wicked-garden 12.27.0

package/skills/platform/compliance/refs/checklists.md

@@ -0,0 +1,303 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# Compliance Checklists
+
+Detailed verification checklists for each framework.
+
+## SOC2 Compliance Checklist
+
+### Access Controls (CC6.1)
+
+- [ ] User authentication implemented
+- [ ] Multi-factor authentication for privileged access
+- [ ] Role-based access control (RBAC) defined
+- [ ] Least privilege principle enforced
+- [ ] Regular access reviews scheduled
+- [ ] Terminated user access removed within 24 hours
+- [ ] Shared accounts prohibited
+- [ ] Session timeout configured
+
+### Encryption (CC6.6, CC6.7)
+
+- [ ] Data at rest encrypted (AES-256 or equivalent)
+- [ ] TLS 1.2+ for data in transit
+- [ ] Encryption key management documented
+- [ ] Key rotation schedule defined
+- [ ] Weak ciphers disabled
+- [ ] Certificate validation enabled
+- [ ] API authentication secured
+
+### Monitoring (CC7.2)
+
+- [ ] Security event logging enabled
+- [ ] Log aggregation configured
+- [ ] Monitoring alerts configured
+- [ ] Anomaly detection implemented
+- [ ] Log retention policy (90+ days)
+- [ ] Log integrity protected
+- [ ] Regular log review process
+
+### System Operations
+
+- [ ] Change management process
+- [ ] Backup and recovery tested
+- [ ] Incident response plan
+- [ ] Business continuity plan
+- [ ] Vendor management process
+
+## HIPAA Compliance Checklist
+
+### Administrative Safeguards
+
+- [ ] Security management process documented
+- [ ] Risk analysis conducted annually
+- [ ] Risk management strategy implemented
+- [ ] Sanction policy for violations
+- [ ] Information system activity review
+- [ ] Security training for workforce
+- [ ] Contingency plan tested
+- [ ] Business associate agreements (BAA) executed
+
+### Physical Safeguards
+
+- [ ] Facility access controls
+- [ ] Workstation use policy
+- [ ] Workstation security implemented
+- [ ] Device and media controls
+- [ ] Disposal procedures for ePHI
+- [ ] Media re-use procedures
+- [ ] Data backup procedures
+
+### Technical Safeguards
+
+- [ ] Unique user identification
+- [ ] Emergency access procedures
+- [ ] Automatic logoff configured
+- [ ] Encryption implemented (addressable)
+- [ ] Audit controls logging access to ePHI
+- [ ] Integrity controls for ePHI
+- [ ] Person/entity authentication
+- [ ] Transmission security (encryption)
+
+### PHI Protection
+
+- [ ] PHI identified and inventoried
+- [ ] Minimum necessary standard applied
+- [ ] PHI not in logs or error messages
+- [ ] Screen display protections
+- [ ] Secure PHI deletion process
+- [ ] De-identification procedures (if applicable)
+
+### Breach Notification
+
+- [ ] Breach detection procedures
+- [ ] Breach assessment process
+- [ ] Notification procedures (<60 days)
+- [ ] Breach log maintained
+
+## GDPR Compliance Checklist
+
+### Lawful Basis
+
+- [ ] Legal basis identified for each processing activity
+- [ ] Consent mechanism implemented (if consent-based)
+- [ ] Consent is freely given, specific, informed
+- [ ] Easy consent withdrawal mechanism
+- [ ] Records of processing activities (Article 30)
+
+### Data Subject Rights
+
+- [ ] Right to access - data export capability
+- [ ] Right to rectification - data correction process
+- [ ] Right to erasure - data deletion capability
+- [ ] Right to restriction - processing limitation
+- [ ] Right to data portability - machine-readable export
+- [ ] Right to object - opt-out mechanism
