Continuous Agentic Development (CAD, brain: wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16.md) requires that every issue dispatched to an agentic executor has passed a regulatory risk assessment. This is what differentiates CAD from ad-hoc automation in regulated-industry engagements.
Currently the skills repo has tdd/, feature-spec/, spec-driven-dev/ — the engineering quality layer. The compliance layer is missing.
Scope: regulatory-risk-assessment/SKILL.md
A skill that guides any harness (Claude Code, Crush, Antigravity) through producing a regulatory risk assessment for a feature or component. Structure:
What the skill produces
A docs/risk-register.md section for the feature with:
Risk ID (e.g. R-AUTH-01)
Risk description (what could go wrong)
Regulatory reference (which regulation/obligation is implicated, if any)
Likelihood + impact (H/M/L)
Mitigation (what we're doing about it)
Validation (how we prove the mitigation works — must be a Gitea issue or test)
Status (open | mitigated | accepted)
Trigger phrases for harnesses
"assess regulatory risk", "risk register", "compliance gate", "what are the risks", "regulated-industry checklist"
Integration with the CAD pipeline
The agent-ready issue contract (agentsquad#29) requires a declared risk level (LOW/MEDIUM/HIGH). This skill is how that declaration is produced — via structured assessment, not guesswork.
Integration with assessor-loop
For complex regulatory cases (banking, PSD2/PSR, DORA, AML), the skill routes to mathias/assessor-loop for deep obligation decomposition. For simpler cases it produces a standalone risk register entry.
Acceptance criteria
regulatory-risk-assessment/SKILL.md exists with purpose, triggers, and mechanics
Skill produces a structured docs/risk-register.md entry (schema defined in SKILL.md)
Risk IDs are namespaced and linkable from Gitea issues
Integration with assessor-loop documented (when to use it vs standalone)
SKILLS_INDEX.md updated
Installed and smoke-tested on koala via task skills:install
Risk
LOW — markdown only, no code. Worst case: the skill is poorly written and gets revised.
## Context — CAD compliance gate
Continuous Agentic Development (CAD, brain: `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16.md`) requires that every issue dispatched to an agentic executor has passed a regulatory risk assessment. This is what differentiates CAD from ad-hoc automation in regulated-industry engagements.
Currently the skills repo has `tdd/`, `feature-spec/`, `spec-driven-dev/` — the engineering quality layer. The compliance layer is missing.
## Scope: `regulatory-risk-assessment/SKILL.md`
A skill that guides any harness (Claude Code, Crush, Antigravity) through producing a regulatory risk assessment for a feature or component. Structure:
### What the skill produces
A `docs/risk-register.md` section for the feature with:
- Risk ID (e.g. `R-AUTH-01`)
- Risk description (what could go wrong)
- Regulatory reference (which regulation/obligation is implicated, if any)
- Likelihood + impact (H/M/L)
- Mitigation (what we're doing about it)
- Validation (how we prove the mitigation works — must be a Gitea issue or test)
- Status (`open` | `mitigated` | `accepted`)
### Trigger phrases for harnesses
"assess regulatory risk", "risk register", "compliance gate", "what are the risks", "regulated-industry checklist"
### Integration with the CAD pipeline
The agent-ready issue contract (agentsquad#29) requires a declared risk level (LOW/MEDIUM/HIGH). This skill is how that declaration is produced — via structured assessment, not guesswork.
### Integration with assessor-loop
For complex regulatory cases (banking, PSD2/PSR, DORA, AML), the skill routes to `mathias/assessor-loop` for deep obligation decomposition. For simpler cases it produces a standalone risk register entry.
## Acceptance criteria
- [ ] `regulatory-risk-assessment/SKILL.md` exists with purpose, triggers, and mechanics
- [ ] Skill produces a structured `docs/risk-register.md` entry (schema defined in SKILL.md)
- [ ] Risk IDs are namespaced and linkable from Gitea issues
- [ ] Integration with assessor-loop documented (when to use it vs standalone)
- [ ] SKILLS_INDEX.md updated
- [ ] Installed and smoke-tested on koala via `task skills:install`
## Risk
**LOW** — markdown only, no code. Worst case: the skill is poorly written and gets revised.
You are starting a focused skills session on koala.
First: brain_context wing=telos limit=8
## Session objective
Add two new skills to mathias/skills, commit, push, and install across
all harnesses. Closes skills#3 and skills#4.
