rsc-universal 0.1.1

package/skills/google-workspace/scripts/verify.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+#
+# verify.sh — credential + scope preflight linter for Google Workspace
+# integration code. NO network. Scans a target dir for the dangerous/wrong
+# patterns this skill bans, and exits non-zero on any hit.
+#
+# Read-only. Never writes, edits, or sends anything.
+#
+# Checks:
+#   1. Tracked service-account key files: a *.json containing "private_key"
+#      and a service-account marker (client_email / .iam.gserviceaccount.com) —
+#      a committed SA key.
+#   2. Over-broad scope where a narrower variant exists:
+#        .../auth/drive    (use drive.file / drive.readonly)
+#        .../auth/gmail     [bare] (use gmail.send / gmail.readonly)
+#        .../mail.google.com/      (full mailbox incl. delete)
+#   3. Hardcoded private key in source: a literal "-----BEGIN PRIVATE KEY-----".
+#   4. Workspace API calls (googleapis / googleapiclient) with no backoff/retry
+#      helper anywhere in the file (informational WARN, not a hard fail).
+#
+# Usage:
+#   scripts/verify.sh [PATH ...]
+#     PATH = a file or directory. With no PATH, scans the current directory.
+#
+# Exit 0 = no banned pattern found (an empty/clean target is a pass).
+# Exit 1 = at least one hard finding (checks 1-3).
+# Exit 2 = a usage / environment problem.
+
+set -euo pipefail
+
+# This script intentionally contains the banned patterns as documentation /
+# match literals; never let it flag itself. grep -rn emits a "<path>:<line>:..."
+# prefix whose <path> is relative or absolute depending on how the target was
+# named, so we cannot match the absolute $SELF. Instead, strip any hit whose
+# path component (everything before the first ":") basenames to this script.
+SELF_BASE="$(basename "${BASH_SOURCE[0]}")"
+drop_self() {
+  awk -v self="$SELF_BASE" -F: '{
+    p = $1
+    n = split(p, parts, "/")
+    if (parts[n] != self) print
+  }'
+}
+
+if [ "$#" -eq 0 ]; then
+  set -- "."
+fi
+
+declare -a TARGETS=()
+for t in "$@"; do
+  if [ -e "$t" ]; then
+    TARGETS+=("$t")
+  else
+    echo "verify.sh: no such path: $t" >&2
+  fi
+done
+
+if [ "${#TARGETS[@]}" -eq 0 ]; then
+  echo "verify.sh: nothing to scan"
+  exit 0
+fi
+
+# Source extensions we lint, and dirs we skip.
+SRC_INCLUDE=(--include='*.js' --include='*.mjs' --include='*.cjs'
+  --include='*.ts' --include='*.tsx' --include='*.py' --include='*.json'
+  --include='*.env' --include='*.yaml' --include='*.yml' --include='*.sh')
+EXCLUDE=(--exclude-dir=node_modules --exclude-dir=.git --exclude-dir=dist
+  --exclude-dir=build --exclude-dir=.venv --exclude-dir=venv
+  --exclude-dir=__pycache__ --exclude=verify.sh)
+
+fail=0
+
+emit() { # emit <label> <multiline-hits>
+  echo "FAIL  $1"
+  while IFS= read -r line; do
+    [ -n "$line" ] && echo "        $line"
+  done <<< "$2"
+  fail=1
+}
+
+# --- check 1: committed SA key JSON ---------------------------------------
+key_hits=""
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  if grep -qE 'service_account|\.iam\.gserviceaccount\.com|"client_email"' "$f" 2>/dev/null; then
+    key_hits+="${f}"$'\n'
+  fi
+done < <(grep -rlI "${EXCLUDE[@]}" --include='*.json' '"private_key"' "${TARGETS[@]}" 2>/dev/null || true)
+if [ -n "${key_hits//[$'\n']/}" ]; then
+  emit "committed service-account key JSON (use keyless ADC/WIF or a secret manager)" "$key_hits"
+fi
+
+# --- check 2: over-broad OAuth scopes -------------------------------------
+broad=""
+b="$( { grep -rnI "${EXCLUDE[@]}" "${SRC_INCLUDE[@]}" \
+  -E 'googleapis\.com/auth/drive([^.a-zA-Z]|$)' "${TARGETS[@]}" 2>/dev/null || true; } | drop_self)"
+[ -n "$b" ] && broad+="$b"$'\n'
+b="$( { grep -rnI "${EXCLUDE[@]}" "${SRC_INCLUDE[@]}" \
+  -E 'googleapis\.com/auth/gmail([^.a-zA-Z]|$)' "${TARGETS[@]}" 2>/dev/null || true; } | drop_self)"
+[ -n "$b" ] && broad+="$b"$'\n'
+b="$( { grep -rnI "${EXCLUDE[@]}" "${SRC_INCLUDE[@]}" \
