clauseflow-ivory.vercel.app

{
  "name": "get_standard",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return the active security standard, a one-line projection of every requirement in it (code, title, risk, owner, control count, stale-evidence count), and the pending change event AC2-CHG-2026-017 awaiting assessment. Start here when you do not yet know which requirement a question concerns, or when the user names a change by its ticket id. Do NOT use this to read the full text or assertions of one requirement — it returns summaries only; call get_requirement. Do NOT call it as a warm-up before every other tool.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "filter": {
        "type": "string",
        "enum": [
          "all",
          "uncovered",
          "critical",
          "stale_evidence"
        ],
        "description": "Restrict the requirement list. 'uncovered' returns requirements with no implementing control; 'stale_evidence' those resting on evidence past its freshness window."
      }
    },
    "additionalProperties": false
  }
}

{
  "name": "get_requirement",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return one requirement — full text, machine-readable assertions, applicability, owner, verification method — plus its version history and the subtree beneath it (controls, their tests and evidence, work items, exceptions). Use it before analyzing a change, so you diff against the real current version rather than an assumption. Do NOT use it to survey many requirements; it is deliberately verbose for one. Do NOT use it to fetch the graph for rendering — that is get_traceability_graph.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "requirementId": {
        "type": "string",
        "description": "Stable requirement code, e.g. 'AC-2'. Not a version id like 'AC-2@2'."
      }
    },
    "required": [
      "requirementId"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_traceability_graph",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return graph nodes and edges as compact projections. Its purpose is to make *absence* legible: pass a filter to get the broken shape you are looking for. 'uncovered' = requirements with no implementing control and work fulfilling nothing; 'stale_evidence' = evidence past its freshness window and what rests on it; 'expiring_exceptions' = carve-outs lapsing within 30 days; 'unverified_links' = edges proposed or never confirmed by a human. Do NOT call this with filter 'all' merely to look around — narrow with rootId and depth. Do NOT use it to decide whether a change breaks something; that is analyze_change_impact.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "filter": {
        "type": "string",
        "enum": [
          "all",
          "uncovered",
          "stale_evidence",
          "expiring_exceptions",
          "unverified_links"
        ],
        "description": "Which slice of the graph to return. Defaults to 'all'."
      },
      "rootId": {
        "type": "string",
        "description": "Restrict to the neighbourhood of this entity, e.g. 'AC-2' or 'CTL-114'."
      },
      "depth": {
        "type": "number",
        "description": "Hops from rootId. Defaults to 2."
      },
      "includeProvenance": {
        "type": "boolean",
        "description": "Include each edge’s full provenance record rather than just its state. Costly; prefer explain_trace_link for one edge."
      }
    },
    "additionalProperties": false
  }
}

{
  "name": "get_execution_state",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return every work item joined to the control it fulfills and the requirement that stays unsatisfied if it slips, across both trackers — Jira for the core org, Azure Boards for the business unit acquired in 2019 and never consolidated. Use it to answer who is doing what, what is blocked, and which obligation a piece of engineering work actually serves. Do NOT use it to propose new work — that is propose_work_item. Do NOT use it to check whether existing work survived a requirement change; analyze_change_impact decides that.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "team": {
        "type": "string",
        "enum": [
          "Platform Identity",
          "Cloud SRE",
          "Developer Experience",
          "GRC",
          "Gov Cloud"
        ],
        "description": "Restrict to one team."
      },
      "status": {
        "type": "string",
        "enum": [
          "backlog",
          "in_progress",
          "in_review",
          "done",
          "blocked"
        ],
        "description": "Restrict to one status."
      },
      "onlyOrphans": {
        "type": "boolean",
        "description": "Return only work that fulfills no control — engineering nobody can trace."
      }
    },
    "additionalProperties": false
  }
}

{
  "name": "search_confluence_pages",
  "kind": "answer",
  "impl": "imperative",
  "description": "Search the simulated Wexler Confluence space for policy and requirement pages by id, title, or text. Use this to locate policy truth, not delivery work.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "query": {
        "type": "string",
        "description": "Policy text, requirement code, page id, or title fragment."
      }
    },
    "required": [
      "query"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_confluence_page",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return one simulated Confluence policy page by its native WSEC page reference. Use it for authoritative policy wording and version metadata.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "pageRef": {
        "type": "string",
        "description": "Native reference such as 'WSEC/pages/884215'."
      }
    },
    "required": [
      "pageRef"
    ],
    "additionalProperties": false
  }
}

