diff --git a/README.md b/README.md
index a6a3df1..cf7bb37 100644
--- a/README.md
+++ b/README.md
@@ -386,7 +386,7 @@ published last month — it is written once and the obligation moves. So skills
 questions an outside authority settles carry a list of those authorities, in
 `references/sources.md` inside the skill, which is where an agent reads it while answering.
 
-50 sources across 36 skills so far — tax and accounting, law and
+181 sources across 144 skills so far — tax and accounting, law and
 employment, security and controls frameworks, education standards.
 [The full index is in `docs/SOURCES.md`](docs/SOURCES.md).
 
@@ -394,7 +394,7 @@ employment, security and controls frameworks, education standards.
 second part is the point: most of what a professional must cite is not open. ISO standards are
 sold, SANS papers are copyrighted, the FASB Codification needs an account — while US federal
 works are public domain by statute and EU legal texts are reusable with attribution.
-32 of the 50 are quotable; the rest are read-and-cite, and the entry
+122 of the 181 are quotable; the rest are read-and-cite, and the entry
 says so in the imperative next to the link.
 
 Links are re-checked weekly by their own workflow rather than on every push, because a
diff --git a/docs/SOURCES.md b/docs/SOURCES.md
index bae977f..fcb142c 100644
--- a/docs/SOURCES.md
+++ b/docs/SOURCES.md
@@ -2,28 +2,63 @@
 
 <!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
 
-50 authoritative sources, mapped to 36 skills. Each skill that has any carries its own list at `references/sources.md` inside the skill, which is where an agent reads it while answering.
+181 authoritative sources, mapped to 144 skills. Each skill that has any carries its own list at `references/sources.md` inside the skill, which is where an agent reads it while answering.
 
 **References, never copies.** The catalog holds a URL and a judgment about it, never source material. That is what keeps it live — a pointer to a regulator's site is right the moment the rule changes, and a snapshot is wrong the day after it is taken.
 
 ## What you may do with it
 
-**32 of 50 are quotable**, with attribution where the license asks for it. The rest are free to read and not free to reproduce, which is the single most useful thing this catalog records — most of what a professional must cite is not open.
+**122 of 181 are quotable**, with attribution where the license asks for it. The rest are free to read and not free to reproduce, which is the single most useful thing this catalog records — most of what a professional must cite is not open.
 
 | License | Sources | What an agent may do |
 |---|---|---|
-| Public domain (US government) | 23 | Quote freely |
-| Public domain | 1 | Quote freely |
-| CC BY | 1 | Quote with attribution |
+| Public domain (US government) | 89 | Quote freely |
+| Public domain | 5 | Quote freely |
+| CC BY | 8 | Quote with attribution |
 | Open data | 1 | Use the data; read the terms before redistributing |
-| Free to use with attribution | 6 | Quote with the publisher's required credit |
-| CC BY-SA (share-alike) | 2 | Quote with attribution; do not fold into this repository |
-| Free to read, all rights reserved | 11 | **Read and cite only. Never reproduce.** |
-| Free behind an account | 3 | **Cite it; the user fetches it.** |
-| Sold | 2 | **Cite the identifier only, never the text.** |
+| Free to use with attribution | 19 | Quote with the publisher's required credit |
+| CC BY-SA (share-alike) | 3 | Quote with attribution; do not fold into this repository |
+| Free to read, all rights reserved | 46 | **Read and cite only. Never reproduce.** |
+| Free behind an account | 5 | **Cite it; the user fetches it.** |
+| Sold | 5 | **Cite the identifier only, never the text.** |
 
 ## By subject
 
+### Data and workforce
+
+| Source | Publisher | License | Skills |
+|---|---|---|---|
+| [29 CFR Part 1607 — Uniform Guidelines on Employee Selection Procedures](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XIV/part-1607) | US Equal Employment Opportunity Commission | Public domain (US government) | `data-analytics:ai-ml-governance`, `people:hiring-and-interviewing`, `people:performance-management` |
+| [29 CFR Part 541 — exemption regulations](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-A/part-541) | US Department of Labor, Wage and Hour Division | Public domain (US government) | `people:compensation-and-leveling`, `people:employment-compliance`, `people:org-design` |
+| [29 CFR Part 825 — Family and Medical Leave Act regulations](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-C/part-825) | US Department of Labor, Wage and Hour Division | Public domain (US government) | `people:benefits-and-leave`, `people:employment-compliance` |
+| [48 CFR Chapter 99 — Cost Accounting Standards](https://www.ecfr.gov/current/title-48/chapter-99) | Cost Accounting Standards Board | Public domain (US government) | `finance:cost-accounting` |
+| [Apache Iceberg table specification](https://iceberg.apache.org/spec/) | Apache Software Foundation | Free to use with attribution | `data-analytics:data-engineering`, `data-analytics:data-modeling` |
+| [Apache Parquet file format specification](https://parquet.apache.org/docs/file-format/) | Apache Software Foundation | Free to use with attribution | `data-analytics:data-engineering` |
+| [Artificial Intelligence and the ADA](https://www.eeoc.gov/eeoc-disability-related-resources/artificial-intelligence-and-ada) | US Equal Employment Opportunity Commission | Public domain (US government) | `data-analytics:ai-ml-governance`, `people:hiring-and-interviewing` |
+| [BLS Handbook of Methods](https://www.bls.gov/opub/hom/) | US Bureau of Labor Statistics | Public domain (US government) | `data-analytics:quantitative-analysis`, `people:workforce-planning` |
+| [Data Catalog Vocabulary](https://www.w3.org/TR/vocab-dcat-3/) | World Wide Web Consortium | Free to read, all rights reserved | `data-analytics:chief-data-officer`, `data-analytics:data-engineering` |
+| [ERISA — laws and regulations](https://www.dol.gov/agencies/ebsa/laws-and-regulations/laws/erisa) | US Department of Labor, Employee Benefits Security Administration | Public domain (US government) | `people:benefits-and-leave` |
+| [FIPS 140-3: Security Requirements for Cryptographic Modules](https://csrc.nist.gov/pubs/fips/140-3/final) | NIST | Public domain (US government) | `security:data-protection-and-encryption` |
+| [Federal Rules of Civil Procedure](https://www.uscourts.gov/forms-rules/current-rules-practice-procedure/federal-rules-civil-procedure) | Administrative Office of the US Courts | Public domain (US government) | `legal-risk:disputes-and-legal-holds` |
+| [General Records Schedules](https://www.archives.gov/records-mgmt/grs) | US National Archives and Records Administration | Public domain (US government) | `data-analytics:chief-data-officer`, `legal-risk:disputes-and-legal-holds` |
+| [Handbook for Employers M-274: guidance for completing Form I-9](https://www.uscis.gov/i-9-central/form-i-9-resources/handbook-for-employers-m-274) | US Citizenship and Immigration Services | Public domain (US government) | `people:employment-compliance`, `people:onboarding-and-offboarding` |
+| [IRS Publication 15-B: Employer's Tax Guide to Fringe Benefits](https://www.irs.gov/pub/irs-pdf/p15b.pdf) | US Internal Revenue Service | Public domain (US government) | `finance:tax`, `people:benefits-and-leave` |
+| [ISO/IEC 42001 — AI management systems](https://www.iso.org/standard/42001.html) | ISO | Sold | `data-analytics:ai-ml-governance` |
+| [Interagency Guidance on Leveraged Lending, SR 13-3](https://www.federalreserve.gov/supervisionreg/srletters/sr1303.htm) | Board of Governors of the Federal Reserve System | Public domain (US government) | `finance:capital-structure-and-covenants` |
+| [NIST AI 600-1: Generative AI Profile](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence) | NIST | Public domain (US government) | `data-analytics:ai-ml-governance`, `executive:ai-research-analyst` |
+| [NIST AI RMF Playbook](https://airc.nist.gov/airmf-resources/playbook/) | NIST | Public domain (US government) | `data-analytics:ai-ml-governance` |
+| [NIST AI Risk Management Framework, AI 100-1](https://www.nist.gov/itl/ai-risk-management-framework) | NIST | Public domain (US government) | `data-analytics:ai-ml-governance`, `data-analytics:chief-data-officer`, `executive:ai-research-analyst` |
+| [NIST SP 800-57 Part 1: Recommendation for Key Management](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final) | NIST | Public domain (US government) | `security:data-protection-and-encryption` |
+| [NIST SP 800-92: Guide to Computer Security Log Management](https://csrc.nist.gov/pubs/sp/800/92/final) | NIST | Public domain (US government) | `security:detection-and-monitoring` |
+| [NIST/SEMATECH e-Handbook of Statistical Methods](https://www.itl.nist.gov/div898/handbook/) | NIST | Public domain (US government) | `data-analytics:quantitative-analysis` |
+| [NYSE Listed Company Manual](https://nyse.wolterskluwer.cloud/listed-company-manual) | New York Stock Exchange | Free to read, all rights reserved | `executive:fundraising-and-investor-relations`, `legal-risk:corporate-governance` |
+| [O*NET database](https://www.onetcenter.org/database.html) | National Center for O*NET Development, US Department of Labor | CC BY | `people:learning-and-development`, `people:org-design`, `people:workforce-planning` |
+| [OECD Recommendation of the Council on Artificial Intelligence](https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449) | OECD | Free to use with attribution | `data-analytics:ai-ml-governance` |
+| [OpenLineage object model](https://openlineage.io/docs/spec/object-model/) | LF AI and Data Foundation | Free to use with attribution | `data-analytics:chief-data-officer`, `data-analytics:data-engineering` |
+| [Shapes Constraint Language](https://www.w3.org/TR/shacl/) | World Wide Web Consortium | Free to read, all rights reserved | `data-analytics:data-engineering`, `data-analytics:data-modeling` |
+| [Statistical Quality Standards](https://www.census.gov/about/policies/quality/standards.html) | US Census Bureau | Public domain (US government) | `data-analytics:business-intelligence`, `data-analytics:quantitative-analysis` |
+| [The Sedona Principles and Commentary on Legal Holds](https://www.thesedonaconference.org/publications) | The Sedona Conference | Free to read, all rights reserved | `legal-risk:disputes-and-legal-holds` |
+
 ### Education
 
 | Source | Publisher | License | Skills |
@@ -50,7 +85,7 @@
 | [COSO Internal Control — Integrated Framework](https://www.coso.org/guidance-on-ic) | Committee of Sponsoring Organizations of the Treadway Commission | Sold | `finance:internal-controls-and-audit`, `legal-risk:enterprise-risk` |
 | [Daily Treasury Par Yield Curve Rates](https://home.treasury.gov/interest-rates-data-csv-archive) | US Department of the Treasury | Public domain (US government) | `finance:capital-allocation`, `finance:financial-modeling`, `finance:treasury-and-liquidity` |
 | [EDGAR full-text search and submissions API](https://www.sec.gov/edgar/search-and-access) | US Securities and Exchange Commission | Public domain (US government) | `corporate-strategy:mergers-and-acquisitions`, `finance:financial-reporting-and-close`, `finance:financial-statement-analysis` |
-| [FASB Accounting Standards Codification](https://asc.fasb.org/) | Financial Accounting Standards Board | Free behind an account | `finance:chief-financial-officer`, `finance:financial-reporting-and-close`, `finance:revenue-recognition` |
+| [FASB Accounting Standards Codification](https://asc.fasb.org/) | Financial Accounting Standards Board | Free behind an account | `finance:chief-financial-officer`, `finance:financial-reporting-and-close`, `finance:revenue-recognition`, `revenue:pricing-and-packaging`, `revenue:revenue-operations` |
 | [FRED — Federal Reserve Economic Data](https://fred.stlouisfed.org/) | Federal Reserve Bank of St. Louis | Open data | `finance:budgeting-and-forecasting`, `finance:financial-modeling`, `finance:treasury-and-liquidity` |
 | [IFRS Accounting Standards](https://www.ifrs.org/issued-standards/list-of-standards/) | IFRS Foundation | Free behind an account | `finance:financial-reporting-and-close`, `finance:revenue-recognition` |
 | [IRS forms, instructions and publications](https://www.irs.gov/forms-instructions) | US Internal Revenue Service | Public domain (US government) | `finance:tax`, `people:payroll-operations` |
@@ -78,6 +113,90 @@
 | [Wage and Hour Division](https://www.dol.gov/agencies/whd) | US Department of Labor | Public domain (US government) | `people:chief-human-resources-officer`, `people:employment-compliance`, `people:payroll-operations` |
 | [govinfo](https://www.govinfo.gov/) | US Government Publishing Office | Public domain (US government) | `legal-risk:regulatory-compliance` |
 
+### Marketing and advertising
+
+| Source | Publisher | License | Skills |
+|---|---|---|---|
+| [.com Disclosures: How to Make Effective Disclosures in Digital Advertising](https://www.ftc.gov/business-guidance/resources/com-disclosures-how-make-effective-disclosures-digital-advertising) | US Federal Trade Commission | Public domain (US government) | `demand-generation:landing-page-cro-expert`, `demand-generation:lead-capture`, `demand-generation:paid-advertising`, `marketing:marketing-copywriting` |
+| [ASA Statement on Statistical Significance and P-Values](https://www.amstat.org/asa/files/pdfs/p-valuestatement.pdf) | American Statistical Association | Free to read, all rights reserved | `demand-generation:experimentation`, `demand-generation:landing-page-cro-expert`, `demand-generation:marketing-analytics` |
+| [App Store Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) | Apple | Free to read, all rights reserved | `demand-generation:app-store-optimization`, `marketing:product-launch`, `product:chief-product-officer`, `revenue:pricing-and-packaging` |
+| [CAN-SPAM Act: A Compliance Guide for Business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) | US Federal Trade Commission | Public domain (US government) | `demand-generation:account-based-marketing`, `demand-generation:lead-capture`, `demand-generation:lifecycle-messaging`, `marketing:newsletter-writer`, `revenue:outbound-prospecting` |
+| [Canada's Anti-Spam Legislation, S.C. 2010 c. 23](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/index.html) | Department of Justice Canada | Free to use with attribution | `demand-generation:lead-capture`, `demand-generation:lifecycle-messaging`, `marketing:newsletter-writer`, `revenue:outbound-prospecting` |
+| [Children's Online Privacy Protection Rule, 16 CFR 312](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312) | US Federal Trade Commission | Public domain (US government) | `demand-generation:app-store-optimization`, `demand-generation:lead-capture`, `demand-generation:paid-advertising`, `marketing:behavioral-marketing`, `product:product-requirements` |
+| [Delivery restrictions and telephone solicitation rules, 47 CFR 64.1200](https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200) | US Federal Communications Commission | Public domain (US government) | `demand-generation:lead-capture`, `demand-generation:lifecycle-messaging`, `marketing:behavioral-marketing`, `revenue:outbound-prospecting` |
+| [Disclosures 101 for Social Media Influencers](https://www.ftc.gov/business-guidance/resources/disclosures-101-social-media-influencers) | US Federal Trade Commission | Public domain (US government) | `marketing:partnership-marketing`, `marketing:social-post-craft`, `marketing:video-content`, `marketing:youtube-producer` |
+| [Google Play Developer Program Policy](https://play.google.com/about/developer-content-policy/) | Google | Free to read, all rights reserved | `demand-generation:app-store-optimization`, `marketing:product-launch` |
+| [Google crawlers and user-triggered fetchers](https://developers.google.com/search/docs/crawling-indexing/overview-google-crawlers) | Google | CC BY | `demand-generation:ai-search-optimization`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy` |
+| [Guide to PECR: cookies and similar technologies](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/) | UK Information Commissioner's Office | Free to use with attribution | `demand-generation:experimentation`, `demand-generation:marketing-analytics`, `marketing:behavioral-marketing` |
+| [Guidelines 05/2020 on consent under Regulation 2016/679](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en) | European Data Protection Board | Free to use with attribution | `demand-generation:landing-page-cro-expert`, `demand-generation:lead-capture`, `demand-generation:marketing-analytics`, `marketing:behavioral-marketing` |
+| [Guides Against Deceptive Pricing, 16 CFR 233](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-233) | US Federal Trade Commission | Public domain (US government) | `demand-generation:landing-page-cro-expert`, `demand-generation:paid-advertising`, `marketing:marketing-copywriting`, `revenue:pricing-and-packaging` |
+| [Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR 255](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255) | US Federal Trade Commission | Public domain (US government) | `marketing:partnership-marketing`, `marketing:public-relations`, `marketing:social-post-craft`, `marketing:youtube-producer`, `revenue:referral-programs` |
+| [MRC standards and guidelines](https://mediaratingcouncil.org/standards-and-guidelines) | Media Rating Council | Free to read, all rights reserved | `demand-generation:marketing-analytics`, `demand-generation:paid-advertising`, `marketing:video-content` |
+| [Native Advertising: A Guide for Businesses](https://www.ftc.gov/business-guidance/resources/native-advertising-guide-businesses) | US Federal Trade Commission | Public domain (US government) | `demand-generation:paid-advertising`, `marketing:content-strategy`, `marketing:partnership-marketing`, `marketing:public-relations` |
+| [Policy Statement Regarding Advertising Substantiation](https://www.ftc.gov/legal-library/browse/ftc-policy-statement-regarding-advertising-substantiation) | US Federal Trade Commission | Public domain (US government) | `demand-generation:paid-advertising`, `marketing:marketing-copywriting`, `marketing:positioning-and-messaging`, `marketing:product-launch` |
+| [Product data specification](https://support.google.com/merchants/answer/7052112) | Google | Free to read, all rights reserved | `demand-generation:listing-distribution`, `demand-generation:paid-advertising` |
+| [RFC 9309: Robots Exclusion Protocol](https://www.rfc-editor.org/rfc/rfc9309.html) | IETF | Free to read, all rights reserved | `demand-generation:ai-search-optimization`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy` |
+| [Schema.org vocabulary](https://schema.org/) | Schema.org community group | CC BY-SA (share-alike) | `demand-generation:listing-distribution`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy` |
+| [Spam policies for Google web search](https://developers.google.com/search/docs/essentials/spam-policies) | Google | CC BY | `demand-generation:ai-search-optimization`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy`, `marketing:content-strategy` |
+| [Standard Definitions: final dispositions of case codes and outcome rates for surveys](https://aapor.org/standards-and-ethics/standard-definitions/) | American Association for Public Opinion Research | Free to read, all rights reserved | `demand-generation:marketing-analytics`, `marketing:customer-research` |
+| [Structured data markup that Google Search supports](https://developers.google.com/search/docs/appearance/structured-data/search-gallery) | Google | CC BY | `demand-generation:listing-distribution`, `demand-generation:programmatic-seo`, `demand-generation:seo-strategy` |
+| [Web Content Accessibility Guidelines 2.2](https://www.w3.org/TR/WCAG22/) | World Wide Web Consortium | Free to read, all rights reserved | `customer-experience:self-service-and-knowledge`, `demand-generation:landing-page-cro-expert`, `marketing:newsletter-writer`, `marketing:video-content`, `marketing:visual-content`, `product:design-system`, `product:interface-craft`, `product:interface-redesign`, `product:ux-product-auditor` |
+
+### Pmo and operations
+
+| Source | Publisher | License | Skills |
+|---|---|---|---|
+| [17 CFR Part 243 — Regulation FD](https://www.ecfr.gov/current/title-17/chapter-II/part-243) | US Securities and Exchange Commission | Public domain (US government) | `executive:fundraising-and-investor-relations`, `legal-risk:corporate-governance` |
+| [2010 ADA Standards for Accessible Design](https://www.ada.gov/law-and-regs/design-standards/2010-stds/) | US Department of Justice | Public domain (US government) | `marketing:events-and-field-marketing`, `operations:facilities-and-workplace` |
+| [21 CFR Part 117 — preventive controls for human food](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117) | US Food and Drug Administration | Public domain (US government) | `operations:procurement-and-sourcing`, `operations:quality-management`, `operations:supply-chain-and-logistics` |
+| [29 CFR Part 1910 — occupational safety and health standards](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XVII/part-1910) | US Occupational Safety and Health Administration | Public domain (US government) | `operations:facilities-and-workplace`, `people:learning-and-development` |
+| [49 CFR Part 395 — hours of service of drivers](https://www.ecfr.gov/current/title-49/subtitle-B/chapter-III/subchapter-B/part-395) | Federal Motor Carrier Safety Administration | Public domain (US government) | `operations:capacity-and-demand-planning`, `operations:supply-chain-and-logistics` |
+| [9 CFR Part 417 — Hazard Analysis and Critical Control Point systems](https://www.ecfr.gov/current/title-9/chapter-III/subchapter-E/part-417) | US Department of Agriculture, Food Safety and Inspection Service | Public domain (US government) | `operations:process-design`, `operations:quality-management` |
+| [Country Commercial Guides](https://www.trade.gov/country-commercial-guides) | US Department of Commerce, International Trade Administration | Public domain (US government) | `corporate-strategy:market-entry`, `operations:supply-chain-and-logistics` |
+| [Delaware General Corporation Law](https://delcode.delaware.gov/title8/c001/index.html) | State of Delaware | Public domain | `executive:chief-executive`, `executive:fundraising-and-investor-relations`, `legal-risk:corporate-governance` |
+| [Exempt offerings and Regulation D](https://www.sec.gov/education/smallbusiness/exemptofferings) | US Securities and Exchange Commission | Public domain (US government) | `executive:chief-executive`, `executive:fundraising-and-investor-relations` |
+| [Federal Acquisition Regulation](https://www.acquisition.gov/browse/index/far) | US General Services Administration, on behalf of the FAR Council | Public domain (US government) | `finance:cost-accounting`, `operations:procurement-and-sourcing`, `operations:vendor-management` |
+| [GAO Agile Assessment Guide](https://www.gao.gov/products/gao-24-105506) | US Government Accountability Office | Public domain (US government) | `pmo:change-and-adoption`, `pmo:head-of-pmo`, `pmo:project-delivery` |
+| [GAO Cost Estimating and Assessment Guide](https://www.gao.gov/products/gao-20-195g) | US Government Accountability Office | Public domain (US government) | `pmo:estimating-and-contingency`, `pmo:portfolio-governance`, `pmo:program-management` |
+| [GAO Schedule Assessment Guide: best practices for project schedules](https://www.gao.gov/products/gao-16-89g) | US Government Accountability Office | Public domain (US government) | `pmo:dependency-and-risk-management`, `pmo:project-delivery`, `pmo:schedule-development-and-analysis` |
+| [Hart-Scott-Rodino premerger notification program](https://www.ftc.gov/enforcement/premerger-notification-program) | US Federal Trade Commission | Public domain (US government) | `corporate-strategy:chief-strategy-officer`, `corporate-strategy:mergers-and-acquisitions` |
+| [ISO 9001 — Quality management systems: requirements](https://www.iso.org/standard/62085.html) | ISO | Sold | `operations:process-design`, `operations:quality-management`, `operations:vendor-management` |
+| [Incoterms rules](https://iccwbo.org/business-solutions/incoterms-rules/) | International Chamber of Commerce | Sold | `operations:procurement-and-sourcing`, `operations:supply-chain-and-logistics` |
+| [Interagency Guidance on Third-Party Relationships: Risk Management](https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm) | Federal Reserve, FDIC and OCC | Public domain (US government) | `operations:procurement-and-sourcing`, `operations:service-level-management`, `operations:vendor-management` |
+| [Merger Guidelines](https://www.ftc.gov/reports/merger-guidelines-2023) | US Department of Justice and Federal Trade Commission | Public domain (US government) | `corporate-strategy:chief-strategy-officer`, `corporate-strategy:mergers-and-acquisitions`, `corporate-strategy:portfolio-strategy` |
+| [NASA Systems Engineering Handbook](https://www.nasa.gov/reference/systems-engineering-handbook/) | NASA | Public domain (US government) | `pmo:portfolio-governance`, `pmo:program-management`, `pmo:project-delivery` |
+| [NIST SP 800-61: Incident Response Recommendations and Considerations](https://csrc.nist.gov/pubs/sp/800/61/r3/final) | NIST | Public domain (US government) | `customer-experience:escalation-management`, `operations:incident-management`, `security:detection-and-monitoring`, `security:incident-response` |
+| [National Incident Management System doctrine](https://www.fema.gov/emergency-managers/nims) | Federal Emergency Management Agency | Public domain (US government) | `operations:business-continuity-and-resilience`, `operations:incident-management` |
+| [The Green Book: appraisal and evaluation in central government](https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent) | HM Treasury | Free to use with attribution | `corporate-strategy:portfolio-strategy`, `pmo:benefits-realization`, `pmo:estimating-and-contingency`, `pmo:portfolio-governance` |
+
+### Revenue and product
+
+| Source | Publisher | License | Skills |
+|---|---|---|---|
+| [15 U.S.C. 7001 — Electronic Signatures in Global and National Commerce Act](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section7001&num=0&edition=prelim) | US Congress, via the Office of the Law Revision Counsel | Public domain (US government) | `customer-experience:customer-onboarding-and-implementation`, `revenue:deal-negotiation`, `revenue:revenue-operations` |
+| [15 U.S.C. 8403 — Restore Online Shoppers' Confidence Act](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section8403&num=0&edition=prelim) | US Congress, via the Office of the Law Revision Counsel | Public domain (US government) | `product:product-requirements`, `revenue:activation`, `revenue:pricing-and-packaging`, `revenue:retention` |
+| [16 CFR Part 310 — Telemarketing Sales Rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310) | US Federal Trade Commission | Public domain (US government) | `revenue:outbound-prospecting`, `revenue:revenue-operations`, `revenue:sales-enablement` |
+| [18 U.S.C. 2511 — interception of communications](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title18-section2511&num=0&edition=prelim) | US Congress, via the Office of the Law Revision Counsel | Public domain (US government) | `customer-experience:support-operations`, `revenue:outbound-prospecting` |
+| [36 CFR Part 1194 — Section 508 information and communication technology standards](https://www.ecfr.gov/current/title-36/subtitle-B/chapter-XI/part-1194) | US Access Board | Public domain (US government) | `product:product-requirements`, `product:ux-product-auditor`, `revenue:sales-enablement` |
+| [Age Appropriate Design Code](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/) | UK Information Commissioner's Office | Free to use with attribution | `product:interface-craft`, `product:product-requirements`, `revenue:activation` |
+| [CCPA regulations, California Code of Regulations title 11](https://cppa.ca.gov/regulations/consumer_privacy_act.html) | California Privacy Protection Agency | Public domain | `marketing:behavioral-marketing`, `product:interface-craft`, `product:interface-redesign`, `product:ux-product-auditor` |
+| [California Automatic Renewal Law, Business and Professions Code 17600-17606](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=7.&chapter=1.&part=3.&lawCode=BPC&article=9.) | California Legislative Counsel | Public domain | `product:interface-craft`, `product:product-requirements`, `revenue:pricing-and-packaging`, `revenue:retention` |
+| [California Labor Code 2751 — commission agreements in writing](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=LAB&sectionNum=2751) | California Legislative Counsel | Public domain | `revenue:revenue-operations`, `revenue:sales-compensation-and-territory` |
+| [Commission Guidance on Management's Discussion and Analysis, Release 33-10751](https://www.federalregister.gov/documents/2020/02/25/2020-02296/commission-guidance-on-managements-discussion-and-analysis-of-financial-condition-and-results-of) | US Securities and Exchange Commission | Public domain (US government) | `data-analytics:business-intelligence`, `finance:unit-economics`, `revenue:revenue-operations` |
+| [Compendium of U.S. Copyright Office Practices](https://www.copyright.gov/comp3/) | US Copyright Office | Public domain (US government) | `legal-risk:intellectual-property`, `product:brand-identity`, `product:visual-reference-generation` |
+| [EN 301 549 — accessibility requirements for ICT products and services](https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf) | ETSI | Free to read, all rights reserved | `product:product-requirements`, `product:ux-product-auditor`, `revenue:sales-enablement` |
+| [Fact Sheet 17F: exemption for outside sales employees](https://www.dol.gov/agencies/whd/fact-sheets/17f-overtime-outside-sales) | US Department of Labor, Wage and Hour Division | Public domain (US government) | `people:employment-compliance`, `revenue:sales-compensation-and-territory` |
+| [Federal Plain Language Guidelines](https://www.plainlanguage.gov/guidelines/) | Plain Language Action and Information Network | Public domain (US government) | `customer-experience:self-service-and-knowledge`, `customer-experience:support-operations` |
+| [Human Interface Guidelines](https://developer.apple.com/design/human-interface-guidelines) | Apple | Free to read, all rights reserved | `product:design-system`, `product:interface-craft`, `product:interface-redesign` |
+| [Non-GAAP financial measures — compliance and disclosure interpretations](https://www.sec.gov/corpfin/non-gaap-financial-measures) | US Securities and Exchange Commission, Division of Corporation Finance | Public domain (US government) | `finance:capital-structure-and-covenants`, `finance:unit-economics` |
+| [PCI Data Security Standard](https://www.pcisecuritystandards.org/document_library/) | PCI Security Standards Council | Free behind an account | `customer-experience:support-operations`, `security:data-protection-and-encryption`, `security:detection-and-monitoring` |
+| [Regulation (EU) 910/2014 — eIDAS](https://eur-lex.europa.eu/eli/reg/2014/910/oj) | Publications Office of the European Union | Free to use with attribution | `revenue:deal-negotiation`, `revenue:revenue-operations` |
+| [SIL Open Font License](https://openfontlicense.org/) | SIL International | Free to read, all rights reserved | `product:brand-identity`, `product:design-system` |
+| [Trademark Manual of Examining Procedure](https://tmep.uspto.gov/) | US Patent and Trademark Office | Public domain (US government) | `legal-risk:intellectual-property`, `product:brand-identity` |
+| [Unicode Common Locale Data Repository](https://cldr.unicode.org/) | Unicode Consortium | Free to use with attribution | `product:design-system`, `product:interface-craft`, `product:product-requirements` |
+| [Uniform Commercial Code, Article 2 — Sales](https://www.law.cornell.edu/ucc/2) | American Law Institute and Uniform Law Commission | Free to read, all rights reserved | `revenue:deal-negotiation`, `revenue:revenue-operations` |
+| [WAI-ARIA and the ARIA Authoring Practices Guide](https://www.w3.org/WAI/ARIA/apg/) | World Wide Web Consortium | Free to read, all rights reserved | `product:design-system`, `product:interface-craft`, `product:interface-redesign`, `product:ux-product-auditor` |
+
 ### Security
 
 | Source | Publisher | License | Skills |
@@ -86,7 +205,7 @@
 | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | CISA | Public domain (US government) | `security:incident-response`, `security:vulnerability-management` |
 | [FedRAMP baselines and automation content](https://www.fedramp.gov/rev5/documents-templates/) | GSA | Public domain (US government) | `legal-risk:regulatory-compliance`, `security:chief-information-security-officer`, `security:security-architecture-review` |
 | [ISO/IEC 27001 — Information security management systems](https://www.iso.org/standard/27001) | ISO | Sold | `legal-risk:regulatory-compliance`, `security:chief-information-security-officer` |
-| [MITRE ATT&CK](https://attack.mitre.org/) | The MITRE Corporation | Free to use with attribution | `security:incident-response`, `security:security-architecture-review`, `security:threat-modeling` |
+| [MITRE ATT&CK](https://attack.mitre.org/) | The MITRE Corporation | Free to use with attribution | `security:detection-and-monitoring`, `security:incident-response`, `security:security-architecture-review`, `security:threat-modeling` |
 | [NIST Cybersecurity Framework 2.0](https://www.nist.gov/cyberframework) | NIST | Public domain (US government) | `security:chief-information-security-officer`, `security:security-architecture-review` |
 | [NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) | NIST | Public domain (US government) | `security:access-and-identity`, `security:chief-information-security-officer`, `security:security-architecture-review` |
 | [National Vulnerability Database](https://nvd.nist.gov/) | NIST | Public domain (US government) | `security:vulnerability-management` |
@@ -94,6 +213,43 @@
 | [OWASP Top 10](https://owasp.org/www-project-top-ten/) | OWASP Foundation | CC BY-SA (share-alike) | `security:security-architecture-review`, `security:threat-modeling` |
 | [SANS Information Security Policy Templates](https://www.sans.org/information-security-policy/) | SANS Institute | Free to read, all rights reserved | `legal-risk:regulatory-compliance`, `security:chief-information-security-officer` |
 
+### Technology and it
+
+| Source | Publisher | License | Skills |
+|---|---|---|---|
+| [47 CFR Part 9 — 911 requirements](https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-9) | US Federal Communications Commission | Public domain (US government) | `it-operations:telephony-and-conferencing` |
+| [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html) | Amazon Web Services | Free to read, all rights reserved | `it-operations:cloud-administration`, `technology:cloud-infrastructure`, `technology:solution-architecture` |
+| [Agent Skills documentation](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) | Anthropic | Free to read, all rights reserved | `technology:skill-authoring` |
+| [Automated Technical Debt Measure](https://www.omg.org/spec/ATDM/) | Object Management Group | Free to read, all rights reserved | `technology:technical-debt-management` |
+| [Azure Well-Architected Framework](https://learn.microsoft.com/en-us/azure/well-architected/) | Microsoft | Free to read, all rights reserved | `it-operations:cloud-administration`, `technology:cloud-infrastructure` |
+| [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks) | Center for Internet Security | Free behind an account | `it-operations:cloud-administration`, `it-operations:endpoint-management`, `it-operations:systems-administration`, `it-operations:virtualization-operations` |
+| [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) | Conventional Commits project | CC BY | `technology:branch-and-worktree-workflow` |
+| [Git reference manual](https://git-scm.com/docs) | Git project | Free to read, all rights reserved | `technology:branch-and-worktree-workflow`, `technology:parallel-agent-delivery` |
+| [Google Cloud Architecture Framework](https://cloud.google.com/architecture/framework) | Google Cloud | Free to read, all rights reserved | `it-operations:cloud-administration`, `technology:cloud-infrastructure` |
+| [Model Context Protocol specification](https://modelcontextprotocol.io/specification/latest) | Model Context Protocol project | Free to read, all rights reserved | `technology:ai-workflow-architect` |
+| [NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices](https://csrc.nist.gov/pubs/sp/800/124/r2/final) | NIST | Public domain (US government) | `it-operations:endpoint-management` |
+| [NIST SP 800-145: The NIST Definition of Cloud Computing](https://csrc.nist.gov/pubs/sp/800/145/final) | NIST | Public domain (US government) | `it-operations:cloud-administration`, `technology:cloud-infrastructure` |
+| [NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final) | NIST | Public domain (US government) | `it-operations:cloud-administration`, `it-operations:identity-lifecycle-administration`, `it-operations:network-administration` |
+| [NIST SP 800-34: Contingency Planning Guide for Federal Information Systems](https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final) | NIST | Public domain (US government) | `it-operations:backup-and-recovery`, `operations:business-continuity-and-resilience`, `operations:incident-management` |
+| [NIST SP 800-40: Guide to Enterprise Patch Management Planning](https://csrc.nist.gov/pubs/sp/800/40/r4/final) | NIST | Public domain (US government) | `it-operations:endpoint-management`, `it-operations:systems-administration`, `security:vulnerability-management` |
+| [NIST SP 800-63: Digital Identity Guidelines](https://csrc.nist.gov/pubs/sp/800/63/4/final) | NIST | Public domain (US government) | `it-operations:identity-lifecycle-administration`, `security:access-and-identity` |
+| [OpenAPI Specification](https://spec.openapis.org/oas/latest.html) | OpenAPI Initiative, Linux Foundation | Free to use with attribution | `technology:api-design` |
+| [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) | OpenID Foundation | Free to read, all rights reserved | `it-operations:identity-lifecycle-administration` |
+| [OpenTelemetry specification and semantic conventions](https://opentelemetry.io/docs/specs/otel/) | OpenTelemetry project, Cloud Native Computing Foundation | CC BY | `technology:observability-and-reliability` |
+| [RFC 1035: Domain Names — Implementation and Specification](https://www.rfc-editor.org/rfc/rfc1035.html) | IETF | Free to read, all rights reserved | `it-operations:network-administration` |
+| [RFC 1918: Address Allocation for Private Internets](https://www.rfc-editor.org/rfc/rfc1918.html) | IETF | Free to read, all rights reserved | `it-operations:network-administration` |
+| [RFC 3261: SIP — Session Initiation Protocol](https://www.rfc-editor.org/rfc/rfc3261.html) | IETF | Free to read, all rights reserved | `it-operations:telephony-and-conferencing` |
+| [RFC 7644: System for Cross-domain Identity Management Protocol](https://www.rfc-editor.org/rfc/rfc7644.html) | IETF | Free to read, all rights reserved | `it-operations:identity-lifecycle-administration` |
+| [RFC 9110: HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110.html) | IETF | Free to read, all rights reserved | `technology:api-design` |
+| [RFC 9457: Problem Details for HTTP APIs](https://www.rfc-editor.org/rfc/rfc9457.html) | IETF | Free to read, all rights reserved | `technology:api-design` |
+| [RFC 9700: Best Current Practice for OAuth 2.0 Security](https://www.rfc-editor.org/rfc/rfc9700.html) | IETF | Free to read, all rights reserved | `it-operations:identity-lifecycle-administration`, `technology:api-design` |
+| [Regulation (EU) 2024/1689 — the AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) | Publications Office of the European Union | Free to use with attribution | `data-analytics:ai-ml-governance`, `legal-risk:regulatory-compliance`, `technology:chief-technology-officer` |
+| [Security Technical Implementation Guides](https://public.cyber.mil/stigs/) | Defense Information Systems Agency, US Department of Defense | Public domain (US government) | `it-operations:endpoint-management`, `it-operations:network-administration`, `it-operations:systems-administration`, `it-operations:virtualization-operations` |
+| [Semantic Versioning 2.0.0](https://semver.org/) | Semantic Versioning project | CC BY | `technology:api-design`, `technology:branch-and-worktree-workflow` |
+| [Site Reliability Engineering and The SRE Workbook](https://sre.google/sre-book/table-of-contents/) | Google | Free to read, all rights reserved | `technology:observability-and-reliability` |
+| [Trace Context](https://www.w3.org/TR/trace-context/) | World Wide Web Consortium | Free to read, all rights reserved | `technology:observability-and-reliability` |
+| [WebRTC: Real-Time Communication in Browsers](https://www.w3.org/TR/webrtc/) | World Wide Web Consortium | Free to read, all rights reserved | `it-operations:telephony-and-conferencing` |
+
 ## Keeping it honest
 
 `scripts/check-sources.py` runs on every push and verifies structure, the license vocabulary, that every skill named resolves, and that a skill with sources actually points at them. Reachability is checked weekly by its own workflow instead, because a publisher being briefly down is not a reason to fail an unrelated pull request.
diff --git a/docs/assets/org-chart-dark.png b/docs/assets/org-chart-dark.png
index c4299f5..e58b887 100644
Binary files a/docs/assets/org-chart-dark.png and b/docs/assets/org-chart-dark.png differ
diff --git a/docs/assets/org-chart-light.png b/docs/assets/org-chart-light.png
index 1b59cd2..57674d2 100644
Binary files a/docs/assets/org-chart-light.png and b/docs/assets/org-chart-light.png differ
diff --git a/docs/org-chart.html b/docs/org-chart.html
index eef9786..e7d82c5 100644
--- a/docs/org-chart.html
+++ b/docs/org-chart.html
@@ -414,7 +414,7 @@ <h2>Using this</h2>
 </div>
 
