@kenkaiiii/ggcoder 5.39.3 → 5.40.0

package/assets/skills/compliance-guard/references/sector-gates.md

@@ -0,0 +1,173 @@
+# Sector Gates
+
+Domains where **building the thing is the problem**, not the privacy policy. Evaluate these *before* any other checklist: if the product cannot lawfully exist as described, nothing downstream matters.
+
+Snapshot **11 Aug 2026**. Markers: **[V]** verified · **[S]** re-verify · **[U]** genuinely unresolved.
+
+Each entry gives the trigger, the **safe subset** a small dev can ship, and the **red line** that means stop.
+
+---
+
+## 1. Health and wellness
+
+**HIPAA** reaches covered entities and their business associates. A direct-to-consumer fitness, period, or wellness app with no provider or plan contract is usually **not** covered **[V]** — but you become a business associate the moment you create, receive, maintain, or transmit PHI *on behalf of* a covered entity, which requires a BAA, Security Rule compliance, and 60-day breach notice. If you are not HIPAA-covered you are still subject to the FTC Health Breach Notification Rule and state consumer-health-data laws, which are often *worse* because one carries a private right of action.
+
+**Wellness app → medical device.** The trigger is **intended use**: claiming to diagnose, treat, cure, mitigate, or prevent a disease. Marketing copy, not architecture, decides this **[V]**. In the EU, MDR Rule 11 puts software providing information used for diagnostic or therapeutic decisions at **Class IIa minimum** **[V]** — there is effectively no "just a wellness app" path for diagnostic output.
+- **Safe subset:** log data, present it back, cite third-party general information, explicitly disclaim diagnosis, no treatment recommendations, no risk scores framed as clinical.
+- **Red line:** "AI doctor", "diagnoses your symptoms", "tells you if you have X", dosage recommendations, or interpreting medical images. Unlawful to market without clearance/CE.
+
+**Telehealth and online prescribing** — the clinician must be licensed **in the patient's state**; compacts ease but do not erase this. Controlled substances add federal constraints and the telemedicine flexibilities have a scheduled expiry **[S]** — verify the current date before relying on it.
+- **Red line:** any flow that results in a prescription without a licensed prescriber in the patient's jurisdiction.
+
+**Mental-health and companion chatbots — the fastest-moving area in this file.** Several states now ban AI systems providing professional mental or behavioural health services outright, and some ban the marketing language itself **[V]**. Others require disclosure, crisis protocols, and minor safeguards, and at least two create a private right of action **[V]**.
+- **Safe subset:** journalling, mood tracking, psychoeducation, guided exercises, explicit "not therapy, not a therapist" framing, crisis resources surfaced on risk detection, no clinical claims.
+- **Red line:** "AI therapist", "AI counselor", presenting as a licensed professional, delivering treatment, or making clinical decisions.
+
+**Reproductive-health data** — no federal ban, but consumer-health-data laws (one with a private right of action) and state AG enforcement make period and fertility data among the highest-risk data classes a small app can hold **[V]**. If you build one: no ad SDKs anywhere near it, no third-party analytics on health screens, separate consent for collection and for sharing, and a real deletion path.
+
+**Health and supplement claims** need competent and reliable scientific evidence; disease claims are a separate regulated category **[V]**. Safe subset: describe features, cite sources, make no efficacy claims.
+
+---
+
+## 2. Legal, financial, and professional advice
+
+**Unauthorized practice of law** — the line is *applying law to a specific person's specific facts* **[V]**. Explaining how a process works generally is information; generating a jurisdiction-specific filing strategy for this user's situation is advice. UPL is a criminal offence in some states.
+- **Safe subset:** document automation with user-entered facts, general explainers, attorney review in the loop, clear "not legal advice" framing that matches what the product actually does.
+- **Red line:** "AI lawyer", "we'll tell you what to file", selecting claims or defences for a user.
+
+**Investment advice** — advising others about securities for compensation triggers adviser registration, federal or state depending on assets; **robo-advisers get no exemption** **[V]**. Unsubstantiated AI capability claims are an active enforcement priority.
+- **Safe subset:** education, generic screening tools with no personalised recommendation, backtests clearly labelled and not presented as predictions.
+- **Red line:** "AI picks stocks for you", personalised buy/sell recommendations, performance claims you cannot substantiate.
+
+**Broker-dealer** triggers on transaction-based compensation, handling customer orders or funds, or matching buyers and sellers. **Insurance** quoting/binding needs producer licensing. **Tax preparation** needs a PTIN and e-file authorisation. Accounting and medical/psych advice are similarly gated **[V]**.
+
+**Disclaimers do not cure any of this.** A "not financial advice" banner over a personalised recommendation engine is evidence of awareness, not a defence.
+
+---
+
+## 3. Money movement and crypto
+
+**Holding or routing user funds** — taking custody, control, or transmission authority over value between two parties is money transmission: FinCEN MSB registration plus state licensing, and operating unlicensed is a **federal felony** **[V]**. This catches far more designs than people expect: marketplace escrow, a `balances` table users can transfer between, tip jars that settle later, wallet features, "hold the payment until the job is done".
+- **Safe subset:** use a payment provider's managed model (Connect/Express-style) where the licensed entity holds and moves the funds and you never touch a balance. Never build your own ledger of user-owned fiat.
+- **Red line:** custody of third-party funds, escrow, or peer-to-peer transfers on your own rails.
+
+**AML/KYC/OFAC** — BSA obligations attach to MSBs, but **OFAC sanctions apply to every US person, including hobby projects and open-source maintainers**, with strict liability and no de-minimis exception **[V]**. Practical minimum for any product taking money globally: geoblock comprehensively sanctioned jurisdictions and screen against the SDN list.
