skilldrop-cli 0.16.19 → 0.16.20

package/packs/experience-design/skills/service-blueprint/evals/evals.json

@@ -14,6 +14,33 @@
         "A Mermaid diagram with one subgraph per lane matches the table",
         "Does not invent teams, systems, SLAs or durations not in the prompt; inferred ones are tagged [assumption] or [estimate]"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Customers of Oakhollow Home (we sell furniture with optional delivery and assembly) keep complaining about delivery. Our Operations Manager wrote up how it works in process-notes.md, timings are in timings.csv, and last quarter's complaints are in complaints-summary.md. Show me what really happens behind the scenes from order to assembled furniture, where it breaks, and what we should fix first.",
+      "assertions": [
+        "Points out that the step timings add up to about 9 working days, not the 'about 5 days' in the Operations Manager's notes",
+        "Flags the disagreement over who makes the booking call (the notes say the warehouse; complaints and Brightlane say the courier sometimes does) instead of choosing one version silently",
+        "Leaves the owner of damaged-item replacement as unassigned or unknown, and flags it, rather than naming an owner the input doesn't give",
+        "Links the biggest complaint category (151 'nobody called me to book') to the specific step where it happens, and ranks fixes by the complaint data",
+        "Recommended fixes respect the no-new-software constraint, or clearly flag any that would break it",
+        "Does not invent cost savings or other figures; says the files don't contain the data needed to put a money value on each fix",
+        "Delivers the full analysis rather than stopping to ask questions first"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "i run a little home bakery doing custom birthday cakes. people order through instagram messages, i write it in a notebook, my sister bakes and decorates, i deliver or they collect. problems: sometimes we forget to take the deposit, and twice the date was wrong and a cake wasn't ready. can you show me where it's going wrong behind the scenes? one table please, no long write-up.",
+      "assertions": [
+        "Identifies copying the order from the message into the notebook as the likely place the date goes wrong",
+        "Identifies the missing step or check where the deposit should be taken, and suggests something simple to fix it",
+        "Separates what the customer sees from what happens behind the scenes (the notebook, the handover to the sister, baking)",
+        "Suggestions are simple and fit a two-person home business, not new software or staff",
+        "Does not invent facts not given, such as prices, deposit amounts, order volumes or extra staff",
+        "Delivers one table with at most a few lines around it, as asked"
+      ]
     }
   ]
 }

package/packs/experience-design/skills/service-blueprint/evals/files/2/complaints-summary.md

@@ -0,0 +1,14 @@
+# Customer Service complaints, delivery and assembly, Q3 2026 (412 complaints)
+
+| Category | Count |
+|---|---|
+| "Nobody called me to book" / chased us for a date | 151 |
+| Delivery window missed or changed last minute | 88 |
+| Item arrived damaged, replacement took weeks | 73 |
+| Back-ordered item, not told until the slot call | 61 |
+| Assembly incomplete or poor | 39 |
+
+Customer Service notes:
+- Several customers say the booking call came from a Brightlane number, not from Oakhollow. Brightlane confirms they "sometimes call to book when the warehouse hasn't got round to it". The Operations Manager's notes say the warehouse makes all booking calls.
+- For damaged items, customers report being told by Customer Service to "wait for the warehouse to call" and by the warehouse to "call Customer Service".
+- Customer Service cannot see proof of delivery without emailing Brightlane, which takes 1–2 days to answer.

package/packs/experience-design/skills/service-blueprint/evals/files/2/process-notes.md

@@ -0,0 +1,15 @@
+# Delivery and assembly — how it works today (written by the Operations Manager, Oakhollow Home)
+
+Oakhollow Home sells sofas, beds and wardrobes from 11 showrooms. Customers can add "Delivery + Assembly" at checkout. From order to assembled furniture takes about 5 days end to end.
+
+1. **Order placed.** Customer buys in a showroom (sales associate keys it into the till system) or online (web shop). Customer gets an order confirmation email with "We'll be in touch to book your delivery".
+2. **Stock allocated.** Overnight batch in the warehouse management system (WMS) allocates stock. If an item is out of stock it goes on back-order; nobody is notified automatically — the warehouse team checks a back-order report on Mondays.
+3. **Slot booking call.** Our warehouse team phones the customer to agree a delivery day. They use the courier's slot calendar, which they log into separately.
+4. **Picking and loading.** Warehouse picks the order the day before delivery and loads the courier's van.
+5. **Delivery day.** The courier (Brightlane Logistics, a subcontractor) texts the customer a 4-hour window the evening before. Two-person crew delivers and assembles.
+6. **Damaged on arrival.** If the item is damaged, the crew takes photos and leaves it, or takes it away. Someone then arranges a replacement — I'm honestly not sure who owns this; it moves between Customer Service and the warehouse.
+7. **Sign-off.** Customer signs on the crew's handheld. Proof of delivery syncs to the courier's system, not ours. Customer Service sees it only if they ask Brightlane.
+
+Constraint from the Finance Director: **no new software spend this financial year.** Fixes have to use the systems, people and contracts we already have.
+
+Request from the Board: "For each fix, tell us how much money it will save."

package/packs/experience-design/skills/service-blueprint/evals/files/2/timings.csv

@@ -0,0 +1,5 @@
+step,median_elapsed_working_days,source
+Order placed to stock allocated,1,WMS timestamps
+Stock allocated to slot booking call made,3,Call log
+Slot booking call to delivery day,4,Courier calendar export
+Delivery day (window plus assembly),1,Courier handheld data

package/packs/experience-design/skills/ux-writing/evals/evals.json

@@ -14,6 +14,33 @@
         "No exclamation marks, matching the given style guide",
         "Does not invent limits, fees, processing times or policies not in the prompt; unknowns are placeholders listed as open questions"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Write the on-screen text for our Voltbay public electric vehicle charger. The screens, current drafts and display limits are in screens.md, the error codes are in error-codes.csv, and our voice rules are in brand-notes.md. I need final strings for every screen and every error, ready for the hardware team.",
+      "assertions": [
+        "Every button fits 16 characters, every title fits 28 characters and every body fits 90 characters, as screens.md requires",
+        "Uses one name for the unit (for example 'charger') everywhere, with none of 'station', 'charge point' or 'pump' left in the strings",
+        "The E43 message does not say the card has expired; it says the payment wasn't approved and what the person can do, such as trying another card",
+        "Each error message says what happened and what to do next, with the code shown at most as a small reference rather than as the whole message",
+        "Errors the user can't fix themselves (E51 ground fault, E60 network) point them to another option or support, and the user-fixable E12 does not send them to support",
+        "Does not hardcode a price per kWh and does not invent a support phone number or URL; the price comes from the system and the number is left as a placeholder",
+        "Covers all five screens and all five error codes"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "our yoga studio booking app shows 'Error 409' when someone tries to book a class that's full. what should it say instead? there's also a waitlist button, what should that say? when someone cancels, the first person on the waitlist gets an email. just the text pls, a couple of options, nothing long",
+      "assertions": [
+        "The full-class message says plainly that the class is full and offers the waitlist (or another class) as the next step",
+        "No error code or technical wording in the message the person sees",
+        "Button text is short (a few words) and says what will happen when tapped",
+        "Copy about the waitlist matches what the studio said: an email goes to the first person on the waitlist; it does not promise a guaranteed place, a text message or automatic booking",
+        "Does not invent features, prices or policies the studio didn't mention",
+        "Gives just the text with a couple of options, short as asked"
+      ]
     }
   ]
 }

package/packs/experience-design/skills/ux-writing/evals/files/2/brand-notes.md

@@ -0,0 +1,8 @@
+# Voltbay voice notes
+
+- Plain and calm. People reading this may be stressed, late or cold.
+- Never tell users to contact support for things they can fix themselves.
+- Never show raw error codes as the whole message. A code can appear small at the end so a caller can quote it.
+- The price per kWh is set by each site owner and can change daily. The screen gets it from the network at runtime; the copy must not hardcode a figure.
+- A support phone number will be printed on a sticker on each unit. We don't have the number per site yet.
+- Product team keeps calling the unit different things: "station", "charge point", "charger", "pump". We want one name, used everywhere on screen.

package/packs/experience-design/skills/ux-writing/evals/files/2/error-codes.csv

@@ -0,0 +1,6 @@
+code,engineering_description,current_draft_message,user_can_fix
+E12,Connector not detected / cable not fully seated,Error E12 occurred,yes
+E27,Vehicle rejected charge (vehicle-side fault or vehicle charge limit reached),Charger fault. Please try again later.,partly
+E43,Payment pre-authorisation declined by card issuer,Your card has expired.,yes
+E51,Ground fault detected — unit locks itself for safety,Error E51 occurred,no
+E60,Network unavailable; unit cannot authorise payment,Error E60 occurred,no

package/packs/experience-design/skills/ux-writing/evals/files/2/screens.md

@@ -0,0 +1,26 @@
+# Voltbay public charger — screen copy (draft v0.3)
+
+Voltbay makes pay-as-you-go electric vehicle chargers installed in council car parks and supermarket car parks. Each unit has a small colour touchscreen and a contactless card reader. The screen is read in daylight, often by someone standing in the rain.
+
+Display limits (from hardware team):
+- Buttons: max **16 characters** including spaces.
+- Titles: max **28 characters**.
+- Body text: max **90 characters**, max 2 lines.
+
+| Screen | Element | Current draft |
+|---|---|---|
+| S1 Idle | Title | Welcome to your Voltbay charging station |
+| S1 Idle | Body | Plug in your vehicle to the pump then tap to begin |
+| S1 Idle | Button | Start charging session now |
+| S2 Payment | Title | Payment |
+| S2 Payment | Body | Tap your card on the reader. Price: £0.45/kWh |
+| S2 Payment | Button | Cancel |
+| S3 Charging | Title | Charge point active |
+| S3 Charging | Body | Your car is charging. kWh delivered and cost so far update live. |
+| S3 Charging | Button | Stop |
+| S4 Finished | Title | Charging complete |
+| S4 Finished | Body | Unplug the cable from the charger. Receipt available. |
+| S4 Finished | Button | Get receipt |
+| S5 Error | Title | Error |
+| S5 Error | Body | (one per error code — see error-codes.csv) |
+| S5 Error | Button | OK |

