@tangle-network/starter-foundry 0.5.3 → 0.7.0

package/registry/families/skypilot-serving/files/.env.example

@@ -0,0 +1,12 @@
+# HuggingFace token — needed for gated models (Llama, Mistral, Gemma).
+# Pass into sky serve at launch time:
+#     sky serve up -n {{endpointName}} service.yaml --env HF_TOKEN=$HF_TOKEN
+HF_TOKEN=
+
+# Override the default model without editing service.yaml:
+#     sky serve up -n {{endpointName}} service.yaml --env MODEL_ID=$MODEL_ID
+MODEL_ID={{modelId}}
+
+# Accelerator pick. SkyPilot-specific strings: A100:1, A100-80GB:1, H100:1, L4:1.
+# Cloud-specific instance types go under resources.instance_type in service.yaml.
+ACCELERATOR={{acceleratorSpec}}

package/registry/families/skypilot-serving/files/README-skypilot.md

@@ -0,0 +1,73 @@
+# SkyPilot Serving — operator guide
+
+Multi-cloud vLLM deployment via SkyPilot. One YAML (`service.yaml`)
+describes the replica; `sky serve up` provisions + load-balances + handles
+spot preemption across AWS / GCP / Azure / on-prem Kubernetes.
+
+## First-run
+
+```bash
+pip install -r requirements.txt
+
+# Authenticate with at least one cloud:
+aws configure              # or: gcloud auth login / kubectl config ...
+sky check                  # should show ≥1 enabled cloud
+
+# Deploy. Pass HF_TOKEN via --env for gated models.
+sky serve up -n {{endpointName}} service.yaml --env HF_TOKEN=$HF_TOKEN
+
+# Watch the replica come up (3-10 min cold start for big models).
+sky serve status {{endpointName}}
+sky serve logs {{endpointName}} --target replica 1
+
+# Hit the endpoint (sky prints the URL once replica is READY).
+ENDPOINT=$(sky serve status {{endpointName}} --endpoint)
+curl "$ENDPOINT/v1/chat/completions" \
+  -H 'Content-Type: application/json' \
+  -d '{"model": "{{modelId}}", "messages": [{"role":"user","content":"hi"}]}'
+
+# Tear down — IMPORTANT, you're billed while this runs.
+sky serve down {{endpointName}}
+```
+
+## Cost knobs
+
+- `use_spot: true` in `service.yaml.resources` → 50-80% cheaper, ~5min MTTR on preemption.
+- `replicas: N` scales the backend fleet. SkyPilot picks the cheapest region per replica.
+- Pin `cloud: aws` / `cloud: gcp` to stay in one cloud; leave unset for multi-cloud optimization.
+- The controller VM runs 24/7 (~$30/mo on AWS). Leave it up — spinning up/down costs more than keeping it on.
+
+## Swapping the inference engine
+
+The `run:` block in `service.yaml` invokes vLLM. Swap in TGI, SGLang, Triton,
+or a custom FastAPI app — SkyPilot just needs `ports:` opened and a
+`readiness_probe`. Example TGI run block:
+
+```yaml
+run: |
+  docker run --rm --gpus all \
+    -p {{port}}:80 \
+    -e HUGGING_FACE_HUB_TOKEN="$HF_TOKEN" \
+    -v ~/data:/data \
+    ghcr.io/huggingface/text-generation-inference:2.3.1 \
+    --model-id "$MODEL_ID"
+```
+
+## Production notes
+
+- **Spend control**: `sky serve down` is not optional. Add a CI teardown
+  step for review environments.
+- **Weights caching**: first spawn pulls weights; subsequent replicas on the
+  same region/AZ re-pull. Use `file_mounts` with S3/GCS for persistent weight
+  caches on large models.
+- **Kubernetes backend**: works with any K8s that exposes NVIDIA GPUs
+  (GKE/EKS + nvidia-device-plugin). Mix and match with cloud backends.
+- **Credentials in CI**: plumb AWS/GCP/K8s configs explicitly; SkyPilot reads
+  from the standard locations (~/.aws, ~/.config/gcloud, ~/.kube).
+
+## When NOT to use SkyPilot
+
+If the product runs on a single pinned host (on-prem, one cloud, one region),
+skip SkyPilot and deploy the raw `vllm-server` / `tgi-server` scaffolds
+directly. SkyPilot's value is multi-cloud / spot / autoscale. On a fixed box
+it's overhead.