{
  "name": "search_jira_issues",
  "kind": "answer",
  "impl": "imperative",
  "description": "Search simulated Jira work by key, title, team, assignee, status, or acceptance criteria. Use it to find engineering work connected to a policy obligation.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "query": {
        "type": "string",
        "description": "Jira key or free-text query, e.g. 'PLAT-4471' or 'break glass'."
      }
    },
    "required": [
      "query"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_jira_issue",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return one simulated Jira issue with status, owner, acceptance criteria, and trace identity. Use this after search_jira_issues identifies a key.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "issueKey": {
        "type": "string",
        "description": "Native Jira key such as 'PLAT-4471'."
      }
    },
    "required": [
      "issueKey"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_azure_board_item",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return one simulated Azure Boards record from the acquired business unit. Use this instead of get_jira_issue for numeric Azure work-item ids.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "workItemId": {
        "type": "string",
        "description": "Native numeric id such as '12844'."
      }
    },
    "required": [
      "workItemId"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_pipeline_run",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return a simulated GitHub Actions or Azure DevOps Pipelines test definition or run. Use this to verify implementation evidence, not policy intent.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "runRef": {
        "type": "string",
        "description": "Native workflow, run, or pipeline reference."
      }
    },
    "required": [
      "runRef"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_identity_record",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return a simulated Microsoft Entra ID or Okta configuration or export. Use this to inspect identity enforcement across corporate and acquired environments.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "recordRef": {
        "type": "string",
        "description": "Native Entra export or Okta report reference."
      }
    },
    "required": [
      "recordRef"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_servicenow_exception",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return one simulated ServiceNow risk exception or approval record. This reads scope, approver, expiry, and rationale; it cannot approve or renew it.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "ticket": {
        "type": "string",
        "description": "Native request id such as 'RITM0084412'."
      }
    },
    "required": [
      "ticket"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_vanta_control_status",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return a simulated Vanta continuous-compliance monitor or evidence record. Use it to reconcile reported compliance with technical evidence.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "monitorRef": {
        "type": "string",
        "description": "Native Vanta monitor reference."
      }
    },
    "required": [
      "monitorRef"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_architecture_decision",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return a simulated SharePoint ADR explaining an architectural constraint or accepted design.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "decisionRef": {
        "type": "string",
        "description": "Native SharePoint ADR reference."
      }
    },
    "required": [
      "decisionRef"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_infrastructure_record",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return a simulated AWS, Azure, or Terraform Cloud infrastructure record tied to a control.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "recordRef": {
        "type": "string",
        "description": "Native cloud resource or Terraform run reference."
      }
    },
    "required": [
      "recordRef"
    ],
    "additionalProperties": false
  }
}

{
  "name": "get_observability_record",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return a simulated Splunk or Datadog logging, retention, drift, or monitoring record.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "recordRef": {
        "type": "string",
        "description": "Native Splunk or Datadog record reference."
      }
    },
    "required": [
      "recordRef"
    ],
    "additionalProperties": false
  }
}

{
  "name": "compare_requirement_versions",
  "kind": "answer",
  "impl": "imperative",
  "description": "Semantic diff between two versions of a requirement — not a text diff. Reports which obligations tightened, loosened, were added or dropped; which identity classes came into or out of scope; and whether the verification method changed. \"Tightened\" is the classification that matters: it is what invalidates a control, a test, or an exception. With no arguments it diffs the current AC-2 against the pending change AC2-CHG-2026-017. Do NOT use this to find out what breaks — it describes the change, not its consequences, and analyze_change_impact runs this diff internally and returns it.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "requirementId": {
        "type": "string",
        "description": "Stable code, e.g. 'AC-2'. Defaults to the pending change."
      },
      "fromVersion": {
        "type": "number",
        "description": "Version to compare from. Defaults to the current approved version."
      },
      "toVersion": {
        "type": "number",
        "description": "Version to compare to. Omit to compare against the pending change."
      }
    },
    "additionalProperties": false
  }
}

{
  "name": "analyze_change_impact",
  "kind": "answer",
  "impl": "imperative",
  "description": "The primary analysis tool, and a deterministic one: it compares assertion objects across the live graph and never asks a model what breaks. Returns identity classes newly in scope, controls whose configuration no longer satisfies the requirement (including controls owned by other teams that are not even linked to it), tests that no longer prove it despite still passing, exceptions whose granted relief is no longer permissible, and in-flight work whose acceptance criteria are now out of date. Every finding carries the comparison that produced it. Called with no arguments it analyzes the pending change AC2-CHG-2026-017. This tool computes and returns; it changes nothing and approves nothing. Follow it with create_impact_review to turn findings into reviewable proposals. Do NOT use it for standing drift unrelated to a change — that is detect_gaps.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "severityAtLeast": {
        "type": "string",
        "enum": [
          "info",
          "low",
          "moderate",
          "high",
          "critical"
        ],
        "description": "Drop findings below this severity from the returned list."
      }
    },
    "additionalProperties": false
  }
}

