@damiangilgonzalez/harness 1.3.7

package/skills/competitor-watch/references/tracker-schema.md

@@ -0,0 +1,98 @@
+# Tracker schema + a filled example
+
+The tracker of record is three structured files under `docs/wiki/competitors/`. Raw
+captures (the diffed HTML/JSON snapshots) go under `docs/raw/competitors/<rival>/`. The
+rule that overrides everything: **a price or feature cell without a `source_url` + `date` is
+not knowledge — leave it blank and say so.**
+
+`docs/wiki/` is an OKF v0.1 bundle, so the one `.md` file here (the competitor profile)
+carries YAML frontmatter with a non-empty `type:`; the two CSVs are data files, not OKF
+documents. Any cross-references in the profile body use **standard markdown links** (e.g.
+`[Beta](./beta.md)`), never wikilinks. See `../../harness/references/wiki-protocol.md`
+"## Conventions".
+
+## 1. Competitor profile (one file per rival)
+
+Markdown front-matter + body. One per rival, named `docs/wiki/competitors/<rival>.md`.
+The frontmatter is OKF v0.1 conformant: `type:` is the only required field (non-empty);
+`title`/`description`/`tags`/`timestamp` are the recommended standard surface. All the
+domain keys below (`name`, `positioning_source.date`, every `pricing_tiers[].date`, …) are
+kept verbatim — OKF allows any extra key and `verify.sh` reads them, so adding the OKF
+fields is purely additive.
+
+```yaml
+---
+type: competitor
+title: Acme
+description: "Tracker of record for Acme — positioning, pricing tiers, and watched surfaces."
+tags: [competitor, pricing-watch, feature-watch]
+timestamp: 2026-05-28T00:00:00Z
+name: Acme
+positioning_line: "The all-in-one workspace for remote-first teams"
+positioning_source: { url: "https://acme.com", date: "2026-05-28" }
+segment: "SMB / mid-market SaaS"
+watched_urls:
+  - { axis: pricing,       url: "https://acme.com/pricing",   selector: ".price-amount",        cadence: "10m" }
+  - { axis: feature,       url: "https://acme.com/changelog", selector: ".changelog li:first-child", cadence: "daily" }
+  - { axis: positioning,   url: "https://acme.com",           selector: "h1.hero-title",        cadence: "weekly" }
+  - { axis: team,          url: "https://acme.com/careers",   selector: ".jobs-count",          cadence: "weekly" }
+pricing_tiers:
+  - { tier: "Starter", amount: 0,  currency: USD, period: mo, source_url: "https://acme.com/pricing", date: "2026-05-28" }
+  - { tier: "Pro",     amount: 59, currency: USD, period: mo, source_url: "https://acme.com/pricing", date: "2026-05-28" }
+  - { tier: "Team",    amount: 99, currency: USD, period: mo, source_url: "https://acme.com/pricing", date: "2026-05-28" }
+---
+
+## Notes
+Repositioned from "project tool" to "workspace" in Q2 2026 — see change log 2026-05-12.
+
+## Related
+- [Beta](./beta.md) — closest competing positioning; cross-watch their pricing moves.
+```
+
+Every `pricing_tiers` row and any feature claim must carry `source_url` + `date`. If you only
+have the tier name but not a confirmed price, omit `amount` rather than guess.
+
+## 2. Feature matrix (CSV)
+
+Rows = features, columns = competitors, plus a sourcing column pair per competitor so
+`verify.sh` can confirm each asserted cell is dated. Keep it at `docs/wiki/competitors/feature-matrix.csv`.
+
+```csv
+feature,acme_value,acme_source_url,acme_date,beta_value,beta_source_url,beta_date
+SSO (SAML),Team plan,https://acme.com/pricing,2026-05-28,Enterprise only,https://beta.io/security,2026-05-29
+API rate limit,1000 req/min,https://acme.com/docs/limits,2026-05-28,,,
+Audit log,yes,https://acme.com/security,2026-05-28,yes,https://beta.io/security,2026-05-29
+```
+
+A blank `*_value` with blank source is honest ("we haven't confirmed it"). A non-blank value
+with a blank source is a violation — that's an invented fact and `verify.sh` fails it.
