@raishin/vanguard-frontier-agentic 2.10.0 → 2.13.0

package/skills/sap/sap-datasphere-data-product-architecture/references/official-sources.md

@@ -0,0 +1,85 @@
+# Official sources — SAP Datasphere Data Product Architecture Review
+
+Use this reference when grounding Datasphere space design, data flow and replication flow assessment, semantic model review, data product governance, data access control evaluation, and SAC/HANA Cloud integration assessment.
+
+**Evidence level**: documentation-based (SAP Datasphere Help Portal). No live-system evidence is collected by this skill.
+
+## Spaces and administration
+
+- Spaces in SAP Datasphere
+  https://help.sap.com/docs/sap-datasphere/sap-datasphere/spaces
+  source_owner: SAP SE
+  topic_supported: Space creation, storage quota assignment, user and role assignment to spaces, space-level connection management, space isolation model
+  why_needed: Primary reference for classifying space design governance findings including over-permissive user assignment, quota misconfiguration, and missing isolation between business domains
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Data flows and replication flows
+
+- Data flows in SAP Datasphere
+  https://help.sap.com/docs/sap-datasphere/sap-datasphere/data-flows
+  source_owner: SAP SE
+  topic_supported: Data flow design, transformation operators, scheduling, target table configuration, run status monitoring
+  why_needed: Defines the data flow model used to classify transformation pipeline design findings including missing error handling, incorrect scheduling, and target configuration gaps
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Replication flows in SAP Datasphere
+  https://help.sap.com/docs/sap-datasphere/sap-datasphere/replication-flows
+  source_owner: SAP SE
+  topic_supported: Replication flow design, load type (initial load, delta load, initial and delta), source and target object selection, replication monitor
+  why_needed: Defines the replication flow model distinct from data flows — required to correctly classify delta-load design findings and prevent data flow / replication flow confusion
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Semantic modeling
+
+- Semantic modeling in SAP Datasphere
+  https://help.sap.com/docs/sap-datasphere/sap-datasphere/semantic-modeling
+  source_owner: SAP SE
+  topic_supported: Graphical views, SQL views, semantic usage types (dimension, fact, analytical dataset, relational dataset), analytic model design, measure definition, dimension association, SAC live connection compatibility
+  why_needed: Defines the semantic usage and analytic model object types — required to assess semantic layer completeness for SAC live connection consumption and measure/dimension correctness
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Data products and sharing
+
+- Data products in SAP Datasphere
+  https://help.sap.com/docs/sap-datasphere/sap-datasphere/data-products
+  source_owner: SAP SE
+  topic_supported: Data product definition, output port types (table sharing, data sharing service, Open SQL schema), cross-space data product sharing, external consumer access
+  why_needed: Defines the data product model — required to classify incomplete output port configurations, overly broad sharing scope, and missing data product governance
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Cross-space sharing in SAP Datasphere
+  https://help.sap.com/docs/sap-datasphere/sap-datasphere/cross-space-sharing
+  source_owner: SAP SE
+  topic_supported: Cross-space table and view sharing, sharing scope, read access grants between spaces
+  why_needed: Defines the governed cross-space sharing model — required to distinguish correct cross-space sharing via data products from unauthorized direct access patterns
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Data access controls
+
+- Data access controls in SAP Datasphere
+  https://help.sap.com/docs/sap-datasphere/sap-datasphere/data-access-controls
+  source_owner: SAP SE
+  topic_supported: Data access control (DAC) definition, criteria entity design, DAC assignment to views and analytic models, combination method (AND/OR), user and team DAC value assignment
+  why_needed: Defines the row-level security model — required to classify missing DAC assignments, incorrect combination methods, and incomplete criteria entity definitions as access control findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## What is SAP Datasphere
+
+- What is SAP Datasphere
+  https://help.sap.com/docs/sap-datasphere/sap-datasphere/what-is-sap-datasphere
+  source_owner: SAP SE
+  topic_supported: SAP Datasphere product overview, space model, data layer, business layer, integration with SAC and HANA Cloud
+  why_needed: Provides the product-level context for all architecture assessments; defines the Datasphere space model and integration capabilities
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Datasphere Help Portal documentation describes the designed behavior of spaces, data flows, replication flows, semantic models, data products, and access controls. It does not prove which spaces exist in the user's tenant, which data flows are deployed, or whether DAC rules are correctly configured. Users must supply space configuration exports, model exports, data product definitions, architecture documents, or written descriptions for concrete assessment.

package/skills/sap/sap-datasphere-data-product-architecture/references/safety-checklist.md

@@ -0,0 +1,35 @@
+# Safety checklist — SAP Datasphere Data Product Architecture Review
+
+Use before making any remediation recommendation, especially for findings that affect data access controls, cross-space sharing, or SAC live connection model structure.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live Datasphere tenant, space, data flow execution engine, or connected source system. This skill reviews artifacts only.
+- Do not accept or request Datasphere tenant credentials, space user credentials, OAuth tokens, connection credentials (HANA Cloud, SAP S/4HANA, third-party source), or data access control user assignment files that contain personal data.
+- Do not recommend structural changes to a semantic model consumed via an active SAC live connection without first confirming which SAC stories and models depend on it. Structural changes (removing measures, renaming keys, changing semantic usage) break SAC stories immediately and silently.
+- Do not recommend changing DAC combination methods (AND/OR) without first confirming the intended access rule logic. An incorrect combination method change can grant unintended access to regulated data or lock out legitimate users.
+- Do not recommend reducing space storage quota without first confirming current space utilization. Quota reduction below actual usage terminates running data flows and blocks new data ingestion.
+- Do not conflate data flows (transformation pipelines) with replication flows (bulk/delta replication). Error handling, scheduling, and target table configuration work differently for each. Recommendations designed for one type must not be applied to the other.
+- Do not classify a finding as `critical` without being able to trace the specific data isolation breach or access control failure from user-provided artifacts or official documentation.
+
+## What people get wrong
+
+- **Assuming SAC can consume any Datasphere view via live connection**: SAC live connections to Datasphere require views with specific semantic usage types (analytic model, analytical dataset, or dimension). Graphical views without a recognized semantic usage type are not directly consumable by SAC live connection stories. Recommending a live connection to an unannoted relational view is incorrect.
