@diottodev/runic 1.0.0 → 1.1.0

package/business/revenue-operations/SKILL.md

@@ -0,0 +1,273 @@
+---
+name: "revenue-operations"
+description: Analyzes sales pipeline health, revenue forecasting accuracy, and go-to-market efficiency metrics for SaaS revenue optimization. Use when analyzing sales pipeline coverage, forecasting revenue, evaluating go-to-market performance, reviewing sales metrics, assessing pipeline analysis, tracking forecast accuracy with MAPE, calculating GTM efficiency, or measuring sales efficiency and unit economics for SaaS teams.
+---
+
+# Revenue Operations
+
+Pipeline analysis, forecast accuracy tracking, and GTM efficiency measurement for SaaS revenue teams.
+
+> **Output formats:** All scripts support `--format text` (human-readable) and `--format json` (dashboards/integrations).
+
+---
+
+## Quick Start
+
+```bash
+# Analyze pipeline health and coverage
+python scripts/pipeline_analyzer.py --input assets/sample_pipeline_data.json --format text
+
+# Track forecast accuracy over multiple periods
+python scripts/forecast_accuracy_tracker.py assets/sample_forecast_data.json --format text
+
+# Calculate GTM efficiency metrics
+python scripts/gtm_efficiency_calculator.py assets/sample_gtm_data.json --format text
+```
+
+---
+
+## Tools Overview
+
+### 1. Pipeline Analyzer
+
+Analyzes sales pipeline health including coverage ratios, stage conversion rates, deal velocity, aging risks, and concentration risks.
+
+**Input:** JSON file with deals, quota, and stage configuration
+**Output:** Coverage ratios, conversion rates, velocity metrics, aging flags, risk assessment
+
+**Usage:**
+
+```bash
+python scripts/pipeline_analyzer.py --input pipeline.json --format text
+```
+
+**Key Metrics Calculated:**
+- **Pipeline Coverage Ratio** -- Total pipeline value / quota target (healthy: 3-4x)
+- **Stage Conversion Rates** -- Stage-to-stage progression rates
+- **Sales Velocity** -- (Opportunities x Avg Deal Size x Win Rate) / Avg Sales Cycle
+- **Deal Aging** -- Flags deals exceeding 2x average cycle time per stage
+- **Concentration Risk** -- Warns when >40% of pipeline is in a single deal
+- **Coverage Gap Analysis** -- Identifies quarters with insufficient pipeline
+
+**Input Schema:**
+
+```json
+{
+  "quota": 500000,
+  "stages": ["Discovery", "Qualification", "Proposal", "Negotiation", "Closed Won"],
+  "average_cycle_days": 45,
+  "deals": [
+    {
+      "id": "D001",
+      "name": "Acme Corp",
+      "stage": "Proposal",
+      "value": 85000,
+      "age_days": 32,
+      "close_date": "2025-03-15",
+      "owner": "rep_1"
+    }
+  ]
+}
+```
+
+### 2. Forecast Accuracy Tracker
+
+Tracks forecast accuracy over time using MAPE, detects systematic bias, analyzes trends, and provides category-level breakdowns.
+
+**Input:** JSON file with forecast periods and optional category breakdowns
+**Output:** MAPE score, bias analysis, trends, category breakdown, accuracy rating
+
+**Usage:**
+
+```bash
+python scripts/forecast_accuracy_tracker.py forecast_data.json --format text
+```
+
+**Key Metrics Calculated:**
+- **MAPE** -- mean(|actual - forecast| / |actual|) x 100
+- **Forecast Bias** -- Over-forecasting (positive) vs under-forecasting (negative) tendency
+- **Weighted Accuracy** -- MAPE weighted by deal value for materiality
+- **Period Trends** -- Improving, stable, or declining accuracy over time
+- **Category Breakdown** -- Accuracy by rep, product, segment, or any custom dimension
+
+**Accuracy Ratings:**
+| Rating | MAPE Range | Interpretation |
+|--------|-----------|----------------|
+| Excellent | <10% | Highly predictable, data-driven process |
+| Good | 10-15% | Reliable forecasting with minor variance |
+| Fair | 15-25% | Needs process improvement |
+| Poor | >25% | Significant forecasting methodology gaps |
+
+**Input Schema:**
+
+```json
+{
+  "forecast_periods": [
+    {"period": "2025-Q1", "forecast": 480000, "actual": 520000},
+    {"period": "2025-Q2", "forecast": 550000, "actual": 510000}
+  ],
+  "category_breakdowns": {
+    "by_rep": [
+      {"category": "Rep A", "forecast": 200000, "actual": 210000},
+      {"category": "Rep B", "forecast": 280000, "actual": 310000}
+    ]
+  }
+}
+```
+
+### 3. GTM Efficiency Calculator
+
+Calculates core SaaS GTM efficiency metrics with industry benchmarking, ratings, and improvement recommendations.
