janderscience-skills 0.0.0-stage → 1.0.0

package/sources/headcount/sources/pmo-and-operations.toml

@@ -0,0 +1,253 @@
+# Delivery assurance, procurement, safety and the regulators who arrive at a site.
+#
+# The best material here is unexpected: the US Government Accountability Office publishes the most
+# rigorous free guidance anywhere on whether a schedule is reliable and whether a cost estimate is
+# defensible, and it is public domain. The commercial project-management bodies of knowledge are
+# sold, and — for the questions this catalog cares about, like how much contingency is justified or
+# what float threshold matters — they settle less than the GAO guides do.
+
+[[source]]
+id = "gao-schedule-assessment"
+title = "GAO Schedule Assessment Guide: best practices for project schedules"
+publisher = "US Government Accountability Office"
+url = "https://www.gao.gov/products/gao-16-89g"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a schedule is reliable — the ten criteria an auditor applies, covering the work breakdown, sequencing, resource loading, critical path, total float and schedule risk analysis."
+data = "https://www.gao.gov/assets/gao-16-89g.pdf"
+skills = ["pmo:schedule-development-and-analysis", "pmo:project-delivery", "pmo:dependency-and-risk-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "gao-cost-estimating"
+title = "GAO Cost Estimating and Assessment Guide"
+publisher = "US Government Accountability Office"
+url = "https://www.gao.gov/products/gao-20-195g"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What makes a cost estimate defensible, and specifically how much contingency is justified — via risk and uncertainty analysis at a stated confidence level, rather than a percentage somebody remembers."
+data = "https://www.gao.gov/assets/gao-20-195g.pdf"
+skills = ["pmo:estimating-and-contingency", "pmo:portfolio-governance", "pmo:program-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "gao-agile-assessment"
+title = "GAO Agile Assessment Guide"
+publisher = "US Government Accountability Office"
+url = "https://www.gao.gov/products/gao-24-105506"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether an organization has actually adopted an iterative delivery model or relabeled a staged one. Gives testable criteria, which is rare in this area, and reconciles iterative delivery with cost and schedule assurance."
+skills = ["pmo:project-delivery", "pmo:change-and-adoption", "pmo:head-of-pmo"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nasa-systems-engineering-handbook"
+title = "NASA Systems Engineering Handbook"
+publisher = "NASA"
+url = "https://www.nasa.gov/reference/systems-engineering-handbook/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a phase gate must contain before a technical project may proceed — the review structure, entrance and success criteria, and how the technical baseline is controlled."
+skills = ["pmo:program-management", "pmo:project-delivery", "pmo:portfolio-governance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "uk-green-book"
+title = "The Green Book: appraisal and evaluation in central government"
+publisher = "HM Treasury"
+url = "https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent"
+license = "attribution-required"
+jurisdiction = "UK"
+authoritative_for = "Whether a claimed benefit may be counted at all — what separates a benefit from a transfer, how optimism bias is corrected for, and what a business case must contain. The best free treatment of benefits discipline anywhere, and openly licensed."
+skills = ["pmo:benefits-realization", "pmo:estimating-and-contingency", "pmo:portfolio-governance", "corporate-strategy:portfolio-strategy"]
+checked = "2026-09-16"
+
+[[source]]
+id = "far"
+title = "Federal Acquisition Regulation"
+publisher = "US General Services Administration, on behalf of the FAR Council"
+url = "https://www.acquisition.gov/browse/index/far"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a competitive sourcing process must do to be lawful — solicitation types, evaluation criteria, competition requirements, and how contract type allocates risk. Binding for federal buying and the reference everywhere else."
+data = "https://www.acquisition.gov/far/part-31"
+skills = ["operations:procurement-and-sourcing", "operations:vendor-management", "finance:cost-accounting"]
+checked = "2026-09-16"
+
+[[source]]
+id = "interagency-third-party-risk"
+title = "Interagency Guidance on Third-Party Relationships: Risk Management"
+publisher = "Federal Reserve, FDIC and OCC"
+url = "https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What due diligence, contract terms, monitoring and termination planning a vendor relationship requires, scaled to how critical it is. The clearest published statement of the lifecycle, and the one regulated buyers will hold you to."