+
+## 3. Change log (CSV, append-only)
+
+The time series. Never overwrite a row; each pass appends. Keep it at
+`docs/wiki/competitors/change-log.csv`.
+
+```csv
+date,competitor,axis,url,old_value,new_value,materiality,action
+2026-05-12,Acme,positioning,https://acme.com,"project tool","remote-first workspace",high,"flag to brand-voice — they moved into our lane"
+2026-05-20,Acme,pricing,https://acme.com/pricing,$49/mo,$59/mo,high,"revisit our mid-tier vs theirs (route to pricing)"
+2026-05-22,Acme,feature,https://acme.com/changelog,,"SSO on Team plan",medium,"note for product"
+2026-05-29,Beta,team,https://beta.io/careers,12 roles,19 roles,low,"hiring sales — watch for go-to-market push"
+```
+
+Field rules (these are what `verify.sh` enforces):
+
+- `axis` ∈ `{pricing, feature, positioning, messaging, team, other}` — exactly one.
+- `materiality` ∈ `{high, medium, low}`.
+- `url` and `date` are required on every row (the change is unverifiable without them).
+- `old_value` may be blank for a *new* surface (first capture); `new_value` should not be blank.
+- `action` is the next step or the route — empty action on a `high` row is a smell.
+
+## End-to-end: one rival, one pass
+
+1. Orient: Acme is in our vital-few list. Watch pricing (10m), changelog (daily), hero (weekly), careers (weekly).
+2. Gather: capture `.price-amount` → reads `$59/mo` on the Pro tier.
+3. Analyze: diff vs last stored capture (`$49/mo`) → changed.
+4. Classify: `pricing`. Score: `high` (it's our competing tier).
+5. Log: append the `2026-05-20` pricing row above.
+6. Flag + route: high → route the pricing implication to `../pricing/SKILL.md`; you don't set our price.

package/skills/competitor-watch/scripts/verify.sh

@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+#
+# verify.sh — competitor-tracker / change-log / monitoring-config linter for the
+# `competitor-watch` skill.
+#
+# WHAT IT DOES (read-only; never edits a file)
+#   Lints the structured artifacts this skill emits against the rules in SKILL.md.
+#   It keys off filenames and CSV headers, so any unrelated file is simply skipped
+#   and an empty/clean target never false-fails.
+#
+#   Checks:
+#     1. CHANGE LOG — any CSV whose header contains both `axis` and `materiality`
+#        (e.g. change-log.csv). Per data row:
+#          - `axis`        must be one of pricing|feature|positioning|messaging|team|other  (FAIL)
+#          - `materiality` must be one of high|medium|low                                   (FAIL)
+#          - `url`  must be non-empty                                                       (FAIL)
+#          - `date` must be non-empty                                                       (FAIL)
+#     2. FEATURE MATRIX — any CSV with paired `<x>_value` + `<x>_source_url` +
+#        `<x>_date` columns. A non-empty value with an empty source_url OR empty
+#        date is an invented fact                                                            (FAIL)
+#     3. MONITORING CONFIG — cadence sanity (WARN, never fail). In any *.md/*.yaml/
+#        *.yml/*.txt file, a line that names an axis and a cadence where:
+#          - a slow axis (positioning|careers|team|reviews|social) is paired with a
+#            sub-15-minute cadence  -> noise/cost                                            (WARN)
+#          - the pricing axis is paired with a slower-than-daily cadence (weekly/
+#            monthly)                -> a missed move                                        (WARN)
+#
+# HOW TO RUN (inside YOUR project, not the skills repo)
+#   ./verify.sh                 # scan ./ for tracker / change-log / config files
+#   ./verify.sh --path docs  # scan a subdirectory
+#   ./verify.sh --strict        # treat any warning as a failure (exit 1)
+#
+# EXIT CODES
+#   0  clean, or warnings only without --strict (also: nothing to check)
+#   1  a structural violation (bad axis/materiality, missing url/date, unsourced
+#      value), or --strict with a warning
+#   2  bad usage
+#
+# Runs on stock macOS bash 3.2 — no mapfile, no associative arrays.