---
## Task 1 — Add telos-load skill
Create file: skills/telos-load/SKILL.md with this content:
# telos-load
Load TELOS — the intention substrate — into a session so every decision
can be traced back to a goal, and every goal to a problem.
**Use when:** starting any session on koala (Claude Code, Crush,
Antigravity), or whenever a session needs to know what we are optimizing
toward. If you find yourself making architectural decisions without knowing
the active goals, load TELOS first.
**Do not skip:** a session without TELOS context is flying blind. It may
produce technically correct output that is strategically wrong.
## What TELOS is
TELOS is a wing in brain (wiki/telos/decisions/) containing 9 files:
PROBLEMS, MISSION, GOALS, CHALLENGES, PROJECTS, STRATEGIES, BELIEFS,
WRONG, STATUS. Together they answer: what are we working against, what
are we trying to build, and how do we approach the work?
Full aggregate: wiki/telos/decisions/principal-telos.md
## Loading TELOS by harness
### Claude Code (per-project CLAUDE.md)
Add to the project CLAUDE.md or ~/.claude/CLAUDE.md:
## Intention context (TELOS)
At session start, call brain_context with wing=telos and limit=8.
Fallback if brain MCP unavailable:
wiki/telos/decisions/principal-telos.md in the brain repo.
The global ~/.claude/CLAUDE.md was wired on koala on 2026-06-16.
### Crush
Location on koala: ~/.config/crush/CRUSH.md (auto-loaded via
global_context_paths). Add:
## Intention context (TELOS)
At session start: query brain MCP with wing=telos, limit=8.
If brain MCP unavailable: read wiki/telos/decisions/principal-telos.md
### Antigravity
Add @brain_context wing=telos directive at top of system instructions.
### Fallback — no brain MCP
cat ~/dev/AI/brain/wiki/telos/decisions/principal-telos.md
Or @-import in CLAUDE.md:
@~/dev/AI/brain/wiki/telos/decisions/principal-telos.md
## Verification
brain_query wing=telos limit=3
→ Expected: PROBLEMS, MISSION, GOALS returned
brain_answer "what am I currently optimizing toward?"
→ Expected: non-empty, telos-sourced
→ If empty: use brain_query wing=telos (known fallback, brain#11 fixed)
## When TELOS is stale
Update STATUS.md via:
brain_write wing=telos hall=decisions filename=STATUS
## Relationship to CAD
TELOS is the intention layer in the CAD pipeline. Every Gitea issue
created in a CAD session should trace to a TELOS GOAL. Every GOAL
traces to a PROBLEM.
Traceability chain: PROBLEM → GOAL → SPEC → TICKET → IMPL → TEST
---
## Task 2 — Add regulatory-risk-assessment skill
Create file: skills/regulatory-risk-assessment/SKILL.md with this content:
# regulatory-risk-assessment
Produce a structured regulatory risk assessment for a feature, component,
or integration — generating a risk register entry that satisfies the
audit requirements of regulated-industry clients (banking, finance,
insurance, PSD2/PSR, DORA, AML/KYC contexts).
**Use when:**
- Filing a Gitea issue dispatched via CAD (needs Risk: LOW/MEDIUM/HIGH)
- Designing a feature touching payments, auth, data storage, external APIs
- Preparing a client deliverable in a regulated industry
- "what are the risks?" / "compliance gate" / "risk register" in session
**Do not use for:** routine refactoring, docs-only changes, internal
tooling with no external data or user impact.
## What this skill produces
A docs/risk-register.md section with this schema:
### R-[DOMAIN]-[NN] — [Short risk title]
| Field | Value |
|-------|-------|
| Risk | What could go wrong (concrete, specific) |
| Regulatory reference | Which obligation/regulation, if any |
| Likelihood | H / M / L |
| Impact | H / M / L |
| Overall | H / M / L (highest of likelihood x impact) |
| Mitigation | What we are doing about it |
| Validation | Test name or Gitea issue number |
| Status | open / mitigated / accepted |
Risk ID namespace:
R-AUTH-NN authentication and authorization
R-DATA-NN data storage, retention, privacy
R-API-NN external API integration
R-PAY-NN payment and financial transactions
R-INFRA-NN infrastructure and availability
R-AGENT-NN agentic / AI execution
R-COMP-NN compliance and regulatory obligation
## Mechanics
Step 1 — Scope the assessment
1. What external systems does this touch?
2. What user data does it read, write, or transmit?
3. What happens on silent failure? Loud failure?
4. What is the blast radius of a worst-case bug?
5. Is a regulation implicated?
Step 2 — Enumerate risks (common examples)
Auth/OAuth: token theft, refresh failure, insufficient scope
Email/Gmail: misclassification archives HUMAN thread, PII in logs
Payment/PAIN.001: wrong amount, duplicate submission, missing field
Agentic: irreversible action without approval, prompt injection, spirals
Infra: single point of failure, secret in logs
Step 3 — Declare overall risk level
Highest individual risk = feature overall level (LOW/MEDIUM/HIGH).
