@raishin/vanguard-frontier-agentic 2.11.0 → 2.13.1

package/skills/sap/sap-finance-fico-controls-review/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: sap-finance-fico-controls-review
+description: Review SAP S/4HANA Finance (FI-CO) internal controls: document posting controls, account assignment validations and substitutions, period-end close governance, Financial Close Cockpit task management, segregation of duties in financial postings, parallel ledger configuration, and intercompany reconciliation controls. Flags control gaps, mis-configured validation rules, uncontrolled period management, and SoD exposures in financial processes. Does not post financial documents or mutate any live system.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: finance
+  lifecycle: experimental
+---
+
+# SAP Finance FI-CO Controls Review
+
+## Purpose
+
+Assess the internal control posture of SAP S/4HANA Finance (FI-CO) configurations and financial close processes. Evaluate document posting controls including tolerance groups, posting keys, and document type assignments. Review account assignment validation rules and substitution logic for correctness, completeness, and circumvention risk. Assess period-end close governance including fiscal year variant configuration, posting period management, and period open/close authorization controls. Evaluate Financial Close Cockpit (FCC) task list design, task dependencies, and governance workflow. Identify SoD exposures in financial posting processes including combinations of document creation, approval, payment release, and reversal authority. Assess parallel ledger design (Leading Ledger, Reconciliation Ledger, Extension Ledger) for completeness and reconciliation control coverage. Review intercompany process controls including clearing accounts, intercompany reconciliation configuration, and elimination governance. Does not connect to or mutate any live SAP system. Never posts, reverses, or modifies financial documents.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review SAP S/4HANA FI document posting controls: document types, posting keys, tolerance groups, field status groups, and account assignment validation rules,
+- assess SAP FI validations and substitutions configured in transaction OB28 / OBB1 — evaluating logic correctness, callout dependencies, and whether any substitution creates a bypass risk for key control fields (cost center, profit center, business area, tax code),
+- evaluate period-end close governance: fiscal year variant design, posting period variant assignment to company codes, and the authorization model for opening and closing posting periods (transaction OB52, role for S_PERIOD_OPEN or equivalent),
+- review Financial Close Cockpit (FCC) or SAP S/4HANA Financial Close Cockpit task list design — task sequencing, dependency modeling, responsible user or group assignments, and escalation or blocking logic,
+- identify SoD exposures in financial posting processes: users or roles with combined authority to create, approve, pay, and reverse financial documents within the same company code or across company codes,
+- assess parallel ledger configuration: number and purpose of ledgers in the ledger group, whether extension ledgers are used correctly, reconciliation controls between the leading and non-leading ledger, and whether reporting currency differences are explained,
+- review intercompany accounting controls: intercompany clearing account assignment, matching logic in the intercompany reconciliation hub, elimination rule configuration, and whether intercompany postings can be created without a corresponding offsetting entry,
+- evaluate accrual and deferral control: recurring entry configurations, accrual engine use, and whether manual accrual postings are subject to approval and reversal controls,
+- assess journal entry controls in the context of SOX ITGC or internal audit: who can post freely to G/L, whether manual journal entries above a materiality threshold require approval, and whether posting restrictions by document type are enforced.
+
+## When not to use
+
+- When the user needs live inspection of SAP S/4HANA Finance configuration, journal entry lists, or posting period tables — this skill accepts only user-provided configuration exports, screen captures, role lists, validation/substitution descriptions, or written descriptions of the FI-CO landscape.
+- When the request is about SAP Controlling (CO) planning, internal order settlement, or product cost analysis without a financial controls angle — this skill focuses on financial controls, not CO planning methodology.
+- When the request concerns consolidation in SAP S/4HANA Group Reporting — use a dedicated Group Reporting skill; intercompany controls at the entity level are in scope here, but full group-level elimination and consolidation processes are not.
+- When the request is about SAP GRC Access Control ruleset design for FI transaction codes — use `sap-security-iam-grc-sod-review` for GRC ruleset assessment; this skill identifies SoD exposures in FI-CO process terms rather than reviewing the GRC system itself.
+- When the request is specifically about SAP MDG master data quality for FI master data (G/L accounts, cost centers) — use `sap-mdg-master-data-quality-review`.
+
+## Does not touch live systems
+
+This skill operates on user-provided configuration descriptions, validation/substitution rule exports, role and authorization object lists, Financial Close Cockpit task list exports, posting period variant summaries, parallel ledger configuration descriptions, or written descriptions of the FI-CO control landscape. It does not connect to any SAP S/4HANA system, Fiori launchpad, SAP GUI session, or backend RFC. It does not post, reverse, park, or modify any financial document. All live inspection is out of scope.