+
+set -euo pipefail
+
+if [ -t 1 ]; then
+  RED=$'\033[31m'; GREEN=$'\033[32m'; YELLOW=$'\033[33m'; NC=$'\033[0m'
+else
+  RED=''; GREEN=''; YELLOW=''; NC=''
+fi
+
+ok_count=0; skip_count=0; warn_count=0; fail_count=0
+ok()   { printf '%s[ ok ]%s %s\n' "$GREEN"  "$NC" "$*"; ok_count=$((ok_count + 1)); }
+skip() { printf '%s[skip]%s %s\n' "$YELLOW" "$NC" "$*"; skip_count=$((skip_count + 1)); }
+warn() { printf '%s[warn]%s %s\n' "$YELLOW" "$NC" "$*"; warn_count=$((warn_count + 1)); }
+fail() { printf '%s[fail]%s %s\n' "$RED"    "$NC" "$*"; fail_count=$((fail_count + 1)); }
+
+usage() { sed -n '2,46p' "$0" | sed 's/^# \{0,1\}//'; }
+
+SCAN_PATH="."
+STRICT=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --path)    SCAN_PATH="${2:?--path needs a value}"; shift 2 ;;
+    --strict)  STRICT=1; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) printf '%sUnknown argument: %s%s\n\n' "$RED" "$1" "$NC"; usage; exit 2 ;;
+  esac
+done
+
+if [ ! -e "$SCAN_PATH" ]; then
+  printf '%sPath not found: %s%s\n' "$RED" "$SCAN_PATH" "$NC"; exit 2
+fi
+
+TMPDIR_V="$(mktemp -d 2>/dev/null || printf '/tmp/cw-verify.%s' "$$")"
+mkdir -p "$TMPDIR_V" 2>/dev/null || true
+cleanup() { rm -rf "$TMPDIR_V" 2>/dev/null || true; }
+trap cleanup EXIT
+
+CSV_FILES="$TMPDIR_V/csv"
+CFG_FILES="$TMPDIR_V/cfg"
+find "$SCAN_PATH" -type f -name '*.csv' 2>/dev/null > "$CSV_FILES" || true
+find "$SCAN_PATH" -type f \
+  \( -name '*.md' -o -name '*.yaml' -o -name '*.yml' -o -name '*.txt' \) \
+  2>/dev/null > "$CFG_FILES" || true
+
+# Allowed sets (whitespace-padded for safe substring match).
+AXES=" pricing feature positioning messaging team other "
+MATS=" high medium low "
+
+# Find the 0-based index of a column name in a comma-separated header line.
+# Echoes -1 if absent.
+col_index() {
+  header="$1"; want="$2"
+  idx=-1; i=0
+  oldifs="$IFS"; IFS=','
+  for c in $header; do
+    # trim spaces and a trailing CR
+    c="$(printf '%s' "$c" | tr -d '\r' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+    if [ "$c" = "$want" ]; then idx=$i; fi
+    i=$((i + 1))
+  done
+  IFS="$oldifs"
+  printf '%s' "$idx"
+}
+
+# Echo the Nth (0-based) field of a CSV row. Simple split on comma — values in this
+# schema do not contain commas; quoted commas would need a real parser, which is out
+# of scope for a lint (we only read low-structure tracker cells).