+  -F 'mail.google.com/' "${TARGETS[@]}" 2>/dev/null || true; } | drop_self)"
+[ -n "$b" ] && broad+="$b"$'\n'
+if [ -n "${broad//[$'\n']/}" ]; then
+  emit "over-broad scope (prefer drive.file / drive.readonly / gmail.send / gmail.readonly)" "$broad"
+fi
+
+# --- check 3: hardcoded private key in source -----------------------------
+pk="$( { grep -rnI "${EXCLUDE[@]}" "${SRC_INCLUDE[@]}" \
+  -F -- '-----BEGIN PRIVATE KEY-----' "${TARGETS[@]}" 2>/dev/null || true; } | drop_self)"
+if [ -n "${pk//[$'\n']/}" ]; then
+  emit "hardcoded private key in source (inject from env/secret manager)" "$pk"
+fi
+
+# --- check 4: Workspace calls without a backoff helper (WARN only) ---------
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  if ! grep -qiE 'backoff|retry|rateLimit|sleep|setTimeout' "$f" 2>/dev/null; then
+    echo "WARN  $f: Workspace API call with no backoff/retry helper detected"
+  fi
+done < <(grep -rlI "${EXCLUDE[@]}" "${SRC_INCLUDE[@]}" \
+  -E 'google\.(gmail|drive|calendar|sheets)\(|build\("(gmail|drive|calendar|sheets)"' \
+  "${TARGETS[@]}" 2>/dev/null | drop_self)
+
+if [ "$fail" -eq 0 ]; then
+  echo "OK    no banned credential/scope patterns found"
+fi
+exit "$fail"

package/skills/grants/SKILL.md

@@ -0,0 +1,171 @@
+---
+name: grants
+description: "Use when the goal is non-dilutive public or foundation funding — money you neither repay nor give equity for — and you must find a fit call, decide go/no-go, register an eligible entity, or write the application a reviewer scores against a published rubric (needs statement, logic model, SMART objectives, impact narrative, budget justification, LOI). Symptoms: a call with an Excellence/Impact/Implementation grid, a 3/5-per-criterion threshold, an indirect-cost line, a SAM.gov/UEI or BDNS lookup, an LOI that filters you before the full proposal. Triggers: 'find grants we qualify for', 'write the impact section so it scores above threshold', 'should we even bother applying to this call', 'build the budget justification', 'write a Letter of Inquiry', 'buscar la convocatòria a la BDNS', 'redactar la solicitud de subvención'. NOT equity rounds or investor pitches (that is fundraising), NOT a paying-customer SOW (that is proposals)."
+tags: [grants, subsidies, fundraising-nondilutive, public-funding, grant-writing]
+recommends: [fundraising, proposals, financial-model, pitch-deck, bookkeeping, contracts]
+origin: risco
+---
+
+# Grants — Win Money You Neither Repay Nor Give Equity For
+
+*Find the fit call, kill the weak ones early, register before the clock runs out, and write each section to clear the threshold the reviewer scores it against.*
+
+You are a **reviewer-minded application writer**. Before you write a word, reconstruct the scoring grid the evaluator will use and write backwards from the threshold they must clear to fund you. The output is never "a nice document" — it is a needs statement, a logic model, SMART objectives, an impact narrative, and a costed budget that each survive their own line of the rubric. Above-threshold is the bar; everything below it scores zero no matter how good the prose.
+
+## When to use / When NOT to use
+
+Use when:
+
+- Building a fit shortlist of grants, public subsidies, or foundation calls an org qualifies for.
+- Deciding **go/no-go** on a specific call — eligibility, fit, effort vs. expected value, deadline vs. registration lead time.
+- Writing the application against a published evaluation rubric: needs, logic model, objectives, workplan, impact, budget justification.
+- Writing a **Letter of Inquiry / concept note** to a foundation.
+- Building the **logic model / theory of change / SMART objectives**, or the impact section.
+- Writing and justifying a **budget** so it survives allowability and indirect-cost rules.
+- Registering an eligible entity: US UEI via SAM.gov, EU PIC, finding the Spanish BDNS convocatoria.
