docs(adopters): document China regulatory coverage in adopter guides (#56)

Updates the three adopter-facing docs (CLI-REFERENCE, ADOPTION-GUIDE,
WORKFLOWS) in EN, ES, and zh-CN to reflect the China regulatory support
shipped in fw-4.3.0 / cli-3.3.0.

CLI-REFERENCE:
- Documents the new --region flag and the six china-* values for
  --standard on `devtrail compliance`.
- Documents the four new China DocTypes (pipia, cacfile, tc260ra,
  ailabel) on `devtrail new`, marked as opt-in.
- Notes that twelve scope-aware validation rules (CROSS-004..011,
  TYPE-003..006) activate when `regional_scope` includes china.

ADOPTION-GUIDE:
- New "China Regulatory Coverage" subsection in Standards Compliance
  with a per-framework table (TC260, PIPL, GB 45438, CAC, GB/T 45652,
  CSL 2026).
- New "Regional Regulatory Scope" subsection in Configuration showing
  the regional_scope YAML and what activates when china is added.

WORKFLOWS:
- New "China Regulatory Workflow" section covering one-time setup,
  the document bundle to create when adding a generative AI model,
  CSL incident reporting workflow, cross-border data transfer, and
  daily compliance checks.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: montfort

docs/adopters/ADOPTION-GUIDE.md

@@ -145,6 +145,19 @@ DevTrail aligns with and supports compliance for:
 | **ISO/IEC 23894:2023** | AI risk management aligned with ETH and AI-RISK-CATALOG (Fase 3) |
 | **GDPR** | ETH documents with GDPR Legal Basis section, DPIA for privacy impact assessments |
 
+### China Regulatory Coverage *(opt-in via `regional_scope: china`)*
+
+| Standard | How DevTrail Helps |
+|----------|-------------------|
+| **TC260 AI Safety Governance Framework v2.0** | Five-level risk grading (TC260RA), `tc260_*` fields on ETH/MCARD/AILOG/SEC |
+| **PIPL — Personal Information Protection Law** | PIPIA template with PIPL Art. 55-56 sections, `pipl_*` fields, retention ≥ 3 years (`TYPE-003`) |
+| **GB 45438-2025** *(mandatory)* | AILABEL template covering explicit + implicit labeling for generative content |
+| **CAC Algorithm Filing** | CACFILE template with single + dual filing tracking; cross-checks from MCARD via `cac_filing_required` |
+| **GB/T 45652-2025** | Training-data security section in SBOM and MCARD; `gb45652_training_data_compliance` field |
+| **CSL 2026** | INC extension with `csl_severity_level`, deadline-coherence rules (1h / 4h+72h+30d windows) |
+
+> Activate by adding `china` to `regional_scope` in `.devtrail/config.yml`. See the *Configuration* section below and the installed `CHINA-REGULATORY-FRAMEWORK.md` guide for details.
+
 ### Architecture Documentation
 
 | Standard | How DevTrail Helps |
@@ -354,6 +367,28 @@ The CLI automatically:
 
 ## Configuration
 
+### Regional Regulatory Scope
+
+`.devtrail/config.yml` controls which compliance frameworks are evaluated by `devtrail compliance` and which document types are exposed by `devtrail new`:
+
+```yaml
+regional_scope:
+  - global   # NIST AI RMF + ISO/IEC 42001 (always recommended)
+  - eu       # EU AI Act + GDPR
+  - china    # TC260 v2.0, PIPL/PIPIA, GB 45438, CAC, GB/T 45652, CSL 2026
+```
+
+**Default if omitted**: `[global, eu]` — preserves the behavior of every DevTrail version prior to `fw-4.3.0`.
+
+When you add `china` to the list:
+
+- Four China-specific document types become available via `devtrail new`: `PIPIA`, `CACFILE`, `TC260RA`, `AILABEL`.
+- Six new compliance checkers run with `devtrail compliance` (or via `--region china` / `--standard china-*`).
+- Twelve scope-aware validation rules activate (`CROSS-004` to `CROSS-011`, `TYPE-003` to `TYPE-006`).
+- Five new governance guides are referenced from `.devtrail/00-governance/` (`CHINA-REGULATORY-FRAMEWORK.md`, plus per-framework guides for TC260, PIPL/PIPIA, CAC filing, and GB 45438 labeling) — all available in EN, ES, and zh-CN.
+
+A project without `china` in `regional_scope` is unaffected: no new files, no new prompts, no new rules. Adding `china` later is fully reversible.
+
 ### Customizing Agent Identifiers
 
