skilldrop-cli 1.12.0 → 1.14.0

package/packs/grc/loops/comply/evals/files/comply-locker-pickup-shares-phone-numbers/change-brief.md

@@ -0,0 +1,19 @@
+# Change brief - locker pickup (Brindlecombe Grocers)
+
+**Launch:** 1 December 2026
+**Launch risk owner:** Marguerite Ashdown, Head of Fulfilment
+**Data protection officer:** Ravi Dellacourt
+**Product owner:** Imogen Sallow
+
+## What changes
+Customers of our online grocery can choose to collect from a parcel locker run by LockerLane Ltd
+(lockerlane.example). For each locker order we send LockerLane the customer's first name,
+surname, mobile number and order number. LockerLane texts the customer a one-time unlock code.
+
+LockerLane uses TextPigeon Inc. (textpigeon.example), based in the United States, to send the
+texts. So customer names and mobile numbers go to the US.
+
+Chilled and frozen items stay in a locker for at most 4 hours; after that LockerLane staff move
+them to a cold store and the customer must collect from the depot.
+
+Expected volume: about 3,000 locker orders a week in the first quarter.

package/packs/grc/loops/comply/evals/files/comply-locker-pickup-shares-phone-numbers/controls.md

@@ -0,0 +1,10 @@
+# Controls we are relying on
+
+| Id | Control | Evidence | Evidence status |
+|---|---|---|---|
+| C1 | Data processing agreement signed with LockerLane | contracts/dpa-lockerlane-signed.pdf, signed 20 Oct 2026 | Held |
+| C2 | Unlock codes expire 72 hours after issue | LockerLane API docs page, screenshot taken 28 Oct 2026 | Held |
+| C3 | LockerLane deletes customer data 30 days after pickup | "LockerLane said yes on the call" (3 Nov) | None in writing |
+| C4 | Access to the locker admin portal needs single sign-on plus MFA | Identity provider config export, 2 Nov 2026 | Held |
+| C5 | Transfer to TextPigeon covered by standard contractual clauses | Requested from LockerLane 4 Nov 2026 | Not received |
+| C6 | Chilled items moved to cold store after 4 hours | LockerLane operations manual, section 7 | Held |

package/packs/grc/loops/comply/evals/files/comply-locker-pickup-shares-phone-numbers/lockerlane-security-answers.md

@@ -0,0 +1,7 @@
+# LockerLane security questionnaire - their answers (received 30 Oct 2026)
+
+- Encryption at rest: "Yes, AES-256." No supporting report supplied.
+- Penetration testing: "Annual, by a third party." Report not shared; "available under NDA".
+- Sub-processors: TextPigeon Inc. (SMS, United States). No others listed.
+- Breach notification: "Within 72 hours of becoming aware."
+- Data retention: not answered.

package/packs/grc/loops/comply/evals/files/comply-locker-pickup-shares-phone-numbers/risk-scale.md

@@ -0,0 +1,17 @@
+# Risk scale (use this, not another one)
+
+Likelihood (L): 1 Rare, 2 Unlikely, 3 Possible, 4 Likely, 5 Almost certain
+Impact (I): 1 Negligible, 2 Minor, 3 Moderate, 4 Major, 5 Severe
+
+Score = L x I.
+
+| Score | Band |
+|---|---|
+| 1-4 | Low |
+| 5-9 | Medium |
+| 10-16 | High |
+| 20-25 | Very high |
+
+Inherent = before any control. Residual = after controls that have evidence.
+A control with no evidence does not reduce a rating.
+Any risk whose residual is High or Very high needs its owner's written acceptance.

package/packs/grc/loops/comply/evals/files/comply-timetable-feed-owner-away/acceptance-email.md

@@ -0,0 +1,14 @@
+From: Tomasz Weller <t.weller@tarnbrook-buses.example>
+To: Annika Rowe <a.rowe@tarnbrook-buses.example>
+Date: 6 Nov 2026
+Subject: FeedHarbour single region - risk acceptance
+
+Annika,
+
+I accept the risk that FeedHarbour hosts in a single region with no failover. If it goes down,
+journey planners will show stale times until it is back. We will keep the old server warm for 30
+days after go-live as the fallback. I want this reviewed in March 2027.
+
+This covers the single-region risk only. I'll look at the rest of the register when I'm back.
+
+Tomasz

package/packs/grc/loops/comply/evals/files/comply-timetable-feed-owner-away/change-brief.md