+- **Confusing table sharing with data product sharing**: Datasphere supports direct table sharing between spaces and data product-governed sharing. Direct table sharing bypasses data product governance and should not be recommended as a primary data distribution pattern — it is intended for ad hoc or internal space federation scenarios.
+- **Treating replication flow delta load and data flow incremental append as equivalent**: Replication flow delta load uses source system change-data-capture (CDC) mechanisms. Data flow incremental append uses a filter on a timestamp or sequence column. They have different failure recovery behaviors and are not interchangeable.
+- **Missing the DAC criteria entity dependency**: A data access control rule requires a correctly structured criteria entity (a view that maps user identifiers to data restriction values). Recommending DAC without confirming the criteria entity exists and returns the correct user identifier attribute leads to silent access grant (all data visible) or silent access denial (no data visible).
+- **Recommending Open SQL schema output port without confirming HANA Cloud connection**: The Open SQL schema output port type requires an active Datasphere-to-HANA Cloud connection. Recommending this output port without confirming the HANA Cloud connection is configured and the schema is shared correctly leads to a non-functional data product.
+- **Ignoring analytic model variable requirements for SAC**: Datasphere analytic models can have mandatory input variables. If an analytic model consumed by SAC has a mandatory variable with no default value, the SAC story will fail to load unless the variable is handled at the story level.
+
+## When to push back
+
+- Push back when the user asks to confirm a data access control finding from a description alone without providing the DAC rule definition, criteria entity structure, or view assignment.
+- Push back when the user asks for specific storage quota numbers without providing current space utilization data.
+- Push back when the user asks to recommend changes to a live SAC connection model without providing the list of SAC stories and models dependent on it.
+- Push back when a request requires live Datasphere tenant access, data flow execution, or connection to a source system — state clearly that live inspection is out of scope and ask the user to supply the relevant exports or descriptions.
+
+## Evidence labels
+
+- `documentation-based` — grounded in SAP Datasphere Help Portal documentation covering spaces, data flows, replication flows, semantic models, data products, data access controls, or SAC/HANA Cloud integration
+- `user-provided evidence` — space configuration exports, data flow screenshots, model exports, data product definitions, architecture documents, or descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence; must always be labeled as such

package/skills/sap/sap-datasphere-data-product-architecture/references/workflow-and-output.md

@@ -0,0 +1,70 @@
+# Workflow and output contract — SAP Datasphere Data Product Architecture Review
+
+Use this reference for all finding classification, risk assignment, remediation path selection, and output formatting.
+
+## Design domain taxonomy
+
+| Domain | Scope | Typical findings |
+|--------|-------|-----------------|
+| `space-design` | Space structure, storage quota, user and role assignment, connection management | Flat single-space design for multi-domain data, over-permissive space user assignment, missing space naming convention, absent quota limits |
+| `data-flows` | Data flow design, transformation operators, scheduling, target table configuration | Missing run error notification, incorrect target table persistence type, missing delta-capable load strategy, scheduling gaps |
+| `replication-flows` | Replication flow design, load type selection, delta replication configuration, replication monitor | Incorrect load type for use case (initial-only when delta is needed), missing replication monitor alerting, incompatible source object selection |
+| `semantic-models` | Graphical views, SQL views, analytic models, semantic usage, star schema structure | Missing semantic usage annotation, incorrect fact-dimension join key, broken star schema, redundant intermediate views, missing analytic model measures |
+| `data-products` | Data product definition, output port configuration, sharing scope | Missing output port definition, overly broad sharing scope, undocumented data product contract, cross-space sharing without data product governance |
+| `data-access-controls` | DAC rule definition, criteria entity design, combination method, user assignment | Missing DAC on multi-tenant views, incorrect AND/OR combination method, orphaned DAC rules not assigned to any view, untested DAC value assignments |
+| `sac-integration` | SAC live vs. import connections, model type compatibility, refresh scheduling | Live connection to a view without compatible semantic usage, import model refresh scheduling gap, broken SAC model after Datasphere view structural change |
+| `hana-cloud-integration` | Remote table access, virtual tables, federation, HANA Cloud storage sharing | Remote table replication vs. federation choice mismatch, missing replication monitoring, virtual access to large tables without partition pruning |
+
+## Risk severity classification
+
+| Risk level | Criteria |
+|-----------|---------|
+| `critical` | Data isolation breach or access control failure: missing DAC on views exposing multi-tenant or regulated data, unauthorized cross-space access bypassing data product governance |
+| `high` | Data architecture failure or pipeline reliability risk: replication flow with incorrect load type causing data loss or duplication, broken analytic model causing SAC story failure, missing output port blocking data product consumption |
+| `medium` | Governance gap or modeling quality gap: missing semantic usage annotation, incorrect star schema structure, undocumented data product contract, SAC import model without refresh schedule |
+| `low` | Best practice deviation: inconsistent space naming, redundant intermediate views, missing data flow run notification for non-critical pipelines |
+
+## Remediation path decision tree
+
+For each finding:
+
+1. **Is this a missing or misconfigured data access control on a view containing multi-tenant or regulated data?**
+   - Yes → `critical`. Add a DAC rule with a correctly defined criteria entity. Assign the DAC to all views and analytic models that expose the regulated data. Verify user DAC value assignments before publishing to SAC.
+   - No → continue.
+
+2. **Is this a cross-space data access that bypasses the data product model?**
+   - Yes → `critical` or `high` depending on whether the access is unauthorized or simply ungoverned. Define a data product with an explicit output port in the source space. Remove any direct cross-space sharing that was not established via a governed data product.
+   - No → continue.
+
+3. **Is this a replication flow with an incorrect load type or a data flow with missing error handling?**
+   - Yes → `high`. For replication flows, confirm the correct load type (initial and delta for ongoing sync; initial load only for one-time migration). For data flows, add run error notification and confirm the target table persistence type matches the pipeline intent (truncate and load vs. append).
+   - No → continue.
+
+4. **Is this a semantic modeling gap blocking SAC live connection compatibility?**
+   - Yes → `high`. Set the correct semantic usage on the view or analytic model (dimension, fact, analytical dataset, or cube). Verify that all measures are correctly typed and that association join keys match dimension key columns.
