Skip to content

WIP: docs(compliance): refresh stale risk register, SoA and SOC 2 ratings (#324) - #3682

Draft
olafkfreund wants to merge 14 commits into
mainfrom
docs/324-compliance-records-refresh
Draft

olafkfreund wants to merge 14 commits into
mainfrom
docs/324-compliance-records-refresh

Conversation

@olafkfreund

@olafkfreund olafkfreund commented Nov 7, 2026 •

Copy link
Copy Markdown
Owner

WIP: follow-up to #324 (PR #3678) under #310. This refreshes the stale compliance records against live evidence measured on 2026-11-07: read-only kubectl on p620, origin/main of the repos, and the gh API.

The user approved all three documents unseen on 2026-11-07, in bulk run wave 2. Each draft was reviewed by codex and agy, and the findings I confirmed were fixed before approval.

Status (stopped at the user's deadline)

Step File Implementer State
1 risk-register.md coder (Sonnet subagent) done
2 statement-of-applicability.md agy (handoff) done: totals 54 Implemented / 8 Partial / 14 Planned / 17 N/A
3 control-matrix.md, dr-runbook.md coder (lead fixed two evidence labels) done
4 soc2-gap-assessment.md codex (handoff; agent-run said "HEAD moved", caused by the lead committing step 3 mid-run) done: 0 Met / 27 Partial / 11 Gap; A1.3, CC7.5, CC7.2 Gap -> Partial
5 verification lead step 4 verifies pass; final fresh-Opus review and codex/agy diff review NOT run (stopped at deadline)

Register rows re-measured (current score on 2026-11-07)

Row Was Now Status
R-001 15 10 In progress, tracked in #3681
R-006 12 6 In progress; no 13-month ILM floor
R-007 text only text only —
R-008 12 8 In progress, tracked in #3665
R-009 16 12 In progress; no paging and no tabletop yet
R-011 9 3 Mitigated
R-013 8 8 Open; kid support exists but is unused live

The intent was edited after approval in commit 6a811eb, which added control-matrix.md to the affected files. That came from an agy finding on the spec. I'm flagging it for review.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1

olafkfreund and others added 14 commits November 7, 2026 15:28
…ds-refresh (#324)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
Approved unseen by user 2026-11-07, bulk run wave 2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
…-records-refresh (#324)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
Approved unseen by user 2026-11-07, bulk run wave 2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
Approved unseen by user 2026-11-07, bulk run wave 2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
R-001, R-006, R-007, R-008, R-009, R-011, R-013 re-measured 2026-11-07
against the live cluster, origin/main and gh. Implemented by the coder subagent.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
…(plan step 2) (#324)

A.5.29, A.5.30, A.8.13, A.8.16 Planned -> Partial; text refreshed on A.5.33,
A.8.8, A.8.10, A.8.14, A.8.15. Totals 54/8/14/17. Implemented by agy (handoff).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
…#324)

BC/DR matrix row Gap -> Partial; runbook trackers point at Factory#3681.
Implemented by the coder subagent; lead replaced two evidence labels with citations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
…atrix (plan step 3) (#324)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
…n step 4) (#324)

A1.3, CC7.5, CC7.2 Gap -> Partial; CC9.1, A1.2, CC7.3 stay Gap (ceiling).
Totals 0 Met / 27 Partial / 11 Gap. Implemented by codex (handoff); agent-run
reported 'HEAD moved' because the lead committed step 3 during the run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant