bmad-plus 0.12.1 → 0.13.0

package/osint-agent-package/skills/bmad-osint-investigate/osint/assets/dossier-template.md

@@ -1,126 +1,126 @@
-🔍 **OSINT: {FULL_NAME}**
-*{one_line_summary}*
-
----
-
-**⚖️ governance / lawful basis** *(Phase −1 gate — required before this dossier exists)*
-- controller: {controller_name}
-- lawful basis (Art. 6): {basis} {legitimate_interest_balancing_ref_if_LI}
-- special-category condition (Art. 9, if psychoprofile): {art9_condition_or_NA}
-- purpose: {specific_purpose}
-- retention: {retention_period} · DSAR/erasure contact: {dsar_contact}
-- recorded: {date} · see `assets/lawful-basis-record.md`
-
----
-
-**контакты и соцсети**
-- telegram: {handle} {status}
-- linkedin: {url} {status}
-- instagram: {handle} {status}
-- facebook: {url} {status}
-- email: {email} {status}
-- телефон: {phone} {status}
-- другое: {any_other}
-
----
-
-**биография**
-
-- дата рождения: {dob_only_if_confirmed_A_or_B}
-- возраст: {age}
-- место рождения: {birthplace}
-- образование: {education}
-
-**карьера:**
-- **{year}** — {role}, {company} ({age_at_time})
-- **{year}** — {role}, {company}
-- ...
-- **сейчас** — {current_role}, {current_company}
-
-паттерн карьеры: {career_pattern_description}
-
----
-
-**текущая ситуация**
-- роль: {current_role}
-- компания: {current_company} — {company_description}
-- локация: {current_location}
-
----
-
-**из переписки** 🔒
-*секция на основе Telegram/email — не для внешнего использования*
-
-- характер общения: {formal_informal_emoji_patterns}
-- темы: {what_they_discuss_ask_about}
-- стиль: {response_speed_active_hours_language}
-- контекст отношений: {cold_warm_hot_business_personal}
-- упомянутые люди: {colleagues_partners_from_conversations}
-- {any_deal_terms_pricing_discussed}
-
----
-
-**психопрофиль**
-
-**MBTI: {type} ({confidence})**
-- E/I: {assessment} — {evidence}
-- S/N: {assessment} — {evidence}
-- T/F: {assessment} — {evidence}
-- J/P: {assessment} — {evidence}
-
-**стиль коммуникации:**
-- голос: {voice_description}
-- ритм: {rhythm_description}
-- эмодзи: {emoji_pattern}
-- формальный vs неформальный: {delta_between_linkedin_and_telegram}
-- ключевые маркеры: {markers}
-
-**ценности (по действиям):**
-- {value_1}
-- {value_2}
-- {value_3}
-
----
-
-**личное**
-- семья: {family_only_confirmed}
-- питомцы: {pets_only_confirmed}
-- увлечения: {hobbies}
-- стиль жизни: {lifestyle}
-
----
-
-**наблюдения**
-- {observation_1_contradictions_or_patterns}
-- {observation_2}
-- {observation_3}
-
----
-
-**карта достоверности**
-- A (подтверждено, 2+ источника): {list_of_A_facts}
-- B (вероятно, 1 надёжный источник): {list_of_B_facts}
-- C (выведено, косвенные данные): {list_of_C_facts}
-- D (не подтверждено): {list_of_D_facts}
-
----
-
-**точки входа**
-- {approach_1_shared_connections_or_topics}
-- {approach_2}
-- {approach_3}
-
----
-
-**пробелы**
-- {gap_1_what_not_found}
-- {gap_2}
-
----
-
-**метрики**
-- depth score: {score}/10
-- coverage: {passed}/{total} checks
-- источников: {source_count} ({source_types_list})
-- внутренняя разведка: {yes_no_what_checked}
-- потрачено: ${total_cost}
+🔍 **OSINT: {FULL_NAME}**
+*{one_line_summary}*
+
+---
+
+**⚖️ governance / lawful basis** *(Phase −1 gate — required before this dossier exists)*
+- controller: {controller_name}
+- lawful basis (Art. 6): {basis} {legitimate_interest_balancing_ref_if_LI}
+- special-category condition (Art. 9, if psychoprofile): {art9_condition_or_NA}
+- purpose: {specific_purpose}
+- retention: {retention_period} · DSAR/erasure contact: {dsar_contact}
+- recorded: {date} · see `assets/lawful-basis-record.md`
+
+---
+
+**контакты и соцсети**
+- telegram: {handle} {status}
+- linkedin: {url} {status}
+- instagram: {handle} {status}
+- facebook: {url} {status}
+- email: {email} {status}
+- телефон: {phone} {status}
+- другое: {any_other}
+
+---
+
+**биография**
+
+- дата рождения: {dob_only_if_confirmed_A_or_B}
+- возраст: {age}
+- место рождения: {birthplace}
+- образование: {education}
+
+**карьера:**
+- **{year}** — {role}, {company} ({age_at_time})
+- **{year}** — {role}, {company}
+- ...
