@raishin/vanguard-frontier-agentic 2.9.0 → 2.11.0

package/skills/cross-functional/change-request-to-go-live-protocol/metadata.json

@@ -0,0 +1,21 @@
+{
+  "id": "change-request-to-go-live-protocol",
+  "name": "Change Request to Go-Live Protocol",
+  "type": "skill",
+  "provider": "generic",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Defines the end-to-end change-to-go-live lifecycle for Dynamics 365 implementations aligned to the Microsoft Success by Design framework — from change request intake and impact/fit-gap assessment through Solution Blueprint Review, UAT sign-off, go-live readiness review, go/no-go decision, cutover execution, and hypercare. Enforces mandatory gates at UAT sign-off, go/no-go, and rollback decision points. All production-impacting actions (go-live, cutover, deployment) require human authorization from the project sponsor and release manager.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/dynamics365/guidance/implementation-guide/success-by-design",
+    "https://learn.microsoft.com/dynamics365/guidance/implementation-guide/prepare-to-go-live",
+    "https://learn.microsoft.com/dynamics365/guidance/fasttrack/go-live-workshops",
+    "https://learn.microsoft.com/dynamics365/guidance/implementation-guide/prepare-go-live-checklist",
+    "https://learn.microsoft.com/dynamics365/guidance/implementation-guide/change-management-transition-handover"
+  ],
+  "security_notes": "Protocol is recommendation and orchestration only — never an authorization for go-live, cutover execution, or production deployments. All production-impacting decisions (go/no-go, cutover initiation, rollback authorization) require explicit human approval from the project sponsor and release manager, recorded before any action is initiated. UAT sign-off is mandatory and cannot be bypassed. Rollback criteria must be defined before go-live begins; any blocking issue meeting rollback criteria requires immediate human escalation rather than a continue-over-risk decision by any agent. Never requests credentials, service principal secrets, tenant IDs, or production customer data to assess go-live readiness; works from sanitized test results, checklist signals, and change request documentation only.",
+  "last_verified": "2026-06-16",
+  "path": "skills/cross-functional/change-request-to-go-live-protocol",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/cross-functional/close-to-report-protocol/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: close-to-report-protocol
+description: Use this skill to coordinate the financial period close and reporting process across Dynamics 365 Finance and Microsoft Fabric / Power BI. It orchestrates subledger close, general ledger reconciliation, currency revaluation, consolidation, financial statement preparation, and report certification. The skill defines stage gates for subledger close, reconciliation sign-off, and report certification, and enforces structured handoffs between d365-finance-close-to-report-agent and fabric-power-bi-business-insights-governance-agent. It does not post journal entries, modify financial data, certify financial statements, or access live ledger credentials; all production-impacting steps are escalated to the relevant specialist or human finance owner.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-16"
+  category: finance
+  lifecycle: experimental
+---
+
+# Close-to-Report Protocol
+
+## Purpose
+This skill orchestrates the financial period close and reporting process in Microsoft Dynamics 365 Finance environments, with downstream coordination to Microsoft Fabric and Power BI for business insights and report distribution. It coordinates the transition from an open accounting period through subledger close, general ledger reconciliation, adjustments, consolidation, financial statement preparation, and certified report publication. The protocol exists so that closing tasks are sequenced correctly, no reconciliation step is skipped, and report data is not published before financial close is certified by the responsible finance owner.
+
+## When to use
+- A month-end, quarter-end, or year-end financial period close must be orchestrated across multiple modules.
+- Subledger close, bank reconciliation, currency revaluation, and ledger reconciliation must be sequenced and tracked.
+- Consolidated financial statements must be prepared across multiple legal entities.
+- Power BI financial reports must not be refreshed with uncertified period data.
+- A cross-module reconciliation discrepancy is detected and must be investigated before close certification.
+
+## When NOT to use
+- The matter is a single-module posting question — route to the Dynamics 365 Finance specialist.
+- The ask involves tax return preparation or external audit coordination — escalate to the finance owner and external advisors.
+- Budget vs. actual analysis is required without a period close event — use Fabric / Power BI governance skill directly.
+- The matter involves procurement or sales order financial entries that are not yet posted — resolve upstream first.
