Not recorded yet. The lesson below is complete and runnable today — the video is added later without touching this page.
recordings/E5.6.mp4Notification obligations discovered in week two.
Feed Track F2 in hour one.
Run the first-hour checklist in a tabletop.
The disclosure clock starts on the incident, not on your understanding of it. Materiality for a probabilistic actor is genuinely hard, and the hard part does not pause the clock.
clock_check() runs from awareness, not from confirmation. Personal data and a significant incident put you on a 24-hour NIS2 early warning and a 72-hour GDPR clock simultaneously, and "we were still confirming" is not a defence — it is a description of the period the clock was running. This is the hour-one handoff into Track F2.Which notification clocks a given incident starts, counted from awareness rather than from confirmation, and why 'we were still investigating' describes the period the clock was running rather than excusing it.
The clock starts at awareness, not at confirmation, and it does not pause while you work out who acted.
Run the first-hour checklist, with separate owners for containment and disclosure.
Hours from awareness to a disclosure decision, against the deadline. Containing in an hour buys none of it back.
Measure this
| what to measure | denominator or target |
|---|---|
| hours from awareness to a disclosure decision | hours, against the deadline; containing in an hour buys none of it back |
incident starts -------------------------------> deadline
| | |
detected understood reportable?
^
materiality for a probabilistic actor is genuinely hard
and the difficulty does not pause the clock
trigger criteria are written before, or they are written badlyRegulatory clocks start at awareness — the point at which you know a reportable event may have occurred. Not at confirmation, not at containment.
Two consequences that teams discover on day three:
Containment and disclosure are separate workstreams competing for the same people. If your runbook has one owner for both, one of them is being done badly under time pressure.
Anchor → E1.0. The one interval you neither own nor can shorten. It starts at awareness rather than confirmation, does not pause while you establish who acted, and containing in an hour buys none of it back.
One-hour containment still misses a 72-hour deadline when scoping takes three days, and broken attribution misses it by twenty hours. The skill runs the clock from each candidate awareness point and names the owner of every runbook step.
The skill — skills/response/regulatory-clock-check/SKILL.md
name: regulatory-clock-check
description: >-
Run a disclosure deadline from each candidate awareness point and find which
scoping delays cause it to be missed, then name the owner of each step in the
runbook. Use when an incident has a reporting obligation and scoping is slow.
allowed-tools: Read, Grep, GlobDisclosure deadlines run from awareness, and awareness is a defensible judgement rather than a timestamp. The same incident is met or missed depending on which point you treat as the start — and the delay that misses it is almost never containment. It is scoping, and broken attribution is what makes scoping slow.
Any incident with a reporting obligation, and in advance as a tabletop, which is the only time the answer can still be changed.
1 — List the candidate awareness points. First alert, first triage, first confirmation, first executive notification. Each is arguable, and the earliest defensible one is the one to plan against.
2 — Run the clock from each. Containment, scoping, report drafted, report submitted. Record met or missed per obligation, per starting point.
3 — Find the term that misses the deadline. Containment in an hour and scoping in three days still misses a 72-hour obligation. Attribution that cannot say which principal acted turns scoping from hours into days.
4 — Map obligations to jurisdictions and their clocks. Different regimes, different windows, different definitions of a reportable event. One incident can be inside one and outside another.
5 — Name an owner per step in the runbook. Containment, scoping, disclosure drafting, submission. A runbook with an unowned step is where the hours go.
Input — the fixture committed at the top of scripts/regulatory_clock_check.py. Edit it and re-run: the buckets, counts and verdicts below are derived from it, not hard-coded.
Output — the opening lines of a real run:
scenario contain report met margin
--------------------------------------------------------------------
fast containment, slow scoping 1.0 80.0 False -8.0
slow containment, fast reporting 40.0 60.0 True 12.0
both fast 2.0 20.0 True 52.0
attribution broken (E3.5) 6.0 92.0 False -20.0
The first row contained in ONE HOUR and still missed the deadline.The run continues past this. test_skills.py executes the script on every build, with no model configured — so what CI proves is that it runs and refuses legibly, not that it prints these lines. The output above is a recorded run against a real model, and nothing re-diffs it: a model's answer is not reproducible, and this repository does not claim otherwise anywhere it can be checked.
