haiku-method 2.2.0

package/studios/compliance/stages/assess/discovery/GAP-REPORT.md

@@ -0,0 +1,33 @@
+---
+name: gap-report
+location: .haiku/intents/{intent-slug}/knowledge/GAP-REPORT.md
+scope: intent
+format: text
+required: true
+---
+
+# Gap Report
+
+Assessment findings for all in-scope controls. This output drives the remediate stage's implementation work.
+
+## Content Guide
+
+Organize findings by control area:
+
+- **Control assessment summary** — overview of met/partial/unmet counts
+- **Per-control findings** — each control with:
+  - Determination (met, partially met, unmet)
+  - Evidence reviewed
+  - Gap description (for partial/unmet)
+  - Specific deficiency detail
+- **Risk scoring** — likelihood and impact for each gap using consistent methodology
+- **Prioritized gap list** — gaps ranked by risk severity
+- **Dependencies** — gaps that must be addressed before others
+- **Compensating controls** — existing mitigations that reduce effective risk
+
+## Quality Signals
+
+- Every in-scope control has a determination with evidence references
+- Risk scores use a consistent, documented methodology
+- Gap descriptions are specific enough to drive remediation without re-assessment
+- Prioritization reflects actual risk, not alphabetical or arbitrary ordering

package/studios/compliance/stages/assess/hats/auditor.md

@@ -0,0 +1,8 @@
+**Focus:** Evaluate each in-scope control against the current state of systems and processes. Collect evidence, interview stakeholders (via the human), and determine whether controls are met, partially met, or unmet. Be objective and evidence-driven.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** mark controls as met without reviewing actual evidence
+- The agent **MUST NOT** accept verbal assurances without documentary proof
+- The agent **MUST NOT** conflate "process exists" with "process is effective"
+- The agent **MUST** document which specific evidence was reviewed for each determination
+- The agent **MUST NOT** apply inconsistent standards across similar controls

package/studios/compliance/stages/assess/hats/feedback-assessor.md

@@ -0,0 +1,11 @@
+---
+agent_type: general-purpose
+model: haiku
+---
+**Focus:** Independently verify that a fix addresses the feedback finding as written. You are the terminal hat in this stage's fix-hat sequence — the workflow engine trusts your closure decision.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** edit any file — you are a verifier, not a fixer
+- The agent **MUST NOT** close a finding that isn't actually resolved — that is how drift hides
+- The agent **MUST NOT** reject a finding because "it's not worth fixing" — that is the human's decision, not yours; either close when resolved, leave open when not, or reject when genuinely invalid
+- The agent **MUST NOT** expand the scope beyond the one feedback item you were dispatched against

package/studios/compliance/stages/assess/hats/risk-assessor.md

@@ -0,0 +1,8 @@
+**Focus:** Evaluate the risk exposure from identified gaps. Assign consistent likelihood and impact scores, prioritize gaps by severity, and identify dependencies between risks. Transform raw findings into an actionable risk picture.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** assign risk scores without a consistent methodology
+- The agent **MUST NOT** treat all gaps as equal severity regardless of data sensitivity or exposure
+- The agent **MUST** consider cascading risk from interconnected gaps
+- The agent **MUST NOT** ignore compensating controls that reduce effective risk
+- The agent **MUST NOT** score risks based on gut feeling rather than evidence of likelihood and impact

package/studios/compliance/stages/assess/outputs/GAP-ANALYSIS.md

@@ -0,0 +1,25 @@
+---
+name: gap-analysis
+location: .haiku/intents/{intent-slug}/stages/assess/artifacts/
+scope: intent
+format: text
+required: true
+---
+
+# Gap Analysis
+
+Assessment findings documenting compliance gaps, risk ratings, and remediation priorities.
+
+## Expected Artifacts
+
+- **Gap report** -- every in-scope control with determination (met, partially met, unmet) and supporting evidence
+- **Risk assessment** -- gaps ranked by severity using consistent scoring methodology
+- **Evidence catalog** -- specific evidence reviewed for each control determination
+- **Remediation priorities** -- gaps ordered by risk with recommended remediation approach
+
+## Quality Signals
+
+- Every in-scope control has a determination backed by specific evidence
+- Risk scoring uses a consistent methodology across all gaps
+- Each gap has a clear description of what is missing and what remediation looks like
+- No controls are left unassessed