+
+**Crypto** — token issuance is presumptively a securities offering absent statutory clarity **[U]**, stablecoin rules are phasing in **[S]**, and in the EU the MiCA transitional period ended, so providing crypto-asset services to EU users without authorisation is unlawful **[V]**. Hosted DeFi front-ends are an enforcement target even where the protocol is not.
+
+**Lending** needs state licences and triggers truth-in-lending disclosures; usury caps apply. **Gift cards and stored value** have their own regime. **Crowdfunding** and **prediction markets** are separately regulated, and prediction markets are the subject of active federal–state litigation **[U]**.
+
+---
+
+## 4. Gambling, contests, and game monetisation
+
+The test is **prize + chance + consideration**. Remove one leg or you need a licence **[V]**.
+
+- **Real-money gaming** requires state-by-state licensure that is not a small-dev path.
+- **Sweepstakes** need genuinely no-purchase-necessary entry with an equal alternative method, official rules stating odds, prize value, eligibility and sponsor, and registration/bonding in some states above prize thresholds. Dual-currency "sweeps casino" mechanics drew a wave of state bans and cease-and-desists in 2025–2026 **[V]**.
+- **Loot boxes and gacha** require probability disclosure in several jurisdictions and are treated as gambling in others; EU consumer authorities issued principles on in-game virtual currencies **[V]**. Allowing items to cash out crosses into gambling.
+- **Skill contests** are a narrower exception than founders assume and are prohibited or restricted in some states.
+
+**Red line:** cash prizes for gameplay, wagering on real-world events, or any cash-out from a chance-based mechanic, without a licence.
+
+---
+
+## 5. Children, education, vulnerable users
+
+**COPPA** requires verifiable parental consent before collection for child-directed services or on actual knowledge of an under-13 user, plus direct notice, deletion rights, and no conditioning participation on unnecessary data **[V]**. See `us.md` §3 for the amended-rule specifics.
+
+**School-facing ed-tech** adds FERPA's school-official framing, PPRA for surveys on protected topics, and state contract-mandating laws requiring specific data-security plans, parent bills of rights, and subcontractor terms **[V]**. Selling to a school without the required contract terms is a dead deal, not just a legal risk.
+
+**Age assurance** — self-declared age is no longer sufficient in a growing number of contexts; adult content in particular now requires real age verification in roughly half of US states **[V]**, and platform/app-store age-signal laws impose duties on **developers**, not only stores **[V]**.
+
+**Red line:** an AI companion marketed to minors with no age gate, no crisis handling, and no content restrictions.
+
+---
+
+## 6. Content, platforms, UGC
+
+**DMCA safe harbour is conditional and easily forfeited.** You must register a designated agent with the Copyright Office (online, small fee, **renewal every 3 years**), publish the agent's contact on your site, implement a takedown and counter-notice workflow, and adopt and *actually enforce* a repeat-infringer policy **[V]**. Most small platforms fail the renewal and the enforcement, which are exactly the two facts a plaintiff checks.
+
+**CSAM** — hosting user images creates a statutory duty to report apparent CSAM to NCMEC on actual knowledge, preserve the material for the statutory period, and **not** independently investigate it **[V]**. There is no size exemption.
+
+**NCII / TAKE IT DOWN** — the notice-and-removal requirement is live since 19 May 2026: a plain-language process usable by non-users, removal of the content and known identical copies within **48 hours**, and published notice **[V]**. Non-compliance is trivially detectable — the absence of the published process is itself the violation.
+
+**Deepfakes and voice cloning** — no federal replica right has passed **[S]**, but state right-of-publicity and digital-replica laws, plus NCII statutes, make cloning an identifiable voice or likeness without consent actionable **[V]**.
+- **Red line:** "nudify"/"undress" tools, sexualised imagery of real people, or cloning a specific real person without documented consent. This is criminal territory, not a grey area — refuse.
+
+**Music and audio** — playing recorded music needs both composition rights (mechanical and public performance) and a master licence; sync for video is separate **[V]**. Streaming-service licences do not transfer to your app.
+
+**Moderation regimes** — the EU DSA, the UK Online Safety Act, and Australia's under-16 social-media restrictions all reach small services **[V]**. See `eu-uk.md` §4–5.
+
+---
+
+## 7. Decisions about people
+
+- **Hiring** — bias-audit and notice regimes apply in some cities and states; some require an annual independent audit, a published summary, and advance candidate notice **[V]**.
+- **Screening or scoring people** — assembling or evaluating consumer information for eligibility decisions makes you a **consumer reporting agency**: permissible purpose, maximum possible accuracy, dispute handling, and adverse-action notices **[V]**. "It's just an AI background check" does not escape this; it is the classic small-company FCRA class action.
+- **Credit** — adverse-action notices must state **specific principal reasons**. A black-box model that cannot articulate reasons is itself the violation **[V]**.
+- **Housing and insurance** — disparate-impact exposure and rating regulation apply regardless of intent.
+- **EU** — these are Annex III high-risk categories under the AI Act, with obligations from Dec 2027 **[V]**.
+
+---
+
+## 8. Other gated verticals
+
+Firearms and ammunition (licensed dealing; publishing certain files raises export-control issues) · alcohol, tobacco, vape (licensing plus shipping-reporting regimes) · cannabis (federally prohibited, so processors, banks and app stores refuse regardless of state law) · online pharmacy (licensure plus valid prescriptions) · dating apps (state safety-disclosure laws) · debt collection · private investigation · background checks · drones (registration and remote ID) · autonomous systems · **export controls** on encryption, model weights and hardware **[U]** · lead generation and robocalling (consent and DNC, with state private rights of action).
+
+---
+
+## 9. Data sourcing legality
+
+- **Scraping public pages** — the federal anti-hacking statute is largely off the table for genuinely public pages with no authentication, leaving contract (ToS), trespass-to-chattels, and copyright/database-right theories **[V]**.
