wicked-garden 12.27.0

package/skills/platform/audit/refs/audit.md

@@ -0,0 +1,145 @@
+# Audit Evidence Collection Rubric
+
+Collect audit evidence, verify controls, and generate compliance artifacts for SOC2/HIPAA/GDPR/PCI.
+
+## Step 1: Parse Arguments
+
+`$ARGUMENTS` = `<framework> [control_id]`
+- Framework: `soc2` | `hipaa` | `gdpr` | `pci`
+- Control: specific control ID (e.g., `CC6.1`) or `all`
+
+## Step 2: Evidence Collection Checklist
+
+### Define Scope
+- [ ] Systems in scope for this audit
+- [ ] Compliance framework and controls to test
+- [ ] Audit period (start/end date)
+- [ ] Evidence sources available
+
+### Design Evidence (Architecture + Policy)
+```bash
+# Find architecture docs
+find . -name "*.md" -path "*/docs/*" | xargs grep -l "architecture\|diagram\|security\|incident" 2>/dev/null | head -10
+
+# Find policy documents
+find . -path "*/policies/*" -o -name "*policy*.md" -o -name "*incident*response*.md" 2>/dev/null | head -10
+```
+
+### Implementation Evidence (Code + Config)
+
+**Access Control (CC6.1, HIPAA 164.312(a))**:
+```bash
+grep -rn "authenticate\|require.*auth\|login\|authorize\|require.*role\|permission" --include="*.py" --include="*.ts" --include="*.js" -l
+```
+
+**Encryption (CC6.6, GDPR Art 32)**:
+```bash
+grep -rn "encrypt\|cipher\|AES\|crypto\|tls\|ssl" --include="*.py" --include="*.ts" -l
+grep -rn "key.*management\|kms\|vault\|secrets" --include="*.yml" --include="*.yaml" -l
+```
+
+**Audit Logging (CC7.2, HIPAA 164.312(b))**:
+```bash
+grep -rn "audit.*log\|access.*log\|security.*event\|log.*retention" --include="*.py" --include="*.ts" -l
+```
+
+### Operational Evidence
+```bash
+# Access logs sample
+tail -n 100 /var/log/access.log 2>/dev/null || echo "No access log found at /var/log/access.log"
+
+# Audit log sample
+tail -n 100 /var/log/audit.log 2>/dev/null || echo "No audit log found"
+```
+
+## Step 3: Control Testing
+
+For each control:
+1. Locate the implementation (file:line)
+2. Review design (does it match the requirement?)
+3. Verify effectiveness (is it enforced, not just present?)
+4. Document: Pass / Partial / Fail + evidence ref
+
+### SOC2 Trust Service Criteria (key controls)
+| Control | Requirement | Test |
+|---------|-------------|------|
+| CC6.1 | Logical access controls | Auth middleware, RBAC code |
+| CC6.6 | Encryption of confidential data | AES/TLS implementation |
+| CC6.7 | Transmission security | TLS config, HTTPS enforcement |
+| CC7.2 | System monitoring | Logging, alerting config |
+
+Full SOC2 + HIPAA evidence checklists: `refs/checklists-soc2-hipaa.md`
+GDPR + PCI checklists: `refs/checklists-gdpr-pci-evidence.md`
+Evidence collection scripts and organization: `refs/checklists-evidence-operations.md`
+
+## Step 4: Gap Analysis
+
+Common gaps to check:
+- **Missing evidence**: no docs, no logs, no test results, no policies
+- **Incomplete implementation**: partial controls, inconsistent application
+- **Insufficient testing**: no control testing, no pen testing, no compliance verification
+
+## Step 5: Bus Events
+
+After the audit result is finalized, emit ONE event:
+
+```bash
+# On pass (all in-scope controls passing, no P0/P1 gaps):
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/scripts/_bus_emit.py" wicked.compliance.passed '{"framework":"{soc2|hipaa|gdpr|pci}","checks_passed_count":{N},"chain_id":"{chain_id}"}' 2>/dev/null || true
+
+# On fail (any failing control or identified gap):
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/scripts/_bus_emit.py" wicked.compliance.failed '{"framework":"{soc2|hipaa|gdpr|pci}","gap_count":{N},"severity_max":"{critical|high|medium|low}","chain_id":"{chain_id}"}' 2>/dev/null || true
+```
+
+## Output Format
+
+```markdown
+## Audit Report
+
+**Audit Date**: {date}
+**Framework**: {SOC2 | HIPAA | GDPR | PCI}
+**Scope**: {systems/components}
+**Period**: {audit period}
+
+### Executive Summary