 <script>
-const DEPTS = [{"slug": "executive", "title": "Office of the CEO", "exec": "Chief Executive", "glyph": "M4 20h16M6 20V9l6-4 6 4v11M10 20v-5h4v5", "reviewer": false, "skills": [{"name": "agent-hierarchy", "summary": "Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independ…", "trigger": "Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a script that runs in CI. Use this whenever the user wants to set up, expand, audit, or fix a multi-agent or subagent structure for a codebase; asks how to divide work between agents; wants agent charters, roles, or a surface map written; or is hitting agents that collide on the same files, review their own work, or drift from their remit. Also use when sizing a roster or deciding whether a new agent is justified.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/agent-hierarchy/SKILL.md", "sources": 0}, {"name": "ai-research-analyst", "summary": "Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with th…", "trigger": "Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit. Use this to analyze a market or industry, map competitors, evaluate a market-entry or build-versus-buy decision, produce a research brief, or assemble evidence for a decision. Also use when comparing options that need a structured, evidence-based verdict rather than an opinion.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/ai-research-analyst/SKILL.md", "sources": 0}, {"name": "business-growth-consultant", "summary": "Finds the single constraint currently limiting a business's growth and the highest-leverage moves against it, rather than producing a list of everyth…", "trigger": "Finds the single constraint currently limiting a business's growth and the highest-leverage moves against it, rather than producing a list of everything that could be improved. Use this when growth has stalled or slowed, when deciding where to spend limited time or budget, when revenue rises but profit does not, when prioritizing growth initiatives, or when a business feels busy without compounding.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/business-growth-consultant/SKILL.md", "sources": 0}, {"name": "ceo-advisor", "summary": "Pressure-tests a decision, plan, or idea before it is committed to — surfacing the assumption it rests on, the case against it, and what would have t…", "trigger": "Pressure-tests a decision, plan, or idea before it is committed to — surfacing the assumption it rests on, the case against it, and what would have to be true for it to work. Use this when weighing options, when a plan needs challenging before commitment, when you have already decided and want a genuine gut check, when processing meeting notes into decisions, or when competing initiatives need ranking. Distinct from `chief-executive`, which owns direction; this one interrogates a specific decision.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/ceo-advisor/SKILL.md", "sources": 0}, {"name": "chief-executive", "summary": "Sets direction, allocates capital and attention, and makes the calls no one else can make", "trigger": "Sets direction, allocates capital and attention, and makes the calls no one else can make. Use this when a decision spans more than one function, when priorities conflict and something must be cut, when a plan needs pressure-testing before commitment, or when the question is what the organization should do rather than how to do it. Also use to route a request to the right executive when it is unclear who owns it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/chief-executive/SKILL.md", "sources": 0}, {"name": "fundraising-and-investor-relations", "summary": "Raises capital and manages the relationship afterward — deciding how much and why, understanding what dilution and preferences actually cost, running…", "trigger": "Raises capital and manages the relationship afterward — deciding how much and why, understanding what dilution and preferences actually cost, running a process with real competitive tension, preparing for diligence before it starts, and reporting to investors and a board in a way that keeps support when results are bad. Use this to plan a raise, evaluate a term sheet beyond the valuation, prepare a data room, or fix reporting that is producing surprises.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/fundraising-and-investor-relations/SKILL.md", "sources": 0}, {"name": "saas-idea-validator", "summary": "Evaluates a software or startup idea against problem, market, competition, monetization, defensibility, and execution, and returns a verdict rather t…", "trigger": "Evaluates a software or startup idea against problem, market, competition, monetization, defensibility, and execution, and returns a verdict rather than encouragement. Use this when an idea needs pressure-testing before anyone builds, when deciding whether something is worth pursuing, when assessing competition or willingness to pay, or when a validated idea needs a first-customers and MVP plan. Default to scrutiny; the useful answer is usually the unwelcome one.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/saas-idea-validator/SKILL.md", "sources": 0}]}, {"slug": "technology", "title": "Technology", "exec": "CTO / CIO", "glyph": "M9 8l-4 4 4 4M15 8l4 4-4 4", "reviewer": false, "skills": [{"name": "ai-workflow-architect", "summary": "Designs AI systems, automations, and agent workflows for a business — identifying which manual work is worth automating, how to structure the system,…", "trigger": "Designs AI systems, automations, and agent workflows for a business — identifying which manual work is worth automating, how to structure the system, which tools fit, and what could go wrong. Use this to automate part of an operation, design an agent or MCP workflow, reduce repetitive manual work, connect tools into a system, decide which automation to build first, or audit an automation that is not delivering.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/ai-workflow-architect/SKILL.md", "sources": 0}, {"name": "api-design", "summary": "Designs interfaces that survive their consumers — resource modeling, errors, versioning, pagination, and compatibility", "trigger": "Designs interfaces that survive their consumers — resource modeling, errors, versioning, pagination, and compatibility. Use this to design a new API, review one before it ships, decide how to version or deprecate, fix an interface consumers keep misusing, or work out whether a change is breaking.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/api-design/SKILL.md", "sources": 0}, {"name": "branch-and-worktree-workflow", "summary": "Isolates feature work in its own branch or worktree and integrates it cleanly when done", "trigger": "Isolates feature work in its own branch or worktree and integrates it cleanly when done. Use this when starting work that should not disturb the current workspace, when several efforts must proceed in parallel on one repository, or when implementation is finished and the change needs merging, rebasing, or splitting for review.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/branch-and-worktree-workflow/SKILL.md", "sources": 0}, {"name": "chief-technology-officer", "summary": "Owns architecture, engineering delivery, infrastructure, data platform, and internal systems", "trigger": "Owns architecture, engineering delivery, infrastructure, data platform, and internal systems. Use this for build-versus-buy calls, technology selection, architectural direction, engineering capacity and delivery risk, technical debt tradeoffs, platform and tooling decisions, or when a technical choice has business consequences that need stating in business terms. Also use to judge whether a technical plan is sound before it is committed to.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/chief-technology-officer/SKILL.md", "sources": 0}, {"name": "cloud-infrastructure", "summary": "Designs and runs cloud infrastructure — environments, infrastructure as code, networking and isolation, scaling, and cost", "trigger": "Designs and runs cloud infrastructure — environments, infrastructure as code, networking and isolation, scaling, and cost. Use this to design a cloud environment, control infrastructure spend, set up environment separation, plan for scale or region failure, or review infrastructure someone configured by hand.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/cloud-infrastructure/SKILL.md", "sources": 0}, {"name": "code-review", "summary": "Conducts and responds to code review — reviewing a change for correctness, design, and risk, and evaluating review feedback received on your own work", "trigger": "Conducts and responds to code review — reviewing a change for correctness, design, and risk, and evaluating review feedback received on your own work. Use this before merging, when asked to review a diff or pull request, when review feedback has arrived and needs acting on, or when feedback seems wrong and needs a reasoned response rather than compliance.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/code-review/SKILL.md", "sources": 0}, {"name": "completion-verification", "summary": "Verifies that work is actually complete before it is claimed to be — running the checks, reading the output, and confirming the original request was…", "trigger": "Verifies that work is actually complete before it is claimed to be — running the checks, reading the output, and confirming the original request was satisfied rather than approximated. Use this before saying something is done, fixed, or passing; before committing or opening a pull request; and whenever a claim of success has not been backed by command output.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/completion-verification/SKILL.md", "sources": 0}, {"name": "data-migration", "summary": "Moves data from one system to another without losing it or corrupting it — profiling the source before mapping, deciding between big-bang and paralle…", "trigger": "Moves data from one system to another without losing it or corrupting it — profiling the source before mapping, deciding between big-bang and parallel-run cutover, reconciling counts and values rather than assuming, handling the records that will not map cleanly, and planning a rollback that is actually executable. Use this to plan or run a migration, assess a migration plan someone else wrote, work out why a completed migration is producing wrong numbers, or size how long one will really take.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/data-migration/SKILL.md", "sources": 0}, {"name": "implementation-planning", "summary": "Turns a spec or requirement into a written plan a separate session or agent can execute, then drives that plan through review checkpoints", "trigger": "Turns a spec or requirement into a written plan a separate session or agent can execute, then drives that plan through review checkpoints. Use this before touching code on any multi-step task, when work needs handing to someone else, when a task keeps sprawling mid-implementation, or when a plan exists and needs executing in order with verification between steps.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/implementation-planning/SKILL.md", "sources": 0}, {"name": "observability-and-reliability", "summary": "Makes systems debuggable and reliably operable — instrumentation, alerting that is worth waking for, service objectives, and learning from failure", "trigger": "Makes systems debuggable and reliably operable — instrumentation, alerting that is worth waking for, service objectives, and learning from failure. Use this to instrument a service, fix alerting that is ignored, set error budgets or reliability targets, prepare for on-call, or run a blameless post-incident review.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/observability-and-reliability/SKILL.md", "sources": 0}, {"name": "parallel-agent-delivery", "summary": "Splits work across multiple agents or sessions running at once, keeping their surfaces disjoint so results merge cleanly", "trigger": "Splits work across multiple agents or sessions running at once, keeping their surfaces disjoint so results merge cleanly. Use this when facing several independent tasks with no shared state, when a plan has parallelizable steps, when a broad search or audit would be faster fanned out, or when deciding whether work can safely be split at all.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/parallel-agent-delivery/SKILL.md", "sources": 0}, {"name": "prompt-optimizer", "summary": "Turns rough intent or a weak prompt into a reliable one — diagnosing why output is inconsistent, restructuring the instruction, and adapting it acros…", "trigger": "Turns rough intent or a weak prompt into a reliable one — diagnosing why output is inconsistent, restructuring the instruction, and adapting it across models. Use this when a prompt is not producing what was wanted, when output varies run to run, when writing a prompt for a repeated task, when moving a prompt between models, or when someone describes what they want an AI to do and needs it written properly.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/prompt-optimizer/SKILL.md", "sources": 0}, {"name": "release-and-deployment", "summary": "Ships changes safely and often — pipelines, deployment strategies, feature flags, rollback, and database changes", "trigger": "Ships changes safely and often — pipelines, deployment strategies, feature flags, rollback, and database changes. Use this to design a deployment pipeline, reduce release risk, roll out a risky change gradually, plan a schema migration, or work out why releases are infrequent and frightening.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/release-and-deployment/SKILL.md", "sources": 1}, {"name": "skill-authoring", "summary": "Writes and revises agent skills so they trigger at the right moments and give usable instruction when they do", "trigger": "Writes and revises agent skills so they trigger at the right moments and give usable instruction when they do. Use this when creating a new skill, editing an existing one, diagnosing a skill that fires too often or never fires, or reviewing a set of skills for overlap. Also use before adding to a skill library, to check the capability is not already covered.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/skill-authoring/SKILL.md", "sources": 0}, {"name": "solution-architecture", "summary": "Designs system structure and makes architectural decisions defensible — boundaries, coupling, trade-offs, and recording why", "trigger": "Designs system structure and makes architectural decisions defensible — boundaries, coupling, trade-offs, and recording why. Use this to design a new system or major component, choose between architectural options, review an existing design, decide where a boundary belongs, or document an architectural decision so it survives the people who made it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/solution-architecture/SKILL.md", "sources": 0}, {"name": "solution-exploration", "summary": "Explores the problem and the range of possible approaches before any code is written — clarifying what is actually being asked, surfacing options wit…", "trigger": "Explores the problem and the range of possible approaches before any code is written — clarifying what is actually being asked, surfacing options with their tradeoffs, and converging on one. Use this at the start of any feature, component, or behavior change, when a request is ambiguous, when the first idea is the only idea on the table, or when a design decision needs pressure-testing before commitment.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/solution-exploration/SKILL.md", "sources": 0}, {"name": "systematic-debugging", "summary": "Finds the root cause of a bug, test failure, or unexpected behavior before proposing any fix", "trigger": "Finds the root cause of a bug, test failure, or unexpected behavior before proposing any fix. Use this whenever something is broken and the cause is not yet proven — a failing test, a production error, intermittent behavior, or a symptom that appeared after a change. Also use when a fix has been attempted and did not work, or when the same bug keeps coming back.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/systematic-debugging/SKILL.md", "sources": 0}, {"name": "technical-debt-management", "summary": "Makes technical debt visible and decidable — distinguishing real debt from mess, quantifying its cost, and arguing for remediation in business terms", "trigger": "Makes technical debt visible and decidable — distinguishing real debt from mess, quantifying its cost, and arguing for remediation in business terms. Use this to assess and prioritize debt, decide whether to fix or live with something, justify remediation work to non-engineers, or plan a migration off a system nobody wants to touch.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/technical-debt-management/SKILL.md", "sources": 0}, {"name": "test-driven-development", "summary": "Drives implementation by writing a failing test first, then the smallest code that passes it", "trigger": "Drives implementation by writing a failing test first, then the smallest code that passes it. Use this before writing implementation code for any feature or bugfix, when a bug needs a regression test, when existing code is hard to change safely, or when someone asks whether a change is covered. Also use to decide what is worth testing and what is not.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/test-driven-development/SKILL.md", "sources": 0}]}, {"slug": "security", "title": "Security", "exec": "CISO", "glyph": "M12 3.2l7 2.8v5.4c0 4.3-2.9 7.4-7 8.8-4.1-1.4-7-4.5-7-8.8V6z", "reviewer": true, "skills": [{"name": "access-and-identity", "summary": "Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process", "trigger": "Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and machine credentials, or diagnose why permissions have sprawled.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/access-and-identity/SKILL.md", "sources": 1}, {"name": "chief-information-security-officer", "summary": "Owns the security posture of the organization — architecture, program strategy, risk acceptance, incident command, and the authority to stop work tha…", "trigger": "Owns the security posture of the organization — architecture, program strategy, risk acceptance, incident command, and the authority to stop work that creates unacceptable exposure. Use this for a security strategy or program decision, when a technical choice creates security risk that needs a verdict, when deciding whether to accept or block a risk, when standing up a security function, or when security and delivery priorities conflict and someone has to decide.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/chief-information-security-officer/SKILL.md", "sources": 6}, {"name": "data-protection-and-encryption", "summary": "Protects data itself rather than the systems around it — classifying what you hold, encrypting in transit and at rest and understanding what each act…", "trigger": "Protects data itself rather than the systems around it — classifying what you hold, encrypting in transit and at rest and understanding what each actually defends against, managing keys and their rotation, handling secrets in applications and pipelines, minimizing and de-identifying, and deleting on purpose. Use this to design data protection for a system, assess an encryption claim, set up key or secret management, or work out what a stolen backup would actually expose.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/data-protection-and-encryption/SKILL.md", "sources": 0}, {"name": "detection-and-monitoring", "summary": "Builds the capability to notice an attack in progress — deciding what to log and retain, centralizing it somewhere tamper-resistant, writing detectio…", "trigger": "Builds the capability to notice an attack in progress — deciding what to log and retain, centralizing it somewhere tamper-resistant, writing detections that fire on attacker behavior rather than on individual events, tuning out the noise that trains people to ignore alerts, and defining what happens when something fires. Use this to design or assess monitoring coverage, work out why an incident went unnoticed, cut alert volume without losing signal, or decide what a detection capability should cost.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/detection-and-monitoring/SKILL.md", "sources": 0}, {"name": "incident-response", "summary": "Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward", "trigger": "Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Use this when a compromise is suspected or confirmed, when preparing an incident response plan or running an exercise, when deciding whether something is an incident, or when a breach may trigger notification obligations.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/incident-response/SKILL.md", "sources": 2}, {"name": "security-architecture-review", "summary": "Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-deve…", "trigger": "Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it. Use this to review an architecture or pull request for security, set secure coding standards, choose or tune SAST and DAST tooling, assess a third-party integration, or decide whether a design is safe to build.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/security-architecture-review/SKILL.md", "sources": 6}, {"name": "threat-modeling", "summary": "Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and th…", "trigger": "Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handling, payments, or external input, before a security review, or when deciding which security work is worth doing at all.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/threat-modeling/SKILL.md", "sources": 2}, {"name": "vulnerability-management", "summary": "Runs the loop from discovering a weakness to confirming it is fixed — scanning, triage, prioritization by real exploitability, remediation tracking,…", "trigger": "Runs the loop from discovering a weakness to confirming it is fixed — scanning, triage, prioritization by real exploitability, remediation tracking, and patch policy. Use this to stand up or fix a vulnerability program, triage scanner output, decide what to fix first, set patch SLAs, handle a disclosure from an outside researcher, or report posture to leadership.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/vulnerability-management/SKILL.md", "sources": 2}]}, {"slug": "it-operations", "title": "IT Operations", "exec": "CIO", "glyph": "M3.5 5h17v10.5h-17zM9.5 20h5M12 15.5V20", "reviewer": false, "skills": [{"name": "backup-and-recovery", "summary": "Protects and restores data — backup coverage and scope, retention, immutability against ransomware, and proving restores actually work", "trigger": "Protects and restores data — backup coverage and scope, retention, immutability against ransomware, and proving restores actually work. Use this to design a backup regime, verify restores, plan retention, protect backups from ransomware, or recover from data loss.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/backup-and-recovery/SKILL.md", "sources": 0}, {"name": "chief-information-officer", "summary": "The CIO's remit — running the technology the company works on, service quality, IT spend, and the boundary with product engineering", "trigger": "The CIO's remit — running the technology the company works on, service quality, IT spend, and the boundary with product engineering. Use this to set IT priorities, decide what IT owns versus engineering, structure IT spend or an IT roadmap, judge whether to build, buy or outsource, or work out why IT is seen as a cost center rather than an enabler.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/chief-information-officer/SKILL.md", "sources": 0}, {"name": "cloud-administration", "summary": "Administers the cloud the company runs on rather than the one it sells — tenant and subscription structure, the SaaS estate and who owns each app, id…", "trigger": "Administers the cloud the company runs on rather than the one it sells — tenant and subscription structure, the SaaS estate and who owns each app, identity as the real perimeter, cloud spend that arrives as a surprise, and what the provider does not do for you. Use this to structure subscriptions or tenants, get control of sprawling SaaS, cut a cloud bill, work out who owns an application nobody admits to buying, or decide what corporate workloads belong in cloud at all.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/cloud-administration/SKILL.md", "sources": 0}, {"name": "collaboration-platform-administration", "summary": "Administers the email, chat, meeting and file-sharing platform the organization runs on — tenant and domain configuration, mail authentication and ro…", "trigger": "Administers the email, chat, meeting and file-sharing platform the organization runs on — tenant and domain configuration, mail authentication and routing, phishing and spam controls, shared mailboxes and distribution groups, external sharing and guest access, permission sprawl in file storage, and retention and legal hold. Use this to configure a tenant, tighten sharing, investigate a mail delivery or phishing problem, or work out who can see a file and why.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/collaboration-platform-administration/SKILL.md", "sources": 0}, {"name": "endpoint-management", "summary": "Manages laptops, desktops and mobile devices — enrollment, configuration, patching, software distribution, and lost or compromised devices", "trigger": "Manages laptops, desktops and mobile devices — enrollment, configuration, patching, software distribution, and lost or compromised devices. Use this to set up device management, standardize builds, roll out software or an OS upgrade, handle a lost device, or bring an unmanaged fleet under control.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/endpoint-management/SKILL.md", "sources": 0}, {"name": "identity-lifecycle-administration", "summary": "Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning", "trigger": "Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning. Use this to set up or fix joiner-mover-leaver, deprovision someone completely, clean up accumulated access, audit group membership, or find accounts that outlived their owners.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/identity-lifecycle-administration/SKILL.md", "sources": 0}, {"name": "it-asset-management", "summary": "Tracks hardware and software assets through their life — procurement, ownership, licensing, refresh, and disposal", "trigger": "Tracks hardware and software assets through their life — procurement, ownership, licensing, refresh, and disposal. Use this to build an asset register, prepare for a software audit, plan a refresh cycle, control license spend, or dispose of equipment safely.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/it-asset-management/SKILL.md", "sources": 0}, {"name": "network-administration", "summary": "Designs and operates the corporate network — segmentation, remote access, wireless, DNS and addressing, and diagnosing network problems", "trigger": "Designs and operates the corporate network — segmentation, remote access, wireless, DNS and addressing, and diagnosing network problems. Use this to segment a network, set up or fix remote access, diagnose intermittent connectivity, plan addressing or DNS, or assess whether the network's trust assumptions still hold.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/network-administration/SKILL.md", "sources": 0}, {"name": "service-desk", "summary": "Runs the IT service desk — intake, triage, prioritization, escalation, knowledge, and the metrics that improve service rather than distort it", "trigger": "Runs the IT service desk — intake, triage, prioritization, escalation, knowledge, and the metrics that improve service rather than distort it. Use this to set up or fix a service desk, design ticket priority and escalation, reduce repeat contacts, structure a knowledge base, or work out why a desk hitting its targets still frustrates everyone.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/service-desk/SKILL.md", "sources": 0}, {"name": "systems-administration", "summary": "Runs servers and corporate systems — patching, configuration baselines, change control, capacity, and the routine that prevents incidents", "trigger": "Runs servers and corporate systems — patching, configuration baselines, change control, capacity, and the routine that prevents incidents. Use this to establish a patching cadence, standardize server configuration, plan a maintenance window, decide change control for infrastructure, or clean up systems that have drifted from any known state.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/systems-administration/SKILL.md", "sources": 0}, {"name": "telephony-and-conferencing", "summary": "Runs voice and meeting infrastructure — phone systems and numbers, emergency calling obligations, conference rooms and their AV, call recording and i…", "trigger": "Runs voice and meeting infrastructure — phone systems and numbers, emergency calling obligations, conference rooms and their AV, call recording and its retention consequences, and the porting that makes provider changes go badly. Use this to replace a phone system, fix rooms nobody can start a meeting in, meet emergency-calling requirements, port numbers without losing service, or work out why voice quality degrades only sometimes.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/telephony-and-conferencing/SKILL.md", "sources": 0}, {"name": "virtualization-operations", "summary": "Runs the hypervisor layer beneath the servers — host capacity and consolidation ratios, VM sprawl, snapshot discipline, resilience and live migration…", "trigger": "Runs the hypervisor layer beneath the servers — host capacity and consolidation ratios, VM sprawl, snapshot discipline, resilience and live migration, and licensing that counts cores rather than instances. Use this to size or expand a cluster, work out why VMs are slow when the hosts look idle, clean up sprawl, set snapshot and template policy, or decide what stays virtualized and what moves to cloud.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/virtualization-operations/SKILL.md", "sources": 0}]}, {"slug": "product", "title": "Product", "exec": "CPO", "glyph": "M12 3.2l7.6 4.3v8.9L12 20.8l-7.6-4.4V7.5zM4.4 7.5l7.6 4.4 7.6-4.4M12 11.9v8.9", "reviewer": false, "skills": [{"name": "brand-identity", "summary": "Defines and applies visual brand — logo usage, palette, typography, imagery direction, and the guidelines that keep expression consistent across prod…", "trigger": "Defines and applies visual brand — logo usage, palette, typography, imagery direction, and the guidelines that keep expression consistent across product and marketing surfaces. Use this to establish a brand from scratch, audit whether an existing brand is being applied consistently, build brand guidelines, or decide how a brand should express itself in an unfamiliar format.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/brand-identity/SKILL.md", "sources": 0}, {"name": "chief-product-officer", "summary": "Owns what gets built and why: product strategy, roadmap, discovery, user experience, and the definition of success for each release", "trigger": "Owns what gets built and why: product strategy, roadmap, discovery, user experience, and the definition of success for each release. Use this to decide what to build next, to cut scope, to turn a business goal into a product bet, to judge whether a feature is worth its cost, or when engineering and go-to-market disagree about what a release is for. Also use for roadmap sequencing and for killing work that is not earning its place.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/chief-product-officer/SKILL.md", "sources": 0}, {"name": "design-styles", "summary": "Applies a deliberate visual direction to an interface — minimalist editorial, industrial utilitarian, or high-polish commercial — each with its own t…", "trigger": "Applies a deliberate visual direction to an interface — minimalist editorial, industrial utilitarian, or high-polish commercial — each with its own type scale, palette behavior, surface treatment, and motion. Use this when a product needs a point of view rather than defaults, when choosing between visual directions, when an interface reads as generic, or when restyling something without changing its structure.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/design-styles/SKILL.md", "sources": 0}, {"name": "design-system", "summary": "Builds and maintains the design system a product is assembled from — tokens for color, type, spacing and elevation, component contracts, and the rule…", "trigger": "Builds and maintains the design system a product is assembled from — tokens for color, type, spacing and elevation, component contracts, and the rules that keep them coherent as the product grows. Use this when starting a new interface, when screens have drifted apart visually, when the same component exists three times in slightly different forms, or when a token or component needs adding without breaking what exists.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/design-system/SKILL.md", "sources": 0}, {"name": "interface-craft", "summary": "Raises the visual and interaction quality of an interface — layout, hierarchy, type, spacing, density, and the details that separate a considered pro…", "trigger": "Raises the visual and interaction quality of an interface — layout, hierarchy, type, spacing, density, and the details that separate a considered product from a generic one. Use this when a screen works but looks unfinished or default, when a layout feels crowded or arbitrary, when a page has no clear focal point, or when an interface needs to feel trustworthy rather than merely functional.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/interface-craft/SKILL.md", "sources": 0}, {"name": "interface-redesign", "summary": "Upgrades an existing interface to a higher standard without rebuilding it — auditing what is there, identifying what reads as generic or unfinished,…", "trigger": "Upgrades an existing interface to a higher standard without rebuilding it — auditing what is there, identifying what reads as generic or unfinished, and sequencing changes by impact. Use this when a product works but looks dated or default, when a redesign is being considered, when deciding whether to restyle or rebuild, or when a screen needs to look substantially better with limited effort.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/interface-redesign/SKILL.md", "sources": 0}, {"name": "presentation-design", "summary": "Designs slide decks and one-pagers that carry an argument rather than decorate one — deck structure, headlines that state the takeaway, charts that m…", "trigger": "Designs slide decks and one-pagers that carry an argument rather than decorate one — deck structure, headlines that state the takeaway, charts that make a single point, and the different rules board decks and conference talks follow. Use this to build or fix a pitch deck, board deck, or conference talk, to design a one-pager, or when a deck is dense, unfocused, or being read aloud from the slides. For social graphics, carousels and infographics, use `marketing:visual-content` instead.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/presentation-design/SKILL.md", "sources": 0}, {"name": "product-discovery", "summary": "Finds out whether a problem is real and a solution would work, before building it — recruiting the right people, interviewing without leading them, s…", "trigger": "Finds out whether a problem is real and a solution would work, before building it — recruiting the right people, interviewing without leading them, separating what users say from what they do, naming the riskiest assumption and testing that one first, and reaching a decision rather than a summary. Use this to validate a problem, test an idea cheaply, decide whether to build something, or fix a discovery process that keeps confirming what the team already believed.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/product-discovery/SKILL.md", "sources": 0}, {"name": "product-requirements", "summary": "Writes down what is being built so a team can build it and know when they are done — problem and success measure before solution, scope stated by exc…", "trigger": "Writes down what is being built so a team can build it and know when they are done — problem and success measure before solution, scope stated by exclusion, user-visible behavior including the states everyone forgets, acceptance criteria someone can test, and the open questions named rather than buried. Use this to write a specification, review one that is causing rework, or work out why a delivered feature technically matched the request and still was not what anyone wanted.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/product-requirements/SKILL.md", "sources": 0}, {"name": "ux-product-auditor", "summary": "Audits a website, app, onboarding flow, or design for usability, conversion, and product problems, tying every finding to a business outcome and a se…", "trigger": "Audits a website, app, onboarding flow, or design for usability, conversion, and product problems, tying every finding to a business outcome and a severity. Use this to review an interface, diagnose low conversion or activation, find where users drop off, get structured product feedback, or decide which UX fixes to ship first. For raising visual quality rather than finding problems, use `interface-craft`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/ux-product-auditor/SKILL.md", "sources": 0}, {"name": "visual-reference-generation", "summary": "Produces design reference imagery before implementation — screen concepts, layout directions, and flows for web or mobile that make a verbal brief co…", "trigger": "Produces design reference imagery before implementation — screen concepts, layout directions, and flows for web or mobile that make a verbal brief concrete enough to argue with. Use this when a brief needs visualizing before anyone builds, when comparing layout directions, when handing a developer a target, or when stakeholders are describing different things with the same words.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/visual-reference-generation/SKILL.md", "sources": 0}]}, {"slug": "marketing", "title": "Marketing", "exec": "CMO", "glyph": "M4 10v4h3l7 4V6l-7 4H4zM17.5 9.2a4 4 0 0 1 0 5.6", "reviewer": false, "skills": [{"name": "behavioral-marketing", "summary": "Applies decision science and cognitive bias research to marketing and product decisions — how people actually choose under uncertainty, and how frami…", "trigger": "Applies decision science and cognitive bias research to marketing and product decisions — how people actually choose under uncertainty, and how framing, defaults, sequencing, and social context change behavior. Use this to diagnose why a well-argued offer is not converting, to structure choices and pricing presentation, to design an experience around how attention and memory work, or to pressure-test whether a persuasion tactic is legitimate or manipulative.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/behavioral-marketing/SKILL.md", "sources": 0}, {"name": "brand-voice", "summary": "Captures how a person or brand actually writes and turns it into reusable voice instructions every other content skill draws from", "trigger": "Captures how a person or brand actually writes and turns it into reusable voice instructions every other content skill draws from. Use this before drafting any content for a new brand or client, when output keeps coming back sounding generic, when several writers need to sound like one, or when a voice needs defining without existing samples to learn from.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/brand-voice/SKILL.md", "sources": 0}, {"name": "chief-content-officer", "summary": "Runs content as an operation — the production pipeline, editorial calendar, repurposing engine, competitive content intelligence, and audits of what…", "trigger": "Runs content as an operation — the production pipeline, editorial calendar, repurposing engine, competitive content intelligence, and audits of what already exists. Use this to build or fix a content production system, plan a calendar, decide how one piece becomes many, rank content ideas by expected impact, or audit an existing library for what to update, consolidate, or retire. For deciding what territory to own and why, use `content-strategy` first.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/chief-content-officer/SKILL.md", "sources": 0}, {"name": "chief-marketing-officer", "summary": "Owns brand, demand generation, content, communications, and how the market understands what the business does", "trigger": "Owns brand, demand generation, content, communications, and how the market understands what the business does. Use this to set marketing strategy, allocate budget across channels, decide positioning and messaging, judge whether a campaign is worth running, diagnose why demand has stalled, or arbitrate between brand-building and short-term acquisition. Also use to decide which marketing work to stop.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/chief-marketing-officer/SKILL.md", "sources": 0}, {"name": "content-strategy", "summary": "Decides what content to make and why — topic territory, format mix, cadence, and how content connects to a business outcome rather than to traffic", "trigger": "Decides what content to make and why — topic territory, format mix, cadence, and how content connects to a business outcome rather than to traffic. Use this to plan a content program, choose topics, build an editorial calendar, decide which formats and platforms to commit to, or diagnose why content is producing audience but not results.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/content-strategy/SKILL.md", "sources": 0}, {"name": "customer-research", "summary": "Plans, runs, and synthesizes customer research — interviews, surveys, win-loss analysis, and message testing — into findings that change decisions", "trigger": "Plans, runs, and synthesizes customer research — interviews, surveys, win-loss analysis, and message testing — into findings that change decisions. Use this when the customer is being guessed at, before positioning or a major launch, when churn or conversion has an unexplained cause, or when a team is arguing from anecdotes. Also use to turn raw interview notes into usable findings.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/customer-research/SKILL.md", "sources": 0}, {"name": "events-and-field-marketing", "summary": "Plans and runs events that produce pipeline — conferences, trade shows, webinars, field programs, and measuring whether any of it worked", "trigger": "Plans and runs events that produce pipeline — conferences, trade shows, webinars, field programs, and measuring whether any of it worked. Use this to decide whether to sponsor an event, plan a conference presence or webinar, design a field program, or work out why event spend is not producing pipeline.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/events-and-field-marketing/SKILL.md", "sources": 0}, {"name": "marketing-campaign-planner", "summary": "Designs a coordinated multi-channel campaign or product launch around one story — objective, message, channel sequencing, timeline, assets, and the c…", "trigger": "Designs a coordinated multi-channel campaign or product launch around one story — objective, message, channel sequencing, timeline, assets, and the checklist that gets it out the door. Use this to plan a launch or campaign, sequence a go-to-market push, pressure-test a campaign before committing budget, or turn a product change into a coordinated set of activity. For ongoing channel programs rather than a bounded push, use `marketing-planning`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/marketing-campaign-planner/SKILL.md", "sources": 0}, {"name": "marketing-copywriting", "summary": "Writes and edits marketing copy for any surface — homepage, product and pricing pages, ads, emails, and collateral — and sharpens existing copy that…", "trigger": "Writes and edits marketing copy for any surface — homepage, product and pricing pages, ads, emails, and collateral — and sharpens existing copy that is not working. Use this to write or rewrite page copy, tighten a draft, fix copy that is vague or feature-led, adapt one message across formats, or review copy before it ships.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/marketing-copywriting/SKILL.md", "sources": 0}, {"name": "marketing-planning", "summary": "Builds the marketing plan of record — objectives, channel mix, budget allocation, sequencing, and the measurement that says whether it worked", "trigger": "Builds the marketing plan of record — objectives, channel mix, budget allocation, sequencing, and the measurement that says whether it worked. Use this for annual or quarterly planning, when budget must be allocated or defended, when marketing activity feels busy but undirected, or when a plan needs pressure-testing before commitment.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/marketing-planning/SKILL.md", "sources": 0}, {"name": "newsletter-writer", "summary": "Writes and edits newsletters and marketing emails people actually open — subject lines, opening, structure, voice, and the conversion turn where ther…", "trigger": "Writes and edits newsletters and marketing emails people actually open — subject lines, opening, structure, voice, and the conversion turn where there is one. Use this to draft or rewrite a newsletter or email, sharpen weak email copy, plan a newsletter's structure and cadence, write a sequence, or repurpose an issue into other formats. For automated lifecycle and SMS programs, use `lifecycle-messaging`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/newsletter-writer/SKILL.md", "sources": 0}, {"name": "partnership-marketing", "summary": "Builds reach through other people's audiences — co-marketing partnerships, creator and influencer programs, and community building", "trigger": "Builds reach through other people's audiences — co-marketing partnerships, creator and influencer programs, and community building. Use this to find and evaluate partners, structure a joint campaign or creator deal, plan a community strategy, or decide whether a partnership is worth the coordination cost.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/partnership-marketing/SKILL.md", "sources": 0}, {"name": "positioning-and-messaging", "summary": "Establishes what a product is understood to be, for whom, and instead of what — then turns that into the messaging every other surface inherits", "trigger": "Establishes what a product is understood to be, for whom, and instead of what — then turns that into the messaging every other surface inherits. Use this when messaging is inconsistent across channels, when prospects misunderstand what the product does, when entering a new segment, when competitors are being compared against you unfavorably, or before any campaign, launch, or site rewrite.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/positioning-and-messaging/SKILL.md", "sources": 0}, {"name": "product-launch", "summary": "Takes something built and gets it into the market — tiering the launch to match what it actually warrants, sequencing internal readiness before exter…", "trigger": "Takes something built and gets it into the market — tiering the launch to match what it actually warrants, sequencing internal readiness before external announcement, preparing sales and support to answer the questions it creates, choosing the date for a reason, and measuring adoption rather than announcement reach. Use this to plan a launch, right-size one that is consuming more than it deserves, work out why a released feature nobody uses was launched loudly, or run the weeks after launch day.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/product-launch/SKILL.md", "sources": 0}, {"name": "public-relations", "summary": "Plans and executes earned media — press strategy, journalist outreach, announcements, commentary, and crisis response", "trigger": "Plans and executes earned media — press strategy, journalist outreach, announcements, commentary, and crisis response. Use this to plan a press push, write a pitch or release, find and approach the right journalists, prepare for an interview, decide whether something is newsworthy, or respond to a story going badly.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/public-relations/SKILL.md", "sources": 0}, {"name": "social-post-craft", "summary": "Writes, structures, and evaluates social posts end to end — hooks, body, formatting for how each platform renders, and a quality check before publish…", "trigger": "Writes, structures, and evaluates social posts end to end — hooks, body, formatting for how each platform renders, and a quality check before publishing. Use this to draft a post, rewrite one that underperformed, turn a longer piece into social content, sharpen an opening, or judge whether a draft is worth publishing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/social-post-craft/SKILL.md", "sources": 0}, {"name": "video-content", "summary": "Plans and scripts short-form and long-form video, and designs the packaging — titles, thumbnails, and openings — that determines whether it gets watc…", "trigger": "Plans and scripts short-form and long-form video, and designs the packaging — titles, thumbnails, and openings — that determines whether it gets watched. Use this to script a video, plan a series, fix retention or click-through problems, design thumbnail and title concepts, or turn written content into video. For a YouTube channel specifically — idea selection, retention teardowns, and channel-level strategy — use `youtube-producer`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/video-content/SKILL.md", "sources": 0}, {"name": "visual-content", "summary": "Designs and directs the visual assets that carry content — carousels, infographics, quote graphics, diagrams, and social imagery — including the gene…", "trigger": "Designs and directs the visual assets that carry content — carousels, infographics, quote graphics, diagrams, and social imagery — including the generation prompts where they are AI-produced. Use this to turn a written piece into a visual format, design a carousel or infographic, create social graphics, or fix visuals that are not stopping the scroll.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/visual-content/SKILL.md", "sources": 0}, {"name": "youtube-producer", "summary": "Plans, packages, and scripts long-form video for retention and channel growth — idea selection, titles and thumbnails, script structure, and diagnosi…", "trigger": "Plans, packages, and scripts long-form video for retention and channel growth — idea selection, titles and thumbnails, script structure, and diagnosing why a video or channel underperforms. Use this for video ideas, packaging, scripting, a retention teardown, or channel strategy — including when someone describes a topic and wants it turned into something publishable. For short-form and cross-platform video, use `video-content`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/youtube-producer/SKILL.md", "sources": 0}]}, {"slug": "demand-generation", "title": "Demand Generation", "exec": "CMO", "glyph": "M4 4.5h16l-6.2 7.2V19l-3.6 1.8v-9.1z", "reviewer": false, "skills": [{"name": "account-based-marketing", "summary": "Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, b…", "trigger": "Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group inside each, tiering effort against account value, coordinating so the account experiences one campaign rather than several, and measuring account progression instead of leads. Use this to decide whether to run an account-based program, build one, or work out why an existing one produces activity and no pipeline.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/account-based-marketing/SKILL.md", "sources": 0}, {"name": "ai-search-optimization", "summary": "Optimizes for AI assistants and AI-generated answers — being retrievable, being cited, and being represented accurately when a model answers on your…", "trigger": "Optimizes for AI assistants and AI-generated answers — being retrievable, being cited, and being represented accurately when a model answers on your behalf. Use this when traffic is shifting from links to AI answers, when a brand is misrepresented or absent in AI responses, when planning content for retrieval rather than ranking, or when deciding how AI search changes an existing SEO program.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/ai-search-optimization/SKILL.md", "sources": 0}, {"name": "app-store-optimization", "summary": "Improves visibility and conversion in the App Store and Google Play — metadata, keywords, screenshots, ratings, and the listing experience that turns…", "trigger": "Improves visibility and conversion in the App Store and Google Play — metadata, keywords, screenshots, ratings, and the listing experience that turns an impression into an install. Use this to audit or optimize an app listing, plan a launch listing, diagnose poor install conversion, or improve store search visibility.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/app-store-optimization/SKILL.md", "sources": 0}, {"name": "experimentation", "summary": "Designs, runs, and reads A/B tests and growth experiments — hypothesis, sample size, duration, and honest interpretation", "trigger": "Designs, runs, and reads A/B tests and growth experiments — hypothesis, sample size, duration, and honest interpretation. Use this to plan a test, judge whether a result is real, build an experimentation program, decide what to test next, or diagnose why tests keep producing inconclusive or non-replicating results.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/experimentation/SKILL.md", "sources": 0}, {"name": "landing-page-cro-expert", "summary": "Audits and rewrites landing pages, homepages, and sales pages to increase conversion — diagnosing why a page is not converting, rewriting headlines,…", "trigger": "Audits and rewrites landing pages, homepages, and sales pages to increase conversion — diagnosing why a page is not converting, rewriting headlines, hero copy and calls to action, and prioritizing which changes to test first. Use this when a page underperforms, when someone pastes a URL or screenshot asking what is wrong, when writing a new page, or when deciding which conversion changes are worth testing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/landing-page-cro-expert/SKILL.md", "sources": 0}, {"name": "lead-capture", "summary": "Converts anonymous traffic into known contacts — lead magnets, gated content, free tools, popups, and the forms behind them", "trigger": "Converts anonymous traffic into known contacts — lead magnets, gated content, free tools, popups, and the forms behind them. Use this to design or improve a lead magnet, plan a free tool, add or fix popups and overlays, improve form conversion, or decide what is worth gating and what should stay open.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/lead-capture/SKILL.md", "sources": 0}, {"name": "lifecycle-messaging", "summary": "Designs automated email and SMS programs — welcome and onboarding sequences, nurture, re-engagement, transactional messaging, and the timing and segm…", "trigger": "Designs automated email and SMS programs — welcome and onboarding sequences, nurture, re-engagement, transactional messaging, and the timing and segmentation behind them. Use this to build or fix an email sequence, plan lifecycle automation, improve open or click performance, set up SMS flows, or decide what messages a customer should receive and when.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/lifecycle-messaging/SKILL.md", "sources": 0}, {"name": "listing-distribution", "summary": "Gets a product listed where buyers and crawlers look — directories, marketplaces, review sites, comparison pages, and aggregators", "trigger": "Gets a product listed where buyers and crawlers look — directories, marketplaces, review sites, comparison pages, and aggregators. Use this to plan a submission push, choose which directories are worth the effort, prepare listing assets, build comparison and alternative pages, or manage presence on review platforms.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/listing-distribution/SKILL.md", "sources": 0}, {"name": "marketing-analytics", "summary": "Sets up, audits, and reports on marketing measurement — tracking plans, event schemas, attribution models, and the dashboards built on them", "trigger": "Sets up, audits, and reports on marketing measurement — tracking plans, event schemas, attribution models, and the dashboards built on them. Use this to instrument a site or product, audit tracking nobody trusts, choose or interpret an attribution model, build reporting that answers a specific question, or reconcile numbers that disagree between tools.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/marketing-analytics/SKILL.md", "sources": 0}, {"name": "paid-advertising", "summary": "Plans, runs, and optimizes paid acquisition across search, social, and display — account structure, targeting, creative, bidding, budget, and the ana…", "trigger": "Plans, runs, and optimizes paid acquisition across search, social, and display — account structure, targeting, creative, bidding, budget, and the analysis that says whether to scale or stop. Use this to set up or restructure campaigns, write and iterate ad creative, diagnose rising costs or falling performance, decide budget allocation, or judge whether a channel is working.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/paid-advertising/SKILL.md", "sources": 0}, {"name": "programmatic-seo", "summary": "Builds large sets of search-targeted pages from a template and a dataset — the location, comparison, integration, and use-case pages that capture lon…", "trigger": "Builds large sets of search-targeted pages from a template and a dataset — the location, comparison, integration, and use-case pages that capture long-tail demand at scale. Use this when there is a repeating query pattern with real volume, when a dataset could answer many similar searches, or to judge whether a programmatic approach is viable before building it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/programmatic-seo/SKILL.md", "sources": 0}, {"name": "seo-strategy", "summary": "Audits and improves organic search performance — technical health, site architecture, internal linking, structured data, and the content decisions th…", "trigger": "Audits and improves organic search performance — technical health, site architecture, internal linking, structured data, and the content decisions that determine what can rank. Use this to run an SEO audit, diagnose why pages are not ranking or were deindexed, plan a site's URL and navigation structure, add structured data, or prioritize which SEO fixes are worth doing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/seo-strategy/SKILL.md", "sources": 0}]}, {"slug": "revenue", "title": "Revenue", "exec": "CRO", "glyph": "M4 17.5l5.2-5.2 3.4 3.4L20 8.2M14.8 8.2H20v5.2", "reviewer": false, "skills": [{"name": "activation", "summary": "Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone bec…", "trigger": "Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account. Use this to design or fix signup and onboarding, diagnose why signups do not convert to active use, reduce time-to-value, or decide what a new user must accomplish first.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/activation/SKILL.md", "sources": 0}, {"name": "chief-revenue-officer", "summary": "Owns the revenue engine end to end: sales, monetization, pricing, customer success, retention, and partnerships", "trigger": "Owns the revenue engine end to end: sales, monetization, pricing, customer success, retention, and partnerships. Use this for pricing and packaging decisions, sales strategy and coverage, forecast and pipeline health, churn and expansion, partner and channel strategy, or when marketing-sourced demand is not converting. Also use to decide which segments to pursue and which to decline.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/chief-revenue-officer/SKILL.md", "sources": 0}, {"name": "deal-negotiation", "summary": "Negotiates a commercial deal without giving away the terms that matter — preparing your walk-away and theirs, trading concessions rather than concedi…", "trigger": "Negotiates a commercial deal without giving away the terms that matter — preparing your walk-away and theirs, trading concessions rather than conceding them, recognizing the tactics that create false urgency, protecting price by moving other variables, and closing on terms someone can actually deliver. Use this to prepare for a negotiation, respond to a demand mid-deal, work out why discounts keep landing at quarter end, or review terms before they are signed.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/deal-negotiation/SKILL.md", "sources": 0}, {"name": "outbound-prospecting", "summary": "Finds, qualifies, and reaches prospects through cold outreach — list building, qualification criteria, cold email and multi-channel sequences, and th…", "trigger": "Finds, qualifies, and reaches prospects through cold outreach — list building, qualification criteria, cold email and multi-channel sequences, and the follow-up that actually gets replies. Use this to build a prospect list, write cold outreach, fix a sequence that is not getting responses, define qualification criteria, or decide whether a segment is worth pursuing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/outbound-prospecting/SKILL.md", "sources": 0}, {"name": "pricing-and-packaging", "summary": "Sets price, structures packages and tiers, and designs the monetization surfaces that carry them — upgrade paths, paywalls, and offer construction", "trigger": "Sets price, structures packages and tiers, and designs the monetization surfaces that carry them — upgrade paths, paywalls, and offer construction. Use this to set or change pricing, design or restructure tiers, choose a pricing metric, build an offer, design upgrade prompts and paywalls, or evaluate whether a pricing change is safe to make.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/pricing-and-packaging/SKILL.md", "sources": 0}, {"name": "referral-programs", "summary": "Designs and improves referral, affiliate, and word-of-mouth programs — incentive structure, mechanics, timing, and fraud control", "trigger": "Designs and improves referral, affiliate, and word-of-mouth programs — incentive structure, mechanics, timing, and fraud control. Use this to build a referral or affiliate program, diagnose one that is not producing, decide what incentive to offer, or judge whether referral is a realistic channel for a product.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/referral-programs/SKILL.md", "sources": 0}, {"name": "retention", "summary": "Diagnoses and reduces churn — cancellation flows, save offers, failed-payment recovery, at-risk detection, and the product and service causes underne…", "trigger": "Diagnoses and reduces churn — cancellation flows, save offers, failed-payment recovery, at-risk detection, and the product and service causes underneath. Use this when churn is rising or unexplained, to design a cancellation or win-back flow, to recover involuntary churn, to identify at-risk accounts before they leave, or to decide whether a retention problem is a product problem.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/retention/SKILL.md", "sources": 0}, {"name": "revenue-operations", "summary": "Runs the mechanics of the revenue engine — lead lifecycle definitions, routing, CRM hygiene, forecasting process, pipeline reporting, and the marketi…", "trigger": "Runs the mechanics of the revenue engine — lead lifecycle definitions, routing, CRM hygiene, forecasting process, pipeline reporting, and the marketing-to-sales handoff. Use this to fix a broken handoff, define lifecycle stages, improve forecast accuracy, clean up CRM data, design territory or routing rules, or diagnose why pipeline numbers are not trusted.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/revenue-operations/SKILL.md", "sources": 0}, {"name": "sales-compensation-and-territory", "summary": "Designs quotas, territories and commission plans that produce the behavior the business needs — sizing territories against real potential, setting qu…", "trigger": "Designs quotas, territories and commission plans that produce the behavior the business needs — sizing territories against real potential, setting quotas people can hit often enough to believe in, choosing what to pay on, handling accelerators, draws, clawbacks and disputes, and changing a plan without destroying trust. Use this to build or fix a comp plan, allocate territories, work out why reps are chasing the wrong deals, or plan a mid-year change.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/sales-compensation-and-territory/SKILL.md", "sources": 0}, {"name": "sales-enablement", "summary": "Builds what a sales team needs to sell — pitch decks, one-pagers, objection handling, competitive battlecards, demo scripts, and case studies", "trigger": "Builds what a sales team needs to sell — pitch decks, one-pagers, objection handling, competitive battlecards, demo scripts, and case studies. Use this to create or fix sales collateral, prepare for a competitive deal, build a demo flow, document objection responses, or diagnose why a pitch is not converting.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/sales-enablement/SKILL.md", "sources": 0}]}, {"slug": "finance", "title": "Finance", "exec": "CFO", "glyph": "M12 12m-8 0a8 8 0 1 0 16 0a8 8 0 1 0-16 0M12 7v10M14.6 9.4c0-1-1.2-1.7-2.6-1.7s-2.6.7-2.6 1.7 1.2 1.7 2.6 1.7 2.6.8 2.6 1.8-1.2 1.7-2.6 1.7-2.6-.7-2.6-1.7", "reviewer": false, "skills": [{"name": "budgeting-and-forecasting", "summary": "Runs the planning cycle — annual budget, rolling forecast, consolidation of business unit inputs, and the variance analysis that explains actuals aga…", "trigger": "Runs the planning cycle — annual budget, rolling forecast, consolidation of business unit inputs, and the variance analysis that explains actuals against plan. Use this to build or challenge a budget, run a forecast cycle, consolidate departmental submissions, explain why results diverged from plan, or improve forecast accuracy.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/budgeting-and-forecasting/SKILL.md", "sources": 1}, {"name": "capital-allocation", "summary": "Evaluates where to spend limited capital — investment appraisal, hurdle rates, payback, and comparing proposals that are not alike", "trigger": "Evaluates where to spend limited capital — investment appraisal, hurdle rates, payback, and comparing proposals that are not alike. Use this to evaluate an investment or major purchase, compare competing funding requests, set a hurdle rate, decide between building and buying, or review whether past investments delivered what was claimed.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/capital-allocation/SKILL.md", "sources": 1}, {"name": "capital-structure-and-covenants", "summary": "Decides how the business is financed and what that financing then requires of it — debt versus equity, weighted average cost of capital as a hurdle r…", "trigger": "Decides how the business is financed and what that financing then requires of it — debt versus equity, weighted average cost of capital as a hurdle rate, how much leverage cash flow can carry, and the financial, affirmative and negative covenants, definitions, test dates and cure rights that come attached. Use this to evaluate a financing option, set an investment hurdle, check whether a planned decision will trip a covenant, or work out what a lender can do when one breaks.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/capital-structure-and-covenants/SKILL.md", "sources": 0}, {"name": "chief-financial-officer", "summary": "Owns the financial position: planning, budgeting, forecasting, unit economics, cash, and the numbers the business is run and reported on", "trigger": "Owns the financial position: planning, budgeting, forecasting, unit economics, cash, and the numbers the business is run and reported on. Use this to build or challenge a budget, model a decision's financial consequence, assess unit economics or runway, evaluate an investment or spend request, set financial controls, or when a plan's numbers do not reconcile. Also use to decide whether the business can afford something.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/chief-financial-officer/SKILL.md", "sources": 2}, {"name": "cost-accounting", "summary": "Establishes what something actually costs — fixed, variable and mixed cost behavior, absorption versus variable costing, job-order, process and activ…", "trigger": "Establishes what something actually costs — fixed, variable and mixed cost behavior, absorption versus variable costing, job-order, process and activity-based methods, breakeven and operating leverage, and price/volume/mix decomposition. Use this to set a price floor, explain why revenue or margin moved, decide make versus buy, judge whether a product line earns its place, or work out how an allocation basis is distorting a reported margin.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/cost-accounting/SKILL.md", "sources": 0}, {"name": "financial-modeling", "summary": "Builds and stress-tests financial models for forecasting, scenario planning, and decision support — revenue build, cost structure, driver logic, and…", "trigger": "Builds and stress-tests financial models for forecasting, scenario planning, and decision support — revenue build, cost structure, driver logic, and the sensitivities that show where a plan breaks. Use this to model a decision's financial consequence, build a forecast or long-range plan, evaluate an investment or hire, or pressure-test someone else's model before relying on it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/financial-modeling/SKILL.md", "sources": 2}, {"name": "financial-reporting-and-close", "summary": "Runs the period-end close and produces reporting — close calendar, reconciliations, accruals, variance analysis, and reporting that gets read", "trigger": "Runs the period-end close and produces reporting — close calendar, reconciliations, accruals, variance analysis, and reporting that gets read. Use this to shorten or stabilize a monthly close, design a close checklist, investigate a variance, structure management reporting, or work out why the numbers keep changing after close.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/financial-reporting-and-close/SKILL.md", "sources": 3}, {"name": "financial-statement-analysis", "summary": "Reads a set of financial statements and establishes what changed and why — fluctuation analysis against prior period and against budget, profitabilit…", "trigger": "Reads a set of financial statements and establishes what changed and why — fluctuation analysis against prior period and against budget, profitability, liquidity, solvency and efficiency ratios, benchmarking, and the non-GAAP measures presented alongside them. Use this to interpret results, review a counterparty's or target's financials, diagnose a deteriorating trend, explain a variance to someone who will act on it, or test whether an adjusted number is honest.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/financial-statement-analysis/SKILL.md", "sources": 1}, {"name": "internal-controls-and-audit", "summary": "Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit", "trigger": "Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit. Use this to design controls for a process, prepare for an external audit, respond to an audit finding, set approval thresholds, or assess where a small team's segregation of duties is genuinely broken.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/internal-controls-and-audit/SKILL.md", "sources": 2}, {"name": "revenue-recognition", "summary": "Determines when and how revenue is recognized — performance obligations, contract terms that change the answer, and the deal structures that create a…", "trigger": "Determines when and how revenue is recognized — performance obligations, contract terms that change the answer, and the deal structures that create accounting problems. Use this to work out how a contract should be recognized, review a non-standard deal before it is signed, understand deferred revenue, or spot terms that would delay or reverse recognition.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/revenue-recognition/SKILL.md", "sources": 2}, {"name": "tax", "summary": "Structures the tax questions a growing business faces — corporate income, sales and use, payroll, nexus, and the obligations created by hiring or sel…", "trigger": "Structures the tax questions a growing business faces — corporate income, sales and use, payroll, nexus, and the obligations created by hiring or selling somewhere new. Use this to work out what a new state or country obligates you to, prepare for a tax filing or audit, understand sales tax on your product, or check what a remote hire or new market triggers.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/tax/SKILL.md", "sources": 4}, {"name": "treasury-and-liquidity", "summary": "Manages cash and liquidity — cash forecasting, runway, working capital, banking structure, and currency and counterparty exposure", "trigger": "Manages cash and liquidity — cash forecasting, runway, working capital, banking structure, and currency and counterparty exposure. Use this to build a cash forecast, extend runway, improve working capital, decide where cash should sit, or assess exposure to a bank, currency, or customer concentration.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/treasury-and-liquidity/SKILL.md", "sources": 3}, {"name": "unit-economics", "summary": "Establishes whether the business makes money on each customer or unit — contribution margin, acquisition cost, payback period, lifetime value, and th…", "trigger": "Establishes whether the business makes money on each customer or unit — contribution margin, acquisition cost, payback period, lifetime value, and the cohort behavior underneath. Use this to assess whether growth is profitable, evaluate a channel or segment, support a pricing decision, judge how fast the business can afford to grow, or diagnose why revenue growth is not producing profit.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/unit-economics/SKILL.md", "sources": 0}]}, {"slug": "operations", "title": "Operations", "exec": "COO", "glyph": "M4.2 12a7.8 7.8 0 0 1 13.3-5.5M19.8 12a7.8 7.8 0 0 1-13.3 5.5M18 3.4v3.6h-3.6M6 20.6V17h3.6", "reviewer": false, "skills": [{"name": "business-continuity-and-resilience", "summary": "Plans for operating through disruption — impact analysis, recovery objectives, continuity plans, and the exercises that prove they work", "trigger": "Plans for operating through disruption — impact analysis, recovery objectives, continuity plans, and the exercises that prove they work. Use this to run a business impact analysis, set RTO and RPO, write or test a continuity plan, prepare for a supplier or site failure, or answer a customer's resilience questionnaire.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/business-continuity-and-resilience/SKILL.md", "sources": 1}, {"name": "capacity-and-demand-planning", "summary": "Matches operational capacity to expected demand — forecasting load, sizing teams and systems, managing queues, and deciding when to add capacity", "trigger": "Matches operational capacity to expected demand — forecasting load, sizing teams and systems, managing queues, and deciding when to add capacity. Use this to plan staffing for expected volume, diagnose a queue that keeps growing, size support or fulfillment capacity, or decide whether a bottleneck needs more capacity or better flow.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/capacity-and-demand-planning/SKILL.md", "sources": 0}, {"name": "chief-operating-officer", "summary": "Owns execution: how work actually gets done across the organization, including process, program management, capacity, vendors, supply chain, and serv…", "trigger": "Owns execution: how work actually gets done across the organization, including process, program management, capacity, vendors, supply chain, and service delivery. Use this when execution is the problem rather than strategy, to design or fix a process, to resolve cross-functional handoff failures, to plan capacity, to assess delivery risk, or when the same failure keeps recurring. Also use to decide whether to build, hire, or outsource a capability.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/chief-operating-officer/SKILL.md", "sources": 0}, {"name": "facilities-and-workplace", "summary": "Runs the physical and hybrid workplace — space planning, leases, health and safety, office services, and the operational side of where people work", "trigger": "Runs the physical and hybrid workplace — space planning, leases, health and safety, office services, and the operational side of where people work. Use this to plan space, evaluate a lease or office move, set up a hybrid workplace, handle facilities incidents, or decide what office services are worth funding.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/facilities-and-workplace/SKILL.md", "sources": 0}, {"name": "incident-management", "summary": "Runs an operational incident from detection to closed action — declaring it and naming a commander, separating the people restoring service from the…", "trigger": "Runs an operational incident from detection to closed action — declaring it and naming a commander, separating the people restoring service from the people communicating, keeping a timeline as it happens, deciding when it is over, and running a review that produces a small number of changes someone actually completes. Use this to set up an incident process, run one, work out why the same failure keeps recurring, or fix a review practice that generates findings nobody closes.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/incident-management/SKILL.md", "sources": 0}, {"name": "operating-cadence", "summary": "Designs the rhythm an organization runs on — which reviews happen weekly, monthly and quarterly, what each one decides, who owns the numbers presente…", "trigger": "Designs the rhythm an organization runs on — which reviews happen weekly, monthly and quarterly, what each one decides, who owns the numbers presented, and how a signal at the front line reaches the people who can act on it. Use this to set up a management operating system, fix a meeting calendar that produces no decisions, work out where a recurring problem keeps failing to surface, or cut a review structure that has grown past what it informs.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/operating-cadence/SKILL.md", "sources": 0}, {"name": "process-design", "summary": "Designs, documents, and fixes operational processes — mapping the current state, finding where work actually stalls, redesigning the flow, and buildi…", "trigger": "Designs, documents, and fixes operational processes — mapping the current state, finding where work actually stalls, redesigning the flow, and building controls that hold. Use this when the same failure keeps recurring, when a handoff between teams is unreliable, when onboarding a repeated task, when work takes far longer than the work itself, or when deciding whether to automate, standardize, or eliminate a process.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/process-design/SKILL.md", "sources": 0}, {"name": "procurement-and-sourcing", "summary": "Buys well — specifying need, running competitive sourcing, negotiating, and category strategy before a contract exists", "trigger": "Buys well — specifying need, running competitive sourcing, negotiating, and category strategy before a contract exists. Use this to run an RFP or vendor selection, negotiate a purchase, consolidate spend across a category, decide between single and multiple suppliers, or bring uncontrolled spending under management.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/procurement-and-sourcing/SKILL.md", "sources": 0}, {"name": "quality-management", "summary": "Builds quality into operations — defining standards, catching defects at the right point, root cause analysis, and continuous improvement", "trigger": "Builds quality into operations — defining standards, catching defects at the right point, root cause analysis, and continuous improvement. Use this to reduce a defect or error rate, design quality controls into a process, run a root cause analysis, respond to a customer quality complaint, or set up quality metrics that drive behavior.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/quality-management/SKILL.md", "sources": 0}, {"name": "service-level-management", "summary": "Defines and manages service levels — setting targets that reflect what customers need, measuring honestly, and handling breaches", "trigger": "Defines and manages service levels — setting targets that reflect what customers need, measuring honestly, and handling breaches. Use this to write or negotiate an SLA, decide what to measure and at what threshold, respond to a missed service level, or work out why a service that meets its targets still has unhappy customers.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/service-level-management/SKILL.md", "sources": 0}, {"name": "supply-chain-and-logistics", "summary": "Manages the flow of goods and inputs — sourcing, inventory, lead times, fulfillment, and supply risk", "trigger": "Manages the flow of goods and inputs — sourcing, inventory, lead times, fulfillment, and supply risk. Use this to reduce stockouts or excess inventory, plan for a supplier failure, decide reorder points and safety stock, improve fulfillment reliability, or assess concentration risk in a supply base.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/supply-chain-and-logistics/SKILL.md", "sources": 0}, {"name": "vendor-management", "summary": "Selects, contracts, and manages suppliers and vendors — requirements, evaluation, negotiation support, onboarding, performance management, and exit", "trigger": "Selects, contracts, and manages suppliers and vendors — requirements, evaluation, negotiation support, onboarding, performance management, and exit. Use this to choose a vendor, run a selection process, structure a service agreement's operational terms, manage an underperforming supplier, plan an exit or migration, or assess concentration and continuity risk.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/vendor-management/SKILL.md", "sources": 0}]}, {"slug": "pmo", "title": "Program Management Office", "exec": "EPMO / COO", "glyph": "M4 7h9M7.5 12h11M4 17h7", "reviewer": false, "skills": [{"name": "benefits-realization", "summary": "Ensures projects deliver the value they were approved on — defining measurable benefits, baselining, tracking after delivery, and honest post-impleme…", "trigger": "Ensures projects deliver the value they were approved on — defining measurable benefits, baselining, tracking after delivery, and honest post-implementation review. Use this to define benefits for a business case, set a baseline, track whether value actually landed, or run a post-implementation review that produces something useful.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/benefits-realization/SKILL.md", "sources": 0}, {"name": "change-and-adoption", "summary": "Gets people to actually use what was delivered — stakeholder analysis, communication, training, resistance, and measuring adoption", "trigger": "Gets people to actually use what was delivered — stakeholder analysis, communication, training, resistance, and measuring adoption. Use this to plan a rollout, recover an implementation nobody is using, handle resistance to a change, sequence communications, or work out why a technically successful project changed nothing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/change-and-adoption/SKILL.md", "sources": 0}, {"name": "dependency-and-risk-management", "summary": "Manages delivery risk and cross-team dependencies — identifying, sizing, mitigating and escalating what could stop the work", "trigger": "Manages delivery risk and cross-team dependencies — identifying, sizing, mitigating and escalating what could stop the work. Use this to build a risk register that gets used, manage dependencies between teams, decide what to escalate and when, or work out why the same risks keep materializing unmanaged.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/dependency-and-risk-management/SKILL.md", "sources": 0}, {"name": "estimating-and-contingency", "summary": "Produces a cost or effort estimate someone can defend — decomposing the work, choosing between analogous, parametric and bottom-up methods, documenti…", "trigger": "Produces a cost or effort estimate someone can defend — decomposing the work, choosing between analogous, parametric and bottom-up methods, documenting the basis and its assumptions, expressing confidence as a range, and sizing contingency and management reserve separately. Use this to build an estimate, challenge one you have been handed, work out why estimates keep coming in low, or decide how much reserve a portfolio actually needs.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/estimating-and-contingency/SKILL.md", "sources": 0}, {"name": "head-of-pmo", "summary": "The EPMO lead's remit — what the PMO governs, what it must never become, and how it earns standing rather than compliance", "trigger": "The EPMO lead's remit — what the PMO governs, what it must never become, and how it earns standing rather than compliance. Use this to stand up or reform a PMO, decide what it should and should not control, judge whether it is adding value or overhead, or work out why teams route around it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/head-of-pmo/SKILL.md", "sources": 0}, {"name": "portfolio-governance", "summary": "Governs the portfolio of work — intake, prioritization, stage gates, resource contention, and stopping things", "trigger": "Governs the portfolio of work — intake, prioritization, stage gates, resource contention, and stopping things. Use this to set up intake and prioritization, run a stage gate, decide between competing initiatives, resolve resource contention across projects, or work out why everything is in flight and nothing is finishing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/portfolio-governance/SKILL.md", "sources": 0}, {"name": "program-management", "summary": "Plans and drives cross-functional programs to delivery — scope, sequencing, dependencies, status, risk, and the escalations that keep work moving", "trigger": "Plans and drives cross-functional programs to delivery — scope, sequencing, dependencies, status, risk, and the escalations that keep work moving. Use this to run a multi-team initiative, recover a program that is slipping, build a delivery plan with dependencies, structure status reporting, or diagnose why cross-team work keeps missing dates.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/program-management/SKILL.md", "sources": 0}, {"name": "project-delivery", "summary": "Plans and delivers a single project — scope, estimation, scheduling, critical path, tracking, and recovering when it slips", "trigger": "Plans and delivers a single project — scope, estimation, scheduling, critical path, tracking, and recovering when it slips. Use this to plan a project, build or challenge a schedule, estimate credibly, track progress meaningfully, or recover a project that is late.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/project-delivery/SKILL.md", "sources": 0}, {"name": "schedule-development-and-analysis", "summary": "Builds and interrogates a project schedule — logic-driven sequencing, dependency types and lags, float and the critical path, resource loading and le…", "trigger": "Builds and interrogates a project schedule — logic-driven sequencing, dependency types and lags, float and the critical path, resource loading and leveling, schedule risk analysis, and measuring progress against a baseline rather than against optimism. Use this to construct a schedule, audit one you have inherited, find out why a plan keeps slipping, work out what a date change actually costs, or judge whether a reported percentage complete means anything.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/schedule-development-and-analysis/SKILL.md", "sources": 0}]}, {"slug": "customer-experience", "title": "Customer Experience", "exec": "CCO", "glyph": "M4 5h16v10.5H9.5L4 20z", "reviewer": false, "skills": [{"name": "chief-customer-officer", "summary": "Owns the customer's experience after the sale — support, success, escalation, and the feedback loop back into product", "trigger": "Owns the customer's experience after the sale — support, success, escalation, and the feedback loop back into product. Use this for a decision spanning support and product, when service quality and cost are in tension, when deciding what to staff or automate, when a customer relationship is at risk above the account-manager level, or when nobody owns a recurring customer problem.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/chief-customer-officer/SKILL.md", "sources": 0}, {"name": "customer-onboarding-and-implementation", "summary": "Takes a new customer from signature to working — setting a definition of live that both sides agreed before the contract was signed, planning and sta…", "trigger": "Takes a new customer from signature to working — setting a definition of live that both sides agreed before the contract was signed, planning and staffing the implementation, running data migration and integration realistically, training the people who will actually use it, and handing over to the ongoing relationship. Use this to design an onboarding motion, rescue a stalled implementation, work out why customers who bought never went live, or scope the services a deal actually needs.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/customer-onboarding-and-implementation/SKILL.md", "sources": 0}, {"name": "customer-success-management", "summary": "Runs the ongoing relationship with accounts after the sale — segmenting coverage against account value, building a health score that predicts rather…", "trigger": "Runs the ongoing relationship with accounts after the sale — segmenting coverage against account value, building a health score that predicts rather than describes, running reviews customers find worth attending, forecasting renewals honestly, and finding expansion that follows usage instead of quota. Use this to design a customer success motion, decide who gets a named contact, work out why renewals surprise you, or fix a health score everyone ignores.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/customer-success-management/SKILL.md", "sources": 0}, {"name": "escalation-management", "summary": "Handles customer situations that have exceeded normal support — severity assessment, incident communication, executive escalation, and recovering a r…", "trigger": "Handles customer situations that have exceeded normal support — severity assessment, incident communication, executive escalation, and recovering a relationship after a failure. Use this when a customer issue is escalating or has gone to leadership, during a customer-affecting outage, when a major account is at risk, when a relationship needs repairing after a failure, or to design the escalation path itself.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/escalation-management/SKILL.md", "sources": 0}, {"name": "self-service-and-knowledge", "summary": "Builds the help center, in-product guidance, and knowledge base that let customers resolve problems without contacting anyone — content, findability,…", "trigger": "Builds the help center, in-product guidance, and knowledge base that let customers resolve problems without contacting anyone — content, findability, maintenance, and deflection measurement. Use this to build or fix a help center, reduce support volume, write documentation for customers, improve findability, or decide what deserves a help article versus a product fix.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/self-service-and-knowledge/SKILL.md", "sources": 0}, {"name": "support-operations", "summary": "Designs and runs the support function — channels, queues, routing, staffing, service levels, quality, and the metrics that show whether it is working", "trigger": "Designs and runs the support function — channels, queues, routing, staffing, service levels, quality, and the metrics that show whether it is working. Use this to set up or fix support operations, choose channels, size a team, set or renegotiate service levels, reduce cost per contact, diagnose long queues or poor quality, or decide what to automate.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/support-operations/SKILL.md", "sources": 0}, {"name": "voice-of-customer", "summary": "Builds the loop from what customers say to what gets changed — collecting feedback, distinguishing signal from noise, routing it to owners, and closi…", "trigger": "Builds the loop from what customers say to what gets changed — collecting feedback, distinguishing signal from noise, routing it to owners, and closing the loop back to the customer. Use this to set up a feedback program, design or interpret CSAT/NPS, decide what customer feedback deserves action, get product to act on recurring issues, or diagnose why feedback is collected but nothing changes.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/voice-of-customer/SKILL.md", "sources": 0}]}, {"slug": "data-analytics", "title": "Data & Analytics", "exec": "CDO", "glyph": "M4 20h16M7 20v-6M12 20V7M17 20v-9", "reviewer": false, "skills": [{"name": "ai-ml-governance", "summary": "Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or ret…", "trigger": "Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire. Use this before deploying a model or AI feature, when defining evaluation criteria, when a model's behavior has drifted, when assessing AI risk or regulatory exposure, or when deciding whether an AI system is fit for a consequential decision.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/ai-ml-governance/SKILL.md", "sources": 0}, {"name": "business-intelligence", "summary": "Builds reporting and self-serve analytics that people actually use — metric trees, dashboard design, distribution, and the discipline that stops dash…", "trigger": "Builds reporting and self-serve analytics that people actually use — metric trees, dashboard design, distribution, and the discipline that stops dashboards proliferating. Use this to build a dashboard or report, design a metrics framework, set up self-serve analytics, decide what to measure, or diagnose why reporting exists but nobody uses it or trusts it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/business-intelligence/SKILL.md", "sources": 0}, {"name": "chief-data-officer", "summary": "Owns data as an asset — governance, quality, the warehouse and semantic layer, analytics capability, and the governance of models built on top", "trigger": "Owns data as an asset — governance, quality, the warehouse and semantic layer, analytics capability, and the governance of models built on top. Use this for a decision about how data is collected, stored, defined, or shared; when numbers disagree between teams; when deciding what to build in-house versus buy; when standing up a data function; or when an AI or model decision needs governance rather than engineering.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/chief-data-officer/SKILL.md", "sources": 0}, {"name": "data-engineering", "summary": "Builds and operates data pipelines — ingestion, transformation, orchestration, quality testing, and reliability of data delivery", "trigger": "Builds and operates data pipelines — ingestion, transformation, orchestration, quality testing, and reliability of data delivery. Use this to design or debug a pipeline, decide batch versus streaming, add data quality checks, handle late or duplicate data, or work out why a dashboard's numbers changed without anyone changing the dashboard.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/data-engineering/SKILL.md", "sources": 0}, {"name": "data-governance", "summary": "Establishes ownership, definitions, quality, access, and lineage for the organization's data", "trigger": "Establishes ownership, definitions, quality, access, and lineage for the organization's data. Use this when metrics disagree between teams, when nobody knows which dataset is authoritative, when setting up data ownership or access policy, when data quality is unreliable, or before opening a dataset to a wider audience.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/data-governance/SKILL.md", "sources": 3}, {"name": "data-modeling", "summary": "Designs the warehouse and semantic layer — source-to-mart structure, dimensional modeling, grain, slowly changing dimensions, and the metric layer an…", "trigger": "Designs the warehouse and semantic layer — source-to-mart structure, dimensional modeling, grain, slowly changing dimensions, and the metric layer analytics reads through. Use this to design or restructure a warehouse, model a new source, decide on grain or table structure, build a semantic or metric layer, or diagnose why queries are slow, wrong, or impossible to write.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/data-modeling/SKILL.md", "sources": 0}, {"name": "quantitative-analysis", "summary": "Answers a business question with data without fooling yourself — framing the question so an answer would change something, choosing the right compari…", "trigger": "Answers a business question with data without fooling yourself — framing the question so an answer would change something, choosing the right comparison, checking the data before trusting it, recognizing the traps that produce confident wrong answers (aggregation reversals, survivorship, regression to the mean, multiple comparisons), and reporting uncertainty honestly. Use this to run an analysis, review one before acting on it, or work out why two people looking at the same data reached opposite conclusions.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/quantitative-analysis/SKILL.md", "sources": 0}]}, {"slug": "corporate-strategy", "title": "Corporate Strategy", "exec": "CSO", "glyph": "M12 12m-8 0a8 8 0 1 0 16 0a8 8 0 1 0-16 0M12 12m-3.4 0a3.4 3.4 0 1 0 6.8 0a3.4 3.4 0 1 0-6.8 0M12 12h.01", "reviewer": false, "skills": [{"name": "chief-strategy-officer", "summary": "Owns where the business plays and how it wins over a multi-year horizon — portfolio choices, corporate development, strategic partnerships, and plann…", "trigger": "Owns where the business plays and how it wins over a multi-year horizon — portfolio choices, corporate development, strategic partnerships, and planning under uncertainty. Use this for a decision about which markets or businesses to be in, whether to build, buy, or partner, how to allocate capital across business lines, or when a long-horizon bet needs framing. Distinct from `chief-executive`, which arbitrates present-quarter conflicts.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/chief-strategy-officer/SKILL.md", "sources": 0}, {"name": "market-entry", "summary": "Decides whether and how to enter a new market — sizing demand from the bottom up rather than from a market report, testing whether your advantage tra…", "trigger": "Decides whether and how to enter a new market — sizing demand from the bottom up rather than from a market report, testing whether your advantage transfers, choosing between organic entry, partnership and acquisition, sequencing the operational and regulatory work that entry actually requires, and setting the criteria that would tell you to stop. Use this to evaluate a new geography, segment or vertical, pressure-test an entry plan, or work out why a launched market never reached scale.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/market-entry/SKILL.md", "sources": 0}, {"name": "mergers-and-acquisitions", "summary": "Runs corporate development — deal thesis, target screening, valuation framing, diligence, and integration planning", "trigger": "Runs corporate development — deal thesis, target screening, valuation framing, diligence, and integration planning. Use this when considering an acquisition or being approached about one, when evaluating build-versus-buy at company scale, when running or reviewing diligence, or when planning how an acquired business will actually be integrated.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/mergers-and-acquisitions/SKILL.md", "sources": 1}, {"name": "portfolio-strategy", "summary": "Decides where capital and attention go across business lines, products, and markets — what to fund, hold, harvest, or exit, and on what evidence", "trigger": "Decides where capital and attention go across business lines, products, and markets — what to fund, hold, harvest, or exit, and on what evidence. Use this to allocate budget across businesses, evaluate whether a product line should continue, decide whether to exit one, structure a portfolio review, or when several initiatives compete for the same limited investment.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/portfolio-strategy/SKILL.md", "sources": 0}, {"name": "scenario-planning", "summary": "Plans under genuine uncertainty — building scenarios, identifying which assumptions are load-bearing, setting early-warning indicators, and stress-te…", "trigger": "Plans under genuine uncertainty — building scenarios, identifying which assumptions are load-bearing, setting early-warning indicators, and stress-testing a plan against futures rather than forecasting one. Use this when a decision depends on something unknowable, when a plan assumes conditions that may not hold, before a large irreversible commitment, or when a market, regulatory, or technology shift could invalidate the strategy.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/scenario-planning/SKILL.md", "sources": 0}, {"name": "strategic-alliances", "summary": "Structures partnerships that change what the business can do — technology integrations, channel and reseller arrangements, joint ventures, and OEM re…", "trigger": "Structures partnerships that change what the business can do — technology integrations, channel and reseller arrangements, joint ventures, and OEM relationships. Use this to evaluate or structure a strategic partnership, decide between partnering and building, negotiate commercial terms of an alliance, or diagnose a partnership that is signed but not producing. For audience-borrowing partnerships, use `marketing:partnership-marketing`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/strategic-alliances/SKILL.md", "sources": 0}]}, {"slug": "people", "title": "People", "exec": "CHRO", "glyph": "M9 8.4m-3 0a3 3 0 1 0 6 0a3 3 0 1 0-6 0M3.4 20a5.6 5.6 0 0 1 11.2 0M17 9.4m-2.3 0a2.3 2.3 0 1 0 4.6 0a2.3 2.3 0 1 0-4.6 0M15.6 20a4.6 4.6 0 0 1 5-4.4", "reviewer": false, "skills": [{"name": "benefits-and-leave", "summary": "Designs and runs employee benefits and leave — health and retirement plans, leave policy, cost and renewal, and the administration that keeps them co…", "trigger": "Designs and runs employee benefits and leave — health and retirement plans, leave policy, cost and renewal, and the administration that keeps them compliant. Use this to design or review a benefits package, prepare for a renewal, write leave policy, handle a leave request, or decide what benefits are worth their cost.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/benefits-and-leave/SKILL.md", "sources": 0}, {"name": "chief-human-resources-officer", "summary": "Owns the organization itself: org design, hiring, performance, compensation, development, culture, and employee relations", "trigger": "Owns the organization itself: org design, hiring, performance, compensation, development, culture, and employee relations. Use this to design or restructure a team, plan hiring, write a role or leveling definition, handle a performance or compensation question, diagnose why a team is underperforming for non-technical reasons, or assess the people risk in a plan. Also use for onboarding design and retention of key staff.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/chief-human-resources-officer/SKILL.md", "sources": 1}, {"name": "compensation-and-leveling", "summary": "Builds and maintains the leveling framework and pay structure — level definitions, salary bands, benchmarking, pay equity, and how raises and promoti…", "trigger": "Builds and maintains the leveling framework and pay structure — level definitions, salary bands, benchmarking, pay equity, and how raises and promotions are decided. Use this to design or revise leveling, set or adjust salary bands, benchmark against market, handle a compensation request or counteroffer, run a review cycle, or diagnose pay compression and equity issues.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/compensation-and-leveling/SKILL.md", "sources": 1}, {"name": "employee-relations", "summary": "Handles the difficult human situations — grievances, complaints, investigations, conflict, and separations conducted properly", "trigger": "Handles the difficult human situations — grievances, complaints, investigations, conflict, and separations conducted properly. Use this to respond to a complaint or grievance, structure an investigation, handle a conflict between colleagues, prepare for a difficult conversation, or work out what a manager can and cannot do in a given situation.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/employee-relations/SKILL.md", "sources": 2}, {"name": "employment-compliance", "summary": "Covers the employment rules that carry real penalties — exempt and non-exempt classification, overtime and hours, employee versus contractor status,…", "trigger": "Covers the employment rules that carry real penalties — exempt and non-exempt classification, overtime and hours, employee versus contractor status, work authorization and recordkeeping, accommodation requests, and the notices and retention obligations that go with them. Use this to classify a role, review a contractor arrangement, respond to an accommodation request, work out what records to keep and for how long, or sanity-check a practice you inherited.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/employment-compliance/SKILL.md", "sources": 5}, {"name": "hiring-and-interviewing", "summary": "Designs and runs hiring — role definition, sourcing, interview loop design, structured evaluation, and the decision itself", "trigger": "Designs and runs hiring — role definition, sourcing, interview loop design, structured evaluation, and the decision itself. Use this to open a role, write a job description or scorecard, design an interview process, prepare interview questions, calibrate a hiring decision, or diagnose why a hiring process produces poor outcomes.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/hiring-and-interviewing/SKILL.md", "sources": 1}, {"name": "learning-and-development", "summary": "Builds capability — skills gaps, career frameworks, training that transfers to the job, and internal mobility", "trigger": "Builds capability — skills gaps, career frameworks, training that transfers to the job, and internal mobility. Use this to design a career ladder, close a capability gap, decide whether to build or hire a skill, structure onboarding into a role, or work out why training keeps failing to change anything.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/learning-and-development/SKILL.md", "sources": 0}, {"name": "onboarding-and-offboarding", "summary": "Designs the joining and leaving experience — first-day readiness, ramp to productivity, knowledge capture, and clean exits", "trigger": "Designs the joining and leaving experience — first-day readiness, ramp to productivity, knowledge capture, and clean exits. Use this to design or fix onboarding, shorten time to productivity, structure a leaver process, capture knowledge before someone leaves, or coordinate the access and asset steps around a joiner or leaver.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/onboarding-and-offboarding/SKILL.md", "sources": 0}, {"name": "org-design", "summary": "Designs how an organization is structured — reporting lines, team boundaries, spans and layers, role definition, and workforce planning against the s…", "trigger": "Designs how an organization is structured — reporting lines, team boundaries, spans and layers, role definition, and workforce planning against the strategy. Use this to structure a new team, restructure an existing one, resolve unclear ownership between teams, plan headcount, or diagnose why a team underperforms for structural rather than individual reasons.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/org-design/SKILL.md", "sources": 0}, {"name": "payroll-operations", "summary": "Runs the pay cycle so it is right, on time, and provable — the calendar and cutoffs, what feeds pay from the HRIS and time systems, gross-to-net and…", "trigger": "Runs the pay cycle so it is right, on time, and provable — the calendar and cutoffs, what feeds pay from the HRIS and time systems, gross-to-net and the deductions in it, multi-jurisdiction registration and tax filing, off-cycle payments and corrections, and the reconciliation to the general ledger. Use this to design or audit a payroll process, work out what happens when someone is paid wrong, or understand what changes when you hire in a new state or country.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/payroll-operations/SKILL.md", "sources": 4}, {"name": "performance-management", "summary": "Runs performance systems that change behavior — expectations, feedback, review cycles, calibration, and handling underperformance", "trigger": "Runs performance systems that change behavior — expectations, feedback, review cycles, calibration, and handling underperformance. Use this to design or fix a review process, run calibration, write or coach on feedback, address sustained underperformance, or work out why reviews consume weeks and change nothing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/performance-management/SKILL.md", "sources": 0}, {"name": "workforce-planning", "summary": "Plans the shape and size of the workforce — demand for roles, build-versus-buy, attrition, and sequencing hiring against budget", "trigger": "Plans the shape and size of the workforce — demand for roles, build-versus-buy, attrition, and sequencing hiring against budget. Use this to build a hiring plan, decide which roles to open and in what order, model attrition and backfill, plan for a growth or contraction scenario, or connect headcount plans to the budget.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/workforce-planning/SKILL.md", "sources": 0}]}, {"slug": "legal-risk", "title": "Legal & Risk", "exec": "CLO / CCO", "glyph": "M12 4.5v14.5M8 19h8M4 7.5h16M4 7.5l-2.4 5h4.8zM20 7.5l-2.4 5h4.8z", "reviewer": true, "skills": [{"name": "chief-legal-and-risk-officer", "summary": "Owns legal, contracts, intellectual property, regulatory compliance, privacy, security governance, enterprise risk, and audit readiness", "trigger": "Owns legal, contracts, intellectual property, regulatory compliance, privacy, security governance, enterprise risk, and audit readiness. Use this to review a contract or commitment, assess regulatory or privacy exposure, evaluate an IP or licensing question, judge the risk in a business decision, prepare for an audit or certification, or when a plan may create obligations the business cannot meet. Also use to decide whether a risk should be accepted, mitigated, or refused.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/chief-legal-and-risk-officer/SKILL.md", "sources": 3}, {"name": "contract-review", "summary": "Reviews and negotiates commercial agreements — MSAs, SOWs, order forms, NDAs, vendor and data-processing agreements — identifying material risk, prop…", "trigger": "Reviews and negotiates commercial agreements — MSAs, SOWs, order forms, NDAs, vendor and data-processing agreements — identifying material risk, proposing positions, and recommending a path rather than listing issues. Use this to review a contract before signature, prepare a negotiation position, build fallback positions and approval thresholds, or assess exposure in terms already agreed.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/contract-review/SKILL.md", "sources": 1}, {"name": "corporate-governance", "summary": "Maintains the corporate record and the governance machinery — entity records, board and committee support, resolutions and minutes, delegations of au…", "trigger": "Maintains the corporate record and the governance machinery — entity records, board and committee support, resolutions and minutes, delegations of authority, insurance, and business continuity. Use this to prepare board or committee materials, record a decision that needs to be minuted, set or check approval authority, review insurance and continuity coverage, establish a retention policy, or work out where a responsibility belongs when it falls between functions.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/corporate-governance/SKILL.md", "sources": 0}, {"name": "disputes-and-legal-holds", "summary": "Handles a dispute from the first sign of it — recognizing when preservation obligations attach, issuing and scoping a legal hold, suspending automati…", "trigger": "Handles a dispute from the first sign of it — recognizing when preservation obligations attach, issuing and scoping a legal hold, suspending automatic deletion across every system that holds relevant material, preserving privilege, managing outside counsel and cost, and evaluating settlement against the real cost of continuing. Use this to respond to a claim or demand letter, issue a hold, work out which systems the hold has to reach, or decide whether to fight.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/disputes-and-legal-holds/SKILL.md", "sources": 0}, {"name": "enterprise-risk", "summary": "Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, a…", "trigger": "Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit. Use this to stand up a risk program, assess the risk in a decision or initiative, prepare for a certification or audit, decide whether a risk should be accepted, mitigated, transferred, or avoided, or report risk posture to leadership.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/enterprise-risk/SKILL.md", "sources": 1}, {"name": "intellectual-property", "summary": "Covers what the organization owns and what it is only borrowing — trademarks and clearance, copyright and work-for-hire, patents and trade secrets, o…", "trigger": "Covers what the organization owns and what it is only borrowing — trademarks and clearance, copyright and work-for-hire, patents and trade secrets, open-source license obligations and copyleft reach, and IP terms in customer, contractor and AI-tool agreements. Use this to check whether a name is usable, establish that you own work you paid for, decide how to handle a license obligation in a dependency, or respond to an infringement claim.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/intellectual-property/SKILL.md", "sources": 2}, {"name": "privacy-and-data-protection", "summary": "Assesses and improves how personal data is collected, used, shared, and retained — data mapping, lawful basis, consent, processor agreements, subject…", "trigger": "Assesses and improves how personal data is collected, used, shared, and retained — data mapping, lawful basis, consent, processor agreements, subject rights, and breach obligations. Use this before launching anything that handles personal data, when adding a vendor that will process it, when a data subject request arrives, when assessing exposure under GDPR or US state privacy laws, or when preparing for a privacy review.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/privacy-and-data-protection/SKILL.md", "sources": 3}, {"name": "regulatory-compliance", "summary": "Identifies which regulations apply and builds the program that keeps you inside them — obligation mapping, controls, monitoring, and responding to re…", "trigger": "Identifies which regulations apply and builds the program that keeps you inside them — obligation mapping, controls, monitoring, and responding to regulators. Use this to work out what applies to your business, stand up a compliance program, prepare for a regulatory exam or certification, respond to a finding, or assess exposure before entering a new market.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/regulatory-compliance/SKILL.md", "sources": 9}]}];