+
+**Input:** JSON file with revenue, cost, and customer metrics
+**Output:** Magic Number, LTV:CAC, CAC Payback, Burn Multiple, Rule of 40, NDR with ratings
+
+**Usage:**
+
+```bash
+python scripts/gtm_efficiency_calculator.py gtm_data.json --format text
+```
+
+**Key Metrics Calculated:**
+
+| Metric | Formula | Target |
+|--------|---------|--------|
+| Magic Number | Net New ARR / Prior Period S&M Spend | >0.75 |
+| LTV:CAC | (ARPA x Gross Margin / Churn Rate) / CAC | >3:1 |
+| CAC Payback | CAC / (ARPA x Gross Margin) months | <18 months |
+| Burn Multiple | Net Burn / Net New ARR | <2x |
+| Rule of 40 | Revenue Growth % + FCF Margin % | >40% |
+| Net Dollar Retention | (Begin ARR + Expansion - Contraction - Churn) / Begin ARR | >110% |
+
+**Input Schema:**
+
+```json
+{
+  "revenue": {
+    "current_arr": 5000000,
+    "prior_arr": 3800000,
+    "net_new_arr": 1200000,
+    "arpa_monthly": 2500,
+    "revenue_growth_pct": 31.6
+  },
+  "costs": {
+    "sales_marketing_spend": 1800000,
+    "cac": 18000,
+    "gross_margin_pct": 78,
+    "total_operating_expense": 6500000,
+    "net_burn": 1500000,
+    "fcf_margin_pct": 8.4
+  },
+  "customers": {
+    "beginning_arr": 3800000,
+    "expansion_arr": 600000,
+    "contraction_arr": 100000,
+    "churned_arr": 300000,
+    "annual_churn_rate_pct": 8
+  }
+}
+```
+
+---
+
+## Revenue Operations Workflows
+
+### Weekly Pipeline Review
+
+Use this workflow for your weekly pipeline inspection cadence.
+
+1. **Verify input data:** Confirm pipeline export is current and all required fields (stage, value, close_date, owner) are populated before proceeding.
+
+2. **Generate pipeline report:**
+   ```bash
+   python scripts/pipeline_analyzer.py --input current_pipeline.json --format text
+   ```
+
+3. **Cross-check output totals** against your CRM source system to confirm data integrity.
+
+4. **Review key indicators:**
+   - Pipeline coverage ratio (is it above 3x quota?)
+   - Deals aging beyond threshold (which deals need intervention?)
+   - Concentration risk (are we over-reliant on a few large deals?)
+   - Stage distribution (is there a healthy funnel shape?)
+
+5. **Document using template:** Use `assets/pipeline_review_template.md`
+
+6. **Action items:** Address aging deals, redistribute pipeline concentration, fill coverage gaps
+
+### Forecast Accuracy Review
+
+Use monthly or quarterly to evaluate and improve forecasting discipline.
+
+1. **Verify input data:** Confirm all forecast periods have corresponding actuals and no periods are missing before running.
+
+2. **Generate accuracy report:**
+   ```bash
+   python scripts/forecast_accuracy_tracker.py forecast_history.json --format text
+   ```
+
+3. **Cross-check actuals** against closed-won records in your CRM before drawing conclusions.
+
+4. **Analyze patterns:**
+   - Is MAPE trending down (improving)?
+   - Which reps or segments have the highest error rates?
+   - Is there systematic over- or under-forecasting?
