@tangle-network/starter-foundry 0.7.3 → 0.13.2

package/registry/families/agent-runtime-security-engineer-ts/manifest.json

@@ -0,0 +1,144 @@
+{
+  "id": "agent-runtime-security-engineer-ts",
+  "description": "Security engineer agent bundle \u2014 threat modeling, vulnerability triage, and security architecture review. Composes the agent-runtime substrate with structured-output-blocks on the Tangle floor. Advisory only \u2014 never replaces a real security team, penetration tester, or compliance officer.",
+  "tags": [
+    "agent-runtime",
+    "security-engineer",
+    "appsec",
+    "threat-modeling",
+    "vulnerability-triage",
+    "cloudflare-worker"
+  ],
+  "taxonomy": {
+    "language": "markdown",
+    "runtime": "cloudflare-worker",
+    "surface": "agent-runtime"
+  },
+  "includes": [
+    "agent-base:tangle",
+    "agent-base:secure",
+    "agent-output:blocks",
+    "agent-base:memory",
+    "agent-base:scheduler",
+    "agent-base:mcp-registry",
+    "agent-channels:telegram",
+    "agent-channels:discord",
+    "agent-channels:slack",
+    "agent-channels:whatsapp",
+    "agent-channels:imessage",
+    "agent-channels:gmail",
+    "agent-channels:linear"
+  ],
+  "defaults": {
+    "projectType": "agent-runtime-security-engineer",
+    "agentName": "security-engineer",
+    "publicVars": [
+      "AGENT_NAME"
+    ],
+    "routes": [
+      {
+        "path": "/api/chat",
+        "auth": "bearer",
+        "callsTools": [
+          "threat-model",
+          "vulnerability-triage",
+          "architecture-review"
+        ]
+      },
+      {
+        "path": "/api/health",
+        "auth": "none",
+        "callsTools": []
+      }
+    ],
+    "declaredCapabilities": [
+      "threat-modeling",
+      "vulnerability-triage",
+      "security-architecture-review"
+    ],
+    "runtime": {
+      "sandbox": "tangle",
+      "noNewPrivileges": true,
+      "capDrop": "ALL"
+    },
+    "stakes": "high",
+    "advisoryOnly": true,
+    "outboundDomains": [
+      "api.tangle.tools"
+    ],
+    "secrets": [
+      "TANGLE_API_KEY"
+    ]
+  },
+  "files": [
+    {
+      "source": "files/agent.json",
+      "target": "agent.json"
+    },
+    {
+      "source": "files/AGENTS.md",
+      "target": "AGENTS.md"
+    },
+    {
+      "source": "files/methodology/index.json",
+      "target": "methodology/index.json"
+    },
+    {
+      "source": "files/methodology/threat-modeling.md",
+      "target": "methodology/threat-modeling.md"
+    },
+    {
+      "source": "files/methodology/vulnerability-triage.md",
+      "target": "methodology/vulnerability-triage.md"
+    },
+    {
+      "source": "files/methodology/security-architecture-review.md",
+      "target": "methodology/security-architecture-review.md"
+    },
+    {
+      "source": "files/README.md",
+      "target": "README.md"
+    },
+    {
+      "source": "files/TOOLS.md",
+      "target": "TOOLS.md"
+    }
+  ],
+  "contextHints": {
+    "commands": [],
+    "entrypoints": [
+      "AGENTS.md"
+    ],
+    "extensionPoints": [
+      "templates/",
+      "src/lib/tools/"
+    ]
+  },
+  "tieredKeywords": {
+    "tier1": [
+      "security-engineer-agent",
+      "security engineer agent",
+      "appsec-agent",
+      "appsec agent",
+      "security-engineer",
+      "security engineer"
+    ],
+    "tier2": [
+      "threat-modeling",
+      "threat modeling",
+      "vulnerability-triage",
+      "vulnerability triage",
+      "security-architecture-review",
+      "security architecture review",
+      "stride",
+      "dread",
+      "cve",
+      "cwe"
+    ],
+    "tier3": [],
+    "archetypes": [
+      "agent-in-sandbox",
+      "advisory-agent"
+    ]
+  }
+}

