compliance-review

Use this skill at Step 10 of the v2 SOP, executed by the Compliance-Agent (whose backing model must be heterogeneous from the main orchestrator), to produce a COMPLIANCE_REPORT.md for a change that has passed functional Verify and code review. Audits PHI handling, prompt-injection surface, model-call conformance to MODEL_ALLOWLIST, and test-data lineage. Outputs risk-tiered findings (High / Medium / Low) with concrete remediation pointers. Chinese trigger examples: "合规审查 Gate", "Step 10", "合规扫描", "PHI 泄漏检查", "数据流图审查", "出 COMPLIANCE_REPORT". Do NOT use as a substitute for Step 8 code review, do NOT use before Step 7 Verify passes (functional bugs distort compliance signal). Success = signed COMPLIANCE_REPORT.md with high-risk = 0, every medium-risk has owner + remediation, no PHI leak found in logs / exceptions / cache layers.