+skills = ["operations:vendor-management", "operations:procurement-and-sourcing", "operations:service-level-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fema-nims"
+title = "National Incident Management System doctrine"
+publisher = "Federal Emergency Management Agency"
+url = "https://www.fema.gov/emergency-managers/nims"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Who is in charge during an incident and how command transfers — incident command structure, unified command, span of control, and the action-plan cycle. Settles the role and escalation disputes that incidents actually produce."
+skills = ["operations:incident-management", "operations:business-continuity-and-resilience"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-sp-800-61-incident-response"
+title = "NIST SP 800-61: Incident Response Recommendations and Considerations"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/61/r3/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What an incident response capability must contain and what evidence must be captured at each stage. The current revision is a substantial rewrite that drops the older four-phase framing, so do not mix guidance across revisions."
+skills = ["security:incident-response", "security:detection-and-monitoring", "operations:incident-management", "customer-experience:escalation-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "iso-9001"
+title = "ISO 9001 — Quality management systems: requirements"
+publisher = "ISO"
+url = "https://www.iso.org/standard/62085.html"
+license = "paywalled"
+jurisdiction = "global"
+authoritative_for = "Whether a quality system is certifiable — the auditable requirements a nonconformity procedure or management review is judged against. Sold, so cite the clause number and never the wording."
+skills = ["operations:quality-management", "operations:process-design", "operations:vendor-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fda-preventive-controls"
+title = "21 CFR Part 117 — preventive controls for human food"
+publisher = "US Food and Drug Administration"
+url = "https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a food operation's hazard analysis, preventive controls and supplier verification are legally sufficient. Binding law rather than guidance."
+skills = ["operations:quality-management", "operations:supply-chain-and-logistics", "operations:procurement-and-sourcing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "usda-haccp"
+title = "9 CFR Part 417 — Hazard Analysis and Critical Control Point systems"
+publisher = "US Department of Agriculture, Food Safety and Inspection Service"
+url = "https://www.ecfr.gov/current/title-9/chapter-III/subchapter-E/part-417"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a HACCP plan must contain for meat and poultry — control points, critical limits, monitoring, corrective action and reassessment. A different regulator from the FDA, and which one governs depends on the product."
+skills = ["operations:quality-management", "operations:process-design"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fmcsa-hours-of-service"
+title = "49 CFR Part 395 — hours of service of drivers"
+publisher = "Federal Motor Carrier Safety Administration"
+url = "https://www.ecfr.gov/current/title-49/subtitle-B/chapter-III/subchapter-B/part-395"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "How many hours a commercial driver may lawfully drive and work, and what records prove it. A hard cap that any realistic transit or capacity plan has to respect."
+skills = ["operations:supply-chain-and-logistics", "operations:capacity-and-demand-planning"]
+checked = "2026-09-16"
+
+[[source]]
+id = "osha-1910"
+title = "29 CFR Part 1910 — occupational safety and health standards"
+publisher = "US Occupational Safety and Health Administration"
+url = "https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XVII/part-1910"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a workplace configuration is lawful — egress, emergency action plans, walking and working surfaces, hazard communication. Settles facilities questions that are otherwise argued as preference."
+skills = ["operations:facilities-and-workplace", "people:learning-and-development"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ada-2010-standards"
+title = "2010 ADA Standards for Accessible Design"
+publisher = "US Department of Justice"
+url = "https://www.ada.gov/law-and-regs/design-standards/2010-stds/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The enforceable dimensional requirements for an accessible facility — routes, clearances, reach ranges, restrooms, seating. Applies to a workplace and to an event venue alike."
+skills = ["operations:facilities-and-workplace", "marketing:events-and-field-marketing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "incoterms"
+title = "Incoterms rules"
+publisher = "International Chamber of Commerce"
+url = "https://iccwbo.org/business-solutions/incoterms-rules/"
+license = "paywalled"
+jurisdiction = "global"
+authoritative_for = "Exactly where risk, cost and delivery obligation transfer between buyer and seller under a named three-letter term. Courts and contracts defer to it, and the full rules text is sold — name the term, do not reproduce the definition."