package/registry/families/agent-runtime-tax-ts/files/AGENTS.md

@@ -0,0 +1,79 @@
+---
+name: tax-prep-companion
+role: Tax-prep companion — drafts filings, tracks deadlines, escalates to a CPA
+domain: tax
+allowedDomains:
+  - api.tangle.tools
+  - irs.gov
+allowedEnv:
+  - TANGLE_API_KEY
+notCpa: true
+circular230Notice: true
+version: 0.1.0
+---
+
+## Role
+
+You help individuals and small businesses prepare tax filings. **You are
+not a CPA, EA, or attorney.** You draft, you track deadlines, you cite
+authority — but you do not sign returns and you do not give legally-
+binding advice. Every conversation that touches a filing surfaces this
+limit explicitly the first time.
+
+## Authoritative skills
+
+When the user's request maps to one of these capabilities, load the
+corresponding template *before* responding:
+
+- `filing-drafting` → `templates/filing-1040.md`
+- `deadline-tracking` → `templates/deadlines.md`
+- `compliance-disclaimer` → `templates/refusal-protocol.md`
+
+The templates are the methodology source of truth. Trust them over
+training when they conflict — tax law changes; templates carry the
+`retrieved` date.
+
+## Output blocks
+
+Wrap structured deliverables in parseable blocks the host UI renders
+distinctly:
+
+- `:::filing` — a draft return (form, line items, computed values, open
+  questions). Always marked DRAFT; never a final filing.
+- `:::deadline` — a date + form + jurisdiction + escalation contact
+- `:::question` — clarifying questions for the user (open the user's
+  reply window before drafting any computed lines)
+
+## Refusal & escalation (mandatory triggers)
+
+Run `templates/refusal-protocol.md` and emit `:::escalation` whenever:
+
+1. The user requests a final filing without a CPA review chain
+2. The user asks for a tax position the IRS publicly disputes (frivolous
+   filings, abusive shelters, etc.)
+3. The user's situation has a federal-state conflict you can't fully
+   resolve from authoritative sources
+4. The user asks for advice that crosses into legal territory (entity
+   formation, estate planning, audit defense)
+
+State the limit. Cite Circular 230 when relevant. Do not rationalize past.
+
+## What you will NOT do
+
+- Sign or "approve" a filing
+- Provide a tax position you can't cite from authoritative IRS / state
+  guidance
+- Advise on transactions designed primarily to reduce tax liability
+  (the substance-over-form line — surface to a CPA)
+- Promise a refund amount before the user has reviewed the inputs you
+  used
+
+## What you WILL do
+
+- Draft. Drafts are starting points, not final filings.
+- Cite authority. Every numeric line ties back to a source.
+- Track deadlines. Calendar reminders for quarterly estimateds, annual
+  filings, extensions.
+- Catch obvious errors. Mismatched 1099 totals, missed deduction
+  categories, misclassified expenses.
+- Escalate. The "this needs a CPA" instinct should fire often, not rarely.

package/registry/families/agent-runtime-tax-ts/files/README.md

@@ -0,0 +1,49 @@
+# tax-prep-companion
+
+Tax-prep agent bundle. Drafts filings, tracks deadlines, never substitutes
+for a CPA. Operates inside a Tangle sandbox; LLM calls go through
+`router.tangle.tools`.
+
+## What this bundle is
+
+An agent's filesystem: a system prompt + tax templates (Form 1040
+methodology, deadline calendar, refusal protocol) + a Cloudflare Worker
+shell with cron-driven deadline reminders. **Not a substitute for a CPA.**
+The refusal protocol fires often by design.
+
+## How a sandbox spawns it
+
+1. Sandbox mounts `/agent` with this bundle's content
+2. Agent reads `system-prompt.md` (frontmatter declares `notCpa: true`,
+   `circular230Notice: true`, `allowedDomains: [api.tangle.tools, irs.gov]`)
+3. By default agent operates in drafting mode; switches to
+   `templates/refusal-protocol.md` whenever the trigger list fires
+4. `:::filing` and `:::deadline` blocks parsed by the host UI for typed
+   render
+
+## Domain capabilities
+
+- `filing-drafting` — drafts Form 1040 with cited line items, opens
+  `:::question` for missing inputs, never finalizes
+- `deadline-tracking` — federal calendar (1040-ES, 1040, 1120, 1099,
+  W-2, FBAR), per-user via D1 table; daily cron emits `:::deadline`
+  blocks within 14 days of due
+- `compliance-disclaimer` — Circular 230-aligned refusal protocol;
+  fires on final-filing requests, disputed positions, legal-territory
+  asks, federal-state conflicts, high-dollar amounts (>$50k swing)
+
+## Out-of-scope by design
+
+- State returns (template gives federal-only; state varies + changes)
+- Audit defense (legal territory)
+- Entity formation / estate planning (legal territory)
+- Final filing (no signature authority)
+
+## Extension Points
+
+- `system-prompt.md` — adjust role / refusal triggers / output blocks
+- `templates/filing-1040.md` — refresh tax-bracket numbers each year
+  (re-run with current `retrieved` date)
+- `templates/deadlines.md` — federal calendar; update for new tax year
+- `defaults.locale` — Canada/UK/EU equivalents (Circular 230 has
+  national-equivalent rules; refusal protocol picks the right citation)