+   - No → continue.
+
+5. **Is this a governance or observability gap?**
+   - Yes → `medium`. Add missing data product output port definitions, correct star schema join structures, add SAC import model refresh schedules, or document data product contracts.
+   - No → classify as `low` and provide best practice guidance.
+
+## Workflow
+
+1. **Receive artifacts** — space configuration exports, data flow screenshots, semantic model exports, data product definitions, architecture documents, or user descriptions.
+2. **Classify each finding** by design domain and finding type.
+3. **Assign risk level** (critical / high / medium / low).
+4. **Apply remediation decision tree** per finding.
+5. **Prioritize** — critical access control findings first; then high pipeline and modeling failures; then medium governance gaps; then low best-practice items.
+6. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Design domain and specific finding type
+2. Evidence label (documentation-based / user-provided evidence / inference)
+3. Risk level per finding (critical / high / medium / low)
+4. Recommended remediation action with specific implementation guidance
+5. Data architecture posture after remediation
+6. Prioritized remediation sequence
+7. Escalation trigger if live Datasphere tenant access is required to confirm or apply the finding

package/skills/sap/sap-ewm-tm-logistics-execution-review/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: sap-ewm-tm-logistics-execution-review
+description: Review SAP Extended Warehouse Management (EWM) and Transportation Management (TM) execution risk: warehouse process type design, wave and task management controls, slotting and bin assignment governance, freight order and carrier management, dock and yard management controls, shipment execution exception handling, and integration quality with SAP S/4HANA. Flags control gaps in warehouse execution flows, unauthorized goods movement paths, freight settlement leakage, carrier assignment governance weaknesses, and unresolved logistics exceptions. Does not post goods movements, confirm warehouse tasks, release freight orders, or mutate any live EWM or TM system.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: operational
+  lifecycle: experimental
+---
+
+# SAP EWM TM Logistics Execution Review
+
+## Purpose
+
+Assess the execution risk, configuration posture, and control coverage of SAP Extended Warehouse Management (EWM) and SAP Transportation Management (TM) implementations integrated with SAP S/4HANA. Evaluate warehouse process type design by reviewing EWM process types, warehouse process steps, document type configuration, activity area assignments, and whether the warehouse process model supports the required throughput and exception handling without creating unauthorized goods movement paths. Assess wave and task management controls by reviewing wave template design, wave release authorization, task creation rules, task assignment and confirmation controls, labor management integration, and whether tasks can be confirmed without physical goods movement verification. Evaluate slotting and bin assignment governance by reviewing slotting profile configuration, storage type and section search strategy design, bin capacity management, and whether bin assignment logic prevents over-packing, unauthorized bin access, or goods location discrepancies. Review freight order and carrier management controls in SAP TM by assessing freight order document type design, carrier selection rule configuration, routing determination, freight agreement and rate management, carrier assignment authorization, subcontracting controls, and whether unauthorized carrier assignment or freight rate deviation is possible. Assess dock and yard management controls by reviewing dock appointment scheduling governance, yard management zone configuration, gate in/gate out process design, and whether dock and yard processes provide traceability for goods arrival and departure without creating undetected discrepancy paths. Evaluate shipment execution exception handling by reviewing freight unit and freight order exception workflows, proof of delivery (POD) processing controls, claims management configuration, and whether logistics exceptions are tracked, routed, and resolved within target cycle times. Assess EWM–S/4HANA and TM–S/4HANA integration quality by reviewing transfer order and goods movement integration, delivery and shipment document flow, inbound and outbound delivery processing controls, and whether integration failures create inventory accuracy gaps or undetected goods movements in the S/4HANA inventory ledger. Does not connect to or mutate any live SAP EWM, SAP TM, or SAP S/4HANA Inventory system. Never posts goods movements, confirms warehouse tasks, releases freight orders, or creates or modifies shipment documents.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review SAP EWM warehouse process type configuration: process type and process step design, document type assignment, activity area and warehouse process step sequencing, queue assignment for picking, packing, and putaway, and whether the warehouse process model prevents unauthorized goods movements or bypasses of required confirmation steps,
+- assess SAP EWM wave and task management controls: wave template design (wave creation rules, release rules, grouping criteria), wave release authorization, task type assignment, task interleaving configuration, task confirmation controls, labor management integration, and whether tasks can be confirmed without corresponding physical verification or scanning,
+- evaluate SAP EWM slotting and bin assignment: slotting profile configuration, storage section search strategy design, mixed storage restrictions, bin capacity and quantity limits, and whether the bin assignment logic prevents over-packing, unauthorized bin usage, or goods location discrepancies that would cause inventory accuracy failures,
+- review SAP Transportation Management (TM) freight order and carrier management: freight order document type and lifecycle design, carrier selection rule configuration (lane-based, ranking-based, cost-optimized), tender process governance, freight agreement and rate table management, carrier assignment authorization, subcontracting chain controls, and whether unauthorized carrier substitution or freight rate deviation from agreed contracts is possible,
+- assess SAP TM dock and yard management: dock appointment scheduling (inbound/outbound), dock door assignment governance, yard zone and location configuration, gate in/gate out check process, vehicle tracking integration, and whether dock and yard processes provide complete traceability for goods arrival and departure without creating inventory receipt or delivery confirmation gaps,
+- evaluate SAP TM shipment execution exception handling: freight unit and freight order exception categorization workflow, proof of delivery (POD) processing and match-to-order controls, freight claims management configuration, carrier performance exception tracking, and whether logistics exceptions are categorized, escalated, and resolved within target cycle times,
+- assess EWM–S/4HANA integration quality: goods movement integration (transfer order to goods movement posting), delivery document flow (inbound delivery from purchase order, outbound delivery from sales order), posting change order processing, physical inventory integration, and whether EWM-to-S/4HANA integration failures create inventory valuation inaccuracies or undetected goods movements in the S/4HANA material ledger,
+- review TM–S/4HANA integration quality: freight settlement integration with FI-AP (freight cost document creation, accrual posting), shipment cost document transfer, delivery and billing integration for freight charges passed to the customer, and whether TM-to-FI integration gaps create freight cost leakage or unposted freight accruals,
+- identify warehouse and transportation execution SoD exposures: combined authority over goods receipt confirmation and inventory quantity adjustment; combined authority over carrier assignment and freight rate approval; combined authority over transfer order confirmation and physical inventory count; combined authority over POD processing and freight claims settlement.