+- [ ] Respond within 30 days of request
+
+### Data Protection Principles
+
+- [ ] Data minimization enforced
+- [ ] Purpose limitation documented
+- [ ] Accuracy maintenance procedures
+- [ ] Storage limitation (retention policies)
+- [ ] Integrity and confidentiality (security measures)
+- [ ] Accountability (documentation and evidence)
+
+### Security Measures (Article 32)
+
+- [ ] Pseudonymization and encryption
+- [ ] Ongoing confidentiality measures
+- [ ] Availability and resilience
+- [ ] Restore capability after incident
+- [ ] Regular testing and evaluation
+- [ ] Data protection impact assessment (DPIA) when required
+
+### International Transfers
+
+- [ ] Adequacy decision confirmed (if applicable)
+- [ ] Standard contractual clauses (SCC) implemented
+- [ ] Binding corporate rules (BCR) if applicable
+- [ ] Transfer impact assessment conducted
+
+### Organizational Requirements
+
+- [ ] Data Protection Officer (DPO) appointed if required
+- [ ] Privacy notice published and accessible
+- [ ] Privacy by design implemented
+- [ ] Privacy by default configured
+- [ ] Vendor (processor) agreements executed
+
+### Breach Response
+
+- [ ] Breach detection capability
+- [ ] 72-hour notification process to supervisory authority
+- [ ] Individual notification process for high-risk breaches
+- [ ] Breach documentation and logs
+
+## PCI DSS Compliance Checklist
+
+### Network Security
+
+- [ ] Firewall configuration standards documented
+- [ ] Firewall rules reviewed semi-annually
+- [ ] Direct public access to CDE prohibited
+- [ ] Network segmentation implemented
+- [ ] Wireless security (WPA2+, unique keys)
+- [ ] Quarterly wireless scans
+
+### Cardholder Data Protection
+
+- [ ] Data retention policy defined and enforced
+- [ ] Sensitive auth data not stored post-authorization
+- [ ] PAN masked when displayed (show max first 6 + last 4)
+- [ ] PAN rendered unreadable everywhere stored
+- [ ] Encryption key management procedures
+- [ ] Key custodian roles defined
+- [ ] Key rotation schedule
+
+### Transmission Security
+
+- [ ] Strong cryptography (TLS 1.2+ minimum)
+- [ ] No unencrypted PANs via email, IM, SMS
+- [ ] Certificate validation
+- [ ] Trusted keys and certificates only
+
+### Access Control
+
+- [ ] Need-to-know access restrictions
+- [ ] Access based on job classification
+- [ ] Default deny-all policy
+- [ ] Unique user IDs assigned
+- [ ] Two-factor authentication for remote access
+- [ ] Two-factor for admin access to CDE
+- [ ] Strong password policy (7+ chars, complex)
+- [ ] Account lockout after 6 failed attempts
+- [ ] Session timeout (15 min idle max)
+- [ ] Physical access controls to CDE
+
+### Monitoring and Testing
+
+- [ ] All access to cardholder data logged
+- [ ] Admin actions logged
+- [ ] Logs secured and integrity protected
+- [ ] Logs reviewed daily
+- [ ] Log retention (1 year, 3 months immediately available)
+- [ ] Quarterly vulnerability scans (ASV if external)
+- [ ] Quarterly internal vulnerability scans
+- [ ] Annual penetration testing
+- [ ] Intrusion detection/prevention deployed
+- [ ] File integrity monitoring on CDE
+
+### Secure Development
+
+- [ ] Vendor-supplied defaults changed
+- [ ] Unnecessary services disabled
+- [ ] Security patches applied within 1 month of release
+- [ ] Secure coding guidelines followed
+- [ ] Development/test separate from production
+- [ ] Test data doesn't contain live PAN
+- [ ] Custom code reviewed for vulnerabilities
+- [ ] Change control process implemented
+
