compliance-trestle-skills

Knowledge about Compliance Trestle workspace structure, initialization, and directory conventions. Use when users ask about trestle workspaces, directory layout, .trestle config, model directories, or how to set up and organize an OSCAL compliance workspace.

Knowledge about writing control implementation responses, rules, parameters, component-level responses, inheritance, and leveraged SSPs in Compliance Trestle. Use when users ask about writing control responses, implementation status, rules, parameters, component definitions, SSP implementation details, or compliance documentation content.

Knowledge about OSCAL model types, their relationships, and how they are managed in Compliance Trestle. Use when users ask about OSCAL documents, model types, catalogs, profiles, SSPs, component definitions, or how different compliance models relate to each other.

Knowledge about Compliance Trestle validation, common errors, and troubleshooting. Use when users ask about validation errors, trestle validate failures, OSCAL schema validation, fixing compliance document issues, or troubleshooting trestle problems.

Convert, validate, and maintain OSCAL documents from legacy SSP/PDF/DOCX/Markdown source material.

Import a legacy SSP, PDF, DOCX, or Markdown package into a traceable OSCAL Document Workbench workspace using extraction, source mapping, Trestle bootstrap, and validation.

Review source-to-OSCAL mappings, triage needs_review rows, and update the review queue before treating generated OSCAL as ready for stakeholders.

Validate an OSCAL package or Compliance Trestle workspace and produce a validation report, failing loudly when required tools are missing.

Validate the current Compliance Trestle workspace with trestle validate, report failures clearly, and recommend fixes using the validation assistant workflow.

Use Compliance Trestle to manage OSCAL catalogs, profiles, component definitions, SSPs, markdown assembly, validation, and source-traceable updates from legacy compliance documents.

Convert legacy SSP/PDF/DOCX source material into traceable, validated OSCAL workspaces with Compliance Trestle and OSCAL CLI.

Knowledge about OSCAL assessment plans and assessment results models in Compliance Trestle. Use when users ask about assessment plans, assessment results, security assessments, SAP, SAR, assessment activities, findings, observations, or assessment-related OSCAL models.

Knowledge about the Compliance Trestle authoring workflow: the generate-edit-assemble cycle for converting OSCAL documents to markdown and back. Use when users ask about authoring catalogs, profiles, SSPs, or component definitions, editing control markdown, YAML headers, or the roundtrip workflow between JSON and markdown.

Knowledge about end-to-end compliance pipelines using Compliance Trestle: GRC personas and artifact ownership, multi-repository coordination, the two-phase component definition authoring pattern, CI/CD pipeline integration, and the Compliance-to-Policy (C2P) bridge. Use when users ask about compliance pipelines, personas, who owns what artifact, multi-repo workflows, component definition dual-mapping (control-to-rule, rule-to-check), CI/CD compliance, C2P, or end-to-end workflow design.

Knowledge about Compliance Trestle's document governance system for enforcing consistent document structure and YAML headers. Use when users ask about document governance, header enforcement, template validation, governed headings, governed folders, trestle author docs/headers/folders, template setup, document structure enforcement, or CI/CD compliance document validation.

Knowledge about Compliance Trestle's Jinja2 templating system for generating compliance documents. Use when users ask about Jinja templates, document generation from OSCAL data, custom trestle Jinja tags (mdsection_include, md_clean_include, md_datestamp), custom filters (as_list, get_party, parties_for_role, diagram_href), SSP document rendering, lookup tables, or bracket formatting.

Knowledge about the OSCAL Plan of Action and Milestones (POA&M) model in Compliance Trestle. Use when users ask about POA&M, plan of action, milestones, remediation, findings tracking, risk management, or managing security finding remediation workflows.

Knowledge about the Compliance Trestle task system for data conversion and transformation. Use when users ask about CSV import, XLSX import, XCCDF results, Tanium results, CIS benchmarks, data conversion to OSCAL, config.ini task configuration, trestle tasks, or converting scan results to assessment results.