+
+## Participating agents
+- d365-finance-close-to-report-agent — owns all period-close tasks in Dynamics 365 Finance: subledger posting, reconciliation, revaluation, consolidation, and financial statement preparation
+- fabric-power-bi-business-insights-governance-agent — owns report certification, data refresh governance, and distribution of certified financial reports via Microsoft Fabric and Power BI
+
+## Inputs required
+- Period end date and fiscal period identifier
+- Legal entity or consolidation group scope
+- Close checklist template reference from Dynamics 365 Finance period close workspace
+- Materiality threshold for reconciliation discrepancy escalation
+- Report distribution list and certification sign-off owner
+
+## Evidence required
+- Subledger close confirmation for: Accounts Receivable, Accounts Payable, Fixed Assets, Inventory, and Project Operations (as applicable)
+- Bank reconciliation sign-off
+- Currency revaluation run confirmation with FX rates source
+- Ledger-to-subledger reconciliation report showing zero unexplained differences
+- Consolidation and elimination journal posting confirmation (multi-entity scenarios)
+- Finance owner sign-off on financial statements before report publication
+
+## Workflow
+1. Open the financial period close workspace in Dynamics 365 Finance; load the applicable close template for the period type (month-end, quarter-end, year-end).
+2. Execute subledger close tasks in sequence: Accounts Payable, Accounts Receivable, Fixed Assets, Inventory, and Project Operations.
+3. Perform bank reconciliation for all bank accounts in scope; escalate any unexplained reconciling items above the materiality threshold.
+4. Run currency revaluation for all foreign-currency accounts; validate source FX rates against an approved reference.
+5. Perform ledger-to-subledger reconciliation; confirm zero unexplained differences. Any difference halts the process.
+6. Subledger close gate: d365-finance-close-to-report-agent confirms all subledger modules are closed and reconciled.
+7. Post period-end accruals, adjustments, and eliminations as required; document all manual journal entries with supporting evidence.
+8. For multi-entity environments: run consolidation, intercompany eliminations, and minority interest calculations.
+9. Prepare draft financial statements: balance sheet, income statement, and cash flow statement.
+10. Reconciliation sign-off gate: finance owner reviews and approves the reconciliation package.
+11. Invoke fabric-power-bi-business-insights-governance-agent to refresh certified financial data in Microsoft Fabric; lock the reporting period to prevent further edits.
+12. Report certification gate: finance owner certifies financial statements before reports are distributed.
+13. Distribute certified financial reports via Power BI; record distribution event with timestamp and recipient list.
+
+## Decision gates
+| Gate | Condition | Action if not met |
+|---|---|---|
+| Subledger close | All subledgers closed with zero unexplained differences | Halt general ledger close; escalate to subledger owner |
+| Bank reconciliation | All bank accounts reconciled with documented items | Halt; escalate unexplained items above materiality threshold to finance owner |
+| Currency revaluation | Revaluation run confirmed with approved FX rates | Hold close; validate rate source |
+| Ledger-to-subledger match | Zero unexplained difference | Halt; investigate and resolve before proceeding |
+| Reconciliation sign-off | Finance owner approved the reconciliation package | Do not prepare or publish financial statements |
+| Report certification | Finance owner certified statements as accurate | Block fabric-power-bi-business-insights-governance-agent from publishing reports |
+
+## Refusal triggers
+- Financial statements are requested for distribution before reconciliation sign-off — refuse.
+- A manual journal entry is requested without supporting documentation and human approval — refuse.
+- A reporting period is requested to be re-opened after financial close certification — escalate; do not re-open without documented approval.
+- Live ledger credentials, chart of accounts details, or intercompany elimination schedules with actual figures are requested by an agent — refuse; escalate.
+- A consolidation adjustment is requested to be backdated — refuse; escalate to the finance controller.
+
+## Handoff rules
+- d365-finance-close-to-report-agent produces the reconciliation package and certified close confirmation before fabric-power-bi-business-insights-governance-agent may refresh or publish any financial data.
+- Every handoff carries a capsule: matter_id, period_id, current_stage, gate_outcomes, open_questions, do_not_do_list.
+- Report publication is blocked until the report certification gate is passed.
+- All manual journal entries are logged separately with author, approver, business reason, and supporting document reference.