+
+## When not to use
+
+- When the user needs live inspection of open warehouse tasks, freight orders, carrier assignment logs, or inventory postings — this skill accepts only user-provided configuration summaries, wave analysis reports, inventory discrepancy reports, freight exception logs, carrier assignment reports, or written descriptions of the EWM/TM landscape.
+- When the request concerns SAP S/4HANA Inventory Management (IM) MIGO goods movements in the standard MM/IM model without an EWM integration angle — use `sap-finance-fico-controls-review` or a dedicated MM skills resource for standard inventory management controls.
+- When the request is about SAP Ariba supplier logistics contracts or procurement-driven freight sourcing without an SAP TM execution angle — use `sap-procurement-ariba-value-leakage-review` for procurement and supplier contracting controls.
+- When the request concerns SAP IBP supply chain network planning or demand sensing without a warehouse or transportation execution angle — use `sap-supply-chain-ibp-resilience-review` for IBP planning controls.
+- When the request is specifically about SAP GRC Access Control ruleset design for EWM or TM transaction codes — use `sap-security-iam-grc-sod-review` for GRC ruleset assessment; this skill identifies logistics execution SoD exposures in process terms rather than reviewing the GRC system itself.
+
+## Does not touch live systems
+
+This skill operates on user-provided configuration descriptions, wave analysis reports, inventory discrepancy summaries, freight order exception logs, carrier assignment reports, slotting configuration exports, dock appointment scheduling summaries, EWM/TM integration status reports, or written descriptions of the logistics execution landscape. It does not connect to any SAP EWM system, SAP TM system, SAP S/4HANA Inventory Management system, Fiori launchpad, SAP GUI session, or backend RFC. It does not post goods movements, confirm warehouse tasks, release or modify freight orders, create or cancel delivery documents, adjust inventory quantities, or process proof of delivery.
+
+**This skill never posts goods movements or releases freight orders.** No transfer order creation or confirmation, no goods receipt or goods issue posting, no freight order release or modification, no carrier assignment or substitution, no dock appointment creation, and no inventory quantity adjustment is performed or recommended as a direct action in this skill's execution path. All remediation recommendations describe configuration and process design changes to be implemented and tested in a non-production environment.
+
+## Lean operating rules
+
+- Classify logistics execution control findings before recommending. Every finding must be assigned to a control domain (warehouse process types / wave and task management / slotting and bin assignment / freight order and carrier management / dock and yard management / shipment execution exceptions / EWM–S/4HANA integration / TM–S/4HANA integration / logistics SoD) before a remediation path is proposed.
+- Unauthorized goods movement confirmation is a first-order inventory integrity risk. Any warehouse task confirmation path that does not require physical scanning verification or supervisor override approval for quantity deviations is a `high` inventory accuracy finding.
+- Carrier assignment without rate verification creates freight cost leakage. A TM configuration that allows carrier assignment to override the agreed freight agreement rate without an approval step is a `high` freight cost control finding.
+- EWM–S/4HANA integration failures create invisible inventory gaps. Any EWM goods movement that cannot be posted to the S/4HANA material ledger due to an integration error, and which has no automated error alerting and reprocessing workflow, is a `high` inventory accuracy and financial reporting risk.
+- Wave release authorization must be separate from task confirmation. A warehouse user who can both release waves (initiating goods movement) and confirm individual tasks (completing goods movement) without a supervisory review step has an SoD exposure in the warehouse execution process.
+- Proof of delivery processing must match to the originating shipment. POD records that can be confirmed without matching to the originating freight order or outbound delivery create a revenue recognition and freight settlement gap.
+- Evidence from user-provided artifacts or official SAP EWM, SAP TM, and SAP S/4HANA documentation takes precedence over inference.
+- Load only the reference needed for the logistics execution control domain under review.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in SAP Extended Warehouse Management, SAP Transportation Management, SAP S/4HANA Logistics, or SAP Help Portal EWM/TM documentation
+- `user-provided evidence` — wave analysis reports, inventory discrepancy summaries, freight order exception logs, carrier assignment reports, slotting configuration exports, dock appointment scheduling summaries, integration status reports, or written descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence
+
+## Live-environment rules
+
+**This skill does not touch live systems.** There is no SAP EWM RFC call, SAP TM OData API invocation, Fiori launchpad session, SAP GUI session, BAPI execution, or direct database query in this skill's execution path. Users must supply configuration summaries, wave analysis reports, inventory discrepancy data, freight exception logs, carrier assignment reports, integration status summaries, or written descriptions of their EWM and TM landscape for this skill to review.
+
+**This skill never posts goods movements or releases freight orders.** Recommendations describing remediation always apply to configuration, authorization, or process design — not to direct goods movement posting, transfer order confirmation, freight order release, carrier assignment, inventory adjustment, or proof of delivery processing.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — EWM/TM control finding taxonomy, severity assignment, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common EWM/TM control review mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP Extended Warehouse Management, SAP Transportation Management, and S/4HANA Logistics integration documentation.
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: logistics execution control domain(s) affected (warehouse process types / wave and task management / slotting and bin assignment / freight order and carrier management / dock and yard management / shipment execution exceptions / EWM–S/4HANA integration / TM–S/4HANA integration / logistics SoD) and specific finding(s) per domain.
+- **Evidence used**: documentation-based / user-provided evidence / inference.
+- **Risk level**: critical (undetected goods movement path bypassing all confirmation controls; inventory fraud via combined task confirmation and quantity adjustment authority) / high (unauthorized task confirmation without scanning verification; carrier assignment overriding agreed freight rate without approval; EWM-to-S/4HANA integration failure without alerting; unmatched POD processing; wave release and task confirmation SoD gap) / medium (slotting configuration creating bin capacity overrun risk; dock appointment scheduling gap causing untracked arrivals; freight exception backlog above resolution target; TM-to-FI freight accrual posting gap) / low (best practice deviation in process type design or wave template configuration).
