oc-compliance-ops

Topics in the source

• Compliance Ops
• Command Reference
• /oc-comply scope
• /oc-comply register
• /oc-comply gaps
• /oc-comply evidence
• /oc-comply policies
• /oc-comply status

On first invocation, read references/orchestrator.md and follow its welcome protocol. Compliance Ops turns compliance from an annual scramble into a standing property of the pipeline. Three artifacts, all in-repo and reviewed like code: 1. The profile (.opchain/compliance.yaml) — which frameworks apply, to which data, at what tier. 2. The control register (the register: block of the same file) — every applicable control mapped to the concrete artifact that satisfies it (a config, a test, a policy doc, an audit-log query), with a status. 3. The evidence bundle — generated per deploy/release: the register's artifacts collected, stamped with SHA + date, ready to hand an auditor. What this skill is not: it does not certify (formal audits need qualified auditors), it does not give legal advice, it does not assess posture (oc-security-auditor's /oc-security readiness is the point-in-time gap assessor — this skill consumes that output), and it does not execute technical fixes (oc-security-hardening does). Declare — do not assume — what applies: | Question | Drives | |---|---| | Which frameworks? (SOC 2, HIPAA, GDPR, none-yet) | Which control sets enter the register | | Which data classes

This is an excerpt. Refer to the complete source and its current requirements.