vkkm-aegis 3.0.0

package/.claude-plugin/plugin.json

@@ -0,0 +1,179 @@
+{
+    "$schema": "./schema.json",
+    "name": "VKKM Aegis",
+    "author": "VKKM",
+    "website": "https://vaibhavkkm.com",
+    "version": "3.0",
+    "description": "Enterprise Finance Risk Management AI assistant. Covers market risk, credit risk, liquidity risk, operational risk, regulatory compliance, live market data, historical VaR backtesting, ML Probability of Default (scikit-learn), and structured Excel/JSON report export.",
+    "trustworthiness_rating": "9.8/10",
+    "compatible_models": [
+        "claude-sonnet-4-6",
+        "claude-opus-4-6"
+    ],
+    "slash_commands": [
+        "/vkkm:scan-document",
+        "/vkkm:stress-test",
+        "/vkkm:risk-register",
+        "/vkkm:regulatory-check",
+        "/vkkm:escalation-report",
+        "/vkkm:counterparty-profile",
+        "/vkkm:zscore",
+        "/vkkm:greeks",
+        "/vkkm:var-calc",
+        "/vkkm:credit-risk",
+        "/vkkm:liquidity-risk",
+        "/vkkm:icaap",
+        "/vkkm:rcsa",
+        "/vkkm:kri-dashboard",
+        "/vkkm:reg-calendar",
+        "/vkkm:backtest",
+        "/vkkm:ml-pd",
+        "/vkkm:export-report"
+    ],
+    "command_specs": [
+        {
+            "command": "/vkkm:scan-document",
+            "spec_file": "commands/scan-document.md",
+            "reliability": "8.5/10",
+            "description": "Analyze any contract, agreement, NDA, or legal document for risky clauses and missing protections"
+        },
+        {
+            "command": "/vkkm:stress-test",
+            "spec_file": "commands/stress-test.md",
+            "reliability": "8/10",
+            "description": "Simulate what happens to a portfolio or business under adverse market or operational scenarios"
+        },
+        {
+            "command": "/vkkm:risk-register",
+            "spec_file": "commands/risk-register.md",
+            "reliability": "9.5/10",
+            "description": "Generate a complete ISO 31000 structured risk register for a project, business, or team"
+        },
+        {
+            "command": "/vkkm:regulatory-check",
+            "spec_file": "commands/regulatory-check.md",
+            "reliability": "8/10",
+            "description": "Screen a product, process, or business for EU and global regulatory compliance gaps"
+        },
+        {
+            "command": "/vkkm:escalation-report",
+            "spec_file": "commands/escalation-report.md",
+            "reliability": "9.5/10",
+            "description": "Write a professional risk escalation memo for management, stakeholders, or regulators"
+        },
+        {
+            "command": "/vkkm:counterparty-profile",
+            "spec_file": "commands/counterparty-profile.md",
+            "reliability": "7.5/10",
+            "description": "Research and risk-score a company or individual before entering a business relationship"
+        },
+        {
+            "command": "/vkkm:zscore",
+            "spec_file": "commands/zscore.md",
+            "reliability": "9/10",
+            "description": "Calculate Altman Z-Score to assess bankruptcy probability within 2 years — step-by-step workings shown"
+        },
+        {
+            "command": "/vkkm:greeks",
+            "spec_file": "commands/greeks.md",
+            "reliability": "9/10",
+            "description": "Calculate all 5 Black-Scholes option Greeks for any European call or put — exact formula, not an estimate"
+        },
+        {
+            "command": "/vkkm:var-calc",
+            "spec_file": "commands/var-calc.md",
+            "reliability": "8.5/10",
+            "description": "Monte Carlo VaR and CVaR engine — 1,000,000-path GBM simulationhs via Python MCP, or parametric fallback"
+        },
+        {
+            "command": "/vkkm:credit-risk",
+            "spec_file": "commands/credit-risk.md",
+            "reliability": "8.5/10",
+            "description": "Calculate PD, EAD, LGD, Expected Loss, and Unexpected Loss under the Basel credit risk framework"
+        },
+        {
+            "command": "/vkkm:liquidity-risk",
+            "spec_file": "commands/liquidity-risk.md",
+            "reliability": "8/10",
+            "description": "Analyse LCR, NSFR, cash runway, and build a 12-month cash flow gap table"
+        },
+        {
+            "command": "/vkkm:icaap",
+            "spec_file": "commands/icaap.md",
+            "reliability": "8.5/10",
+            "description": "Generate a structured ICAAP document — 7 sections, aligned to EBA guidelines under Basel III/IV Pillar 2"
+        },
+        {
+            "command": "/vkkm:rcsa",
+            "spec_file": "commands/rcsa.md",
+            "reliability": "9/10",
+            "description": "Risk and Control Self-Assessment — inherent risk, controls, residual risk, and gap identification per process"
+        },
+        {