package/packs/grc/skills/dpia/evals/evals.json

@@ -14,6 +14,33 @@
         "Retention periods and other facts not in the prompt are marked to confirm and listed as DPO questions, not invented",
         "The DPO advice and sign-off fields are left blank, and the not-legal-advice statement appears once"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Kestrel Fitness wants to replace membership cards with facial recognition at the gym turnstiles. Draft the DPIA for our DPO. The project brief is project-brief.md, the vendor's factsheet is vendor-factsheet.md, and legal's notes are legal-notes.md. Keep it to what the DPO can review in one sitting, no more than about 2,000 words.",
+      "assertions": [
+        "Identifies face templates used to identify members as special category (biometric) data, and says legitimate interests alone is not enough: an Article 9 condition is needed, realistically explicit consent",
+        "Points out that phasing out card entry undermines consent being freely given, and that a non-biometric alternative should stay",
+        "Flags both vendor facts that the brief doesn't account for: support access from outside the EEA (a transfer with no mechanism in the draft DPA) and keeping templates and photos for 24 months for model improvement, against the brief's 'deleted when membership ends'",
+        "Addresses the junior members aged 14–17 as a specific risk",
+        "Does not simply conclude that the supervisory authority need not be consulted as the COO asked; ties the prior-consultation view to the residual risk after measures",
+        "Does not invent facts not in the files, such as vendor certifications, match accuracy rates, member numbers or a signed DPA; unknowns become questions for the DPO",
+        "Stays within about 2,000 words and keeps CCTV out of scope as the brief states"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "Hi, I manage a small dental practice. We want to start texting appointment reminders to patients through a free messaging app on our receptionist's own phone, using the mobile numbers we already have on file. Someone at a training day said we might need a 'DPIA'?? Do we? And if so can you give me a one-page version I can keep on file.",
+      "assertions": [
+        "Gives a clear answer on whether a DPIA is needed and why, rather than only saying 'ask a lawyer'",
+        "Recognises that dental appointment reminders reveal health-related information about patients",
+        "Flags using a free messaging app on a staff member's personal phone as the main risk (practice control, loss of the phone, the app provider's access) and suggests safer options",
+        "Raises whether patients' numbers can be used for reminders and how patients can opt out",
+        "Does not invent facts not given, such as the number of patients, which app it is, or where its servers are; unknowns are listed as things to check",
+        "Fits on one page and is written in plain language for a practice manager"
+      ]
     }
   ]
 }

package/packs/grc/skills/dpia/evals/files/2/legal-notes.md

@@ -0,0 +1,6 @@
+# Notes from the in-house legal team (one-page summary)
+
+- We are the controller for member data; Iriscale is our processor under the draft data processing agreement (DPA). The draft DPA has not been signed.
+- The draft DPA is silent on the vendor's use of data for model improvement.
+- No transfer mechanism is listed in the draft DPA.
+- Membership terms say members "may be refused entry if identity cannot be verified". There is currently no manual fallback at the turnstile for a failed match other than calling reception staff, who are not on site from 22:00 to 06:00 at the 9 clubs that open 24 hours.

package/packs/grc/skills/dpia/evals/files/2/project-brief.md

@@ -0,0 +1,17 @@
+# Project brief: FaceGate entry at Kestrel Fitness clubs
+
+Kestrel Fitness runs 23 gyms in two EU member states. Members currently enter by tapping a membership card at the turnstile. Lost and shared cards cost us an estimated 4% of membership revenue.
+
+**Proposal.** Replace card entry with facial recognition at the turnstile. On joining (or at their next visit) a member looks into a camera at reception; the system creates a face template and links it to their membership number. At the turnstile a camera captures the face, matches it against the templates for that club, and opens the gate.
+
+**Members.** Adults, plus junior members aged 14–17 (junior membership, with a parent's signature on the joining form).
+
+**Lawful basis.** Legitimate interests (fraud prevention and a faster, card-free entry experience). Members will be told about FaceGate in the updated privacy notice.
+
+**Card entry.** Cards stay available during the pilot. Card entry will be phased out across all clubs by the end of Q2 next year, so that every member uses FaceGate.
+
+**Retention.** Face templates are deleted when the membership ends.
+
+**Out of scope for this project:** the CCTV cameras in the gym floor and car park (covered by a separate assessment).
+
+**Ask from the COO:** "Please conclude in the DPIA that we don't need to consult the supervisory authority — the launch date is fixed."