+
+5. **Document using template:** Use `assets/forecast_report_template.md`
+
+6. **Improvement actions:** Coach high-bias reps, adjust methodology, improve data hygiene
+
+### GTM Efficiency Audit
+
+Use quarterly or during board prep to evaluate go-to-market efficiency.
+
+1. **Verify input data:** Confirm revenue, cost, and customer figures reconcile with finance records before running.
+
+2. **Calculate efficiency metrics:**
+   ```bash
+   python scripts/gtm_efficiency_calculator.py quarterly_data.json --format text
+   ```
+
+3. **Cross-check computed ARR and spend totals** against your finance system before sharing results.
+
+4. **Benchmark against targets:**
+   - Magic Number (>0.75)
+   - LTV:CAC (>3:1)
+   - CAC Payback (<18 months)
+   - Rule of 40 (>40%)
+
+5. **Document using template:** Use `assets/gtm_dashboard_template.md`
+
+6. **Strategic decisions:** Adjust spend allocation, optimize channels, improve retention
+
+### Quarterly Business Review
+
+Combine all three tools for a comprehensive QBR analysis.
+
+1. Run pipeline analyzer for forward-looking coverage
+2. Run forecast tracker for backward-looking accuracy
+3. Run GTM calculator for efficiency benchmarks
+4. Cross-reference pipeline health with forecast accuracy
+5. Align GTM efficiency metrics with growth targets
+
+---
+
+## Reference Documentation
+
+| Reference | Description |
+|-----------|-------------|
+| [RevOps Metrics Guide](references/revops-metrics-guide.md) | Complete metrics hierarchy, definitions, formulas, and interpretation |
+| [Pipeline Management Framework](references/pipeline-management-framework.md) | Pipeline best practices, stage definitions, conversion benchmarks |
+| [GTM Efficiency Benchmarks](references/gtm-efficiency-benchmarks.md) | SaaS benchmarks by stage, industry standards, improvement strategies |
+
+---
+
+## Templates
+
+| Template | Use Case |
+|----------|----------|
+| [Pipeline Review Template](assets/pipeline_review_template.md) | Weekly/monthly pipeline inspection documentation |
+| [Forecast Report Template](assets/forecast_report_template.md) | Forecast accuracy reporting and trend analysis |
+| [GTM Dashboard Template](assets/gtm_dashboard_template.md) | GTM efficiency dashboard for leadership review |
+| [Sample Pipeline Data](assets/sample_pipeline_data.json) | Example input for pipeline_analyzer.py |
+| [Expected Output](assets/expected_output.json) | Reference output from pipeline_analyzer.py |

package/business/sales-engineer/SKILL.md

@@ -0,0 +1,225 @@
+---
+name: "sales-engineer"
+description: Analyzes RFP/RFI responses for coverage gaps, builds competitive feature comparison matrices, and plans proof-of-concept (POC) engagements for pre-sales engineering. Use when responding to RFPs, bids, or proposal requests; comparing product features against competitors; planning or scoring a customer POC or sales demo; preparing a technical proposal; or performing win/loss competitor analysis. Handles tasks described as 'RFP response', 'bid response', 'proposal response', 'competitor comparison', 'feature matrix', 'POC planning', 'sales demo prep', or 'pre-sales engineering'.
+---
+
+# Sales Engineer Skill
+
+## 5-Phase Workflow
+
+### Phase 1: Discovery & Research
+
+**Objective:** Understand customer requirements, technical environment, and business drivers.
+
+**Checklist:**
+- [ ] Conduct technical discovery calls with stakeholders
+- [ ] Map customer's current architecture and pain points
+- [ ] Identify integration requirements and constraints
+- [ ] Document security and compliance requirements
+- [ ] Assess competitive landscape for this opportunity
+
+**Tools:** Run `rfp_response_analyzer.py` to score initial requirement alignment.
+
+```bash
+python scripts/rfp_response_analyzer.py assets/sample_rfp_data.json --format json > phase1_rfp_results.json
+```
+
+**Output:** Technical discovery document, requirement map, initial coverage assessment.