+
+Do NOT use when — route instead:
+
+| The ask | Owner |
+|---|---|
+| Equity/VC round, cap table, term sheet, investor data room | `fundraising` |
+| The pitch deck / one-pager that sells the vision to a room | `pitch-deck` |
+| Company financial model, projections, runway, scenario P&L | `financial-model` |
+| Commercial B2B proposal / SOW that gets a *paying buyer* to sign | `proposals` |
+| The grant agreement's binding legal clauses (IP, liability, law) | `contracts` |
+| Post-award ledgers, fund accounting, spend tracking | `bookkeeping` |
+| Pricing, packaging, what to charge customers | `pricing` |
+
+The one-sentence boundary: `grants` owns the pursuit and writing of money scored by a **reviewer against a published rubric**; the moment it is **equity or a round** it is `fundraising`, and the moment the document persuades a **paying customer** it is `proposals`.
+
+## The non-dilutive landscape
+
+Three lanes, and the rules live in different documents in each. Read the rule-document **and** the deadline-document before you draft — eligibility lives in one, the clock in the other.
+
+| Lane | Where the rules live | Where the deadline lives |
+|---|---|---|
+| Government grant (EU/US) | The call text / solicitation / work programme | The same call's submission deadline |
+| Public subsidy (Spain) | The `bases reguladoras` (who/what/requirements) | The `convocatoria` (opens the window, fixes the year's pot) |
+| Foundation award | The funder's published priorities & guidelines | The LOI / full-proposal deadlines |
+
+**Calibrate effort to the odds.** Horizon Europe overall success runs ~12–16%, the most competitive calls under 10% (some ~2%), and roughly 7 of 10 *above-threshold* proposals still go unfunded for lack of budget. Foundation LOIs are a hard filter: ~20–40% are invited to a full proposal on average, some funders ~10%. Above-threshold is necessary and nowhere near sufficient — which is exactly why go/no-go and rubric-maxing earn their keep.
+
+## Go/no-go before you write
+
+Most wasted grant effort is spent on calls you were never eligible for. Run this gate first and kill weak fits in an hour, not a fortnight.
+
+| Signal | Decision |
+|---|---|
+| You miss any **eligibility hard-stop** (entity type, sector, geography, size, TRL) | **STOP.** No application survives an eligibility miss. |
+| Deadline is **before** your registration can complete (e.g. SAM.gov in 7–10 business days) | **STOP** for this round; start registering now for the next. |
+| Fit is real but **weak / unproven** | Lead with an **LOI** if the funder takes one; do not sink days into a full proposal yet. |
+| Effort (person-weeks) **>** expected value (award × win probability) | **Pass.** Spend the weeks on a better-fit call. |
+| Strong eligibility + strong fit + winnable budget | **Go.** Reconstruct the rubric and write. |
+
+## Register first, panic later
+
+The deadline you can hit is gated by a registration you cannot rush. Start these weeks ahead.
+
+- **US federal:** you need a **UEI** (Unique Entity ID), which requires an **active SAM.gov registration**, before you can submit on Grants.gov. SAM.gov takes **7–10 business days** (longer if data needs verification), **expires after 365 days**, and must be renewed annually — a lapse blocks payments even on active awards.
+- **EU (Horizon / Funding & Tenders):** the org needs a **PIC** (Participant Identification Code) on the Funding & Tenders portal before the coordinator can add you to a consortium.
+- **Spain:** find the **convocatoria** on the BDNS at `infosubvenciones.es`; confirm the `bases reguladoras` and check you hold any required certs (e.g. *estar al corriente* with tax/Social Security) before the window closes.
+
+Portals, vocabulary, and per-jurisdiction entry points → `references/jurisdictions.md`.
+
+## Write to the rubric
+
+This is the core move: **reconstruct the scoring grid first, then write each section to clear its own threshold — not just the total.**
+
+Horizon Europe is the worked example. Proposals are scored on three criteria, each **0–5 in half-point steps**:
+
+- **Excellence** — objectives, ambition, methodology, beyond state-of-the-art.
+- **Impact** — significance, pathways, exploitation/dissemination, measures.
+- **Quality & Efficiency of Implementation** — workplan, consortium, resources.
+
+Each criterion has a **3/5 threshold**, and the total must reach **10/15**. Fail any *single* threshold and the proposal is rejected automatically — a 14/15 with a 2.5 on one criterion scores zero. Two-stage calls: Stage 1 is ~10–15 pages with a **4/5-per-criterion** threshold.
+
+So: write each section against the criterion it feeds, name the sub-bullets the evaluator will tick, and clear the lowest threshold before you polish the highest. A strong proposal that fails one threshold loses to a balanced one.
+
+## Needs statement & the red thread
+
+Open with an **evidence-backed problem**, not an assertion. Then run a **theory of change as one "red thread"** through needs → design → evaluation: the same causal claim should be visible in the problem, the workplan, and how you measure success.
+
+```text
+Bad:  "There is a large and growing need for digital skills training in the region."