+- **сейчас** — {current_role}, {current_company}
+
+паттерн карьеры: {career_pattern_description}
+
+---
+
+**текущая ситуация**
+- роль: {current_role}
+- компания: {current_company} — {company_description}
+- локация: {current_location}
+
+---
+
+**из переписки** 🔒
+*секция на основе Telegram/email — не для внешнего использования*
+
+- характер общения: {formal_informal_emoji_patterns}
+- темы: {what_they_discuss_ask_about}
+- стиль: {response_speed_active_hours_language}
+- контекст отношений: {cold_warm_hot_business_personal}
+- упомянутые люди: {colleagues_partners_from_conversations}
+- {any_deal_terms_pricing_discussed}
+
+---
+
+**психопрофиль**
+
+**MBTI: {type} ({confidence})**
+- E/I: {assessment} — {evidence}
+- S/N: {assessment} — {evidence}
+- T/F: {assessment} — {evidence}
+- J/P: {assessment} — {evidence}
+
+**стиль коммуникации:**
+- голос: {voice_description}
+- ритм: {rhythm_description}
+- эмодзи: {emoji_pattern}
+- формальный vs неформальный: {delta_between_linkedin_and_telegram}
+- ключевые маркеры: {markers}
+
+**ценности (по действиям):**
+- {value_1}
+- {value_2}
+- {value_3}
+
+---
+
+**личное**
+- семья: {family_only_confirmed}
+- питомцы: {pets_only_confirmed}
+- увлечения: {hobbies}
+- стиль жизни: {lifestyle}
+
+---
+
+**наблюдения**
+- {observation_1_contradictions_or_patterns}
+- {observation_2}
+- {observation_3}
+
+---
+
+**карта достоверности**
+- A (подтверждено, 2+ источника): {list_of_A_facts}
+- B (вероятно, 1 надёжный источник): {list_of_B_facts}
+- C (выведено, косвенные данные): {list_of_C_facts}
+- D (не подтверждено): {list_of_D_facts}
+
+---
+
+**точки входа**
+- {approach_1_shared_connections_or_topics}
+- {approach_2}
+- {approach_3}
+
+---
+
+**пробелы**
+- {gap_1_what_not_found}
+- {gap_2}
+
+---
+
+**метрики**
+- depth score: {score}/10
+- coverage: {passed}/{total} checks
+- источников: {source_count} ({source_types_list})
+- внутренняя разведка: {yes_no_what_checked}
+- потрачено: ${total_cost}

package/osint-agent-package/skills/bmad-osint-investigate/osint/assets/lawful-basis-record.md

@@ -1,48 +1,48 @@
-# Lawful Basis Record — OSINT investigation (GDPR Phase −1 gate)
-
-Complete this BEFORE profiling a named natural person. It doubles as the ROPA
-(Record of Processing Activities) entry for this investigation. Governed by Shield (GRC).
