@kenkaiiii/ggcoder 5.39.3 → 5.40.0

package/assets/skills/compliance-guard/references/eu-uk.md

@@ -0,0 +1,151 @@
+# EU / EEA / UK
+
+Snapshot **11 Aug 2026**. Markers: **[V]** verified against a primary/first-tier source · **[S]** snapshot, re-verify · **[U]** contested or in flux.
+
+**Territorial reality:** GDPR applies to anyone offering goods or services to, or *monitoring the behaviour of*, people in the EU/EEA — regardless of where the developer sits **[V]**. Monitoring includes analytics cookies, session replay, ad pixels, and behavioural profiling. A US solo dev with an open signup form and Google Analytics is in scope. Blocking EU traffic is a legitimate engineering answer and should be offered as an option.
+
+---
+
+## 1. GDPR / UK GDPR
+
+**Lawful basis (Art 6)** — pick one *per purpose*, before shipping, and record it **[V]**. Typical mapping: consent for marketing, non-essential analytics, and optional AI-training use; contract for account creation and core feature delivery; legitimate interests (with a documented assessment) for security, fraud prevention, and basic product telemetry. The UK adds a "recognised legitimate interests" list that removes the balancing test for some purposes **[V]**.
+
+**Consent quality (Art 4(11), 7)** — unbundled, granular per purpose, an affirmative act, as easy to withdraw as to give, and logged with timestamp, version and scope **[V]**. You cannot bundle analytics, advertising and functional purposes into one checkbox.
+
+**Transparency notice (Art 13/14)** must contain: controller identity and contact (plus the Art 27 representative), DPO if any, purposes and lawful basis **per purpose**, the legitimate-interests description, recipients or categories of recipients (name subprocessors), third-country transfers with the mechanism and how to obtain a copy of safeguards, retention periods, the full rights list including withdrawal and the right to complain to a supervisory authority, whether provision is statutory or contractual, and any automated decision-making with meaningful information about the logic **[V]**.
+
+**Rights and deadlines** — one month, extendable by two for complexity, with notification inside the first month **[V]**. The UK now calculates the clock differently under a new Art 12A, allowing a stop-the-clock while you seek identification or clarification **[V]**.
+
+**UK complaints duty** — from 19 June 2026 UK controllers must operate a formal data-protection complaints procedure and acknowledge complaints within 30 days **[V]**. Artifact: a published complaints route and a tracked queue.
+
+**Art 30 records** — the "under 250 employees" exemption is effectively worthless because it falls away for non-occasional processing (any live product), risky processing, or special-category data **[V]**. Assume you need a record of processing activities.
+
+**DPIA (Art 35)** — required when two or more of the WP248 criteria hit: scoring/evaluation, automated decisions with legal or significant effect, systematic monitoring, sensitive data, large scale, matched or combined datasets, vulnerable subjects including children, innovative technology (**LLM features count**), or preventing access to a service **[V]**. Many AI features trip two criteria immediately.
+
+**Art 27 representative** — a non-EU controller targeting EU users must appoint a written-mandated EU representative in a Member State where subjects are located and publish it in the notice; the UK requires a separate one **[V]**. The exemption is narrow (occasional, low-risk, no special-category data), so most US indie SaaS with EU users technically needs both. Cost is a real annual subscription — flag it as a business decision, not a code change.
+
+**DPO** — only for large-scale systematic monitoring, large-scale special-category/criminal data, or public authorities. A typical small SaaS does not need one; name a privacy contact instead **[V]**.
+
+**Art 28 processor contracts** — every vendor processing personal data on your behalf (hosting, database, CDN, error tracking, analytics, email, LLM APIs) needs a DPA with the Art 28(3) clauses, documented subprocessor authorisation, and change notification **[V]**. Most major vendors publish a self-serve DPA; some require acceptance in the dashboard. Note that some vendors act as independent controllers for parts of their service — check rather than assume.
+
+**International transfers** — the EU–US Data Privacy Framework remains valid: the General Court dismissed the Latombe challenge in September 2025 and the appeal was pending with no hearing date as of mid-2026 **[V]**. Design for reversibility: execute SCCs alongside DPF reliance and know which vendors are US-only **[V]**.
+
+**Breach notification** — 72 hours to the lead supervisory authority from *awareness*, not from confirmation, unless a risk is unlikely; without undue delay to individuals where the risk is high; and an internal register of **all** breaches regardless of reportability **[V]**.
+
+**Children (Art 8)** — the digital age of consent varies by Member State between 13 and 16 **[V]**. If you cannot gate per country, set 16, or design so that no consent-based processing applies to minors.
+
+---
+
+## 2. ePrivacy — cookies and device storage
+
+Consent is required **before** any non-essential storage or access on the user's device, under the ePrivacy Directive as transposed by each Member State — 27 variants, and harmonisation is not coming **[V]**. Scope is technology-neutral and expressly reaches pixels, local storage, and similar techniques **[V]**. This applies **whether or not** the data is personal, which is why "we only use anonymous analytics" is not an answer.
+
+**Banner technical spec** (this is the implementable contract):
+- No third-party script, pixel, or network request before an affirmative choice.
+- No pre-ticked boxes.
+- Reject at the same layer and with the same visual weight as accept.
+- Granular per-purpose toggles.
+- A persistent re-open control for withdrawal.
+- Store the choice with a bounded expiry and re-ask; log timestamp, version and scope.
+
+**Enforcement reality:** very large fines have gone to large platforms, and regulators have run complaint-driven sweeps and warning campaigns against ordinary websites, including fines for pre-ticked boxes **[V]**. Small sites are targeted by complaints, not by proactive audits.
+
+**Consent-or-pay:** permitted only under conditions, with the guidance scoped to large platforms; a hard cookie wall with no free path is high risk for a small app **[V]**. A third "free without personalised tracking" option is the defensible design. Later broadening of this guidance is reported but unconfirmed **[U]**.
+
+**Google Analytics** is not illegal in Europe in 2026 — the transfer defect behind the 2022 decisions has an answer in the DPF — but the consent-before-tracking requirement still applies **[V]**.