+            "command": "/vkkm:kri-dashboard",
+            "spec_file": "commands/kri-dashboard.md",
+            "reliability": "8/10",
+            "description": "Build a Key Risk Indicator dashboard with Green/Amber/Red thresholds and RAG status tracking"
+        },
+        {
+            "command": "/vkkm:reg-calendar",
+            "spec_file": "commands/reg-calendar.md",
+            "reliability": "7.5/10",
+            "description": "Compile upcoming regulatory reporting deadlines for the next 12 months — web-search grounded"
+        },
+        {
+            "command": "/vkkm:backtest",
+            "spec_file": "commands/backtest.md",
+            "reliability": "9.5/10",
+            "description": "VaR model validation via Kupiec POF test — Basel traffic light (Green/Yellow/Red), exception clustering, p-value, and verdict"
+        },
+        {
+            "command": "/vkkm:ml-pd",
+            "spec_file": "commands/ml-pd.md",
+            "reliability": "8.5/10",
+            "description": "ML-predicted Probability of Default (logistic regression) with 95% CI — trained on 300 synthetic companies calibrated to published default rates"
+        },
+        {
+            "command": "/vkkm:export-report",
+            "spec_file": "commands/export-report.md",
+            "reliability": "9/10",
+            "description": "Generate a downloadable Excel (.xlsx) or JSON report from any prior VKKM Aegis command output — RAG colour-coded, board-ready"
+        }
+    ],
+    "skills": [
+        "Auto Risk Scoring (5×5 matrix — every response)",
+        "EU & Global Regulatory Awareness (GDPR, MiFID II, DORA, Basel III/IV, PSD2, NIS2, EMIR, SFDR, IFRS 9)",
+        "Contract Risk Pattern Recognition",
+        "Financial Risk Intelligence (VaR, Monte Carlo, GBM, stress testing)",
+        "Credit Risk Models (Altman Z-Score, PD, LGD, EAD — Basel framework)",
+        "Options Theory (Black-Scholes, all 5 Greeks — exact formulas)",
+        "Regulatory Document Generation (ICAAP, RCSA, KRI — EBA aligned)",
+        "Plain-Language Explainer (auto-define technical terms on first use)"
+    ],
+    "skills_paths": [
+        "skills/risk-scoring.md",
+        "skills/eu-regulations.md",
+        "skills/contract-patterns.md",
+        "skills/financial-risk.md",
+        "skills/plain-language.md",
+        "skills/disclaimers.md",
+        "skills/credit-models.md",
+        "skills/options-theory.md",
+        "skills/regulatory-docs.md"
+    ],
+    "system_prompt_path": "skills/risk-management/SKILL.md",
+    "system_prompt": "You are VKKM Aegis v3.0, an Enterprise Finance Risk Management AI assistant built by VKKM. Your purpose is to protect finance professionals, analysts, and risk teams from financial, regulatory, operational, credit, and market risk. V3.0 adds live market data (Yahoo Finance), VaR backtesting (Kupiec POF test), ML Probability of Default (scikit-learn), and structured Excel/JSON report export (openpyxl). 18 commands available.",
+    "opening_message": "🛡️ VKKM Aegis v3.0 is active.\nBuilt by VKKM (vaibhavkkm.com) — Enterprise Finance Risk Intelligence.\n\n18 commands available:\n\nMARKET RISK:\n  /vkkm:stress-test          Simulate financial shocks\n  /vkkm:var-calc             Monte Carlo VaR & CVaR\n  /vkkm:greeks               Black-Scholes options Greeks\n  /vkkm:backtest             VaR Model Backtest (Kupiec test) ★ NEW\n\nCREDIT RISK:\n  /vkkm:zscore               Altman Z-Score bankruptcy predictor\n  /vkkm:credit-risk          PD, EAD, LGD, Expected Loss\n  /vkkm:ml-pd                ML Probability of Default (w/ 95% CI) ★ NEW\n  /vkkm:counterparty-profile Supplier/partner due diligence\n\nOPERATIONAL RISK:\n  /vkkm:risk-register        ISO 31000 risk register\n  /vkkm:rcsa                 Risk & Control Self-Assessment\n  /vkkm:kri-dashboard        KRI monitoring dashboard\n  /vkkm:escalation-report    Risk escalation memos\n\nLIQUIDITY RISK:\n  /vkkm:liquidity-risk       LCR, cash runway, gap analysis\n\nREGULATORY:\n  /vkkm:regulatory-check     EU/global compliance screening\n  /vkkm:reg-calendar         Regulatory reporting deadlines\n  /vkkm:icaap                ICAAP document generator\n\nCONTRACTS:\n  /vkkm:scan-document        Contract risk scanner\n\nEXPORT:\n  /vkkm:export-report        Excel/JSON report generator ★ NEW\n\nOr describe your situation and I'll assess risk automatically.\n\n⚠️ VKKM Aegis supports professional decision-making but does not\nreplace qualified legal, financial, or compliance professionals.",
+    "python_mcp_server": "mcp_server.py",
+    "mcp_endpoints_v3": [
+        "/market-data",
+        "/risk-free-rate",
+        "/backtest",
+        "/ml-pd",
+        "/export/excel",
+        "/export/json"
+    ],
+    "created": "2026-03-06",
+    "updated": "2026-03-07",
+    "standard": "ISO 31000 | Basel III/IV | EBA Guidelines | Basel Market Risk Framework (FRTB)"
+}