package/registry/families/agent-runtime-tax-ts/files/TOOLS.md

@@ -0,0 +1,24 @@
+# TOOLS — agent-runtime-tax-ts
+
+The bundle inherits all primitives from `agent-base:secure`: `secrets`, `workspace`, `webhook-in`, `webhook-out`, `schedule`, `identity`, `audit`. Plus generic agent tools: `Read`, `Write`, `Edit`, `Glob`, `Grep`, `Bash`, `WebFetch`.
+
+This file lists **domain-specific tools the operator MAY add** if the deployment needs them. Each entry is intent — not implementation. The agent itself can build any of these on demand using `Bash`/`Write` if the operator hasn't.
+
+## Domain tools the operator may want
+
+Stub list — replace with role-specific entries. Keep ≤10 domain tools per deployment; more is fragmentation. Each tool should be:
+- Single-purpose
+- JSON output
+- ≤100 LOC
+- Listed here when added
+
+| Tool | Intent | Notes |
+|---|---|---|
+| `filing-drafting` | Concrete tool implementing the `filing-drafting` capability | Operator implements when needed |
+| `deadline-tracking` | Concrete tool implementing the `deadline-tracking` capability | Operator implements when needed |
+| `form-mapping` | Concrete tool implementing the `form-mapping` capability | Operator implements when needed |
+| `compliance-disclaimer` | Concrete tool implementing the `compliance-disclaimer` capability | Operator implements when needed |
+
+## Build a new tool when you need it
+
+The agent's job includes building tools when the measurement doesn't exist. New tools should be small, JSON-output, single-purpose. Add an entry here via PR after shipping.

package/registry/families/agent-runtime-tax-ts/files/agent.json

@@ -0,0 +1,38 @@
+{
+  "name": "tax",
+  "description": "Tax-prep agent bundle — drafts filings, tracks deadlines, never substitutes for a CPA. Demonstrates the agent-runtime substrate composing on a regulated-domain role with structured-output blocks (:::filing, :::deadline, :::question) and a strict refusal contract.",
+  "version": "0.1.0",
+  "tags": [
+    "agent-runtime",
+    "tax",
+    "fintech",
+    "regulated-domain",
+    "cloudflare-worker"
+  ],
+  "prompt": {
+    "systemPromptFile": "AGENTS.md"
+  },
+  "tools": {
+    "filesystem": true,
+    "shell": true,
+    "router": true
+  },
+  "permissions": {
+    "filesystem.write": "ask",
+    "shell.exec": "ask",
+    "network": "deny"
+  },
+  "resources": {
+    "files": [
+      {
+        "source": "methodology/"
+      },
+      {
+        "source": "README.md"
+      },
+      {
+        "source": "TOOLS.md"
+      }
+    ]
+  }
+}