package/registry/families/skypilot-serving/files/requirements.txt

@@ -0,0 +1,5 @@
+# SkyPilot CLI + cloud adapters. Pick the adapters that match your cloud(s).
+# Installing all three is cheap (pure Python wrappers); the real footprint is
+# the cloud SDK dependencies.
+skypilot[aws,gcp,kubernetes]>=0.7.0
+httpx>=0.27.0

package/registry/families/skypilot-serving/files/service.yaml

@@ -0,0 +1,44 @@
+# sky serve up -n {{endpointName}} service.yaml
+#
+# SkyPilot service spec — provisions N replicas of a vLLM server behind a
+# managed load balancer. Handles spot preemption, multi-region failover,
+# and rolling updates automatically.
+
+service:
+  readiness_probe:
+    path: /v1/models
+    # Large models cold-start in 3-10 minutes. Tune post_data if you want
+    # readiness only after a real inference completes.
+    initial_delay_seconds: 600
+  # Replica count. Scale out by editing replicas and `sky serve update`.
+  replicas: 1
+
+resources:
+  accelerators: {{acceleratorSpec}}
+  # Flip to true for 50-80% cost savings. Preemption will restart replicas —
+  # the load balancer drains in-flight requests gracefully.
+  use_spot: false
+  # Multi-cloud: leave clouds unset to let SkyPilot pick the cheapest region.
+  # Pin to a single cloud with `cloud: aws` or `cloud: gcp`.
+  disk_size: 256
+  # Open the vLLM port for the load balancer.
+  ports:
+    - {{port}}
+
+envs:
+  MODEL_ID: {{modelId}}
+  # Gated HF models need a token AND license acceptance on huggingface.co.
+  # Pass via `sky serve up --env HF_TOKEN=...` or set at launch time.
+  HF_TOKEN: ""
+
+setup: |
+  pip install "vllm>=0.6.0" "fastapi>=0.115" "uvicorn[standard]>=0.32"
+
+run: |
+  export HUGGING_FACE_HUB_TOKEN="$HF_TOKEN"
+  python -m vllm.entrypoints.openai.api_server \
+    --model "$MODEL_ID" \
+    --host 0.0.0.0 \
+    --port {{port}} \
+    --max-model-len 4096 \
+    --gpu-memory-utilization 0.90

package/registry/families/skypilot-serving/files/sky-serve.yaml

@@ -0,0 +1,25 @@
+# Controller + policy config for `sky serve`. Referenced from service.yaml
+# via `--controller-yaml sky-serve.yaml` when you want non-default sizing.
+# Most teams leave the defaults and only edit service.yaml.
+
+controller:
+  # Controller VM runs 24/7 and coordinates replicas. ~$30/mo on AWS defaults.
+  resources:
+    cloud: aws
+    cpus: 4+
+    memory: 16+
+    disk_size: 50
+
+service:
+  # Load-balancer policy: round_robin | least_load | queue_first.
+  load_balancing_policy: round_robin
+
+  # Auto-restart replicas on health-check failure.
+  # base_ondemand_fallback_replicas keeps at least one on-demand replica
+  # up even when use_spot: true, so spot-wide outages don't zero out capacity.
+  replica_policy:
+    min_replicas: 1
+    max_replicas: 4
+    base_ondemand_fallback_replicas: 1
+    # Scale out when average QPS per replica exceeds this.
+    target_qps_per_replica: 10

package/registry/families/skypilot-serving/files/validate-skypilot.mjs

@@ -0,0 +1,41 @@
+import fs from "node:fs/promises";
+
+const [requirements, service, skyServe, readme, envExample] = await Promise.all([
+  fs.readFile("requirements.txt", "utf8"),
+  fs.readFile("service.yaml", "utf8"),
+  fs.readFile("sky-serve.yaml", "utf8"),
+  fs.readFile("README.md", "utf8"),
+  fs.readFile(".env.example", "utf8"),
+]);
+
+if (!requirements.includes("skypilot")) {
+  throw new Error("requirements.txt missing skypilot");
+}
+
+for (const token of ["service:", "readiness_probe", "resources:", "accelerators", "run:"]) {
+  if (!service.includes(token)) {
+    throw new Error(`service.yaml missing ${token}`);
+  }
+}
+if (!service.includes("vllm") && !service.includes("openai.api_server")) {
+  throw new Error("service.yaml run: block should launch a vLLM / OpenAI-compatible server");
+}
+if (!service.includes("MODEL_ID")) {
+  throw new Error("service.yaml should plumb MODEL_ID via envs:");
+}
+
+for (const token of ["controller", "replica_policy", "load_balancing_policy"]) {
+  if (!skyServe.includes(token)) {
+    throw new Error(`sky-serve.yaml missing ${token}`);
+  }
+}
+
+if (!readme.includes("sky serve up") || !readme.includes("sky serve down")) {
+  throw new Error("README.md must document both `sky serve up` and `sky serve down` (cost safety)");
+}
+
+if (!envExample.includes("HF_TOKEN")) {
+  throw new Error(".env.example missing HF_TOKEN");
+}
+
+console.log("skypilot starter ok");

