Context Bootstrap

Hollow reports are worse than no reports. When a user runs /report:exec-summary with an empty findings cache, the right move is to teach them the setup, not to make up a report.

What to check

Before any report command generates, verify:

1. Plugins installed. Run /plugin list or inspect the marketplace. Need at least:

   • grc-engineer (the pipeline hub)
   • One connector (e.g., github-inspector, aws-inspector, okta-inspector)
   • One framework plugin (e.g., soc2, fedramp-rev5, iso27001)

2. Findings cache populated. Look in ~/.cache/claude-grc/findings/<source>/*.json. Timestamps within the last 30 days mean the pipeline is active.

3. Framework metadata available. Each framework plugin's plugin.json should have a framework_metadata block. Without it, coverage math fails silently.

4. History depth (for week-over-week commands). /report:automation-coverage needs at least 2 metric snapshots in ./grc-data/metrics/ that are 7+ days apart. Verify snapshot dates there rather than inferring movement from the findings cache.