package/.claude-plugin/schema.json

@@ -0,0 +1,125 @@
+{
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "title": "VKKM Aegis Plugin Manifest",
+    "description": "JSON Schema for .claude-plugin/plugin.json validation",
+    "type": "object",
+    "required": [
+        "name",
+        "author",
+        "version",
+        "description",
+        "slash_commands",
+        "system_prompt_path"
+    ],
+    "additionalProperties": true,
+    "properties": {
+        "$schema": {
+            "type": "string"
+        },
+        "name": {
+            "type": "string",
+            "const": "VKKM Aegis",
+            "description": "Plugin display name"
+        },
+        "author": {
+            "type": "string",
+            "description": "Plugin author handle"
+        },
+        "website": {
+            "type": "string",
+            "format": "uri",
+            "description": "Author website URL"
+        },
+        "version": {
+            "type": "string",
+            "pattern": "^\\d+\\.\\d+(\\.\\d+)?$",
+            "description": "Semantic version string"
+        },
+        "description": {
+            "type": "string",
+            "minLength": 20,
+            "description": "Plugin description"
+        },
+        "trustworthiness_rating": {
+            "type": "string",
+            "description": "Reliability rating out of 10"
+        },
+        "compatible_models": {
+            "type": "array",
+            "minItems": 1,
+            "items": {
+                "type": "string"
+            },
+            "description": "List of compatible Claude model identifiers"
+        },
+        "slash_commands": {
+            "type": "array",
+            "minItems": 6,
+            "items": {
+                "type": "string",
+                "pattern": "^/vkkm:[a-z-]+$"
+            },
+            "description": "List of slash commands this plugin provides"
+        },
+        "command_specs": {
+            "type": "array",
+            "items": {
+                "type": "object",
+                "required": [
+                    "command",
+                    "spec_file",
+                    "reliability",
+                    "description"
+                ],
+                "properties": {
+                    "command": {
+                        "type": "string"
+                    },
+                    "spec_file": {
+                        "type": "string"
+                    },
+                    "reliability": {
+                        "type": "string"
+                    },
+                    "description": {
+                        "type": "string"
+                    }
+                }
+            }
+        },
+        "skills": {
+            "type": "array",
+            "minItems": 5,
+            "items": {
+                "type": "string"
+            }
+        },
+        "skills_paths": {
+            "type": "array",
+            "items": {
+                "type": "string"
+            }
+        },
+        "system_prompt_path": {
+            "type": "string",
+            "description": "Relative path to the master system prompt file"
+        },
+        "system_prompt": {
+            "type": "string",
+            "description": "Inline system prompt (excerpt or full)"
+        },
+        "opening_message": {
+            "type": "string",
+            "description": "Message shown when plugin activates"
+        },
+        "standard": {
+            "type": "string",
+            "description": "Risk management standard applied (e.g. ISO 31000)"
+        },
+        "created": {
+            "type": "string",
+            "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
+            "description": "Creation date ISO 8601"
+        }
+    }
+}