+skills = ["operations:supply-chain-and-logistics", "operations:procurement-and-sourcing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-doj-merger-guidelines"
+title = "Merger Guidelines"
+publisher = "US Department of Justice and Federal Trade Commission"
+url = "https://www.ftc.gov/reports/merger-guidelines-2023"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether an acquisition is likely to be challenged — the concentration thresholds, how the agencies define a market, and the theories of harm they actually apply. The closest thing to a decision procedure for whether you can buy someone."
+skills = ["corporate-strategy:portfolio-strategy", "corporate-strategy:chief-strategy-officer", "corporate-strategy:mergers-and-acquisitions"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-hsr-premerger"
+title = "Hart-Scott-Rodino premerger notification program"
+publisher = "US Federal Trade Commission"
+url = "https://www.ftc.gov/enforcement/premerger-notification-program"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a transaction must be reported before closing, at what size, and how long the parties must then wait. A threshold question with one right answer — and the thresholds are revised annually, so resolve them here rather than from memory."
+skills = ["corporate-strategy:mergers-and-acquisitions", "corporate-strategy:chief-strategy-officer"]
+checked = "2026-09-16"
+
+[[source]]
+id = "trade-gov-country-guides"
+title = "Country Commercial Guides"
+publisher = "US Department of Commerce, International Trade Administration"
+url = "https://www.trade.gov/country-commercial-guides"
+license = "public-domain-usgov"
+jurisdiction = "global"
+authoritative_for = "The factual regulatory picture for entering a named foreign market — licensing, customs, standards, distribution and investment restrictions. It settles the factual questions in a market entry, not the strategic ones."
+skills = ["corporate-strategy:market-entry", "operations:supply-chain-and-logistics"]
+checked = "2026-09-16"
+
+[[source]]
+id = "delaware-dgcl"
+title = "Delaware General Corporation Law"
+publisher = "State of Delaware"
+url = "https://delcode.delaware.gov/title8/c001/index.html"
+license = "public-domain"
+jurisdiction = "US-DE"
+authoritative_for = "What a board may and may not do — board power, interested-director transactions, exculpation, merger mechanics and appraisal rights. Primary law for most US public companies and nearly every venture-backed one."
+skills = ["legal-risk:corporate-governance", "executive:chief-executive", "executive:fundraising-and-investor-relations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sec-reg-fd"
+title = "17 CFR Part 243 — Regulation FD"
+publisher = "US Securities and Exchange Commission"
+url = "https://www.ecfr.gov/current/title-17/chapter-II/part-243"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "When selective disclosure of material nonpublic information triggers a mandatory public disclosure, and on what timeline. The rule that decides whether a given investor conversation was lawful."
+skills = ["executive:fundraising-and-investor-relations", "legal-risk:corporate-governance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sec-exempt-offerings"
+title = "Exempt offerings and Regulation D"
+publisher = "US Securities and Exchange Commission"
+url = "https://www.sec.gov/education/smallbusiness/exemptofferings"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a private raise is lawful — whether general solicitation is permitted, how many non-accredited investors may participate, what disclosure is owed and when the filing is due."
+data = "https://www.ecfr.gov/current/title-17/chapter-II/part-230"
+skills = ["executive:fundraising-and-investor-relations", "executive:chief-executive"]
+checked = "2026-09-16"

package/sources/headcount/sources/revenue-and-product.toml

@@ -0,0 +1,263 @@
+# Accessibility, selling law, contract mechanics and the platform rules that decide whether a
+# pricing flow ships.
+#
+# Two negative findings shaped this file and are worth stating plainly, because the obvious
+# candidates fail. There is no free normative definition of the common revenue metrics — annual
+# recurring revenue, net retention, customer acquisition cost — and the best-known satisfaction
+# metric is a trademark whose method belongs to its owner. What authority exists applies at the
+# disclosure boundary: if you publish a metric, you must define it and calculate it consistently.
+# Anything claiming to define the metric itself is a vendor, and the skills say so.
