feat(KI-10): compliance pack scaffold + baseline re-scan (KI-103)

feat(KI-10): compliance pack scaffold + baseline re-scan #103

Merged

syntropicagent opened 3 weeks ago

KI-10 — Operational and Data Compliance (v1.1-hardening)

Status: DRAFT — scaffolding only. Baseline re-scan confirms the gap; ISMS docs next.

What this PR does now

Adds docs/compliance/ pack: README.md + baseline-rescan-2026-08.md
Re-scans 15 compliance areas on v1.0.0 (main @ c92e2ff)

Baseline verdict (unchanged from original assessment)

Framework	Readiness
SOC 2 Type I	~70% — strong technical controls, missing policy docs
ISO 27001:2022	~55% — good controls, missing ISMS documentation

Technical controls verified present: SOPS secrets, gateway auth (12 tests), event/scheduler durability, checksummed migrations, nightly verified backup, carbon-credit custody, EAS attestation integrity, CI supply-chain scanning (pip-audit/semgrep/slither).

Gap this branch closes (next commits)

Formal ISMS policy (isms-policy.md)
Consolidated risk register (risk-register.md)
Access-control matrix + data residency/retention (data-handling.md) — prereq for KI-8
Control mapping SOC2 CC / ISO 27001 A.5–A.8 (control-mapping.md) — prereq for KI-11
Evidence collection wired into scripts/verify-platform.sh

Out of scope

No new infrastructure, no schema changes
SOC 2 Type II 6–12mo observation window = explicit follow-up (not blockable here)

CI

Will run on push. Note: test_migration.py needs the SOPS age key (host-only) and is expected to pass in CI/staging, not local.

Refs KI-10 · iteration v1.1-hardening

Copy

Commits were merged into target branch

docs(compliance): scaffold KI-10 compliance pack + baseline re-scan

- Add docs/compliance/ with README + baseline-rescan-2026-08 (confirms
  SOC2 ~70% / ISO27001 ~55% on v1.0.0, unchanged from original assessment)
- Baseline scan of 15 areas: technical controls strong, ISMS/policy layer
  missing (the actual gap this branch closes)
- No infra or schema changes; sets up evidence + control-mapping work that
  KI-11 (MiCA) and KI-8 (Replicas) will consume

Refs KI-10 (iteration v1.1-hardening)

3 weeks ago

68d9f1dc

syntropicagent commented 3 weeks ago

Draft PR for KI-10. Branch feat/ki10-compliance-hardening — scaffolding + baseline re-scan committed; ISMS docs incoming. Issue KI-10 now in progress under iteration v1.1-hardening.

Copy 👀 1

docs(compliance): add ISMS policy (KI-10 )

Formal information security management system policy anchoring KI to
ISO 27001:2022 domains A.5-A.8. Establishes CIA objectives, roles, access
control, crypto, incident, backup posture. Closes R-07 (missing ISMS docs).

3 weeks ago

13209715

docs(compliance): add consolidated risk register (KI-10 )

10 risks scored LxI from crisp-risk-scoring/risk-mitigation + re-scan.
Treatment strategy + quarterly review cadence. Feeds KI-8/KI-11 scoping.

3 weeks ago

b1e36204

docs(compliance): add data classification, retention, residency (KI-10 )

Classification tiers, retention schedule, and residency rule that KI-8
(Distributed Replicas) MUST honor before sharding by location_id. GDPR
Art.17 erasure cascade defined.

3 weeks ago

91f41aa5

docs(compliance): map controls to SOC 2 CC + ISO 27001 A.5-A.8 (KI-10 )

Traceability matrix for auditors. Flags A.8.14 redundancy as KI-8-dependent.
Crypto-asset controls (KokonutCreditToken) handed off to KI-11 (MiCA).

3 weeks ago

765fba19

chore(compliance): emit evidence from verify-platform.sh (KI-10 )

verify-platform.sh now writes docs/compliance/evidence/verify-<date>.json
with 14 control-presence checks. Reproducible readiness instead of asserted.
No infra/schema change.

3 weeks ago

a230364c

syntropicagent merged 2 weeks ago (merge commit: 1d431cb4 )
Login to comment

Submitter	syntropicagent
Target	main
Source	feat/ki10-compliance-hardening

Jobs

Merge Strategy

Create Merge Commit

Watchers (1)

Reference

pr KI-103