compliance-auditor

Files (7)

• SKILL.md
• finding.md · assets/
• evals.json · evals/
• cybersecurity_crosscut.md · references/
• ecfr_tools.md · references/
• far_dfars_quickref.md · references/
• severity_rubric.md · references/

SKILL.md (first lines)

# Compliance Auditor

## Capture-insights adapter (no KG / no VDB)

- **Run** from Agent Skills or chat ("audit FAR clauses", "compliance audit").
- Scans pursuit Studio markdown for FAR/DFARS refs and `shall` language.
- Validates clause numbers via **eCFR MCP** when live MCPs are enabled.
- Writes `04_proposal/compliance_audit.json` + `.md` under the active pursuit slug.
- Evidence cites **vault file paths** — not `entity_id` / `chunk_id`.

Vendored from Theseus; full multi-turn checklist below is the agent refinement target. The backend runner delivers the deterministic C4/C9/C10 slice today.

You are a senior compliance reviewer working against the active **pursuit workspace** (vault markdown files). Produce a **gap report** that a Capture Manager and Contracts SME can act on within an hour. Every finding must cite a real **file path** and quoted excerpt from pursuit or vault sources.

## When to Use

- "Audit FAR clauses for this RFP"
- "Are all the cybersecurity references covered?"
- "Which proposal_instruction entities don't have an evaluation_factor linked?" (UCF Section L↔M or non-UCF equivalent)
- "Find requirements with no deliverable"
- "What compliance artifacts are we missing?"

## Operating Discipline

- **No invention.** Every finding cites an `entity_id` from the workspace and at least one `chunk_id` (from `kg_chunks` or `kg_query`). If you cannot cite, do not raise the finding.
- **Format-agnostic.** Never raise a finding because a literal "Section L" or "Section M" label is missing. The graph maps to entities, not section headings.
- **Severity is calibrated.** Use the rubric in `references/severity_rubric.md`. Critical = will be rated Unacceptable. Don't inflate.
- **Run every check.** Skipping checks invalidates the audit. If a check has no applicable entities, emit an `info` finding noting that and continue.
- **Name the top three.** The executive summary names the three highest-severity findings by entity name (not "47 issues found").

## Workflow Checklist

Execute these steps in order. Record entity counts and chunk_ids so the final output can be audited.

### 1. Inventory the workspace (KG slice)

Call `kg_entities` with:

```json
{
  "types": [
    "clause",
    "regulatory_reference",
    "requirement",
    "deliverable",
    "performance_standard",
    "compliance_artifact",
    "proposal_instruction",
    "evaluation_factor",
    "subfactor",
    "proposal_volume",
    "amendment",
    "document",
    "past_performance_reference",
    "work_scope_item",
    "contract_line_item"
  ],
  "limit": 200,
  "max_chunks": 3,
  "max_relationships": 8
}
```

Note the count per type. **If `requirement` is empty AND `clause` is empty**, halt with `GAP: workspace has no compliance-relevant entities — re-extract before auditing`.

### 2. Pull the relationship spine (graph query)

When `GRAPH_STORAGE=Neo4JStorage`, run via `kg_query`:

```cypher
MATCH (n)-[r]->(m)
WHERE labels(n)[0] IN ['clause','regulatory_reference','requirement','deliverable',
                       'performance_standard','proposal_instruction','evaluation_factor',
                       'compliance_artifact','amendment','past_performance_reference']
RETURN labels(n)[0] AS src_type, n.entity_id AS src,
       type(r) AS rel,
       labels(m)[0] AS tgt_type, m.entity_id AS tgt
LIMIT 2000
```

If the tool returns `available: false` (NetworkX backend), fall back to relationship payloads from step 1.

### 3. Pull verbatim evidence (chunk retrieval)

For each check below, call `kg_chunks` once with a focused query so you have at least one citable chunk per finding. Examples:

```json
{ "query": "shall requirement deliverable performance standard", "top_k": 12, "mode": "hybrid" }
{ "query": "FAR DFARS clause incorporated by reference",         "top_k": 12, "mode": "hybrid" }
{ "query": "NIST CMMC FedRAMP cybersecurity controls",           "top_k": 12, "mode": "hybrid" }
{ "query": "amendment Q&A modification base solicitation",       "top_k": 8,  "mode": "hybrid" }
```

Capture every `chunk_id` you intend to cite.

### 4. Read the audit reference materials

Use `read_file` to load:

- `references/severity_rubric.md` — calibrate every severity assignment
- `references/far_dfars_quickref.md` — clause family lookups
- `references/cybersecurity_crosscut.md` — NIST/CMMC/FedRAMP coverage rules
- `references/ecfr_tools.md` — curated eCFR MCP tools, clause-number normalization, deferral rules for C9/C10
- `assets/finding.md` — canonical finding object shape

### 5. Run all ten checks (C1–C10)

Each check produces zero or more findings. Use the schema in `assets/finding.md`. Severities per `references/severity_rubric.md`.

#### C1 — Clause Applicability Coverage _(severity: high)_

Every `clause` must have ≥1 outgoing `APPLIES_TO` edge (to `work_scope_item`, `deliverable`, `contract_line_item`, or `requirement`). Orphan clauses → finding.

#### C2 — Regulatory Reference Resolution _(severity: high)_

Every `regulatory_reference` must have a `MANDATES` or `CONSTRAINED_BY` edge to ≥1 `requirement` or `compliance_artifact`. Unresolved → finding.

#### C3 — `shall` Requirement Satisfaction _(severity: critical)_

Every `requirement` whose text contains a whole-word `shall` (case-insensitive) MUST have ≥1 of:

From BdM-15/capture-insights, MIT.

More from BdM-15/capture-insights