+
+## KPIs
+- Period close cycle time (period end date to final close certification)
+- Reconciliation first-pass rate (% of accounts reconciled without human intervention)
+- Number of post-close adjustments (target: zero material adjustments post-certification)
+- Report certification lead time (time from close completion to certified report distribution)
+- Audit finding rate related to period close (target: zero repeat findings)
+
+## References
+- [Close financial periods — Dynamics 365 Finance record-to-report](https://learn.microsoft.com/dynamics365/guidance/business-processes/record-to-report-close-financial-periods)
+- [Financial period close workspace — Dynamics 365 Finance](https://learn.microsoft.com/dynamics365/finance/general-ledger/financial-period-close-workspace)
+- [Record to report business process areas overview](https://learn.microsoft.com/dynamics365/guidance/business-processes/record-to-report-areas)
+- [Configure and perform periodic processes in Dynamics 365 Finance (training)](https://learn.microsoft.com/training/modules/configure-periodic-processes-dyn365-finance/)

package/skills/cross-functional/close-to-report-protocol/metadata.json

@@ -0,0 +1,19 @@
+{
+  "id": "close-to-report-protocol",
+  "name": "Close-to-Report Protocol",
+  "type": "skill",
+  "provider": "generic",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Orchestration protocol for the financial period close and reporting process in Dynamics 365 Finance and Microsoft Fabric / Power BI environments. Sequences subledger close, bank reconciliation, currency revaluation, ledger reconciliation, consolidation, and financial statement preparation. Enforces subledger close, reconciliation sign-off, and report certification gates. Coordinates d365-finance-close-to-report-agent (all Dynamics 365 Finance close tasks) and fabric-power-bi-business-insights-governance-agent (certified report publication via Microsoft Fabric and Power BI).",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/dynamics365/guidance/business-processes/record-to-report-close-financial-periods",
+    "https://learn.microsoft.com/dynamics365/finance/general-ledger/financial-period-close-workspace",
+    "https://learn.microsoft.com/dynamics365/guidance/business-processes/record-to-report-areas"
+  ],
+  "security_notes": "This protocol is a recommendation and orchestration guide only — it is never an authorization to post journal entries, modify financial data, re-open closed periods, or certify financial statements. All production-impacting steps require confirmation by the relevant human finance owner. The protocol never requests live ledger credentials, chart of accounts with actual balances, consolidation schedules with customer-level data, or tenant IDs. Report publication via fabric-power-bi-business-insights-governance-agent is blocked until the finance owner completes reconciliation sign-off and report certification. Manual journal entries without supporting documentation and human approval are refused. Backdated consolidation adjustments are refused and escalated.",
+  "last_verified": "2026-06-16",
+  "path": "skills/cross-functional/close-to-report-protocol",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/cross-functional/close-to-report-protocol/references/workflow-and-output.md

@@ -0,0 +1,185 @@
+# Close-to-Report Protocol — Workflow and Output Contract
+
+## Overview
+This document provides the detailed step-by-step workflow, decision tree, and output contract for the close-to-report-protocol skill. It covers the full financial period close sequence from the opening of the close workspace through certified report distribution in Microsoft Fabric and Power BI.
+
+---
+
+## Detailed Step-by-Step Workflow
+
+### Phase 1 — Period Close Workspace Initialization (d365-finance-close-to-report-agent)
+
+**Step 1.1 — Load close template**
+- Open the Financial Period Close workspace in Dynamics 365 Finance.
+- Select the appropriate close template for the period type: month-end, quarter-end, or year-end.
+- Verify that all task assignments, due dates, and dependencies in the template are current.
+- Confirm the period end date and legal entities in scope.
+
+**Step 1.2 — Pre-close validation**
+- Confirm that all sales orders, purchase orders, and project transactions that should be in the period have been posted.
+- Identify any unposted transactions that require attention before subledger close.
+- Surface a pre-close readiness summary to the finance owner; do not begin subledger close until the owner confirms readiness.
+
+---
+
+### Phase 2 — Subledger Close (d365-finance-close-to-report-agent)
+
+**Step 2.1 — Accounts Payable close**
+- Confirm all vendor invoices for the period are posted.
+- Run vendor aging report; confirm no unexpected open items.
+- Mark Accounts Payable subledger as closed for the period.
+
+**Step 2.2 — Accounts Receivable close**
+- Confirm all customer invoices, credit memos, and cash applications for the period are posted.
+- Run customer aging report; confirm AR balance against the general ledger.
+- Mark Accounts Receivable subledger as closed for the period.
+
+**Step 2.3 — Fixed Assets close**
+- Run depreciation for all fixed asset books for the period.
+- Post depreciation journals.
+- Reconcile fixed asset net book value to the general ledger balance.
+
+**Step 2.4 — Inventory close**
+- Run inventory close or cost adjustment in Dynamics 365 Supply Chain Management.
+- Confirm that inventory transaction costs are settled and inventory value agrees to the general ledger.
+
+**Step 2.5 — Project Operations close (if applicable)**
+- Post all project costs, revenue recognition, and WIP adjustments for the period.
+- Confirm project subledger agrees to the general ledger.
+
+**Subledger close gate:**
+- d365-finance-close-to-report-agent must confirm that all applicable subledgers are closed before proceeding to general ledger activities.
+- Any open subledger item above the materiality threshold halts the process.
+
+---
+
+### Phase 3 — Reconciliation and Adjustments (d365-finance-close-to-report-agent)
+
+**Step 3.1 — Bank reconciliation**
+- Run automated bank statement matching for all bank accounts.
+- Investigate and document all unmatched items.
+- Escalate any unexplained reconciling item above the materiality threshold to the finance owner.
+- Record bank reconciliation sign-off for each account.
+
+**Step 3.2 — Currency revaluation**
+- Run foreign currency revaluation for all applicable accounts (AR, AP, bank, intercompany).
+- Validate the FX rate source against the approved external reference (e.g., European Central Bank or configured rate provider).
+- Post revaluation adjustments; confirm posting with supporting rate documentation.
+
+**Step 3.3 — Ledger-to-subledger reconciliation**
+- Run the trial balance and compare general ledger balances to each subledger summary.
+- Zero unexplained differences required. Any difference halts the close process.
+- Document all reconciling items with business reason and resolution.
+
+**Step 3.4 — Period-end accruals and adjustments**
+- Post all approved accrual and deferral journals.
+- Every manual journal entry must have: business reason, supporting document, preparer identity, and human approver confirmation.
+- Reject any manual journal entry without complete documentation.
+
+---
+
+### Phase 4 — Consolidation (d365-finance-close-to-report-agent, multi-entity only)
+
+**Step 4.1 — Intercompany eliminations**
+- Identify all intercompany balances across legal entities.
+- Post elimination journals to remove intercompany revenues, costs, receivables, and payables.
+- Confirm eliminations net to zero.
+
+**Step 4.2 — Consolidation run**
+- Run financial consolidation in Dynamics 365 Finance.
+- Validate that the consolidated trial balance is complete and all entities are included.
+
+---
+
+### Phase 5 — Financial Statement Preparation and Sign-off (d365-finance-close-to-report-agent + human)
+
+**Step 5.1 — Draft financial statements**
+- Generate draft balance sheet, income statement, and cash flow statement.
+- Run standard analytical checks: significant period-over-period variances, unusual account balances.
+- Surface variance explanations to the finance owner for review.
+
+**Step 5.2 — Reconciliation sign-off gate**
+- Finance owner reviews the reconciliation package and draft financial statements.
+- This gate must be explicitly passed before any report data is released to fabric-power-bi-business-insights-governance-agent.
+- Sign-off is recorded with timestamp and owner identity.
+
+---
+
+### Phase 6 — Report Publication (fabric-power-bi-business-insights-governance-agent)
+
+**Step 6.1 — Data refresh governance**
+- fabric-power-bi-business-insights-governance-agent receives the certified close confirmation from d365-finance-close-to-report-agent.
+- Refresh financial datasets in Microsoft Fabric with certified period data.
+- Lock the reporting period to prevent further data changes.
+
+**Step 6.2 — Report certification gate**
+- Finance owner certifies the published reports as accurate before distribution.
+- Reports are marked with certification timestamp, period, and certifying owner.
+
+**Step 6.3 — Distribution**
+- Distribute certified reports to the defined recipient list via Power BI.
+- Record distribution event: timestamp, recipients, report version, and certifying owner.
+
+---
+
+## Decision Tree
+
+```
+START: Period end date reached
+│
+├─ All transactions posted (pre-close readiness)?
