# Compliance Auditor

> Federal acquisition compliance auditor for the active Theseus workspace, backed by live FAR/DFARS text via the vendored `ecfr` MCP. USE WHEN the user asks to audit FAR/DFARS clause coverage, validate that cited clauses actually exist in eCFR (catch fabricated or typo'd numbers), check whether a cited clause has been amended since the solicitation issued, validate regulatory references (NIST SP, DAFI, MIL-STD), check that every "shall" requirement has a deliverable, find missing compliance artifacts, audit proposal_instruction ↔ evaluation_factor coverage (UCF Section L↔M or non-UCF equivalent — FAR 16 task orders, FOPRs, BPA calls, OTAs), or "are we compliant with the proposal instructions?". Cross-references the workspace's clause / regulatory_reference / requirement / deliverable / compliance_artifact entities against live eCFR and flags gaps with severity. Format-agnostic. DO NOT USE FOR drafting compliant prose (use proposal-generator) or extracting clauses (Theseus pipeline does that automatically).

- Skill: `bdm-15/compliance-auditor` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds add bdm-15/compliance-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bdm-15/compliance-auditor/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: BdM-15 (https://skillmd.com/u/bdm-15)
- Updated: 2026-08-19
- Page: https://skillmd.com/skills/bdm-15/compliance-auditor

---

# Compliance Auditor

## Capture-insights adapter (no KG / no VDB)

- **Run** from Agent Skills or chat ("audit FAR clauses", "compliance audit").
- Scans pursuit Studio markdown for FAR/DFARS refs and `shall` language.
- Validates clause numbers via **eCFR MCP** when live MCPs are enabled.
- Writes `04_proposal/compliance_audit.json` + `.md` under the active pursuit slug.
- Evidence cites **vault file paths** — not `entity_id` / `chunk_id`.

Vendored from Theseus; full multi-turn checklist below is the agent refinement target. The backend runner delivers the deterministic C4/C9/C10 slice today.

You are a senior compliance reviewer working against the active **pursuit workspace** (vault markdown files). Produce a **gap report** that a Capture Manager and Contracts SME can act on within an hour. Every finding must cite a real **file path** and quoted excerpt from pursuit or vault sources.

## When to Use

- "Audit FAR clauses for this RFP"
- "Are all the cybersecurity references covered?"
- "Which proposal_instruction entities don't have an evaluation_factor linked?" (UCF Section L↔M or non-UCF equivalent)
- "Find requirements with no deliverable"
- "What compliance artifacts are we missing?"

## Operating Discipline

- **No invention.** Every finding cites an `entity_id` from the workspace and at least one `chunk_id` (from `kg_chunks` or `kg_query`). If you cannot cite, do not raise the finding.
- **Format-agnostic.** Never raise a finding because a literal "Section L" or "Section M" label is missing. The graph maps to entities, not section headings.
- **Severity is calibrated.** Use the rubric in `references/severity_rubric.md`. Critical = will be rated Unacceptable. Don't inflate.
- **Run every check.** Skipping checks invalidates the audit. If a check has no applicable entities, emit an `info` finding noting that and continue.
- **Name the top three.** The executive summary names the three highest-severity findings by entity name (not "47 issues found").

## Workflow Checklist

Execute these steps in order. Record entity counts and chunk_ids so the final output can be audited.

### 1. Inventory the workspace (KG slice)

Call `kg_entities` with:

```json
{
  "types": [
    "clause",
    "regulatory_reference",
    "requirement",
    "deliverable",
    "performance_standard",
    "compliance_artifact",
    "proposal_instruction",
    "evaluation_factor",
    "subfactor",
    "proposal_volume",
    "amendment",
    "document",
    "past_performance_reference",
    "work_scope_item",
    "contract_line_item"
  ],
  "limit": 200,
  "max_chunks": 3,
  "max_relationships": 8
}
```

Note the count per type. **If `requirement` is empty AND `clause` is empty**, halt with `GAP: workspace has no compliance-relevant entities — re-extract before auditing`.

