From eb28475a66b072da5acbaa2f9ec263929db6ecba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20Antonio=20Bre=C3=B1a=20Moral?= Date: Sun, 14 Jun 2026 15:00:57 +0200 Subject: [PATCH] docs(openspec): archive EU regulation changes Archive completed EU regulation OpenSpec changes after the corresponding skills merged, and promote their requirements into active specs. Co-authored-by: Cursor --- .../design.md | 0 .../proposal.md | 0 .../spec.md | 0 .../tasks.md | 0 .../design.md | 0 .../proposal.md | 0 .../spec.md | 0 .../tasks.md | 0 .../design.md | 0 .../proposal.md | 0 .../spec.md | 0 .../tasks.md | 0 .../design.md | 0 .../proposal.md | 0 .../spec.md | 0 .../tasks.md | 0 .../design.md | 0 .../proposal.md | 0 .../spec.md | 0 .../tasks.md | 0 .../spec.md | 62 ++++++++++++++++ .../spec.md | 62 ++++++++++++++++ .../spec.md | 64 ++++++++++++++++ .../spec.md | 74 +++++++++++++++++++ .../spec.md | 63 ++++++++++++++++ 25 files changed, 325 insertions(+) rename documentation/openspec/changes/{add-eu-cyber-resilience-act-regulation-skill => archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill}/design.md (100%) rename documentation/openspec/changes/{add-eu-cyber-resilience-act-regulation-skill => archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill}/proposal.md (100%) rename documentation/openspec/changes/{add-eu-cyber-resilience-act-regulation-skill => archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill}/specs/eu-cyber-resilience-act-regulation-skill-reference/spec.md (100%) rename documentation/openspec/changes/{add-eu-cyber-resilience-act-regulation-skill => archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill}/tasks.md (100%) rename documentation/openspec/changes/{add-eu-data-act-regulation-skill => archive/2026-06-14-add-eu-data-act-regulation-skill}/design.md (100%) rename documentation/openspec/changes/{add-eu-data-act-regulation-skill => archive/2026-06-14-add-eu-data-act-regulation-skill}/proposal.md (100%) rename documentation/openspec/changes/{add-eu-data-act-regulation-skill => archive/2026-06-14-add-eu-data-act-regulation-skill}/specs/eu-data-act-regulation-skill-reference/spec.md (100%) rename documentation/openspec/changes/{add-eu-data-act-regulation-skill => archive/2026-06-14-add-eu-data-act-regulation-skill}/tasks.md (100%) rename documentation/openspec/changes/{add-eu-digital-markets-act-regulation-skill => archive/2026-06-14-add-eu-digital-markets-act-regulation-skill}/design.md (100%) rename documentation/openspec/changes/{add-eu-digital-markets-act-regulation-skill => archive/2026-06-14-add-eu-digital-markets-act-regulation-skill}/proposal.md (100%) rename documentation/openspec/changes/{add-eu-digital-markets-act-regulation-skill => archive/2026-06-14-add-eu-digital-markets-act-regulation-skill}/specs/eu-digital-markets-act-regulation-skill-reference/spec.md (100%) rename documentation/openspec/changes/{add-eu-digital-markets-act-regulation-skill => archive/2026-06-14-add-eu-digital-markets-act-regulation-skill}/tasks.md (100%) rename documentation/openspec/changes/{add-eu-digital-omnibus-regulation-skill => archive/2026-06-14-add-eu-digital-omnibus-regulation-skill}/design.md (100%) rename documentation/openspec/changes/{add-eu-digital-omnibus-regulation-skill => archive/2026-06-14-add-eu-digital-omnibus-regulation-skill}/proposal.md (100%) rename documentation/openspec/changes/{add-eu-digital-omnibus-regulation-skill => archive/2026-06-14-add-eu-digital-omnibus-regulation-skill}/specs/eu-digital-omnibus-regulation-skill-reference/spec.md (100%) rename documentation/openspec/changes/{add-eu-digital-omnibus-regulation-skill => archive/2026-06-14-add-eu-digital-omnibus-regulation-skill}/tasks.md (100%) rename documentation/openspec/changes/{add-eu-digital-services-act-regulation-skill => archive/2026-06-14-add-eu-digital-services-act-regulation-skill}/design.md (100%) rename documentation/openspec/changes/{add-eu-digital-services-act-regulation-skill => archive/2026-06-14-add-eu-digital-services-act-regulation-skill}/proposal.md (100%) rename documentation/openspec/changes/{add-eu-digital-services-act-regulation-skill => archive/2026-06-14-add-eu-digital-services-act-regulation-skill}/specs/eu-digital-services-act-regulation-skill-reference/spec.md (100%) rename documentation/openspec/changes/{add-eu-digital-services-act-regulation-skill => archive/2026-06-14-add-eu-digital-services-act-regulation-skill}/tasks.md (100%) create mode 100644 documentation/openspec/specs/eu-cyber-resilience-act-regulation-skill-reference/spec.md create mode 100644 documentation/openspec/specs/eu-data-act-regulation-skill-reference/spec.md create mode 100644 documentation/openspec/specs/eu-digital-markets-act-regulation-skill-reference/spec.md create mode 100644 documentation/openspec/specs/eu-digital-omnibus-regulation-skill-reference/spec.md create mode 100644 documentation/openspec/specs/eu-digital-services-act-regulation-skill-reference/spec.md diff --git a/documentation/openspec/changes/add-eu-cyber-resilience-act-regulation-skill/design.