/ds-compliance

Single missing privacy policy or unpatched XSS can mean fines, data breaches, or store rejection. Skill audits 158 rules across 9 compliance domains with file:line precision.

Security & Regulatory Compliance — OWASP security, privacy laws, data protection, web security, and internationalization.

Completion Evidence — applies to every phase: Report done/OK only with the machine-checkable evidence the gates name — the exact command run and its observed output (or file:line diff). Missing evidence → report INCOMPLETE plus what is missing. Self-assessment is never evidence. (This band repeats at file end by design — both copies are normative.)

Triggers

• User runs /ds-compliance, or asks about GDPR/KVKK/CCPA/HIPAA or other regulatory compliance, security vulnerabilities/secrets/injection risks, privacy/data-protection/consent, CSP/CORS/XSS/CSRF, or internationalization compliance

Triggers — INVOKE / DON'T INVOKE

Contract

Dimensions: C1 (canonical), C2 (canonical, conditional messaging), C3 (regulatory), A7 (regulatory), A8 (rules), A9 (conditional ecosystem rules), A11 (portability crosscheck) Framework alignment (advisory): OWASP ASVS 5.0.0 (C1), OWASP SAMM (C2). Tool-derived findings carry the tool's own ASVS version tag (OSS DAST tools still emit 4.0.3 — never claim ASVS 5.0 coverage from them).

• Every finding cites file:line — never infer. Unverifiable rules skipped, not guessed. Only audits compliance; code fixes are CAT-1 (auto) or CAT-2 (approval).
• Standalone. Uses blueprint profile when available; ds/audit/findings.md only when fresh (git_hash == HEAD AND current run-cycle); own analysis otherwise.
• State-exempt: single regenerable report/audit.
• Full accounting enforced: every finding and planned check ends in an explicit disposition (fixed / skipped + reason / only you can do); summary totals balance.
• Pre-existing / out-of-scope errors detected during work are NOT skipped — fixed inline or escalated with concrete blocker. <!-- portable-only -->
• Mobile-project overlap: mobile signals (pubspec.yaml flutter / react-native dep / *.xcodeproj / android {}) route security/privacy/regulatory per Phase 1 step 6 — /ds-mobile present → delegated (mobile-authoritative, default-skip locally); absent → audited inline. Override either path with --scope=security,privacy,regulatory.

Arguments

Default: no disambiguating flag runs the full scan-and-fix pass, recorded in the summary. --preview: scan and report only, no fixes applied. --ask: present scope selection and per-phase confirmations.

Secrets Migrate Mode (--secrets-migrate)

Full walkthrough (per-secret surface/rotate/vault/apply/git-history steps): references/scopes-conditional.md § Secrets Migrate Mode. Every secret is its own needs-approval item and matches the publish/irreversible exception list (rotating/transmitting a real credential) — never decided automatically, default or --ask; each stays skipped (only you can do) until the human acts.

Scopes

Delegation

Owns: regulatory, privacy (canonical — GDPR / KVKK / CCPA / etc.), a11y-regulatory-framing (ADA / EN301549 mapping), security-regulatory, i18n, secrets-migrate (--secrets-migrate) | Delegates: ds-mobile → security/privacy/regulatory when mobile detected (pubspec.yaml / Info.plist / AndroidManifest.xml); ds-frontend → a11y implementation + fixes | Receives: ds-launch → canonical privacy for store labels; ds-ship → Phase 2 regulatory pass; ds-productize → subscription-law + privacy canonical audit

Conditional scopes

Zero-cost when absent.

Execution Flow

Detect → Configure → Scan → Report → [Fix] → [Needs-Approval] → Summary

Phase 1: Detect

1. Upstream artifacts: Profile → Regulations:, Data:, Audience:, Type+Stack. Findings(compliance scopes) → verify + use. Absent → own analysis.
2. Project detection. Search for config to identify type:
   • Web frontend: package.json with react/next/vue/nuxt/angular/svelte/astro
   • API/backend: express/fastify/nestjs, fastapi/django/flask, go.mod with gin/echo, Cargo.toml with actix/axum, spring-boot
   • CLI/library: bin field, commander/yargs/click/cobra/clap, or library exports without bin
   • Override with --type if auto-detection wrong
3. Stack detection. Framework, language, architecture pattern, auth, DB, ORM, API style, testing, CI/CD, i18n, deployment.
4. Scope selection. Default: all applicable domains, and regulatory frameworks detected from codebase patterns (GDPR, KVKK, CCPA, etc.) apply without confirmation. --ask, no --scope: ask which domains; confirm the detected regulatory frameworks.
5. Overlap routing (runtime enforcement of the overlap rules):
   • Mobile project detected (pubspec.yaml with flutter: OR Info.plist OR AndroidManifest.xml) → /ds-mobile present → invoke /ds-mobile --scope=security,privacy,regulatory, wait for completion, read its ds/audit/findings.md updates, remove security/privacy/regulatory from active scope; keep only non-mobile-covered scopes (a11y, i18n, web, network, perf, arch) locally (ds-mobile authoritative; running both duplicates findings). /ds-mobile absent → keep security/privacy/regulatory active; load rules-compliance.md as usual plus references/scopes-conditional.md § Mobile-Fallback Checks; gap-note "deeper mobile-specific coverage (13-domain release audit) requires /ds-mobile" so the reduced depth is visible, never silent.
   • a11y scope active + project has frontend (framework detected in package.json / equivalent) → /ds-frontend present → announce "a11y delegated to /ds-frontend; this run keeps regulatory framing only (ADA/EN301549)." Mark a11y framing-only; emit only regulatory-mapping findings. /ds-frontend absent → audit and CAT-1-fix the full a11y scope directly from rules-a11y.md (A11Y-01–08) plus the regulatory-mapping findings; gap-note "deeper design-system a11y coverage requires /ds-frontend".
   • Privacy scope active → canonical owner. Announce: "/ds-launch --privacy narrows to store-label-correctness. This run emits canonical privacy findings, including event-property PII scanning."

