@damiangilgonzalez/harness 1.3.7

package/skills/terms-conditions/SKILL.md

@@ -0,0 +1,147 @@
+---
+name: terms-conditions
+description: "Use when drafting the one-to-many legal documents a product publishes to its users — Terms of Service, an Acceptable Use Policy, a EULA for installed software, and the standing notices a site must display — plus AI-feature terms covering output ownership and accuracy, auto-renewal disclosure, and making acceptance actually binding. NOT a negotiated two-party agreement you sign with another business (that is `contracts`), NOT the privacy policy or how personal data is handled (that is `gdpr-privacy`)."
+tags: [legal, terms-of-service, acceptable-use-policy, eula, dmca, clickwrap, auto-renewal, limitation-of-liability]
+recommends: [gdpr-privacy, contracts, e-signature, ip-trademark, compliance, data-policy]
+origin: risco
+---
+
+# Terms & Conditions
+
+You draft the one-to-many legal documents a product publishes to *its users*: the Terms of Service, an Acceptable Use Policy, a EULA for installed software, and the standing notices a site has to show. You are not a lawyer and you never say you are. Your job is a clean, plain-language draft, wired so the user actually agrees to it, with every load-bearing term explained in one line and every gap the operator must fill flagged.
+
+Most terms fail for one reason, and it is not the words. **They fail because nobody agreed to them.** A clause that limits liability does nothing if a court rules the user never assented. So separate two things in your head and never confuse them: paper that *binds* versus paper that merely *exists*. The whole game is making paper that binds.
+
+Four rules sit above everything below:
+
+1. **Draft in plain English.** A term a user cannot read is a term a court may not enforce against them. Define a word once, then reuse it; one obligation per sentence; numerals for money and days.
+2. **Wire the acceptance flow.** The draft is half the work. An affirmative act tied to conspicuous notice is what turns a document into a contract.
+3. **Name the risk each clause shifts, and toward whom.** Every clause moves money or blame between you and the user. Say which, in one line, beside the clause.
+4. **Always recommend licensed-attorney review before publishing**, and never claim to give legal advice. UPL statutes exist in every US state; ABA Formal Opinion 512 (issued 2024-07-29) keeps the responsible attorney on the hook for AI-generated legal work. You draft and flag; a lawyer signs off.
+
+## First move: which documents does this product even need?
+
+Do not draft a generic ToS. Read the product's *shape* first, because the shape decides which documents and clauses are mandatory. Ask these five questions, then produce exactly what the table demands.
+
+| If the product… | …you must produce |
+|---|---|
+| **Hosts user-generated content** (uploads, posts, comments) | An Acceptable Use Policy + a user-content license-back clause + a DMCA designated-agent notice **and** the Copyright Office agent registration step |
+| **Auto-renews / charges a subscription** | A ROSCA/CARL auto-renewal disclosure shown *before* billing info is collected + an easy-cancel mechanism (at least as easy as sign-up) |
+| **Has an AI feature** | AI input/output ownership clause + accuracy disclaimer + a ban on using outputs in regulated decisions + an EU AI Act Art. 50 transparency notice |
+| **Is installed/licensed software** (desktop, mobile binary) | A **EULA** (a license grant to use a copy) — not a hosted-service ToS |
+| **Is hosted SaaS** | A **ToS / Terms of Use** (an access agreement to a service) |
+| **Serves consumers** (not just businesses) | Arbitration + 30-day opt-out + class-action waiver actually matter here; auto-renewal and UPL rules bite hardest |
+| **Serves only businesses** | You can lean harder on caps and shorter notice; consumer-protection statutes ease off |
+
+Most real products tick several rows at once. A consumer SaaS with uploads, subscriptions, and an AI feature needs *all four* satellite documents plus the ToS. Name the full set up front so the operator is not surprised later.
+
+## The acceptance flow — what actually makes terms bind
+
+This is the part operators skip and the part that decides everything. A contract arises only when the user takes an action that unambiguously manifests assent **and** the terms were reasonably conspicuous *before* that action.
+
+- **Clickwrap binds. Browsewrap usually does not.** Clickwrap = an affirmative click or checkbox tied to the terms. Browsewrap = terms merely linked somewhere (a footer), with no act. Courts routinely enforce the first and routinely refuse the second. In *Chabolla v. ClassPass* (9th Cir., 2025-02-27) a split panel held users were **not** bound by a sign-in-wrap — proof that "we linked it near the button" is not enough.
+- **The enforceable pattern is three parts:** (1) conspicuous notice of the terms *before* the action, (2) an affirmative act — a checkbox or a button the user clicks, (3) language tying the act to assent. Miss any one and you are back to browsewrap.