+field_at() {
+  row="$1"; n="$2"
+  i=0
+  oldifs="$IFS"; IFS=','
+  for c in $row; do
+    if [ "$i" -eq "$n" ]; then
+      printf '%s' "$c" | tr -d '\r' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//'
+      IFS="$oldifs"; return 0
+    fi
+    i=$((i + 1))
+  done
+  IFS="$oldifs"
+  printf ''
+}
+
+# ---------------------------------------------------------------------------
+# 1 + 2. CSV checks
+# ---------------------------------------------------------------------------
+csv_change_log_seen=0
+csv_matrix_seen=0
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  header="$(head -n 1 "$f" 2>/dev/null | tr -d '\r')"
+  [ -z "$header" ] && continue
+
+  # --- change log: header has both axis and materiality ---
+  ai="$(col_index "$header" axis)"
+  mi="$(col_index "$header" materiality)"
+  ui="$(col_index "$header" url)"
+  di="$(col_index "$header" date)"
+  if [ "$ai" -ge 0 ] && [ "$mi" -ge 0 ]; then
+    csv_change_log_seen=1
+    rownum=0; bad=0
+    while IFS= read -r row; do
+      rownum=$((rownum + 1))
+      [ "$rownum" -le 1 ] && continue   # skip header
+      # skip blank lines
+      [ -z "$(printf '%s' "$row" | tr -d ', \r')" ] && continue
+
+      axv="$(field_at "$row" "$ai")"
+      mav="$(field_at "$row" "$mi")"
+      case "$AXES" in *" $axv "*) : ;; *) fail "$f row $rownum: axis '$axv' not in {pricing,feature,positioning,messaging,team,other}"; bad=1 ;; esac
+      case "$MATS" in *" $mav "*) : ;; *) fail "$f row $rownum: materiality '$mav' not in {high,medium,low}"; bad=1 ;; esac
+      if [ "$ui" -ge 0 ]; then
+        urv="$(field_at "$row" "$ui")"
+        [ -z "$urv" ] && { fail "$f row $rownum: empty url"; bad=1; }
+      fi
+      if [ "$di" -ge 0 ]; then
+        dtv="$(field_at "$row" "$di")"
+        [ -z "$dtv" ] && { fail "$f row $rownum: empty date"; bad=1; }
+      fi
+    done < "$f"
+    [ "$bad" -eq 0 ] && ok "change log clean: $f"
+  fi
+
+  # --- feature matrix: any <x>_value with a PAIRED <x>_source_url column ---
+  # discover candidate prefixes that have a *_value column, then keep only those
+  # that also declare a *_source_url column (so change-log old_value/new_value,
+  # which have no paired source column, are not mistaken for matrix cells).
+  cand="$(printf '%s' "$header" | tr ',' '\n' | sed 's/\r//' | sed -n 's/^[[:space:]]*\([A-Za-z0-9_]*\)_value[[:space:]]*$/\1/p')"
+  prefixes=""
+  for pre in $cand; do
+    if [ "$(col_index "$header" "${pre}_source_url")" -ge 0 ]; then
+      prefixes="$prefixes $pre"
+    fi
+  done
+  if [ -n "$(printf '%s' "$prefixes" | tr -d ' ')" ]; then
+    csv_matrix_seen=1
+    bad=0
+    for pre in $prefixes; do
+      vi="$(col_index "$header" "${pre}_value")"
+      si="$(col_index "$header" "${pre}_source_url")"
+      pi="$(col_index "$header" "${pre}_date")"
+      rownum=0
+      while IFS= read -r row; do
+        rownum=$((rownum + 1))
+        [ "$rownum" -le 1 ] && continue   # skip header
+        [ -z "$(printf '%s' "$row" | tr -d ', \r')" ] && continue
+        val="$(field_at "$row" "$vi")"
+        [ -z "$val" ] && continue   # blank value is honest; nothing to source
+        src=""; dat=""
+        [ "$si" -ge 0 ] && src="$(field_at "$row" "$si")"
+        [ "$pi" -ge 0 ] && dat="$(field_at "$row" "$pi")"
+        if [ -z "$src" ] || [ -z "$dat" ]; then
+          fail "$f row $rownum: '${pre}' value '$val' has no source_url+date (invented fact)"
+          bad=1
+        fi
+      done < "$f"
+    done
+    [ "$bad" -eq 0 ] && ok "feature-matrix cells all sourced+dated: $f"
+  fi
+done < "$CSV_FILES"
+
+[ "$csv_change_log_seen" -eq 0 ] && skip "no change-log CSV (header with axis+materiality) found"
+[ "$csv_matrix_seen" -eq 0 ] && skip "no feature-matrix CSV (<x>_value/_source_url/_date) found"
+
+# ---------------------------------------------------------------------------
+# 3. Monitoring-config cadence sanity (WARN only)
+# ---------------------------------------------------------------------------
+SLOW_AXES="positioning careers team reviews review social"
+cfg_seen=0
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  # only consider files that look like config (mention a cadence keyword)
+  grep -iqE 'cadence|every|min|hour|daily|weekly|monthly' "$f" 2>/dev/null || continue
+  while IFS= read -r ln; do
+    low="$(printf '%s' "$ln" | tr 'A-Z' 'a-z')"
+    case "$low" in *axis*|*cadence*|*pricing*|*positioning*|*careers*) : ;; *) continue ;; esac
+
+    # sub-15-minute cadence present on the line?
