dew-method 0.1.0

package/src/dew-skills/3-solutioning/dew-governance-security-design/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: dew-governance-security-design
+description: Design privacy posture, access control, ownership, lineage, metadata, auditability, and governance rules for the data product.
+---
+
+# DEW Governance Security Design
+
+**Goal:** Define governance and security design for the data product.
+
+**Your Role:** You are a governance and security facilitator.
+
+You identify privacy/security risks, access requirements, ownership, lineage, metadata, and auditability expectations.
+
+You may recommend, but you must not decide.
+
+## Mandatory Rules
+
+- Do not skip privacy/security review.
+- Do not expose serving assets without access control decision.
+- Do not assume data is non-sensitive without review.
+- If privacy/security is unreviewed, trigger `HALT-16`.
+- If ownership is unclear, mark governance risk.
+- If lineage/metadata is insufficient for trust expectation, trigger caveat.
+
+## Workflow Architecture
+
+This workflow uses step-file architecture.
+
+## On Activation
+
+1. Resolve customization.
+2. Execute `{workflow.activation_steps_prepend}`.
+3. Load persistent facts.
+4. Load config if present.
+5. Load:
+   - `{workflow.governance_security_review_template}`
+   - `{workflow.access_control_matrix_template}`
+   - `{workflow.privacy_post_rubric}`
+   - `{workflow.lineage_metadata_rubric}`
+   - `{workflow.governance_decision_record_template}`
+6. Greet user in configured language.
+
+## Execution
+
+Read fully and follow:
+
+`steps/step-01-init.md`

package/src/dew-skills/3-solutioning/dew-governance-security-design/assets/access-control-matrix-template.md

@@ -0,0 +1,41 @@
+# Access Control Matrix Template
+
+```markdown
+# Access Control Matrix
+
+## Purpose
+
+Define who can access which data product assets.
+
+## Matrix
+
+| Role / User Group | Asset | Access Level | Purpose | Approval Needed? | Notes |
+|---|---|---|---|---|---|
+| Analyst | gold_mart | read | analysis | Yes/No | |
+| Farmer/User | web app feature | view only | advisory | Yes/No | |
+| Data Engineer | pipeline/logs | admin/write | operations | Yes | |
+
+## Access Levels
+
+- none
+- view
+- read
+- write
+- admin
+- owner
+
+## Asset Types
+
+- raw/bronze data
+- silver data
+- gold data
+- dashboard
+- API
+- web app feature
+- logs
+- DQ results
+- evidence artifacts
+- decision logs
+
+## Caveats
+```

package/src/dew-skills/3-solutioning/dew-governance-security-design/assets/governance-decision-record-template.md

@@ -0,0 +1,38 @@
+# Governance Decision Records
+
+## GDR-0001 — {Decision Title}
+
+Date:
+
+Status:
+- proposed
+- accepted
+- accepted-with-caveats
+- rejected
+- superseded
+
+## Context
+
+## Decision
+
+## Options Considered
+
+## Selected Option
+
+## Rationale
+
+## Evidence Used
+
+## Consequences
+
+## Access / Privacy Impact
+
+## Revisit Trigger
+
+## Downstream Impact
+
+- DataOps:
+- Implementation stories:
+- Serving:
+- Documentation:
+```

package/src/dew-skills/3-solutioning/dew-governance-security-design/assets/governance-security-review-template.md