+
+**Overall Status**: {READY | NEEDS WORK | NOT READY}
+**Controls Tested**: {count}  **Passing**: {count}  **Failing**: {count}
+**Evidence Collected**: {count artifacts}
+
+{1-2 sentence summary}
+
+### Controls Tested
+
+| Control ID | Description | Status | Evidence | Notes |
+|------------|-------------|--------|----------|-------|
+| CC6.1 | Access controls | PASS | auth.py:15-45 | RBAC enforced |
+| CC7.2 | Monitoring | FAIL | — | Missing security alerts |
+
+### Evidence Collected
+
+#### Design Evidence
+1. {doc name} — {path}
+
+#### Implementation Evidence
+1. Access Control — {file:line}
+2. Encryption — {file:line}
+3. Audit Logging — {file:line}
+
+#### Operational Evidence
+1. Access Logs — {path} ({retention days} days)
+
+### Gaps Identified
+
+#### Critical (P0)
+1. **{gap}** — Control: {ID} — Impact: {description} — Remediation: {steps}
+
+#### High Priority (P1)
+1. **{gap}** — {fix}
+
+### Certification Readiness
+
+**{Framework}**: {READY | NEEDS WORK | NOT READY}
+- Blockers: {P0 count} P0 findings
+- Timeline: {estimate} to address
+```

package/skills/platform/audit/refs/checklists-evidence-operations.md

@@ -0,0 +1,144 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# Audit Evidence: Collection, Organization & Readiness
+
+Evidence collection scripts, organization structure, gap tracking, and audit readiness checklists.
+
+## Evidence Collection Scripts
+
+### Automated Evidence Gathering
+
+**Collect Code Evidence**:
+```bash
+#!/bin/bash
+# Collect encryption implementations
+grep -rn "encrypt\|AES\|cipher" src/ > evidence/encryption_code.txt
+
+# Collect access control
+grep -rn "authorize\|authenticate\|require_role" src/ > evidence/access_control.txt
+
+# Collect logging
+grep -rn "log\|audit" src/ > evidence/logging.txt
+```
+
+**Collect Configuration Evidence**:
+```bash
+#!/bin/bash
+# Gather all configs
+find . -name "*.yml" -o -name "*.conf" -o -name "*.json" | \
+  grep -v node_modules | \
+  tar czf evidence/configurations.tar.gz -T -
+
+# Extract TLS configs
+grep -r "TLS\|SSL" config/ > evidence/tls_configs.txt
+```
+
+**Collect Log Samples**:
+```bash
+#!/bin/bash
+# Recent access logs
+tail -n 1000 /var/log/access.log > evidence/access_log_sample.txt
+
+# Recent audit logs
+tail -n 1000 /var/log/audit.log > evidence/audit_log_sample.txt
+
+# Security events
+tail -n 1000 /var/log/security.log > evidence/security_log_sample.txt
+```
+
+## Evidence Organization
+
+### Directory Structure
+
+```
+audit-evidence/
+├── design/
+│   ├── architecture.pdf
+│   ├── network_diagram.pdf
+│   └── data_flow.pdf
+├── code/
+│   ├── authentication/
+│   ├── authorization/
+│   ├── encryption/
+│   └── logging/
+├── configs/
+│   ├── tls/
+│   ├── database/
+│   └── application/
+├── logs/
+│   ├── access/
+│   ├── audit/
+│   └── security/
+├── policies/
+│   ├── security_policy.pdf
+│   ├── incident_response.pdf
+│   └── access_control_policy.pdf
+└── reports/
+    ├── vulnerability_scans/
+    ├── penetration_tests/
+    └── compliance_assessments/
+```
+
+### Evidence Metadata
+
+For each piece of evidence, document:
+```yaml
+evidence_id: SOC2-CC6.1-001
+control: CC6.1 - Access Control
+type: code
+file: src/auth/middleware.py
+lines: 45-67
+description: RBAC enforcement middleware
+collected_by: John Doe
+collected_date: 2025-01-24
+status: verified
+notes: Integrates with IAM service, role checks enforced
+```
+
+## Gap Tracking
+
+### Gap Register Format
+
+```markdown
+| Gap ID | Control | Description | Priority | Status | Target Date | Owner |
+|--------|---------|-------------|----------|--------|-------------|-------|
+| G001 | CC6.1 | Missing MFA for admins | P0 | In Progress | 2025-02-01 | Security Team |
+| G002 | 164.312(b) | Incomplete PHI logging | P0 | Not Started | 2025-02-15 | Dev Team |
+| G003 | PCI-10 | Log retention < 1 year | P1 | In Progress | 2025-03-01 | Ops Team |