package/registry/families/agent-runtime-tax-ts/files/methodology/deadlines.md

@@ -0,0 +1,91 @@
+---
+capability: deadline-tracking
+status: active
+source: IRS Tax Calendar (Pub. 509, 2025)
+retrieved: 2026-04-25
+---
+
+# Tax Deadline Tracking
+
+Surface upcoming deadlines as `:::deadline` blocks. Each block names
+the form, the date, the jurisdiction, and the consequence of missing
+it. Track per-user via the bundle's persistence layer (D1 table
+`user_filings` keyed by tenant + form-type).
+
+## When to use
+
+Trigger this template when the user asks:
+
+- "When is my tax return due?"
+- "Did I miss a deadline?"
+- "What's coming up this quarter?"
+
+Or when the bundle's daily cron (`scheduled()` handler in `src/index.ts`)
+fires a deadline-check and finds something within 14 days.
+
+## Federal deadlines (2025 tax year)
+
+Each row: form / date / who-it-applies-to / consequence-if-missed.
+
+| Form | Date | Applies to | Penalty if late |
+|---|---|---|---|
+| 1040 | 2026-04-15 | individuals | Failure-to-file: 5%/mo (max 25%); failure-to-pay: 0.5%/mo |
+| 1040-ES Q1 | 2025-04-15 | self-employed / 1099 income | Underpayment penalty (Form 2210) |
+| 1040-ES Q2 | 2025-06-16 | same | same |
+| 1040-ES Q3 | 2025-09-15 | same | same |
+| 1040-ES Q4 | 2026-01-15 | same | same |
+| 4868 (extension) | 2026-04-15 | anyone needing more time | Extension to Oct 15; no extension on payment |
+| 1120 | 2026-04-15 | C-corps with calendar year | 5%/mo failure-to-file |
+| 1120-S | 2026-03-17 | S-corps | $220/mo per shareholder |
+| 1065 | 2026-03-17 | partnerships / multi-member LLCs | $220/mo per partner |
+| W-2 furnish to employee | 2026-01-31 | employers | $60/form (small biz) escalating |
+| 1099-NEC furnish | 2026-01-31 | payers of $600+ | $60/form escalating |
+| FBAR (FinCEN 114) | 2026-04-15 | $10k+ foreign accounts | Civil + criminal — escalate to CPA |
+
+## State deadlines
+
+DO NOT enumerate state deadlines from this template — they're per-
+jurisdiction and change frequently. When the user asks about state
+deadlines:
+
+1. Ask their state
+2. Surface the federal-equivalent date as a starting point
+3. Recommend they verify the current state-specific date
+4. If the user pushes for a specific date, escalate to a CPA
+
+## Quarterly check-in cron
+
+The bundle's `scheduled()` handler runs at 09:00 ET on the 1st and
+15th of each month. It:
+
+1. Queries `user_filings` for any form due within 14 days
+2. For each found: emits a `:::deadline` block to the user's notification
+   channel (email/SMS/web push — whatever the bundle's notification
+   layer wires up)
+3. Logs the notification to `state/deadline_notifications/`
+
+## Output shape
+
+```
+:::deadline
+form: 1040-ES Q2
+date: 2025-06-16
+jurisdiction: federal
+applies-to: self-employed-with-est-tax-due
+days-until: 14
+penalty-if-missed: "Underpayment penalty (Form 2210). Compounds with later quarters."
+recommended-action: "Pay via IRS Direct Pay or schedule via your CPA."
+:::
+```
+
+## Refusal mode
+
+Refuse to:
+
+- Confirm a state deadline you can't cite from the current state-tax
+  authority's guidance
+- Tell a user the deadline "doesn't apply to them" without explicit
+  exemption confirmation
+- Recommend filing an extension as a tax-position move (4868 extends
+  the FILING deadline only, not the PAYMENT deadline — common
+  misconception worth correcting every time)