-
-## 1. Parties
-- **Controller:** {who decides why/how — org or person}
-- **Operator / analyst:** {who runs the investigation}
-- **Data subject:** {named person} — category: {public figure | employee | counterparty | other}
-
-## 2. Purpose (purpose limitation — GDPR Art. 5(1)(b))
-- **Specific purpose:** {e.g. pre-contract due diligence on a supplier director; NOT "find everything"}
-- **Why OSINT is necessary & proportionate for this purpose:** {justification}
-
-## 3. Lawful basis — GDPR Art. 6(1)
-Select ONE and justify:
-- [ ] (a) Consent — attach/reference the consent record
-- [ ] (b) Contract — necessary for a contract with the data subject
-- [ ] (c) Legal obligation — cite the obligation
-- [ ] (d) Vital interests
-- [ ] (e) Public task
-- [ ] (f) **Legitimate interest** — complete the 3-part balancing test below
-
-**Legitimate Interest Assessment (if (f)):**
-- Purpose test (is there a legitimate interest?): {…}
-- Necessity test (is OSINT necessary, or is there a less intrusive way?): {…}
-- Balancing test (do the person's rights/freedoms override?): {…}
-
-## 4. Special-category data — GDPR Art. 9 (REQUIRED if building a psychoprofile)
-Inferring personality (MBTI/Big Five), health, political opinions, religion, sexual
-orientation, etc. is special-category processing. Select an Art. 9(2) condition:
-- [ ] (a) Explicit consent
-- [ ] (e) Data manifestly made public by the data subject (document how)
-- [ ] (f) Legal claims
-- [ ] other: {cite}
-- **If none applies → do NOT build the psychoprofile.** Keep the factual dossier only.
-
-## 5. Data-subject rights & retention
-- **Retention period:** {e.g. 90 days after purpose fulfilled, then delete}
-- **DSAR / erasure contact:** {email/process to honor access, rectification, erasure, objection}
-- **Transparency:** how/whether the data subject is or will be informed (Art. 14), or the exemption relied on.
-
-## 6. Sign-off
-- Basis confirmed by: {name} · date: {date}
-- Shield review (if enterprise/high-risk): {ref or N/A}
-
-> If sections 2–4 cannot be completed, the Phase −1 gate FAILS: decline the
-> named-person profiling and use the non-personal research paths instead.
+# Lawful Basis Record — OSINT investigation (GDPR Phase −1 gate)
+
+Complete this BEFORE profiling a named natural person. It doubles as the ROPA
+(Record of Processing Activities) entry for this investigation. Governed by Shield (GRC).
+
+## 1. Parties
+- **Controller:** {who decides why/how — org or person}
+- **Operator / analyst:** {who runs the investigation}
+- **Data subject:** {named person} — category: {public figure | employee | counterparty | other}
+
+## 2. Purpose (purpose limitation — GDPR Art. 5(1)(b))
+- **Specific purpose:** {e.g. pre-contract due diligence on a supplier director; NOT "find everything"}
+- **Why OSINT is necessary & proportionate for this purpose:** {justification}
+
+## 3. Lawful basis — GDPR Art. 6(1)
+Select ONE and justify:
+- [ ] (a) Consent — attach/reference the consent record
+- [ ] (b) Contract — necessary for a contract with the data subject
+- [ ] (c) Legal obligation — cite the obligation
+- [ ] (d) Vital interests
+- [ ] (e) Public task
+- [ ] (f) **Legitimate interest** — complete the 3-part balancing test below
+
+**Legitimate Interest Assessment (if (f)):**
+- Purpose test (is there a legitimate interest?): {…}
+- Necessity test (is OSINT necessary, or is there a less intrusive way?): {…}
+- Balancing test (do the person's rights/freedoms override?): {…}
+
+## 4. Special-category data — GDPR Art. 9 (REQUIRED if building a psychoprofile)
+Inferring personality (MBTI/Big Five), health, political opinions, religion, sexual
+orientation, etc. is special-category processing. Select an Art. 9(2) condition:
+- [ ] (a) Explicit consent
+- [ ] (e) Data manifestly made public by the data subject (document how)
+- [ ] (f) Legal claims
+- [ ] other: {cite}
+- **If none applies → do NOT build the psychoprofile.** Keep the factual dossier only.
+
+## 5. Data-subject rights & retention
+- **Retention period:** {e.g. 90 days after purpose fulfilled, then delete}
+- **DSAR / erasure contact:** {email/process to honor access, rectification, erasure, objection}
+- **Transparency:** how/whether the data subject is or will be informed (Art. 14), or the exemption relied on.
+
+## 6. Sign-off
+- Basis confirmed by: {name} · date: {date}
+- Shield review (if enterprise/high-risk): {ref or N/A}
+
+> If sections 2–4 cannot be completed, the Phase −1 gate FAILS: decline the
+> named-person profiling and use the non-personal research paths instead.

