# =============================================================================
# COMPETENCY RECORD - Cedric Ancellin's demonstrated engineering skills and
# experience. Third-party technologies and vendors are named as the concrete
# skill surface. Professional background / track record.
# =============================================================================

# ============================================================
# REGULATORY, FISCAL & COMPLIANCE ENGINEERING - COMPETENCY RECORD
# ============================================================
# Core Purpose:
#   Demonstrated experience implementing government fiscal
#   compliance, tax handling, legal consent/waivers, and a
#   deep audit/change-tracking system - the regulatory and
#   governance surface of a payments-handling platform.
# ============================================================

summary: >
  Built the regulatory and governance surface of a
  payments-handling platform: a full government fiscal e-invoicing
  compliance module (cryptographically signed invoices submitted
  to a national tax authority), multi-rate tax handling, digital
  consent and waiver management, and a deep audit / change-tracking
  system spanning API access, transactions, and infrastructure.


# ==================================================================
# 1. GOVERNMENT FISCAL E-INVOICING COMPLIANCE
# ==================================================================

fiscalization:
  description: >
    Implemented end-to-end fiscal compliance for a national
    e-invoicing regime (Croatian fiscalization / FINA), as a
    self-contained, unit-tested module wired into checkout.
  mechanisms:
    - "Cryptographic invoice signing, RSA-SHA1 XML digital signatures using PKCS#12 / X.509 certificates."
    - "SOAP integration with the national tax authority over mandatory TLS 1.2."
    - "Generation of the issuer security code and receipt of the tax-authority identifier per invoice (ZKI / JIR)."
    - "Full audit persistence of every fiscalization attempt (codes + raw request/response) per venue and transaction."
    - "Automatic fiscalization triggered on transaction completion in the checkout flow."
  skill_signal: "Regulatory compliance with a foreign jurisdiction's tax law, digital-signature standards (PKCS#12/X.509, XML-DSig), and SOAP/legacy government integration."


# ==================================================================
# 2. TAX HANDLING
# ==================================================================

tax:
  description: >
    Built multi-rate, multi-jurisdiction tax and fee computation
    into the pricing/checkout path.
  coverage:
    - "Multiple VAT rates, excise tax, local entertainment/hospitality tax, margin-based taxation, and tax-exempt handling."
    - "Granular per-line tax + fee breakdown persisted for audit (service charge, processing fee, gratuity variants, taxes)."
    - "Configurable fee formulas (fixed, percentage, capped-percentage, per-guest, per-item, tiered), 30+ formula variants."


# ==================================================================
# 3. CONSENT, WAIVERS & TERMS
# ==================================================================

consent:
  description: >
    Built digital legal-consent capture tied to transactions and
    memberships.
  mechanisms:
    - "Event/booking-level terms of service captured and stored per transaction for audit."
    - "Digital waiver signing with timestamp, signer location, and source, including separate minor/junior waivers."
    - "Re-sign prevention and completion-state validation; waivers linked to membership and member identity."


# ==================================================================
# 4. AUDIT & CHANGE-TRACKING
# ==================================================================

audit:
  description: >
    Built a broad audit and change-tracking system covering
    application, data, and infrastructure, the evidence layer for
    governance and incident response.
  application_audit:
    - "API access auditing (per date / endpoint / key / host / IP with period-over-period trending)."
    - "Transaction audit records (who / what / when), account create/modify history, admin-user action tracking."
    - "Dispute/chargeback workflow states (pending / approved / denied / completed / cancelled) with evidence management."
  infrastructure_audit:
    - "Database schema/access/user/IP/instance change tracking and slow-query auditing."
    - "VM provisioning/deprovisioning, SSH connection logs, service-password rotation, and deployment/published-code auditing."
    - "Hardware/software inventory and feature-flag rollout/assignment tracking."
  workflow:
    - "Incident / audit / log / follow-up record types with state, ownership, priority, due dates, and attachments."
    - "Two-party approval workflow (requester + approver) with email notification."
  cross_reference:
    $ref: "https://zc8.com/competencies/07_security_engineering"