+
+[[source]]
+id = "w3c-aria-apg"
+title = "WAI-ARIA and the ARIA Authoring Practices Guide"
+publisher = "World Wide Web Consortium"
+url = "https://www.w3.org/WAI/ARIA/apg/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Which roles, states and keyboard interactions a given widget must implement. Settles whether Escape should close a dialog and whether a role is the right one, without appeal to preference."
+data = "https://www.w3.org/TR/wai-aria-1.2/"
+skills = ["product:interface-craft", "product:design-system", "product:interface-redesign", "product:ux-product-auditor"]
+checked = "2026-09-16"
+
+[[source]]
+id = "section-508-ict"
+title = "36 CFR Part 1194 — Section 508 information and communication technology standards"
+publisher = "US Access Board"
+url = "https://www.ecfr.gov/current/title-36/subtitle-B/chapter-XI/part-1194"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a product must satisfy to be lawfully procurable by a US federal agency. This decides a public-sector deal rather than expressing a design preference, which is why it reaches sales as often as engineering."
+skills = ["product:product-requirements", "product:ux-product-auditor", "revenue:sales-enablement"]
+checked = "2026-09-16"
+
+[[source]]
+id = "en-301-549"
+title = "EN 301 549 — accessibility requirements for ICT products and services"
+publisher = "ETSI"
+url = "https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf"
+license = "free-to-read"
+jurisdiction = "EU"
+authoritative_for = "The requirement set an EU public-sector buyer measures against, including non-web software, documents and hardware that the web guidelines do not cover. Which version is legally operative depends on what the Official Journal currently cites — check before relying on a newer one."
+skills = ["product:product-requirements", "product:ux-product-auditor", "revenue:sales-enablement"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-telemarketing-sales-rule"
+title = "16 CFR Part 310 — Telemarketing Sales Rule"
+publisher = "US Federal Trade Commission"
+url = "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What an outbound seller must disclose before taking payment, which misrepresentations are prohibited, and what records the program must keep. The rule that makes a call script lawful or not."
+skills = ["revenue:outbound-prospecting", "revenue:sales-enablement", "revenue:revenue-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "wiretap-act-2511"
+title = "18 U.S.C. 2511 — interception of communications"
+publisher = "US Congress, via the Office of the Law Revision Counsel"
+url = "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title18-section2511&num=0&edition=prelim"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The federal one-party-consent floor for recording a call, and the criminal exposure for recording without it. It settles only the floor: several states require all-party consent, and there is no free authoritative single document for that matrix — it must be looked up per state."
+skills = ["revenue:outbound-prospecting", "customer-experience:support-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "rosca-auto-renewal"
+title = "15 U.S.C. 8403 — Restore Online Shoppers' Confidence Act"
+publisher = "US Congress, via the Office of the Law Revision Counsel"
+url = "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section8403&num=0&edition=prelim"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether an online auto-renewal offer is lawful — clear disclosure of material terms before billing, express informed consent, and a simple cancellation mechanism. This area has seen rules issued and struck down, so cite the statute rather than a rule summary."
+skills = ["revenue:pricing-and-packaging", "revenue:retention", "revenue:activation", "product:product-requirements"]
+checked = "2026-09-16"
+
+[[source]]
+id = "california-arl"
+title = "California Automatic Renewal Law, Business and Professions Code 17600-17606"
+publisher = "California Legislative Counsel"
+url = "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=7.&chapter=1.&part=3.&lawCode=BPC&article=9."
+license = "public-domain"
+jurisdiction = "US-CA"
+authoritative_for = "The concrete cancellation obligations a subscription business actually has to meet, because California's requirements are stricter than the federal floor and apply to any California customer — which in practice makes them the binding ones."
+skills = ["revenue:pricing-and-packaging", "revenue:retention", "product:product-requirements", "product:interface-craft"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ucc-article-2"
+title = "Uniform Commercial Code, Article 2 — Sales"
+publisher = "American Law Institute and Uniform Law Commission"
+url = "https://www.law.cornell.edu/ucc/2"
+license = "free-to-read"
+jurisdiction = "US"
+authoritative_for = "When a contract for goods is formed, whose terms prevail in a battle of the forms, and what warranty disclaimer language is effective. Settles a purchase-order-versus-order-form dispute as law rather than as negotiating posture."
