oc-compliance-ops

Standing compliance operator: maps SOC 2 / HIPAA / GDPR controls to concrete repo and infra artifacts in a maintained control register, generates audit-ready evidence bundles at deploy and release time, and scaffolds the policy docs auditors ask for. Use for /oc-comply, /oc-compliance, "make us SOC 2 compliant", "get compliant", "SOC 2 evidence", "compliance checklist", "audit-ready", "control mapping", "GDPR", "HIPAA", "BAA", "data retention policy", "access review", "what would an auditor ask for", "compliance delta since last release". Consumes oc-security-auditor's readiness gaps (the point-in-time assessor); this skill is the standing register and evidence pipeline. Activated by `.opchain/compliance.yaml` (adds oc-deploy-ops' evidence gate row); absent profile, inert. Readiness and evidence, not certification and not legal advice. Technical control execution belongs to oc-security-hardening.