+
+**This skill never posts financial documents.** No document creation (FB01, F-02, FB50, MIRO, or equivalent), no reversal (FB08, MR8M), no payment run (F110), and no clearing (F-44, F-32) is performed or recommended as a direct action in this skill's execution path. All remediation recommendations describe configuration changes to be implemented and tested in a non-production environment.
+
+## Lean operating rules
+
+- Classify control findings before recommending. Every finding must be assigned to a control domain (document posting controls / validations and substitutions / period management / Financial Close Cockpit / SoD in FI / parallel ledgers / intercompany) before a remediation path is proposed.
+- SoD in financial postings is a first-order risk. Any user or role with combined authority to create financial documents, approve payment runs, and reverse postings within the same company code is a `critical` finding. Escalate before other remediation.
+- Validation and substitution bypass risk must be assessed. A substitution that silently overwrites a key control field (cost center, profit center, tax code, business area) without user notification or approval is a `high` control risk regardless of the business justification.
+- Period management authorization is a key segregation control. The authority to open posting periods (S_PERIOD_OPEN or equivalent in S/4HANA) must be separated from the authority to post documents. Shared authority over both is a `high` control gap.
+- Financial Close Cockpit task lists must have owners and dependencies. A task list with no responsible user or group, with tasks that can be completed in any order without dependency enforcement, or without an escalation path for blocked tasks is a governance gap.
+- Parallel ledger reconciliation gaps require explanation. Any unexplained difference between the leading ledger and a non-leading ledger (local GAAP, IFRS, tax ledger) that is not covered by a documented reconciliation control is a `high` finding.
+- Intercompany postings must require a matching offsetting entry. Intercompany G/L postings that can be created without a corresponding offsetting entry in the partner company code — or without routing through the intercompany reconciliation hub — are a `high` process control gap.
+- Evidence from user-provided artifacts or official SAP S/4HANA Finance documentation takes precedence over inference.
+- Load only the reference needed for the FI-CO control domain under review.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in SAP S/4HANA Finance, SAP Help Portal FI-CO documentation, SAP Financial Closing Cockpit, or SAP audit and compliance guidance
+- `user-provided evidence` — validation/substitution exports, role lists, posting period variant descriptions, FCC task list exports, intercompany configuration summaries, or written descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence
+
+## Live-environment rules
+
+**This skill does not touch live systems.** There is no RFC call, Fiori OData API invocation, SAP GUI session, BAPI execution, or direct database query in this skill's execution path. Users must supply configuration exports, validation/substitution rule descriptions, period management summaries, Financial Close Cockpit task list exports, parallel ledger configuration descriptions, or written accounts of their FI-CO control landscape for this skill to review.
+
+**This skill never posts financial documents.** Recommendations describing remediation always apply to configuration, authorization, or process design — not to direct financial document creation or modification.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — FI-CO control finding taxonomy, severity assignment, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common FI-CO control review mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP S/4HANA Finance, FI-CO controls, Financial Close Cockpit, parallel ledgers, and intercompany documentation.
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: FI-CO control domain(s) affected (document posting controls / validations and substitutions / period management / Financial Close Cockpit / SoD in FI / parallel ledgers / intercompany) and specific finding(s) per domain.
+- **Evidence used**: documentation-based / user-provided evidence / inference.
+- **Risk level**: critical (SoD in financial postings enabling fraud, uncontrolled period management, financial statement misstatement risk) / high (validation bypass, unsupported parallel ledger difference, intercompany imbalance) / medium (FCC governance gap, missing accrual reversal control, incomplete field status) / low (best practice deviation).
+- **Recommended action**: specific configuration or process remediation per finding (validation rule correction, tolerance group tightening, period management role separation, FCC task dependency addition, parallel ledger reconciliation control, intercompany hub routing enforcement, etc.).
+- **Refusal / escalation triggers**: if unmitigated critical SoD conflicts in financial postings are found, escalate to the audit team and GRC team before any further role or access change is authorized. If a finding requires live SAP system inspection, state that clearly and ask the user to supply the relevant export or description.
+- **Business impact**: financial statement integrity risk, SOX ITGC compliance gap, internal audit finding risk, fraud enablement, or period-close efficiency impact.
+- **Next verification step**: confirm recommended configuration changes against the user's current FI-CO setup in a non-production system before promoting to production.

