# CHANGELOG ## v2.11.0 — owner-authorised publication, 9 October 2026 Published from commit `861274f0c7af0ae8cdfc9c6a889847a964980090` (release branch `release-2.11.0`), merged as `87e64b51f1f26701d48cad146c0ece4c24c135bb` by pull request #1; [GitHub Pages deployment succeeded](https://github.com/Dankhisa/bermuda-compliance-navigator/actions/runs/37970014689). All ten checked public files matched the release manifest on 9 October 2026. From this release, changes to `main` go through a pull request. Wording, metadata and scope-statement changes. No new regulatory coverage, no new entries and no change to calculations, fees, calendar logic or the CI and SPI profiles. The owner approved each change as editorial copy; no counsel sign-off or legal opinion is claimed. - **Review-status wording.** "Pending legal review" no longer appears. Notices now say the content has not been reviewed by a lawyer or by the BMA, and report footers say "Not legally reviewed." The internal `legal_review` value is unchanged. - **Filing-extension limit entry** (`conseq-extension-cap`): the title and two sentences now describe the text of s.17(4) and no longer state a conclusion about the Authority's powers; readers are told to confirm the position with the BMA or Bermuda counsel. A regression test now rejects phrases such as "what the law actually says" and "has no power" in any entry. - **ALS Bill entry** (`rec-bill-insurance-als-2026`): dated note that the as-tabled text was re-read on 9 October 2026; stage, enactment and commencement are still not established; `review_due` moved to 30 October 2026. The entry remains a proposal and derives no filing date. - **Scope statement:** the report scope card now says Bermuda corporate income tax returns and instalment payments are not covered, with no dates. - **Smaller changes:** one entity and class per assessment is stated at step 1; the report metadata line reads "Bermuda regulatory regime (BMA-supervised)"; two external links gain `noreferrer`. - **Fingerprints.** Two entries changed, so the all-161 and all-162 pinned hashes were re-recorded on the owner's approval; the other 158 original entries are byte-identical to 2.10.0. Because the knowledge-base fingerprint changed, overlays stored with an earlier version stay stored but inactive. - Tests: 95 of 95 pass (2.10.0: 92). ## v2.10.0 — owner-authorised publication, 27 September 2026 Published from commit `23c6ff46fef3ff0395c333e7a3dc4c89233ca126`; [GitHub Pages deployment succeeded](https://github.com/Dankhisa/bermuda-compliance-navigator/actions/runs/36364577666). All ten checked public files matched the release manifest. A live smoke test showed KB 2.10.0 with the security policy active. A Class 4 overview generated through the UI showed the three topic cards; a study status set on the Operational Resilience checklist updated its summary, with no console errors or policy violations. The owner authorised publication of 2.10.0 after approving the research (Gate 2) and the built topic cards and checklists as editorial copy (Gate 3). No counsel sign-off or legal opinion is claimed. - **Three topic deep-dives** in the regulatory landscape overview, built on the SBA card's template: - **Solvency self-assessment (CISSA and GSSA):** Classes 3A, 3B, 4, C, D and E. - **Operational Resilience and Outsourcing Code:** the entities listed in Code para 3. - **Police Clearance Certificates and Key Person vetting:** every supported sector, including DABA Classes F, M and T. Requirements are cited to primary law and BMA instruments. BMA expectations, dated observations from the BMA's 2019 review, official commentary and international standards are labelled. Conflicting texts and points not established are shown, not resolved. - **Learning checklists (196 items):** - Filters by basis, a separate toggle for future items, grouping by stage, typical owner or basis, and "Depends on" labels for unconfirmed study facts. - Study statuses (Not reviewed, Reviewing, Understood, Not applicable to my study) and optional notes of up to 280 characters. - CSV, Markdown and print exports carrying the reliance notice, knowledge-base version, profile and filters. - No score, percentage or compliance status. - The PCC study facts stay inside the checklist and do not change the report. - **Saved bookmarks** can hold checklist state. It is validated field by field; malformed data invalidates the bookmark without overwriting it. Items changed or removed since saving are reported on re-opening. - **Scope rule.