+- **Authenticated scraping revives that exposure** — logging in and scraping is a materially different legal act. Treat "we scrape LinkedIn" as a stop-and-discuss.
+- **Personal data in scraped sets** — publishing data publicly is not consent under EU law; you need a documented lawful basis, and machine-readable text-and-data-mining opt-outs must be honoured **[V]**.
+- **Training on user content** — needs its own lawful basis, notice, and usually opt-in; retrofitting it into an existing product via a terms update is a classic enforcement trigger.
+- **Dataset licences** — many public datasets are research-only. Check before commercial use.
+
+---
+
+## RED FLAG PHRASE TABLE
+
+Product descriptions or code signals → regime → the one-line warning to show the user.
+
+| User says / code shows | Regime | Warning |
+|---|---|---|
+| "let users send money to each other", a `balances` table + transfer endpoint | State money transmitter licensing + federal MSB registration | Holding or routing other people's funds is licensed money transmission, and unlicensed operation is a federal felony. Use a licensed provider's managed model instead. |
+| "escrow until the job is done" | Money transmission / escrow licensing | Escrowing third-party funds is a licensed activity in most states. Route through a licensed processor. |
+| "AI doctor", "diagnoses", "tells you what's wrong" | FDA device / EU MDR Rule 11 | Diagnostic intent makes this a regulated medical device — unlawful to market without clearance or CE marking. |
+| "AI therapist", "chatbot counselor" | State AI-therapy bans and licensing | Several states ban AI delivering therapy outright and ban this marketing language. Do not ship as described. |
+| "companion for teens", romantic AI persona | State companion-chatbot laws | Requires AI disclosure, crisis detection and routing, minor safeguards and break reminders — with a private right of action in some states. |
+| "prescribe", "get your meds online" | Prescriber licensing, controlled-substance rules | Prescribing requires a licensed prescriber in the patient's state. |
+| "AI lawyer", "we'll tell you what to file" | Unauthorized practice of law | Applying law to a user's specific facts is UPL, criminal in some states. Automate documents; do not advise. |
+| "AI picks stocks", "our AI predicts the market" | Adviser registration; AI-claim enforcement | Personalised recommendations require registration, and unsubstantiated AI claims are an active enforcement priority. |
+| "background check", "hireability score", "we scan their socials for employers" | FCRA | You would be a consumer reporting agency: permissible purpose, accuracy, disputes and adverse-action notices are mandatory. |
+| "our model decides who gets the loan/apartment/job" | ECOA, FHA, state AI-employment laws, EU AI Act Annex III | Consequential automated decisions require specific-reason adverse-action notices, bias testing and disclosure. |
+| "sweepstakes", "sweeps coins", "free coins redeemable for cash" | State lottery/gambling law | Dual-currency casino mechanics drew state bans and cease-and-desists. This is the banned model. |
+| "cash prizes for gameplay" | Gaming licensure | Prize + chance + consideration is a lottery. Remove one leg or get licensed. |
+| "bet on the outcome", event contracts | Gambling law vs commodities regulation **[U]** | Under active state enforcement and federal preemption litigation. High risk. |
+| "loot box", "gacha" | Consumer-protection and gambling rules | Disclose real-money value and drop rates; cash-out crosses into gambling. |
+| "users upload photos/videos" | DMCA, CSAM reporting, NCII takedown | Register a DMCA agent, build a CSAM reporting path, and ship a 48-hour NCII takedown flow. |
+| "voice clone of [celebrity]", "sounds like [artist]" | Right of publicity, digital-replica laws | Cloning an identifiable voice without consent is actionable in a growing number of states. |
+| "nudify", "undress", sexualised image of a real person | Federal criminal statutes, NCII law, EU AI Act Art 5 | Criminal territory, not a grey area. Refuse. |
+| "we scrape LinkedIn" or any logged-in source | Anti-hacking statutes, contract, GDPR | Authenticated scraping revives criminal-statute exposure, and EU personal data needs a documented lawful basis. |
+| "train on scraped user photos/posts" | GDPR, TDM opt-outs, AI Act | Public availability is not consent; machine-readable opt-outs must be honoured and a training-data summary published for the EU. |
+| "under 13", kids' game, school rollout | COPPA, FERPA, state student-privacy laws | Verifiable parental consent or a signed school agreement is required before any collection, and no ad SDKs. |
+| "adult content", "18+" | State age-verification laws | A click-through age gate is no longer sufficient in about half of US states. |
+| "social app, no age check" shipping to AU/UK | Australian minimum-age rules, UK Online Safety Act | Under-16 accounts are prohibited in Australia with very large fines; the UK requires children's risk assessments. |
+| "auto-dial", "SMS blast", "AI voice agent calls leads" | TCPA and state analogues | Prior express written consent and DNC scrubbing required; damages are per message and uncapped. |
+| "we'll launch a token" | Securities law; MiCA | Presumptively a securities offering absent statutory clarity; EU sales need MiCA compliance. |
+| "hosted DeFi front-end", "swap widget with a fee" | MiCA, AML, sanctions | Front-ends are the enforcement target even when the protocol is not. |
+| "no geoblocking, available worldwide" | Sanctions (strict liability) | Sanctions apply to hobby projects. Block comprehensively sanctioned jurisdictions and screen the SDN list. |
+| "export our model weights", chip resale | Export controls **[U]** | Get an export-control read before shipping weights or hardware. |
+| "background music from Spotify/YouTube" | Music licensing | Streaming licences do not transfer to your app; you need composition and master rights, plus sync for video. |
+
+---
+
+## How to deliver a gate finding
+
+Lead with the conclusion, then the safe subset, then the question that would change the answer:
+
+> **This crosses into licensed territory.** Letting users hold balances and send each other money is money transmission — that needs state licences and federal registration, and operating without them is a federal crime, not a fine. What I *can* build today is the same marketplace using [provider]'s managed accounts, where the licensed entity holds the funds and you never touch a balance — same user experience, no licence. If you already hold licences or have counsel advising on this, tell me and I'll build the direct version.