+### Policy and Procedures
+
+- [ ] Information security policy established
+- [ ] Policy reviewed annually
+- [ ] Risk assessment conducted annually
+- [ ] Security awareness program implemented
+- [ ] Personnel screening procedures
+- [ ] Acceptable use policies distributed
+- [ ] Incident response plan tested
+- [ ] Service provider (vendor) management
+
+## Quick Violation Detection — Common Anti-Patterns
+
+**PII/PHI in Logs**:
+```python
+# BAD - logs sensitive data
+logger.info(f"Processing SSN: {user.ssn}")
+
+# GOOD - redacted logging
+logger.info(f"Processing record: {user.id}")
+```
+
+**Hardcoded Secrets**:
+```python
+# BAD - hardcoded credentials
+api_key = "sk_live_123456789"
+
+# GOOD - environment variables
+api_key = os.environ.get("API_KEY")
+```
+
+**Missing Encryption**:
+```python
+# BAD - plaintext storage
+db.save({"ssn": user_ssn})
+
+# GOOD - encrypted storage
+encrypted_ssn = encrypt(user_ssn, kms_key)
+db.save({"ssn": encrypted_ssn})
+```
+
+**Weak Access Control**:
+```python
+# BAD - no authorization
+def view_records():
+    return all_records
+
+# GOOD - RBAC enforced
+@require_role("admin")
+def view_records():
+    return all_records
+```
+
+### Scanning Patterns
+
+Search for potential violations:
+
+```bash
+# Find potential PII in logs
+grep -r "ssn\|social.security\|credit.card\|password" --include="*.log"
+
+# Find hardcoded secrets
+grep -r "api[_-]key.*=.*['\"]" --include="*.py" --include="*.js"
+
+# Check for weak encryption
+grep -r "DES\|MD5\|SHA1" --include="*.py" --include="*.js"
+
+# Verify TLS version
+grep -r "TLSv1\|SSLv" --include="*.conf" --include="*.yaml"
+```
+
+## Evidence Collection
+
+| Category | Examples |
+|---|---|
+| Code | Encryption implementations, access control decorators, audit logging, input validation |
+| Configuration | TLS/SSL settings, DB encryption, key management, IAM policies |
+| Documentation | Architecture diagrams, data flow diagrams, security policies, incident response plans |
+| Operational | Access logs, audit logs, security dashboards, incident reports, training records |

package/skills/platform/compliance/refs/compliance.md

@@ -0,0 +1,117 @@
+# Regulatory Compliance Check Rubric
+
+Check code and architecture against regulatory compliance frameworks: SOC2, HIPAA, GDPR, PCI.
+
+## Step 1: Parse Framework and Scope
+
+`$ARGUMENTS` = `<framework> [path]`
+- Framework: `soc2` | `hipaa` | `gdpr` | `pci`
+- Scope: path to check, or full codebase if omitted
+
+## Step 2: Data Classification
+
+Identify sensitive data handling:
+```bash
+# PII patterns (GDPR/SOC2)
+grep -rn "ssn\|social.?security\|email\|phone\|address\|first.?name\|last.?name" --include="*.py" --include="*.ts" --include="*.js" -l
+
+# PHI patterns (HIPAA)
+grep -rn "patient\|diagnosis\|treatment\|medical\|health.?record\|phi" --include="*.py" --include="*.ts" -l
+
+# Payment data (PCI)
+grep -rn "card.?number\|cvv\|expir\|pan\b" --include="*.py" --include="*.ts" -l
+```
+
+## Step 3: Control Verification Checklist
+
+- [ ] **Authentication** — is authentication required for sensitive data access?
+- [ ] **Authorization (RBAC)** — are authorization checks enforced?
+- [ ] **Encryption at rest** — is sensitive data encrypted in the database/storage?
+- [ ] **Encryption in transit** — is TLS enforced on all endpoints?
+- [ ] **Audit logging** — is access to sensitive data logged?
+- [ ] **Input validation** — is user input validated before processing?
+- [ ] **Error handling** — do errors leak sensitive data?