+```
+
+## Audit Readiness Checklist
+
+### Pre-Audit Preparation
+
+- [ ] All evidence collected and organized
+- [ ] Gap analysis completed
+- [ ] Critical gaps (P0) remediated
+- [ ] Control documentation updated
+- [ ] Policies and procedures reviewed
+- [ ] Team trained on audit process
+- [ ] Point of contact identified
+- [ ] Audit scope agreed upon
+- [ ] Sample period defined
+- [ ] Evidence access prepared
+
+### During Audit
+
+- [ ] Respond to auditor requests promptly
+- [ ] Provide clear, organized evidence
+- [ ] Document all auditor interactions
+- [ ] Track outstanding requests
+- [ ] Escalate issues quickly
+- [ ] Maintain audit log of activities
+
+### Post-Audit
+
+- [ ] Review audit findings
+- [ ] Prioritize remediation items
+- [ ] Create action plans for gaps
+- [ ] Update documentation
+- [ ] Implement corrective actions
+- [ ] Schedule follow-up audits
+- [ ] Update compliance status

package/skills/platform/audit/refs/checklists-gdpr-pci-evidence.md

@@ -0,0 +1,213 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# Audit Evidence Checklists: GDPR & PCI DSS
+
+Checklists for GDPR and PCI DSS audit evidence collection.
+
+## GDPR Audit Evidence
+
+### Lawfulness of Processing Evidence
+
+- [ ] Legal basis documentation for each processing activity
+- [ ] Consent forms (if consent-based)
+- [ ] Consent withdrawal mechanism
+- [ ] Records of processing activities (Article 30)
+- [ ] Legitimate interest assessments (if applicable)
+- [ ] Contracts with data processors
+- [ ] Privacy notices
+- [ ] Cookie consent mechanism (if applicable)
+
+### Data Subject Rights Evidence
+
+- [ ] Data access request procedures
+- [ ] Data portability export capability
+- [ ] Data rectification procedures
+- [ ] Data erasure procedures
+- [ ] Processing restriction procedures
+- [ ] Objection handling procedures
+- [ ] Automated decision-making disclosures
+- [ ] Response time tracking (30-day compliance)
+
+### Data Protection Principles Evidence
+
+- [ ] Data minimization analysis
+- [ ] Purpose limitation documentation
+- [ ] Data accuracy procedures
+- [ ] Storage limitation/retention policies
+- [ ] Security measures (Article 32)
+- [ ] Accountability documentation
+- [ ] Privacy by design assessments
+- [ ] Privacy by default configurations
+
+### Security Measures Evidence
+
+- [ ] Pseudonymization/encryption implementations
+- [ ] Access control mechanisms
+- [ ] Backup and recovery procedures
+- [ ] Security testing reports
+- [ ] Vulnerability assessments
+- [ ] Penetration test results
+- [ ] Disaster recovery tests
+- [ ] Security incident log
+
+### International Transfers Evidence
+
+- [ ] Adequacy decision documentation
+- [ ] Standard contractual clauses (SCC)
+- [ ] Binding corporate rules (BCR) if applicable
+- [ ] Transfer impact assessments (TIA)
+- [ ] Supplementary measures for transfers
+
+### Organizational Evidence
+
+- [ ] DPO appointment (if required)
+- [ ] DPO contact information publication
+- [ ] Data protection impact assessments (DPIA) for high-risk processing
+- [ ] Processor agreements (Article 28)
+- [ ] Joint controller agreements (if applicable)
+- [ ] Training records
+
+### Breach Response Evidence
+
+- [ ] Breach detection procedures
+- [ ] Breach notification procedures (<72 hours)
+- [ ] Breach register/log
+- [ ] Supervisory authority notifications
+- [ ] Individual notifications (if high risk)
+- [ ] Breach impact assessments
+
+## PCI DSS Audit Evidence
+
+### Requirement 1 - Firewall Configuration
+
+- [ ] Firewall configuration standards
+- [ ] Current firewall rulesets
+- [ ] Firewall rule review logs (semi-annual)
+- [ ] Network diagram showing CDE boundaries
+- [ ] DMZ configuration
+- [ ] Wireless access point configurations
+- [ ] Quarterly wireless scans
+
+### Requirement 2 - Configuration Management
+
+- [ ] Configuration standards documentation
