rsc-universal 0.1.1

package/skills/competitor-watch/scripts/verify.sh

@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+#
+# verify.sh — competitor-tracker / change-log / monitoring-config linter for the
+# `competitor-watch` skill.
+#
+# WHAT IT DOES (read-only; never edits a file)
+#   Lints the structured artifacts this skill emits against the rules in SKILL.md.
+#   It keys off filenames and CSV headers, so any unrelated file is simply skipped
+#   and an empty/clean target never false-fails.
+#
+#   Checks:
+#     1. CHANGE LOG — any CSV whose header contains both `axis` and `materiality`
+#        (e.g. change-log.csv). Per data row:
+#          - `axis`        must be one of pricing|feature|positioning|messaging|team|other  (FAIL)
+#          - `materiality` must be one of high|medium|low                                   (FAIL)
+#          - `url`  must be non-empty                                                       (FAIL)
+#          - `date` must be non-empty                                                       (FAIL)
+#     2. FEATURE MATRIX — any CSV with paired `<x>_value` + `<x>_source_url` +
+#        `<x>_date` columns. A non-empty value with an empty source_url OR empty
+#        date is an invented fact                                                            (FAIL)
+#     3. MONITORING CONFIG — cadence sanity (WARN, never fail). In any *.md/*.yaml/
+#        *.yml/*.txt file, a line that names an axis and a cadence where:
+#          - a slow axis (positioning|careers|team|reviews|social) is paired with a
+#            sub-15-minute cadence  -> noise/cost                                            (WARN)
+#          - the pricing axis is paired with a slower-than-daily cadence (weekly/
+#            monthly)                -> a missed move                                        (WARN)
+#
+# HOW TO RUN (inside YOUR project, not the skills repo)
+#   ./verify.sh                 # scan ./ for tracker / change-log / config files
+#   ./verify.sh --path 02-DOCS  # scan a subdirectory
+#   ./verify.sh --strict        # treat any warning as a failure (exit 1)
+#
+# EXIT CODES
+#   0  clean, or warnings only without --strict (also: nothing to check)
+#   1  a structural violation (bad axis/materiality, missing url/date, unsourced
+#      value), or --strict with a warning
+#   2  bad usage
+#
+# Runs on stock macOS bash 3.2 — no mapfile, no associative arrays.
+
+set -euo pipefail
+
+if [ -t 1 ]; then
+  RED=$'\033[31m'; GREEN=$'\033[32m'; YELLOW=$'\033[33m'; NC=$'\033[0m'
+else
+  RED=''; GREEN=''; YELLOW=''; NC=''
+fi
+
+ok_count=0; skip_count=0; warn_count=0; fail_count=0
+ok()   { printf '%s[ ok ]%s %s\n' "$GREEN"  "$NC" "$*"; ok_count=$((ok_count + 1)); }
+skip() { printf '%s[skip]%s %s\n' "$YELLOW" "$NC" "$*"; skip_count=$((skip_count + 1)); }
+warn() { printf '%s[warn]%s %s\n' "$YELLOW" "$NC" "$*"; warn_count=$((warn_count + 1)); }
+fail() { printf '%s[fail]%s %s\n' "$RED"    "$NC" "$*"; fail_count=$((fail_count + 1)); }
+
+usage() { sed -n '2,46p' "$0" | sed 's/^# \{0,1\}//'; }
+
+SCAN_PATH="."
+STRICT=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --path)    SCAN_PATH="${2:?--path needs a value}"; shift 2 ;;
+    --strict)  STRICT=1; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) printf '%sUnknown argument: %s%s\n\n' "$RED" "$1" "$NC"; usage; exit 2 ;;
+  esac
+done
+
+if [ ! -e "$SCAN_PATH" ]; then
+  printf '%sPath not found: %s%s\n' "$RED" "$SCAN_PATH" "$NC"; exit 2
+fi
+
+TMPDIR_V="$(mktemp -d 2>/dev/null || printf '/tmp/cw-verify.%s' "$$")"
+mkdir -p "$TMPDIR_V" 2>/dev/null || true
+cleanup() { rm -rf "$TMPDIR_V" 2>/dev/null || true; }
+trap cleanup EXIT
+
+CSV_FILES="$TMPDIR_V/csv"
+CFG_FILES="$TMPDIR_V/cfg"
+find "$SCAN_PATH" -type f -name '*.csv' 2>/dev/null > "$CSV_FILES" || true
+find "$SCAN_PATH" -type f \
+  \( -name '*.md' -o -name '*.yaml' -o -name '*.yml' -o -name '*.txt' \) \
+  2>/dev/null > "$CFG_FILES" || true
+
+# Allowed sets (whitespace-padded for safe substring match).
