operating-model-author

name	operating-model-author
description	Author the annual operating model (operating principles + function design + process architecture + decision rights + RACI + SLA architecture + governance cadence). COO authored; CEO approved. Use when user asks to "draft a operating model" or "create the operating model". Do NOT use for "audit existing operating model" (use operating-model-audit instead).
license	Apache-2.0
metadata	{"version":"1.0.0","module":"skill","stage":"cross","cyberos-template":"task@1","cyberos-rubric-target":"operating-model_rubric@1.0"}
allowed_memory_scopes	{"read":["project:*","module:*","company:locked-decisions","memories:decisions","memories:projects","memories:refinements"],"write":["project:*","memories:projects"]}
allowed_mcp_tools	["kb.read","kb.search","memory.search","memory.write_memory","audit.append","chat.notify"]
escalation	{"to_persona_on_legal":"cuo-clo","to_persona_on_security":"cuo-cseco","to_persona_on_compliance":"cuo-clo","to_human_on_irreversible":true}
invocation_modes	["standalone","chained"]
expects	{"schema_ref":"./envelopes/input.json","required_fields":["source_files","output_dir"],"optional_fields":["manifest_path","batch_size","caller_persona","trace_id","chain_to"],"standalone_interview_ref":"./STANDALONE_INTERVIEW.md"}
produces	{"schema_ref":"./envelopes/output.json","output_kind":"artefact","human_summary_ref":"./HUMAN_SUMMARY.md"}
depends_on_contracts	[{"id":"operating-model","version":"v1","purpose":"generation_skeleton","pin_path":"cyberos/skill/contracts/operating-model/"},{"id":"nats-subjects","version":"v1","purpose":"wire_protocol_emission","pin_path":"cyberos/skill/contracts/nats-subjects/"}]
exposable_as	{"internal":true,"agent_plugin":true,"mcp_tool":true,"partner_connector":false}
audit	{"emit_to":"genie.action_log","row_kind":"artefact_write","payload_hash_field":"artefact_hash","explanation_pane":"required"}
confidence_band	{"default":0.7,"defer_below":0.5,"cite_sources":"required"}
untrusted_inputs	{"wrap_in_marker":"untrusted_content","injection_scan":"required","on_marker_hit":"surface_to_human"}
self_audit	{"invariants_ref":"./INVARIANTS.md","check_at":["on_node_boundary",{"on_audit_row_count":25},"on_completion"],"anomaly_signals":{"confidence_low_streak":{"threshold":3,"window":10},"user_correction_streak":{"threshold":2,"window":5},"denylist_near_miss_streak":{"threshold":2,"window":20},"scope_rejection_streak":{"threshold":1,"window":1},"citation_missing_streak":{"threshold":2,"window":10}},"on_breach":{"emit":"refinement_proposal","pause_pipeline":true,"resume_token_field":"refinement_run_id"}}
human_fine_tune	{"fine_tuner_role":"cpo","review_required":{"on_minor_bump":false,"on_major_bump":true,"on_safety_change":true},"signals_to_initiate":[{"acceptance_rate_below":0.6},{"hitl_pause_rate_above":0.4},{"drift_signal_count_above":3},"user_complaint_received","regulator_inquiry_received",{"self_audit_refinement_proposal_count_above":2}],"procedure_ref":null,"required_artifacts":["changelog_entry","acceptance_test_added","memory_refinement_entry"],"blackout_windows":[]}
determinism	{"reproducible":false,"fixity_notes":"Authoring is judgement; manifest state IS reproducible. Re-running on settled state is a no-op except for last_audit_at refresh."}
emitted_source_freshness_tier	30
gated_until_phase	null
untrusted_content_wrapping	required

operating-model-author — OPERATING-MODEL generator

Standalone trigger that turns one or more documents into a versioned, audited operating-model@1 markdown. Halts at PLAN approval and HITL gates; resumable from manifest.json state. Chains naturally into operating-model-audit by default.

prompt_revision: operating-model_author@1.0.0

When to invoke this skill

CUO routes a request here when the user wants to:

• "Turn this into a OPERATING-MODEL."
• "Generate v2 of the OPERATING-MODEL from the updated source."
• "Draft a OPERATING-MODEL for ."

If the user asks to audit an existing OPERATING-MODEL, route to operating-model-audit instead. If both, the supervisor chains the two.

Self-test preamble — emit BEFORE any file action

Begin every invocation with a single fenced CONTRACT_ECHO block. Do NOT proceed past this block until it has been emitted.

CONTRACT_ECHO
skill_id:                        operating-model-author
skill_version:                   1.0.0
prompt_revision:                 operating-model_author@1.0.0
template_version:                operating-model@1   (loaded from cyberos/skill/contracts/operating-model/template.md)
output_dir:                      <from caller>
manifest_path:                   <from caller; default: <output_dir>/manifest.json>
naming_pattern:                  OPERATING-MODEL-{NNN}-{slug}.md
batch_size:                      <from caller; default 3, soft-cap 5, hard-cap 10>
hitl_categories:                 [<list per skill — e.g. customer_quotes, success_metric_targets, scope_decomposition>]
hitl_policy:                     HALT_BATCH_ON_PAUSE
amendment_policy:                ACCUMULATE_THEN_BATCH
max_iterations_per_artefact:     10
re_entrancy:                     idempotent_on_manifest_state
untrusted_content_handling:      spotlight_xml_tagged
file_scope:                      MUST NOT write outside output_dir
inputs:
  source_files:                  [<list of paths/URLs with media_type>]
  source_hash:                   <sha256 of normalized concat, see references/MANIFEST_SCHEMA.md §3.1>
phase:                           <PLAN | WORKER | RESUME>   (computed per §3 below)

§1 Pipeline interface (envelopes)

Input envelope (envelopes/input.json):

{
  "source_files":