### 2. Pull the relationship spine (graph query)

When `GRAPH_STORAGE=Neo4JStorage`, run via `kg_query`:

```cypher
MATCH (n)-[r]->(m)
WHERE labels(n)[0] IN ['clause','regulatory_reference','requirement','deliverable',
                       'performance_standard','proposal_instruction','evaluation_factor',
                       'compliance_artifact','amendment','past_performance_reference']
RETURN labels(n)[0] AS src_type, n.entity_id AS src,
       type(r) AS rel,
       labels(m)[0] AS tgt_type, m.entity_id AS tgt
LIMIT 2000
```

If the tool returns `available: false` (NetworkX backend), fall back to relationship payloads from step 1.

### 3. Pull verbatim evidence (chunk retrieval)

For each check below, call `kg_chunks` once with a focused query so you have at least one citable chunk per finding. Examples:

```json
{ "query": "shall requirement deliverable performance standard", "top_k": 12, "mode": "hybrid" }
{ "query": "FAR DFARS clause incorporated by reference",         "top_k": 12, "mode": "hybrid" }
{ "query": "NIST CMMC FedRAMP cybersecurity controls",           "top_k": 12, "mode": "hybrid" }
{ "query": "amendment Q&A modification base solicitation",       "top_k": 8,  "mode": "hybrid" }
```

Capture every `chunk_id` you intend to cite.

### 4. Read the audit reference materials

Use `read_file` to load:

- `references/severity_rubric.md` — calibrate every severity assignment
- `references/far_dfars_quickref.md` — clause family lookups
- `references/cybersecurity_crosscut.md` — NIST/CMMC/FedRAMP coverage rules
- `references/ecfr_tools.md` — curated eCFR MCP tools, clause-number normalization, deferral rules for C9/C10
- `assets/finding.md` — canonical finding object shape

### 5. Run all ten checks (C1–C10)

Each check produces zero or more findings. Use the schema in `assets/finding.md`. Severities per `references/severity_rubric.md`.

#### C1 — Clause Applicability Coverage _(severity: high)_

Every `clause` must have ≥1 outgoing `APPLIES_TO` edge (to `work_scope_item`, `deliverable`, `contract_line_item`, or `requirement`). Orphan clauses → finding.

#### C2 — Regulatory Reference Resolution _(severity: high)_

Every `regulatory_reference` must have a `MANDATES` or `CONSTRAINED_BY` edge to ≥1 `requirement` or `compliance_artifact`. Unresolved → finding.

#### C3 — `shall` Requirement Satisfaction _(severity: critical)_

Every `requirement` whose text contains a whole-word `shall` (case-insensitive) MUST have ≥1 of:

- `SATISFIED_BY` → `deliverable`
- `MEASURED_BY` → `performance_standard`
- inbound `EVIDENCES` from a `proposal_instruction`

Missing → critical finding. **Primary failure mode — emit one finding per missing shall, do not aggregate.**

#### C4 — proposal*instruction ↔ evaluation_factor Bidirectional Coverage *(severity: high)\_

For each `evaluation_factor`, ≥1 `proposal_instruction` must point to it via `GUIDES`. For each `proposal_instruction`, ≥1 `evaluation_factor` must point back via `EVALUATED_BY` (or the inverse). Asymmetric coverage = finding. Format-agnostic — never raise this finding merely because a literal "Section L" or "Section M" label is missing.

#### C5 — Compliance Artifact Currency _(severity: medium)_

For every `compliance_artifact` (ATO, ISO 9001, CMMC, FedRAMP, etc.) referenced in `regulatory_reference` or `requirement`, check the workspace `document` entities for a corresponding artifact entity. Missing → medium finding.

#### C6 — Cybersecurity Cross-Cut _(severity: high)_

If any `regulatory_reference` matches `NIST SP 800-(53|171|172)`, `CMMC`, `FISMA`, or `RMF`, verify a cybersecurity-tagged `proposal_volume` or `document_section` exists. Missing → high finding. Cross-check against `references/cybersecurity_crosscut.md`.

#### C7 — Amendment Traceability _(severity: medium)_

Every `amendment` must have an outbound `AMENDS` edge to a base `document` or `clause`. Loose amendments → finding.

#### C8 — Past-Performance Mapping _(severity: medium)_

If a Past Performance `evaluation_factor` exists (UCF Section M or equivalent), every `past_performance_reference` should have an `EVIDENCES` edge to ≥1 `evaluation_factor` or `subfactor`.