+AXES=" pricing feature positioning messaging team other "
+MATS=" high medium low "
+
+# Find the 0-based index of a column name in a comma-separated header line.
+# Echoes -1 if absent.
+col_index() {
+  header="$1"; want="$2"
+  idx=-1; i=0
+  oldifs="$IFS"; IFS=','
+  for c in $header; do
+    # trim spaces and a trailing CR
+    c="$(printf '%s' "$c" | tr -d '\r' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+    if [ "$c" = "$want" ]; then idx=$i; fi
+    i=$((i + 1))
+  done
+  IFS="$oldifs"
+  printf '%s' "$idx"
+}
+
+# Echo the Nth (0-based) field of a CSV row. Simple split on comma — values in this
+# schema do not contain commas; quoted commas would need a real parser, which is out
+# of scope for a lint (we only read low-structure tracker cells).
+field_at() {
+  row="$1"; n="$2"
+  i=0
+  oldifs="$IFS"; IFS=','
+  for c in $row; do
+    if [ "$i" -eq "$n" ]; then
+      printf '%s' "$c" | tr -d '\r' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//'
+      IFS="$oldifs"; return 0
+    fi
+    i=$((i + 1))
+  done
+  IFS="$oldifs"
+  printf ''
+}
+
+# ---------------------------------------------------------------------------
+# 1 + 2. CSV checks
+# ---------------------------------------------------------------------------
+csv_change_log_seen=0
+csv_matrix_seen=0
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  header="$(head -n 1 "$f" 2>/dev/null | tr -d '\r')"
+  [ -z "$header" ] && continue
+
+  # --- change log: header has both axis and materiality ---
+  ai="$(col_index "$header" axis)"
+  mi="$(col_index "$header" materiality)"
+  ui="$(col_index "$header" url)"
+  di="$(col_index "$header" date)"
+  if [ "$ai" -ge 0 ] && [ "$mi" -ge 0 ]; then
+    csv_change_log_seen=1
+    rownum=0; bad=0
+    while IFS= read -r row; do
+      rownum=$((rownum + 1))
+      [ "$rownum" -le 1 ] && continue   # skip header
+      # skip blank lines
+      [ -z "$(printf '%s' "$row" | tr -d ', \r')" ] && continue
+
+      axv="$(field_at "$row" "$ai")"
+      mav="$(field_at "$row" "$mi")"
+      case "$AXES" in *" $axv "*) : ;; *) fail "$f row $rownum: axis '$axv' not in {pricing,feature,positioning,messaging,team,other}"; bad=1 ;; esac
+      case "$MATS" in *" $mav "*) : ;; *) fail "$f row $rownum: materiality '$mav' not in {high,medium,low}"; bad=1 ;; esac
+      if [ "$ui" -ge 0 ]; then
+        urv="$(field_at "$row" "$ui")"
+        [ -z "$urv" ] && { fail "$f row $rownum: empty url"; bad=1; }
+      fi
+      if [ "$di" -ge 0 ]; then
+        dtv="$(field_at "$row" "$di")"
+        [ -z "$dtv" ] && { fail "$f row $rownum: empty date"; bad=1; }
+      fi
+    done < "$f"
+    [ "$bad" -eq 0 ] && ok "change log clean: $f"
+  fi
+
+  # --- feature matrix: any <x>_value with a PAIRED <x>_source_url column ---
+  # discover candidate prefixes that have a *_value column, then keep only those
+  # that also declare a *_source_url column (so change-log old_value/new_value,
+  # which have no paired source column, are not mistaken for matrix cells).
