canon

<!-- CAPABILITIES_SUMMARY: - standards_assessment: Version-pinned OWASP/WCAG/OpenAPI/ISO/NIST findings with citations - regulatory_controls: SOC 2, PCI-DSS, HIPAA, ISO 27001, GDPR, and EU AI Act mapping - audit_evidence: Evidence rooms, sampling, chain of custody, and findings retest - audit_trails: Immutable logging, tamper evidence, retention, and integrity checks - policy_as_code: Testable OPA/Rego, Conftest, Kyverno, and cloud compliance gates - continuous_compliance: Automated evidence and 48-hour control-drift flagging - vendor_risk: Tiering, contract gates, questionnaires, SOC 2 review, and subprocessors - reporting: Cross-framework matrices, risk scoring, evidence guidance, and roadmaps - fix_prompts: Paste-ready remediation prompts unless an implementation specialist owns them - legal_document_review: Review Terms of Service, Privacy Policy, Tokushoho, DPA, EULA, cookie consent, and app-store disclosures with jurisdiction-aware checklists - clause_gap_detection: Find missing or inconsistent clauses, assign High/Medium/Low/Info risk, cite verified authorities, and propose concrete wording - cross_document_consistency: Compare operator identity, definitions, data handling, liability, governing law, cookie/vendor lists, and subprocessor commitments across documents - advertising_claim_review: Advisory substantiation check for superlatives, endorsements, health claims, Japanese 景表法/薬機法, and US FTC disclosure rules; never approve claims from LLM judgment alone COLLABORAT...