compliance-diff

Launch readiness decays. A month after a clean review, someone adds a session-replay tool, a signup field, or a /admin route. This skill reads a change and says what it re-opens.

Activate when

• A PR, branch, or release diff is under review, or the user asks "what does this change do to our launch/privacy posture?"
• A context note (.readyvibe/context.md), if one exists, has "NOT APPLICABLE" items whose recheck triggers might have fired.
• Not for a first full review (use launch-all).

Inspect

Get the diff (git diff <base>...HEAD, or the PR files). Look for these introductions, in order of consequence:

Also look for deletions that reduce protection: removed consent gating, removed unsubscribe route, dropped auth check.

Evidence that counts

Label each claim OBSERVED, SOURCE-INDICATED, DECLARED, INFERRED, UNKNOWN, or REVIEW REQUIRED. UNKNOWN is never a pass and never a failure.

• A diff shows SOURCE-INDICATED behavior. "This adds PostHog" is fact; "PostHog loads before consent" is unproven until the change is run.
• If you can run the branch, do a targeted runtime pass on the affected routes rather than guessing: node scripts/observe-runtime.mjs --url <local-url>/<route> --block-third-party (path relative to this skill's folder).

May change

Nothing in the product. Produce a short review note (in the reply, or .readyvibe/diff-review.md if asked).

Changes with launch/privacy impact
  1. New third party: posthog-js (analytics + replay-capable). Runtime timing unproven.  -> analytics-privacy, cookie-and-storage-audit; privacy notice does not mention it.
  2. New field: phone on /signup. Stored in profiles.phone.  -> data-flow-mapping, privacy-policy, data-rights (deletion covers it?)
No impact found in: routes, metadata, email, payments.

Must not claim

That the change is "approved", "compliant", or "safe to ship". Say what it introduces, what is unverified, and what to recheck.

Verify

Confirm each listed introduction by locating the code (file and line), and confirm each "no impact" claim by searching for the corresponding patterns. For anything you can run, run it.

Escalate

Regulated-domain or child-directed features appearing in a diff; exposure of credentials in the diff (report at once and do not copy the value); changes that silently contradict the published privacy notice or terms.

No change is valid when

The diff is refactoring, styling, or copy that touches none of the surfaces above. Say "no launch or privacy impact found" and name the patterns you searched.