@@ -0,0 +1,102 @@
+# Governance Security Review Template
+
+```markdown
+---
+title: "{Project Name} Governance Security Review"
+status: draft
+created: {YYYY-MM-DD}
+updated: YYYY-MM-DD
+workflow: dew
+phase: "3-solutioning"
+stepsCompleted: []
+decisionGates:
+  GATE-21-privacy-posture:
+    status: pending
+  GATE-access-control:
+    status: pending
+evidence: []
+assumptions: []
+caveats: []
+---
+
+# Governance Security Review: {Project Name}
+
+## 0. Document Purpose
+
+This document defines governance, privacy, security, access control, lineage, metadata, and auditability expectations.
+
+## 1. Input Context
+
+| Input | Path | Status | Notes |
+|---|---|---|---|
+| Serving Spec | | Loaded/Missing | |
+| Trust Statement | | Loaded/Missing | |
+| Data Model Spec | | Loaded/Missing | |
+| DQ Rules | | Loaded/Missing | |
+| Source Validation | | Loaded/Missing | |
+| Storage Design | | Loaded/Missing | |
+| Ingestion Design | | Loaded/Missing | |
+
+## 2. Data Sensitivity Review
+
+| Dataset / Asset | Contains Sensitive Data? | Type | Risk | Notes |
+|---|---|---|---|---|
+| | Yes/No/Unknown | PII/Internal/Public/etc. | Low/Medium/High | |
+
+## 3. Privacy Posture
+
+Choose one:
+
+A. No sensitive data identified  
+B. Low-risk internal data  
+C. PII/sensitive data present with controls  
+D. High-risk data requiring governance review  
+E. Unknown; block until reviewed  
+
+Selected:
+
+## 4. Access Control Matrix
+
+See:
+
+`access-control-matrix.md`
+
+## 5. Ownership
+
+| Asset | Owner | Steward | Technical Owner | Notes |
+|---|---|---|---|---|
+
+## 6. Lineage and Metadata
+
+### Required Lineage
+
+### Required Metadata
+
+### Evidence Links
+
+## 7. Auditability
+
+What needs to be auditable:
+- source input
+- ingestion run
+- transformation run
+- DQ result
+- metric definition
+- user-facing caveat
+- access decision
+
+## 8. Governance Risks
+
+| Risk ID | Risk | Severity | Mitigation |
+|---|---|---|---|
+
+## 9. Handoff to DataOps
+
+DataOps must operationalize:
+- monitoring
+- logs
+- access checks
+- DQ evidence
+- incident process
+- change process
+```

package/src/dew-skills/3-solutioning/dew-governance-security-design/assets/lineage-metadata-rubric.md

@@ -0,0 +1,47 @@
+# Lineage Metadata Rubric
+
+## Minimal lineage
+
+Use when:
+- learning/portfolio project
+- few sources
+- low trust expectation
+
+Minimum:
+- source file/path
+- source system
+- run timestamp
+- transformation note
+
+## Operational lineage
+
+Use when:
+- internal decision-support
+- recurring pipeline
+- DQ evidence matters
+
+Minimum:
+- source system
+- source object/file
+- ingestion run ID
+- transform run ID
+- schema version
+- DQ status
+- evidence path
+
+## Full audit lineage
+
+Use when:
+- trusted shared product
+- compliance/auditability needed
+- multiple consumers
+
+Minimum:
+- source version
+- ingestion job/run
+- transformation job/run
+- DQ rules/results
+- metric version
+- access decision
+- caveat version
+- owner approval

package/src/dew-skills/3-solutioning/dew-governance-security-design/assets/privacy-posture-rubric.md

@@ -0,0 +1,35 @@
+# Privacy Posture Rubric
+
+## A. No sensitive data identified
+
+Use when:
+- data is public or non-sensitive
+- no personal data
+- no restricted internal data
+
+## B. Low-risk internal data
+
+Use when:
+- data is internal
+- no direct PII
+- access should still be controlled
+
+## C. PII/sensitive data present with controls
+
+Use when:
+- personal or sensitive fields exist
+- access controls, minimization, and retention must be explicit
+
+## D. High-risk data requiring governance review
+
+Use when:
+- regulated data
+- sensitive personal data
+- safety/financial/legal risk
+- external exposure
+
+## E. Unknown; block until reviewed
+
+Use when:
+- data sensitivity is unclear
+- source content has not been inspected

package/src/dew-skills/3-solutioning/dew-governance-security-design/checklist.md

@@ -0,0 +1,16 @@
+# Governance Security Design Checklist
+
+- [ ] Serving spec loaded.
+- [ ] Trust and limitations statement loaded.
+- [ ] Data model spec loaded.
+- [ ] Source validation loaded.
+- [ ] Data sensitivity reviewed.
+- [ ] Privacy posture selected by user.
+- [ ] Access control matrix created.
+- [ ] Owners/stewards identified or caveated.
+- [ ] Lineage/metadata requirements defined.
+- [ ] Auditability requirements defined.
+- [ ] Governance risks documented.
+- [ ] Decision log updated.
+- [ ] Learning log updated if enabled.
+- [ ] HALT-16 resolved or caveated.

package/src/dew-skills/3-solutioning/dew-governance-security-design/customize.toml