+  cand="$(printf '%s' "$header" | tr ',' '\n' | sed 's/\r//' | sed -n 's/^[[:space:]]*\([A-Za-z0-9_]*\)_value[[:space:]]*$/\1/p')"
+  prefixes=""
+  for pre in $cand; do
+    if [ "$(col_index "$header" "${pre}_source_url")" -ge 0 ]; then
+      prefixes="$prefixes $pre"
+    fi
+  done
+  if [ -n "$(printf '%s' "$prefixes" | tr -d ' ')" ]; then
+    csv_matrix_seen=1
+    bad=0
+    for pre in $prefixes; do
+      vi="$(col_index "$header" "${pre}_value")"
+      si="$(col_index "$header" "${pre}_source_url")"
+      pi="$(col_index "$header" "${pre}_date")"
+      rownum=0
+      while IFS= read -r row; do
+        rownum=$((rownum + 1))
+        [ "$rownum" -le 1 ] && continue   # skip header
+        [ -z "$(printf '%s' "$row" | tr -d ', \r')" ] && continue
+        val="$(field_at "$row" "$vi")"
+        [ -z "$val" ] && continue   # blank value is honest; nothing to source
+        src=""; dat=""
+        [ "$si" -ge 0 ] && src="$(field_at "$row" "$si")"
+        [ "$pi" -ge 0 ] && dat="$(field_at "$row" "$pi")"
+        if [ -z "$src" ] || [ -z "$dat" ]; then
+          fail "$f row $rownum: '${pre}' value '$val' has no source_url+date (invented fact)"
+          bad=1
+        fi
+      done < "$f"
+    done
+    [ "$bad" -eq 0 ] && ok "feature-matrix cells all sourced+dated: $f"
+  fi
+done < "$CSV_FILES"
+
+[ "$csv_change_log_seen" -eq 0 ] && skip "no change-log CSV (header with axis+materiality) found"
+[ "$csv_matrix_seen" -eq 0 ] && skip "no feature-matrix CSV (<x>_value/_source_url/_date) found"
+
+# ---------------------------------------------------------------------------
+# 3. Monitoring-config cadence sanity (WARN only)
+# ---------------------------------------------------------------------------
+SLOW_AXES="positioning careers team reviews review social"
+cfg_seen=0
+while IFS= read -r f; do
+  [ -z "$f" ] && continue
+  # only consider files that look like config (mention a cadence keyword)
+  grep -iqE 'cadence|every|min|hour|daily|weekly|monthly' "$f" 2>/dev/null || continue
+  while IFS= read -r ln; do
+    low="$(printf '%s' "$ln" | tr 'A-Z' 'a-z')"
+    case "$low" in *axis*|*cadence*|*pricing*|*positioning*|*careers*) : ;; *) continue ;; esac
+
+    # sub-15-minute cadence present on the line?
+    sub15=0
+    # patterns like 5m, 10 min, 00:10:00, "5 minutes", "every 10 min"
+    if printf '%s' "$low" | grep -Eq '(^|[^0-9])(0?[0-9]|1[0-4])[[:space:]]*m(in)?([^a-z]|$)'; then sub15=1; fi
+    if printf '%s' "$low" | grep -Eq '00:0[0-9]:00|00:1[0-4]:00'; then sub15=1; fi
+    if printf '%s' "$low" | grep -Eq '(0?[0-9]|1[0-4])[[:space:]]*minute'; then sub15=1; fi
+
+    slower_than_daily=0
+    if printf '%s' "$low" | grep -Eq 'weekly|monthly|[0-9]+[[:space:]]*(day|days)'; then
+      # >1 day or weekly/monthly
+      if printf '%s' "$low" | grep -Eq 'weekly|monthly|([2-9]|[1-9][0-9]+)[[:space:]]*day'; then slower_than_daily=1; fi
+    fi
+
+    # pricing axis with a slower-than-daily cadence -> missed move
+    if printf '%s' "$low" | grep -q 'pricing' && [ "$slower_than_daily" -eq 1 ]; then
+      cfg_seen=1
+      warn "$f: pricing axis on a slower-than-daily cadence — risks a missed move :: $ln"
+    fi
+
+    # slow axis with a sub-15-min cadence -> noise/cost
+    if [ "$sub15" -eq 1 ]; then
+      for sa in $SLOW_AXES; do
+        if printf '%s' "$low" | grep -q "$sa"; then
+          cfg_seen=1
+          warn "$f: '$sa' axis on a sub-15-min cadence — noise and cost :: $ln"
+          break
+        fi
+      done
+    fi
+  done < "$f"
+done < "$CFG_FILES"
+[ "$cfg_seen" -eq 0 ] && skip "no monitoring-config cadence mismatches found"
+
+printf '\nok=%d skip=%d warn=%d fail=%d\n' "$ok_count" "$skip_count" "$warn_count" "$fail_count"
+
+if [ "$fail_count" -gt 0 ]; then exit 1; fi
+if [ "$STRICT" -eq 1 ] && [ "$warn_count" -gt 0 ]; then exit 1; fi
+exit 0

package/skills/compliance/SKILL.md

@@ -0,0 +1,184 @@
+---
+name: compliance
+description: "Use when a business needs to know which regulatory frameworks actually bind it and how to keep the program true between audits — scoping SOC 2 / ISO 27001 / HIPAA / PCI DSS / EU AI Act / DORA / NIS2, building a control register with owners and evidence, or standing up a recurring compliance cadence. Triggers: 'what compliance do we need for a fintech', 'build a SOC 2 readiness checklist', 'map our controls — who owns what', 'we have an audit in 90 days, set up the prep rhythm', 'does the EU AI Act apply to us and what's the deadline', 'set up a continuous-compliance calendar so we stop scrambling', '¿qué compliance necesitamos para una app de salud con datos médicos?', 'muntar el checklist de SOC 2'. NOT drafting the privacy policy, ROPA, or DPA text (that is gdpr-privacy), NOT writing Terms of Service (that is terms-conditions), NOT hardening the code itself (that is secure-coding)."