This is the **Risk:** declaration in the CAD agent-ready issue contract.
Step 4 — Write validations
Every mitigation needs a validation:
- Specific test name (TestXxx)
- Gitea issue number
- Manual verification step with acceptance criteria
Not acceptable: "will test later", "review manually"
Step 5 — Update docs/risk-register.md
Append entries. Create if absent:
# Risk Register
All entries follow R-[DOMAIN]-[NN] schema.
See skills/regulatory-risk-assessment/SKILL.md for conventions.
Last updated: [date]
## Integration with assessor-loop
For complex regulated-industry features (PSD2/PSR, DORA, AML), route to
mathias/assessor-loop for deep obligation decomposition first.
Use this skill standalone for internal tooling or general engineering risk.
## Integration with CAD
Every CAD-dispatched issue must include:
**Risk:** LOW | MEDIUM | HIGH
CAD pre-flight (agentsquad#29) rejects issues without it.
If genuinely no risks: declare LOW and note why.
## Example entry
### R-DATA-01 — Email misclassification archives a HUMAN thread
| Field | Value |
|-------|-------|
| Risk | LLM labels a real person's email as NOISE, causing auto-archive |
| Regulatory reference | None (internal) |
| Likelihood | M |
| Impact | H |
| Overall | H |
| Mitigation | Phase 1 read-only; HUMAN class never auto-archived in any phase |
| Validation | TestClassifier_HumanThreadNeverArchived; 1-week Phase 1 review |
| Status | open |
---
## Task 3 — Update SKILLS_INDEX.md
Add two rows to the skills table:
| `telos-load` | Load TELOS intention substrate at session start | Starting any koala session; before architectural decisions; CAD pipeline entry |
| `regulatory-risk-assessment` | Structured risk register for regulated-industry features | Filing a CAD issue (needs Risk: level); features touching payments, auth, external APIs, user data |
Add to Quick Triggers section:
| "What are the risks?" / "compliance gate" / "risk register" | `regulatory-risk-assessment` |
| "Start of session" / "load TELOS" / "what are we optimizing toward?" | `telos-load` |
---
## Task 4 — Commit and push
cd ~/dev/AI/skills
git add telos-load/ regulatory-risk-assessment/ SKILLS_INDEX.md
git commit -m "feat: add telos-load and regulatory-risk-assessment skills
- telos-load: harness-agnostic TELOS session context loading (closes #4)
- regulatory-risk-assessment: CAD compliance gate + risk register (closes #3)
Bump-Type: minor"
git push origin main
---
## Task 5 — Install on koala
task skills:install
Verify:
ls ~/.claude/skills/ | grep -E "telos-load|regulatory-risk-assessment"
ls ~/.config/crush/skills/ | grep -E "telos-load|regulatory-risk-assessment"
Both should appear in both harness skill dirs.
---
## Task 6 — Close issues and report back
Close skills#3 and skills#4 in Gitea.
Report:
1. Commit SHA
2. Install output (both skills in Claude Code + Crush dirs)
3. skills#3 and #4 closed
4. Any surprises
## Koala execution prompt
```
You are starting a focused skills session on koala.
First: brain_context wing=telos limit=8
## Session objective
Add two new skills to mathias/skills, commit, push, and install across
all harnesses. Closes skills#3 and skills#4.
---
## Task 1 — Add telos-load skill
Create file: skills/telos-load/SKILL.md with this content:
# telos-load
Load TELOS — the intention substrate — into a session so every decision
can be traced back to a goal, and every goal to a problem.
**Use when:** starting any session on koala (Claude Code, Crush,
Antigravity), or whenever a session needs to know what we are optimizing
toward. If you find yourself making architectural decisions without knowing
the active goals, load TELOS first.
**Do not skip:** a session without TELOS context is flying blind. It may
produce technically correct output that is strategically wrong.