+
+**UK divergence (important):** from 5 February 2026 certain first-party analytics and functionality cookies are exempt from the PECR consent requirement where you give clear information and a simple, free way to object **[V]**. This does **not** extend to third-party advertising cookies, and it does not change EU rules — a single banner serving both markets should keep the stricter behaviour unless you geo-branch.
+
+**PECR penalties** rose to £17.5m or 4% of global turnover **[V]**.
+
+---
+
+## 3. EU AI Act — verified timeline
+
+The Digital Omnibus on AI (Reg (EU) 2026/1744) was published on 24 July 2026 and entered into force on 27 July 2026 **[V]**. **Any guidance dated before mid-2026 saying high-risk obligations apply from 2 August 2026 is now wrong.**
+
+| Date | Status |
+|---|---|
+| 2 Feb 2025 | Prohibited practices and AI literacy — **in force** |
+| 2 Aug 2025 | GPAI models, governance, penalties — **in force** |
+| **2 Aug 2026** | **Article 50 transparency obligations — in force now** (Art 50(2) not applying to systems already on the market at that date) |
+| 2 Dec 2026 | Art 50(2) marking for legacy systems; new prohibited practices added (AI-generated NCII and CSAM) |
+| 2 Feb 2027 | Watermark-detection interoperability deadline for providers |
+| **2 Dec 2027** | High-risk obligations for standalone Annex III systems — **deferred** |
+| 2 Aug 2028 | High-risk obligations for embedded Annex I systems |
+
+**Provider vs deployer is the consequential classification.** Providers develop an AI system, or have it developed, and place it on the market or into service **under their own name or trademark**, regardless of establishment **[V]**. Wrapping a foundation model in your own product and shipping it under your brand generally makes you a provider of that AI system — not merely a deployer.
+
+**What applies right now:**
+- **Art 4 AI literacy** — provider *or* deployer, no size exemption, in force since Feb 2025. Realistic artifact for a small team: a one-page internal AI-use policy plus a dated reading/training record **[V]**.
+### Art 5 prohibited practices — check these FIRST
+
+These are **bans**, in force since 2 Feb 2025, carrying the top penalty tier of €35M or 7% of global turnover **[V]**. They map to the **ILLEGAL** severity label: the answer is "delete the feature", never "add a disclosure". Check this list before Art 50, because Art 50 tells you how to *label* a system you are allowed to ship, and it will quietly mislead you into labelling one you are not.
+
+Eight categories are prohibited **[V]**. The ones a small developer realistically builds by accident:
+
+- **Art 5(1)(f) — inferring emotions in the workplace or education**, except for medical or safety reasons **[V]**. The Commission reads "workplace" broadly and it **expressly covers recruitment and hiring** **[V]**. Any system scoring an interview candidate's confidence, enthusiasm, engagement, or sincerity from face, voice, or physiology is caught, and commentary concludes there is no realistic exemption for interview assessment **[V]**. Same for exam proctoring and student-attention scoring in education **[V]**. A narrow carve-out exists for personal training use where results are not shared with HR and cannot affect assessment or promotion **[S]** — do not rely on it without advice.
+- **Art 5(1)(g) — biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation** from biometric data **[V]**. Any "guess ethnicity/gender/orientation from a photo" feature is prohibited, including as an internal analytics field.
+- **Art 5(1)(e) — untargeted scraping of facial images** from the internet or CCTV to build or expand facial-recognition databases **[V]**. This bans the face-search-engine pattern outright.
+- **Art 5(1)(c) — social scoring** leading to detrimental or disproportionate treatment in unrelated contexts — including by private actors **[V]**. A general-purpose "trust score" or "reputation score" applied across unrelated domains is the risky shape.
+- **Art 5(1)(b) — exploiting vulnerabilities** of age, disability, or socio-economic situation to materially distort behaviour **[V]**; **Art 5(1)(a) — subliminal or manipulative techniques** causing significant harm **[V]**. Aggressive engagement mechanics aimed at children or people in financial distress live here.
+- **Art 5(1)(d)** — predicting criminal offending from profiling or personality traits; **Art 5(1)(h)** — real-time remote biometric identification in public spaces for law enforcement **[V]**. Rare for small devs, but absolute.
+
+**Territorial reach:** the ban applies to use affecting people in the EU regardless of where the company is established **[V]**. A US or UK company running emotion analysis on EU candidates is in scope.
+
+**Stacking:** emotion recognition and biometric categorisation almost always process biometric data, which is Art 9 special-category data, so a prohibited-practice finding normally carries a parallel GDPR violation **[V]**. Report both.
+
+### Art 50 transparency — for systems you are allowed to ship
+
+- **Art 50(1) chatbot disclosure** — disclose that the user is interacting with an AI at first interaction, in the UI. The "obvious to a reasonable person" carve-out exists but is a bad bet; label it **[V]**.
+- **Art 50(2) synthetic-output marking** — providers of generative systems must embed machine-readable provenance in generated audio, image, video and text: C2PA/Content Credentials manifests, watermarking where feasible **[V]**. New systems now; pre-2 Aug 2026 systems from 2 Dec 2026 — **record your placing-on-the-market date**.
+- **Art 50(4) deepfake and public-interest text labelling** — deployers must apply a user-visible label at first exposure; guidance takes a broad territorial view for globally accessible content **[V]**.
+- **Art 50(3)** — emotion recognition or biometric categorisation requires informing exposed persons, and is special-category processing under GDPR **[V]**.
+- **Code of Practice safe harbour** — adherence to the transparency Code of Practice is the cheapest defensible posture for a small provider, though not conclusive evidence of compliance **[V]**.
+
+**High-risk (Annex III)** is unlikely unless the feature does CV screening or hiring, credit scoring, education assessment, biometric identification, essential-service eligibility, or law-enforcement/migration work **[V]**. If it does, treat it as a major project and route to counsel.
