itpp-infrastructure/audit/phase-one/skill-spec.md

Skill Spec - ITPP Policy-Adherence Gate

Type: Documentation-only spec (no skill is created by Phase One). Actual implementation is a Phase Two task, pending Germaine's go-ahead. Purpose: A Hermes skill that makes Sho'Nuff the enforcement point for the Policy & Procedure Document, so policy is applied consistently rather than remembered ad hoc.

---

1. Name & Placement

• Skill name: itpp-policy-adherence (or policy-adherence-gate)
• Category: devops (alongside governance-and-honesty, subagent-verification)
• Location: ~/.hermes/skills/devops/itpp-policy-adherence/SKILL.md
• Reference dependency: loads the Policy & Procedure Document and the Running Exemptions Document from /root/projects/itpp-infrastructure/audit/phase-one/ (or their canonical home once promoted).

---

2. Trigger Conditions

The skill activates whenever a user request or an automated job would, if executed, do any of the following:

• Modify production configuration on Core/app1/app2/app3/app1-bu/wphost02.
• Rotate, create, store, or transmit a credential.
• Change a firewall rule, DNS record, Tailscale ACL, or Docker port binding.
• Alter a backup target, backup schedule, or the standby sync.
• Add a new host, site, or product to the estate.
• Deprecate, decommission, or rename any infrastructure component.
• Publish or change anything on docs.itpropartner.com or the docs repo.
• Introduce a service that would bind to 0.0.0.0 or bypass the reverse proxy.

---

3. Behavior

When triggered, the skill runs a policy check before acting:

1. Classify the request against the Policy & Procedure Document sections (§2 Change Management, §3 Docs-Sync, §4 Backup/DR, §5 Access, §6 Segmentation, §7 Cadence).
2. Compliant → proceed normally, and record the action per §2 (what / who / when / rollback).
3. Departure → do not execute. Raise an exemption request:

• State the provision being departed from.
• Request a business justification.
• Only Germaine may authorize the departure. No self-approval, no "it's low stakes, I'll just do it."

4. Unknown / ambiguous → ask Germaine rather than guessing, consistent with the standing no-fabrication rule.

---

4. Running Exemptions Document - Schema

The skill maintains a single append-only document (e.g. exemptions.md alongside the policy doc). Each entry:

## EX-<seq>

- **Date:** YYYY-MM-DD
- **Requester:** <who asked / what job asked>
- **Provision departed from:** <Policy & Procedure §X.Y - short title>
- **Request + business justification:** <what is being asked, why>
- **Germaine authorization:** <approve / deny / deferred, with date>
- **Type:** one-time | ongoing
- **Follow-up:** <review date for ongoing; or "closed" with closure date for one-time>

Rules:

• Every exemption is append-only. Existing entries are never edited to change the authorization; supersession adds a new entry.
• Ongoing exemptions carry a follow-up review date; a review is triggered when that date passes.
• The Phase One public-repo deferral is the seed entry:

## EX-001

- **Date:** 2026-08-13
- **Requester:** Sho'Nuff (conductor, Phase One audit - Git-A finding)
- **Provision departed from:** §5 Access / §8 Exemptions - live credential in public repo `itpp-infrastructure`
- **Request + business justification:** Immediate lockdown (private + history scrub) of a public repo re-leaking admin passwords; surfaced as a Critical finding under the "cannot wait" policy.
- **Germaine authorization:** deferred - "leave the repo alone for now"
- **Type:** one-time (deferral)
- **Follow-up:** re-surface at Phase Two planning

---

5. Integration Notes

• The skill does not itself enforce anything mechanically - it is a decision gate that runs in Sho'Nuff's reasoning before any privileged action, and it surfaces exemption requests to Germaine.
• It references, but does not duplicate, the Policy & Procedure Document. The policy doc is the source of truth; the skill is the tripwire that consults it.
• It composes with the existing governance-and-honesty and subagent-verification skills: those govern output integrity and subagent checking; this one governs whether a privileged action is even permitted.

---

6. Acceptance Criteria (for the eventual implementation)

1. A request to change an app1 firewall rule with no exemption raises an exemption request to Germaine instead of executing.
2. A compliant change (e.g. fixing the LiteLLM pg_dump target) proceeds and is recorded per §2.
3. EX-001 is present in the Running Exemptions Document and re-surfaces at Phase Two planning.
4. The skill never self-authorizes an exemption; Germaine's explicit approval is always required for a departure.

---

End of Skill Spec.