+
+Never build the gated version silently, never bury the warning at the end of a long report, and never soften it into "you may want to consider consulting a lawyer".

package/assets/skills/compliance-guard/references/security-baseline.md

@@ -0,0 +1,130 @@
+# Security Baseline
+
+Security is the fastest route from "small app" to "regulatory incident": a breach triggers notification duties, class actions in states with a breach private right of action, and the deception theory that your privacy policy promised protection you did not provide. This file is the pre-deploy floor, weighted toward the failure modes that AI-generated and rapidly built apps produce most often.
+
+Snapshot **11 Aug 2026**. Verify version numbers and vendor terms before asserting them.
+
+---
+
+## PRE-DEPLOY BLOCKERS
+
+Do not ship with any of these unresolved. Each is P0.
+
+1. **Secrets in the client or the repo.** Any API key, service-role key, database URL, or private key present in a client bundle, a `NEXT_PUBLIC_*`/`VITE_*` variable, committed `.env`, or git history. Fix: move server-side, rotate the exposed value (rotation is mandatory — history is public forever), add `.env*` to `.gitignore`, add a secret scanner to CI, purge history if the repo is public.
+2. **Row-level security or equivalent not enabled** on any table reachable by a client SDK (Supabase, Firebase, PocketBase, direct PostgREST). Default-deny, then add policies per table. Verify by querying as an anonymous user, not by reading the dashboard.
+3. **Service-role / admin key reachable from the browser or an edge function that any user can call.** This bypasses every policy you wrote.
+4. **Authorization enforced only in the UI or only on the route.** Every read and write must check *this user may act on this object* server-side, at the data layer. Broken object-level authorization is the most common serious defect in generated code: `/api/orders/:id` returning any id, `PATCH /users/:id` accepting an arbitrary id, an `isAdmin` check that lives only in a React component.
+4a. **Defaults that grant instead of deny.** Any column, flag, or config whose default hands out access, verification, or entitlement without anyone checking: `is_verified DEFAULT TRUE`, `is_adult_verified DEFAULT TRUE`, `role DEFAULT 'admin'`, `plan DEFAULT 'pro'`, `approved BOOLEAN DEFAULT TRUE`, a permissive fallback in `getEnv("MODE", "debug")`. These read as harmless schema lines and silently defeat the entire control they belong to — an age gate whose column defaults to verified is not an age gate. Grep every `DEFAULT TRUE`, `DEFAULT 'admin'`, and default-valued boolean in the schema, and ask what it authorises before anyone acts.
+
+4b. **Tenant isolation derived from client input.** In any B2B or multi-tenant product, a handler that takes `org_id`, `employer_id`, `workspace_id`, `account_id` or similar **from the request** and filters on it lets any customer read another customer's records by changing one value. The tenant must come from the authenticated session or token, never from a parameter. Enforce it once — a session-level filter, a policy, or a repository wrapper — not per route, and test it by authenticating as tenant A and requesting tenant B's id.
+5. **Mass assignment.** Spreading a request body into a create/update (`{...req.body}`, `Object.assign(user, body)`, `prisma.user.update({data: body})`) lets a user set `role`, `is_admin`, `credits`, `plan`, or `stripe_customer_id`. Fix: explicit allow-listed field mapping or a strict schema with unknown-key rejection.
+6. **String-built queries.** Any SQL, NoSQL filter, or ORM raw call assembled by concatenation or template literal from user input. Use parameterised queries everywhere, no exceptions.
+7. **Unauthenticated internal endpoints.** Cron routes, webhooks, admin actions, migration or seed endpoints, debug routes, `/api/dev/*`, and server actions with no auth check. Webhooks must verify the provider's signature; cron routes must verify a shared secret.
+8. **Publicly writable or listable storage buckets.** Signed URLs with sane expiry; no public write; no directory listing; validate content type and size server-side; never trust the client-supplied filename or MIME.
+9. **No rate limiting on anything expensive or abusable** — auth, password reset, signup, search, file upload, and every LLM call. Absence produces credential stuffing, enumeration, and unbounded vendor bills.
+10. **Password storage that is not a modern memory-hard hash** (argon2id or bcrypt/scrypt with adequate parameters). Never MD5/SHA-family, never unsalted, never encryption-instead-of-hashing. Or drop passwords entirely for an identity provider or passkeys.
+11. **Session cookies without `HttpOnly`, `Secure`, and `SameSite`**, or tokens stored in `localStorage` where XSS can read them, or sessions that never expire and are not invalidated on password change.
+12. **JWT verification that trusts the token** — `decode` instead of `verify`, algorithm not pinned, `none` accepted, no expiry check, secret shared with the client.
+13. **CORS `*` combined with credentials**, or an origin reflected from the request header.
+14. **Card data touching your systems.** PAN, CVV, or full track data in your database, your logs, or your error tracker. Use hosted fields or hosted checkout so the data never reaches your origin.
+14b. **Financial and identity columns stored in the clear.** `payout_iban`, `bank_account`, `routing`, `tax_id`, `ssn`, `national_id`, `passport`, `government_id` sitting in a table with no encryption, no restricted access path, and no retention rule. They look like ordinary text columns and are routinely written that way; a breach involving them is materially worse than one involving emails, and several regimes treat them as their own category.
+15. **PII in logs and error trackers** — request bodies, headers with tokens, full user objects, prompts containing user data. Scrub at the transport, set retention, sign the vendor DPA.
+16. **No transport security or mixed content** — HTTPS everywhere, HSTS, secure cookies, no `http://` asset loads.