package/registry/families/skypilot-serving/manifest.json

@@ -0,0 +1,181 @@
+{
+  "id": "skypilot-serving",
+  "description": "SkyPilot-based multi-cloud LLM deployment \u2014 `sky serve up` launches a managed serving endpoint across AWS/GCP/Azure/Kubernetes, auto-picks cheapest region, handles spot preemption, load balances replicas. Ships a vLLM service spec, a sky-serve controller config, and a README flow. For teams running LLM inference across clouds or on spot GPUs without writing Terraform.",
+  "tags": [
+    "ml",
+    "llm",
+    "inference",
+    "python",
+    "serving",
+    "skypilot",
+    "multi-cloud"
+  ],
+  "taxonomy": {
+    "language": "python",
+    "runtime": "python",
+    "surface": "inference"
+  },
+  "slots": {
+    "auth": {
+      "options": [
+        "auth:none",
+        "auth:better-auth",
+        "auth:clerk"
+      ],
+      "default": "auth:none"
+    }
+  },
+  "defaults": {
+    "projectType": "inference",
+    "serviceName": "starter-foundry-sky",
+    "endpointName": "starter-foundry-sky",
+    "port": 8000,
+    "modelId": "meta-llama/Meta-Llama-3.1-8B-Instruct",
+    "acceleratorSpec": "A100:1"
+  },
+  "files": [
+    {
+      "source": "files/requirements.txt",
+      "target": "requirements.txt"
+    },
+    {
+      "source": "files/service.yaml",
+      "target": "service.yaml"
+    },
+    {
+      "source": "files/sky-serve.yaml",
+      "target": "sky-serve.yaml"
+    },
+    {
+      "source": "files/.env.example",
+      "target": ".env.example"
+    },
+    {
+      "source": "files/README-skypilot.md",
+      "target": "README.md"
+    },
+    {
+      "source": "files/validate-skypilot.mjs",
+      "target": "validate-skypilot.mjs"
+    }
+  ],
+  "validationChecks": [
+    {
+      "type": "file-exists",
+      "path": "service.yaml"
+    },
+    {
+      "type": "file-exists",
+      "path": "sky-serve.yaml"
+    },
+    {
+      "type": "file-exists",
+      "path": "requirements.txt"
+    },
+    {
+      "type": "file-exists",
+      "path": "README.md"
+    },
+    {
+      "type": "command-success",
+      "command": [
+        "node",
+        "validate-skypilot.mjs"
+      ],
+      "expect": "skypilot starter ok"
+    }
+  ],
+  "contextHints": {
+    "commands": [
+      "pip install -r requirements.txt",
+      "sky check",
+      "sky serve up -n {{endpointName}} service.yaml",
+      "sky serve status {{endpointName}}",
+      "sky serve logs {{endpointName}} --target replica 1"
+    ],
+    "entrypoints": [
+      "service.yaml",
+      "sky-serve.yaml",
+      "README.md"
+    ],
+    "preview": null,
+    "extensionPoints": [
+      "service.yaml",
+      "sky-serve.yaml"
+    ]
+  },
+  "keywords": [
+    "skypilot",
+    "sky serve",
+    "skyserve",
+    "multi-cloud llm",
+    "multi-cloud inference",
+    "spot inference",
+    "spot gpu",
+    "cheapest gpu",
+    "sky launch",
+    "sky.co",
+    "berkeley sky",
+    "cloud llm deployment",
+    "managed llm serving"
+  ],
+  "scoring": {
+    "boost": {
+      "skypilot": 4,
+      "sky serve": 4,
+      "multi-cloud": 2
+    }
+  },
+  "tieredKeywords": {
+    "tier1": [
+      "skypilot",
+      "sky serve",
+      "multi-cloud llm",
+      "spot inference"
+    ],
+    "tier2": [
+      "spot gpu",
+      "cheapest gpu",
+      "managed llm serving",
+      "cloud llm deployment"
+    ],
+    "archetypes": [
+      "cross-cloud llm host",
+      "spot-GPU inference endpoint",
+      "cheapest-region llm serving"
+    ]
+  },
+  "buildHints": {
+    "whenToUse": "Pick SkyPilot when you want a single YAML that deploys LLM inference across AWS/GCP/Azure/Kubernetes, handles spot preemption + failover, and auto-picks the cheapest region. For single-host docker-compose deployment, use vllm-server / tgi-server / sglang-server directly. SkyPilot is the multi-cloud orchestrator \u2014 the underlying server is still vLLM (or whatever you specify).",
+    "firstSteps": [
+      "pip install -r requirements.txt (installs skypilot[aws,gcp,kubernetes])",
+      "Configure one cloud \u2014 `aws configure` / `gcloud auth login` / `kubectl config` \u2014 then `sky check`",
+      "Review service.yaml \u2014 set resources.accelerators, the model id, and replica count",
+      "sky serve up -n {{endpointName}} service.yaml",
+      "sky serve status {{endpointName}} \u2014 wait for a replica to reach READY, then hit the printed URL"
+    ],
+    "gotchas": [
+      "SkyPilot provisions real cloud resources. `sky serve up` starts billing immediately \u2014 always run `sky serve down {{endpointName}}` when you're done.",
+      "Accelerator strings are SkyPilot-specific: `A100:1`, `A100-80GB:1`, `H100:1`. Cloud-specific names (`p4d.24xlarge`) go under `resources.instance_type`.",
+      "`use_spot: true` is great for cost but spot preemption will restart replicas; services.yaml `readiness_probe` must be tuned for cold-start time.",
+      "First `sky serve up` launches a controller VM (~$30/month on AWS). Reuse it for all services \u2014 don't `sky down` the controller.",
+      "Model weights download on every replica spawn unless you mount a shared bucket. For large models, use `file_mounts` with S3/GCS to cache weights.",
+      "Credentials: SkyPilot reads local cloud SDK configs (~/.aws, ~/.config/gcloud, ~/.kube). CI pipelines need these explicitly plumbed.",
+      "Kubernetes backend: `sky check kubernetes` must succeed BEFORE `sky serve up` \u2014 otherwise SkyPilot silently falls back to the first configured cloud."
+    ],
+    "placeholders": [
+      {
+        "path": "src/main.py",
+        "description": "service.yaml (MODEL_ID, accelerators, replica count, spot flag)"
+      },
+      {
+        "path": "src/main.py",
+        "description": "sky-serve.yaml (controller sizing, readiness probe, load balancing policy)"
+      },
+      {
+        "path": ".env",
+        "description": "HF_TOKEN for gated models \u2014 passed into the replicas via the envs map in service.yaml."
+      }
+    ]
+  }
+}