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill/design.md similarity index 100% rename from documentation/openspec/changes/add-eu-cyber-resilience-act-regulation-skill/design.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill/design.md diff --git a/documentation/openspec/changes/add-eu-cyber-resilience-act-regulation-skill/proposal.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill/proposal.md similarity index 100% rename from documentation/openspec/changes/add-eu-cyber-resilience-act-regulation-skill/proposal.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill/proposal.md diff --git a/documentation/openspec/changes/add-eu-cyber-resilience-act-regulation-skill/specs/eu-cyber-resilience-act-regulation-skill-reference/spec.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill/specs/eu-cyber-resilience-act-regulation-skill-reference/spec.md similarity index 100% rename from documentation/openspec/changes/add-eu-cyber-resilience-act-regulation-skill/specs/eu-cyber-resilience-act-regulation-skill-reference/spec.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill/specs/eu-cyber-resilience-act-regulation-skill-reference/spec.md diff --git a/documentation/openspec/changes/add-eu-cyber-resilience-act-regulation-skill/tasks.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill/tasks.md similarity index 100% rename from documentation/openspec/changes/add-eu-cyber-resilience-act-regulation-skill/tasks.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-cyber-resilience-act-regulation-skill/tasks.md diff --git a/documentation/openspec/changes/add-eu-data-act-regulation-skill/design.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-data-act-regulation-skill/design.md similarity index 100% rename from documentation/openspec/changes/add-eu-data-act-regulation-skill/design.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-data-act-regulation-skill/design.md diff --git a/documentation/openspec/changes/add-eu-data-act-regulation-skill/proposal.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-data-act-regulation-skill/proposal.md similarity index 100% rename from documentation/openspec/changes/add-eu-data-act-regulation-skill/proposal.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-data-act-regulation-skill/proposal.md diff --git a/documentation/openspec/changes/add-eu-data-act-regulation-skill/specs/eu-data-act-regulation-skill-reference/spec.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-data-act-regulation-skill/specs/eu-data-act-regulation-skill-reference/spec.md similarity index 100% rename from documentation/openspec/changes/add-eu-data-act-regulation-skill/specs/eu-data-act-regulation-skill-reference/spec.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-data-act-regulation-skill/specs/eu-data-act-regulation-skill-reference/spec.md diff --git a/documentation/openspec/changes/add-eu-data-act-regulation-skill/tasks.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-data-act-regulation-skill/tasks.md similarity index 100% rename from documentation/openspec/changes/add-eu-data-act-regulation-skill/tasks.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-data-act-regulation-skill/tasks.md diff --git a/documentation/openspec/changes/add-eu-digital-markets-act-regulation-skill/design.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-markets-act-regulation-skill/design.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-markets-act-regulation-skill/design.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-markets-act-regulation-skill/design.md diff --git a/documentation/openspec/changes/add-eu-digital-markets-act-regulation-skill/proposal.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-markets-act-regulation-skill/proposal.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-markets-act-regulation-skill/proposal.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-markets-act-regulation-skill/proposal.md diff --git a/documentation/openspec/changes/add-eu-digital-markets-act-regulation-skill/specs/eu-digital-markets-act-regulation-skill-reference/spec.