+
+**Minimum for a small dev shipping an LLM feature — do all five:** visible AI label; provenance marking on generated media; user-facing label on deepfakes and AI-published text on matters of public interest; an `ai-literacy.md` plus AI-use policy; and a one-page system description recording model provider, purpose, limitations, human-oversight path, and your provider/deployer determination.
+
+Penalties for Art 50 breaches reach €15M or 3% of global turnover; prohibited practices reach €35M or 7% **[S]** on the exact tier post-Omnibus.
+
+---
+
+## 4. Other EU acts
+
+- **Digital Services Act** — triggered by *hosting information provided by a recipient*: user uploads, comments, profiles, public pastes, shared docs. Single-tenant B2B SaaS with no third-party-visible content is generally out **[V]**. All hosting providers regardless of size owe a point of contact for authorities and users, a notice-and-action mechanism, statements of reasons for removals, and terms describing moderation. Micro and small enterprises are exempt from several heavier duties but **not** from the basics.
+- **European Accessibility Act** — applies to **service categories**, not all software: e-commerce (any consumer-facing online sale), consumer banking, e-books, electronic communications, transport ticketing, and access to audiovisual media **[V]**. In force since 28 June 2025 for new products and services. A B2B-only SaaS is out of scope; a B2C app with a checkout is in. Technical standard is EN 301 549 (WCAG 2.1 AA today; a WCAG 2.2-aligned version is expected **[U]** — build to 2.2 AA now, it is backwards-compatible). Microenterprise exemptions apply to services but the detail varies by transposition **[U]**.
+- **Cyber Resilience Act** — applies to *manufacturers* of products with digital elements placed on the EU market: downloadable or installable software, desktop and mobile apps, browser extensions, firmware, monetised libraries **[V]**. Main obligations from 11 December 2027, but **reporting obligations from 11 September 2026** — actively exploited vulnerabilities and severe incidents must be reported on a short clock. Pure SaaS is generally outside, but the SaaS boundary is exactly where small products get caught unexpectedly; re-read the Commission's practical guidance **[U]**.
+- **NIS2** — sector plus size; cloud, data-centre, managed-service and managed-security providers are in scope, but the size cap generally means ≥50 staff or >€10M turnover **[S]**. A small SaaS is normally out unless designated.
+- **Data Act** — applies to providers of data processing services (expressly including SaaS, PaaS, IaaS) with EU customers, with no carve-out for small providers **[V]**. Practical duties: contractual switching and egress terms, no unreasonable exit barriers, and data-porting support.
+- **DORA** — only if you are a financial entity or a contracted ICT provider to one; for a small dev it arrives as customer contract terms **[S]**.
+- **PSD2 SCA** — use a PSP with 3-D Secure rather than building card flows; exemptions belong to the PSP **[S]**.
+- **MiCA** — issuing a token or providing crypto-asset services to EU users requires authorisation; merely accepting crypto payment through a licensed processor generally does not **[S]**.
+- **GPSR** — whether standalone software is a "product" is genuinely unresolved: the Commission's FAQ says software is included, while a recital excludes services **[U]**. Flag as uncertain rather than asserting either way.
+- **Platform-to-Business Regulation** — if you let business users offer goods or services to consumers (a marketplace, a booking layer): plain-language terms with 15-day change notice, disclosed ranking parameters, stated reasons for suspension, and an internal complaints process **[V]**.
+
+---
+
+## 5. UK specifics
+
+- **Data (Use and Access) Act 2025** — principal data-protection provisions in force from 5 February 2026 **[V]**. Code-relevant changes: the new DSAR clock (Art 12A), recognised legitimate interests, a permission-plus-safeguards model for automated decision-making replacing the old prohibition, and the PECR analytics/functionality cookie exemption.
+- **Online Safety Act** — triggered by **user-to-user** services (anywhere users can encounter content uploaded by others — comments, DMs, forums, shared galleries, multiplayer chat), search services, and pornography publishers, with UK links. **There is no small-service exemption from the core duties**, and the regulator runs a dedicated "small but risky" supervision function **[V]**. Duties include illegal-content and children's-access risk assessments, proportionate safety measures, reporting and complaints mechanisms, and highly effective age assurance where required. Treat any UK-reachable UGC product as in scope and produce the risk assessments — their absence is itself the enforceable failure.
+- **Children's Code** — applies to services *likely to be accessed* by under-18s, a much lower bar than "aimed at children": high-privacy defaults, geolocation off by default, no nudges toward weaker privacy, a DPIA covering children, minimised profiling **[V]**.
+- **Accessibility** — no private-sector EAA equivalent; exposure runs through the Equality Act duty to make reasonable adjustments, with WCAG 2.1 AA as the de facto benchmark **[S]**.
+
+---
+
+## 6. Consumer and tax blindsides
+
+- **VAT on B2C digital sales to EU consumers** — there is **no small-seller threshold for businesses established outside the EU**; VAT is due from the first sale, via OSS registration or a merchant-of-record **[V]**. This is the single most commonly missed obligation for indie SaaS selling to Europe.
+- **Right of withdrawal for digital content** — a 14-day cooling-off period applies by default. You lose it for immediately-supplied digital content **only if** you obtain prior express consent to immediate performance **and** the consumer's acknowledgement that they thereby lose the right, and you confirm it **[V]**. That means a specific checkbox pair at checkout, not a link to terms.
+- **A claim circulating that a mandatory "withdrawal button" applies to all EU online traders from 19 June 2026 is a misreading of a financial-services directive** **[V]**. Do not implement it as a general obligation; do not repeat the claim.
+- **Pre-contract information** — before the order: main characteristics, total price inclusive of taxes and all charges, duration and minimum term, auto-renewal terms, trader identity with geographic address and email, complaint handling, and digital-content functionality and interoperability. The order button must be labelled to make the payment obligation explicit **[V]**.
+- **Pricing and dark patterns** — price-reduction claims must reference the lowest price in the previous 30 days; paid ranking placement must be disclosed; review verification must be described honestly; personalised pricing must be disclosed **[V]**.
