREF)." The DX-over-peering preference itself is unchanged.

Note on merge state: the branch-protection gate currently blocks because the existing approval was made with read-only permissions and the latest push requires a fresh approval from someone other than the last pusher. This needs an approving review from a maintainer with write access to clear. Happy to make any further adjustments.