+const DEPTS = [{"slug": "executive", "title": "Office of the CEO", "exec": "Chief Executive", "glyph": "M4 20h16M6 20V9l6-4 6 4v11M10 20v-5h4v5", "reviewer": false, "skills": [{"name": "agent-hierarchy", "summary": "Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independ…", "trigger": "Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a script that runs in CI. Use this whenever the user wants to set up, expand, audit, or fix a multi-agent or subagent structure for a codebase; asks how to divide work between agents; wants agent charters, roles, or a surface map written; or is hitting agents that collide on the same files, review their own work, or drift from their remit. Also use when sizing a roster or deciding whether a new agent is justified.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/agent-hierarchy/SKILL.md", "sources": 0}, {"name": "ai-research-analyst", "summary": "Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with th…", "trigger": "Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit. Use this to analyze a market or industry, map competitors, evaluate a market-entry or build-versus-buy decision, produce a research brief, or assemble evidence for a decision. Also use when comparing options that need a structured, evidence-based verdict rather than an opinion.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/ai-research-analyst/SKILL.md", "sources": 2}, {"name": "business-growth-consultant", "summary": "Finds the single constraint currently limiting a business's growth and the highest-leverage moves against it, rather than producing a list of everyth…", "trigger": "Finds the single constraint currently limiting a business's growth and the highest-leverage moves against it, rather than producing a list of everything that could be improved. Use this when growth has stalled or slowed, when deciding where to spend limited time or budget, when revenue rises but profit does not, when prioritizing growth initiatives, or when a business feels busy without compounding.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/business-growth-consultant/SKILL.md", "sources": 0}, {"name": "ceo-advisor", "summary": "Pressure-tests a decision, plan, or idea before it is committed to — surfacing the assumption it rests on, the case against it, and what would have t…", "trigger": "Pressure-tests a decision, plan, or idea before it is committed to — surfacing the assumption it rests on, the case against it, and what would have to be true for it to work. Use this when weighing options, when a plan needs challenging before commitment, when you have already decided and want a genuine gut check, when processing meeting notes into decisions, or when competing initiatives need ranking. Distinct from `chief-executive`, which owns direction; this one interrogates a specific decision.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/ceo-advisor/SKILL.md", "sources": 0}, {"name": "chief-executive", "summary": "Sets direction, allocates capital and attention, and makes the calls no one else can make", "trigger": "Sets direction, allocates capital and attention, and makes the calls no one else can make. Use this when a decision spans more than one function, when priorities conflict and something must be cut, when a plan needs pressure-testing before commitment, or when the question is what the organization should do rather than how to do it. Also use to route a request to the right executive when it is unclear who owns it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/chief-executive/SKILL.md", "sources": 2}, {"name": "fundraising-and-investor-relations", "summary": "Raises capital and manages the relationship afterward — deciding how much and why, understanding what dilution and preferences actually cost, running…", "trigger": "Raises capital and manages the relationship afterward — deciding how much and why, understanding what dilution and preferences actually cost, running a process with real competitive tension, preparing for diligence before it starts, and reporting to investors and a board in a way that keeps support when results are bad. Use this to plan a raise, evaluate a term sheet beyond the valuation, prepare a data room, or fix reporting that is producing surprises.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/fundraising-and-investor-relations/SKILL.md", "sources": 4}, {"name": "saas-idea-validator", "summary": "Evaluates a software or startup idea against problem, market, competition, monetization, defensibility, and execution, and returns a verdict rather t…", "trigger": "Evaluates a software or startup idea against problem, market, competition, monetization, defensibility, and execution, and returns a verdict rather than encouragement. Use this when an idea needs pressure-testing before anyone builds, when deciding whether something is worth pursuing, when assessing competition or willingness to pay, or when a validated idea needs a first-customers and MVP plan. Default to scrutiny; the useful answer is usually the unwelcome one.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/executive/skills/saas-idea-validator/SKILL.md", "sources": 0}]}, {"slug": "technology", "title": "Technology", "exec": "CTO / CIO", "glyph": "M9 8l-4 4 4 4M15 8l4 4-4 4", "reviewer": false, "skills": [{"name": "ai-workflow-architect", "summary": "Designs AI systems, automations, and agent workflows for a business — identifying which manual work is worth automating, how to structure the system,…", "trigger": "Designs AI systems, automations, and agent workflows for a business — identifying which manual work is worth automating, how to structure the system, which tools fit, and what could go wrong. Use this to automate part of an operation, design an agent or MCP workflow, reduce repetitive manual work, connect tools into a system, decide which automation to build first, or audit an automation that is not delivering.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/ai-workflow-architect/SKILL.md", "sources": 1}, {"name": "api-design", "summary": "Designs interfaces that survive their consumers — resource modeling, errors, versioning, pagination, and compatibility", "trigger": "Designs interfaces that survive their consumers — resource modeling, errors, versioning, pagination, and compatibility. Use this to design a new API, review one before it ships, decide how to version or deprecate, fix an interface consumers keep misusing, or work out whether a change is breaking.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/api-design/SKILL.md", "sources": 5}, {"name": "branch-and-worktree-workflow", "summary": "Isolates feature work in its own branch or worktree and integrates it cleanly when done", "trigger": "Isolates feature work in its own branch or worktree and integrates it cleanly when done. Use this when starting work that should not disturb the current workspace, when several efforts must proceed in parallel on one repository, or when implementation is finished and the change needs merging, rebasing, or splitting for review.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/branch-and-worktree-workflow/SKILL.md", "sources": 3}, {"name": "chief-technology-officer", "summary": "Owns architecture, engineering delivery, infrastructure, data platform, and internal systems", "trigger": "Owns architecture, engineering delivery, infrastructure, data platform, and internal systems. Use this for build-versus-buy calls, technology selection, architectural direction, engineering capacity and delivery risk, technical debt tradeoffs, platform and tooling decisions, or when a technical choice has business consequences that need stating in business terms. Also use to judge whether a technical plan is sound before it is committed to.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/chief-technology-officer/SKILL.md", "sources": 1}, {"name": "cloud-infrastructure", "summary": "Designs and runs cloud infrastructure — environments, infrastructure as code, networking and isolation, scaling, and cost", "trigger": "Designs and runs cloud infrastructure — environments, infrastructure as code, networking and isolation, scaling, and cost. Use this to design a cloud environment, control infrastructure spend, set up environment separation, plan for scale or region failure, or review infrastructure someone configured by hand.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/cloud-infrastructure/SKILL.md", "sources": 4}, {"name": "code-review", "summary": "Conducts and responds to code review — reviewing a change for correctness, design, and risk, and evaluating review feedback received on your own work", "trigger": "Conducts and responds to code review — reviewing a change for correctness, design, and risk, and evaluating review feedback received on your own work. Use this before merging, when asked to review a diff or pull request, when review feedback has arrived and needs acting on, or when feedback seems wrong and needs a reasoned response rather than compliance.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/code-review/SKILL.md", "sources": 0}, {"name": "completion-verification", "summary": "Verifies that work is actually complete before it is claimed to be — running the checks, reading the output, and confirming the original request was…", "trigger": "Verifies that work is actually complete before it is claimed to be — running the checks, reading the output, and confirming the original request was satisfied rather than approximated. Use this before saying something is done, fixed, or passing; before committing or opening a pull request; and whenever a claim of success has not been backed by command output.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/completion-verification/SKILL.md", "sources": 0}, {"name": "data-migration", "summary": "Moves data from one system to another without losing it or corrupting it — profiling the source before mapping, deciding between big-bang and paralle…", "trigger": "Moves data from one system to another without losing it or corrupting it — profiling the source before mapping, deciding between big-bang and parallel-run cutover, reconciling counts and values rather than assuming, handling the records that will not map cleanly, and planning a rollback that is actually executable. Use this to plan or run a migration, assess a migration plan someone else wrote, work out why a completed migration is producing wrong numbers, or size how long one will really take.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/data-migration/SKILL.md", "sources": 0}, {"name": "implementation-planning", "summary": "Turns a spec or requirement into a written plan a separate session or agent can execute, then drives that plan through review checkpoints", "trigger": "Turns a spec or requirement into a written plan a separate session or agent can execute, then drives that plan through review checkpoints. Use this before touching code on any multi-step task, when work needs handing to someone else, when a task keeps sprawling mid-implementation, or when a plan exists and needs executing in order with verification between steps.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/implementation-planning/SKILL.md", "sources": 0}, {"name": "observability-and-reliability", "summary": "Makes systems debuggable and reliably operable — instrumentation, alerting that is worth waking for, service objectives, and learning from failure", "trigger": "Makes systems debuggable and reliably operable — instrumentation, alerting that is worth waking for, service objectives, and learning from failure. Use this to instrument a service, fix alerting that is ignored, set error budgets or reliability targets, prepare for on-call, or run a blameless post-incident review.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/observability-and-reliability/SKILL.md", "sources": 3}, {"name": "parallel-agent-delivery", "summary": "Splits work across multiple agents or sessions running at once, keeping their surfaces disjoint so results merge cleanly", "trigger": "Splits work across multiple agents or sessions running at once, keeping their surfaces disjoint so results merge cleanly. Use this when facing several independent tasks with no shared state, when a plan has parallelizable steps, when a broad search or audit would be faster fanned out, or when deciding whether work can safely be split at all.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/parallel-agent-delivery/SKILL.md", "sources": 1}, {"name": "prompt-optimizer", "summary": "Turns rough intent or a weak prompt into a reliable one — diagnosing why output is inconsistent, restructuring the instruction, and adapting it acros…", "trigger": "Turns rough intent or a weak prompt into a reliable one — diagnosing why output is inconsistent, restructuring the instruction, and adapting it across models. Use this when a prompt is not producing what was wanted, when output varies run to run, when writing a prompt for a repeated task, when moving a prompt between models, or when someone describes what they want an AI to do and needs it written properly.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/prompt-optimizer/SKILL.md", "sources": 0}, {"name": "release-and-deployment", "summary": "Ships changes safely and often — pipelines, deployment strategies, feature flags, rollback, and database changes", "trigger": "Ships changes safely and often — pipelines, deployment strategies, feature flags, rollback, and database changes. Use this to design a deployment pipeline, reduce release risk, roll out a risky change gradually, plan a schema migration, or work out why releases are infrequent and frightening.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/release-and-deployment/SKILL.md", "sources": 1}, {"name": "skill-authoring", "summary": "Writes and revises agent skills so they trigger at the right moments and give usable instruction when they do", "trigger": "Writes and revises agent skills so they trigger at the right moments and give usable instruction when they do. Use this when creating a new skill, editing an existing one, diagnosing a skill that fires too often or never fires, or reviewing a set of skills for overlap. Also use before adding to a skill library, to check the capability is not already covered.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/skill-authoring/SKILL.md", "sources": 1}, {"name": "solution-architecture", "summary": "Designs system structure and makes architectural decisions defensible — boundaries, coupling, trade-offs, and recording why", "trigger": "Designs system structure and makes architectural decisions defensible — boundaries, coupling, trade-offs, and recording why. Use this to design a new system or major component, choose between architectural options, review an existing design, decide where a boundary belongs, or document an architectural decision so it survives the people who made it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/solution-architecture/SKILL.md", "sources": 1}, {"name": "solution-exploration", "summary": "Explores the problem and the range of possible approaches before any code is written — clarifying what is actually being asked, surfacing options wit…", "trigger": "Explores the problem and the range of possible approaches before any code is written — clarifying what is actually being asked, surfacing options with their tradeoffs, and converging on one. Use this at the start of any feature, component, or behavior change, when a request is ambiguous, when the first idea is the only idea on the table, or when a design decision needs pressure-testing before commitment.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/solution-exploration/SKILL.md", "sources": 0}, {"name": "systematic-debugging", "summary": "Finds the root cause of a bug, test failure, or unexpected behavior before proposing any fix", "trigger": "Finds the root cause of a bug, test failure, or unexpected behavior before proposing any fix. Use this whenever something is broken and the cause is not yet proven — a failing test, a production error, intermittent behavior, or a symptom that appeared after a change. Also use when a fix has been attempted and did not work, or when the same bug keeps coming back.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/systematic-debugging/SKILL.md", "sources": 0}, {"name": "technical-debt-management", "summary": "Makes technical debt visible and decidable — distinguishing real debt from mess, quantifying its cost, and arguing for remediation in business terms", "trigger": "Makes technical debt visible and decidable — distinguishing real debt from mess, quantifying its cost, and arguing for remediation in business terms. Use this to assess and prioritize debt, decide whether to fix or live with something, justify remediation work to non-engineers, or plan a migration off a system nobody wants to touch.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/technical-debt-management/SKILL.md", "sources": 1}, {"name": "test-driven-development", "summary": "Drives implementation by writing a failing test first, then the smallest code that passes it", "trigger": "Drives implementation by writing a failing test first, then the smallest code that passes it. Use this before writing implementation code for any feature or bugfix, when a bug needs a regression test, when existing code is hard to change safely, or when someone asks whether a change is covered. Also use to decide what is worth testing and what is not.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/technology/skills/test-driven-development/SKILL.md", "sources": 0}]}, {"slug": "security", "title": "Security", "exec": "CISO", "glyph": "M12 3.2l7 2.8v5.4c0 4.3-2.9 7.4-7 8.8-4.1-1.4-7-4.5-7-8.8V6z", "reviewer": true, "skills": [{"name": "access-and-identity", "summary": "Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process", "trigger": "Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and machine credentials, or diagnose why permissions have sprawled.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/access-and-identity/SKILL.md", "sources": 2}, {"name": "chief-information-security-officer", "summary": "Owns the security posture of the organization — architecture, program strategy, risk acceptance, incident command, and the authority to stop work tha…", "trigger": "Owns the security posture of the organization — architecture, program strategy, risk acceptance, incident command, and the authority to stop work that creates unacceptable exposure. Use this for a security strategy or program decision, when a technical choice creates security risk that needs a verdict, when deciding whether to accept or block a risk, when standing up a security function, or when security and delivery priorities conflict and someone has to decide.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/chief-information-security-officer/SKILL.md", "sources": 6}, {"name": "data-protection-and-encryption", "summary": "Protects data itself rather than the systems around it — classifying what you hold, encrypting in transit and at rest and understanding what each act…", "trigger": "Protects data itself rather than the systems around it — classifying what you hold, encrypting in transit and at rest and understanding what each actually defends against, managing keys and their rotation, handling secrets in applications and pipelines, minimizing and de-identifying, and deleting on purpose. Use this to design data protection for a system, assess an encryption claim, set up key or secret management, or work out what a stolen backup would actually expose.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/data-protection-and-encryption/SKILL.md", "sources": 3}, {"name": "detection-and-monitoring", "summary": "Builds the capability to notice an attack in progress — deciding what to log and retain, centralizing it somewhere tamper-resistant, writing detectio…", "trigger": "Builds the capability to notice an attack in progress — deciding what to log and retain, centralizing it somewhere tamper-resistant, writing detections that fire on attacker behavior rather than on individual events, tuning out the noise that trains people to ignore alerts, and defining what happens when something fires. Use this to design or assess monitoring coverage, work out why an incident went unnoticed, cut alert volume without losing signal, or decide what a detection capability should cost.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/detection-and-monitoring/SKILL.md", "sources": 4}, {"name": "incident-response", "summary": "Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward", "trigger": "Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Use this when a compromise is suspected or confirmed, when preparing an incident response plan or running an exercise, when deciding whether something is an incident, or when a breach may trigger notification obligations.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/incident-response/SKILL.md", "sources": 3}, {"name": "security-architecture-review", "summary": "Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-deve…", "trigger": "Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it. Use this to review an architecture or pull request for security, set secure coding standards, choose or tune SAST and DAST tooling, assess a third-party integration, or decide whether a design is safe to build.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/security-architecture-review/SKILL.md", "sources": 6}, {"name": "threat-modeling", "summary": "Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and th…", "trigger": "Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handling, payments, or external input, before a security review, or when deciding which security work is worth doing at all.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/threat-modeling/SKILL.md", "sources": 2}, {"name": "vulnerability-management", "summary": "Runs the loop from discovering a weakness to confirming it is fixed — scanning, triage, prioritization by real exploitability, remediation tracking,…", "trigger": "Runs the loop from discovering a weakness to confirming it is fixed — scanning, triage, prioritization by real exploitability, remediation tracking, and patch policy. Use this to stand up or fix a vulnerability program, triage scanner output, decide what to fix first, set patch SLAs, handle a disclosure from an outside researcher, or report posture to leadership.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/security/skills/vulnerability-management/SKILL.md", "sources": 3}]}, {"slug": "it-operations", "title": "IT Operations", "exec": "CIO", "glyph": "M3.5 5h17v10.5h-17zM9.5 20h5M12 15.5V20", "reviewer": false, "skills": [{"name": "backup-and-recovery", "summary": "Protects and restores data — backup coverage and scope, retention, immutability against ransomware, and proving restores actually work", "trigger": "Protects and restores data — backup coverage and scope, retention, immutability against ransomware, and proving restores actually work. Use this to design a backup regime, verify restores, plan retention, protect backups from ransomware, or recover from data loss.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/backup-and-recovery/SKILL.md", "sources": 1}, {"name": "chief-information-officer", "summary": "The CIO's remit — running the technology the company works on, service quality, IT spend, and the boundary with product engineering", "trigger": "The CIO's remit — running the technology the company works on, service quality, IT spend, and the boundary with product engineering. Use this to set IT priorities, decide what IT owns versus engineering, structure IT spend or an IT roadmap, judge whether to build, buy or outsource, or work out why IT is seen as a cost center rather than an enabler.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/chief-information-officer/SKILL.md", "sources": 0}, {"name": "cloud-administration", "summary": "Administers the cloud the company runs on rather than the one it sells — tenant and subscription structure, the SaaS estate and who owns each app, id…", "trigger": "Administers the cloud the company runs on rather than the one it sells — tenant and subscription structure, the SaaS estate and who owns each app, identity as the real perimeter, cloud spend that arrives as a surprise, and what the provider does not do for you. Use this to structure subscriptions or tenants, get control of sprawling SaaS, cut a cloud bill, work out who owns an application nobody admits to buying, or decide what corporate workloads belong in cloud at all.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/cloud-administration/SKILL.md", "sources": 6}, {"name": "collaboration-platform-administration", "summary": "Administers the email, chat, meeting and file-sharing platform the organization runs on — tenant and domain configuration, mail authentication and ro…", "trigger": "Administers the email, chat, meeting and file-sharing platform the organization runs on — tenant and domain configuration, mail authentication and routing, phishing and spam controls, shared mailboxes and distribution groups, external sharing and guest access, permission sprawl in file storage, and retention and legal hold. Use this to configure a tenant, tighten sharing, investigate a mail delivery or phishing problem, or work out who can see a file and why.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/collaboration-platform-administration/SKILL.md", "sources": 0}, {"name": "endpoint-management", "summary": "Manages laptops, desktops and mobile devices — enrollment, configuration, patching, software distribution, and lost or compromised devices", "trigger": "Manages laptops, desktops and mobile devices — enrollment, configuration, patching, software distribution, and lost or compromised devices. Use this to set up device management, standardize builds, roll out software or an OS upgrade, handle a lost device, or bring an unmanaged fleet under control.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/endpoint-management/SKILL.md", "sources": 4}, {"name": "identity-lifecycle-administration", "summary": "Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning", "trigger": "Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning. Use this to set up or fix joiner-mover-leaver, deprovision someone completely, clean up accumulated access, audit group membership, or find accounts that outlived their owners.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/identity-lifecycle-administration/SKILL.md", "sources": 5}, {"name": "it-asset-management", "summary": "Tracks hardware and software assets through their life — procurement, ownership, licensing, refresh, and disposal", "trigger": "Tracks hardware and software assets through their life — procurement, ownership, licensing, refresh, and disposal. Use this to build an asset register, prepare for a software audit, plan a refresh cycle, control license spend, or dispose of equipment safely.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/it-asset-management/SKILL.md", "sources": 0}, {"name": "network-administration", "summary": "Designs and operates the corporate network — segmentation, remote access, wireless, DNS and addressing, and diagnosing network problems", "trigger": "Designs and operates the corporate network — segmentation, remote access, wireless, DNS and addressing, and diagnosing network problems. Use this to segment a network, set up or fix remote access, diagnose intermittent connectivity, plan addressing or DNS, or assess whether the network's trust assumptions still hold.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/network-administration/SKILL.md", "sources": 4}, {"name": "service-desk", "summary": "Runs the IT service desk — intake, triage, prioritization, escalation, knowledge, and the metrics that improve service rather than distort it", "trigger": "Runs the IT service desk — intake, triage, prioritization, escalation, knowledge, and the metrics that improve service rather than distort it. Use this to set up or fix a service desk, design ticket priority and escalation, reduce repeat contacts, structure a knowledge base, or work out why a desk hitting its targets still frustrates everyone.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/service-desk/SKILL.md", "sources": 0}, {"name": "systems-administration", "summary": "Runs servers and corporate systems — patching, configuration baselines, change control, capacity, and the routine that prevents incidents", "trigger": "Runs servers and corporate systems — patching, configuration baselines, change control, capacity, and the routine that prevents incidents. Use this to establish a patching cadence, standardize server configuration, plan a maintenance window, decide change control for infrastructure, or clean up systems that have drifted from any known state.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/systems-administration/SKILL.md", "sources": 3}, {"name": "telephony-and-conferencing", "summary": "Runs voice and meeting infrastructure — phone systems and numbers, emergency calling obligations, conference rooms and their AV, call recording and i…", "trigger": "Runs voice and meeting infrastructure — phone systems and numbers, emergency calling obligations, conference rooms and their AV, call recording and its retention consequences, and the porting that makes provider changes go badly. Use this to replace a phone system, fix rooms nobody can start a meeting in, meet emergency-calling requirements, port numbers without losing service, or work out why voice quality degrades only sometimes.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/telephony-and-conferencing/SKILL.md", "sources": 3}, {"name": "virtualization-operations", "summary": "Runs the hypervisor layer beneath the servers — host capacity and consolidation ratios, VM sprawl, snapshot discipline, resilience and live migration…", "trigger": "Runs the hypervisor layer beneath the servers — host capacity and consolidation ratios, VM sprawl, snapshot discipline, resilience and live migration, and licensing that counts cores rather than instances. Use this to size or expand a cluster, work out why VMs are slow when the hosts look idle, clean up sprawl, set snapshot and template policy, or decide what stays virtualized and what moves to cloud.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/it-operations/skills/virtualization-operations/SKILL.md", "sources": 2}]}, {"slug": "product", "title": "Product", "exec": "CPO", "glyph": "M12 3.2l7.6 4.3v8.9L12 20.8l-7.6-4.4V7.5zM4.4 7.5l7.6 4.4 7.6-4.4M12 11.9v8.9", "reviewer": false, "skills": [{"name": "brand-identity", "summary": "Defines and applies visual brand — logo usage, palette, typography, imagery direction, and the guidelines that keep expression consistent across prod…", "trigger": "Defines and applies visual brand — logo usage, palette, typography, imagery direction, and the guidelines that keep expression consistent across product and marketing surfaces. Use this to establish a brand from scratch, audit whether an existing brand is being applied consistently, build brand guidelines, or decide how a brand should express itself in an unfamiliar format.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/brand-identity/SKILL.md", "sources": 3}, {"name": "chief-product-officer", "summary": "Owns what gets built and why: product strategy, roadmap, discovery, user experience, and the definition of success for each release", "trigger": "Owns what gets built and why: product strategy, roadmap, discovery, user experience, and the definition of success for each release. Use this to decide what to build next, to cut scope, to turn a business goal into a product bet, to judge whether a feature is worth its cost, or when engineering and go-to-market disagree about what a release is for. Also use for roadmap sequencing and for killing work that is not earning its place.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/chief-product-officer/SKILL.md", "sources": 1}, {"name": "design-styles", "summary": "Applies a deliberate visual direction to an interface — minimalist editorial, industrial utilitarian, or high-polish commercial — each with its own t…", "trigger": "Applies a deliberate visual direction to an interface — minimalist editorial, industrial utilitarian, or high-polish commercial — each with its own type scale, palette behavior, surface treatment, and motion. Use this when a product needs a point of view rather than defaults, when choosing between visual directions, when an interface reads as generic, or when restyling something without changing its structure.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/design-styles/SKILL.md", "sources": 0}, {"name": "design-system", "summary": "Builds and maintains the design system a product is assembled from — tokens for color, type, spacing and elevation, component contracts, and the rule…", "trigger": "Builds and maintains the design system a product is assembled from — tokens for color, type, spacing and elevation, component contracts, and the rules that keep them coherent as the product grows. Use this when starting a new interface, when screens have drifted apart visually, when the same component exists three times in slightly different forms, or when a token or component needs adding without breaking what exists.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/design-system/SKILL.md", "sources": 5}, {"name": "interface-craft", "summary": "Raises the visual and interaction quality of an interface — layout, hierarchy, type, spacing, density, and the details that separate a considered pro…", "trigger": "Raises the visual and interaction quality of an interface — layout, hierarchy, type, spacing, density, and the details that separate a considered product from a generic one. Use this when a screen works but looks unfinished or default, when a layout feels crowded or arbitrary, when a page has no clear focal point, or when an interface needs to feel trustworthy rather than merely functional.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/interface-craft/SKILL.md", "sources": 7}, {"name": "interface-redesign", "summary": "Upgrades an existing interface to a higher standard without rebuilding it — auditing what is there, identifying what reads as generic or unfinished,…", "trigger": "Upgrades an existing interface to a higher standard without rebuilding it — auditing what is there, identifying what reads as generic or unfinished, and sequencing changes by impact. Use this when a product works but looks dated or default, when a redesign is being considered, when deciding whether to restyle or rebuild, or when a screen needs to look substantially better with limited effort.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/interface-redesign/SKILL.md", "sources": 4}, {"name": "presentation-design", "summary": "Designs slide decks and one-pagers that carry an argument rather than decorate one — deck structure, headlines that state the takeaway, charts that m…", "trigger": "Designs slide decks and one-pagers that carry an argument rather than decorate one — deck structure, headlines that state the takeaway, charts that make a single point, and the different rules board decks and conference talks follow. Use this to build or fix a pitch deck, board deck, or conference talk, to design a one-pager, or when a deck is dense, unfocused, or being read aloud from the slides. For social graphics, carousels and infographics, use `marketing:visual-content` instead.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/presentation-design/SKILL.md", "sources": 0}, {"name": "product-discovery", "summary": "Finds out whether a problem is real and a solution would work, before building it — recruiting the right people, interviewing without leading them, s…", "trigger": "Finds out whether a problem is real and a solution would work, before building it — recruiting the right people, interviewing without leading them, separating what users say from what they do, naming the riskiest assumption and testing that one first, and reaching a decision rather than a summary. Use this to validate a problem, test an idea cheaply, decide whether to build something, or fix a discovery process that keeps confirming what the team already believed.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/product-discovery/SKILL.md", "sources": 0}, {"name": "product-requirements", "summary": "Writes down what is being built so a team can build it and know when they are done — problem and success measure before solution, scope stated by exc…", "trigger": "Writes down what is being built so a team can build it and know when they are done — problem and success measure before solution, scope stated by exclusion, user-visible behavior including the states everyone forgets, acceptance criteria someone can test, and the open questions named rather than buried. Use this to write a specification, review one that is causing rework, or work out why a delivered feature technically matched the request and still was not what anyone wanted.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/product-requirements/SKILL.md", "sources": 7}, {"name": "ux-product-auditor", "summary": "Audits a website, app, onboarding flow, or design for usability, conversion, and product problems, tying every finding to a business outcome and a se…", "trigger": "Audits a website, app, onboarding flow, or design for usability, conversion, and product problems, tying every finding to a business outcome and a severity. Use this to review an interface, diagnose low conversion or activation, find where users drop off, get structured product feedback, or decide which UX fixes to ship first. For raising visual quality rather than finding problems, use `interface-craft`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/ux-product-auditor/SKILL.md", "sources": 5}, {"name": "visual-reference-generation", "summary": "Produces design reference imagery before implementation — screen concepts, layout directions, and flows for web or mobile that make a verbal brief co…", "trigger": "Produces design reference imagery before implementation — screen concepts, layout directions, and flows for web or mobile that make a verbal brief concrete enough to argue with. Use this when a brief needs visualizing before anyone builds, when comparing layout directions, when handing a developer a target, or when stakeholders are describing different things with the same words.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/product/skills/visual-reference-generation/SKILL.md", "sources": 1}]}, {"slug": "marketing", "title": "Marketing", "exec": "CMO", "glyph": "M4 10v4h3l7 4V6l-7 4H4zM17.5 9.2a4 4 0 0 1 0 5.6", "reviewer": false, "skills": [{"name": "behavioral-marketing", "summary": "Applies decision science and cognitive bias research to marketing and product decisions — how people actually choose under uncertainty, and how frami…", "trigger": "Applies decision science and cognitive bias research to marketing and product decisions — how people actually choose under uncertainty, and how framing, defaults, sequencing, and social context change behavior. Use this to diagnose why a well-argued offer is not converting, to structure choices and pricing presentation, to design an experience around how attention and memory work, or to pressure-test whether a persuasion tactic is legitimate or manipulative.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/behavioral-marketing/SKILL.md", "sources": 5}, {"name": "brand-voice", "summary": "Captures how a person or brand actually writes and turns it into reusable voice instructions every other content skill draws from", "trigger": "Captures how a person or brand actually writes and turns it into reusable voice instructions every other content skill draws from. Use this before drafting any content for a new brand or client, when output keeps coming back sounding generic, when several writers need to sound like one, or when a voice needs defining without existing samples to learn from.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/brand-voice/SKILL.md", "sources": 0}, {"name": "chief-content-officer", "summary": "Runs content as an operation — the production pipeline, editorial calendar, repurposing engine, competitive content intelligence, and audits of what…", "trigger": "Runs content as an operation — the production pipeline, editorial calendar, repurposing engine, competitive content intelligence, and audits of what already exists. Use this to build or fix a content production system, plan a calendar, decide how one piece becomes many, rank content ideas by expected impact, or audit an existing library for what to update, consolidate, or retire. For deciding what territory to own and why, use `content-strategy` first.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/chief-content-officer/SKILL.md", "sources": 0}, {"name": "chief-marketing-officer", "summary": "Owns brand, demand generation, content, communications, and how the market understands what the business does", "trigger": "Owns brand, demand generation, content, communications, and how the market understands what the business does. Use this to set marketing strategy, allocate budget across channels, decide positioning and messaging, judge whether a campaign is worth running, diagnose why demand has stalled, or arbitrate between brand-building and short-term acquisition. Also use to decide which marketing work to stop.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/chief-marketing-officer/SKILL.md", "sources": 0}, {"name": "content-strategy", "summary": "Decides what content to make and why — topic territory, format mix, cadence, and how content connects to a business outcome rather than to traffic", "trigger": "Decides what content to make and why — topic territory, format mix, cadence, and how content connects to a business outcome rather than to traffic. Use this to plan a content program, choose topics, build an editorial calendar, decide which formats and platforms to commit to, or diagnose why content is producing audience but not results.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/content-strategy/SKILL.md", "sources": 2}, {"name": "customer-research", "summary": "Plans, runs, and synthesizes customer research — interviews, surveys, win-loss analysis, and message testing — into findings that change decisions", "trigger": "Plans, runs, and synthesizes customer research — interviews, surveys, win-loss analysis, and message testing — into findings that change decisions. Use this when the customer is being guessed at, before positioning or a major launch, when churn or conversion has an unexplained cause, or when a team is arguing from anecdotes. Also use to turn raw interview notes into usable findings.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/customer-research/SKILL.md", "sources": 1}, {"name": "events-and-field-marketing", "summary": "Plans and runs events that produce pipeline — conferences, trade shows, webinars, field programs, and measuring whether any of it worked", "trigger": "Plans and runs events that produce pipeline — conferences, trade shows, webinars, field programs, and measuring whether any of it worked. Use this to decide whether to sponsor an event, plan a conference presence or webinar, design a field program, or work out why event spend is not producing pipeline.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/events-and-field-marketing/SKILL.md", "sources": 1}, {"name": "marketing-campaign-planner", "summary": "Designs a coordinated multi-channel campaign or product launch around one story — objective, message, channel sequencing, timeline, assets, and the c…", "trigger": "Designs a coordinated multi-channel campaign or product launch around one story — objective, message, channel sequencing, timeline, assets, and the checklist that gets it out the door. Use this to plan a launch or campaign, sequence a go-to-market push, pressure-test a campaign before committing budget, or turn a product change into a coordinated set of activity. For ongoing channel programs rather than a bounded push, use `marketing-planning`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/marketing-campaign-planner/SKILL.md", "sources": 0}, {"name": "marketing-copywriting", "summary": "Writes and edits marketing copy for any surface — homepage, product and pricing pages, ads, emails, and collateral — and sharpens existing copy that…", "trigger": "Writes and edits marketing copy for any surface — homepage, product and pricing pages, ads, emails, and collateral — and sharpens existing copy that is not working. Use this to write or rewrite page copy, tighten a draft, fix copy that is vague or feature-led, adapt one message across formats, or review copy before it ships.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/marketing-copywriting/SKILL.md", "sources": 3}, {"name": "marketing-planning", "summary": "Builds the marketing plan of record — objectives, channel mix, budget allocation, sequencing, and the measurement that says whether it worked", "trigger": "Builds the marketing plan of record — objectives, channel mix, budget allocation, sequencing, and the measurement that says whether it worked. Use this for annual or quarterly planning, when budget must be allocated or defended, when marketing activity feels busy but undirected, or when a plan needs pressure-testing before commitment.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/marketing-planning/SKILL.md", "sources": 0}, {"name": "newsletter-writer", "summary": "Writes and edits newsletters and marketing emails people actually open — subject lines, opening, structure, voice, and the conversion turn where ther…", "trigger": "Writes and edits newsletters and marketing emails people actually open — subject lines, opening, structure, voice, and the conversion turn where there is one. Use this to draft or rewrite a newsletter or email, sharpen weak email copy, plan a newsletter's structure and cadence, write a sequence, or repurpose an issue into other formats. For automated lifecycle and SMS programs, use `lifecycle-messaging`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/newsletter-writer/SKILL.md", "sources": 3}, {"name": "partnership-marketing", "summary": "Builds reach through other people's audiences — co-marketing partnerships, creator and influencer programs, and community building", "trigger": "Builds reach through other people's audiences — co-marketing partnerships, creator and influencer programs, and community building. Use this to find and evaluate partners, structure a joint campaign or creator deal, plan a community strategy, or decide whether a partnership is worth the coordination cost.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/partnership-marketing/SKILL.md", "sources": 3}, {"name": "positioning-and-messaging", "summary": "Establishes what a product is understood to be, for whom, and instead of what — then turns that into the messaging every other surface inherits", "trigger": "Establishes what a product is understood to be, for whom, and instead of what — then turns that into the messaging every other surface inherits. Use this when messaging is inconsistent across channels, when prospects misunderstand what the product does, when entering a new segment, when competitors are being compared against you unfavorably, or before any campaign, launch, or site rewrite.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/positioning-and-messaging/SKILL.md", "sources": 1}, {"name": "product-launch", "summary": "Takes something built and gets it into the market — tiering the launch to match what it actually warrants, sequencing internal readiness before exter…", "trigger": "Takes something built and gets it into the market — tiering the launch to match what it actually warrants, sequencing internal readiness before external announcement, preparing sales and support to answer the questions it creates, choosing the date for a reason, and measuring adoption rather than announcement reach. Use this to plan a launch, right-size one that is consuming more than it deserves, work out why a released feature nobody uses was launched loudly, or run the weeks after launch day.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/product-launch/SKILL.md", "sources": 3}, {"name": "public-relations", "summary": "Plans and executes earned media — press strategy, journalist outreach, announcements, commentary, and crisis response", "trigger": "Plans and executes earned media — press strategy, journalist outreach, announcements, commentary, and crisis response. Use this to plan a press push, write a pitch or release, find and approach the right journalists, prepare for an interview, decide whether something is newsworthy, or respond to a story going badly.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/public-relations/SKILL.md", "sources": 2}, {"name": "social-post-craft", "summary": "Writes, structures, and evaluates social posts end to end — hooks, body, formatting for how each platform renders, and a quality check before publish…", "trigger": "Writes, structures, and evaluates social posts end to end — hooks, body, formatting for how each platform renders, and a quality check before publishing. Use this to draft a post, rewrite one that underperformed, turn a longer piece into social content, sharpen an opening, or judge whether a draft is worth publishing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/social-post-craft/SKILL.md", "sources": 2}, {"name": "video-content", "summary": "Plans and scripts short-form and long-form video, and designs the packaging — titles, thumbnails, and openings — that determines whether it gets watc…", "trigger": "Plans and scripts short-form and long-form video, and designs the packaging — titles, thumbnails, and openings — that determines whether it gets watched. Use this to script a video, plan a series, fix retention or click-through problems, design thumbnail and title concepts, or turn written content into video. For a YouTube channel specifically — idea selection, retention teardowns, and channel-level strategy — use `youtube-producer`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/video-content/SKILL.md", "sources": 3}, {"name": "visual-content", "summary": "Designs and directs the visual assets that carry content — carousels, infographics, quote graphics, diagrams, and social imagery — including the gene…", "trigger": "Designs and directs the visual assets that carry content — carousels, infographics, quote graphics, diagrams, and social imagery — including the generation prompts where they are AI-produced. Use this to turn a written piece into a visual format, design a carousel or infographic, create social graphics, or fix visuals that are not stopping the scroll.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/visual-content/SKILL.md", "sources": 1}, {"name": "youtube-producer", "summary": "Plans, packages, and scripts long-form video for retention and channel growth — idea selection, titles and thumbnails, script structure, and diagnosi…", "trigger": "Plans, packages, and scripts long-form video for retention and channel growth — idea selection, titles and thumbnails, script structure, and diagnosing why a video or channel underperforms. Use this for video ideas, packaging, scripting, a retention teardown, or channel strategy — including when someone describes a topic and wants it turned into something publishable. For short-form and cross-platform video, use `video-content`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/marketing/skills/youtube-producer/SKILL.md", "sources": 2}]}, {"slug": "demand-generation", "title": "Demand Generation", "exec": "CMO", "glyph": "M4 4.5h16l-6.2 7.2V19l-3.6 1.8v-9.1z", "reviewer": false, "skills": [{"name": "account-based-marketing", "summary": "Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, b…", "trigger": "Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group inside each, tiering effort against account value, coordinating so the account experiences one campaign rather than several, and measuring account progression instead of leads. Use this to decide whether to run an account-based program, build one, or work out why an existing one produces activity and no pipeline.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/account-based-marketing/SKILL.md", "sources": 1}, {"name": "ai-search-optimization", "summary": "Optimizes for AI assistants and AI-generated answers — being retrievable, being cited, and being represented accurately when a model answers on your…", "trigger": "Optimizes for AI assistants and AI-generated answers — being retrievable, being cited, and being represented accurately when a model answers on your behalf. Use this when traffic is shifting from links to AI answers, when a brand is misrepresented or absent in AI responses, when planning content for retrieval rather than ranking, or when deciding how AI search changes an existing SEO program.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/ai-search-optimization/SKILL.md", "sources": 3}, {"name": "app-store-optimization", "summary": "Improves visibility and conversion in the App Store and Google Play — metadata, keywords, screenshots, ratings, and the listing experience that turns…", "trigger": "Improves visibility and conversion in the App Store and Google Play — metadata, keywords, screenshots, ratings, and the listing experience that turns an impression into an install. Use this to audit or optimize an app listing, plan a launch listing, diagnose poor install conversion, or improve store search visibility.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/app-store-optimization/SKILL.md", "sources": 3}, {"name": "experimentation", "summary": "Designs, runs, and reads A/B tests and growth experiments — hypothesis, sample size, duration, and honest interpretation", "trigger": "Designs, runs, and reads A/B tests and growth experiments — hypothesis, sample size, duration, and honest interpretation. Use this to plan a test, judge whether a result is real, build an experimentation program, decide what to test next, or diagnose why tests keep producing inconclusive or non-replicating results.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/experimentation/SKILL.md", "sources": 2}, {"name": "landing-page-cro-expert", "summary": "Audits and rewrites landing pages, homepages, and sales pages to increase conversion — diagnosing why a page is not converting, rewriting headlines,…", "trigger": "Audits and rewrites landing pages, homepages, and sales pages to increase conversion — diagnosing why a page is not converting, rewriting headlines, hero copy and calls to action, and prioritizing which changes to test first. Use this when a page underperforms, when someone pastes a URL or screenshot asking what is wrong, when writing a new page, or when deciding which conversion changes are worth testing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/landing-page-cro-expert/SKILL.md", "sources": 5}, {"name": "lead-capture", "summary": "Converts anonymous traffic into known contacts — lead magnets, gated content, free tools, popups, and the forms behind them", "trigger": "Converts anonymous traffic into known contacts — lead magnets, gated content, free tools, popups, and the forms behind them. Use this to design or improve a lead magnet, plan a free tool, add or fix popups and overlays, improve form conversion, or decide what is worth gating and what should stay open.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/lead-capture/SKILL.md", "sources": 6}, {"name": "lifecycle-messaging", "summary": "Designs automated email and SMS programs — welcome and onboarding sequences, nurture, re-engagement, transactional messaging, and the timing and segm…", "trigger": "Designs automated email and SMS programs — welcome and onboarding sequences, nurture, re-engagement, transactional messaging, and the timing and segmentation behind them. Use this to build or fix an email sequence, plan lifecycle automation, improve open or click performance, set up SMS flows, or decide what messages a customer should receive and when.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/lifecycle-messaging/SKILL.md", "sources": 3}, {"name": "listing-distribution", "summary": "Gets a product listed where buyers and crawlers look — directories, marketplaces, review sites, comparison pages, and aggregators", "trigger": "Gets a product listed where buyers and crawlers look — directories, marketplaces, review sites, comparison pages, and aggregators. Use this to plan a submission push, choose which directories are worth the effort, prepare listing assets, build comparison and alternative pages, or manage presence on review platforms.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/listing-distribution/SKILL.md", "sources": 3}, {"name": "marketing-analytics", "summary": "Sets up, audits, and reports on marketing measurement — tracking plans, event schemas, attribution models, and the dashboards built on them", "trigger": "Sets up, audits, and reports on marketing measurement — tracking plans, event schemas, attribution models, and the dashboards built on them. Use this to instrument a site or product, audit tracking nobody trusts, choose or interpret an attribution model, build reporting that answers a specific question, or reconcile numbers that disagree between tools.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/marketing-analytics/SKILL.md", "sources": 5}, {"name": "paid-advertising", "summary": "Plans, runs, and optimizes paid acquisition across search, social, and display — account structure, targeting, creative, bidding, budget, and the ana…", "trigger": "Plans, runs, and optimizes paid acquisition across search, social, and display — account structure, targeting, creative, bidding, budget, and the analysis that says whether to scale or stop. Use this to set up or restructure campaigns, write and iterate ad creative, diagnose rising costs or falling performance, decide budget allocation, or judge whether a channel is working.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/paid-advertising/SKILL.md", "sources": 7}, {"name": "programmatic-seo", "summary": "Builds large sets of search-targeted pages from a template and a dataset — the location, comparison, integration, and use-case pages that capture lon…", "trigger": "Builds large sets of search-targeted pages from a template and a dataset — the location, comparison, integration, and use-case pages that capture long-tail demand at scale. Use this when there is a repeating query pattern with real volume, when a dataset could answer many similar searches, or to judge whether a programmatic approach is viable before building it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/programmatic-seo/SKILL.md", "sources": 5}, {"name": "seo-strategy", "summary": "Audits and improves organic search performance — technical health, site architecture, internal linking, structured data, and the content decisions th…", "trigger": "Audits and improves organic search performance — technical health, site architecture, internal linking, structured data, and the content decisions that determine what can rank. Use this to run an SEO audit, diagnose why pages are not ranking or were deindexed, plan a site's URL and navigation structure, add structured data, or prioritize which SEO fixes are worth doing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/demand-generation/skills/seo-strategy/SKILL.md", "sources": 5}]}, {"slug": "revenue", "title": "Revenue", "exec": "CRO", "glyph": "M4 17.5l5.2-5.2 3.4 3.4L20 8.2M14.8 8.2H20v5.2", "reviewer": false, "skills": [{"name": "activation", "summary": "Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone bec…", "trigger": "Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account. Use this to design or fix signup and onboarding, diagnose why signups do not convert to active use, reduce time-to-value, or decide what a new user must accomplish first.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/activation/SKILL.md", "sources": 2}, {"name": "chief-revenue-officer", "summary": "Owns the revenue engine end to end: sales, monetization, pricing, customer success, retention, and partnerships", "trigger": "Owns the revenue engine end to end: sales, monetization, pricing, customer success, retention, and partnerships. Use this for pricing and packaging decisions, sales strategy and coverage, forecast and pipeline health, churn and expansion, partner and channel strategy, or when marketing-sourced demand is not converting. Also use to decide which segments to pursue and which to decline.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/chief-revenue-officer/SKILL.md", "sources": 0}, {"name": "deal-negotiation", "summary": "Negotiates a commercial deal without giving away the terms that matter — preparing your walk-away and theirs, trading concessions rather than concedi…", "trigger": "Negotiates a commercial deal without giving away the terms that matter — preparing your walk-away and theirs, trading concessions rather than conceding them, recognizing the tactics that create false urgency, protecting price by moving other variables, and closing on terms someone can actually deliver. Use this to prepare for a negotiation, respond to a demand mid-deal, work out why discounts keep landing at quarter end, or review terms before they are signed.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/deal-negotiation/SKILL.md", "sources": 3}, {"name": "outbound-prospecting", "summary": "Finds, qualifies, and reaches prospects through cold outreach — list building, qualification criteria, cold email and multi-channel sequences, and th…", "trigger": "Finds, qualifies, and reaches prospects through cold outreach — list building, qualification criteria, cold email and multi-channel sequences, and the follow-up that actually gets replies. Use this to build a prospect list, write cold outreach, fix a sequence that is not getting responses, define qualification criteria, or decide whether a segment is worth pursuing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/outbound-prospecting/SKILL.md", "sources": 5}, {"name": "pricing-and-packaging", "summary": "Sets price, structures packages and tiers, and designs the monetization surfaces that carry them — upgrade paths, paywalls, and offer construction", "trigger": "Sets price, structures packages and tiers, and designs the monetization surfaces that carry them — upgrade paths, paywalls, and offer construction. Use this to set or change pricing, design or restructure tiers, choose a pricing metric, build an offer, design upgrade prompts and paywalls, or evaluate whether a pricing change is safe to make.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/pricing-and-packaging/SKILL.md", "sources": 5}, {"name": "referral-programs", "summary": "Designs and improves referral, affiliate, and word-of-mouth programs — incentive structure, mechanics, timing, and fraud control", "trigger": "Designs and improves referral, affiliate, and word-of-mouth programs — incentive structure, mechanics, timing, and fraud control. Use this to build a referral or affiliate program, diagnose one that is not producing, decide what incentive to offer, or judge whether referral is a realistic channel for a product.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/referral-programs/SKILL.md", "sources": 1}, {"name": "retention", "summary": "Diagnoses and reduces churn — cancellation flows, save offers, failed-payment recovery, at-risk detection, and the product and service causes underne…", "trigger": "Diagnoses and reduces churn — cancellation flows, save offers, failed-payment recovery, at-risk detection, and the product and service causes underneath. Use this when churn is rising or unexplained, to design a cancellation or win-back flow, to recover involuntary churn, to identify at-risk accounts before they leave, or to decide whether a retention problem is a product problem.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/retention/SKILL.md", "sources": 2}, {"name": "revenue-operations", "summary": "Runs the mechanics of the revenue engine — lead lifecycle definitions, routing, CRM hygiene, forecasting process, pipeline reporting, and the marketi…", "trigger": "Runs the mechanics of the revenue engine — lead lifecycle definitions, routing, CRM hygiene, forecasting process, pipeline reporting, and the marketing-to-sales handoff. Use this to fix a broken handoff, define lifecycle stages, improve forecast accuracy, clean up CRM data, design territory or routing rules, or diagnose why pipeline numbers are not trusted.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/revenue-operations/SKILL.md", "sources": 7}, {"name": "sales-compensation-and-territory", "summary": "Designs quotas, territories and commission plans that produce the behavior the business needs — sizing territories against real potential, setting qu…", "trigger": "Designs quotas, territories and commission plans that produce the behavior the business needs — sizing territories against real potential, setting quotas people can hit often enough to believe in, choosing what to pay on, handling accelerators, draws, clawbacks and disputes, and changing a plan without destroying trust. Use this to build or fix a comp plan, allocate territories, work out why reps are chasing the wrong deals, or plan a mid-year change.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/sales-compensation-and-territory/SKILL.md", "sources": 2}, {"name": "sales-enablement", "summary": "Builds what a sales team needs to sell — pitch decks, one-pagers, objection handling, competitive battlecards, demo scripts, and case studies", "trigger": "Builds what a sales team needs to sell — pitch decks, one-pagers, objection handling, competitive battlecards, demo scripts, and case studies. Use this to create or fix sales collateral, prepare for a competitive deal, build a demo flow, document objection responses, or diagnose why a pitch is not converting.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/revenue/skills/sales-enablement/SKILL.md", "sources": 3}]}, {"slug": "finance", "title": "Finance", "exec": "CFO", "glyph": "M12 12m-8 0a8 8 0 1 0 16 0a8 8 0 1 0-16 0M12 7v10M14.6 9.4c0-1-1.2-1.7-2.6-1.7s-2.6.7-2.6 1.7 1.2 1.7 2.6 1.7 2.6.8 2.6 1.8-1.2 1.7-2.6 1.7-2.6-.7-2.6-1.7", "reviewer": false, "skills": [{"name": "budgeting-and-forecasting", "summary": "Runs the planning cycle — annual budget, rolling forecast, consolidation of business unit inputs, and the variance analysis that explains actuals aga…", "trigger": "Runs the planning cycle — annual budget, rolling forecast, consolidation of business unit inputs, and the variance analysis that explains actuals against plan. Use this to build or challenge a budget, run a forecast cycle, consolidate departmental submissions, explain why results diverged from plan, or improve forecast accuracy.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/budgeting-and-forecasting/SKILL.md", "sources": 1}, {"name": "capital-allocation", "summary": "Evaluates where to spend limited capital — investment appraisal, hurdle rates, payback, and comparing proposals that are not alike", "trigger": "Evaluates where to spend limited capital — investment appraisal, hurdle rates, payback, and comparing proposals that are not alike. Use this to evaluate an investment or major purchase, compare competing funding requests, set a hurdle rate, decide between building and buying, or review whether past investments delivered what was claimed.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/capital-allocation/SKILL.md", "sources": 1}, {"name": "capital-structure-and-covenants", "summary": "Decides how the business is financed and what that financing then requires of it — debt versus equity, weighted average cost of capital as a hurdle r…", "trigger": "Decides how the business is financed and what that financing then requires of it — debt versus equity, weighted average cost of capital as a hurdle rate, how much leverage cash flow can carry, and the financial, affirmative and negative covenants, definitions, test dates and cure rights that come attached. Use this to evaluate a financing option, set an investment hurdle, check whether a planned decision will trip a covenant, or work out what a lender can do when one breaks.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/capital-structure-and-covenants/SKILL.md", "sources": 2}, {"name": "chief-financial-officer", "summary": "Owns the financial position: planning, budgeting, forecasting, unit economics, cash, and the numbers the business is run and reported on", "trigger": "Owns the financial position: planning, budgeting, forecasting, unit economics, cash, and the numbers the business is run and reported on. Use this to build or challenge a budget, model a decision's financial consequence, assess unit economics or runway, evaluate an investment or spend request, set financial controls, or when a plan's numbers do not reconcile. Also use to decide whether the business can afford something.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/chief-financial-officer/SKILL.md", "sources": 2}, {"name": "cost-accounting", "summary": "Establishes what something actually costs — fixed, variable and mixed cost behavior, absorption versus variable costing, job-order, process and activ…", "trigger": "Establishes what something actually costs — fixed, variable and mixed cost behavior, absorption versus variable costing, job-order, process and activity-based methods, breakeven and operating leverage, and price/volume/mix decomposition. Use this to set a price floor, explain why revenue or margin moved, decide make versus buy, judge whether a product line earns its place, or work out how an allocation basis is distorting a reported margin.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/cost-accounting/SKILL.md", "sources": 2}, {"name": "financial-modeling", "summary": "Builds and stress-tests financial models for forecasting, scenario planning, and decision support — revenue build, cost structure, driver logic, and…", "trigger": "Builds and stress-tests financial models for forecasting, scenario planning, and decision support — revenue build, cost structure, driver logic, and the sensitivities that show where a plan breaks. Use this to model a decision's financial consequence, build a forecast or long-range plan, evaluate an investment or hire, or pressure-test someone else's model before relying on it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/financial-modeling/SKILL.md", "sources": 2}, {"name": "financial-reporting-and-close", "summary": "Runs the period-end close and produces reporting — close calendar, reconciliations, accruals, variance analysis, and reporting that gets read", "trigger": "Runs the period-end close and produces reporting — close calendar, reconciliations, accruals, variance analysis, and reporting that gets read. Use this to shorten or stabilize a monthly close, design a close checklist, investigate a variance, structure management reporting, or work out why the numbers keep changing after close.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/financial-reporting-and-close/SKILL.md", "sources": 3}, {"name": "financial-statement-analysis", "summary": "Reads a set of financial statements and establishes what changed and why — fluctuation analysis against prior period and against budget, profitabilit…", "trigger": "Reads a set of financial statements and establishes what changed and why — fluctuation analysis against prior period and against budget, profitability, liquidity, solvency and efficiency ratios, benchmarking, and the non-GAAP measures presented alongside them. Use this to interpret results, review a counterparty's or target's financials, diagnose a deteriorating trend, explain a variance to someone who will act on it, or test whether an adjusted number is honest.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/financial-statement-analysis/SKILL.md", "sources": 1}, {"name": "internal-controls-and-audit", "summary": "Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit", "trigger": "Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit. Use this to design controls for a process, prepare for an external audit, respond to an audit finding, set approval thresholds, or assess where a small team's segregation of duties is genuinely broken.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/internal-controls-and-audit/SKILL.md", "sources": 2}, {"name": "revenue-recognition", "summary": "Determines when and how revenue is recognized — performance obligations, contract terms that change the answer, and the deal structures that create a…", "trigger": "Determines when and how revenue is recognized — performance obligations, contract terms that change the answer, and the deal structures that create accounting problems. Use this to work out how a contract should be recognized, review a non-standard deal before it is signed, understand deferred revenue, or spot terms that would delay or reverse recognition.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/revenue-recognition/SKILL.md", "sources": 2}, {"name": "tax", "summary": "Structures the tax questions a growing business faces — corporate income, sales and use, payroll, nexus, and the obligations created by hiring or sel…", "trigger": "Structures the tax questions a growing business faces — corporate income, sales and use, payroll, nexus, and the obligations created by hiring or selling somewhere new. Use this to work out what a new state or country obligates you to, prepare for a tax filing or audit, understand sales tax on your product, or check what a remote hire or new market triggers.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/tax/SKILL.md", "sources": 5}, {"name": "treasury-and-liquidity", "summary": "Manages cash and liquidity — cash forecasting, runway, working capital, banking structure, and currency and counterparty exposure", "trigger": "Manages cash and liquidity — cash forecasting, runway, working capital, banking structure, and currency and counterparty exposure. Use this to build a cash forecast, extend runway, improve working capital, decide where cash should sit, or assess exposure to a bank, currency, or customer concentration.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/treasury-and-liquidity/SKILL.md", "sources": 3}, {"name": "unit-economics", "summary": "Establishes whether the business makes money on each customer or unit — contribution margin, acquisition cost, payback period, lifetime value, and th…", "trigger": "Establishes whether the business makes money on each customer or unit — contribution margin, acquisition cost, payback period, lifetime value, and the cohort behavior underneath. Use this to assess whether growth is profitable, evaluate a channel or segment, support a pricing decision, judge how fast the business can afford to grow, or diagnose why revenue growth is not producing profit.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/finance/skills/unit-economics/SKILL.md", "sources": 2}]}, {"slug": "operations", "title": "Operations", "exec": "COO", "glyph": "M4.2 12a7.8 7.8 0 0 1 13.3-5.5M19.8 12a7.8 7.8 0 0 1-13.3 5.5M18 3.4v3.6h-3.6M6 20.6V17h3.6", "reviewer": false, "skills": [{"name": "business-continuity-and-resilience", "summary": "Plans for operating through disruption — impact analysis, recovery objectives, continuity plans, and the exercises that prove they work", "trigger": "Plans for operating through disruption — impact analysis, recovery objectives, continuity plans, and the exercises that prove they work. Use this to run a business impact analysis, set RTO and RPO, write or test a continuity plan, prepare for a supplier or site failure, or answer a customer's resilience questionnaire.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/business-continuity-and-resilience/SKILL.md", "sources": 3}, {"name": "capacity-and-demand-planning", "summary": "Matches operational capacity to expected demand — forecasting load, sizing teams and systems, managing queues, and deciding when to add capacity", "trigger": "Matches operational capacity to expected demand — forecasting load, sizing teams and systems, managing queues, and deciding when to add capacity. Use this to plan staffing for expected volume, diagnose a queue that keeps growing, size support or fulfillment capacity, or decide whether a bottleneck needs more capacity or better flow.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/capacity-and-demand-planning/SKILL.md", "sources": 1}, {"name": "chief-operating-officer", "summary": "Owns execution: how work actually gets done across the organization, including process, program management, capacity, vendors, supply chain, and serv…", "trigger": "Owns execution: how work actually gets done across the organization, including process, program management, capacity, vendors, supply chain, and service delivery. Use this when execution is the problem rather than strategy, to design or fix a process, to resolve cross-functional handoff failures, to plan capacity, to assess delivery risk, or when the same failure keeps recurring. Also use to decide whether to build, hire, or outsource a capability.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/chief-operating-officer/SKILL.md", "sources": 0}, {"name": "facilities-and-workplace", "summary": "Runs the physical and hybrid workplace — space planning, leases, health and safety, office services, and the operational side of where people work", "trigger": "Runs the physical and hybrid workplace — space planning, leases, health and safety, office services, and the operational side of where people work. Use this to plan space, evaluate a lease or office move, set up a hybrid workplace, handle facilities incidents, or decide what office services are worth funding.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/facilities-and-workplace/SKILL.md", "sources": 2}, {"name": "incident-management", "summary": "Runs an operational incident from detection to closed action — declaring it and naming a commander, separating the people restoring service from the…", "trigger": "Runs an operational incident from detection to closed action — declaring it and naming a commander, separating the people restoring service from the people communicating, keeping a timeline as it happens, deciding when it is over, and running a review that produces a small number of changes someone actually completes. Use this to set up an incident process, run one, work out why the same failure keeps recurring, or fix a review practice that generates findings nobody closes.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/incident-management/SKILL.md", "sources": 3}, {"name": "operating-cadence", "summary": "Designs the rhythm an organization runs on — which reviews happen weekly, monthly and quarterly, what each one decides, who owns the numbers presente…", "trigger": "Designs the rhythm an organization runs on — which reviews happen weekly, monthly and quarterly, what each one decides, who owns the numbers presented, and how a signal at the front line reaches the people who can act on it. Use this to set up a management operating system, fix a meeting calendar that produces no decisions, work out where a recurring problem keeps failing to surface, or cut a review structure that has grown past what it informs.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/operating-cadence/SKILL.md", "sources": 0}, {"name": "process-design", "summary": "Designs, documents, and fixes operational processes — mapping the current state, finding where work actually stalls, redesigning the flow, and buildi…", "trigger": "Designs, documents, and fixes operational processes — mapping the current state, finding where work actually stalls, redesigning the flow, and building controls that hold. Use this when the same failure keeps recurring, when a handoff between teams is unreliable, when onboarding a repeated task, when work takes far longer than the work itself, or when deciding whether to automate, standardize, or eliminate a process.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/process-design/SKILL.md", "sources": 2}, {"name": "procurement-and-sourcing", "summary": "Buys well — specifying need, running competitive sourcing, negotiating, and category strategy before a contract exists", "trigger": "Buys well — specifying need, running competitive sourcing, negotiating, and category strategy before a contract exists. Use this to run an RFP or vendor selection, negotiate a purchase, consolidate spend across a category, decide between single and multiple suppliers, or bring uncontrolled spending under management.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/procurement-and-sourcing/SKILL.md", "sources": 4}, {"name": "quality-management", "summary": "Builds quality into operations — defining standards, catching defects at the right point, root cause analysis, and continuous improvement", "trigger": "Builds quality into operations — defining standards, catching defects at the right point, root cause analysis, and continuous improvement. Use this to reduce a defect or error rate, design quality controls into a process, run a root cause analysis, respond to a customer quality complaint, or set up quality metrics that drive behavior.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/quality-management/SKILL.md", "sources": 3}, {"name": "service-level-management", "summary": "Defines and manages service levels — setting targets that reflect what customers need, measuring honestly, and handling breaches", "trigger": "Defines and manages service levels — setting targets that reflect what customers need, measuring honestly, and handling breaches. Use this to write or negotiate an SLA, decide what to measure and at what threshold, respond to a missed service level, or work out why a service that meets its targets still has unhappy customers.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/service-level-management/SKILL.md", "sources": 1}, {"name": "supply-chain-and-logistics", "summary": "Manages the flow of goods and inputs — sourcing, inventory, lead times, fulfillment, and supply risk", "trigger": "Manages the flow of goods and inputs — sourcing, inventory, lead times, fulfillment, and supply risk. Use this to reduce stockouts or excess inventory, plan for a supplier failure, decide reorder points and safety stock, improve fulfillment reliability, or assess concentration risk in a supply base.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/supply-chain-and-logistics/SKILL.md", "sources": 4}, {"name": "vendor-management", "summary": "Selects, contracts, and manages suppliers and vendors — requirements, evaluation, negotiation support, onboarding, performance management, and exit", "trigger": "Selects, contracts, and manages suppliers and vendors — requirements, evaluation, negotiation support, onboarding, performance management, and exit. Use this to choose a vendor, run a selection process, structure a service agreement's operational terms, manage an underperforming supplier, plan an exit or migration, or assess concentration and continuity risk.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/operations/skills/vendor-management/SKILL.md", "sources": 3}]}, {"slug": "pmo", "title": "Program Management Office", "exec": "EPMO / COO", "glyph": "M4 7h9M7.5 12h11M4 17h7", "reviewer": false, "skills": [{"name": "benefits-realization", "summary": "Ensures projects deliver the value they were approved on — defining measurable benefits, baselining, tracking after delivery, and honest post-impleme…", "trigger": "Ensures projects deliver the value they were approved on — defining measurable benefits, baselining, tracking after delivery, and honest post-implementation review. Use this to define benefits for a business case, set a baseline, track whether value actually landed, or run a post-implementation review that produces something useful.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/benefits-realization/SKILL.md", "sources": 1}, {"name": "change-and-adoption", "summary": "Gets people to actually use what was delivered — stakeholder analysis, communication, training, resistance, and measuring adoption", "trigger": "Gets people to actually use what was delivered — stakeholder analysis, communication, training, resistance, and measuring adoption. Use this to plan a rollout, recover an implementation nobody is using, handle resistance to a change, sequence communications, or work out why a technically successful project changed nothing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/change-and-adoption/SKILL.md", "sources": 1}, {"name": "dependency-and-risk-management", "summary": "Manages delivery risk and cross-team dependencies — identifying, sizing, mitigating and escalating what could stop the work", "trigger": "Manages delivery risk and cross-team dependencies — identifying, sizing, mitigating and escalating what could stop the work. Use this to build a risk register that gets used, manage dependencies between teams, decide what to escalate and when, or work out why the same risks keep materializing unmanaged.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/dependency-and-risk-management/SKILL.md", "sources": 1}, {"name": "estimating-and-contingency", "summary": "Produces a cost or effort estimate someone can defend — decomposing the work, choosing between analogous, parametric and bottom-up methods, documenti…", "trigger": "Produces a cost or effort estimate someone can defend — decomposing the work, choosing between analogous, parametric and bottom-up methods, documenting the basis and its assumptions, expressing confidence as a range, and sizing contingency and management reserve separately. Use this to build an estimate, challenge one you have been handed, work out why estimates keep coming in low, or decide how much reserve a portfolio actually needs.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/estimating-and-contingency/SKILL.md", "sources": 2}, {"name": "head-of-pmo", "summary": "The EPMO lead's remit — what the PMO governs, what it must never become, and how it earns standing rather than compliance", "trigger": "The EPMO lead's remit — what the PMO governs, what it must never become, and how it earns standing rather than compliance. Use this to stand up or reform a PMO, decide what it should and should not control, judge whether it is adding value or overhead, or work out why teams route around it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/head-of-pmo/SKILL.md", "sources": 1}, {"name": "portfolio-governance", "summary": "Governs the portfolio of work — intake, prioritization, stage gates, resource contention, and stopping things", "trigger": "Governs the portfolio of work — intake, prioritization, stage gates, resource contention, and stopping things. Use this to set up intake and prioritization, run a stage gate, decide between competing initiatives, resolve resource contention across projects, or work out why everything is in flight and nothing is finishing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/portfolio-governance/SKILL.md", "sources": 3}, {"name": "program-management", "summary": "Plans and drives cross-functional programs to delivery — scope, sequencing, dependencies, status, risk, and the escalations that keep work moving", "trigger": "Plans and drives cross-functional programs to delivery — scope, sequencing, dependencies, status, risk, and the escalations that keep work moving. Use this to run a multi-team initiative, recover a program that is slipping, build a delivery plan with dependencies, structure status reporting, or diagnose why cross-team work keeps missing dates.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/program-management/SKILL.md", "sources": 2}, {"name": "project-delivery", "summary": "Plans and delivers a single project — scope, estimation, scheduling, critical path, tracking, and recovering when it slips", "trigger": "Plans and delivers a single project — scope, estimation, scheduling, critical path, tracking, and recovering when it slips. Use this to plan a project, build or challenge a schedule, estimate credibly, track progress meaningfully, or recover a project that is late.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/project-delivery/SKILL.md", "sources": 3}, {"name": "schedule-development-and-analysis", "summary": "Builds and interrogates a project schedule — logic-driven sequencing, dependency types and lags, float and the critical path, resource loading and le…", "trigger": "Builds and interrogates a project schedule — logic-driven sequencing, dependency types and lags, float and the critical path, resource loading and leveling, schedule risk analysis, and measuring progress against a baseline rather than against optimism. Use this to construct a schedule, audit one you have inherited, find out why a plan keeps slipping, work out what a date change actually costs, or judge whether a reported percentage complete means anything.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/pmo/skills/schedule-development-and-analysis/SKILL.md", "sources": 1}]}, {"slug": "customer-experience", "title": "Customer Experience", "exec": "CCO", "glyph": "M4 5h16v10.5H9.5L4 20z", "reviewer": false, "skills": [{"name": "chief-customer-officer", "summary": "Owns the customer's experience after the sale — support, success, escalation, and the feedback loop back into product", "trigger": "Owns the customer's experience after the sale — support, success, escalation, and the feedback loop back into product. Use this for a decision spanning support and product, when service quality and cost are in tension, when deciding what to staff or automate, when a customer relationship is at risk above the account-manager level, or when nobody owns a recurring customer problem.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/chief-customer-officer/SKILL.md", "sources": 0}, {"name": "customer-onboarding-and-implementation", "summary": "Takes a new customer from signature to working — setting a definition of live that both sides agreed before the contract was signed, planning and sta…", "trigger": "Takes a new customer from signature to working — setting a definition of live that both sides agreed before the contract was signed, planning and staffing the implementation, running data migration and integration realistically, training the people who will actually use it, and handing over to the ongoing relationship. Use this to design an onboarding motion, rescue a stalled implementation, work out why customers who bought never went live, or scope the services a deal actually needs.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/customer-onboarding-and-implementation/SKILL.md", "sources": 1}, {"name": "customer-success-management", "summary": "Runs the ongoing relationship with accounts after the sale — segmenting coverage against account value, building a health score that predicts rather…", "trigger": "Runs the ongoing relationship with accounts after the sale — segmenting coverage against account value, building a health score that predicts rather than describes, running reviews customers find worth attending, forecasting renewals honestly, and finding expansion that follows usage instead of quota. Use this to design a customer success motion, decide who gets a named contact, work out why renewals surprise you, or fix a health score everyone ignores.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/customer-success-management/SKILL.md", "sources": 0}, {"name": "escalation-management", "summary": "Handles customer situations that have exceeded normal support — severity assessment, incident communication, executive escalation, and recovering a r…", "trigger": "Handles customer situations that have exceeded normal support — severity assessment, incident communication, executive escalation, and recovering a relationship after a failure. Use this when a customer issue is escalating or has gone to leadership, during a customer-affecting outage, when a major account is at risk, when a relationship needs repairing after a failure, or to design the escalation path itself.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/escalation-management/SKILL.md", "sources": 1}, {"name": "self-service-and-knowledge", "summary": "Builds the help center, in-product guidance, and knowledge base that let customers resolve problems without contacting anyone — content, findability,…", "trigger": "Builds the help center, in-product guidance, and knowledge base that let customers resolve problems without contacting anyone — content, findability, maintenance, and deflection measurement. Use this to build or fix a help center, reduce support volume, write documentation for customers, improve findability, or decide what deserves a help article versus a product fix.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/self-service-and-knowledge/SKILL.md", "sources": 2}, {"name": "support-operations", "summary": "Designs and runs the support function — channels, queues, routing, staffing, service levels, quality, and the metrics that show whether it is working", "trigger": "Designs and runs the support function — channels, queues, routing, staffing, service levels, quality, and the metrics that show whether it is working. Use this to set up or fix support operations, choose channels, size a team, set or renegotiate service levels, reduce cost per contact, diagnose long queues or poor quality, or decide what to automate.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/support-operations/SKILL.md", "sources": 3}, {"name": "voice-of-customer", "summary": "Builds the loop from what customers say to what gets changed — collecting feedback, distinguishing signal from noise, routing it to owners, and closi…", "trigger": "Builds the loop from what customers say to what gets changed — collecting feedback, distinguishing signal from noise, routing it to owners, and closing the loop back to the customer. Use this to set up a feedback program, design or interpret CSAT/NPS, decide what customer feedback deserves action, get product to act on recurring issues, or diagnose why feedback is collected but nothing changes.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/customer-experience/skills/voice-of-customer/SKILL.md", "sources": 0}]}, {"slug": "data-analytics", "title": "Data & Analytics", "exec": "CDO", "glyph": "M4 20h16M7 20v-6M12 20V7M17 20v-9", "reviewer": false, "skills": [{"name": "ai-ml-governance", "summary": "Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or ret…", "trigger": "Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire. Use this before deploying a model or AI feature, when defining evaluation criteria, when a model's behavior has drifted, when assessing AI risk or regulatory exposure, or when deciding whether an AI system is fit for a consequential decision.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/ai-ml-governance/SKILL.md", "sources": 8}, {"name": "business-intelligence", "summary": "Builds reporting and self-serve analytics that people actually use — metric trees, dashboard design, distribution, and the discipline that stops dash…", "trigger": "Builds reporting and self-serve analytics that people actually use — metric trees, dashboard design, distribution, and the discipline that stops dashboards proliferating. Use this to build a dashboard or report, design a metrics framework, set up self-serve analytics, decide what to measure, or diagnose why reporting exists but nobody uses it or trusts it.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/business-intelligence/SKILL.md", "sources": 2}, {"name": "chief-data-officer", "summary": "Owns data as an asset — governance, quality, the warehouse and semantic layer, analytics capability, and the governance of models built on top", "trigger": "Owns data as an asset — governance, quality, the warehouse and semantic layer, analytics capability, and the governance of models built on top. Use this for a decision about how data is collected, stored, defined, or shared; when numbers disagree between teams; when deciding what to build in-house versus buy; when standing up a data function; or when an AI or model decision needs governance rather than engineering.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/chief-data-officer/SKILL.md", "sources": 4}, {"name": "data-engineering", "summary": "Builds and operates data pipelines — ingestion, transformation, orchestration, quality testing, and reliability of data delivery", "trigger": "Builds and operates data pipelines — ingestion, transformation, orchestration, quality testing, and reliability of data delivery. Use this to design or debug a pipeline, decide batch versus streaming, add data quality checks, handle late or duplicate data, or work out why a dashboard's numbers changed without anyone changing the dashboard.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/data-engineering/SKILL.md", "sources": 5}, {"name": "data-governance", "summary": "Establishes ownership, definitions, quality, access, and lineage for the organization's data", "trigger": "Establishes ownership, definitions, quality, access, and lineage for the organization's data. Use this when metrics disagree between teams, when nobody knows which dataset is authoritative, when setting up data ownership or access policy, when data quality is unreliable, or before opening a dataset to a wider audience.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/data-governance/SKILL.md", "sources": 3}, {"name": "data-modeling", "summary": "Designs the warehouse and semantic layer — source-to-mart structure, dimensional modeling, grain, slowly changing dimensions, and the metric layer an…", "trigger": "Designs the warehouse and semantic layer — source-to-mart structure, dimensional modeling, grain, slowly changing dimensions, and the metric layer analytics reads through. Use this to design or restructure a warehouse, model a new source, decide on grain or table structure, build a semantic or metric layer, or diagnose why queries are slow, wrong, or impossible to write.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/data-modeling/SKILL.md", "sources": 2}, {"name": "quantitative-analysis", "summary": "Answers a business question with data without fooling yourself — framing the question so an answer would change something, choosing the right compari…", "trigger": "Answers a business question with data without fooling yourself — framing the question so an answer would change something, choosing the right comparison, checking the data before trusting it, recognizing the traps that produce confident wrong answers (aggregation reversals, survivorship, regression to the mean, multiple comparisons), and reporting uncertainty honestly. Use this to run an analysis, review one before acting on it, or work out why two people looking at the same data reached opposite conclusions.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/data-analytics/skills/quantitative-analysis/SKILL.md", "sources": 3}]}, {"slug": "corporate-strategy", "title": "Corporate Strategy", "exec": "CSO", "glyph": "M12 12m-8 0a8 8 0 1 0 16 0a8 8 0 1 0-16 0M12 12m-3.4 0a3.4 3.4 0 1 0 6.8 0a3.4 3.4 0 1 0-6.8 0M12 12h.01", "reviewer": false, "skills": [{"name": "chief-strategy-officer", "summary": "Owns where the business plays and how it wins over a multi-year horizon — portfolio choices, corporate development, strategic partnerships, and plann…", "trigger": "Owns where the business plays and how it wins over a multi-year horizon — portfolio choices, corporate development, strategic partnerships, and planning under uncertainty. Use this for a decision about which markets or businesses to be in, whether to build, buy, or partner, how to allocate capital across business lines, or when a long-horizon bet needs framing. Distinct from `chief-executive`, which arbitrates present-quarter conflicts.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/chief-strategy-officer/SKILL.md", "sources": 2}, {"name": "market-entry", "summary": "Decides whether and how to enter a new market — sizing demand from the bottom up rather than from a market report, testing whether your advantage tra…", "trigger": "Decides whether and how to enter a new market — sizing demand from the bottom up rather than from a market report, testing whether your advantage transfers, choosing between organic entry, partnership and acquisition, sequencing the operational and regulatory work that entry actually requires, and setting the criteria that would tell you to stop. Use this to evaluate a new geography, segment or vertical, pressure-test an entry plan, or work out why a launched market never reached scale.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/market-entry/SKILL.md", "sources": 1}, {"name": "mergers-and-acquisitions", "summary": "Runs corporate development — deal thesis, target screening, valuation framing, diligence, and integration planning", "trigger": "Runs corporate development — deal thesis, target screening, valuation framing, diligence, and integration planning. Use this when considering an acquisition or being approached about one, when evaluating build-versus-buy at company scale, when running or reviewing diligence, or when planning how an acquired business will actually be integrated.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/mergers-and-acquisitions/SKILL.md", "sources": 3}, {"name": "portfolio-strategy", "summary": "Decides where capital and attention go across business lines, products, and markets — what to fund, hold, harvest, or exit, and on what evidence", "trigger": "Decides where capital and attention go across business lines, products, and markets — what to fund, hold, harvest, or exit, and on what evidence. Use this to allocate budget across businesses, evaluate whether a product line should continue, decide whether to exit one, structure a portfolio review, or when several initiatives compete for the same limited investment.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/portfolio-strategy/SKILL.md", "sources": 2}, {"name": "scenario-planning", "summary": "Plans under genuine uncertainty — building scenarios, identifying which assumptions are load-bearing, setting early-warning indicators, and stress-te…", "trigger": "Plans under genuine uncertainty — building scenarios, identifying which assumptions are load-bearing, setting early-warning indicators, and stress-testing a plan against futures rather than forecasting one. Use this when a decision depends on something unknowable, when a plan assumes conditions that may not hold, before a large irreversible commitment, or when a market, regulatory, or technology shift could invalidate the strategy.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/scenario-planning/SKILL.md", "sources": 0}, {"name": "strategic-alliances", "summary": "Structures partnerships that change what the business can do — technology integrations, channel and reseller arrangements, joint ventures, and OEM re…", "trigger": "Structures partnerships that change what the business can do — technology integrations, channel and reseller arrangements, joint ventures, and OEM relationships. Use this to evaluate or structure a strategic partnership, decide between partnering and building, negotiate commercial terms of an alliance, or diagnose a partnership that is signed but not producing. For audience-borrowing partnerships, use `marketing:partnership-marketing`.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/corporate-strategy/skills/strategic-alliances/SKILL.md", "sources": 0}]}, {"slug": "people", "title": "People", "exec": "CHRO", "glyph": "M9 8.4m-3 0a3 3 0 1 0 6 0a3 3 0 1 0-6 0M3.4 20a5.6 5.6 0 0 1 11.2 0M17 9.4m-2.3 0a2.3 2.3 0 1 0 4.6 0a2.3 2.3 0 1 0-4.6 0M15.6 20a4.6 4.6 0 0 1 5-4.4", "reviewer": false, "skills": [{"name": "benefits-and-leave", "summary": "Designs and runs employee benefits and leave — health and retirement plans, leave policy, cost and renewal, and the administration that keeps them co…", "trigger": "Designs and runs employee benefits and leave — health and retirement plans, leave policy, cost and renewal, and the administration that keeps them compliant. Use this to design or review a benefits package, prepare for a renewal, write leave policy, handle a leave request, or decide what benefits are worth their cost.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/benefits-and-leave/SKILL.md", "sources": 3}, {"name": "chief-human-resources-officer", "summary": "Owns the organization itself: org design, hiring, performance, compensation, development, culture, and employee relations", "trigger": "Owns the organization itself: org design, hiring, performance, compensation, development, culture, and employee relations. Use this to design or restructure a team, plan hiring, write a role or leveling definition, handle a performance or compensation question, diagnose why a team is underperforming for non-technical reasons, or assess the people risk in a plan. Also use for onboarding design and retention of key staff.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/chief-human-resources-officer/SKILL.md", "sources": 1}, {"name": "compensation-and-leveling", "summary": "Builds and maintains the leveling framework and pay structure — level definitions, salary bands, benchmarking, pay equity, and how raises and promoti…", "trigger": "Builds and maintains the leveling framework and pay structure — level definitions, salary bands, benchmarking, pay equity, and how raises and promotions are decided. Use this to design or revise leveling, set or adjust salary bands, benchmark against market, handle a compensation request or counteroffer, run a review cycle, or diagnose pay compression and equity issues.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/compensation-and-leveling/SKILL.md", "sources": 2}, {"name": "employee-relations", "summary": "Handles the difficult human situations — grievances, complaints, investigations, conflict, and separations conducted properly", "trigger": "Handles the difficult human situations — grievances, complaints, investigations, conflict, and separations conducted properly. Use this to respond to a complaint or grievance, structure an investigation, handle a conflict between colleagues, prepare for a difficult conversation, or work out what a manager can and cannot do in a given situation.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/employee-relations/SKILL.md", "sources": 2}, {"name": "employment-compliance", "summary": "Covers the employment rules that carry real penalties — exempt and non-exempt classification, overtime and hours, employee versus contractor status,…", "trigger": "Covers the employment rules that carry real penalties — exempt and non-exempt classification, overtime and hours, employee versus contractor status, work authorization and recordkeeping, accommodation requests, and the notices and retention obligations that go with them. Use this to classify a role, review a contractor arrangement, respond to an accommodation request, work out what records to keep and for how long, or sanity-check a practice you inherited.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/employment-compliance/SKILL.md", "sources": 9}, {"name": "hiring-and-interviewing", "summary": "Designs and runs hiring — role definition, sourcing, interview loop design, structured evaluation, and the decision itself", "trigger": "Designs and runs hiring — role definition, sourcing, interview loop design, structured evaluation, and the decision itself. Use this to open a role, write a job description or scorecard, design an interview process, prepare interview questions, calibrate a hiring decision, or diagnose why a hiring process produces poor outcomes.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/hiring-and-interviewing/SKILL.md", "sources": 3}, {"name": "learning-and-development", "summary": "Builds capability — skills gaps, career frameworks, training that transfers to the job, and internal mobility", "trigger": "Builds capability — skills gaps, career frameworks, training that transfers to the job, and internal mobility. Use this to design a career ladder, close a capability gap, decide whether to build or hire a skill, structure onboarding into a role, or work out why training keeps failing to change anything.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/learning-and-development/SKILL.md", "sources": 2}, {"name": "onboarding-and-offboarding", "summary": "Designs the joining and leaving experience — first-day readiness, ramp to productivity, knowledge capture, and clean exits", "trigger": "Designs the joining and leaving experience — first-day readiness, ramp to productivity, knowledge capture, and clean exits. Use this to design or fix onboarding, shorten time to productivity, structure a leaver process, capture knowledge before someone leaves, or coordinate the access and asset steps around a joiner or leaver.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/onboarding-and-offboarding/SKILL.md", "sources": 1}, {"name": "org-design", "summary": "Designs how an organization is structured — reporting lines, team boundaries, spans and layers, role definition, and workforce planning against the s…", "trigger": "Designs how an organization is structured — reporting lines, team boundaries, spans and layers, role definition, and workforce planning against the strategy. Use this to structure a new team, restructure an existing one, resolve unclear ownership between teams, plan headcount, or diagnose why a team underperforms for structural rather than individual reasons.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/org-design/SKILL.md", "sources": 2}, {"name": "payroll-operations", "summary": "Runs the pay cycle so it is right, on time, and provable — the calendar and cutoffs, what feeds pay from the HRIS and time systems, gross-to-net and…", "trigger": "Runs the pay cycle so it is right, on time, and provable — the calendar and cutoffs, what feeds pay from the HRIS and time systems, gross-to-net and the deductions in it, multi-jurisdiction registration and tax filing, off-cycle payments and corrections, and the reconciliation to the general ledger. Use this to design or audit a payroll process, work out what happens when someone is paid wrong, or understand what changes when you hire in a new state or country.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/payroll-operations/SKILL.md", "sources": 4}, {"name": "performance-management", "summary": "Runs performance systems that change behavior — expectations, feedback, review cycles, calibration, and handling underperformance", "trigger": "Runs performance systems that change behavior — expectations, feedback, review cycles, calibration, and handling underperformance. Use this to design or fix a review process, run calibration, write or coach on feedback, address sustained underperformance, or work out why reviews consume weeks and change nothing.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/performance-management/SKILL.md", "sources": 1}, {"name": "workforce-planning", "summary": "Plans the shape and size of the workforce — demand for roles, build-versus-buy, attrition, and sequencing hiring against budget", "trigger": "Plans the shape and size of the workforce — demand for roles, build-versus-buy, attrition, and sequencing hiring against budget. Use this to build a hiring plan, decide which roles to open and in what order, model attrition and backfill, plan for a growth or contraction scenario, or connect headcount plans to the budget.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/people/skills/workforce-planning/SKILL.md", "sources": 2}]}, {"slug": "legal-risk", "title": "Legal & Risk", "exec": "CLO / CCO", "glyph": "M12 4.5v14.5M8 19h8M4 7.5h16M4 7.5l-2.4 5h4.8zM20 7.5l-2.4 5h4.8z", "reviewer": true, "skills": [{"name": "chief-legal-and-risk-officer", "summary": "Owns legal, contracts, intellectual property, regulatory compliance, privacy, security governance, enterprise risk, and audit readiness", "trigger": "Owns legal, contracts, intellectual property, regulatory compliance, privacy, security governance, enterprise risk, and audit readiness. Use this to review a contract or commitment, assess regulatory or privacy exposure, evaluate an IP or licensing question, judge the risk in a business decision, prepare for an audit or certification, or when a plan may create obligations the business cannot meet. Also use to decide whether a risk should be accepted, mitigated, or refused.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/chief-legal-and-risk-officer/SKILL.md", "sources": 3}, {"name": "contract-review", "summary": "Reviews and negotiates commercial agreements — MSAs, SOWs, order forms, NDAs, vendor and data-processing agreements — identifying material risk, prop…", "trigger": "Reviews and negotiates commercial agreements — MSAs, SOWs, order forms, NDAs, vendor and data-processing agreements — identifying material risk, proposing positions, and recommending a path rather than listing issues. Use this to review a contract before signature, prepare a negotiation position, build fallback positions and approval thresholds, or assess exposure in terms already agreed.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/contract-review/SKILL.md", "sources": 1}, {"name": "corporate-governance", "summary": "Maintains the corporate record and the governance machinery — entity records, board and committee support, resolutions and minutes, delegations of au…", "trigger": "Maintains the corporate record and the governance machinery — entity records, board and committee support, resolutions and minutes, delegations of authority, insurance, and business continuity. Use this to prepare board or committee materials, record a decision that needs to be minuted, set or check approval authority, review insurance and continuity coverage, establish a retention policy, or work out where a responsibility belongs when it falls between functions.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/corporate-governance/SKILL.md", "sources": 3}, {"name": "disputes-and-legal-holds", "summary": "Handles a dispute from the first sign of it — recognizing when preservation obligations attach, issuing and scoping a legal hold, suspending automati…", "trigger": "Handles a dispute from the first sign of it — recognizing when preservation obligations attach, issuing and scoping a legal hold, suspending automatic deletion across every system that holds relevant material, preserving privilege, managing outside counsel and cost, and evaluating settlement against the real cost of continuing. Use this to respond to a claim or demand letter, issue a hold, work out which systems the hold has to reach, or decide whether to fight.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/disputes-and-legal-holds/SKILL.md", "sources": 3}, {"name": "enterprise-risk", "summary": "Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, a…", "trigger": "Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit. Use this to stand up a risk program, assess the risk in a decision or initiative, prepare for a certification or audit, decide whether a risk should be accepted, mitigated, transferred, or avoided, or report risk posture to leadership.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/enterprise-risk/SKILL.md", "sources": 1}, {"name": "intellectual-property", "summary": "Covers what the organization owns and what it is only borrowing — trademarks and clearance, copyright and work-for-hire, patents and trade secrets, o…", "trigger": "Covers what the organization owns and what it is only borrowing — trademarks and clearance, copyright and work-for-hire, patents and trade secrets, open-source license obligations and copyleft reach, and IP terms in customer, contractor and AI-tool agreements. Use this to check whether a name is usable, establish that you own work you paid for, decide how to handle a license obligation in a dependency, or respond to an infringement claim.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/intellectual-property/SKILL.md", "sources": 4}, {"name": "privacy-and-data-protection", "summary": "Assesses and improves how personal data is collected, used, shared, and retained — data mapping, lawful basis, consent, processor agreements, subject…", "trigger": "Assesses and improves how personal data is collected, used, shared, and retained — data mapping, lawful basis, consent, processor agreements, subject rights, and breach obligations. Use this before launching anything that handles personal data, when adding a vendor that will process it, when a data subject request arrives, when assessing exposure under GDPR or US state privacy laws, or when preparing for a privacy review.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/privacy-and-data-protection/SKILL.md", "sources": 3}, {"name": "regulatory-compliance", "summary": "Identifies which regulations apply and builds the program that keeps you inside them — obligation mapping, controls, monitoring, and responding to re…", "trigger": "Identifies which regulations apply and builds the program that keeps you inside them — obligation mapping, controls, monitoring, and responding to regulators. Use this to work out what applies to your business, stand up a compliance program, prepare for a regulatory exam or certification, respond to a finding, or assess exposure before entering a new market.", "url": "https://github.com/cbrock84/headcount/blob/main/plugins/legal-risk/skills/regulatory-compliance/SKILL.md", "sources": 10}]}];
 
