Add Breach Notification Analyst agent preset to Security category

[ahmadvh]

Context

Octochains provides built-in "preset" agents: pre-configured domain specialists designed to run in parallel pipelines. Each preset pairs a role (e.g., "Chief Financial Officer") with a SKILL.md file defining its domain procedure.

The Security category uses these presets to analyze log and endpoint data from different angles without overlap:

• security_threat_hunter (Merged): Focuses on external intrusions (IoCs, MITRE ATT&CK tactics). Good First Issue: Add "Security Threat Hunter" preset agent #9
• insider_threat_analyst (In Progress): Focuses on internal misuse by legitimate users post-authentication. Add Insider Threat Analyst agent preset to Security category #18
• identity_access_auditor (In Progress): Focuses on authentication/authorization events (how access was obtained). Add Identity & Access Auditor agent preset to Security category #19
• breach_notification_analyst (This Issue): Focuses on regulatory risk. It takes the same log/incident evidence as the other security presets, but asks whether an incident involves personal data and triggers legal breach notification obligations (e.g., GDPR 72-hour window).

---

Goal

Implement the breach_notification_analyst agent preset, following the same pattern as existing Security presets.

Refer to Adding a New Official Agent Preset in CONTRIBUTING.md for the setup guide.

---

Preset Specification

• Role: "Breach Notification Analyst"
• Goal: Determine whether an incident involves personal data, triggers regulatory breach-notification requirements, and what timelines apply.
• Expected Inputs: Security incident logs, data-access records, affected-system inventories.
• Skill Name: breach-notification-triage
• Skill Requirements:
  • Differentiate between affected personal data vs. purely system/infrastructure data.
  • Evaluate notification rules (e.g., GDPR Art. 33 72-hour supervisory authority notification vs. Art. 34 individual notification).
  • Scope Constraint: Focus on notification obligations, not technical severity assessments (leave detection and technical severity to security_threat_hunter).

---

Checklist

• Discuss Location: Comment on preferred skill directory placement (security/ vs legal/) or open a draft PR to discuss.
• Create Skill: Add SKILL.md with name, description, and version frontmatter at the agreed path.
• Create Factory Function: Add breach_notification_analyst() to src/octochains/agents/presets.py (see existing presets for reference).
• Export Agent: Import and add breach_notification_analyst to __all__ in src/octochains/agents/__init__.py.
• Add Tests: Update tests/test_presets.py to verify:
  • Fails fast without an llm_callable
  • Attaches the correct skill
  • Contains non-empty role and goal fields
  • Merges extra_skills correctly

---

First-time contributor? This issue involves a small architectural decision regarding file placement alongside the standard preset recipe. Feel free to comment below if you want to discuss the spec or skill location before opening a PR!