## What TELOS is
TELOS is a wing in brain (wiki/telos/decisions/) containing 9 files:
PROBLEMS, MISSION, GOALS, CHALLENGES, PROJECTS, STRATEGIES, BELIEFS,
WRONG, STATUS. Together they answer: what are we working against, what
are we trying to build, and how do we approach the work?
Full aggregate: wiki/telos/decisions/principal-telos.md
## Loading TELOS by harness
### Claude Code (per-project CLAUDE.md)
Add to the project CLAUDE.md or ~/.claude/CLAUDE.md:
## Intention context (TELOS)
At session start, call brain_context with wing=telos and limit=8.
Fallback if brain MCP unavailable:
wiki/telos/decisions/principal-telos.md in the brain repo.
The global ~/.claude/CLAUDE.md was wired on koala on 2026-06-16.
### Crush
Location on koala: ~/.config/crush/CRUSH.md (auto-loaded via
global_context_paths). Add:
## Intention context (TELOS)
At session start: query brain MCP with wing=telos, limit=8.
If brain MCP unavailable: read wiki/telos/decisions/principal-telos.md
### Antigravity
Add @brain_context wing=telos directive at top of system instructions.
### Fallback — no brain MCP
cat ~/dev/AI/brain/wiki/telos/decisions/principal-telos.md
Or @-import in CLAUDE.md:
@~/dev/AI/brain/wiki/telos/decisions/principal-telos.md
## Verification
brain_query wing=telos limit=3
→ Expected: PROBLEMS, MISSION, GOALS returned
brain_answer "what am I currently optimizing toward?"
→ Expected: non-empty, telos-sourced
→ If empty: use brain_query wing=telos (known fallback, brain#11 fixed)
## When TELOS is stale
Update STATUS.md via:
brain_write wing=telos hall=decisions filename=STATUS
## Relationship to CAD
TELOS is the intention layer in the CAD pipeline. Every Gitea issue
created in a CAD session should trace to a TELOS GOAL. Every GOAL
traces to a PROBLEM.
Traceability chain: PROBLEM → GOAL → SPEC → TICKET → IMPL → TEST
---
## Task 2 — Add regulatory-risk-assessment skill
Create file: skills/regulatory-risk-assessment/SKILL.md with this content:
# regulatory-risk-assessment
Produce a structured regulatory risk assessment for a feature, component,
or integration — generating a risk register entry that satisfies the
audit requirements of regulated-industry clients (banking, finance,
insurance, PSD2/PSR, DORA, AML/KYC contexts).
**Use when:**
- Filing a Gitea issue dispatched via CAD (needs Risk: LOW/MEDIUM/HIGH)
- Designing a feature touching payments, auth, data storage, external APIs
- Preparing a client deliverable in a regulated industry
- "what are the risks?" / "compliance gate" / "risk register" in session
**Do not use for:** routine refactoring, docs-only changes, internal
tooling with no external data or user impact.
## What this skill produces
A docs/risk-register.md section with this schema:
### R-[DOMAIN]-[NN] — [Short risk title]
| Field | Value |
|-------|-------|
| Risk | What could go wrong (concrete, specific) |
| Regulatory reference | Which obligation/regulation, if any |
| Likelihood | H / M / L |
| Impact | H / M / L |
| Overall | H / M / L (highest of likelihood x impact) |
| Mitigation | What we are doing about it |
| Validation | Test name or Gitea issue number |
| Status | open / mitigated / accepted |
Risk ID namespace:
R-AUTH-NN authentication and authorization
R-DATA-NN data storage, retention, privacy
R-API-NN external API integration
R-PAY-NN payment and financial transactions
R-INFRA-NN infrastructure and availability
R-AGENT-NN agentic / AI execution
R-COMP-NN compliance and regulatory obligation
## Mechanics
Step 1 — Scope the assessment
1. What external systems does this touch?
2. What user data does it read, write, or transmit?
3. What happens on silent failure? Loud failure?
4. What is the blast radius of a worst-case bug?
5. Is a regulation implicated?
Step 2 — Enumerate risks (common examples)
Auth/OAuth: token theft, refresh failure, insufficient scope
Email/Gmail: misclassification archives HUMAN thread, PII in logs
Payment/PAIN.001: wrong amount, duplicate submission, missing field
Agentic: irreversible action without approval, prompt injection, spirals
Infra: single point of failure, secret in logs
Step 3 — Declare overall risk level
Highest individual risk = feature overall level (LOW/MEDIUM/HIGH).
This is the **Risk:** declaration in the CAD agent-ready issue contract.