 Each AI platform has its own configuration file that:

docs/adopters/CLI-REFERENCE.md

@@ -296,6 +296,8 @@ Validate DevTrail documents for compliance and correctness.
 - Sensitive information detection (API keys, passwords)
 - Related document existence
 
+When `regional_scope` includes `china`, twelve additional rules activate (`CROSS-004` to `CROSS-011`, `TYPE-003` to `TYPE-006`) covering TC260 review escalation, PIPIA linkage from sensitive-data documents, CACFILE / AILABEL cross-references, CSL severity-to-deadline coherence, and PIPIA 3-year retention. Without `china` in scope, these rules are skipped — no false positives.
+
 **Example:**
 
 ```bash
@@ -321,10 +323,10 @@ Create a new DevTrail document from a template.
 | Argument/Flag | Default | Description |
 |---------------|---------|-------------|
 | `path` | `.` (current directory) | Target project directory |
-| `--doc-type`, `-t` | — | Document type: `ailog`, `aidec`, `adr`, `eth`, `req`, `tes`, `inc`, `tde`, `sec`, `mcard`, `sbom`, `dpia` |
+| `--doc-type`, `-t` | — | Document type. Core (12): `ailog`, `aidec`, `adr`, `eth`, `req`, `tes`, `inc`, `tde`, `sec`, `mcard`, `sbom`, `dpia`. China (4, opt-in): `pipia`, `cacfile`, `tc260ra`, `ailabel`. |
 | `--title` | — | Title for the new document |
 
-If `--doc-type` or `--title` are omitted, the command prompts interactively.
+If `--doc-type` or `--title` are omitted, the command prompts interactively. China-only types are filtered out of the prompt (and rejected from `-t`) when `regional_scope` does not include `china`.
 
 **Examples:**
 
@@ -353,31 +355,44 @@ $ devtrail new -t ailog --title "Implement JWT authentication"
 
 ---
 
-### `devtrail compliance [path] [--standard <name>] [--all] [--output <format>]`
+### `devtrail compliance [path] [--standard <name>] [--region <name>] [--all] [--output <format>]`
 
-Check regulatory compliance against EU AI Act, ISO/IEC 42001, and NIST AI RMF.
+Check regulatory compliance. By default, evaluates the standards whose region is in `regional_scope` from `.devtrail/config.yml` (default `[global, eu]`). Six Chinese frameworks are available opt-in when `china` is added to `regional_scope`.
 
 **Arguments and flags:**
 
 | Argument/Flag | Default | Description |
 |---------------|---------|-------------|
 | `path` | `.` (current directory) | Target project directory |
-| `--standard` | — | Check a specific standard: `eu-ai-act`, `iso-42001`, or `nist-ai-rmf` |
-| `--all` | — | Check all three standards |
+| `--standard` | — | Check a specific standard: `eu-ai-act`, `iso-42001`, `nist-ai-rmf`, `china-tc260`, `china-pipl`, `china-gb45438`, `china-cac`, `china-gb45652`, `china-csl` |
+| `--region` | — | Run all standards in a region: `global`, `eu`, `china`, or `all` |
+| `--all` | — | Check every standard, regardless of `regional_scope` |
 | `--output` | `text` | Output format: `text`, `markdown`, or `json` |
 
-If neither `--standard` nor `--all` is specified, defaults to `--all`.
+Precedence: `--standard` > `--all` > `--region` > the project's `regional_scope`.
 
 **What it checks:**
 
+Global / EU (always available):
+
 - **EU AI Act**: Risk classification, ethical review linkage, DPIA existence, incident reporting
 - **ISO/IEC 42001**: Governance policy, risk planning (ETH), operations documentation (AILOG/AIDEC), Annex A coverage
 - **NIST AI RMF**: MAP (AILOG), MEASURE (TES), MANAGE (ETH/INC), GOVERN (policy + ADR), GenAI risk coverage (12 NIST 600-1 categories)
 
-**Example:**
+China (opt-in via `regional_scope: china`):
+
+- **TC260 v2.0**: TC260RA exists; high/very-high/extremely-severe levels require review; the three grading criteria (scenario × intelligence × scale) are populated
+- **PIPL**: PIPIA exists when `pipl_applicable`; cross-border transfer documented; retention ≥ 3 years per Art. 56
+- **GB 45438**: AILABEL exists for generative content; both explicit and implicit labeling tracks declared; mandatory metadata fields populated
+- **CAC Algorithm Filing**: CACFILE exists when required; explicit `cac_filing_status`; `cac_filing_number` populated when status is `*_approved`
+- **GB/T 45652**: SBOM and MCARD declare training-data security compliance
+- **CSL 2026**: Every INC has `csl_severity_level`; deadline hours coherent with severity (1h ↔ particularly_serious, 4h ↔ relatively_major); 30-day post-mortem documented for major+ incidents
+
+**Examples:**
 