** Topics can be scoped by insurer class, entity type and DABA class, and can reuse an existing applicability rule. The SBA card keeps its original class-list scope. - **Journey links.** The obligations and application journeys show one line pointing to the topic deep-dives; no topic text is repeated there. - **Review findings:** - **NAV-01:** printed reports carry a reliance and non-affiliation notice on page 1, and the closing disclaimer now states the tool is not issued, endorsed or approved by the BMA. - **NAV-03:** a running footer in the bottom page margin of every printed page. - **NAV-13:** a Content Security Policy that blocks network connections, plugins and external scripts. - **Sources.** 22 new sources were added; source labels now also distinguish BMA codes, BMA notices and international standards. - **Unchanged:** the 162 entries, the SBA card, the CI/SPI profiles, the original source records, and every calculation, fee, calendar, template and application rule. Each is pinned by a regression test. - **Printing.** The new topic cards print as a summary (At a glance, scope and a pointer to the full screen version); each checklist has its own Print button. The printed Class E overview is 24 pages (20 in 2.9.0). - **Approval.** The three cards are owner-approved editorial copy; no legal opinion is claimed. - **Tests:** the regression suite grows from 78 to 92 tests. ## v2.9.0 — owner-authorised publication, 25 September 2026 Published from commit `b424cebb99074a22527dea682b843949727d53d0`; [GitHub Pages deployment succeeded](https://github.com/Dankhisa/bermuda-compliance-navigator/actions/runs/36209426770). All ten checked public files matched the release manifest. A live smoke test showed KB 2.9.0 and the SBA card for Class E, including its stated grandfathering limit, with no captured errors. The owner authorised publication of 2.9.0 after approving the Scenario-Based Approach deep-dive and the two entry corrections as editorial copy. No counsel sign-off or legal opinion is claimed. - **SBA deep-dive.** Adds an owner-approved "Topic deep-dive: Scenario-Based Approach (SBA)" to the regulatory overview for Classes C, D and E. It has 50 source-labelled claims covering: - origin (2015–2016 EBS), the 2023 consultations and the 31 March 2024 rules - eligibility and BMA approval - asset categories needing approval, and default and downgrade costs - technical and governance requirements - ongoing supervision, 2026 fees and dated developments - a labelled comparison with the Solvency II matching adjustment Requirements are cited to Schedule XXVI of the Class C, D and E Solvency Rules; BMA guidance and industry views are labelled. The card appears only in the overview and is linked from the C, D and E class backgrounds. - **Entry corrections (owner-approved):** - `focus-cap-4` now describes the established SBA approval requirements (status: established). - `conseq-sba-unapproved` now applies only to Classes C, D and E, cites Schedule XXVI (status: verify), and no longer appears for Classes 3B and 4. - The other 159 original entries are unchanged and pinned separately. - **Supporting changes:** section labels vary by profile type (class and entity labels unchanged); an optional list of dated development notes; "Not established" shown as a readable status label. - **Tests:** the regression suite passes 78/78. CI and SPI profiles are unchanged. ## v2.8.0 — owner-authorised publication, 25 September 2026 Published from commit `069739f8e520e9012451fa3e1a07d9963227da44`; [GitHub Pages deployment succeeded](https://github.com/Dankhisa/bermuda-compliance-navigator/actions/runs/36165665516). All ten checked public files matched the release manifest, and a live smoke test showed KB 2.8.0 with no captured errors. The owner authorised publication of 2.8.0. It releases the background depth programme developed in stages on 25 September 2026, each stage reviewed and approved by the owner as editorial copy. No counsel sign-off or legal opinion is claimed. - **Shared background template.** Class and entity backgrounds use one template with optional sections for how a class or sector is used in practice, sub-categories and routes, and key terms. A section appears only when sourced content exists. Key terms are labelled as statutory, regulatory (BMA returns, groupings and processes) or market usage. - **Insurer classes.