+- **Unfair terms** — in B2C, non-negotiated terms creating significant imbalance are void: blanket liability exclusions, unilateral changes without notice and an exit right, forum clauses depriving consumers of their home courts, and mandatory arbitration **[V]**. **Do not copy a US ToS into an EU-facing product** — the arbitration and class-waiver clauses that protect you in the US are unenforceable and can themselves be an unfair-terms violation.
+
+---
+
+## 7. Verify before relying
+
+AI Act fine tiers post-Omnibus · the EAA transitional date for pre-2025 service contracts (sources conflict between 2027 and 2030) · EN 301 549 version status · the GDPR/ePrivacy half of the Digital Omnibus (**still in negotiation — not law**) · consent-or-pay scope broadening · CRA SaaS boundary · NIS2 small-provider designation practice · UK adequacy status.

package/assets/skills/compliance-guard/references/exposure-triage.md

@@ -0,0 +1,161 @@
+# Exposure Triage
+
+Determine what the product actually is before deciding what applies. Everything here is code-observable; do not ask the user what the repo can answer.
+
+## 1. Reach — can a stranger touch this?
+
+Obligations scale almost entirely with reach. Establish it first.
+
+| Class | Signals | Baseline exposure |
+|---|---|---|
+| **Local-only** | CLI, no server, no network calls with user data, no deploy config, no telemetry | Near zero. Licence hygiene and secrets hygiene only. Do not generate a compliance program. |
+| **Internal / self-hosted, no third parties** | Docker compose for one org, no public DNS, SSO to one tenant | Security baseline, employment/monitoring rules if it watches staff, vendor terms |
+| **Private beta / invite-only** | Auth required, invite table, no public signup | Full privacy stack applies to real users; volume-threshold laws mostly do not |
+| **Public app** | Open signup, public marketing page, app-store listing | Everything in `trigger-map.md` |
+| **Public + UGC** | Uploads, comments, profiles, messaging | Adds intermediary/safe-harbour, CSAM, NCII, moderation duties |
+| **Public + money** | Checkout, subscriptions, payouts | Adds payments, auto-renewal, tax, consumer law |
+
+Deploy signals: `vercel.json`, `netlify.toml`, `fly.toml`, `render.yaml`, `app.yaml`, `wrangler.toml`, `Procfile`, Dockerfile with exposed ports, Terraform/Pulumi with public ingress, GitHub Actions deploy jobs, `CNAME`, custom-domain config, `robots.txt`, sitemap, `apple-app-site-association`, `.well-known/assetlinks.json`, Fastlane, EAS config, `Info.plist`, `AndroidManifest.xml`.
+
+Absence of deploy config does not prove absence of a deployment. If it looks like a web app, ask.
+
+## 1b. Translate the signatures to the stack in front of you
+
+The greps in this file lean JavaScript because that is what most of these apps are built in. **They are examples of a pattern, not the pattern itself.** Before concluding "not applicable", restate the signature in the project's own idiom:
+
+| Signature | JS/TS | Python | Ruby | Go / Rust / PHP / mobile |
+|---|---|---|---|---|
+| Dependency manifest | `package.json`, lockfile | `requirements.txt`, `pyproject.toml`, `poetry.lock` | `Gemfile`, `Gemfile.lock` | `go.mod`, `Cargo.toml`, `composer.json`, `Podfile`, `build.gradle` |
+| Secret leaked to the client | `NEXT_PUBLIC_*`, `VITE_*`, `REACT_APP_*` | hardcoded literal in source; a default in `os.environ.get("KEY", "sk-...")`; committed `settings.py` | mis-scoped credentials, hardcoded literal | `EXPO_PUBLIC_*`, `Info.plist`, `AndroidManifest`, strings compiled into a shipped binary |
+| Injection sink | template literal in a query | f-string / `%` / `.format()` into `text()` or `execute()` | interpolation into `where("...")` | any concatenated query in any language |
+| Missing object authorization | handler reading `params.id` | FastAPI/Flask/Django view trusting a query or body field | controller trusting `params[:id]` | any handler trusting a client-supplied id |
+| Mass assignment | `{...req.body}` spread | `Model(**payload)`, `setattr` loops, unrestricted serializer | `update_attributes(params)` without strong params | any bulk bind of request data to a model |
+| Licence/vuln scanning | `npm audit`, licence checker | `pip-audit`, `pip-licenses` | `bundler-audit` | `govulncheck`, `cargo audit`, `cargo deny` |
+| Tracking/tags | `<script src>`, tag manager | server-rendered template blocks, or a separate frontend repo | ERB/HAML layouts | native SDK init in the app delegate |
+
+**If the repo is backend-only, say so and check whether a separate frontend exists** rather than silently reporting the tracking and accessibility sections as clean. "No frontend in this repo" and "no frontend in this product" are different findings, and only the second one is good news.
+
+## 2. Personal data inventory
+
+Grep the schema, not the prose. Look at migrations, ORM models, Zod/Pydantic schemas, form components, and event payloads.
+
+```
+# identity & contact
+email|phone|mobile|first_?name|last_?name|full_?name|address|postcode|zip|dob|date_of_birth|ssn|national_id|passport|driver
+# online identifiers (these ARE personal data in the EU/UK and most US state laws)
+ip_?address|user_?agent|device_?id|advertising_?id|idfa|gaid|fingerprint|cookie_?id|session_?id
+# location
+lat|lng|latitude|longitude|geo|coords|precise_location|geofence
+# special categories / sensitive
+health|medical|diagnos|symptom|prescription|patient|therapy|mental|cycle|period|fertility|pregnan
+biometric|face_?(embedding|descriptor|template|encoding)|voice_?(print|embedding)|fingerprint_template|iris|gait
+race|ethnic|religio|politic|union|sexual|orientation|gender_identity|immigration|criminal|conviction
+genetic|dna|genome
+# financial
+card|pan|cvv|iban|routing|account_number|balance|ledger|payout|tax_id
+# minors
+age|birthday|minor|child|parent_consent|guardian|grade|school|student
+```
+
+Classify each hit into: **basic** (name/email), **identifier** (IP/device/cookie), **sensitive** (health, biometric, precise location, sexual life, race, religion, union, immigration, criminal, genetic, financial account), **children's**, **credential**. Sensitive and children's data change the legal analysis more than volume ever does.