package/skills/sap/sap-finance-fico-controls-review/agents/openai.yaml

@@ -0,0 +1,11 @@
+interface:
+  display_name: "SAP Finance FI-CO Controls Review"
+  short_description: "Review SAP S/4HANA Finance (FI-CO) internal controls: document posting controls, validations and substitutions, period-end close governance, Financial Close Cockpit task management, SoD in financial postings, parallel ledger configuration, and intercompany reconciliation controls. Does not post financial documents or access live systems."
+  default_prompt: "Use $sap-finance-fico-controls-review to assess the provided SAP FI-CO control configuration. Classify each finding by control domain (document posting controls, validations/substitutions, period management, Financial Close Cockpit, SoD in FI, parallel ledgers, intercompany), assign a risk level (critical/high/medium/low), and recommend specific remediation actions. Flag any critical SoD exposures in financial postings for immediate escalation. State evidence level (documentation-based, user-provided, inference) and confirm that no live system access or financial document posting is required or performed."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/general-ledger-accounting"
+      description: "SAP S/4HANA Finance documentation — primary reference for FI-CO controls review"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-finance-fico-controls-review/metadata.json

@@ -0,0 +1,33 @@
+{
+  "id": "sap-finance-fico-controls-review",
+  "name": "SAP Finance FI-CO Controls Review",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review SAP S/4HANA Finance (FI-CO) internal controls: document posting controls, validations and substitutions, period-end close governance, Financial Close Cockpit task management, SoD in financial postings, parallel ledger configuration, and intercompany reconciliation controls. Does not post financial documents or access live systems.",
+  "source_type": "original",
+  "category": "finance",
+  "official_docs": [
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/general-ledger-accounting",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/validations-and-substitutions",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/posting-periods",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/financial-closing-cockpit",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/parallel-ledgers",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/intercompany-reconciliation",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/accrual-management",
+    "https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/document-splitting"
+  ],
+  "security_notes": "Does not access live SAP S/4HANA Finance systems, Fiori launchpads, SAP GUI sessions, or any production financial database. Accepts only user-provided configuration exports, validation/substitution descriptions, role lists, posting period variant summaries, Financial Close Cockpit task list exports, parallel ledger configuration descriptions, or written descriptions of the FI-CO control landscape. Never request or accept SAP logon credentials, RFC connection details, or direct database access. Never posts, reverses, parks, or modifies financial documents. Critical SoD findings in financial postings must be escalated to the audit and GRC team — this skill does not approve access or close audit findings.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-finance-fico-controls-review",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}

package/skills/sap/sap-finance-fico-controls-review/references/official-sources.md

@@ -0,0 +1,89 @@
+# Official sources — SAP Finance FI-CO Controls Review
+
+Use this reference when grounding document posting control assessment, validation and substitution rule review, period-end close governance analysis, Financial Close Cockpit task list evaluation, SoD classification in financial postings, parallel ledger configuration review, and intercompany control assessment.
+
+**Evidence level**: documentation-based (SAP Help Portal, SAP S/4HANA Finance documentation). No live-system evidence is collected by this skill.
+
+## Document posting controls and field status
+
+- SAP S/4HANA Finance — General Ledger Accounting
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/general-ledger-accounting
+  source_owner: SAP SE
+  topic_supported: G/L account master data, document types, posting keys, field status groups, tolerance groups, document posting controls in SAP S/4HANA Cloud
+  why_needed: Primary reference for G/L posting control configuration — defines document type and field status assignment model used to classify posting control findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Validations and substitutions
+
+- Validations and Substitutions (On-Premise)
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/validations-and-substitutions
+  source_owner: SAP SE
+  topic_supported: Validation rule configuration (OB28), substitution rule configuration (OBB1), callout logic, field-level rule activation, prerequisite and check logic for FI documents
+  why_needed: Authoritative reference for assessing validation and substitution rule design correctness, bypass risk, and callout dependencies — required to classify validation findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Posting period management
+
+- Posting Periods (On-Premise)
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/posting-periods
+  source_owner: SAP SE
+  topic_supported: Fiscal year variant configuration, posting period variant assignment to company codes, posting period open/close controls (OB52), account type–level period restrictions
+  why_needed: Defines the posting period management model — required to assess period open/close authorization controls and period management SoD
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Financial Close Cockpit
+
+- Financial Closing Cockpit
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/financial-closing-cockpit
+  source_owner: SAP SE
+  topic_supported: Financial Close Cockpit task list design, task type definitions (manual task, program execution, workflow task), task dependency configuration, responsible user/group assignment, monitoring and escalation
+  why_needed: Primary reference for evaluating FCC task list governance — defines task sequencing, dependency modeling, and responsibility assignment model used to classify close governance findings
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Parallel ledgers and extension ledgers
+
+- Parallel Accounting (On-Premise)
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/parallel-ledgers
+  source_owner: SAP SE
+  topic_supported: Leading ledger, non-leading ledger, extension ledger configuration, ledger-specific posting rules, parallel valuation approaches (IFRS, US GAAP, local GAAP, tax ledger)
+  why_needed: Authoritative source for parallel ledger design assessment — defines the ledger group, ledger assignment, and extension ledger model used to classify parallel accounting control gaps
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Intercompany reconciliation
+
+- Intercompany Reconciliation
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/intercompany-reconciliation
+  source_owner: SAP SE
+  topic_supported: Intercompany G/L clearing account assignment, intercompany reconciliation hub configuration, matching logic, intercompany posting controls in S/4HANA Cloud
+  why_needed: Defines the intercompany reconciliation control model in S/4HANA — required to assess intercompany imbalance risk and elimination control gaps
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Accrual and journal entry controls
+
+- Accrual Management (S/4HANA On-Premise)
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/accrual-management
+  source_owner: SAP SE
+  topic_supported: Accrual object configuration, accrual posting and reversal controls, accrual engine integration with G/L, recurring entry management
+  why_needed: Defines the accrual control model — required to classify manual accrual approval gaps and missing reversal controls in period-end processes
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Financial consolidation and group reporting context
+
+- SAP S/4HANA Group Reporting — Document Splitting
+  https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/s4hana-finance/document-splitting
+  source_owner: SAP SE
+  topic_supported: Intercompany matching rules, reconciliation status, intercompany difference classification, group reporting elimination context
+  why_needed: Provides context for intercompany reconciliation findings at the group level — used to understand downstream impact of entity-level intercompany control gaps on group reporting
+  evidence_level: supplemental
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Help Portal and S/4HANA Finance documentation describe the designed control model and configuration options for FI-CO. They do not prove what validation rules are active in the user's system, what posting period variants are assigned, whether FCC task lists exist, or whether SoD exposures are present in the user's role design. Users must supply configuration exports, validation/substitution descriptions, period management summaries, Financial Close Cockpit task list exports, parallel ledger configuration descriptions, or written descriptions of their FI-CO control landscape for concrete assessment.