+- **Recommended action**: specific configuration or process remediation per finding (task confirmation scanning enforcement, carrier rate verification approval step, EWM-S/4HANA integration error alerting, POD match-to-order enforcement, wave release SoD role separation, slotting capacity rule correction, dock tracking gap closure, freight exception escalation workflow addition, TM-FI integration reconciliation control, etc.).
+- **Refusal / escalation triggers**: if an undetected goods movement bypass path or combined inventory fraud authorization is found, escalate to the warehouse operations manager, internal audit team, and S/4HANA inventory controller before any further warehouse or transportation transactions are processed. If a finding requires live EWM or TM system inspection, state that clearly and ask the user to supply the relevant configuration export or description.
+- **Business impact**: inventory accuracy and shrinkage risk, freight cost leakage from carrier rate deviation, revenue recognition risk from unmatched POD, financial reporting inaccuracy from EWM-to-S/4HANA integration failure, customer service level impact from wave and task management gaps, regulatory compliance risk for controlled goods, audit finding risk for inventory controls.
+- **Next verification step**: confirm recommended configuration changes against the user's current SAP EWM and TM setup in a non-production system before promoting to production.

package/skills/sap/sap-ewm-tm-logistics-execution-review/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP EWM TM Logistics Execution Review"
+  short_description: "Review SAP Extended Warehouse Management (EWM) and Transportation Management (TM) execution risk: warehouse process types, wave and task management, slotting and bin assignment, freight order and carrier management, dock and yard management, shipment execution exceptions, and EWM/TM integration with S/4HANA. Does not post goods movements, confirm warehouse tasks, release freight orders, or access live logistics systems."
+  default_prompt: "Use $sap-ewm-tm-logistics-execution-review to assess the provided SAP EWM and TM logistics execution control configuration. Classify each finding by logistics execution control domain (warehouse process types, wave and task management, slotting and bin assignment, freight order and carrier management, dock and yard management, shipment execution exceptions, EWM–S/4HANA integration, TM–S/4HANA integration, logistics SoD), assign a risk level (critical/high/medium/low), and recommend specific remediation actions. Flag any undetected goods movement bypass path or combined inventory fraud authorization for immediate escalation. State evidence level (documentation-based, user-provided, inference) and confirm that no live EWM or TM system access, goods movement posting, task confirmation, or freight order release is required or performed."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-ewm/warehouse-process-types"
+      description: "SAP Extended Warehouse Management documentation — primary reference for warehouse process type and task management controls review"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-ewm-tm-logistics-execution-review/metadata.json

@@ -0,0 +1,32 @@
+{
+  "id": "sap-ewm-tm-logistics-execution-review",
+  "name": "SAP EWM TM Logistics Execution Review",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review SAP Extended Warehouse Management (EWM) and Transportation Management (TM) execution risk: warehouse process types, wave and task management, slotting and bin assignment, freight order and carrier management, dock and yard management, shipment execution exceptions, and EWM/TM integration with S/4HANA. Does not post goods movements, confirm warehouse tasks, release freight orders, or access live logistics systems.",
+  "source_type": "original",
+  "category": "operational",
+  "official_docs": [
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-ewm/warehouse-process-types",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-ewm/wave-management",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-ewm/slotting-and-rearrangement",
+    "https://help.sap.com/docs/SAP_TM/sap-transportation-management/freight-order-management",
+    "https://help.sap.com/docs/SAP_TM/sap-transportation-management/dock-and-yard-management",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-ewm/integration-with-sap-s4hana",
+    "https://help.sap.com/docs/SAP_TM/sap-transportation-management/dangerous-goods-management"
+  ],
+  "security_notes": "Does not access live SAP EWM systems, SAP TM systems, SAP S/4HANA Inventory Management, Fiori launchpads, SAP GUI sessions, or any production logistics or warehouse database. Accepts only user-provided configuration exports, wave analysis reports, inventory discrepancy summaries, freight exception logs, carrier assignment reports, integration status summaries, or written descriptions of the EWM and TM landscape. Never request or accept SAP logon credentials, RFC connection details, or direct logistics database access. Never posts goods movements, confirms warehouse tasks, releases freight orders, or adjusts inventory quantities. Inventory fraud or undetected goods movement findings must be escalated to the warehouse operations manager and internal audit team before further transactions are processed.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-ewm-tm-logistics-execution-review",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-ewm-tm-logistics-execution-review/references/official-sources.md

@@ -0,0 +1,79 @@
+# Official sources — SAP EWM TM Logistics Execution Review
+
+Use this reference when grounding warehouse process type assessment, wave and task management control review, slotting and bin assignment evaluation, freight order and carrier management analysis, dock and yard management control assessment, shipment execution exception review, and EWM/TM–S/4HANA integration quality analysis.
+
+**Evidence level**: documentation-based (SAP Help Portal, SAP Extended Warehouse Management documentation, SAP Transportation Management documentation, SAP S/4HANA Logistics documentation). No live-system evidence is collected by this skill.