** The 12 expanded insurer profiles gain business context from BMA reports, BMA 2024 class statistics, 2025 application and registration flows, key terms and limits. Figures that cover several classes together are labelled as combined and are not attributed to one class. Where a balance-sheet figure could be confused with a statutory classification test, the page says so. Class E adds no size threshold, cedant profile or classification ladder. The approved IIGB licence-count note remains its only footprint claim. The Collateralized Insurer and Special Purpose Insurer profiles are unchanged. - **Non-insurer sectors.** The intermediary, investment business, trust, corporate service provider, bank and deposit company, fund administration, money service business and DABA Class F, M and T selections now have full background profiles. Each gives licence or registration routes from primary law, history and purpose from official documents, and 2024–2025 counts. Every previously shown context claim is carried over. One CSP citation was corrected from s.2(4) to s.2(5). The owner-resolved MSB note is unchanged. - **Flagged points.** The BMA's intragroup insurance-manager comment remains an interpretation point, not an exemption. A BMA fund-administration licensing page that still cites the repealed Investment Funds Act route is shown as a conflicting-sources limit. The DABA Class T appeal point remains flagged for confirmation. - **Metadata.** Profile research and review dates are stored as data. The knowledge-base release date now matches this publication. - **Print.** Section headings stay with their content. Report length grows by about one to three pages per profile. - **Tests.** The regression suite grows from 55 to 74 tests. New tests cover claim-text parity, evidence and wording rules for business context, short-quote limits, route sub-sections, carried-over claims, the Class E and IIGB constraints, the MSB note and a pinned fingerprint for the unchanged CI/SPI profiles. The original 161-entry fingerprint and all eligibility, calculation, fee, calendar and application logic are unchanged. ### 2.8.0 development record (local stages, 25 September 2026) 1. **Structure only.** Shared template, profile dates stored as data, empty entity-details structure, non-insurer heading "Entity background (context, not requirements)". There were no claim changes across 72 checked renders. Tests: 60/60. 2. **Pilot.** Class 1 and insurance intermediaries. Seven source-register entries were added and the Conyers captive overview date corrected. The print keep-with-next rule was added. Tests: 63/63. 3. **Insurer batches:** - Classes 2, 3, A and B. - Classes 3A, 3B and 4, with the "Regulatory term" label. - Classes C and D, plus 2024 statistics on Classes 1, 2, 3, A and B. - IIGB and Class E. Tests: 65/65 to 69/69. 4. **Sector batches:** - Investment business, trust and CSP, with the CI/SPI fingerprint test added. - Bank and deposit company, fund administration and MSB. - DABA Classes F, M and T. Tests: 71/71 to 74/74. ## v2.7.4 — owner-authorised publication, 25 September 2026 Published from commit `167d97946f9199e2bb2396c75e6ff64bc74d8294`; [GitHub Pages deployment succeeded](https://github.com/Dankhisa/bermuda-compliance-navigator/actions/runs/36146707766). All ten checked public files matched the release manifest. Live Chrome checks rendered the Class E background and proposal horizon, then the IIGB footprint with both attributed counts and the editorial parenthesis; no captured application errors. Portfolio unchanged. - Releases the reviewed class backgrounds and sector context developed through versions 2.5.0–2.7.4, with the qualified IIGB count note, proposal-only C/D/E horizon item and print refinements. - Owner approval is editorial release approval. Existing source and applicability limitations remain visible; the historical development records below preserve checks and decisions at each stage. - Release browser checks confirmed the Class E sample and conditional output, save/reload/reopen, modification-request selection and copied template, and invalid JSON rejection. Calendar export was triggered; delivery was not independently confirmed. Printed PDF evidence is recorded in VERIFICATION.md. ## v2.7.4 — IIGB copy and print-readability refinement, 25 September 2026 (local candidate; not published) - Replaced “publication lag” with the