docs(compliance): update SOC2 CC mapping with RBAC fixes, OIDC, audit v4 (#1949) (#3205)

- Update CC6.1: per-endpoint RBAC guards (templates, tools) — #3187
- Update CC6.2: OIDC/SSO now implemented — close Phase 3 gap
- Update CC6.3: tenant-scoped access, template/tool RBAC added
- Update CC7.2: audit chain upgraded to HMAC-SHA256 v4 with
  inter-process locking and symlink protection
- Update CC7.3: audit export API with offset pagination (#2082)
- Update evidence checklist: RBAC matrix, audit chain, event types
- Bump version reference to 0.6.7-preview.1

Security sign-off: Themis 🛡️
Refs: #1949, #3185, #3186, #3187

Author: OneStepAt4time

docs/compliance/README.md

@@ -2,7 +2,7 @@
 
 > **Status:** Pre-compliance (Phase 4 — Enterprise GA, not yet active)
 >
-> **Last reviewed:** 2026-05-08 | **Aegis version:** 0.6.0-preview
+> **Last reviewed:** 2026-05-11 | **Aegis version:** 0.6.7-preview.1
 
 This directory contains Aegis's compliance documentation, organized for SOC 2 Type II audit preparation, GDPR adherence, and enterprise security reviews.
 

docs/compliance/soc2-cc-mapping.md

@@ -20,12 +20,13 @@ Security is the **required** Trust Services category for SOC 2. The Common Crite
 | Master token + per-key roles (admin / operator / viewer) | `src/routes/auth.ts` — role-based permission policies | ✅ Implemented |
 | Per-key permissions and quotas | `src/config.ts` — `ApiKeyPermissions`, quota enforcement middleware | ✅ Implemented |
 | Timing-safe token comparison | `src/routes/auth.ts` — `crypto.timingSafeEqual()` | ✅ Implemented |
-| Session ownership enforcement | `enforceSessionOwnership: true` default; `src/routes/sessions.ts` — ownership checks | ⚠️ Partial — per-action RBAC not yet granular (P0-6) |
+| Session ownership enforcement | `enforceSessionOwnership: true` default; `src/routes/sessions.ts` — ownership checks | ✅ Implemented (CC6.3 also covers) |
+| Per-endpoint RBAC guards | `requireRole()` on all route handlers including templates and tools (#3187) | ✅ Implemented |
 | Dashboard authentication | `dashboard/src/` — login gate, token persistence | ✅ Implemented |
 
 **Gap Actions:**
-- Implement per-action RBAC (P0-6)
-- Complete session ownership enforcement for all session operations (P0-1)
+- ~~Implement per-action RBAC (P0-6)~~ ✅ Closed — #3187 added `requireRole()` to all endpoints
+- ~~Complete session ownership enforcement for all session operations (P0-1)~~ ✅ Closed
 
 ### CC6.2 — Authentication
 
@@ -39,7 +40,7 @@ Security is the **required** Trust Services category for SOC 2. The Common Crite
 | SSE tokens: 60s TTL, single-use, max 5 per key | `src/routes/sessions.ts` — SSE endpoint | ✅ Implemented |
 
 **Gap Actions:**
-- Add SSO / OIDC support (Phase 3)
+- ~~Add SSO / OIDC support (Phase 3)~~ ✅ Closed — OIDC/DexidP implemented (`src/routes/oidc-auth.ts`, `src/services/auth/OIDCManager.ts`)
 - Implement MFA for dashboard access
 - Add mandatory API key expiry and rotation policies
 
@@ -52,9 +53,12 @@ Security is the **required** Trust Services category for SOC 2. The Common Crite
 | Three roles with permission policies | `src/config.ts` — `admin`, `operator`, `viewer` | ✅ Implemented |
 | Session ownership enforcement (default on) | `enforceSessionOwnership: true` | ✅ Implemented |
 | Metrics endpoint gated by dedicated token | `src/routes/metrics.ts` — metrics auth | ✅ Implemented |
+| Tenant-scoped access isolation | `src/routes/context.ts` — tenant-scoped session/audit queries | ✅ Implemented |
+| Template RBAC guards (CUD=admin+operator, R=all) | `src/routes/templates.ts` — #3187 | ✅ Implemented |
+| Tool enumeration RBAC (auth required) | `src/routes/session-data.ts` — #3187 | ✅ Implemented |
 