+Good: "In [region], 38% of SMEs report unfilled digital roles (Eurostat 2025);
+       existing programs reach <500/yr against a gap of ~9,000 — a coverage
+       ratio under 6% [cite]. We close it by [mechanism], measured by [outcome]."
+```
+
+The reviewer scores the *logic*, not the urgency adjectives.
+
+## Logic model & SMART objectives
+
+Funders expect the **INPUTS → ACTIVITIES → OUTPUTS → OUTCOMES** causal chain (W.K. Kellogg framework), with outcomes split short/medium/long-term. The classic, fatal error is selling **outputs as outcomes**.
+
+```text
+Output  (what you did):       held 100 workshops; trained 200 people.
+Outcome (what changed):       at 6 months, 200 participants sustain [behaviour],
+                              raising [indicator] by X% vs. a matched baseline.
+```
+
+Objectives must be **SMART** — Specific, Measurable, Achievable, Relevant, Time-bound:
+
+```text
+Bad:  "Improve employability of participants."
+Good: "By month 12, 70% of the 200 enrolled participants (≥140) secure a
+       digital-sector role or progression, verified by follow-up survey."
+```
+
+Template, theory-of-change worked example, and 4–5 output-vs-outcome contrasts → `references/logic-model.md`.
+
+## Impact narrative
+
+Impact is **significance + a credible pathway**, with quantified KPIs and an exploitation/dissemination plan — not a list of papers you might publish.
+
+```text
+Bad:  "The project will have a significant impact and produce publications."
+Good: "Reaching 9,000 SMEs by year 3 lifts regional digital-role fill rates from
+       62%→80% (KPI). Exploitation: open toolkit (CC-BY) + 3 SME pilots;
+       dissemination: 2 sector bodies commit to roll-out [LoS attached]."
+```
+
+## Budget & justification
+
+Every line ties to an activity in the workplan; a reviewer who cannot map a euro to a task cuts it.
+
+- **Allowability:** each cost must be **necessary, reasonable, allocable, and consistently treated**. You cannot charge a cost direct if a like cost is recovered as indirect.
+- **Indirect:** an entity **without a negotiated rate** may charge a **de minimis up to 15% of modified total direct costs (MTDC)** under the Oct 2024 OMB Uniform Guidance (2 CFR 200.414) — raised from the prior 10%. Declare a negotiated rate if you have one; otherwise stay at or under 15%.
+- **Matching / co-funding:** if the call requires it, show the source and that it is eligible (cash or in-kind), not a placeholder.
+
+Allowable/unallowable checklist, direct-vs-indirect, the 15% MTDC worked calc, and line-item→justification mapping → `references/budget-justification.md`.
+
+## The LOI / concept note
+
+When a funder takes a **Letter of Inquiry**, it is the early filter (~20–40% invited onward). In **1–3 pages**, lead with **funder-fit** — prove your mission aligns with their stated priorities — then organizational credibility, then measurable impact. Win the fit argument here or you never reach the full proposal. Do not bury the alignment under your origin story.
+
+## Page-limit discipline & submission
+
+Hard caps are real and enforced: Horizon Europe Part B is **40 pages** for standard RIA/IA (**45** with lump-sum funding), **25** for a CSA. **Content beyond the limit is disregarded** by evaluators — over-the-limit padding is wasted. Prioritize ruthlessly: cut the lowest-scoring paragraph before you exceed the cap. Submit **hours, not minutes**, before close; portals slow and reject at the deadline crush.
+
+## Anti-patterns
+
+| Anti-pattern | Why it loses | Do instead |
+|---|---|---|
+| Outputs sold as outcomes ("100 workshops held") | Reviewers score change, not activity | State the behaviour/indicator that shifts, with a baseline |
+| Copy-paste proposal ignoring this funder's rubric | Sections don't map to the criteria being scored | Reconstruct the grid; write each section to its threshold |
+| Starting registration the week of the deadline | SAM.gov needs 7–10 business days; you miss the round | Register weeks ahead; renew annually |
+| Budget that doesn't map to the workplan | A euro with no task gets cut | Tie every line to a named activity |
+| Over-the-page-limit padding | Content beyond the cap is disregarded | Cut the weakest paragraph before exceeding the limit |
+| Applying while ineligible | An eligibility miss is an automatic reject | Run the go/no-go hard-stops first |
+| Treating above-threshold as funded | ~7/10 above-threshold EU proposals go unfunded | Maximize score; pursue several fit calls |
+| Generic LOI with no fit argument | LOIs filter on alignment first | Lead with funder-fit, then credibility, then impact |
+| Indirect line guessed or padded | Breaches the 15% de minimis with no negotiated rate | Use ≤15% MTDC, or declare your negotiated rate |
+
+## Jurisdiction quick-reference
+
+EU (Funding & Tenders portal, PIC, Horizon evaluation criteria, page limits), US (Grants.gov, SAM.gov/UEI, 2 CFR 200 de minimis), and Spain (BDNS / infosubvenciones, `bases reguladoras` vs `convocatoria`, vocabulary) entry points and authoritative portals → `references/jurisdictions.md`.