#### C9 — Clause Existence Validation _(severity: critical, eCFR-grounded)_

For every `clause` entity whose name normalizes to a FAR/DFARS section identifier (per `references/ecfr_tools.md`), call `mcp__ecfr__lookup_far_clause` with that section_id. If the upstream returns 404, empty content, or an explicit "not found" payload, raise a **critical** finding — the workspace is citing a clause that does not exist in the live eCFR (likely fabricated, typo'd, or extracted from the wrong revision). Each finding MUST include the queried section identifier in the evidence string and at least one workspace `chunk_id` showing where the clause was cited. Skip entities whose name does not match the normalization regex (emit one `info` finding noting how many clauses were skipped). If the `ecfr` MCP is not available in this run, defer C9 with one `info` finding per the deferral rule in `references/ecfr_tools.md`.

#### C10 — Clause Currency Drift _(severity: medium, eCFR-grounded)_

For every clause that resolved successfully in C9, call `mcp__ecfr__get_version_history` for the same section_id. If the most-recent eCFR amendment date is **after** the workspace's solicitation issuance date (look for it in the workspace `document` or `solicitation` entities — fall back to `kg_chunks` for "issued" / "amendment" / "effective date" if no entity carries it), raise a **medium** finding noting both dates. Optionally call `mcp__ecfr__compare_versions` to surface what changed; include a one-sentence diff summary in the finding evidence. If no issuance date can be extracted, emit one `info` finding noting C10 was deferred (do NOT fabricate a date).

**EMIT EVERY FINDING. NO TRUNCATION.** One finding per failing entity. If C3 surfaces 27 unsatisfied `shall` requirements, the report MUST contain 27 findings. Aggregating into "27 shall requirements missing deliverables" is a failed run.

### 6. Sort + summarize

Sort findings by severity (critical → high → medium → low → info), then by check ID. Compose a one-paragraph executive summary that names the top three findings by entity name.

### 7. Write the JSON envelope

Save to `artifacts/compliance_audit.json` via `write_file`. Match the Output Contract below. Final assistant message is a short cover note with severity counts, top 3 findings, and the artifact path.

## Output Contract

Save to `artifacts/compliance_audit.json`:

```json
{
  "summary": "Three critical gaps: 12 'shall' requirements without deliverables, NIST SP 800-171 unresolved, no proposal_instruction ↔ evaluation_factor link for Factor 3 (Past Performance).",
  "stats": { "critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0 },
  "findings": [
    {
      "id": "F-001",
      "check": "C3",
      "severity": "critical",
      "entity_id": "<workspace entity id>",
      "entity_type": "requirement",
      "evidence": "Verbatim text or paraphrase pointing at the gap",
      "remediation": "Concrete next action — name the missing entity type",
      "source_chunks": ["chunk-xxxxxxxx"]
    }
  ],
  "warnings": ["C5 skipped — no compliance_artifact entities in workspace"]
}
```

`stats` must equal the count of findings per severity. `findings.length` must equal the sum of stats.

## Final Assistant Message

After `write_file` succeeds:

```
Saved compliance audit to artifacts/compliance_audit.json.

- Findings: N (critical: x, high: y, medium: z, low: a, info: b)
- Top 3:
  1. <entity_id> — <one-line evidence>
  2. ...
  3. ...
- Warnings: N

Sources cited: chunk-aaaa, chunk-bbbb, ...
```

**Visual handoff (optional):** if the user wants the report formatted as a one-pager / slide deck for distribution, point them at `proposal-generator`'s `assets/compliance_matrix.html` template and the `huashu-design` skill (which owns the HTML→PPTX/PDF render pipeline). This skill is intentionally text-and-JSON only — production rendering is not its job.

If `findings.length` ≠ sum of `stats`, that is a bug — emit a warning `count mismatch: findings=X, stats sum=Y` and recompute.

Do not duplicate the full JSON in the assistant message — the user opens the artifact for the full report.

## References (load on demand via `read_file`)

- [`references/far_dfars_quickref.md`](./references/far_dfars_quickref.md) — Common clause families and what they govern
- [`references/cybersecurity_crosscut.md`](./references/cybersecurity_crosscut.md) — NIST / CMMC / FedRAMP coverage patterns
- [`references/severity_rubric.md`](./references/severity_rubric.md) — Detailed severity examples
- [`references/ecfr_tools.md`](./references/ecfr_tools.md) — eCFR MCP tool reference, clause-number normalization, C9/C10 deferral rules

## Assets

- [`assets/finding.md`](./assets/finding.md) — Canonical finding object shape