Step 4 — Write validations
Every mitigation needs a validation:
- Specific test name (TestXxx)
- Gitea issue number
- Manual verification step with acceptance criteria
Not acceptable: "will test later", "review manually"
Step 5 — Update docs/risk-register.md
Append entries. Create if absent:
# Risk Register
All entries follow R-[DOMAIN]-[NN] schema.
See skills/regulatory-risk-assessment/SKILL.md for conventions.
Last updated: [date]
## Integration with assessor-loop
For complex regulated-industry features (PSD2/PSR, DORA, AML), route to
mathias/assessor-loop for deep obligation decomposition first.
Use this skill standalone for internal tooling or general engineering risk.
## Integration with CAD
Every CAD-dispatched issue must include:
**Risk:** LOW | MEDIUM | HIGH
CAD pre-flight (agentsquad#29) rejects issues without it.
If genuinely no risks: declare LOW and note why.
## Example entry
### R-DATA-01 — Email misclassification archives a HUMAN thread
| Field | Value |
|-------|-------|
| Risk | LLM labels a real person's email as NOISE, causing auto-archive |
| Regulatory reference | None (internal) |
| Likelihood | M |
| Impact | H |
| Overall | H |
| Mitigation | Phase 1 read-only; HUMAN class never auto-archived in any phase |
| Validation | TestClassifier_HumanThreadNeverArchived; 1-week Phase 1 review |
| Status | open |
---
## Task 3 — Update SKILLS_INDEX.md
Add two rows to the skills table:
| `telos-load` | Load TELOS intention substrate at session start | Starting any koala session; before architectural decisions; CAD pipeline entry |
| `regulatory-risk-assessment` | Structured risk register for regulated-industry features | Filing a CAD issue (needs Risk: level); features touching payments, auth, external APIs, user data |
Add to Quick Triggers section:
| "What are the risks?" / "compliance gate" / "risk register" | `regulatory-risk-assessment` |
| "Start of session" / "load TELOS" / "what are we optimizing toward?" | `telos-load` |
---
## Task 4 — Commit and push
cd ~/dev/AI/skills
git add telos-load/ regulatory-risk-assessment/ SKILLS_INDEX.md
git commit -m "feat: add telos-load and regulatory-risk-assessment skills
- telos-load: harness-agnostic TELOS session context loading (closes #4)
- regulatory-risk-assessment: CAD compliance gate + risk register (closes #3)
Bump-Type: minor"
git push origin main
---
## Task 5 — Install on koala
task skills:install
Verify:
ls ~/.claude/skills/ | grep -E "telos-load|regulatory-risk-assessment"
ls ~/.config/crush/skills/ | grep -E "telos-load|regulatory-risk-assessment"
Both should appear in both harness skill dirs.
---
## Task 6 — Close issues and report back
Close skills#3 and skills#4 in Gitea.
Report:
1. Commit SHA
2. Install output (both skills in Claude Code + Crush dirs)
3. skills#3 and #4 closed
4. Any surprises
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Context — CAD compliance gate
Continuous Agentic Development (CAD, brain:
wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16.md) requires that every issue dispatched to an agentic executor has passed a regulatory risk assessment. This is what differentiates CAD from ad-hoc automation in regulated-industry engagements.Currently the skills repo has
tdd/,feature-spec/,spec-driven-dev/— the engineering quality layer. The compliance layer is missing.Scope:
regulatory-risk-assessment/SKILL.mdA skill that guides any harness (Claude Code, Crush, Antigravity) through producing a regulatory risk assessment for a feature or component. Structure:
What the skill produces
A
docs/risk-register.mdsection for the feature with:R-AUTH-01)open|mitigated|accepted)Trigger phrases for harnesses
"assess regulatory risk", "risk register", "compliance gate", "what are the risks", "regulated-industry checklist"
Integration with the CAD pipeline
The agent-ready issue contract (agentsquad#29) requires a declared risk level (LOW/MEDIUM/HIGH). This skill is how that declaration is produced — via structured assessment, not guesswork.
Integration with assessor-loop
For complex regulatory cases (banking, PSD2/PSR, DORA, AML), the skill routes to
mathias/assessor-loopfor deep obligation decomposition. For simpler cases it produces a standalone risk register entry.Acceptance criteria
regulatory-risk-assessment/SKILL.mdexists with purpose, triggers, and mechanicsdocs/risk-register.mdentry (schema defined in SKILL.md)task skills:installRisk
LOW — markdown only, no code. Worst case: the skill is poorly written and gets revised.
Koala execution prompt