 const grid = document.getElementById('grid');
 const q = document.getElementById('q');
@@ -430,7 +430,7 @@ <h2>Using this</h2>
   [DEPTS.length, 'departments'],
   [totalSkills, 'skills'],
   [reviewers.length, 'reviewer-class'],
-  [50, 'cited sources'],
+  [181, 'cited sources'],
 ].map(([n, l]) => `<div class="figure"><b>${n}</b><span>${l}</span></div>`).join('');
 
 const esc = s => s.replace(/[&<>"]/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c]));
diff --git a/plugins/corporate-strategy/skills/chief-strategy-officer/SKILL.md b/plugins/corporate-strategy/skills/chief-strategy-officer/SKILL.md
index cc1f273..40104c2 100644
--- a/plugins/corporate-strategy/skills/chief-strategy-officer/SKILL.md
+++ b/plugins/corporate-strategy/skills/chief-strategy-officer/SKILL.md
@@ -82,6 +82,13 @@ Strategy functions drift into producing analysis nobody acts on. The defense is
 work names the decision it serves and the date that decision is needed. Analysis with no decision
 attached is a hobby.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Confuse a plan with a strategy. A sequence of initiatives is not a choice about where to compete.
diff --git a/plugins/corporate-strategy/skills/chief-strategy-officer/references/sources.md b/plugins/corporate-strategy/skills/chief-strategy-officer/references/sources.md
new file mode 100644
index 0000000..cd9b718
--- /dev/null
+++ b/plugins/corporate-strategy/skills/chief-strategy-officer/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `corporate-strategy:chief-strategy-officer`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Hart-Scott-Rodino premerger notification program
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/enforcement/premerger-notification-program>
+
+**Authoritative for:** Whether a transaction must be reported before closing, at what size, and how long the parties must then wait. A threshold question with one right answer — and the thresholds are revised annually, so resolve them here rather than from memory.
+
+## Merger Guidelines
+
+US Department of Justice and Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/reports/merger-guidelines-2023>
+
+**Authoritative for:** Whether an acquisition is likely to be challenged — the concentration thresholds, how the agencies define a market, and the theories of harm they actually apply. The closest thing to a decision procedure for whether you can buy someone.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/corporate-strategy/skills/market-entry/SKILL.md b/plugins/corporate-strategy/skills/market-entry/SKILL.md
index 0babbb3..0aeeaf1 100644
--- a/plugins/corporate-strategy/skills/market-entry/SKILL.md
+++ b/plugins/corporate-strategy/skills/market-entry/SKILL.md
@@ -71,6 +71,13 @@ was producing better returns on.
 
 Review against the criteria on the date, not when someone finally raises it.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Size a market from a published figure without building it up from countable units.
diff --git a/plugins/corporate-strategy/skills/market-entry/references/sources.md b/plugins/corporate-strategy/skills/market-entry/references/sources.md
new file mode 100644
index 0000000..c82119f
--- /dev/null
+++ b/plugins/corporate-strategy/skills/market-entry/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `corporate-strategy:market-entry`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Country Commercial Guides
+
+US Department of Commerce, International Trade Administration · global · public domain (US government) — quote freely
+
+<https://www.trade.gov/country-commercial-guides>
+
+**Authoritative for:** The factual regulatory picture for entering a named foreign market — licensing, customs, standards, distribution and investment restrictions. It settles the factual questions in a market entry, not the strategic ones.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/corporate-strategy/skills/mergers-and-acquisitions/references/sources.md b/plugins/corporate-strategy/skills/mergers-and-acquisitions/references/sources.md
index 20e29ea..6904cdd 100644
--- a/plugins/corporate-strategy/skills/mergers-and-acquisitions/references/sources.md
+++ b/plugins/corporate-strategy/skills/mergers-and-acquisitions/references/sources.md
@@ -14,6 +14,22 @@ Machine-readable: <https://www.sec.gov/search-filings/edgar-application-programm
 
 **Authoritative for:** What public companies actually reported, in their own filings — the primary source for a competitor's economics, a comparable's margin structure, or how a peer disclosed an accounting policy.
 
+## Hart-Scott-Rodino premerger notification program
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/enforcement/premerger-notification-program>
+
+**Authoritative for:** Whether a transaction must be reported before closing, at what size, and how long the parties must then wait. A threshold question with one right answer — and the thresholds are revised annually, so resolve them here rather than from memory.
+
+## Merger Guidelines
+
+US Department of Justice and Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/reports/merger-guidelines-2023>
+
+**Authoritative for:** Whether an acquisition is likely to be challenged — the concentration thresholds, how the agencies define a market, and the theories of harm they actually apply. The closest thing to a decision procedure for whether you can buy someone.
+
 ---
 
 Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/corporate-strategy/skills/portfolio-strategy/SKILL.md b/plugins/corporate-strategy/skills/portfolio-strategy/SKILL.md
index 7ebe9c5..922b0e4 100644
--- a/plugins/corporate-strategy/skills/portfolio-strategy/SKILL.md
+++ b/plugins/corporate-strategy/skills/portfolio-strategy/SKILL.md
@@ -54,6 +54,13 @@ allocation you already had.
 
 Force a ranking. Tiers are how everything stays funded.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Fund a line because it is large. Fund it on marginal return.
diff --git a/plugins/corporate-strategy/skills/portfolio-strategy/references/sources.md b/plugins/corporate-strategy/skills/portfolio-strategy/references/sources.md
new file mode 100644
index 0000000..477fdcc
--- /dev/null
+++ b/plugins/corporate-strategy/skills/portfolio-strategy/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `corporate-strategy:portfolio-strategy`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Merger Guidelines
+
+US Department of Justice and Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/reports/merger-guidelines-2023>
+
+**Authoritative for:** Whether an acquisition is likely to be challenged — the concentration thresholds, how the agencies define a market, and the theories of harm they actually apply. The closest thing to a decision procedure for whether you can buy someone.
+
+## The Green Book: appraisal and evaluation in central government
+
+HM Treasury · UK · free to use with attribution — credit the publisher
+
+<https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent>
+
+**Authoritative for:** Whether a claimed benefit may be counted at all — what separates a benefit from a transfer, how optimism bias is corrected for, and what a business case must contain. The best free treatment of benefits discipline anywhere, and openly licensed.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/customer-experience/skills/customer-onboarding-and-implementation/SKILL.md b/plugins/customer-experience/skills/customer-onboarding-and-implementation/SKILL.md
index eb35670..2c6da05 100644
--- a/plugins/customer-experience/skills/customer-onboarding-and-implementation/SKILL.md
+++ b/plugins/customer-experience/skills/customer-onboarding-and-implementation/SKILL.md
@@ -62,6 +62,13 @@ An implementation that ends when the project ends leaves the account with nobody
 context — what was configured and why, what was deferred, what is fragile, who the people are —
 and confirm the receiving side has it rather than assuming.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Start an implementation without written go-live criteria both sides agreed.
diff --git a/plugins/customer-experience/skills/customer-onboarding-and-implementation/references/sources.md b/plugins/customer-experience/skills/customer-onboarding-and-implementation/references/sources.md
new file mode 100644
index 0000000..4910fc2
--- /dev/null
+++ b/plugins/customer-experience/skills/customer-onboarding-and-implementation/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `customer-experience:customer-onboarding-and-implementation`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 15 U.S.C. 7001 — Electronic Signatures in Global and National Commerce Act
+
+US Congress, via the Office of the Law Revision Counsel · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section7001&num=0&edition=prelim>
+
+**Authoritative for:** Whether an electronically signed contract, a clickwrap acceptance or an emailed order form is enforceable, and what consumer consent steps must precede it.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/customer-experience/skills/escalation-management/SKILL.md b/plugins/customer-experience/skills/escalation-management/SKILL.md
index 32ea827..583c66e 100644
--- a/plugins/customer-experience/skills/escalation-management/SKILL.md
+++ b/plugins/customer-experience/skills/escalation-management/SKILL.md
@@ -58,6 +58,13 @@ correctly, did we communicate on time, and what would have prevented it.
 Escalation volume is a health metric for the whole function. Rising escalations mean the normal path
 is failing more often, and that is the thing to fix.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Escalate without naming an owner. An escalation with no name on it is a broadcast.
diff --git a/plugins/customer-experience/skills/escalation-management/references/sources.md b/plugins/customer-experience/skills/escalation-management/references/sources.md
new file mode 100644
index 0000000..837322b
--- /dev/null
+++ b/plugins/customer-experience/skills/escalation-management/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `customer-experience:escalation-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## NIST SP 800-61: Incident Response Recommendations and Considerations
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/61/r3/final>
+
+**Authoritative for:** What an incident response capability must contain and what evidence must be captured at each stage. The current revision is a substantial rewrite that drops the older four-phase framing, so do not mix guidance across revisions.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/customer-experience/skills/self-service-and-knowledge/SKILL.md b/plugins/customer-experience/skills/self-service-and-knowledge/SKILL.md
index 3e3d742..9fbfdf7 100644
--- a/plugins/customer-experience/skills/self-service-and-knowledge/SKILL.md
+++ b/plugins/customer-experience/skills/self-service-and-knowledge/SKILL.md
@@ -63,6 +63,13 @@ volume for a topic falls after content ships.
 Watch articles with high views *and* a high subsequent contact rate. Those are articles that are
 failing to answer, and they look like your best-performing content.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Write an article for a problem the product should not have. Fix the product and delete the article.
diff --git a/plugins/customer-experience/skills/self-service-and-knowledge/references/sources.md b/plugins/customer-experience/skills/self-service-and-knowledge/references/sources.md
new file mode 100644
index 0000000..a979fc2
--- /dev/null
+++ b/plugins/customer-experience/skills/self-service-and-knowledge/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `customer-experience:self-service-and-knowledge`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Federal Plain Language Guidelines
+
+Plain Language Action and Information Network · US · public domain (US government) — quote freely
+
+<https://www.plainlanguage.gov/guidelines/>
+
+**Authoritative for:** What counts as plain language in user-facing writing — audience-first structure, active voice, short sections. Backed by statute for federal agencies, and the only free normative writing standard that is not one author's style preference.
+
+## Web Content Accessibility Guidelines 2.2
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/WCAG22/>
+
+**Authoritative for:** Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/customer-experience/skills/support-operations/SKILL.md b/plugins/customer-experience/skills/support-operations/SKILL.md
index bcbc4ce..3b24f3f 100644
--- a/plugins/customer-experience/skills/support-operations/SKILL.md
+++ b/plugins/customer-experience/skills/support-operations/SKILL.md
@@ -69,6 +69,13 @@ by a wide margin and then blames the team.
 Review a sample of resolved contacts against a rubric agreed with the team, and coach against it.
 Reviewing only escalations trains for defense rather than quality.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Ticketing: Zendesk, Freshdesk, Intercom, Front, Help Scout, and similar; Jira Service
diff --git a/plugins/customer-experience/skills/support-operations/references/sources.md b/plugins/customer-experience/skills/support-operations/references/sources.md
new file mode 100644
index 0000000..f23caeb
--- /dev/null
+++ b/plugins/customer-experience/skills/support-operations/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `customer-experience:support-operations`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 18 U.S.C. 2511 — interception of communications
+
+US Congress, via the Office of the Law Revision Counsel · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title18-section2511&num=0&edition=prelim>
+
+**Authoritative for:** The federal one-party-consent floor for recording a call, and the criminal exposure for recording without it. It settles only the floor: several states require all-party consent, and there is no free authoritative single document for that matrix — it must be looked up per state.
+
+## Federal Plain Language Guidelines
+
+Plain Language Action and Information Network · US · public domain (US government) — quote freely
+
+<https://www.plainlanguage.gov/guidelines/>
+
+**Authoritative for:** What counts as plain language in user-facing writing — audience-first structure, active voice, short sections. Backed by statute for federal agencies, and the only free normative writing standard that is not one author's style preference.
+
+## PCI Data Security Standard
+
+PCI Security Standards Council · global · **account required — cite it; the user fetches it**
+
+<https://www.pcisecuritystandards.org/document_library/>
+
+**Authoritative for:** Whether a support agent may take a card number by phone, whether that call may be recorded, and what must happen to card data in ticket attachments and screen shares. Assessed by a qualified assessor, so genuinely dispositive.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/data-analytics/skills/ai-ml-governance/SKILL.md b/plugins/data-analytics/skills/ai-ml-governance/SKILL.md
index 3c0c8ee..de41d35 100644
--- a/plugins/data-analytics/skills/ai-ml-governance/SKILL.md
+++ b/plugins/data-analytics/skills/ai-ml-governance/SKILL.md
@@ -64,6 +64,13 @@ asks why a decision was made — and increasingly what a regulator expects to se
 Have a way to turn it off. Know what happens to the process when you do, and confirm the fallback
 still works — a manual path that has not been exercised in two years is not a fallback.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Deploy without an evaluation set and a monitoring plan.
diff --git a/plugins/data-analytics/skills/ai-ml-governance/references/sources.md b/plugins/data-analytics/skills/ai-ml-governance/references/sources.md
new file mode 100644
index 0000000..3023972
--- /dev/null
+++ b/plugins/data-analytics/skills/ai-ml-governance/references/sources.md
@@ -0,0 +1,77 @@
+# Sources — `data-analytics:ai-ml-governance`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 29 CFR Part 1607 — Uniform Guidelines on Employee Selection Procedures
+
+US Equal Employment Opportunity Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XIV/part-1607>
+
+**Authoritative for:** What counts as a selection procedure, when adverse impact exists, and what validation evidence an employer must hold to defend one that has it. This is the document that settles disputes about hiring tests, scored assessments and promotion criteria — including automated ones.
+
+## Artificial Intelligence and the ADA
+
+US Equal Employment Opportunity Commission · US · public domain (US government) — quote freely
+
+<https://www.eeoc.gov/eeoc-disability-related-resources/artificial-intelligence-and-ada>
+
+**Authoritative for:** When an algorithmic assessment screens out a person with a disability, and what accommodation is owed inside an automated hiring flow.
+
+## ISO/IEC 42001 — AI management systems
+
+ISO · global · **sold — cite the identifier only, never the text**
+
+<https://www.iso.org/standard/42001.html>
+
+**Authoritative for:** What a certifiable AI management system requires — the only thing an external auditor can certify against, and increasingly what enterprise customers ask for by name. Sold, so name the clause and never reproduce it.
+
+## NIST AI 600-1: Generative AI Profile
+
+NIST · US · public domain (US government) — quote freely
+
+<https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence>
+
+Machine-readable: <https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf>
+
+**Authoritative for:** Which risks are unique to or amplified by generative models, as distinct from general machine learning risk. Settles the claim that generative systems are just another model.
+
+## NIST AI RMF Playbook
+
+NIST · US · public domain (US government) — quote freely
+
+<https://airc.nist.gov/airmf-resources/playbook/>
+
+**Authoritative for:** For each framework subcategory, which actions and documentation artifacts satisfy it. The operational layer the framework itself deliberately leaves abstract.
+
+## NIST AI Risk Management Framework, AI 100-1
+
+NIST · US · public domain (US government) — quote freely
+
+<https://www.nist.gov/itl/ai-risk-management-framework>
+
+Machine-readable: <https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf>
+
+**Authoritative for:** What the four AI risk functions are and what an organization must be able to evidence under each. It ends the argument about what claiming to have an AI governance program has to mean concretely.
+
+## OECD Recommendation of the Council on Artificial Intelligence
+
+OECD · global · free to use with attribution — credit the publisher
+
+<https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449>
+
+**Authoritative for:** The intergovernmentally agreed definition of an AI system, which other regimes adopt by reference. That definitional question is the one it actually settles.
+
+## Regulation (EU) 2024/1689 — the AI Act
+
+Publications Office of the European Union · EU · free to use with attribution — credit the publisher
+
+<https://eur-lex.europa.eu/eli/reg/2024/1689/oj>
+
+**Authoritative for:** Whether an AI system is prohibited, high-risk or limited-risk in the EU and what obligations attach. Binding law rather than guidance, and only the Official Journal version is authentic.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/data-analytics/skills/business-intelligence/SKILL.md b/plugins/data-analytics/skills/business-intelligence/SKILL.md
index 81f14ad..04f657b 100644
--- a/plugins/data-analytics/skills/business-intelligence/SKILL.md
+++ b/plugins/data-analytics/skills/business-intelligence/SKILL.md
@@ -64,6 +64,13 @@ check every figure by hand.
 Dashboards accumulate. Review usage periodically and retire what nobody opens — with a notice period,
 since the one person using it may be using it for something important.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 BI: Power BI, Looker, Tableau, Metabase, Omni, Hex, and similar.
diff --git a/plugins/data-analytics/skills/business-intelligence/references/sources.md b/plugins/data-analytics/skills/business-intelligence/references/sources.md
new file mode 100644
index 0000000..32f3c4e
--- /dev/null
+++ b/plugins/data-analytics/skills/business-intelligence/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `data-analytics:business-intelligence`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Commission Guidance on Management's Discussion and Analysis, Release 33-10751
+
+US Securities and Exchange Commission · US · public domain (US government) — quote freely
+
+<https://www.federalregister.gov/documents/2020/02/25/2020-02296/commission-guidance-on-managements-discussion-and-analysis-of-financial-condition-and-results-of>
+
+**Authoritative for:** What a company must do when it publishes an operating metric — define it, disclose how it is calculated, apply it consistently, and explain any change in method. It disciplines metrics like recurring revenue and net retention without defining them, which is the honest ceiling on authority here.
+
+## Statistical Quality Standards
+
+US Census Bureau · US · public domain (US government) — quote freely
+
+<https://www.census.gov/about/policies/quality/standards.html>
+
+**Authoritative for:** The quality requirements at each stage of producing a statistical product, including when an estimate must be suppressed or flagged rather than published.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/data-analytics/skills/chief-data-officer/SKILL.md b/plugins/data-analytics/skills/chief-data-officer/SKILL.md
index 202d85f..1b10055 100644
--- a/plugins/data-analytics/skills/chief-data-officer/SKILL.md
+++ b/plugins/data-analytics/skills/chief-data-officer/SKILL.md
@@ -87,6 +87,13 @@ reported performance. To Legal & Risk before any new use of personal data — pa
 fine-tuning models on customer data, where the lawful basis for the original collection rarely
 covers it.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Let a metric be defined by whoever reports it.
diff --git a/plugins/data-analytics/skills/chief-data-officer/references/sources.md b/plugins/data-analytics/skills/chief-data-officer/references/sources.md
new file mode 100644
index 0000000..ced6088
--- /dev/null
+++ b/plugins/data-analytics/skills/chief-data-officer/references/sources.md
@@ -0,0 +1,43 @@
+# Sources — `data-analytics:chief-data-officer`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Data Catalog Vocabulary
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/vocab-dcat-3/>
+
+**Authoritative for:** The interoperable vocabulary for describing datasets and catalogs — what a catalog entry must carry to be exchangeable rather than specific to one tool.
+
+## General Records Schedules
+
+US National Archives and Records Administration · US · public domain (US government) — quote freely
+
+<https://www.archives.gov/records-mgmt/grs>
+
+**Authoritative for:** Minimum retention and disposition periods for common administrative record classes. Binding on federal agencies only — for a private company it is a defensible published baseline rather than law, which is still better than arguing from habit.
+
+## NIST AI Risk Management Framework, AI 100-1
+
+NIST · US · public domain (US government) — quote freely
+
+<https://www.nist.gov/itl/ai-risk-management-framework>
+
+Machine-readable: <https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf>
+
+**Authoritative for:** What the four AI risk functions are and what an organization must be able to evidence under each. It ends the argument about what claiming to have an AI governance program has to mean concretely.
+
+## OpenLineage object model
+
+LF AI and Data Foundation · global · free to use with attribution — credit the publisher
+
+<https://openlineage.io/docs/spec/object-model/>
+
+**Authoritative for:** The vendor-neutral event schema for lineage — what an event must contain to be portable, rather than whatever one catalog happens to record.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/data-analytics/skills/data-engineering/SKILL.md b/plugins/data-analytics/skills/data-engineering/SKILL.md
index ec102f2..a7c4bc5 100644
--- a/plugins/data-analytics/skills/data-engineering/SKILL.md
+++ b/plugins/data-analytics/skills/data-engineering/SKILL.md
@@ -51,6 +51,13 @@ is valid but wrong. Assert on the data itself, in the pipeline, and fail loudly:
 A silent failure is worse than a loud one. Prefer stopping the pipeline to publishing data you do not
 trust.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Warehouses and lakehouses: Snowflake, BigQuery, Databricks, Redshift, and Postgres or
diff --git a/plugins/data-analytics/skills/data-engineering/references/sources.md b/plugins/data-analytics/skills/data-engineering/references/sources.md
new file mode 100644
index 0000000..f1243b9
--- /dev/null
+++ b/plugins/data-analytics/skills/data-engineering/references/sources.md
@@ -0,0 +1,49 @@
+# Sources — `data-analytics:data-engineering`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Apache Iceberg table specification
+
+Apache Software Foundation · global · free to use with attribution — credit the publisher
+
+<https://iceberg.apache.org/spec/>
+
+**Authoritative for:** The on-disk contract — metadata layout, snapshots, schema and partition evolution, and what isolation a reader may assume. The document that decides whether two engines agree on what a table is.
+
+## Apache Parquet file format specification
+
+Apache Software Foundation · global · free to use with attribution — credit the publisher
+
+<https://parquet.apache.org/docs/file-format/>
+
+**Authoritative for:** Physical layout, encodings, nesting and the statistics a reader may rely on for predicate pushdown. The normative answer to why a file is slow or unreadable.
+
+## Data Catalog Vocabulary
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/vocab-dcat-3/>
+
+**Authoritative for:** The interoperable vocabulary for describing datasets and catalogs — what a catalog entry must carry to be exchangeable rather than specific to one tool.
+
+## OpenLineage object model
+
+LF AI and Data Foundation · global · free to use with attribution — credit the publisher
+
+<https://openlineage.io/docs/spec/object-model/>
+
+**Authoritative for:** The vendor-neutral event schema for lineage — what an event must contain to be portable, rather than whatever one catalog happens to record.
+
+## Shapes Constraint Language
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/shacl/>
+
+**Authoritative for:** How a data constraint is expressed and what conformance means — the normative answer to whether a record is valid against a model, rather than each tool inventing its own semantics.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/data-analytics/skills/data-modeling/SKILL.md b/plugins/data-analytics/skills/data-modeling/SKILL.md
index d9c700e..b5cf188 100644
--- a/plugins/data-analytics/skills/data-modeling/SKILL.md
+++ b/plugins/data-analytics/skills/data-modeling/SKILL.md
@@ -67,6 +67,13 @@ warehouse queries are full scans of a table that could have been partitioned by
 Denormalize deliberately, and write down why. Undocumented denormalization is indistinguishable from
 a modeling error six months later.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Build a mart directly on raw. The coupling means every source change breaks the business layer.
diff --git a/plugins/data-analytics/skills/data-modeling/references/sources.md b/plugins/data-analytics/skills/data-modeling/references/sources.md
new file mode 100644
index 0000000..5e8c6da
--- /dev/null
+++ b/plugins/data-analytics/skills/data-modeling/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `data-analytics:data-modeling`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Apache Iceberg table specification
+
+Apache Software Foundation · global · free to use with attribution — credit the publisher
+
+<https://iceberg.apache.org/spec/>
+
+**Authoritative for:** The on-disk contract — metadata layout, snapshots, schema and partition evolution, and what isolation a reader may assume. The document that decides whether two engines agree on what a table is.
+
+## Shapes Constraint Language
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/shacl/>
+
+**Authoritative for:** How a data constraint is expressed and what conformance means — the normative answer to whether a record is valid against a model, rather than each tool inventing its own semantics.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/data-analytics/skills/quantitative-analysis/SKILL.md b/plugins/data-analytics/skills/quantitative-analysis/SKILL.md
index f15241e..3384a5a 100644
--- a/plugins/data-analytics/skills/quantitative-analysis/SKILL.md
+++ b/plugins/data-analytics/skills/quantitative-analysis/SKILL.md
@@ -75,6 +75,13 @@ gets trusted on the things it can determine.
 **Distinguish what the data shows from what you infer.** Both belong in the report; conflating them
 is how a plausible interpretation becomes a fact by the third time it is repeated.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Run an analysis that leads to the same action whatever it finds.
diff --git a/plugins/data-analytics/skills/quantitative-analysis/references/sources.md b/plugins/data-analytics/skills/quantitative-analysis/references/sources.md
new file mode 100644
index 0000000..28572a9
--- /dev/null
+++ b/plugins/data-analytics/skills/quantitative-analysis/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `data-analytics:quantitative-analysis`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## BLS Handbook of Methods
+
+US Bureau of Labor Statistics · US · public domain (US government) — quote freely
+
+<https://www.bls.gov/opub/hom/>
+
+Machine-readable: <https://www.bls.gov/developers/>
+
+**Authoritative for:** What each labor statistic actually measures and how. Ends the common error of comparing two series that measure different things, which is most disagreements about labor market data.
+
+## NIST/SEMATECH e-Handbook of Statistical Methods
+
+NIST · US · public domain (US government) — quote freely
+
+<https://www.itl.nist.gov/div898/handbook/>
+
+**Authoritative for:** The correct procedure, assumptions and interpretation for a named statistical technique. A neutral referee when two analysts disagree on method — strong on classical methods, silent on modern causal inference.
+
+## Statistical Quality Standards
+
+US Census Bureau · US · public domain (US government) — quote freely
+
+<https://www.census.gov/about/policies/quality/standards.html>
+
+**Authoritative for:** The quality requirements at each stage of producing a statistical product, including when an estimate must be suppressed or flagged rather than published.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/account-based-marketing/SKILL.md b/plugins/demand-generation/skills/account-based-marketing/SKILL.md
index 889d59e..1d3f142 100644
--- a/plugins/demand-generation/skills/account-based-marketing/SKILL.md
+++ b/plugins/demand-generation/skills/account-based-marketing/SKILL.md
@@ -74,6 +74,13 @@ Expect the timeline to be long. Judging an account-based program on a quarter is
 any of its mechanism has had time to work, and canceling it there is the most common way the
 investment is wasted entirely.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Adopt the model without checking whether the deal size carries the per-account cost.
diff --git a/plugins/demand-generation/skills/account-based-marketing/references/sources.md b/plugins/demand-generation/skills/account-based-marketing/references/sources.md
new file mode 100644
index 0000000..772b54d
--- /dev/null
+++ b/plugins/demand-generation/skills/account-based-marketing/references/sources.md
@@ -0,0 +1,19 @@
+# Sources — `demand-generation:account-based-marketing`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## CAN-SPAM Act: A Compliance Guide for Business
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business>
+
+Machine-readable: <https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316>
+
+**Authoritative for:** The mandatory elements of a US commercial email — header accuracy, subject-line honesty, physical address, opt-out mechanism and the window for honoring it — and that hiring an agency does not move the liability.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/ai-search-optimization/SKILL.md b/plugins/demand-generation/skills/ai-search-optimization/SKILL.md
index 717a8e5..02209dd 100644
--- a/plugins/demand-generation/skills/ai-search-optimization/SKILL.md
+++ b/plugins/demand-generation/skills/ai-search-optimization/SKILL.md
@@ -45,6 +45,13 @@ Click-through will fall on informational queries even as influence rises. Track
 frequency, and downstream branded search and direct traffic, rather than judging this program on
 organic sessions — that metric will say you are losing while you are winning.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Optimize for one assistant's current behavior. Retrieval and citation rules change without notice and without a changelog.
diff --git a/plugins/demand-generation/skills/ai-search-optimization/references/sources.md b/plugins/demand-generation/skills/ai-search-optimization/references/sources.md
new file mode 100644
index 0000000..c4b7ac7
--- /dev/null
+++ b/plugins/demand-generation/skills/ai-search-optimization/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `demand-generation:ai-search-optimization`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Google crawlers and user-triggered fetchers
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/crawling-indexing/overview-google-crawlers>
+
+Machine-readable: <https://developers.google.com/search/docs/crawling-indexing/robots/intro>
+
+**Authoritative for:** Which user agents Google operates and what each one is for, including the separate control over training and AI surfaces — the question behind every robots.txt argument about blocking AI.
+
+## RFC 9309: Robots Exclusion Protocol
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc9309.html>
+
+**Authoritative for:** The formal parsing rules for robots.txt — precedence, wildcards, size limits, and what a crawler is obliged to do. Settles at the protocol level whether disallow prevents indexing, which it does not.
+
+## Spam policies for Google web search
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/essentials/spam-policies>
+
+**Authoritative for:** Whether a tactic is sanctionable — scaled content abuse, site reputation abuse, expired-domain abuse, cloaking, doorway pages. The only authoritative answer to whether a programmatic build will be penalized.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/app-store-optimization/SKILL.md b/plugins/demand-generation/skills/app-store-optimization/SKILL.md
index 1c28cec..317b1d3 100644
--- a/plugins/demand-generation/skills/app-store-optimization/SKILL.md
+++ b/plugins/demand-generation/skills/app-store-optimization/SKILL.md
@@ -47,6 +47,13 @@ Watch review text for recurring themes — it is the cheapest continuous product
 Change one element at a time and let it run a full weekly cycle; app traffic is strongly
 day-of-week seasonal. Attributing a lift to the wrong change is worse than not testing.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 The consoles are the source of truth: App Store Connect and Google Play Console, including their
diff --git a/plugins/demand-generation/skills/app-store-optimization/references/sources.md b/plugins/demand-generation/skills/app-store-optimization/references/sources.md
new file mode 100644
index 0000000..16ba6bd
--- /dev/null
+++ b/plugins/demand-generation/skills/app-store-optimization/references/sources.md
@@ -0,0 +1,37 @@
+# Sources — `demand-generation:app-store-optimization`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## App Store Review Guidelines
+
+Apple · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://developer.apple.com/app-store/review/guidelines/>
+
+Machine-readable: <https://developer.apple.com/app-store/search/>
+
+**Authoritative for:** Whether a listing, screenshot set, price presentation or subscription flow will be rejected. Binding for anything shipping through the App Store, and copyrighted — cite the rule number, do not mirror the text.
+
+## Children's Online Privacy Protection Rule, 16 CFR 312
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312>
+
+Machine-readable: <https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions>
+
+**Authoritative for:** Whether a property counts as directed to children, and therefore whether behavioral advertising, retargeting pixels or lead capture may run on it at all.
+
+## Google Play Developer Program Policy
+
+Google · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://play.google.com/about/developer-content-policy/>
+
+**Authoritative for:** Store listing, metadata, ads, data-safety and monetization rules for Android distribution, including the explicit prohibitions on keyword stuffing and incentivized ratings.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/experimentation/SKILL.md b/plugins/demand-generation/skills/experimentation/SKILL.md
index 5a6209b..9d47e1e 100644
--- a/plugins/demand-generation/skills/experimentation/SKILL.md
+++ b/plugins/demand-generation/skills/experimentation/SKILL.md
@@ -47,6 +47,13 @@ tests a year — spend them on structural questions, not button colors.
 Keep a log of every test: hypothesis, result, decision. Without it, teams re-run the same tests every
 eighteen months and re-learn the same things.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Client-side and web testing: Optimizely, VWO, AB Tasty, and similar. Warehouse- or
diff --git a/plugins/demand-generation/skills/experimentation/references/sources.md b/plugins/demand-generation/skills/experimentation/references/sources.md
new file mode 100644
index 0000000..740ffaa
--- /dev/null
+++ b/plugins/demand-generation/skills/experimentation/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `demand-generation:experimentation`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## ASA Statement on Statistical Significance and P-Values
+
+American Statistical Association · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.amstat.org/asa/files/pdfs/p-valuestatement.pdf>
+
+**Authoritative for:** What a p-value does and does not mean. It settles the most common error in marketing experimentation, which is reading a test that crossed ninety-five percent as a result.
+
+## Guide to PECR: cookies and similar technologies
+
+UK Information Commissioner's Office · UK · free to use with attribution — credit the publisher
+
+<https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/>
+
+**Authoritative for:** Which trackers are strictly necessary and therefore exempt from consent, and which are not. Analytics, A/B testing and personalization are addressed by name, which is where most internal arguments about test tooling end.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/landing-page-cro-expert/SKILL.md b/plugins/demand-generation/skills/landing-page-cro-expert/SKILL.md
index ff5d9eb..e84693b 100644
--- a/plugins/demand-generation/skills/landing-page-cro-expert/SKILL.md
+++ b/plugins/demand-generation/skills/landing-page-cro-expert/SKILL.md
@@ -70,6 +70,13 @@ objections handled, and visual hierarchy supporting the path.
 Publish the criteria with the score. A page scored 6/10 with no rubric produces an argument; the
 same score with the rubric produces a work list.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Rewrite before diagnosing. Most pages that fail to convert are failing above the fold or off the page entirely, in the traffic.
diff --git a/plugins/demand-generation/skills/landing-page-cro-expert/references/sources.md b/plugins/demand-generation/skills/landing-page-cro-expert/references/sources.md
new file mode 100644
index 0000000..f8a3c10
--- /dev/null
+++ b/plugins/demand-generation/skills/landing-page-cro-expert/references/sources.md
@@ -0,0 +1,49 @@
+# Sources — `demand-generation:landing-page-cro-expert`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## .com Disclosures: How to Make Effective Disclosures in Digital Advertising
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/com-disclosures-how-make-effective-disclosures-digital-advertising>
+
+**Authoritative for:** What 'clear and conspicuous' means on a screen — proximity, hyperlinks, scrolling, pop-ups, and space-constrained formats.
+
+## ASA Statement on Statistical Significance and P-Values
+
+American Statistical Association · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.amstat.org/asa/files/pdfs/p-valuestatement.pdf>
+
+**Authoritative for:** What a p-value does and does not mean. It settles the most common error in marketing experimentation, which is reading a test that crossed ninety-five percent as a result.
+
+## Guidelines 05/2020 on consent under Regulation 2016/679
+
+European Data Protection Board · EU · free to use with attribution — credit the publisher
+
+<https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en>
+
+**Authoritative for:** Whether a consent interface is valid — cookie walls, scroll-as-consent, pre-ticked boxes, granularity and bundling. More decisive in practice than the regulation text, because this is what supervisory authorities apply.
+
+## Guides Against Deceptive Pricing, 16 CFR 233
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-233>
+
+**Authoritative for:** Whether a 'was $X, now $Y', list-price, free-offer or percentage-off claim is lawful as presented.
+
+## Web Content Accessibility Guidelines 2.2
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/WCAG22/>
+
+**Authoritative for:** Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/lead-capture/SKILL.md b/plugins/demand-generation/skills/lead-capture/SKILL.md
index 36b438e..450372d 100644
--- a/plugins/demand-generation/skills/lead-capture/SKILL.md
+++ b/plugins/demand-generation/skills/lead-capture/SKILL.md
@@ -53,6 +53,13 @@ Every field costs conversion. Ask for what you need to do the next step and noth
 — enrichment can fill the rest. Explain any field whose purpose is not obvious, since unexplained
 fields are where people abandon.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Gate something the buyer can get ungated elsewhere in one click.
diff --git a/plugins/demand-generation/skills/lead-capture/references/sources.md b/plugins/demand-generation/skills/lead-capture/references/sources.md
new file mode 100644
index 0000000..d49db1d
--- /dev/null
+++ b/plugins/demand-generation/skills/lead-capture/references/sources.md
@@ -0,0 +1,61 @@
+# Sources — `demand-generation:lead-capture`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## .com Disclosures: How to Make Effective Disclosures in Digital Advertising
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/com-disclosures-how-make-effective-disclosures-digital-advertising>
+
+**Authoritative for:** What 'clear and conspicuous' means on a screen — proximity, hyperlinks, scrolling, pop-ups, and space-constrained formats.
+
+## CAN-SPAM Act: A Compliance Guide for Business
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business>
+
+Machine-readable: <https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316>
+
+**Authoritative for:** The mandatory elements of a US commercial email — header accuracy, subject-line honesty, physical address, opt-out mechanism and the window for honoring it — and that hiring an agency does not move the liability.
+
+## Canada's Anti-Spam Legislation, S.C. 2010 c. 23
+
+Department of Justice Canada · CA · free to use with attribution — credit the publisher
+
+<https://laws-lois.justice.gc.ca/eng/acts/E-1.6/index.html>
+
+**Authoritative for:** Whether you may send a commercial message to a Canadian address at all. CASL is opt-in by default, which inverts the US assumption, and this is the text governing express versus implied consent.
+
+## Children's Online Privacy Protection Rule, 16 CFR 312
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312>
+
+Machine-readable: <https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions>
+
+**Authoritative for:** Whether a property counts as directed to children, and therefore whether behavioral advertising, retargeting pixels or lead capture may run on it at all.
+
+## Delivery restrictions and telephone solicitation rules, 47 CFR 64.1200
+
+US Federal Communications Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200>
+
+**Authoritative for:** The consent standard for marketing SMS and autodialed calls — what prior express written consent requires, how revocation must be handled, and the identification rules. Read the current text rather than a summary; this area moves in court.
+
+## Guidelines 05/2020 on consent under Regulation 2016/679
+
+European Data Protection Board · EU · free to use with attribution — credit the publisher
+
+<https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en>
+
+**Authoritative for:** Whether a consent interface is valid — cookie walls, scroll-as-consent, pre-ticked boxes, granularity and bundling. More decisive in practice than the regulation text, because this is what supervisory authorities apply.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/lifecycle-messaging/SKILL.md b/plugins/demand-generation/skills/lifecycle-messaging/SKILL.md
index 0d749d6..514b384 100644
--- a/plugins/demand-generation/skills/lifecycle-messaging/SKILL.md
+++ b/plugins/demand-generation/skills/lifecycle-messaging/SKILL.md
@@ -77,6 +77,13 @@ it, and never leave it to default to the first line of the body.
 - **Click but no conversion** — the destination, not the email.
 - **Rising unsubscribes** — frequency or relevance. Usually frequency.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Lifecycle automation: Customer.io, Braze, Iterable, Klaviyo for commerce, HubSpot or
diff --git a/plugins/demand-generation/skills/lifecycle-messaging/references/sources.md b/plugins/demand-generation/skills/lifecycle-messaging/references/sources.md
new file mode 100644
index 0000000..9475d37
--- /dev/null
+++ b/plugins/demand-generation/skills/lifecycle-messaging/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `demand-generation:lifecycle-messaging`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## CAN-SPAM Act: A Compliance Guide for Business
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business>
+
+Machine-readable: <https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316>
+
+**Authoritative for:** The mandatory elements of a US commercial email — header accuracy, subject-line honesty, physical address, opt-out mechanism and the window for honoring it — and that hiring an agency does not move the liability.
+
+## Canada's Anti-Spam Legislation, S.C. 2010 c. 23
+
+Department of Justice Canada · CA · free to use with attribution — credit the publisher
+
+<https://laws-lois.justice.gc.ca/eng/acts/E-1.6/index.html>
+
+**Authoritative for:** Whether you may send a commercial message to a Canadian address at all. CASL is opt-in by default, which inverts the US assumption, and this is the text governing express versus implied consent.
+
+## Delivery restrictions and telephone solicitation rules, 47 CFR 64.1200
+
+US Federal Communications Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200>
+
+**Authoritative for:** The consent standard for marketing SMS and autodialed calls — what prior express written consent requires, how revocation must be handled, and the identification rules. Read the current text rather than a summary; this area moves in court.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/listing-distribution/SKILL.md b/plugins/demand-generation/skills/listing-distribution/SKILL.md
index f027ffd..4b0befa 100644
--- a/plugins/demand-generation/skills/listing-distribution/SKILL.md
+++ b/plugins/demand-generation/skills/listing-distribution/SKILL.md
@@ -53,6 +53,13 @@ set is worse than nothing.
 Set a periodic sweep: listings drift out of date, and an aggregator showing your old pricing will
 outrank your own page for some queries.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - List everywhere available. Directories with no traffic cost maintenance and dilute nothing but your attention.
diff --git a/plugins/demand-generation/skills/listing-distribution/references/sources.md b/plugins/demand-generation/skills/listing-distribution/references/sources.md
new file mode 100644
index 0000000..e7a817c
--- /dev/null
+++ b/plugins/demand-generation/skills/listing-distribution/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `demand-generation:listing-distribution`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Product data specification
+
+Google · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://support.google.com/merchants/answer/7052112>
+
+**Authoritative for:** The required attributes, formats and accepted values for a product feed — whether a listing is accepted is a specification question rather than an opinion.
+
+## Schema.org vocabulary
+
+Schema.org community group · global · CC BY-SA — quote with attribution; share-alike, so do not fold into this repository
+
+<https://schema.org/>
+
+Machine-readable: <https://schema.org/version/latest/schemaorg-current-https.jsonld>
+
+**Authoritative for:** The canonical property names and expected types for structured markup. Share-alike, so cite and link rather than folding definitions into your own documentation.
+
+## Structured data markup that Google Search supports
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/appearance/structured-data/search-gallery>
+
+**Authoritative for:** Which structured data types Google actually acts on, as opposed to which exist in the vocabulary. Pair it with schema.org: one defines the vocabulary, the other says what is honored.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/marketing-analytics/SKILL.md b/plugins/demand-generation/skills/marketing-analytics/SKILL.md
index 8c1be80..c2b209a 100644
--- a/plugins/demand-generation/skills/marketing-analytics/SKILL.md
+++ b/plugins/demand-generation/skills/marketing-analytics/SKILL.md
@@ -52,6 +52,13 @@ Show the metric, its comparison period, and the decision it informs. A number wi
 not information. Where a number moved, the report should say why or say that the cause is unknown —
 "unknown" is a legitimate and useful finding.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Product and web analytics: Google Analytics 4, Amplitude, Mixpanel, PostHog, Plausible,
diff --git a/plugins/demand-generation/skills/marketing-analytics/references/sources.md b/plugins/demand-generation/skills/marketing-analytics/references/sources.md
new file mode 100644
index 0000000..8a07084
--- /dev/null
+++ b/plugins/demand-generation/skills/marketing-analytics/references/sources.md
@@ -0,0 +1,49 @@
+# Sources — `demand-generation:marketing-analytics`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## ASA Statement on Statistical Significance and P-Values
+
+American Statistical Association · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.amstat.org/asa/files/pdfs/p-valuestatement.pdf>
+
+**Authoritative for:** What a p-value does and does not mean. It settles the most common error in marketing experimentation, which is reading a test that crossed ninety-five percent as a result.
+
+## Guide to PECR: cookies and similar technologies
+
+UK Information Commissioner's Office · UK · free to use with attribution — credit the publisher
+
+<https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/>
+
+**Authoritative for:** Which trackers are strictly necessary and therefore exempt from consent, and which are not. Analytics, A/B testing and personalization are addressed by name, which is where most internal arguments about test tooling end.
+
+## Guidelines 05/2020 on consent under Regulation 2016/679
+
+European Data Protection Board · EU · free to use with attribution — credit the publisher
+
+<https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en>
+
+**Authoritative for:** Whether a consent interface is valid — cookie walls, scroll-as-consent, pre-ticked boxes, granularity and bundling. More decisive in practice than the regulation text, because this is what supervisory authorities apply.
+
+## MRC standards and guidelines
+
+Media Rating Council · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://mediaratingcouncil.org/standards-and-guidelines>
+
+**Authoritative for:** The primary definitions behind ad measurement — what counts as an impression, what counts as viewable, and what counts as invalid traffic. This is what every vendor dashboard claims to implement.
+
+## Standard Definitions: final dispositions of case codes and outcome rates for surveys
+
+American Association for Public Opinion Research · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://aapor.org/standards-and-ethics/standard-definitions/>
+
+**Authoritative for:** How a response rate, cooperation rate, refusal rate and contact rate are computed. The arbiter when two people report different response rates from the same fieldwork.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/paid-advertising/SKILL.md b/plugins/demand-generation/skills/paid-advertising/SKILL.md
index ae2ed2a..13cd6c9 100644
--- a/plugins/demand-generation/skills/paid-advertising/SKILL.md
+++ b/plugins/demand-generation/skills/paid-advertising/SKILL.md
@@ -60,6 +60,13 @@ conversion rate (is the page delivering), cost per acquisition (is it economic),
 quality (did those customers stay). Stopping at cost per acquisition is how channels get scaled that
 are buying bad customers cheaply.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 The platforms themselves: Google Ads, Meta Ads Manager, LinkedIn Campaign Manager, Microsoft
diff --git a/plugins/demand-generation/skills/paid-advertising/references/sources.md b/plugins/demand-generation/skills/paid-advertising/references/sources.md
new file mode 100644
index 0000000..9bb8f6c
--- /dev/null
+++ b/plugins/demand-generation/skills/paid-advertising/references/sources.md
@@ -0,0 +1,67 @@
+# Sources — `demand-generation:paid-advertising`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## .com Disclosures: How to Make Effective Disclosures in Digital Advertising
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/com-disclosures-how-make-effective-disclosures-digital-advertising>
+
+**Authoritative for:** What 'clear and conspicuous' means on a screen — proximity, hyperlinks, scrolling, pop-ups, and space-constrained formats.
+
+## Children's Online Privacy Protection Rule, 16 CFR 312
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312>
+
+Machine-readable: <https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions>
+
+**Authoritative for:** Whether a property counts as directed to children, and therefore whether behavioral advertising, retargeting pixels or lead capture may run on it at all.
+
+## Guides Against Deceptive Pricing, 16 CFR 233
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-233>
+
+**Authoritative for:** Whether a 'was $X, now $Y', list-price, free-offer or percentage-off claim is lawful as presented.
+
+## MRC standards and guidelines
+
+Media Rating Council · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://mediaratingcouncil.org/standards-and-guidelines>
+
+**Authoritative for:** The primary definitions behind ad measurement — what counts as an impression, what counts as viewable, and what counts as invalid traffic. This is what every vendor dashboard claims to implement.
+
+## Native Advertising: A Guide for Businesses
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/native-advertising-guide-businesses>
+
+**Authoritative for:** When sponsored content is deceptively formatted, and what labeling makes a paid placement non-deceptive.
+
+## Policy Statement Regarding Advertising Substantiation
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/legal-library/browse/ftc-policy-statement-regarding-advertising-substantiation>
+
+**Authoritative for:** What evidence you must already hold before making an objective claim. This is the document that answers whether you may say 'number one', 'three times faster' or 'clinically proven'.
+
+## Product data specification
+
+Google · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://support.google.com/merchants/answer/7052112>
+
+**Authoritative for:** The required attributes, formats and accepted values for a product feed — whether a listing is accepted is a specification question rather than an opinion.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/programmatic-seo/SKILL.md b/plugins/demand-generation/skills/programmatic-seo/SKILL.md
index 09d1c7f..cfd837b 100644
--- a/plugins/demand-generation/skills/programmatic-seo/SKILL.md
+++ b/plugins/demand-generation/skills/programmatic-seo/SKILL.md
@@ -42,6 +42,13 @@ Stale programmatic pages rot faster than editorial ones because there are so man
 cadence tied to the data source, and prune: pages with no impressions after two quarters should be
 consolidated or removed. Volume is not the goal.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Generate pages for instances with no data.
diff --git a/plugins/demand-generation/skills/programmatic-seo/references/sources.md b/plugins/demand-generation/skills/programmatic-seo/references/sources.md
new file mode 100644
index 0000000..7e39070
--- /dev/null
+++ b/plugins/demand-generation/skills/programmatic-seo/references/sources.md
@@ -0,0 +1,53 @@
+# Sources — `demand-generation:programmatic-seo`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Google crawlers and user-triggered fetchers
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/crawling-indexing/overview-google-crawlers>
+
+Machine-readable: <https://developers.google.com/search/docs/crawling-indexing/robots/intro>
+
+**Authoritative for:** Which user agents Google operates and what each one is for, including the separate control over training and AI surfaces — the question behind every robots.txt argument about blocking AI.
+
+## RFC 9309: Robots Exclusion Protocol
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc9309.html>
+
+**Authoritative for:** The formal parsing rules for robots.txt — precedence, wildcards, size limits, and what a crawler is obliged to do. Settles at the protocol level whether disallow prevents indexing, which it does not.
+
+## Schema.org vocabulary
+
+Schema.org community group · global · CC BY-SA — quote with attribution; share-alike, so do not fold into this repository
+
+<https://schema.org/>
+
+Machine-readable: <https://schema.org/version/latest/schemaorg-current-https.jsonld>
+
+**Authoritative for:** The canonical property names and expected types for structured markup. Share-alike, so cite and link rather than folding definitions into your own documentation.
+
+## Spam policies for Google web search
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/essentials/spam-policies>
+
+**Authoritative for:** Whether a tactic is sanctionable — scaled content abuse, site reputation abuse, expired-domain abuse, cloaking, doorway pages. The only authoritative answer to whether a programmatic build will be penalized.
+
+## Structured data markup that Google Search supports
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/appearance/structured-data/search-gallery>
+
+**Authoritative for:** Which structured data types Google actually acts on, as opposed to which exist in the vocabulary. Pair it with schema.org: one defines the vocabulary, the other says what is honored.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/demand-generation/skills/seo-strategy/SKILL.md b/plugins/demand-generation/skills/seo-strategy/SKILL.md
index eab9bf9..ac58c43 100644
--- a/plugins/demand-generation/skills/seo-strategy/SKILL.md
+++ b/plugins/demand-generation/skills/seo-strategy/SKILL.md
@@ -83,6 +83,13 @@ Rank fixes by traffic at risk against effort. In practice the order is almost al
 problems, then intent mismatch on high-value pages, then internal linking, then structured data,
 then everything else.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Chase rankings for a term the page cannot satisfy. The click arrives, bounces, and teaches the engine the page was wrong.
diff --git a/plugins/demand-generation/skills/seo-strategy/references/sources.md b/plugins/demand-generation/skills/seo-strategy/references/sources.md
new file mode 100644
index 0000000..871cbdc
--- /dev/null
+++ b/plugins/demand-generation/skills/seo-strategy/references/sources.md
@@ -0,0 +1,53 @@
+# Sources — `demand-generation:seo-strategy`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Google crawlers and user-triggered fetchers
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/crawling-indexing/overview-google-crawlers>
+
+Machine-readable: <https://developers.google.com/search/docs/crawling-indexing/robots/intro>
+
+**Authoritative for:** Which user agents Google operates and what each one is for, including the separate control over training and AI surfaces — the question behind every robots.txt argument about blocking AI.
+
+## RFC 9309: Robots Exclusion Protocol
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc9309.html>
+
+**Authoritative for:** The formal parsing rules for robots.txt — precedence, wildcards, size limits, and what a crawler is obliged to do. Settles at the protocol level whether disallow prevents indexing, which it does not.
+
+## Schema.org vocabulary
+
+Schema.org community group · global · CC BY-SA — quote with attribution; share-alike, so do not fold into this repository
+
+<https://schema.org/>
+
+Machine-readable: <https://schema.org/version/latest/schemaorg-current-https.jsonld>
+
+**Authoritative for:** The canonical property names and expected types for structured markup. Share-alike, so cite and link rather than folding definitions into your own documentation.
+
+## Spam policies for Google web search
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/essentials/spam-policies>
+
+**Authoritative for:** Whether a tactic is sanctionable — scaled content abuse, site reputation abuse, expired-domain abuse, cloaking, doorway pages. The only authoritative answer to whether a programmatic build will be penalized.
+
+## Structured data markup that Google Search supports
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/appearance/structured-data/search-gallery>
+
+**Authoritative for:** Which structured data types Google actually acts on, as opposed to which exist in the vocabulary. Pair it with schema.org: one defines the vocabulary, the other says what is honored.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/executive/skills/ai-research-analyst/SKILL.md b/plugins/executive/skills/ai-research-analyst/SKILL.md
index f3fb88a..ab1ca72 100644
--- a/plugins/executive/skills/ai-research-analyst/SKILL.md
+++ b/plugins/executive/skills/ai-research-analyst/SKILL.md
@@ -56,6 +56,13 @@ Score against criteria stated and weighted **before** the analysis. Weighting af
 answer you already preferred. Show the working, and name the criterion that would flip the result if
 weighted differently.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Present a range as a point estimate.
diff --git a/plugins/executive/skills/ai-research-analyst/references/sources.md b/plugins/executive/skills/ai-research-analyst/references/sources.md
new file mode 100644
index 0000000..064643f
--- /dev/null
+++ b/plugins/executive/skills/ai-research-analyst/references/sources.md
@@ -0,0 +1,29 @@
+# Sources — `executive:ai-research-analyst`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## NIST AI 600-1: Generative AI Profile
+
+NIST · US · public domain (US government) — quote freely
+
+<https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence>
+
+Machine-readable: <https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf>
+
+**Authoritative for:** Which risks are unique to or amplified by generative models, as distinct from general machine learning risk. Settles the claim that generative systems are just another model.
+
+## NIST AI Risk Management Framework, AI 100-1
+
+NIST · US · public domain (US government) — quote freely
+
+<https://www.nist.gov/itl/ai-risk-management-framework>
+
+Machine-readable: <https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf>
+
+**Authoritative for:** What the four AI risk functions are and what an organization must be able to evidence under each. It ends the argument about what claiming to have an AI governance program has to mean concretely.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/executive/skills/chief-executive/SKILL.md b/plugins/executive/skills/chief-executive/SKILL.md
index 72e2f17..5bda063 100644
--- a/plugins/executive/skills/chief-executive/SKILL.md
+++ b/plugins/executive/skills/chief-executive/SKILL.md
@@ -126,6 +126,13 @@ These are the artifacts of record. Where two of them disagree, this one is right
 