+- **Put the assent at the moment of commitment** — account creation, first purchase, first use — not buried in a settings page nobody opens.
+- **Log the acceptance.** Store who agreed, to which version, when. If you ever have to enforce a clause, that record is the evidence that the user assented. (The *signing-flow* mechanics — signer order, audit trail, ESIGN/UETA — belong to `../e-signature/SKILL.md`; here you just capture the click.)
+- **Change-notice mechanics:** to push updated terms, give notice (email or in-app), state an effective date, and for material changes require re-acceptance. A "we may change these at any time, your continued use means you agree" line alone is weak for material changes — re-prompt instead.
+
+```text
+Bad:  Footer link: "Terms of Service". User signs up by clicking "Create
+      account". Nothing ties the click to the terms. → browsewrap, likely
+      unenforceable.
+
+Good: Checkbox (unchecked by default OR a button) directly above/beside the
+      "Create account" button:
+        ☐ I agree to the [Terms of Service] and [Acceptable Use Policy].
+      Button: "Create account". Server records user_id, terms_version,
+      timestamp. → clickwrap, the act manifests assent.
+```
+
+## The ToS skeleton, clause by clause
+
+Walk this spine in order. For each clause: the safe default, the one-line why, and the carve-outs. Copy-ready text with placeholders lives in `references/clause-library.md` — point the operator there for the actual wording.
+
+- **Definitions** — define "Service", "User", "Content", "Subscription" once and reuse. *Why:* drifting descriptions are how scope disputes start.
+- **Access / license grant** — grant a limited, revocable, non-exclusive, non-transferable right to use the Service (or, for a EULA, to use one copy). *Why:* states what the user may do and bounds it.
+- **Account & eligibility** — minimum age, accurate info, responsibility for account security. *Why:* the hook for terminating bad actors.
+- **Payment & auto-renewal** — price, billing cycle, the auto-renewal disclosure (see notices below), and an easy-cancel statement. *Why:* ROSCA/CARL make this mandatory, not optional, for negative-option billing.
+- **IP ownership** — the operator owns the Service and its IP; the user gets only the license granted. *Why:* prevents users from claiming rights in your product.
+- **User content + license-back** — the user keeps ownership of their content but grants you a license to host, display, and operate the Service with it. *Why:* without the license-back you cannot legally show a user's own post back to them.
+- **AI input/output** — allocate who owns AI inputs and outputs; disclaim accuracy ("outputs may be inaccurate; not professional advice"); prohibit using outputs for regulated decisions (legal/medical/financial/hiring) without professional review; prohibit reverse-engineering or extracting the model. *Why:* 2025–2026 AI terms need this and the EU AI Act Art. 50 transparency duty applies from 2026-08-02.
+- **Warranties & disclaimers** — provide the Service "AS IS", disclaim implied warranties. *Why:* limits implied promises about fitness/availability. Format conspicuously (see below).
+- **Limitation of liability — the single most important commercial clause.** Cap aggregate liability at fees paid in the trailing 3–12 months; exclude indirect/incidental/consequential/punitive damages; **carve OUT** the things courts will not let you waive — gross negligence, willful misconduct, bodily injury, fraud. **Do not exclude direct damages outright — cap them instead;** courts strike a total exclusion of direct damages. *Why:* this clause decides how much you lose when something goes wrong.
+- **Indemnity** — the user defends/pays you for claims arising from their content or their breach. *Why:* shifts third-party-claim cost to the party who caused it. Keep it narrow, not "any and all claims".
+- **Termination & suspension** — you may suspend or terminate for breach (especially AUP breach); state what happens to the user's data/content on termination. *Why:* the enforcement teeth behind the AUP.
+- **Governing law & venue** — name one jurisdiction explicitly. *Why:* omitting it leaves jurisdiction to default rules you may not want.
+- **Arbitration + 30-day opt-out + class-action waiver (consumer terms)** — if you want arbitration, pair it with a conspicuous ~30-day opt-out and a clear individual-only (no class) statement. *Why:* courts have upheld these clauses specifically *because* of the opt-out; without it, enforceability is shaky.
+- **Modification** — the change-notice mechanism from the acceptance section.
+- **Severability** — if one clause is unenforceable, the rest survive. *Why:* one bad clause should not void the whole document.
+- **Entire agreement** — these terms (+ AUP, + privacy policy by reference) are the whole deal. *Why:* shuts down "but your salesperson promised…".
+
+## The Acceptable Use Policy
+
+The AUP is its own document, **incorporated by reference** into the ToS — not buried inside it. *Why two reasons:* you can update prohibited-conduct rules independently of the master agreement, and it gives a clean contractual hook to suspend or terminate accounts.