 **Gap Actions:**
-- Implement per-action RBAC granularity (P0-6)
+- ~~Implement per-action RBAC granularity (P0-6)~~ ✅ Closed — all endpoints now have `requireRole()` guards (#3187)
 - Add attribute-based access control (ABAC) for enterprise tier
 
 ### CC6.6 — Network Security
@@ -127,7 +131,9 @@ Security is the **required** Trust Services category for SOC 2. The Common Crite
 
 | Aegis Feature | Evidence | Status |
 |---------------|----------|--------|
-| Tamper-evident audit chain (SHA-256, daily rotation) | `src/audit.ts` — chained audit logger | ✅ Implemented |
+| Tamper-evident audit chain (HMAC-SHA256 v4, daily rotation) | `src/audit.ts` — chained audit logger with inter-process locking | ✅ Implemented |
+| Audit chain verification (`ag doctor`) | `src/audit.ts` — `verify()` method supports v1–v4 records | ✅ Implemented |
+| Symlink attack prevention on audit files | `src/audit.ts` — `assertNotSymlink()` on all read/write paths | ✅ Implemented |
 | Structured JSON logging with token redaction | `src/logger.ts` — serializers | ✅ Implemented |
 | Stall detection + dead session diagnostics | `src/sessionManager.ts` — health checks | ✅ Implemented |
 | Alert webhooks for session failures | `src/` — webhook alert system | ✅ Implemented |
@@ -145,8 +151,9 @@ Security is the **required** Trust Services category for SOC 2. The Common Crite
 | Aegis Feature | Evidence | Status |
 |---------------|----------|--------|
 | Audit logger: key CRUD, quota changes, authenticated calls | `src/audit.ts` — event types | ✅ Implemented |
-| SHA-256 chained daily audit files | `src/audit.ts` — chain integrity | ✅ Implemented |
+| HMAC-SHA256 chained daily audit files (v4) | `src/audit.ts` — chain integrity with scrypt actor obfuscation | ✅ Implemented |
 | Token and secret redaction in all log serializers | `src/logger.ts` — redaction rules | ✅ Implemented |
+| Audit log export with offset pagination (#2082) | `src/audit.ts` — `queryWithOffset()` API | ✅ Implemented |
 
 **Gap Actions:**
 - Add SIEM integration guide

docs/compliance/soc2-evidence-checklist.md

@@ -15,7 +15,7 @@
 | 1.1 | API key inventory (hashes, roles, creation dates) | `{stateDir}/keys.json` | Scripted export | Per audit | ✅ Available |
 | 1.2 | Key creation / revocation / rotation events | `{stateDir}/audit/YYYY-MM-DD.jsonl` | Audit log query | Continuous | ✅ Available |
 | 1.3 | Session ownership enforcement config | `aegis.config.ts` — `enforceSessionOwnership` | Config snapshot | Per audit | ✅ Available |
-| 1.4 | RBAC permission matrix | `src/config.ts` — role definitions | Code review | Per release | ✅ Available |
+| 1.4 | RBAC permission matrix | `src/services/auth/permissions.ts` — role definitions; `requireRole()` on all routes | Code review | Per release | ✅ Available |
 | 1.5 | Dashboard auth configuration | Dashboard login flow test | Manual / automated test | Per release | ✅ Available |
 
 ### 2. Authentication Evidence
@@ -41,8 +41,8 @@
 
 | # | Evidence | Source | Collection Method | Frequency | Status |
 |---|----------|--------|-------------------|-----------|--------|
-| 4.1 | Audit log chain integrity proof | `{stateDir}/audit/` — SHA-256 chain | Integrity verification script | Per audit | ✅ Available |
-| 4.2 | Audit log coverage (event types) | `src/audit.ts` — event type enumeration | Code review | Per release | ✅ Available |
+| 4.1 | Audit log chain integrity proof | `{stateDir}/audit/` — HMAC-SHA256 v4 chain with inter-process locking | `ag doctor` verification | Per audit | ✅ Available |
+| 4.2 | Audit log coverage (event types) | `src/audit.ts` — 25+ event types across key, session, permission, driver, terminal, ACP | Code review | Per release | ✅ Available |
 | 4.3 | Token redaction verification | `src/logger.ts` — redaction rules | Test suite | Per release | ✅ Available |
 | 4.4 | Daily rotation verification | Audit file dates | Scripted check | Per audit | ✅ Available |