 Nothing — this is the escalation endpoint. Where a decision is genuinely the owner's, say so plainly rather than deciding for them.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Do not do the functional work yourself — delegate to the responsible chief and hold them to a return contract
diff --git a/plugins/executive/skills/chief-executive/references/sources.md b/plugins/executive/skills/chief-executive/references/sources.md
new file mode 100644
index 0000000..50e6f70
--- /dev/null
+++ b/plugins/executive/skills/chief-executive/references/sources.md
@@ -0,0 +1,27 @@
+# Sources — `executive:chief-executive`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Delaware General Corporation Law
+
+State of Delaware · US-DE · public domain — quote freely
+
+<https://delcode.delaware.gov/title8/c001/index.html>
+
+**Authoritative for:** What a board may and may not do — board power, interested-director transactions, exculpation, merger mechanics and appraisal rights. Primary law for most US public companies and nearly every venture-backed one.
+
+## Exempt offerings and Regulation D
+
+US Securities and Exchange Commission · US · public domain (US government) — quote freely
+
+<https://www.sec.gov/education/smallbusiness/exemptofferings>
+
+Machine-readable: <https://www.ecfr.gov/current/title-17/chapter-II/part-230>
+
+**Authoritative for:** Whether a private raise is lawful — whether general solicitation is permitted, how many non-accredited investors may participate, what disclosure is owed and when the filing is due.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/executive/skills/fundraising-and-investor-relations/SKILL.md b/plugins/executive/skills/fundraising-and-investor-relations/SKILL.md
index c074e27..51d67d2 100644
--- a/plugins/executive/skills/fundraising-and-investor-relations/SKILL.md
+++ b/plugins/executive/skills/fundraising-and-investor-relations/SKILL.md
@@ -78,6 +78,13 @@ Board material goes out days ahead and is read before the meeting, so the meetin
 rather than presentation. Bring the real questions, including the ones you do not have answers to —
 a board only shown finished thinking cannot help with anything and eventually stops trying.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Optimize a term sheet on valuation without modeling the preference stack at mediocre exits.
diff --git a/plugins/executive/skills/fundraising-and-investor-relations/references/sources.md b/plugins/executive/skills/fundraising-and-investor-relations/references/sources.md
new file mode 100644
index 0000000..3b237bd
--- /dev/null
+++ b/plugins/executive/skills/fundraising-and-investor-relations/references/sources.md
@@ -0,0 +1,43 @@
+# Sources — `executive:fundraising-and-investor-relations`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 17 CFR Part 243 — Regulation FD
+
+US Securities and Exchange Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-17/chapter-II/part-243>
+
+**Authoritative for:** When selective disclosure of material nonpublic information triggers a mandatory public disclosure, and on what timeline. The rule that decides whether a given investor conversation was lawful.
+
+## Delaware General Corporation Law
+
+State of Delaware · US-DE · public domain — quote freely
+
+<https://delcode.delaware.gov/title8/c001/index.html>
+
+**Authoritative for:** What a board may and may not do — board power, interested-director transactions, exculpation, merger mechanics and appraisal rights. Primary law for most US public companies and nearly every venture-backed one.
+
+## Exempt offerings and Regulation D
+
+US Securities and Exchange Commission · US · public domain (US government) — quote freely
+
+<https://www.sec.gov/education/smallbusiness/exemptofferings>
+
+Machine-readable: <https://www.ecfr.gov/current/title-17/chapter-II/part-230>
+
+**Authoritative for:** Whether a private raise is lawful — whether general solicitation is permitted, how many non-accredited investors may participate, what disclosure is owed and when the filing is due.
+
+## NYSE Listed Company Manual
+
+New York Stock Exchange · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://nyse.wolterskluwer.cloud/listed-company-manual>
+
+**Authoritative for:** What a listed issuer must do to stay listed — board independence tests, committee composition, shareholder approval thresholds and immediate disclosure obligations. Binding as a listing condition.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/finance/skills/capital-structure-and-covenants/SKILL.md b/plugins/finance/skills/capital-structure-and-covenants/SKILL.md
index 08fadb5..31c71c5 100644
--- a/plugins/finance/skills/capital-structure-and-covenants/SKILL.md
+++ b/plugins/finance/skills/capital-structure-and-covenants/SKILL.md
@@ -57,6 +57,13 @@ equity cure is permitted and how often, and whether cross-default provisions pul
 in behind this one. Consequences escalate rather than arriving all at once — a fee, then a rate
 step-up, then tightened covenants, then a cash sweep, then acceleration.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Sign a facility without modeling its covenants against the downside case.
diff --git a/plugins/finance/skills/capital-structure-and-covenants/references/sources.md b/plugins/finance/skills/capital-structure-and-covenants/references/sources.md
new file mode 100644
index 0000000..8c10b01
--- /dev/null
+++ b/plugins/finance/skills/capital-structure-and-covenants/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `finance:capital-structure-and-covenants`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Interagency Guidance on Leveraged Lending, SR 13-3
+
+Board of Governors of the Federal Reserve System · US · public domain (US government) — quote freely
+
+<https://www.federalreserve.gov/supervisionreg/srletters/sr1303.htm>
+
+**Authoritative for:** What regulators treat as a leveraged transaction and the repayment-capacity, covenant and valuation analysis they expect behind a credit agreement. Supervisory guidance rather than a rule — the analytical lens, not binding law.
+
+## Non-GAAP financial measures — compliance and disclosure interpretations
+
+US Securities and Exchange Commission, Division of Corporation Finance · US · public domain (US government) — quote freely
+
+<https://www.sec.gov/corpfin/non-gaap-financial-measures>
+
+**Authoritative for:** When a non-GAAP measure becomes misleading and therefore prohibited — individually tailored recognition, excluding normal operating costs, improper labeling, and the equal-prominence requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/finance/skills/cost-accounting/SKILL.md b/plugins/finance/skills/cost-accounting/SKILL.md
index 7028758..d48dd1a 100644
--- a/plugins/finance/skills/cost-accounting/SKILL.md
+++ b/plugins/finance/skills/cost-accounting/SKILL.md
@@ -65,6 +65,13 @@ This is the single most useful technique here and the one most often skipped. Wi
 shift toward an expensive product gets reported as a pricing win, and a discount gets buried under
 volume growth.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Allocate overhead on revenue and present the result as a product margin.
diff --git a/plugins/finance/skills/cost-accounting/references/sources.md b/plugins/finance/skills/cost-accounting/references/sources.md
new file mode 100644
index 0000000..4c95aca
--- /dev/null
+++ b/plugins/finance/skills/cost-accounting/references/sources.md
@@ -0,0 +1,27 @@
+# Sources — `finance:cost-accounting`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 48 CFR Chapter 99 — Cost Accounting Standards
+
+Cost Accounting Standards Board · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-48/chapter-99>
+
+**Authoritative for:** For covered government contractors, the mandatory treatment of cost allocation — consistency in estimating and reporting, indirect and home-office allocation, and the disclosure statement. Where it applies, cost accounting stops being a matter of preference.
+
+## Federal Acquisition Regulation
+
+US General Services Administration, on behalf of the FAR Council · US · public domain (US government) — quote freely
+
+<https://www.acquisition.gov/browse/index/far>
+
+Machine-readable: <https://www.acquisition.gov/far/part-31>
+
+**Authoritative for:** What a competitive sourcing process must do to be lawful — solicitation types, evaluation criteria, competition requirements, and how contract type allocates risk. Binding for federal buying and the reference everywhere else.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/finance/skills/tax/references/sources.md b/plugins/finance/skills/tax/references/sources.md
index 2e40e1a..5171b60 100644
--- a/plugins/finance/skills/tax/references/sources.md
+++ b/plugins/finance/skills/tax/references/sources.md
@@ -12,6 +12,14 @@ US Internal Revenue Service · US · public domain (US government) — quote fre
 
 **Authoritative for:** The minimum interest rate an intercompany or related-party loan must carry to avoid imputed interest, published monthly.
 
+## IRS Publication 15-B: Employer's Tax Guide to Fringe Benefits
+
+US Internal Revenue Service · US · public domain (US government) — quote freely
+
+<https://www.irs.gov/pub/irs-pdf/p15b.pdf>
+
+**Authoritative for:** Which fringe benefits are excludable from income and which are taxable, with valuation and withholding treatment. Reissued annually at a stable address, so it is never stale.
+
 ## IRS forms, instructions and publications
 
 US Internal Revenue Service · US · public domain (US government) — quote freely
diff --git a/plugins/finance/skills/unit-economics/SKILL.md b/plugins/finance/skills/unit-economics/SKILL.md
index 0e3a7f3..05e9612 100644
--- a/plugins/finance/skills/unit-economics/SKILL.md
+++ b/plugins/finance/skills/unit-economics/SKILL.md
@@ -43,6 +43,13 @@ Good unit economics by segment tell you where to spend. Bad ones tell you to fix
 scaling — no acquisition efficiency rescues a negative contribution margin, it only reaches the
 loss faster.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Compare acquisition cost against revenue rather than contribution.
diff --git a/plugins/finance/skills/unit-economics/references/sources.md b/plugins/finance/skills/unit-economics/references/sources.md
new file mode 100644
index 0000000..e1d74d8
--- /dev/null
+++ b/plugins/finance/skills/unit-economics/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `finance:unit-economics`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Commission Guidance on Management's Discussion and Analysis, Release 33-10751
+
+US Securities and Exchange Commission · US · public domain (US government) — quote freely
+
+<https://www.federalregister.gov/documents/2020/02/25/2020-02296/commission-guidance-on-managements-discussion-and-analysis-of-financial-condition-and-results-of>
+
+**Authoritative for:** What a company must do when it publishes an operating metric — define it, disclose how it is calculated, apply it consistently, and explain any change in method. It disciplines metrics like recurring revenue and net retention without defining them, which is the honest ceiling on authority here.
+
+## Non-GAAP financial measures — compliance and disclosure interpretations
+
+US Securities and Exchange Commission, Division of Corporation Finance · US · public domain (US government) — quote freely
+
+<https://www.sec.gov/corpfin/non-gaap-financial-measures>
+
+**Authoritative for:** When a non-GAAP measure becomes misleading and therefore prohibited — individually tailored recognition, excluding normal operating costs, improper labeling, and the equal-prominence requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/it-operations/skills/backup-and-recovery/SKILL.md b/plugins/it-operations/skills/backup-and-recovery/SKILL.md
index 8f70a8d..7d8f08c 100644
--- a/plugins/it-operations/skills/backup-and-recovery/SKILL.md
+++ b/plugins/it-operations/skills/backup-and-recovery/SKILL.md
@@ -55,6 +55,13 @@ the only honest input to an RTO, and it is invariably longer than assumed.
 Test the full-scale case at least annually. Restoring one file proves the mechanism; restoring the
 system proves the plan.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Backup platforms: Veeam, Rubrik, Cohesity, Commvault, Acronis, and similar.
diff --git a/plugins/it-operations/skills/backup-and-recovery/references/sources.md b/plugins/it-operations/skills/backup-and-recovery/references/sources.md
new file mode 100644
index 0000000..63c994c
--- /dev/null
+++ b/plugins/it-operations/skills/backup-and-recovery/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `it-operations:backup-and-recovery`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## NIST SP 800-34: Contingency Planning Guide for Federal Information Systems
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final>
+
+**Authoritative for:** What recovery time and recovery point objectives formally mean, what a business impact analysis must contain, and which plan covers what — contingency, disaster recovery, continuity of operations.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/it-operations/skills/cloud-administration/SKILL.md b/plugins/it-operations/skills/cloud-administration/SKILL.md
index ee9b6fb..bf637a9 100644
--- a/plugins/it-operations/skills/cloud-administration/SKILL.md
+++ b/plugins/it-operations/skills/cloud-administration/SKILL.md
@@ -82,6 +82,13 @@ sync. Retention settings are not backups, and the recycle bin is not a recovery
 deliberately what needs independent protection under `it-operations:backup-and-recovery` rather
 than assuming the vendor's durability promise covers your mistakes.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Platforms: AWS, Microsoft Azure, Google Cloud, and similar.
diff --git a/plugins/it-operations/skills/cloud-administration/references/sources.md b/plugins/it-operations/skills/cloud-administration/references/sources.md
new file mode 100644
index 0000000..3f82c04
--- /dev/null
+++ b/plugins/it-operations/skills/cloud-administration/references/sources.md
@@ -0,0 +1,57 @@
+# Sources — `it-operations:cloud-administration`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## AWS Well-Architected Framework
+
+Amazon Web Services · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html>
+
+**Authoritative for:** What AWS itself considers a correct design on AWS, and therefore what an AWS architecture review will be graded against.
+
+## Azure Well-Architected Framework
+
+Microsoft · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://learn.microsoft.com/en-us/azure/well-architected/>
+
+**Authoritative for:** Microsoft's own normative design guidance for Azure, and the basis of its assessment tooling.
+
+## CIS Benchmarks
+
+Center for Internet Security · global · **account required — cite it; the user fetches it**
+
+<https://www.cisecurity.org/cis-benchmarks>
+
+**Authoritative for:** The consensus hardening baseline for a specific product version, with two profile levels. The non-defense equivalent of a STIG and the baseline most commercial audits cite.
+
+## Google Cloud Architecture Framework
+
+Google Cloud · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://cloud.google.com/architecture/framework>
+
+**Authoritative for:** Google Cloud's own normative design guidance, and what its architecture reviews assess against.
+
+## NIST SP 800-145: The NIST Definition of Cloud Computing
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/145/final>
+
+**Authoritative for:** What counts as infrastructure, platform or software as a service, and what public, private, community and hybrid mean. Still the definition contracts and audits cite.
+
+## NIST SP 800-207: Zero Trust Architecture
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/207/final>
+
+**Authoritative for:** What zero trust denotes — the policy engine, administrator and enforcement point model, and the tenets — so that a vendor cannot redefine the term mid-conversation.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/it-operations/skills/endpoint-management/SKILL.md b/plugins/it-operations/skills/endpoint-management/SKILL.md
index 6ff271d..c3f0360 100644
--- a/plugins/it-operations/skills/endpoint-management/SKILL.md
+++ b/plugins/it-operations/skills/endpoint-management/SKILL.md
@@ -52,6 +52,13 @@ one that gets left in a taxi.
 Departures are coordinated with `people:onboarding-and-offboarding`, with asset return tracked
 against `it-operations:it-asset-management`.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Windows: Microsoft Intune, Configuration Manager, Ivanti, and similar. Apple: Jamf Pro,
diff --git a/plugins/it-operations/skills/endpoint-management/references/sources.md b/plugins/it-operations/skills/endpoint-management/references/sources.md
new file mode 100644
index 0000000..54b474d
--- /dev/null
+++ b/plugins/it-operations/skills/endpoint-management/references/sources.md
@@ -0,0 +1,43 @@
+# Sources — `it-operations:endpoint-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## CIS Benchmarks
+
+Center for Internet Security · global · **account required — cite it; the user fetches it**
+
+<https://www.cisecurity.org/cis-benchmarks>
+
+**Authoritative for:** The consensus hardening baseline for a specific product version, with two profile levels. The non-defense equivalent of a STIG and the baseline most commercial audits cite.
+
+## NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/124/r2/final>
+
+**Authoritative for:** The baseline control set for mobile endpoints and the deployment-model distinctions — corporate-owned, personally enabled, bring-your-own — that mobile policy arguments turn on.
+
+## NIST SP 800-40: Guide to Enterprise Patch Management Planning
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/40/r4/final>
+
+**Authoritative for:** What a defensible patch program contains — maintenance windows, phased deployment, and the position that leaving something unpatched requires documented compensating controls rather than silence.
+
+## Security Technical Implementation Guides
+
+Defense Information Systems Agency, US Department of Defense · US · public domain (US government) — quote freely
+
+<https://public.cyber.mil/stigs/>
+
+Machine-readable: <https://public.cyber.mil/stigs/downloads/>
+
+**Authoritative for:** The exact required configuration of a given operating system, hypervisor or appliance, setting by setting with severity. When two administrators disagree about a hardening value, this states the required one.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/it-operations/skills/identity-lifecycle-administration/SKILL.md b/plugins/it-operations/skills/identity-lifecycle-administration/SKILL.md
index b82cf69..a1626b7 100644
--- a/plugins/it-operations/skills/identity-lifecycle-administration/SKILL.md
+++ b/plugins/it-operations/skills/identity-lifecycle-administration/SKILL.md
@@ -54,6 +54,13 @@ formality that certifies whatever exists.
 Hunt specifically for orphaned accounts — accounts with no owner, service accounts nobody claims,
 and credentials that have not been used in months but still work.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Directory and SSO: Microsoft Entra ID, Okta, Google Workspace, JumpCloud, and similar.
diff --git a/plugins/it-operations/skills/identity-lifecycle-administration/references/sources.md b/plugins/it-operations/skills/identity-lifecycle-administration/references/sources.md
new file mode 100644
index 0000000..a2a1305
--- /dev/null
+++ b/plugins/it-operations/skills/identity-lifecycle-administration/references/sources.md
@@ -0,0 +1,53 @@
+# Sources — `it-operations:identity-lifecycle-administration`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## NIST SP 800-207: Zero Trust Architecture
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/207/final>
+
+**Authoritative for:** What zero trust denotes — the policy engine, administrator and enforcement point model, and the tenets — so that a vendor cannot redefine the term mid-conversation.
+
+## NIST SP 800-63: Digital Identity Guidelines
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/63/4/final>
+
+Machine-readable: <https://pages.nist.gov/800-63-4/>
+
+**Authoritative for:** What each identity, authenticator and federation assurance level requires — and, notably, that forced periodic password rotation and composition rules are not among them.
+
+## OpenID Connect Core 1.0
+
+OpenID Foundation · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://openid.net/specs/openid-connect-core-1_0.html>
+
+**Authoritative for:** What an ID token is, which claims are standard, and what a conformant party must do in each flow. Settles arguments that begin 'our provider does it differently'.
+
+## RFC 7644: System for Cross-domain Identity Management Protocol
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc7644.html>
+
+Machine-readable: <https://www.rfc-editor.org/rfc/rfc7643.html>
+
+**Authoritative for:** How provisioning and deprovisioning are transacted between an identity provider and a downstream application — endpoints, patch semantics, filtering, and the canonical user and group attributes.
+
+## RFC 9700: Best Current Practice for OAuth 2.0 Security
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc9700.html>
+
+**Authoritative for:** Which OAuth 2.0 patterns remain permitted — that the implicit grant and password grant must not be used, that PKCE is required, and that redirect URIs must match exactly.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/it-operations/skills/network-administration/SKILL.md b/plugins/it-operations/skills/network-administration/SKILL.md
index 01e0fea..b4fe299 100644
--- a/plugins/it-operations/skills/network-administration/SKILL.md
+++ b/plugins/it-operations/skills/network-administration/SKILL.md
@@ -78,6 +78,13 @@ address range someone reused. Budget for a periodic physical visit — remote ma
 show you the cable run someone added, and the sites without permanent IT staff are exactly the ones
 that drift furthest from the standard.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Run a flat network and rely on host controls alone.
diff --git a/plugins/it-operations/skills/network-administration/references/sources.md b/plugins/it-operations/skills/network-administration/references/sources.md
new file mode 100644
index 0000000..913dcd9
--- /dev/null
+++ b/plugins/it-operations/skills/network-administration/references/sources.md
@@ -0,0 +1,45 @@
+# Sources — `it-operations:network-administration`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## NIST SP 800-207: Zero Trust Architecture
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/207/final>
+
+**Authoritative for:** What zero trust denotes — the policy engine, administrator and enforcement point model, and the tenets — so that a vendor cannot redefine the term mid-conversation.
+
+## RFC 1035: Domain Names — Implementation and Specification
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc1035.html>
+
+Machine-readable: <https://www.rfc-editor.org/rfc/rfc1034.html>
+
+**Authoritative for:** DNS record semantics and constraints, including why a CNAME cannot coexist with other records at the same name, and how TTL behaves.
+
+## RFC 1918: Address Allocation for Private Internets
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc1918.html>
+
+**Authoritative for:** Which address ranges are private and must not be routed publicly. The definitive answer whenever an addressing plan is proposed.
+
+## Security Technical Implementation Guides
+
+Defense Information Systems Agency, US Department of Defense · US · public domain (US government) — quote freely
+
+<https://public.cyber.mil/stigs/>
+
+Machine-readable: <https://public.cyber.mil/stigs/downloads/>
+
+**Authoritative for:** The exact required configuration of a given operating system, hypervisor or appliance, setting by setting with severity. When two administrators disagree about a hardening value, this states the required one.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/it-operations/skills/systems-administration/SKILL.md b/plugins/it-operations/skills/systems-administration/SKILL.md
index f1894e0..0532521 100644
--- a/plugins/it-operations/skills/systems-administration/SKILL.md
+++ b/plugins/it-operations/skills/systems-administration/SKILL.md
@@ -52,6 +52,13 @@ An unmanaged system is a system nobody patches. Reconcile what is running agains
 `it-operations:it-asset-management` regularly, and treat anything unaccounted for as urgent — the
 server nobody owns is the one still running an unsupported operating system.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Repair a drifted system without correcting the baseline that let it drift.
diff --git a/plugins/it-operations/skills/systems-administration/references/sources.md b/plugins/it-operations/skills/systems-administration/references/sources.md
new file mode 100644
index 0000000..d8a12dd
--- /dev/null
+++ b/plugins/it-operations/skills/systems-administration/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `it-operations:systems-administration`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## CIS Benchmarks
+
+Center for Internet Security · global · **account required — cite it; the user fetches it**
+
+<https://www.cisecurity.org/cis-benchmarks>
+
+**Authoritative for:** The consensus hardening baseline for a specific product version, with two profile levels. The non-defense equivalent of a STIG and the baseline most commercial audits cite.
+
+## NIST SP 800-40: Guide to Enterprise Patch Management Planning
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/40/r4/final>
+
+**Authoritative for:** What a defensible patch program contains — maintenance windows, phased deployment, and the position that leaving something unpatched requires documented compensating controls rather than silence.
+
+## Security Technical Implementation Guides
+
+Defense Information Systems Agency, US Department of Defense · US · public domain (US government) — quote freely
+
+<https://public.cyber.mil/stigs/>
+
+Machine-readable: <https://public.cyber.mil/stigs/downloads/>
+
+**Authoritative for:** The exact required configuration of a given operating system, hypervisor or appliance, setting by setting with severity. When two administrators disagree about a hardening value, this states the required one.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/it-operations/skills/telephony-and-conferencing/SKILL.md b/plugins/it-operations/skills/telephony-and-conferencing/SKILL.md
index 22ac25b..268cd52 100644
--- a/plugins/it-operations/skills/telephony-and-conferencing/SKILL.md
+++ b/plugins/it-operations/skills/telephony-and-conferencing/SKILL.md
@@ -75,6 +75,13 @@ summaries are records too, and they are increasingly produced automatically by t
 whether or not anyone chose it. `legal-risk:privacy-and-data-protection` owns the obligations; this
 skill owns knowing the feature creates them.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Deploy softphones without solving location for emergency calls.
diff --git a/plugins/it-operations/skills/telephony-and-conferencing/references/sources.md b/plugins/it-operations/skills/telephony-and-conferencing/references/sources.md
new file mode 100644
index 0000000..ed0e935
--- /dev/null
+++ b/plugins/it-operations/skills/telephony-and-conferencing/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `it-operations:telephony-and-conferencing`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 47 CFR Part 9 — 911 requirements
+
+US Federal Communications Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-9>
+
+**Authoritative for:** The obligations on a multi-line telephone system — direct 911 dialing, on-site notification and dispatchable location. A hard compliance question for anyone administering a phone or conferencing platform in the US, and one that is usually discovered late.
+
+## RFC 3261: SIP — Session Initiation Protocol
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc3261.html>
+
+Machine-readable: <https://www.rfc-editor.org/rfc/rfc3550.html>
+
+**Authoritative for:** SIP signaling semantics — dialog and transaction state, response code meanings, registration, and the role of proxies. What an interop dispute between a phone system and a carrier is settled against.
+
+## WebRTC: Real-Time Communication in Browsers
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/webrtc/>
+
+**Authoritative for:** The browser API surface and behavior for real-time audio, video and data — the normative reference for what a conferencing client can and must do.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/it-operations/skills/virtualization-operations/SKILL.md b/plugins/it-operations/skills/virtualization-operations/SKILL.md
index 6f68110..268df91 100644
--- a/plugins/it-operations/skills/virtualization-operations/SKILL.md
+++ b/plugins/it-operations/skills/virtualization-operations/SKILL.md
@@ -81,6 +81,13 @@ Hybrid is the normal end state, not a transitional embarrassment. What makes it
 two operating models with two sets of habits, so decide deliberately which one owns identity,
 monitoring, and backup rather than letting each side answer differently.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Provision a guest without an owner, a lifetime, and a decommission trigger.
diff --git a/plugins/it-operations/skills/virtualization-operations/references/sources.md b/plugins/it-operations/skills/virtualization-operations/references/sources.md
new file mode 100644
index 0000000..f8e9f71
--- /dev/null
+++ b/plugins/it-operations/skills/virtualization-operations/references/sources.md
@@ -0,0 +1,27 @@
+# Sources — `it-operations:virtualization-operations`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## CIS Benchmarks
+
+Center for Internet Security · global · **account required — cite it; the user fetches it**
+
+<https://www.cisecurity.org/cis-benchmarks>
+
+**Authoritative for:** The consensus hardening baseline for a specific product version, with two profile levels. The non-defense equivalent of a STIG and the baseline most commercial audits cite.
+
+## Security Technical Implementation Guides
+
+Defense Information Systems Agency, US Department of Defense · US · public domain (US government) — quote freely
+
+<https://public.cyber.mil/stigs/>
+
+Machine-readable: <https://public.cyber.mil/stigs/downloads/>
+
+**Authoritative for:** The exact required configuration of a given operating system, hypervisor or appliance, setting by setting with severity. When two administrators disagree about a hardening value, this states the required one.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/legal-risk/skills/corporate-governance/SKILL.md b/plugins/legal-risk/skills/corporate-governance/SKILL.md
index db76664..686881c 100644
--- a/plugins/legal-risk/skills/corporate-governance/SKILL.md
+++ b/plugins/legal-risk/skills/corporate-governance/SKILL.md
@@ -64,6 +64,13 @@ Some responsibilities sit between functions and get dropped. When one appears, d
 right home in the abstract — assign it to whoever bears the consequence if it fails, and record the
 assignment. An owner who is imperfect beats an owner who is undecided.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Take an action that requires board or member approval and paper it afterward.
diff --git a/plugins/legal-risk/skills/corporate-governance/references/sources.md b/plugins/legal-risk/skills/corporate-governance/references/sources.md
new file mode 100644
index 0000000..6e53949
--- /dev/null
+++ b/plugins/legal-risk/skills/corporate-governance/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `legal-risk:corporate-governance`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 17 CFR Part 243 — Regulation FD
+
+US Securities and Exchange Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-17/chapter-II/part-243>
+
+**Authoritative for:** When selective disclosure of material nonpublic information triggers a mandatory public disclosure, and on what timeline. The rule that decides whether a given investor conversation was lawful.
+
+## Delaware General Corporation Law
+
+State of Delaware · US-DE · public domain — quote freely
+
+<https://delcode.delaware.gov/title8/c001/index.html>
+
+**Authoritative for:** What a board may and may not do — board power, interested-director transactions, exculpation, merger mechanics and appraisal rights. Primary law for most US public companies and nearly every venture-backed one.
+
+## NYSE Listed Company Manual
+
+New York Stock Exchange · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://nyse.wolterskluwer.cloud/listed-company-manual>
+
+**Authoritative for:** What a listed issuer must do to stay listed — board independence tests, committee composition, shareholder approval thresholds and immediate disclosure obligations. Binding as a listing condition.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/legal-risk/skills/disputes-and-legal-holds/SKILL.md b/plugins/legal-risk/skills/disputes-and-legal-holds/SKILL.md
index 0c59d6a..aa3afa0 100644
--- a/plugins/legal-risk/skills/disputes-and-legal-holds/SKILL.md
+++ b/plugins/legal-risk/skills/disputes-and-legal-holds/SKILL.md
@@ -68,6 +68,13 @@ the cost most consistently omitted and is often the largest.
 Consider what a settlement signals to other potential claimants, and get releases that are broad
 enough to actually end it.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Wait for a filing before preserving.
diff --git a/plugins/legal-risk/skills/disputes-and-legal-holds/references/sources.md b/plugins/legal-risk/skills/disputes-and-legal-holds/references/sources.md
new file mode 100644
index 0000000..992d580
--- /dev/null
+++ b/plugins/legal-risk/skills/disputes-and-legal-holds/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `legal-risk:disputes-and-legal-holds`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Federal Rules of Civil Procedure
+
+Administrative Office of the US Courts · US · public domain (US government) — quote freely
+
+<https://www.uscourts.gov/forms-rules/current-rules-practice-procedure/federal-rules-civil-procedure>
+
+**Authoritative for:** The duty to preserve and what follows from failing it — proportionality, the discovery conference, form of production, and the exclusive framework and intent threshold for sanctions over lost electronic evidence.
+
+## General Records Schedules
+
+US National Archives and Records Administration · US · public domain (US government) — quote freely
+
+<https://www.archives.gov/records-mgmt/grs>
+
+**Authoritative for:** Minimum retention and disposition periods for common administrative record classes. Binding on federal agencies only — for a private company it is a defensible published baseline rather than law, which is still better than arguing from habit.
+
+## The Sedona Principles and Commentary on Legal Holds
+
+The Sedona Conference · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.thesedonaconference.org/publications>
+
+**Authoritative for:** The operational standard of care for electronic discovery that federal courts routinely cite — when the duty to preserve triggers, the scope of a defensible hold, and custodian notice practice. Free to download, copyrighted, so cite rather than reproduce.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/legal-risk/skills/intellectual-property/references/sources.md b/plugins/legal-risk/skills/intellectual-property/references/sources.md
index 3d7bf4a..486de37 100644
--- a/plugins/legal-risk/skills/intellectual-property/references/sources.md
+++ b/plugins/legal-risk/skills/intellectual-property/references/sources.md
@@ -4,6 +4,14 @@
 
 Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
 
+## Compendium of U.S. Copyright Office Practices
+
+US Copyright Office · US · public domain (US government) — quote freely
+
+<https://www.copyright.gov/comp3/>
+
+**Authoritative for:** What is protectable and registrable, including the Office's position on human authorship for machine-generated material and how much of a layout or typeface is protectable at all.
+
 ## SPDX License List
 
 The Linux Foundation · global · CC BY — quote with attribution
@@ -14,6 +22,14 @@ Machine-readable: <https://github.com/spdx/license-list-data>
 
 **Authoritative for:** The canonical identifier and full text of every common open-source license — the reference for an inbound license review, and for what a share-alike obligation actually says.
 
+## Trademark Manual of Examining Procedure
+
+US Patent and Trademark Office · US · public domain (US government) — quote freely
+
+<https://tmep.uspto.gov/>
+
+**Authoritative for:** Whether a proposed name, logo or tagline is registrable — distinctiveness, descriptiveness refusals, likelihood of confusion, specimen requirements. Settles whether you can actually own a name.
+
 ## USPTO search and guidance
 
 US Patent and Trademark Office · US · public domain (US government) — quote freely
diff --git a/plugins/legal-risk/skills/regulatory-compliance/references/sources.md b/plugins/legal-risk/skills/regulatory-compliance/references/sources.md
index 278b3e2..1c68503 100644
--- a/plugins/legal-risk/skills/regulatory-compliance/references/sources.md
+++ b/plugins/legal-risk/skills/regulatory-compliance/references/sources.md
@@ -56,6 +56,14 @@ Publications Office of the European Union · EU · free to use with attribution
 
 **Authoritative for:** The operative text of the GDPR. EU legal texts are reusable with attribution under the Commission's reuse decision, so this is quotable where a national summary is not.
 
+## Regulation (EU) 2024/1689 — the AI Act
+
+Publications Office of the European Union · EU · free to use with attribution — credit the publisher
+
+<https://eur-lex.europa.eu/eli/reg/2024/1689/oj>
+
+**Authoritative for:** Whether an AI system is prohibited, high-risk or limited-risk in the EU and what obligations attach. Binding law rather than guidance, and only the Official Journal version is authentic.
+
 ## SANS Information Security Policy Templates
 
 SANS Institute · global · **read and cite only — copyrighted, do not reproduce**
diff --git a/plugins/marketing/skills/behavioral-marketing/SKILL.md b/plugins/marketing/skills/behavioral-marketing/SKILL.md
index 185e4d1..1bbe390 100644
--- a/plugins/marketing/skills/behavioral-marketing/SKILL.md
+++ b/plugins/marketing/skills/behavioral-marketing/SKILL.md
@@ -70,6 +70,13 @@ buy anyway.
   Treat every application as a hypothesis to test rather than a known quantity — this is where
   behavioral marketing most often overreaches.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Deploy an effect without being able to name the mechanism. A tactic borrowed without its mechanism fails silently in a context that differs in ways nobody checked.
diff --git a/plugins/marketing/skills/behavioral-marketing/references/sources.md b/plugins/marketing/skills/behavioral-marketing/references/sources.md
new file mode 100644
index 0000000..ba90bf1
--- /dev/null
+++ b/plugins/marketing/skills/behavioral-marketing/references/sources.md
@@ -0,0 +1,51 @@
+# Sources — `marketing:behavioral-marketing`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## CCPA regulations, California Code of Regulations title 11
+
+California Privacy Protection Agency · US-CA · public domain — quote freely
+
+<https://cppa.ca.gov/regulations/consumer_privacy_act.html>
+
+**Authoritative for:** Symmetry in choice, as law. It settles whether a consent flow where accepting is one click and declining is three is permissible — converting what is usually argued as design taste into a compliance question.
+
+## Children's Online Privacy Protection Rule, 16 CFR 312
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312>
+
+Machine-readable: <https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions>
+
+**Authoritative for:** Whether a property counts as directed to children, and therefore whether behavioral advertising, retargeting pixels or lead capture may run on it at all.
+
+## Delivery restrictions and telephone solicitation rules, 47 CFR 64.1200
+
+US Federal Communications Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200>
+
+**Authoritative for:** The consent standard for marketing SMS and autodialed calls — what prior express written consent requires, how revocation must be handled, and the identification rules. Read the current text rather than a summary; this area moves in court.
+
+## Guide to PECR: cookies and similar technologies
+
+UK Information Commissioner's Office · UK · free to use with attribution — credit the publisher
+
+<https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/>
+
+**Authoritative for:** Which trackers are strictly necessary and therefore exempt from consent, and which are not. Analytics, A/B testing and personalization are addressed by name, which is where most internal arguments about test tooling end.
+
+## Guidelines 05/2020 on consent under Regulation 2016/679
+
+European Data Protection Board · EU · free to use with attribution — credit the publisher
+
+<https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en>
+
+**Authoritative for:** Whether a consent interface is valid — cookie walls, scroll-as-consent, pre-ticked boxes, granularity and bundling. More decisive in practice than the regulation text, because this is what supervisory authorities apply.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/content-strategy/SKILL.md b/plugins/marketing/skills/content-strategy/SKILL.md
index 73d1c9b..65a375c 100644
--- a/plugins/marketing/skills/content-strategy/SKILL.md
+++ b/plugins/marketing/skills/content-strategy/SKILL.md
@@ -48,6 +48,13 @@ everything on traffic is why content programs drift toward the reach end and sta
 Set a review point where a topic that is not working gets dropped. Content strategies fail by
 accumulation.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Claim a territory you cannot sustain publishing on. Withdrawing from one costs more than never entering it.
diff --git a/plugins/marketing/skills/content-strategy/references/sources.md b/plugins/marketing/skills/content-strategy/references/sources.md
new file mode 100644
index 0000000..d92c90a
--- /dev/null
+++ b/plugins/marketing/skills/content-strategy/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `marketing:content-strategy`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Native Advertising: A Guide for Businesses
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/native-advertising-guide-businesses>
+
+**Authoritative for:** When sponsored content is deceptively formatted, and what labeling makes a paid placement non-deceptive.
+
+## Spam policies for Google web search
+
+Google · global · CC BY — quote with attribution
+
+<https://developers.google.com/search/docs/essentials/spam-policies>
+
+**Authoritative for:** Whether a tactic is sanctionable — scaled content abuse, site reputation abuse, expired-domain abuse, cloaking, doorway pages. The only authoritative answer to whether a programmatic build will be penalized.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/customer-research/SKILL.md b/plugins/marketing/skills/customer-research/SKILL.md
index 33998ba..5e9e8ef 100644
--- a/plugins/marketing/skills/customer-research/SKILL.md
+++ b/plugins/marketing/skills/customer-research/SKILL.md
@@ -38,6 +38,13 @@ would change if it is true. A finding that changes nothing is trivia.
 Separate what people **said**, what they **did**, and what you **inferred**. Conflating the three is
 the most common way research misleads.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Recruit only happy customers. The sample that answers your email is not your market.
diff --git a/plugins/marketing/skills/customer-research/references/sources.md b/plugins/marketing/skills/customer-research/references/sources.md
new file mode 100644
index 0000000..dfdae89
--- /dev/null
+++ b/plugins/marketing/skills/customer-research/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `marketing:customer-research`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Standard Definitions: final dispositions of case codes and outcome rates for surveys
+
+American Association for Public Opinion Research · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://aapor.org/standards-and-ethics/standard-definitions/>
+
+**Authoritative for:** How a response rate, cooperation rate, refusal rate and contact rate are computed. The arbiter when two people report different response rates from the same fieldwork.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/events-and-field-marketing/SKILL.md b/plugins/marketing/skills/events-and-field-marketing/SKILL.md
index db9640b..b764c5b 100644
--- a/plugins/marketing/skills/events-and-field-marketing/SKILL.md
+++ b/plugins/marketing/skills/events-and-field-marketing/SKILL.md
@@ -55,6 +55,13 @@ Track influenced pipeline with the assumption stated, alongside the honest direc
 compare cost per opportunity against your other channels through
 `demand-generation:marketing-analytics`.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Event and webinar platforms, roughly by scale: Luma or Zoom Webinars for small and recurring
diff --git a/plugins/marketing/skills/events-and-field-marketing/references/sources.md b/plugins/marketing/skills/events-and-field-marketing/references/sources.md
new file mode 100644
index 0000000..5696556
--- /dev/null
+++ b/plugins/marketing/skills/events-and-field-marketing/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `marketing:events-and-field-marketing`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 2010 ADA Standards for Accessible Design
+
+US Department of Justice · US · public domain (US government) — quote freely
+
+<https://www.ada.gov/law-and-regs/design-standards/2010-stds/>
+
+**Authoritative for:** The enforceable dimensional requirements for an accessible facility — routes, clearances, reach ranges, restrooms, seating. Applies to a workplace and to an event venue alike.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/marketing-copywriting/SKILL.md b/plugins/marketing/skills/marketing-copywriting/SKILL.md
index e8a2744..02aab21 100644
--- a/plugins/marketing/skills/marketing-copywriting/SKILL.md
+++ b/plugins/marketing/skills/marketing-copywriting/SKILL.md
@@ -50,6 +50,13 @@ Empty openers ("In today's fast-paced world"), we-focused framing where you-focu
 that weaken a true claim, feature lists with no consequence attached, and any adjective a competitor
 could equally use.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Write before you know what the reader should do next.
diff --git a/plugins/marketing/skills/marketing-copywriting/references/sources.md b/plugins/marketing/skills/marketing-copywriting/references/sources.md
new file mode 100644
index 0000000..bf9a0e1
--- /dev/null
+++ b/plugins/marketing/skills/marketing-copywriting/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `marketing:marketing-copywriting`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## .com Disclosures: How to Make Effective Disclosures in Digital Advertising
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/com-disclosures-how-make-effective-disclosures-digital-advertising>
+
+**Authoritative for:** What 'clear and conspicuous' means on a screen — proximity, hyperlinks, scrolling, pop-ups, and space-constrained formats.
+
+## Guides Against Deceptive Pricing, 16 CFR 233
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-233>
+
+**Authoritative for:** Whether a 'was $X, now $Y', list-price, free-offer or percentage-off claim is lawful as presented.
+
+## Policy Statement Regarding Advertising Substantiation
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/legal-library/browse/ftc-policy-statement-regarding-advertising-substantiation>
+
+**Authoritative for:** What evidence you must already hold before making an objective claim. This is the document that answers whether you may say 'number one', 'three times faster' or 'clinically proven'.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/newsletter-writer/SKILL.md b/plugins/marketing/skills/newsletter-writer/SKILL.md
index 837e02a..9c4e9ea 100644
--- a/plugins/marketing/skills/newsletter-writer/SKILL.md
+++ b/plugins/marketing/skills/newsletter-writer/SKILL.md
@@ -82,6 +82,13 @@ read-aloud pass catches what silent reading never does.
 One issue contains several short-form posts, a talk track, and often a longer piece. Plan which
 before writing, so the sections that should stand alone are written to.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Write a subject line the opening does not pay off. It buys one open and costs the next.
diff --git a/plugins/marketing/skills/newsletter-writer/references/sources.md b/plugins/marketing/skills/newsletter-writer/references/sources.md
new file mode 100644
index 0000000..a58a629
--- /dev/null
+++ b/plugins/marketing/skills/newsletter-writer/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `marketing:newsletter-writer`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## CAN-SPAM Act: A Compliance Guide for Business
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business>
+
+Machine-readable: <https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316>
+
+**Authoritative for:** The mandatory elements of a US commercial email — header accuracy, subject-line honesty, physical address, opt-out mechanism and the window for honoring it — and that hiring an agency does not move the liability.
+
+## Canada's Anti-Spam Legislation, S.C. 2010 c. 23
+
+Department of Justice Canada · CA · free to use with attribution — credit the publisher
+
+<https://laws-lois.justice.gc.ca/eng/acts/E-1.6/index.html>
+
+**Authoritative for:** Whether you may send a commercial message to a Canadian address at all. CASL is opt-in by default, which inverts the US assumption, and this is the text governing express versus implied consent.
+
+## Web Content Accessibility Guidelines 2.2
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/WCAG22/>
+
+**Authoritative for:** Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/partnership-marketing/SKILL.md b/plugins/marketing/skills/partnership-marketing/SKILL.md
index 901ab20..a69cf2c 100644
--- a/plugins/marketing/skills/partnership-marketing/SKILL.md
+++ b/plugins/marketing/skills/partnership-marketing/SKILL.md
@@ -48,6 +48,13 @@ Attribute honestly. Partnership traffic is often assisted rather than last-touch
 attribution will under-count it and you will kill something that was working. Agree the measurement
 method before launch, when neither side is defending a result.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Partner with someone whose audience you have not actually looked at.
diff --git a/plugins/marketing/skills/partnership-marketing/references/sources.md b/plugins/marketing/skills/partnership-marketing/references/sources.md
new file mode 100644
index 0000000..5c2479f
--- /dev/null
+++ b/plugins/marketing/skills/partnership-marketing/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `marketing:partnership-marketing`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Disclosures 101 for Social Media Influencers
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/disclosures-101-social-media-influencers>
+
+**Authoritative for:** Where in a post a disclosure has to sit for the regulator to treat it as clear and conspicuous — the placement question the regulation leaves open.
+
+## Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR 255
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255>
+
+**Authoritative for:** Whether a given influencer, affiliate, employee or review arrangement requires disclosure, and what counts as an adequate one. The regulation itself, rather than a summary of it.
+
+## Native Advertising: A Guide for Businesses
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/native-advertising-guide-businesses>
+
+**Authoritative for:** When sponsored content is deceptively formatted, and what labeling makes a paid placement non-deceptive.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/positioning-and-messaging/SKILL.md b/plugins/marketing/skills/positioning-and-messaging/SKILL.md
index 9203a74..70f119d 100644
--- a/plugins/marketing/skills/positioning-and-messaging/SKILL.md
+++ b/plugins/marketing/skills/positioning-and-messaging/SKILL.md
@@ -38,6 +38,13 @@ Read the one-liner to someone in the target segment and ask what they think it d
 for. If they answer with your category but the wrong use case, the frame is wrong. If they answer
 with a competitor's name, the differentiation is not landing.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Position against a competitor the buyer has not heard of.
diff --git a/plugins/marketing/skills/positioning-and-messaging/references/sources.md b/plugins/marketing/skills/positioning-and-messaging/references/sources.md
new file mode 100644
index 0000000..8567403
--- /dev/null
+++ b/plugins/marketing/skills/positioning-and-messaging/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `marketing:positioning-and-messaging`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Policy Statement Regarding Advertising Substantiation
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/legal-library/browse/ftc-policy-statement-regarding-advertising-substantiation>
+
+**Authoritative for:** What evidence you must already hold before making an objective claim. This is the document that answers whether you may say 'number one', 'three times faster' or 'clinically proven'.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/product-launch/SKILL.md b/plugins/marketing/skills/product-launch/SKILL.md
index 716596d..da93856 100644
--- a/plugins/marketing/skills/product-launch/SKILL.md
+++ b/plugins/marketing/skills/product-launch/SKILL.md
@@ -66,6 +66,13 @@ intended people are using the thing and whether it did what the roadmap claimed.
 Decide the number before launch — how many of which accounts, doing what, by when. A launch
 evaluated on engagement metrics chosen afterward is always a success and teaches you nothing.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Announce externally before support and sales can answer the obvious questions.
diff --git a/plugins/marketing/skills/product-launch/references/sources.md b/plugins/marketing/skills/product-launch/references/sources.md
new file mode 100644
index 0000000..2bce492
--- /dev/null
+++ b/plugins/marketing/skills/product-launch/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `marketing:product-launch`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## App Store Review Guidelines
+
+Apple · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://developer.apple.com/app-store/review/guidelines/>
+
+Machine-readable: <https://developer.apple.com/app-store/search/>
+
+**Authoritative for:** Whether a listing, screenshot set, price presentation or subscription flow will be rejected. Binding for anything shipping through the App Store, and copyrighted — cite the rule number, do not mirror the text.
+
+## Google Play Developer Program Policy
+
+Google · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://play.google.com/about/developer-content-policy/>
+
+**Authoritative for:** Store listing, metadata, ads, data-safety and monetization rules for Android distribution, including the explicit prohibitions on keyword stuffing and incentivized ratings.
+
+## Policy Statement Regarding Advertising Substantiation
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/legal-library/browse/ftc-policy-statement-regarding-advertising-substantiation>
+
+**Authoritative for:** What evidence you must already hold before making an objective claim. This is the document that answers whether you may say 'number one', 'three times faster' or 'clinically proven'.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/public-relations/SKILL.md b/plugins/marketing/skills/public-relations/SKILL.md
index 9890d6c..e977a18 100644
--- a/plugins/marketing/skills/public-relations/SKILL.md
+++ b/plugins/marketing/skills/public-relations/SKILL.md
@@ -47,6 +47,13 @@ explicitly agreed in advance — and even then, assume it may not hold.
 - Correct genuine errors privately, with evidence, and specifically. Vague complaints about tone
   achieve nothing.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Media databases and pitching: Muck Rack, Cision, Prowly, Roxhill, and similar. They are expensive,
diff --git a/plugins/marketing/skills/public-relations/references/sources.md b/plugins/marketing/skills/public-relations/references/sources.md
new file mode 100644
index 0000000..c2cd976
--- /dev/null
+++ b/plugins/marketing/skills/public-relations/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `marketing:public-relations`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR 255
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255>
+
+**Authoritative for:** Whether a given influencer, affiliate, employee or review arrangement requires disclosure, and what counts as an adequate one. The regulation itself, rather than a summary of it.
+
+## Native Advertising: A Guide for Businesses
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/native-advertising-guide-businesses>
+
+**Authoritative for:** When sponsored content is deceptively formatted, and what labeling makes a paid placement non-deceptive.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/social-post-craft/SKILL.md b/plugins/marketing/skills/social-post-craft/SKILL.md
index c654824..b871fa7 100644
--- a/plugins/marketing/skills/social-post-craft/SKILL.md
+++ b/plugins/marketing/skills/social-post-craft/SKILL.md
@@ -52,6 +52,13 @@ most platforms strip formatting.
 