{
  "name": "detect_gaps",
  "kind": "answer",
  "impl": "imperative",
  "description": "Find drift that exists right now, with no change proposed: requirements with no implementing control, identity classes a requirement covers that its controls do not, evidence past its freshness window, exceptions expiring or already lapsed, and controls whose coverage overlaps an exception carving out the same class. Use it to answer \"where do we stand\" and before generating an audit packet. Do NOT use it to evaluate the proposed change — it knows nothing about the change; analyze_change_impact does that.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "scope": {
        "type": "string",
        "enum": [
          "controls",
          "evidence",
          "conflicts",
          "all"
        ],
        "description": "'controls' = coverage gaps; 'evidence' = staleness; 'conflicts' = exception expiry and overlap. Defaults to 'all'."
      }
    },
    "additionalProperties": false
  }
}

{
  "name": "calculate_readiness",
  "kind": "act",
  "impl": "imperative",
  "description": "Compute the readiness score with its full breakdown: control coverage, verification, evidence freshness, exception health, and open proposals, each with its weight, sub-score, and the specific reason it is not 100%. The formula is returned with the result. The score is always recomputed from the live graph — approving a fix changes the graph, and the score follows; nothing adds points for activity. Do NOT report the score without its breakdown; a bare number is exactly the false confidence this system exists to prevent.",
  "inputSchema": {
    "type": "object",
    "properties": {},
    "additionalProperties": false
  }
}

{
  "name": "explain_trace_link",
  "kind": "answer",
  "impl": "imperative",
  "description": "Read back provenance. Given an edge, return who created it, whether a human or an agent did, why they said it holds, which system of record supports it, when a human last confirmed it, and whether it is approved or still proposed. Given a finding id, return the deterministic rule that produced it with the expected and observed assertions and the records compared. Use it when asked how a conclusion was reached, or whether a connection can be trusted. Do NOT infer a rationale when this returns none — say the link is unexplained, because an edge without provenance is a defect worth reporting. Do NOT use it to list a subtree.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "edgeId": {
        "type": "string",
        "description": "Edge id, e.g. 'E-001'."
      },
      "findingId": {
        "type": "string",
        "description": "Finding id, e.g. 'F-004'."
      },
      "fromId": {
        "type": "string",
        "description": "Source entity id, when you do not know the edge id."
      },
      "toId": {
        "type": "string",
        "description": "Target entity id, when you do not know the edge id."
      }
    },
    "additionalProperties": false
  }
}

{
  "name": "show_requirement_history",
  "kind": "answer",
  "impl": "imperative",
  "description": "Return every recorded version of a requirement with its effective date, approval status and what changed. Editing a requirement here never overwrites; it appends a version, so this is a complete record rather than a reconstruction. Use it to answer when an obligation changed and what it was before. Do NOT use it to compare against the pending change — compare_requirement_versions does that.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "requirementId": {
        "type": "string",
        "description": "Stable code, e.g. 'AC-2'."
      }
    },
    "required": [
      "requirementId"
    ],
    "additionalProperties": false
  }
}

{
  "name": "generate_traceability_matrix",
  "kind": "act",
  "impl": "imperative",
  "description": "Produce the requirement-to-evidence matrix an assessor reads: each requirement, the controls implementing it, the tests verifying those controls, the evidence supporting them with freshness, the work in flight, and any exception carving out part of the scope — each row carrying the source-system reference it came from. Rows with nothing in a column are the point of the document, so gaps are rendered explicitly rather than omitted. Do NOT use this to read the graph for your own reasoning; it is formatted for a human assessor and is expensive. Do NOT present it as an audit submission — that is generate_audit_packet.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "requirementIds": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "Restrict to these requirements. Omit for the whole standard."
      }
    },
    "additionalProperties": false
  }
}

{
  "name": "generate_audit_packet",
  "kind": "act",
  "impl": "imperative",
  "description": "Assemble the record for an assessor: the requirement before and after, the interpretation that was accepted and who accepted it, affected controls with their source-system references, work approved and work rejected, exception rationale, the named decision-maker for each approval, and the coverage gaps that remain open. Rejected proposals and remaining gaps are included deliberately — a packet showing only what passed is the one an assessor trusts least. Call it after a review has been acted on, so approvals carry names and dates. Do NOT call it to preview what a packet would contain before anyone has decided anything; it will honestly report that nothing was decided.",
  "inputSchema": {
    "type": "object",
    "properties": {},
    "additionalProperties": false
  }
}