narrower editorial possibility of different data-compilation cutoffs; shortened the IIGB note while preserving both attributed figures, the unreconciled status and the non-live-register caveat. - Refined print spacing and kept the Market footprint claim with its citation and the Recommended Next Steps card together where possible. Reprinted Class E, CI and IIGB locally; no browser GUI print-preview claim or deployment is made. - Preserved the original 161-entry fingerprint and existing eligibility, calculation, fee, calendar and application logic. ## v2.7.3 — qualified IIGB explanatory parenthesis, 25 September 2026 (local candidate; not published) - Clarified that the seven-entity narrative belongs to the report's Digital Finance Supervision discussion, separate from the all-insurers table's eight-licence figure. - Added the owner's requested possible mechanisms only as explicitly labelled editorial hypotheses, not as BMA findings or a reconciliation. The original 161 entries and application/obligations logic are unchanged. No push or deployment. ## v2.7.2 — IIGB report-count disclosure, 25 September 2026 (local candidate; not published) - Added the owner-approved IIGB Market footprint note attributing the BMA Annual Report 2025's eight-licence table figure and seven-entity innovation narrative separately. The report does not establish whether the measures share a scope or cut-off; the profile claims no live register total. - Left the original 161 entries, the 2026 Bill proposal, obligations and application logic unchanged. Added an overview-only regression check; no push or deployment. ## v2.7.1 — bounded Bill horizon and print QA, 25 September 2026 (local candidate; not published) - Added one source-linked, proposal-labelled 2026 Insurance Amendment Bill item to the Class C/D/E overview horizon. It does not amend the existing asset-and-liability-statement obligation, calculate a new date, or appear as an application requirement. Class backgrounds link to the single horizon entry. - Corrected the horizon heading to point to each item's own review date rather than the original July knowledge-base research date. - Printed Class E and Collateralized Insurer overview reports to local PDFs with Chrome's print engine. Removed the redundant global footer from print after it created a footer-only page; the report-specific disclaimer remains. The browser's GUI print-preview dialog was not independently observed. - Preserved the original 161-entry fingerprint and updated version, source and regression checks. No push or deployment. ## v2.7.0 — evidence-led class-background depth, 25 September 2026 (local candidate; not published) - Implemented the owner-approved editorial copy for the 12 non-pilot insurer classes in the overview journey. Each has a class-specific origin, attributed official context, statutory qualification, nearest-class distinction and dated footprint; where supported, it also has a scoped market observation or combined-study link. - Added a shared, source-labelled insurer-class history timeline instead of repeating reform narratives across profiles. Class E displays the Act wording and BMA descriptions separately without an eligibility ladder or exact-boundary outcome. - Kept filing, capital and application guidance in their existing journeys. No original KB entry, calculation, fee, calendar or template was changed. Fingerprints and import restrictions cover the shared timeline and expanded source register. - Owner approval is an editorial decision, not a legal opinion or publication authorisation. ## v2.6.0 — expanded insurer class backgrounds, 25 September 2026 (local candidate; not published) - Expanded all 12 non-pilot selectable insurer classes with source-labelled history, primary-law qualification, neighbouring-class distinctions and 2025 BMA registration counts; official policy context is shown only where supported. - Preserved the Class E statutory/BMA-summary conflict, the Class 3B/Class 4 overlap and the IIGB capital-rule verification hold. Profiles remain educational and overview-only. - Added source and rendering checks for the new data, included it in the KB fingerprint, and preserved the 161-entry baseline. ## v2.5.9 — context source-integrity guard, 24 September 2026 (not published) - Added regression validation for every insurer/entity context claim's source, retrieval date, tier and citation pin. ## v2.5.8 — context fingerprint