 A draft that fails these gets rewritten, not published with a caveat.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Scheduling and publishing: Buffer, Hootsuite, Later, Sprout Social, Typefully, and similar. Native
diff --git a/plugins/marketing/skills/social-post-craft/references/sources.md b/plugins/marketing/skills/social-post-craft/references/sources.md
new file mode 100644
index 0000000..74cee79
--- /dev/null
+++ b/plugins/marketing/skills/social-post-craft/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `marketing:social-post-craft`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Disclosures 101 for Social Media Influencers
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/disclosures-101-social-media-influencers>
+
+**Authoritative for:** Where in a post a disclosure has to sit for the regulator to treat it as clear and conspicuous — the placement question the regulation leaves open.
+
+## Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR 255
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255>
+
+**Authoritative for:** Whether a given influencer, affiliate, employee or review arrangement requires disclosure, and what counts as an adequate one. The regulation itself, rather than a summary of it.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/video-content/SKILL.md b/plugins/marketing/skills/video-content/SKILL.md
index 9c9f448..5e2dddc 100644
--- a/plugins/marketing/skills/video-content/SKILL.md
+++ b/plugins/marketing/skills/video-content/SKILL.md
@@ -55,6 +55,13 @@ Plan derivatives before filming, not after. Segments intended to stand alone get
 alone. Extracting short-form from a video not built for it produces clips that need context they do
 not have.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Editing: DaVinci Resolve, Adobe Premiere Pro, Final Cut Pro, CapCut, and similar; Descript for
diff --git a/plugins/marketing/skills/video-content/references/sources.md b/plugins/marketing/skills/video-content/references/sources.md
new file mode 100644
index 0000000..cc3c581
--- /dev/null
+++ b/plugins/marketing/skills/video-content/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `marketing:video-content`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Disclosures 101 for Social Media Influencers
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/disclosures-101-social-media-influencers>
+
+**Authoritative for:** Where in a post a disclosure has to sit for the regulator to treat it as clear and conspicuous — the placement question the regulation leaves open.
+
+## MRC standards and guidelines
+
+Media Rating Council · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://mediaratingcouncil.org/standards-and-guidelines>
+
+**Authoritative for:** The primary definitions behind ad measurement — what counts as an impression, what counts as viewable, and what counts as invalid traffic. This is what every vendor dashboard claims to implement.
+
+## Web Content Accessibility Guidelines 2.2
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/WCAG22/>
+
+**Authoritative for:** Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/visual-content/SKILL.md b/plugins/marketing/skills/visual-content/SKILL.md
index 5562dae..e4d3503 100644
--- a/plugins/marketing/skills/visual-content/SKILL.md
+++ b/plugins/marketing/skills/visual-content/SKILL.md
@@ -51,6 +51,13 @@ constraints. Generate one concept per image. Then check the output actually rend
 text correctly and matches the brand palette — generated imagery drifts, and drifted brand color is
 worse than no brand color.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Choose a visual format before knowing whether the content is a sequence, a comparison, or a single claim.
diff --git a/plugins/marketing/skills/visual-content/references/sources.md b/plugins/marketing/skills/visual-content/references/sources.md
new file mode 100644
index 0000000..d482ef3
--- /dev/null
+++ b/plugins/marketing/skills/visual-content/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `marketing:visual-content`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Web Content Accessibility Guidelines 2.2
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/WCAG22/>
+
+**Authoritative for:** Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/marketing/skills/youtube-producer/SKILL.md b/plugins/marketing/skills/youtube-producer/SKILL.md
index 240f713..d7d58cb 100644
--- a/plugins/marketing/skills/youtube-producer/SKILL.md
+++ b/plugins/marketing/skills/youtube-producer/SKILL.md
@@ -88,6 +88,13 @@ different kinds of value teaches the audience nothing about whether to click the
 Plan repurposing before filming — segments meant to stand alone as short-form get shot to stand
 alone.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Produce an idea whose title you cannot write. If the title is hard, the idea is not yet clear.
diff --git a/plugins/marketing/skills/youtube-producer/references/sources.md b/plugins/marketing/skills/youtube-producer/references/sources.md
new file mode 100644
index 0000000..4080ff5
--- /dev/null
+++ b/plugins/marketing/skills/youtube-producer/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `marketing:youtube-producer`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Disclosures 101 for Social Media Influencers
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/disclosures-101-social-media-influencers>
+
+**Authoritative for:** Where in a post a disclosure has to sit for the regulator to treat it as clear and conspicuous — the placement question the regulation leaves open.
+
+## Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR 255
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255>
+
+**Authoritative for:** Whether a given influencer, affiliate, employee or review arrangement requires disclosure, and what counts as an adequate one. The regulation itself, rather than a summary of it.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/operations/skills/business-continuity-and-resilience/references/sources.md b/plugins/operations/skills/business-continuity-and-resilience/references/sources.md
index 298cda6..b51000e 100644
--- a/plugins/operations/skills/business-continuity-and-resilience/references/sources.md
+++ b/plugins/operations/skills/business-continuity-and-resilience/references/sources.md
@@ -4,6 +4,22 @@
 
 Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
 
+## NIST SP 800-34: Contingency Planning Guide for Federal Information Systems
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final>
+
+**Authoritative for:** What recovery time and recovery point objectives formally mean, what a business impact analysis must contain, and which plan covers what — contingency, disaster recovery, continuity of operations.
+
+## National Incident Management System doctrine
+
+Federal Emergency Management Agency · US · public domain (US government) — quote freely
+
+<https://www.fema.gov/emergency-managers/nims>
+
+**Authoritative for:** Who is in charge during an incident and how command transfers — incident command structure, unified command, span of control, and the action-plan cycle. Settles the role and escalation disputes that incidents actually produce.
+
 ## OSHA law and regulations
 
 US Occupational Safety and Health Administration · US · public domain (US government) — quote freely
diff --git a/plugins/operations/skills/capacity-and-demand-planning/SKILL.md b/plugins/operations/skills/capacity-and-demand-planning/SKILL.md
index f19b273..96b04ab 100644
--- a/plugins/operations/skills/capacity-and-demand-planning/SKILL.md
+++ b/plugins/operations/skills/capacity-and-demand-planning/SKILL.md
@@ -51,6 +51,13 @@ Before adding capacity, establish which it is:
 
 The tell: if work spends most of its life waiting rather than being worked, it is a flow problem.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Plan against nominal headcount rather than effective capacity.
diff --git a/plugins/operations/skills/capacity-and-demand-planning/references/sources.md b/plugins/operations/skills/capacity-and-demand-planning/references/sources.md
new file mode 100644
index 0000000..69615ce
--- /dev/null
+++ b/plugins/operations/skills/capacity-and-demand-planning/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `operations:capacity-and-demand-planning`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 49 CFR Part 395 — hours of service of drivers
+
+Federal Motor Carrier Safety Administration · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-49/subtitle-B/chapter-III/subchapter-B/part-395>
+
+**Authoritative for:** How many hours a commercial driver may lawfully drive and work, and what records prove it. A hard cap that any realistic transit or capacity plan has to respect.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/operations/skills/facilities-and-workplace/SKILL.md b/plugins/operations/skills/facilities-and-workplace/SKILL.md
index 05e70bf..cfca38c 100644
--- a/plugins/operations/skills/facilities-and-workplace/SKILL.md
+++ b/plugins/operations/skills/facilities-and-workplace/SKILL.md
@@ -56,6 +56,13 @@ Absorbs the administrative-services function — mail, reception, supplies, work
 sits here rather than as a separate department, alongside `operations:vendor-management` for the
 suppliers delivering it.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Size space from headcount rather than observed occupancy.
diff --git a/plugins/operations/skills/facilities-and-workplace/references/sources.md b/plugins/operations/skills/facilities-and-workplace/references/sources.md
new file mode 100644
index 0000000..cdcb971
--- /dev/null
+++ b/plugins/operations/skills/facilities-and-workplace/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `operations:facilities-and-workplace`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 2010 ADA Standards for Accessible Design
+
+US Department of Justice · US · public domain (US government) — quote freely
+
+<https://www.ada.gov/law-and-regs/design-standards/2010-stds/>
+
+**Authoritative for:** The enforceable dimensional requirements for an accessible facility — routes, clearances, reach ranges, restrooms, seating. Applies to a workplace and to an event venue alike.
+
+## 29 CFR Part 1910 — occupational safety and health standards
+
+US Occupational Safety and Health Administration · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XVII/part-1910>
+
+**Authoritative for:** Whether a workplace configuration is lawful — egress, emergency action plans, walking and working surfaces, hazard communication. Settles facilities questions that are otherwise argued as preference.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/operations/skills/incident-management/SKILL.md b/plugins/operations/skills/incident-management/SKILL.md
index a2b72eb..ffd7b59 100644
--- a/plugins/operations/skills/incident-management/SKILL.md
+++ b/plugins/operations/skills/incident-management/SKILL.md
@@ -79,6 +79,13 @@ actually happened.
 does not, and an unclosed action from a previous incident is the most common finding in the next
 one. Track them to completion somewhere visible, with owners and dates.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Debug while nobody is commanding.
diff --git a/plugins/operations/skills/incident-management/references/sources.md b/plugins/operations/skills/incident-management/references/sources.md
new file mode 100644
index 0000000..08d2854
--- /dev/null
+++ b/plugins/operations/skills/incident-management/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `operations:incident-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## NIST SP 800-34: Contingency Planning Guide for Federal Information Systems
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final>
+
+**Authoritative for:** What recovery time and recovery point objectives formally mean, what a business impact analysis must contain, and which plan covers what — contingency, disaster recovery, continuity of operations.
+
+## NIST SP 800-61: Incident Response Recommendations and Considerations
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/61/r3/final>
+
+**Authoritative for:** What an incident response capability must contain and what evidence must be captured at each stage. The current revision is a substantial rewrite that drops the older four-phase framing, so do not mix guidance across revisions.
+
+## National Incident Management System doctrine
+
+Federal Emergency Management Agency · US · public domain (US government) — quote freely
+
+<https://www.fema.gov/emergency-managers/nims>
+
+**Authoritative for:** Who is in charge during an incident and how command transfers — incident command structure, unified command, span of control, and the action-plan cycle. Settles the role and escalation disputes that incidents actually produce.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/operations/skills/process-design/SKILL.md b/plugins/operations/skills/process-design/SKILL.md
index d2fdd2c..b4eba60 100644
--- a/plugins/operations/skills/process-design/SKILL.md
+++ b/plugins/operations/skills/process-design/SKILL.md
@@ -51,6 +51,13 @@ system: required fields, blocking gates, defaults that are correct, automated ha
 **Never fix a recurring failure with a reminder.** If people are forgetting a step, the system
 permits forgetting it. Fix that.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Redesign from the documented process. Map what people actually do first.
diff --git a/plugins/operations/skills/process-design/references/sources.md b/plugins/operations/skills/process-design/references/sources.md
new file mode 100644
index 0000000..9df792e
--- /dev/null
+++ b/plugins/operations/skills/process-design/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `operations:process-design`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 9 CFR Part 417 — Hazard Analysis and Critical Control Point systems
+
+US Department of Agriculture, Food Safety and Inspection Service · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-9/chapter-III/subchapter-E/part-417>
+
+**Authoritative for:** What a HACCP plan must contain for meat and poultry — control points, critical limits, monitoring, corrective action and reassessment. A different regulator from the FDA, and which one governs depends on the product.
+
+## ISO 9001 — Quality management systems: requirements
+
+ISO · global · **sold — cite the identifier only, never the text**
+
+<https://www.iso.org/standard/62085.html>
+
+**Authoritative for:** Whether a quality system is certifiable — the auditable requirements a nonconformity procedure or management review is judged against. Sold, so cite the clause number and never the wording.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/operations/skills/procurement-and-sourcing/SKILL.md b/plugins/operations/skills/procurement-and-sourcing/SKILL.md
index 9104639..f7c91c4 100644
--- a/plugins/operations/skills/procurement-and-sourcing/SKILL.md
+++ b/plugins/operations/skills/procurement-and-sourcing/SKILL.md
@@ -55,6 +55,13 @@ deciding that trade.
 Route the resulting terms through `legal-risk:contract-review`, and anything touching customer data
 through `legal-risk:privacy-and-data-protection` before signature rather than after.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Procure-to-pay: Coupa, SAP Ariba, Zip, Precoro, and similar. At smaller scale a request
diff --git a/plugins/operations/skills/procurement-and-sourcing/references/sources.md b/plugins/operations/skills/procurement-and-sourcing/references/sources.md
new file mode 100644
index 0000000..7ef4afd
--- /dev/null
+++ b/plugins/operations/skills/procurement-and-sourcing/references/sources.md
@@ -0,0 +1,43 @@
+# Sources — `operations:procurement-and-sourcing`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 21 CFR Part 117 — preventive controls for human food
+
+US Food and Drug Administration · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117>
+
+**Authoritative for:** Whether a food operation's hazard analysis, preventive controls and supplier verification are legally sufficient. Binding law rather than guidance.
+
+## Federal Acquisition Regulation
+
+US General Services Administration, on behalf of the FAR Council · US · public domain (US government) — quote freely
+
+<https://www.acquisition.gov/browse/index/far>
+
+Machine-readable: <https://www.acquisition.gov/far/part-31>
+
+**Authoritative for:** What a competitive sourcing process must do to be lawful — solicitation types, evaluation criteria, competition requirements, and how contract type allocates risk. Binding for federal buying and the reference everywhere else.
+
+## Incoterms rules
+
+International Chamber of Commerce · global · **sold — cite the identifier only, never the text**
+
+<https://iccwbo.org/business-solutions/incoterms-rules/>
+
+**Authoritative for:** Exactly where risk, cost and delivery obligation transfer between buyer and seller under a named three-letter term. Courts and contracts defer to it, and the full rules text is sold — name the term, do not reproduce the definition.
+
+## Interagency Guidance on Third-Party Relationships: Risk Management
+
+Federal Reserve, FDIC and OCC · US · public domain (US government) — quote freely
+
+<https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm>
+
+**Authoritative for:** What due diligence, contract terms, monitoring and termination planning a vendor relationship requires, scaled to how critical it is. The clearest published statement of the lifecycle, and the one regulated buyers will hold you to.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/operations/skills/quality-management/SKILL.md b/plugins/operations/skills/quality-management/SKILL.md
index 7b2ad15..04798ef 100644
--- a/plugins/operations/skills/quality-management/SKILL.md
+++ b/plugins/operations/skills/quality-management/SKILL.md
@@ -52,6 +52,13 @@ and pair any rate metric with a volume metric so improvement by doing less is vi
 
 Escaped defects — those the customer found — are the honest measure. Everything else is a proxy.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 A quality management system is a regulatory purchase before it is an operational one. Greenlight
diff --git a/plugins/operations/skills/quality-management/references/sources.md b/plugins/operations/skills/quality-management/references/sources.md
new file mode 100644
index 0000000..ce415c1
--- /dev/null
+++ b/plugins/operations/skills/quality-management/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `operations:quality-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 21 CFR Part 117 — preventive controls for human food
+
+US Food and Drug Administration · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117>
+
+**Authoritative for:** Whether a food operation's hazard analysis, preventive controls and supplier verification are legally sufficient. Binding law rather than guidance.
+
+## 9 CFR Part 417 — Hazard Analysis and Critical Control Point systems
+
+US Department of Agriculture, Food Safety and Inspection Service · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-9/chapter-III/subchapter-E/part-417>
+
+**Authoritative for:** What a HACCP plan must contain for meat and poultry — control points, critical limits, monitoring, corrective action and reassessment. A different regulator from the FDA, and which one governs depends on the product.
+
+## ISO 9001 — Quality management systems: requirements
+
+ISO · global · **sold — cite the identifier only, never the text**
+
+<https://www.iso.org/standard/62085.html>
+
+**Authoritative for:** Whether a quality system is certifiable — the auditable requirements a nonconformity procedure or management review is judged against. Sold, so cite the clause number and never the wording.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/operations/skills/service-level-management/SKILL.md b/plugins/operations/skills/service-level-management/SKILL.md
index e52a333..961abce 100644
--- a/plugins/operations/skills/service-level-management/SKILL.md
+++ b/plugins/operations/skills/service-level-management/SKILL.md
@@ -50,6 +50,13 @@ Then separate the incident from the pattern. One breach is an incident, handled
 `customer-experience:escalation-management`. Repeated breaches of the same target mean the target was
 never fundable — renegotiate it honestly rather than continuing to miss it.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Commit to a level you have not measured yourself achieving for a sustained period.
diff --git a/plugins/operations/skills/service-level-management/references/sources.md b/plugins/operations/skills/service-level-management/references/sources.md
new file mode 100644
index 0000000..67c2609
--- /dev/null
+++ b/plugins/operations/skills/service-level-management/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `operations:service-level-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Interagency Guidance on Third-Party Relationships: Risk Management
+
+Federal Reserve, FDIC and OCC · US · public domain (US government) — quote freely
+
+<https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm>
+
+**Authoritative for:** What due diligence, contract terms, monitoring and termination planning a vendor relationship requires, scaled to how critical it is. The clearest published statement of the lifecycle, and the one regulated buyers will hold you to.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/operations/skills/supply-chain-and-logistics/SKILL.md b/plugins/operations/skills/supply-chain-and-logistics/SKILL.md
index e3873c8..a307c35 100644
--- a/plugins/operations/skills/supply-chain-and-logistics/SKILL.md
+++ b/plugins/operations/skills/supply-chain-and-logistics/SKILL.md
@@ -46,6 +46,13 @@ schedule are a way of appearing to hit a target while failing the customer.
 Diagnose misses by cause: supply, capacity, information, or process. The remedies do not overlap,
 and a fulfillment problem attributed to the wrong one gets more expensive rather than better.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Size safety stock from average demand without accounting for variability.
diff --git a/plugins/operations/skills/supply-chain-and-logistics/references/sources.md b/plugins/operations/skills/supply-chain-and-logistics/references/sources.md
new file mode 100644
index 0000000..9d4b133
--- /dev/null
+++ b/plugins/operations/skills/supply-chain-and-logistics/references/sources.md
@@ -0,0 +1,41 @@
+# Sources — `operations:supply-chain-and-logistics`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 21 CFR Part 117 — preventive controls for human food
+
+US Food and Drug Administration · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117>
+
+**Authoritative for:** Whether a food operation's hazard analysis, preventive controls and supplier verification are legally sufficient. Binding law rather than guidance.
+
+## 49 CFR Part 395 — hours of service of drivers
+
+Federal Motor Carrier Safety Administration · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-49/subtitle-B/chapter-III/subchapter-B/part-395>
+
+**Authoritative for:** How many hours a commercial driver may lawfully drive and work, and what records prove it. A hard cap that any realistic transit or capacity plan has to respect.
+
+## Country Commercial Guides
+
+US Department of Commerce, International Trade Administration · global · public domain (US government) — quote freely
+
+<https://www.trade.gov/country-commercial-guides>
+
+**Authoritative for:** The factual regulatory picture for entering a named foreign market — licensing, customs, standards, distribution and investment restrictions. It settles the factual questions in a market entry, not the strategic ones.
+
+## Incoterms rules
+
+International Chamber of Commerce · global · **sold — cite the identifier only, never the text**
+
+<https://iccwbo.org/business-solutions/incoterms-rules/>
+
+**Authoritative for:** Exactly where risk, cost and delivery obligation transfer between buyer and seller under a named three-letter term. Courts and contracts defer to it, and the full rules text is sold — name the term, do not reproduce the definition.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/operations/skills/vendor-management/SKILL.md b/plugins/operations/skills/vendor-management/SKILL.md
index 6b9b7c0..bcdcf65 100644
--- a/plugins/operations/skills/vendor-management/SKILL.md
+++ b/plugins/operations/skills/vendor-management/SKILL.md
@@ -51,6 +51,13 @@ never been thought through is not an option, it is a hope.
 
 Maintain your own copy of your data continuously where the vendor holds anything critical.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Sign before you know what leaving costs — data export, notice period, transition support.
diff --git a/plugins/operations/skills/vendor-management/references/sources.md b/plugins/operations/skills/vendor-management/references/sources.md
new file mode 100644
index 0000000..2677bfa
--- /dev/null
+++ b/plugins/operations/skills/vendor-management/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `operations:vendor-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Federal Acquisition Regulation
+
+US General Services Administration, on behalf of the FAR Council · US · public domain (US government) — quote freely
+
+<https://www.acquisition.gov/browse/index/far>
+
+Machine-readable: <https://www.acquisition.gov/far/part-31>
+
+**Authoritative for:** What a competitive sourcing process must do to be lawful — solicitation types, evaluation criteria, competition requirements, and how contract type allocates risk. Binding for federal buying and the reference everywhere else.
+
+## ISO 9001 — Quality management systems: requirements
+
+ISO · global · **sold — cite the identifier only, never the text**
+
+<https://www.iso.org/standard/62085.html>
+
+**Authoritative for:** Whether a quality system is certifiable — the auditable requirements a nonconformity procedure or management review is judged against. Sold, so cite the clause number and never the wording.
+
+## Interagency Guidance on Third-Party Relationships: Risk Management
+
+Federal Reserve, FDIC and OCC · US · public domain (US government) — quote freely
+
+<https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm>
+
+**Authoritative for:** What due diligence, contract terms, monitoring and termination planning a vendor relationship requires, scaled to how critical it is. The clearest published statement of the lifecycle, and the one regulated buyers will hold you to.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/people/skills/benefits-and-leave/SKILL.md b/plugins/people/skills/benefits-and-leave/SKILL.md
index 06cc99b..6baa8e6 100644
--- a/plugins/people/skills/benefits-and-leave/SKILL.md
+++ b/plugins/people/skills/benefits-and-leave/SKILL.md
@@ -53,6 +53,13 @@ ones. Route anything touching disability, pregnancy, or accommodation through co
 Track leave centrally rather than in managers' memories. The organization that cannot say who is on
 what leave and until when is the one that mishandles a return.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Change plan design without modeling the effect on the employees who use it most.
diff --git a/plugins/people/skills/benefits-and-leave/references/sources.md b/plugins/people/skills/benefits-and-leave/references/sources.md
new file mode 100644
index 0000000..d1619f6
--- /dev/null
+++ b/plugins/people/skills/benefits-and-leave/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `people:benefits-and-leave`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 29 CFR Part 825 — Family and Medical Leave Act regulations
+
+US Department of Labor, Wage and Hour Division · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-C/part-825>
+
+**Authoritative for:** Employer coverage and employee eligibility, what counts as a serious health condition, intermittent leave, notice and certification, and reinstatement. Ends nearly every operational leave dispute.
+
+## ERISA — laws and regulations
+
+US Department of Labor, Employee Benefits Security Administration · US · public domain (US government) — quote freely
+
+<https://www.dol.gov/agencies/ebsa/laws-and-regulations/laws/erisa>
+
+**Authoritative for:** Fiduciary duty, plan documents, reporting, participant disclosure and claims procedure for employer-sponsored plans — what a plan sponsor is legally on the hook for.
+
+## IRS Publication 15-B: Employer's Tax Guide to Fringe Benefits
+
+US Internal Revenue Service · US · public domain (US government) — quote freely
+
+<https://www.irs.gov/pub/irs-pdf/p15b.pdf>
+
+**Authoritative for:** Which fringe benefits are excludable from income and which are taxable, with valuation and withholding treatment. Reissued annually at a stable address, so it is never stale.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/people/skills/compensation-and-leveling/references/sources.md b/plugins/people/skills/compensation-and-leveling/references/sources.md
index e93273f..9da4a12 100644
--- a/plugins/people/skills/compensation-and-leveling/references/sources.md
+++ b/plugins/people/skills/compensation-and-leveling/references/sources.md
@@ -4,6 +4,14 @@
 
 Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
 
+## 29 CFR Part 541 — exemption regulations
+
+US Department of Labor, Wage and Hour Division · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-A/part-541>
+
+**Authoritative for:** Whether a role can lawfully be classified exempt — the salary basis, salary level and duties tests. Organization design is judgment, but which levels may be exempt and what a manager must actually do is settled law.
+
 ## Consolidated State Minimum Wage and Overtime tables
 
 US Department of Labor · US · public domain (US government) — quote freely
diff --git a/plugins/people/skills/employment-compliance/references/sources.md b/plugins/people/skills/employment-compliance/references/sources.md
index d065625..a88bdd6 100644
--- a/plugins/people/skills/employment-compliance/references/sources.md
+++ b/plugins/people/skills/employment-compliance/references/sources.md
@@ -4,6 +4,22 @@
 
 Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
 
+## 29 CFR Part 541 — exemption regulations
+
+US Department of Labor, Wage and Hour Division · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-A/part-541>
+
+**Authoritative for:** Whether a role can lawfully be classified exempt — the salary basis, salary level and duties tests. Organization design is judgment, but which levels may be exempt and what a manager must actually do is settled law.
+
+## 29 CFR Part 825 — Family and Medical Leave Act regulations
+
+US Department of Labor, Wage and Hour Division · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-C/part-825>
+
+**Authoritative for:** Employer coverage and employee eligibility, what counts as a serious health condition, intermittent leave, notice and certification, and reinstatement. Ends nearly every operational leave dispute.
+
 ## Consolidated State Minimum Wage and Overtime tables
 
 US Department of Labor · US · public domain (US government) — quote freely
@@ -20,6 +36,22 @@ US Equal Employment Opportunity Commission · US · public domain (US government
 
 **Authoritative for:** Federal anti-discrimination obligation as the agency that enforces it reads it — including guidance on selection procedures, accommodation, and automated decision tools in hiring.
 
+## Fact Sheet 17F: exemption for outside sales employees
+
+US Department of Labor, Wage and Hour Division · US · public domain (US government) — quote freely
+
+<https://www.dol.gov/agencies/whd/fact-sheets/17f-overtime-outside-sales>
+
+**Authoritative for:** Whether a sales role is exempt from overtime — the inside against outside classification question that territory design quietly creates.
+
+## Handbook for Employers M-274: guidance for completing Form I-9
+
+US Citizenship and Immigration Services · US · public domain (US government) — quote freely
+
+<https://www.uscis.gov/i-9-central/form-i-9-resources/handbook-for-employers-m-274>
+
+**Authoritative for:** Which documents are acceptable for employment eligibility verification, how to correct an error, what triggers reverification, and the retention clock.
+
 ## National Labor Relations Board — decisions and guidance
 
 NLRB · US · public domain (US government) — quote freely
diff --git a/plugins/people/skills/hiring-and-interviewing/references/sources.md b/plugins/people/skills/hiring-and-interviewing/references/sources.md
index 3a83ff5..87420eb 100644
--- a/plugins/people/skills/hiring-and-interviewing/references/sources.md
+++ b/plugins/people/skills/hiring-and-interviewing/references/sources.md
@@ -4,6 +4,22 @@
 
 Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
 
+## 29 CFR Part 1607 — Uniform Guidelines on Employee Selection Procedures
+
+US Equal Employment Opportunity Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XIV/part-1607>
+
+**Authoritative for:** What counts as a selection procedure, when adverse impact exists, and what validation evidence an employer must hold to defend one that has it. This is the document that settles disputes about hiring tests, scored assessments and promotion criteria — including automated ones.
+
+## Artificial Intelligence and the ADA
+
+US Equal Employment Opportunity Commission · US · public domain (US government) — quote freely
+
+<https://www.eeoc.gov/eeoc-disability-related-resources/artificial-intelligence-and-ada>
+
+**Authoritative for:** When an algorithmic assessment screens out a person with a disability, and what accommodation is owed inside an automated hiring flow.
+
 ## EEOC Laws, Regulations, Guidance and MOUs
 
 US Equal Employment Opportunity Commission · US · public domain (US government) — quote freely
diff --git a/plugins/people/skills/learning-and-development/SKILL.md b/plugins/people/skills/learning-and-development/SKILL.md
index 6bfdaad..e7504f8 100644
--- a/plugins/people/skills/learning-and-development/SKILL.md
+++ b/plugins/people/skills/learning-and-development/SKILL.md
@@ -51,6 +51,13 @@ Fix the incentive rather than the policy: make developing and releasing people s
 evaluated on. A mobility policy that costs a manager their best person and gives them nothing will be
 quietly resisted, and quiet resistance always wins.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Delivery: TalentLMS, Docebo, WorkRamp, Absorb, and similar; smaller organizations often do better
diff --git a/plugins/people/skills/learning-and-development/references/sources.md b/plugins/people/skills/learning-and-development/references/sources.md
new file mode 100644
index 0000000..55eeef7
--- /dev/null
+++ b/plugins/people/skills/learning-and-development/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `people:learning-and-development`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 29 CFR Part 1910 — occupational safety and health standards
+
+US Occupational Safety and Health Administration · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XVII/part-1910>
+
+**Authoritative for:** Whether a workplace configuration is lawful — egress, emergency action plans, walking and working surfaces, hazard communication. Settles facilities questions that are otherwise argued as preference.
+
+## O*NET database
+
+National Center for O*NET Development, US Department of Labor · US · CC BY — quote with attribution
+
+<https://www.onetcenter.org/database.html>
+
+**Authoritative for:** The canonical task, skill, knowledge and ability content of an occupation. A neutral reference when arguing about what a role comprises or how two roles overlap — and openly licensed, which is rare here.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/people/skills/onboarding-and-offboarding/SKILL.md b/plugins/people/skills/onboarding-and-offboarding/SKILL.md
index 48f260c..33d5fc6 100644
--- a/plugins/people/skills/onboarding-and-offboarding/SKILL.md
+++ b/plugins/people/skills/onboarding-and-offboarding/SKILL.md
@@ -56,6 +56,13 @@ Exit conversations produce candid information that is unavailable any other way,
 collected and never used. Aggregate themes over time and look by manager and by team; a single exit
 is an anecdote, a pattern across four is a finding for `people:chief-human-resources-officer`.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 HRIS as the record of who works here and when they started or left: Workday, BambooHR,
diff --git a/plugins/people/skills/onboarding-and-offboarding/references/sources.md b/plugins/people/skills/onboarding-and-offboarding/references/sources.md
new file mode 100644
index 0000000..f215362
--- /dev/null
+++ b/plugins/people/skills/onboarding-and-offboarding/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `people:onboarding-and-offboarding`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Handbook for Employers M-274: guidance for completing Form I-9
+
+US Citizenship and Immigration Services · US · public domain (US government) — quote freely
+
+<https://www.uscis.gov/i-9-central/form-i-9-resources/handbook-for-employers-m-274>
+
+**Authoritative for:** Which documents are acceptable for employment eligibility verification, how to correct an error, what triggers reverification, and the retention clock.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/people/skills/org-design/SKILL.md b/plugins/people/skills/org-design/SKILL.md
index cc3364a..f183a61 100644
--- a/plugins/people/skills/org-design/SKILL.md
+++ b/plugins/people/skills/org-design/SKILL.md
@@ -55,6 +55,13 @@ them is a common and expensive ordering error.
 - Anything touching an individual's role, level, or pay goes through the people function before
   announcement, without exception.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Restructure to avoid a performance conversation.
diff --git a/plugins/people/skills/org-design/references/sources.md b/plugins/people/skills/org-design/references/sources.md
new file mode 100644
index 0000000..434361b
--- /dev/null
+++ b/plugins/people/skills/org-design/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `people:org-design`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 29 CFR Part 541 — exemption regulations
+
+US Department of Labor, Wage and Hour Division · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-A/part-541>
+
+**Authoritative for:** Whether a role can lawfully be classified exempt — the salary basis, salary level and duties tests. Organization design is judgment, but which levels may be exempt and what a manager must actually do is settled law.
+
+## O*NET database
+
+National Center for O*NET Development, US Department of Labor · US · CC BY — quote with attribution
+
+<https://www.onetcenter.org/database.html>
+
+**Authoritative for:** The canonical task, skill, knowledge and ability content of an occupation. A neutral reference when arguing about what a role comprises or how two roles overlap — and openly licensed, which is rare here.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/people/skills/performance-management/SKILL.md b/plugins/people/skills/performance-management/SKILL.md
index e188870..fdd2054 100644
--- a/plugins/people/skills/performance-management/SKILL.md
+++ b/plugins/people/skills/performance-management/SKILL.md
@@ -59,6 +59,13 @@ Where a formal plan is warranted it needs specific outcomes, a real timeframe, d
 stated consequence. A plan that is only a paper trail for a decision already taken is recognized as
 such and does damage well beyond the individual.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Review and feedback: Lattice, Culture Amp, 15Five, Leapsome, Workday Talent, and similar.
diff --git a/plugins/people/skills/performance-management/references/sources.md b/plugins/people/skills/performance-management/references/sources.md
new file mode 100644
index 0000000..33809a2
--- /dev/null
+++ b/plugins/people/skills/performance-management/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `people:performance-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 29 CFR Part 1607 — Uniform Guidelines on Employee Selection Procedures
+
+US Equal Employment Opportunity Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XIV/part-1607>
+
+**Authoritative for:** What counts as a selection procedure, when adverse impact exists, and what validation evidence an employer must hold to defend one that has it. This is the document that settles disputes about hiring tests, scored assessments and promotion criteria — including automated ones.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/people/skills/workforce-planning/SKILL.md b/plugins/people/skills/workforce-planning/SKILL.md
index 751aaec..9725647 100644
--- a/plugins/people/skills/workforce-planning/SKILL.md
+++ b/plugins/people/skills/workforce-planning/SKILL.md
@@ -49,6 +49,13 @@ scramble.
 Offers, notice periods and some contractor arrangements are commitments before anyone starts. Know
 which parts of the plan can still be unwound and by when.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Build a plan on salary rather than fully loaded cost.
diff --git a/plugins/people/skills/workforce-planning/references/sources.md b/plugins/people/skills/workforce-planning/references/sources.md
new file mode 100644
index 0000000..6ae11bd
--- /dev/null
+++ b/plugins/people/skills/workforce-planning/references/sources.md
@@ -0,0 +1,27 @@
+# Sources — `people:workforce-planning`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## BLS Handbook of Methods
+
+US Bureau of Labor Statistics · US · public domain (US government) — quote freely
+
+<https://www.bls.gov/opub/hom/>
+
+Machine-readable: <https://www.bls.gov/developers/>
+
+**Authoritative for:** What each labor statistic actually measures and how. Ends the common error of comparing two series that measure different things, which is most disagreements about labor market data.
+
+## O*NET database
+
+National Center for O*NET Development, US Department of Labor · US · CC BY — quote with attribution
+
+<https://www.onetcenter.org/database.html>
+
+**Authoritative for:** The canonical task, skill, knowledge and ability content of an occupation. A neutral reference when arguing about what a role comprises or how two roles overlap — and openly licensed, which is rare here.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/pmo/skills/benefits-realization/SKILL.md b/plugins/pmo/skills/benefits-realization/SKILL.md
index a37e5d9..c673c9c 100644
--- a/plugins/pmo/skills/benefits-realization/SKILL.md
+++ b/plugins/pmo/skills/benefits-realization/SKILL.md
@@ -53,6 +53,13 @@ that say the project was a success. Feed the findings back to
 `pmo:portfolio-governance` and `finance:capital-allocation`, which are where the next set of
 approvals gets made.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Approve a case whose benefits have no owner after the project closes.
diff --git a/plugins/pmo/skills/benefits-realization/references/sources.md b/plugins/pmo/skills/benefits-realization/references/sources.md
new file mode 100644
index 0000000..d7d0ecf
--- /dev/null
+++ b/plugins/pmo/skills/benefits-realization/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `pmo:benefits-realization`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## The Green Book: appraisal and evaluation in central government
+
+HM Treasury · UK · free to use with attribution — credit the publisher
+
+<https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent>
+
+**Authoritative for:** Whether a claimed benefit may be counted at all — what separates a benefit from a transfer, how optimism bias is corrected for, and what a business case must contain. The best free treatment of benefits discipline anywhere, and openly licensed.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/pmo/skills/change-and-adoption/SKILL.md b/plugins/pmo/skills/change-and-adoption/SKILL.md
index 08c4d16..ed782d4 100644
--- a/plugins/pmo/skills/change-and-adoption/SKILL.md
+++ b/plugins/pmo/skills/change-and-adoption/SKILL.md
@@ -60,6 +60,13 @@ and the workaround is data about what the new system fails to do, not merely non
 Adoption is the mechanism by which `pmo:benefits-realization` becomes possible; without it there is
 nothing to realize.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Treat resistance as a communication deficit without asking what the change costs.
diff --git a/plugins/pmo/skills/change-and-adoption/references/sources.md b/plugins/pmo/skills/change-and-adoption/references/sources.md
new file mode 100644
index 0000000..91b7f78
--- /dev/null
+++ b/plugins/pmo/skills/change-and-adoption/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `pmo:change-and-adoption`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## GAO Agile Assessment Guide
+
+US Government Accountability Office · US · public domain (US government) — quote freely
+
+<https://www.gao.gov/products/gao-24-105506>
+
+**Authoritative for:** Whether an organization has actually adopted an iterative delivery model or relabeled a staged one. Gives testable criteria, which is rare in this area, and reconciles iterative delivery with cost and schedule assurance.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/pmo/skills/dependency-and-risk-management/SKILL.md b/plugins/pmo/skills/dependency-and-risk-management/SKILL.md
index c4a9f39..5632747 100644
--- a/plugins/pmo/skills/dependency-and-risk-management/SKILL.md
+++ b/plugins/pmo/skills/dependency-and-risk-management/SKILL.md
@@ -58,6 +58,13 @@ resolved. A general expression of concern gets acknowledged and nothing happens.
 Escalate when the decision exceeds your authority or the decision date is approaching — not when the
 risk has already materialized, at which point it is a status report.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Carry a dependency the owning team has not committed to.
diff --git a/plugins/pmo/skills/dependency-and-risk-management/references/sources.md b/plugins/pmo/skills/dependency-and-risk-management/references/sources.md
new file mode 100644
index 0000000..223c978
--- /dev/null
+++ b/plugins/pmo/skills/dependency-and-risk-management/references/sources.md
@@ -0,0 +1,19 @@
+# Sources — `pmo:dependency-and-risk-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## GAO Schedule Assessment Guide: best practices for project schedules
+
+US Government Accountability Office · US · public domain (US government) — quote freely
+
+<https://www.gao.gov/products/gao-16-89g>
+
+Machine-readable: <https://www.gao.gov/assets/gao-16-89g.pdf>
+
+**Authoritative for:** Whether a schedule is reliable — the ten criteria an auditor applies, covering the work breakdown, sequencing, resource loading, critical path, total float and schedule risk analysis.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/pmo/skills/estimating-and-contingency/SKILL.md b/plugins/pmo/skills/estimating-and-contingency/SKILL.md
index baae82e..113e505 100644
--- a/plugins/pmo/skills/estimating-and-contingency/SKILL.md
+++ b/plugins/pmo/skills/estimating-and-contingency/SKILL.md
@@ -70,6 +70,13 @@ than it punishes overruns, so nobody revises.
 Fix the incentive before fixing the arithmetic. An organization that treats a re-estimate as a
 failure will get accurate estimates from no one.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Present a point estimate for work nobody has decomposed.
diff --git a/plugins/pmo/skills/estimating-and-contingency/references/sources.md b/plugins/pmo/skills/estimating-and-contingency/references/sources.md
new file mode 100644
index 0000000..7ffe4af
--- /dev/null
+++ b/plugins/pmo/skills/estimating-and-contingency/references/sources.md
@@ -0,0 +1,27 @@
+# Sources — `pmo:estimating-and-contingency`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## GAO Cost Estimating and Assessment Guide
+
+US Government Accountability Office · US · public domain (US government) — quote freely
+
+<https://www.gao.gov/products/gao-20-195g>
+
+Machine-readable: <https://www.gao.gov/assets/gao-20-195g.pdf>
+
+**Authoritative for:** What makes a cost estimate defensible, and specifically how much contingency is justified — via risk and uncertainty analysis at a stated confidence level, rather than a percentage somebody remembers.
+
+## The Green Book: appraisal and evaluation in central government
+
+HM Treasury · UK · free to use with attribution — credit the publisher
+
+<https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent>
+
+**Authoritative for:** Whether a claimed benefit may be counted at all — what separates a benefit from a transfer, how optimism bias is corrected for, and what a business case must contain. The best free treatment of benefits discipline anywhere, and openly licensed.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/pmo/skills/head-of-pmo/SKILL.md b/plugins/pmo/skills/head-of-pmo/SKILL.md
index d73a390..5973dd4 100644
--- a/plugins/pmo/skills/head-of-pmo/SKILL.md
+++ b/plugins/pmo/skills/head-of-pmo/SKILL.md
@@ -84,6 +84,13 @@ held visibly at the portfolio level rather than hidden inside every task.
 Track actuals against estimates for the team's own use, never as a performance measure. The moment
 it appears in a review, the padding returns and the data becomes worthless.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Collect status that feeds no decision.
diff --git a/plugins/pmo/skills/head-of-pmo/references/sources.md b/plugins/pmo/skills/head-of-pmo/references/sources.md
new file mode 100644
index 0000000..eef0763
--- /dev/null
+++ b/plugins/pmo/skills/head-of-pmo/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `pmo:head-of-pmo`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## GAO Agile Assessment Guide
+
+US Government Accountability Office · US · public domain (US government) — quote freely
+
+<https://www.gao.gov/products/gao-24-105506>
+
+**Authoritative for:** Whether an organization has actually adopted an iterative delivery model or relabeled a staged one. Gives testable criteria, which is rare in this area, and reconciles iterative delivery with cost and schedule assurance.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/pmo/skills/portfolio-governance/SKILL.md b/plugins/pmo/skills/portfolio-governance/SKILL.md
index 97580bf..a4d5b06 100644
--- a/plugins/pmo/skills/portfolio-governance/SKILL.md
+++ b/plugins/pmo/skills/portfolio-governance/SKILL.md
@@ -58,6 +58,13 @@ the organization.
 Watch for the same scarce specialist appearing on the critical path of several initiatives — the
 most common invisible cause of portfolio-wide slippage.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Approve work without naming what it displaces.
diff --git a/plugins/pmo/skills/portfolio-governance/references/sources.md b/plugins/pmo/skills/portfolio-governance/references/sources.md
new file mode 100644
index 0000000..9f03059
--- /dev/null
+++ b/plugins/pmo/skills/portfolio-governance/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `pmo:portfolio-governance`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## GAO Cost Estimating and Assessment Guide
+
+US Government Accountability Office · US · public domain (US government) — quote freely
+
+<https://www.gao.gov/products/gao-20-195g>
+
+Machine-readable: <https://www.gao.gov/assets/gao-20-195g.pdf>
+
+**Authoritative for:** What makes a cost estimate defensible, and specifically how much contingency is justified — via risk and uncertainty analysis at a stated confidence level, rather than a percentage somebody remembers.
+
+## NASA Systems Engineering Handbook
+
+NASA · US · public domain (US government) — quote freely
+
+<https://www.nasa.gov/reference/systems-engineering-handbook/>
+
+**Authoritative for:** What a phase gate must contain before a technical project may proceed — the review structure, entrance and success criteria, and how the technical baseline is controlled.
+
+## The Green Book: appraisal and evaluation in central government
+
+HM Treasury · UK · free to use with attribution — credit the publisher
+
+<https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent>
+
+**Authoritative for:** Whether a claimed benefit may be counted at all — what separates a benefit from a transfer, how optimism bias is corrected for, and what a business case must contain. The best free treatment of benefits discipline anywhere, and openly licensed.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/pmo/skills/program-management/SKILL.md b/plugins/pmo/skills/program-management/SKILL.md
index 8d41cc0..82ed806 100644
--- a/plugins/pmo/skills/program-management/SKILL.md
+++ b/plugins/pmo/skills/program-management/SKILL.md
@@ -49,6 +49,13 @@ is affected), or add capacity (which rarely helps late, and often hurts).
 Re-baseline once, visibly, rather than slipping a week at a time. Serial small slips destroy
 credibility far faster than one honest reset.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Report green on a program with an unresolved blocker.
diff --git a/plugins/pmo/skills/program-management/references/sources.md b/plugins/pmo/skills/program-management/references/sources.md
new file mode 100644
index 0000000..64734bd
--- /dev/null
+++ b/plugins/pmo/skills/program-management/references/sources.md
@@ -0,0 +1,27 @@
+# Sources — `pmo:program-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## GAO Cost Estimating and Assessment Guide
+
+US Government Accountability Office · US · public domain (US government) — quote freely
+
+<https://www.gao.gov/products/gao-20-195g>
+
+Machine-readable: <https://www.gao.gov/assets/gao-20-195g.pdf>
+
+**Authoritative for:** What makes a cost estimate defensible, and specifically how much contingency is justified — via risk and uncertainty analysis at a stated confidence level, rather than a percentage somebody remembers.
+
+## NASA Systems Engineering Handbook
+
+NASA · US · public domain (US government) — quote freely
+
+<https://www.nasa.gov/reference/systems-engineering-handbook/>
+
+**Authoritative for:** What a phase gate must contain before a technical project may proceed — the review structure, entrance and success criteria, and how the technical baseline is controlled.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/pmo/skills/project-delivery/SKILL.md b/plugins/pmo/skills/project-delivery/SKILL.md
index 255267c..7b07530 100644
--- a/plugins/pmo/skills/project-delivery/SKILL.md
+++ b/plugins/pmo/skills/project-delivery/SKILL.md
@@ -76,6 +76,13 @@ route around it.
 Re-baseline when an approved change makes the old plan meaningless, and not otherwise. A baseline
 re-set to hide variance destroys the only reference you had.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Delivery tracking: Jira, Asana, Linear, Monday.com, Smartsheet, Microsoft Project, and
diff --git a/plugins/pmo/skills/project-delivery/references/sources.md b/plugins/pmo/skills/project-delivery/references/sources.md
new file mode 100644
index 0000000..26d4e13
--- /dev/null
+++ b/plugins/pmo/skills/project-delivery/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `pmo:project-delivery`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## GAO Agile Assessment Guide
+
+US Government Accountability Office · US · public domain (US government) — quote freely
+
+<https://www.gao.gov/products/gao-24-105506>
+
+**Authoritative for:** Whether an organization has actually adopted an iterative delivery model or relabeled a staged one. Gives testable criteria, which is rare in this area, and reconciles iterative delivery with cost and schedule assurance.
+
+## GAO Schedule Assessment Guide: best practices for project schedules
+
+US Government Accountability Office · US · public domain (US government) — quote freely
+
+<https://www.gao.gov/products/gao-16-89g>
+
+Machine-readable: <https://www.gao.gov/assets/gao-16-89g.pdf>
+
+**Authoritative for:** Whether a schedule is reliable — the ten criteria an auditor applies, covering the work breakdown, sequencing, resource loading, critical path, total float and schedule risk analysis.
+
+## NASA Systems Engineering Handbook
+
+NASA · US · public domain (US government) — quote freely
+
+<https://www.nasa.gov/reference/systems-engineering-handbook/>
+
+**Authoritative for:** What a phase gate must contain before a technical project may proceed — the review structure, entrance and success criteria, and how the technical baseline is controlled.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/pmo/skills/schedule-development-and-analysis/SKILL.md b/plugins/pmo/skills/schedule-development-and-analysis/SKILL.md
index f24f573..c46d718 100644
--- a/plugins/pmo/skills/schedule-development-and-analysis/SKILL.md
+++ b/plugins/pmo/skills/schedule-development-and-analysis/SKILL.md
@@ -73,6 +73,13 @@ predecessor or successor, hard date constraints, negative float, durations longe
 period, tasks that have been 90% complete for more than one period, and a baseline that has been
 re-set so often it no longer means anything.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Accept a date on a task with no logic behind it.
diff --git a/plugins/pmo/skills/schedule-development-and-analysis/references/sources.md b/plugins/pmo/skills/schedule-development-and-analysis/references/sources.md
new file mode 100644
index 0000000..7e1345f
--- /dev/null
+++ b/plugins/pmo/skills/schedule-development-and-analysis/references/sources.md
@@ -0,0 +1,19 @@
+# Sources — `pmo:schedule-development-and-analysis`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## GAO Schedule Assessment Guide: best practices for project schedules
+
+US Government Accountability Office · US · public domain (US government) — quote freely
+
+<https://www.gao.gov/products/gao-16-89g>
+
+Machine-readable: <https://www.gao.gov/assets/gao-16-89g.pdf>
+
+**Authoritative for:** Whether a schedule is reliable — the ten criteria an auditor applies, covering the work breakdown, sequencing, resource loading, critical path, total float and schedule risk analysis.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/product/skills/brand-identity/SKILL.md b/plugins/product/skills/brand-identity/SKILL.md
index 09f90bf..3c7e16b 100644
--- a/plugins/product/skills/brand-identity/SKILL.md
+++ b/plugins/product/skills/brand-identity/SKILL.md
@@ -45,6 +45,13 @@ for: palette drift, more type families than the system defines, logo variants no
 tone that changes between surfaces. Report by severity, and separate what breaks the system from
 what merely was not specified.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Pick color and type before you know what the brand has to sound like and what it will sit next to.
diff --git a/plugins/product/skills/brand-identity/references/sources.md b/plugins/product/skills/brand-identity/references/sources.md
new file mode 100644
index 0000000..578dadf
--- /dev/null
+++ b/plugins/product/skills/brand-identity/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `product:brand-identity`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Compendium of U.S. Copyright Office Practices
+
+US Copyright Office · US · public domain (US government) — quote freely
+
+<https://www.copyright.gov/comp3/>
+
+**Authoritative for:** What is protectable and registrable, including the Office's position on human authorship for machine-generated material and how much of a layout or typeface is protectable at all.
+
+## SIL Open Font License
+
+SIL International · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://openfontlicense.org/>
+
+**Authoritative for:** Whether a typeface may be embedded in a product, bundled into a design system, modified or redistributed. The font-licensing question that surfaces reliably when a brand system ships.
+
+## Trademark Manual of Examining Procedure
+
+US Patent and Trademark Office · US · public domain (US government) — quote freely
+
+<https://tmep.uspto.gov/>
+
+**Authoritative for:** Whether a proposed name, logo or tagline is registrable — distinctiveness, descriptiveness refusals, likelihood of confusion, specimen requirements. Settles whether you can actually own a name.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/product/skills/chief-product-officer/SKILL.md b/plugins/product/skills/chief-product-officer/SKILL.md
index 03a651d..55b26e7 100644
--- a/plugins/product/skills/chief-product-officer/SKILL.md
+++ b/plugins/product/skills/chief-product-officer/SKILL.md
@@ -84,6 +84,13 @@ These are the artifacts of record. Where two of them disagree, this one is right
 