@@ -0,0 +1,39 @@
+# DO NOT EDIT -- overwritten on every update.
+#
+# Workflow customization surface for dew-governance-security-design.
+
+[workflow]
+
+activation_steps_prepend = []
+activation_steps_append = []
+
+persistent_facts = [
+  "file:{project-root}/**/serving-data-product-spec.md",
+  "file:{project-root}/**/metric-serving-contract.md",
+  "file:{project-root}/**/trust-and-limitations-statement.md",
+  "file:{project-root}/**/data-product-prd.md",
+  "file:{project-root}/**/data-model-spec.md",
+  "file:{project-root}/**/data-quality-rules.md",
+  "file:{project-root}/**/storage-design.md",
+  "file:{project-root}/**/ingestion-design.md",
+  "file:{project-root}/**/source-validation-report.md",
+  "file:{project-root}/**/validation-evidence-index.md",
+  "file:{project-root}/**/.decision-log.md",
+  "file:{project-root}/**/.learning-log.md",
+]
+
+on_complete = ""
+
+governance_security_review_template = "assets/governance-security-review-template.md"
+access_control_matrix_template = "assets/access-control-matrix-template.md"
+privacy_posture_rubric = "assets/privacy-posture-rubric.md"
+lineage_metadata_rubric = "assets/lineage-metadata-rubric.md"
+governance_decision_record_template = "assets/governance-decision-record-template.md"
+checklist = "checklist.md"
+
+governance_output_path = "{planning_artifacts}/governance-security-design"
+run_folder_pattern = "governance-security-{project_name}-{date}"
+
+decision_log_path = "{planning_artifacts}/.decision-log.md"
+learning_log_path = "{learning_artifacts}/.learning-log.md"
+evidence_index_path = "{evidence_artifacts}/validation-evidence-index.md"

package/src/dew-skills/3-solutioning/dew-governance-security-design/steps/step-01-init.md

@@ -0,0 +1,62 @@
+# Step 01 — Governance Security Initialization
+
+## Mandatory Rules
+
+- Do not proceed if serving design is missing.
+- Do not assume privacy posture.
+- Read the complete step before acting.
+
+## Task
+
+Initialize Governance Security Design workflow.
+
+## Sequence
+
+### 1. Detect existing workflow
+
+Look for:
+- `{workflow.governance_output_path}/**/governance-security-review.md`
+- `{planning_artifacts}/**/*governance*.md`
+- `{planning_artifacts}/**/*security*.md`
+
+If unfinished workflow exists, offer to resume.
+
+### 2. Validate prerequisites
+
+Look for:
+- `serving-data-product-spec.md`
+- `trust-and-limitations-statement.md`
+- `data-model-spec.md`
+- `source-validation-report.md`
+
+If missing:
+- missing serving → return to `dew-serving-design`
+- missing source validation → `HALT-06`
+
+### 3. Create workspace
+
+Bind `{doc_workspace}` to:
+
+`{workflow.governance_output_path}/{workflow.run_folder_pattern}/`
+
+Create:
+- `governance-security-review.md`
+- `access-control-matrix.md`
+- `governance-decision-record.md`
+
+Use templates.
+
+### 4. Initialize frontmatter
+
+Set:
+
+```yaml
+status: draft
+stepsCompleted:
+  - step-01-init
+decisionGates:
+  GATE-21-privacy-posture:
+    status: pending
+  GATE-access-control:
+    status: pending
+```

package/src/dew-skills/3-solutioning/dew-governance-security-design/steps/step-02-load-serving-and-data-context.md

@@ -0,0 +1,46 @@
+# Step 02 — Load Serving and Data Context
+
+## Mandatory Rules
+
+- Review actual served assets and datasets.
+- Do not assume data is public/non-sensitive.
+
+## Task
+
+Extract governance/security context.
+
+## Extract
+
+From serving spec:
+- consumers
+- assets
+- serving modes
+- external/internal exposure
+- trust limitations
+
+From data model:
+- fields
+- Gold/Silver assets
+- possible sensitive fields
+
+From source validation:
+- source type
+- provider
+- license/usage notes
+- privacy risk
+
+From DQ/governance caveats:
+- known risks
+- quality limitations
+
+## Update
+
+Update:
+- governance-security-review.md
+- access-control-matrix.md
+
+## Continue checkpoint
+
+Ask:
+
+`[C] Continue to privacy posture gate`

package/src/dew-skills/3-solutioning/dew-governance-security-design/steps/step-03-privacy-posture-gate.md

