janderscience-skills 0.0.0-stage → 1.0.0

package/sources/headcount/plugins/it-operations/skills/telephony-and-conferencing/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: telephony-and-conferencing
+description: Runs voice and meeting infrastructure — phone systems and numbers, emergency calling obligations, conference rooms and their AV, call recording and its retention consequences, and the porting that makes provider changes go badly. Use this to replace a phone system, fix rooms nobody can start a meeting in, meet emergency-calling requirements, port numbers without losing service, or work out why voice quality degrades only sometimes.
+---
+
+# Telephony and conferencing
+
+Voice is the service where failure is most visible and least tolerated. Nobody files a ticket when
+email is slow; everyone notices a dead phone, and customers notice first. It is also the service
+most likely to be nobody's stated job — inherited from a facilities vendor, half-migrated to a
+collaboration suite, with the parts that still work unowned.
+
+## Voice is an application on the network now, and behaves like one
+
+A phone system is real-time traffic sharing a network built for everything else. That makes voice
+the first service to expose problems the network was hiding: jitter, packet loss, and asymmetric
+routing that a file transfer absorbs and a conversation does not.
+
+Quality complaints are almost never about the phone system. Diagnose them as network problems on
+the path, and prioritize voice traffic explicitly rather than assuming capacity is enough — a link
+with headroom on average still queues at the moment someone is talking. See
+`it-operations:network-administration` for the diagnosis order.
+
+The corollary is that a network change can break voice without touching it, which is an argument
+for including voice in the change review rather than discovering it afterward.
+
+## Emergency calling is a legal obligation, not a feature
+
+Emergency calls must reach the right dispatch center with a location accurate enough to send help
+to, and in most jurisdictions this is regulated rather than optional. Two requirements that
+routinely get missed: a caller must be able to dial emergency services directly without a prefix,
+and someone on site should be notified when such a call is placed.
+
+Remote and hybrid work is what makes this hard. A softphone carries its number, not its location,
+so a home worker dialing for help may route to the office's dispatch center hundreds of miles away.
+Provider features exist to handle this and they require configuration and user prompting to work.
+
+Treat location records as data that goes stale. Desk moves, new floors, and new home addresses all
+invalidate them, and nobody discovers the error at a good moment.
+
+## Numbers are assets, and porting is the risky part
+
+Phone numbers are contractually held by the losing provider until a port completes, which gives
+that provider both the ability and the incentive to make leaving slow. Ports fail on trivial
+mismatches — a service address that does not match the billing record exactly, an account PIN
+nobody has, a number that was never actually on the account.
+
+Get a current bill and a copy of the losing provider's records before scheduling anything, port a
+small test group first, and never cancel the old service until the new one carries live traffic.
+Canceling early does not accelerate the port; it strands the numbers.
+
+Keep the number inventory somewhere permanent, with what each number is for. Main lines, fax lines
+that still receive real documents, and numbers printed on physical material are all things that
+cost more than they appear to when lost.
+
+## Rooms fail on the last two feet
+
+Conference rooms are where the technology is judged, and they fail in the mundane ways: the wrong
+cable, a display on the wrong input, a control panel asleep, a camera pointed at a wall. A room
+that takes five minutes to start a meeting is a room people stop booking.
+
+Standardize aggressively — the same room build repeated is supportable, and eight bespoke rooms are
+not. One-touch join is worth real money because it eliminates the entire class of failure. Monitor
+rooms as infrastructure rather than waiting for complaints; most platforms report device health,
+and a dead room found on Monday morning beats one found by an executive at nine o'clock.
+
+## Recording creates records
+
+Call and meeting recording is trivial to enable and produces material that is discoverable in
+litigation, subject to privacy law, and subject to consent requirements that vary by jurisdiction —
+some places require every party to consent, not just one.
+
+Decide retention before switching it on, and default to short. Transcripts and AI-generated
+summaries are records too, and they are increasingly produced automatically by the meeting platform
+whether or not anyone chose it. `legal-risk:privacy-and-data-protection` owns the obligations; this
+skill owns knowing the feature creates them.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Never
+
+- Deploy softphones without solving location for emergency calls.
+- Cancel the losing provider before numbers have ported and carry traffic.
+- Enable recording before deciding retention.
+- Diagnose voice quality inside the phone system when the network is untested.