+
+**Validation checkpoint:** Coverage score must be >50% and must-have gaps ≤3 before proceeding to Phase 2. Check with:
+```bash
+python scripts/rfp_response_analyzer.py assets/sample_rfp_data.json --format json | python -c "import sys,json; r=json.load(sys.stdin); print('PROCEED' if r['coverage_score']>50 and r['must_have_gaps']<=3 else 'REVIEW')"
+```
+
+---
+
+### Phase 2: Solution Design
+
+**Objective:** Design a solution architecture that addresses customer requirements.
+
+**Checklist:**
+- [ ] Map product capabilities to customer requirements
+- [ ] Design integration architecture
+- [ ] Identify customization needs and development effort
+- [ ] Build competitive differentiation strategy
+- [ ] Create solution architecture diagrams
+
+**Tools:** Run `competitive_matrix_builder.py` using Phase 1 data to identify differentiators and vulnerabilities.
+
+```bash
+python scripts/competitive_matrix_builder.py competitive_data.json --format json > phase2_competitive.json
+
+python -c "import json; d=json.load(open('phase2_competitive.json')); print('Differentiators:', d['differentiators']); print('Vulnerabilities:', d['vulnerabilities'])"
+```
+
+**Output:** Solution architecture, competitive positioning, technical differentiation strategy.
+
+**Validation checkpoint:** Confirm at least one strong differentiator exists per customer priority before proceeding to Phase 3. If no differentiators found, escalate to Product Team (see Integration Points).
+
+---
+
+### Phase 3: Demo Preparation & Delivery
+
+**Objective:** Deliver compelling technical demonstrations tailored to stakeholder priorities.
+
+**Checklist:**
+- [ ] Build demo environment matching customer's use case
+- [ ] Create demo script with talking points per stakeholder role
+- [ ] Prepare objection handling responses
+- [ ] Rehearse failure scenarios and recovery paths
+- [ ] Collect feedback and adjust approach
+
+**Templates:** Use `assets/demo_script_template.md` for structured demo preparation.
+
+**Output:** Customized demo, stakeholder-specific talking points, feedback capture.
+
+**Validation checkpoint:** Demo script must cover every must-have requirement flagged in `phase1_rfp_results.json` before delivery. Cross-reference with:
+```bash
+python -c "import json; rfp=json.load(open('phase1_rfp_results.json')); [print('UNCOVERED:', r) for r in rfp['must_have_requirements'] if r['coverage']=='Gap']"
+```
+
+---
+
+### Phase 4: POC & Evaluation
+
+**Objective:** Execute a structured proof-of-concept that validates the solution.
+
+**Checklist:**
+- [ ] Define POC scope, success criteria, and timeline
+- [ ] Allocate resources and set up environment
+- [ ] Execute phased testing (core, advanced, edge cases)
+- [ ] Track progress against success criteria
+- [ ] Generate evaluation scorecard
+
+**Tools:** Run `poc_planner.py` to generate the complete POC plan.
+
+```bash
+python scripts/poc_planner.py poc_data.json --format json > phase4_poc_plan.json
+
+python -c "import json; p=json.load(open('phase4_poc_plan.json')); print('Go/No-Go:', p['recommendation'])"
+```
+
+**Templates:** Use `assets/poc_scorecard_template.md` for evaluation tracking.
+
+**Output:** POC plan, evaluation scorecard, go/no-go recommendation.
+
+**Validation checkpoint:** POC conversion requires scorecard score >60% across all evaluation dimensions (functionality, performance, integration, usability, support). If score <60%, document gaps and loop back to Phase 2 for solution redesign.
+
+---
+
+### Phase 5: Proposal & Closing
+
+**Objective:** Deliver a technical proposal that supports the commercial close.
+
+**Checklist:**
+- [ ] Compile POC results and success metrics
+- [ ] Create technical proposal with implementation plan
+- [ ] Address outstanding objections with evidence
+- [ ] Support pricing and packaging discussions
+- [ ] Conduct win/loss analysis post-decision
+
+**Templates:** Use `assets/technical_proposal_template.md` for the proposal document.
+
+**Output:** Technical proposal, implementation timeline, risk mitigation plan.