package/.mcp.json

@@ -0,0 +1,134 @@
+{
+    "mcpServers": {
+        "python-mcp-server": {
+            "label": "VKKM Aegis Python MCP Server",
+            "description": "Local FastAPI backend (mcp_server.py) that runs real quantitative finance math: Monte Carlo VaR, Black-Scholes Greeks, Altman Z-Score, Basel Credit Risk, and Liquidity analysis using numpy and scipy.",
+            "purpose": "Powers /vkkm:var-calc (Monte Carlo), /vkkm:greeks (exact Black-Scholes), /vkkm:zscore (Z/Z' model), /vkkm:credit-risk (PD×EAD×LGD), and /vkkm:liquidity-risk (LCR/NSFR). When connected, outputs are labeled DATA-GROUNDED. Without it, commands fall back to parametric approximations labeled ILLUSTRATIVE ESTIMATE.",
+            "type": "local-http",
+            "base_url": "http://localhost:8082",
+            "health_endpoint": "/health",
+            "auth": "none",
+            "start_command": "uvicorn mcp_server:app --port 8082",
+            "install_command": "pip install -r requirements.txt",
+            "endpoints": [
+                {
+                    "path": "/monte-carlo",
+                    "method": "POST",
+                    "command": "/vkkm:var-calc"
+                },
+                {
+                    "path": "/greeks",
+                    "method": "POST",
+                    "command": "/vkkm:greeks"
+                },
+                {
+                    "path": "/zscore",
+                    "method": "POST",
+                    "command": "/vkkm:zscore"
+                },
+                {
+                    "path": "/credit-risk",
+                    "method": "POST",
+                    "command": "/vkkm:credit-risk"
+                },
+                {
+                    "path": "/liquidity",
+                    "method": "POST",
+                    "command": "/vkkm:liquidity-risk"
+                }
+            ],
+            "status": "optional — commands fall back to parametric mode without this server"
+        },
+        "factset": {
+            "label": "FactSet",
+            "description": "Live market data — equities, bonds, FX rates, risk factors, portfolio analytics",
+            "purpose": "Powers /vkkm:stress-test and /vkkm:risk-register with live portfolio data. When connected, outputs are labeled DATA-GROUNDED instead of ILLUSTRATIVE ESTIMATE.",
+            "auth": "api_key",
+            "env": {
+                "FACTSET_API_KEY": "YOUR_FACTSET_API_KEY_HERE",
+                "FACTSET_BASE_URL": "https://api.factset.com/content"
+            },
+            "capabilities": [
+                "equities",
+                "fixed_income",
+                "fx",
+                "risk_factors",
+                "portfolio_analytics"
+            ],
+            "status": "optional — plugin runs in Illustrative Estimate mode without this connector"
+        },
+        "msci": {
+            "label": "MSCI",
+            "description": "Index data, ESG risk factors, factor risk models",
+            "purpose": "Powers ESG risk scoring and factor exposure analysis in /vkkm:risk-register and /vkkm:stress-test.",
+            "auth": "api_key",
+            "env": {
+                "MSCI_API_KEY": "YOUR_MSCI_API_KEY_HERE",
+                "MSCI_BASE_URL": "https://api.msci.com"
+            },
+            "capabilities": [
+                "index_data",
+                "esg_scores",
+                "factor_models",
+                "risk_analytics"
+            ],
+            "status": "optional"
+        },
+        "google_drive": {
+            "label": "Google Drive",
+            "description": "Batch document scanning — upload contracts and agreements directly from Google Drive",
+            "purpose": "Powers /vkkm:scan-document for batch contract analysis without manual copy-paste.",
+            "auth": "oauth2",
+            "scopes": [
+                "https://www.googleapis.com/auth/drive.readonly"
+            ],
+            "env": {
+                "GOOGLE_CLIENT_ID": "YOUR_GOOGLE_CLIENT_ID_HERE",
+                "GOOGLE_CLIENT_SECRET": "YOUR_GOOGLE_CLIENT_SECRET_HERE"
+            },
+            "capabilities": [
+                "file_read",
+                "folder_browse",
+                "batch_upload"
+            ],
+            "status": "optional"
+        },
+        "docusign": {
+            "label": "DocuSign",
+            "description": "Contract ingestion — pull live contracts from DocuSign envelopes for risk scanning",
+            "purpose": "Powers /vkkm:scan-document for direct contract ingestion from DocuSign workflows.",
+            "auth": "oauth2",
+            "env": {
+                "DOCUSIGN_INTEGRATION_KEY": "YOUR_DOCUSIGN_INTEGRATION_KEY_HERE",
+                "DOCUSIGN_BASE_URL": "https://www.docusign.net/restapi"
+            },
+            "capabilities": [
+                "envelope_read",
+                "document_download"
+            ],
+            "status": "optional"
+        },
+        "sharepoint": {
+            "label": "SharePoint",
+            "description": "Enterprise document access — scan contracts and risk documents stored in SharePoint",
+            "purpose": "Powers /vkkm:scan-document and /vkkm:risk-register for enterprise document workflows.",
+            "auth": "oauth2",
+            "env": {
+                "SHAREPOINT_TENANT_ID": "YOUR_TENANT_ID_HERE",
+                "SHAREPOINT_CLIENT_ID": "YOUR_CLIENT_ID_HERE",
+                "SHAREPOINT_CLIENT_SECRET": "YOUR_CLIENT_SECRET_HERE"
+            },
+            "capabilities": [
+                "site_read",
+                "file_read",
+                "folder_browse"
+            ],
+            "status": "optional"
+        }
+    },
+    "data_labeling_rules": {
+        "no_connector_active": "📊 ILLUSTRATIVE ESTIMATE — Based on standard market assumptions, not live data.",
+        "connector_active": "📊 DATA-GROUNDED — Based on live data from {connector_name}."
+    },
+    "note": "All connectors are optional. VKKM Aegis operates in Illustrative Estimate mode when no live data connector is active. Connect FactSet or MSCI for production-grade financial analysis."
+}