package/sources/headcount/plugins/it-operations/skills/telephony-and-conferencing/references/sources.md

@@ -0,0 +1,35 @@
+# Sources — `it-operations:telephony-and-conferencing`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 47 CFR Part 9 — 911 requirements
+
+US Federal Communications Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-9>
+
+**Authoritative for:** The obligations on a multi-line telephone system — direct 911 dialing, on-site notification and dispatchable location. A hard compliance question for anyone administering a phone or conferencing platform in the US, and one that is usually discovered late.
+
+## RFC 3261: SIP — Session Initiation Protocol
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc3261.html>
+
+Machine-readable: <https://www.rfc-editor.org/rfc/rfc3550.html>
+
+**Authoritative for:** SIP signaling semantics — dialog and transaction state, response code meanings, registration, and the role of proxies. What an interop dispute between a phone system and a carrier is settled against.
+
+## WebRTC: Real-Time Communication in Browsers
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/webrtc/>
+
+**Authoritative for:** The browser API surface and behavior for real-time audio, video and data — the normative reference for what a conferencing client can and must do.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.

package/sources/headcount/plugins/it-operations/skills/virtualization-operations/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: virtualization-operations
+description: Runs the hypervisor layer beneath the servers — host capacity and consolidation ratios, VM sprawl, snapshot discipline, resilience and live migration, and licensing that counts cores rather than instances. Use this to size or expand a cluster, work out why VMs are slow when the hosts look idle, clean up sprawl, set snapshot and template policy, or decide what stays virtualized and what moves to cloud.
+---
+
+# Virtualization operations
+
+Virtualization is the layer most infrastructure problems actually live in, and the one most
+monitoring is blind to. A guest reports healthy CPU while contending for a core it never gets. The
+usual failure is diagnosing upward — into the application — when the constraint is a host two
+layers below.
+
+## Consolidation ratio is a decision, not a result
+
+Every cluster has a ratio of virtual resources to physical ones, and most organizations discover
+theirs rather than choosing it. Overcommitting memory and CPU is normal and correct; the question
+is how far, and what happens at peak rather than average.
+
+Two numbers worth knowing at all times: what the cluster runs at now, and what it runs at when one
+host is gone. If losing a single host takes you past capacity, you have a cluster that survives
+hardware failure on paper and not in practice. Size for N-1 and keep the spare capacity visible in
+the budget, or the first thing cut is the headroom that makes the design work.
+
+Memory is usually the real ceiling, not CPU. Cores oversubscribe gracefully; RAM does not.
+
+## Sprawl is a lifecycle problem wearing an infrastructure costume
+
+VMs are trivially easy to create and socially difficult to delete. Nobody remembers what the box
+does, so it stays — consuming license, backup capacity, patching effort, and an attack surface
+nobody reviews.
+
+The fix is ownership recorded at creation, not an annual cleanup. Every VM gets a named owner and a
+review date before it is built. Anything that cannot name an owner is a candidate for
+decommissioning, and the decommission path is: power off, wait a defined period, then delete.
+Powering off first turns an irreversible decision into a reversible one and produces the phone call
+that tells you what the machine did.
+
+Templates and golden images keep the estate consistent. Builds that started from a template drift
+less than builds someone assembled, and drift is what makes patching unpredictable — see
+`it-operations:systems-administration` for the configuration baseline this feeds.
+
+## Snapshots are not backups, and old ones cause outages
+
+A snapshot is a change log against a disk, and it grows until it is merged. Left running, it fills
+the datastore and takes down every VM sharing that storage, which is a much worse incident than
+whatever the snapshot was protecting against.
+
+Treat them as a short-lived tool for a specific change: take one before a risky upgrade, merge it
+the same day, and alert on any snapshot older than the threshold you set. They are not a retention
+mechanism and they do not survive storage failure — real recovery belongs to
+`it-operations:backup-and-recovery`.
+
+## Live migration is a maintenance capability, not a resilience one
+
+Moving running workloads between hosts is what makes patching the hypervisor possible without a
+maintenance window, and that alone justifies it. It does not protect against a host failing
+suddenly — that is a restart on another host, with downtime measured in boot time.
+
+Know which of your workloads tolerate that restart and which do not. The ones that do not need
+clustering inside the guest, and virtualizing them does not remove that requirement.
+
+## Licensing counts what you provision, not what you use
+
+Hypervisor and guest licensing is commonly priced per physical core or socket, which means a
+consolidation decision is also a licensing decision, and adding hosts can cost more in license than
+in hardware. Some vendors license every core in a cluster a workload could migrate to, not the one
+it runs on — which turns an availability setting into a bill.
+
+Model the license cost before the hardware purchase, and check it again when the cluster grows.
+`it-operations:it-asset-management` owns the entitlement records; this skill owns knowing which
+architectural choices move them.
+
+## Where the boundary sits with cloud
+
+Not everything should be virtualized on-premises, and not everything should move. The honest test
+is not cost per VM — it is whether the workload's demand is steady or spiky. Steady, predictable
+load runs cheaper on hardware you own. Spiky or seasonal load is what cloud elasticity is actually
+for.
+
+Hybrid is the normal end state, not a transitional embarrassment. What makes it painful is running
+two operating models with two sets of habits, so decide deliberately which one owns identity,
+monitoring, and backup rather than letting each side answer differently.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Never
+
+- Provision a guest without an owner, a lifetime, and a decommission trigger.
+- Size a cluster with no headroom to lose a node during maintenance.
+- Grow a guest's resources before checking whether the guest itself is misbehaving. Oversizing hides the bug and eats the consolidation ratio.
+- Move a workload to cloud to escape a capacity problem you have not diagnosed on-premises.

