Skill: teoslayer/pilot-compliance-governance-setup (version 1.0.0)

--- name: pilot-compliance-governance-setup description: > Deploy a compliance and governance system with 4 agents. Use this skill when: 1. User wants to set up automated compliance enforcement 2. User is configuring a policy engine, auditor, certifier, or reporter agent 3. User asks about governance rules, audit trails, or compliance certification Do NOT use this skill when: - User wants a single audit log (use pilot-audit-log instead) - User wants to issue a single certificate (use pilot-certificate instead) tags: - pilot-protocol - setup - compliance - governance license: AGPL-3.0 metadata: author: vulture-labs version: "1.0" openclaw: requires: bins: - pilotctl - clawhub homepage: https://pilotprotocol.network allowed-tools: - Bash --- # Compliance & Governance Setup Deploy 4 agents: policy engine, auditor, certifier, and reporter. ## Roles | Role | Hostname | Skills | Purpose | |------|----------|--------|---------| | policy-engine | `<prefix>-policy` | pilot-event-filter, pilot-sla, pilot-workflow, pilot-task-chain | Evaluates governance rules | | auditor | `<prefix>-auditor` | pilot-audit-log, pilot-verify, pilot-event-log, pilot-cron | Tamper-evident audit trail | | certifier | `<prefix>-certifier` | pilot-certificate, pilot-keychain, pilot-verify, pilot-receipt | Issues compliance certificates | | reporter | `<prefix>-reporter` | pilot-metrics, pilot-webhook-bridge, pilot-slack-bridge, pilot-archive | Generates compliance reports | ## Setup Procedure **Step 1:** Ask the user which role and prefix. **Step 2:** Install skills: ```bash # policy-engine: clawhub install pilot-event-filter pilot-sla pilot-workflow pilot-task-chain # auditor: clawhub install pilot-audit-log pilot-verify pilot-event-log pilot-cron # certifier: clawhub install pilot-certificate pilot-keychain pilot-verify pilot-receipt # reporter: clawhub install pilot-metrics pilot-webhook-bridge pilot-slack-bridge pilot-archive ``` **Step 3:** Set hostname and write manifest to `~/.pilot/setups/compliance-governance.json`. **Step 4:** Handshake: policy↔auditor, policy↔certifier, auditor↔reporter, certifier↔reporter. ## Manifest Templates Per Role ### policy-engine ```json { "setup": "compliance-governance", "role": "policy-engine", "role_name": "Policy Engine", "hostname": "<prefix>-policy", "skills": { "pilot-event-filter": "Evaluate agent actions against governance rules.", "pilot-sla": "Enforce SLA policies and response deadlines.", "pilot-workflow": "Define multi-step compliance workflows.", "pilot-task-chain": "Chain policy checks sequentially." }, "data_flows": [ { "direction": "send", "peer": "<prefix>-auditor", "port": 1002, "topic": "policy-violation", "description": "Violations for logging" }, { "direction": "send", "peer": "<prefix>-certifier", "port": 1002, "topic": "cert-request", "description": "Certification requests" } ], "handshakes_needed": ["<prefix>-auditor", "<prefix>-certifier"] } ``` ### auditor ```json { "setup": "compliance-governance", "role": "auditor", "role_name": "Audit Trail", "hostname": "<prefix>-auditor", "skills": { "pilot-audit-log": "Maintain tamper-evident, append-only audit logs.", "pilot-verify": "Run periodic integrity checks on logs.", "pilot-event-log": "Searchable event log of all agent actions.", "pilot-cron": "Schedule periodic audit sweeps." }, "data_flows": [ { "direction": "receive", "peer": "<prefix>-policy", "port": 1002, "topic": "policy-violation", "description": "Violations" }, { "direction": "send", "peer": "<prefix>-reporter", "port": 1002, "topic": "audit-finding", "description": "Audit data for reports" } ], "handshakes_needed": ["<prefix>-policy", "<prefix>-reporter"] } ``` ### certifier ```json { "setup": "compliance-governance", "role": "certifier", "role_name": "Compliance Certifier", "hostname": "<prefix>-certifier", "skills": { "pilot-certificate": "Issue Ed25519-signed compliance certificates.", "pilot-keychain": "Manage signing keys with auto-expiry.", "pilot-verify": "Verify existing certificates.", "pilot-receipt": "Issue certification receipts." }, "data_flows": [ { "direction": "receive", "peer": "<prefix>-policy", "port": 1002, "topic": "cert-request", "description": "Certification requests" }, { "direction": "send", "peer": "<prefix>-reporter", "port": 1002, "topic": "cert-issued", "description": "Certification records" } ], "handshakes_needed": ["<prefix>-policy", "<prefix>-reporter"] } ``` ### reporter ```json { "setup": "compliance-governance", "role": "reporter", "role_name": "Compliance Reporter", "hostname": "<prefix>-reporter", "skills": { "pilot-metrics": "Aggregate compliance metrics (violation rates, cert counts).", "pilot-webhook-bridge": "Forward reports to external systems.", "pilot-slack-bridge": "Post compliance summaries to Slack.", "pilot-archive": "Archive reports for retention." }, "data_flows": [ { "direction": "receive", "peer": "<prefix>-auditor", "port": 1002, "topic": "audit-finding", "description": "Audit data" }, { "direction": "receive", "peer": "<prefix>-certifier", "port": 1002, "topic": "cert-issued", "description": "Certification records" } ], "handshakes_needed": ["<prefix>-auditor", "<prefix>-certifier"] } ``` ## Data Flows - `policy → auditor` : policy violations (port 1002) - `policy → certifier` : certification requests (port 1002) - `auditor → reporter` : audit data for reports (port 1002) - `certifier → reporter` : certification records (port 1002) ## Workflow Example ```bash # On policy-engine: pilotctl --json publish <prefix>-auditor policy-violation '{"agent":"data-proc-3","action":"write_to_prod","severity":"high"}' pilotctl --json publish <prefix>-certifier cert-request '{"agent":"data-proc-1","scope":"prod-write"}' # On auditor: pilotctl --json publish <prefix>-reporter audit-finding '{"finding_id":"AUD-721","violation":"unauthorized prod write"}' # On certifier: pilotctl --json publish <prefix>-reporter cert-issued '{"cert_id":"CERT-315","agent":"data-proc-1","scope":"prod-write"}' ``` ## Dependencies Requires `pilot-protocol` skill, `pilotctl` binary, `clawhub` binary, and a running daemon.