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-markets-act-regulation-skill/specs/eu-digital-markets-act-regulation-skill-reference/spec.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-markets-act-regulation-skill/specs/eu-digital-markets-act-regulation-skill-reference/spec.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-markets-act-regulation-skill/specs/eu-digital-markets-act-regulation-skill-reference/spec.md diff --git a/documentation/openspec/changes/add-eu-digital-markets-act-regulation-skill/tasks.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-markets-act-regulation-skill/tasks.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-markets-act-regulation-skill/tasks.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-markets-act-regulation-skill/tasks.md diff --git a/documentation/openspec/changes/add-eu-digital-omnibus-regulation-skill/design.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-omnibus-regulation-skill/design.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-omnibus-regulation-skill/design.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-omnibus-regulation-skill/design.md diff --git a/documentation/openspec/changes/add-eu-digital-omnibus-regulation-skill/proposal.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-omnibus-regulation-skill/proposal.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-omnibus-regulation-skill/proposal.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-omnibus-regulation-skill/proposal.md diff --git a/documentation/openspec/changes/add-eu-digital-omnibus-regulation-skill/specs/eu-digital-omnibus-regulation-skill-reference/spec.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-omnibus-regulation-skill/specs/eu-digital-omnibus-regulation-skill-reference/spec.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-omnibus-regulation-skill/specs/eu-digital-omnibus-regulation-skill-reference/spec.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-omnibus-regulation-skill/specs/eu-digital-omnibus-regulation-skill-reference/spec.md diff --git a/documentation/openspec/changes/add-eu-digital-omnibus-regulation-skill/tasks.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-omnibus-regulation-skill/tasks.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-omnibus-regulation-skill/tasks.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-omnibus-regulation-skill/tasks.md diff --git a/documentation/openspec/changes/add-eu-digital-services-act-regulation-skill/design.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-services-act-regulation-skill/design.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-services-act-regulation-skill/design.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-services-act-regulation-skill/design.md diff --git a/documentation/openspec/changes/add-eu-digital-services-act-regulation-skill/proposal.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-services-act-regulation-skill/proposal.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-services-act-regulation-skill/proposal.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-services-act-regulation-skill/proposal.md diff --git a/documentation/openspec/changes/add-eu-digital-services-act-regulation-skill/specs/eu-digital-services-act-regulation-skill-reference/spec.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-services-act-regulation-skill/specs/eu-digital-services-act-regulation-skill-reference/spec.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-services-act-regulation-skill/specs/eu-digital-services-act-regulation-skill-reference/spec.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-services-act-regulation-skill/specs/eu-digital-services-act-regulation-skill-reference/spec.md diff --git a/documentation/openspec/changes/add-eu-digital-services-act-regulation-skill/tasks.md b/documentation/openspec/changes/archive/2026-06-14-add-eu-digital-services-act-regulation-skill/tasks.md similarity index 100% rename from documentation/openspec/changes/add-eu-digital-services-act-regulation-skill/tasks.md rename to documentation/openspec/changes/archive/2026-06-14-add-eu-digital-services-act-regulation-skill/tasks.md diff --git a/documentation/openspec/specs/eu-cyber-resilience-act-regulation-skill-reference/spec.md b/documentation/openspec/specs/eu-cyber-resilience-act-regulation-skill-reference/spec.md new file mode 100644 