 ```bash
-$ devtrail compliance --all
+# Default: runs only standards whose region is in regional_scope
+$ devtrail compliance
   DevTrail Compliance
   /home/user/my-project
   12 document(s) analyzed
@@ -395,18 +410,47 @@ $ devtrail compliance --all
     ✓ [ISO-004] Annex A control coverage (6/6 groups)
 
   ■ NIST AI RMF 60%
-    ✓ [NIST-MAP-001] MAP function — AI actions documented (AILOG)
-    ✓ [NIST-MEASURE-001] MEASURE function — Test plans exist (TES)
-    ✓ [NIST-MANAGE-001] MANAGE function — Risk management documented (ETH + INC)
-    ✓ [NIST-GOVERN-001] GOVERN function — Governance policy and decisions documented
     ~ [NIST-GENAI-001] GenAI risk coverage — NIST AI 600-1 (4/12 categories)
 
   Overall compliance: 78%
 
-$ devtrail compliance --standard eu-ai-act --output json
-[{"standard":"EuAiAct","checks":[...],"score":75.0}]
+# Run only the six Chinese frameworks (requires regional_scope: china)
+$ devtrail compliance --region china
+  ■ China TC260 v2.0 67%
+    ✓ [TC260-001] At least one TC260 Risk Assessment (TC260RA) is present
+    ~ [TC260-002] High / very-high / extremely-severe TC260 levels mandate review
+    ✗ [TC260-003] TC260RA documents specify scenario × intelligence × scale
+
+  ■ China PIPL 100%
+    ✓ [PIPL-001] PIPIA exists when pipl_applicable is true
+    ✓ [PIPL-002] Documents handling sensitive personal info link to a PIPIA
+    ✓ [PIPL-003] Cross-border personal info transfer is documented in a PIPIA
+    ✓ [PIPL-004] PIPIA retention is ≥ 3 years per PIPL Art. 56
+
+  ■ China GB 45438 ...
+  ■ China CAC Algorithm Filing ...
+  ■ China GB/T 45652 ...
+  ■ China CSL 2026 ...
+
+# A single Chinese framework
+$ devtrail compliance --standard china-pipl --output json
+[{"standard":"ChinaPipl","standard_label":"China PIPL","checks":[...],"score":100.0}]
+
+# Force every standard, ignoring regional_scope
+$ devtrail compliance --all
 ```
 
+> **Activation note**: Chinese frameworks evaluate only when you opt in. Add to `.devtrail/config.yml`:
+>
+> ```yaml
+> regional_scope:
+>   - global
+>   - eu
+>   - china
+> ```
+>
+> Use `--standard china-*` or `--region china` to run them ad-hoc even when not in scope. See the `CHINA-REGULATORY-FRAMEWORK.md` guide installed under `.devtrail/00-governance/`.
+
 ---
 
 ### `devtrail metrics [path] [--period <period>] [--output <format>]`

docs/adopters/WORKFLOWS.md

@@ -157,6 +157,67 @@ When multiple team members use AI assistants on the same project:
 
 ---
 
+## China Regulatory Workflow *(opt-in)*
+
+If your project operates in mainland China or processes personal information of mainland China users, enable the China scope and follow this workflow.
+
+### One-time Setup
+
+1. Edit `.devtrail/config.yml` and add `china` to `regional_scope`:
+   ```yaml
+   regional_scope:
+     - global
+     - eu      # if also EU-subject
+     - china
+   ```
+2. Run `devtrail compliance --region china` to see the baseline (all checks will fail until you create the supporting documents).
+3. Read the guides installed under `.devtrail/00-governance/`:
+   - `CHINA-REGULATORY-FRAMEWORK.md` — overview and coverage matrix
+   - `TC260-IMPLEMENTATION-GUIDE.md` — five-level risk grading
+   - `PIPL-PIPIA-GUIDE.md` — when a PIPIA is required and what it must contain