+│   └─ NO → SURFACE to finance owner; do not begin subledger close
+│
+├─ All subledgers closed with zero unexplained differences?
+│   └─ NO → HALT; escalate to subledger owner
+│
+├─ Bank accounts reconciled?
+│   └─ NO (unexplained items above threshold) → HALT; escalate to finance owner
+│
+├─ Currency revaluation complete with approved FX rates?
+│   └─ NO → HOLD; validate rate source
+│
+├─ Ledger-to-subledger reconciliation: zero differences?
+│   └─ NO → HALT; investigate and resolve
+│
+├─ All manual journals documented and approved?
+│   └─ NO → REJECT; require documentation
+│
+├─ Consolidation and eliminations complete (multi-entity)?
+│   └─ NO → HOLD; complete consolidation
+│
+├─ Reconciliation sign-off from finance owner?
+│   └─ NO → BLOCK report data release to Fabric/Power BI
+│
+├─ Report certification from finance owner?
+│   └─ NO → BLOCK distribution
+│
+└─ Distribution complete?
+    └─ YES → CLOSE period; record audit trail
+```
+
+---
+
+## Output Contract
+
+Every execution of this protocol produces a structured output capsule:
+
+| Field | Type | Description |
+|---|---|---|
+| matter_id | string | Unique identifier for this close-to-report instance |
+| period_id | string | Fiscal period identifier (e.g., 2026-06) |
+| legal_entities | array | Legal entities in scope |
+| current_stage | enum | One of: initialization, subledger_close, reconciliation, consolidation, financial_statements, report_publication, closed |
+| gate_outcomes | object | Pass/fail/escalated: subledger_close, bank_recon, fx_revaluation, ledger_recon, recon_signoff, report_certification |
+| agents_involved | array | Agent IDs that participated |
+| escalations | array | Each escalation: {trigger, timestamp, escalated_to, reason} |
+| open_questions | array | Unresolved items requiring human input |
+| do_not_do_list | array | Actions explicitly prohibited in the current state |
+| evidence_quality | enum | high / medium / low |
+| privilege_sensitivity | boolean | True if statements contain material non-public financial data |
+| last_updated | ISO8601 timestamp | When the capsule was last updated |
+
+---
+
+## Audit Log Fields
+- matter_id, skill_id, skill_version, invoked_by, period_id, input_hash, evidence_quality, output_verdict, escalation_fired, recon_signoff_recorded, report_certification_recorded, timestamp

package/skills/cross-functional/copilot-data-readiness-protocol/SKILL.md

@@ -0,0 +1,142 @@
+---
+name: copilot-data-readiness-protocol
+description: Use this skill before enabling Microsoft 365 Copilot for any user population. Runs an oversharing assessment, applies sensitivity labels and DLP controls, validates permissions baseline, and confirms a secure data foundation exists. Orchestrates m365-copilot-readiness-governance-agent as primary, m365-identity-zero-trust-agent for identity-layer controls, and copilot-governance-maestro-agent for cross-pillar sign-off. Hard refusal: Microsoft 365 Copilot must not be enabled for any user until the oversharing baseline is established and remediated. Never requests credentials, tenant IDs, or customer data. Production-impacting steps escalate to the relevant data owner or compliance team.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-16"
+  category: ai
+  lifecycle: experimental
+---
+
+# Copilot Data Readiness Protocol
+
+## Purpose
+Microsoft 365 Copilot surfaces content that users already have permission to
+access. If that content is over-shared, unlabelled, or poorly governed, Copilot
+amplifies the exposure. This skill defines the mandatory readiness sequence that
+must complete before Copilot is enabled: oversharing baseline, sensitivity
+labelling, DLP guardrails, and a permissions baseline sign-off. It exists so
+organisations never enable Copilot into an ungoverned data estate. It does not
+configure production systems; it produces structured recommendations that data
+owners and security teams confirm.
+
+## When to use
+- An organisation is planning to enable Microsoft 365 Copilot for the first time.
+- Copilot is expanding to new user groups and the data estate for those users
+  has not been assessed.
+- A periodic data readiness review is due for an active Copilot deployment.
+- An oversharing alert has been raised by Microsoft Purview DSPM and must be
+  assessed before Copilot access continues.