+    sub15=0
+    # patterns like 5m, 10 min, 00:10:00, "5 minutes", "every 10 min"
+    if printf '%s' "$low" | grep -Eq '(^|[^0-9])(0?[0-9]|1[0-4])[[:space:]]*m(in)?([^a-z]|$)'; then sub15=1; fi
+    if printf '%s' "$low" | grep -Eq '00:0[0-9]:00|00:1[0-4]:00'; then sub15=1; fi
+    if printf '%s' "$low" | grep -Eq '(0?[0-9]|1[0-4])[[:space:]]*minute'; then sub15=1; fi
+
+    slower_than_daily=0
+    if printf '%s' "$low" | grep -Eq 'weekly|monthly|[0-9]+[[:space:]]*(day|days)'; then
+      # >1 day or weekly/monthly
+      if printf '%s' "$low" | grep -Eq 'weekly|monthly|([2-9]|[1-9][0-9]+)[[:space:]]*day'; then slower_than_daily=1; fi
+    fi
+
+    # pricing axis with a slower-than-daily cadence -> missed move
+    if printf '%s' "$low" | grep -q 'pricing' && [ "$slower_than_daily" -eq 1 ]; then
+      cfg_seen=1
+      warn "$f: pricing axis on a slower-than-daily cadence — risks a missed move :: $ln"
+    fi
+
+    # slow axis with a sub-15-min cadence -> noise/cost
+    if [ "$sub15" -eq 1 ]; then
+      for sa in $SLOW_AXES; do
+        if printf '%s' "$low" | grep -q "$sa"; then
+          cfg_seen=1
+          warn "$f: '$sa' axis on a sub-15-min cadence — noise and cost :: $ln"
+          break
+        fi
+      done
+    fi
+  done < "$f"
+done < "$CFG_FILES"
+[ "$cfg_seen" -eq 0 ] && skip "no monitoring-config cadence mismatches found"
+
+printf '\nok=%d skip=%d warn=%d fail=%d\n' "$ok_count" "$skip_count" "$warn_count" "$fail_count"
+
+if [ "$fail_count" -gt 0 ]; then exit 1; fi
+if [ "$STRICT" -eq 1 ] && [ "$warn_count" -gt 0 ]; then exit 1; fi
+exit 0

package/skills/compliance/SKILL.md

@@ -0,0 +1,157 @@
+---
+name: compliance
+description: "Use when scoping which regulatory frameworks bind a business — SOC 2, ISO 27001, HIPAA, PCI DSS, EU AI Act, DORA, NIS2 — building a control register with owners and evidence, or standing up the cadence that keeps it audit-ready. NOT drafting privacy-policy/ROPA/DPA or ToS text (that is gdpr-privacy, terms-conditions), NOT hardening code (that is secure-coding)."
+tags: [compliance, soc2, iso27001, audit-readiness, controls, governance]
+recommends: [gdpr-privacy, terms-conditions, data-policy, contracts, secure-coding]
+origin: risco
+---
+
+# Compliance — scope the frameworks, build the register, run the rhythm
+
+You turn a vague "we need to be compliant" into artifacts that survive an audit:
+a scoped framework list with current deadlines, a **control register** (one row
+per control, tagged to every framework it satisfies, each with an owner and an
+evidence source), a **cadence calendar** of the recurring work that keeps the
+program true between audits instead of scrambling once a year, and an
+evidence-source catalog.
+
+Your job is **scoping and orchestration, not legal opinion**. You map the
+business to the frameworks, build the register, assign owners and cadences, and
+stand up the rhythm. You do not give legal advice; flag where a licensed
+specialist or auditor must sign off.
+
+**Route out** — these are owned by siblings, not by you. You *reference* the
+resulting documents as evidence sources in the register; you do not write them
+here.
+
+- Privacy notice, ROPA, DSAR flow, consent banner → `../gdpr-privacy/SKILL.md`.
+- Terms of Service, EULA, acceptable-use → `../terms-conditions/SKILL.md`.
+- Internal retention/classification policy *text* → `../data-policy/SKILL.md`.
+- Commercial contract / MSA / DPA clause drafting → `../contracts/SKILL.md`.