package/skills/sap/sap-finance-fico-controls-review/references/safety-checklist.md

@@ -0,0 +1,38 @@
+# Safety checklist — SAP Finance FI-CO Controls Review
+
+Use before making any FI-CO control remediation recommendation, especially for findings involving SoD in financial postings, validation/substitution rule changes, period management, or parallel ledger differences.
+
+## Non-negotiables
+
+- Do not access, connect to, or request access to any live SAP S/4HANA Finance system, Fiori launchpad, SAP GUI session, backend RFC, or production financial database. This skill reviews artifacts only.
+- Do not accept or request SAP logon credentials, RFC connection details, or direct financial database access.
+- Do not post, reverse, park, approve, or modify any financial document. There is no document creation (FB01, F-02, FB50, MIRO, or equivalent), no reversal (FB08, MR8M), no payment run (F110), and no clearing (F-44, F-32) in this skill's execution path. Recommendations always describe configuration changes, not direct financial transactions.
+- Do not approve, close, or recommend closing an unmitigated critical SoD exposure in financial postings. Only the audit team and GRC team with appropriate authority can accept a financial process SoD risk. State this explicitly when critical SoD is found.
+- Do not recommend implementing configuration changes (validation rule edits, tolerance group changes, period variant modifications) directly in a production SAP system. All recommendations must first be tested in a development or quality system.
+- Do not use memory alone to assert whether a specific combination of SAP authorization objects (F_BKPF_BUK, F_BKPF_KOA, F_KNA1_BUK, etc.) creates an SoD conflict. SoD classification must be grounded in user-provided role exports, GRC conflict reports, or official SAP documentation.
+- Do not conflate posting period authorization (S_PERIOD_OPEN or T_REXFI_P) with document posting authorization (F_BKPF_BUK). They are separate authorization objects covering different aspects of the period close control.
+
+## What people get wrong
+
+- **Treating substitutions as always benign**: Substitution rules in OBB1 that silently overwrite cost center, profit center, or tax code fields are often added for efficiency reasons without a control impact assessment. A substitution that overwrites a cost center based on a plant or company code mapping can bypass a required cost center validation, creating an undetected mis-posting.
+- **Overlooking prior-period posting risk**: An open prior-period posting window (e.g., the previous fiscal period remaining open for weeks after month-end close) is a material control risk. Prior-period adjustments should require documented approval, not simply be enabled by the posting period variant remaining open.
+- **Conflating Financial Close Cockpit with financial control completion**: A completed FCC task list only confirms that tasks were marked complete — it does not prove that the underlying financial reconciliations or controls were actually performed correctly. FCC governance and financial control substance are separate layers.
+- **Missing parallel ledger completeness**: Reviews that confirm the leading ledger (IFRS or US GAAP) but do not verify that all parallel non-leading ledgers (local GAAP, tax) are complete and reconciled miss a common audit finding area. Extension ledger postings in particular require review to confirm they are not used to override approved base ledger entries.
+- **Assuming intercompany clearing accounts balance automatically**: Intercompany G/L postings do not automatically create an offsetting entry in the partner company code in all configurations. Without the intercompany reconciliation hub or a strict cross-company code posting configuration, imbalanced intercompany positions can accumulate undetected.
+- **Treating document type as a sufficient posting control**: Document types (DR, KR, SA, etc.) restrict which account types can be posted, but they do not enforce cost object assignment completeness or field-level validation. Field status groups and validation rules provide the substantive field-level control — document type alone is not sufficient.
+- **Ignoring manual journal entry control in the SOX ITGC context**: SOX ITGC controls over financial reporting require that manual journal entries above a materiality threshold be subject to approval. A landscape where all users with G/L posting authority can post manual journal entries without an approval step is a SOX ITGC gap regardless of other compensating controls.
+
+## When to push back
+
+- Push back (and escalate) when a critical SoD exposure in financial postings (create + approve + pay + reverse combined) is found — do not proceed with other recommendations until this is escalated.
+- Push back when the user asks to confirm FI-CO control compliance from memory alone without providing configuration exports, role lists, or validation/substitution descriptions.
+- Push back when the request requires live SAP system access (SAP GUI session, RFC call, Fiori OData API) — state clearly that live inspection is out of scope and ask the user to supply the relevant exports or summaries.
+- Push back when asked to post, reverse, approve, or modify any financial document — this is an absolute boundary and must be refused in all circumstances.
+- Push back when asked to approve or close an audit finding or SoD risk without GRC/audit team authorization — this skill is advisory only.
+- Push back when parallel ledger differences are identified but the user cannot provide a documented reconciliation explanation — do not accept that differences are expected without evidence.
+
+## Evidence labels
+
+- `documentation-based` — grounded in SAP S/4HANA Finance, SAP Help Portal FI-CO documentation, SAP Financial Closing Cockpit documentation, or SAP audit and compliance guidance
+- `user-provided evidence` — validation/substitution exports, role lists, posting period variant descriptions, FCC task list exports, parallel ledger configuration notes, intercompany reconciliation summaries, or written descriptions provided by the user
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence; must always be labeled as such

