Add RFP response skill

skills/rfp-response/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: rfp-response
+description: Draft cited RFP and security-questionnaire answers from a supplied knowledge pack, with gaps for unsupported questions.
+source:
+  type: cli-tool
+  command: node
+  args:
+    - run.mjs
+  input_mode: stdin
+  cwd: .
+  timeout_seconds: 30
+inputs:
+  questionnaire:
+    type: json
+    required: true
+    description: Array of questionnaire prompts with id, question text, and optional section.
+  knowledge_pack:
+    type: json
+    required: true
+    description: Sources and claims that may be cited in answers.
+  objective:
+    type: string
+    required: false
+    description: Optional operator intent for the draft.
+runx:
+  category: business-ops
+  input_resolution:
+    required:
+      - questionnaire
+      - knowledge_pack
+---
+
+# rfp-response
+
+Use this skill when an operator needs a reviewable RFP or security-questionnaire
+draft that is grounded only in supplied company knowledge. The skill reads a
+questionnaire and knowledge pack, drafts cited answers for supported questions,
+and records unsupported questions as gaps instead of inventing certifications,
+controls, metrics, or contractual claims.
+
+The skill is read-only over its inputs. It performs no network calls, sends no
+responses, stores no secrets, and emits only a draft for human approval before it
+leaves the organization.
+
+## Inputs
+
+- `questionnaire`: array of `{id, question, section}` records.
+- `knowledge_pack`: object with a `sources` array. Each source may contain
+  `id`, `title`, `url`, and `claims`; each claim may contain `id`, `text`, and
+  optional `tags`.
+- `objective`: optional operator intent.
+
+## Output
+
+The runner returns JSON with:
+
+- `answers` array: `{q, answer, citations, confidence}` for grounded answers.
+- `gaps` array: unsupported questions with missing-evidence notes.
+- `evidence_json` object: compact verification summary.
+- `report` string: human-readable draft review notes.
+
+Every answer contains at least one citation. Questions without supporting
+knowledge are placed in `gaps` and are not answered.

skills/rfp-response/X.yaml

@@ -0,0 +1,117 @@
+skill: rfp-response
+version: "0.1.0"
+
+catalog:
+  kind: skill
+  audience: public
+  visibility: public
+  role: canonical
+
+policy:
+  side_effects: none
+  network_during_run: denied
+  secrets_required: false
+  filesystem:
+    read: []
+    write: []
+
+harness:
+  cases:
+    - name: cited-security-questionnaire-answers
+      runner: default
+      inputs:
+        objective: "Draft grounded security questionnaire answers for a vendor review."
+        questionnaire:
+          - id: q1
+            section: encryption
+            question: "Do you encrypt customer data at rest and in transit?"
+          - id: q2
+            section: access
+            question: "How do you restrict production access?"
+        knowledge_pack:
+          sources:
+            - id: security-overview
+              title: "Acme Security Overview 2026"
+              url: "https://example.com/acme/security-overview"
+              claims:
+                - id: enc-1
+                  text: "Customer data is encrypted at rest with AES-256 and in transit with TLS 1.2 or newer."
+                  tags: [encryption, data, transit, rest]
+                - id: access-1
+                  text: "Production access is limited to approved on-call engineers, requires MFA, and is reviewed quarterly."
+                  tags: [access, production, mfa, review]
+      expect:
+        status: sealed
+        receipt:
+          schema: runx.receipt.v1
+          state: sealed
+          disposition: closed
+          reason_code: process_closed
+
+    - name: unsupported-certification-is-gap
+      runner: default
+      inputs:
+        objective: "Do not invent unsupported certifications."
+        questionnaire:
+          - id: q1
+            section: compliance
+            question: "Are you ISO 27001 certified?"
+        knowledge_pack:
+          sources:
+            - id: security-overview
+              title: "Acme Security Overview 2026"
+              url: "https://example.com/acme/security-overview"
+              claims:
+                - id: access-1
+                  text: "Production access is limited to approved on-call engineers and requires MFA."
+                  tags: [access, production, mfa]
+      expect:
+        status: sealed
+        receipt:
+          schema: runx.receipt.v1
+          state: sealed
+          disposition: closed
+          reason_code: process_closed
+
+    - name: missing-knowledge-pack-fails-closed
+      runner: default
+      inputs:
+        objective: "Fail closed when grounding sources are absent."
+        questionnaire:
+          - id: q1
+            section: compliance
+            question: "Are you ISO 27001 certified?"
+        knowledge_pack:
+          sources: []
+      expect:
+        status: failure
+
+runners:
+  default:
+    default: true
+    type: cli-tool
+    command: node
+    input_mode: stdin
+    args:
+      - run.mjs
+    outputs:
+      answers: array
+      gaps: array
+      evidence_json: object
+      report: string
+    artifacts:
+      wrap_as: rfp_response_packet
+      packet: runx.business_ops.rfp_response.v1
+    inputs:
+      questionnaire:
+        type: json
+        required: true
+        description: Questionnaire prompts to answer.
+      knowledge_pack:
+        type: json
+        required: true
+        description: Source-backed company knowledge pack.
+      objective:
+        type: string
+        required: false
+        description: Operator intent for the response draft.

skills/rfp-response/evidence/clean-install.json

@@ -0,0 +1,43 @@
+{
+  "status": "success",
+  "registry": {
+    "action": "install",
+    "source": "remote",
+    "ref": "lubuseb/rfp-response@sha-68462d4db0fd",
+    "install": {
+      "status": "installed",
+      "destination": "/tmp/runx-rfp-response-clean-install/lubuseb/rfp-response/sha-68462d4db0fd/SKILL.md",
+      "skill_name": "rfp-response",
+      "source": "runx-registry",
+      "source_label": "runx registry",
+      "skill_id": "lubuseb/rfp-response",
+      "version": "sha-68462d4db0fd",
+      "digest": "sha256:53684267a1bca9969949207600ca436940ced49500ff3a6381e7f3a375458f9e",
+      "profile_digest": "sha256:75bfeb70a9559a6ed9d077c7d4f8d0db786191172fc7fbe5eeadaef67b07543c",
+      "profile_state_path": "/tmp/runx-rfp-response-clean-install/lubuseb/rfp-response/sha-68462d4db0fd/.runx/profile.json",
+      "runner_names": [
+        "default"
+      ],
+      "trust_tier": "community"
+    },
+    "receipt_metadata": {
+      "destination": "/tmp/runx-rfp-response-clean-install/lubuseb/rfp-response/sha-68462d4db0fd/SKILL.md",
+      "digest": "sha256:53684267a1bca9969949207600ca436940ced49500ff3a6381e7f3a375458f9e",
+      "install_count": 1,
+      "package_digest": "3c983bb8018f48bec461085fccd230d657548ac25b3363529aa4a5af10423be5",
+      "profile_digest": "sha256:75bfeb70a9559a6ed9d077c7d4f8d0db786191172fc7fbe5eeadaef67b07543c",
+      "publisher": {
+        "display_name": "LubuSeb",
+        "handle": "lubuseb",
+        "id": "user_53f00ae7ec2363e37ac6ff68",
+        "kind": "user"
+      },
+      "ref": "lubuseb/rfp-response@sha-68462d4db0fd",
+      "skill_id": "lubuseb/rfp-response",
+      "source_label": "runx registry",
+      "status": "installed",
+      "trust_tier": "community",
+      "version": "sha-68462d4db0fd"
+    }
+  }
+}