index 00000000..8ba8aba1 --- /dev/null +++ b/documentation/openspec/specs/eu-cyber-resilience-act-regulation-skill-reference/spec.md @@ -0,0 +1,62 @@ +# eu-cyber-resilience-act-regulation-skill-reference Specification + +## Purpose +TBD - created by archiving change add-eu-cyber-resilience-act-regulation-skill. Update Purpose after archive. +## Requirements +### Requirement: Cyber Resilience Act regulation skill + +The repository MUST define `805-regulations-eu-cyber-resilience-act` as the EU Cyber Resilience Act skill for Java enterprise engineering review. + +#### Scenario: Cyber Resilience Act skill identifier is standardized + +- **GIVEN** maintainers implement Cyber Resilience Act guidance in generator sources +- **WHEN** they create or reference the skill in XML, inventories, OpenSpec artifacts, or generated local skill output +- **THEN** the identifier is `805-regulations-eu-cyber-resilience-act` +- **AND** the official source reference is `https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847` + +#### Scenario: Cyber Resilience Act scope maps product-security concerns to engineering controls + +- **GIVEN** a user asks to review a Java enterprise system or product for Cyber Resilience Act concerns +- **WHEN** the `805-regulations-eu-cyber-resilience-act` skill is applied +- **THEN** the guidance frames findings as engineering controls rather than legal advice +- **AND** it addresses secure-by-design controls, threat modeling, secure defaults, vulnerability management, coordinated disclosure, security update mechanisms, dependency and SBOM evidence, cryptography, authentication and authorization, sensitive-data-safe logging, product security documentation, end-of-support signaling, and release readiness +- **AND** it recommends escalation to legal, compliance, product, security, risk, or executive accountability owners for product classification, economic-operator role, conformity assessment, CE marking implications, and regulatory interpretation + +### Requirement: Relationship to other regulation skills + +The Cyber Resilience Act skill MUST complement existing and planned regulation skills without changing their workflows. + +#### Scenario: Select CRA for product-security concerns + +- **GIVEN** a Java enterprise system may involve AI, privacy, resilience, product security, platform, data, and cybersecurity concerns +- **WHEN** an agent chooses regulation guidance +- **THEN** `804-regulations-eu-nis2` is used for EU cybersecurity risk-management and critical-sector concerns +- **AND** `805-regulations-eu-cyber-resilience-act` is used for products with digital elements, secure-by-design, vulnerability handling, coordinated disclosure, security updates, product security documentation, or SBOM evidence concerns +- **AND** multiple regulation skills may be used together when the same Java system crosses those concern boundaries + +### Requirement: Generator registration + +The Cyber Resilience Act skill source MUST be registered in the generator inventory so local skill generation emits it. + +#### Scenario: Register Cyber Resilience Act regulation skill + +- **WHEN** `skills-generator/src/main/resources/skills.xml` is inspected +- **THEN** skill id `805` registers reference `805-regulations-eu-cyber-resilience-act` + +#### Scenario: Generate local Cyber Resilience Act skill + +- **WHEN** `./mvnw clean install -pl skills-generator` is run +- **THEN** generated local skill output includes `.agents/skills/805-regulations-eu-cyber-resilience-act/SKILL.md` +- **AND** generated references contain no unresolved include markers or broken local reference paths + +### Requirement: Source and generated-output boundaries + +The implementation MUST edit XML sources and validate generated local skill output without directly editing generated legacy or release outputs. + +#### Scenario: Preserve generated-output ownership + +- **WHEN** implementation files are reviewed +- **THEN** `.cursor/rules/` is not edited directly +- **AND** public `skills/` release output is not edited manually +- **AND** public `skills/` is refreshed only through the release profile when release output is intentionally in scope + diff --git a/documentation/openspec/specs/eu-data-act-regulation-skill-reference/spec.md b/documentation/openspec/specs/eu-data-act-regulation-skill-reference/spec.md new file mode 100644 index 00000000..4bab0548 --- /dev/null +++ b/documentation/openspec/specs/eu-data-act-regulation-skill-reference/spec.md @@ -0,0 +1,62 @@ +# eu-data-act-regulation-skill-reference Specification + +## Purpose +TBD - created by archiving change add-eu-data-act-regulation-skill. Update Purpose after archive. +## Requirements +### Requirement: Data Act regulation skill + +The repository MUST define `806-regulations-eu-data-act` as the EU Data Act skill for Java enterprise engineering review. + +#### Scenario: Data Act skill identifier is standardized + +- **GIVEN** maintainers implement Data Act guidance in generator sources +- **WHEN** they create or reference the skill in XML, inventories, OpenSpec artifacts, or generated local skill output +- **THEN** the identifier is `806-regulations-eu-data-act` +- **AND** the official source reference is `https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854` + +#### Scenario: Data Act scope maps data access and portability concerns to engineering controls + +- **GIVEN** a user asks to review a Java enterprise system for Data Act concerns +- **WHEN** the `806-regulations-eu-data-act` skill is applied +- **THEN** the guidance frames findings as engineering controls rather than legal advice +- **AND** it addresses data inventory, access authorization, portability APIs, export formats, interoperability, metadata, audit logs, cloud-switching support, non-personal data safeguards, trade-secret or sensitive-data handoff, data-sharing request workflows, contract evidence, and operational controls for data access requests +- **AND** it recommends escalation to legal, compliance, privacy, data governance, security, product, or risk owners for data-holder status, user entitlement, contract interpretation, trade-secret disclosure boundaries, international access restrictions, and regulatory interpretation + +### Requirement: Relationship to other regulation skills + +The Data Act skill MUST complement existing and planned regulation skills without changing their workflows. + +#### Scenario: Select Data Act for data access and portability concerns + +- **GIVEN** a Java enterprise system may involve AI, privacy, non-personal data, cloud, platform, cybersecurity, and resilience concerns +- **WHEN** an agent chooses regulation guidance +- **THEN** `803-regulations-gdpr` is used for EU personal-data processing and privacy controls +- **AND** `806-regulations-eu-data-act` is used for EU data access, data sharing, data portability, interoperability, cloud switching, and non-personal data governance concerns +- **AND** multiple regulation skills may be used together when the same Java system crosses those concern boundaries + +### Requirement: Generator registration + +The Data Act skill source MUST be registered in the generator inventory so local skill generation emits it. + +#### Scenario: Register Data Act regulation skill + +- **WHEN** `skills-generator/src/main/resources/skills.xml` is inspected +- **THEN** skill id `806` registers reference `806-regulations-eu-data-act` + +#### Scenario: Generate local Data Act skill + +- **WHEN** `./mvnw clean install -pl skills-generator` is run +- **THEN** generated local skill output includes `.agents/skills/806-regulations-eu-data-act/SKILL.md` +- **AND** generated references contain no unresolved include markers or broken local reference paths + +### Requirement: Source and generated-output boundaries + +The implementation MUST edit XML sources and validate generated local skill output without directly editing generated legacy or release outputs. + +#### Scenario: Preserve generated-output ownership + +- **WHEN** implementation files are reviewed +- **THEN** `.cursor/rules/` is not edited directly +- **AND** public `skills/` release output is not edited manually +- **AND** public `skills/` is refreshed only through the release profile when release output is intentionally in scope + diff --git a/documentation/openspec/specs/eu-digital-markets-act-regulation-skill-reference/spec.md b/documentation/openspec/specs/eu-digital-markets-act-regulation-skill-reference/spec.md new file mode 100644 index 00000000..da6bdfd5 --- /dev/null +++ b/documentation/openspec/specs/eu-digital-markets-act-regulation-skill-reference/spec.md @@ -0,0 +1,64 @@ +# eu-digital-markets-act-regulation-skill-reference Specification + +## Purpose +TBD - created by archiving change add-eu-digital-markets-act-regulation-skill. Update Purpose after archive. +## Requirements +### Requirement: Digital Markets Act regulation skill + +The repository MUST define `808-regulations-eu-digital-markets-act` as the EU Digital Markets Act skill for Java enterprise