coverage, 24 September 2026 (not published) - Extended the KB fingerprint to include insurer and entity context structures. - Added a regression assertion that context-content changes are detected. ## v2.5.7 — context-card section refinement, 24 September 2026 (not published) - Split context-card content into “Core framework” and “Boundaries and review points” disclosures where applicable. ## v2.5.6 — context-card warning refinement, 24 September 2026 (not published) - Removed the duplicate generic pending-review banner when a source-labelled context card is already present. - Kept the card-level confirmation and limitation wording beside the relevant content. ## v2.5.5 — overview coverage regression guard, 24 September 2026 (not published) - Added a regression check that every selectable insurer class, DABA licence and non-insurer type renders an overview background/context section. ## v2.5.4 — local role and activity-boundary refinement, 24 September 2026 (not published) - Added broker/agent/manager distinctions and the s.29 premium-receipt caveat to the intermediary context. - Added DABA activity-specific exemption, custody and M/T appeal caveats. ## v2.5.3 — local sector-context expansion, 24 September 2026 (not published) - Added source-labelled context cards for intermediary roles, DABA F/M/T, investment, fund administration, trust, banking, CSP and MSB selections. - Kept role boundaries, exemptions, licence conditions and unresolved interpretation points explicitly qualified. - Preserved existing workflows, obligations, calculations, fees and the 161-entry baseline. ## v2.5.2 — local insurer-class context expansion, 24 September 2026 (not published) - Added source-labelled statutory context cards for all selectable insurer classes. - Kept Class E, Class 3B/Class 4, group terminology and IIGB capital interpretation points visibly qualified. - Preserved the full CI/SPI profiles, non-insurer coverage-limits card and 161-entry baseline. ## v2.5.1 — local Class E boundary update, 24 September 2026 (not published) - Added a source-labelled, overview-only Class E boundary note. - Displayed the Insurance Act s.4EF wording and the BMA summary as separate evidence, with the exactly-$500m outcome explicitly marked not established. - Added a safe fallback note for insurer classes without a published profile. - Added a sector coverage-limits card for non-insurer selections; it provides no cross-sector legal inference. - Kept the 161 shipped entries, applicability logic, calculations, fees, calendars and templates unchanged. ## v2.5.0 — local Phase 3 candidate, 24 September 2026 (not published) - Added CI and SPI class-background research only to the Regulatory landscape overview, with source labels, provision citations, retrieval dates, timeline, statutory qualification, market context and a shared comparison. Class 3A is collapsed context; Class E and unsupported classes have no new profile. - Added the owner-approved restricted-SPI audit wording, distinguishing GAAP statements in the return from audited Statutory Financial Statements and directing readers to counsel or the BMA for the interaction. Removed the generic pending-review sign from the CI/SPI profile view without representing that external legal sign-off occurred. - Added source/claim schema checks, visible overdue and imported-profile status, overview-only tests and a 2.4.0 fingerprint assertion for all 161 unchanged entries. Profile-bearing imports are limited to the two pilot IDs, use the shipped source catalogue, and are forced to pending review. - Updated the candidate version and documentation. This log records local implementation only: no push, deployment, portfolio update or legal sign-off. ## v2.4.0 — 23 September 2026 - Added related-guidance buttons that preserve entity context and take users to the relevant facts or application selection. Focus selections survive switching journeys. Retained the existing report-section anchors; separate URLs/subpages were unnecessary for these shared-profile workflows. - Separated the three assessment journeys so the regulatory landscape overview is the detailed regime map, ongoing obligations & filings is the operational calendar/checklist view, and application preparation is task-specific. - Removed duplicated framework, selected-change, filing-calendar and optional-focus sections from inappropriate report paths. All source-backed content remains available