devflow-kit 1.8.3 → 2.0.0

package/src/assets/skills/boundary-validation/references/violations.md

@@ -0,0 +1,211 @@
+# Boundary Validation — Violations
+
+Extended examples of validation violations to detect and fix, with citations.
+
+## Manual Validation Anti-Pattern [1]
+
+The core violation: scattering type checks instead of parsing through a schema.
+"If you just _check_ a property and then proceed, you've gained nothing — the
+type system doesn't know you checked." [1]
+
+```typescript
+// VIOLATION: Manual validation — no type proof, easy to miss cases
+function createUser(data: any): User {
+  if (!data.email || typeof data.email !== 'string') throw new Error('Invalid email');
+  if (!data.age || typeof data.age !== 'number' || data.age < 0) throw new Error('Invalid age');
+  if (!data.name || data.name.length > 100) throw new Error('Invalid name');
+  return { email: data.email, age: data.age, name: data.name };
+}
+```
+
+**Why this is wrong** [1][5]:
+- Scattered validation logic — no single source of truth
+- No type inference — `data` is still `any` after checks
+- Easy to miss edge cases (NaN, empty strings, overflow)
+- Inconsistent error handling (throws vs returns)
+- `any` propagates through the entire call chain [21]
+
+---
+
+## Missing API Boundary Validation [3][4][7]
+
+```typescript
+// VIOLATION: No validation at API boundary — trusts external data
+app.post('/api/users', async (req, res) => {
+  const user = await createUser(req.body); // hostile data flows in unchecked
+  res.json(user);
+});
+```
+
+**Security Risk**: HIGH — injection attacks, data corruption, type confusion [4][7]
+
+---
+
+## Trusting External API Responses [2]
+
+```typescript
+// VIOLATION: External API response consumed without parsing
+async function fetchUserData(userId: string): Promise<UserData> {
+  const response = await fetch(`https://api.example.com/users/${userId}`);
+  const data = await response.json();
+  return data; // no schema validation — crashes if API changes
+}
+```
+
+**Risk**: Runtime crash on API contract change, silent data corruption [2]
+
+---
+
+## Unvalidated Environment Variables [8]
+
+```typescript
+// VIOLATION: Environment variables used without parsing
+const config = {
+  port: process.env.PORT,           // undefined? string? NaN?
+  dbUrl: process.env.DATABASE_URL,  // could be empty or malformed
+  apiKey: process.env.API_KEY,      // could be missing entirely
+};
+```
+
+**Risk**: Subtle runtime failures instead of fail-fast startup crash [8]
+
+---
+
+## SQL Injection via String Interpolation [7][15]
+
+```typescript
+// VIOLATION: String interpolation in SQL — CRITICAL injection risk
+async function getUserByEmail(email: string): Promise<User> {
+  const query = `SELECT * FROM users WHERE email = '${email}'`;
+  return db.query(query);
+}
+
+// VIOLATION: Input not parsed before parameterized query
+async function searchUsers(searchTerm: string): Promise<User[]> {
+  return db.query('SELECT * FROM users WHERE name LIKE $1', [`%${searchTerm}%`]);
+}
+```
+
+**Security Risk**: CRITICAL — SQL injection allows data theft, modification, deletion [7][15]
+
+---
+
+## File Upload Without Validation [4]
+
+```typescript
+// VIOLATION: No validation on file upload — trusts everything
+app.post('/upload', async (req, res) => {