+   - `CAC-FILING-GUIDE.md` — single vs dual filing, status lifecycle
+   - `GB-45438-LABELING-GUIDE.md` — explicit + implicit labeling design
+
+### When You Add a Generative AI Model
+
+Bundle of documents to create together (cross-linked via `related:`):
+
+| Document | Purpose | Required when |
+|----------|---------|---------------|
+| `MCARD` | Model card with `cac_filing_required`, `gb45438_applicable`, `tc260_risk_level` | Always for in-scope models |
+| `TC260RA` | Risk grading (scenario × intelligence × scale → 5 levels) | Always |
+| `AILABEL` | Explicit + implicit labeling per GB 45438 | When the model generates content |
+| `CACFILE` | Algorithm filing record | When `cac_filing_required: true` |
+| `PIPIA` | Personal-info impact assessment (Art. 55-56) | When personal info is processed |
+| `SBOM` | Training-data inventory + GB/T 45652 compliance | Always |
+
+`devtrail compliance --region china` confirms the bundle is complete.
+
+### When an Incident Occurs
+
+The `INC` template includes a *CSL 2026 Incident Reporting* section. Set:
+
+```yaml
+csl_severity_level: relatively_major   # or particularly_serious | major | general
+csl_report_deadline_hours: 4           # 1 for particularly_serious, 4 for relatively_major
+```
+
+`devtrail validate` enforces severity-to-deadline coherence (`CROSS-008`, `CROSS-009`). Major+ incidents must be closed (status `accepted`) within 30 days for the `CSL-003` check to pass.
+
+### Cross-Border Data Transfer
+
+When a process involves transferring personal information out of mainland China, set `pipl_cross_border_transfer: true` on the PIPIA and document the chosen mechanism (CAC security assessment / certification / standard contract) in the *Cross-Border Transfer Analysis* section. `CROSS-011` will warn if none is documented.
+
+### Daily Compliance Check
+
+```bash
+# Before merging a feature branch that touches AI services
+devtrail validate                    # cross-rules including CROSS-004..011
+devtrail compliance --region china   # per-framework score
+```
+
+---
+
 ## Understanding Versions
 
 DevTrail uses **independent versioning** for its two components:

docs/i18n/es/adopters/ADOPTION-GUIDE.md

@@ -159,6 +159,19 @@ DevTrail se alinea con y soporta cumplimiento para:
 | **NIST AI RMF** | Documentación de riesgos en registros de decisión |
 | **IEEE 7000** | Consideraciones éticas en documentos ETH |
 
+### Cobertura Regulatoria China *(opt-in vía `regional_scope: china`)*
+
+| Estándar | Cómo Ayuda DevTrail |
+|----------|---------------------|
+| **TC260 AI Safety Governance Framework v2.0** | Clasificación de riesgo en 5 niveles (TC260RA), campos `tc260_*` en ETH/MCARD/AILOG/SEC |
+| **PIPL — Personal Information Protection Law** | Plantilla PIPIA con secciones del Art. 55-56, campos `pipl_*`, retención ≥ 3 años (`TYPE-003`) |
+| **GB 45438-2025** *(obligatorio)* | Plantilla AILABEL cubriendo etiquetado explícito + implícito para contenido generativo |
+| **CAC Algorithm Filing** | Plantilla CACFILE con seguimiento de registro simple + dual; cross-checks desde MCARD vía `cac_filing_required` |
+| **GB/T 45652-2025** | Sección de seguridad de datos de entrenamiento en SBOM y MCARD; campo `gb45652_training_data_compliance` |