package/osint-agent-package/skills/bmad-osint-investigate/osint/references/content-extraction.md

@@ -1,100 +1,100 @@
-# Content Extraction Guide
-
-When you find a content platform (YouTube, podcast, blog, conference talks) -
-**extract everything immediately.** Don't just note the URL and move on.
-
-## Principle
-
-Content platforms are the richest source for psychoprofile and real personality.
-LinkedIn is a resume. Instagram is a highlight reel. YouTube/podcasts are unfiltered.
-
-A person talking for 20 minutes on camera reveals more than 100 LinkedIn posts.
-
-## YouTube
-
-### Discovery
-```bash
-# Search for channel
-web_search "site:youtube.com <Name> <context>"
-bash skills/osint/scripts/exa.sh search "<Name> youtube channel"
-```
-
-### Channel metadata
-```bash
-# Fetch channel page - subscriber count, video count, about
-web_fetch "https://www.youtube.com/@<handle>"
-# Or channel page
-bash skills/osint/scripts/jina.sh read "https://www.youtube.com/@<handle>/about"
-```
-
-### Transcript extraction (CRITICAL)
-Pick 3-5 most viewed or most recent videos. Extract transcripts:
-```bash
-# Fetch video page - title, description, comments
-web_fetch "https://www.youtube.com/watch?v=<id>"
-# Get auto-generated transcript via Jina
-bash skills/osint/scripts/jina.sh read "https://www.youtube.com/watch?v=<id>"
-```
-
-If transcripts unavailable via fetch, try:
-```bash
-bash skills/osint/scripts/brightdata.sh scrape "https://www.youtube.com/watch?v=<id>"
-```
-
-### What to extract from YouTube:
-- **Topics** - what they talk about = what they care about
-- **Speaking style** - formal/casual, speed, filler words, humor
-- **Vocabulary** - jargon level, code-switching between languages
-- **Self-presentation** - humble/confident/arrogant, claims vs evidence
-- **Recurring themes** - across videos, what keeps coming back
-- **Guest interactions** - how they treat guests, who they invite
-- **Comment section** - audience demographics, sentiment
-- **Upload frequency** - consistency = discipline trait
-- **Video titles** - clickbait vs informative = marketing approach
-- **Playlists** - how they organize knowledge = thinking structure
-
-### Budget: 3-5 video transcripts via Jina = ~$0.02-0.05
-
-## Podcasts / Audio Appearances
-
-Search for podcast appearances:
-```bash
-web_search "<Name> podcast interview"
-bash skills/osint/scripts/exa.sh search "<Name> podcast episode guest"
-```
-
-Podcast interviews are gold - the host asks personal questions.
-Look for: origin story, career pivots, failures mentioned, mentors named.
-
-## Blog / Personal Website
-
-```bash
-web_fetch "<personal-site>"
-bash skills/osint/scripts/jina.sh read "<blog-url>"
-# Crawl multiple pages
-bash skills/osint/scripts/exa.sh crawl "<blog-url>"
-```
-
-Extract: writing style, topics, frequency, tone evolution over time.
-
-## Conference Talks / Speaker Bios
-
-```bash
-web_search "<Name> speaker conference talk"
-web_search "site:youtube.com <Name> conference keynote"
-```
-
-Speaker bios at conferences are often more honest than LinkedIn -
-written for specific audience, include unique details.
-
-## Rule: Immediate Deep Extraction
-
-When you discover ANY content platform during Phase 1-2:
-
-1. **STOP** current task
-2. **Extract** 3-5 pieces of content immediately
-3. **Analyze** for psychoprofile signals
-4. **Resume** original task with enriched data
-
-Do NOT bookmark for later. Later = never.
-The insight from 3 YouTube transcripts outweighs 10 LinkedIn connections.
+# Content Extraction Guide
+
+When you find a content platform (YouTube, podcast, blog, conference talks) -
+**extract everything immediately.** Don't just note the URL and move on.
+
+## Principle
+
+Content platforms are the richest source for psychoprofile and real personality.
+LinkedIn is a resume. Instagram is a highlight reel. YouTube/podcasts are unfiltered.
+
+A person talking for 20 minutes on camera reveals more than 100 LinkedIn posts.
