Primacode
Skill: compliance-trace
Assemble the auditable record of a change or a release. It reports what happened; it does not analyse anything.
Live Built and working today on the surface this card describes.
What it does
Its own description: use when asked for a compliance trace, an evidence pack, an audit trail for a release, who approved something, or when preparing evidence for a regulator, an external auditor, or a board review.
It reports what already happened. It does not analyse a diff, and the skill says so: for that, compliance, privacy-audit or security-audit are the ones.
Sources are consulted in a stated order of trust, so two runs over the same release produce the same trace.
What was not checked is part of the trace, named as not checked. An evidence pack that omits the gap is an evidence pack that misleads.
Inputs and outputs
| Input | A range of changes, and whatever review output exists for them. |
|---|---|
| Output | One block: the change, what was requested, what was checked, what was not checked, who approved, whether it is deployed, and what is open. |
| Sources | Taken in the skill's own order of trust. |
| Not this skill | Analysing a diff. |
Configuration
| How it is chosen | By name, or by the model matching the description this card opens with. That description is the routing rule, and it is what decides which of the nine runs. |
|---|---|
| Where it lives | Embedded in the binary as <name>/SKILL.md, on the branch that ships it. The same file is what the published catalog serves, so there is one copy in one layout. The catalog itself is built and verified and not yet uploaded to the portal. |
PRIMACODE_SKILLS_URL | Points the tool at a catalog of skills. Leave it alone unless you are serving a separate catalog. The nine that ship in the binary are already loaded without it. |
Limits
- It can only report what exists. A release with no review output produces a trace that says so, which is the useful answer and not a failure.
- Do not point the tool at the published catalog for these nine. The binary already embeds them, and the loader keys skills by name: a duplicate logs a warning and silently replaces rather than merging.
Example
the shape of a trace
Change: 88eeae7..f0d3cc7 (14 commits)
Requested: "add the compliance gate before we go to the bank" - 2026-08-19
Checked: compliance (4 findings, 3 resolved, 1 accepted)
security-audit (0 confirmed, 2 unverified)
Not checked: privacy - no pass was run against this change
Approved: <name>, 2026-08-21, on the diff at f0d3cc7 and the compliance output
Deployed: not deployed
Open: 1 accepted risk - unencrypted phone field, owner <name>, review 2026-11Source of truth
primacode/.opencode/skills/compliance-trace/SKILL.md (the checked-out copy; on branch `claim-event-model` the same file is embedded at packages/core/src/plugin/skill/primacode/compliance-trace/SKILL.md, which is what a released binary carries)philosophers_stone/platform/primacode.md § Status (the nine skills ship in the binary, 2026-08-27)