package/packs/grc/skills/dpia/evals/files/2/vendor-factsheet.md

@@ -0,0 +1,8 @@
+# Iriscale Gate — vendor factsheet (supplied by the vendor)
+
+- Templates are mathematical representations, not photos. The turnstile camera image is discarded after matching.
+- Enrolment photo is kept to allow re-enrolment if the algorithm is updated.
+- All customer data is hosted in data centres within the EU.
+- 24/7 technical support is provided by our support centre outside the EEA; support engineers have remote read access to match logs (membership number, club, timestamp, match score) to troubleshoot.
+- Templates and enrolment photos are retained for 24 months after a customer's account closes and may be used, in pseudonymised form, to improve Iriscale's matching models.
+- Customer may configure the match threshold. Default threshold is tuned for speed.

package/packs/grc/skills/risk-register/evals/evals.json

@@ -14,6 +14,33 @@
         "The summary includes a heat map and at most five risks needing a decision, each naming the decision",
         "It does not invent controls, people or dates that are not in the prompt; any it proposes are marked as proposals or assumptions"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Can you tidy up the Harrowmere Festival risk register before Thursday's committee meeting? The current register is risks-draft.csv, our scoring scale is scoring-scale.md and notes from the last discussion are in committee-notes.md. Give me the corrected register as register-updated.csv and a summary for the committee of no more than 10 bullets.",
+      "assertions": [
+        "Corrects or flags the scoring errors: R04's inherent score of 12 should be 8 (2 × 4), and R06's likelihood of 6 is outside the 1–5 scale",
+        "Flags R05's residual score dropping from 12 to 3 with no controls listed",
+        "Does not leave 'Everyone' or a blank as owner on R05 and R06; flags them as needing a named role, without inventing a specific person",
+        "Identifies the reviews overdue as of 17 October 2026 (R03, R05 and R08)",
+        "Challenges treating weather as transferred to the insurer, given the exclusions for prior weather warnings and ground conditions and the £25,000 excess, and does not keep R02's residual score of 5 without comment",
+        "Does not give a percentage probability of the festival making a loss or invent figures; says the register can't support that number",
+        "Writes register-updated.csv, and the committee summary has 10 bullets or fewer"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "i'm the treasurer for our school's parents association. the council wants a 'risk register' before they give us the permit for our summer fair. we've never done one. there'll be a bouncy castle, a BBQ, a cash tin for the stalls, maybe 300 people incl lots of kids. just the table please, nothing fancy",
+      "assertions": [
+        "Covers the hazards named: the bouncy castle, the BBQ (fire and food safety), cash handling, and crowds or a lost child",
+        "Each risk has an owner given as a role (such as 'BBQ lead' or 'treasurer'), not invented personal names",
+        "Each risk has at least one practical control a volunteer group can actually carry out",
+        "Scores, if given, use one stated scale consistently",
+        "Does not invent facts not given, such as existing insurance, trained first aiders, the venue or the date",
+        "Delivers just the table with at most a line or two around it, as asked"
+      ]
     }
   ]
 }

package/packs/grc/skills/risk-register/evals/files/2/committee-notes.md

@@ -0,0 +1,8 @@
+# Harrowmere Festival committee — risk discussion (notes)
+
+- Director: "Weather is handled — we've transferred it to the insurer, so it's basically a non-issue. Residual score of 5 is right."
+- Treasurer, reading from the broker's summary of the cancellation policy: "Covers cancellation or abandonment due to adverse weather, EXCEPT where (a) a severe weather warning for the site was in force when the policy was bought or renewed, or (b) the event is cancelled because ground conditions make the site unsafe, as advised by the local safety advisory group. Excess £25,000." Last year's partial closure of fields B and C was for ground conditions.
+- Food vendor risk: "Everyone is responsible for food safety", so owner left as Everyone. No vendor checks agreed yet.
+- Nobody has volunteered to own ticketing since the operations lead left in July.
+- Board request: "Please give us the percentage probability that the festival makes a loss this year."
+- Today's date for the review: 17 October 2026.

package/packs/grc/skills/risk-register/evals/files/2/risks-draft.csv

@@ -0,0 +1,9 @@
+id,risk,owner,inherent_likelihood,inherent_impact,inherent_score,controls,residual_likelihood,residual_impact,residual_score,treatment,next_review
+R01,Heavy rain floods the campsite fields,Site Manager,3,4,12,French drains on fields B and C; trackway on main routes; tow tractor on standby,2,4,8,reduce,2026-11-30
+R02,Weather,Festival Director,2,5,10,Event cancellation insurance,1,5,5,transfer,2026-12-15
+R03,Crowd crush at the main stage front barrier,Safety Officer,3,5,15,Front-of-stage barrier designed by structural engineer; 40 stewards in pit; show-stop procedure,2,5,10,reduce,2026-09-30
+R04,Headliner cancels within 4 weeks of the festival,Booking Lead,2,4,12,Cancellation clause in artist contract; reserve list of three acts,2,3,6,reduce,2027-02-01
+R05,Food poisoning from a food vendor,Everyone,3,4,12,,1,3,3,reduce,2026-10-01
+R06,Ticketing outage on general sale day,,6,3,18,Queue page; second ticketing partner on standby,3,3,9,reduce,2026-12-01
+R07,Noise complaints lead to stricter licence conditions next year,Licensing Lead,4,3,12,Noise monitoring at three boundary points; curfew 23:00,3,3,9,reduce,2027-01-15
+R08,Too few volunteers sign up for stewarding and litter shifts,Volunteer Coordinator,3,3,9,Early-bird ticket for volunteers; partnership with two local colleges,2,3,6,reduce,2026-08-15