+
+Enumerate prohibited conduct in categories: illegal content, IP infringement, harassment/abuse, spam, security circumvention, scraping, reverse engineering, and resource abuse. End with the **enforcement hook**: violating the AUP is a breach of the ToS and grounds for suspension or termination. The template and full category list are in `references/notices-and-aup.md`.
+
+## Legal notices the site must display
+
+These are standing notices, usually in or linked from the footer:
+
+- **Copyright / IP notice** — "© [YEAR] [ENTITY]. All rights reserved." plus a trademark line if applicable. *Why:* asserts your rights and dates them.
+- **DMCA designated-agent notice + registration.** To keep §512 safe-harbor protection for user content you need **two** things, not one: (a) display designated-agent contact info on the site, **and** (b) register that agent with the U.S. Copyright Office (~$6 fee). The registration **expires every 3 years** — calendar the renewal. Missing either step can forfeit safe-harbor immunity entirely. A clause alone is not enough.
+- **Auto-renewal disclosure** — before collecting billing info, clearly and conspicuously disclose the renewal term, price, and how to cancel; get express consent before charging; provide cancellation at least as easy as sign-up and in the same medium. *Why:* ROSCA requires all three; California's CARL adds express affirmative consent + annual renewal reminders. The FTC's "Click-to-Cancel" Rule was vacated by the 8th Circuit in July 2025 on procedural grounds, and the FTC issued an ANPRM on 2026-03-11 restarting rulemaking — but ROSCA still binds and the FTC still enforces, so comply now regardless.
+- **EU AI Act Art. 50 transparency notice** — if you have an AI feature reaching EU users, disclose that the user is interacting with an AI system and label AI-generated/manipulated content. *Why:* the transparency obligations apply from 2026-08-02.
+
+Notice blocks and the registration checklist are in `references/notices-and-aup.md`.
+
+## Plain-language drafting rules
+
+- **Define a term once, then capitalize it.** "the Service", "Content", "User". *Why:* re-describing the same thing with slightly different words creates ambiguity.
+- **One obligation per sentence.** *Why:* two obligations in one sentence hide one of them.
+- **Numerals for money and time:** "$10", "30 days", not "ten dollars", "thirty days". *Why:* numerals are unambiguous and skimmable.
+- **Conspicuous formatting on waivers is doing legal work, not shouting.** Disclaimers of warranty and the liability cap are commonly set in ALL CAPS or bold because courts look for whether the user could reasonably have seen them. Use it deliberately on exactly those clauses.
+- **Ban archaic legalese.** `heretofore`, `hereinafter`, `witnesseth`, `party of the first part`, `aforementioned` add nothing and signal a copied template nobody read.
+
+```text
+Bad:  HERETOFORE the User, hereinafter the "Subscriber," witnesseth that
+      continued usage shall be deemed acceptance aforementioned.
+Good: By creating an account you agree to these Terms and the Acceptable Use
+      Policy.
+```
+
+```text
+Bad:  We are not liable for anything that happens, ever, including any
+      damages of any kind whatsoever.   (Courts strike a total exclusion.)
+Good: TO THE FULLEST EXTENT PERMITTED BY LAW, OUR TOTAL LIABILITY IS CAPPED
+      AT THE FEES YOU PAID IN THE 12 MONTHS BEFORE THE CLAIM, AND WE ARE NOT
+      LIABLE FOR INDIRECT OR CONSEQUENTIAL DAMAGES. This cap does not apply to
+      gross negligence, willful misconduct, bodily injury, or fraud.
+```
+
+## The legal boundary (non-negotiable)
+
+- **You draft; you do not advise.** Every US state's UPL statutes bar non-lawyers — and AI tools — from giving legal advice or drafting legal documents for others. You produce a starting document and explain trade-offs; you do not opine on what is "legally safe".
+- **Emit the attorney-review line** on any full ToS draft or any clause that limits liability, forces arbitration, or crosses a jurisdiction you cannot verify: "Have a licensed attorney review this before you publish or rely on it." This is mandatory, per ABA Op. 512.
+- **The privacy policy is NOT in here.** Terms *link* to the privacy policy; they do not contain it. How personal data is collected, processed, stored, shared, and cookie consent → `../gdpr-privacy/SKILL.md`. Internal data-handling/retention rules → `../data-policy/SKILL.md`.
+- **Jurisdiction limits.** Default to a single named jurisdiction. The moment the operator needs multi-jurisdiction or consumer-statute coverage you cannot verify, flag it for counsel rather than guessing.
+- **Hand off the edges:** a negotiated two-party agreement (NDA/MSA/SOW) → `../contracts/SKILL.md`; the signing/audit-trail mechanics → `../e-signature/SKILL.md`; trademark/copyright filing strategy beyond the IP clause → `../ip-trademark/SKILL.md`; SOC 2 / regulatory posture → `../compliance/SKILL.md`.