through its relevant journey; the obligations view points users back to the detailed regime map. - Made the choice-card descriptions and recommended next steps explicit about the boundary between understanding the regime and running the compliance cycle. - No knowledge-base entries, source links, verification labels, calculations, fees, deadlines or applicability rules changed. Saved assessments remain input bookmarks and regenerate against the new presentation. - 40 automated checks pass, including a regression that asserts the paths do not reintroduce the duplicated sections. ## v2.3.0 — 22 September 2026 - Fixed the wizard rebuilding the request dropdown from stale state before reading a new selection. Modification and other requests now retain their own task through navigation. - Reworked five distinct draft letters, including task-specific subjects, grounds and requested outcomes. Labelled document lists as preparation aids and preserved unconfirmed facts as placeholders. - Clarified section 56 scope, distinguished sections 6C/6D and designated-investment-contract section 57A, and avoided a generic modification fee quote. - Added conditional PCC preparation questions, a collapsible checklist and escalation prompts. No certificates, passport data or residence histories are collected; no issuer is claimed to be BMA-approved. - Rechecked the original PCC notice, the consolidated Insurance Act, 2026 fee schedule and available personal-declaration form. Form/issuer acceptance and submission-channel uncertainties remain visible. - 39 automated checks pass. Targeted browser checks cover all five letters, saved PCC state, desktop/mobile layout, keyboard disclosure and native copy/paste. Print/offline output remains unverified. ## v2.2.0 — 21 September 2026 Targeted accuracy and saved-data release; 161 entries. Original research and per-entry review history are retained. This is not a complete regulatory or legal re-verification. - Corrected Operational Resilience scope, current outsourcing Act treatment, insurer officer citations, dividend/capital row scope, filing-specific extension fees, annual fees, Code dates, ALS wording and economic-substance administration/source links. - Added conditional Key Person PCC guidance, including new licensing, and separated the June consultation's proposed timings. Added resolution/PSPI developments as pending information. - Added optional applicability questions and explicit limits for unsupported profiles, reporting periods and fee years. Withheld unsupported SBA/internal-model breach conclusions. - Preserved legacy overlays without activation; new overlays use baseline version/fingerprint. Merge rejects raw-storage changes; local review claims remain unendorsed. Legacy bookmarks ask for new facts. - Reviewed all five letter templates, added report scope/assumptions, sample report, portfolio case study and social preview. - Added source-derived regression cases: 33 automated tests. Browser approval blocked the fresh preview; browser/mobile, print/direct-file and related interactive checks remain outstanding. See VERIFICATION.md. Earlier notes are historical. ## v2.1.0 — 16 September 2026 Stage 2 improvement release. Author attribution: Daniel Khisa. This is an educational portfolio project; the app update date does not reverify the KB. The 156-entry KB retains its original 2 July 2026 research date and individual review dates. Earlier release notes below are historical. - Corrected insurer-only application scope, unsupported cross-sector examples, speculative enforcement wording, and unconfirmed assertions in draft letters. Corrected the asset-and-liability statement description against BR 123/2025; its conditional date is excluded from automatic calendar generation. - Removed the live LLM/API integration and embedded prompt. Added a privacy and storage explanation and an explicit action to remove a legacy stored API key. - Added semantic navigation, native mode radios and dialogs, keyboard focus handling, associated labels, readable contrast, mobile navigation, scrollable tables, and separate New/Edit assessment actions. Saved focus selections reopen. - Validated KB imports and stored records, escaped rendered text, restricted source links to HTTPS, and made merge previews expire when input or baseline changes. Corrupt storage is reported without silent overwriting. - Restricted calendar estimates to supported, current