engineering review. + +#### Scenario: Digital Markets Act skill identifier is standardized + +- **GIVEN** maintainers implement Digital Markets Act guidance in generator sources +- **WHEN** they create or reference the skill in XML, inventories, OpenSpec artifacts, or generated local skill output +- **THEN** the identifier is `808-regulations-eu-digital-markets-act` +- **AND** the official source reference is `https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R1925` + +#### Scenario: Digital Markets Act scope maps gatekeeper-platform concerns to engineering controls + +- **GIVEN** a user asks to review a Java enterprise system for Digital Markets Act concerns +- **WHEN** the `808-regulations-eu-digital-markets-act` skill is applied +- **THEN** the guidance frames findings as engineering controls rather than legal advice +- **AND** it addresses interoperability interfaces, data access APIs, consent and preference evidence, ranking and self-preferencing audit signals, business-user export workflows, anti-circumvention guardrails, access control, observability, change control, documentation, and compliance evidence handoff +- **AND** it recommends escalation to legal, compliance, platform governance, product, privacy, security, or risk owners for gatekeeper designation, core-platform-service classification, obligation applicability, self-preferencing determinations, and regulatory interpretation + +### Requirement: Relationship to other regulation skills + +The Digital Markets Act skill MUST complement existing and planned regulation skills without changing their workflows. + +#### Scenario: Select DMA for gatekeeper-platform concerns + +- **GIVEN** a Java enterprise system may involve AI, privacy, platform, marketplace, advertising, data access, and interoperability concerns +- **WHEN** an agent chooses regulation guidance +- **THEN** `803-regulations-gdpr` is used for EU personal-data processing and privacy controls +- **AND** `806-regulations-eu-data-act` is used for EU data access and portability concerns +- **AND** `807-regulations-eu-digital-services-act` is used for online-platform, content-moderation, recommender, advertising, and transparency concerns +- **AND** `808-regulations-eu-digital-markets-act` is used for gatekeeper-platform, core-platform-service, interoperability, business-user access, consent-dependent data combination, self-preferencing, and platform-control concerns +- **AND** multiple regulation skills may be used together when the same Java system crosses those concern boundaries + +### Requirement: Generator registration + +The Digital Markets Act skill source MUST be registered in the generator inventory so local skill generation emits it. + +#### Scenario: Register Digital Markets Act regulation skill + +- **WHEN** `skills-generator/src/main/resources/skills.xml` is inspected +- **THEN** skill id `808` registers reference `808-regulations-eu-digital-markets-act` + +#### Scenario: Generate local Digital Markets Act skill + +- **WHEN** `./mvnw clean install -pl skills-generator` is run +- **THEN** generated local skill output includes `.agents/skills/808-regulations-eu-digital-markets-act/SKILL.md` +- **AND** generated references contain no unresolved include markers or broken local reference paths + +### Requirement: Source and generated-output boundaries + +The implementation MUST edit XML sources and validate generated local skill output without directly editing generated legacy or release outputs. + +#### Scenario: Preserve generated-output ownership + +- **WHEN** implementation files are reviewed +- **THEN** `.cursor/rules/` is not edited directly +- **AND** public `skills/` release output is not edited manually +- **AND** public `skills/` is refreshed only through the release profile when release output is intentionally in scope + diff --git a/documentation/openspec/specs/eu-digital-omnibus-regulation-skill-reference/spec.md b/documentation/openspec/specs/eu-digital-omnibus-regulation-skill-reference/spec.md new file mode 100644 index 00000000..c07dca4b --- /dev/null +++ b/documentation/openspec/specs/eu-digital-omnibus-regulation-skill-reference/spec.md @@ -0,0 +1,74 @@ +# eu-digital-omnibus-regulation-skill-reference Specification + +## Purpose +TBD - created by archiving change add-eu-digital-omnibus-regulation-skill. Update Purpose after archive. +## Requirements +### Requirement: Digital Omnibus regulation skill + +The repository MUST define `809-regulations-eu-digital-omnibus` as the EU