@@ -0,0 +1,16 @@
+# Change brief - move the open-data timetable feed to FeedHarbour (Tarnbrook Valley Buses)
+
+**Go-live:** 20 November 2026
+**Risk owner:** Tomasz Weller, Head of Digital (on leave until 24 November 2026)
+**Project lead:** Annika Rowe
+
+## What moves
+Our public open-data feed - timetables, stop locations and fares - moves from our own server to
+FeedHarbour (feedharbour.example), a hosted feed service. Journey-planner apps read the feed from
+FeedHarbour from go-live.
+
+No passenger or staff data goes to FeedHarbour. The feed is published under an open licence and
+anyone can download it. We push to FeedHarbour with a single service account whose key is held in
+our secrets vault.
+
+FeedHarbour hosts in one region with no failover.

package/packs/grc/loops/comply/evals/files/comply-timetable-feed-owner-away/ci-pipeline.yml.fixture

@@ -0,0 +1,17 @@
+# CI pipeline for the timetable feed (stored as a fixture)
+name: publish-feed
+on:
+  push:
+    branches: [main]
+jobs:
+  validate-and-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate feed
+        run: ./tools/validate_feed.sh build/feed.zip   # exits non-zero on any error
+      - name: Publish to FeedHarbour
+        if: success()
+        run: ./tools/publish.sh build/feed.zip
+        env:
+          FEEDHARBOUR_KEY: ${{ secrets.FEEDHARBOUR_KEY }}

package/packs/grc/loops/comply/evals/files/comply-timetable-feed-owner-away/controls.md

@@ -0,0 +1,8 @@
+# Controls
+
+| Id | Control | Evidence |
+|---|---|---|
+| C1 | Feed validated in CI before each publish; publish blocked on errors | ci-pipeline.yml.fixture |
+| C2 | Old server kept warm for 30 days after go-live | Change ticket CHG-2231, approved 5 Nov 2026 |
+| C3 | Automatic failover to a second FeedHarbour region | Planned; FeedHarbour says "on the roadmap" |
+| C4 | Service account key rotated every 90 days | Not yet set up |

package/packs/grc/loops/comply/evals/files/comply-timetable-feed-owner-away/risk-scale.md

@@ -0,0 +1,17 @@
+# Risk scale (use this, not another one)
+
+Likelihood (L): 1 Rare, 2 Unlikely, 3 Possible, 4 Likely, 5 Almost certain
+Impact (I): 1 Negligible, 2 Minor, 3 Moderate, 4 Major, 5 Severe
+
+Score = L x I.
+
+| Score | Band |
+|---|---|
+| 1-4 | Low |
+| 5-9 | Medium |
+| 10-16 | High |
+| 20-25 | Very high |
+
+Inherent = before any control. Residual = after controls that have evidence.
+A control with no evidence does not reduce a rating.
+Any risk whose residual is High or Very high needs its owner's written acceptance.

package/packs/grc/loops/comply/loop.json

@@ -1,7 +1,7 @@
 {
   "$comment": "RFC-0052. A change to a risk position its owner has signed. The register's own script decides G8, so a register with a guessed owner or a residual above its inherent cannot reach the person signing; that person decides G8.1, because accepting a risk is theirs alone.",
   "name": "comply",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Take a change that carries risk (a launch, a new vendor, a new use of personal data) to a risk position its owner has signed: a risk register scored inherent and residual, a DPIA when personal data is processed, the evidence behind every control the ratings rely on, a script that checks the register, and a sign-off only the named owner can give. Use when the user says \"get this ready for risk sign-off\", \"run the comply loop\", \"what do we need before we can launch this\", or needs a register, a DPIA and audit evidence that agree with each other.",
   "entrypoint": "LOOP.md",
   "kind": "loop",

package/packs/infra-as-code/loops/provision/LOOP.md

@@ -58,8 +58,20 @@ when the module was, and checks at apply time that nothing moved between review
    Only they choose the verdict. Never run `terraform apply` yourself in this loop.
 7. **Hand over the verdict and what apply will do.** Lead with what changes in plain words,
    what is destroyed or replaced, and the checks to do first. The review goes underneath.
-   Close with each gate on its own line, `G13: <VERDICT>` and `G13.1: <VERDICT>` (or
-   `G13.1: awaiting <role>`), and one sentence of reasons.
+
+## What the reply says
+
+- **Lead with what was asked for, in plain words:** what the change does in plain words, what is destroyed or replaced, and the checks to do before apply. The review goes underneath.
+- **No loop internals.** No gate id, verdict word, stage or skill name, and no path inside a
+  skill folder, in the reply or in any file the person receives. Say the outcome instead:
+  ✅ *"Safe to apply after one fix: the plan replaces the billing database because its engine version changed. Pin it and re-plan"* — ❌ *"G13: REVISE"*.
+- **The verdict goes to the run log only,** when one is set. The reply never mentions the run
+  log, whether it is set, or how the run was set up.
+- **A person's decision never holds back the work.** Deliver everything up to it, then name
+  the decision in one line: who makes it, and what each answer means. When the request
+  already holds their decision ("the platform lead approved this plan"), record it as theirs and carry on.
+- **Stop only when nothing can be made.** With an essential input missing, the first line says
+  in plain words what's missing, then what you'll produce once it arrives.
 