+17. **SSRF in any server-side fetch of a user-supplied URL** (image import, webhook test, link preview, RSS, "fetch my site"). Allow-list schemes and hosts, block private/link-local ranges and metadata endpoints, disable redirects to internal addresses.
+18. **No backup, or an untested restore.** Data loss is the incident nobody calls a breach and everybody suffers.
+
+---
+
+## Why AI-generated code fails here specifically
+
+Generated code optimises for a working happy path. The recurring gaps, in rough order of frequency:
+
+- Authorization is written as UI conditionals, not data-layer policy.
+- Database-level security is left at the framework default, which is often permissive for client SDKs.
+- Convenience keys (service role, admin tokens) get wired into wherever made the demo work.
+- Input validation exists at the form, not at the API boundary.
+- Error handling leaks stack traces, queries, and internal paths to the client.
+- Rate limits, quotas, and abuse controls are simply absent.
+- Dependencies are added freely, including hallucinated or typosquatted package names.
+- Secrets end up in whichever file the example used.
+
+Academic and vendor studies through 2024–2026 consistently find a substantial share of LLM-generated code samples contain a known weakness **[S]** — treat the prevalence as directionally real and the specific percentages as unverified.
+
+**Review heuristic:** for every table, ask "who can read this row, who can write it, and where is that enforced?" For every endpoint, ask "what happens if I change the id to someone else's?" Those two questions find most of it.
+
+---
+
+## Supply chain
+
+- Commit lockfiles; pin or range-pin deliberately; use `npm ci`/`pnpm i --frozen-lockfile` in CI.
+- Consider disabling install scripts by default in CI (`--ignore-scripts`) — 2025–2026 saw self-propagating npm worms that executed on install and stole credentials **[V]**.
+- Verify every package name before adding it. AI models hallucinate package names and attackers register them ("slopsquatting").
+- Run dependency vulnerability scanning and a licence scan in the same CI step (see `lawsuit-vectors.md` §6).
+- Generate an SBOM per release. Enterprise buyers and some regulatory regimes now expect one.
+- Scope CI tokens; never give a workflow a long-lived org-wide credential.
+
+---
+
+## Authentication and account safety
+
+- Prefer a managed identity provider or passkeys over rolling your own.
+- Long passwords over composition rules; screen against known-breached password lists; do not force periodic rotation without cause **[S]** — verify against the current NIST digital identity guidance before stating specifics.
+- MFA available for all users, required for admin.
+- Account recovery is the real attack surface: single-use, short-lived, one-time tokens; no user enumeration in responses or timing; invalidate all sessions on password or email change.
+- Lock or throttle after repeated failures, per-account and per-IP.
+- Log authentication events with enough detail to reconstruct an incident, without logging credentials.
+
+---
+
+## Payments
+
+- Use hosted fields/checkout from your processor so PAN never touches your origin. This is what keeps your PCI scope minimal.
+- Payment-page script integrity and script inventory requirements now apply to pages that take card data **[S]** — verify the current PCI DSS requirement numbers and SAQ eligibility with your processor before advising, since eligibility differs between fully hosted redirect and embedded-fields integrations.
+- Verify webhook signatures; make handlers idempotent; never grant entitlements from a client-side success callback.
+- Reconcile: entitlement state must derive from the processor's record, not from your optimistic write.
+- Store only the processor's customer/payment-method reference, never card data.
+
+---
+
+## Data handling that maps to legal duties
+
+- **Encryption** in transit always; at rest via managed disk/db encryption plus column-level encryption for sensitive categories.
+- **Minimisation** — every column you do not collect is a column you cannot leak, cannot be asked to delete, and cannot be sued over. This is the highest-leverage privacy control that exists.
+- **Retention** — a documented schedule per data class, implemented as a scheduled job, not a policy sentence. Include logs, analytics, backups, email provider, CRM, and LLM vendor retention.
+- **Deletion propagation** — deletion that leaves the row in backups, the analytics warehouse, the email tool, and the vendor's logs is not deletion. Document the realistic backup-expiry approach rather than claiming instant erasure.
+- **Access logging** for administrative access to user data.
+- **"Reasonable security"** is the legal standard in most US enforcement: the failures above are what regulators cite. Meeting this list is most of it.
+
+---
+
+## Incident readiness
+
+- Know your clocks before you need them: EU/UK supervisory-authority notification runs on a short deadline from awareness **[V]**; US state deadlines vary and several require attorney-general notice above thresholds; sector rules add their own.
+- Keep an incident runbook: who decides, how to contain, how to preserve evidence, notification templates, and a contact list.
+- Preserve logs long enough to reconstruct an event — 30 days is often too short.
+- Do not publicly characterise scope before you know it.
+
+---
+
+## Prompt-injection fingerprint
+
+The most common shape in AI-built apps is untrusted text interpolated straight into a prompt — an f-string, template literal, or concatenation carrying a CV, a support message, a scraped page, a filename, or a database field into the system or user message. Anything reaching the model is attacker-controlled input.
+
+Detect any prompt string built by interpolation from a request body, a stored record, an uploaded file, or fetched web content. Then ask the two questions that set severity — **what can the model do** (tools, queries, sends, spend) and **where does its output land** (rendered HTML, a shell, another prompt, a decision about a person). Treat the untrusted span as data: fence it, keep authority at the tool layer rather than in prompt wording, and never let output reach a dangerous sink unchecked.
+
+## AI and agent security
+
+- **Prompt injection is not solvable by prompting.** Treat all retrieved, scraped, uploaded, or user-supplied content as hostile instructions. Enforce authority at the tool layer: the model requests, your code authorises.
+- **Never let model output reach a dangerous sink unchecked** — no `eval`, no shell string interpolation, no SQL from model text, no unsanitised HTML render (LLM output is a live XSS vector; render as text or sanitise).