+
+## EWM warehouse process types and process steps
+
+- SAP Extended Warehouse Management — Warehouse Process Types (On-Premise)
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-ewm/warehouse-process-types
+  source_owner: SAP SE
+  topic_supported: Warehouse process type configuration, process step design, document type assignment, activity area assignment, queue configuration for picking, packing, and putaway operations in SAP EWM
+  why_needed: Primary reference for warehouse process type control review — defines the process type and process step model used to classify unauthorized goods movement path findings and confirmation bypass risks
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## EWM wave and task management
+
+- SAP Extended Warehouse Management — Wave Management (On-Premise)
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-ewm/wave-management
+  source_owner: SAP SE
+  topic_supported: Wave template design, wave creation and release rules, grouping criteria, task type assignment and interleaving, task confirmation controls, labor management integration, and resource assignment in SAP EWM
+  why_needed: Authoritative reference for wave release and task management control assessment — defines the wave template, task creation, and task confirmation model used to classify wave release SoD gaps and task confirmation control findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## EWM slotting and bin management
+
+- SAP Extended Warehouse Management — Slotting and Rearrangement (On-Premise)
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-ewm/slotting-and-rearrangement
+  source_owner: SAP SE
+  topic_supported: Slotting profile configuration, storage type and section search strategy design, bin capacity management, mixed storage restrictions, quantity limits, and bin assignment optimization in SAP EWM
+  why_needed: Defines the slotting and bin assignment control model — required to assess bin capacity governance, unauthorized bin usage risk, and goods location discrepancy findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP TM freight order and carrier management
+
+- SAP Transportation Management — Freight Order Management
+  https://help.sap.com/docs/SAP_TM/sap-transportation-management/freight-order-management
+  source_owner: SAP SE
+  topic_supported: Freight order document type design, carrier selection rule configuration (lane-based, ranking-based, cost-optimized), tender process governance, freight agreement and rate table management, carrier assignment authorization, subcontracting chain controls in SAP TM
+  why_needed: Primary reference for freight order and carrier management control assessment — defines the freight order lifecycle, carrier selection model, and freight agreement design used to classify unauthorized carrier substitution and freight rate deviation findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP TM dock and yard management
+
+- SAP Transportation Management — Dock and Yard Management
+  https://help.sap.com/docs/SAP_TM/sap-transportation-management/dock-and-yard-management
+  source_owner: SAP SE
+  topic_supported: Dock appointment scheduling (inbound/outbound), dock door assignment governance, yard zone and location configuration, gate in/gate out check process, vehicle tracking integration, and goods arrival/departure traceability in SAP TM
+  why_needed: Defines the dock and yard management control model — required to assess dock appointment governance gaps, untracked goods arrival and departure risk, and yard traceability findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## EWM–S/4HANA integration
+
+- SAP EWM Integration with SAP S/4HANA (On-Premise)
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-ewm/integration-with-sap-s4hana
+  source_owner: SAP SE
+  topic_supported: EWM-to-S/4HANA goods movement integration (transfer order to MIGO posting), delivery document flow (inbound delivery from purchase order, outbound delivery from sales order), posting change order processing, physical inventory document integration, and integration error handling in SAP EWM embedded S/4HANA
+  why_needed: Authoritative reference for EWM–S/4HANA integration quality assessment — defines the goods movement integration model and delivery document flow used to classify inventory accuracy gaps and undetected goods movement findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## TM dangerous goods management
+
+- SAP Transportation Management — Dangerous Goods Management
+  https://help.sap.com/docs/SAP_TM/sap-transportation-management/dangerous-goods-management
+  source_owner: SAP SE
+  topic_supported: Dangerous goods classification configuration (UN number, hazard class, packing group), dangerous goods checks at freight order level, ADR/IMDG/IATA regulatory compliance controls, quantity limit enforcement, dangerous goods document generation, and driver/vehicle restriction enforcement in SAP TM
+  why_needed: Defines the dangerous goods management control model — required to classify dangerous goods compliance gaps, missing classification checks, and document generation control deficiencies in freight execution
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Help Portal and S/4HANA EWM/TM documentation describe the designed control model and configuration options for warehouse process types, wave management, slotting, freight order management, dock and yard management, and logistics integration. They do not prove what process types are active in the user's EWM system, whether wave release authorization is separated from task confirmation, whether carrier selection rules enforce freight agreement rates, or whether EWM-to-S/4HANA integration errors are being monitored. Users must supply configuration exports, wave analysis reports, inventory discrepancy data, freight exception logs, carrier assignment summaries, integration status reports, or written descriptions of their EWM and TM landscape for concrete assessment.

package/skills/sap/sap-ewm-tm-logistics-execution-review/references/safety-checklist.md

@@ -0,0 +1,37 @@
+# Safety checklist — SAP EWM TM Logistics Execution Review
+
+Use before making any logistics execution control remediation recommendation, especially for findings involving goods movement confirmation, carrier assignment, freight agreement governance, or EWM/TM–S/4HANA integration.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live SAP EWM system, SAP TM system, SAP S/4HANA Inventory Management system, Fiori launchpad, SAP GUI session, backend RFC, or production logistics or warehouse database. This skill reviews artifacts only.
+- Do not accept or request SAP logon credentials, RFC connection details, warehouse management system API keys, or direct logistics database connectivity.
+- Do not post goods movements, confirm warehouse tasks, release or modify freight orders, create or cancel delivery documents, adjust inventory quantities, process proof of delivery, create dock appointments, or modify carrier assignments. There is no transfer order creation, no MIGO goods movement, no freight order release, no carrier assignment change, no inventory adjustment, and no POD confirmation in this skill's execution path. Recommendations always describe configuration and process design changes, not direct logistics actions.
+- Do not approve, close, or recommend closing an unmitigated critical goods movement bypass finding or inventory fraud authorization finding. Only the warehouse operations manager, internal audit team, and S/4HANA inventory controller with appropriate authority can accept a logistics execution integrity risk. State this explicitly when critical findings are identified.
+- Do not recommend implementing configuration changes (process type modification, wave template rule changes, carrier selection rule updates, freight agreement rate changes) directly in a production SAP EWM or TM system. All recommendations must first be tested in a development or quality system.
+- Do not use memory alone to assert whether a specific combination of SAP EWM or TM authorization objects creates an SoD conflict. Logistics SoD classification must be grounded in user-provided role exports, GRC conflict reports, or official SAP EWM/TM documentation.
+
+## What people get wrong
+
+- **Treating manual task confirmation as equivalent to scan-verified confirmation**: Many EWM implementations allow manual task confirmation as an override for scanning failures. If manual override is available to all warehouse users without supervisory approval, the scanning control is effectively bypassed. Assess whether manual override requires a separate authorization or supervisor sign-off.
+- **Overlooking carrier substitution risk in TM subcontracting**: TM subcontracting chains (where a primary carrier further subcontracts to a secondary carrier) can introduce unauthorized carriers into the shipment execution chain. If the subcontracting relationship is not governed by an approved subcontracting agreement in SAP TM, the actual carrier performing the transport may differ from the contracted carrier without business visibility.
+- **Missing EWM-to-S/4HANA integration error backlog**: EWM integration monitor errors accumulate silently if no alerting is configured. A backlog of unprocessed integration errors means that S/4HANA inventory quantities and values do not reflect actual warehouse stock — a material financial reporting risk that may not be visible in standard inventory reports.