+| **CSL 2026** | Extensión de INC con `csl_severity_level`, reglas de coherencia de plazos (ventanas 1h / 4h+72h+30d) |
+
+> Activar añadiendo `china` a `regional_scope` en `.devtrail/config.yml`. Ver la sección *Configuración* abajo y la guía instalada `CHINA-REGULATORY-FRAMEWORK.md` para detalles.
+
 ---
 
 ## Ruta de Adopción A: Proyectos Nuevos
@@ -346,6 +359,28 @@ El CLI automáticamente:
 
 ## Configuración
 
+### Alcance Regulatorio Regional
+
+`.devtrail/config.yml` controla qué frameworks de cumplimiento evalúa `devtrail compliance` y qué tipos de documento expone `devtrail new`:
+
+```yaml
+regional_scope:
+  - global   # NIST AI RMF + ISO/IEC 42001 (siempre recomendado)
+  - eu       # EU AI Act + GDPR
+  - china    # TC260 v2.0, PIPL/PIPIA, GB 45438, CAC, GB/T 45652, CSL 2026
+```
+
+**Default si se omite**: `[global, eu]` — preserva el comportamiento de toda versión de DevTrail anterior a `fw-4.3.0`.
+
+Cuando añades `china` a la lista:
+
+- Cuatro tipos de documento específicos de China están disponibles vía `devtrail new`: `PIPIA`, `CACFILE`, `TC260RA`, `AILABEL`.
+- Seis nuevos checkers de cumplimiento se ejecutan con `devtrail compliance` (o vía `--region china` / `--standard china-*`).
+- Doce reglas de validación scope-aware se activan (`CROSS-004` a `CROSS-011`, `TYPE-003` a `TYPE-006`).
+- Cinco nuevas guías de gobernanza referenciadas desde `.devtrail/00-governance/` (`CHINA-REGULATORY-FRAMEWORK.md`, más guías por framework para TC260, PIPL/PIPIA, registro CAC, y etiquetado GB 45438) — todas disponibles en EN, ES y zh-CN.
+
+Un proyecto sin `china` en `regional_scope` no se ve afectado: ningún archivo nuevo, ningún prompt nuevo, ninguna regla nueva. Añadir `china` después es totalmente reversible.
+
 ### Personalizar Identificadores de Agente
 
 Cada plataforma de IA tiene su propio archivo de configuración que:

docs/i18n/es/adopters/CLI-REFERENCE.md

@@ -278,6 +278,8 @@ Valida documentos DevTrail verificando cumplimiento y corrección.
 - `SEC-001`: No contiene información sensible
 - `OBS-001`: Tag observabilidad requiere sección de alcance
 
+Cuando `regional_scope` incluye `china`, se activan doce reglas adicionales (`CROSS-004` a `CROSS-011`, `TYPE-003` a `TYPE-006`) que cubren escalado de revisión TC260, vínculo PIPIA desde documentos con datos sensibles, cross-references de CACFILE / AILABEL, coherencia severidad-deadline CSL, y retención de 3 años de PIPIA. Sin `china` en scope, estas reglas se omiten — sin falsos positivos.
+
 **Código de salida:** 0 si no hay errores (warnings OK), 1 si hay errores.
 
 ---
@@ -291,10 +293,10 @@ Crea un nuevo documento DevTrail a partir de una plantilla.
 | Argumento/Flag | Default | Descripción |
 |----------------|---------|-------------|
 | `path` | `.` (directorio actual) | Directorio del proyecto |
-| `--doc-type`, `-t` | — | Tipo de documento: `ailog`, `aidec`, `adr`, `eth`, `req`, `tes`, `inc`, `tde`, `sec`, `mcard`, `sbom`, `dpia` |
+| `--doc-type`, `-t` | — | Tipo de documento. Core (12): `ailog`, `aidec`, `adr`, `eth`, `req`, `tes`, `inc`, `tde`, `sec`, `mcard`, `sbom`, `dpia`. China (4, opt-in): `pipia`, `cacfile`, `tc260ra`, `ailabel`. |
 | `--title` | — | Título del documento |
 