package/sources/headcount/plugins/it-operations/skills/virtualization-operations/references/sources.md

@@ -0,0 +1,27 @@
+# Sources — `it-operations:virtualization-operations`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## CIS Benchmarks
+
+Center for Internet Security · global · **account required — cite it; the user fetches it**
+
+<https://www.cisecurity.org/cis-benchmarks>
+
+**Authoritative for:** The consensus hardening baseline for a specific product version, with two profile levels. The non-defense equivalent of a STIG and the baseline most commercial audits cite.
+
+## Security Technical Implementation Guides
+
+Defense Information Systems Agency, US Department of Defense · US · public domain (US government) — quote freely
+
+<https://public.cyber.mil/stigs/>
+
+Machine-readable: <https://public.cyber.mil/stigs/downloads/>
+
+**Authoritative for:** The exact required configuration of a given operating system, hypervisor or appliance, setting by setting with severity. When two administrators disagree about a hardening value, this states the required one.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.

package/sources/headcount/plugins/legal-risk/.claude-plugin/plugin.json

@@ -0,0 +1,16 @@
+{
+  "name": "legal-risk",
+  "description": "Contract review, privacy and data protection, enterprise risk, corporate governance, compliance, and audit readiness. Reviewer-class: its findings are not overrulable by the department under review.",
+  "version": "1.0.0",
+  "author": {
+    "name": "Chris Brock"
+  },
+  "repository": "https://github.com/cbrock84/headcount",
+  "keywords": [
+    "legal",
+    "privacy",
+    "risk",
+    "compliance",
+    "contracts"
+  ]
+}

package/sources/headcount/plugins/legal-risk/.codex-plugin/plugin.json

@@ -0,0 +1,25 @@
+{
+  "name": "legal-risk",
+  "version": "1.0.0",
+  "description": "Contract review, privacy and data protection, enterprise risk, corporate governance, compliance, and audit readiness. Reviewer-class: its findings are not overrulable by the department under review.",
+  "author": {
+    "name": "Chris Brock"
+  },
+  "repository": "https://github.com/cbrock84/headcount",
+  "license": "MIT",
+  "keywords": [
+    "legal",
+    "privacy",
+    "risk",
+    "compliance",
+    "contracts"
+  ],
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "Legal & Risk",
+    "category": "Productivity",
+    "shortDescription": "Legal & Risk, as an installable department",
+    "longDescription": "Contract review, privacy and data protection, enterprise risk, corporate governance, compliance, and audit readiness. Reviewer-class: its findings are not overrulable by the department under review.",
+    "developerName": "Chris Brock"
+  }
+}

package/sources/headcount/plugins/legal-risk/skills/chief-legal-and-risk-officer/SKILL.md

@@ -0,0 +1,128 @@
+---
+name: chief-legal-and-risk-officer
+description: Owns legal, contracts, intellectual property, regulatory compliance, privacy, security governance, enterprise risk, and audit readiness. Use this to review a contract or commitment, assess regulatory or privacy exposure, evaluate an IP or licensing question, judge the risk in a business decision, prepare for an audit or certification, or when a plan may create obligations the business cannot meet. Also use to decide whether a risk should be accepted, mitigated, or refused.
+---
+
+# Chief Legal & Risk Officer
+
+## Reviewer class
+
+**This department is reviewer-class.** It reviews what other departments commit to, and its findings
+are not overrulable by the department under review. A producing department cannot approve its own
+contract terms, accept its own risk above threshold, or close its own compliance finding.
+
+Where a chief disagrees with a finding, the path is escalation to the Chief Executive, not
+resolution inside the reviewed department. Risk accepted at that level is recorded as accepted, with
+a name against it — never downgraded to fit an existing authority.
+
+This exists because a producer that audits its own output approves it. That is not a statement about
+anyone's integrity; it is what the structure produces regardless of intent.
+
+## Why this role exists
+
+The executive accountable for this function. It exists so that one agent — not the orchestrator, and not whichever specialist happens to be in the conversation — owns the call when the specialists disagree or when a decision crosses their boundaries.
+
+## Remit
+
+- Contracts, commitments, and commercial terms
+- IP and licensing, inbound and outbound
+- Regulatory compliance and privacy
+- Enterprise risk register and audit readiness
+
+## What this role owns
+
+These are the artifacts of record. Where two of them disagree, this one is right:
+
+- The risk register
+- Contract templates and approval thresholds
+- The compliance posture of record
+
+## Separate the legal question from the business decision
+
+The fastest way for this function to become something people route around is to answer business
+questions in legal language. "You can't do that" is usually shorthand for a risk the speaker has
+silently decided is unacceptable — which is a business judgment wearing legal clothes, and it
+belongs to whoever owns the outcome.
+
+Answer in two parts, always. What the law or the contract actually requires, which is not
+negotiable. Then the exposure created by each available option, quantified as far as it can be, so
+the decision-maker can choose. That structure keeps the function consulted early, which is the only
+position from which it can prevent anything.
+
+The exception is a genuine legal prohibition, and it is worth being unmistakable about which is
+which. Blurring the two costs more than either — a function whose "no" sometimes means "I would
+prefer not" gets its real prohibitions argued with.
+
+## Risk acceptance needs a name and a date
+
+Risk that is accepted implicitly is not accepted; it is unowned, and it surfaces later with nobody
+willing to say they chose it.
+
+Every accepted risk should record what is being accepted, who accepted it, on what date, and when
+it will be revisited. The name matters most. An acceptance attributed to "the business" or "we
+decided" provides no accountability and will not survive an audit, an incident, or a change of
+leadership.
+
+Revisit on the date. Conditions change, and a risk accepted under one set of facts is frequently
+indefensible under the next. See `legal-risk:enterprise-risk` for the register itself.
+
+## In contracts, most terms are ceremony and a few are the deal
+
+Negotiating every clause with equal energy is how legal review becomes the reason deals are slow,
+and it trains the business to route around review.
+
+The terms that reliably matter are the ones that decide what happens when things go wrong:
+limitation of liability and its carve-outs, indemnity, data handling and breach obligations,
+termination and what happens to data afterward, and how disputes get resolved and where. Most of
+the rest is negotiable at low value.
+
+Know which of your own positions are genuinely non-negotiable and say so early. A redline that
+treats everything as equally important gets treated as noise, and the term that mattered is lost
+in it.
+
+## Privilege is easy to lose and impossible to recover
+
+Legal privilege protects advice, not facts, and it is forfeited more often by ordinary behavior
+than by any decision — forwarding advice to a wide internal audience, mixing legal analysis into a
+business document, or looping in a party outside the relationship.
+
+Where an investigation may become contentious, decide at the outset how it is structured and who
+directs it, because that determination cannot be made retroactively. The instinct to share findings
+broadly is exactly the instinct that destroys the protection.
+
+## Escalation
+
+Escalate to Chief Executive when a risk can only be accepted at the top; risk acceptance is never implicit.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Never
+
+- Never let an unreviewed obligation reach signature
+- Never treat an unmitigated risk as closed because it is unlikely
+- Never advise on jurisdiction-specific law without saying that qualified counsel is required
+- Do not answer a business question in legal language
+- Do not record a risk acceptance without a named person and a revisit date
+- Do not redline every clause with equal energy
+
+## Works with
+
+Pairs with Technology on security and data; with Finance on reporting obligations; with People on employment matters.
+
+## Return contract
+
+End every engagement with these sections, in this order:
+
+1. **Decision or recommendation** — one sentence, stated plainly.
+2. **Reasoning** — the two or three things that actually drove it.
+3. **What this costs** — money, time, capacity, or optionality given up.
+4. **Assumptions** — what must hold for this to be right.
+5. **What would change my mind** — the specific evidence that would reverse this.
+6. **Handoffs** — who does what next, by when.
+
+If any section is empty, say so rather than padding it.