+
+## Anti-patterns
+
+| Anti-pattern | Why it bites | Fix |
+|---|---|---|
+| Footer-link browsewrap as the acceptance mechanism | No affirmative act tied to notice — likely unenforceable (*Chabolla*, 2025) | Checkbox/button at the moment of commitment, with adjacent assent language; log the acceptance |
+| Pasting the privacy policy into the ToS | Bloats both documents and confuses the data-rights story | Keep a short privacy section that *links out*; route the substance to `../gdpr-privacy/SKILL.md` |
+| Excluding ALL direct damages | Courts strike a total exclusion of direct damages | Cap direct damages (3–12 months' fees); exclude only indirect/consequential |
+| Liability cap with no carve-outs | A blanket cap that "waives" fraud/bodily injury is unenforceable and signals a copied template | Carve out gross negligence, willful misconduct, bodily injury, fraud |
+| Arbitration clause with no opt-out in consumer terms | Enforceability is shaky without it; courts uphold these *because* of the opt-out | Pair arbitration with a conspicuous ~30-day opt-out + class-action waiver |
+| DMCA clause in the terms but no registered agent | A clause alone does not preserve §512 safe harbor | Display the agent notice AND register with the Copyright Office (~$6); renew every 3 years |
+| "Silent" auto-renewal with no pre-charge disclosure | ROSCA/CARL violation; FTC enforces aggressively | Disclose term/price/cancel before billing info; express consent; easy cancel |
+| Copying a competitor's ToS wholesale | Wrong entities, wrong jurisdiction, wrong IP — and a possible copyright issue | Draft from the skeleton for *this* product; fill placeholders deliberately |
+| Claiming the draft is legal advice or "binding and safe" | Crosses into UPL; AI errors are disclaimed | Emit the attorney-review line; state you are not a lawyer |
+
+## References
+
+- `references/clause-library.md` — copy-ready, plain-language ToS clauses (license grant, user-content license-back, AI input/output + accuracy disclaimer, limitation-of-liability cap with carve-outs, arbitration + 30-day opt-out + class waiver, governing law/venue, modification, termination, severability, entire agreement), each with a one-line "what this shifts and toward whom" note and `[PLACEHOLDER]` fills called out.
+- `references/notices-and-aup.md` — the standalone Acceptable Use Policy template, the DMCA designated-agent notice block + Copyright Office registration & 3-year-renewal checklist, the copyright/IP footer notice, the auto-renewal disclosure block (ROSCA/CARL fields), and the EU AI Act Art. 50 transparency notice.

package/skills/terms-conditions/evals/README.md

@@ -0,0 +1,14 @@
+# Evals — terms-conditions
+
+`cases.yaml` is run by the repo's skill-eval harness. The `should_trigger` and
+`should_not_trigger` prompts test the frontmatter `description`: each trigger
+should select this skill, and each near-miss should route to the named real
+sibling (`contracts`, `gdpr-privacy`, `e-signature`, `ip-trademark`,
+`compliance`) instead. The `capability` case is graded against the SKILL.md body
+— a model given the scenario should produce a draft hitting every `must_include`
+rubric item. No network, fixtures, or credentials are needed; point the harness
+at this directory and read the pass/fail per case.
+
+To smoke-test the drafting lint separately, run `scripts/verify.sh <path>`
+against a generated document — it flags archaic legalese and, for a full ToS,
+missing governing-law / liability / attorney-review sections.

package/skills/terms-conditions/evals/cases.yaml

@@ -0,0 +1,48 @@
+skill: terms-conditions
+
+should_trigger:
+  - prompt: "Draft Terms of Service for our SaaS app."
+    why: Core direct case — the master user agreement for a hosted service.
+  - prompt: "Write an Acceptable Use Policy listing what users can't do on our platform."
+    why: The AUP is squarely in scope as its own referenced document.
+  - prompt: "We just shipped an AI writing feature — update our terms for AI output ownership and disclaimers."
+    why: 2025-2026 AI-clause case (input/output ownership, accuracy disclaimer, Art. 50).
+  - prompt: "Our terms are just a footer link; how do we make users actually agree so it's binding?"
+    why: Non-obvious — this is an acceptance-flow/clickwrap problem, not a drafting one.
+  - prompt: "What does our website footer need to say legally — copyright, DMCA, that kind of notice?"
+    why: Non-obvious — legal-notices framing rather than a named document.
+  - prompt: "We auto-renew monthly subscriptions; what does our terms page need to disclose before we charge?"