 ## Verdicts
 
@@ -84,9 +96,10 @@ so the change needs a person to rethink it.
 ## Non-interactive runs
 
 Missing provider or Terraform versions degrade to `terraform-module`'s `[assumption]` tags.
-With no plan and no way to run one, the loop ends after `module` with
-`G13: BLOCKED: need a saved plan (terraform plan -out=tfplan, then terraform show -json tfplan)`.
-G13.1 always stops at the person who runs apply.
+With no plan and no way to run one, deliver the module and the scope, and say plainly that the
+review needs a saved plan, with the two commands that make one (`terraform plan -out=tfplan`,
+then `terraform show -json tfplan`). Apply is always the person's: deliver the review and the
+checks, and name their decision.
 
 ## When a stage's skill is not installed
 
@@ -101,6 +114,7 @@ G13.1.
 Only when the environment variable `SKILLDROP_LOOP_LOG` is set to a file path: after each
 gate's verdict, append one JSON line to that file. Nothing else is recorded, and nothing is
 sent anywhere. When the variable isn't set, or you can't read it, skip this section.
+The reply never mentions the run log, whether or not it is set.
 
 ```bash
 printf '%s\n' '{"ts":"2026-11-03T10:15:00Z","loop":"provision","stage":"plan","gate":"G13","verdict":"REVISE","round":1}' >> "$SKILLDROP_LOOP_LOG"
@@ -126,3 +140,4 @@ The log holds verdicts only: never resource names, plan contents or values.
 - ❌ **Passing G13 because the destroy is "probably fine".** A stateful destroy without a confirmed backup is `DO NOT APPLY`, and the loop maps it to `REVISE` or `RECONSIDER`.
 - ❌ **Applying a fresh plan after reviewing an old one.** Anything merged in between is unreviewed.
 - ❌ **Treating `RECONSIDER` as a bigger `REVISE`.** A change that has to replace state is a migration; another module edit won't make it safe.
+- ❌ **Gate talk in the reply.** "G9: READY, G9.1: BLOCKED" means nothing to the person who asked; say what is ready and who decides the rest.

package/packs/infra-as-code/loops/provision/evals/evals.json

@@ -62,6 +62,36 @@
         "Treats the revised module as needing a fresh plan: does not reach the apply check or approve applying this afternoon, and gives the commands to re-plan",
         "Does not invent facts not in the inputs, such as a recent manual snapshot existing, the replica needing public access, or changes plan.json does not contain"
       ]
+    },
+    {
+      "id": "provision-order-events-queue",
+      "held_out": "2026-11-12",
+      "prompt": "Run the provision loop on the order events queue. The need is in need.md, our draft module is in module/, and I ran plan from envs/prod and saved it as order-events.tfplan. The JSON is plan.json. Rui will approve the apply. Tell me if it's good to go and exactly what to run.",
+      "assertions": [
+        "The reply opens by saying in plain words that the plan only creates what the need asks for and can go to Rui Okafor for approval. The detail comes after that",
+        "It checks the module against the need: a KMS key with rotation on, 4-day retention, a 14-day DLQ, redrive after 5 receives, a 60-second visibility timeout, and a queue policy limited to the orders-created topic by aws:SourceArn",
+        "It lists all five resources in the plan as creates and says there are no destroys, replaces or in-place updates",
+        "It confirms that nothing widens access: SendMessage and the KMS grants go only to sns.amazonaws.com, conditioned on the topic ARN, and the fulfilment-worker role is untouched, as the need asks",
+        "It says to apply the saved planfile (terraform apply order-events.tfplan), not to run a fresh apply. It also says to check, just before applying, that the planfile is still the one that was reviewed",
+        "Any change it suggests to the module is marked as optional or as needing a new plan and review, not slipped in under the reviewed plan",
+        "It does not run apply or claim to have run it, and it leaves the approval to Rui",
+        "It does not invent resources, attribute values or findings that are not in the module or plan, such as drift, a replacement or a resource that isn't there"
+      ]
+    },
+    {
+      "id": "provision-reporting-role-widens-s3",
+      "held_out": "2026-11-12",