+- [ ] Hardening guides
+- [ ] Baseline configurations
+- [ ] System inventory
+- [ ] Evidence of vendor default changes
+- [ ] Unnecessary services disabled
+- [ ] Configuration change logs
+
+### Requirement 3 - Data Protection
+
+- [ ] Data retention and disposal policy
+- [ ] Data flow diagram
+- [ ] Evidence sensitive auth data not stored
+- [ ] PAN masking implementation
+- [ ] Encryption implementation
+- [ ] Key management procedures
+- [ ] Cryptographic key inventory
+- [ ] Key custodian assignments
+- [ ] Key rotation logs
+
+### Requirement 4 - Transmission Encryption
+
+- [ ] Encryption policy for PAN transmission
+- [ ] TLS configuration (1.2+ minimum)
+- [ ] Certificate inventory
+- [ ] Trusted key and certificate management
+- [ ] End-user messaging security (no unencrypted PAN)
+
+### Requirement 5 - Anti-Malware
+
+- [ ] Anti-virus software deployment
+- [ ] AV definition update logs
+- [ ] AV scan logs
+- [ ] AV policy and procedures
+
+### Requirement 6 - Secure Systems
+
+- [ ] Patch management procedures
+- [ ] Critical patch deployment records (<30 days)
+- [ ] Secure coding guidelines
+- [ ] Code review procedures
+- [ ] Vulnerability management process
+- [ ] Change control procedures
+- [ ] Development/test/production separation
+- [ ] Test data procedures (no live PAN)
+
+### Requirement 7 - Access Restriction
+
+- [ ] Access control policy
+- [ ] Need-to-know documentation
+- [ ] Access rights based on job function
+- [ ] Default deny-all configuration
+- [ ] Access authorization records
+- [ ] Privilege assignment documentation
+
+### Requirement 8 - Authentication
+
+- [ ] User identification procedures
+- [ ] Unique user ID assignment
+- [ ] Two-factor authentication implementation (remote + admin)
+- [ ] Password policy (7+ chars, complexity)
+- [ ] Account lockout configuration (6 attempts)
+- [ ] Session timeout (15 min idle)
+- [ ] Password history (4 different)
+- [ ] Password change every 90 days
+- [ ] Shared account prohibition
+- [ ] User account review (quarterly)
+
+### Requirement 9 - Physical Access
+
+- [ ] Facility access controls
+- [ ] Visitor authorization and logging
+- [ ] Badge system
+- [ ] Escort procedures for visitors
+- [ ] Media storage controls
+- [ ] Secure media destruction procedures
+- [ ] Media tracking logs
+- [ ] Device inventory
+
+### Requirement 10 - Logging and Monitoring
+
+- [ ] Audit log policy
+- [ ] Log configuration (what to log)
+- [ ] Cardholder data access logs
+- [ ] Admin action logs
+- [ ] Log integrity protection
+- [ ] Daily log review procedures
+- [ ] Log review evidence
+- [ ] Log retention configuration (1 year, 3 months online)
+- [ ] Time synchronization (NTP)
+
+### Requirement 11 - Security Testing
+
+- [ ] Quarterly external vulnerability scans (ASV)
+- [ ] Quarterly internal vulnerability scans
+- [ ] Scan remediation tracking
+- [ ] Annual penetration testing
+- [ ] Penetration test results and remediation
+- [ ] IDS/IPS deployment and configuration
+- [ ] IDS/IPS alert review logs
+- [ ] File integrity monitoring (FIM) configuration
+- [ ] FIM alerts and review
+- [ ] Change detection procedures
+
+### Requirement 12 - Security Policy
+
+- [ ] Information security policy
+- [ ] Policy annual review
+- [ ] Risk assessment (annual)
+- [ ] Acceptable use policies
+- [ ] User acknowledgment of policies
+- [ ] Security awareness program materials
+- [ ] Training completion records
+- [ ] Personnel screening procedures
+- [ ] Incident response plan
+- [ ] Incident response testing
+- [ ] Service provider management procedures
+- [ ] Service provider list
+- [ ] Service provider assessments

package/skills/platform/audit/refs/checklists-soc2-hipaa.md

@@ -0,0 +1,120 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# Audit Evidence Checklists: SOC2 & HIPAA
+
+Comprehensive checklists for collecting SOC2 Type II and HIPAA audit evidence.