+
+Also record for each class: where it is stored, who it is sent to, how long it is kept, and whether deletion actually removes it. Most vibe-coded apps have no answer to the last two — that gap *is* a finding.
+
+## 3. Third-party recipients
+
+Every external call is a disclosure. Enumerate exhaustively — this is the single highest-yield sweep for litigation risk.
+
+```
+# tags & trackers
+googletagmanager|google-analytics|gtag|analytics\.js|connect\.facebook\.net|fbq\(|fbevents
+tiktok.*analytics|ttq\.|snap.*sc-static|pinterest.*pintrk|linkedin.*insight|_linkedin_partner
+clarity\.ms|hotjar|fullstory|logrocket|smartlook|mouseflow|inspectlet|quantummetric|heap|mixpanel|amplitude|segment|posthog|plausible|fathom|matomo
+# chat & support widgets (a wiretap-claim magnet)
+intercom|drift|zendesk|tawk|crisp|livechat|hubspot|freshchat|olark
+# infra & vendors
+sentry|datadog|bugsnag|rollbar|newrelic|cloudflare|vercel|supabase|firebase|auth0|clerk|stripe|paddle|lemonsqueezy
+resend|sendgrid|postmark|mailgun|twilio|vonage|onesignal|expo-notifications
+openai|anthropic|googleapis.*generativelanguage|bedrock|azure.*openai|replicate|huggingface|elevenlabs|deepgram|assemblyai
+# fonts & assets loaded cross-origin
+fonts\.googleapis|fonts\.gstatic|cdnjs|unpkg|jsdelivr
+```
+
+For each: what data does it receive, is it a processor or an independent controller, is there a signed DPA, and does it fire before consent? Cross-origin Google Fonts alone has produced German damages awards; ad pixels firing pre-consent are the top demand-letter fingerprint in `lawsuit-vectors.md`.
+
+## 4. Money
+
+```
+stripe|paddle|lemonsqueezy|braintree|adyen|paypal|razorpay|square|revenuecat|chargebee|recurly
+subscription|plan_id|price_id|trial|renew|invoice|refund|payout|wallet|balance|escrow|transfer|topup|credits
+```
+
+Distinguish: one-off purchase, **auto-renewing subscription** (adds ROSCA/state auto-renewal duties), **free trial converting to paid** (highest-risk pattern), **holding or routing user funds** (money-transmission analysis, see `sector-gates.md`), **paying users out** (tax reporting, KYC), **in-app currency or loot boxes** (consumer-protection scrutiny).
+
+## 5. Decisions about people
+
+Any code path that scores, ranks, filters, approves, denies, prices, or flags a human. Grep `score|risk|approve|reject|eligib|screen|rank|match|fraud|verify_identity|creditworth|applicant|candidate|tenant`.
+
+If the output affects **employment, credit, housing, insurance, education, or access to essential services**, the analysis changes completely — see the automated-decision sections in `us.md` and `eu-uk.md`. An LLM in that path is still an automated decision system.
+
+## 6. User-generated content
+
+Uploads, comments, profiles, DMs, public feeds, file sharing, avatars. Grep `upload|multipart|presigned|s3\.|bucket|attachment|comment|post|message|thread|profile|avatar|report_abuse|moderat`.
+
+If images or video can be uploaded by users, CSAM detection/reporting and NCII takedown duties attach in the US regardless of size — see `sector-gates.md` §6. If it is a service in the EU or UK, intermediary duties attach.
+
+## 7. Messaging
+
+Separate **transactional** (receipt, password reset, security alert) from **marketing/promotional** (newsletter, offers, re-engagement, "we miss you", abandoned cart). The legal treatment is completely different and most codebases blur them in one `sendEmail()`.
+
+Grep for template names, campaign tables, `unsubscribe`, `List-Unsubscribe`, cron/scheduled sends, SMS providers, push topics.
+
+## 8. AI surface
+
+```
+openai|anthropic|gemini|generativelanguage|bedrock|ollama|vllm|langchain|llamaindex|ai-sdk|streamText|createAgent|tool_choice|function_call
+embedding|vector|pgvector|pinecone|qdrant|weaviate|chroma
+diffusion|stable-?diffusion|dall-?e|midjourney|tts|voice_?clone|speech_?synth|avatar
+```
+
+Then classify:
+- **AI-assisted internal tooling** — low external exposure.
+- **User-facing chatbot** — disclosure duties (EU AI Act Art 50, several US state laws); companion/emotional framing pulls in far stricter rules.
+- **Generated synthetic media** — marking/provenance duties.
+- **AI in a consequential decision** — high-risk classification.
+- **Agent with tools/code execution** — prompt-injection and sandboxing become security blockers, see `security-baseline.md`.
+- **Training or fine-tuning on user data** — needs a lawful basis, notice, and usually opt-in; check vendor training terms.
+
+## 9. Domain signal scan
+
+Route names, table names, and README copy reveal the regulated domain faster than asking. Match against the red-flag phrase table in `sector-gates.md`. Any hit escalates immediately — the domain gate is evaluated *before* the privacy checklist, because if the product cannot lawfully exist as described, the cookie banner is irrelevant.
+
+## 10. Jurisdiction inference
+
+Do not assume the company's country limits exposure.
+
+- **EU/UK in scope if**: the app is reachable from there and offers goods/services (any language/currency targeting, EU/UK addresses accepted, EUR/GBP pricing, EU-targeted marketing) or monitors behaviour of people there (analytics, ad tracking, profiling). Mere accessibility alone is weaker, but analytics on EU visitors is monitoring.
+- **US state laws in scope by**: residents of that state using the service, subject to per-state thresholds — but several states have low or no thresholds, and California's threshold is met by ordinary ad-tech "sharing" more often than founders expect.