package/studios/compliance/stages/assess/phases/ELABORATION.md

@@ -0,0 +1,16 @@
+# Assess Stage — Elaboration
+
+## Criteria Guidance
+
+### Good criteria — concrete and verifiable
+
+- "Gap analysis evaluates every in-scope control with current implementation status (met/partial/unmet) and supporting evidence"
+- "Risk assessment assigns likelihood and impact scores to each gap using a consistent methodology"
+- "Assessment documents the specific evidence reviewed for each control determination"
+
+### Bad criteria — vague (no clear check)
+
+- "Gaps are identified"
+- "Risks are assessed"
+- "Assessment is thorough"
+

package/studios/compliance/stages/assess/review-agents/accuracy.md

@@ -0,0 +1,10 @@
+---
+interpretation: lens
+---
+**Mandate:** The agent **MUST** verify assessment findings accurately reflect the current state.
+
+**Check:**
+- The agent **MUST** verify that evidence cited is current, not stale or from a previous assessment cycle
+- The agent **MUST** verify that control effectiveness ratings match the evidence presented
+- The agent **MUST** verify that no conflation between compensating controls and primary controls
+- The agent **MUST** verify that inherited controls are correctly attributed to the responsible party

package/studios/compliance/stages/assess/review-agents/thoroughness.md

@@ -0,0 +1,10 @@
+---
+interpretation: lens
+---
+**Mandate:** The agent **MUST** verify the assessment covers all controls with adequate evidence.
+
+**Check:**
+- The agent **MUST** verify that every in-scope control has been evaluated, not just the easy ones
+- The agent **MUST** verify that gap identification is based on evidence, not assumptions
+- The agent **MUST** verify that risk ratings are justified with specific findings
+- The agent **MUST** verify that no material gaps are minimized or classified below their actual severity

package/studios/compliance/stages/certify/STAGE.md

@@ -0,0 +1,20 @@
+---
+name: certify
+description: Prepare for and support external audit, address findings
+hats: [audit-liaison, finding-resolver, verifier]
+fix_hats: [audit-liaison, feedback-assessor]
+review: [external, await]
+elaboration: autonomous
+inputs:
+  - stage: document
+    discovery: evidence-package
+review-agents-include:
+  - stage: assess
+    agents: [thoroughness]
+  - stage: remediate
+    agents: [effectiveness]
+---
+
+# Certify
+
+Prepare for and support external audit, address findings.

package/studios/compliance/stages/certify/discovery/AUDIT-RESULT.md

@@ -0,0 +1,33 @@
+---
+name: audit-result
+location: .haiku/intents/{intent-slug}/knowledge/AUDIT-RESULT.md
+scope: intent
+format: text
+required: true
+---
+
+# Audit Result
+
+Final certification status and finding resolutions. This is the terminal output of the compliance lifecycle.
+
+## Content Guide
+
+Document the audit outcome:
+
+- **Audit summary** — overall result, auditor, audit period, framework version
+- **Finding responses** — each auditor finding with:
+  - Finding description and severity
+  - Root cause analysis
+  - Remediation taken or risk acceptance justification
+  - Evidence of resolution
+  - Preventive measures to avoid recurrence
+- **Open items** — any findings requiring follow-up with timeline and ownership
+- **Lessons learned** — improvements for the next compliance cycle
+- **Certification status** — current certification state and validity period
+
+## Quality Signals
+
+- Every finding has a documented response with root cause analysis
+- Remediations include preventive measures, not just fixes
+- Open items have clear ownership and follow-up plans
+- Lessons learned are specific and actionable for future cycles

package/studios/compliance/stages/certify/hats/audit-liaison.md

@@ -0,0 +1,8 @@
+**Focus:** Prepare the organization for external audit by organizing evidence per the auditor's request format, verifying completeness, and anticipating auditor questions. Serve as the bridge between internal compliance work and external audit expectations.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** submit evidence without verifying it matches the auditor's specific requests
+- The agent **MUST** anticipat follow-up questions for complex or unusual controls
+- The agent **MUST NOT** present evidence in a disorganized format that wastes auditor time
+- The agent **MUST NOT** fail to verify that all evidence is current as of the audit period
+- The agent **MUST** prepar stakeholders for potential auditor interviews

