{
  "$comment": "Contract A4, extended with a `compliance` block. A compliance credential is not just an achievement — it carries a due date, an attestation, an audit trail and a recertification clock. Those four are the shape; the keys below express them so the platform can drive them rather than inferring them from prose.",
  "track": "ashr-posh",
  "level": "foundations",
  "title": "ASHR.work POSH Compliance — Annual Certification",
  "description": "Annual compliance certification that a person at ASHR.work understands the Company's Policy on Prevention of Sexual Harassment at the Workplace: what the policy covers and where the workplace extends to, what conduct it prohibits, how to raise a complaint and what happens next, the statutory clocks, and the confidentiality and anti-retaliation protections that make the process usable.",
  "criteria": "Complete the ashr-posh foundations track, pass the assessment against the published blueprint (policy-scope-and-definitions 35%, raising-and-redressal 40%, committee-records-and-recertification 25%) at the cut score set by the named SME panel, AND record the Annexure A acknowledgement for the policy version in force. A pass without a recorded attestation does not satisfy this credential.",
  "achievement_type": "Certification",
  "skills": [
    "Scope of the POSH Act and of the Company's policy, including digital and work-from-home settings",
    "Recognising prohibited conduct, quid pro quo and hostile-environment harassment",
    "Raising a complaint: internal Point of Contact and the district Local Committee route",
    "Statutory timelines: the complaint window, the inquiry period and the action period",
    "Confidentiality, interim relief and protection against retaliation",
    "What the Company must be able to evidence about awareness and acknowledgement"
  ],
  "validity_days": 365,
  "renewal_window_days": 45,
  "assurance_level": "A1",
  "compliance": {
    "mandatory": true,
    "audience": "every person with an ASHR.work login, and every person the policy applies to under its section 2 — permanent and fixed-term employees, founders and directors, interns, trainees, consultants and contractors, irrespective of gender, role or employment status",
    "due_within_days_of_joining": 30,
    "due_reason": "Policy section 12 commits the Company to communicating this policy to every person at induction; 30 days is the operational reading of 'at induction'.",
    "attestation": {
      "required": true,
      "kind": "annexure_a_acknowledgement",
      "statement": "I confirm that I have received, read, and understood the Company's Policy on Prevention of Sexual Harassment at the Workplace, and I agree to comply with it.",
      "source": "docs/POSH_POLICY.md — section 13 and Annexure A",
      "recorded_per": "person per policy version",
      "policy_slug": "posh",
      "policy_slug_note": "The ASHR.work `policies.slug` (B3-09, scripts/121) whose acknowledgement records this attestation. Declared here, beside the attestation it belongs to, so the compliance dashboard (M6-06) can join the two halves from the pack instead of guessing a slug in code. A tenant that has published no policy under this slug is reported as 'attestation not tracked' — never as satisfied."
    },
    "audit_evidence": [
      "who was in scope for the policy version in force, and on what date they came into scope",
      "who completed the track, and when",
      "who recorded the Annexure A acknowledgement, against which policy version, and when",
      "who is overdue, and by how long",
      "the policy version in force at each point in time"
    ],
    "audit_evidence_note": "The Compliance Declaration in docs/POSH_POLICY.md asks separately for the number of complaints received, resolved and pending in the financial year. That is case data and is NOT a certification artifact — it is held in ASHR.work's own concerns records (/concerns/committee) and never leaves them.",
    "recertification": {
      "cadence": "annual",
      "grace_days": 0,
      "grace_note": "A compliance credential with a grace period is a credential that is quietly expired. Renewal opens 45 days before expiry; on the expiry date the person is out of compliance and must show as such."
    },
    "recertification_triggers": [
      {
        "trigger": "policy_version_change",
        "effect": "every existing certification for the superseded version expires immediately; everyone in scope recertifies against the new version",
        "why": "The policy is currently a template pending legal review. Its adopted text will differ, and a certification against the draft cannot stand for the adopted policy."
      },
      {
        "trigger": "internal_committee_constituted",
        "effect": "every existing certification expires immediately; everyone in scope recertifies",
        "why": "Policy section 2: the Company employs fewer than 10 persons today, so complaints route to the district Local Committee. The moment headcount reaches 10 an Internal Committee must be constituted and the redressal route changes — which invalidates the single most consequential thing this track teaches."
      },
      {
        "trigger": "annual_review",
        "effect": "normal expiry at validity_days",
        "why": "Policy section 12: the policy is reviewed at least annually."
      }
    ],
    "policy_source": {
      "path": "docs/POSH_POLICY.md",
      "repo": "https://github.com/demystify-systems/hrms-e2e",
      "version": "1.0",
      "status": "template_pending_legal_review",
      "status_note": "The source document is marked 'Template / draft for small teams (fewer than 10 employees)' and instructs that it be reviewed by a lawyer before formal adoption. It still carries bracketed placeholders for the company legal name, effective date, designated Point of Contact and district Local Committee contact. No item in this pack tests a placeholder. When the policy is adopted, policy_source.version changes and policy_version_change fires.",
      "act": "Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013"
    },
    "product_surfaces": [
      {
        "url": "https://ashr.work/help/concerns/raising-a-confidential-concern",
        "what": "how a person raises a concern, named or anonymously, and what the tracking token is for"
      },
      {
        "url": "https://ashr.work/help/concerns/handling-a-grievance-case",
        "what": "how the committee works a case: acknowledge, confidential notes, deadline sweep, recorded outcome, access log"
      }
    ]
  }
}