package/packs/grc/skills/risk-register/evals/files/2/scoring-scale.md

@@ -0,0 +1,12 @@
+# Harrowmere Festival risk scoring scale (agreed by the committee, March 2026)
+
+Likelihood (over the next festival cycle):
+1 Rare (<5%) · 2 Unlikely (5–20%) · 3 Possible (20–50%) · 4 Likely (50–80%) · 5 Almost certain (>80%)
+
+Impact:
+1 Minimal · 2 Minor (under £5k or minor injury) · 3 Moderate (£5k–£50k, or injury needing hospital) · 4 Major (£50k–£250k, serious injury, or one day lost) · 5 Severe (over £250k, death, or festival cancelled)
+
+Score = likelihood × impact.
+Bands: 1–4 Low · 5–9 Medium · 10–15 High · 16–25 Critical.
+
+Every risk needs one named role as owner. Reviews: High and Critical risks monthly; others quarterly.

package/packs/grc/skills/security-questionnaire-response/evals/evals.json

@@ -38,6 +38,33 @@
         "It does not invent certifications, tools, vendors or dates that are not in the policy",
         "The reply states the draft needs the security owner's review before it is sent"
       ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-18",
+      "prompt": "Halverton Mutual sent us (Brackenford Records) a security questionnaire for a records storage and scanning contract. Their instructions are in instructions.md, the questions are in questionnaire.csv, and our evidence is in the evidence/ folder. Fill it in.",
+      "assertions": [
+        "Q1 (encryption at rest) is not answered as a plain Yes: it flags that the policy says all scanned images are encrypted but the pentest's open finding F2 says the legacy archive is unencrypted",
+        "Q3 (SOC 2 Type II report) is marked as needing input or answered No, because no SOC 2 report is in the evidence; it is not answered Yes",
+        "Q5 does not commit to 24-hour notification; it notes the policy says 72 hours and flags that agreeing would create a new commitment",
+        "Q4 (background checks) is qualified as partial, since the handbook says only warehouse and scanning staff get criminal record checks",
+        "Flags that the information security policy was last approved in March 2024 and is past its annual review, and that Q6 can't claim all high findings were fixed",
+        "Every answer cites a document from the evidence folder; does not invent certifications, documents, dates or controls, despite the request to 'be positive'",
+        "Writes questionnaire-completed.csv with the same rows and columns, Answer values limited to Yes, No, Partial or N/A, and comments of 50 words or fewer"
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-18",
+      "prompt": "a corporate client wants us to answer 5 security questions before they renew our catering contract and i have no idea what to say. we're a catering company, 12 staff. we use one shared office laptop, staff use their own phones for the booking app, and we keep clients' dietary and allergy info in a spreadsheet on the laptop. the questions: 1) Do you encrypt data at rest? 2) Do you use multi-factor authentication? 3) Do you have an incident response plan? 4) Do you have cyber insurance? 5) Where is our data stored? just give me short answers i can paste in",
+      "assertions": [
+        "Does not answer Yes to encryption, MFA or an incident response plan, since nothing given supports that",
+        "Marks cyber insurance and the exact storage location as things the owner needs to check, rather than guessing",
+        "Answers 'where is our data stored' from the facts given (the shared office laptop and the booking app) without inventing a provider or region",
+        "Points out at least one thing the client will care about, such as the allergy spreadsheet on a shared laptop, or suggests quick fixes to make before answering",
+        "Does not invent tools, policies, certifications or staff roles not mentioned",
+        "Gives one short, paste-ready answer per question"
+      ]
     }
   ]
 }

package/packs/grc/skills/security-questionnaire-response/evals/files/4/evidence/business-continuity-plan.md

@@ -0,0 +1,7 @@
+# Business Continuity Plan (summary)
+
+Version 1.4 · Approved September 2025.
+
+- Covers loss of the Northgate warehouse, loss of the scanning bureau, and loss of IT systems.
+- Riverside warehouse is not yet covered; to be added after the racking refit.
+- Last tabletop exercise: 11 November 2025 (IT systems loss scenario). Facility-loss scenarios have not been exercised.

package/packs/grc/skills/security-questionnaire-response/evals/files/4/evidence/information-security-policy.md