{
"awareness_points": [{"name": "str", "at": "str", "defensible": true}],
"obligations": [{"regime": "str", "hours": 0}],
"runs": [{"from": "str", "containment_h": 0, "scoping_h": 0, "report_h": 0,
"met": [{"regime": "str", "met": false, "by_hours": 0}]}],
"dominant_delay": "str",
"runbook": [{"step": "str", "owner": "str|null"}]
}Three ways to do this lesson. Pick one. They run the same procedure against the same code — what changes is who drives it, and how much you see.
The agent reads the lesson, explains the idea, fetches the code, runs the check and answers your questions as you go. This is the one to take if you are here to learn.
Install it, once. From the folder you cloned. --all does every agent it finds on your machine:
python3 scripts/install_skills.py --all --lessons E5.6Then restart your agent and open it in that folder. On Windows, if python3 says Python was not found, use python instead.
Then pick e5-6-the-regulatory-clock:
| agent | install just for this agent | start it |
|---|---|---|
| Claude Code | python3 scripts/install_skills.py --tool claude --lessons E5.6 | type /e5-6-the-regulatory-clock |
| GitHub Copilot (VS Code) | python3 scripts/install_skills.py --tool copilot --lessons E5.6 | type /e5-6-the-regulatory-clock in Chat |
| Cursor | python3 scripts/install_skills.py --tool cursor --lessons E5.6 | type / in Agent chat and search for it |
| Codex | python3 scripts/install_skills.py --tool agents --lessons E5.6 | type $e5-6-the-regulatory-clock, or run /skills |
No agent, no conversation. The same lesson executes and prints the same readback. Take this one if you have no assistant, if you are reviewing rather than learning, or if you want the result without the teaching around it.
python3 scripts/lesson.py E5.6Neither of the above, and no model needed. The first command writes CyberTravels exactly as it stood at the end of this lesson; the second prints the diff — the lines this lesson added or changed, and nothing from any later one.
python3 scripts/checkpoint.py --at E5.6 --out work/cybertravels
python3 scripts/checkpoint.py --at E5.6 --diffOn Windows, type python wherever these say python3 — and use \ instead of / in the paths. Everything else is identical. A0.0 step 2 explains why.
Ways 1 and 2 need a model; way 3 does not. A signed-in Claude Code CLI needs no API key, and any OpenAI-compatible endpoint works too. With neither, the audit exits 2 and says so rather than inventing an answer. A0.0 sets this up.
Ways 1 and 2 both end with the same readback: What I did, What changed, The number and Read this next. A step that was skipped or refused is reported as exactly that, never as a pass.
If you did the last lesson’s challenge, expect this to stop. Most challenges ask you to edit the code, and ways 1 and 2 will not overwrite your edits: you get stopped, not a failure, with two options — --out for a fresh folder that keeps your work, or --force to discard it and start this lesson clean.
One-hour containment still misses the 72-hour deadline in the slow-scoping scenario, and broken attribution misses it by 20 hours. The same incident is met or missed depending on which point is treated as awareness. The obligation register shows DORA's 4-hour clock as the binding one, and the runbook check flags a shared owner and a late clock start.
Build your shortest-clock register: every obligation, its deadline, and who notifies. Then check whether your runbook starts the clock at awareness or at confirmation. The gap between those two is often more than a day.
What you can do now. You can close an incident properly: a run you can reproduce, a root cause naming a control rather than a person, the fix at the right layer, the indicators re-read to see which actually came back, and the policy change as a reviewable diff.
What you still cannot do. All five intervals are now yours to measure — and one is not. The regulatory clock started at awareness, and nothing here tells you which controls a supervisor will ask for, on what date, or what evidence they will accept.
Function F is governance, and it is told in the unit E5.4 already used: the key control indicator. F1.1 defines it, and the rest of the function builds it, evidences it and runs it as a programme. Next → F1.0, what AI governance means.
Skill source: skills/response/regulatory-clock-check