+- Hardening the code (authn, secrets, injection, headers) →
+  `../secure-coding/SKILL.md`.
+
+## Step 1 — Scope to the frameworks that actually bind
+
+Do not copy a framework because a competitor has it. Map business attributes to
+obligations. Ask the operator the attribute questions, then apply this table.
+
+| Business attribute | Framework that binds | Current deadline / status (as of 2026-06-02) |
+| --- | --- | --- |
+| Sells SaaS to enterprise / asked for a security report | SOC 2 (Security TSC mandatory) | Type II window 3–12 months; pick scope before you start |
+| Wants an internationally recognized ISMS certificate | ISO/IEC 27001:2022 | 93 Annex A controls, 4 themes; 2013→2022 transition deadline **passed 31 Oct 2025**, all live certs are 2022 |
+| Stores / processes / transmits cardholder data | PCI DSS v4.0.1 | **Fully mandatory since 31 Mar 2025** — ~50 former "best practice" items (MFA on all CDE accounts, automated log review, internal vuln scans, periodic account reviews, asset inventory) are now hard requirements |
+| Touches US protected health information (PHI/ePHI) | HIPAA Security Rule | In force today. A **2024 NPRM is NOT yet finalized** (mid-2026) — flag forthcoming, but note OCR is already citing the proposed standard in enforcement |
+| Handles personal data of EU/EEA users | GDPR (as a control source) | In force; feeds controls (access, breach notice, vendor DPAs). Document *text* → `../gdpr-privacy/SKILL.md` |
+| Builds or deploys an AI system, esp. high-risk use | EU AI Act | Phased — see below; **2 Aug 2026 is the active legal date** for Annex III high-risk |
+| Is an EU financial entity (or critical ICT vendor to one) | DORA | **In force since Jan 2025** — ICT risk mgmt, incident reporting, resilience testing, third-party risk |
+| Operates essential/important services in the EU | NIS2 | Transposed in 21/27 member states by Mar 2026; many set a first audit deadline of **30 Jun 2026** |
+
+**EU AI Act — get the dates exactly right (high audit risk):**
+
+- Prohibited practices + AI-literacy: **2 Feb 2025**.
+- GPAI-model obligations + governance + penalties: **2 Aug 2025**.
+- Annex III (use-based) high-risk obligations: **2 Aug 2026**.
+- Annex I (product-regulated, incl. medical devices): **2 Aug 2027**.
+- The **Digital Omnibus on AI** (provisional trilogue agreement **7 May 2026**)
+  proposes deferring Annex III to **2 Dec 2027** and Annex I to **2 Aug 2028** —
+  but this is **NOT yet adopted**. Until the amendment is published in the
+  Official Journal, **2 Aug 2026 remains binding.** Plan to the original date;
+  flag the deferral as forthcoming-not-final.
+- Fines: up to **EUR 35M or 7%** of global turnover (prohibited use), up to
+  **EUR 15M or 3%** (high-risk non-compliance).
+
+**Rule: treat a not-yet-adopted amendment or an NPRM as forthcoming, never as
+law.** Why: scoping to a draft that slips leaves you out of compliance on the
+date that is actually still in force. See `references/frameworks.md` for the
+per-framework control summaries.
+
+## Step 2 — Build the control register
+
+One row per control. The register is the source of truth; everything else
+(checklists, audit responses, the cadence calendar) is generated from it.
+
+| Column | What goes in it |
+| --- | --- |
+| `control-id` | Stable internal id, e.g. `AC-02` |
+| `framework` | Every framework this control satisfies (multi-tag) |
+| `owner` | A named person/role accountable — never "the team" |
+| `evidence` | The exact artifact that proves it, and where it lives |
+| `cadence` | How often it is reviewed, sized by risk |
+| `last-verified` | Timestamp of the last attestation |
+| `status` | `met` / `gap` / `in-progress` |
+
+**Bad → Good control:**
+
+```text
+Bad:  "We do access control."        (no owner, no proof, not testable)
+Good: AC-02 | ISO A.5.18 + SOC2 CC6.2 + PCI 7.2 | owner: Head of IT |
+      evidence: quarterly IdP access-export reviewed & signed |
+      cadence: quarterly | last-verified: 2026-05-30 | status: met
+```
+
+The Good row is auditable: an auditor can ask the owner for the dated export and
+verify the claim in minutes.