 Escalate to Chief Executive when the roadmap and the strategy have diverged; to CTO when the technically feasible scope will not meet the commitment.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Never ship a feature whose success metric was never stated
diff --git a/plugins/product/skills/chief-product-officer/references/sources.md b/plugins/product/skills/chief-product-officer/references/sources.md
new file mode 100644
index 0000000..0f744d3
--- /dev/null
+++ b/plugins/product/skills/chief-product-officer/references/sources.md
@@ -0,0 +1,19 @@
+# Sources — `product:chief-product-officer`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## App Store Review Guidelines
+
+Apple · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://developer.apple.com/app-store/review/guidelines/>
+
+Machine-readable: <https://developer.apple.com/app-store/search/>
+
+**Authoritative for:** Whether a listing, screenshot set, price presentation or subscription flow will be rejected. Binding for anything shipping through the App Store, and copyrighted — cite the rule number, do not mirror the text.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/product/skills/design-system/SKILL.md b/plugins/product/skills/design-system/SKILL.md
index 34d7ba5..2befc34 100644
--- a/plugins/product/skills/design-system/SKILL.md
+++ b/plugins/product/skills/design-system/SKILL.md
@@ -41,6 +41,13 @@ a polish item; it is whether people can use it.
 - Never remove a token or component because it looks unused. You cannot see every consumer from
   inside the system. Deprecate, announce, then remove.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Design source: Figma, and similar. Component documentation and review: Storybook.
diff --git a/plugins/product/skills/design-system/references/sources.md b/plugins/product/skills/design-system/references/sources.md
new file mode 100644
index 0000000..3df72e4
--- /dev/null
+++ b/plugins/product/skills/design-system/references/sources.md
@@ -0,0 +1,51 @@
+# Sources — `product:design-system`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Human Interface Guidelines
+
+Apple · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://developer.apple.com/design/human-interface-guidelines>
+
+**Authoritative for:** What correct platform behavior is on Apple platforms — control semantics, navigation structure, touch targets. Its authority is not taste: deviation is grounds for review rejection.
+
+## SIL Open Font License
+
+SIL International · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://openfontlicense.org/>
+
+**Authoritative for:** Whether a typeface may be embedded in a product, bundled into a design system, modified or redistributed. The font-licensing question that surfaces reliably when a brand system ships.
+
+## Unicode Common Locale Data Repository
+
+Unicode Consortium · global · free to use with attribution — credit the publisher
+
+<https://cldr.unicode.org/>
+
+**Authoritative for:** Correct date, number, currency, name-order, plural and sort behavior for a locale. Settles how something should render in a given language with data rather than guesswork, and every platform's internationalization library derives from it.
+
+## WAI-ARIA and the ARIA Authoring Practices Guide
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/WAI/ARIA/apg/>
+
+Machine-readable: <https://www.w3.org/TR/wai-aria-1.2/>
+
+**Authoritative for:** Which roles, states and keyboard interactions a given widget must implement. Settles whether Escape should close a dialog and whether a role is the right one, without appeal to preference.
+
+## Web Content Accessibility Guidelines 2.2
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/WCAG22/>
+
+**Authoritative for:** Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/product/skills/interface-craft/SKILL.md b/plugins/product/skills/interface-craft/SKILL.md
index 34e17a1..64767de 100644
--- a/plugins/product/skills/interface-craft/SKILL.md
+++ b/plugins/product/skills/interface-craft/SKILL.md
@@ -71,6 +71,13 @@ These are not polish items — below them, some people cannot use the interface
 - Real semantic elements — buttons that are buttons, headings in order. A styled div is invisible to
   assistive technology.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Add visual weight to fix a hierarchy problem caused by too many equal elements. Remove instead.
diff --git a/plugins/product/skills/interface-craft/references/sources.md b/plugins/product/skills/interface-craft/references/sources.md
new file mode 100644
index 0000000..dc7de30
--- /dev/null
+++ b/plugins/product/skills/interface-craft/references/sources.md
@@ -0,0 +1,67 @@
+# Sources — `product:interface-craft`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Age Appropriate Design Code
+
+UK Information Commissioner's Office · UK · free to use with attribution — credit the publisher
+
+<https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/>
+
+**Authoritative for:** What default settings, nudges and profiling are permissible in a service likely to be used by children. A statutory code, so it settles whether onboarding may default a toggle on.
+
+## CCPA regulations, California Code of Regulations title 11
+
+California Privacy Protection Agency · US-CA · public domain — quote freely
+
+<https://cppa.ca.gov/regulations/consumer_privacy_act.html>
+
+**Authoritative for:** Symmetry in choice, as law. It settles whether a consent flow where accepting is one click and declining is three is permissible — converting what is usually argued as design taste into a compliance question.
+
+## California Automatic Renewal Law, Business and Professions Code 17600-17606
+
+California Legislative Counsel · US-CA · public domain — quote freely
+
+<https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=7.&chapter=1.&part=3.&lawCode=BPC&article=9.>
+
+**Authoritative for:** The concrete cancellation obligations a subscription business actually has to meet, because California's requirements are stricter than the federal floor and apply to any California customer — which in practice makes them the binding ones.
+
+## Human Interface Guidelines
+
+Apple · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://developer.apple.com/design/human-interface-guidelines>
+
+**Authoritative for:** What correct platform behavior is on Apple platforms — control semantics, navigation structure, touch targets. Its authority is not taste: deviation is grounds for review rejection.
+
+## Unicode Common Locale Data Repository
+
+Unicode Consortium · global · free to use with attribution — credit the publisher
+
+<https://cldr.unicode.org/>
+
+**Authoritative for:** Correct date, number, currency, name-order, plural and sort behavior for a locale. Settles how something should render in a given language with data rather than guesswork, and every platform's internationalization library derives from it.
+
+## WAI-ARIA and the ARIA Authoring Practices Guide
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/WAI/ARIA/apg/>
+
+Machine-readable: <https://www.w3.org/TR/wai-aria-1.2/>
+
+**Authoritative for:** Which roles, states and keyboard interactions a given widget must implement. Settles whether Escape should close a dialog and whether a role is the right one, without appeal to preference.
+
+## Web Content Accessibility Guidelines 2.2
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/WCAG22/>
+
+**Authoritative for:** Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/product/skills/interface-redesign/SKILL.md b/plugins/product/skills/interface-redesign/SKILL.md
index 4b629f4..4ec8e98 100644
--- a/plugins/product/skills/interface-redesign/SKILL.md
+++ b/plugins/product/skills/interface-redesign/SKILL.md
@@ -47,6 +47,13 @@ Fix in this order, because each makes the next easier to see:
 Rebuild only when the structure is wrong — when the information architecture does not match how
 people work. Everything else is a restyle, and a restyle that ships beats a rebuild that stalls.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Restyle a screen whose problem is structural. New paint on a broken flow buys nothing.
diff --git a/plugins/product/skills/interface-redesign/references/sources.md b/plugins/product/skills/interface-redesign/references/sources.md
new file mode 100644
index 0000000..15311f7
--- /dev/null
+++ b/plugins/product/skills/interface-redesign/references/sources.md
@@ -0,0 +1,43 @@
+# Sources — `product:interface-redesign`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## CCPA regulations, California Code of Regulations title 11
+
+California Privacy Protection Agency · US-CA · public domain — quote freely
+
+<https://cppa.ca.gov/regulations/consumer_privacy_act.html>
+
+**Authoritative for:** Symmetry in choice, as law. It settles whether a consent flow where accepting is one click and declining is three is permissible — converting what is usually argued as design taste into a compliance question.
+
+## Human Interface Guidelines
+
+Apple · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://developer.apple.com/design/human-interface-guidelines>
+
+**Authoritative for:** What correct platform behavior is on Apple platforms — control semantics, navigation structure, touch targets. Its authority is not taste: deviation is grounds for review rejection.
+
+## WAI-ARIA and the ARIA Authoring Practices Guide
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/WAI/ARIA/apg/>
+
+Machine-readable: <https://www.w3.org/TR/wai-aria-1.2/>
+
+**Authoritative for:** Which roles, states and keyboard interactions a given widget must implement. Settles whether Escape should close a dialog and whether a role is the right one, without appeal to preference.
+
+## Web Content Accessibility Guidelines 2.2
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/WCAG22/>
+
+**Authoritative for:** Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/product/skills/product-requirements/SKILL.md b/plugins/product/skills/product-requirements/SKILL.md
index 7afa98a..90cce50 100644
--- a/plugins/product/skills/product-requirements/SKILL.md
+++ b/plugins/product/skills/product-requirements/SKILL.md
@@ -59,6 +59,13 @@ A specification that diverges from what was built becomes a trap for the next pe
 it as decisions change, or mark it as-of-a-date and point at wherever the truth now lives. The
 worst outcome is a document that looks current and is not.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Open with a solution and leave the problem implied.
diff --git a/plugins/product/skills/product-requirements/references/sources.md b/plugins/product/skills/product-requirements/references/sources.md
new file mode 100644
index 0000000..2f6c593
--- /dev/null
+++ b/plugins/product/skills/product-requirements/references/sources.md
@@ -0,0 +1,67 @@
+# Sources — `product:product-requirements`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 15 U.S.C. 8403 — Restore Online Shoppers' Confidence Act
+
+US Congress, via the Office of the Law Revision Counsel · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section8403&num=0&edition=prelim>
+
+**Authoritative for:** Whether an online auto-renewal offer is lawful — clear disclosure of material terms before billing, express informed consent, and a simple cancellation mechanism. This area has seen rules issued and struck down, so cite the statute rather than a rule summary.
+
+## 36 CFR Part 1194 — Section 508 information and communication technology standards
+
+US Access Board · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-36/subtitle-B/chapter-XI/part-1194>
+
+**Authoritative for:** What a product must satisfy to be lawfully procurable by a US federal agency. This decides a public-sector deal rather than expressing a design preference, which is why it reaches sales as often as engineering.
+
+## Age Appropriate Design Code
+
+UK Information Commissioner's Office · UK · free to use with attribution — credit the publisher
+
+<https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/>
+
+**Authoritative for:** What default settings, nudges and profiling are permissible in a service likely to be used by children. A statutory code, so it settles whether onboarding may default a toggle on.
+
+## California Automatic Renewal Law, Business and Professions Code 17600-17606
+
+California Legislative Counsel · US-CA · public domain — quote freely
+
+<https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=7.&chapter=1.&part=3.&lawCode=BPC&article=9.>
+
+**Authoritative for:** The concrete cancellation obligations a subscription business actually has to meet, because California's requirements are stricter than the federal floor and apply to any California customer — which in practice makes them the binding ones.
+
+## Children's Online Privacy Protection Rule, 16 CFR 312
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312>
+
+Machine-readable: <https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions>
+
+**Authoritative for:** Whether a property counts as directed to children, and therefore whether behavioral advertising, retargeting pixels or lead capture may run on it at all.
+
+## EN 301 549 — accessibility requirements for ICT products and services
+
+ETSI · EU · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf>
+
+**Authoritative for:** The requirement set an EU public-sector buyer measures against, including non-web software, documents and hardware that the web guidelines do not cover. Which version is legally operative depends on what the Official Journal currently cites — check before relying on a newer one.
+
+## Unicode Common Locale Data Repository
+
+Unicode Consortium · global · free to use with attribution — credit the publisher
+
+<https://cldr.unicode.org/>
+
+**Authoritative for:** Correct date, number, currency, name-order, plural and sort behavior for a locale. Settles how something should render in a given language with data rather than guesswork, and every platform's internationalization library derives from it.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/product/skills/ux-product-auditor/SKILL.md b/plugins/product/skills/ux-product-auditor/SKILL.md
index 2bb193c..244ab42 100644
--- a/plugins/product/skills/ux-product-auditor/SKILL.md
+++ b/plugins/product/skills/ux-product-auditor/SKILL.md
@@ -87,6 +87,13 @@ Rank by users affected × severity ÷ effort. Then state the one thing to fix fi
 say that most of the list is not worth doing yet. A prioritized audit is more useful than a complete
 one.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Report a finding without the path that produces it. A claim nobody can reproduce gets ignored.
diff --git a/plugins/product/skills/ux-product-auditor/references/sources.md b/plugins/product/skills/ux-product-auditor/references/sources.md
new file mode 100644
index 0000000..3489367
--- /dev/null
+++ b/plugins/product/skills/ux-product-auditor/references/sources.md
@@ -0,0 +1,51 @@
+# Sources — `product:ux-product-auditor`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 36 CFR Part 1194 — Section 508 information and communication technology standards
+
+US Access Board · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-36/subtitle-B/chapter-XI/part-1194>
+
+**Authoritative for:** What a product must satisfy to be lawfully procurable by a US federal agency. This decides a public-sector deal rather than expressing a design preference, which is why it reaches sales as often as engineering.
+
+## CCPA regulations, California Code of Regulations title 11
+
+California Privacy Protection Agency · US-CA · public domain — quote freely
+
+<https://cppa.ca.gov/regulations/consumer_privacy_act.html>
+
+**Authoritative for:** Symmetry in choice, as law. It settles whether a consent flow where accepting is one click and declining is three is permissible — converting what is usually argued as design taste into a compliance question.
+
+## EN 301 549 — accessibility requirements for ICT products and services
+
+ETSI · EU · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf>
+
+**Authoritative for:** The requirement set an EU public-sector buyer measures against, including non-web software, documents and hardware that the web guidelines do not cover. Which version is legally operative depends on what the Official Journal currently cites — check before relying on a newer one.
+
+## WAI-ARIA and the ARIA Authoring Practices Guide
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/WAI/ARIA/apg/>
+
+Machine-readable: <https://www.w3.org/TR/wai-aria-1.2/>
+
+**Authoritative for:** Which roles, states and keyboard interactions a given widget must implement. Settles whether Escape should close a dialog and whether a role is the right one, without appeal to preference.
+
+## Web Content Accessibility Guidelines 2.2
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/WCAG22/>
+
+**Authoritative for:** Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/product/skills/visual-reference-generation/SKILL.md b/plugins/product/skills/visual-reference-generation/SKILL.md
index 8893f2b..eb83fd7 100644
--- a/plugins/product/skills/visual-reference-generation/SKILL.md
+++ b/plugins/product/skills/visual-reference-generation/SKILL.md
@@ -42,6 +42,13 @@ not the screenshot.
 Say explicitly what in the reference is **direction** and what is **placeholder**. A developer
 handed a concept will otherwise implement the lorem ipsum faithfully.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Generate before the content, states, and constraints are settled. A reference built on placeholder copy hides every real problem.
diff --git a/plugins/product/skills/visual-reference-generation/references/sources.md b/plugins/product/skills/visual-reference-generation/references/sources.md
new file mode 100644
index 0000000..38aebde
--- /dev/null
+++ b/plugins/product/skills/visual-reference-generation/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `product:visual-reference-generation`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Compendium of U.S. Copyright Office Practices
+
+US Copyright Office · US · public domain (US government) — quote freely
+
+<https://www.copyright.gov/comp3/>
+
+**Authoritative for:** What is protectable and registrable, including the Office's position on human authorship for machine-generated material and how much of a layout or typeface is protectable at all.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/revenue/skills/activation/SKILL.md b/plugins/revenue/skills/activation/SKILL.md
index bc1b2b7..aa31277 100644
--- a/plugins/revenue/skills/activation/SKILL.md
+++ b/plugins/revenue/skills/activation/SKILL.md
@@ -57,6 +57,13 @@ for.
 Percentage reaching the activation moment, and time to reach it. Signup conversion alone will
 happily improve while activation falls.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Pick an activation moment because it is easy to measure. It has to be the point where the user gets the value they came for.
diff --git a/plugins/revenue/skills/activation/references/sources.md b/plugins/revenue/skills/activation/references/sources.md
new file mode 100644
index 0000000..d7fd2d1
--- /dev/null
+++ b/plugins/revenue/skills/activation/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `revenue:activation`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 15 U.S.C. 8403 — Restore Online Shoppers' Confidence Act
+
+US Congress, via the Office of the Law Revision Counsel · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section8403&num=0&edition=prelim>
+
+**Authoritative for:** Whether an online auto-renewal offer is lawful — clear disclosure of material terms before billing, express informed consent, and a simple cancellation mechanism. This area has seen rules issued and struck down, so cite the statute rather than a rule summary.
+
+## Age Appropriate Design Code
+
+UK Information Commissioner's Office · UK · free to use with attribution — credit the publisher
+
+<https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/>
+
+**Authoritative for:** What default settings, nudges and profiling are permissible in a service likely to be used by children. A statutory code, so it settles whether onboarding may default a toggle on.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/revenue/skills/deal-negotiation/SKILL.md b/plugins/revenue/skills/deal-negotiation/SKILL.md
index 83ac03b..7724f75 100644
--- a/plugins/revenue/skills/deal-negotiation/SKILL.md
+++ b/plugins/revenue/skills/deal-negotiation/SKILL.md
@@ -83,6 +83,13 @@ A deal won on a commitment nobody in delivery has agreed to is a churn event wit
 promised outside the standard agreement — a date, a feature, a service level — needs the person who
 will own it to have said yes before it is signed.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Enter a negotiation without a written walk-away.
diff --git a/plugins/revenue/skills/deal-negotiation/references/sources.md b/plugins/revenue/skills/deal-negotiation/references/sources.md
new file mode 100644
index 0000000..baa8b77
--- /dev/null
+++ b/plugins/revenue/skills/deal-negotiation/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `revenue:deal-negotiation`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 15 U.S.C. 7001 — Electronic Signatures in Global and National Commerce Act
+
+US Congress, via the Office of the Law Revision Counsel · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section7001&num=0&edition=prelim>
+
+**Authoritative for:** Whether an electronically signed contract, a clickwrap acceptance or an emailed order form is enforceable, and what consumer consent steps must precede it.
+
+## Regulation (EU) 910/2014 — eIDAS
+
+Publications Office of the European Union · EU · free to use with attribution — credit the publisher
+
+<https://eur-lex.europa.eu/eli/reg/2014/910/oj>
+
+**Authoritative for:** Whether an electronic signature has legal effect in the EU and which of the three tiers a given contract requires. Settles whether an ordinary e-signature suffices for a particular European deal.
+
+## Uniform Commercial Code, Article 2 — Sales
+
+American Law Institute and Uniform Law Commission · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.law.cornell.edu/ucc/2>
+
+**Authoritative for:** When a contract for goods is formed, whose terms prevail in a battle of the forms, and what warranty disclaimer language is effective. Settles a purchase-order-versus-order-form dispute as law rather than as negotiating posture.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/revenue/skills/outbound-prospecting/SKILL.md b/plugins/revenue/skills/outbound-prospecting/SKILL.md
index f944fbb..0e1ce40 100644
--- a/plugins/revenue/skills/outbound-prospecting/SKILL.md
+++ b/plugins/revenue/skills/outbound-prospecting/SKILL.md
@@ -56,6 +56,13 @@ Use a subdomain for outbound so a reputation problem cannot take down your trans
 - **Replies, no meetings** — a qualification problem: you are reaching people who cannot act.
 - **Meetings, no pipeline** — the segment is wrong.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Sequencing: Outreach, Salesloft, Apollo, Lemlist, Instantly, and similar.
diff --git a/plugins/revenue/skills/outbound-prospecting/references/sources.md b/plugins/revenue/skills/outbound-prospecting/references/sources.md
new file mode 100644
index 0000000..e939b28
--- /dev/null
+++ b/plugins/revenue/skills/outbound-prospecting/references/sources.md
@@ -0,0 +1,51 @@
+# Sources — `revenue:outbound-prospecting`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 16 CFR Part 310 — Telemarketing Sales Rule
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310>
+
+**Authoritative for:** What an outbound seller must disclose before taking payment, which misrepresentations are prohibited, and what records the program must keep. The rule that makes a call script lawful or not.
+
+## 18 U.S.C. 2511 — interception of communications
+
+US Congress, via the Office of the Law Revision Counsel · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title18-section2511&num=0&edition=prelim>
+
+**Authoritative for:** The federal one-party-consent floor for recording a call, and the criminal exposure for recording without it. It settles only the floor: several states require all-party consent, and there is no free authoritative single document for that matrix — it must be looked up per state.
+
+## CAN-SPAM Act: A Compliance Guide for Business
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business>
+
+Machine-readable: <https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316>
+
+**Authoritative for:** The mandatory elements of a US commercial email — header accuracy, subject-line honesty, physical address, opt-out mechanism and the window for honoring it — and that hiring an agency does not move the liability.
+
+## Canada's Anti-Spam Legislation, S.C. 2010 c. 23
+
+Department of Justice Canada · CA · free to use with attribution — credit the publisher
+
+<https://laws-lois.justice.gc.ca/eng/acts/E-1.6/index.html>
+
+**Authoritative for:** Whether you may send a commercial message to a Canadian address at all. CASL is opt-in by default, which inverts the US assumption, and this is the text governing express versus implied consent.
+
+## Delivery restrictions and telephone solicitation rules, 47 CFR 64.1200
+
+US Federal Communications Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200>
+
+**Authoritative for:** The consent standard for marketing SMS and autodialed calls — what prior express written consent requires, how revocation must be handled, and the identification rules. Read the current text rather than a summary; this area moves in court.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/revenue/skills/pricing-and-packaging/SKILL.md b/plugins/revenue/skills/pricing-and-packaging/SKILL.md
index 0a41ab1..991d196 100644
--- a/plugins/revenue/skills/pricing-and-packaging/SKILL.md
+++ b/plugins/revenue/skills/pricing-and-packaging/SKILL.md
@@ -53,6 +53,13 @@ buy one conversion and lose the account.
 - Change one thing at a time — price and packaging together makes the result unreadable.
 - Model the downside first: at what churn rate does this increase lose money?
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Change price without telling existing customers before it takes effect and honoring what they already signed.
diff --git a/plugins/revenue/skills/pricing-and-packaging/references/sources.md b/plugins/revenue/skills/pricing-and-packaging/references/sources.md
new file mode 100644
index 0000000..7c8ce0a
--- /dev/null
+++ b/plugins/revenue/skills/pricing-and-packaging/references/sources.md
@@ -0,0 +1,51 @@
+# Sources — `revenue:pricing-and-packaging`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 15 U.S.C. 8403 — Restore Online Shoppers' Confidence Act
+
+US Congress, via the Office of the Law Revision Counsel · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section8403&num=0&edition=prelim>
+
+**Authoritative for:** Whether an online auto-renewal offer is lawful — clear disclosure of material terms before billing, express informed consent, and a simple cancellation mechanism. This area has seen rules issued and struck down, so cite the statute rather than a rule summary.
+
+## App Store Review Guidelines
+
+Apple · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://developer.apple.com/app-store/review/guidelines/>
+
+Machine-readable: <https://developer.apple.com/app-store/search/>
+
+**Authoritative for:** Whether a listing, screenshot set, price presentation or subscription flow will be rejected. Binding for anything shipping through the App Store, and copyrighted — cite the rule number, do not mirror the text.
+
+## California Automatic Renewal Law, Business and Professions Code 17600-17606
+
+California Legislative Counsel · US-CA · public domain — quote freely
+
+<https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=7.&chapter=1.&part=3.&lawCode=BPC&article=9.>
+
+**Authoritative for:** The concrete cancellation obligations a subscription business actually has to meet, because California's requirements are stricter than the federal floor and apply to any California customer — which in practice makes them the binding ones.
+
+## FASB Accounting Standards Codification
+
+Financial Accounting Standards Board · US · **account required — cite it; the user fetches it**
+
+<https://asc.fasb.org/>
+
+**Authoritative for:** US GAAP as it actually reads — revenue recognition, leases, impairment. The Basic View is free with an account and the text is copyrighted: cite the ASC number, do not reproduce the wording.
+
+## Guides Against Deceptive Pricing, 16 CFR 233
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-233>
+
+**Authoritative for:** Whether a 'was $X, now $Y', list-price, free-offer or percentage-off claim is lawful as presented.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/revenue/skills/referral-programs/SKILL.md b/plugins/revenue/skills/referral-programs/SKILL.md
index 09ccbad..61f7d68 100644
--- a/plugins/revenue/skills/referral-programs/SKILL.md
+++ b/plugins/revenue/skills/referral-programs/SKILL.md
@@ -54,6 +54,13 @@ you already had.
 Track referred-customer retention against baseline. If referred customers retain worse, the
 incentive is buying the wrong behavior and the program is losing money while appearing to work.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Launch referrals before the product retains. A referral program amplifies whatever is already there, churn included.
diff --git a/plugins/revenue/skills/referral-programs/references/sources.md b/plugins/revenue/skills/referral-programs/references/sources.md
new file mode 100644
index 0000000..5a20c21
--- /dev/null
+++ b/plugins/revenue/skills/referral-programs/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `revenue:referral-programs`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR 255
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255>
+
+**Authoritative for:** Whether a given influencer, affiliate, employee or review arrangement requires disclosure, and what counts as an adequate one. The regulation itself, rather than a summary of it.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/revenue/skills/retention/SKILL.md b/plugins/revenue/skills/retention/SKILL.md
index 81dfbae..95c4f17 100644
--- a/plugins/revenue/skills/retention/SKILL.md
+++ b/plugins/revenue/skills/retention/SKILL.md
@@ -50,6 +50,13 @@ Build a simple signal from declining usage, a support escalation, a champion goi
 count dropping. Then act on it while intervention is still possible — a health score nobody works is
 a dashboard, not a program.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Count a saved cancellation as retained without checking whether they stayed a quarter later.
diff --git a/plugins/revenue/skills/retention/references/sources.md b/plugins/revenue/skills/retention/references/sources.md
new file mode 100644
index 0000000..44a2b17
--- /dev/null
+++ b/plugins/revenue/skills/retention/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `revenue:retention`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 15 U.S.C. 8403 — Restore Online Shoppers' Confidence Act
+
+US Congress, via the Office of the Law Revision Counsel · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section8403&num=0&edition=prelim>
+
+**Authoritative for:** Whether an online auto-renewal offer is lawful — clear disclosure of material terms before billing, express informed consent, and a simple cancellation mechanism. This area has seen rules issued and struck down, so cite the statute rather than a rule summary.
+
+## California Automatic Renewal Law, Business and Professions Code 17600-17606
+
+California Legislative Counsel · US-CA · public domain — quote freely
+
+<https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=7.&chapter=1.&part=3.&lawCode=BPC&article=9.>
+
+**Authoritative for:** The concrete cancellation obligations a subscription business actually has to meet, because California's requirements are stricter than the federal floor and apply to any California customer — which in practice makes them the binding ones.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/revenue/skills/revenue-operations/SKILL.md b/plugins/revenue/skills/revenue-operations/SKILL.md
index 5d4ba1f..d56bc6d 100644
--- a/plugins/revenue/skills/revenue-operations/SKILL.md
+++ b/plugins/revenue/skills/revenue-operations/SKILL.md
@@ -71,6 +71,13 @@ be unusable within two quarters.
 Never require a field whose value is not used in a decision. Every unnecessary field trains sellers
 to enter garbage in all of them.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 CRM: Salesforce, HubSpot, Pipedrive, Zoho CRM, and similar. The CRM is the record for
diff --git a/plugins/revenue/skills/revenue-operations/references/sources.md b/plugins/revenue/skills/revenue-operations/references/sources.md
new file mode 100644
index 0000000..86c0391
--- /dev/null
+++ b/plugins/revenue/skills/revenue-operations/references/sources.md
@@ -0,0 +1,65 @@
+# Sources — `revenue:revenue-operations`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 15 U.S.C. 7001 — Electronic Signatures in Global and National Commerce Act
+
+US Congress, via the Office of the Law Revision Counsel · US · public domain (US government) — quote freely
+
+<https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section7001&num=0&edition=prelim>
+
+**Authoritative for:** Whether an electronically signed contract, a clickwrap acceptance or an emailed order form is enforceable, and what consumer consent steps must precede it.
+
+## 16 CFR Part 310 — Telemarketing Sales Rule
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310>
+
+**Authoritative for:** What an outbound seller must disclose before taking payment, which misrepresentations are prohibited, and what records the program must keep. The rule that makes a call script lawful or not.
+
+## California Labor Code 2751 — commission agreements in writing
+
+California Legislative Counsel · US-CA · public domain — quote freely
+
+<https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=LAB&sectionNum=2751>
+
+**Authoritative for:** Whether a commission arrangement is enforceable. California requires a signed written contract setting out how commission is computed and paid, which settles whether a plan can be changed mid-year by email.
+
+## Commission Guidance on Management's Discussion and Analysis, Release 33-10751
+
+US Securities and Exchange Commission · US · public domain (US government) — quote freely
+
+<https://www.federalregister.gov/documents/2020/02/25/2020-02296/commission-guidance-on-managements-discussion-and-analysis-of-financial-condition-and-results-of>
+
+**Authoritative for:** What a company must do when it publishes an operating metric — define it, disclose how it is calculated, apply it consistently, and explain any change in method. It disciplines metrics like recurring revenue and net retention without defining them, which is the honest ceiling on authority here.
+
+## FASB Accounting Standards Codification
+
+Financial Accounting Standards Board · US · **account required — cite it; the user fetches it**
+
+<https://asc.fasb.org/>
+
+**Authoritative for:** US GAAP as it actually reads — revenue recognition, leases, impairment. The Basic View is free with an account and the text is copyrighted: cite the ASC number, do not reproduce the wording.
+
+## Regulation (EU) 910/2014 — eIDAS
+
+Publications Office of the European Union · EU · free to use with attribution — credit the publisher
+
+<https://eur-lex.europa.eu/eli/reg/2014/910/oj>
+
+**Authoritative for:** Whether an electronic signature has legal effect in the EU and which of the three tiers a given contract requires. Settles whether an ordinary e-signature suffices for a particular European deal.
+
+## Uniform Commercial Code, Article 2 — Sales
+
+American Law Institute and Uniform Law Commission · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.law.cornell.edu/ucc/2>
+
+**Authoritative for:** When a contract for goods is formed, whose terms prevail in a battle of the forms, and what warranty disclaimer language is effective. Settles a purchase-order-versus-order-form dispute as law rather than as negotiating posture.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/revenue/skills/sales-compensation-and-territory/SKILL.md b/plugins/revenue/skills/sales-compensation-and-territory/SKILL.md
index 9a8271c..89f17ce 100644
--- a/plugins/revenue/skills/sales-compensation-and-territory/SKILL.md
+++ b/plugins/revenue/skills/sales-compensation-and-territory/SKILL.md
@@ -71,6 +71,13 @@ Mid-period changes are occasionally necessary and always expensive in trust. Giv
 the reason, and never restate a commission already earned under the prior plan. A team that
 believes the plan can be changed retroactively stops treating it as an incentive.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Commission calculation: CaptivateIQ, Spiff, Everstage, Xactly, and similar. The threshold for
diff --git a/plugins/revenue/skills/sales-compensation-and-territory/references/sources.md b/plugins/revenue/skills/sales-compensation-and-territory/references/sources.md
new file mode 100644
index 0000000..62f8063
--- /dev/null
+++ b/plugins/revenue/skills/sales-compensation-and-territory/references/sources.md
@@ -0,0 +1,25 @@
+# Sources — `revenue:sales-compensation-and-territory`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## California Labor Code 2751 — commission agreements in writing
+
+California Legislative Counsel · US-CA · public domain — quote freely
+
+<https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=LAB&sectionNum=2751>
+
+**Authoritative for:** Whether a commission arrangement is enforceable. California requires a signed written contract setting out how commission is computed and paid, which settles whether a plan can be changed mid-year by email.
+
+## Fact Sheet 17F: exemption for outside sales employees
+
+US Department of Labor, Wage and Hour Division · US · public domain (US government) — quote freely
+
+<https://www.dol.gov/agencies/whd/fact-sheets/17f-overtime-outside-sales>
+
+**Authoritative for:** Whether a sales role is exempt from overtime — the inside against outside classification question that territory design quietly creates.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/revenue/skills/sales-enablement/SKILL.md b/plugins/revenue/skills/sales-enablement/SKILL.md
index b8f471b..3e91e63 100644
--- a/plugins/revenue/skills/sales-enablement/SKILL.md
+++ b/plugins/revenue/skills/sales-enablement/SKILL.md
@@ -49,6 +49,13 @@ Collateral rots. Every asset needs an owner and a review date, and anything refe
 competitors, or product capability needs checking every quarter. A battlecard describing a
 competitor's old product loses deals.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Build collateral before you know where deals actually stall. Ask the reps and read the losses first.
diff --git a/plugins/revenue/skills/sales-enablement/references/sources.md b/plugins/revenue/skills/sales-enablement/references/sources.md
new file mode 100644
index 0000000..ccde161
--- /dev/null
+++ b/plugins/revenue/skills/sales-enablement/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `revenue:sales-enablement`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 16 CFR Part 310 — Telemarketing Sales Rule
+
+US Federal Trade Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310>
+
+**Authoritative for:** What an outbound seller must disclose before taking payment, which misrepresentations are prohibited, and what records the program must keep. The rule that makes a call script lawful or not.
+
+## 36 CFR Part 1194 — Section 508 information and communication technology standards
+
+US Access Board · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-36/subtitle-B/chapter-XI/part-1194>
+
+**Authoritative for:** What a product must satisfy to be lawfully procurable by a US federal agency. This decides a public-sector deal rather than expressing a design preference, which is why it reaches sales as often as engineering.
+
+## EN 301 549 — accessibility requirements for ICT products and services
+
+ETSI · EU · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf>
+
+**Authoritative for:** The requirement set an EU public-sector buyer measures against, including non-web software, documents and hardware that the web guidelines do not cover. Which version is legally operative depends on what the Official Journal currently cites — check before relying on a newer one.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/security/skills/access-and-identity/references/sources.md b/plugins/security/skills/access-and-identity/references/sources.md
index dc9f4ba..bd6c2f3 100644
--- a/plugins/security/skills/access-and-identity/references/sources.md
+++ b/plugins/security/skills/access-and-identity/references/sources.md
@@ -14,6 +14,16 @@ Machine-readable: <https://github.com/usnistgov/oscal-content>
 
 **Authoritative for:** The control catalog US federal systems are assessed against, and the control vocabulary FedRAMP and many private frameworks inherit.
 
+## NIST SP 800-63: Digital Identity Guidelines
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/63/4/final>
+
+Machine-readable: <https://pages.nist.gov/800-63-4/>
+
+**Authoritative for:** What each identity, authenticator and federation assurance level requires — and, notably, that forced periodic password rotation and composition rules are not among them.
+
 ---
 
 Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/security/skills/data-protection-and-encryption/SKILL.md b/plugins/security/skills/data-protection-and-encryption/SKILL.md
index 7ae64f6..1a4338f 100644
--- a/plugins/security/skills/data-protection-and-encryption/SKILL.md
+++ b/plugins/security/skills/data-protection-and-encryption/SKILL.md
@@ -72,6 +72,13 @@ The most reliable protection is not holding the data.
 - **Delete on a schedule you can evidence**, and confirm deletion reaches backups, replicas,
   analytics copies and archives — where it usually does not.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Describe data as encrypted without saying against which threat.
diff --git a/plugins/security/skills/data-protection-and-encryption/references/sources.md b/plugins/security/skills/data-protection-and-encryption/references/sources.md
new file mode 100644
index 0000000..5f8d6bd
--- /dev/null
+++ b/plugins/security/skills/data-protection-and-encryption/references/sources.md
@@ -0,0 +1,35 @@
+# Sources — `security:data-protection-and-encryption`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## FIPS 140-3: Security Requirements for Cryptographic Modules
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/fips/140-3/final>
+
+Machine-readable: <https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules>
+
+**Authoritative for:** Whether a cryptographic module is validated and at what level. Not an opinion about cryptographic quality — a certification fact that federal and many regulated buyers depend on.
+
+## NIST SP 800-57 Part 1: Recommendation for Key Management
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final>
+
+**Authoritative for:** Approved algorithms and key lengths, cryptoperiods by key type, and the full key lifecycle. The referee for how long a key may stay in use and whether a length is still acceptable.
+
+## PCI Data Security Standard
+
+PCI Security Standards Council · global · **account required — cite it; the user fetches it**
+
+<https://www.pcisecuritystandards.org/document_library/>
+
+**Authoritative for:** Whether a support agent may take a card number by phone, whether that call may be recorded, and what must happen to card data in ticket attachments and screen shares. Assessed by a qualified assessor, so genuinely dispositive.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/security/skills/detection-and-monitoring/SKILL.md b/plugins/security/skills/detection-and-monitoring/SKILL.md
index a13aba8..da55c7a 100644
--- a/plugins/security/skills/detection-and-monitoring/SKILL.md
+++ b/plugins/security/skills/detection-and-monitoring/SKILL.md
@@ -74,6 +74,13 @@ Detection coverage is assumed far more often than it is verified. Run the behavi
 version of the technique — and confirm the alert arrives, reaches a person, and carries enough
 context to act on. Coverage claimed from a configuration page is not coverage.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Retain logs for a window shorter than the time it typically takes to discover an intrusion.
diff --git a/plugins/security/skills/detection-and-monitoring/references/sources.md b/plugins/security/skills/detection-and-monitoring/references/sources.md
new file mode 100644
index 0000000..46dc962
--- /dev/null
+++ b/plugins/security/skills/detection-and-monitoring/references/sources.md
@@ -0,0 +1,43 @@
+# Sources — `security:detection-and-monitoring`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## MITRE ATT&CK
+
+The MITRE Corporation · global · free to use with attribution — credit the publisher
+
+<https://attack.mitre.org/>
+
+Machine-readable: <https://github.com/mitre-attack/attack-stix-data>
+
+**Authoritative for:** The shared vocabulary for adversary tactics and techniques — what to name a behavior so a detection, a threat model and an incident report refer to the same thing.
+
+## NIST SP 800-61: Incident Response Recommendations and Considerations
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/61/r3/final>
+
+**Authoritative for:** What an incident response capability must contain and what evidence must be captured at each stage. The current revision is a substantial rewrite that drops the older four-phase framing, so do not mix guidance across revisions.
+
+## NIST SP 800-92: Guide to Computer Security Log Management
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/92/final>
+
+**Authoritative for:** What log management must provide — source prioritization, retention and rotation, log integrity, and the review responsibility that makes logs useful rather than merely voluminous. The final version is old and a revision is in draft, so check for a newer one.
+
+## PCI Data Security Standard
+
+PCI Security Standards Council · global · **account required — cite it; the user fetches it**
+
+<https://www.pcisecuritystandards.org/document_library/>
+
+**Authoritative for:** Whether a support agent may take a card number by phone, whether that call may be recorded, and what must happen to card data in ticket attachments and screen shares. Assessed by a qualified assessor, so genuinely dispositive.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/security/skills/incident-response/references/sources.md b/plugins/security/skills/incident-response/references/sources.md
index ee0811c..4fdee89 100644
--- a/plugins/security/skills/incident-response/references/sources.md
+++ b/plugins/security/skills/incident-response/references/sources.md
@@ -24,6 +24,14 @@ Machine-readable: <https://github.com/mitre-attack/attack-stix-data>
 
 **Authoritative for:** The shared vocabulary for adversary tactics and techniques — what to name a behavior so a detection, a threat model and an incident report refer to the same thing.
 
+## NIST SP 800-61: Incident Response Recommendations and Considerations
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/61/r3/final>
+
+**Authoritative for:** What an incident response capability must contain and what evidence must be captured at each stage. The current revision is a substantial rewrite that drops the older four-phase framing, so do not mix guidance across revisions.
+
 ---
 
 Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/security/skills/vulnerability-management/references/sources.md b/plugins/security/skills/vulnerability-management/references/sources.md
index 816ced6..f8f1257 100644
--- a/plugins/security/skills/vulnerability-management/references/sources.md
+++ b/plugins/security/skills/vulnerability-management/references/sources.md
@@ -14,6 +14,14 @@ Machine-readable: <https://www.cisa.gov/sites/default/files/feeds/known_exploite
 
 **Authoritative for:** Which vulnerabilities are being exploited in the wild right now — the only list that reliably separates patch-this-week from patch-this-quarter.
 
+## NIST SP 800-40: Guide to Enterprise Patch Management Planning
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/40/r4/final>
+
+**Authoritative for:** What a defensible patch program contains — maintenance windows, phased deployment, and the position that leaving something unpatched requires documented compensating controls rather than silence.
+
 ## National Vulnerability Database
 
 NIST · US · public domain (US government) — quote freely
diff --git a/plugins/technology/skills/ai-workflow-architect/SKILL.md b/plugins/technology/skills/ai-workflow-architect/SKILL.md
index 8208569..b1ef586 100644
--- a/plugins/technology/skills/ai-workflow-architect/SKILL.md
+++ b/plugins/technology/skills/ai-workflow-architect/SKILL.md
@@ -87,6 +87,13 @@ Data leaving your control, model output reaching customers unreviewed, a silent
 vendor's pricing, and the maintenance burden landing on one person. Name the owner of each before
 building, not after.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Automate a process nobody has written down. You will automate the exceptions along with the work.
diff --git a/plugins/technology/skills/ai-workflow-architect/references/sources.md b/plugins/technology/skills/ai-workflow-architect/references/sources.md
new file mode 100644
index 0000000..a7a69e0
--- /dev/null
+++ b/plugins/technology/skills/ai-workflow-architect/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `technology:ai-workflow-architect`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Model Context Protocol specification
+
+Model Context Protocol project · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://modelcontextprotocol.io/specification/latest>
+
+**Authoritative for:** The protocol between an agent host and a tool or resource server — message shapes, lifecycle, transports, and what a conformant server must implement.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/technology/skills/api-design/SKILL.md b/plugins/technology/skills/api-design/SKILL.md
index 443fe00..32843cd 100644
--- a/plugins/technology/skills/api-design/SKILL.md
+++ b/plugins/technology/skills/api-design/SKILL.md
@@ -51,6 +51,13 @@ offset pagination silently skips and duplicates records under concurrent writes.
 State rate limits in the contract and communicate them in responses. An undocumented limit is
 discovered in the consumer's production incident.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Specification and documentation: OpenAPI with Redocly, Stoplight, or Scalar; gRPC with protocol
diff --git a/plugins/technology/skills/api-design/references/sources.md b/plugins/technology/skills/api-design/references/sources.md
new file mode 100644
index 0000000..08b3a46
--- /dev/null
+++ b/plugins/technology/skills/api-design/references/sources.md
@@ -0,0 +1,49 @@
+# Sources — `technology:api-design`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## OpenAPI Specification
+
+OpenAPI Initiative, Linux Foundation · global · free to use with attribution — credit the publisher
+
+<https://spec.openapis.org/oas/latest.html>
+
+**Authoritative for:** What a valid API description document contains. Settles whether a given file is conformant rather than merely accepted by one tool.
+
+## RFC 9110: HTTP Semantics
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc9110.html>
+
+**Authoritative for:** What an HTTP method, status code or header actually means. Settles whether PUT is idempotent, whether 409 or 422 is correct, and what a conditional request obliges a server to do.
+
+## RFC 9457: Problem Details for HTTP APIs
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc9457.html>
+
+**Authoritative for:** The wire format of an API error body. It obsoletes RFC 7807, so it also settles which of the two a new service should follow.
+
+## RFC 9700: Best Current Practice for OAuth 2.0 Security
+
+IETF · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.rfc-editor.org/rfc/rfc9700.html>
+
+**Authoritative for:** Which OAuth 2.0 patterns remain permitted — that the implicit grant and password grant must not be used, that PKCE is required, and that redirect URIs must match exactly.
+
+## Semantic Versioning 2.0.0
+
+Semantic Versioning project · global · CC BY — quote with attribution
+
+<https://semver.org/>
+
+**Authoritative for:** What a version increment is allowed to mean, and therefore whether a given change requires a major bump. A community specification rather than a standards body, but the one every dependency resolver assumes.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/technology/skills/branch-and-worktree-workflow/SKILL.md b/plugins/technology/skills/branch-and-worktree-workflow/SKILL.md
index 78d3b16..f2fc234 100644
--- a/plugins/technology/skills/branch-and-worktree-workflow/SKILL.md
+++ b/plugins/technology/skills/branch-and-worktree-workflow/SKILL.md
@@ -36,6 +36,13 @@ Then decide how it integrates:
   merits. A reviewer given three concerns in one diff reviews none of them well.
 - **Exploratory** — keep the useful commits, drop the rest.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Rewrite history on a branch someone else has checked out. Merge instead; a force-push breaks their
diff --git a/plugins/technology/skills/branch-and-worktree-workflow/references/sources.md b/plugins/technology/skills/branch-and-worktree-workflow/references/sources.md
new file mode 100644
index 0000000..b1ddb6d
--- /dev/null
+++ b/plugins/technology/skills/branch-and-worktree-workflow/references/sources.md
@@ -0,0 +1,33 @@
+# Sources — `technology:branch-and-worktree-workflow`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Conventional Commits 1.0.0
+
+Conventional Commits project · global · CC BY — quote with attribution
+
+<https://www.conventionalcommits.org/en/v1.0.0/>
+
+**Authoritative for:** The grammar of a commit message, and how a breaking change is marked so that tooling can derive a version bump from history.
+
+## Git reference manual
+
+Git project · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://git-scm.com/docs>
+
+**Authoritative for:** What a Git operation actually does — what a worktree is, what rebase rewrites, what detached HEAD means. It settles behavior, not which workflow a team should adopt.
+
+## Semantic Versioning 2.0.0
+
+Semantic Versioning project · global · CC BY — quote with attribution
+
+<https://semver.org/>
+
+**Authoritative for:** What a version increment is allowed to mean, and therefore whether a given change requires a major bump. A community specification rather than a standards body, but the one every dependency resolver assumes.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/technology/skills/chief-technology-officer/SKILL.md b/plugins/technology/skills/chief-technology-officer/SKILL.md
index cfcf49d..ede308d 100644
--- a/plugins/technology/skills/chief-technology-officer/SKILL.md
+++ b/plugins/technology/skills/chief-technology-officer/SKILL.md
@@ -85,6 +85,13 @@ These are the artifacts of record. Where two of them disagree, this one is right
 
 Escalate to Chief Executive when a technical constraint forces a change in scope, timeline, or strategy; to Legal & Risk when a choice creates a regulatory or contractual exposure.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Never approve your own architecture — pair every design with an independent reviewer
diff --git a/plugins/technology/skills/chief-technology-officer/references/sources.md b/plugins/technology/skills/chief-technology-officer/references/sources.md
new file mode 100644
index 0000000..b696c36
--- /dev/null
+++ b/plugins/technology/skills/chief-technology-officer/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `technology:chief-technology-officer`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Regulation (EU) 2024/1689 — the AI Act
+
+Publications Office of the European Union · EU · free to use with attribution — credit the publisher
+
+<https://eur-lex.europa.eu/eli/reg/2024/1689/oj>
+
+**Authoritative for:** Whether an AI system is prohibited, high-risk or limited-risk in the EU and what obligations attach. Binding law rather than guidance, and only the Official Journal version is authentic.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/technology/skills/cloud-infrastructure/SKILL.md b/plugins/technology/skills/cloud-infrastructure/SKILL.md
index 55b6dc1..6a6d19a 100644
--- a/plugins/technology/skills/cloud-infrastructure/SKILL.md
+++ b/plugins/technology/skills/cloud-infrastructure/SKILL.md
@@ -57,6 +57,13 @@ tagging, cost becomes an unattributable aggregate that only ever gets addressed
 The usual large wins are unglamorous: idle non-production resources, over-provisioned instances,
 storage nobody deleted, and cross-zone data transfer nobody accounted for.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Platforms: AWS, Google Cloud, Microsoft Azure, and similar; managed application platforms —
diff --git a/plugins/technology/skills/cloud-infrastructure/references/sources.md b/plugins/technology/skills/cloud-infrastructure/references/sources.md
new file mode 100644
index 0000000..6a46986
--- /dev/null
+++ b/plugins/technology/skills/cloud-infrastructure/references/sources.md
@@ -0,0 +1,41 @@
+# Sources — `technology:cloud-infrastructure`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## AWS Well-Architected Framework
+
+Amazon Web Services · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html>
+
+**Authoritative for:** What AWS itself considers a correct design on AWS, and therefore what an AWS architecture review will be graded against.
+
+## Azure Well-Architected Framework
+
+Microsoft · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://learn.microsoft.com/en-us/azure/well-architected/>
+
+**Authoritative for:** Microsoft's own normative design guidance for Azure, and the basis of its assessment tooling.
+
+## Google Cloud Architecture Framework
+
+Google Cloud · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://cloud.google.com/architecture/framework>
+
+**Authoritative for:** Google Cloud's own normative design guidance, and what its architecture reviews assess against.
+
+## NIST SP 800-145: The NIST Definition of Cloud Computing
+
+NIST · US · public domain (US government) — quote freely
+
+<https://csrc.nist.gov/pubs/sp/800/145/final>
+
+**Authoritative for:** What counts as infrastructure, platform or software as a service, and what public, private, community and hybrid mean. Still the definition contracts and audits cite.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/technology/skills/observability-and-reliability/SKILL.md b/plugins/technology/skills/observability-and-reliability/SKILL.md
index 2fde7bf..6f4b83a 100644
--- a/plugins/technology/skills/observability-and-reliability/SKILL.md
+++ b/plugins/technology/skills/observability-and-reliability/SKILL.md
@@ -54,6 +54,13 @@ defect, and it is the part that repeats.
 Produce a small number of real actions with owners and dates. A review generating fifteen actions
 generates none.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Tooling
 
 Metrics and traces: Datadog, Grafana with Prometheus, New Relic, Honeycomb, and similar.
diff --git a/plugins/technology/skills/observability-and-reliability/references/sources.md b/plugins/technology/skills/observability-and-reliability/references/sources.md
new file mode 100644
index 0000000..82cebc8
--- /dev/null
+++ b/plugins/technology/skills/observability-and-reliability/references/sources.md
@@ -0,0 +1,37 @@
+# Sources — `technology:observability-and-reliability`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## OpenTelemetry specification and semantic conventions
+
+OpenTelemetry project, Cloud Native Computing Foundation · global · CC BY — quote with attribution
+
+<https://opentelemetry.io/docs/specs/otel/>
+
+Machine-readable: <https://opentelemetry.io/docs/specs/semconv/>
+
+**Authoritative for:** The data model for traces, metrics and logs, and — in the semantic conventions — the attribute names themselves, which is what naming arguments actually turn on.
+
+## Site Reliability Engineering and The SRE Workbook
+
+Google · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://sre.google/sre-book/table-of-contents/>
+
+Machine-readable: <https://sre.google/workbook/table-of-contents/>
+
+**Authoritative for:** The definitions the reliability vocabulary rests on — indicator against objective against agreement, error budget, toil. It settles what the words mean, not whether a practice suits your organization.
+
+## Trace Context
+
+World Wide Web Consortium · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.w3.org/TR/trace-context/>
+
+**Authoritative for:** The on-the-wire format of the traceparent and tracestate headers, which settles how trace context propagates between tools from different vendors.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/technology/skills/parallel-agent-delivery/SKILL.md b/plugins/technology/skills/parallel-agent-delivery/SKILL.md
index 969655d..193b299 100644
--- a/plugins/technology/skills/parallel-agent-delivery/SKILL.md
+++ b/plugins/technology/skills/parallel-agent-delivery/SKILL.md
@@ -39,6 +39,13 @@ Reach for parallelism here first and freely.
 - Where two disagree on a shared fact, neither is authoritative — resolve it yourself.
 - One agent returning nothing useful is a normal outcome, not a failure to retry blindly.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Split work to look faster when the steps are actually sequential.
diff --git a/plugins/technology/skills/parallel-agent-delivery/references/sources.md b/plugins/technology/skills/parallel-agent-delivery/references/sources.md
new file mode 100644
index 0000000..827ebef
--- /dev/null
+++ b/plugins/technology/skills/parallel-agent-delivery/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `technology:parallel-agent-delivery`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Git reference manual
+
+Git project · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://git-scm.com/docs>
+
+**Authoritative for:** What a Git operation actually does — what a worktree is, what rebase rewrites, what detached HEAD means. It settles behavior, not which workflow a team should adopt.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/technology/skills/skill-authoring/SKILL.md b/plugins/technology/skills/skill-authoring/SKILL.md
index 139e922..5e87070 100644
--- a/plugins/technology/skills/skill-authoring/SKILL.md
+++ b/plugins/technology/skills/skill-authoring/SKILL.md
@@ -48,6 +48,13 @@ family into one skill with references, over adding a near-neighbor.
 Write three requests that should trigger it and two that should not, and check the description
 actually discriminates. If a near-miss request would pull it in, tighten the description.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Ship a skill whose description does not say when to use it. A skill that never triggers is dead weight.
diff --git a/plugins/technology/skills/skill-authoring/references/sources.md b/plugins/technology/skills/skill-authoring/references/sources.md
new file mode 100644
index 0000000..b10caa3
--- /dev/null
+++ b/plugins/technology/skills/skill-authoring/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `technology:skill-authoring`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Agent Skills documentation
+
+Anthropic · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview>
+
+**Authoritative for:** The SKILL.md format and its loading semantics — required frontmatter, body, and how bundled resources are surfaced. The format, not what makes a skill good.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/technology/skills/solution-architecture/SKILL.md b/plugins/technology/skills/solution-architecture/SKILL.md
index 6844917..20a6d09 100644
--- a/plugins/technology/skills/solution-architecture/SKILL.md
+++ b/plugins/technology/skills/solution-architecture/SKILL.md
@@ -48,6 +48,13 @@ next team reads a constraint as an accident.
 
 Keep records short and immutable — supersede rather than edit, so the history of thinking survives.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Design against quality attributes nobody has quantified.
diff --git a/plugins/technology/skills/solution-architecture/references/sources.md b/plugins/technology/skills/solution-architecture/references/sources.md
new file mode 100644
index 0000000..4284884
--- /dev/null
+++ b/plugins/technology/skills/solution-architecture/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `technology:solution-architecture`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## AWS Well-Architected Framework
+
+Amazon Web Services · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html>
+
+**Authoritative for:** What AWS itself considers a correct design on AWS, and therefore what an AWS architecture review will be graded against.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/plugins/technology/skills/technical-debt-management/SKILL.md b/plugins/technology/skills/technical-debt-management/SKILL.md
index 9468899..bfac0a1 100644
--- a/plugins/technology/skills/technical-debt-management/SKILL.md
+++ b/plugins/technology/skills/technical-debt-management/SKILL.md
@@ -46,6 +46,13 @@ without leaving a mess.
 Improve opportunistically where you are already working — the code you are touching anyway is the
 cheapest code to improve, and it is by definition the code that is being touched.
 
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
 ## Never
 
 - Present debt as a quality argument to someone accountable for delivery dates.
diff --git a/plugins/technology/skills/technical-debt-management/references/sources.md b/plugins/technology/skills/technical-debt-management/references/sources.md
new file mode 100644
index 0000000..4937341
--- /dev/null
+++ b/plugins/technology/skills/technical-debt-management/references/sources.md
@@ -0,0 +1,17 @@
+# Sources — `technology:technical-debt-management`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Automated Technical Debt Measure
+
+Object Management Group · global · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.omg.org/spec/ATDM/>
+
+**Authoritative for:** How technical debt is computed from source code as a standardized measure. It settles why two debt numbers disagree; it settles nothing about whether to pay the debt down.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.
diff --git a/scripts/check-provenance.py b/scripts/check-provenance.py
index 32ffe8c..2634a6c 100755
--- a/scripts/check-provenance.py
+++ b/scripts/check-provenance.py
@@ -2,7 +2,7 @@
 """All content here is original. This is a heuristic backstop, not proof: it catches the common
 shapes of third-party license text and vendored assets. It cannot detect prose copied without a
 notice, so it supplements review rather than replacing it."""
-import glob, os, re, sys
+import fnmatch, glob, os, re, sys
 
 # Markers for the licenses most likely to arrive with vendored material.
 PATTERNS = [
@@ -48,12 +48,20 @@
 # (c)", "Redistribution and use..."), which no real license lacks. This is the same reasoning as the
 # MIT waiver above: a name is a reference, a body is a copy.
 #
-# The catalog itself holds no license names to waive — entries carry a short slug (`cc-by-sa`) and
-# never the family's prose name — so the waiver deliberately does not extend to `sources/*.toml`.
-LICENSE_FAMILY_MENTION = {"sources/README.md", ".claude/agents/sources.md"}
+# This originally excluded the catalog files themselves, on the reasoning that entries carry a short
+# slug (`cc-by-sa`) and never a family's prose name. That stopped being true the moment a license
+# became a *source*: a font license is the authority on whether a typeface may be embedded, so its
+# title is the family name. The waiver now covers the catalog and what is generated from it.
+LICENSE_FAMILY_MENTION_GLOBS = (
+    "sources/*.toml",
+    "sources/README.md",
+    ".claude/agents/sources.md",
+    "docs/SOURCES.md",
+    "plugins/*/skills/*/references/sources.md",
+)
 LICENSE_FAMILY_PATTERNS = {r"\bCreative Commons Attribution\b", r"\bMIT License\b",
                            r"\bApache License\b", r"\bBSD \d-Clause\b",
-                           r"\bMozilla Public License\b"}
+                           r"\bMozilla Public License\b", r"\bSIL Open Font License\b"}
 
 # Generated output and build byproducts are not this repository's content. `dist/` in particular
 # is a copy of the tree already being checked, so scanning it doubles every finding.
@@ -97,7 +105,8 @@ def is_probably_text(path, sniff=4096):
         continue
     text = open(path, encoding="utf-8", errors="replace").read()
     waived = {OWN_LICENSE_PATTERN} if path in OWN_LICENSE_MENTION else set()
-    if path in LICENSE_FAMILY_MENTION:
+    if any(fnmatch.fnmatch(path.replace(os.sep, "/").lstrip("./"), g)
+           for g in LICENSE_FAMILY_MENTION_GLOBS):
         waived |= LICENSE_FAMILY_PATTERNS
     for pattern in PATTERNS:
         if pattern in waived:
diff --git a/scripts/check-us-english.py b/scripts/check-us-english.py
index 65e98b6..d651859 100755
--- a/scripts/check-us-english.py
+++ b/scripts/check-us-english.py
@@ -95,6 +95,17 @@
 TEXT_EXT = {".md", ".py", ".sh", ".json", ".yml", ".yaml", ".html", ".txt", ".mjs", ".js"}
 