+
+## Optional self-check
+
+`scripts/verify.sh path/to/application.md --criteria "Excellence,Impact,Implementation"` is a read-only structural guardrail (not a grader): it flags output verbs leaking into an outcomes block, objectives missing a measurable target or date, an indirect line over 15% MTDC with no negotiated rate declared, and any named rubric criterion with no matching heading. It exits 0 on a clean or empty file. The real rigor is the capability eval, not the linter.

package/skills/grants/evals/README.md

@@ -0,0 +1,3 @@
+# Evals for `grants`
+
+These are judgment evals, not automated assertions. To run them, read `cases.yaml` and eyeball each prompt against the skill's `description`: every entry under `should_trigger` should plausibly load `grants` (the find-fit, go/no-go, registration, and rubric-keyed writing jobs — including the non-obvious "should we even apply" and the Catalan BDNS phrasing), while every `should_not_trigger` entry should route to the named sibling instead (equity → `fundraising`, paying-buyer SOW → `proposals`, company model → `financial-model`, post-award ledger → `bookkeeping`, investor slides → `pitch-deck`) — those are the near-misses that share the word "money" or "proposal" but belong elsewhere. For the `capability` case, run the scenario by hand and check the produced application against the `must_include` rubric (go/no-go before drafting, every evaluation criterion addressed to its own threshold, outcomes distinct from outputs, SMART objectives with target+date, budget lines mapped to activities, indirect ≤15% MTDC, page limit respected). The optional `scripts/verify.sh` is a structural guardrail you can run over a drafted application file, but it is a linter, not the grader — the rubric above is.

package/skills/grants/evals/cases.yaml

@@ -0,0 +1,69 @@
+skill: grants
+
+# Prompts that MUST load `grants`. The skill owns the pursuit and writing of
+# non-dilutive public/foundation funding scored by a reviewer against a
+# published rubric: find-fit, go/no-go, registration, and the application
+# (needs, logic model, SMART objectives, impact, budget justification, LOI).
+should_trigger:
+  - prompt: "Find public grants and subsidies my nonprofit qualifies for."
+    why: "Building a funder-fit shortlist of grants/subsidies an org is eligible for is the skill's core find-fit job."
+
+  - prompt: "Write the impact section for this Horizon Europe proposal so it scores above threshold."
+    why: "Non-obvious: the user expects rubric-keyed writing that clears the 3/5 Impact threshold — the skill thinks in the evaluator's scoring grid, not generic prose."
+
+  - prompt: "Should we even bother applying to this call, or is it a two-week waste?"
+    why: "Non-obvious go/no-go: eligibility hard-stops, fit, and effort-vs-expected-value before any drafting — the gate that prevents wasted grant effort."
+
+  - prompt: "Build the budget and budget justification for this federal grant, including the indirect line."
+    why: "Budget with allowability (necessary/reasonable/allocable/consistent) and the 15% de minimis MTDC indirect rate is owned here, not by financial-model."
+
+  - prompt: "Necessito buscar la convocatòria a la BDNS i redactar la sol·licitud de la subvenció."
+    why: "Catalan: find the convocatoria on the BDNS and write the subsidy application — the Spain non-dilutive lane (bases reguladoras + convocatoria) plus the write."
+
+  - prompt: "Write a Letter of Inquiry to this foundation to get invited to the full proposal."
+    why: "The 1-3 page LOI fit filter (~20-40% invited onward) is an explicit owned artifact; lead with funder-fit."
+
+  - prompt: "Build the logic model and SMART objectives for our youth-employment grant application."
+    why: "INPUTS->ACTIVITIES->OUTPUTS->OUTCOMES chain and SMART objectives with measurable targets/dates are core owned deliverables, even without the word 'grant rubric'."
+
+# NEAR-MISS prompts that must NOT load `grants`. Each routes to the genuinely
+# correct sibling. The recurring trap: anything about money that is actually
+# equity (fundraising), a paying buyer (proposals), the company model
+# (financial-model), or post-award accounting (bookkeeping).
+should_not_trigger:
+  - prompt: "Write our seed round pitch and prep the investor data room."
+    route_to: "fundraising"
+    why: "Equity round, cap table, and investor data room are dilutive funding — grants owns only money you neither repay nor give equity for."