package/registry/families/soc2-compliance-pack/files/docs/SOC2-controls.md

@@ -0,0 +1,54 @@
+# SOC2 Trust Services Criteria — Control Surface
+
+This pack produces the technical artifacts a SOC2 Type II audit checks. The
+process bits (risk assessments, vendor reviews, tabletop exercises) are
+operational — not shipped by code.
+
+## Trust Services Criteria covered
+
+| TSC | Name | Artifact |
+|---|---|---|
+| CC1.1 | Organizational demonstration of integrity | Policies (markdown) |
+| CC2.1 | Communication of internal controls | `docs/SOC2-controls.md` (this file) |
+| CC3.1 | Risk identification | Annual risk assessment (process) |
+| CC5.1 | Control activities | `src/change-mgmt.ts` |
+| CC6.1 | Logical access — role-based | Auth layer in consuming app |
+| CC6.6 | System monitoring | Dashboards + alerts (infra) |
+| CC7.1 | System availability SLI | Uptime monitor |
+| **CC7.2** | System operations monitoring | `src/audit.ts` append-only audit log |
+| CC7.3 | Incident response | `docs/incident-response.md` |
+| **CC8.1** | Change management | `src/change-mgmt.ts` + branch protection + CODEOWNERS |
+| CC9.1 | Vendor risk management | `docs/vendor-attestations.md` |
+| CC9.2 | Vendor performance monitoring | Vendor SLAs tracked operationally |
+
+## CC7.2 — Monitoring evidence
+
+The `SocAuditStore` backing must be append-only at the DB level. Enforce via:
+
+- Postgres: revoke UPDATE + DELETE on `socaudit_*` tables from the application user.
+- Other DBs: use a WORM storage tier (S3 Object Lock, Azure Blob Immutable).
+
+## CC8.1 — Change management
+
+`recordChange()` rejects:
+
+- Changes with zero approvers.
+- Self-approved changes (requester ∈ approvers).
+
+This matches the auditor's expectation that **every** production-affecting
+change is logged AND signed off by someone other than the requester.
+Enforce the underlying via:
+
+- GitHub branch protection: "Require pull request reviews before merging"
+  with "Dismiss stale pull request approvals when new commits are pushed."
+- `.github/CODEOWNERS` pointing every directory to at least 2 maintainers.
+
+## Audit retention
+
+Minimum 12 months for the audit window + 3 months pre-window = 15 months
+typical. Many auditors prefer 7 years. Confirm with your audit firm.
+
+## Operational sibling docs
+
+- `docs/incident-response.md` — tabletop + real-incident playbook.
+- `docs/vendor-attestations.md` — live sub-processor registry.