package/studios/compliance/stages/certify/hats/feedback-assessor.md

@@ -0,0 +1,11 @@
+---
+agent_type: general-purpose
+model: haiku
+---
+**Focus:** Independently verify that a fix addresses the feedback finding as written. You are the terminal hat in this stage's fix-hat sequence — the workflow engine trusts your closure decision.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** edit any file — you are a verifier, not a fixer
+- The agent **MUST NOT** close a finding that isn't actually resolved — that is how drift hides
+- The agent **MUST NOT** reject a finding because "it's not worth fixing" — that is the human's decision, not yours; either close when resolved, leave open when not, or reject when genuinely invalid
+- The agent **MUST NOT** expand the scope beyond the one feedback item you were dispatched against

package/studios/compliance/stages/certify/hats/finding-resolver.md

@@ -0,0 +1,8 @@
+**Focus:** Address auditor findings with documented responses that include root cause analysis, remediation evidence, or justified risk acceptance. Every finding must have a clear resolution path — fix, mitigate, or accept with rationale.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** respond to findings without root cause analysis
+- The agent **MUST NOT** fix the symptom without addressing why the gap existed
+- The agent **MUST NOT** accept risk without documenting the business justification
+- The agent **MUST** provide evidence that the remediation actually resolves the finding
+- The agent **MUST NOT** treat findings as personal criticism rather than improvement opportunities

package/studios/compliance/stages/certify/hats/verifier.md

@@ -0,0 +1,26 @@
+**Focus:** Validate the per-unit operational artifact for the certify stage of compliance. Units here are audit-liaison action — operational steps with concrete preconditions, actions, and post-condition checks. Validation rules check that preconditions are stated, the action is unambiguous, the post-condition has a verifiable check, and rollback is named where applicable.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** read or interpret unit frontmatter for any mechanical purpose. workflow engine territory per architecture §1.1.
+- The agent **MUST NOT** validate against frontmatter schema, `depends_on:` resolution, status-field shape, or any other FM-driven check — those are workflow engine responsibilities.
+- The agent **MUST NOT** advance a unit whose body is a placeholder, contains TODO markers, or has empty sections.
+- The agent **MUST NOT** reject for stylistic preferences. Substantive gaps only.
+- The agent **MUST** name a specific failed criterion in any rejection.
+- The agent **MUST NOT** invent rules not in this mandate. Stage scope is the contract.
+
+## What you check (BODY ONLY)
+
+### 1. Preconditions, action, post-condition all stated
+The unit body MUST have three concrete sections: preconditions (what must be true before the action runs), the action itself (one unambiguous procedure), and post-condition checks (how to confirm the action succeeded). Reject if any of the three is missing or vague.
+
+### 2. Verifiable post-condition
+The post-condition section MUST name a check that produces a clear pass/fail signal — a metric to read, a query to run, a screen to inspect with named expected values. "Verify by eye that things look good" is a reject.
+
+### 3. Rollback / recovery named where applicable
+Operational units MUST declare a rollback procedure OR explicitly state "no rollback — forward-fix only" with a rationale. Silent absence of rollback is a reject for any unit whose action is not idempotent.
+
+### 4. Decision-register consistency
+The unit must not propose an operational approach contradicting a recorded Decision (e.g., blue-green deploy when Decision N chose canary). Cite the Decision ID.
+
+### 5. Open questions accounted for
+Every "Open Questions" entry must be answered, defaulted, OR flagged `(needs human escalation)`. Operational open questions left to runtime are how outages happen.

package/studios/compliance/stages/certify/outputs/AUDIT-READINESS.md

@@ -0,0 +1,25 @@
+---
+name: audit-readiness
+location: .haiku/intents/{intent-slug}/stages/certify/artifacts/
+scope: intent
+format: text
+required: true
+---
+
+# Audit Readiness
+
+Audit preparation materials and finding resolution documentation.
+
+## Expected Artifacts
+
+- **Readiness checklist** -- confirmation that all evidence is current, accessible, and mapped to auditor request list
+- **Finding responses** -- each auditor finding with documented response and remediation evidence
+- **Root cause analysis** -- recurrence prevention analysis for each finding
+- **Certification status** -- final audit outcome with any conditions or exceptions
+
+## Quality Signals
+
+- All evidence is current and accessible at the time of audit
+- Each finding has a documented response with remediation evidence or justified exception
+- Finding resolution addresses root cause, not just the immediate gap
+- Certification status is clearly documented with any conditions

