check-australian-privacy-principles-l0cka

Check Australian Privacy Principles

Verify every fact-triggered APP framework layer before applying an APP. Never assume that the text, application perimeter, instruments, codes, future changes or guidance remains unchanged.

Read references/app-verification-method.md before starting.

Workflow

1. Fix dates and facts.

   • Record the legal as-at date and decision horizon, including deployment, contract, retention and review dates actually known.
   • Identify the relevant entity, conduct, location, information, exemption, code and instrument facts. Do not invent a future horizon.

2. Establish official versions.

   • Invoke $check-commonwealth-legislation for the Privacy Act, Schedule 1 and every material application provision at the as-at date.
   • Invoke $trace-commonwealth-legislative-change through the horizon when a version boundary, amendment or commencement may intervene.
   • Check current Privacy Regulations and the OAIC registered-code inventory. Treat OAIC APP text and Guidelines as regulator material, not legislation.

3. Build provenance-bound inventories.

   • Inspect complete Schedule 1 boundaries and enumerate every displayed APP without a hard-coded count or list.
   • Capture the official canonical and final URL, effective period, retrieval timestamp, raw document SHA-256 and the complete text needed for fingerprinting. Do not reproduce full statutory text in the work product.
   • Fingerprint the application perimeter, applicable regulations and codes, and versioned guidance as separate layers using the reference schema.

4. Compare deterministically.

   python3 <skill-root>/scripts/compare_app_inventory.py validate <inventory.json>
   python3 <skill-root>/scripts/compare_app_inventory.py compare \
     <earlier.json> <later.json> --horizon <YYYY-MM-DD>
   

   validate returns only INVENTORY SCHEMA VALID. The script cannot prove that supplied content is official and never independently returns APP FRAMEWORK VERIFIED. The helper is optional, read-only and offline. Without command execution, perform the same comparison manually and record that the scripted check was not run.

5. Apply fail-closed statuses.

   • Use APP FRAMEWORK VERIFIED only after legislation checks establish the official source, applicable period, complete Schedule and every fact-triggered layer.
   • Use APP FRAMEWORK CHANGE DETECTED – LEGAL CONTENT REVIEW REQUIRED for an APP text, application-perimeter, regulation or applicable-code change.
   • Use APP TEXT UNCHANGED – APPLICATION LAW REVIEW REQUIRED for a mapped future change or unresolved application layer.
   • Use GUIDANCE REFRESH REQUIRED for a guidance-only change, separately from statutory status.
   • Use APP FRAMEWORK NOT VERIFIED – DO NOT RELY whenever any required source, version, Schedule boundary, layer or comparison is unresolved.