package/registry/families/soc2-compliance-pack/files/docs/incident-response.md

@@ -0,0 +1,33 @@
+# Incident Response Playbook — SOC2 CC7.3
+
+## Severity ladder
+
+- **P0** — production down, customer data at risk, or active breach. Page on-call. Bridge opened within 15 min.
+- **P1** — partial degradation, no data loss. On-call acknowledges within 30 min.
+- **P2** — single-tenant issue or internal tool. Business hours.
+
+## First 15 minutes
+
+1. Acknowledge the page.
+2. Open the bridge (chat channel + status call).
+3. Declare severity + incident commander (not you if you're also technical lead).
+4. Write a one-line hypothesis in the channel so out-of-channel observers see it.
+5. Start the timeline doc in `.evolve/incidents/<date>-<slug>/timeline.md`.
+
+## Scribe requirement
+
+Every P0/P1 has a scribe separate from the commander. Scribe writes
+timestamps + action-taken into the timeline. This is the SOC2 evidence.
+
+## Post-incident
+
+Within 72 hours of resolution:
+
+1. Write the post-mortem (blameless) — root cause, impact, fix, prevention.
+2. File the tickets for the prevention work with due dates.
+3. Record the incident close in `src/audit.ts` via `action: 'incident.close'`.
+
+## Tabletop cadence
+
+Run at least ONE tabletop exercise per audit window, ideally quarterly.
+Auditors ask for evidence; record the exercise to `docs/tabletop-log.md`.

package/registry/families/soc2-compliance-pack/files/docs/vendor-attestations.md

@@ -0,0 +1,36 @@
+# Vendor Attestations — Sub-processor Registry
+
+SOC2 CC9.1/CC9.2 expect a live list of sub-processors with current
+attestations. Update this file BEFORE onboarding any vendor that handles
+customer data.
+
+| Vendor | Purpose | Attestation | Report Date | Next Review |
+|---|---|---|---|---|
+| AWS | Compute + storage | SOC2 Type II | _fill in_ | _annually_ |
+| Cloudflare | CDN + WAF | SOC2 Type II | _fill in_ | _annually_ |
+| Stripe | Payments | PCI DSS + SOC1 Type II | _fill in_ | _annually_ |
+| Vercel | Hosting | SOC2 Type II | _fill in_ | _annually_ |
+| GitHub | Source + CI | SOC2 Type II | _fill in_ | _annually_ |
+| Datadog | Observability | SOC2 Type II | _fill in_ | _annually_ |
+| Sentry | Error monitoring | SOC2 Type II | _fill in_ | _annually_ |
+| Linear | Issue tracking | SOC2 Type II | _fill in_ | _annually_ |
+
+## Onboarding checklist
+
+Before integrating a new vendor:
+
+1. Confirm they have a current SOC2 Type II (≤ 12 months old) or equivalent.
+2. Confirm they sign a DPA if they process EU data.
+3. Add them to this table with the attestation report date.
+4. Record the onboarding in `src/audit.ts` via `action: 'vendor.change'`.
+
+## Data classification
+
+For each vendor, note the data classes they receive:
+- **A** — PII (names, emails, addresses)
+- **B** — Sensitive PII (SSN, DOB, government IDs)
+- **C** — PHI (health records)
+- **D** — PCI (cardholder data)
+- **E** — Secrets (API keys, tokens)
+
+Minimize A-E exposure per vendor. Keep the minimum-necessary principle.