+
+## Step 4: Framework-Specific Checks
+
+### SOC2 (Trust Service Criteria)
+| Control | Focus | Check |
+|---------|-------|-------|
+| CC6.1 | Logical access controls | Auth + RBAC present |
+| CC6.6 | Encryption of confidential data | AES-256 / KMS |
+| CC6.7 | Transmission security | TLS 1.2+ on all endpoints |
+| CC7.2 | System monitoring | Security event logging |
+
+### HIPAA
+| Safeguard | Requirement | Check |
+|-----------|-------------|-------|
+| 164.308(a)(3) | Workforce security | RBAC, access reviews |
+| 164.308(a)(4) | Access management | Auth, session management |
+| 164.312(a)(1) | Access controls | Unique user IDs, session timeout |
+| 164.312(e)(1) | Transmission security | TLS, encryption in transit |
+
+### GDPR
+| Article | Requirement | Check |
+|---------|-------------|-------|
+| Art 5 | Principles (minimization, accuracy) | Only necessary data collected |
+| Art 6 | Lawful basis for processing | Consent or contract documented |
+| Art 17 | Right to erasure | User deletion capability |
+| Art 32 | Security of processing | Encryption, pseudonymization |
+
+### PCI DSS
+| Requirement | Focus | Check |
+|-------------|-------|-------|
+| Req 3 | Protect stored cardholder data | PAN masked/encrypted |
+| Req 4 | Encrypt transmission | TLS for cardholder data |
+| Req 8 | Identify and authenticate access | Unique IDs, MFA |
+| Req 10 | Track and monitor access | Audit logging |
+
+Full checklists per framework: `refs/checklists.md`
+Framework-specific compliance patterns: `refs/frameworks.md`
+
+## Step 5: Bus Events
+
+After the pass/fail decision, emit ONE event:
+```bash
+# On pass (no P0/P1 gaps, all controls verified):
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/scripts/_bus_emit.py" wicked.compliance.passed '{"framework":"{soc2|hipaa|gdpr|pci}","checks_passed_count":{N},"chain_id":"{chain_id}"}' 2>/dev/null || true
+
+# On fail (any gap found):
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/scripts/_bus_emit.py" wicked.compliance.failed '{"framework":"{soc2|hipaa|gdpr|pci}","gap_count":{N},"severity_max":"{critical|high|medium|low}","chain_id":"{chain_id}"}' 2>/dev/null || true
+```
+
+## Output Format
+
+```markdown
+## Compliance Assessment: {Framework}
+
+**Scope**: {what was reviewed}
+**Compliance Status**: [COMPLIANT | PARTIAL | NON-COMPLIANT]
+**Confidence**: {HIGH | MEDIUM | LOW}
+
+### Sensitive Data Inventory
+| Type | Location | Protection | Status |
+|------|----------|------------|--------|
+| {type} | {file:line} | {encryption/masking} | {status} |
+
+### Control Assessment
+| Control | Required | Status | Evidence |
+|---------|----------|--------|----------|
+| Access Control | Yes | {PASS/FAIL} | {file:line or "MISSING"} |
+| Encryption at rest | Yes | {PASS/FAIL} | {file:line or "MISSING"} |
+| Encryption in transit | Yes | {PASS/FAIL} | {config:line or "MISSING"} |
+| Audit Logging | Yes | {PASS/FAIL} | {file:line or "MISSING"} |
+
+### Gaps
+
+#### Critical (P0) — Must Fix
+1. **{violation}** — {Control} — Location: {file:line}
+   Impact: {description}. Remediation: {specific steps}
+
+#### High Priority (P1) — Should Fix
+1. **{gap}** — Recommendation: {guidance}
+
+### Remediation Plan
+1. **P0**: {action}
+2. **P1**: {action}
+```

package/skills/platform/compliance/refs/frameworks.md

@@ -0,0 +1,282 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# Compliance Frameworks Reference
+
+Detailed framework-specific requirements and controls.