+
+---
+
+## Python Automation Tools
+
+### 1. RFP Response Analyzer
+
+**Script:** `scripts/rfp_response_analyzer.py`
+
+**Purpose:** Parse RFP/RFI requirements, score coverage, identify gaps, and generate bid/no-bid recommendations.
+
+**Coverage Categories:** Full (100%), Partial (50%), Planned (25%), Gap (0%).  
+**Priority Weighting:** Must-Have 3×, Should-Have 2×, Nice-to-Have 1×.
+
+**Bid/No-Bid Logic:**
+- **Bid:** Coverage >70% AND must-have gaps ≤3
+- **Conditional Bid:** Coverage 50–70% OR must-have gaps 2–3
+- **No-Bid:** Coverage <50% OR must-have gaps >3
+
+**Usage:**
+```bash
+python scripts/rfp_response_analyzer.py assets/sample_rfp_data.json            # human-readable
+python scripts/rfp_response_analyzer.py assets/sample_rfp_data.json --format json  # JSON output
+python scripts/rfp_response_analyzer.py --help
+```
+
+**Input Format:** See `assets/sample_rfp_data.json` for the complete schema.
+
+---
+
+### 2. Competitive Matrix Builder
+
+**Script:** `scripts/competitive_matrix_builder.py`
+
+**Purpose:** Generate feature comparison matrices, calculate competitive scores, identify differentiators and vulnerabilities.
+
+**Feature Scoring:** Full (3), Partial (2), Limited (1), None (0).
+
+**Usage:**
+```bash
+python scripts/competitive_matrix_builder.py competitive_data.json              # human-readable
+python scripts/competitive_matrix_builder.py competitive_data.json --format json  # JSON output
+```
+
+**Output Includes:** Feature comparison matrix, weighted competitive scores, differentiators, vulnerabilities, and win themes.
+
+---
+
+### 3. POC Planner
+
+**Script:** `scripts/poc_planner.py`
+
+**Purpose:** Generate structured POC plans with timeline, resource allocation, success criteria, and evaluation scorecards.
+
+**Default Phase Breakdown:**
+- **Week 1:** Setup — environment provisioning, data migration, configuration
+- **Weeks 2–3:** Core Testing — primary use cases, integration testing
+- **Week 4:** Advanced Testing — edge cases, performance, security
+- **Week 5:** Evaluation — scorecard completion, stakeholder review, go/no-go
+
+**Usage:**
+```bash
+python scripts/poc_planner.py poc_data.json              # human-readable
+python scripts/poc_planner.py poc_data.json --format json  # JSON output
+```
+
+**Output Includes:** Phased POC plan, resource allocation, success criteria, evaluation scorecard, risk register, and go/no-go recommendation framework.
+
+---
+
+## Reference Knowledge Bases
+
+| Reference | Description |
+|-----------|-------------|
+| `references/rfp-response-guide.md` | RFP/RFI response best practices, compliance matrix, bid/no-bid framework |
+| `references/competitive-positioning-framework.md` | Competitive analysis methodology, battlecard creation, objection handling |
+| `references/poc-best-practices.md` | POC planning methodology, success criteria, evaluation frameworks |
+
+## Asset Templates
+
+| Template | Purpose |
+|----------|---------|
+| `assets/technical_proposal_template.md` | Technical proposal with executive summary, solution architecture, implementation plan |
+| `assets/demo_script_template.md` | Demo script with agenda, talking points, objection handling |
+| `assets/poc_scorecard_template.md` | POC evaluation scorecard with weighted scoring |
+| `assets/sample_rfp_data.json` | Sample RFP data for testing the analyzer |
+| `assets/expected_output.json` | Expected output from rfp_response_analyzer.py |
+
+## Integration Points
+
+- **Marketing Skills** - Leverage competitive intelligence and messaging frameworks from `../../marketing-skill/`
+- **Product Team** - Coordinate on roadmap items flagged as "Planned" in RFP analysis from `../../product-team/`
+- **C-Level Advisory** - Escalate strategic deals requiring executive engagement from `../../c-level-advisor/`
+- **Customer Success** - Hand off POC results and success criteria to CSM from `../customer-success-manager/`
+
+---
+
+**Last Updated:** February 2026
+**Status:** Production-ready
+**Tools:** 3 Python automation scripts
+**References:** 3 knowledge base documents