+- **Geoblocking is a real control.** If the user wants to reduce scope, blocking signup by country/region at the edge (and enforcing it, not just hiding UI) is legitimate and should be offered as an option. Note that it must be enforced server-side and that IP geolocation is imperfect.
+- **Sanctions screening is not optional** and applies to hobby projects: OFAC-restricted jurisdictions must be blocked for US persons.
+
+## 11. Question set (max five, batched, with defaults)
+
+Only ask what the repo cannot answer. Always state the default you will assume.
+
+1. **Reach** — "Public signup, invite-only, internal, or just you?" *(default: public if a deploy target and open signup exist)*
+2. **Geography** — "Which countries can sign up? Anything blocked today?" *(default: worldwide, nothing blocked → EU/UK/US all in scope)*
+3. **Real data** — "Real users and real data, or test data only?" *(default: real if there is a production deploy)*
+4. **Minors** — "Could under-18s (or under-13s) realistically use it? Any age gate?" *(default: no age gate present → treat general-audience unless the product is clearly workplace-only)*
+5. **Entity** — "Company entity and country, or personal/no entity yet?" *(default: unknown → flag as a LAWYER item, do not fill in documents)*
+
+Ask a sixth only if a domain gate fired and the answer determines legality (e.g. "do you hold a licence for X?").
+
+## 12. Proportionality rule
+
+Scale output to reach:
+
+- Local-only / prototype with fake data → at most a short note: secrets, licences, and "here is what changes when you deploy".
+- Private beta → security blockers, privacy notice, deletion path, vendor DPAs.
+- Public launch → the full register.
+
+Never produce a 60-item report for a project with no users. Findings nobody acts on are worse than none, because they teach the user to ignore the skill.

package/assets/skills/compliance-guard/references/lawsuit-vectors.md

@@ -0,0 +1,141 @@
+# Lawsuit & Demand-Letter Vectors
+
+How a small app actually gets sued or extorted, ranked by real base rate rather than statutory maximum. Snapshot **11 Aug 2026** — verify any date, amount, or case posture before stating it as current.
+
+**The core asymmetry:** most regulators do not chase solo developers. Private plaintiffs and demand-letter mills do, because the process is automated: a bot scans public sites for a technical fingerprint, a letter goes out, and settling is cheaper than defending. Optimise against *fingerprints*, not against theoretical liability.
+
+---
+
+## 1. Web accessibility demand letters — highest base rate
+
+**Who:** serial plaintiff firms filing thousands of federal suits a year, plus a much larger volume of pre-suit letters. Filings have grown year over year **[V]**; small e-commerce is the primary target.
+
+**Fingerprint they scan for:** automated scanners on the homepage and checkout. Missing `alt`, unlabeled form inputs, missing form `<label>`/`aria-label`, low contrast, no visible focus indicator, keyboard traps in modals and menus, inaccessible custom dropdowns, images of text, missing page language, empty links/buttons with icon-only content, and — the defect generated code produces most reliably — **a clickable `<div>` or `<span>` carrying an `onClick` with no `<button>`, no `role`, no `tabIndex`, and no key handler**, which is simply invisible to keyboard and screen-reader users.
+
+**Enumerate each defect separately.** Report accessibility as one finding per distinct defect class with its file and element — "hero image missing `alt`", "email input has no label", "`div` with `onClick` is not keyboard reachable", "#aaa text on #ccc fails contrast" — never as a single "accessibility issues" row. A collapsed row gets partially fixed: the developer adds the alt text, ships, and keeps every remaining barrier. Contrast in particular is checkable statically from the literal colour values in the source and should never be reported as merely "likely".
+
+**Exposure:** federal ADA suits seek injunctive relief plus fees; California's Unruh Act adds statutory damages per visit **[V]**, which is what makes California filings profitable. Settlements for small sites typically land in the low five figures plus remediation.
+
+**Counter-intuitive finding: accessibility overlay widgets increase risk.** A large share of 2025 filings targeted sites running overlays, and the leading overlay vendor faced a regulatory action over its claims **[V]**. Overlays are a beacon, not a shield.
+
+**Engineering fix**
+- `@axe-core/playwright` (or `axe-core` + Puppeteer) as a **blocking** CI gate on the top 10 routes; fail on `critical` and `serious`.
+- Manual keyboard pass on every flow that takes money or data: tab order, focus visible, escape closes, focus returns.
+- Remove any overlay widget and fix the DOM instead.
+- Publish an accessibility statement with a real contact route and a response commitment — it does not immunise you, but it converts some letters into conversations.
+- Never label the result "ADA compliant"; automated tooling finds a minority of barriers.
+
+---
+
+## 2. Wiretap / pixel / session-replay claims — highest volume in privacy
+
+**Who:** California plaintiffs' firms under CIPA §631 (wiretap) and §638.51 (pen register / trap-and-trace), plus growing analogues in other states **[U]** for the exact state list.
+
+**Theory:** a third-party script on your page is an uninvited "eavesdropper" on the user's communications with you, or is a device capturing routing/identifier data. IP addresses and click data suffice; no sensitive data and no harm are needed.
+
+**Scale:** pen-register-style claims have become a dominant share of active privacy litigation, driven by ordinary analytics and ad tools **[V]**. Statutory damages of **$5,000 per violation** are the leverage **[V]**.
+
+**Relief status:** California SB 690 would strip private rights of action for the pen-register sections only, and as amended in July 2026 it does **not** touch §631 wiretap claims **[V]**. Do not plan around it; re-verify its status before advising.
+
+**Fingerprint:** any third-party request firing on page load before consent — Meta/TikTok/LinkedIn pixels, GA, session replay, chat widgets, A/B tools. Server-side tagging does **not** cure it if the third party still receives the data.
+
+**Engineering fix**
+- Consent-before-load, enforced technically: no third-party tag may execute until an explicit signal. Test it — a CI check asserting **zero third-party network requests on first paint** is the single highest-value guard.
+- Google Consent Mode v2 defaulting to `denied` for ad and analytics storage.