@@ -0,0 +1,49 @@
+# Step 03 — Privacy Posture Gate
+
+## Mandatory Rules
+
+- Stop at this gate.
+- User must approve privacy posture.
+- If sensitivity is unknown, recommend blocking until reviewed.
+- If privacy/security unreviewed, trigger HALT-16.
+
+## Options
+
+A. No sensitive data identified  
+B. Low-risk internal data  
+C. PII/sensitive data present with controls  
+D. High-risk data requiring governance review  
+E. Unknown; block until reviewed  
+
+## Required table
+
+| Asset | Sensitivity | Exposure | Risk | Recommendation |
+|---|---|---|---|---|
+
+## User decision
+
+Ask user to choose A/B/C/D/E.
+
+Do not continue until user chooses.
+
+## Record
+
+Update:
+- governance-security-review.md
+- governance-decision-record.md
+- .decision-log.md
+- .learning-log.md if enabled
+
+Update frontmatter:
+
+```yaml
+decisionGates:
+  GATE-21-privacy-posture:
+    status: approved / approved-with-caveats / blocked
+```
+
+## Continue checkpoint
+
+Ask:
+
+`[C] Continue to access control and ownership`

package/src/dew-skills/3-solutioning/dew-governance-security-design/steps/step-04-access-control-and-ownership.md

@@ -0,0 +1,46 @@
+# Step 04 — Access Control and Ownership
+
+## Mandatory Rules
+
+- Every served asset must have intended role/user group.
+- Ownership must be explicit or caveated.
+- Access levels must be explicit.
+
+## Task
+
+Create access control matrix.
+
+## Access matrix
+
+| Role / User Group | Asset | Access Level | Purpose | Approval Needed? |
+|---|---|---|---|---|
+
+## Ownership table
+
+| Asset | Business Owner | Data Steward | Technical Owner | Caveat |
+|---|---|---|---|---|
+
+## Gate
+
+Ask user to approve access and ownership:
+
+A. Approve  
+B. Approve with caveats  
+C. Revise access levels  
+D. Block until owner/steward clarified  
+
+Do not continue until user chooses.
+
+## Record
+
+Update:
+- access-control-matrix.md
+- governance-security-review.md
+- governance-decision-record.md
+- .decision-log.md
+
+## Continue checkpoint
+
+Ask:
+
+`[C] Continue to lineage metadata and auditability`

package/src/dew-skills/3-solutioning/dew-governance-security-design/steps/step-05-lineage-metadata-and-auditability.md

@@ -0,0 +1,46 @@
+# Step 05 — Lineage, Metadata, and Auditability
+
+## Mandatory Rules
+
+- Lineage depth must match trust expectation.
+- Metadata requirements must carry into implementation stories.
+- Auditability cannot be only prose; specify what must be logged/tracked.
+
+## Task
+
+Define lineage, metadata, and auditability.
+
+## Decide lineage depth
+
+A. Minimal lineage  
+B. Operational lineage  
+C. Full audit lineage  
+D. Custom lineage by asset  
+
+Ask user if trust expectation is B/C/D.
+
+## Required audit trail
+
+Specify whether these must be auditable:
+
+- source input
+- source schema
+- ingestion run
+- transformation run
+- DQ result
+- metric version
+- caveat version
+- access decision
+- serving release
+
+## Update
+
+Update:
+- governance-security-review.md
+- governance-decision-record.md
+
+## Continue checkpoint
+
+Ask:
+
+`[C] Continue to finalize governance security design`

package/src/dew-skills/3-solutioning/dew-governance-security-design/steps/step-06-finalize.md

@@ -0,0 +1,36 @@
+# Step 06 — Finalize Governance Security Design
+
+## Mandatory Rules
+
+- Do not finalize if privacy posture gate is unresolved.
+- Do not finalize if access control is unresolved.
+- Run checklist.
+
+## Required outputs
+
+- governance-security-review.md
+- access-control-matrix.md
+- governance-decision-record.md
+- decision log entries
+- learning log entries if enabled
+
+## Final status
+
+Set:
+
+```yaml
+status: final
+stepsCompleted:
+  - step-01-init
+  - step-02-load-serving-and-data-context
+  - step-03-privacy-posture-gate
+  - step-04-access-control-and-ownership
+  - step-05-lineage-metadata-and-auditability
+  - step-06-finalize
+```
+
+## Next workflow
+
+Recommend:
+
+`dew-dataops-design`