+
+  - prompt: "Draft the SOW and proposal to close this paying enterprise client."
+    route_to: "proposals"
+    why: "A commercial SOW persuades a paying buyer to sign, not a grant reviewer scoring a rubric."
+
+  - prompt: "Build our 3-year financial projection model with runway and scenario P&L."
+    route_to: "financial-model"
+    why: "Company projections and runway are the financial model, not an application keyed to an evaluation rubric."
+
+  - prompt: "Set up the books to track how we spent the grant after the award landed."
+    route_to: "bookkeeping"
+    why: "Post-award ledgers and spend tracking (justificación) are recordkeeping after the money lands, explicitly out of scope for grants."
+
+  - prompt: "Make the slides that pitch our vision to a room of investors."
+    route_to: "pitch-deck"
+    why: "The investor pitch deck sells a vision to a room; grants writes the rubric-scored application, not the slides."
+
+capability:
+  - scenario: >
+      Given a fictional call with a published Excellence/Impact/Implementation
+      rubric (each 0-5, 3/5 threshold, 10/15 total), a 40-page Part B limit, and
+      a small nonprofit org profile, do a go/no-go on eligibility and fit, then
+      write the impact section, a logic model, and a 12-month justified budget
+      with a de minimis indirect line.
+    must_include:
+      - "An explicit go/no-go decision citing the eligibility hard-stops and registration lead time, before any drafting."
+      - "Each rubric criterion (Excellence, Impact, Implementation) addressed by a section written to clear its own 3/5 threshold, not just the 10/15 total."
+      - "Outcomes stated as changed states with baselines/timeframes, distinct from outputs (no 'held N workshops' sold as an outcome)."
+      - "SMART objectives, each with a numeric target AND a date/timeframe."
+      - "A logic model with the INPUTS->ACTIVITIES->OUTPUTS->OUTCOMES chain."
+      - "Budget lines each mapped to a named workplan activity."
+      - "An indirect line at or below 15% of MTDC (computed on the MTDC base), or a stated negotiated rate."
+      - "Respects the stated 40-page limit and notes that content beyond it is disregarded."

package/skills/grants/references/budget-justification.md

@@ -0,0 +1,71 @@
+# Budget & justification
+
+The budget is scored as part of implementation/feasibility. A reviewer who cannot map a euro to an activity cuts it. This file is the depth behind the SKILL.md "Budget & justification" section.
+
+## Allowability — the four tests
+
+Every cost charged to a federal award (and most public grants by analogy) must pass all four:
+
+1. **Necessary** — needed to carry out the funded work; not nice-to-have.
+2. **Reasonable** — a prudent person would pay this; defensible price.
+3. **Allocable** — the award actually benefits from it, in proportion to what you charge.
+4. **Consistently treated** — you don't charge a cost type as direct here and as indirect elsewhere.
+
+**The consistency trap:** you cannot charge a cost **direct** if a *like* cost is recovered as **indirect**. If office supplies sit in your indirect pool, you can't also line-item office supplies as a direct cost on this award.
+
+## Direct vs. indirect
+
+- **Direct costs** are identifiable to the specific project: project staff salaries + fringe, project travel, equipment, materials, subcontracts, participant costs.
+- **Indirect (F&A) costs** support operations broadly and can't be traced to one project: general admin, HR, facilities, accounting, utilities.
+
+## The 15% de minimis (2 CFR 200.414)
+
+Under the **Oct 2024 OMB Uniform Guidance** revision, an entity **without a negotiated indirect rate** may charge a **de minimis rate of up to 15% of modified total direct costs (MTDC)** — raised from the prior 10%. If you hold a negotiated rate, you use that and **declare it**; otherwise the de minimis is your ceiling.
+
+**MTDC base** = total direct costs, **minus** these exclusions:
+- Equipment and capital expenditures.
+- The portion of **each subaward over $50,000** (you may apply indirect to the first $50k of each subaward only).
+- Participant support costs, rent, scholarships/fellowships.
+
+### Worked calculation
+
+```text
+Direct costs
+  Personnel (salary + fringe)        180,000
+  Travel                               12,000
+  Materials & supplies                 18,000
+  Equipment (EXCLUDED from MTDC)       40,000
+  Subaward A (first $50k counts)       80,000   -> 50,000 in base, 30,000 out
+  Participant support (EXCLUDED)       25,000
+  -----------------------------------------------
+  Total direct costs                  355,000
+
+MTDC base = 180,000 + 12,000 + 18,000 + 50,000              = 260,000
+            (equipment 40k, subaward overage 30k, participant 25k all excluded)
+
+Indirect @ 15% de minimis = 0.15 × 260,000                  = 39,000
+Total budget = 355,000 + 39,000                             = 394,000
+```
+
+Compute indirect on the **MTDC base, never on total direct costs**. Charging 15% of the full $355k (= $53,250) overstates indirect by $14,250 and is a common rejection cause.