+    why: ROSCA/CARL auto-renewal disclosure is owned here.
+  - prompt: "Redactar los términos y condiciones de nuestra plataforma marketplace."
+    why: Spanish trigger for the core case.
+
+should_not_trigger:
+  - prompt: "Draft a mutual NDA between us and a contractor."
+    route_to: contracts
+    why: A negotiated two-party agreement, not a one-to-many published user policy.
+  - prompt: "Write our privacy policy — how we collect, store, and share user personal data and cookies."
+    route_to: gdpr-privacy
+    why: Terms link to the privacy policy; the data-handling substance is not part of them.
+  - prompt: "Set up the signer order and audit trail so this agreement gets signed."
+    route_to: e-signature
+    why: The signing mechanics, not the document being signed.
+  - prompt: "We need to register our brand name as a trademark."
+    route_to: ip-trademark
+    why: IP filing strategy beyond the terms' IP clause.
+  - prompt: "Get us SOC 2 ready and document our compliance posture."
+    route_to: compliance
+    why: Regulatory/standards posture, not user-facing published terms.
+
+capability:
+  - scenario: "We run a consumer SaaS with user-uploaded content, monthly auto-renewing subscriptions, and a new AI feature. Draft our Terms of Service."
+    must_include:
+      - Identifies the full document set needed (ToS + AUP + DMCA notice + auto-renewal disclosure + AI clauses)
+      - Builds an enforceable acceptance flow (clickwrap with conspicuous notice + affirmative act, not a footer browsewrap)
+      - Limitation-of-liability cap at trailing 3-12 months' fees with the unwaivable carve-outs (gross negligence, willful misconduct, bodily injury, fraud) and does NOT exclude all direct damages
+      - Arbitration paired with a ~30-day opt-out plus a class-action waiver for consumer users
+      - ROSCA/CARL-compliant auto-renewal disclosure shown before billing info, with easy cancellation
+      - DMCA designated-agent notice AND the U.S. Copyright Office registration step (with the 3-year renewal)
+      - AI input/output ownership + accuracy disclaimer + EU AI Act Art. 50 transparency note
+      - Governing law/venue, modification/change-notice, termination, and severability clauses present
+      - Routes the privacy policy out to gdpr-privacy rather than inlining it
+      - Ends with the attorney-review / not-legal-advice boundary

package/skills/terms-conditions/references/clause-library.md

@@ -0,0 +1,158 @@
+# Clause library — copy-ready ToS clauses
+
+Plain-language starting clauses for the ToS spine. Each carries a `> what this
+shifts and toward whom` note. Fill every `[PLACEHOLDER]`. None of this is legal
+advice — a licensed attorney must review before you publish or rely on it.
+
+Conventions: `[ENTITY]` = your legal entity; `[SERVICE]` = the product name;
+`[JURISDICTION]` = the state/country whose law governs; capitalized words are
+defined terms used consistently throughout the agreement.
+
+## Access / license grant
+
+> Shifts nothing away from you; bounds what the User may do with the Service.
+
+```text
+Subject to these Terms, [ENTITY] grants you a limited, revocable,
+non-exclusive, non-transferable, non-sublicensable right to access and use
+[SERVICE] for your own [personal / internal business] purposes. You may not
+resell, copy, or create derivative works from [SERVICE] except as these Terms
+allow.
+```
+
+For installed software (EULA), replace "access and use" with "install and use
+one copy of" and add the platform/seat limit in `[LICENSE SCOPE]`.
+
+## User content + license-back
+
+> You keep nothing of the User's ownership; the User grants you the operating
+> license you need to actually run the Service on their content.
+
+```text
+You retain ownership of content you submit to [SERVICE] ("Your Content"). You
+grant [ENTITY] a worldwide, non-exclusive, royalty-free license to host, store,
+reproduce, display, and transmit Your Content solely to operate and improve
+[SERVICE] and as you direct through its features. This license ends when you
+delete Your Content or close your account, except for [backups retained for
+[N] days] and content others have already shared.
+```
+
+## AI input/output ownership + accuracy disclaimer
+
+> Allocates AI input/output rights to the User where you can, and shifts the
+> risk of relying on AI output back onto the User.
+
+```text
+"Inputs" are the prompts and data you submit to the AI features; "Outputs" are
+the content those features generate for you. As between you and [ENTITY], you
+own your Inputs and, to the extent permitted by law, [ENTITY] assigns to you its
+rights in the Outputs generated for you. You are responsible for your use of
+Outputs.
+
+OUTPUTS ARE GENERATED AUTOMATICALLY, MAY BE INACCURATE OR INCOMPLETE, AND ARE
+NOT PROFESSIONAL ADVICE. DO NOT RELY ON OUTPUTS FOR LEGAL, MEDICAL, FINANCIAL,
+EMPLOYMENT, OR OTHER REGULATED DECISIONS WITHOUT INDEPENDENT PROFESSIONAL REVIEW.