Digital Omnibus simplification-impact skill for Java enterprise engineering review. + +#### Scenario: Digital Omnibus skill identifier is standardized + +- **GIVEN** maintainers implement Digital Omnibus guidance in generator sources +- **WHEN** they create or reference the skill in XML, inventories, OpenSpec artifacts, or generated local skill output +- **THEN** the identifier is `809-regulations-eu-digital-omnibus` +- **AND** source references include `https://commission.europa.eu/news-and-media/news/simpler-digital-rules-help-eu-businesses-grow-2025-11-19_en` and `https://digital-strategy.ec.europa.eu/en/policies/digital-rulebook` + +#### Scenario: Digital Omnibus scope maps simplification impacts to engineering controls + +- **GIVEN** a user asks to review a Java enterprise system for Digital Omnibus impacts +- **WHEN** the `809-regulations-eu-digital-omnibus` skill is applied +- **THEN** the guidance frames findings as proposal-stage simplification impacts and engineering controls rather than legal advice +- **AND** it addresses source-status checks, affected-regulation mapping, evidence inventory updates, change-control impacts, questionnaire or report-template update candidates, incident-reporting workflow consolidation, data-rights workflow impacts, AI governance timeline changes, compatibility with existing regulation skills, and escalation when proposal-stage language is ambiguous +- **AND** it recommends escalation to legal, compliance, privacy, security, risk, resilience, data-governance, or AI governance owners for legislative-status assessment, applicability, interpretation, and adoption decisions + +### Requirement: Proposal-stage safeguards + +The Digital Omnibus skill MUST prevent proposal-stage material from being treated as final settled regulation. + +#### Scenario: Preserve regulation-specific authority + +- **GIVEN** Digital Omnibus material may affect AI Act, GDPR, DORA, NIS2, Data Act, or other EU digital-rule guidance +- **WHEN** the `809-regulations-eu-digital-omnibus` skill is applied +- **THEN** it checks and reports the source status before recommending changes +- **AND** it does not replace regulation-specific review from `801`, `802`, `803`, `804`, `806`, or future regulation skills +- **AND** it does not silently relax controls, reduce escalation requirements, or rewrite conclusions from regulation-specific skills + +### Requirement: Relationship to other regulation skills + +The Digital Omnibus skill MUST complement existing and planned regulation skills without changing their workflows. + +#### Scenario: Select Digital Omnibus as a cross-cutting overlay + +- **GIVEN** a Java enterprise system may involve AI, privacy, cybersecurity, resilience, data access, or incident-reporting concerns +- **WHEN** an agent chooses regulation guidance +- **THEN** regulation-specific skills are used for regulation-specific review +- **AND** `809-regulations-eu-digital-omnibus` is used only when the primary concern is how Digital Omnibus simplification proposals may affect existing EU digital-rule evidence, timelines, reporting paths, or skill guidance +- **AND** multiple regulation skills may be used together when the same Java system crosses those concern boundaries + +### Requirement: Generator registration + +The Digital Omnibus skill source MUST be registered in the generator inventory so local skill generation emits it. + +#### Scenario: Register Digital Omnibus regulation skill + +- **WHEN** `skills-generator/src/main/resources/skills.xml` is inspected +- **THEN** skill id `809` registers reference `809-regulations-eu-digital-omnibus` + +#### Scenario: Generate local Digital Omnibus skill + +- **WHEN** `./mvnw clean install -pl skills-generator` is run +- **THEN** generated local skill output includes `.agents/skills/809-regulations-eu-digital-omnibus/SKILL.md` +- **AND** generated references contain no unresolved include markers or broken local reference paths + +### Requirement: Source and generated-output boundaries + +The implementation MUST edit XML sources and validate generated local skill output without directly editing generated legacy or release outputs. + +#### Scenario: Preserve generated-output ownership + +- **WHEN** implementation files are reviewed +- **THEN** `.cursor/rules/` is not edited directly +- **AND** public `skills/` release output is not edited manually +- **AND** public `skills/` is refreshed only through the release profile when release output is intentionally in scope + diff --git