package/skills/sap/sap-finance-fico-controls-review/references/workflow-and-output.md

@@ -0,0 +1,88 @@
+# Workflow and output contract — SAP Finance FI-CO Controls Review
+
+Use this reference for all control finding classification, risk level assignment, remediation path selection, and output formatting.
+
+## FI-CO control finding taxonomy
+
+| Domain | Finding class | Description |
+|--------|--------------|-------------|
+| `document-posting-controls` | `over-permissive-document-type` | Document type allows posting to account classes that should be restricted for the given business process (e.g., vendor document type usable for G/L-only postings) |
+| `document-posting-controls` | `tolerance-group-gap` | User or G/L account tolerance group permits posting differences or payment differences above the financially material threshold |
+| `document-posting-controls` | `field-status-suppressed-required` | Field status group suppresses a required control field (cost center, profit center, business area, tax code) for an account category where it is a control requirement |
+| `validations-substitutions` | `substitution-silent-overwrite` | Substitution rule silently overwrites a key control field (cost center, profit center, tax code, business area) without user notification or explicit approval step |
+| `validations-substitutions` | `validation-inactive-or-missing` | Validation rule that should prevent an invalid account assignment combination is inactive, missing, or has an incomplete callout chain |
+| `validations-substitutions` | `substitution-bypass-path` | A substitution rule can be triggered to bypass a validation that would otherwise block a posting, creating a control circumvention path |
+| `period-management` | `period-open-close-sod-gap` | The same user or role can both open/close posting periods and post financial documents in the same company code — SoD gap in period management |
+| `period-management` | `unrestricted-prior-period-posting` | Posting periods for prior fiscal periods are open without documented business justification or compensating approval control |
+| `period-management` | `missing-period-variant-assignment` | A company code has no posting period variant assigned, or shares a posting period variant with a company code in a different control boundary |
+| `financial-close-cockpit` | `task-no-owner` | FCC task list task has no responsible user or group assigned — close process has no accountable party for the task |
+| `financial-close-cockpit` | `missing-task-dependency` | FCC task list allows tasks to be completed in any order, including a downstream task being marked complete before its upstream prerequisite is done |
+| `financial-close-cockpit` | `no-escalation-path` | FCC task list has no blocking dependency or notification configured for overdue tasks — close timeline risk has no governance response |
+| `sod-financial-postings` | `create-approve-pay-combined` | User or role has combined authority to create financial documents, approve payment runs, and release payments within the same company code |
+| `sod-financial-postings` | `post-and-reverse-combined` | User or role can both post original financial documents and reverse them — creates undetected error or fraud path |
+| `sod-financial-postings` | `cross-company-code-sod` | User has posting authority in multiple company codes that are in separate control boundaries, enabling artificial intercompany transactions |
+| `parallel-ledgers` | `unexplained-ledger-difference` | Difference between leading ledger and non-leading ledger (local GAAP, IFRS, tax) balance is not explained by a documented reconciliation control |
+| `parallel-ledgers` | `extension-ledger-misuse` | Extension ledger is used to post adjustments that should be in the base ledger, creating a hidden override of approved accounting entries |
+| `intercompany` | `imbalanced-ic-posting` | Intercompany G/L postings can be created without a corresponding offsetting entry in the partner company code or without routing through the reconciliation hub |
+| `intercompany` | `clearing-account-not-reconciled` | Intercompany clearing accounts carry open items that are not matched and reconciled within the expected period — unreconciled intercompany balances at period close |
+
+## Risk level assignment
+
+| Risk level | Criteria |
+|-----------|---------|
+| `critical` | SoD in financial postings enabling fraud (create + approve + pay + reverse); uncontrolled period management SoD; financial statement misstatement risk at material threshold |
+| `high` | Validation bypass or silent substitution of key control field; parallel ledger difference without reconciliation control; imbalanced intercompany posting path; unrestricted prior-period posting without compensating control |
+| `medium` | FCC governance gap (missing owner, missing dependency, no escalation); tolerance group above internal threshold; field status suppression of a recommended control field |
+| `low` | Best practice deviation in document type design; minor field status gap in a low-risk account category; cosmetic FCC task list structure improvement |
+
+## Remediation path decision tree
+
+For each finding:
+
+1. **Is this a critical SoD exposure in financial postings (create + approve + pay + reverse combined)?**
+   - Yes → `critical`. Immediately escalate to the audit team and GRC team. Do not approve or defer without documented compensating control and approver sign-off. State this explicitly in the response. Role redesign is required.
+   - No → continue.
+
+2. **Is this a validation bypass or silent substitution overwrite of a key control field?**
+   - Yes → `high`. Review the substitution rule logic and callout chain. Remove the overwrite for the affected field or add an explicit user notification step. Engage the FI configuration team to correct the rule in a non-production system first.
+   - No → continue.
+
+3. **Is this a period management SoD gap (same user opens periods and posts documents)?**
+   - Yes → `high`. Separate the S_PERIOD_OPEN authorization (or equivalent in S/4HANA) from the F_BKPF_BUK posting authorization. Assign period management authority to a dedicated finance operations user or the Controller role only.
+   - No → continue.
+
+4. **Is this a parallel ledger difference without a reconciliation control?**
+   - Yes → `high`. Document the expected differences (e.g., IFRS vs. local GAAP revaluation, tax depreciation delta). Implement a ledger reconciliation report as a scheduled FCC task. Flag any unexplained residual difference for audit review.
+   - No → continue.
+
+5. **Is this an intercompany imbalance or unmatched clearing account?**
+   - Yes → `high`. Enforce intercompany reconciliation hub routing for all intercompany G/L postings. Add a period-end FCC task requiring reconciliation hub match rate of 100% (or documented exception) before period close sign-off.
+   - No → continue.
+
+6. **Is this a Financial Close Cockpit governance gap?**
+   - Yes → `medium`. Assign a responsible user or group to each unowned task. Add dependency links between prerequisite and downstream tasks. Configure blocking logic or notification for overdue tasks.
+   - No → classify as `low` and provide best practice guidance.
+
+## Workflow
+
+1. **Receive artifacts** — configuration exports, validation/substitution descriptions, period variant summaries, FCC task list exports, parallel ledger configuration notes, intercompany reconciliation summaries, role lists, or user descriptions.
+2. **Classify each finding** by FI-CO control domain and finding class.
+3. **Assign risk level** per the table above (critical / high / medium / low).
+4. **Flag critical SoD exposures in financial postings** immediately — escalate before any other remediation discussion.
+5. **Apply remediation decision tree** per finding.
+6. **Prioritize** — critical SoD exposures first; then high validation/substitution bypass and period management gaps; then high parallel ledger and intercompany findings; then medium FCC and tolerance gaps; then low best-practice items.
+7. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. FI-CO control domain and finding class per finding
+2. Evidence label (documentation-based / user-provided evidence / inference)
+3. Risk level per finding (critical / high / medium / low)
+4. Finding detail: affected configuration object, transaction code, company code, role or user (if provided), and specific control gap
+5. Recommended remediation action (role redesign, validation rule correction, tolerance group tightening, period variant SoD separation, FCC task owner assignment, parallel ledger reconciliation control, intercompany hub routing enforcement, etc.)
+6. FI-CO control posture after remediation
+7. Escalation notice for any critical SoD exposure in financial postings — explicit statement that this requires audit team and GRC team sign-off before proceeding
+8. Prioritized remediation sequence
+9. Confirmation that no financial documents were posted, reversed, or modified in this review