+
+You may not use the AI features to (a) reverse-engineer, extract, or replicate
+the underlying models, or (b) generate content prohibited by the Acceptable Use
+Policy.
+```
+
+## Limitation of liability (the cap)
+
+> Shifts most downside risk onto the User by capping your exposure — except the
+> harms courts will not let you waive.
+
+```text
+TO THE FULLEST EXTENT PERMITTED BY LAW, [ENTITY]'S TOTAL AGGREGATE LIABILITY
+ARISING OUT OF OR RELATING TO THESE TERMS OR [SERVICE] WILL NOT EXCEED THE
+GREATER OF (A) THE FEES YOU PAID TO [ENTITY] IN THE [3 TO 12] MONTHS BEFORE THE
+EVENT GIVING RISE TO THE CLAIM, OR (B) [$AMOUNT]. [ENTITY] WILL NOT BE LIABLE
+FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR
+FOR LOST PROFITS OR DATA.
+
+THIS LIMITATION DOES NOT APPLY TO LIABILITY FOR GROSS NEGLIGENCE, WILLFUL
+MISCONDUCT, BODILY INJURY, OR FRAUD, OR TO ANY LIABILITY THAT CANNOT BE LIMITED
+UNDER APPLICABLE LAW.
+```
+
+Never write a total exclusion of *direct* damages — cap them as above. Courts
+strike a clause that tries to waive direct damages entirely.
+
+## Arbitration + 30-day opt-out + class-action waiver (consumer terms)
+
+> Shifts dispute resolution out of court and bars class actions — enforceable
+> mainly *because* of the opt-out you give the User.
+
+```text
+PLEASE READ THIS SECTION CAREFULLY — IT AFFECTS YOUR LEGAL RIGHTS.
+
+You and [ENTITY] agree to resolve any dispute by binding individual
+arbitration administered by [ARBITRATION BODY] under its rules, in
+[JURISDICTION]. YOU AND [ENTITY] WAIVE THE RIGHT TO A JURY TRIAL AND TO
+PARTICIPATE IN A CLASS ACTION. Arbitration is on an individual basis only.
+
+OPT-OUT: You may opt out of this arbitration agreement within 30 days of first
+accepting these Terms by sending notice to [OPT-OUT ADDRESS / EMAIL] with your
+name and account. Opting out does not affect any other part of these Terms.
+
+This section does not apply to claims you may bring in small-claims court or to
+requests for injunctive relief for IP infringement.
+```
+
+## Governing law & venue
+
+> Fixes which law applies and where disputes are heard — to your home turf.
+
+```text
+These Terms are governed by the laws of [JURISDICTION], without regard to its
+conflict-of-laws rules. Subject to the arbitration section above, the exclusive
+venue for any dispute is the courts located in [CITY, JURISDICTION], and you
+consent to their personal jurisdiction.
+```
+
+## Modification & change notice
+
+> Lets you update the Terms; protects you only if you actually give notice.
+
+```text
+[ENTITY] may update these Terms. For material changes, [ENTITY] will give notice
+by [email / in-app notice] at least [N] days before the change takes effect and,
+where required, will ask you to accept the updated Terms. Your continued use of
+[SERVICE] after the effective date means you accept the updated Terms for
+non-material changes.
+```
+
+## Termination & suspension
+
+> Gives you the right to cut off a User; tells the User what happens to data.
+
+```text
+[ENTITY] may suspend or terminate your access if you breach these Terms or the
+Acceptable Use Policy, or to comply with law. You may stop using [SERVICE] at
+any time. On termination, your right to use [SERVICE] ends; [ENTITY] will
+[delete / retain for [N] days then delete] Your Content, except as required by
+law. Sections that by their nature should survive (IP, disclaimers, liability,
+arbitration, governing law) survive termination.
+```
+
+## Severability
+
+> Stops one bad clause from voiding the whole agreement.
+
+```text
+If any provision of these Terms is held unenforceable, that provision will be
+limited or removed to the minimum extent necessary, and the remaining
+provisions will stay in full force.
+```
+
+## Entire agreement
+
+> Shuts down side-promises; makes the written terms the whole deal.
+
+```text
+These Terms, together with the Acceptable Use Policy and the Privacy Policy
+(each incorporated by reference), are the entire agreement between you and
+[ENTITY] regarding [SERVICE] and supersede any prior agreements or
+understandings.