a/documentation/openspec/specs/eu-digital-services-act-regulation-skill-reference/spec.md b/documentation/openspec/specs/eu-digital-services-act-regulation-skill-reference/spec.md new file mode 100644 index 00000000..a8e89ebe --- /dev/null +++ b/documentation/openspec/specs/eu-digital-services-act-regulation-skill-reference/spec.md @@ -0,0 +1,63 @@ +# eu-digital-services-act-regulation-skill-reference Specification + +## Purpose +TBD - created by archiving change add-eu-digital-services-act-regulation-skill. Update Purpose after archive. +## Requirements +### Requirement: Digital Services Act regulation skill + +The repository MUST define `807-regulations-eu-digital-services-act` as the EU Digital Services Act skill for Java enterprise engineering review. + +#### Scenario: Digital Services Act skill identifier is standardized + +- **GIVEN** maintainers implement Digital Services Act guidance in generator sources +- **WHEN** they create or reference the skill in XML, inventories, OpenSpec artifacts, or generated local skill output +- **THEN** the identifier is `807-regulations-eu-digital-services-act` +- **AND** the official source reference is `https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065` + +#### Scenario: Digital Services Act scope maps online-platform concerns to engineering controls + +- **GIVEN** a user asks to review a Java enterprise system for Digital Services Act concerns +- **WHEN** the `807-regulations-eu-digital-services-act` skill is applied +- **THEN** the guidance frames findings as engineering controls rather than legal advice +- **AND** it addresses content decision audit logs, moderation workflow state, notice intake and response tracking, recommender and ranking explanation evidence, ad transparency metadata, user controls, complaint and appeal workflows, risk assessment evidence, incident escalation, data access for auditors or researchers where applicable, and privacy-safe observability +- **AND** it recommends escalation to legal, compliance, trust-and-safety, privacy, security, product, or risk owners for intermediary classification, platform classification, very-large-online-platform status, illegal-content determinations, systemic-risk conclusions, and regulatory interpretation + +### Requirement: Relationship to other regulation skills + +The Digital Services Act skill MUST complement existing and planned regulation skills without changing their workflows. + +#### Scenario: Select DSA for online-platform and transparency concerns + +- **GIVEN** a Java enterprise system may involve AI, privacy, data, platform, advertising, cybersecurity, and transparency concerns +- **WHEN** an agent chooses regulation guidance +- **THEN** `801-regulations-eu-ai-act` is used for EU AI systems and AI-agent governance +- **AND** `803-regulations-gdpr` is used for EU personal-data processing and privacy controls +- **AND** `807-regulations-eu-digital-services-act` is used for online-platform, intermediary-service, content-moderation, recommender-transparency, ad-transparency, notice-and-action, user-redress, and systemic-risk evidence concerns +- **AND** multiple regulation skills may be used together when the same Java system crosses those concern boundaries + +### Requirement: Generator registration + +The Digital Services Act skill source MUST be registered in the generator inventory so local skill generation emits it. + +#### Scenario: Register Digital Services Act regulation skill + +- **WHEN** `skills-generator/src/main/resources/skills.xml` is inspected +- **THEN** skill id `807` registers reference `807-regulations-eu-digital-services-act` + +#### Scenario: Generate local Digital Services Act skill + +- **WHEN** `./mvnw clean install -pl skills-generator` is run +- **THEN** generated local skill output includes `.agents/skills/807-regulations-eu-digital-services-act/SKILL.md` +- **AND** generated references contain no unresolved include markers or broken local reference paths + +### Requirement: Source and generated-output boundaries + +The implementation MUST edit XML sources and validate generated local skill output without directly editing generated legacy or release outputs. + +#### Scenario: Preserve generated-output ownership + +- **WHEN** implementation files are reviewed +- **THEN** `.cursor/rules/` is not edited directly +- **AND** public `skills/` release output is not edited manually +- **AND** public `skills/` is refreshed only through the release profile when release output is intentionally in scope +