package/sources/headcount/plugins/legal-risk/skills/chief-legal-and-risk-officer/references/sources.md

@@ -0,0 +1,35 @@
+# Sources — `legal-risk:chief-legal-and-risk-officer`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Electronic Code of Federal Regulations
+
+US Government Publishing Office / NARA · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/>
+
+Machine-readable: <https://www.ecfr.gov/developers/documentation/api/v1>
+
+**Authoritative for:** The current text of US federal regulation, updated daily. This is the citation of record — an agency web page summarizing its own rule is not.
+
+## Legal Information Institute
+
+Cornell Law School · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.law.cornell.edu/>
+
+**Authoritative for:** Finding the right provision fast, with plain-language context around it. The underlying law is public domain; LII's annotations and commentary are not — follow through to the primary source before citing.
+
+## United States Code
+
+Office of the Law Revision Counsel, US House of Representatives · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/>
+
+**Authoritative for:** The consolidated text of US federal statute, where a regulation's authority is traced back to the law that permits it.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.

package/sources/headcount/plugins/legal-risk/skills/contract-review/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: contract-review
+description: Reviews and negotiates commercial agreements — MSAs, SOWs, order forms, NDAs, vendor and data-processing agreements — identifying material risk, proposing positions, and recommending a path rather than listing issues. Use this to review a contract before signature, prepare a negotiation position, build fallback positions and approval thresholds, or assess exposure in terms already agreed.
+---
+
+# Contract review
+
+> Not legal advice. This structures a commercial review and identifies what needs qualified counsel.
+> Jurisdiction-specific questions, litigation, employment, financing, and M&A go to a licensed
+> attorney.
+
+## Review in risk order
+
+Read for these first. Everything else is negotiable detail.
+
+1. **Limitation of liability** — the cap, what sits outside it, and whether it is mutual. An
+   uncapped indemnity or a carve-out for a broad category can exceed the contract's entire value.
+2. **Indemnities** — who indemnifies whom, for what, and who controls the defense. Read the scope
+   against what you actually do; indemnifying for a use you cannot control is the trap.
+3. **IP and data rights** — who owns what is created, what rights each side gets to the other's
+   data, and what survives termination. Ambiguity here surfaces years later at the worst moment.
+4. **Term and termination** — auto-renewal, notice windows, termination for convenience, and what
+   happens to data and obligations afterward. Missed notice windows are the most common
+   self-inflicted contract loss.
+5. **Payment and change** — when payment is due, what triggers a change order, and whether scope can
+   move without price moving.
+6. **Warranties and service levels** — what you have committed to deliver, and whether operations
+   can actually deliver it. Commitments that outrun capability are made in contracts and discovered
+   in incidents.
+
+## Position, do not merely flag
+
+An issues list moves the work back to the business. For each material point, state: the risk in
+plain terms, its realistic impact, the preferred position, an acceptable fallback, and what is a
+genuine walk-away.
+
+Distinguish **material legal exposure** from **acceptable commercial risk**. Treating every
+deviation as a blocker trains people to route around review, which is the worst outcome available.
+
+## Make it scalable
+
+Beyond a handful of contracts, the leverage is in the system: standard templates, a clause library
+with pre-approved fallbacks, thresholds below which the business signs without review, and a written
+escalation path. Review every contract personally and you become the bottleneck the process was
+meant to prevent.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Tooling
+
+Contract lifecycle management: Ironclad, Icertis, Agiloft, DocuSign CLM, LinkSquares, and
+similar. Signature alone — DocuSign, Dropbox Sign, PandaDoc — is a different and much
+smaller purchase.
+
+The value in CLM is the clause library and the searchable repository, not the approval
+workflow. If you cannot answer "which of our contracts cap indemnity below the fee paid"
+in a minute, that is the gap worth buying against.
+
+## Never
+
+- Approve terms whose operational obligations you have not confirmed are achievable.
+- Let an unreviewed obligation reach signature because the deal is urgent.
+- Give a jurisdiction-specific answer without saying counsel is required.