+- Strict CSP `connect-src`/`script-src` so an accidental tag cannot phone home.
+- Disclose every third-party recipient by name in the privacy notice.
+- Arbitration clause with class waiver, presented in an enforceable clickwrap (see `artifacts.md`) — the most effective structural defence.
+- Delete session replay, or restrict it to post-login with `maskAllInputs: true` and explicit in-product consent.
+
+---
+
+## 3. Biometric claims (Illinois BIPA and analogues)
+
+**Trigger:** collecting a face geometry, fingerprint, voiceprint, iris, or similar identifier from a person in Illinois — with **no volume threshold**, so a single user creates exposure. Consent must be a **written release obtained before collection**, and you must publish a retention and destruction schedule **[V]**.
+
+**Damages:** $1,000 negligent / $5,000 intentional **per person**, plus fees. A 2024 amendment limits recovery to a single accrual per person rather than per scan, which materially reduced exposure but not filing volume **[V]**.
+
+**Fingerprint in code:** face detection or recognition SDKs, `face_embedding`/`descriptor`/`template` columns, voice embeddings, liveness checks, photo auto-tagging, avatar generation from a selfie. Face *detection* without identification is contested **[U]** — do not rely on it as a defence.
+
+**Engineering fix:** run matching on-device and return a boolean; never persist a template server-side. If you must, obtain a written release before capture, publish the retention schedule, set a hard deletion job, and treat Illinois/Texas/Washington users as in scope regardless of where you are.
+
+---
+
+## 4. TCPA / SMS
+
+**Trigger:** any SMS to a mobile number without provable prior express consent, or outside permitted hours, or after a revocation. **$500–$1,500 per message, uncapped** **[V]** — one 5,000-recipient blast is millions in exposure.
+
+**Fingerprint:** a `phone` column with no matching consent record; a send loop with no timezone check; "STOP" handled only by the carrier, not your suppression list.
+
+**Engineering fix:** exactly one `canSend()` chokepoint that owns the SMS provider credentials and enforces: valid consent record (with the exact disclosure text shown and a timestamp), suppression list, quiet hours in the recipient's timezone, frequency cap, and campaign type. Process opt-outs received on **any** channel within the statutory window. Register your messaging campaign with the carriers. Keep consent records for years, not weeks.
+
+---
+
+## 5. Subscription / auto-renewal class actions
+
+**Trigger:** auto-renewal or free-trial conversion with disclosures that are not clear and conspicuous *adjacent to the enrolment control*, no separate affirmative consent, or a cancellation path harder than the signup path **[V]**. California's amended auto-renewal law broadened what is actionable **[V]**; a federal click-to-cancel rule was vacated in 2025, so **state law and general deception rules are the live risk** — do not tell a user the federal rule saves them **[V]**.
+
+**Fingerprint:** trial logic with no reminder job; a cancel flow that emails support; terms shown behind a link rather than adjacent to the button; no stored record of what the user was shown.
+
+**Engineering fix:** disclosure block immediately above the pay button (price, renewal cadence, first charge date, how to cancel); a checkbox or equivalent affirmative act; store `{user, timestamp, disclosure_hash, price, terms_version}`; in-app cancel reachable in ≤2 clicks from account home; renewal and trial-conversion reminders; notice before any price change.
+
+---
+
+## 6. IP demand letters
+
+**Stock photos and fonts — the most common IP hit on small sites.** Automated reverse-image scanning drives letters typically in the hundreds to low thousands, escalating to firms that file real suits **[V]**. Leverage depends on registration timing **[V]** — always ask for the registration number and date before negotiating, and route the letter to counsel.
+
+Typical sources of the problem: images pulled from search results, assets supplied by a contractor with no licence trail, Creative Commons images used without the required attribution, platform stock reused after migrating off that platform, foundry fonts self-hosted under a desktop-only licence, paid icon sets vendored from a CDN.
+
+**Copyleft contamination.** AGPL/SSPL dependencies in a closed SaaS create a source-disclosure demand and kill acquisitions; AI-suggested snippets can reproduce GPL or CC-BY-SA code.
+
+**Your own code may not be protectable.** US Copyright Office guidance holds that purely AI-generated output is not copyrightable and that prompting alone does not create authorship **[V]**. For a vibe-coded product this weakens IP claims and must be disclosed in diligence — keep human-authored commits, review history, and meaningful human editing.
+
+**Engineering fix**
+- Blocking licence scan in CI (`license-checker`, `syft` + `grant`, ScanCode). Deny AGPL, SSPL, GPL-2.0/3.0, CC-BY-SA, BUSL, Commons Clause, UNLICENSED, UNKNOWN. Fail, don't warn.
+- Generate an SBOM per release (CycloneDX) and keep it as an artifact.
+- Ship the attribution notices MIT/BSD/Apache actually require at an in-app "Open source licences" route.
+- Asset inventory build step: walk `public/`, `assets/`, and `@font-face` sources, hash each file, require a row in a checked-in `LICENSES.csv` with `{sha256, source, licence, receipt, permitted_use}`. Fail on unmatched assets.
+- Clear the product name against trademark databases before buying the domain and shipping to app stores.
+
+**Patents:** non-practising entities target small companies heavily and defence costs dwarf settlements **[V]**. You cannot engineer around unknown patents. Do not respond substantively to a demand letter yourself; preserve it and route it to counsel.
+
+---
+
+## 7. Consumer-protection / advertising
+
+- **Fabricated, incentivised, or insider reviews** are directly prohibited with per-violation civil penalties, and enforcement is active **[V]**. Fingerprint: a reviews table with no `verified_purchase`, seeded testimonial fixtures with stock avatars, "5 stars for 10% off", display logic filtering `rating >= 4`, an approval queue that only approves positives.
+- **"AI-powered" and accuracy claims** without substantiation are an active enforcement theme **[V]**. Keep a repo-resident claims file mapping each marketing claim to dated evidence.
+- **Hidden mandatory fees** are restricted; one `displayPrice()` helper used everywhere is the fix **[V]**.