+tags: [compliance, soc2, iso27001, audit-readiness, controls, governance]
+recommends: [gdpr-privacy, terms-conditions, data-policy, contracts, secure-coding]
+origin: risco
+---
+
+# Compliance — scope the frameworks, build the register, run the rhythm
+
+You turn a vague "we need to be compliant" into two artifacts that survive an
+audit:
+
+1. **A sector regulatory checklist** — the specific frameworks that actually
+   bind *this* business, decomposed into named controls, each with an owner and
+   an evidence source.
+2. **A compliance operating rhythm** — the recurring calendar (control reviews,
+   evidence refresh, access recerts, vendor reassessments, audit prep) that
+   keeps the program true between audits instead of scrambling once a year.
+
+Your job is **scoping and orchestration, not legal opinion**. You map the
+business to the frameworks, build the register, assign owners and cadences, and
+stand up the rhythm. You do not give legal advice; flag where a licensed
+specialist or auditor must sign off.
+
+## What you produce — and what you refuse
+
+**Produce:** a scoped framework list with current deadlines, a control register
+(one row per control, tagged to every framework it satisfies), a cadence
+calendar, and an evidence-source catalog.
+
+**Refuse and route** — these are owned by siblings, not by you:
+
+- Privacy notice, ROPA, DSAR flow, consent banner → `../gdpr-privacy/SKILL.md`.
+- Terms of Service, EULA, acceptable-use → `../terms-conditions/SKILL.md`.
+- Internal retention/classification policy *text* → `../data-policy/SKILL.md`.
+- Commercial contract / MSA / DPA clause drafting → `../contracts/SKILL.md`.
+- Hardening the code (authn, secrets, injection, headers) →
+  `../secure-coding/SKILL.md`.
+
+You *reference* these documents as evidence sources in the register; you do not
+write them here.
+
+## Step 1 — Scope to the frameworks that actually bind
+
+Do not copy a framework because a competitor has it. Map business attributes to
+obligations. Ask the operator the attribute questions, then apply this table.
+
+| Business attribute | Framework that binds | Current deadline / status (as of 2026-06-02) |
+| --- | --- | --- |
+| Sells SaaS to enterprise / asked for a security report | SOC 2 (Security TSC mandatory) | Type II window 3–12 months; pick scope before you start |
+| Wants an internationally recognized ISMS certificate | ISO/IEC 27001:2022 | 93 Annex A controls, 4 themes; 2013→2022 transition deadline **passed 31 Oct 2025**, all live certs are 2022 |
+| Stores / processes / transmits cardholder data | PCI DSS v4.0.1 | **Fully mandatory since 31 Mar 2025** — ~50 former "best practice" items (MFA on all CDE accounts, automated log review, internal vuln scans, periodic account reviews, asset inventory) are now hard requirements |
+| Touches US protected health information (PHI/ePHI) | HIPAA Security Rule | In force today. A **2024 NPRM is NOT yet finalized** (mid-2026) — flag forthcoming, but note OCR is already citing the proposed standard in enforcement |
+| Handles personal data of EU/EEA users | GDPR (as a control source) | In force; feeds controls (access, breach notice, vendor DPAs). Document *text* → `../gdpr-privacy/SKILL.md` |
+| Builds or deploys an AI system, esp. high-risk use | EU AI Act | Phased — see below; **2 Aug 2026 is the active legal date** for Annex III high-risk |
+| Is an EU financial entity (or critical ICT vendor to one) | DORA | **In force since Jan 2025** — ICT risk mgmt, incident reporting, resilience testing, third-party risk |
+| Operates essential/important services in the EU | NIS2 | Transposed in 21/27 member states by Mar 2026; many set a first audit deadline of **30 Jun 2026** |
+
+**EU AI Act — get the dates exactly right (high audit risk):**
+
+- Prohibited practices + AI-literacy: **2 Feb 2025**.