+  const file = req.files.document;
+  await file.mv(`./uploads/${file.name}`); // path traversal, arbitrary extension
+  res.send('Uploaded');
+});
+```
+
+**Risks**: Arbitrary file execution, path traversal (`../../etc/passwd`), storage exhaustion, malware [4]
+
+---
+
+## Unvalidated URL/Query Parameters [3][4]
+
+```typescript
+// VIOLATION: Path parameters used directly without parsing
+app.get('/users/:id', async (req, res) => {
+  const user = await db.users.findById(req.params.id); // could be anything
+  res.json(user);
+});
+
+// VIOLATION: Query parameters used directly
+app.get('/search', async (req, res) => {
+  const results = await db.search(req.query.q); // unchecked, could be array or object
+  res.json(results);
+});
+```
+
+**Risks**: NoSQL injection, type coercion attacks, DoS via crafted input [3]
+
+---
+
+## Header Trust Without Verification [4]
+
+```typescript
+// VIOLATION: Trusting request headers for identity
+app.use((req, res, next) => {
+  const userId = req.headers['x-user-id'];
+  req.userId = userId; // spoofable — never trust client headers for auth
+  next();
+});
+
+// VIOLATION: jwt.decode without jwt.verify
+app.use((req, res, next) => {
+  const token = req.headers.authorization?.split(' ')[1];
+  const decoded = jwt.decode(token); // decode != verify! No signature check
+  req.user = decoded;
+  next();
+});
+```
+
+**Risks**: Authentication bypass, privilege escalation [4]
+
+---
+
+## Webhook Without Signature Verification [9]
+
+```typescript
+// VIOLATION: Webhook payload trusted without signature check
+app.post('/webhook', async (req, res) => {
+  const event = req.body;
+  await processPaymentEvent(event); // spoofed events accepted
+  res.sendStatus(200);
+});
+```
+
+**Risks**: Spoofed events, unauthorized actions, financial manipulation [9]
+
+---
+
+## GraphQL Without Depth/Input Limits [3]
+
+```typescript
+// VIOLATION: No depth limits, no input validation
+const schema = buildSchema(`type Query { users(filter: UserFilter): [User] }`);
+
+resolvers.Query.users = (_, { filter }) => {
+  return db.users.find(filter); // filter passed directly to DB — injection risk
+};
+```
+
+**Risks**: Query complexity attacks, nested injection [3]
+
+---
+
+## Stored XSS via Unsanitized Form Data [4]
+
+```typescript
+// VIOLATION: User input rendered and stored without sanitization
+app.post('/profile', async (req, res) => {
+  const bio = req.body.bio;
+  await db.users.update({ bio });         // stored XSS
+  res.send(`Profile updated: ${bio}`);    // reflected XSS
+});
+```
+
+**Risks**: Cross-site scripting (XSS) — both stored and reflected [4]
+
+---
+
+## Detection Patterns
+
+When reviewing code, look for these red flags:
+
+| Pattern | Risk | Source |
+|---------|------|--------|
+| `req.body` without schema validation | HIGH | [3][4] |
+| `req.params` used directly | MEDIUM | [3] |
+| `req.query` used directly | MEDIUM | [3] |
+| `process.env` without validation | MEDIUM | [8] |
+| String interpolation in SQL | CRITICAL | [7][15] |
+| `JSON.parse` without schema | HIGH | [1] |
+| `eval()` or `Function()` with user input | CRITICAL | [7] |
+| File operations with user-provided paths | CRITICAL | [4] |
+| `jwt.decode` instead of `jwt.verify` | CRITICAL | [4] |
+| Missing webhook signature verification | HIGH | [9] |