+- **Conflating dock appointment scheduling with actual arrival control**: A dock appointment system only controls planned arrivals. If gate in/gate out processes are not enforced with physical vehicle checks and system-recorded timestamps, unscheduled trucks can unload or load goods outside the appointment window without system visibility.
+- **Assuming slotting optimization is purely operational**: Slotting configurations that allow bin capacity limits to be exceeded create physical risk (over-packed bins, falling goods, safety hazards) and inventory accuracy risk (multiple products recorded in a bin beyond the bin's physical capacity). Slotting capacity governance is both an operational and a control matter.
+- **Overlooking freight claims management as a revenue and cost recovery control**: Unclaimed freight damages, shortages, and overcharges represent a direct cost leakage. If SAP TM claims management is not configured, or if claims are tracked outside the system, the freight cost recovery process is not auditable and is likely incomplete.
+- **Treating POD processing as purely operational**: Proof of delivery confirmation in SAP TM triggers freight settlement, revenue recognition confirmation, and potentially billing to the customer (if freight charges are passed through). POD records that can be confirmed without matching to the originating freight order bypass these downstream financial controls.
+
+## When to push back
+
+- Push back (and escalate) when an undetected goods movement bypass path or combined inventory fraud authorization is found — do not proceed with other recommendations until this is escalated to the warehouse operations manager, internal audit team, and inventory controller.
+- Push back when the user asks to confirm EWM or TM control compliance from memory alone without providing configuration exports, wave analysis data, freight exception logs, or integration status summaries.
+- Push back when the request requires live SAP EWM or TM system access (SAP GUI session, RFC call, Fiori OData API, direct warehouse database query) — state clearly that live inspection is out of scope and ask the user to supply the relevant exports or summaries.
+- Push back when asked to post goods movements, confirm warehouse tasks, release freight orders, modify carrier assignments, or adjust inventory quantities — this is an absolute boundary and must be refused in all circumstances.
+- Push back when asked to approve or close a warehouse or transportation audit finding without operations manager and audit team authorization — this skill is advisory only.
+- Push back when EWM-to-S/4HANA integration errors are identified but the user cannot provide integration monitor status reports or inventory reconciliation data — do not accept that integration is clean without evidence.
+
+## Evidence labels
+
+- `documentation-based` — grounded in SAP Extended Warehouse Management, SAP Transportation Management, SAP S/4HANA Logistics, or SAP Help Portal EWM/TM documentation
+- `user-provided evidence` — warehouse process type configuration summaries, wave analysis reports, slotting configuration exports, inventory discrepancy summaries, freight order exception logs, carrier assignment reports, dock appointment scheduling summaries, EWM/TM integration status reports, or written descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence; must always be labeled as such

package/skills/sap/sap-ewm-tm-logistics-execution-review/references/workflow-and-output.md

@@ -0,0 +1,91 @@
+# Workflow and output contract — SAP EWM TM Logistics Execution Review
+
+Use this reference for all logistics execution control finding classification, risk level assignment, remediation path selection, and output formatting.
+
+## Logistics execution control finding taxonomy
+
+| Domain | Finding class | Description |
+|--------|--------------|-------------|
+| `warehouse-process-types` | `confirmation-bypass-path` | Warehouse process type configuration allows a transfer order or task to be confirmed without a required physical scanning verification or supervisor override for quantity deviations |
+| `warehouse-process-types` | `unauthorized-goods-movement-path` | Warehouse process type permits a goods movement (goods receipt, goods issue, stock transfer) to be triggered without the required upstream document or authorization step |
+| `warehouse-process-types` | `activity-area-assignment-gap` | Activity area assignment does not route tasks to the correct queue for the physical warehouse zone, causing tasks to be executed in the wrong sequence or location |
+| `wave-task-management` | `wave-release-sod-gap` | The same user or role can both release waves (initiating goods movement) and confirm individual tasks (completing goods movement) without a supervisory review step |
+| `wave-task-management` | `task-confirmation-no-scan` | Task confirmation can be performed manually without barcode or RFID scan verification — enables phantom confirmations without physical goods movement |
+| `wave-task-management` | `wave-template-grouping-gap` | Wave template grouping criteria do not align with physical warehouse layout or customer priority rules, causing suboptimal pick paths or SLA-impacting task sequencing |
+| `slotting-bin-assignment` | `bin-capacity-overrun-risk` | Slotting profile or storage section search strategy allows bin quantity limits to be exceeded, creating physical over-packing risk and inventory location accuracy failures |
+| `slotting-bin-assignment` | `mixed-storage-restriction-missing` | Mixed storage restrictions are not configured for incompatible product categories (hazardous materials, temperature-sensitive goods, high-value items), creating regulatory compliance or damage risk |
+| `slotting-bin-assignment` | `unauthorized-bin-access` | Bin assignment logic does not restrict access to high-value or controlled goods storage locations by user role or warehouse process type |
+| `freight-order-carrier-management` | `carrier-rate-deviation-uncontrolled` | TM carrier selection rule allows carrier assignment that deviates from the agreed freight agreement rate without a documented approval step, creating freight cost leakage |
+| `freight-order-carrier-management` | `unauthorized-carrier-substitution` | Freight order can be reassigned to an alternative carrier outside the approved carrier list without a second authorization step — subcontracting risk |
+| `freight-order-carrier-management` | `freight-agreement-governance-gap` | Freight agreement or rate table can be modified without a four-eyes approval, enabling unauthorized rate changes that benefit specific carriers or routing lanes |
+| `dock-yard-management` | `gate-in-gate-out-gap` | Gate in/gate out process does not capture vehicle identity, dock door assignment, or arrival timestamp, creating a gap in goods arrival and departure traceability |
+| `dock-yard-management` | `dock-appointment-governance-gap` | Dock appointments can be scheduled, modified, or cancelled without authorization controls, enabling unauthorized goods arrivals or departures outside scheduled windows |
+| `shipment-execution-exceptions` | `pod-match-to-order-gap` | Proof of delivery (POD) records can be confirmed without matching to the originating freight order or outbound delivery, creating a revenue recognition and freight settlement gap |