Gate: Project type identified; scope confirmed; regulatory frameworks resolved; overlap routing applied. If fails → type undetected + no --type response → default web, announce, proceed; regulatory ambiguous after detection → default: apply the best-guess framework(s) from detected signals (audience, data locality, stack) and record the assumption in the summary; --ask: present detected signals, require explicit framework selection before proceeding.

Phase 2: Architecture Discovery

When: scope includes 3+ domains or all. Skip for narrow scans.

1. Analyze architecture (pattern, auth, DB, ORM, API style, testing, CI/CD, i18n, deployment).
2. Default: proceed directly on the auto-detected architecture. --ask: present detected architecture for confirmation.
3. Classify rules:
   • CAT-1 Conformance: universal best practice, existing pattern misused, bug, security flaw — auto-fixable
   • CAT-2 Enhancement: new layers/patterns not in current architecture — needs approval
4. Default: none of the enhancement opportunities are included. --ask: present enhancement opportunities, ask which to include.

Gate: Architecture confirmed; every rule classified CAT-1 / CAT-2; approved enhancements finalized. If fails → user unconfirmed (no response or rejection) → re-present detected architecture with brief explanation, ask once more; still unconfirmed → proceed with auto-detected, add WARN: "Architecture unconfirmed — CAT-2 classifications may be inaccurate" to the report.

Phase 3: Rule Loading

Load reference files matching scope:

Gate: All reference files for in-scope domains loaded; unloadable marked N/A. If fails → file missing → mark domain N/A, continue with available, surface missing path in report.

Phase 4: Scan

Per in-scope domain:

1. Search for relevant files.
2. Search contents for violation patterns.
3. Read files to verify findings in context.
4. Skip rules that cannot be verified.
5. Defense-in-depth check (../core/principles.md §5): flag a sensitive operation backed by only one control layer (e.g. input validation with no output encoding and no auth layer) — single-control reliance is itself a finding regardless of that control's strength.

Confidence: HIGH = match + context verified. MEDIUM = pattern, ambiguous. LOW = heuristic.

False-positive prevention: check surrounding context. Never flag // noqa, // intentional, // safe:, _ prefix, TYPE_CHECKING, test fixtures.

Large scope (3+ domains): numbered progress checklist + append findings to ds/audit/findings.md (add to .gitignore) — file exists with git_hash equal to git rev-parse HEAD output → preserve findings from other scopes, append only your own. After each domain scan, append. Enables recovery on context loss.

Gate: Every in-scope domain scanned; findings recorded with severity + confidence. If fails → domain(s) un-scan-able (no scannable source, access denied, reference N/A) → mark inconclusive, continue with successful ones, list skipped domains in Phase 5 report.

Phase 5: Report

## Audit Report — {project-name}
Stack: {stack} | Scanned: {domains} | Date: {today}
Architecture: {detected-summary}

### Conformance Issues (CAT-1)
| # | Rule | Sev | File:Line | Issue | Impact | Fix | Conf |

### Enhancement Opportunities (CAT-2) — pre-approved
| # | Rule | Sev | File:Line | Issue | Impact | Fix | Conf |

### Potential Issues (LOW confidence)
| # | Rule | File:Line | Issue | Suggested Fix |

### Summary
| Category | BLOCKER | CRITICAL | HIGH | MEDIUM | LOW | Total |

Severity: BLOCKER > CRITICAL > HIGH > MEDIUM > LOW. BLOCKER = legally mandated gap with a citable source (regulation article / store policy) — feeds ds-ship's mandated-blocker test; ADVISORY findings never block and never count toward blockers. Uncertain → choose lower.

Gate: Report with findings + severities + summary. If fails → findings list empty because all domains inconclusive or N/A → print report with single section "No verifiable findings — all domains inconclusive or reference files missing", list domains + skip reason, exit with status WARN.