+
+## SOC2 Type II
+
+Service Organization Control 2 - Trust Services Criteria
+
+### Common Criteria
+
+**CC6.1 - Logical and Physical Access Controls**:
+- Implement authentication mechanisms
+- Enforce authorization checks (RBAC)
+- Apply least privilege principle
+- Segregate duties where appropriate
+- Review access rights periodically
+
+**CC6.6 - Encryption of Confidential Information**:
+- Encrypt data at rest (AES-256 recommended)
+- Use secure key management systems
+- Rotate encryption keys regularly
+- Document encryption standards
+
+**CC6.7 - Transmission of Data**:
+- Use TLS 1.2+ for data in transit
+- Validate certificates
+- Disable weak ciphers
+- Implement secure API authentication
+
+**CC7.2 - System Monitoring**:
+- Log security events
+- Monitor for anomalies
+- Alert on suspicious activities
+- Retain logs per policy (90+ days typical)
+
+### Evidence Requirements
+
+- Access control policies and implementation
+- Encryption verification (code + config)
+- Network security configurations
+- Monitoring and alerting setup
+- Log retention policies
+
+## HIPAA
+
+Health Insurance Portability and Accountability Act
+
+### Administrative Safeguards (§164.308)
+
+**164.308(a)(3) - Workforce Security**:
+- Authorization and supervision
+- Clearance procedures
+- Termination procedures
+
+**164.308(a)(4) - Information Access Management**:
+- Isolate healthcare clearinghouse functions
+- Access authorization
+- Access establishment and modification
+
+### Physical Safeguards (§164.310)
+
+**164.310(d) - Device and Media Controls**:
+- Disposal procedures
+- Media re-use procedures
+- Accountability tracking
+- Data backup and storage
+
+### Technical Safeguards (§164.312)
+
+**164.312(a) - Access Control**:
+- Unique user identification (required)
+- Emergency access procedure (required)
+- Automatic logoff (addressable)
+- Encryption and decryption (addressable)
+
+**164.312(b) - Audit Controls**:
+- Implement hardware/software to record and examine activity
+- Track access to PHI
+
+**164.312(c) - Integrity**:
+- Mechanism to authenticate ePHI
+- Ensure data not improperly altered/destroyed
+
+**164.312(d) - Person/Entity Authentication**:
+- Verify identity before access
+
+**164.312(e) - Transmission Security**:
+- Integrity controls (addressable)
+- Encryption (addressable)
+
+### PHI Handling
+
+Protected Health Information includes:
+- Individual health information
+- Treatment records
+- Payment information
+- Healthcare operations data
+- Any individually identifiable health data
+
+### Business Associate Agreements (BAA)
+
+Required when third parties access PHI:
+- Define permitted uses
+- Safeguard requirements
+- Reporting obligations
+- Termination provisions
+
+## GDPR
+
+General Data Protection Regulation (EU)
+
+### Core Principles (Article 5)
+
+**Lawfulness, Fairness, Transparency**:
+- Valid legal basis for processing
+- Clear privacy notices
+- Transparent data practices
+
+**Purpose Limitation**:
+- Collect for specific purposes
+- Don't process incompatibly
+
+**Data Minimization**:
+- Adequate and relevant only
+- Limited to necessary
+
+**Accuracy**:
+- Keep data accurate
+- Allow corrections
+
+**Storage Limitation**:
+- Keep only as long as needed
+- Define retention periods
+
+**Integrity and Confidentiality**:
+- Appropriate security measures
+- Protect against unauthorized processing
+
+### Key Rights
+
+**Article 15 - Right of Access**: Provide copy of data
+**Article 16 - Right to Rectification**: Correct inaccurate data
+**Article 17 - Right to Erasure**: Delete data ("right to be forgotten")
+**Article 18 - Right to Restriction**: Limit processing
+**Article 20 - Data Portability**: Provide in machine-readable format
+**Article 21 - Right to Object**: Stop processing
+