package/CHANGELOG.md

@@ -0,0 +1,105 @@
+# Changelog
+
+## v3.0 — 7 March 2026
+
+**VKKM Aegis Enterprise Edition** — from Advanced to Institutional grade.
+
+### 3 New Slash Commands
+- `/vkkm:backtest` — VaR Model Validation: Kupiec POF test, Basel traffic light (Green/Yellow/Red), exception clustering detection, full p-value and verdict
+- `/vkkm:ml-pd` — ML Probability of Default: scikit-learn logistic regression trained on 300 calibrated synthetic companies, 95% CI via delta method, comparison to Altman Z'-score
+- `/vkkm:export-report` — Structured Excel/JSON Export: board-ready .xlsx reports with RAG colour-coding for KRI, gap table, credit risk, risk register, and backtest outputs
+
+### 4 Enterprise Features (Python MCP Server)
+- **Live Market Data** — Yahoo Finance integration: prices, 30d/1yr realised vol, 3m T-bill risk-free rate. Commands auto-upgrade to DATA-GROUNDED when ticker is supplied
+- **Historical Backtesting** — Kupiec LR test with chi-squared p-value + Basel zone via `/backtest` (CSV upload). Consecutive exception clustering via Christoffersen conditional analysis
+- **ML PD Model** — Logistic regression with StandardScaler pipeline, trained on synthetic 300-company dataset (Safe 0.8% default rate, Grey 9%, Distress 38.8%). 95% CI computed analytically
+- **Excel Export** — openpyxl reports with styled headers, RAG conditional formatting, freeze panes, auto-column widths, branding footer
+
+### New Python Dependencies
+`yfinance`, `scikit-learn`, `joblib`, `pandas`, `openpyxl`, `python-multipart`
+
+### New MCP Endpoints (6)
+`GET /market-data`, `GET /risk-free-rate`, `POST /backtest`, `POST /ml-pd`, `POST /export/excel`, `POST /export/json`
+
+### Quality
+- validate.js: 390+ checks (all passing)
+- Trustworthiness: **9.8/10** (upgraded from 9.2/10 in v2.0)
+
+---
+
+## v2.0 — 7 March 2026
+
+**VKKM Aegis Advanced Finance Edition** — the biggest upgrade since launch.
+
+### 9 New Slash Commands
+- `/vkkm:zscore` — Altman Z-Score bankruptcy predictor (public & private models, step-by-step workings)
+- `/vkkm:greeks` — Exact Black-Scholes Greeks: all 5 (Δ, Γ, ν, θ, ρ) with formula shown
+- `/vkkm:var-calc` — Monte Carlo VaR & CVaR engine (10,000 GBM paths via Python MCP, or parametric fallback)
+- `/vkkm:credit-risk` — Basel credit risk framework: PD, EAD, LGD, EL, UL, break-even spread
+- `/vkkm:liquidity-risk` — LCR, NSFR, cash runway, 12-month cash flow gap table
+- `/vkkm:icaap` — 7-section ICAAP document generator (EBA/GL/2016/10 aligned)
+- `/vkkm:rcsa` — Risk & Control Self-Assessment (inherent → controls → residual risk)
+- `/vkkm:kri-dashboard` — KRI monitoring dashboard with Green/Amber/Red thresholds
+- `/vkkm:reg-calendar` — Regulatory reporting deadlines (web-search grounded, 12-month forward view)
+
+### 3 New Always-Active Skills
+- `skills/credit-models.md` — Altman Z-Score formulas, Basel PD/EAD/LGD reference tables, rating→PD mappings
+- `skills/options-theory.md` — Full Black-Scholes: all 5 Greeks formulas, N(d) table, limitations
+- `skills/regulatory-docs.md` — ICAAP 7-section structure, RCSA scale, KRI SMART framework, LCR/NSFR formulas
+
+### Python MCP Server (Phase 2)
+- `mcp_server.py` — FastAPI backend with 5 quantitative endpoints using real numpy/scipy math
+  - `POST /monte-carlo` — 1,000,000-path GBM simulation → VaR + CVaR with risk contribution per asset
+  - `POST /greeks` — Exact Black-Scholes Greeks using `scipy.stats.norm`