+      "prompt": "The plan for the reporting role is all creates, nothing destroyed, so I'd like to apply it tonight. The need is need.md, the module is in module/, and plan.json is from ledger-report.tfplan. Run the provision loop and confirm it's OK.",
+      "assertions": [
+        "The reply opens by saying plainly not to apply this plan tonight, because it gives the job write and delete access to every bucket. The detail comes after that",
+        "It names the widening from the plan's policy: s3:PutObject and s3:DeleteObject on arn:aws:s3:::* and arn:aws:s3:::*/*, when the need is read-only on ledger-exports-example/monthly/",
+        "It traces the problem to the module's defaults for bucket_arns and actions, which the root call left in place. It fixes the module's defaults rather than only patching the root call",
+        "The revised module allows s3:GetObject only on arn:aws:s3:::ledger-exports-example/monthly/* and s3:ListBucket only on the bucket, with an s3:prefix condition for monthly/. It grants no write or delete",
+        "It explains that a plan with only creates can still be unsafe, because a new grant widens access even when nothing is destroyed",
+        "It says ledger-report.tfplan must not be applied and that the changed module needs a new plan and a fresh review before anyone applies it",
+        "It does not apply anything or present the change as approved by Hana Sorensen",
+        "It does not invent buckets, resources or access needs that are not in the need or plan, such as a KMS key or a second bucket"
+      ]
     }
   ]
 }

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/module/main.tf

@@ -0,0 +1,94 @@
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+locals {
+  tags      = merge(var.tags, { module = "order-events-queue" })
+  queue_arn = "arn:aws:sqs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:${var.name}"
+}
+
+resource "aws_kms_key" "queue" {
+  description             = "${var.name} queue encryption"
+  enable_key_rotation     = true
+  deletion_window_in_days = 30
+  policy                  = data.aws_iam_policy_document.key.json
+  tags                    = local.tags
+}
+
+data "aws_iam_policy_document" "key" {
+  statement {
+    sid = "AccountAdmin"
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
+    }
+    actions   = ["kms:*"]
+    resources = ["*"]
+  }
+
+  statement {
+    sid = "AllowSourceTopic"
+    principals {
+      type        = "Service"
+      identifiers = ["sns.amazonaws.com"]
+    }
+    actions   = ["kms:GenerateDataKey", "kms:Decrypt"]
+    resources = ["*"]
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [var.source_topic_arn]
+    }
+  }
+}
+
+resource "aws_sqs_queue" "dlq" {
+  name                              = "${var.name}-dlq"
+  message_retention_seconds         = var.dlq_retention_seconds
+  kms_master_key_id                 = aws_kms_key.queue.arn
+  kms_data_key_reuse_period_seconds = 300
+  tags                              = local.tags
+}
+
+resource "aws_sqs_queue" "main" {
+  name                              = var.name
+  message_retention_seconds         = var.retention_seconds
+  visibility_timeout_seconds        = var.visibility_timeout_seconds
+  kms_master_key_id                 = aws_kms_key.queue.arn
+  kms_data_key_reuse_period_seconds = 300
+
+  redrive_policy = jsonencode({
+    deadLetterTargetArn = aws_sqs_queue.dlq.arn
+    maxReceiveCount     = var.max_receive_count
+  })
+
+  tags = local.tags
+}
+
+data "aws_iam_policy_document" "queue" {
+  statement {
+    sid = "AllowSourceTopicSend"
+    principals {
+      type        = "Service"
+      identifiers = ["sns.amazonaws.com"]
+    }
+    actions   = ["sqs:SendMessage"]
+    resources = [local.queue_arn]
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [var.source_topic_arn]
+    }
+  }
+}
+
+resource "aws_sqs_queue_policy" "main" {
+  queue_url = aws_sqs_queue.main.id
+  policy    = data.aws_iam_policy_document.queue.json
+}
+
+resource "aws_sns_topic_subscription" "main" {
+  topic_arn            = var.source_topic_arn
+  protocol             = "sqs"
+  endpoint             = aws_sqs_queue.main.arn
+  raw_message_delivery = true
+}

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/module/outputs.tf

@@ -0,0 +1,19 @@
+output "queue_arn" {
+  description = "ARN of the main queue."