+- GPAI-model obligations + governance + penalties: **2 Aug 2025**.
+- Annex III (use-based) high-risk obligations: **2 Aug 2026**.
+- Annex I (product-regulated, incl. medical devices): **2 Aug 2027**.
+- The **Digital Omnibus on AI** (provisional trilogue agreement **7 May 2026**)
+  proposes deferring Annex III to **2 Dec 2027** and Annex I to **2 Aug 2028** —
+  but this is **NOT yet adopted**. Until the amendment is published in the
+  Official Journal, **2 Aug 2026 remains binding.** Plan to the original date;
+  flag the deferral as forthcoming-not-final.
+- Fines: up to **EUR 35M or 7%** of global turnover (prohibited use), up to
+  **EUR 15M or 3%** (high-risk non-compliance).
+
+**Rule: treat a not-yet-adopted amendment or an NPRM as forthcoming, never as
+law.** Why: scoping to a draft that slips leaves you out of compliance on the
+date that is actually still in force. See `references/frameworks.md` for the
+per-framework control summaries.
+
+## Step 2 — Build the control register
+
+One row per control. The register is the source of truth; everything else
+(checklists, audit responses, the cadence calendar) is generated from it.
+
+| Column | What goes in it |
+| --- | --- |
+| `control-id` | Stable internal id, e.g. `AC-02` |
+| `framework` | Every framework this control satisfies (multi-tag) |
+| `owner` | A named person/role accountable — never "the team" |
+| `evidence` | The exact artifact that proves it, and where it lives |
+| `cadence` | How often it is reviewed, sized by risk |
+| `last-verified` | Timestamp of the last attestation |
+| `status` | `met` / `gap` / `in-progress` |
+
+**Bad → Good control:**
+
+```text
+Bad:  "We do access control."        (no owner, no proof, not testable)
+Good: AC-02 | ISO A.5.18 + SOC2 CC6.2 + PCI 7.2 | owner: Head of IT |
+      evidence: quarterly IdP access-export reviewed & signed |
+      cadence: quarterly | last-verified: 2026-05-30 | status: met
+```
+
+The Good row is auditable: an auditor can ask the owner for the dated export and
+verify the claim in minutes.
+
+**Exploit the overlap — one control, many frameworks.** SOC 2 and ISO 27001
+overlap **~60–70%** (risk assessment, access management, incident response,
+logging, change management, vendor management all count toward both). So:
+
+- **Bad:** maintain a separate register per framework → the same control gets
+  re-documented 3 times and drifts out of sync.
+- **Good:** one register, each control tagged to *all* frameworks it satisfies.
+  Generate the per-framework checklist as a filtered view.
+
+## Step 3 — Stand up the operating rhythm
+
+Audit-readiness is a continuous state, not an annual project. Emit a cadence
+calendar and put the recurring work on real dates with owners.
+
+| Cadence | Recurring compliance work |
+| --- | --- |
+| Daily | Automated control monitoring / alerting (failed logins, drift) |
+| Weekly | **Control-health review** — the heartbeat: walk open gaps, stale evidence, overdue owners |
+| Monthly | Evidence refresh for high-risk controls; vulnerability-scan review |
+| Quarterly | Access recertification; vendor/third-party risk reassessment |
+| Annual | Full risk assessment; policy review; penetration test; audit prep |
+
+The **weekly control-health review** is the single habit that kills the annual
+scramble. Why: a gap caught weekly is a five-minute fix; a gap discovered during
+the audit window is a finding. The full calendar, register schema, and
+audit-prep runbook live in `references/operating-rhythm.md`.