path: README.md
content: # Compliance & Governance Setup

Automated compliance for regulated environments. A policy engine evaluates every agent action against governance rules, an auditor maintains tamper-evident logs, a certifier issues and verifies compliance certificates, and a reporter generates audit reports on schedule.

**Difficulty:** Advanced | **Agents:** 4

## Roles

### policy (Policy Engine)
Evaluates agent actions against governance rules and SLA policies. Blocks non-compliant actions and routes violations to the auditor.

**Skills:** pilot-event-filter, pilot-sla, pilot-workflow, pilot-task-chain

### auditor (Audit Trail)
Maintains tamper-evident, append-only logs of all agent actions. Runs periodic integrity checks and flags anomalies.

**Skills:** pilot-audit-log, pilot-verify, pilot-event-log, pilot-cron

### certifier (Compliance Certifier)
Issues compliance certificates to agents that pass policy checks. Manages a keychain for certificate signing and issues receipts for every certification.

**Skills:** pilot-certificate, pilot-keychain, pilot-verify, pilot-receipt

### reporter (Compliance Reporter)
Generates periodic compliance reports from audit logs and certification data. Archives reports and sends summaries to stakeholders via Slack and webhooks.

**Skills:** pilot-metrics, pilot-webhook-bridge, pilot-slack-bridge, pilot-archive

## Data Flow

```
policy    --> auditor   : Policy violations and action logs (port 1002)
policy    --> certifier : Compliance certification requests for passing agents (port 1002)
auditor   --> reporter  : Audit data for reports (port 1002)
certifier --> reporter  : Certification records for reports (port 1002)
```

## Setup

Replace `<your-prefix>` with a unique name for your deployment (e.g. `acme`).

### 1. Install skills on each server

```bash
# On policy engine node
clawhub install pilot-event-filter pilot-sla pilot-workflow pilot-task-chain
pilotctl set-hostname <your-prefix>-policy

# On auditor node
clawhub install pilot-audit-log pilot-verify pilot-event-log pilot-cron
pilotctl set-hostname <your-prefix>-auditor

# On certifier node
clawhub install pilot-certificate pilot-keychain pilot-verify pilot-receipt
pilotctl set-hostname <your-prefix>-certifier

# On reporter node
clawhub install pilot-metrics pilot-webhook-bridge pilot-slack-bridge pilot-archive
pilotctl set-hostname <your-prefix>-reporter
```

### 2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

```bash
# policy <-> auditor
# On policy:
pilotctl handshake <your-prefix>-auditor "compliance"
# On auditor:
pilotctl handshake <your-prefix>-policy "compliance"

# policy <-> certifier
# On policy:
pilotctl handshake <your-prefix>-certifier "compliance"
# On certifier:
pilotctl handshake <your-prefix>-policy "compliance"

# auditor <-> reporter
# On auditor:
pilotctl handshake <your-prefix>-reporter "compliance"
# On reporter:
pilotctl handshake <your-prefix>-auditor "compliance"

# certifier <-> reporter
# On certifier:
pilotctl handshake <your-prefix>-reporter "compliance"
# On reporter:
pilotctl handshake <your-prefix>-certifier "compliance"
```

### 3. Verify

```bash
pilotctl trust
```

## Try It

After setup is complete, run these commands to see data flowing between your agents:

```bash
# On <your-prefix>-policy — evaluate an agent action and route:
pilotctl publish <your-prefix>-auditor policy-violation '{"agent":"data-processor-3","action":"write_to_prod","rule":"require-approval","severity":"high"}'
pilotctl publish <your-prefix>-certifier cert-request '{"agent":"data-processor-1","scope":"prod-write","policy_checks_passed":true}'

# On <your-prefix>-auditor — log and forward to reporter:
pilotctl publish <your-prefix>-reporter audit-finding '{"finding_id":"AUD-0721","agent":"data-processor-3","violation":"unauthorized prod write","severity":"high"}'

# On <your-prefix>-certifier — issue cert and notify reporter:
pilotctl publish <your-prefix>-reporter cert-issued '{"agent":"data-processor-1","cert_id":"CERT-2024-0315","scope":"prod-write","expires":"2024-06-15"}'

# On <your-prefix>-reporter — generate summary:
pilotctl publish <your-prefix>-reporter slack-forward '{"channel":"#compliance","text":"Weekly report: 3 violations, 12 certs issued, 99.2% compliance rate"}'
```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)