# Skill Spec - ITPP Policy-Adherence Gate

**Type:** Documentation-only spec (no skill is created by Phase One). Actual implementation is a Phase Two task, pending Germaine's go-ahead.
**Purpose:** A Hermes skill that makes Sho'Nuff the enforcement point for the Policy & Procedure Document, so policy is applied consistently rather than remembered ad hoc.

---

## 1. Name & Placement

- **Skill name:** `itpp-policy-adherence` (or `policy-adherence-gate`)
- **Category:** `devops` (alongside `governance-and-honesty`, `subagent-verification`)
- **Location:** `~/.hermes/skills/devops/itpp-policy-adherence/SKILL.md`
- **Reference dependency:** loads the Policy & Procedure Document and the Running Exemptions Document from `/root/projects/itpp-infrastructure/audit/phase-one/` (or their canonical home once promoted).

---

## 2. Trigger Conditions

The skill activates whenever a user request or an automated job would, if executed, do any of the following:

- Modify production configuration on Core/app1/app2/app3/app1-bu/wphost02.
- Rotate, create, store, or transmit a credential.
- Change a firewall rule, DNS record, Tailscale ACL, or Docker port binding.
- Alter a backup target, backup schedule, or the standby sync.
- Add a new host, site, or product to the estate.
- Deprecate, decommission, or rename any infrastructure component.
- Publish or change anything on `docs.itpropartner.com` or the docs repo.
- Introduce a service that would bind to 0.0.0.0 or bypass the reverse proxy.

---

## 3. Behavior

When triggered, the skill runs a policy check **before** acting:

1. **Classify** the request against the Policy & Procedure Document sections (§2 Change Management, §3 Docs-Sync, §4 Backup/DR, §5 Access, §6 Segmentation, §7 Cadence).
2. **Compliant** → proceed normally, and record the action per §2 (what / who / when / rollback).
3. **Departure** → do **not** execute. Raise an exemption request:
 - State the provision being departed from.
 - Request a business justification.
 - **Only Germaine may authorize** the departure. No self-approval, no "it's low stakes, I'll just do it."
4. **Unknown / ambiguous** → ask Germaine rather than guessing, consistent with the standing no-fabrication rule.

---

## 4. Running Exemptions Document - Schema

The skill maintains a single append-only document (e.g. `exemptions.md` alongside the policy doc). Each entry:

```markdown
## EX-<seq>

- **Date:** YYYY-MM-DD
- **Requester:** <who asked / what job asked>
- **Provision departed from:** <Policy & Procedure §X.Y - short title>
- **Request + business justification:** <what is being asked, why>
- **Germaine authorization:** <approve / deny / deferred, with date>
- **Type:** one-time | ongoing
- **Follow-up:** <review date for ongoing; or "closed" with closure date for one-time>
```

**Rules:**
- Every exemption is append-only. Existing entries are never edited to change the authorization; supersession adds a new entry.
- Ongoing exemptions carry a follow-up review date; a review is triggered when that date passes.
- The Phase One public-repo deferral is the seed entry:

```markdown
## EX-001

- **Date:** 2026-08-13
- **Requester:** Sho'Nuff (conductor, Phase One audit - Git-A finding)
- **Provision departed from:** §5 Access / §8 Exemptions - live credential in public repo `itpp-infrastructure`
- **Request + business justification:** Immediate lockdown (private + history scrub) of a public repo re-leaking admin passwords; surfaced as a Critical finding under the "cannot wait" policy.
- **Germaine authorization:** deferred - "leave the repo alone for now"
- **Type:** one-time (deferral)
- **Follow-up:** re-surface at Phase Two planning
```

---

## 5. Integration Notes

- The skill does **not** itself enforce anything mechanically - it is a decision gate that runs in Sho'Nuff's reasoning before any privileged action, and it surfaces exemption requests to Germaine.
- It references, but does not duplicate, the Policy & Procedure Document. The policy doc is the source of truth; the skill is the tripwire that consults it.
- It composes with the existing `governance-and-honesty` and `subagent-verification` skills: those govern output integrity and subagent checking; this one governs *whether a privileged action is even permitted*.

---

## 6. Acceptance Criteria (for the eventual implementation)

1. A request to change an app1 firewall rule with no exemption raises an exemption request to Germaine instead of executing.
2. A compliant change (e.g. fixing the LiteLLM `pg_dump` target) proceeds and is recorded per §2.
3. EX-001 is present in the Running Exemptions Document and re-surfaces at Phase Two planning.
4. The skill never self-authorizes an exemption; Germaine's explicit approval is always required for a departure.

---

*End of Skill Spec.*