entries; added omitted date explanations, class-specific identifiers, and UTF-8-safe ICS folding. - Added metadata, inline favicon, report navigation, print styling, and About content. Preserved the existing index.html + kb.js architecture with no build step or remote JavaScript dependency. - Added 16 dependency-free regression checks and verified core flows in the browser, including 375px mobile reflow, save/reopen, and invalid-import rejection. See README.md for usage, verification and the live demonstration. The local STAGE_2_CHANGES.md records the precise improvement diff. GitHub Pages publication and public desktop/mobile viewport checks completed on 16 September 2026; direct file and print-output checks remain unverified. The personal portfolio is a later stage. ## v2.0.0 — 2 July 2026 Enhancement release: research-refreshed, versioned knowledge base; non-compliance & consequences module; optional LLM layer; compliance-officer features. Visual design unchanged (design lock respected — existing tokens and component classes only; new components reuse the same language). ### What was verified against sources (research pass 2 July 2026 — see SOURCES.md) - **Insurance Act 1978** — official bermudalaws.bm consolidation (current through the Insurance Amendment (No. 2) Act 2025, effective 7 Jan 2026) downloaded and the following verified verbatim: filing dates and the statutory extension caps (s.17(4): 4→max 7 months commercial/special; 6→max 9 months captive classes); weekly late-filing fees and inspector trigger (s.18A); annual fee due date and 10%/month late penalty (s.14); principal representative duties (ss.8–8A); cyber event notification (s.30JEA); solvency/ECR breach duties and dividend freezes (ss.31A, 31AA); dividend/capital-reduction restrictions (ss.31B–31C); controller regime and offences (ss.30D–30H); intervention powers (s.32); civil penalties up to $500,000 (s.32D); public censure (s.32F); prohibition orders (s.32H); cancellation (ss.41–44); false documents (s.50). - **2026 BMA fee schedule** (effective 1 Jan 2026) — actual amounts captured for insurer annual fees by class/tier, registration/application fees, per-month filing-extension fees, controller/dividend/capital-reduction/modification fees, internal-model and SBA approval fees, and group (s.27B) fees. - **Research directive — extension limit:** the "three extensions then breach" belief resolves to a statutory cap on the aggregate extension period (three additional months, s.17(4)), not a count of requests; the fee schedule prices extensions only to the third month. Encoded as ESTABLISHED (statute) + VERIFY (fees) with the rule-of-thumb framing labelled as practitioner view. - **Research directive — SBA approval:** confirmed that SBA use requires BMA review/approval under Rules made under s.6A/27F (fee schedule prices approval at $120k–$1.5M, $250k annual monitoring, biennial re-approval of default cost assumptions); unapproved use = contravention of the Rules engaging s.32D, s.32 and s.6D. Exact rule paragraph per class flagged for verification. - **Current instruments:** Insurance Code of Conduct (rev. Aug 2022); Cyber Risk Code (Oct 2020, in force 1 Jan 2021 — 72h notification / 14-day report); Operational Resilience & Outsourcing Code (Sep 2025; banks 1 Jan 2027, others 31 Mar 2028); Climate guidance (Mar 2023, action plans by YE2025); Prudential Standards Amendment Rules 2024 (EBS reforms, 31 Mar 2024) and Class C/D/E Amendment Rules 2025 (asset & liability statement, 1 Jan 2026); Recovery Plan Rules 2024 (1 May 2025, designated insurers); AML/ATF general guidance (June 2023) + Oct 2024 long-term sector risk paper; economic substance declaration (6 months post-FYE; administration transferring to the Corporate Income Tax Agency); group supervision changes (designated insurance holding companies, 7 Jan 2026); BMA enforcement practice (published penalties incl. $900k against a long-term insurer). ### What changed - **kb.js (new):** all regulatory content extracted from index.html into a versioned data layer (KB v2.0.0, as at 2026-07-02; ~90 entries). Every entry carries id, entity_scope, topic, text, citation, source (typed), verification, last_reviewed, review_due (+12 months; +6 for fees), legal_review ("pending"). - **index.html:** consumes kb.js (still zero-dependency, works from file://). Added, in the existing visual language: - "Reviewed {date}" metadata on every rendered item + amber "Review overdue" badge past review_due; KB version + "knowledge base as at" date in the results header (and print); source-type pills ("Expert opinion — not a BMA source", "Practitioner view — not a BMA source") on all non-BMA content; persistent "Illustrative content — pending legal review" notice (prints). - **Non-Compliance & Consequences card** (DISTIL + EXECUTE; task-filtered in EXECUTE): breach triggers, statutory consequences tables (Breach | Consequence | Provision | Status) with verified citations, supervisory-escalation-in-practice callout (published enforcement actions), labelled practitioner guidance, and the extended counsel disclaimer. 