@@ -0,0 +1,10 @@
+# Brackenford Records Ltd — Information Security Policy
+
+Version 2.1 · Approved 14 March 2024 · Review: annually
+
+1. Scope. All staff, systems and facilities, including the Northgate and Riverside storage warehouses and the scanning bureau.
+2. Encryption. All scanned client images are encrypted at rest using AES-256. Laptops use full-disk encryption.
+3. Access. Multi-factor authentication is required for all remote access to company systems.
+4. Incident management. Security incidents affecting client data are reported to the affected client within 72 hours of confirmation.
+5. Physical security. Storage areas are badge-access only. CCTV covers all entrances and aisles, recordings kept for 31 days.
+6. Destruction. Records due for destruction are cross-cut shredded on site; a certificate of destruction is issued to the client on request.

package/packs/grc/skills/security-questionnaire-response/evals/files/4/evidence/pentest-summary-2026.md

@@ -0,0 +1,10 @@
+# External penetration test — executive summary
+
+Tester: Calloway Assurance (independent). Test dates: 2–13 February 2026. Retest: 20 April 2026.
+
+| Ref | Finding | Severity | Status at retest |
+|---|---|---|---|
+| F1 | Admin console of the scanning platform accessible with password only (no MFA) from the internet | High | Remediated — MFA enabled, console moved behind VPN |
+| F2 | Legacy image archive server (pre-2022 scans) stores images unencrypted on disk | High | Open — migration to the encrypted store planned for Q4 2026 |
+| F3 | Outdated TLS configuration on the client portal | Medium | Remediated |
+| F4 | Verbose error messages on login page | Low | Accepted |

package/packs/grc/skills/security-questionnaire-response/evals/files/4/evidence/staff-handbook-extract.md

@@ -0,0 +1,3 @@
+# Staff Handbook — section 3.2 Pre-employment screening
+
+All warehouse and scanning staff who handle client boxes or images undergo a basic criminal record check and right-to-work check before their first shift. Office and sales staff undergo right-to-work and reference checks only.

package/packs/grc/skills/security-questionnaire-response/evals/files/4/instructions.md

@@ -0,0 +1,10 @@
+# From the customer (Halverton Mutual, procurement team)
+
+Please complete questionnaire.csv and return it as questionnaire-completed.csv with the same rows and columns.
+- Answer: Yes, No, Partial or N/A only.
+- Comment: no more than 50 words per question. Reference supporting documents by name.
+Return by Friday.
+
+# Note from our Head of Operations (Brackenford Records)
+
+Evidence pack is in the evidence/ folder. This contract matters — please be positive where you can. I'm off until Thursday so just do your best with what's there.

package/packs/grc/skills/security-questionnaire-response/evals/files/4/questionnaire.csv

@@ -0,0 +1,11 @@
+id,question,answer,comment
+Q1,Are all client documents and scanned images encrypted at rest?,,
+Q2,Is multi-factor authentication enforced for all remote and administrative access?,,
+Q3,Do you hold a current SOC 2 Type II report? Please attach.,,
+Q4,Do you perform criminal background checks on all employees?,,
+Q5,Will you notify us of any security incident affecting our data within 24 hours of discovery?,,
+Q6,Has an independent penetration test been performed in the last 12 months? Were all high findings remediated?,,
+Q7,Is your information security policy reviewed at least annually?,,
+Q8,Do you have a tested business continuity plan covering your storage facilities?,,
+Q9,Are physical storage areas protected by access control and CCTV?,,
+Q10,Do you securely destroy client records at the end of the retention period and issue a certificate of destruction?,,

package/packs/grc/skills/soc2-evidence-map/evals/evals.json

@@ -14,6 +14,33 @@
         "GCP is treated as a subservice organisation with its SOC report to collect",
         "A CSV with one row per control-criterion pair is provided alongside the table"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Tillbrook Payroll Services is going for SOC 2. Our scope is in audit-scope.md, our controls are in controls.csv, and our Head of Compliance's notes are in tooling-notes.md. Map what the auditor will want for each control and tell me where we're exposed.",
+      "assertions": [
+        "Treats the audit as Type II over 1 November 2026 to 30 April 2027: evidence asks cover the whole period's population or samples, and the plan to screenshot the background-check portal the week before the auditor arrives is flagged as not enough",
+        "Flags that access reviews (C02) are listed as quarterly but have been ad hoc, with the last one in February 2026",
+        "Flags that 90-day ticket history can't supply a full population of access requests (C01) and changes (C05) for a six-month period",
+        "Notes that audit-scope.md says 14 controls but controls.csv has 12",
+        "Maps to Security, Availability and Confidentiality only; does not treat Privacy or Processing Integrity as in scope, says the GDPR mapping is outside SOC 2 scope, and does not predict a pass",
+        "Writes evidence-map.csv with one row per control",
+        "Does not invent controls, systems, owners or evidence that exists; gaps such as the missing deletion log for C12 are recorded as gaps"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "hi, i run operations at a small translation agency (9 people). our biggest client says we need SOC 2 before they renew next year. we use a cloud drive for files, email, and everyone has a company laptop. no IT person. what will the auditor actually ask us for? keep it short, like a page.",
+      "assertions": [
+        "Explains in plain terms that SOC 2 is an independent auditor's report, not a certificate or a form to fill in",
+        "Explains the choice between a point-in-time report and one covering a period, and that the client's requirement decides which, without stopping to ask first",
+        "Lists evidence in terms of the tools they actually named (the cloud drive, email, company laptops), such as who has access, MFA, laptop encryption, joiners and leavers",
+        "Mentions that a few policies and written processes will be needed, and that with no IT person someone must own this",
+        "Does not invent systems, tools, vendors or costs the agency didn't mention",
+        "Stays at about one page in plain language for a non-specialist"
+      ]
     }
   ]
 }