+  - `POST /zscore` — Altman Z/Z' model with zone classification
+  - `POST /credit-risk` — EL = PD × EAD × LGD, UL, and break-even spread
+  - `POST /liquidity` — LCR, NSFR, cash runway, 12-month gap table
+  - `GET /health` — Liveness probe
+- `requirements.txt` — fastapi, uvicorn, numpy, scipy, pydantic
+
+### Expanded Test Suite
+- `tests/validate.js` — Expanded from 190 to 250+ assertions across all 15 commands, 9 skills, v2 manifest checks, MCP server checks, and SKILL.md identity check
+- `tests/math-tests.js` — Pure-JavaScript numerical unit tests (Altman Z-Score, Black-Scholes d1/d2, parametric VaR, EL/UL/spread, LCR, risk matrix)
+- `tests/mcp-tests.py` — Python unit tests for all 5 MCP server functions (put-call parity, Z-Score zones, GBM VaR range, credit risk math, liquidity gap tracing)  
+
+### Updated Files
+- `plugin.json` → v2.0: 15 commands, 9 skill paths, Python MCP reference, new opening message
+- `SKILL.md` (both copies) → v2.0 master prompt: all 15 commands, 8 skills, command reference card
+- `.mcp.json` → added `python-mcp-server` entry
+- `package.json` → v2.0.0, added `test:math`, `test:python`, `test:all`, `mcp:start`, `mcp:install` scripts
+
+---
+
+## v1.1 — 6 March 2026
+
+The big improvement in this release is the test suite. Previously there was no way to know programmatically whether the plugin was fully intact — now there is. Run `npm test` and you get 190 checks across file structure, JSON validity, command spec completeness, disclaimer coverage, risk scoring consistency, and EU regulation accuracy.
+
+A few gaps that slipped through in v1.0 were also fixed:
+
+- `plugin.json` was missing the `system_prompt` inline field, which Claude Code and direct API callers need. Added, along with per-command metadata in a new `command_specs` array and a `skills_paths` list.
+- `risk-register.md` and `escalation-report.md` were both missing disclaimer blocks — fixed and each given a proper edge cases section to handle vague inputs, unknown root causes, and varying project complexity.
+- `eu-regulations.md` now explicitly states DORA's effective date (17 January 2025) and NIS2's effective date (18 October 2024). They were referenced but the dates weren't there.
+
+**What's new:**
+- `tests/validate.js` — validation suite, 190 assertions, no npm dependencies
+- `tests/fixtures/` — sample contract, portfolio, and project brief for manual testing
+- `tests/README.md` — per-command manual test checklists
+- `.claude-plugin/schema.json` — JSON Schema for plugin.json validation
+- `schemas/mcp-schema.json` — JSON Schema for .mcp.json validation
+- `package.json`, `.gitignore`, `CHANGELOG.md`
+
+---
+
+## v1.0 — 6 March 2026
+
+First release. Built the entire plugin from scratch based on the VKKM Aegis specification:
+
+- Master prompt at `skills/risk-management/SKILL.md` (canonical copy at `skills/vkkm-aegis/SKILL.md`)
+- Plugin manifest at `.claude-plugin/plugin.json`
+- MCP connector config at `.mcp.json` (FactSet, MSCI, Google Drive, DocuSign, SharePoint)
+- Six slash command specs: `scan-document`, `stress-test`, `risk-register`, `regulatory-check`, `escalation-report`, `counterparty-profile`
+- Six always-active skill files: `risk-scoring`, `eu-regulations`, `contract-patterns`, `financial-risk`, `plain-language`, `disclaimers`
+
+---
+
+*VKKM Aegis — by Vaibhav Mangroliya | vaibhavkkm.com*

