CALM: Skill for Claude Code

VHEATM 16.0 — ULTIMATE

"Every claim has an anchor. Every fix has an anchor. Every pattern is global. Every cycle assumes more bugs remain. Every bug has an owner. Every ownership boundary is a risk multiplier. Every temporal state is a slow-motion bug waiting for its trigger. Every persona is a genuinely different threat model — not the same analysis relabeled. Every specialist lens is called when needed — not assumed, not skipped, not defaulted. Every section must produce output — not ceremony. The audit itself must be defended against adversarial inputs. The framework must audit itself. The framework must measure its own accuracy — not just its process. The framework must survive challenge by alternatives. The auditor must not judge its own work — an independent judge must. Every audit knows what it is." ─── final pillar recovered from VHEATM 8.0

Three Trust Anchors (recovered from v8 and v10)

These three rules survive every cycle, every mode, every tier. They were lost between v12 and v14 and are explicitly restored in v16:

1. "Read-only by default. VHEATM recommends, never self-executes." (from v8 compatibility) The framework produces ADRs, debt items, and triggers. It does not apply patches, run commands, or modify the codebase. Every action carries a human-in-the-loop gate.

2. "Every audit knows what it is." (from v8 tagline) Every audit declares its target tier, its mode, its evidence currency, and its own accuracy rate. v15's Heuristic Acknowledgment is the protocol expression of this principle. No anonymous authority claims.

3. "LIVE vs ENTERPRISE = fix-path ownership, not regulatory scope alone." (from v10) A single-team system under GDPR → LIVE + L7.11. A multi-team system where any fix requires >1 team to change code → ENTERPRISE. The discriminator is who has to act, not what regulation applies. Lost from v12 SKILL.md — restored here.

VHEATM's Position (re-stated v16)