package/src/assets/skills/complexity/SKILL.md

@@ -0,0 +1,150 @@
+---
+name: complexity
+description: This skill should be used when reviewing code for high cyclomatic complexity, deep nesting, or long functions.
+user-invocable: false
+allowed-tools: Read, Grep, Glob
+---
+
+# Complexity Patterns
+
+Domain expertise for code complexity and maintainability analysis. Use alongside `devflow:review-methodology` for complete complexity reviews.
+
+## Iron Law
+
+> **IF YOU CAN'T UNDERSTAND IT IN 5 MINUTES, IT'S TOO COMPLEX**
+>
+> Every function should be explainable to a colleague in under 5 minutes. If you need a
+> diagram to understand control flow, refactor. If you need comments to explain what
+> (not why), the code is too clever. Simplicity is a feature, complexity is a bug.
+
+---
+
+## Complexity Categories
+
+### 1. Cyclomatic Complexity
+
+High decision path count makes code hard to test and understand.
+
+**Violation**: Deep nesting (5+ levels)
+```typescript
+if (order) {
+  if (order.items) {
+    for (const item of order.items) {
+      if (item.quantity > 0) {
+        if (item.product?.inStock) {
+          // Buried logic
+```
+
+**Solution**: Early returns and extraction
+```typescript
+function processOrder(order: Order) {
+  if (!order?.items) return;
+  for (const item of order.items) processItem(item);
+}
+
+function processItem(item: OrderItem) {
+  if (item.quantity <= 0 || !item.product?.inStock) return;
+  // Logic at top level
+}
+```
+
+### 2. Readability Issues
+
+Code that requires mental effort to parse.
+
+**Violation**: Magic values
+```typescript
+if (status === 3) {
+  setTimeout(callback, 86400000);
+}
+```
+
+**Solution**: Named constants
+```typescript
+const OrderStatus = { COMPLETED: 3 } as const;
+const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+
+if (status === OrderStatus.COMPLETED) {
+  setTimeout(callback, ONE_DAY_MS);
+}
+```
+
+### 3. Maintainability Issues
+
+Code that's expensive to change.
+
+**Violation**: Long parameter lists
+```typescript
+function createUser(name, email, password, role, dept, manager, startDate, salary) { }
+```
+
+**Solution**: Object parameter
+```typescript
+interface CreateUserParams {
+  name: string; email: string; password: string;
+  role: string; department: string; manager?: string;
+  startDate: Date; salary: number;
+}
+function createUser(params: CreateUserParams) { }
+```
+
+### 4. Boolean Complexity
+
+Conditions that are hard to reason about.
+
+**Violation**: Complex boolean expression
+```typescript
+if (user.active && !user.deleted && (user.role === 'admin' || user.role === 'moderator') && user.verified && (!user.suspended || user.suspendedUntil < Date.now())) { }
+```
+
+**Solution**: Extract to named predicate
+```typescript
+const canModerate = (user: User): boolean => {
+  if (!user.active || user.deleted || !user.verified) return false;
+  if (!['admin', 'moderator'].includes(user.role)) return false;
+  if (user.suspended && user.suspendedUntil >= Date.now()) return false;
+  return true;
+};
+
+if (canModerate(user)) { }
+```
+
+### 5. Reliability Patterns
+
+Operations that risk non-termination or resource exhaustion. See `devflow:reliability` for
+full coverage of bounded iteration, assertion density, allocation discipline, and indirection limits.
+Complexity-relevant: unbounded loops increase cyclomatic complexity and make termination reasoning harder.
+
+---
+
+## Extended References
+
+For extended examples and detection techniques:
+
+| Reference | Content |
+|-----------|---------|
+| `references/violations.md` | Extended violation examples for all categories |
+| `references/patterns.md` | Detailed refactoring solutions |
+| `references/detection.md` | Bash commands and static analysis setup |
+
+---
+
+## Severity Guidelines
+
+| Severity | Criteria |
+|----------|----------|
+| **CRITICAL** | Functions > 200 lines, complexity > 20, nesting > 6, duplication in 5+ places, unbounded loop on external I/O |
+| **HIGH** | Functions 50-200 lines, complexity 10-20, nesting 4-6, 5+ boolean conditions, 5+ parameters, retry with no max |
+| **MEDIUM** | Functions 30-50 lines, complexity 5-10, magic values, minor duplication |
+| **LOW** | Could be more readable, naming improvements, comments would help |
+
+## Metrics Quick Reference
+
+| Metric | Good | Warning | Critical |
+|--------|------|---------|----------|
+| Function length | < 30 | 30-50 | > 50 |
+| Cyclomatic complexity | < 5 | 5-10 | > 10 |
+| Nesting depth | < 3 | 3-4 | > 4 |
+| Parameters | < 3 | 3-5 | > 5 |
+| File length | < 300 | 300-500 | > 500 |
+| Loop bound | explicit | implicit | unbounded |