package/skills/sap/sap-fiori-ui5-ux-review/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: sap-fiori-ui5-ux-review
+description: Review SAP Fiori and SAPUI5 applications for Fiori design guidelines adherence, UI5 app structure and MVC correctness, OData consumption patterns, performance, accessibility, and Fiori launchpad integration. Use when assessing Fiori app code, manifest.json, XML views, controllers, OData model binding, or launchpad tile configuration for quality, compliance with SAP UX standards, and readiness for productive use. Does not touch live systems.
+allowed-tools: Read Grep Glob WebSearch WebFetch
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: platform
+  lifecycle: experimental
+---
+
+# SAP Fiori and UI5 UX Review
+
+## Purpose
+
+Assess the quality, correctness, and SAP UX standards compliance of SAP Fiori and SAPUI5 applications. Review app structure for correct MVC separation, component configuration, and manifest.json completeness. Assess XML views, controllers, and fragment design for UI5 best practices. Evaluate OData V2 and V4 model binding for correct consumption patterns, error handling, and batch request strategy. Review adherence to SAP Fiori design guidelines including floorplan selection, responsive design, and accessibility. Assess Fiori launchpad integration: tile configuration, navigation intent, target mapping, and app descriptor correctness. Does not connect to or mutate any live UI5 app runtime, BTP system, or backend OData service.
+
+## When to use
+
+Use this skill when the user asks to:
+
+- review a Fiori app's `manifest.json` (app descriptor) for completeness: data sources, routing configuration, model declarations, component settings, and library dependencies,
+- assess UI5 XML view and fragment design: view nesting correctness, control usage compliance with Fiori design guidelines, missing aggregation bindings, and layout anti-patterns,
+- evaluate controller code: MVC separation of concerns, correct lifecycle hook usage (`onInit`, `onExit`, `onBeforeRendering`, `onAfterRendering`), event handler design, and controller extension patterns,
+- review OData V2 or V4 model consumption: binding paths, batch mode configuration, read/write operation patterns, error handling in `ODataModel`, and filter/sort expression correctness,
+- assess Fiori design guideline adherence: correct floorplan selection (List Report, Object Page, Overview Page, Worklist, Wizard), SAP Fiori Elements usage versus freestyle compliance, header and footer bar patterns,
+- review accessibility compliance: ARIA landmark usage, labeling of form fields and tables, keyboard navigation support, high-contrast theme compatibility, and screen reader compatibility of custom controls,
+- evaluate Fiori launchpad integration: tile configuration, semantic object and action definition, target mapping correctness, cross-application navigation intent, and app descriptor `sap.app` and `sap.ui5` section completeness,
+- identify UI5 performance issues: synchronous loading of UI5 modules, missing `async` component loading, oversized initial payload, missing lazy loading for non-critical views, and unoptimized OData batch grouping.
+
+## When not to use
+
+- When the request is about the CAP backend service layer providing OData — use `sap-cap-architecture-review`.
+- When the request requires live UI5 app inspection, BTP cockpit access, or Fiori launchpad configuration execution — this skill accepts only user-provided code artifacts, manifest files, and written descriptions.
+- When the request is about ABAP-side OData service implementation (CDS views, SEGW service builder, RAP) rather than the UI5 consumer side — use the appropriate ABAP review skill.
+- When the request is about SAP Build Work Zone configuration (site-level configuration, workspace templates) rather than individual app quality.
+
+## Does not touch live systems
+
+This skill operates on user-provided UI5 source files, `manifest.json`, XML views, controller code, fragment files, OData metadata documents (`$metadata`), launchpad tile descriptors, or written descriptions of the Fiori app. It does not connect to any UI5 app runtime, BTP subaccount, ABAP backend, or Fiori launchpad configuration service. All live inspection is out of scope.
+
+## Lean operating rules
+
+- Classify findings by review domain before recommending. Every finding must be assigned to a domain (App Structure / XML View / Controller / OData Consumption / Fiori Design / Accessibility / Launchpad / Performance) before a remediation path is proposed.