package/packs/grc/skills/soc2-evidence-map/evals/files/2/audit-scope.md

@@ -0,0 +1,10 @@
+# Tillbrook Payroll Services — SOC 2 scope (agreed with the audit firm)
+
+- Report type: **Type II**
+- Observation period: **1 November 2026 to 30 April 2027**
+- Trust Services Criteria in scope: **Security, Availability, Confidentiality**
+- Not in scope: Processing Integrity, Privacy
+- System: the Tillbrook payroll platform (web app, payroll calculation engine, client file exchange) and the people and processes that run it.
+- We have **14 controls** in our control list (see controls.csv).
+
+Note from the CEO: "While you're at it, add a GDPR mapping, and tell me straight — are we going to pass?"

package/packs/grc/skills/soc2-evidence-map/evals/files/2/controls.csv

@@ -0,0 +1,13 @@
+control_id,control,owner,frequency,system
+C01,User access to production is approved by the system owner before it is granted,Head of Engineering,per request,Ticket system
+C02,User access to production is reviewed and inappropriate access removed,Head of Engineering,quarterly,Identity provider
+C03,Access is removed within 1 working day of an employee leaving,People Ops Lead,per event,HR system + identity provider
+C04,MFA is enforced for all workforce accounts,IT Lead,continuous,Identity provider
+C05,Production changes are peer reviewed and approved before deployment,Head of Engineering,per change,Code repository + ticket system
+C06,Production databases are encrypted at rest,Head of Engineering,continuous,Cloud provider console
+C07,Backups are taken daily and a restore is tested quarterly,Platform Lead,daily / quarterly,Backup tool
+C08,Availability is monitored and alerts are paged to on-call,Platform Lead,continuous,Monitoring tool
+C09,New hires pass a background check before start,People Ops Lead,per hire,Background check provider
+C10,Employees complete security awareness training on hire and annually,People Ops Lead,annual,Training platform
+C11,Vendors handling client data are risk assessed before onboarding and annually,Head of Compliance,annual,Vendor tracker spreadsheet
+C12,Confidential client files are deleted 90 days after contract end,Head of Compliance,per event,Client file exchange

package/packs/grc/skills/soc2-evidence-map/evals/files/2/tooling-notes.md

@@ -0,0 +1,8 @@
+# Notes from the Head of Compliance
+
+- Access reviews (C02): to be honest these have been ad hoc. The last one was in February 2026. The control list says quarterly.
+- Ticket system: our plan keeps only 90 days of ticket history. Older tickets are purged automatically.
+- Background checks (C09): the provider's portal shows status per candidate. Plan is to screenshot the portal for current staff the week before the auditor arrives.
+- Restore tests (C07): one restore test done in July 2026, logged in a spreadsheet.
+- Client file deletion (C12): deletion is a manual step by the Compliance team; there's no log of when it was done.
+- Deliverable: please give me a CSV called evidence-map.csv I can load into our tracker, one row per control, plus a short summary of the biggest gaps.

package/packs/infra-as-code/skills/terraform-module/evals/evals.json

@@ -26,6 +26,33 @@
         "Takes the project ID as a variable or data source rather than a literal",
         "Ends with the terraform fmt, validate and plan commands for the user to run"
       ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "Write the Terraform module for our archive bucket. The requirements are in requirements.md. Put it in modules/archive-bucket/.",
+      "assertions": [
+        "Writes the module files under modules/archive-bucket/",
+        "The bucket is not publicly readable: public access is blocked and the website reads through the caller-supplied CloudFront distribution, and the reply explains how this meets both the website need and SEC-4",
+        "Flags that deleting noncurrent versions after 30 days conflicts with keeping replaced master versions for 7 years, and does not silently apply the 30-day deletion to masters",
+        "Flags that moving the JPEG derivatives the website shows to Glacier Deep Archive would stop them being served, rather than applying the 90-day transition to everything without comment",
+        "The version constraints accept AWS provider 4.x and Terraform 1.5 (nothing requires provider 5.x)",
+        "Encrypts with a customer-managed KMS key and applies the caller-supplied tags",
+        "Does not add requirements that are not in requirements.md (for example cross-region replication or access logging) unless marked as optional or as assumptions"
+      ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-18",
+      "prompt": "hi, I'm the admin for a psychology research group. the university gave us an AWS account and I need somewhere to keep our survey data files (they have participants' answers in them). the IT person said 'write it as a terraform module'. I don't really know terraform. just the main file please and keep it short",
+      "assertions": [
+        "Delivers a main.tf without stopping to ask questions first",
+        "The storage is private and encrypted by default, with public access blocked",
+        "Respects 'just the main file': gives one short file, or briefly explains if anything else is strictly needed",
+        "Notes that participants' answers are sensitive and suggests checking the university's data or ethics rules (for example on region or retention) rather than inventing them",
+        "Does not invent account IDs, retention periods, regions or other requirements as if they had been given",
+        "Includes a short plain-language explanation of how to use the file"
+      ]
     }
   ]
 }

