Conciseness

Nearly every line is an operational rule Claude would not know (evidence bars, window rules, four exclusion fields, verdict bands) with no padding explaining what GDPR or HIPAA are. Not 5 because the self-assessment disclaimer is repeated three times across sections and the intro ownership section partly restates the description.

Actionability

Fully executable throughout: runnable grep/find evidence-discovery commands, a complete YAML exclusion record shape, a table of per-state evidence bars, and a fully worked, copy-paste-ready markdown output matrix covering the common case. Not 4 because there are no missing key details - even criterion IDs and dates are modeled.

Workflow Clarity

Clear five-step sequence (resolve framework, score, record exclusions, emit matrix, dry run) with explicit validation checkpoints: the four scoring rules decide disputed cells, exclusion enforcement rules void incomplete or expired exclusions, and the adversarial-review refusal rules plus the post-assessment re-baseline step form feedback loops. Not 4 because checkpoints are explicit at every stage, not merely present.

Progressive Disclosure

The body is a lean overview that clearly signals what lives in references/frameworks.md and references/iso27001.md, both of which exist. Not 5 because references nest two levels deep (iso27001.md delegates to annex-a-control-index.md and technical-control-test-patterns.md), and the body attributes the 93-control index to iso27001.md when it actually lives in annex-a-control-index.md, so two bundle files are unreachable without a second hop.

Specificity

Names several concrete actions - "Marks each criterion met, partial or not met, records approved exclusions and never claims ready with a gap" - alongside the six frameworks. Not 5 because coverage has minor gaps: the coverage-matrix output and the framework-version resolution step are not mentioned.

Completeness

Explicitly answers both: "Use when a named framework ... and existing evidence need a per-criterion readiness score before an audit, assessor visit or regulator inquiry" (when, with concrete trigger phrases) and "Marks each criterion met, partial or not met, records approved exclusions" (what). Not 4 because neither half is weak or implicit.

Trigger Term Quality

Lists all six framework names a user would say verbatim (GDPR, CCPA, SOC 2, HIPAA, PCI DSS, ISO 27001) plus natural trigger contexts "before an audit, assessor visit or regulator inquiry". Not 5 because common synonyms like "compliance", "gap assessment", or "audit prep" are missing.

Distinctiveness Conflict Risk

Clear niche: per-criterion readiness scoring tied to an explicit list of named frameworks, with distinctive trigger vocabulary ("per-criterion readiness score", "assessor visit"). Unlikely to fire for neighboring security-review or evidence-collection skills.