+```

package/skills/terms-conditions/references/notices-and-aup.md

@@ -0,0 +1,125 @@
+# Notices & AUP kit
+
+The standalone Acceptable Use Policy, the DMCA designated-agent block plus its
+registration checklist, the copyright/IP footer notice, the auto-renewal
+disclosure block, and the EU AI Act Art. 50 transparency notice. Fill every
+`[PLACEHOLDER]`. Not legal advice — have a licensed attorney review before you
+publish.
+
+## Acceptable Use Policy (standalone, referenced by the ToS)
+
+Keep this a separate document so you can update prohibited conduct without
+re-opening the master agreement. The ToS should say: "Your use of [SERVICE] is
+also governed by the Acceptable Use Policy, incorporated by reference."
+
+```text
+Acceptable Use Policy — [SERVICE]
+
+You may not use [SERVICE] to:
+
+1. Illegal content/conduct — post or transmit anything unlawful, or use
+   [SERVICE] to break the law.
+2. Infringement — upload content that infringes another's IP or privacy.
+3. Harassment & abuse — threaten, harass, defame, or target others; post
+   hateful or violent content.
+4. Spam — send unsolicited bulk messages, phishing, or deceptive content.
+5. Security circumvention — bypass authentication, probe, scan, or breach
+   security or access controls.
+6. Scraping & automated extraction — scrape, crawl, or harvest data except as
+   [SERVICE] expressly permits.
+7. Reverse engineering — decompile or reverse-engineer [SERVICE] or extract its
+   models, except where the law forbids this restriction.
+8. Resource abuse — overload, disrupt, or interfere with [SERVICE] or other
+   users (e.g., denial-of-service, excessive load).
+
+Enforcement: Violating this Policy is a breach of the Terms of Service.
+[ENTITY] may remove content and suspend or terminate your account, with or
+without notice depending on severity, and may report illegal activity to
+authorities.
+```
+
+## DMCA designated-agent notice + registration checklist
+
+A clause is not enough. You need **both** the on-site notice **and** the
+Copyright Office registration to keep §512 safe-harbor protection for
+user-generated content.
+
+On-site notice block:
+
+```text
+Copyright Complaints (DMCA)
+
+[ENTITY] responds to notices of alleged copyright infringement under the DMCA.
+To file a notice, send the following to our Designated Agent:
+
+Designated Agent: [NAME / TITLE]
+[ENTITY], [MAILING ADDRESS]
+Email: [DMCA EMAIL]
+
+Your notice must include: (1) your physical or electronic signature; (2)
+identification of the copyrighted work; (3) identification of the infringing
+material and its location (URL); (4) your contact information; (5) a statement
+of good-faith belief that the use is unauthorized; and (6) a statement, under
+penalty of perjury, that the notice is accurate and you are authorized to act.
+
+We may remove material, notify the user, and terminate repeat infringers.
+```
+
+Registration checklist (do not skip):
+
+- [ ] Register the Designated Agent in the U.S. Copyright Office DMCA Directory
+      (online; fee is ~$6).
+- [ ] Use the *same* agent contact details on the site and in the registration.
+- [ ] Implement and follow a repeat-infringer termination policy.
+- [ ] **Renew the registration every 3 years** — it expires automatically.
+      Add a calendar reminder now.
+
+## Copyright / IP footer notice
+
+```text
+© [YEAR] [ENTITY]. All rights reserved. [SERVICE] and the [SERVICE] logo are
+trademarks of [ENTITY]. All other marks are the property of their owners.
+```
+
+## Auto-renewal disclosure block (ROSCA / CARL fields)
+
+Show this *clearly and conspicuously before* collecting billing information and
+get express consent before charging. Provide cancellation at least as easy as
+sign-up, in the same medium.
+
+```text
+Subscription & Auto-Renewal
+
+Your [PLAN] subscription is [PRICE] per [BILLING PERIOD]. It automatically
+renews each [BILLING PERIOD] at the then-current price until you cancel. By
+subscribing you authorize [ENTITY] to charge [PAYMENT METHOD] at the start of
+each renewal term.
+
+Cancel anytime in [Account → Billing] or by emailing [CANCEL EMAIL] — no phone
+call required. If you cancel, you keep access until the end of the current
+billing period. [For California users: we will send a renewal reminder before
+each renewal.]
+```
+
+Compliance notes: ROSCA requires (a) clear/conspicuous disclosure of all
+material terms before billing info is collected, (b) express informed consent
+before charging, and (c) a simple cancellation mechanism at least as easy as
+sign-up and in the same medium. California's CARL adds express affirmative
+consent and annual renewal reminders. The FTC "Click-to-Cancel" Rule was
+vacated July 2025; the FTC issued an ANPRM 2026-03-11 restarting rulemaking,
+but ROSCA still binds and the FTC still enforces — comply now.