package/src/assets/skills/compliance/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: compliance
+description: This skill should be used when reviewing code handling PII, payment data, health records, audit logs, data retention, or IaC under GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, or SOX.
+user-invocable: false
+allowed-tools: Read, Grep, Glob
+---
+
+# Compliance Patterns
+
+<!-- Composition tokens (5): DEVFLOW_COMPLIANCE_SCOPE, DEVFLOW_COMPLIANCE_ACTIVE,
+     DEVFLOW_COMPLIANCE_MAPPING, DEVFLOW_COMPLIANCE_CHECKLIST, DEVFLOW_COMPLIANCE_REFERENCES.
+     Dynamic sections compose from frameworks/{id}/fragment.md at install time (C1: token-free shadows pass through). -->
+
+Regulatory compliance review for code that touches regulated data ${DEVFLOW_COMPLIANCE_SCOPE}. Use alongside `devflow:security` for complete coverage.
+
+## Iron Law
+
+> **IF IT TOUCHES REGULATED DATA: CLASSIFY IT, MINIMIZE IT, ENCRYPT IT, AUDIT IT**
+>
+> Regulated data crossing a code path without classification, minimization, encryption,
+> or an audit trail is a compliance gap — regardless of framework. No exceptions.
+
+## Active Frameworks
+
+${DEVFLOW_COMPLIANCE_ACTIVE}
+
+## Scope Boundary
+
+Compliance covers regulatory-specific gaps: retention, erasure/data-subject rights, audit-trail completeness (actor/purpose fields), segregation of duties, framework mapping, IaC exposure. Do NOT re-raise security lens findings (injection, secret handling, authN/Z) — reference those via framework mapping only.
+
+## Clean-Report Contract
+
+If the diff/design has no regulated-data surface (no PII/PHI/payment fields, no sensitive data in logs, no IaC, no auth/audit/retention changes) → emit zero findings with a one-line "no compliance-relevant surface detected" note. Never manufacture findings.
+
+## Control Categories
+
+### 1. Data Classification & Minimization
+```typescript
+// VULNERABLE: full SSN stored when only last-4 needed
+user.ssn = req.body.ssn;
+// COMPLIANT: store minimum; annotate purpose + retention
+user.ssnLast4 = req.body.ssn.slice(-4); // retention: 90d for verification
+```
+
+### 2. Sensitive Data in Logs & Errors
+```typescript
+// VULNERABLE: PII in structured log
+logger.info('login', { email, password, creditCard });
+// COMPLIANT: omit or mask regulated fields
+logger.info('login', { userId, ip });
+```
+
+### 3. Encryption In Transit & At Rest
+```typescript
+// VULNERABLE: plaintext PHI written to disk
+fs.writeFileSync('/data/patients.json', JSON.stringify(records));
+// COMPLIANT: encrypt before write; TLS enforced at transport
+await vault.encrypt(records, { key: 'phi-key', algo: 'AES-256-GCM' });
+```
+
+### 4. Audit Trails & Change Traceability
+```typescript
+// VULNERABLE: mutation with no audit entry; no segregation of duties
+await db.update('orders', { status: 'refunded' }, { id });
+// COMPLIANT: append-only audit before state change; actor ≠ approver
+await audit.append({ actor, action: 'refund', target: id, purpose, ts: Date.now() });
+await db.update('orders', { status: 'refunded' }, { id });
+```
+
+### 5. Retention & Erasure
+```typescript
+// VULNERABLE: PII stored with no deletion path
+await db.insert('user_pii', { userId, ssn, email });
+// COMPLIANT: TTL field + erasure handler registered at write time
+await db.insert('user_pii', { userId, ssn, email, retainUntil: addDays(90) });
+await erasure.register(userId, ['user_pii']);
+```
+
+### 6. Environments & IaC
+```hcl
+# VULNERABLE: public bucket, no encryption, no access logging
+resource "aws_s3_bucket" "data" { acl = "public-read" }
+# COMPLIANT: private, encrypted, logging enabled
+resource "aws_s3_bucket_acl" "data" { acl = "private" }
+resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
+  rule { apply_server_side_encryption_by_default { sse_algorithm = "AES256" } }
+}
+resource "aws_s3_bucket_logging" "data" { target_bucket = var.audit_bucket_id }
+```
+
+---
+
+## Severity
+
+| Level | Criteria |
+|-------|----------|
+| **CRITICAL** | Plaintext regulated data exposed; public IaC exposure of regulated stores |
+| **HIGH** | Missing audit trail on regulated mutations; PII in logs or errors |
+| **MEDIUM** | Missing retention/erasure paths; weak traceability (no actor/purpose) |
+| **LOW** | No active framework reference files installed; documentation/annotation gaps |
+
+${DEVFLOW_COMPLIANCE_MAPPING}
+
+## Checklist
+
+- [ ] Active frameworks identified from installed `references/{id}.md` files; controls applied
+- [ ] No PII/PHI/payment data in logs, errors, or analytics events
+- [ ] Regulated data encrypted in transit (TLS 1.2+) and at rest
+- [ ] Every regulated mutation has an append-only audit entry (actor, purpose, timestamp)
+- [ ] All stored fields have a declared purpose, retention period, and deletion path
+- [ ] Segregation of duties enforced — no self-approval of regulated state changes
+- [ ] IaC scanned: no public buckets/SGs, no unencrypted volumes, no wildcard IAM
+${DEVFLOW_COMPLIANCE_CHECKLIST}
+
+## Extended References
+
+| Reference | Contents |
+|-----------|---------|
+| `references/detection.md` | Grep patterns: PII field names, logging sinks, crypto misuse; IaC globs |
+| `references/sources.md` | NIST SSDF SP 800-218, OWASP ASVS 5.0, GDPR, HIPAA, PCI DSS v4.0.1, AICPA TSC, ISO/IEC 27001, SOX |
+${DEVFLOW_COMPLIANCE_REFERENCES}