+
+## Matching / co-funding
+
+If the call requires a match (cost-share), show:
+- The **source** (named, committed — not "to be confirmed").
+- Whether it is **cash or in-kind**, and that the in-kind valuation is documented (e.g. donated staff time at a defensible rate).
+- That the matched cost is **itself allowable** — you can't match with an unallowable cost.
+
+## Line-item → justification mapping
+
+Every line gets one sentence tying it to a workplan activity. The justification, not the number, is what survives review.
+
+| Line item | Amount | Justification (ties to activity) |
+|---|---|---|
+| Project Lead 0.5 FTE | 45,000 | Runs WP1–WP3; 50% allocation matches 50% of effort on this award |
+| Trainer 1.0 FTE | 55,000 | Delivers the 10 cohorts in Activity 2; sole training resource |
+| Travel | 12,000 | 3 SME pilot sites × 4 visits (Activity 3) at documented per-diem |
+| Materials | 18,000 | Curriculum print + LMS licences for 200 trainees (Activity 2) |
+| Indirect @ 15% MTDC | 39,000 | De minimis; no negotiated rate; computed on MTDC base above |
+
+If a line has no activity to point at, it is padding — cut it before a reviewer does.

package/skills/grants/references/jurisdictions.md

@@ -0,0 +1,35 @@
+# Jurisdiction quick-reference
+
+Entry points, portals, and vocabulary for the three lanes the SKILL.md "non-dilutive landscape" names. Always confirm rules in the live call text — these are starting points, accurate as of 2026-06-02.
+
+## EU — Horizon Europe & the Funding & Tenders portal
+
+- **Portal:** EU Funding & Tenders portal (`ec.europa.eu/info/funding-tenders`). Find calls, register your org, submit.
+- **PIC** (Participant Identification Code): the org's ID on the portal; needed before a coordinator can add you to a consortium. Register the legal entity once; reuse the PIC across calls.
+- **Evaluation criteria:** three, each scored **0–5 in half-point steps**:
+  - **Excellence** — objectives, ambition, methodology, beyond state-of-the-art.
+  - **Impact** — significance, pathways to impact, exploitation & dissemination, measures.
+  - **Quality & Efficiency of Implementation** — workplan, consortium, resources, risk.
+  - **Thresholds:** 3/5 per criterion, **10/15 total**; failing any one threshold = automatic rejection. Two-stage calls: Stage 1 ~10–15 pages with a **4/5-per-criterion** threshold.
+- **Page limits (Part B, 2026–2027):** **40** pages standard RIA/IA (**45** with lump-sum funding), **25** for CSA. Content beyond the cap is **disregarded**.
+- **Vocabulary:** RIA (Research & Innovation Action), IA (Innovation Action), CSA (Coordination & Support Action), TRL (Technology Readiness Level), work programme, topic, consortium, coordinator, deliverable, work package (WP).
+
+## US — Grants.gov, SAM.gov & 2 CFR 200
+
+- **Find & apply:** `Grants.gov` lists federal opportunities and is where you submit.
+- **Registration chain:** you need a **UEI** (Unique Entity ID) → which requires an **active SAM.gov** registration → before you can submit on Grants.gov. SAM.gov takes **7–10 business days** (longer if data is verified), **expires after 365 days**, renews annually; a lapse **blocks payments** even on active awards. Start weeks ahead.
+- **Uniform Guidance (2 CFR Part 200):** the federal cost rules. Key for budgeting:
+  - **§200.414 de minimis indirect rate: up to 15% of MTDC** for entities without a negotiated rate (raised from 10% in the Oct 2024 OMB revision).
+  - Costs must be **necessary, reasonable, allocable, consistently treated**.
+  - MTDC excludes equipment, the portion of each subaward over $50k, and participant support costs.
+- **Vocabulary:** NOFO/FOA (Notice of Funding Opportunity / Funding Opportunity Announcement), SF-424, period of performance, cost-share/match, F&A (facilities & administrative = indirect), recipient, subrecipient.
+
+## Spain — BDNS / infosubvenciones
+
+- **Find:** the **Base de Datos Nacional de Subvenciones (BDNS)** at `infosubvenciones.es` — the official register of public subsidies under the **Ley General de Subvenciones**. In 2025 it carried 30,000+ calls, aggregate budget over €50bn.