+
+**Exploit the overlap — one control, many frameworks.** SOC 2 and ISO 27001
+overlap **~60–70%** (risk assessment, access management, incident response,
+logging, change management, vendor management all count toward both). So:
+
+- **Bad:** maintain a separate register per framework → the same control gets
+  re-documented 3 times and drifts out of sync.
+- **Good:** one register, each control tagged to *all* frameworks it satisfies.
+  Generate the per-framework checklist as a filtered view.
+
+## Step 3 — Stand up the operating rhythm
+
+Audit-readiness is a continuous state, not an annual project. Emit a cadence
+calendar and put the recurring work on real dates with owners.
+
+| Cadence | Recurring compliance work |
+| --- | --- |
+| Daily | Automated control monitoring / alerting (failed logins, drift) |
+| Weekly | **Control-health review** — the heartbeat: walk open gaps, stale evidence, overdue owners |
+| Monthly | Evidence refresh for high-risk controls; vulnerability-scan review |
+| Quarterly | Access recertification; vendor/third-party risk reassessment |
+| Annual | Full risk assessment; policy review; penetration test; audit prep |
+
+The **weekly control-health review** is the single habit that kills the annual
+scramble. Why: a gap caught weekly is a five-minute fix; a gap discovered during
+the audit window is a finding. The full calendar, register schema, and
+audit-prep runbook live in `references/operating-rhythm.md`.
+
+## Step 4 — Evidence discipline
+
+Evidence is what an auditor tests. Every piece must be:
+
+- **Timestamped** — undated evidence proves nothing about *when* the control ran.
+- **Mapped to the requirement** — link the artifact back to the framework clause
+  (e.g. this export proves `ISO A.5.18` *and* `SOC2 CC6.2`).
+- **Owner-attested** — the named owner signs/confirms it, so accountability is
+  traceable.
+- **Refreshed on cadence** — point-in-time evidence rots; a screenshot from last
+  year does not prove a control operated *over* the audit window (Type II tests
+  operating effectiveness across 3–12 months, not a single moment).
+
+Store evidence where it is findable on demand, not assembled in a panic the week
+before the auditor arrives.
+
+## Anti-patterns
+
+| Anti-pattern | Why it fails | Do instead |
+| --- | --- | --- |
+| Checklist with no owners | "Everyone's job" means no one's job; the auditor asks who, and the room goes silent | Every control names one accountable owner |
+| Copying a framework you don't fall under | Wastes months certifying SOC 2 when the binding obligation was PCI DSS | Scope from business attributes (Step 1) first |
+| Treating an NPRM / not-yet-adopted amendment as law | The draft slips; you're non-compliant on the date still legally in force | Plan to the active date; flag drafts as forthcoming |
+| Point-in-time evidence | A single screenshot can't prove a control operated over the Type II window | Timestamped, periodic, owner-attested evidence |
+| One register per framework | Same control re-documented 3× and drifts; the 60–70% overlap is wasted | One register, each control multi-tagged |
+| Annual evidence scramble | Gaps surface as audit findings instead of weekly fixes | Weekly control-health review + cadence calendar |
+| Drafting the privacy policy / DPA here | That's legal-document substance, a different skill's lane | Route to `../gdpr-privacy/SKILL.md` / `../contracts/SKILL.md` |
+| Giving a legal opinion | You scope and orchestrate; you are not counsel | Flag where a licensed specialist or auditor must sign off |
+
+## Verify
+
+`scripts/verify.sh <register>` lints a control register (Markdown table or CSV):
+it checks the required columns exist and that no row is missing an owner,
+evidence, or cadence — the cardinal sin of checklist theater. Read-only, exits 0
+on a clean or empty register.

