Update to DPDP Planner and Organizer

{
  "description": "Use this when a company in India wants its DPDP gaps listed: missing notices, missing consent records, no way to withdraw consent, no route for data requests, no retention rule, no breach plan, no vendor contracts, and no named owner. Also use for DPDP gap analysis, gap register, data protection readiness check, and what is missing under India's data protection law. Do not use for a law outside India.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 464
    }
  ],
  "name": "dpdp-gap-view",
  "skill_md_contents": "---\nname: dpdp-gap-view\ndescription: Use this when a company in India wants its DPDP gaps listed: missing notices, missing consent records, no way to withdraw consent, no route for data requests, no retention rule, no breach plan, no vendor contracts, and no named owner. Also use for DPDP gap analysis, gap register, data protection readiness check, and what is missing under India's data protection law. Do not use for a law outside India.\n---\n\n# DPDP Gap View\n\nThis step turns the company's answers and its map into one gap register it can work from.\n\n## Tools\n\n- `start_dpdp_plan` and `confirm_company_profile`: run the interview and return the profile.\n- `build_data_map`: builds the map.\n- `draft_obligations_note`: returns the questions for a lawyer and the citation ids an added gap needs.\n- `assess_dpdp_gaps`: runs the server rules and returns the register.\n\n## The seed: what every call carries\n\nThe server keeps no state. It derives the profile, the map, the note and the gaps from a small seed every time.\n\n- `industry`: one of `healthcare`, `d2c`, `financial-services`, `saas`, `general`\n- `company_name`, `business_description`, `role`\n- `answers`: every answer so far, keyed by question id, each `{ value, basis }`\n- `map_changes`: every map edit so far\n- `model_added_gaps`: optional, any gap you added\n\nRules:\n\n- `basis` is `stated` for a fact the user gave and `assumed` for anything you worked out. Use the value `dont_know` for an unknown.\n- Carry all answers, all map changes and all added gaps forward on every call. The full seed runs about 2 KB.\n- Never send a `plan` field. The server rejects it.\n- Keep the whole argument under 8,000 bytes.\n\n## Getting here from an empty seed\n\nThe server derives the gaps from the seed, so the interview and the map run first.\n\n1. Call `start_dpdp_plan` with the industry, a short business description, the user's role and `answers: {}`.\n2. The intake screen appears with every question and a \"Send my answers\" button. Say the user can answer on the screen or in the chat. Screen path: call `confirm_company_profile` once with all their answers. Chat path: ask the `interview.next_questions` batch, call `confirm_company_profile` with every answer so far, and repeat until `interview.remaining` is zero.\n3. Show the profile and have the user confirm it.\n4. Call `build_data_map` with `map_changes: {}` to get the node keys, show the map, ask what is right, what they lack, their own tool names, the owners, what sits outside India and which outside companies have signed data terms. Call it again with those corrections in `map_changes`.\n\nKeep that catch-up short, then come back here.\n\n## Step 1: Run the rules\n\n- Call `assess_dpdp_gaps` with the seed and `map_changes`.\n- The server rules run on the user's own answers. A gap the answers prove comes back stated. A gap from a context rule comes back assumed.\n- Never drop a row the server returned.\n\n## Step 2: Show the register\n\nGroup the rows the way the result groups them: legal, technical, operational.\n\nEach row carries `id`, `evidence`, `fix`, `owner_role`, `priority`, `proof_of_closure`, `flows`, `question_ids`, `citation_ids` and its basis.\n\nSay the counts from the result: total, P1, P2, stated, assumed.\n\n## Step 3: Add a gap the rules missed\n\nUse `model_added_gaps` when the user's answers show a gap the register lacks. Each one needs:\n\n- a new `id`\n- `group`, one of legal, technical, operational\n- `evidence`, `fix`, `owner_role`, `priority`, `proof_of_closure`\n- `flows` and `question_ids` that already exist\n- `citation_ids` taken from the note result you just read\n\nThen:\n\n- Call `draft_obligations_note` first if you have not read the note, because the citation ids come from it.\n- An added gap always stays assumed and enters week one.\n- Carry it on every later call.\n\n## Step 4: Check the assumed rows\n\n- Name the rows marked assumed.\n- Ask the user to confirm or correct each one.\n- Fix the answer in the seed and call `assess_dpdp_gaps` again, so the marks are right.\n\n## Reading a result\n\nEach result holds `schema_version: 2`, `step`, `company_name`, `counts`, `disclaimer` and the register. The screen shows the detail.\n\n- Say the counts and read out the P1 rows.\n- Do not recite every row in the chat. Point the user at the screen.\n- Never name a gap, a citation or a flow the result did not return.\n\n## What you must never say\n\n- Never say the company is compliant. Never say the company is in breach.\n- Never predict a penalty, a fine or an outcome.\n- Never call this an audit or a certificate. It is a gap register built on the user's own answers.\n- Show the `disclaimer` from the result with the register.\n\n## Legal statements\n\n- Cite the section or rule the result gives. Use the label or the ref from the `sources` entry for that citation id.\n- Leave out any point with no citation in the result.\n- Do not import GDPR words into DPDP.\n\n## Support requests\n\n- Do not add a contact line to your replies.\n- When the user is stuck, help with the step itself.\n- If the user asks how to reach MBS about the planner, give the contact page once: https://www.meridianbridgestrategy.com/contact\n- Never give a person's name, an email address or a booking link.\n\n## What happens next\n\nOffer the 30-day plan from this register, then the buying guide. Say it in one line and wait. Keep the seed, the map changes and any added gaps.\n\n## What to leave out\n\n- Send only the seed fields the schema asks for. No chat history, no files, no unrelated context.\n- Never ask for names, contact details or records of real people. The server rejects them with `PERSONAL_RECORDS`. If the user pastes such records, say you will not take them, and ask for the kinds of data held.\n\n## Host reply\n\n- Describe the result in plain text on Codex. Screens and the Save the pack button belong to ChatGPT; mention them when that host provides them.\n- Explain the planner boundary in your own words. Keep internal skill paths and instruction quotes out of the reply.\n\n## User confirmation\n\n- Ask a question batch, then wait for the user. Repeat confirm only after answers change. Mark other answers dont_know when the user asks to leave them unknown.\n- Carry profile_confirmed true only after the user confirms the profile, and map_confirmed true only after the user confirms the map. Clear the relevant confirmation when its inputs change.\n"
}