/engagement-report-assembly

name: engagement-report-assembly
description: "Assembles supplied validated artifacts, immutable final findings, scope, methods, coverage, limitations, contradictions, and evidence indexes into a complete review-ready engagement package without rewriting, rescoring, hiding, closing, publishing, or contacting."
allowed-tools: Read Grep Glob

Engagement report assembly

Use this skill to answer one question: does the package faithfully and completely represent the declared engagement universe and every eligible supplied artifact?

When to Use

• Assemble evidence-backed engagement reports.
• Use only within explicit authorization and the stated rules of engagement.

When NOT to Use

• Do not treat this skill as permission to access, test, or change a target.
• Do not convert missing evidence into a clean result or a stronger claim.

Hold the boundary

1. Accept only supplied validated specialist artifacts and administrative receipts. 2. Do not scan, test, reinterpret, rewrite, rescore, merge, split, close, suppress, rank, publish, deliver, notify, sign, or contact. 3. Keep raw evidence, secrets, personal data, payloads, commands, paths, live identifiers, and report prose outside the ledger.

Declare the universe

1. Record the immutable expected source universe, authority-bound admissions, engagement authority, policy, cutoff, and strict window. Obtain the expected authority-manifest digest independently of the package; never derive or replace it while validating the package. 2. Record supplied scope units, objectives, methods, and limitations without adding or improving them. 3. Give every expected input exactly one disposition: eligible current, eligible historical, boundary-only, excluded invalid, excluded out of scope, or conflicted.

Preserve source meaning

1. Preserve each external assessment result. Bind its exact capability/version, artifact format, artifact, exit contract, disposition, inclusion, policy, assessment window, manifests, scope, origin, custody, and presentation approval in a separate authority admission; use the registry assembly digest only for packaging. 2. Include every eligible claim and finding exactly once. 3. Preserve claim polarity, state, confidence, applicable status, freshness, and limitations. Never strengthen or reverse them. Represent not-applicable only as a policy-backed coverage cell, never as a claim. 4. Preserve every immutable finding field digest and ordinal. Never retitle, paraphrase, rescore, reorder, merge, split, suppress, or change remediation state. 5. Count shared origin lineage once; duplicate transformations are not corroboration. 6. Keep stale or disposed sources historical. They cannot support current coverage.

Preserve open truth

1. Keep the full scope-by-objective denominator, including blocked, unknown, gap, prohibited, and not-applicable cells. 2. Bind each cell to exact applicable claims whose scope, objective, polarity, state, confidence, freshness, sources, and evidence derive the cell state. A not-applicable cell has no claims and requires an exact typed current policy receipt whose reason matches the declared scope kind. 3. Represent every independent-origin eligible opposing claim pair with one exact open contradiction; shared-origin transformations never add corroboration. 4. Keep evidence gaps as gaps and findings as findings. 5. Keep implementation and ticket receipts distinct from later remediation verification. 6. Cleanup completion is not evidence disposition, and neither closes a finding.

Assemble deterministically

1. Include every required appendix exactly once with no dangling or unreferenced member. 2. Recompute every record digest plus section, appendix, manifest, package, and presentation fingerprints from canonical ID-sorted membership. 3. Make rendered presentation membership and order match canonical sections followed by canonical appendices exactly. 4. Recompute factual counts and exact identifier sets. Do not produce a score, grade, maturity, compliance, certification, or all-clear statement. 5. A correction creates version N from one admitted N-1 package receipt with the exact superseded digest; never mutate a released package in place.

Review package

| Section | Source of truth | | --- | --- | | Scope and objectives | Supplied engagement authority and scope records | | Methods and limitations | Admitted specialist artifacts; preserve their wording and bounds | | Coverage | Full scope-by-objective denominator, including blocked and unknown cells | | Findings | Immutable final finding records, included exactly once | | Contradictions and gaps | Open records; assembly does not resolve or hide them | | Evidence index | Exact identifiers, custody state, and presentation approval | | Appendices | Canonical membership and order, with no dangling members | | Release receipt | Package version, independently supplied authority digest, package digest, and supersession link |

The package is review-ready when every expected input has one disposition and every eligible artifact is represented. It is not automatically approved, signed, delivered, or published.

Rationalizations to reject

• “A nonzero source is invalid.” Claim-bearing nonzero results can be eligible.
• “Rewrite the finding for readability.” Immutable findings remain byte-bound by field digests.
• “Drop unknown or blocked rows.” They remain in the coverage denominator.
• “Resolve the contradiction in prose.” Assembly preserves it for review.
• “The ticket says fixed.” Implementation is not verification.
• “Disposed evidence can still support the current claim.” It is historical only.
• “Add a posture score for executives.” This package has factual counts, never a score.
• “Send the finished report.” This skill never publishes, delivers, signs, or contacts.