+- Fiori design guideline adherence is a first-class concern. A Fiori app that deviates from the correct floorplan for its use case (e.g., using a custom freestyle layout where a List Report or Object Page is the correct pattern) is a `medium` finding. A Fiori app missing required header or footer bar patterns for its floorplan is a `high` finding.
+- Asynchronous component loading is required. A UI5 component that does not declare `async: true` in its `manifest.json` component settings, or that uses synchronous `sap.ui.require` calls in controllers, is a `high` performance finding.
+- OData error handling is required. A controller that calls `ODataModel.read()`, `ODataModel.create()`, or `ODataModel.update()` without an `error` callback is a `high` finding for operational reliability.
+- Accessibility is not optional. Missing ARIA labels on interactive controls, form fields without associated labels, and tables without column headers or row headers are `high` accessibility findings.
+- Direct DOM manipulation in controllers is a `high` finding. Accessing `document.getElementById()` or jQuery DOM selectors in UI5 controllers bypasses the UI5 rendering lifecycle and breaks testability.
+- Evidence from official SAP Fiori design guidelines, SAPUI5/OpenUI5 documentation, and user-provided artifacts takes precedence over inference.
+- Context7-sourced SAPUI5/OpenUI5 documentation is supplementary to official SAP sources. Label it `context7-supplementary`.
+- Load only the reference needed for the review domain in scope.
+
+## Evidence rules
+
+Label all claims with one of:
+
+- `documentation-based` — grounded in official SAP Fiori design guidelines, SAPUI5 API documentation, or SAP Help Portal
+- `user-provided evidence` — manifest files, XML views, controller code, fragment files, OData metadata, tile descriptors, or written descriptions provided by the user
+- `context7-supplementary` — grounded in SAPUI5/OpenUI5 framework documentation fetched from Context7 (supplementary to official SAP Fiori and SAPUI5 docs; applies for MVC patterns, OData model usage, and component configuration)
+- `inference` — derived reasoning not directly confirmed by official docs or user evidence
+
+## Live-environment rules
+
+**This skill does not touch live systems.** There is no UI5 app runtime API call, BTP subaccount access, ABAP backend OData request, Fiori launchpad configuration service call, or BTP cockpit session in this skill's execution path. Users must supply UI5 source files, manifest files, controller code, XML views, OData metadata documents, or written descriptions of their Fiori app for this skill to review.
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — review domain taxonomy, severity classification, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, common Fiori and UI5 review mistakes, when to push back.
+- [Official sources](references/official-sources.md) — SAP Fiori design guidelines, SAPUI5 API docs, Fiori launchpad, OData consumption guides.
+- [Context7 framework docs](references/context7-framework-docs.md) — SAPUI5/OpenUI5 MVC patterns, OData model binding, component configuration, and accessibility (supplementary; applies for this skill).
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: review domain(s) in scope and specific finding(s) per domain.
+- **Evidence used**: documentation-based / user-provided evidence / context7-supplementary / inference.
+- **Risk level**: critical (security or data integrity risk from UI5 app) / high (functional, operational, or accessibility failure) / medium (Fiori design deviation, maintainability gap) / low (best practice deviation or code quality concern).
+- **Recommended action**: specific remediation per finding (add `async: true`, implement OData error callback, add ARIA label, correct floorplan pattern, fix routing configuration, etc.).
+- **Refusal / escalation triggers**: if live UI5 runtime access, BTP deployment, or ABAP backend inspection is required to complete the review, state that clearly and do not proceed.
+- **Business impact**: user experience degradation, accessibility compliance failure, performance regression, launchpad integration failure, or OData consumption reliability risk.
+- **Next verification step**: validate recommended changes against the target SAPUI5 version, Fiori launchpad configuration, and connected OData service metadata before deploying.