+
+## Step 4 — Evidence discipline
+
+Evidence is what an auditor tests. Every piece must be:
+
+- **Timestamped** — undated evidence proves nothing about *when* the control ran.
+- **Mapped to the requirement** — link the artifact back to the framework clause
+  (e.g. this export proves `ISO A.5.18` *and* `SOC2 CC6.2`).
+- **Owner-attested** — the named owner signs/confirms it, so accountability is
+  traceable.
+- **Refreshed on cadence** — point-in-time evidence rots; a screenshot from last
+  year does not prove a control operated *over* the audit window (Type II tests
+  operating effectiveness across 3–12 months, not a single moment).
+
+Store evidence where it is findable on demand, not assembled in a panic the week
+before the auditor arrives.
+
+## Anti-patterns
+
+| Anti-pattern | Why it fails | Do instead |
+| --- | --- | --- |
+| Checklist with no owners | "Everyone's job" means no one's job; the auditor asks who, and the room goes silent | Every control names one accountable owner |
+| Copying a framework you don't fall under | Wastes months certifying SOC 2 when the binding obligation was PCI DSS | Scope from business attributes (Step 1) first |
+| Treating an NPRM / not-yet-adopted amendment as law | The draft slips; you're non-compliant on the date still legally in force | Plan to the active date; flag drafts as forthcoming |
+| Point-in-time evidence | A single screenshot can't prove a control operated over the Type II window | Timestamped, periodic, owner-attested evidence |
+| One register per framework | Same control re-documented 3× and drifts; the 60–70% overlap is wasted | One register, each control multi-tagged |
+| Annual evidence scramble | Gaps surface as audit findings instead of weekly fixes | Weekly control-health review + cadence calendar |
+| Drafting the privacy policy / DPA here | That's legal-document substance, a different skill's lane | Route to `../gdpr-privacy/SKILL.md` / `../contracts/SKILL.md` |
+| Giving a legal opinion | You scope and orchestrate; you are not counsel | Flag where a licensed specialist or auditor must sign off |
+
+## References
+
+- `references/frameworks.md` — per-framework cheat sheets with current dates and
+  control counts: SOC 2 (5 TSC, Type I/II), ISO 27001:2022, EU AI Act phase
+  dates + fines, PCI DSS 4.0.1, HIPAA (+ 2024 NPRM forthcoming), DORA, NIS2,
+  GDPR as a control source.
+- `references/operating-rhythm.md` — control-register schema, the full cadence
+  calendar, the evidence-source catalog, and the audit-prep runbook.
+
+## Verify
+
+`scripts/verify.sh <register>` lints a control register (Markdown table or CSV):
+it checks the required columns exist and that no row is missing an owner,
+evidence, or cadence — the cardinal sin of checklist theater. Read-only, exits 0
+on a clean or empty register.
+
+## See also
+
+- `../gdpr-privacy/SKILL.md` — privacy notice, ROPA, DSAR, consent.
+- `../terms-conditions/SKILL.md` — ToS, EULA, acceptable-use.
+- `../data-policy/SKILL.md` — internal retention/classification policy text.
+- `../contracts/SKILL.md` — MSA / DPA / NDA drafting and review.
+- `../secure-coding/SKILL.md` — code-level hardening that produces your evidence.

package/skills/compliance/evals/README.md

@@ -0,0 +1,14 @@
+# Evals — compliance
+
+These cases are graded by judgment, not by an automated runner. Feed each
+`should_trigger` and `should_not_trigger` prompt to the skill router and confirm
+the routing matches: triggers should land on `compliance`, and each
+`should_not_trigger` prompt should route to the named sibling (`route_to`). For
+the `capability` case, run the scenario through the skill and check the response
+covers every item in `must_include` — especially the date-sensitive ones (EU AI
+Act 2 Aug 2026 as active vs the not-yet-adopted Omnibus deferral; HIPAA NPRM as
+forthcoming-not-law) and the structural ones (a register with owner/evidence/
+cadence columns, the 60-70% overlap, a weekly control-health review). The
+separate `scripts/verify.sh` mechanically lints a finished control register; run
+it against a generated register to confirm no control is missing an owner,
+evidence, or cadence.

package/skills/compliance/evals/cases.yaml

@@ -0,0 +1,46 @@
+skill: compliance
+
+should_trigger:
+  - prompt: "What compliance frameworks do we need for a fintech operating in the EU?"