+
+## EU AI Act Art. 50 transparency notice
+
+Applies to AI features reaching EU users; transparency obligations apply from
+2026-08-02.
+
+```text
+AI Transparency
+
+[SERVICE] uses artificial-intelligence systems. When you interact with our AI
+features, you are interacting with an AI system, not a human. Content generated
+or substantially modified by our AI is identifiable as AI-generated [and is
+labeled where required]. AI output may be inaccurate — see the AI terms in our
+Terms of Service.
+```

package/skills/terms-conditions/scripts/verify.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# verify.sh — lint a drafted Terms / AUP / notice document.
+#
+# Read-only. Checks a generated legal document for two things:
+#   1. archaic legalese the skill is told never to use (always FAIL),
+#   2. if the doc self-identifies as a full Terms of Service, the required
+#      structural sections (governing law, limitation of liability, attorney-
+#      review disclaimer); a missing DMCA notice is a WARN, not a FAIL.
+#
+# Usage:
+#   scripts/verify.sh [path]
+#   - path to a .md file, OR
+#   - a directory (globs for *.md), OR
+#   - nothing (globs the current working directory for *.md).
+#
+# Exits 0 on a clean target AND on an empty target (no docs found => nothing to
+# fail). Exits 1 only when a real FAIL is found. No dependencies beyond a POSIX
+# shell + grep.
+
+set -u
+
+FAILS=0
+WARNS=0
+CHECKED=0
+
+BANLIST='heretofore|hereinafter|witnesseth|party of the first part|aforementioned|whereas the parties'
+
+is_full_tos() {
+  # Only treat a document as a full ToS if the phrase appears in a HEADING or a
+  # title line — not merely mentioned in prose (e.g. an AUP that says "the
+  # Terms of Service"). A heading is a Markdown '#'-line or a line that is
+  # *only* the title.
+  grep -Eiq '^[[:space:]]*#{1,6}[[:space:]].*(terms of service|terms of use|terms (and|&) conditions)' "$1" \
+    || grep -Eiq '^[[:space:]]*(terms of service|terms of use|terms (and|&) conditions)([[:space:]]*[—:-].*)?[[:space:]]*$' "$1"
+}
+
+check_file() {
+  local f="$1"
+  CHECKED=$((CHECKED + 1))
+  local file_failed=0
+
+  # 1. Archaic-legalese banlist (case-insensitive). Always a FAIL.
+  if grep -Eiq "$BANLIST" "$f"; then
+    echo "FAIL  $f: archaic legalese found ->"
+    grep -Eino "$BANLIST" "$f" | sed 's/^/        line /'
+    file_failed=1
+  fi
+
+  # 2. Structural checks, only for a full ToS.
+  if is_full_tos "$f"; then
+    grep -Eiq 'governing law|governed by the laws' "$f" || {
+      echo "FAIL  $f: full ToS missing a governing-law clause"; file_failed=1; }
+    grep -Eiq 'limitation of liability|aggregate liability|total .*liability' "$f" || {
+      echo "FAIL  $f: full ToS missing a limitation-of-liability clause"; file_failed=1; }
+    grep -Eiq 'attorney|legal advice|not a lawyer|licensed (counsel|attorney)' "$f" || {
+      echo "FAIL  $f: full ToS missing an attorney-review / not-legal-advice disclaimer"; file_failed=1; }
+    grep -Eiq 'dmca|designated agent|copyright complaints' "$f" || {
+      echo "WARN  $f: full ToS has no DMCA notice (fine only if there is no user-generated content)"
+      WARNS=$((WARNS + 1)); }
+  fi
+
+  if [ "$file_failed" -eq 0 ]; then
+    echo "ok    $f"
+  else
+    FAILS=$((FAILS + 1))
+  fi
+}
+
+# Resolve the target into a list of .md files.
+TARGET="${1:-.}"
+FILES=()
+if [ -f "$TARGET" ]; then
+  FILES=("$TARGET")
+elif [ -d "$TARGET" ]; then
+  while IFS= read -r line; do FILES+=("$line"); done < <(find "$TARGET" -type f -name '*.md' 2>/dev/null)
+else
+  echo "verify.sh: target not found: $TARGET" >&2
+  exit 0
+fi
+
+if [ "${#FILES[@]}" -eq 0 ]; then
+  echo "verify.sh: no .md documents to check under '$TARGET' — nothing to verify."
+  exit 0
+fi
+
+for f in "${FILES[@]}"; do
+  check_file "$f"
+done
+
+echo "---"
+echo "checked: $CHECKED  fails: $FAILS  warns: $WARNS"
+[ "$FAILS" -eq 0 ] && exit 0 || exit 1