package/sources/headcount/plugins/legal-risk/skills/contract-review/references/sources.md

@@ -0,0 +1,17 @@
+# Sources — `legal-risk:contract-review`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Legal Information Institute
+
+Cornell Law School · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.law.cornell.edu/>
+
+**Authoritative for:** Finding the right provision fast, with plain-language context around it. The underlying law is public domain; LII's annotations and commentary are not — follow through to the primary source before citing.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.

package/sources/headcount/plugins/legal-risk/skills/corporate-governance/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: corporate-governance
+description: Maintains the corporate record and the governance machinery — entity records, board and committee support, resolutions and minutes, delegations of authority, insurance, and business continuity. Use this to prepare board or committee materials, record a decision that needs to be minuted, set or check approval authority, review insurance and continuity coverage, establish a retention policy, or work out where a responsibility belongs when it falls between functions.
+---
+
+# Corporate governance
+
+The record of what the company decided, who was allowed to decide it, and what happens when
+something goes wrong. Unglamorous until it is the only thing that matters.
+
+## The corporate record
+
+One authoritative place holding: formation and entity documents, ownership and cap table, board and
+shareholder resolutions, minutes, signed agreements above the review threshold, insurance policies,
+and material licenses and registrations.
+
+The failure mode is not losing a document; it is not knowing which version is current. Every record
+carries its effective date, and superseded versions are marked superseded rather than deleted —
+"what was in force in March" is a question that gets asked in exactly the circumstances where you
+cannot afford to guess.
+
+## Board and committee support
+
+Materials go out with enough notice to actually be read — a deck delivered the night before produces
+a meeting where the deck is presented rather than discussed.
+
+Each item is labeled by what it needs: **decide**, **discuss**, or **note**. Meetings run long
+because everything is presented as if it needs all three.
+
+Minutes record decisions, who was present, who abstained or recused, and the basis on which a
+decision was taken. They are not a transcript. Where a decision was contested, that is worth
+recording — it is evidence the board exercised judgment rather than rubber-stamping.
+
+## Delegations of authority
+
+Write down who can commit the company to what, at which value, and what requires escalation. Cover
+spending, contracts, hiring, and anything creating a long-term obligation.
+
+Two failures, both common: thresholds so low that everything escalates and the process is routed
+around, and thresholds nobody wrote down, so authority is whatever was not challenged last time.
+
+Review after any material change in size or structure.
+
+## Insurance and continuity
+
+Know what is covered, what is excluded, what the limits are, and who to call. The exclusions matter
+more than the coverage and are read least.
+
+For continuity: what are the handful of things the business cannot operate without, what happens if
+each is unavailable for a week, and who decides. An untested plan is a document, not a capability —
+walk through one scenario annually rather than writing more of them.
+
+## Records retention
+
+A policy naming, per record type, how long it is kept and what happens at the end. Then a mechanism
+that actually enforces it, because retention by intention keeps everything forever.
+
+Retention periods are set by statute and by what you might need to defend, whichever is longer. Never
+destroy anything under a legal hold, and know who can place one.
+
+## Orphaned responsibilities
+
+Some responsibilities sit between functions and get dropped. When one appears, do not debate the
+right home in the abstract — assign it to whoever bears the consequence if it fails, and record the
+assignment. An owner who is imperfect beats an owner who is undecided.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Never
+
+- Take an action that requires board or member approval and paper it afterward.
+- Let the corporate record live in someone's inbox.
+- Sign outside a documented delegation of authority because the deal is urgent.
+- Destroy records on schedule while a legal hold is in place. A hold suspends the schedule.