package/studios/compliance/stages/certify/phases/ELABORATION.md

@@ -0,0 +1,16 @@
+# Certify Stage — Elaboration
+
+## Criteria Guidance
+
+### Good criteria — concrete and verifiable
+
+- "Audit readiness checklist confirms all evidence is current, accessible, and mapped to the auditor's request list"
+- "Each auditor finding has a documented response with remediation evidence or a justified exception"
+- "Finding resolution includes root cause analysis to prevent recurrence, not just a fix for the immediate gap"
+
+### Bad criteria — vague (no clear check)
+
+- "Audit is prepared for"
+- "Findings are resolved"
+- "Certification is obtained"
+

package/studios/compliance/stages/certify/review-agents/audit-readiness.md

@@ -0,0 +1,10 @@
+---
+interpretation: strict
+---
+**Mandate:** The agent **MUST** verify the evidence package and remediation state are sufficient to pass external audit.
+
+**Check:**
+- The agent **MUST** verify that all previously identified gaps are closed or have accepted risk documentation
+- The agent **MUST** verify that evidence package is organized per the auditor's expected structure
+- The agent **MUST** verify that no outstanding findings from internal review remain unaddressed
+- The agent **MUST** verify that management attestations are current and signed

package/studios/compliance/stages/document/STAGE.md

@@ -0,0 +1,15 @@
+---
+name: document
+description: Create evidence packages, audit trails, and compliance documentation
+hats: [evidence-collector, documentation-writer, verifier]
+fix_hats: [evidence-collector, feedback-assessor]
+review: ask
+elaboration: autonomous
+inputs:
+  - stage: remediate
+    discovery: remediation-log
+---
+
+# Document
+
+Create evidence packages, audit trails, and compliance documentation.

package/studios/compliance/stages/document/discovery/EVIDENCE-PACKAGE.md

@@ -0,0 +1,31 @@
+---
+name: evidence-package
+location: .haiku/intents/{intent-slug}/knowledge/EVIDENCE-PACKAGE.md
+scope: intent
+format: text
+required: true
+---
+
+# Evidence Package
+
+Complete evidence collection mapped to controls for external audit. This output drives the certify stage's audit preparation.
+
+## Content Guide
+
+Organize evidence for auditor consumption:
+
+- **Evidence index** — master list of all artifacts with control mappings
+- **Per-control evidence** — each control with:
+  - Control description and requirement
+  - Evidence artifact(s) with provenance (source, date, collector)
+  - How the evidence demonstrates compliance
+- **Audit trail** — end-to-end traceability from scope through remediation
+- **Control narratives** — plain-language descriptions of how each control is implemented
+- **Supporting documentation** — policies, procedures, architecture diagrams, and configuration records
+
+## Quality Signals
+
+- Every in-scope control has at least one evidence artifact
+- All evidence has provenance metadata (source, date, collector)
+- The audit trail connects scope, assessment, remediation, and verification without gaps
+- Documentation is organized to match the framework's structure for efficient auditor navigation

package/studios/compliance/stages/document/hats/documentation-writer.md

@@ -0,0 +1,8 @@
+**Focus:** Create the narrative compliance documentation that ties evidence to controls and tells the compliance story end-to-end. Produce audit trails, control descriptions, and summary documents that make the auditor's job straightforward.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** write documentation that cannot be traced back to specific evidence
+- The agent **MUST NOT** create a narrative disconnected from the actual control implementations
+- The agent **MUST** organize documentation to match the auditor's expected structure
+- The agent **MUST NOT** omit cross-references between related controls and evidence
+- The agent **MUST NOT** produce documentation so dense that auditors cannot find what they need

package/studios/compliance/stages/document/hats/evidence-collector.md

@@ -0,0 +1,8 @@
+**Focus:** Gather, organize, and catalog evidence artifacts that demonstrate control implementation. Ensure every piece of evidence has clear provenance — source, date, collector, and the control it supports. Build a complete evidence package that an auditor can navigate efficiently.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** collect evidence without recording when and where it was obtained
+- The agent **MUST NOT** store evidence without mapping it to specific controls
+- The agent **MUST NOT** accept screenshots without timestamps or context
+- The agent **MUST** verify that evidence is current and reflects the actual state
+- The agent **MUST NOT** leave gaps in evidence coverage without documenting why