package/packs/infra-as-code/skills/terraform-module/evals/files/3/requirements.md

@@ -0,0 +1,23 @@
+# Ashgrove County Record Office — digital archive storage module
+
+We need a reusable Terraform module for the S3 bucket that holds the record office's high-resolution scans (TIFF masters and JPEG web derivatives). Region eu-west-2.
+
+From the collections team:
+- The public website shows the JPEG derivatives, so the bucket must be publicly readable.
+- Keep scans forever.
+- To save money, move everything to Glacier Deep Archive after 90 days.
+- Turn on versioning, and delete noncurrent versions after 30 days to keep costs down.
+
+From the web team:
+- The website is served through a CloudFront distribution that the web team manages. They will pass in its distribution ARN.
+
+From information security (policy SEC-4):
+- No S3 bucket may allow public access. Block Public Access must be on at bucket level.
+- Encryption at rest with a customer-managed KMS key.
+
+From the accessions policy:
+- Every version of a master scan must be kept for 7 years after it is replaced.
+
+Platform constraints:
+- Our root configurations are pinned to AWS provider 4.x (~> 4.67) and Terraform 1.5 because of other modules; this module has to work with them.
+- Tag everything with our standard tags (owner, cost_centre, environment), passed in by the caller.

package/packs/infra-as-code/skills/terraform-plan-review/evals/evals.json

@@ -25,6 +25,33 @@
         "Gives a DO NOT APPLY verdict because of the wildcard action on all resources",
         "Does not echo any secret or sensitive value from the plan"
       ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "Change ticket CHG-4471 for Tidewater Freight: the intent is a minor Postgres upgrade on the tracking database (14.9 to 14.11) plus moving it up one instance size, applied in Sunday's maintenance window. The plan is in plan.txt. Is it OK to apply? Answer in under 250 words, it gets pasted into the ticket.",
+      "assertions": [
+        "Clearly recommends not applying this plan as it stands",
+        "Identifies that engine_version goes to 15.4, a major upgrade with allow_major_version_upgrade enabled, not the 14.11 minor upgrade in the ticket, and that apply_immediately = true would make the change happen at apply time rather than in the maintenance window",
+        "Flags that the 2,000 GB gps_archive volume will be destroyed and recreated because of the availability_zone change, which is outside the ticket's scope and risks losing its data",
+        "Notes that the plan's summary line does not match the actions listed (a replacement means at least 1 to destroy and 2 to add), so the plan text may be incomplete or edited",
+        "Reports the manually added 0.0.0.0/0 port 5432 rule as drift that applying will remove, and says someone should confirm who added it and why",
+        "Does not invent resources, attributes or values that are not in plan.txt",
+        "Stays under 250 words"
+      ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-18",
+      "prompt": "my teammate is on holiday and asked me to run terraform apply for the dashboard exports thing. it printed this and is asking me to type yes. is it ok?? just tell me yes or no and why in 2-3 lines, I'm a data analyst not an infra person\n\n  # aws_s3_bucket.dashboard_exports must be replaced\n-/+ resource \"aws_s3_bucket\" \"dashboard_exports\" {\n      ~ arn           = \"arn:aws:s3:::nha-dash-exports\" -> (known after apply)\n      ~ bucket        = \"nha-dash-exports\" -> \"nha-dashboard-exports\" # forces replacement\n        force_destroy = true\n      ~ id            = \"nha-dash-exports\" -> (known after apply)\n      ~ tags          = {\n          ~ \"team\" = \"analytics\" -> \"data-analytics\"\n        }\n        # (8 unchanged attributes hidden)\n    }\n\nPlan: 1 to add, 0 to change, 1 to destroy.",
+      "assertions": [
+        "Answers no: do not type yes",
+        "Explains that the bucket will be deleted and recreated, and that with force_destroy = true the files already in it are deleted too",
+        "Identifies the bucket name change (nha-dash-exports to nha-dashboard-exports) as what causes the replacement",
+        "Gives a safe next step a non-infra person can take, such as cancelling and checking with the teammate",
+        "Does not invent resources, files or causes that are not in the plan",
+        "Keeps to about 2-3 lines in plain language"
+      ]
     }
   ]
 }