+    why: Core scoping — map business attributes (financial entity, EU) to binding frameworks (DORA, GDPR-as-source, maybe SOC 2).
+  - prompt: "Build us a SOC 2 readiness checklist with control owners and what proves each control."
+    why: Core artifact — the control register with owner + evidence columns.
+  - prompt: "We have an ISO 27001 audit in 90 days, set up the prep rhythm and evidence collection."
+    why: Non-obvious — the deliverable is a cadence/runbook, not a document; audit-prep is squarely this skill.
+  - prompt: "Map our controls — who owns what, how often each is reviewed, and what evidence backs it."
+    why: The control register is the exact artifact; ownership + cadence + evidence is the skill's spine.
+  - prompt: "Set up a continuous-compliance calendar so we stop scrambling the week before every audit."
+    why: Non-obvious operating-rhythm trigger — the weekly control-health review and cadence calendar.
+  - prompt: "Does the EU AI Act apply to our recommender system, and what's the deadline we have to hit?"
+    why: Scoping to a dated framework — must surface 2 Aug 2026 as active and flag the Omnibus deferral as not-yet-adopted.
+  - prompt: "¿Qué compliance necesitamos para una app de salud con datos médicos de usuarios europeos?"
+    why: Spanish + multi-framework sector scoping (HIPAA-style PHI, GDPR-as-source, SOC 2), not a single document.
+
+should_not_trigger:
+  - prompt: "Write our privacy policy and cookie consent banner."
+    route_to: gdpr-privacy
+    why: Privacy-document drafting and consent UX — substance owned by gdpr-privacy, not program scoping.
+  - prompt: "Draft the Terms of Service for our SaaS website."
+    route_to: terms-conditions
+    why: A one-to-many published legal document, not a control register or cadence.
+  - prompt: "Fix the SQL injection and harden the auth on our API endpoints."
+    route_to: secure-coding
+    why: Code-level hardening (the evidence source), not the program-level control mapping.
+  - prompt: "Review this vendor MSA and DPA before we sign it."
+    route_to: contracts
+    why: Negotiated two-party agreement review, not framework scoping.
+  - prompt: "Write our internal data retention and classification policy text."
+    route_to: data-policy
+    why: Internal policy-document prose, not the control register that references it.
+
+capability:
+  - scenario: "We're a Series-A health SaaS with EU users and an AI triage feature that scores patient symptoms. Tell us what compliance we need and how to keep it true between audits."
+    must_include:
+      - Scopes to HIPAA for the PHI, flagging the 2024 NPRM as forthcoming/not-yet-finalized while noting OCR is already enforcing toward it
+      - Treats GDPR as a control source for the EU users (and routes the privacy-document drafting to gdpr-privacy, not drafting it here)
+      - Includes SOC 2 (Security TSC) for the enterprise-readiness angle and notes Type II tests operating effectiveness over a 3-12 month window
+      - Scopes the EU AI Act high-risk obligations to the active 2 Aug 2026 date while flagging the 7 May 2026 Digital Omnibus proposed deferral to 2 Dec 2027 as not-yet-adopted
+      - Produces a control register with owner / evidence / cadence columns, one row per control
+      - Notes the SOC 2 / ISO 27001 ~60-70% overlap to keep a single multi-tagged register instead of duplicates
+      - Stands up an operating rhythm with a weekly control-health review and a cadence calendar
+      - Routes privacy-policy / DPA drafting to gdpr-privacy and contracts, and does NOT give a legal opinion

package/skills/compliance/references/frameworks.md

@@ -0,0 +1,108 @@
+# Framework cheat sheets
+
+Current as of 2026-06-02. Numbers and dates are load-bearing — verify against
+the primary source before quoting them in an audit response.
+
+## SOC 2
+
+- Built on **five Trust Services Criteria**: **Security** (the only mandatory
+  one, the "Common Criteria"), **Availability**, **Processing Integrity**,
+  **Confidentiality**, **Privacy**. Most start with Security alone and add
+  criteria as customers demand.
+- **Type I** = controls suitably designed at a **point in time**.
+- **Type II** = controls **operating effectively over a window**, typically
+  **3–12 months**. This is what enterprise buyers want, and it is why
+  point-in-time evidence is insufficient.
+- Not a certification — an auditor's attestation report. Renewed annually.
+
+## ISO/IEC 27001:2022
+
+- **93 Annex A controls** in **four themes**: Organizational (37), People (8),
+  Physical (14), Technological (34).