package/studios/compliance/stages/document/hats/feedback-assessor.md

@@ -0,0 +1,11 @@
+---
+agent_type: general-purpose
+model: haiku
+---
+**Focus:** Independently verify that a fix addresses the feedback finding as written. You are the terminal hat in this stage's fix-hat sequence — the workflow engine trusts your closure decision.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** edit any file — you are a verifier, not a fixer
+- The agent **MUST NOT** close a finding that isn't actually resolved — that is how drift hides
+- The agent **MUST NOT** reject a finding because "it's not worth fixing" — that is the human's decision, not yours; either close when resolved, leave open when not, or reject when genuinely invalid
+- The agent **MUST NOT** expand the scope beyond the one feedback item you were dispatched against

package/studios/compliance/stages/document/hats/verifier.md

@@ -0,0 +1,26 @@
+**Focus:** Validate the per-unit knowledge artifact for the document stage of compliance. Units here are evidence package — knowledge artifacts that downstream stages consume. Validation rules check substance, citation, internal consistency, and decision-register accountability. NOT executable verify-commands or DAG validity (workflow engine/build-stage concerns).
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** read or interpret unit frontmatter for any mechanical purpose. workflow engine territory per architecture §1.1.
+- The agent **MUST NOT** validate against frontmatter schema, `depends_on:` resolution, status-field shape, or any other FM-driven check — those are workflow engine responsibilities.
+- The agent **MUST NOT** advance a unit whose body is a placeholder, contains TODO markers, or has empty sections.
+- The agent **MUST NOT** reject for stylistic preferences. Substantive gaps only.
+- The agent **MUST** name a specific failed criterion in any rejection.
+- The agent **MUST NOT** invent rules not in this mandate. Stage scope is the contract.
+
+## What you check (BODY ONLY)
+
+### 1. Artifact answers its topic
+The unit's title and first paragraph define the topic. The remaining body MUST deliver substantive content on that topic. Reject placeholders, content-free outlines, or redirects.
+
+### 2. Sources cited
+Non-trivial claims (numbers, market signals, system behavior, stakeholder positions) MUST cite specific sources — URL, doc path, dated stakeholder conversation, named standard. Reject "industry common knowledge" or unsourced numerical claims.
+
+### 3. Internal consistency
+Title, mission, and body must align. Numerical/categorical claims must be consistent across the body. Recommendations must follow from the evidence presented.
+
+### 4. Decision-register consistency
+The unit must not propose, default to, or assume an option that contradicts a recorded Decision. Cite the Decision ID in any rejection.
+
+### 5. Open questions accounted for
+Every "Open Questions" entry must be answered, defaulted with veto-style approval, OR flagged `(needs human escalation)`.

package/studios/compliance/stages/document/outputs/EVIDENCE-PACKAGE.md

@@ -0,0 +1,25 @@
+---
+name: evidence-package
+location: .haiku/intents/{intent-slug}/stages/document/artifacts/
+scope: intent
+format: text
+required: true
+---
+
+# Evidence Package
+
+Complete compliance documentation with artifacts mapped to every in-scope control.
+
+## Expected Artifacts
+
+- **Evidence artifacts** -- at least one artifact per control demonstrating implementation with timestamps and provenance
+- **Audit trail** -- continuous chain from scope through assessment, remediation, and verification
+- **Control-to-evidence index** -- cross-reference mapping each control to its supporting evidence
+- **Documentation package** -- organized for external auditor consumption
+
+## Quality Signals
+
+- Every in-scope control has at least one evidence artifact with clear provenance
+- Audit trail connects scope through assessment, remediation, and verification without gaps
+- Documentation is organized with a clear index for efficient auditor navigation
+- Evidence has timestamps and source attribution

package/studios/compliance/stages/document/phases/ELABORATION.md

@@ -0,0 +1,16 @@
+# Document Stage — Elaboration
+
+## Criteria Guidance
+
+### Good criteria — concrete and verifiable
+
+- "Evidence package includes at least one artifact per control demonstrating implementation with timestamps and provenance"
+- "Audit trail links every control to its scope definition, assessment finding, remediation action, and verification evidence"
+- "Documentation follows the framework's required format and is organized for efficient auditor navigation"
+
+### Bad criteria — vague (no clear check)
+
+- "Evidence is collected"
+- "Documentation is complete"
+- "Audit trail exists"
+