 
+# A URL is an address, not prose. Spelling it "correctly" changes where it points — and because
+# --fix rewrites in place, a British spelling inside a link silently became a broken link and the
+# build then went green. The UK regulator whose own path is /for-organisations/ is what exposed it.
+# Masked rather than skipped line-by-line, so a sentence with a link in it is still checked.
+URL = re.compile(r"""(?:https?://|www\.)[^\s<>"'`)\]]+""")
+
+
+def mask_urls(text):
+    return URL.sub(lambda m: "\0" * len(m.group(0)), text)
+
+
 def match_case(british, american):
     if british.isupper():
         return american.upper()
@@ -121,16 +132,24 @@ def main():
             text = open(path, encoding="utf-8").read()
         except (UnicodeDecodeError, OSError):
             continue
-        if not WORD.search(text):
+        masked = mask_urls(text)
+        if not WORD.search(masked):
             continue
 
         if fix:
-            new = WORD.sub(lambda m: match_case(m.group(1), PAIRS[m.group(1).lower()]), text)
+            # Rebuild from the original text, using the mask only to decide which spans to touch.
+            out, last = [], 0
+            for m in WORD.finditer(masked):
+                out.append(text[last:m.start()])
+                out.append(match_case(m.group(1), PAIRS[m.group(1).lower()]))
+                last = m.end()
+            out.append(text[last:])
+            new = "".join(out)
             if new != text:
                 open(path, "w", encoding="utf-8").write(new)
                 changed += 1
         else:
-            for n, line in enumerate(text.splitlines(), 1):
+            for n, line in enumerate(masked.splitlines(), 1):
                 for m in WORD.finditer(line):
                     b = m.group(1)
                     problems.append(f"{path}:{n}: '{b}' -> '{match_case(b, PAIRS[b.lower()])}'")
diff --git a/sources/data-and-workforce.toml b/sources/data-and-workforce.toml
new file mode 100644
index 0000000..4d0f02e
--- /dev/null
+++ b/sources/data-and-workforce.toml
@@ -0,0 +1,352 @@
+# AI governance, data specifications, statistical method, and the employment rules that constrain
+# how people are hired, classified and paid.
+#
+# One finding from the research is worth carrying: a federal agency's technical assistance document
+# on AI in hiring — widely cited — was withdrawn from its own site. A skill citing it would send an
+# agent to a dead link. The durable substitute is the regulation underneath it, which is far harder
+# to withdraw than a guidance page. That is a general lesson for this catalog: prefer the rule to
+# the explainer, because the explainer is what disappears.
+
+# ── AI governance ─────────────────────────────────────────────────────────────
+
+[[source]]
+id = "nist-ai-rmf"
+title = "NIST AI Risk Management Framework, AI 100-1"
+publisher = "NIST"
+url = "https://www.nist.gov/itl/ai-risk-management-framework"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What the four AI risk functions are and what an organization must be able to evidence under each. It ends the argument about what claiming to have an AI governance program has to mean concretely."
+data = "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf"
+skills = ["data-analytics:ai-ml-governance", "data-analytics:chief-data-officer", "executive:ai-research-analyst"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-ai-rmf-playbook"
+title = "NIST AI RMF Playbook"
+publisher = "NIST"
+url = "https://airc.nist.gov/airmf-resources/playbook/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "For each framework subcategory, which actions and documentation artifacts satisfy it. The operational layer the framework itself deliberately leaves abstract."
+skills = ["data-analytics:ai-ml-governance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-ai-genai-profile"
+title = "NIST AI 600-1: Generative AI Profile"
+publisher = "NIST"
+url = "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Which risks are unique to or amplified by generative models, as distinct from general machine learning risk. Settles the claim that generative systems are just another model."
+data = "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf"
+skills = ["data-analytics:ai-ml-governance", "executive:ai-research-analyst"]
+checked = "2026-09-16"
+
+[[source]]
+id = "oecd-ai-principles"
+title = "OECD Recommendation of the Council on Artificial Intelligence"
+publisher = "OECD"
+url = "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449"
+license = "attribution-required"
+jurisdiction = "global"
+authoritative_for = "The intergovernmentally agreed definition of an AI system, which other regimes adopt by reference. That definitional question is the one it actually settles."
+skills = ["data-analytics:ai-ml-governance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "iso-42001"
+title = "ISO/IEC 42001 — AI management systems"
+publisher = "ISO"
+url = "https://www.iso.org/standard/42001.html"
+license = "paywalled"
+jurisdiction = "global"
+authoritative_for = "What a certifiable AI management system requires — the only thing an external auditor can certify against, and increasingly what enterprise customers ask for by name. Sold, so name the clause and never reproduce it."
+skills = ["data-analytics:ai-ml-governance"]
+checked = "2026-09-16"
+
+# ── Data specifications ───────────────────────────────────────────────────────
+
+[[source]]
+id = "w3c-dcat"
+title = "Data Catalog Vocabulary"
+publisher = "World Wide Web Consortium"
+url = "https://www.w3.org/TR/vocab-dcat-3/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "The interoperable vocabulary for describing datasets and catalogs — what a catalog entry must carry to be exchangeable rather than specific to one tool."
+skills = ["data-analytics:chief-data-officer", "data-analytics:data-engineering"]
+checked = "2026-09-16"
+
+[[source]]
+id = "w3c-shacl"
+title = "Shapes Constraint Language"
+publisher = "World Wide Web Consortium"
+url = "https://www.w3.org/TR/shacl/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "How a data constraint is expressed and what conformance means — the normative answer to whether a record is valid against a model, rather than each tool inventing its own semantics."
+skills = ["data-analytics:data-modeling", "data-analytics:data-engineering"]
+checked = "2026-09-16"
+
+[[source]]
+id = "apache-iceberg-spec"
+title = "Apache Iceberg table specification"
+publisher = "Apache Software Foundation"
+url = "https://iceberg.apache.org/spec/"
+license = "attribution-required"
+jurisdiction = "global"
+authoritative_for = "The on-disk contract — metadata layout, snapshots, schema and partition evolution, and what isolation a reader may assume. The document that decides whether two engines agree on what a table is."
+skills = ["data-analytics:data-engineering", "data-analytics:data-modeling"]
+checked = "2026-09-16"
+
+[[source]]
+id = "apache-parquet-spec"
+title = "Apache Parquet file format specification"
+publisher = "Apache Software Foundation"
+url = "https://parquet.apache.org/docs/file-format/"
+license = "attribution-required"
+jurisdiction = "global"
+authoritative_for = "Physical layout, encodings, nesting and the statistics a reader may rely on for predicate pushdown. The normative answer to why a file is slow or unreadable."
+skills = ["data-analytics:data-engineering"]
+checked = "2026-09-16"
+
+[[source]]
+id = "openlineage-spec"
+title = "OpenLineage object model"
+publisher = "LF AI and Data Foundation"
+url = "https://openlineage.io/docs/spec/object-model/"
+license = "attribution-required"
+jurisdiction = "global"
+authoritative_for = "The vendor-neutral event schema for lineage — what an event must contain to be portable, rather than whatever one catalog happens to record."
+skills = ["data-analytics:data-engineering", "data-analytics:chief-data-officer"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nara-general-records-schedules"
+title = "General Records Schedules"
+publisher = "US National Archives and Records Administration"
+url = "https://www.archives.gov/records-mgmt/grs"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Minimum retention and disposition periods for common administrative record classes. Binding on federal agencies only — for a private company it is a defensible published baseline rather than law, which is still better than arguing from habit."
+skills = ["data-analytics:chief-data-officer", "legal-risk:disputes-and-legal-holds"]
+checked = "2026-09-16"
+
+# ── Statistical method ────────────────────────────────────────────────────────
+
+[[source]]
+id = "nist-sematech-handbook"
+title = "NIST/SEMATECH e-Handbook of Statistical Methods"
+publisher = "NIST"
+url = "https://www.itl.nist.gov/div898/handbook/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The correct procedure, assumptions and interpretation for a named statistical technique. A neutral referee when two analysts disagree on method — strong on classical methods, silent on modern causal inference."
+skills = ["data-analytics:quantitative-analysis"]
+checked = "2026-09-16"
+
+[[source]]
+id = "census-quality-standards"
+title = "Statistical Quality Standards"
+publisher = "US Census Bureau"
+url = "https://www.census.gov/about/policies/quality/standards.html"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The quality requirements at each stage of producing a statistical product, including when an estimate must be suppressed or flagged rather than published."
+skills = ["data-analytics:quantitative-analysis", "data-analytics:business-intelligence"]
+checked = "2026-09-16"
+
+[[source]]
+id = "bls-handbook-of-methods"
+title = "BLS Handbook of Methods"
+publisher = "US Bureau of Labor Statistics"
+url = "https://www.bls.gov/opub/hom/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What each labor statistic actually measures and how. Ends the common error of comparing two series that measure different things, which is most disagreements about labor market data."
+data = "https://www.bls.gov/developers/"
+skills = ["data-analytics:quantitative-analysis", "people:workforce-planning"]
+checked = "2026-09-16"
+
+[[source]]
+id = "onet-database"
+title = "O*NET database"
+publisher = "National Center for O*NET Development, US Department of Labor"
+url = "https://www.onetcenter.org/database.html"
+license = "cc-by"
+jurisdiction = "US"
+authoritative_for = "The canonical task, skill, knowledge and ability content of an occupation. A neutral reference when arguing about what a role comprises or how two roles overlap — and openly licensed, which is rare here."
+skills = ["people:workforce-planning", "people:org-design", "people:learning-and-development"]
+checked = "2026-09-16"
+
+# ── Employment law that constrains design ─────────────────────────────────────
+
+[[source]]
+id = "uniform-guidelines-selection"
+title = "29 CFR Part 1607 — Uniform Guidelines on Employee Selection Procedures"
+publisher = "US Equal Employment Opportunity Commission"
+url = "https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XIV/part-1607"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What counts as a selection procedure, when adverse impact exists, and what validation evidence an employer must hold to defend one that has it. This is the document that settles disputes about hiring tests, scored assessments and promotion criteria — including automated ones."
+skills = ["people:hiring-and-interviewing", "people:performance-management", "data-analytics:ai-ml-governance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "eeoc-ai-and-ada"
+title = "Artificial Intelligence and the ADA"
+publisher = "US Equal Employment Opportunity Commission"
+url = "https://www.eeoc.gov/eeoc-disability-related-resources/artificial-intelligence-and-ada"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "When an algorithmic assessment screens out a person with a disability, and what accommodation is owed inside an automated hiring flow."
+skills = ["people:hiring-and-interviewing", "data-analytics:ai-ml-governance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fmla-regulations"
+title = "29 CFR Part 825 — Family and Medical Leave Act regulations"
+publisher = "US Department of Labor, Wage and Hour Division"
+url = "https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-C/part-825"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Employer coverage and employee eligibility, what counts as a serious health condition, intermittent leave, notice and certification, and reinstatement. Ends nearly every operational leave dispute."
+skills = ["people:benefits-and-leave", "people:employment-compliance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "flsa-exemption-541"
+title = "29 CFR Part 541 — exemption regulations"
+publisher = "US Department of Labor, Wage and Hour Division"
+url = "https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-A/part-541"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a role can lawfully be classified exempt — the salary basis, salary level and duties tests. Organization design is judgment, but which levels may be exempt and what a manager must actually do is settled law."
+skills = ["people:org-design", "people:compensation-and-leveling", "people:employment-compliance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "dol-ebsa-erisa"
+title = "ERISA — laws and regulations"
+publisher = "US Department of Labor, Employee Benefits Security Administration"
+url = "https://www.dol.gov/agencies/ebsa/laws-and-regulations/laws/erisa"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Fiduciary duty, plan documents, reporting, participant disclosure and claims procedure for employer-sponsored plans — what a plan sponsor is legally on the hook for."
+skills = ["people:benefits-and-leave"]
+checked = "2026-09-16"
+
+[[source]]
+id = "irs-pub-15b"
+title = "IRS Publication 15-B: Employer's Tax Guide to Fringe Benefits"
+publisher = "US Internal Revenue Service"
+url = "https://www.irs.gov/pub/irs-pdf/p15b.pdf"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Which fringe benefits are excludable from income and which are taxable, with valuation and withholding treatment. Reissued annually at a stable address, so it is never stale."
+skills = ["people:benefits-and-leave", "finance:tax"]
+checked = "2026-09-16"
+
+[[source]]
+id = "uscis-i9-handbook"
+title = "Handbook for Employers M-274: guidance for completing Form I-9"
+publisher = "US Citizenship and Immigration Services"
+url = "https://www.uscis.gov/i-9-central/form-i-9-resources/handbook-for-employers-m-274"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Which documents are acceptable for employment eligibility verification, how to correct an error, what triggers reverification, and the retention clock."
+skills = ["people:onboarding-and-offboarding", "people:employment-compliance"]
+checked = "2026-09-16"
+
+# ── Finance, governance and security gaps ─────────────────────────────────────
+
+[[source]]
+id = "cost-accounting-standards"
+title = "48 CFR Chapter 99 — Cost Accounting Standards"
+publisher = "Cost Accounting Standards Board"
+url = "https://www.ecfr.gov/current/title-48/chapter-99"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "For covered government contractors, the mandatory treatment of cost allocation — consistency in estimating and reporting, indirect and home-office allocation, and the disclosure statement. Where it applies, cost accounting stops being a matter of preference."
+skills = ["finance:cost-accounting"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fed-leveraged-lending"
+title = "Interagency Guidance on Leveraged Lending, SR 13-3"
+publisher = "Board of Governors of the Federal Reserve System"
+url = "https://www.federalreserve.gov/supervisionreg/srletters/sr1303.htm"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What regulators treat as a leveraged transaction and the repayment-capacity, covenant and valuation analysis they expect behind a credit agreement. Supervisory guidance rather than a rule — the analytical lens, not binding law."
+skills = ["finance:capital-structure-and-covenants"]
+checked = "2026-09-16"
+
+[[source]]
+id = "frcp"
+title = "Federal Rules of Civil Procedure"
+publisher = "Administrative Office of the US Courts"
+url = "https://www.uscourts.gov/forms-rules/current-rules-practice-procedure/federal-rules-civil-procedure"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The duty to preserve and what follows from failing it — proportionality, the discovery conference, form of production, and the exclusive framework and intent threshold for sanctions over lost electronic evidence."
+skills = ["legal-risk:disputes-and-legal-holds"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sedona-conference"
+title = "The Sedona Principles and Commentary on Legal Holds"
+publisher = "The Sedona Conference"
+url = "https://www.thesedonaconference.org/publications"
+license = "free-to-read"
+jurisdiction = "US"
+authoritative_for = "The operational standard of care for electronic discovery that federal courts routinely cite — when the duty to preserve triggers, the scope of a defensible hold, and custodian notice practice. Free to download, copyrighted, so cite rather than reproduce."
+skills = ["legal-risk:disputes-and-legal-holds"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nyse-listed-company-manual"
+title = "NYSE Listed Company Manual"
+publisher = "New York Stock Exchange"
+url = "https://nyse.wolterskluwer.cloud/listed-company-manual"
+license = "free-to-read"
+jurisdiction = "US"
+authoritative_for = "What a listed issuer must do to stay listed — board independence tests, committee composition, shareholder approval thresholds and immediate disclosure obligations. Binding as a listing condition."
+skills = ["legal-risk:corporate-governance", "executive:fundraising-and-investor-relations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fips-140-3"
+title = "FIPS 140-3: Security Requirements for Cryptographic Modules"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/fips/140-3/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a cryptographic module is validated and at what level. Not an opinion about cryptographic quality — a certification fact that federal and many regulated buyers depend on."
+data = "https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules"
+skills = ["security:data-protection-and-encryption"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-sp-800-57-key-management"
+title = "NIST SP 800-57 Part 1: Recommendation for Key Management"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Approved algorithms and key lengths, cryptoperiods by key type, and the full key lifecycle. The referee for how long a key may stay in use and whether a length is still acceptable."
+skills = ["security:data-protection-and-encryption"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-sp-800-92-logging"
+title = "NIST SP 800-92: Guide to Computer Security Log Management"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/92/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What log management must provide — source prioritization, retention and rotation, log integrity, and the review responsibility that makes logs useful rather than merely voluminous. The final version is old and a revision is in draft, so check for a newer one."
+skills = ["security:detection-and-monitoring"]
+checked = "2026-09-16"
diff --git a/sources/finance-and-tax.toml b/sources/finance-and-tax.toml
index f178e71..80f2f5f 100644
--- a/sources/finance-and-tax.toml
+++ b/sources/finance-and-tax.toml
@@ -91,7 +91,7 @@ url = "https://asc.fasb.org/"
 license = "registration-required"
 jurisdiction = "US"
 authoritative_for = "US GAAP as it actually reads — revenue recognition, leases, impairment. The Basic View is free with an account and the text is copyrighted: cite the ASC number, do not reproduce the wording."
-skills = ["finance:revenue-recognition", "finance:financial-reporting-and-close", "finance:chief-financial-officer"]
+skills = ["finance:revenue-recognition", "finance:financial-reporting-and-close", "finance:chief-financial-officer", "revenue:revenue-operations", "revenue:pricing-and-packaging"]
 checked = "2026-09-16"
 
 [[source]]
diff --git a/sources/marketing-and-advertising.toml b/sources/marketing-and-advertising.toml
new file mode 100644
index 0000000..d61180c
--- /dev/null
+++ b/sources/marketing-and-advertising.toml
@@ -0,0 +1,285 @@
+# Advertising regulation, messaging law, and the platform documentation that decides whether a
+# tactic is sanctionable.
+#
+# The pattern worth noticing: almost nothing here settles how to market well. What it settles is
+# where the boundary is — what you may claim, how you must disclose it, whom you may contact, and
+# what will get a page or a listing penalized. Craft skills in this department deliberately carry no
+# sources, because no authority decides how to write a good line and a source pretending otherwise
+# would lend false weight.
+
+# ── Claims, endorsements and disclosure ───────────────────────────────────────
+
+[[source]]
+id = "ftc-endorsement-guides"
+title = "Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR 255"
+publisher = "US Federal Trade Commission"
+url = "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a given influencer, affiliate, employee or review arrangement requires disclosure, and what counts as an adequate one. The regulation itself, rather than a summary of it."
+skills = ["marketing:partnership-marketing", "marketing:social-post-craft", "marketing:public-relations", "marketing:youtube-producer", "revenue:referral-programs"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-disclosures-101"
+title = "Disclosures 101 for Social Media Influencers"
+publisher = "US Federal Trade Commission"
+url = "https://www.ftc.gov/business-guidance/resources/disclosures-101-social-media-influencers"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Where in a post a disclosure has to sit for the regulator to treat it as clear and conspicuous — the placement question the regulation leaves open."
+skills = ["marketing:social-post-craft", "marketing:partnership-marketing", "marketing:video-content", "marketing:youtube-producer"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-dot-com-disclosures"
+title = ".com Disclosures: How to Make Effective Disclosures in Digital Advertising"
+publisher = "US Federal Trade Commission"
+url = "https://www.ftc.gov/business-guidance/resources/com-disclosures-how-make-effective-disclosures-digital-advertising"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What 'clear and conspicuous' means on a screen — proximity, hyperlinks, scrolling, pop-ups, and space-constrained formats."
+skills = ["demand-generation:landing-page-cro-expert", "demand-generation:paid-advertising", "marketing:marketing-copywriting", "demand-generation:lead-capture"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-native-advertising"
+title = "Native Advertising: A Guide for Businesses"
+publisher = "US Federal Trade Commission"
+url = "https://www.ftc.gov/business-guidance/resources/native-advertising-guide-businesses"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "When sponsored content is deceptively formatted, and what labeling makes a paid placement non-deceptive."
+skills = ["marketing:content-strategy", "marketing:public-relations", "marketing:partnership-marketing", "demand-generation:paid-advertising"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-ad-substantiation"
+title = "Policy Statement Regarding Advertising Substantiation"
+publisher = "US Federal Trade Commission"
+url = "https://www.ftc.gov/legal-library/browse/ftc-policy-statement-regarding-advertising-substantiation"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What evidence you must already hold before making an objective claim. This is the document that answers whether you may say 'number one', 'three times faster' or 'clinically proven'."
+skills = ["marketing:positioning-and-messaging", "marketing:marketing-copywriting", "marketing:product-launch", "demand-generation:paid-advertising"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-deceptive-pricing"
+title = "Guides Against Deceptive Pricing, 16 CFR 233"
+publisher = "US Federal Trade Commission"
+url = "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-233"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a 'was $X, now $Y', list-price, free-offer or percentage-off claim is lawful as presented."
+skills = ["demand-generation:paid-advertising", "demand-generation:landing-page-cro-expert", "marketing:marketing-copywriting", "revenue:pricing-and-packaging"]
+checked = "2026-09-16"
+
+# ── Email, SMS and contact permission ─────────────────────────────────────────
+
+[[source]]
+id = "ftc-can-spam"
+title = "CAN-SPAM Act: A Compliance Guide for Business"
+publisher = "US Federal Trade Commission"
+url = "https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The mandatory elements of a US commercial email — header accuracy, subject-line honesty, physical address, opt-out mechanism and the window for honoring it — and that hiring an agency does not move the liability."
+data = "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-316"
+skills = ["marketing:newsletter-writer", "demand-generation:lifecycle-messaging", "demand-generation:lead-capture", "demand-generation:account-based-marketing", "revenue:outbound-prospecting"]
+checked = "2026-09-16"
+
+[[source]]
+id = "casl"
+title = "Canada's Anti-Spam Legislation, S.C. 2010 c. 23"
+publisher = "Department of Justice Canada"
+url = "https://laws-lois.justice.gc.ca/eng/acts/E-1.6/index.html"
+license = "attribution-required"
+jurisdiction = "CA"
+authoritative_for = "Whether you may send a commercial message to a Canadian address at all. CASL is opt-in by default, which inverts the US assumption, and this is the text governing express versus implied consent."
+skills = ["marketing:newsletter-writer", "demand-generation:lifecycle-messaging", "demand-generation:lead-capture", "revenue:outbound-prospecting"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fcc-tcpa-64-1200"
+title = "Delivery restrictions and telephone solicitation rules, 47 CFR 64.1200"
+publisher = "US Federal Communications Commission"
+url = "https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The consent standard for marketing SMS and autodialed calls — what prior express written consent requires, how revocation must be handled, and the identification rules. Read the current text rather than a summary; this area moves in court."
+skills = ["demand-generation:lifecycle-messaging", "demand-generation:lead-capture", "marketing:behavioral-marketing", "revenue:outbound-prospecting"]
+checked = "2026-09-16"
+
+[[source]]
+id = "coppa-rule"
+title = "Children's Online Privacy Protection Rule, 16 CFR 312"
+publisher = "US Federal Trade Commission"
+url = "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a property counts as directed to children, and therefore whether behavioral advertising, retargeting pixels or lead capture may run on it at all."
+data = "https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions"
+skills = ["marketing:behavioral-marketing", "demand-generation:lead-capture", "demand-generation:paid-advertising", "demand-generation:app-store-optimization", "product:product-requirements"]
+checked = "2026-09-16"
+
+[[source]]
+id = "edpb-consent-guidelines"
+title = "Guidelines 05/2020 on consent under Regulation 2016/679"
+publisher = "European Data Protection Board"
+url = "https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en"
+license = "attribution-required"
+jurisdiction = "EU"
+authoritative_for = "Whether a consent interface is valid — cookie walls, scroll-as-consent, pre-ticked boxes, granularity and bundling. More decisive in practice than the regulation text, because this is what supervisory authorities apply."
+skills = ["marketing:behavioral-marketing", "demand-generation:lead-capture", "demand-generation:marketing-analytics", "demand-generation:landing-page-cro-expert"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ico-pecr-cookies"
+title = "Guide to PECR: cookies and similar technologies"
+publisher = "UK Information Commissioner's Office"
+url = "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/"
+license = "attribution-required"
+jurisdiction = "UK"
+authoritative_for = "Which trackers are strictly necessary and therefore exempt from consent, and which are not. Analytics, A/B testing and personalization are addressed by name, which is where most internal arguments about test tooling end."
+skills = ["demand-generation:experimentation", "marketing:behavioral-marketing", "demand-generation:marketing-analytics"]
+checked = "2026-09-16"
+
+# ── Platform rules, which decide whether work ships at all ────────────────────
+
+[[source]]
+id = "google-search-spam-policies"
+title = "Spam policies for Google web search"
+publisher = "Google"
+url = "https://developers.google.com/search/docs/essentials/spam-policies"
+license = "cc-by"
+jurisdiction = "global"
+authoritative_for = "Whether a tactic is sanctionable — scaled content abuse, site reputation abuse, expired-domain abuse, cloaking, doorway pages. The only authoritative answer to whether a programmatic build will be penalized."
+skills = ["demand-generation:programmatic-seo", "demand-generation:seo-strategy", "demand-generation:ai-search-optimization", "marketing:content-strategy"]
+checked = "2026-09-16"
+
+[[source]]
+id = "google-crawlers"
+title = "Google crawlers and user-triggered fetchers"
+publisher = "Google"
+url = "https://developers.google.com/search/docs/crawling-indexing/overview-google-crawlers"
+license = "cc-by"
+jurisdiction = "global"
+authoritative_for = "Which user agents Google operates and what each one is for, including the separate control over training and AI surfaces — the question behind every robots.txt argument about blocking AI."
+data = "https://developers.google.com/search/docs/crawling-indexing/robots/intro"
+skills = ["demand-generation:seo-strategy", "demand-generation:programmatic-seo", "demand-generation:ai-search-optimization"]
+checked = "2026-09-16"
+
+[[source]]
+id = "google-structured-data-gallery"
+title = "Structured data markup that Google Search supports"
+publisher = "Google"
+url = "https://developers.google.com/search/docs/appearance/structured-data/search-gallery"
+license = "cc-by"
+jurisdiction = "global"
+authoritative_for = "Which structured data types Google actually acts on, as opposed to which exist in the vocabulary. Pair it with schema.org: one defines the vocabulary, the other says what is honored."
+skills = ["demand-generation:seo-strategy", "demand-generation:programmatic-seo", "demand-generation:listing-distribution"]
+checked = "2026-09-16"
+
+[[source]]
+id = "schema-org"
+title = "Schema.org vocabulary"
+publisher = "Schema.org community group"
+url = "https://schema.org/"
+license = "cc-by-sa"
+jurisdiction = "global"
+authoritative_for = "The canonical property names and expected types for structured markup. Share-alike, so cite and link rather than folding definitions into your own documentation."
+data = "https://schema.org/version/latest/schemaorg-current-https.jsonld"
+skills = ["demand-generation:seo-strategy", "demand-generation:programmatic-seo", "demand-generation:listing-distribution"]
+checked = "2026-09-16"
+
+[[source]]
+id = "rfc-9309-robots"
+title = "RFC 9309: Robots Exclusion Protocol"
+publisher = "IETF"
+url = "https://www.rfc-editor.org/rfc/rfc9309.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "The formal parsing rules for robots.txt — precedence, wildcards, size limits, and what a crawler is obliged to do. Settles at the protocol level whether disallow prevents indexing, which it does not."
+skills = ["demand-generation:seo-strategy", "demand-generation:programmatic-seo", "demand-generation:ai-search-optimization"]
+checked = "2026-09-16"
+
+[[source]]
+id = "apple-app-review-guidelines"
+title = "App Store Review Guidelines"
+publisher = "Apple"
+url = "https://developer.apple.com/app-store/review/guidelines/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Whether a listing, screenshot set, price presentation or subscription flow will be rejected. Binding for anything shipping through the App Store, and copyrighted — cite the rule number, do not mirror the text."
+data = "https://developer.apple.com/app-store/search/"
+skills = ["demand-generation:app-store-optimization", "marketing:product-launch", "revenue:pricing-and-packaging", "product:chief-product-officer"]
+checked = "2026-09-16"
+
+[[source]]
+id = "google-play-policy"
+title = "Google Play Developer Program Policy"
+publisher = "Google"
+url = "https://play.google.com/about/developer-content-policy/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Store listing, metadata, ads, data-safety and monetization rules for Android distribution, including the explicit prohibitions on keyword stuffing and incentivized ratings."
+skills = ["demand-generation:app-store-optimization", "marketing:product-launch"]
+checked = "2026-09-16"
+
+[[source]]
+id = "google-merchant-product-spec"
+title = "Product data specification"
+publisher = "Google"
+url = "https://support.google.com/merchants/answer/7052112"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "The required attributes, formats and accepted values for a product feed — whether a listing is accepted is a specification question rather than an opinion."
+skills = ["demand-generation:listing-distribution", "demand-generation:paid-advertising"]
+checked = "2026-09-16"
+
+[[source]]
+id = "wcag-22"
+title = "Web Content Accessibility Guidelines 2.2"
+publisher = "World Wide Web Consortium"
+url = "https://www.w3.org/TR/WCAG22/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Whether a page, email or video is accessible. It is the criteria list that US Section 508, the EU's EN 301 549 and most enterprise procurement point at, so it settles any argument that reaches a buyer's accessibility requirement."
+skills = ["demand-generation:landing-page-cro-expert", "marketing:video-content", "marketing:visual-content", "marketing:newsletter-writer", "product:interface-craft", "product:design-system", "product:ux-product-auditor", "product:interface-redesign", "customer-experience:self-service-and-knowledge"]
+checked = "2026-09-16"
+
+# ── Measurement definitions, as opposed to vendors' versions of them ──────────
+
+[[source]]
+id = "mrc-standards"
+title = "MRC standards and guidelines"
+publisher = "Media Rating Council"
+url = "https://mediaratingcouncil.org/standards-and-guidelines"
+license = "free-to-read"
+jurisdiction = "US"
+authoritative_for = "The primary definitions behind ad measurement — what counts as an impression, what counts as viewable, and what counts as invalid traffic. This is what every vendor dashboard claims to implement."
+skills = ["demand-generation:marketing-analytics", "demand-generation:paid-advertising", "marketing:video-content"]
+checked = "2026-09-16"
+
+[[source]]
+id = "asa-p-value-statement"
+title = "ASA Statement on Statistical Significance and P-Values"
+publisher = "American Statistical Association"
+url = "https://www.amstat.org/asa/files/pdfs/p-valuestatement.pdf"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "What a p-value does and does not mean. It settles the most common error in marketing experimentation, which is reading a test that crossed ninety-five percent as a result."
+skills = ["demand-generation:experimentation", "demand-generation:landing-page-cro-expert", "demand-generation:marketing-analytics"]
+checked = "2026-09-16"
+
+[[source]]
+id = "aapor-standard-definitions"
+title = "Standard Definitions: final dispositions of case codes and outcome rates for surveys"
+publisher = "American Association for Public Opinion Research"
+url = "https://aapor.org/standards-and-ethics/standard-definitions/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "How a response rate, cooperation rate, refusal rate and contact rate are computed. The arbiter when two people report different response rates from the same fieldwork."
+skills = ["marketing:customer-research", "demand-generation:marketing-analytics"]
+checked = "2026-09-16"
diff --git a/sources/pmo-and-operations.toml b/sources/pmo-and-operations.toml
new file mode 100644
index 0000000..aa1c4d8
--- /dev/null
+++ b/sources/pmo-and-operations.toml
@@ -0,0 +1,253 @@
+# Delivery assurance, procurement, safety and the regulators who arrive at a site.
+#
+# The best material here is unexpected: the US Government Accountability Office publishes the most
+# rigorous free guidance anywhere on whether a schedule is reliable and whether a cost estimate is
+# defensible, and it is public domain. The commercial project-management bodies of knowledge are
+# sold, and — for the questions this catalog cares about, like how much contingency is justified or
+# what float threshold matters — they settle less than the GAO guides do.
+
+[[source]]
+id = "gao-schedule-assessment"
+title = "GAO Schedule Assessment Guide: best practices for project schedules"
+publisher = "US Government Accountability Office"
+url = "https://www.gao.gov/products/gao-16-89g"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a schedule is reliable — the ten criteria an auditor applies, covering the work breakdown, sequencing, resource loading, critical path, total float and schedule risk analysis."
+data = "https://www.gao.gov/assets/gao-16-89g.pdf"
+skills = ["pmo:schedule-development-and-analysis", "pmo:project-delivery", "pmo:dependency-and-risk-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "gao-cost-estimating"
+title = "GAO Cost Estimating and Assessment Guide"
+publisher = "US Government Accountability Office"
+url = "https://www.gao.gov/products/gao-20-195g"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What makes a cost estimate defensible, and specifically how much contingency is justified — via risk and uncertainty analysis at a stated confidence level, rather than a percentage somebody remembers."
+data = "https://www.gao.gov/assets/gao-20-195g.pdf"
+skills = ["pmo:estimating-and-contingency", "pmo:portfolio-governance", "pmo:program-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "gao-agile-assessment"
+title = "GAO Agile Assessment Guide"
+publisher = "US Government Accountability Office"
+url = "https://www.gao.gov/products/gao-24-105506"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether an organization has actually adopted an iterative delivery model or relabeled a staged one. Gives testable criteria, which is rare in this area, and reconciles iterative delivery with cost and schedule assurance."
+skills = ["pmo:project-delivery", "pmo:change-and-adoption", "pmo:head-of-pmo"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nasa-systems-engineering-handbook"
+title = "NASA Systems Engineering Handbook"
+publisher = "NASA"
+url = "https://www.nasa.gov/reference/systems-engineering-handbook/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a phase gate must contain before a technical project may proceed — the review structure, entrance and success criteria, and how the technical baseline is controlled."
+skills = ["pmo:program-management", "pmo:project-delivery", "pmo:portfolio-governance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "uk-green-book"
+title = "The Green Book: appraisal and evaluation in central government"
+publisher = "HM Treasury"
+url = "https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent"
+license = "attribution-required"
+jurisdiction = "UK"
+authoritative_for = "Whether a claimed benefit may be counted at all — what separates a benefit from a transfer, how optimism bias is corrected for, and what a business case must contain. The best free treatment of benefits discipline anywhere, and openly licensed."
+skills = ["pmo:benefits-realization", "pmo:estimating-and-contingency", "pmo:portfolio-governance", "corporate-strategy:portfolio-strategy"]
+checked = "2026-09-16"
+
+[[source]]
+id = "far"
+title = "Federal Acquisition Regulation"
+publisher = "US General Services Administration, on behalf of the FAR Council"
+url = "https://www.acquisition.gov/browse/index/far"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a competitive sourcing process must do to be lawful — solicitation types, evaluation criteria, competition requirements, and how contract type allocates risk. Binding for federal buying and the reference everywhere else."
+data = "https://www.acquisition.gov/far/part-31"
+skills = ["operations:procurement-and-sourcing", "operations:vendor-management", "finance:cost-accounting"]
+checked = "2026-09-16"
+
+[[source]]
+id = "interagency-third-party-risk"
+title = "Interagency Guidance on Third-Party Relationships: Risk Management"
+publisher = "Federal Reserve, FDIC and OCC"
+url = "https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What due diligence, contract terms, monitoring and termination planning a vendor relationship requires, scaled to how critical it is. The clearest published statement of the lifecycle, and the one regulated buyers will hold you to."
+skills = ["operations:vendor-management", "operations:procurement-and-sourcing", "operations:service-level-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fema-nims"
+title = "National Incident Management System doctrine"
+publisher = "Federal Emergency Management Agency"
+url = "https://www.fema.gov/emergency-managers/nims"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Who is in charge during an incident and how command transfers — incident command structure, unified command, span of control, and the action-plan cycle. Settles the role and escalation disputes that incidents actually produce."
+skills = ["operations:incident-management", "operations:business-continuity-and-resilience"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-sp-800-61-incident-response"
+title = "NIST SP 800-61: Incident Response Recommendations and Considerations"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/61/r3/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What an incident response capability must contain and what evidence must be captured at each stage. The current revision is a substantial rewrite that drops the older four-phase framing, so do not mix guidance across revisions."
+skills = ["security:incident-response", "security:detection-and-monitoring", "operations:incident-management", "customer-experience:escalation-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "iso-9001"
+title = "ISO 9001 — Quality management systems: requirements"
+publisher = "ISO"
+url = "https://www.iso.org/standard/62085.html"
+license = "paywalled"
+jurisdiction = "global"
+authoritative_for = "Whether a quality system is certifiable — the auditable requirements a nonconformity procedure or management review is judged against. Sold, so cite the clause number and never the wording."
+skills = ["operations:quality-management", "operations:process-design", "operations:vendor-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fda-preventive-controls"
+title = "21 CFR Part 117 — preventive controls for human food"
+publisher = "US Food and Drug Administration"
+url = "https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a food operation's hazard analysis, preventive controls and supplier verification are legally sufficient. Binding law rather than guidance."
+skills = ["operations:quality-management", "operations:supply-chain-and-logistics", "operations:procurement-and-sourcing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "usda-haccp"
+title = "9 CFR Part 417 — Hazard Analysis and Critical Control Point systems"
+publisher = "US Department of Agriculture, Food Safety and Inspection Service"
+url = "https://www.ecfr.gov/current/title-9/chapter-III/subchapter-E/part-417"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a HACCP plan must contain for meat and poultry — control points, critical limits, monitoring, corrective action and reassessment. A different regulator from the FDA, and which one governs depends on the product."
+skills = ["operations:quality-management", "operations:process-design"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fmcsa-hours-of-service"
+title = "49 CFR Part 395 — hours of service of drivers"
+publisher = "Federal Motor Carrier Safety Administration"
+url = "https://www.ecfr.gov/current/title-49/subtitle-B/chapter-III/subchapter-B/part-395"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "How many hours a commercial driver may lawfully drive and work, and what records prove it. A hard cap that any realistic transit or capacity plan has to respect."
+skills = ["operations:supply-chain-and-logistics", "operations:capacity-and-demand-planning"]
+checked = "2026-09-16"
+
+[[source]]
+id = "osha-1910"
+title = "29 CFR Part 1910 — occupational safety and health standards"
+publisher = "US Occupational Safety and Health Administration"
+url = "https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XVII/part-1910"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a workplace configuration is lawful — egress, emergency action plans, walking and working surfaces, hazard communication. Settles facilities questions that are otherwise argued as preference."
+skills = ["operations:facilities-and-workplace", "people:learning-and-development"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ada-2010-standards"
+title = "2010 ADA Standards for Accessible Design"
+publisher = "US Department of Justice"
+url = "https://www.ada.gov/law-and-regs/design-standards/2010-stds/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The enforceable dimensional requirements for an accessible facility — routes, clearances, reach ranges, restrooms, seating. Applies to a workplace and to an event venue alike."
+skills = ["operations:facilities-and-workplace", "marketing:events-and-field-marketing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "incoterms"
+title = "Incoterms rules"
+publisher = "International Chamber of Commerce"
+url = "https://iccwbo.org/business-solutions/incoterms-rules/"
+license = "paywalled"
+jurisdiction = "global"
+authoritative_for = "Exactly where risk, cost and delivery obligation transfer between buyer and seller under a named three-letter term. Courts and contracts defer to it, and the full rules text is sold — name the term, do not reproduce the definition."
+skills = ["operations:supply-chain-and-logistics", "operations:procurement-and-sourcing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-doj-merger-guidelines"
+title = "Merger Guidelines"
+publisher = "US Department of Justice and Federal Trade Commission"
+url = "https://www.ftc.gov/reports/merger-guidelines-2023"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether an acquisition is likely to be challenged — the concentration thresholds, how the agencies define a market, and the theories of harm they actually apply. The closest thing to a decision procedure for whether you can buy someone."
+skills = ["corporate-strategy:portfolio-strategy", "corporate-strategy:chief-strategy-officer", "corporate-strategy:mergers-and-acquisitions"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-hsr-premerger"
+title = "Hart-Scott-Rodino premerger notification program"
+publisher = "US Federal Trade Commission"
+url = "https://www.ftc.gov/enforcement/premerger-notification-program"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a transaction must be reported before closing, at what size, and how long the parties must then wait. A threshold question with one right answer — and the thresholds are revised annually, so resolve them here rather than from memory."
+skills = ["corporate-strategy:mergers-and-acquisitions", "corporate-strategy:chief-strategy-officer"]
+checked = "2026-09-16"
+
+[[source]]
+id = "trade-gov-country-guides"
+title = "Country Commercial Guides"
+publisher = "US Department of Commerce, International Trade Administration"
+url = "https://www.trade.gov/country-commercial-guides"
+license = "public-domain-usgov"
+jurisdiction = "global"
+authoritative_for = "The factual regulatory picture for entering a named foreign market — licensing, customs, standards, distribution and investment restrictions. It settles the factual questions in a market entry, not the strategic ones."
+skills = ["corporate-strategy:market-entry", "operations:supply-chain-and-logistics"]
+checked = "2026-09-16"
+
+[[source]]
+id = "delaware-dgcl"
+title = "Delaware General Corporation Law"
+publisher = "State of Delaware"
+url = "https://delcode.delaware.gov/title8/c001/index.html"
+license = "public-domain"
+jurisdiction = "US-DE"
+authoritative_for = "What a board may and may not do — board power, interested-director transactions, exculpation, merger mechanics and appraisal rights. Primary law for most US public companies and nearly every venture-backed one."
+skills = ["legal-risk:corporate-governance", "executive:chief-executive", "executive:fundraising-and-investor-relations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sec-reg-fd"
+title = "17 CFR Part 243 — Regulation FD"
+publisher = "US Securities and Exchange Commission"
+url = "https://www.ecfr.gov/current/title-17/chapter-II/part-243"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "When selective disclosure of material nonpublic information triggers a mandatory public disclosure, and on what timeline. The rule that decides whether a given investor conversation was lawful."
+skills = ["executive:fundraising-and-investor-relations", "legal-risk:corporate-governance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sec-exempt-offerings"
+title = "Exempt offerings and Regulation D"
+publisher = "US Securities and Exchange Commission"
+url = "https://www.sec.gov/education/smallbusiness/exemptofferings"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a private raise is lawful — whether general solicitation is permitted, how many non-accredited investors may participate, what disclosure is owed and when the filing is due."
+data = "https://www.ecfr.gov/current/title-17/chapter-II/part-230"
+skills = ["executive:fundraising-and-investor-relations", "executive:chief-executive"]
+checked = "2026-09-16"
diff --git a/sources/revenue-and-product.toml b/sources/revenue-and-product.toml
new file mode 100644
index 0000000..83b0488
--- /dev/null
+++ b/sources/revenue-and-product.toml
@@ -0,0 +1,263 @@
+# Accessibility, selling law, contract mechanics and the platform rules that decide whether a
+# pricing flow ships.
+#
+# Two negative findings shaped this file and are worth stating plainly, because the obvious
+# candidates fail. There is no free normative definition of the common revenue metrics — annual
+# recurring revenue, net retention, customer acquisition cost — and the best-known satisfaction
+# metric is a trademark whose method belongs to its owner. What authority exists applies at the
+# disclosure boundary: if you publish a metric, you must define it and calculate it consistently.
+# Anything claiming to define the metric itself is a vendor, and the skills say so.
+
+[[source]]
+id = "w3c-aria-apg"
+title = "WAI-ARIA and the ARIA Authoring Practices Guide"
+publisher = "World Wide Web Consortium"
+url = "https://www.w3.org/WAI/ARIA/apg/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Which roles, states and keyboard interactions a given widget must implement. Settles whether Escape should close a dialog and whether a role is the right one, without appeal to preference."
+data = "https://www.w3.org/TR/wai-aria-1.2/"
+skills = ["product:interface-craft", "product:design-system", "product:interface-redesign", "product:ux-product-auditor"]
+checked = "2026-09-16"
+
+[[source]]
+id = "section-508-ict"
+title = "36 CFR Part 1194 — Section 508 information and communication technology standards"
+publisher = "US Access Board"
+url = "https://www.ecfr.gov/current/title-36/subtitle-B/chapter-XI/part-1194"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a product must satisfy to be lawfully procurable by a US federal agency. This decides a public-sector deal rather than expressing a design preference, which is why it reaches sales as often as engineering."
+skills = ["product:product-requirements", "product:ux-product-auditor", "revenue:sales-enablement"]
+checked = "2026-09-16"
+
+[[source]]
+id = "en-301-549"
+title = "EN 301 549 — accessibility requirements for ICT products and services"
+publisher = "ETSI"
+url = "https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf"
+license = "free-to-read"
+jurisdiction = "EU"
+authoritative_for = "The requirement set an EU public-sector buyer measures against, including non-web software, documents and hardware that the web guidelines do not cover. Which version is legally operative depends on what the Official Journal currently cites — check before relying on a newer one."
+skills = ["product:product-requirements", "product:ux-product-auditor", "revenue:sales-enablement"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ftc-telemarketing-sales-rule"
+title = "16 CFR Part 310 — Telemarketing Sales Rule"
+publisher = "US Federal Trade Commission"
+url = "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What an outbound seller must disclose before taking payment, which misrepresentations are prohibited, and what records the program must keep. The rule that makes a call script lawful or not."
+skills = ["revenue:outbound-prospecting", "revenue:sales-enablement", "revenue:revenue-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "wiretap-act-2511"
+title = "18 U.S.C. 2511 — interception of communications"
+publisher = "US Congress, via the Office of the Law Revision Counsel"
+url = "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title18-section2511&num=0&edition=prelim"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The federal one-party-consent floor for recording a call, and the criminal exposure for recording without it. It settles only the floor: several states require all-party consent, and there is no free authoritative single document for that matrix — it must be looked up per state."
+skills = ["revenue:outbound-prospecting", "customer-experience:support-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "rosca-auto-renewal"
+title = "15 U.S.C. 8403 — Restore Online Shoppers' Confidence Act"
+publisher = "US Congress, via the Office of the Law Revision Counsel"
+url = "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section8403&num=0&edition=prelim"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether an online auto-renewal offer is lawful — clear disclosure of material terms before billing, express informed consent, and a simple cancellation mechanism. This area has seen rules issued and struck down, so cite the statute rather than a rule summary."
+skills = ["revenue:pricing-and-packaging", "revenue:retention", "revenue:activation", "product:product-requirements"]
+checked = "2026-09-16"
+
+[[source]]
+id = "california-arl"
+title = "California Automatic Renewal Law, Business and Professions Code 17600-17606"
+publisher = "California Legislative Counsel"
+url = "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=7.&chapter=1.&part=3.&lawCode=BPC&article=9."
+license = "public-domain"
+jurisdiction = "US-CA"
+authoritative_for = "The concrete cancellation obligations a subscription business actually has to meet, because California's requirements are stricter than the federal floor and apply to any California customer — which in practice makes them the binding ones."
+skills = ["revenue:pricing-and-packaging", "revenue:retention", "product:product-requirements", "product:interface-craft"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ucc-article-2"
+title = "Uniform Commercial Code, Article 2 — Sales"
+publisher = "American Law Institute and Uniform Law Commission"
+url = "https://www.law.cornell.edu/ucc/2"
+license = "free-to-read"
+jurisdiction = "US"
+authoritative_for = "When a contract for goods is formed, whose terms prevail in a battle of the forms, and what warranty disclaimer language is effective. Settles a purchase-order-versus-order-form dispute as law rather than as negotiating posture."
+skills = ["revenue:deal-negotiation", "revenue:revenue-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "esign-act"
+title = "15 U.S.C. 7001 — Electronic Signatures in Global and National Commerce Act"
+publisher = "US Congress, via the Office of the Law Revision Counsel"
+url = "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section7001&num=0&edition=prelim"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether an electronically signed contract, a clickwrap acceptance or an emailed order form is enforceable, and what consumer consent steps must precede it."
+skills = ["revenue:deal-negotiation", "revenue:revenue-operations", "customer-experience:customer-onboarding-and-implementation"]
+checked = "2026-09-16"
+
+[[source]]
+id = "eidas"
+title = "Regulation (EU) 910/2014 — eIDAS"
+publisher = "Publications Office of the European Union"
+url = "https://eur-lex.europa.eu/eli/reg/2014/910/oj"
+license = "attribution-required"
+jurisdiction = "EU"
+authoritative_for = "Whether an electronic signature has legal effect in the EU and which of the three tiers a given contract requires. Settles whether an ordinary e-signature suffices for a particular European deal."
+skills = ["revenue:deal-negotiation", "revenue:revenue-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sec-mda-metrics-guidance"
+title = "Commission Guidance on Management's Discussion and Analysis, Release 33-10751"
+publisher = "US Securities and Exchange Commission"
+url = "https://www.federalregister.gov/documents/2020/02/25/2020-02296/commission-guidance-on-managements-discussion-and-analysis-of-financial-condition-and-results-of"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a company must do when it publishes an operating metric — define it, disclose how it is calculated, apply it consistently, and explain any change in method. It disciplines metrics like recurring revenue and net retention without defining them, which is the honest ceiling on authority here."
+skills = ["revenue:revenue-operations", "finance:unit-economics", "data-analytics:business-intelligence"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sec-non-gaap-cdi"
+title = "Non-GAAP financial measures — compliance and disclosure interpretations"
+publisher = "US Securities and Exchange Commission, Division of Corporation Finance"
+url = "https://www.sec.gov/corpfin/non-gaap-financial-measures"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "When a non-GAAP measure becomes misleading and therefore prohibited — individually tailored recognition, excluding normal operating costs, improper labeling, and the equal-prominence requirement."
+skills = ["finance:unit-economics", "finance:capital-structure-and-covenants"]
+checked = "2026-09-16"
+
+[[source]]
+id = "ico-childrens-code"
+title = "Age Appropriate Design Code"
+publisher = "UK Information Commissioner's Office"
+url = "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/"
+license = "attribution-required"
+jurisdiction = "UK"
+authoritative_for = "What default settings, nudges and profiling are permissible in a service likely to be used by children. A statutory code, so it settles whether onboarding may default a toggle on."
+skills = ["product:product-requirements", "product:interface-craft", "revenue:activation"]
+checked = "2026-09-16"
+
+[[source]]
+id = "cppa-regulations"
+title = "CCPA regulations, California Code of Regulations title 11"
+publisher = "California Privacy Protection Agency"
+url = "https://cppa.ca.gov/regulations/consumer_privacy_act.html"
+license = "public-domain"
+jurisdiction = "US-CA"
+authoritative_for = "Symmetry in choice, as law. It settles whether a consent flow where accepting is one click and declining is three is permissible — converting what is usually argued as design taste into a compliance question."
+skills = ["product:interface-craft", "product:ux-product-auditor", "product:interface-redesign", "marketing:behavioral-marketing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "pci-dss"
+title = "PCI Data Security Standard"
+publisher = "PCI Security Standards Council"
+url = "https://www.pcisecuritystandards.org/document_library/"
+license = "registration-required"
+jurisdiction = "global"
+authoritative_for = "Whether a support agent may take a card number by phone, whether that call may be recorded, and what must happen to card data in ticket attachments and screen shares. Assessed by a qualified assessor, so genuinely dispositive."
+skills = ["customer-experience:support-operations", "security:data-protection-and-encryption", "security:detection-and-monitoring"]
+checked = "2026-09-16"
+
+[[source]]
+id = "apple-hig"
+title = "Human Interface Guidelines"
+publisher = "Apple"
+url = "https://developer.apple.com/design/human-interface-guidelines"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "What correct platform behavior is on Apple platforms — control semantics, navigation structure, touch targets. Its authority is not taste: deviation is grounds for review rejection."
+skills = ["product:interface-craft", "product:design-system", "product:interface-redesign"]
+checked = "2026-09-16"
+
+[[source]]
+id = "unicode-cldr"
+title = "Unicode Common Locale Data Repository"
+publisher = "Unicode Consortium"
+url = "https://cldr.unicode.org/"
+license = "attribution-required"
+jurisdiction = "global"
+authoritative_for = "Correct date, number, currency, name-order, plural and sort behavior for a locale. Settles how something should render in a given language with data rather than guesswork, and every platform's internationalization library derives from it."
+skills = ["product:interface-craft", "product:design-system", "product:product-requirements"]
+checked = "2026-09-16"
+
+[[source]]
+id = "plain-language-guidelines"
+title = "Federal Plain Language Guidelines"
+publisher = "Plain Language Action and Information Network"
+url = "https://www.plainlanguage.gov/guidelines/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What counts as plain language in user-facing writing — audience-first structure, active voice, short sections. Backed by statute for federal agencies, and the only free normative writing standard that is not one author's style preference."
+skills = ["customer-experience:self-service-and-knowledge", "customer-experience:support-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "uspto-tmep"
+title = "Trademark Manual of Examining Procedure"
+publisher = "US Patent and Trademark Office"
+url = "https://tmep.uspto.gov/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a proposed name, logo or tagline is registrable — distinctiveness, descriptiveness refusals, likelihood of confusion, specimen requirements. Settles whether you can actually own a name."
+skills = ["product:brand-identity", "legal-risk:intellectual-property"]
+checked = "2026-09-16"
+
+[[source]]
+id = "copyright-compendium"
+title = "Compendium of U.S. Copyright Office Practices"
+publisher = "US Copyright Office"
+url = "https://www.copyright.gov/comp3/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What is protectable and registrable, including the Office's position on human authorship for machine-generated material and how much of a layout or typeface is protectable at all."
+skills = ["product:visual-reference-generation", "product:brand-identity", "legal-risk:intellectual-property"]
+checked = "2026-09-16"
+
+[[source]]
+id = "sil-open-font-license"
+title = "SIL Open Font License"
+publisher = "SIL International"
+url = "https://openfontlicense.org/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Whether a typeface may be embedded in a product, bundled into a design system, modified or redistributed. The font-licensing question that surfaces reliably when a brand system ships."
+skills = ["product:brand-identity", "product:design-system"]
+checked = "2026-09-16"
+
+[[source]]
+id = "california-labor-2751"
+title = "California Labor Code 2751 — commission agreements in writing"
+publisher = "California Legislative Counsel"
+url = "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=LAB&sectionNum=2751"
+license = "public-domain"
+jurisdiction = "US-CA"
+authoritative_for = "Whether a commission arrangement is enforceable. California requires a signed written contract setting out how commission is computed and paid, which settles whether a plan can be changed mid-year by email."
+skills = ["revenue:sales-compensation-and-territory", "revenue:revenue-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "dol-outside-sales-exemption"
+title = "Fact Sheet 17F: exemption for outside sales employees"
+publisher = "US Department of Labor, Wage and Hour Division"
+url = "https://www.dol.gov/agencies/whd/fact-sheets/17f-overtime-outside-sales"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "Whether a sales role is exempt from overtime — the inside against outside classification question that territory design quietly creates."
+skills = ["revenue:sales-compensation-and-territory", "people:employment-compliance"]
+checked = "2026-09-16"
diff --git a/sources/security.toml b/sources/security.toml
index 7199f4b..b5c650d 100644
--- a/sources/security.toml
+++ b/sources/security.toml
@@ -68,7 +68,7 @@ license = "attribution-required"
 jurisdiction = "global"
 authoritative_for = "The shared vocabulary for adversary tactics and techniques — what to name a behavior so a detection, a threat model and an incident report refer to the same thing."
 data = "https://github.com/mitre-attack/attack-stix-data"
-skills = ["security:threat-modeling", "security:incident-response", "security:security-architecture-review"]
+skills = ["security:threat-modeling", "security:incident-response", "security:security-architecture-review", "security:detection-and-monitoring"]
 checked = "2026-09-16"
 
 [[source]]
diff --git a/sources/technology-and-it.toml b/sources/technology-and-it.toml
new file mode 100644
index 0000000..547630f
--- /dev/null
+++ b/sources/technology-and-it.toml
@@ -0,0 +1,374 @@
+# Protocol specifications, hardening baselines and platform reference architectures.
+#
+# This is the department where the "does an authority settle it" test does the most work. Protocol
+# and format questions have exact answers published by the body that defines them. Practice
+# questions — how to review code, how to debug, when a thing is done — have none, and the skills
+# that cover them deliberately carry no sources. A blog post with a confident tone is not an
+# authority, and this area has more of those than any other.
+
+# ── Interfaces and protocols ──────────────────────────────────────────────────
+
+[[source]]
+id = "rfc-9110-http"
+title = "RFC 9110: HTTP Semantics"
+publisher = "IETF"
+url = "https://www.rfc-editor.org/rfc/rfc9110.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "What an HTTP method, status code or header actually means. Settles whether PUT is idempotent, whether 409 or 422 is correct, and what a conditional request obliges a server to do."
+skills = ["technology:api-design"]
+checked = "2026-09-16"
+
+[[source]]
+id = "rfc-9457-problem-details"
+title = "RFC 9457: Problem Details for HTTP APIs"
+publisher = "IETF"
+url = "https://www.rfc-editor.org/rfc/rfc9457.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "The wire format of an API error body. It obsoletes RFC 7807, so it also settles which of the two a new service should follow."
+skills = ["technology:api-design"]
+checked = "2026-09-16"
+
+[[source]]
+id = "rfc-9700-oauth-bcp"
+title = "RFC 9700: Best Current Practice for OAuth 2.0 Security"
+publisher = "IETF"
+url = "https://www.rfc-editor.org/rfc/rfc9700.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Which OAuth 2.0 patterns remain permitted — that the implicit grant and password grant must not be used, that PKCE is required, and that redirect URIs must match exactly."
+skills = ["technology:api-design", "it-operations:identity-lifecycle-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "openapi-spec"
+title = "OpenAPI Specification"
+publisher = "OpenAPI Initiative, Linux Foundation"
+url = "https://spec.openapis.org/oas/latest.html"
+license = "attribution-required"
+jurisdiction = "global"
+authoritative_for = "What a valid API description document contains. Settles whether a given file is conformant rather than merely accepted by one tool."
+skills = ["technology:api-design"]
+checked = "2026-09-16"
+
+[[source]]
+id = "semver"
+title = "Semantic Versioning 2.0.0"
+publisher = "Semantic Versioning project"
+url = "https://semver.org/"
+license = "cc-by"
+jurisdiction = "global"
+authoritative_for = "What a version increment is allowed to mean, and therefore whether a given change requires a major bump. A community specification rather than a standards body, but the one every dependency resolver assumes."
+skills = ["technology:api-design", "technology:branch-and-worktree-workflow"]
+checked = "2026-09-16"
+
+[[source]]
+id = "conventional-commits"
+title = "Conventional Commits 1.0.0"
+publisher = "Conventional Commits project"
+url = "https://www.conventionalcommits.org/en/v1.0.0/"
+license = "cc-by"
+jurisdiction = "global"
+authoritative_for = "The grammar of a commit message, and how a breaking change is marked so that tooling can derive a version bump from history."
+skills = ["technology:branch-and-worktree-workflow"]
+checked = "2026-09-16"
+
+[[source]]
+id = "git-reference"
+title = "Git reference manual"
+publisher = "Git project"
+url = "https://git-scm.com/docs"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "What a Git operation actually does — what a worktree is, what rebase rewrites, what detached HEAD means. It settles behavior, not which workflow a team should adopt."
+skills = ["technology:branch-and-worktree-workflow", "technology:parallel-agent-delivery"]
+checked = "2026-09-16"
+
+[[source]]
+id = "mcp-spec"
+title = "Model Context Protocol specification"
+publisher = "Model Context Protocol project"
+url = "https://modelcontextprotocol.io/specification/latest"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "The protocol between an agent host and a tool or resource server — message shapes, lifecycle, transports, and what a conformant server must implement."
+skills = ["technology:ai-workflow-architect"]
+checked = "2026-09-16"
+
+# ── Observability ─────────────────────────────────────────────────────────────
+
+[[source]]
+id = "opentelemetry-spec"
+title = "OpenTelemetry specification and semantic conventions"
+publisher = "OpenTelemetry project, Cloud Native Computing Foundation"
+url = "https://opentelemetry.io/docs/specs/otel/"
+license = "cc-by"
+jurisdiction = "global"
+authoritative_for = "The data model for traces, metrics and logs, and — in the semantic conventions — the attribute names themselves, which is what naming arguments actually turn on."
+data = "https://opentelemetry.io/docs/specs/semconv/"
+skills = ["technology:observability-and-reliability"]
+checked = "2026-09-16"
+
+[[source]]
+id = "w3c-trace-context"
+title = "Trace Context"
+publisher = "World Wide Web Consortium"
+url = "https://www.w3.org/TR/trace-context/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "The on-the-wire format of the traceparent and tracestate headers, which settles how trace context propagates between tools from different vendors."
+skills = ["technology:observability-and-reliability"]
+checked = "2026-09-16"
+
+[[source]]
+id = "google-sre-book"
+title = "Site Reliability Engineering and The SRE Workbook"
+publisher = "Google"
+url = "https://sre.google/sre-book/table-of-contents/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "The definitions the reliability vocabulary rests on — indicator against objective against agreement, error budget, toil. It settles what the words mean, not whether a practice suits your organization."
+data = "https://sre.google/workbook/table-of-contents/"
+skills = ["technology:observability-and-reliability"]
+checked = "2026-09-16"
+
+# ── Cloud and architecture ────────────────────────────────────────────────────
+
+[[source]]
+id = "nist-sp-800-145-cloud"
+title = "NIST SP 800-145: The NIST Definition of Cloud Computing"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/145/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What counts as infrastructure, platform or software as a service, and what public, private, community and hybrid mean. Still the definition contracts and audits cite."
+skills = ["technology:cloud-infrastructure", "it-operations:cloud-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "aws-well-architected"
+title = "AWS Well-Architected Framework"
+publisher = "Amazon Web Services"
+url = "https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "What AWS itself considers a correct design on AWS, and therefore what an AWS architecture review will be graded against."
+skills = ["technology:cloud-infrastructure", "technology:solution-architecture", "it-operations:cloud-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "azure-well-architected"
+title = "Azure Well-Architected Framework"
+publisher = "Microsoft"
+url = "https://learn.microsoft.com/en-us/azure/well-architected/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Microsoft's own normative design guidance for Azure, and the basis of its assessment tooling."
+skills = ["technology:cloud-infrastructure", "it-operations:cloud-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "google-cloud-architecture-framework"
+title = "Google Cloud Architecture Framework"
+publisher = "Google Cloud"
+url = "https://cloud.google.com/architecture/framework"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Google Cloud's own normative design guidance, and what its architecture reviews assess against."
+skills = ["technology:cloud-infrastructure", "it-operations:cloud-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "omg-atdm"
+title = "Automated Technical Debt Measure"
+publisher = "Object Management Group"
+url = "https://www.omg.org/spec/ATDM/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "How technical debt is computed from source code as a standardized measure. It settles why two debt numbers disagree; it settles nothing about whether to pay the debt down."
+skills = ["technology:technical-debt-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "eu-ai-act"
+title = "Regulation (EU) 2024/1689 — the AI Act"
+publisher = "Publications Office of the European Union"
+url = "https://eur-lex.europa.eu/eli/reg/2024/1689/oj"
+license = "attribution-required"
+jurisdiction = "EU"
+authoritative_for = "Whether an AI system is prohibited, high-risk or limited-risk in the EU and what obligations attach. Binding law rather than guidance, and only the Official Journal version is authentic."
+skills = ["technology:chief-technology-officer", "data-analytics:ai-ml-governance", "legal-risk:regulatory-compliance"]
+checked = "2026-09-16"
+
+[[source]]
+id = "anthropic-agent-skills"
+title = "Agent Skills documentation"
+publisher = "Anthropic"
+url = "https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "The SKILL.md format and its loading semantics — required frontmatter, body, and how bundled resources are surfaced. The format, not what makes a skill good."
+skills = ["technology:skill-authoring"]
+checked = "2026-09-16"
+
+# ── Identity, hardening and the network ───────────────────────────────────────
+
+[[source]]
+id = "nist-sp-800-63"
+title = "NIST SP 800-63: Digital Identity Guidelines"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/63/4/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What each identity, authenticator and federation assurance level requires — and, notably, that forced periodic password rotation and composition rules are not among them."
+data = "https://pages.nist.gov/800-63-4/"
+skills = ["it-operations:identity-lifecycle-administration", "security:access-and-identity"]
+checked = "2026-09-16"
+
+[[source]]
+id = "scim-rfc-7644"
+title = "RFC 7644: System for Cross-domain Identity Management Protocol"
+publisher = "IETF"
+url = "https://www.rfc-editor.org/rfc/rfc7644.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "How provisioning and deprovisioning are transacted between an identity provider and a downstream application — endpoints, patch semantics, filtering, and the canonical user and group attributes."
+data = "https://www.rfc-editor.org/rfc/rfc7643.html"
+skills = ["it-operations:identity-lifecycle-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "openid-connect-core"
+title = "OpenID Connect Core 1.0"
+publisher = "OpenID Foundation"
+url = "https://openid.net/specs/openid-connect-core-1_0.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "What an ID token is, which claims are standard, and what a conformant party must do in each flow. Settles arguments that begin 'our provider does it differently'."
+skills = ["it-operations:identity-lifecycle-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-sp-800-207-zero-trust"
+title = "NIST SP 800-207: Zero Trust Architecture"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/207/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What zero trust denotes — the policy engine, administrator and enforcement point model, and the tenets — so that a vendor cannot redefine the term mid-conversation."
+skills = ["it-operations:identity-lifecycle-administration", "it-operations:network-administration", "it-operations:cloud-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "disa-stigs"
+title = "Security Technical Implementation Guides"
+publisher = "Defense Information Systems Agency, US Department of Defense"
+url = "https://public.cyber.mil/stigs/"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The exact required configuration of a given operating system, hypervisor or appliance, setting by setting with severity. When two administrators disagree about a hardening value, this states the required one."
+data = "https://public.cyber.mil/stigs/downloads/"
+skills = ["it-operations:systems-administration", "it-operations:endpoint-management", "it-operations:virtualization-operations", "it-operations:network-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "cis-benchmarks"
+title = "CIS Benchmarks"
+publisher = "Center for Internet Security"
+url = "https://www.cisecurity.org/cis-benchmarks"
+license = "registration-required"
+jurisdiction = "global"
+authoritative_for = "The consensus hardening baseline for a specific product version, with two profile levels. The non-defense equivalent of a STIG and the baseline most commercial audits cite."
+skills = ["it-operations:systems-administration", "it-operations:endpoint-management", "it-operations:cloud-administration", "it-operations:virtualization-operations"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-sp-800-40-patch"
+title = "NIST SP 800-40: Guide to Enterprise Patch Management Planning"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/40/r4/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What a defensible patch program contains — maintenance windows, phased deployment, and the position that leaving something unpatched requires documented compensating controls rather than silence."
+skills = ["it-operations:endpoint-management", "it-operations:systems-administration", "security:vulnerability-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-sp-800-124-mobile"
+title = "NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/124/r2/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The baseline control set for mobile endpoints and the deployment-model distinctions — corporate-owned, personally enabled, bring-your-own — that mobile policy arguments turn on."
+skills = ["it-operations:endpoint-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "nist-sp-800-34-contingency"
+title = "NIST SP 800-34: Contingency Planning Guide for Federal Information Systems"
+publisher = "NIST"
+url = "https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "What recovery time and recovery point objectives formally mean, what a business impact analysis must contain, and which plan covers what — contingency, disaster recovery, continuity of operations."
+skills = ["it-operations:backup-and-recovery", "operations:business-continuity-and-resilience", "operations:incident-management"]
+checked = "2026-09-16"
+
+[[source]]
+id = "rfc-1918-private-addresses"
+title = "RFC 1918: Address Allocation for Private Internets"
+publisher = "IETF"
+url = "https://www.rfc-editor.org/rfc/rfc1918.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "Which address ranges are private and must not be routed publicly. The definitive answer whenever an addressing plan is proposed."
+skills = ["it-operations:network-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "rfc-1035-dns"
+title = "RFC 1035: Domain Names — Implementation and Specification"
+publisher = "IETF"
+url = "https://www.rfc-editor.org/rfc/rfc1035.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "DNS record semantics and constraints, including why a CNAME cannot coexist with other records at the same name, and how TTL behaves."
+data = "https://www.rfc-editor.org/rfc/rfc1034.html"
+skills = ["it-operations:network-administration"]
+checked = "2026-09-16"
+
+[[source]]
+id = "rfc-3261-sip"
+title = "RFC 3261: SIP — Session Initiation Protocol"
+publisher = "IETF"
+url = "https://www.rfc-editor.org/rfc/rfc3261.html"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "SIP signaling semantics — dialog and transaction state, response code meanings, registration, and the role of proxies. What an interop dispute between a phone system and a carrier is settled against."
+data = "https://www.rfc-editor.org/rfc/rfc3550.html"
+skills = ["it-operations:telephony-and-conferencing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "w3c-webrtc"
+title = "WebRTC: Real-Time Communication in Browsers"
+publisher = "World Wide Web Consortium"
+url = "https://www.w3.org/TR/webrtc/"
+license = "free-to-read"
+jurisdiction = "global"
+authoritative_for = "The browser API surface and behavior for real-time audio, video and data — the normative reference for what a conferencing client can and must do."
+skills = ["it-operations:telephony-and-conferencing"]
+checked = "2026-09-16"
+
+[[source]]
+id = "fcc-911-part-9"
+title = "47 CFR Part 9 — 911 requirements"
+publisher = "US Federal Communications Commission"
+url = "https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-9"
+license = "public-domain-usgov"
+jurisdiction = "US"
+authoritative_for = "The obligations on a multi-line telephone system — direct 911 dialing, on-site notification and dispatchable location. A hard compliance question for anyone administering a phone or conferencing platform in the US, and one that is usually discovered late."
+skills = ["it-operations:telephony-and-conferencing"]
+checked = "2026-09-16"