package/DEPLOYMENT.md

@@ -0,0 +1,57 @@
+# VKKM Aegis — Deployment Guide (Hugging Face Spaces) 🚀
+
+This guide explains how to host your **VKKM Aegis v3.0** backend for free so that 50+ people can use it simultaneously.
+
+---
+
+## 1. Is Hugging Face Spaces Free?
+**Yes.** As long as you choose the **"CPU Basic"** instance type, it is **$0.00 forever.**
+- **CPU:** 2 vCPUs
+- **RAM:** 16GB (This is huge! It handles our 1 Million path simulations easily)
+- **Disk:** 50GB
+
+You do **not** need to enter a credit card for the free tier.
+
+---
+
+## 2. Setting Up the Space
+
+1.  **Create an Account:** Go to [huggingface.co](https://huggingface.co) and sign up.
+2.  **New Space:** Click the **"+" (New)** button in the top right and select **Space**.
+3.  **Name Your Project:** e.g., `vkkm-aegis-engine`.
+4.  **Select SDK:** Choose **Docker**.
+5.  **Instance:** Choose **CPU Basic (Free - 2 vCPU · 16GB · 0.00/h)**.
+6.  **Visibility:** Set to **Public** if you want others to use it easily.
+
+---
+
+## 3. Uploading Code
+
+You can either connect your GitHub repo or upload files manually:
+1.  Go to the **Files** tab in your new Space.
+2.  Upload `mcp_server.py`, `requirements.txt`, `Dockerfile`, and the entire `data/` folder.
+3.  Hugging Face will automatically start building the container. Once it says **Running**, it's live!
+
+---
+
+## 4. Making it "Live" on Claude
+
+Once the building is finished, you will see a public URL. It usually looks like:
+`https://<your-username>-<space-name>.hf.space`
+
+To make it live for users:
+1.  **For individual users:** They add the URL to their `claude_desktop_config.json`.
+2.  **For a Claude Project:** (Easiest for a 50-person trial) 
+    - Create a **Claude Project**.
+    - Invite your 50 people to it.
+    - Paste the `skills/risk-management/SKILL.md` into the Project Instructions.
+    - Note: For the "1 Million Path" math to work in a Project, you would typically need to host the server behind an OpenAPI spec (which our FastAPI server already provides at `/openapi.json`).
+
+---
+
+## 5. Security Note
+Hugging Face URLs are public. Since this is a trial, it's fine. If you move to "Enterprise" later, you would add an **API Key** (Bearer Token) to the headers so only your Claude plugin can talk to your server.
+
+---
+
+**Built by VKKM** — *Protecting you before things go wrong.*

package/Dockerfile

@@ -0,0 +1,20 @@
+# Use the official lightweight Python image.
+FROM python:3.11-slim
+
+# Set the working directory to /app
+WORKDIR /app
+
+# Copy the requirements file and install dependencies.
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy the rest of the application code.
+COPY . .
+
+# Expose the port that Hugging Face expects (7860 by default for HF Spaces)
+EXPOSE 7860
+
+# Run the FastAPI server. 
+# We set host to 0.0.0.0 so it's accessible externally.
+# We set port to 7860 to match Hugging Face's default.
+CMD ["uvicorn", "mcp_server:app", "--host", "0.0.0.0", "--port", "7860"]

package/LICENSE

@@ -0,0 +1 @@
+Copyright (c) 2026 Vaibhav Mangroliya. All rights reserved. No part of this repository may be reproduced or distributed without permission.