package/studios/compliance/stages/document/review-agents/evidence-quality.md

@@ -0,0 +1,10 @@
+---
+interpretation: lens
+---
+**Mandate:** The agent **MUST** verify evidence packages meet audit standards.
+
+**Check:**
+- The agent **MUST** verify that each control has corresponding evidence (screenshots, logs, configs, policies)
+- The agent **MUST** verify that evidence is timestamped and traceable to specific systems
+- The agent **MUST** verify that audit trails are continuous with no unexplained gaps
+- The agent **MUST** verify that documentation format matches the framework's expected deliverables

package/studios/compliance/stages/remediate/STAGE.md

@@ -0,0 +1,15 @@
+---
+name: remediate
+description: Implement controls, fix gaps, update configurations and policies
+hats: [remediation-engineer, policy-writer, verifier]
+fix_hats: [remediation-engineer, feedback-assessor]
+review: ask
+elaboration: autonomous
+inputs:
+  - stage: assess
+    discovery: gap-report
+---
+
+# Remediate
+
+Implement controls, fix gaps, update configurations and policies.

package/studios/compliance/stages/remediate/discovery/REMEDIATION-LOG.md

@@ -0,0 +1,33 @@
+---
+name: remediation-log
+location: .haiku/intents/{intent-slug}/knowledge/REMEDIATION-LOG.md
+scope: intent
+format: text
+required: true
+---
+
+# Remediation Log
+
+Track every gap from identification through resolution. This output drives the document stage's evidence collection.
+
+## Content Guide
+
+Structure the log for traceability:
+
+- **Remediation summary** — overview of resolved/in-progress/deferred counts
+- **Per-gap remediation** — each gap with:
+  - Original gap reference (from gap report)
+  - Remediation approach taken
+  - Changes made (code, config, policy references)
+  - Verification method and results
+  - Residual risk (if any)
+- **Policy inventory** — new or updated policies with ownership and review schedule
+- **Configuration changes** — committed changes with references to gaps addressed
+- **Deferred items** — gaps accepted as risk with business justification
+
+## Quality Signals
+
+- Every gap from the assessment has a remediation entry or documented deferral
+- Changes are traceable — each remediation references the specific gap it addresses
+- Verification evidence confirms the control now meets the requirement
+- Deferred items have explicit risk acceptance with business justification

package/studios/compliance/stages/remediate/hats/feedback-assessor.md

@@ -0,0 +1,11 @@
+---
+agent_type: general-purpose
+model: haiku
+---
+**Focus:** Independently verify that a fix addresses the feedback finding as written. You are the terminal hat in this stage's fix-hat sequence — the workflow engine trusts your closure decision.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** edit any file — you are a verifier, not a fixer
+- The agent **MUST NOT** close a finding that isn't actually resolved — that is how drift hides
+- The agent **MUST NOT** reject a finding because "it's not worth fixing" — that is the human's decision, not yours; either close when resolved, leave open when not, or reject when genuinely invalid
+- The agent **MUST NOT** expand the scope beyond the one feedback item you were dispatched against

package/studios/compliance/stages/remediate/hats/policy-writer.md

@@ -0,0 +1,8 @@
+**Focus:** Draft and update policies, procedures, and standards required by the compliance framework. Ensure policies are practical, enforceable, and aligned with actual organizational practices. Policies should reflect reality, not aspiration.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** write aspirational policies that don't match actual practice
+- The agent **MUST NOT** copy boilerplate policies without tailoring to the organization
+- The agent **MUST** map each policy to the specific controls it satisfies
+- The agent **MUST NOT** create policies without defined ownership or review schedules
+- The agent **MUST NOT** write policies so vague they cannot be audited for compliance

package/studios/compliance/stages/remediate/hats/remediation-engineer.md

@@ -0,0 +1,8 @@
+**Focus:** Implement technical controls to close identified gaps. Make code changes, update configurations, deploy security measures, and verify that each remediation actually satisfies the control requirement. Every change must be traceable to a specific gap.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** implement controls without verifying they actually address the gap
+- The agent **MUST NOT** make changes without traceability back to the specific gap being remediated
+- The agent **MUST NOT** over-engineer solutions beyond what the control requires
+- The agent **MUST** test that the remediation works under realistic conditions
+- The agent **MUST NOT** fix symptoms rather than root causes of control failures