Phase 6: Fix [SKIP if --preview]

Checkpoint pre-step (before the first fix is written, core checkpoint protocol): git status --porcelain → empty → proceed. Non-empty and disjoint from this run's planned writes → proceed, list the dirty paths as untouched. Non-empty and a planned fix touches a dirty path → default: mark that fix skipped (only you can do), continue with disjoint fixes. --ask: show the dirty files, ask Commit first (recommended) / Stash / Proceed anyway (the mechanical-gate revert path git checkout -- {file} also discards pre-existing edits in that file). Never run a bulk fix over uncommitted unrelated changes silently.

Overwrite prevention: before generating/modifying any compliance document (Privacy Policy, DPIA, Breach Plan, Processor Registry), check if target exists. Default: Keep existing when it already has non-trivial content, otherwise update; the decision and diff are recorded in the summary. --ask: show diff between existing + proposed, ask "Update existing / Keep existing / Show diff".

1. Present fix plan — one line per fix ([severity] title — file:line) grouped by category/severity with counts; state the question (Apply these N fixes?). "All" = exactly the displayed set.
2. Default: apply all, summary only. --ask: show plan, offer Apply all / per-severity bulk (Apply all HIGH … alongside the total, CRITICAL bulk still confirms per item) / proceed / cancel.
3. Apply fixes grouped by file. Different files in parallel, same file sequential.

Gate: All standard fixes attempted; each recorded. If fails → CAT-1 fix unappliable (file write error, merge conflict, generated doc exists + user chose "Keep existing") → record failed with specific error, continue with remaining, surface all failed IDs in Phase 8 summary.

Phase 7: Needs-Approval Review [needs_approval > 0]

Default: every item, including CRITICAL, resolves via the same impact/effort/risk reasoning an approval block would show, applied and recorded fixed/failed; items matching the publish/irreversible exception list (e.g. secret rotation, per the Secrets Migrate section) resolve skipped (only you can do) instead. --ask: present each item compactly (one line [severity] title — file:line) grouped by severity with counts, and state the question (Approve these N items?); ask Apply all / per-severity bulk (Apply all HIGH … alongside the total, CRITICAL bulk still confirms per item) / Review Each / Skip All. approve-all excludes CRITICAL; "all" = exactly the displayed set.

Gate: All items resolved (applied → fixed/failed, declined → skipped). If fails → unresolved → re-present each with forced binary prompt (Apply / Skip); user declines → mark skipped (no response), proceed.

Mechanical Done Gate [any fix applied]

Resolve {check-cmd} in Phase 1: ds-quality enforcement arm installed (stop-hook / pre-commit hook / auto-lint) → use its gate command; else detect stack-native format/lint/type/test commands; none detectable → Verification-Infrastructure Gap — report it, offer /ds-quality, record the decision, never silently skip. Run {check-cmd} once at baseline; baseline red → record red-at-baseline — done condition becomes "no new red", baseline reds reported as findings, never inherited as green.

After each Phase 6/7 fix batch: run {check-cmd} on the touched scope. Before Phase 8: run the full {check-cmd} once — aggregate result gates the summary.

Never report OK while {check-cmd} shows a new red.

Phase 8: Summary

ds-compliance: {OK|WARN|FAIL} | Scopes: ran {a,b} · N/A — {c}={reason} | Fixed: {n} | Skipped: {n} | Failed: {n} | Total: {n}

Disposition accounting — totals balance. fixed + failed + skipped + needs_approval + not_applicable = total.

Gate: Summary balances; every modified file re-read. If fails → identify findings without disposition, assign disposition: skipped (accounting-fix), recompute summary, add WARN: "{n} finding(s) auto-skipped to balance accounting".

Effect: 1-5 concrete bullets, real changes only — each states what got better and why it matters, in plain language a non-technical reader understands (quantified when measurable), never the mechanical activity; they are the closing block's Effect line. Example shapes (placeholders, not literal output):

• {n} CRITICAL secrets in source intercepted — credentials no longer leak into git history (rotation guidance attached)
• {regulation} compliance: {n} consent gaps, {n} retention policy gaps closed — exposure window before {audit-date} eliminated

Zero-finding run: Compliance scope clean — no regulatory or security findings.

Quality Gates

1. No cascading breakage after fixes
2. Format preservation (indentation, code style)
3. Scope boundary (only touch required lines)
4. Stack consistency (use correct framework APIs)
5. W10: defer detection to fresh ds/audit/findings.md — own scan only for uncovered scopes.
6. W1: cite file:line, never assume. W2: check consumers after modify. W3: only task-required lines. W4: re-read after gap. W5: uncertain → lower severity. W6: verify all phases output. W7: dedup file:line. W8: no raw shell interpolation. <!-- portable-only -->

Error Recovery

Edge Cases

Completion Evidence — final gate (duplicate of the opening band by design): Before the summary line, show the evidence for every gate that ran — command plus observed output; a phase with no visible output was not executed — execute it now. Report done/OK only with this evidence present; otherwise report INCOMPLETE plus what is missing. <!-- portable-only -->