package/src/assets/skills/compliance/frameworks/gdpr/fragment.md

@@ -0,0 +1,11 @@
+## Mapping
+| Art. 25 | Art. 32 | Art. 32 | Art. 30/32 | Art. 17 | Art. 25 |
+
+## Reference
+Data-subject rights endpoints, Art. 25/30/32/33 as code-level checks
+
+## Checklist
+- [ ] Data-subject rights handlers present (erasure, portability) when GDPR is in scope
+
+## Rule
+- Apply GDPR: classify all personal-data fields, implement erasure and portability endpoints, and audit every access.

package/src/assets/skills/compliance/frameworks/gdpr/reference.md

@@ -0,0 +1,50 @@
+# GDPR — Code-Level Checks
+
+**Regulation**: EU General Data Protection Regulation 2016/679
+
+## Key Articles as Code Checks
+
+### Art. 25 — Data Protection by Design and by Default
+- Schema design: collect only fields with a documented purpose (`purpose` column or annotation)
+- Default values must not over-share; opt-in, not opt-out, for non-essential data processing
+
+### Art. 30 — Records of Processing Activities
+- Each data store must have a corresponding processing record (purpose, retention, recipients)
+- Code owning a new regulated table should emit a warning if no processing record is referenced
+
+### Art. 32 — Security of Processing
+- Encrypted in transit (TLS 1.2+) and at rest (AES-256-GCM or equivalent)
+- Access controls scoped to least privilege; no shared service accounts with write access
+
+### Art. 33 — Notification of a Personal Data Breach
+- Breach detection requires audit logs sufficient to determine scope and affected subjects
+- Code review: verify logging captures which records were accessed, by whom, and when
+
+## Data-Subject Rights Endpoints
+
+| Right | Art. | Code obligation |
+|-------|------|----------------|
+| Access (SAR) | 15 | Export endpoint returning all data held for a subject |
+| Rectification | 16 | Update path that records the correction in the audit log |
+| Erasure ("Right to be Forgotten") | 17 | Hard-delete or anonymization; cascades to all replicas |
+| Portability | 20 | Machine-readable export (JSON/CSV) of subject's own data |
+| Restriction | 18 | Flag to suppress processing without deleting the record |
+
+## Retention Pattern
+
+```typescript
+// Each PII insert must register an erasure handler and TTL
+await db.insert('user_profiles', {
+  userId, email, name,
+  createdAt: new Date(),
+  retainUntil: addYears(new Date(), 3), // explicit retention period
+});
+await erasureRegistry.register(userId, ['user_profiles', 'audit_events']);
+```
+
+## Common Code-Level Gaps
+
+- Missing erasure cascade: deleting the user row but not linked tables
+- Soft deletes that leave PII queryable post-erasure request
+- Analytics events that include email or userId in plaintext event properties
+- Backup/export pipelines that bypass the encryption layer