+skills = ["revenue:deal-negotiation", "revenue:revenue-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "esign-act"
+title = "15 U.S.C. 7001 — Electronic Signatures in Global and National Commerce Act"
+publisher = "US Congress, via the Office of the Law Revision Counsel"
+url = "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section7001&num=0&edition=prelim"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether an electronically signed contract, a clickwrap acceptance or an emailed order form is enforceable, and what consumer consent steps must precede it."
+skills = ["revenue:deal-negotiation", "revenue:revenue-operations", "customer-experience:customer-onboarding-and-implementation"]
+checked = "2026-09-16"
+
+[[source]]
+id = "eidas"
+title = "Regulation (EU) 910/2014 — eIDAS"
+publisher = "Publications Office of the European Union"
+url = "https://eur-lex.europa.eu/eli/reg/2014/910/oj"
+license = "attribution-required"
+jurisdiction = "EU"
+authoritative_for = "Whether an electronic signature has legal effect in the EU and which of the three tiers a given contract requires. Settles whether an ordinary e-signature suffices for a particular European deal."
+skills = ["revenue:deal-negotiation", "revenue:revenue-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sec-mda-metrics-guidance"
+title = "Commission Guidance on Management's Discussion and Analysis, Release 33-10751"
+publisher = "US Securities and Exchange Commission"
+url = "https://www.federalregister.gov/documents/2020/02/25/2020-02296/commission-guidance-on-managements-discussion-and-analysis-of-financial-condition-and-results-of"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a company must do when it publishes an operating metric — define it, disclose how it is calculated, apply it consistently, and explain any change in method. It disciplines metrics like recurring revenue and net retention without defining them, which is the honest ceiling on authority here."
+skills = ["revenue:revenue-operations", "finance:unit-economics", "data-analytics:business-intelligence"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sec-non-gaap-cdi"
+title = "Non-GAAP financial measures — compliance and disclosure interpretations"
+publisher = "US Securities and Exchange Commission, Division of Corporation Finance"
+url = "https://www.sec.gov/corpfin/non-gaap-financial-measures"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "When a non-GAAP measure becomes misleading and therefore prohibited — individually tailored recognition, excluding normal operating costs, improper labeling, and the equal-prominence requirement."
+skills = ["finance:unit-economics", "finance:capital-structure-and-covenants"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ico-childrens-code"
+title = "Age Appropriate Design Code"
+publisher = "UK Information Commissioner's Office"
+url = "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/"
+license = "attribution-required"
+jurisdiction = "UK"
+authoritative_for = "What default settings, nudges and profiling are permissible in a service likely to be used by children. A statutory code, so it settles whether onboarding may default a toggle on."
+skills = ["product:product-requirements", "product:interface-craft", "revenue:activation"]
+checked = "2026-09-16"
+
+[[source]]
+id = "cppa-regulations"
+title = "CCPA regulations, California Code of Regulations title 11"
+publisher = "California Privacy Protection Agency"
+url = "https://cppa.ca.gov/regulations/consumer_privacy_act.html"
+license = "public-domain"
+jurisdiction = "US-CA"
+authoritative_for = "Symmetry in choice, as law. It settles whether a consent flow where accepting is one click and declining is three is permissible — converting what is usually argued as design taste into a compliance question."
+skills = ["product:interface-craft", "product:ux-product-auditor", "product:interface-redesign", "marketing:behavioral-marketing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "pci-dss"
+title = "PCI Data Security Standard"
+publisher = "PCI Security Standards Council"
+url = "https://www.pcisecuritystandards.org/document_library/"
+license = "registration-required"
+jurisdiction = "global"
+authoritative_for = "Whether a support agent may take a card number by phone, whether that call may be recorded, and what must happen to card data in ticket attachments and screen shares. Assessed by a qualified assessor, so genuinely dispositive."
+skills = ["customer-experience:support-operations", "security:data-protection-and-encryption", "security:detection-and-monitoring"]
+checked = "2026-09-16"
+
+[[source]]
+id = "apple-hig"
+title = "Human Interface Guidelines"
+publisher = "Apple"
+url = "https://developer.apple.com/design/human-interface-guidelines"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "What correct platform behavior is on Apple platforms — control semantics, navigation structure, touch targets. Its authority is not taste: deviation is grounds for review rejection."