+**Templates:** 5 asset files

package/business/vendor-management/SKILL.md

@@ -0,0 +1,170 @@
+---
+name: vendor-management
+description: Use when reviewing, scoring, or auditing third-party SaaS / vendor relationships — running a vendor scorecard, tracking SLA compliance, classifying third-party risk, preparing a tier-1 vendor review, or auditing the SaaS portfolio. Triggers on "vendor SLA", "vendor scorecard", "third-party risk", "TPRM", "vendor review", "SaaS audit", "supplier performance", "vendor health check", "renewal review". Forks context so large vendor catalogs (50-500 line items) and SLA logs don't pollute the parent thread. Ships 3 stdlib-only Python tools (vendor scorer with industry tuning, SLA compliance tracker with credit-claim flags, vendor risk classifier across 4 risk vectors), 3 reference docs each citing 7+ authoritative sources (Gartner / Shared Assessments / NIST / ISO 27036 / breach post-mortems), and a 5-vendor catalog template. Distinct from c-level-advisor/general-counsel-advisor (contract law, not operational management), business-growth/contract-and-proposal-writer (outbound proposals, not inbound vendor scoring), and sibling procurement-optimizer (spend categorization, not vendor performance).
+context: fork
+version: 2.8.0
+author: claude-code-skills
+license: MIT
+tags: [bizops, vendor, sla, third-party-risk, vendor-management, saas-management, tprm]
+compatible_tools: [claude-code, codex-cli, cursor, antigravity, opencode, gemini-cli]
+---
+
+# Vendor Management — Operational Third-Party Performance
+
+You are a BizOps / IT / Vendor Management Office (VMO) operator. Your job is **ongoing vendor performance review**, not initial selection or contract drafting. You score vendors on multi-dimensional criteria, track SLA compliance against contractual targets, classify third-party risk, and recommend KEEP / REVIEW / REPLACE actions.
+
+## Purpose
+
+A typical mid-stage company carries 80-200 SaaS subscriptions and dozens of operational vendors. Most of them are reviewed only at renewal — which is too late. This skill enables **quarterly or rolling vendor performance reviews** with deterministic scoring (not LLM-flavored opinions) so the renewal decision is already half-made before the contract comes due.
+
+## When to use
+
+- The VMO or IT director needs to prepare a quarterly vendor scorecard for the leadership team
+- A tier-1 vendor (e.g., your identity provider, your data warehouse) has had recurring incidents and you need to quantify the SLA gap
+- The CISO needs a third-party risk classification of the SaaS portfolio for the next audit
+- A renewal is 60-90 days out and you need a defensible KEEP / REVIEW / REPLACE recommendation
+- Post-acquisition, you need to deduplicate vendor coverage across two organizations
+
+## When NOT to use
+
+- Negotiating new contract terms → `c-level-advisor/general-counsel-advisor`
+- Writing an outbound proposal or RFP response → `business-growth/contract-and-proposal-writer`
+- Categorizing software spend or finding duplicate SaaS → sibling `procurement-optimizer`
+- Designing internal system SLOs/error budgets → `engineering/slo-architect`
+
+## Workflow
+
+### Step 1 — Intake the vendor catalog
+
+The user provides a JSON catalog (see `assets/vendor_catalog_template.md` for the schema and a 5-vendor sample). Required fields per vendor:
+
+- `name`, `category`, `annual_spend` (USD)
+- `contract_end_date` (ISO 8601)
+- `criticality`: one of `tier-1` (business-stops-if-down), `tier-2` (important-but-workaround-exists), `tier-3` (nice-to-have)
+- `uptime_pct` (last 12 months, e.g., 99.92)
+- `support_response_hours_p90` (P90 ticket response time in hours)
+- `incident_count_last_12m`
+- `security_certs`: list of strings from {SOC2, SOC2-Type-II, ISO27001, HIPAA, PCI-DSS, FedRAMP, GDPR-DPA, CCPA}
+- `renewal_terms`: one of `auto-renew`, `manual-renew`, `evergreen`, `fixed-term`
+
+### Step 2 — Score each vendor 0-100
+
+Run `scripts/vendor_scorer.py --input catalog.json --profile <industry> --output scorecard.md`.