+- **Tool permissions must be least-privilege and user-scoped.** A tool that can read "the database" will be talked into reading someone else's rows.
+- **Sandbox code execution** — isolated runtime, no network by default, no host filesystem, hard CPU/memory/time limits.
+- **Cost and abuse limits per user and globally**, with a kill switch. Unbounded LLM spend is a real business-ending failure mode.
+- **PII into prompts** — redact what you can, disclose the vendor in your privacy notice, sign the vendor's DPA, and prefer zero/limited-retention endpoints. Business/API tiers and consumer tiers of the same vendor often have different training and retention defaults **[S]** — verify the current terms for the specific endpoint before telling a user their data is not trained on.
+- **Log prompts and outputs carefully**: they frequently contain the most sensitive data in the system, and their retention is now part of your retention schedule.
+- Consult current OWASP guidance for web, API, and LLM applications for the full control set **[S]** — verify the current version numbers before citing them.
+
+---
+
+## Assurance for B2B sales
+
+Only when a buyer demands it: SOC 2 Type II or ISO 27001 are months and meaningful cost; a security questionnaire answer pack, a public trust page, a pen-test report, and a VPAT cover most early enterprise deals. Do not start a certification because it feels responsible — start it because a deal requires it.

package/assets/skills/compliance-guard/references/trigger-map.md

@@ -0,0 +1,163 @@
+# Trigger Map
+
+Observable fact → what it triggers → what to actually do. This is the routing index; depth lives in the jurisdiction and vector files.
+
+Status markers: **[V]** verified against a primary source in the 11 Aug 2026 snapshot · **[S]** snapshot claim, re-verify date/threshold before asserting · **[U]** uncertain or contested, present as uncertain.
+
+---
+
+## A. Universal — applies to essentially any product with real users
+
+| Observed fact | Triggers | Do this |
+|---|---|---|
+| Any personal data at all, any deployed app | GDPR/UK GDPR if EU/UK reachable; US state privacy laws by residency | Privacy notice at collection; lawful basis recorded; deletion path that actually deletes; vendor list |
+| Third-party scripts on a public page | ePrivacy consent **[V]**, CIPA/wiretap claims **[V]**, state "sharing" opt-outs | Block non-essential tags until consent; consent banner with reject parity; disclose recipients |
+| Accounts / login | Security baseline; breach-notification readiness | See `security-baseline.md` P0 list; hashing, session flags, server-side authz |
+| A public marketing or product web page | ADA Title III / EAA accessibility **[V]** | WCAG 2.1 AA minimum (2.2 AA if targeting EU public-sector or new work); axe CI gate; accessibility statement |
+| Any email you send | CAN-SPAM; Gmail/Yahoo bulk-sender rules **[S]** | Physical postal address, working unsubscribe, `List-Unsubscribe` + one-click, honour within 10 business days |
+| Contact/support form | Privacy notice; retention | Say what you do with it; delete on a schedule |
+| Error tracking / logs | Personal data in logs; transfer duties | Scrub PII, set retention, sign the vendor DPA |
+| No entity, personal liability | Contract/liability exposure | LAWYER item — do not paper over it |
+
+---
+
+## B. Tracking, analytics, advertising
+
+| Observed fact | Triggers | Do this |
+|---|---|---|
+| Any analytics that sets a cookie or reads device storage | ePrivacy consent (EU/UK) **[V]** regardless of whether data is personal | Prior blocking; granular purposes; consent record with timestamp + policy version |
+| Meta/TikTok/Google ad pixel | CIPA §631/§638.51 **[V]**, state "sale/share" opt-out, GDPR joint-controller | Consent-gated load; GPC honoured server-side; DPA/joint-controller terms; list recipient in the notice |
+| Session replay (Hotjar, Clarity, FullStory, LogRocket) | Wiretap claims — the strongest fingerprint **[V]** | Prefer removal. If kept: post-login only, mask all inputs, explicit in-product consent, no keystroke capture |
+| Chat widget (Intercom, Drift, Zendesk, tawk) | Wiretap/third-party-eavesdropper claims **[V]** | Disclose the third party in the chat UI before the first message; consent-gate the script |
+| Fingerprinting / device ID | Consent; several state laws treat it as an identifier | Consent-gate; document purpose; do not use to defeat opt-outs |
+| Cross-origin Google Fonts / CDN assets | EU transfer + consent claims **[S]** | Self-host fonts. Cheapest fix in the whole file |
+| Cookie banner that loads tags first, or has no reject button | Regulator fines and litigation **[V]** | Reject-all as prominent as accept-all; nothing fires pre-consent; withdrawal as easy as consent |
+| Video content + any ad pixel | VPPA class actions **[U]** — circuit split, actively litigated | Strip ad pixels from pages containing video until resolved. **Passing the video title or id into the pixel payload is the exact fingerprint** — check tag parameters, not just tag presence |
