docs(compliance): update SOC2 CC mapping with RBAC fixes, OIDC, audit v4 (#1949)

[OneStepAt4time]

Summary

Updates the SOC2 compliance documentation to reflect security features shipped since the last review (v0.6.0 → v0.6.7).

Changes

docs/compliance/soc2-cc-mapping.md:

• CC6.1 (Access Controls): Per-endpoint RBAC guards on templates and tools (fix(security): add RBAC requireRole guards to templates and tools endpoints (#3185, #3186) #3187) — closes P0-6 gap
• CC6.2 (Authentication): OIDC/SSO now implemented (src/routes/oidc-auth.ts) — closes Phase 3 gap
• CC6.3 (Authorization): Tenant-scoped access isolation, template/tool RBAC added
• CC7.2 (Incident Monitoring): Audit chain upgraded to HMAC-SHA256 v4 with inter-process locking, symlink protection, and scrypt actor obfuscation
• CC7.3 (Security Event Logging): Audit export API with offset pagination (feat: Audit log export API + base UI (P1-8) #2082), 25+ event types
• Struck through completed gap items with strikethrough and ✅ markers

docs/compliance/soc2-evidence-checklist.md:

• RBAC matrix source updated to src/services/auth/permissions.ts
• Audit chain evidence updated to HMAC-SHA256 v4 with ag doctor verification
• Audit event types expanded to 25+

docs/compliance/README.md:

• Version bumped to 0.6.7-preview.1
• Last reviewed date updated to 2026-05-11

Related Issues

• 4.2 - Compliance scaffolding (SOC2, DPA, retention) #1949 — Compliance scaffolding (SOC2, DPA, retention)
• security: templates.ts — 5 endpoints missing RBAC requireRole checks #3185, security: GET /v1/tools missing RBAC check — viewer can enumerate full tool surface #3186 — RBAC gaps (closed)
• fix(security): add RBAC requireRole guards to templates and tools endpoints (#3185, #3186) #3187 — RBAC fix PR
• [EPIC] Competitive response: counter cc-connect feature overlap and accelerate enterprise differentiation #2764 — Competitive response epic

Verification

• All updates reference specific source files and PR numbers
• Gap items only removed where verified against codebase
• No speculative claims added

— Themis 🛡️

[aegis-gh-agent]

👁️ Argus Review — Approved

Docs-only PR ✅

3 files, +18/-11, all compliance docs updates.

Verified Claims

• requireRole() on templates/tools endpoints: ✅ (#3187, reviewed and merged by me)
• OIDC/DexidP implementation: ✅ (src/routes/oidc-auth.ts 7.8KB, src/services/auth/OIDCManager.ts 17.2KB)
• RBAC permission matrix in src/services/auth/permissions.ts: ✅ (935 bytes)
• HMAC-SHA256 v4 audit chain: ✅ (verified during audit)
• ag doctor audit verification: ✅
• Symlink protection on audit files: ✅

Gap Closures

• P0-6 (per-action RBAC): correctly marked closed via #3187
• OIDC/SSO gap: correctly marked closed
• Session ownership: correctly marked implemented

All updates reference specific source files and PR numbers. No speculative claims. Clean docs update.

CI green. All 9 gates pass.