package/registry/families/soc2-compliance-pack/files/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "{{packageName}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc --noEmit",
+    "validate": "node validate-hipaa-pack.mjs"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "typescript": "^5.9.0",
+    "@types/node": "^22.0.0"
+  }
+}

package/registry/families/soc2-compliance-pack/files/src/audit.ts

@@ -0,0 +1,46 @@
+// SOC2 Type II audit log. Append-only. Every state-changing action (deploy,
+// config change, user role grant, PII export) emits one row.
+// Covers CC7.2 (monitoring), CC8.1 (change management).
+
+export type SocAction =
+  | 'deploy'
+  | 'config.change'
+  | 'role.grant'
+  | 'role.revoke'
+  | 'pii.export'
+  | 'incident.open'
+  | 'incident.close'
+  | 'vendor.change'
+
+export interface SocAuditEntry {
+  id?: string
+  at: string
+  actor: string
+  action: SocAction
+  target: string
+  before?: unknown
+  after?: unknown
+  reason?: string
+  /** Required for CC8.1 change-management — who approved this change. */
+  approvedBy?: string[]
+}
+
+export interface SocAuditStore {
+  append(entry: SocAuditEntry): Promise<void>
+  list(filter?: { actor?: string; action?: SocAction; since?: string }): Promise<SocAuditEntry[]>
+}
+
+export class InMemorySocAuditStore implements SocAuditStore {
+  private entries: SocAuditEntry[] = []
+  async append(entry: SocAuditEntry): Promise<void> {
+    this.entries.push({ ...entry, id: entry.id ?? crypto.randomUUID() })
+  }
+  async list(filter?: Parameters<SocAuditStore['list']>[0]): Promise<SocAuditEntry[]> {
+    return this.entries.filter((e) => {
+      if (filter?.actor && e.actor !== filter.actor) return false
+      if (filter?.action && e.action !== filter.action) return false
+      if (filter?.since && e.at < filter.since) return false
+      return true
+    })
+  }
+}

package/registry/families/soc2-compliance-pack/files/src/change-mgmt.ts

@@ -0,0 +1,36 @@
+// Change-management surface for SOC2 CC8.1. Every production-affecting
+// change MUST be recorded with ≥1 approver. Rejected = no approvers.
+
+import type { SocAuditStore } from './audit.js'
+
+export interface ChangeRequest {
+  id: string
+  title: string
+  description: string
+  requester: string
+  approvers: string[]
+  target: 'infrastructure' | 'application' | 'data' | 'access-policy' | 'vendor'
+  requestedAt: string
+  executedAt?: string
+  rollbackPlan?: string
+}
+
+export async function recordChange(
+  store: SocAuditStore,
+  change: ChangeRequest,
+): Promise<void> {
+  if (change.approvers.length === 0) {
+    throw new Error(`CC8.1 violation: change ${change.id} has no approvers`)
+  }
+  if (change.approvers.includes(change.requester)) {
+    throw new Error(`CC8.1 violation: change ${change.id} self-approved by ${change.requester}`)
+  }
+  await store.append({
+    at: change.executedAt ?? new Date().toISOString(),
+    actor: change.requester,
+    action: change.target === 'infrastructure' ? 'deploy' : 'config.change',
+    target: `${change.target}:${change.title}`,
+    approvedBy: change.approvers,
+    reason: change.description,
+  })
+}

package/registry/families/soc2-compliance-pack/files/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "declaration": true,
+    "lib": ["ES2022"]
+  },
+  "include": ["src"]
+}

package/registry/families/soc2-compliance-pack/files/validate-soc2-pack.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+
+for (const rel of [
+  'src/audit.ts',
+  'src/change-mgmt.ts',
+  'docs/SOC2-controls.md',
+  'docs/incident-response.md',
+  'docs/vendor-attestations.md',
+]) {
+  if (!existsSync(join(here, rel))) throw new Error(`missing ${rel}`)
+}
+
+const chg = readFileSync(join(here, 'src/change-mgmt.ts'), 'utf8')
+if (!/approvers\.includes\(change\.requester\)/.test(chg)) throw new Error('change-mgmt.ts missing self-approval rejection')
+
+const controls = readFileSync(join(here, 'docs/SOC2-controls.md'), 'utf8')
+if (!/CC7\.2/.test(controls)) throw new Error('SOC2-controls.md missing CC7.2 reference')
+if (!/CC8\.1/.test(controls)) throw new Error('SOC2-controls.md missing CC8.1 reference')
+
+console.log('soc2-pack ok')