+| Any cross-context tracking at all | Universal opt-out / GPC duty **[V]** | Handle `Sec-GPC: 1` server-side before tags load. The defect is an **absent handler**, so grep for its absence rather than waiting for something to look wrong |
+
+---
+
+## C. Money
+
+| Observed fact | Triggers | Do this |
+|---|---|---|
+| Card payments via Stripe/Paddle/etc. | PCI DSS scope, consumer law, tax | Never let PAN touch your server; hosted fields/Checkout; verify webhook signatures; idempotency keys |
+| Auto-renewing subscription | ROSCA + ~25 state auto-renewal laws **[V]** | Clear pre-purchase disclosure adjacent to the CTA; separate affirmative consent + stored record; cancel in the same medium in ≤2 clicks; renewal reminders; price-change notice |
+| Free trial converting to paid | Highest-risk consumer pattern **[V]** | Pre-conversion reminder; disclose conversion date and amount before charging |
+| Hidden mandatory fees at checkout | Junk-fee and honest-pricing rules **[V]** | One `displayPrice()` returning base + all mandatory fees, used on every surface |
+| You hold, route, or pool user funds | Money transmission licensing | **Gate** — see `sector-gates.md` §3 before writing the ledger |
+| Payouts to users | Tax reporting, KYC, sanctions | Use a provider that owns the obligation (Stripe Connect/Express) rather than building it |
+| Selling to EU/UK consumers | Distance-selling info duties, withdrawal rights, VAT/OSS **[V]** | Pre-contract info before the pay button, 14-day withdrawal terms **plus the digital-content waiver checkbox pair**, tax handling or a merchant-of-record. **Fires on any paid consumer flow reachable from the EU/UK, independently of auto-renewal and pricing findings** — do not treat those as covering it |
+| Crypto, tokens, wallets | MiCA / US regimes | **Gate** — `sector-gates.md` §3 |
+
+---
+
+## D. Users, content, community
+
+| Observed fact | Triggers | Do this |
+|---|---|---|
+| In-app currency, credits, gems, or tips **that can be cashed out** | Money transmission / e-money licensing **[V]** | **ILLEGAL without authorisation** — route through a licensed provider's managed payouts; never hold a user-owned balance. See `sector-gates.md` §3 |
+| Any generated audio, video, image, or synthetic persona shown to users | Synthetic-content marking + labelling **[V]** | Machine-readable provenance on the artifact **and** a visible label, separate from whether generating it was allowed |
+| Users can upload files or post content | DMCA safe harbour prerequisites **[V]**; intermediary duties | Register a DMCA designated agent (small fee, expires after 3 years — calendar a renewal); publish it; repeat-infringer policy with a real termination mechanism |
+| Users can upload **images or video** | CSAM reporting duties **[V]**; NCII takedown duty **[V]** | Hash-matching where feasible; NCMEC reporting path and preservation; public NCII report form with a 48-hour removal SLA and identical-copy removal |
+| Hosting user content while established in, or reachable from, the EU/UK | **EU DSA** intermediary duties **[V]**; UK Online Safety Act | Notice-and-action mechanism, published point of contact, moderation criteria in the terms, minors' protection. **Separate from and additional to the US DMCA/CSAM/NCII duties** — naming only the US set leaves an EU-established platform's own regulator unaddressed |
+| Public profiles, DMs, feeds | EU DSA / UK Online Safety duties **[V]**, harassment/safety | Notice-and-action mechanism, contact point, terms describing moderation, risk assessment if UK-facing |
+| Reviews or testimonials displayed | FTC Consumer Reviews Rule **[V]** | No fabricated or seeded reviews, no incentives conditioned on sentiment, no rating-filtered display, disclose insider reviews. Delete fixture testimonials before launch |
+| Adult content | State age-verification laws **[V]** | **Gate** — `sector-gates.md` §6 |
+| Deepfakes, voice cloning, likeness | Right of publicity, NCII, state AI laws **[V]** | **Gate** — consent-of-subject architecture or do not build |
+
+---
+
+## E. Minors
+
+| Observed fact | Triggers | Do this |
+|---|---|---|
+| Any realistic under-13 users (US) | COPPA **[V]** | Verifiable parental consent before collection; separate consent for third-party disclosure; published retention policy; no behavioural ads to children; delete on request |
+| Under-16/18 users | State minor-protection laws, UK/EU children's codes **[V]** | High-privacy defaults, no profiling ads, age-appropriate design, no dark patterns |
+| App-store distribution to minors | Platform family policies + state app-store age laws **[S]** | Correct age rating, families policy compliance, no third-party ad SDKs in kids builds |
+| Education/school customers | FERPA/PPRA and state student-privacy contracts **[V]** | School-consent model, contractual terms, no secondary use, no ads |
+| AI companion features reachable by minors | Companion-chatbot laws **[V]**, incl. a private right of action in at least one state | Disclosure, crisis handling, minor mode, incident logs — see `us.md` |
+
+**Rule:** "we don't allow under-13s" in the terms is not a defence if the design attracts them or you have actual knowledge. Actual-knowledge signals include a user telling support their age.