+| `shipment-execution-exceptions` | `exception-resolution-backlog` | Freight unit or freight order exceptions are not categorized, escalated, and resolved within target cycle times, indicating a systemic exception management process failure |
+| `shipment-execution-exceptions` | `claims-management-gap` | Freight claims management is not configured or is manually managed outside SAP TM, creating freight cost recovery leakage and carrier accountability gaps |
+| `ewm-s4hana-integration` | `goods-movement-integration-failure` | EWM transfer order confirmation does not trigger the corresponding S/4HANA MIGO goods movement posting — creates invisible inventory discrepancy in the S/4HANA material ledger |
+| `ewm-s4hana-integration` | `integration-error-no-alerting` | EWM-to-S/4HANA integration errors are not monitored with automated alerting and reprocessing workflows — errors can accumulate undetected, causing inventory valuation inaccuracies |
+| `tm-s4hana-integration` | `freight-accrual-posting-gap` | TM freight cost documents are not transferred to FI-AP for accrual posting, creating unbooked freight cost liabilities and understated logistics cost in the P&L |
+| `logistics-sod` | `goods-receipt-quantity-adjustment-combined` | User or role has combined authority to confirm goods receipt and adjust inventory quantities — enables undetected inventory shrinkage or inflation |
+| `logistics-sod` | `carrier-assignment-rate-approval-combined` | User or role has combined authority to assign carriers to freight orders and approve freight agreement rate changes — enables self-serving carrier rate manipulation |
+
+## Risk level assignment
+
+| Risk level | Criteria |
+|-----------|---------|
+| `critical` | Undetected goods movement bypass path circumventing all confirmation controls; combined inventory fraud authority (goods receipt confirmation + quantity adjustment + inventory adjustment release) |
+| `high` | Unauthorized task confirmation without scanning verification; carrier assignment overriding agreed freight rate without approval; EWM-to-S/4HANA integration failure without alerting; unmatched POD processing; wave release and task confirmation SoD gap; freight agreement governance gap |
+| `medium` | Slotting configuration creating bin capacity overrun risk; mixed storage restriction missing for regulated goods; dock appointment governance gap; freight exception backlog above resolution target; TM-to-FI freight accrual posting gap; claims management gap |
+| `low` | Best practice deviation in wave template grouping; minor activity area assignment gap in low-throughput zone; wave template optimization opportunity |
+
+## Remediation path decision tree
+
+For each finding:
+
+1. **Is this an undetected goods movement bypass path circumventing all confirmation controls?**
+   - Yes → `critical`. Escalate immediately to the warehouse operations manager, internal audit team, and S/4HANA inventory controller. Do not process further warehouse transactions until the bypass path is closed. Implement mandatory scanning confirmation for the affected process type and add a supervisor override approval for quantity deviations.
+   - No → continue.
+
+2. **Is this a wave release and task confirmation SoD gap, or combined goods receipt and quantity adjustment authority?**
+   - Yes → `high`. Separate wave release authorization from task confirmation authorization at the role and activity level. Assign task confirmation to a different role than wave release. For inventory quantity adjustment authority, separate goods receipt confirmation from physical inventory adjustment roles.
+   - No → continue.
+
+3. **Is this a carrier rate deviation or freight agreement governance gap?**
+   - Yes → `high`. Add a mandatory approval step for carrier assignment deviating from the agreed freight agreement rate. Implement four-eyes approval for freight agreement and rate table modifications. Restrict carrier substitution authority to a logistics procurement role separate from freight order management.
+   - No → continue.
+
+4. **Is this an EWM-to-S/4HANA integration failure without alerting?**
+   - Yes → `high`. Implement automated integration error monitoring with alert notification to the warehouse controller and S/4HANA inventory team. Establish a reprocessing workflow with a target resolution time. Reconcile any accumulated inventory discrepancies between EWM and S/4HANA.
+   - No → continue.
+
+5. **Is this a POD match-to-order gap or freight accrual posting gap?**
+   - Yes → `high` (POD) or `medium` (freight accrual). For POD: enforce match-to-originating-freight-order validation before POD confirmation. For freight accrual: implement automated transfer of TM freight cost documents to FI-AP and configure accrual reversal on actual invoice receipt.
+   - No → continue.
+
+6. **Is this a slotting, dock management, or exception resolution finding?**
+   - Yes → `medium`. Configure bin capacity limits in the storage type search strategy. Add mixed storage restrictions for regulated product categories. Enforce dock appointment authorization controls. Define exception escalation targets and configure exception monitoring reports.
+   - No → classify as `low` and provide best practice guidance.
+
+## Workflow
+
+1. **Receive artifacts** — warehouse process type configuration summaries, wave analysis reports, slotting configuration exports, inventory discrepancy summaries, freight order exception logs, carrier assignment reports, dock appointment scheduling summaries, EWM/TM integration status reports, or written descriptions of the logistics execution landscape.
+2. **Classify each finding** by logistics execution control domain and finding class.
+3. **Assign risk level** per the table above (critical / high / medium / low).
+4. **Flag critical goods movement bypass findings immediately** — escalate before any other remediation discussion.
+5. **Apply remediation decision tree** per finding.
+6. **Prioritize** — critical bypass and inventory fraud findings first; then high wave/task SoD, carrier rate, and integration findings; then medium slotting, dock, and exception management gaps; then low best-practice items.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Logistics execution control domain and finding class per finding
+2. Evidence label (documentation-based / user-provided evidence / inference)
+3. Risk level per finding (critical / high / medium / low)
+4. Finding detail: affected warehouse, process type, wave template, freight order type, integration channel, role or authorization object (if provided), and specific control gap
+5. Recommended remediation action (scanning enforcement, SoD role separation, carrier rate approval step, freight agreement four-eyes, integration error alerting, POD match enforcement, slotting capacity rule correction, dock tracking gap closure, exception escalation workflow, freight accrual transfer setup, etc.)
+6. Logistics execution control posture after remediation
+7. Escalation notice for any critical goods movement bypass or inventory fraud finding — explicit statement that this requires warehouse operations manager, internal audit team, and inventory controller sign-off before proceeding
+8. Prioritized remediation sequence
+9. Confirmation that no goods movements were posted, no warehouse tasks were confirmed, no freight orders were released, and no inventory quantities were adjusted in this review