package/skills/compliance/evals/README.md

@@ -0,0 +1,14 @@
+# Evals — compliance
+
+These cases are graded by judgment, not by an automated runner. Feed each
+`should_trigger` and `should_not_trigger` prompt to the skill router and confirm
+the routing matches: triggers should land on `compliance`, and each
+`should_not_trigger` prompt should route to the named sibling (`route_to`). For
+the `capability` case, run the scenario through the skill and check the response
+covers every item in `must_include` — especially the date-sensitive ones (EU AI
+Act 2 Aug 2026 as active vs the not-yet-adopted Omnibus deferral; HIPAA NPRM as
+forthcoming-not-law) and the structural ones (a register with owner/evidence/
+cadence columns, the 60-70% overlap, a weekly control-health review). The
+separate `scripts/verify.sh` mechanically lints a finished control register; run
+it against a generated register to confirm no control is missing an owner,
+evidence, or cadence.

package/skills/compliance/evals/cases.yaml

@@ -0,0 +1,46 @@
+skill: compliance
+
+should_trigger:
+  - prompt: "What compliance frameworks do we need for a fintech operating in the EU?"
+    why: Core scoping — map business attributes (financial entity, EU) to binding frameworks (DORA, GDPR-as-source, maybe SOC 2).
+  - prompt: "Build us a SOC 2 readiness checklist with control owners and what proves each control."
+    why: Core artifact — the control register with owner + evidence columns.
+  - prompt: "We have an ISO 27001 audit in 90 days, set up the prep rhythm and evidence collection."
+    why: Non-obvious — the deliverable is a cadence/runbook, not a document; audit-prep is squarely this skill.
+  - prompt: "Map our controls — who owns what, how often each is reviewed, and what evidence backs it."
+    why: The control register is the exact artifact; ownership + cadence + evidence is the skill's spine.
+  - prompt: "Set up a continuous-compliance calendar so we stop scrambling the week before every audit."
+    why: Non-obvious operating-rhythm trigger — the weekly control-health review and cadence calendar.
+  - prompt: "Does the EU AI Act apply to our recommender system, and what's the deadline we have to hit?"
+    why: Scoping to a dated framework — must surface 2 Aug 2026 as active and flag the Omnibus deferral as not-yet-adopted.
+  - prompt: "¿Qué compliance necesitamos para una app de salud con datos médicos de usuarios europeos?"
+    why: Spanish + multi-framework sector scoping (HIPAA-style PHI, GDPR-as-source, SOC 2), not a single document.
+
+should_not_trigger:
+  - prompt: "Write our privacy policy and cookie consent banner."
+    route_to: gdpr-privacy
+    why: Privacy-document drafting and consent UX — substance owned by gdpr-privacy, not program scoping.
+  - prompt: "Draft the Terms of Service for our SaaS website."
+    route_to: terms-conditions
+    why: A one-to-many published legal document, not a control register or cadence.
+  - prompt: "Fix the SQL injection and harden the auth on our API endpoints."
+    route_to: secure-coding
+    why: Code-level hardening (the evidence source), not the program-level control mapping.
+  - prompt: "Review this vendor MSA and DPA before we sign it."
+    route_to: contracts
+    why: Negotiated two-party agreement review, not framework scoping.
+  - prompt: "Write our internal data retention and classification policy text."
+    route_to: data-policy
+    why: Internal policy-document prose, not the control register that references it.
+
+capability:
+  - scenario: "We're a Series-A health SaaS with EU users and an AI triage feature that scores patient symptoms. Tell us what compliance we need and how to keep it true between audits."
+    must_include:
+      - Scopes to HIPAA for the PHI, flagging the 2024 NPRM as forthcoming/not-yet-finalized while noting OCR is already enforcing toward it
+      - Treats GDPR as a control source for the EU users (and routes the privacy-document drafting to gdpr-privacy, not drafting it here)
+      - Includes SOC 2 (Security TSC) for the enterprise-readiness angle and notes Type II tests operating effectiveness over a 3-12 month window
+      - Scopes the EU AI Act high-risk obligations to the active 2 Aug 2026 date while flagging the 7 May 2026 Digital Omnibus proposed deferral to 2 Dec 2027 as not-yet-adopted
+      - Produces a control register with owner / evidence / cadence columns, one row per control
+      - Notes the SOC 2 / ISO 27001 ~60-70% overlap to keep a single multi-tagged register instead of duplicates
+      - Stands up an operating rhythm with a weekly control-health review and a cadence calendar
+      - Routes privacy-policy / DPA drafting to gdpr-privacy and contracts, and does NOT give a legal opinion