+skills = ["product:interface-craft", "product:design-system", "product:interface-redesign"]
+checked = "2026-09-16"
+
+[[source]]
+id = "unicode-cldr"
+title = "Unicode Common Locale Data Repository"
+publisher = "Unicode Consortium"
+url = "https://cldr.unicode.org/"
+license = "attribution-required"
+jurisdiction = "global"
+authoritative_for = "Correct date, number, currency, name-order, plural and sort behavior for a locale. Settles how something should render in a given language with data rather than guesswork, and every platform's internationalization library derives from it."
+skills = ["product:interface-craft", "product:design-system", "product:product-requirements"]
+checked = "2026-09-16"
+
+[[source]]
+id = "plain-language-guidelines"
+title = "Federal Plain Language Guidelines"
+publisher = "Plain Language Action and Information Network"
+url = "https://www.plainlanguage.gov/guidelines/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What counts as plain language in user-facing writing — audience-first structure, active voice, short sections. Backed by statute for federal agencies, and the only free normative writing standard that is not one author's style preference."
+skills = ["customer-experience:self-service-and-knowledge", "customer-experience:support-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "uspto-tmep"
+title = "Trademark Manual of Examining Procedure"
+publisher = "US Patent and Trademark Office"
+url = "https://tmep.uspto.gov/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a proposed name, logo or tagline is registrable — distinctiveness, descriptiveness refusals, likelihood of confusion, specimen requirements. Settles whether you can actually own a name."
+skills = ["product:brand-identity", "legal-risk:intellectual-property"]
+checked = "2026-09-16"
+
+[[source]]
+id = "copyright-compendium"
+title = "Compendium of U.S. Copyright Office Practices"
+publisher = "US Copyright Office"
+url = "https://www.copyright.gov/comp3/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What is protectable and registrable, including the Office's position on human authorship for machine-generated material and how much of a layout or typeface is protectable at all."
+skills = ["product:visual-reference-generation", "product:brand-identity", "legal-risk:intellectual-property"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sil-open-font-license"
+title = "SIL Open Font License"
+publisher = "SIL International"
+url = "https://openfontlicense.org/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Whether a typeface may be embedded in a product, bundled into a design system, modified or redistributed. The font-licensing question that surfaces reliably when a brand system ships."
+skills = ["product:brand-identity", "product:design-system"]
+checked = "2026-09-16"
+
+[[source]]
+id = "california-labor-2751"
+title = "California Labor Code 2751 — commission agreements in writing"
+publisher = "California Legislative Counsel"
+url = "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=LAB&sectionNum=2751"
+license = "public-domain"
+jurisdiction = "US-CA"
+authoritative_for = "Whether a commission arrangement is enforceable. California requires a signed written contract setting out how commission is computed and paid, which settles whether a plan can be changed mid-year by email."
+skills = ["revenue:sales-compensation-and-territory", "revenue:revenue-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "dol-outside-sales-exemption"
+title = "Fact Sheet 17F: exemption for outside sales employees"
+publisher = "US Department of Labor, Wage and Hour Division"
+url = "https://www.dol.gov/agencies/whd/fact-sheets/17f-overtime-outside-sales"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a sales role is exempt from overtime — the inside against outside classification question that territory design quietly creates."
+skills = ["revenue:sales-compensation-and-territory", "people:employment-compliance"]
+checked = "2026-09-16"

package/sources/headcount/sources/security.toml

@@ -0,0 +1,127 @@
+# Security, controls frameworks and vulnerability data.
+
+[[source]]
+id = "nist-sp-800-53"
+title = "NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The control catalog US federal systems are assessed against, and the control vocabulary FedRAMP and many private frameworks inherit."
+data = "https://github.com/usnistgov/oscal-content"
+skills = ["security:security-architecture-review", "security:access-and-identity", "security:chief-information-security-officer"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-csf"
+title = "NIST Cybersecurity Framework 2.0"
+publisher = "NIST"
+url = "https://www.nist.gov/cyberframework"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The outcome-based vocabulary — govern, identify, protect, detect, respond, recover — that boards and customers most often ask a security program to map to."