+
+The scorer weights 5 dimensions per industry profile:
+
+| Dimension | SaaS | Fintech | Healthcare | Enterprise |
+|---|---|---|---|---|
+| Reliability (uptime + incidents) | 30% | 25% | 25% | 25% |
+| Support (response P90) | 15% | 15% | 15% | 20% |
+| Security (certs) | 25% | 30% | 35% | 25% |
+| Commercial (renewal flexibility) | 15% | 15% | 10% | 15% |
+| Strategic fit (criticality vs spend) | 15% | 15% | 15% | 15% |
+
+Output: ranked markdown scorecard with per-dimension breakdown and a verdict per vendor:
+
+- **KEEP** (≥ 75) — vendor is performing; routine renewal
+- **REVIEW** (50-74) — schedule a quarterly business review with the vendor before renewing
+- **REPLACE** (< 50) — start an alternatives search now; do not auto-renew
+
+### Step 3 — Measure SLA compliance
+
+Run `scripts/sla_compliance_tracker.py --input sla_records.json --output sla_report.md`.
+
+For each SLA record `{vendor, sla_metric, target, actual_last_month, actual_last_quarter, breach_count_12m}`, the tracker computes:
+
+- Compliance % vs target (last month, last quarter)
+- Trend classification (improving / stable / degrading) based on month-vs-quarter delta
+- **Credit-claim eligibility flag** — if breach_count_12m ≥ 2 OR actual_last_quarter < target by > 0.5pp, flag the SLA credit as claimable
+
+### Step 4 — Classify third-party risk
+
+Run `scripts/vendor_risk_classifier.py --input catalog.json --profile <industry> --output risk_matrix.md`.
+
+Classifies each vendor as **Critical / High / Medium / Low** across 4 risk vectors (Shared Assessments SIG-Lite-ish):
+
+1. **Data sensitivity** — PII / PHI / cardholder / source code access
+2. **Financial exposure** — annual spend × tier multiplier
+3. **Operational dependency** — tier-1 + no break-glass = Critical
+4. **Regulatory exposure** — industry profile drives weighting (e.g., healthcare: HIPAA-without-BAA = Critical)
+
+Output: risk matrix markdown + per-vendor mitigation recommendations (e.g., "Tier-1 with no SOC2 → require SOC2 attestation before next renewal").
+
+### Step 5 — Synthesize recommendations
+
+Combine the 3 artifacts into a final BizOps / VMO digest:
+
+- Top 3 KEEP wins (vendors over-performing — consider deepening)
+- Top 3 REVIEW conversations (schedule QBR with vendor)
+- Top 3 REPLACE candidates (start alternatives search now)
+- All SLA credits eligible to claim (with dollar estimate where possible)
+- All Critical-risk vendors with no current mitigation
+
+## Scripts
+
+| Script | Purpose |
+|---|---|
+| `scripts/vendor_scorer.py` | Multi-dimensional 0-100 scoring with industry profile tuning |
+| `scripts/sla_compliance_tracker.py` | SLA compliance %, trend, credit-claim eligibility |
+| `scripts/vendor_risk_classifier.py` | 4-vector risk classification with mitigation recommendations |
+
+All three accept `--input` (JSON), `--output` (markdown path), `--sample` (run with built-in sample data), and `--help`. The two with industry-specific weighting accept `--profile {saas,fintech,healthcare,enterprise}`.
+
+## References
+
+- `references/vendor_management_canon.md` — Gartner / Shared Assessments / ISO 27036 / NIST 800-161 / Forrester / ISACA / Vendr industry reports
+- `references/sla_design_patterns.md` — Google SRE Workbook (SLI/SLO/SLA distinction), Atlassian, ITIL v4, Gartner SLA research, hyperscaler SLA documentation patterns
+- `references/vendor_risk_anti_patterns.md` — Real breach post-mortems: SolarWinds, Target/HVAC, NotPetya/M.E.Doc, Capital One, Verkada, Okta 2022, log4j
+
+## Assumptions
+
+1. The user has a vendor catalog or can construct one from procurement records, the SaaS management tool (Vendr / Tropic / Zylo), or a spend export.
