Initial commit

docs/work/epics/compliance-manifests-pii-retention-subprocessors/08-docs-compliance-reference-files/_story.md

@@ -0,0 +1,44 @@
+---
+id: 08-docs-compliance-reference-files
+epic: compliance-manifests-pii-retention-subprocessors
+title: docs/compliance reference example files and README
+type: technical-story
+status: done
+feature: docs
+depends-on: [06-compliance-generator-scripts]
+blocks: []
+created: 2026-05-18T17:52:09Z
+updated: 2026-05-18T20:23:30.582Z
+---
+
+## Goal
+
+Add `docs/compliance/data-map.example.yml`, `docs/compliance/retention-policy.example.yml`, `docs/compliance/sub-processors.example.yml`, and `docs/compliance/README.md` explaining the `docs/compliance/` (templates / examples) vs root `compliance/` (live generated artifacts) split and how to operate the generators.
+
+## Why
+
+Without documentation, a downstream consumer editing `compliance/*.yml` manually won't understand which files are generated vs hand-authored, what fields each entry requires, or how to run the generators. The `docs/compliance/` folder becomes the canonical onboarding reference for the compliance module.
+
+## Done when
+
+- `docs/compliance/data-map.example.yml` shows a complete data-map entry with every field (`category`, `purpose`, `exportable`, `restrictable`, optional `retention`) populated and annotated.
+- `docs/compliance/retention-policy.example.yml` shows a complete retention-policy entry (`activeRetention`, `postDeletion`, `purgeSchedule`, optional `coldArchive`).
+- `docs/compliance/sub-processors.example.yml` shows both a trace-backed entry (`is-sub-processor: true` with all conditional fields) and a `source: manual` hand-authored entry.
+- `docs/compliance/README.md` explains: what each YAML file contains, how they are generated, the `docs/compliance/` (examples) vs `compliance/` (live) split, when and how to author `compliance/sub-processors.manual.yml`, and how to run `pnpm compliance:emit-all`.
+- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass.
+
+## In scope
+
+- `docs/compliance/data-map.example.yml`
+- `docs/compliance/retention-policy.example.yml`
+- `docs/compliance/sub-processors.example.yml`
+- `docs/compliance/README.md`
+
+## Out of scope
+
+- `compliance/sub-processors.manual.yml` — consumer-authored artifact; not shipped by the template.
+- Runbooks, privacy policies, pre-launch checklist — Epic D territory.
+
+## Tasks
+
+- [x] Add `docs/compliance/data-map.example.yml`, `docs/compliance/retention-policy.example.yml`, `docs/compliance/sub-processors.example.yml`, and `docs/compliance/README.md` explaining the docs/compliance (templates) vs compliance/ (live artifacts) split, generator usage, and manual sub-processor entry authoring — all gates pass on this commit.