+
+## YouTube
+
+### Discovery
+```bash
+# Search for channel
+web_search "site:youtube.com <Name> <context>"
+bash skills/osint/scripts/exa.sh search "<Name> youtube channel"
+```
+
+### Channel metadata
+```bash
+# Fetch channel page - subscriber count, video count, about
+web_fetch "https://www.youtube.com/@<handle>"
+# Or channel page
+bash skills/osint/scripts/jina.sh read "https://www.youtube.com/@<handle>/about"
+```
+
+### Transcript extraction (CRITICAL)
+Pick 3-5 most viewed or most recent videos. Extract transcripts:
+```bash
+# Fetch video page - title, description, comments
+web_fetch "https://www.youtube.com/watch?v=<id>"
+# Get auto-generated transcript via Jina
+bash skills/osint/scripts/jina.sh read "https://www.youtube.com/watch?v=<id>"
+```
+
+If transcripts unavailable via fetch, try:
+```bash
+bash skills/osint/scripts/brightdata.sh scrape "https://www.youtube.com/watch?v=<id>"
+```
+
+### What to extract from YouTube:
+- **Topics** - what they talk about = what they care about
+- **Speaking style** - formal/casual, speed, filler words, humor
+- **Vocabulary** - jargon level, code-switching between languages
+- **Self-presentation** - humble/confident/arrogant, claims vs evidence
+- **Recurring themes** - across videos, what keeps coming back
+- **Guest interactions** - how they treat guests, who they invite
+- **Comment section** - audience demographics, sentiment
+- **Upload frequency** - consistency = discipline trait
+- **Video titles** - clickbait vs informative = marketing approach
+- **Playlists** - how they organize knowledge = thinking structure
+
+### Budget: 3-5 video transcripts via Jina = ~$0.02-0.05
+
+## Podcasts / Audio Appearances
+
+Search for podcast appearances:
+```bash
+web_search "<Name> podcast interview"
+bash skills/osint/scripts/exa.sh search "<Name> podcast episode guest"
+```
+
+Podcast interviews are gold - the host asks personal questions.
+Look for: origin story, career pivots, failures mentioned, mentors named.
+
+## Blog / Personal Website
+
+```bash
+web_fetch "<personal-site>"
+bash skills/osint/scripts/jina.sh read "<blog-url>"
+# Crawl multiple pages
+bash skills/osint/scripts/exa.sh crawl "<blog-url>"
+```
+
+Extract: writing style, topics, frequency, tone evolution over time.
+
+## Conference Talks / Speaker Bios
+
+```bash
+web_search "<Name> speaker conference talk"
+web_search "site:youtube.com <Name> conference keynote"
+```
+
+Speaker bios at conferences are often more honest than LinkedIn -
+written for specific audience, include unique details.
+
+## Rule: Immediate Deep Extraction
+
+When you discover ANY content platform during Phase 1-2:
+
+1. **STOP** current task
+2. **Extract** 3-5 pieces of content immediately
+3. **Analyze** for psychoprofile signals
+4. **Resume** original task with enriched data
+
+Do NOT bookmark for later. Later = never.
+The insight from 3 YouTube transcripts outweighs 10 LinkedIn connections.

package/osint-agent-package/skills/bmad-osint-investigate/osint/references/gdpr-osint.md

@@ -1,48 +1,48 @@
-# GDPR & OSINT — governance for the investigate skill
-
-This pack performs OSINT on named individuals, including psychoprofiling. That is
-personal-data processing (GDPR + analogous laws such as UK GDPR, LGPD, CCPA/CPRA).
-BMAD+ **keeps** this capability and **governs** it — the Phase −1 lawful-basis gate
-in `SKILL.md` makes lawful use explicit and auditable rather than removing the pack.
-(Decision: keep + govern, 2026-07-02.)
-
-## Why this matters
-- Profiling and evaluating personal aspects is regulated (GDPR Art. 4(4), Art. 22, Recital 71).
-- Inferring personality, health, political/religious views, or sexual orientation is
-  **special-category** processing (Art. 9) — a higher bar than ordinary personal data.
-- "Publicly available" ≠ "no rules apply." Scraping public profiles is still processing;
-  you still need a lawful basis and must respect purpose limitation and data-subject rights.
-
-## The gate, in one line
-No lawful basis + specific purpose recorded (`assets/lawful-basis-record.md`) → no
-named-person profiling. Non-personal research (company/product/market, public entities)
-is unaffected.
