Organisation Modern Slavery Collect

Assess one record's modern-slavery risk and write the assessment beside it.

No reviews yet 0 installs

Use to assess modern-slavery risk for a saved record. Discovers the organisation's modern slavery statement and adverse media via the Ploutonion organization-compliance agent, scores governance and operational mitigation via LLM, combines those with deterministic geographic and industry inherent risk, and writes modern-slavery-risk-assessment.json beside identity.json. MUST run the bundled lib/ms_collect.py — never regenerate the collector. Runs either against one named record (--resource-type-slug + --resource-id, writing under the collection the slug maps to) or as a background shard of the Organization modern slavery service's batch fan-out (gated on RUN_ID). A record whose identity.json is missing, carries no organisation name, or has no jurisdiction to score against is skipped with a reason, never scored. The name must come from identity (a name typed on the record is not identification); the jurisdiction may also come from the record's own address.countryCode. No cortex_search.

modern-slaverysuppliersriskcollectcompliance

Versions

v1 # Changelog ## v1.5 - Single-record mode: `--resource-type-slug` + `--resource-id` assesses one saved record under the collection the slug maps to, which is what the per-record modern-slavery risk action runs. Built the way `organisation-iso-collect` built its own — a manifest-shaped row via `row_from_record`, then the existing `collect_one` unchanged — so there is one assessment body, not two that can drift. Manifest and shard modes are untouched. - Gates on a readable identity rather than scoring a record it cannot identify. A missing `identity.json` reports `needs_identity` when `resource.json` is present and `skipped` when neither is; an identity with no organisation NAME, or with no jurisdiction, is `skipped`. The name must come from identity, as enumerate's `_real_company_name` reads it — a name typed on the record is not identification; the jurisdiction may also come from the record's own `address.countryCode`, which is deliberately looser and matches why `organisation-iso-collect` reads it. Without the name half, the row builder's id fallback sent the record's UUID to the adverse-media agent and wrote the answer down as a Medium risk level, which then satisfied the 30-day freshness gate. Freshness itself is left to the resource action's own window. - Carries the record-reader helpers pinned by `supplier-identity-write`'s parity suite, which now covers this bundle too. ## v1.4 - Promoted from a skill nested inside Supplier Modern Slavery Service to a shared top-level bundle, mirroring Organisation ISO Collect. Gains its own `listing.json`, which this repo's validator requires of every top-level skill. No change to `ms_collect.py` or `ms_risk.py`: the batch-shard path (`RUN_ID` / `SHARD_INDEX` / `ITEM_IDS`) behaves exactly as before. ## v1.3 - Run statement and adverse-media discovery concurrently (two threads) instead of back to back, so one supplier's discovery costs ~485s rather than ~970s against the 600s sandbox exec that runs a shard. - Print a failed discovery to stderr (exception type and message). `a2a_agent_not_allowed` is re-raised, so a blueprint missing `organization-compliance` from `referencedA2aAgents` fails the supplier instead of scoring it as "nothing found". - Treat a whitespace-only website as missing: statement discovery is skipped, and the manifest row's website is used when identity's is blank. - SKILL.md: the tool timeout advice is the 600s maximum (it said 900–1800s, which the sandbox tools reject); multi-supplier runs go through the batch path. ## v1.2 - Statement and adverse-media discovery move from the broker's Talos helpers (`talos_modern_slavery_discover`, `talos_news_discover`, now removed) to the Ploutonion `organization-compliance` A2A agent via `qb.a2a_call_skill` — `modern-slavery-statements.discover` and `adverse-media.discover`. Request fields keep their names (`organizationName`, `jurisdictionCode`, `websiteUrls`); response fields are unchanged. - Pass `timeout_sec=480` on both calls: discovery runs up to 420s and the broker's default A2A timeout is 180s. - Skip statement discovery for a supplier without a website instead of sending an empty `websiteUrls` — the skill rejects it (Talos returned 400 for it too), so the outcome is the same without the wasted call. `jurisdictionCode` is omitted rather than sent as null when unknown. - `allowed-tools`: `a2a_call_skill` replaces the two Talos helpers. The consuming blueprint must list `organization-compliance` in `referencedA2aAgents`. ## v1.1 - Report each shard item to the agent-control-plane via `qb.batch_item_done` instead of writing a `shard-<i>.json` file ledger. Dropped `_write_shard_progress` / `SHARD_LEDGER_ROOT` — no local shard-ledger file. `collect_shard` now returns the reported items list instead of a path. - SKILL.md: updated the shard-mode section to describe the `qb.batch_item_done` reporting path. ## v1 - Initial release: deterministic geographic/industry inherent scoring (`ms_risk`), Talos statement discovery + LLM governance scoring, LLM operational mitigation scoring (with conservative fallback defaults), Talos adverse-news discovery + escalation, hybrid combine into a single final risk score/level/grade, written to per-supplier `modern-slavery-risk-assessment.json`. - Shard mode: `collect_shard`/`main_shard` for the generic batch fan-out mechanism, contract-conformant with `batch-reconcile/CONTRACT.md` (byte-for-byte shard doc shape shared with `organisation-iso-collect`). 11/3/2026