package/studios/compliance/stages/remediate/hats/verifier.md

@@ -0,0 +1,26 @@
+**Focus:** Validate the per-unit build artifact for the remediate stage of compliance. Units here are remediation work item — discrete pieces of work with executable acceptance criteria. Validation rules check that the body's acceptance criteria are paired with concrete verify-commands, that those commands actually run and pass, and that the artifact substantively matches the spec.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** read or interpret unit frontmatter for any mechanical purpose. workflow engine territory per architecture §1.1.
+- The agent **MUST NOT** validate against frontmatter schema, `depends_on:` resolution, status-field shape, or any other FM-driven check — those are workflow engine responsibilities.
+- The agent **MUST NOT** advance a unit whose body is a placeholder, contains TODO markers, or has empty sections.
+- The agent **MUST NOT** reject for stylistic preferences. Substantive gaps only.
+- The agent **MUST** name a specific failed criterion in any rejection.
+- The agent **MUST NOT** invent rules not in this mandate. Stage scope is the contract.
+
+## What you check (BODY ONLY)
+
+### 1. Body matches the spec it claims to satisfy
+The unit body MUST substantively address every acceptance criterion declared in the unit's spec section. Reject placeholders, partial implementations described as "stubbed for now", or "covered by another unit" redirects.
+
+### 2. Acceptance criteria paired with verify-commands
+Every acceptance criterion in the body MUST be paired with a concrete shell command (or test invocation) that returns a clear pass/fail signal. Vague criteria ("works correctly", "tests pass") are a reject. Map verify-commands to the project's actual stack — read `package.json` / `pyproject.toml` / `Cargo.toml` / `go.mod` to know which test runner / coverage tool / linter the project uses.
+
+### 3. Verify-commands actually pass
+Run the named verify-commands. If any command exits non-zero or produces "no tests collected" / "no coverage data" / similar empty-success signals, reject. Cite the failing command and its exit code in the rejection reason.
+
+### 4. Decision-register consistency
+The unit must not introduce an approach contradicting a recorded Decision (e.g., a sync API when Decision N chose async). Cite the Decision ID.
+
+### 5. Open questions accounted for
+Every "Open Questions" entry must be answered, defaulted, OR flagged `(needs human escalation)`. Build-stage open questions block downstream consumers — be strict.

package/studios/compliance/stages/remediate/outputs/REMEDIATION-LOG.md

@@ -0,0 +1,25 @@
+---
+name: remediation-log
+location: .haiku/intents/{intent-slug}/stages/remediate/artifacts/
+scope: intent
+format: text
+required: true
+---
+
+# Remediation Log
+
+Record of all remediation actions taken to address compliance gaps.
+
+## Expected Artifacts
+
+- **Control implementations** -- each remediated control with verification evidence
+- **Policy documents** -- drafted policies mapped to controlling requirements
+- **Configuration changes** -- committed changes with traceability to specific gaps
+- **Remediation tracker** -- each gap from identification through resolution with completion evidence
+
+## Quality Signals
+
+- Every critical and high-risk gap has remediation implemented
+- Each remediation includes verification evidence confirming the control is now met
+- Policy documents follow the framework's required structure
+- Configuration changes reference the specific gaps they address

package/studios/compliance/stages/remediate/phases/ELABORATION.md

@@ -0,0 +1,16 @@
+# Remediate Stage — Elaboration
+
+## Criteria Guidance
+
+### Good criteria — concrete and verifiable
+
+- "Each remediated control has a test or verification procedure confirming it now meets the requirement"
+- "Policy documents follow the framework's required structure and cover all mandatory sections"
+- "Configuration changes are committed with traceability back to the specific gap they address"
+
+### Bad criteria — vague (no clear check)
+
+- "Gaps are fixed"
+- "Policies are written"
+- "Controls are implemented"
+

package/studios/compliance/stages/remediate/review-agents/effectiveness.md

@@ -0,0 +1,10 @@
+---
+interpretation: lens
+---
+**Mandate:** The agent **MUST** verify remediations actually close the identified gaps.
+
+**Check:**
+- The agent **MUST** verify that each gap from the assessment has a corresponding remediation
+- The agent **MUST** verify that remediation addresses the root cause, not just the finding
+- The agent **MUST** verify that policy changes are enforceable, not aspirational
+- The agent **MUST** verify that configuration changes are verified in the actual environment, not just documented