-
-## Legitimate interest (the common basis)
-When relying on Art. 6(1)(f), complete the 3-part LIA in the record:
-1. **Purpose** — a real, specific legitimate interest (due diligence, fraud/security, journalism).
-2. **Necessity** — OSINT is necessary and proportionate; no less-intrusive route.
-3. **Balancing** — the person's rights/freedoms do not override; consider their reasonable
-   expectations, the sensitivity of the data, and any special-category inference (which
-   usually tips the balance and requires an Art. 9 condition instead).
-
-## Special-category / psychoprofile
-Only build the psychoprofile (MBTI/Big Five, etc.) with a valid **Art. 9(2)** condition
-(typically explicit consent, or data manifestly made public by the subject). Otherwise
-keep the factual dossier and skip the personality inference.
-
-## Data-subject rights & retention
-- Define a **retention period**; delete when the purpose is met.
-- Provide a **DSAR/erasure** path (access, rectification, erasure, objection).
-- Consider **transparency** (Art. 14) or a documented exemption.
-
-## Prohibited / out of scope
-- No profiling without a recorded basis + purpose.
-- No use for unlawful discrimination, harassment, stalking, or unauthorized surveillance.
-- No special-category inference without an Art. 9 condition.
-
-## Related BMAD+ assets
-- `SKILL.md` → Phase −1 gate.
-- `assets/lawful-basis-record.md` → gate record + ROPA entry.
-- Shield (GRC) pack → `gdpr-agent`, `legitimate-interest`, `dpia-sentinel`, `privacy-notice-gen`
-  for DPIA, LIA, ROPA, and privacy-notice generation at scale.
+# GDPR & OSINT — governance for the investigate skill
+
+This pack performs OSINT on named individuals, including psychoprofiling. That is
+personal-data processing (GDPR + analogous laws such as UK GDPR, LGPD, CCPA/CPRA).
+BMAD+ **keeps** this capability and **governs** it — the Phase −1 lawful-basis gate
+in `SKILL.md` makes lawful use explicit and auditable rather than removing the pack.
+(Decision: keep + govern, 2026-07-02.)
+
+## Why this matters
+- Profiling and evaluating personal aspects is regulated (GDPR Art. 4(4), Art. 22, Recital 71).
+- Inferring personality, health, political/religious views, or sexual orientation is
+  **special-category** processing (Art. 9) — a higher bar than ordinary personal data.
+- "Publicly available" ≠ "no rules apply." Scraping public profiles is still processing;
+  you still need a lawful basis and must respect purpose limitation and data-subject rights.
+
+## The gate, in one line
+No lawful basis + specific purpose recorded (`assets/lawful-basis-record.md`) → no
+named-person profiling. Non-personal research (company/product/market, public entities)
+is unaffected.
+
+## Legitimate interest (the common basis)
+When relying on Art. 6(1)(f), complete the 3-part LIA in the record:
+1. **Purpose** — a real, specific legitimate interest (due diligence, fraud/security, journalism).
+2. **Necessity** — OSINT is necessary and proportionate; no less-intrusive route.
+3. **Balancing** — the person's rights/freedoms do not override; consider their reasonable
+   expectations, the sensitivity of the data, and any special-category inference (which
+   usually tips the balance and requires an Art. 9 condition instead).
+
+## Special-category / psychoprofile
+Only build the psychoprofile (MBTI/Big Five, etc.) with a valid **Art. 9(2)** condition
+(typically explicit consent, or data manifestly made public by the subject). Otherwise
+keep the factual dossier and skip the personality inference.
+
+## Data-subject rights & retention
+- Define a **retention period**; delete when the purpose is met.
+- Provide a **DSAR/erasure** path (access, rectification, erasure, objection).
+- Consider **transparency** (Art. 14) or a documented exemption.
+
+## Prohibited / out of scope
+- No profiling without a recorded basis + purpose.
+- No use for unlawful discrimination, harassment, stalking, or unauthorized surveillance.
+- No special-category inference without an Art. 9 condition.
+
+## Related BMAD+ assets
+- `SKILL.md` → Phase −1 gate.
+- `assets/lawful-basis-record.md` → gate record + ROPA entry.
+- Shield (GRC) pack → `gdpr-agent`, `legitimate-interest`, `dpia-sentinel`, `privacy-notice-gen`
+  for DPIA, LIA, ROPA, and privacy-notice generation at scale.