12 consequence topics incl. late filing, extension cap, unapproved SBA/ internal model, MSM/ECR breach, controllers, principal representative, dividends/capital, annual fee, cyber events, unregistered business, false information; generic sector-ladder entry for non-insurer sectors. - **Recent & Pending Changes card** (MAP mode) built from the research pass. - **Knowledge Base admin view:** paste/upload JSON fragments; schema validation; new/changed/unchanged diff; merge into a localStorage overlay over the shipped kb.js; version bump; overlay export/removal. - **Ask the Navigator (optional):** user-supplied Anthropic API key (localStorage only), free-text follow-ups sent with the master prompt + wizard state + keyword-retrieved KB entries direct to the Anthropic Messages API (claude-sonnet-5); [ESTABLISHED]/[VERIFY]/[UNVERIFIED] tokens parsed into badges; "AI-generated — verify before reliance" pill + disclaimer; fully degraded behaviour without a key or on API failure. - **Export calendar (.ics)** on DISTIL results: RFC 5545 output (CRLF, 75-octet folding, escaping, per-event UIDs, all-day DTSTART, 30-day and 7-day VALARMs), structurally validated before download. - **Saved assessments:** localStorage audit records (timestamp, prepared_by, inputs, mode, app/KB version, KB entry ids used); list view with re-open (re-renders against the current KB with a version-change notice), delete, export-all-JSON; honest per-device limitation statement. - **MASTER_PROMPT.md v1.1:** mandatory "Consequences of Non-Compliance" section in DISTIL and EXECUTE modes with BMA-vs-practitioner source-labelling and do-not-assume guardrails (mirrored into index.html for the LLM layer). - **SOURCES.md (new):** full research log — every source, URL, version date, retrieval date, use, and the unresolved-items register. - **Filing data corrections from research:** captive SFR deadline firmed from "six months — confirm" to ESTABLISHED s.17(4)(a); SPI/Collateralized/IIGB correctly placed in the four-month group; cyber notification window resolved (was UNVERIFIED); economic substance deadline resolved (6 months post-FYE); annual fee date confirmed (before 31 March, s.14(2)) with 2026 amounts; extension task rewritten around the verified s.17(4)/s.6C mechanics and per-month fees. ### What remains unverified (flagged in-app and in SOURCES.md) - Exact rule-paragraph citations for SBA approval per class; quarterly-return deadlines per class; current submission channels/portals per application type; any fee for auditor/actuary/principal-representative approval; whether a post-2019 revision of the Insurance Act Statement of Principles exists; final status of the 2024 Code-of-Conduct extension to intermediaries; Operational Resilience Code no-objection mechanics (verify in Code text); obligation-level detail for non-insurer sectors; post-transfer economic substance mechanics. Everything ships with `legal_review: "pending"`. ### Verified in preview (WS6) Class 4 (MAP/DISTIL/EXECUTE), Class 1 captive (DISTIL/MAP), trust company (MAP/DISTIL); date-arithmetic edge cases (31 Dec + 4m = 30 Apr; 31 Aug + 6m = 28 Feb; 29 Feb + 4m = 29 Jun; 31 Oct + 4m = 28 Feb); consequences card and EXECUTE task filtering; reviewed dates, source pills, legal-review banner and KB pills (screen + print structure); .ics build passes internal RFC 5545 validation (5 events, 2 alarms each, ≤75-octet lines, unique UIDs); save / saved-list / re-open (incl. KB-version-change notice) / delete / export; KB import validation (bad fragments rejected), diff and overlay merge with version bump; Ask-the-Navigator no-key note, mocked API failure (static results unaffected) and mocked success (badge tokens parsed, AI pill + disclaimer appended); zero console errors or warnings throughout.