package/src/assets/skills/compliance/frameworks/hipaa/fragment.md

@@ -0,0 +1,11 @@
+## Mapping
+| §164.514 | §164.312(b) | §164.312(a)(2) | §164.312(b) | §164.530(j) | §164.312(a) |
+
+## Reference
+PHI/18 identifiers, §164.312 safeguards, minimum-necessary, 6-year retention
+
+## Checklist
+- [ ] PHI access scoped to minimum necessary; 6-year retention policy documented
+
+## Rule
+- Apply HIPAA: scope PHI access to minimum necessary, encrypt all PHI at rest and in transit, retain records for 6 years.

package/src/assets/skills/compliance/frameworks/hipaa/reference.md

@@ -0,0 +1,44 @@
+# HIPAA — Code-Level Checks
+
+**Regulation**: Health Insurance Portability and Accountability Act — 45 CFR Part 164
+
+## The 18 PHI Identifiers
+
+Any field containing one of these transforms ordinary data into PHI requiring full safeguards:
+
+Names, geographic data below state level, dates (except year) for individuals, phone numbers, fax numbers, email addresses, SSNs, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers, device identifiers, URLs, IPs, biometric identifiers, full-face photographs, any other unique identifying number.
+
+**Pattern**: grep for field names matching `name|dob|birth|ssn|mrn|phone|email|address|zip|ip_addr` in models that live in health-related services.
+
+## §164.312 — Technical Safeguards
+
+| Safeguard | §164.312 ref | Code obligation |
+|-----------|-------------|----------------|
+| Access control | (a)(1) | Unique user IDs; no shared credentials; role-based access |
+| Audit controls | (b) | Log all PHI access: user, timestamp, record touched, action |
+| Integrity | (c)(1) | Checksums or MACs on PHI at rest; detect tampering |
+| Transmission security | (e)(1) | TLS 1.2+ for all PHI in transit; no plaintext channels |
+
+## Minimum Necessary Principle (§164.502(b))
+
+Code reviews must check:
+- API responses do not include PHI fields not needed by the caller
+- Query projections are explicit (`SELECT mrn, dob` not `SELECT *`)
+- Logs contain event metadata, never PHI content
+
+## Retention
+
+HIPAA §164.530(j) requires covered entities to retain required documentation (policies, procedures, and records mandated by the rules) for **6 years** from creation or last effective date. HIPAA sets **no federal PHI retention period** — state law governs how long medical records must be kept. Code must:
+- Store a `retainUntil` timestamp on every PHI record (6 years is a conservative default covering required documentation; verify applicable state law for medical records)
+- Prevent deletion before the retention period unless a HIPAA-compliant destruction process is followed
+
+## Business Associate Agreements (BAA)
+
+Third-party services receiving PHI must have a BAA on file. Code review flag: any external HTTP call that includes PHI fields in the request body or query string.
+
+## Common Code-Level Gaps
+
+- PHI included in exception messages caught by logging middleware
+- Audit log records missing the `purpose` or `user_id` field
+- Backup files stored in unencrypted S3 buckets or local dev volumes
+- PHI columns returned in paginated list endpoints consumed by non-clinical roles