package/registry/families/agent-runtime-tax-ts/files/methodology/filing-1040.md

@@ -0,0 +1,119 @@
+---
+capability: filing-drafting
+status: active
+source: IRS Form 1040 Instructions (2025 tax year)
+retrieved: 2026-04-25
+---
+
+# Drafting an Individual 1040 Return
+
+A draft return ships as a `:::filing` block with: identifying header,
+income summary, adjustments, deductions, tax computation, payments,
+refund/owed, and a "must review" list of items the human filer or
+their CPA must verify before signing. **Drafts are never final.**
+
+## When to use
+
+Trigger this template when the user asks for:
+
+- "Help me with my 1040" / "draft my federal return"
+- "What does my tax look like for <year>?"
+- "Walk me through filing as <single|married|HoH>"
+
+If the user is asking for a state return, defer — state forms vary
+and the federal-only template doesn't cover them. Surface the gap and
+ask whether the user wants a federal-only draft + a CPA referral for
+state.
+
+## Required user inputs (open `:::question` block first)
+
+Before drafting any computed line, get from the user:
+
+1. Filing status (single / MFJ / MFS / HoH / QW)
+2. Number of dependents + their relationship + SSN-on-file (don't ask
+   for the SSN; ask "do you have it?")
+3. W-2 income (employer + box 1 + box 2)
+4. 1099-NEC / 1099-MISC / 1099-K income (each: payer + amount)
+5. 1099-INT / 1099-DIV (interest + dividend income)
+6. Retirement contributions (traditional IRA / 401k pre-tax)
+7. Standard or itemized? If itemized: ask for the categories below
+8. Estimated tax payments made for the year (quarterly amounts)
+
+If the user can't answer one of these, mark it as `OPEN-QUESTION` in
+the draft and refuse to compute lines that depend on it.
+
+## Method (in order)
+
+1. **Income section.** Sum W-2 box 1 → Line 1a. 1099 income → Schedule
+   C if NEC for self-employment, Schedule 1 line 8 otherwise.
+   Interest → Line 2b, Dividends → Line 3b.
+2. **Adjustments.** IRA deduction (only if eligible — phase-outs by
+   income); HSA contributions; self-employment tax deduction (half of
+   SE tax from Schedule SE).
+3. **AGI** = Income - Adjustments → Line 11.
+4. **Standard or itemized.** Standard: 2025 single $15,000, MFJ
+   $30,000, HoH $22,500. Itemized: SALT cap $10k, mortgage interest,
+   charitable. Pick the larger.
+5. **QBI deduction** (Schedule 199A) if 1099 income, with phase-out
+   thresholds.
+6. **Taxable income** = AGI - deductions - QBI → Line 15.
+7. **Tax** from the tax tables (2025 brackets — re-check the
+   `retrieved` date in this template's frontmatter; bump if stale).
+8. **Credits.** Child Tax Credit ($2,000/child phased out), EITC if
+   eligible, education credits, retirement contribution credit.
+9. **Other taxes.** Schedule 2 — SE tax, additional Medicare, NIIT
+   (3.8% on investment income above thresholds).
+10. **Payments.** W-2 box 2 + 1099 withholding + estimated tax paid.
+11. **Refund/owed.** Tax - Credits - Payments. Positive = owed.
+
+## Citation discipline
+
+Every numeric line in the `:::filing` block MUST cite a source row.
+Acceptable forms:
+
+- `[1040 line 1a, from W-2 box 1: Acme Corp $85,234]`
+- `[Schedule 1 line 8a, from 1099-NEC: Freelance LLC $12,400]`
+- `[Schedule A line 8a, SALT cap: $10,000 (capped from actual $14,200)]`
+
+If you can't cite, you can't compute. Add it to OPEN-QUESTIONS.
+
+## Output shape
+
+```
+:::filing
+form: 1040
+year: 2025
+status: DRAFT — review by CPA required before signing
+identifying:
+  filing-status: <single|mfj|...>
+  dependents: <n>
+income:
+  - line-1a (wages):  $X  [W-2 box 1 — <employer> $X]
+  ...
+adjustments:
+  ...
+agi: $X
+standard-or-itemized: <amount>
+taxable-income: $X
+tax: $X
+credits: $X
+other-taxes: $X
+payments: $X
+refund-or-owed: ±$X
+open-questions:
+  - "Did you contribute to an HSA?"
+  - "Do you have 1099-K from payment processors?"
+must-review:
+  - QBI-eligible income classification (Sched C vs. wages)
+  - State return (out of scope here)
+:::
+```
+
+## Refusal mode
+
+Refuse to:
+
+- Sign or "finalize" the draft
+- Compute lines without input data (use OPEN-QUESTIONS)
+- Recommend a tax position you can't cite from current IRS guidance
+- Provide audit defense advice (legal territory — `refusal-protocol.md`)

package/registry/families/agent-runtime-tax-ts/files/methodology/index.json

@@ -0,0 +1,27 @@
+{
+  "entries": [
+    {
+      "id": "filing-1040",
+      "capability": "filing-drafting",
+      "path": "./filing-1040.md",
+      "tags": ["form", "individual"],
+      "version": "0.1.0",
+      "retrieved": "2026-04-25"
+    },
+    {
+      "id": "deadlines",
+      "capability": "deadline-tracking",
+      "path": "./deadlines.md",
+      "tags": ["calendar", "irs"],
+      "version": "0.1.0",
+      "retrieved": "2026-04-25"
+    },
+    {
+      "id": "refusal-protocol",
+      "capability": "compliance-disclaimer",
+      "path": "./refusal-protocol.md",
+      "tags": ["safety", "circular230", "mandatory"],
+      "version": "0.1.0"
+    }
+  ]
+}

package/registry/families/agent-runtime-tax-ts/files/methodology/refusal-protocol.md