+### Security Requirements (Article 32)
+
+**Technical Measures**:
+- Pseudonymization and encryption
+- Ongoing confidentiality, integrity, availability
+- Restore availability after incident
+- Regular testing and evaluation
+
+**Organizational Measures**:
+- Data protection by design
+- Data protection by default
+- Data protection impact assessments (DPIA)
+- Data Protection Officer (DPO) where required
+
+### Breach Notification
+
+**72-hour rule** (Article 33):
+- Notify supervisory authority within 72 hours
+- Document nature of breach
+- Describe likely consequences
+- Outline remediation measures
+
+**Individual notification** (Article 34):
+- When high risk to rights and freedoms
+- Clear and plain language
+- Timely notification
+
+## PCI DSS
+
+Payment Card Industry Data Security Standard
+
+### Build and Maintain Secure Network
+
+**Req 1 - Firewalls**:
+- Install and maintain firewall configuration
+- Restrict connections between untrusted networks
+- Prohibit direct public access to cardholder data
+
+**Req 2 - Configuration**:
+- Don't use vendor defaults
+- Remove unnecessary services
+- Document and implement security configurations
+
+### Protect Cardholder Data
+
+**Req 3 - Stored Data Protection**:
+- Keep cardholder data storage to minimum
+- Don't store sensitive auth data after authorization
+- Mask PAN when displayed (show only first 6 and last 4)
+- Render PAN unreadable (encryption, truncation, hashing)
+- Document and implement key management
+
+**Req 4 - Transmission Encryption**:
+- Use strong cryptography (TLS 1.2+)
+- Never send unprotected PANs via email, IM, SMS
+- Document encryption policies
+
+### Maintain Vulnerability Management
+
+**Req 5 - Anti-Virus**:
+- Deploy on all systems commonly affected by malware
+- Keep definitions current
+- Generate logs and review periodically
+
+**Req 6 - Secure Development**:
+- Patch critical vulnerabilities within one month
+- Develop applications based on secure coding guidelines
+- Separate development/test from production
+- Review custom code for vulnerabilities
+
+### Implement Strong Access Control
+
+**Req 7 - Need-to-Know**:
+- Limit access to business need-to-know
+- Implement access control systems
+- Default "deny-all" setting
+
+**Req 8 - Unique IDs**:
+- Assign unique ID to each person
+- Implement two-factor authentication
+- Use strong passwords/passphrases
+- Lock out after max failed attempts
+
+**Req 9 - Physical Access**:
+- Control physical access to cardholder data
+- Distinguish employees from visitors
+- Log and monitor physical access
+
+### Monitor and Test Networks
+
+**Req 10 - Logging**:
+- Log all access to cardholder data
+- Log privileged user actions
+- Secure audit logs
+- Review logs daily
+- Retain logs at least one year (3+ months immediately available)
+
+**Req 11 - Security Testing**:
+- Test for wireless access points quarterly
+- Run internal/external vulnerability scans quarterly
+- Perform penetration testing annually
+- Use intrusion detection/prevention systems
+
+### Maintain Information Security Policy
+
+**Req 12 - Policy**:
+- Establish, publish, maintain security policy
+- Implement risk assessment process
+- Develop usage policies for technologies
+- Assign information security responsibilities
+- Implement security awareness program
+
+## Cardholder Data Environment (CDE)
+
+Scope includes:
+- Systems that store, process, or transmit cardholder data
+- Systems that provide security services (auth, logging, etc.)
+- Systems that impact security of above
+
+### Data Elements
+
+**Cardholder Data**:
+- Primary Account Number (PAN)
+- Cardholder Name
+- Expiration Date
+- Service Code
+
+**Sensitive Authentication Data** (NEVER store post-auth):
+- Full magnetic stripe data
+- CAV2/CVC2/CVV2/CID
+- PINs/PIN blocks