+
+## SOC2 Type II Audit Evidence
+
+### Design Evidence
+
+- [ ] System architecture diagrams
+- [ ] Network diagrams
+- [ ] Data flow diagrams
+- [ ] Security policies and procedures
+- [ ] Incident response plan
+- [ ] Business continuity plan
+- [ ] Disaster recovery plan
+- [ ] Change management procedures
+- [ ] Vendor management policy
+- [ ] Access control policy
+
+### Implementation Evidence
+
+- [ ] Authentication code and configuration
+- [ ] Authorization/RBAC implementation
+- [ ] Encryption at rest implementation
+- [ ] Encryption in transit configuration
+- [ ] Logging and monitoring setup
+- [ ] Backup and recovery scripts
+- [ ] Security configurations (firewalls, IDS/IPS)
+- [ ] Key management implementation
+- [ ] Session management code
+- [ ] Input validation code
+
+### Operational Evidence
+
+- [ ] Access logs (90+ days)
+- [ ] Audit logs (90+ days)
+- [ ] Security event logs
+- [ ] Change logs
+- [ ] Incident reports
+- [ ] Access review reports
+- [ ] Vulnerability scan reports
+- [ ] Penetration test results
+- [ ] Training completion records
+- [ ] Vendor assessment reports
+
+### Process Evidence
+
+- [ ] Access request/approval records
+- [ ] User onboarding checklists
+- [ ] User offboarding checklists
+- [ ] Incident response procedures
+- [ ] Evidence of log review
+- [ ] Evidence of access reviews
+- [ ] Security awareness training materials
+- [ ] Background check procedures
+
+## HIPAA Audit Evidence
+
+### Administrative Safeguards Evidence
+
+- [ ] Security management process documentation
+- [ ] Risk analysis (annual)
+- [ ] Risk management plan
+- [ ] Sanction policy
+- [ ] Information system activity review procedures
+- [ ] Security training materials
+- [ ] Security awareness program
+- [ ] Contingency plan
+- [ ] Business associate agreements (BAA)
+- [ ] Workforce clearance procedures
+- [ ] Termination procedures
+
+### Physical Safeguards Evidence
+
+- [ ] Facility access control procedures
+- [ ] Visitor logs
+- [ ] Workstation use policy
+- [ ] Workstation security procedures
+- [ ] Device inventory
+- [ ] Media disposal procedures
+- [ ] Media re-use procedures
+- [ ] Backup procedures
+- [ ] Physical access logs
+
+### Technical Safeguards Evidence
+
+- [ ] Unique user ID assignment process
+- [ ] Authentication implementation
+- [ ] Emergency access procedures
+- [ ] Session timeout configuration
+- [ ] Encryption implementation (if used)
+- [ ] Audit controls implementation
+- [ ] PHI access logging
+- [ ] Integrity control mechanisms
+- [ ] Person/entity authentication
+- [ ] Transmission security (TLS configs)
+
+### PHI Protection Evidence
+
+- [ ] PHI inventory
+- [ ] Minimum necessary analysis
+- [ ] Data classification scheme
+- [ ] PHI handling procedures
+- [ ] De-identification procedures (if applicable)
+- [ ] PHI disposal/destruction logs
+- [ ] Breach notification procedures
+- [ ] Breach log/register
+
+### Documentation Evidence
+
+- [ ] HIPAA policies and procedures manual
+- [ ] Privacy notices
+- [ ] Authorization forms
+- [ ] Patient rights materials
+- [ ] Privacy officer designation
+- [ ] Security officer designation