+- The **2013 → 2022 transition deadline passed 31 Oct 2025** — all live
+  certificates are now on the 2022 standard. Do not reference the old 114-control
+  / 14-domain structure.
+- Requires a documented ISMS, risk assessment, Statement of Applicability, and
+  internal audit. A real certification (vs SOC 2's attestation).
+
+## SOC 2 ↔ ISO 27001 overlap
+
+- **~60–70% of controls overlap**: risk assessment, access management, incident
+  response, logging, change management, vendor management all count toward both.
+- Practical consequence: maintain **one control register**, tag each control to
+  every framework it satisfies, and generate per-framework views. Do not keep
+  parallel registers.
+
+## EU AI Act
+
+Phased application:
+
+| Obligation | Date |
+| --- | --- |
+| Prohibited practices + AI-literacy | 2 Feb 2025 |
+| GPAI-model obligations + governance + penalties | 2 Aug 2025 |
+| Annex III (use-based) high-risk obligations | **2 Aug 2026 — active legal date** |
+| Annex I (product-regulated, incl. medical devices) | 2 Aug 2027 |
+
+High-risk obligations include conformity assessment, registration, risk
+management, data governance, logging, and human oversight.
+
+**Digital Omnibus on AI** — a provisional trilogue agreement (**7 May 2026**)
+proposes deferring Annex III high-risk to **2 Dec 2027** and Annex I to
+**2 Aug 2028**. It is **NOT yet adopted**. Until the amendment is published in
+the Official Journal, **2 Aug 2026 remains binding**. Plan to the original date;
+record the deferral as forthcoming-not-final.
+
+Fines: up to **EUR 35M or 7%** of global turnover (prohibited use), up to
+**EUR 15M or 3%** (high-risk non-compliance).
+
+## PCI DSS v4.0.1
+
+- **Fully mandatory since 31 Mar 2025.** ~50 previously "best practice"
+  future-dated requirements are now hard requirements, layered on the 12
+  foundational requirements. Newly mandatory items include:
+  - MFA for **all** accounts with access to the cardholder data environment.
+  - Automated log review.
+  - Internal vulnerability scanning.
+  - Periodic account reviews.
+  - A maintained hardware/software inventory.
+- Scope is defined by where cardholder data is stored, processed, or transmitted
+  — minimizing scope (e.g. tokenization, hosted payment pages) minimizes burden.
+
+## HIPAA Security Rule (+ 2024 NPRM — forthcoming, not law)
+
+- The current Security Rule is in force today.
+- An **NPRM** (issued 27 Dec 2024, published in the Federal Register 6 Jan 2025,
+  comment close 7 Mar 2025) proposes to:
+  - Remove the **"required vs addressable"** distinction — nearly everything
+    becomes required, with narrow exceptions.
+  - Mandate **MFA** for ePHI access.
+  - Require a written technology **asset inventory + network map**.
+  - Patch **critical** risks in **15 days**, **high** in **30 days**.
+  - Terminate workforce ePHI access within **1 hour** of departure.
+  - If finalized, **240 days** to comply (covered entities 180 + business
+    associates +60 for agreement updates).
+- **As of mid-2026 the rule is still NOT finalized** — OCR received 4,700+
+  comments and is still parsing them. But OCR has **begun citing the proposed
+  standard in resolution agreements and enforcement**, so enforcement is already
+  gravitating toward it. Scope to the current rule; prepare for the proposed one.
+
+## DORA (Digital Operational Resilience Act)
+
+- **In force since Jan 2025** for EU financial entities (and their critical ICT
+  third-party providers). Four pillars: ICT risk management, incident reporting,
+  digital operational resilience testing, and third-party (ICT) risk management.
+
+## NIS2
+
+- As of Mar 2026, **21 of 27 member states had transposed** it. Many set a first
+  audit deadline of **30 Jun 2026**. Check the specific transposition for each
+  member state you operate in — obligations vary in the national implementation.
+
+## GDPR as a control source
+
+GDPR is not "a checklist you certify against" — it feeds controls into your
+register: lawful-basis records, access controls, breach-notification timelines,
+vendor DPAs, and data-subject-rights handling. The *documents* (privacy notice,
+ROPA, DSAR procedure) are drafted by `../gdpr-privacy/SKILL.md` and `../contracts/SKILL.md`;
+here you only map them as evidence sources.