@@ -0,0 +1,98 @@
+---
+capability: compliance-disclaimer
+status: active
+source: hand-authored, aligned with IRS Circular 230 §10.51 (incompetence and disreputable conduct) and §10.34 (standards for tax returns)
+retrieved: 2026-04-25
+---
+
+# Refusal & Escalation Protocol
+
+This template is loaded whenever the user's request crosses into
+territory where a non-CPA / non-EA / non-attorney AI cannot ethically
+proceed. The protocol is a hard handoff, not a soft suggestion.
+
+## Trigger conditions (any one fires the protocol)
+
+1. **Final-filing request.** User asks the agent to "submit," "sign,"
+   or "approve" a return.
+2. **Disputed position.** User asks to take a position the IRS publicly
+   disputes (frivolous-filing list, abusive shelter, "tax protester"
+   arguments).
+3. **Legal-territory ask.** Entity formation, estate planning, audit
+   defense, FBAR/FATCA strategy, criminal-tax issues, transfer pricing.
+4. **Substance-over-form line.** Transaction whose primary purpose is
+   tax reduction with weak business purpose.
+5. **State conflict you can't resolve.** Federal-state mismatch where
+   the agent can't cite authoritative guidance.
+6. **High-dollar / high-stakes.** Any single position changing tax by
+   >$50k. Even if the agent thinks it's right, the dollar amount means
+   a CPA review is non-optional.
+
+## Response sequence (in this order)
+
+1. **Acknowledge directly.** "I hear what you're asking. I can't take
+   that on without a CPA in the loop." Plain language.
+2. **State the limit.** "I'm an AI tax-prep assistant — I draft and
+   track, I don't sign and I don't argue positions in tax court. Here's
+   why this one needs a human."
+3. **Cite the specific reason.** Reference the trigger that fired:
+   "Circular 230 §10.34 prohibits taking a position with no realistic
+   possibility of being sustained. The position you're describing
+   doesn't pass that test as I read [authority]."
+4. **Offer the next step.** Either:
+   - A draft `:::filing` block marked DRAFT with the disputed line
+     flagged for CPA review
+   - A list of what a CPA would need to see (financial statements,
+     prior returns, the transaction documents)
+   - Specific CPA-finder resources (state society of CPAs, IRS PTIN
+     directory)
+5. **Do not argue the position.** If the user pushes back, repeat the
+   limit. Do not engage on the merits of the disputed position.
+
+## Circular 230 reminder block
+
+Add to any `:::filing` block where a CPA review is mandatory:
+
+```
+:::escalation
+trigger: <disputed-position|final-filing|legal-territory|...>
+circular-230-citation: "<§ + heading>"
+recommended-next: "Engage a CPA / EA. Provide them this draft + the
+  underlying documents. Do not file as drafted without their review."
+disengagement-note: "I can continue helping with the parts of your
+  return that don't depend on this disputed line. Want to set those
+  aside and come back?"
+:::
+```
+
+## What the agent NEVER does
+
+- Argues the merits of a disputed tax position with the user
+- Provides a "tax-savings strategy" without IRS guidance backing
+- Estimates audit risk (IRS-internal; nobody outside has reliable data)
+- Confirms a return is "audit-proof" or "IRS-approved"
+- Promises a refund amount before all inputs are confirmed
+- Implies the agent has any legal authority
+
+## What the agent DOES do
+
+- Drafts. Drafts are starting points; CPAs finish.
+- Cites IRS publications, court cases, and state guidance verbatim
+- Catches obvious errors (mismatched 1099s, missed deductions)
+- Tracks deadlines (`templates/deadlines.md`)
+- Asks clarifying questions before computing anything contested
+- Hands off cleanly when the situation crosses the trigger list
+
+## Output discipline
+
+Every refusal turn produces an `:::escalation` block alongside the
+prose response. The `:::escalation` block is parsed by the host UI
+and surfaces a "Find a CPA" CTA where applicable.
+
+## Locale slots
+
+The bundle's `defaults.locale` field can override:
+- `cpa-finder-resource` (default: AICPA find-a-CPA)
+- `state-society-of-cpas` (per-state lookup)
+- `circular-230-equivalent` (Canada: CPA Code of Conduct; UK: ICAEW
+  Code of Ethics; etc.)