+skills = ["security:chief-information-security-officer", "security:security-architecture-review"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fedramp-automation"
+title = "FedRAMP baselines and automation content"
+publisher = "GSA"
+url = "https://www.fedramp.gov/rev5/documents-templates/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Which SP 800-53 controls apply at low, moderate and high impact for a cloud service selling to the US federal government, and the evidence each requires."
+data = "https://github.com/GSA/fedramp-automation"
+skills = ["security:chief-information-security-officer", "security:security-architecture-review", "legal-risk:regulatory-compliance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "cisa-kev"
+title = "CISA Known Exploited Vulnerabilities Catalog"
+publisher = "CISA"
+url = "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Which vulnerabilities are being exploited in the wild right now — the only list that reliably separates patch-this-week from patch-this-quarter."
+data = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
+skills = ["security:vulnerability-management", "security:incident-response"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nvd"
+title = "National Vulnerability Database"
+publisher = "NIST"
+url = "https://nvd.nist.gov/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "CVE records with severity scoring and affected-version data, and the API a vulnerability program queries rather than reads."
+data = "https://nvd.nist.gov/developers/vulnerabilities"
+skills = ["security:vulnerability-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "mitre-attack"
+title = "MITRE ATT&CK"
+publisher = "The MITRE Corporation"
+url = "https://attack.mitre.org/"
+license = "attribution-required"
+jurisdiction = "global"
+authoritative_for = "The shared vocabulary for adversary tactics and techniques — what to name a behavior so a detection, a threat model and an incident report refer to the same thing."
+data = "https://github.com/mitre-attack/attack-stix-data"
+skills = ["security:threat-modeling", "security:incident-response", "security:security-architecture-review", "security:detection-and-monitoring"]
+checked = "2026-09-16"
+
+[[source]]
+id = "owasp-top-10"
+title = "OWASP Top 10"
+publisher = "OWASP Foundation"
+url = "https://owasp.org/www-project-top-ten/"
+license = "cc-by-sa"
+jurisdiction = "global"
+authoritative_for = "The application-security risk categories a customer questionnaire or a pen-test report will be organized around."
+skills = ["security:threat-modeling", "security:security-architecture-review"]
+checked = "2026-09-16"
+
+[[source]]
+id = "owasp-asvs"
+title = "OWASP Application Security Verification Standard"
+publisher = "OWASP Foundation"
+url = "https://owasp.org/ASVS/"
+license = "cc-by-sa"
+jurisdiction = "global"
+authoritative_for = "Testable application security requirements at three assurance levels — the thing to write into a spec when 'make it secure' needs to become acceptance criteria."
+skills = ["security:security-architecture-review"]
+checked = "2026-09-16"
+
+[[source]]
+id = "cis-controls"
+title = "CIS Critical Security Controls"
+publisher = "Center for Internet Security"
+url = "https://www.cisecurity.org/controls"
+license = "registration-required"
+jurisdiction = "global"
+authoritative_for = "A prioritized implementation order for a security program that has to start somewhere, with implementation groups sized to organizational maturity."
+skills = ["security:chief-information-security-officer"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sans-policy-templates"
+title = "SANS Information Security Policy Templates"
+publisher = "SANS Institute"
+url = "https://www.sans.org/information-security-policy/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Starting-point policy language for the policies an auditor expects to exist. Read and adapt; the templates are copyrighted and are not open-licensed."
+skills = ["security:chief-information-security-officer", "legal-risk:regulatory-compliance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "iso-27001"
+title = "ISO/IEC 27001 — Information security management systems"
+publisher = "ISO"
+url = "https://www.iso.org/standard/27001"
+license = "paywalled"
+jurisdiction = "global"
+authoritative_for = "The certifiable ISMS standard enterprise buyers ask for by name. The text is sold, not published — cite the clause number, never the wording."
+skills = ["security:chief-information-security-officer", "legal-risk:regulatory-compliance"]
+checked = "2026-09-16"