+  value       = aws_sqs_queue.main.arn
+}
+
+output "queue_url" {
+  description = "URL of the main queue."
+  value       = aws_sqs_queue.main.id
+}
+
+output "dlq_arn" {
+  description = "ARN of the dead-letter queue."
+  value       = aws_sqs_queue.dlq.arn
+}
+
+output "kms_key_arn" {
+  description = "ARN of the KMS key encrypting both queues."
+  value       = aws_kms_key.queue.arn
+}

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/module/variables.tf

@@ -0,0 +1,69 @@
+variable "name" {
+  description = "Name of the main queue. The DLQ is named <name>-dlq."
+  type        = string
+
+  validation {
+    condition     = can(regex("^[A-Za-z0-9_-]{1,76}$", var.name))
+    error_message = "name must be 1-76 characters: letters, numbers, hyphens or underscores."
+  }
+}
+
+variable "source_topic_arn" {
+  description = "ARN of the SNS topic allowed to send to the queue."
+  type        = string
+
+  validation {
+    condition     = can(regex("^arn:aws:sns:[a-z0-9-]+:[0-9]{12}:[A-Za-z0-9_-]+$", var.source_topic_arn))
+    error_message = "source_topic_arn must be an SNS topic ARN."
+  }
+}
+
+variable "retention_seconds" {
+  description = "How long the main queue keeps messages."
+  type        = number
+  default     = 345600
+
+  validation {
+    condition     = var.retention_seconds >= 60 && var.retention_seconds <= 1209600
+    error_message = "retention_seconds must be between 60 and 1209600."
+  }
+}
+
+variable "dlq_retention_seconds" {
+  description = "How long the DLQ keeps messages."
+  type        = number
+  default     = 1209600
+
+  validation {
+    condition     = var.dlq_retention_seconds >= 60 && var.dlq_retention_seconds <= 1209600
+    error_message = "dlq_retention_seconds must be between 60 and 1209600."
+  }
+}
+
+variable "visibility_timeout_seconds" {
+  description = "Visibility timeout for the main queue."
+  type        = number
+  default     = 60
+
+  validation {
+    condition     = var.visibility_timeout_seconds >= 0 && var.visibility_timeout_seconds <= 43200
+    error_message = "visibility_timeout_seconds must be between 0 and 43200."
+  }
+}
+
+variable "max_receive_count" {
+  description = "Failed receives before a message moves to the DLQ."
+  type        = number
+  default     = 5
+
+  validation {
+    condition     = var.max_receive_count >= 1 && var.max_receive_count <= 1000
+    error_message = "max_receive_count must be between 1 and 1000."
+  }
+}
+
+variable "tags" {
+  description = "Tags merged onto every resource."
+  type        = map(string)
+  default     = {}
+}

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/module/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.70"
+    }
+  }
+}

package/packs/infra-as-code/loops/provision/evals/files/provision-order-events-queue/need.md

@@ -0,0 +1,47 @@
+# Need: order events queue
+
+**Team:** Fulfilment platform, Quillfield Goods (fictional)
+**Environment:** prod, eu-west-2, account 111122223333
+**Apply approver:** Rui Okafor, platform on-call
+
+## What we need
+
+An SQS queue that receives order-created events from the existing SNS topic
+`arn:aws:sns:eu-west-2:111122223333:orders-created`.
+
+- Queue name: `order-events`
+- Keep messages for 4 days.
+- After 5 failed receives, move the message to a dead-letter queue `order-events-dlq`. Keep DLQ messages for 14 days.
+- Visibility timeout 60 seconds (the worker takes up to 40 seconds per message).
+- Encrypt both queues with a customer-managed KMS key, rotation on.
+- Only the orders-created topic may send to the queue.
+- Raw message delivery on the subscription.
+
+## Not in this change
+
+The consumer role (`arn:aws:iam::111122223333:role/fulfilment-worker`) gets its permissions to read the queue in a separate change next week. Nothing in this change should touch it.
+
+## How the module is called
+
+`envs/prod/main.tf`:
+
+```hcl
+module "order_events" {
+  source           = "../../modules/order-events-queue"
+  name             = "order-events"
+  source_topic_arn = "arn:aws:sns:eu-west-2:111122223333:orders-created"
+  tags = {
+    team        = "fulfilment"
+    cost-centre = "cc-4410"
+  }
+}
+```
+
+## Plan
+
+Run from `envs/prod`:
+
+```
+terraform plan -out=order-events.tfplan
+terraform show -json order-events.tfplan > plan.json
+```