package/src/assets/skills/compliance/frameworks/iso-27001/fragment.md

@@ -0,0 +1,10 @@
+## Mapping
+| A.5.12 | A.8.15 | A.8.24 | A.8.15 | A.8.10 | A.8.25/A.8.27 |
+
+## Reference
+Annex A: A.5.12 classification, A.8.15 logging, A.8.25–A.8.29 secure dev
+
+## Checklist
+
+## Rule
+- Apply ISO 27001: classify data per A.5.12, log access per A.8.15, harden IaC per A.8.25–A.8.27.

package/src/assets/skills/compliance/frameworks/iso-27001/reference.md

@@ -0,0 +1,45 @@
+# ISO/IEC 27001 — Code-Level Checks
+
+**Standard**: ISO/IEC 27001:2022 Annex A — Information Security Controls
+
+## Relevant Annex A Controls as Code Checks
+
+### A.5 — Organizational Controls (Information Classification & Handling)
+
+| Control | Code obligation |
+|---------|----------------|
+| A.5.12 Classification of information | Annotate data models with classification level (public / internal / confidential / restricted) |
+| A.5.10 Acceptable use of information | Confidential/restricted data must be encrypted at rest and in transit |
+
+### A.8 — Technological Controls (Logging, Monitoring, Cryptography, Secure Development)
+
+| Control | Code obligation |
+|---------|----------------|
+| A.8.10 Information deletion | Secure deletion procedures for regulated data; overwrite or cryptographic erasure |
+| A.8.15 Logging | Log privileged access, authentication events, and data access to regulated stores; logs must be append-only or write to a tamper-resistant sink; no log deletion by app code |
+| A.8.16 Monitoring activities | Monitor and alert on anomalous access patterns and privilege escalation |
+| A.8.17 Clock synchronization | All log timestamps from NTP-synchronized source; UTC ISO-8601 format |
+| A.8.24 Use of cryptography | Approved algorithms only (AES-256-GCM, RSA-4096+, ECDSA-P256+); no MD5/SHA-1 for security |
+| A.8.25 Secure development life cycle | Security review gates in the CI/CD pipeline |
+| A.8.26 Application security requirements | TLS enforced; no HTTP fallback for services handling regulated data |
+| A.8.27 Secure system architecture and engineering principles | Defense in depth; fail secure; least privilege |
+| A.8.29 Security testing in development and acceptance | Security tests in CI; dependency scanning; SAST for confidential-data code paths |
+
+## Classification Annotation Pattern
+
+```typescript
+/** @classification confidential — contains employee PII */
+interface EmployeeRecord {
+  id: string;
+  name: string;       // PII
+  nationalId: string; // PII — restricted
+  department: string; // internal
+}
+```
+
+## Common Code-Level Gaps
+
+- No data classification in model definitions (A.5.12)
+- Logs written to the same sink as application output — no tamper protection (A.8.15)
+- Development environment using production data without de-identification (A.8.29)
+- Deprecated cryptographic primitives (MD5, SHA-1) used for data integrity (A.8.24)

package/src/assets/skills/compliance/frameworks/pci-dss/fragment.md

@@ -0,0 +1,11 @@
+## Mapping
+| Req 3 | Req 3.5.1 | Req 3/4 | Req 10.x | Req 3.2.1 | Req 1/6.x |
+
+## Reference
+Scope minimization, no CVV/track data, Req 3/6.x/10, tokenization; need-based retention (Req 3.2.1)
+
+## Checklist
+- [ ] No CVV, full PAN, or magnetic-stripe track data retained post-authorization
+
+## Rule
+- Apply PCI DSS: never retain CVV or full PAN post-auth, scope cardholder data to minimum required surfaces.