+
+## When NOT to use
+- Copilot is already enabled and this is a routine operational review with no
+  new user groups — use the periodic governance review workflow instead.
+- The matter is a data breach or security incident — route to the incident
+  response protocol.
+- The organisation has not yet deployed Microsoft Purview or SharePoint Advanced
+  Management — prerequisites are not met; this protocol cannot proceed.
+- You need live tenant configuration changes — escalate to the data owner;
+  this protocol is recommendation-only.
+
+## Participating agents
+- `m365-copilot-readiness-governance-agent` (primary — oversharing assessment, sensitivity labels, DLP, permissions baseline)
+- `m365-identity-zero-trust-agent` (secondary — Conditional Access, identity-layer least privilege)
+- `copilot-governance-maestro-agent` (cross-pillar sign-off and final readiness gate)
+
+## Inputs required
+- Tenant-level SharePoint sharing settings and EEEU (Everyone except external
+  users) status
+- Microsoft Purview DSPM Data Risk Assessment output (or permission to run one)
+- SharePoint Advanced Management (SAM) Content Management Assessment output
+- List of user groups proposed for Copilot enablement
+- Existing sensitivity label taxonomy and publishing scope
+- DLP policy inventory for Microsoft 365 workloads
+
+## Evidence required
+- Microsoft Purview is deployed and DSPM is active
+- SharePoint Advanced Management is licensed and configured
+- Sensitivity labels are published to users in scope
+- Purview Audit is enabled for Copilot interaction activity
+- A data owner is identified for each high-risk site
+
+## Workflow
+
+1. **Oversharing baseline** — Run (or review) the Microsoft Purview DSPM Data
+   Risk Assessment and SAM Content Management Assessment. Identify sites with
+   EEEU access, broken permission inheritance, ownerless sites, inactive sites,
+   and sensitive content exposed broadly.
+2. **Interim protections** — Before remediating, apply SAM Restricted Content
+   Discovery (RCD) to exclude high-risk sites from Copilot discovery. Apply
+   Purview DLP policies scoped to the Copilot location to exclude sensitive
+   content from grounding.
+3. **Sensitivity label review** — Confirm that sensitivity labels are published
+   to all users in scope. Identify content lacking labels on high-risk sites.
+   Draft labelling recommendations for data owners.
+4. **Permissions remediation** — For sites flagged as high-risk: remove
+   excessive access and company-wide sharing links, correct broken inheritance,
+   rescope sharing to approved users or groups, confirm site ownership.
+5. **Gate 1 — Oversharing remediation sign-off** — Confirm that all
+   critical-risk sites have been remediated or have accepted interim protections.
+   Do not proceed to Copilot enablement without this sign-off from the data
+   owner and copilot-governance-maestro-agent.
+6. **Identity layer check** — Invoke m365-identity-zero-trust-agent to confirm
+   that Conditional Access policies for Copilot users enforce MFA and device
+   compliance. Flag any gaps.
+7. **DLP guardrails** — Confirm DLP policies cover the Copilot location and
+   are actively monitoring sensitive content interactions. Validate Insider Risk
+   Management (IRM) adaptive protection is configured for high-risk users.
+8. **Gate 2 — Permissions baseline** — Produce a permissions baseline document:
+   confirmed label coverage rate, EEEU status, high-risk site count (open vs.
+   remediated), DLP policy coverage. This is the minimum viable baseline
+   before Copilot enablement.
+9. **Copilot readiness recommendation** — copilot-governance-maestro-agent
+   produces a go / conditional-go / no-go recommendation per user group.
+   Conditional-go requires time-bound remediation commitments.
+10. **Human confirmation** — Route the readiness recommendation to the data
+    owner, security team, and Copilot programme owner for final sign-off.
+    This protocol never enables Copilot autonomously.
+
+## Decision gates
+
+| Gate | Condition | Action |
+|---|---|---|
+| Oversharing baseline | Purview DSPM or SAM assessment not run | Block enablement; run assessment first |
+| Critical-risk sites unmediated | High-risk sites without interim protection or remediation | Block enablement; apply RCD and DLP interim controls |
+| EEEU active at tenant level | Everyone except external users enabled tenant-wide | Escalate to SharePoint admin; recommend disabling before enablement |
+| Sensitivity label gap | >20% of content on high-risk sites lacks labels | Require labelling sprint before go-live |
+| Identity layer gap | MFA or device compliance not enforced for Copilot users | Invoke m365-identity-zero-trust-agent; hold enablement |
+
+## Refusal triggers
+- Hard refusal: do not recommend Copilot enablement without an oversharing
+  baseline. This is unconditional.