+- **Two documents, always read both:**
+  - **`bases reguladoras`** — the standing rules: who can apply, what's funded, requirements, scoring criteria. **Eligibility lives here.**
+  - **`convocatoria`** — opens a specific window and fixes that year's budget pot and deadline. **The clock lives here.**
+- **Common prerequisites:** be *al corriente* (up to date) with tax (AEAT) and Social Security (TGSS) obligations; hold a digital certificate / Cl@ve for electronic submission; not be subject to a *prohibición para obtener subvenciones*.
+- **Vocabulary:** subvención, ayuda pública, beneficiario, memoria técnica, justificación (post-award reporting — out of scope here, that's `bookkeeping`), concurrencia competitiva (competitive scoring) vs. concesión directa, plazo de presentación.
+- **Catalan equivalents:** subvenció, ajut públic, convocatòria, bases reguladores, memòria tècnica, beneficiari, termini de presentació.

package/skills/grants/references/logic-model.md

@@ -0,0 +1,66 @@
+# Logic model, theory of change & SMART objectives
+
+The reviewer scores the **causal logic**, not the activity list. This file is the depth behind the SKILL.md "Logic model & SMART objectives" section.
+
+## The logic-model chain
+
+The W.K. Kellogg framework: **INPUTS → ACTIVITIES → OUTPUTS → OUTCOMES** (outcomes split short / medium / long-term). Inputs and activities are what you control; outputs are what you produce; outcomes are what *changes in the world* as a result.
+
+| Column | Question it answers | Example |
+|---|---|---|
+| Inputs | What we invest | €450k, 4 FTE, 3 partner SMEs, training curriculum |
+| Activities | What we do | Run 10 cohorts of a 12-week digital upskilling program |
+| Outputs | What we produce (countable) | 200 people trained; 1 open curriculum published |
+| Outcomes (short) | What changes at 0–6 months | 70% of trainees apply ≥1 new skill on the job |
+| Outcomes (medium) | What changes at 6–18 months | 140 secure a digital-sector role or progression |
+| Outcomes (long) | The ultimate change | Regional digital-role fill rate 62% → 80% |
+
+Fill it left-to-right, then **read it right-to-left** to test the logic: does each outcome plausibly follow from the output before it? If a link requires a leap of faith, name the assumption or fix the design.
+
+## Theory of change — the "red thread"
+
+A theory of change is the **same causal claim made visible in every section**. The problem you state, the activities you fund, and the way you measure success should all be the same story:
+
+```text
+Needs:      SMEs can't fill digital roles (38% report unfilled roles, Eurostat 2025).
+Mechanism:  Because the local pipeline lacks job-ready, certified candidates.
+Design:     So we run cohort-based, employer-co-designed upskilling to certification.
+Evaluation: Therefore we measure job-readiness, placements, and regional fill rate —
+            the exact indicators implied by the mechanism.
+```
+
+If the evaluation measures something the mechanism never claimed (e.g. "satisfaction" when the theory was about placements), the thread is broken and the reviewer sees it.
+
+## Output vs. outcome — five contrasts
+
+The single most common scoring failure. Outputs use verbs of *doing*; outcomes describe a *changed state* with a baseline and a timeframe.
+
+| Output (what you did) | Outcome (what changed) |
+|---|---|
+| Held 100 workshops | At 6 months, 200 participants sustain [behaviour] vs. baseline |
+| Trained 200 people | 140 of 200 secure a digital-sector role by month 12 |
+| Published a toolkit | 3 partner orgs adopt the toolkit in their own programs by month 18 |
+| Conducted 50 outreach visits | SME enrolment rises from 12 → 45 per quarter |
+| Produced 4 reports | 2 sector bodies cite the findings in revised guidance |
+
+Rule of thumb: if you can count it the day the activity ends, it is an output. If it requires the world to have changed, it is an outcome.
+
+## SMART objectives — Bad → Good
+
+Specific, Measurable, Achievable, Relevant, Time-bound. Every objective needs a **numeric target** and a **date/timeframe**.
+
+```text
+Bad:  "Improve employability of participants."
+Good: "By month 12, ≥140 of 200 enrolled participants (70%) secure a digital-sector
+       role or progression, verified by a follow-up survey."
+
+Bad:  "Increase awareness of the program among regional SMEs."
+Good: "By month 9, raise quarterly SME enrolment from 12 to ≥45 (3.75×),
+       tracked via the enrolment CRM."
+
+Bad:  "Disseminate results widely."
+Good: "By month 24, secure documented adoption commitments from ≥2 sector bodies
+       (letters of support attached) covering ≥9,000 SMEs."
+```
+
+If an objective has no number or no date, it is not yet SMART — push back before drafting the budget around it.