+- **Dark patterns** (pre-checked boxes, confirmshaming, fake urgency timers, obstructed cancel) are independently actionable across many regimes.
+
+---
+
+## 8. Platform and structural risks
+
+- **DMCA safe harbour** requires a registered designated agent *and* a reasonably implemented repeat-infringer policy. The registration **expires after three years** unless renewed — a lapse silently converts every user upload into direct liability **[V]**. Fix: register, calendar the renewal well before expiry, publish the agent contact, and implement `takedown_notices` + `strikes` tables with an actual `terminated_at` column and a counter-notice flow.
+- **Contractor IP:** without a signed assignment before the first commit, the contractor may own the copyright — "work made for hire" does not apply to most software by default **[V]**.
+- **Single-platform dependency:** an app-store or payment-processor termination is unappealable in practice. Keep a web fallback, a data-export path, and a second processor behind a flag.
+- **Accidental data-broker status:** selling or making available personal information about people who never interacted with you triggers registration and deletion-mechanism duties with per-day penalties, and enforcement has already hit companies of exactly this size **[V]**.
+
+---
+
+## Top vectors to check first on any consumer web app
+
+1. Unlabeled inputs / missing alt / no focus indicator on public pages → accessibility letter.
+2. Ad or analytics tags firing before consent → wiretap claim.
+3. An accessibility overlay installed instead of remediation → increases targeting.
+4. Auto-renew or trial checkout with buried terms and email-only cancel → subscription class action.
+5. SMS with no per-recipient consent record or timezone check → uncapped statutory damages.
+6. Unlicensed image or font anywhere on the site → automated demand letter.
+7. Session replay recording form input → wiretap claim.
+8. UGC with no registered DMCA agent (or a lapsed one) → loss of safe harbour.
+9. Face/voice embedding persisted server-side → biometric claim from a single user.
+10. Seeded, incentivised, or AI-written reviews → advertising enforcement.
+11. Unsubstantiated "AI-powered"/accuracy claims → deception enforcement.
+12. AGPL/GPL dependency in closed-source SaaS → source-disclosure demand and diligence failure.
+13. Video pages carrying ad pixels → video-privacy claims **[U]**.
+14. Hidden mandatory fees at checkout → pricing enforcement.
+15. Lead-gen or enrichment selling data about non-customers → data-broker penalties.
+
+**Structural defences that cut across everything:** an enforceable clickwrap at signup with arbitration and class waiver; a consent state that gates all non-essential third parties; one chokepoint per risky capability; and records — consent records, disclosure hashes, and audit logs are what convert a lawsuit into a dismissal.

package/assets/skills/compliance-guard/references/provenance.md

@@ -0,0 +1,42 @@
+# Provenance and Volatility
+
+## Snapshot
+
+These references were compiled on **11 August 2026** from primary and first-tier sources: EUR-Lex and the Official Journal, EDPB, national data protection authorities, ICO, Ofcom, the European Commission, the FTC, CPPA, state legislature and AG sites, US federal court opinions, the Copyright Office, NIST, OWASP, PCI SSC, and platform developer documentation.
+
+## Confidence markers
+
+Every substantive claim in these files carries a marker. **Preserve them when you report to the user.**
+
+- **[V] Verified** — checked against a primary or first-tier source at snapshot time. Still subject to change after that date.
+- **[S] Snapshot** — accurate at snapshot time but date-, threshold-, or version-sensitive. Re-verify before stating it as current.
+- **[U] Uncertain** — contested, in litigation, in legislative flux, or where sources conflicted. Present it to the user as uncertain, with both readings if they matter.
+
+Laundering an `[S]` or `[U]` item into a confident assertion is the most damaging failure mode of this skill. A user who acts on a wrong effective date is worse off than a user who was told to check.
+
+## What decays fastest
+
+Re-verify these before relying on them, in rough order of volatility:
+
+1. **US state AI laws** — effective dates have moved repeatedly, some are enjoined, some were repealed and replaced mid-cycle, and federal preemption efforts are active.
+2. **State privacy law scope** — new states take effect on 1 January and 1 July cycles; thresholds and cure periods change.
+3. **EU AI Act dates** — amended in July 2026; any guidance written before mid-2026 is unreliable on the high-risk timeline.
+4. **EU data/ePrivacy reform** — the data-protection half of the Digital Omnibus was still in negotiation at snapshot time and is **not law**. Do not build to proposed cookie or browser-signal provisions.
+5. **EU–US transfer framework** — valid at snapshot, with an appeal pending.
+6. **Wiretap/pixel litigation** — statutory reform and appellate decisions are actively reshaping which theories survive.
+7. **Age-verification and minors' laws** — rapid state adoption plus constitutional litigation.
+8. **Platform requirements** — Apple and Google change privacy and account requirements on their own schedule.
+9. **Security standards and vendor terms** — OWASP versions, PCI requirements, and LLM vendor retention/training defaults all move.
+10. **Penalty amounts** — many are inflation-adjusted annually.
+
+## Known gaps at snapshot
+
+- Jurisdictions outside the EU/UK/US are covered only where they surfaced incidentally (Australia, Canada, Brazil, India). **Do not extrapolate** — if the user targets another market, say the references do not cover it and research it before advising.
+- Sector regimes are covered at gate-detection depth, not implementation depth. The purpose is to recognise the gate and route to counsel, not to compliance-engineer a regulated business.
+- Fine tiers, transitional dates, and standard versions were flagged individually where they could not be re-verified.
+
+## Using this with web access
+
+When web access is available, verify in this order before making a claim the user will act on: (1) the effective date, (2) whether the law survived litigation, (3) the threshold and whether the user is over it, (4) the penalty and whether a private right of action exists. Prefer the statute, the regulator's own guidance, or the court's opinion over secondary commentary — law-firm blog posts were a recurring source of the errors corrected during this research, including at least one widely-repeated claim about an EU obligation that does not exist.
+
+When web access is unavailable, say so, cite the snapshot date, and mark the affected findings as needing verification.