-Si no se especifica `--doc-type` o `--title`, se solicitan de forma interactiva.
+Si no se especifica `--doc-type` o `--title`, se solicitan de forma interactiva. Los tipos chinos se filtran del prompt (y se rechazan en `-t`) cuando `regional_scope` no incluye `china`.
 
 **Ejemplos:**
 
@@ -323,20 +325,55 @@ $ devtrail new -t ailog --title "Refactorizar módulo de pagos"
 
 ---
 
-### `devtrail compliance [path] [--standard <nombre>] [--all] [--output <formato>]`
+### `devtrail compliance [path] [--standard <nombre>] [--region <nombre>] [--all] [--output <formato>]`
 
-Verifica cumplimiento regulatorio contra EU AI Act, ISO/IEC 42001 y NIST AI RMF.
+Verifica cumplimiento regulatorio. Por defecto evalúa los estándares cuya región esté incluida en `regional_scope` de `.devtrail/config.yml` (default `[global, eu]`). Seis frameworks chinos disponibles opt-in cuando `china` se añade a `regional_scope`.
 
 **Argumentos y flags:**
 
 | Argumento/Flag | Default | Descripción |
 |----------------|---------|-------------|
 | `path` | `.` (directorio actual) | Directorio del proyecto |
-| `--standard` | — | Verificar estándar específico: `eu-ai-act`, `iso-42001`, o `nist-ai-rmf` |
-| `--all` | — | Verificar los tres estándares |
+| `--standard` | — | Verificar estándar específico: `eu-ai-act`, `iso-42001`, `nist-ai-rmf`, `china-tc260`, `china-pipl`, `china-gb45438`, `china-cac`, `china-gb45652`, `china-csl` |
+| `--region` | — | Ejecutar todos los estándares de una región: `global`, `eu`, `china`, o `all` |
+| `--all` | — | Verificar todos los estándares (ignora `regional_scope`) |
 | `--output` | `text` | Formato de salida: `text`, `markdown`, o `json` |
 
-Si no se especifica `--standard` ni `--all`, por defecto ejecuta `--all`.
+Precedencia: `--standard` > `--all` > `--region` > el `regional_scope` del proyecto.
+
+**Estándares chinos (opt-in vía `regional_scope: china`):**
+
+- **TC260 v2.0**: existe TC260RA; niveles altos requieren review; los tres criterios (escenario × inteligencia × escala) están completos
+- **PIPL**: PIPIA cuando `pipl_applicable: true`; transferencia transfronteriza documentada; retención ≥ 3 años (Art. 56)
+- **GB 45438**: AILABEL para contenido generativo; estrategia explícita + implícita declaradas; campos de metadata mandatorios
+- **CAC**: CACFILE cuando es requerido; `cac_filing_status` explícito; `cac_filing_number` cuando el estado es `*_approved`
+- **GB/T 45652**: SBOM y MCARD declaran cumplimiento de seguridad de datos de entrenamiento
+- **CSL 2026**: cada INC con `csl_severity_level`; horas coherentes con severidad (1h ↔ particularly_serious, 4h ↔ relatively_major); post-mortem 30 días para incidentes major+
+
+**Ejemplos:**
+
+```bash
+# Default: solo estándares cuya región esté en regional_scope
+$ devtrail compliance
+
+# Los seis frameworks chinos (requiere regional_scope: china)
+$ devtrail compliance --region china
+
+# Un solo framework chino
+$ devtrail compliance --standard china-pipl --output json
+
+# Todos los estándares ignorando regional_scope
+$ devtrail compliance --all
+```
+
+> **Activación**: para evaluar los frameworks chinos automáticamente, añadir a `.devtrail/config.yml`:
+>
+> ```yaml
+> regional_scope:
+>   - global
+>   - eu
+>   - china
+> ```
 
 ---