+
+---
+
+## F. Sensitive data classes
+
+| Observed fact | Triggers | Do this |
+|---|---|---|
+| Estimating age, gender, or any attribute from a face or voice | Biometric categorisation duties **[V]**; age-assurance law where it gates content | Inform the exposed person; document the GDPR Art 9 analysis; an *estimate* is not verification where a law requires effective age assurance |
+| Face/voice templates, fingerprints, iris | Illinois BIPA and analogues **[V]** — per-person statutory damages, no volume threshold | Written release before capture; published retention/destruction schedule; prefer on-device matching returning a boolean, never storing a template |
+| Health, symptoms, fitness, mental health, cycle/fertility | Consumer-health-data laws with a private right of action **[V]**; possibly HIPAA | Separate consent for collection; separate signed authorisation before any sale/share; strict vendor control; see `sector-gates.md` §1 |
+| Precise geolocation | Sensitive category in most state laws; consent required | Opt-in, purpose-limited, coarse where possible, short retention |
+| Genetic data | Dedicated genetic-privacy statutes | LAWYER before building |
+| Government ID / identity documents | Retention and security duties, breach severity | Use a verification vendor; do not store images; keep only a boolean and a reference |
+| Immigration, criminal, union, religion, sexual orientation, race | GDPR Art 9 / state sensitive-data rules | Explicit opt-in, DPIA, minimise or drop the field |
+
+---
+
+## G. AI features
+
+| Observed fact | Triggers | Do this |
+|---|---|---|
+| User-facing chatbot | EU AI Act Art 50 disclosure **[V]**; several US state chatbot-disclosure laws **[V]** | Persistent "you are talking to an AI" disclosure, not buried in terms |
+| Companion / emotional / therapy-adjacent chatbot | Companion-AI laws + AI-therapy bans **[V]** | **Gate** — crisis protocol, minor protections, and in some states you cannot offer therapy at all |
+| Scoring emotion, confidence, engagement or sincerity from face/voice in **hiring, work, or education** | EU AI Act Art 5(1)(f) **prohibited practice** **[V]** | **ILLEGAL in the EU — remove the feature.** Not curable by disclosure or consent. See `eu-uk.md` Art 5 |
+| Inferring race, ethnicity, gender, religion, union membership or sexual orientation from a photo, face or voice | EU AI Act Art 5(1)(g) **prohibited** **[V]**; discrimination law everywhere | **ILLEGAL in the EU — delete the field and the model.** Also a discrimination claim if it touches any decision |
+| Building a face database by scraping images from the web or CCTV | EU AI Act Art 5(1)(e) **prohibited** **[V]** | **ILLEGAL in the EU.** Also BIPA and scraping exposure |
+| Cross-context "trust score" or "reputation score" affecting unrelated treatment | EU AI Act Art 5(1)(c) social scoring **[V]** | **Gate** — narrow the score to the context it was collected for |
+| Generated images/audio/video | Synthetic-content marking duties **[V]** | Machine-readable provenance (C2PA-style) + visible label where required |
+| AI in hiring, lending, housing, insurance, education, essential services | High-risk/ADS regimes **[V]** | Notice, human review, bias testing, records, adverse-action reasons. LAWYER item |
+| Training or fine-tuning on user data | Lawful basis, notice, opt-in expectations, training-data disclosure laws **[S]** | Default to opt-out-by-default = off; document data sources; check vendor terms |
+| Agent with tool access / code execution | Prompt injection, exfiltration, cost abuse | See `security-baseline.md` §9 — this is a security blocker, not a policy item |
+| Sending user PII to an LLM vendor | Processor relationship, transfers, retention | Sign the DPA, use zero/limited-retention endpoints, redact before send, disclose the vendor |
+| Marketing claims like "AI-powered", "99% accurate", "fully automated" | Deceptive-claims enforcement **[V]** | Keep a dated substantiation file mapping each claim to evidence |
+
+---
+
+## H. Messaging
+
+| Observed fact | Triggers | Do this |
+|---|---|---|
+| Marketing email | CAN-SPAM, EU/UK consent + soft opt-in, CASL for Canada **[V]** | Consent record per recipient per channel; postal address; one-click unsubscribe; suppression list enforced at send |
+| SMS / voice | TCPA + state analogues **[V]** — uncapped per-message statutory damages | One `canSend()` chokepoint enforcing consent + opt-out + quiet hours in the recipient's timezone + frequency cap; STOP/HELP handling; carrier registration |
+| Push notifications used for marketing | Platform policy + consent expectations | Separate marketing toggle from transactional |
+| Cold outreach / scraped contacts | Anti-spam and data-protection breaches | Usually unlawful in the EU/UK without consent. Say so plainly |
+
+---
+
+## I. Data sourcing
+
+| Observed fact | Triggers | Do this |
+|---|---|---|
+| Scraping public web pages | Contract/ToS, trespass, database rights **[V]** | Never authenticate to scrape; never click through terms on the target; honour `robots.txt`; rate-limit; log `{url, timestamp, status, robots snapshot}` |
+| Scraping personal data | EU regulators treat this as high-risk **[V]** | Document a legitimate-interest assessment or do not do it; expect it to be the weakest point in any audit |
+| Selling or licensing data about people who never used you | Data-broker registration + deletion-mechanism duties **[V]** | Ask at design review: "do we sell PI of people who never used us?" If yes: registration, deletion pipeline, real budget |
+| Training on data of unknown provenance | Infringement exposure turns on *how you obtained it* **[V]** | No pirated corpora, ever. Keep provenance records |
+| Bundled images, fonts, icons, UI kits | Stock-photo and font demand letters — high base rate **[V]** | Build-step asset inventory: every image/font needs a row in a checked-in licence manifest with source + licence + receipt. Fail the build on unmatched assets |
+| Dependencies | Copyleft contamination in closed-source SaaS **[V]** | Blocking licence scan in CI denying AGPL/SSPL/GPL/CC-BY-SA/BUSL/unknown; generate an SBOM; ship the attribution notices MIT/Apache actually require |
+
+---
+
+## J. Regulated domains — evaluate before anything else
+
+Any hit here goes to `sector-gates.md` first, because the answer may be "this cannot ship as described".
+
+Health/medical · mental health/therapy · telehealth/prescribing · legal advice · financial/investment advice · tax preparation · insurance · lending/BNPL · money transmission/wallets/crypto · gambling/sweepstakes/prize contests/loot boxes · firearms · alcohol/tobacco/vape/cannabis · pharmacy · adult content · dating/safety · background checks/tenant screening/hiring decisions · credit/housing decisions · children's education · drones/aviation/maritime · export-controlled technology · elections/political ads.
+
+---
+
+## K. Fast severity heuristics
+
+Treat as **BLOCKER** on sight:
+
+1. Secrets, service-role keys, or admin credentials reachable from a client bundle or committed to the repo.
+2. Any table with user data readable or writable without a server-side authorization check on the object (not just the route).
+3. Tracking or ad pixels firing before consent where consent is required.
+4. Children's data collected with no parental-consent path.
+5. Biometric templates persisted with no written release and no retention schedule.
+6. Payment card data touching your server or logs.
+7. Auto-renewing charges with no in-product cancel.
+8. SMS sending with no per-recipient consent record.
+9. User uploads of images with no abuse-reporting or takedown path.
+10. A regulated-domain product with no licence and no disclaimer, presented as the real service.