+2. SLA records come from the vendor's own status page, the support ticketing system, or an internal monitoring tool — not invented.
+3. The user is operating on behalf of an organization with regulated data (most are) but the **profile flag** lets them dial security weighting up for healthcare/fintech or down for non-regulated B2B SaaS.
+4. The output artifacts (markdown scorecard, SLA report, risk matrix) are **inputs to a human decision**, not the decision itself.
+
+## Anti-patterns
+
+- **Treat all vendors at the same tier.** A logo monitoring tool and your identity provider do not deserve the same scrutiny. Use the tier field.
+- **Annual review is enough.** Tier-1 vendors should be reviewed quarterly. Tier-2 semi-annually. Tier-3 at renewal.
+- **Trust the security questionnaire without verification.** Ask for the SOC2 report, not a SIG checkbox. See `references/vendor_risk_anti_patterns.md`.
+- **No break-glass plan for a tier-1 vendor.** If the vendor disappears tomorrow, what is the 72-hour plan?
+- **Forget offboarding.** When a vendor is replaced or acquired, run the data-deletion and access-revocation checklist. SolarWinds and Okta both demonstrate why.
+- **Score by gut feel.** Use the deterministic tools. The point of this skill is that two operators score the same catalog the same way.
+
+## Distinct from
+
+- **`business-growth/contract-and-proposal-writer`** — that's writing outbound proposals to win customers. This is scoring inbound vendors you already pay.
+- **`c-level-advisor/general-counsel-advisor`** — that's contract law (indemnity, liquidated damages, IP). This is operational performance against an existing contract.
+- **Sibling `procurement-optimizer`** — that's spend categorization, supplier rationalization, finding duplicate SaaS. This is performance scoring of the vendors you've already decided to keep paying.
+- **`engineering/slo-architect`** — that's internal SLO/error-budget discipline for systems you operate. This is contractual SLA tracking for systems someone else operates on your behalf.
+
+## Forcing-question library (Matt Pocock grill discipline)
+
+Walked one at a time by `/cs:grill-bizops` or the BizOps orchestrator. Recommended answer + canon citation per question. Never bundled.
+
+1. **"What's your tier-1 criticality threshold — by spend ($X/year) or by operational dependency (revenue-blocking if vendor fails)?"**
+   Recommended: operational dependency.
+   Canon: Gartner TPRM research, Target/HVAC breach lesson — spend-only tiering misses critical low-spend vendors like the HVAC vendor that became the Target attack vector.
+
+2. **"For tier-1 vendors, do you have an in-hand SOC 2 Type II report (issued within the last 12 months), or just the questionnaire?"**
+   Recommended: insist on the report; the questionnaire is unverified self-attestation.
+   Canon: NIST SP 800-161 (Supply Chain Risk Management), Shared Assessments SIG framework.
+
+3. **"What's the 72-hour break-glass plan if a tier-1 vendor disappears tomorrow?"**
+   Recommended: documented contingency per vendor, tested annually.
+   Canon: NotPetya / M.E.Doc supply chain attack, log4j response patterns.
+
+4. **"When was the last time the SLA was actually invoked (credit claim filed)?"**
+   Recommended: if never, audit whether SLA terms are weak or breaches are unreported.
+   Canon: Atlassian SLA best practices, ITIL v4 service level management.
+
+5. **"Is your offboarding checklist current — data deletion, access revocation, key rotation?"**
+   Recommended: rehearse it on one vendor per quarter.
+   Canon: SolarWinds + Okta 2022 breach lessons.
+
+6. **"What's the regulatory blast-radius — HIPAA / GDPR / SOX / PCI?"**
+   Recommended: surface explicitly; weights security scoring up via `--profile`.
+   Canon: ISO/IEC 27036 (supplier relationships security).
+
+Walk depth-first. Lock 1-3 before opening 4-6. After all are answered, invoke `vendor_scorer.py` → `sla_compliance_tracker.py` → `vendor_risk_classifier.py` in sequence.