package/skills/sap/sap-fiori-ui5-ux-review/agents/openai.yaml

@@ -0,0 +1,14 @@
+interface:
+  display_name: "SAP Fiori and UI5 UX Review"
+  short_description: "Review SAP Fiori and SAPUI5 apps for Fiori design guideline adherence, UI5 MVC correctness, OData consumption, performance, accessibility, and Fiori launchpad integration"
+  default_prompt: "Use $sap-fiori-ui5-ux-review to assess the provided SAP Fiori or SAPUI5 application artifacts. Classify findings by domain (App Structure / XML View / Controller / OData Consumption / Fiori Design / Accessibility / Launchpad / Performance), assign severity (critical / high / medium / low), state evidence level (documentation-based / user-provided evidence / context7-supplementary / inference), and recommend specific remediation per finding. Flag any missing OData error callbacks, synchronous module loading, and accessibility violations as high severity."
+dependencies:
+  tools:
+    - type: "web"
+      value: "https://experience.sap.com/fiori-design-web/"
+      description: "SAP Fiori design guidelines — verify floorplan selection, header/footer bar patterns, and UX compliance"
+    - type: "web"
+      value: "https://ui5.sap.com/#/topic/003f755d46d34dd1bbce9ffe08c8d46a"
+      description: "SAPUI5 App Descriptor (manifest.json) reference — verify component configuration, data sources, routing, and model declarations"
+policy:
+  allow_implicit_invocation: true

package/skills/sap/sap-fiori-ui5-ux-review/metadata.json

@@ -0,0 +1,33 @@
+{
+  "id": "sap-fiori-ui5-ux-review",
+  "name": "SAP Fiori and UI5 UX Review",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Review SAP Fiori and SAPUI5 applications for Fiori design guidelines adherence, UI5 app structure and MVC correctness, OData consumption patterns, performance, accessibility, and Fiori launchpad integration. Does not access live systems.",
+  "source_type": "original",
+  "category": "platform",
+  "official_docs": [
+    "https://experience.sap.com/fiori-design-web/",
+    "https://ui5.sap.com/#/topic/003f755d46d34dd1bbce9ffe08c8d46a",
+    "https://ui5.sap.com/#/topic/958ead51e2e94ab8bcdc90fb7e9d53d0",
+    "https://ui5.sap.com/#/topic/91f0a22d6f4d1014b6dd926db0e91070",
+    "https://ui5.sap.com/#/topic/68b9644a253741e8a4b9e4279a35c247",
+    "https://help.sap.com/docs/SAP_FIORI_LAUNCHPAD/fd8d03d7-14b9-40f7-9a07-1a594f20ac8d/what-is-sap-fiori-launchpad",
+    "https://ui5.sap.com/#/topic/5338bd1f9afb45fb8b2af957c3530e8f",
+    "https://ui5.sap.com/#/topic/c9ab34570cc14ea5ab72a6d1a4a03e3f"
+  ],
+  "security_notes": "Does not access live UI5 app runtimes, BTP subaccounts, ABAP backends, or Fiori launchpad configuration services. Accepts only user-provided UI5 source files, manifest.json, XML views, controller code, fragment files, OData metadata documents, or written descriptions. Never request or accept BTP service keys, ABAP system credentials, OAuth tokens, or OData service passwords. Fiori apps that use custom controls to bypass SAPUI5 rendering lifecycle should be flagged for security review if they manipulate DOM directly.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-fiori-ui5-ux-review",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental"
+}