+- Stop if the Purview DSPM assessment has not been run — do not substitute
+  manual estimates for a real assessment.
+- Stop if credentials, tenant IDs, or customer PII are requested to perform
+  this assessment — refuse and escalate.
+- Stop if the data owner cannot be identified for a critical-risk site — flag
+  as a blocker; do not proceed past Gate 1.
+
+## Handoff rules
+- All handoffs carry: tenant_scope, skill_id, skill_version, invoked_by,
+  oversharing_risk_level, label_coverage_rate, gate_status, open_questions,
+  do_not_do_list.
+- Gate 1 sign-off must include the data owner name/role, the date, and a
+  statement of residual risk accepted.
+- copilot-governance-maestro-agent's readiness recommendation is the final
+  cross-pillar artefact; it must not be bypassed.
+
+## KPIs
+- Oversharing risk sites: critical / high / medium count (pre- vs. post-remediation)
+- Sensitivity label coverage rate (% of files on high-risk sites labelled)
+- EEEU status: tenant-level and site-level
+- DLP policy coverage for Copilot location
+- Time from assessment to enablement (days)
+
+## References
+- https://learn.microsoft.com/microsoft-365/copilot/secure-govern-copilot-foundational-deployment-guidance
+- https://learn.microsoft.com/microsoft-365/copilot/configure-secure-governed-data-foundation-microsoft-365-copilot
+- https://learn.microsoft.com/sharepoint/get-ready-copilot-sharepoint-advanced-management
+- https://learn.microsoft.com/purview/data-security-posture-management-learn-about
+- https://learn.microsoft.com/security/zero-trust/copilots/zero-trust-microsoft-365-copilot

package/skills/cross-functional/copilot-data-readiness-protocol/metadata.json

@@ -0,0 +1,21 @@
+{
+  "id": "copilot-data-readiness-protocol",
+  "name": "Copilot Data Readiness Protocol",
+  "type": "skill",
+  "provider": "generic",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Mandatory pre-enablement readiness protocol for Microsoft 365 Copilot. Runs an oversharing assessment via Microsoft Purview DSPM and SharePoint Advanced Management, applies sensitivity label and DLP controls, validates identity-layer Conditional Access, and confirms a permissions baseline before any user population is enabled. Hard refusal: Microsoft 365 Copilot must not be enabled without an oversharing baseline. All readiness recommendations require data owner, security team, and Copilot programme owner sign-off; this protocol never enables Copilot autonomously.",
+  "source_type": "original",
+  "official_docs": [
+    "https://learn.microsoft.com/microsoft-365/copilot/secure-govern-copilot-foundational-deployment-guidance",
+    "https://learn.microsoft.com/microsoft-365/copilot/configure-secure-governed-data-foundation-microsoft-365-copilot",
+    "https://learn.microsoft.com/sharepoint/get-ready-copilot-sharepoint-advanced-management",
+    "https://learn.microsoft.com/purview/data-security-posture-management-learn-about",
+    "https://learn.microsoft.com/security/zero-trust/copilots/zero-trust-microsoft-365-copilot"
+  ],
+  "security_notes": "This protocol is a recommendation and orchestration aid only; it is never an authorisation to enable Microsoft 365 Copilot or to change data access permissions. Enabling Copilot without an oversharing baseline is a hard refusal — no exception. It never requests credentials, tenant IDs, or customer PII to perform assessments; all inputs are aggregate governance signals. Critical-risk sites without interim protection (SAM Restricted Content Discovery, Purview DLP) block the enablement recommendation until remediated or accepted by the data owner. Sensitivity label coverage and DLP guardrails must be confirmed by the data owner and security team before any go recommendation. Production SharePoint, Purview, or Entra configuration changes escalate to the relevant service owner. This protocol does not publish knowledge articles, modify sharing settings, or change Conditional Access policies autonomously.",
+  "last_verified": "2026-06-16",
+  "path": "skills/cross-functional/copilot-data-readiness-protocol",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}