wehub-resource-sync
26382a7ac6
CI / Clippy (push) Failing after 15m13s
CI / Test (ubuntu-latest) (push) Failing after 16m1s
CI / Test (macos-latest) (push) Has been cancelled
CI / Test (windows-latest) (push) Has been cancelled
CI / Build (no embeddings / no ORT) (push) Has been cancelled
CI / Format (push) Has been cancelled
CI / Cookbook (Node) (push) Has been cancelled
CI / Pi Extension (Node) (push) Has been cancelled
CI / Rust SDK (lean-ctx-client) (push) Has been cancelled
CI / Embed SDK (lean-ctx-sdk) (push) Has been cancelled
CI / Python SDK (leanctx) (push) Has been cancelled
CI / Hermes Plugin (Python) (push) Has been cancelled
CI / SDK Conformance Matrix (push) Has been cancelled
CI / Coverage (push) Has been cancelled
CI / cargo-deny (push) Has been cancelled
CI / Adversarial Safety (push) Has been cancelled
CI / Benchmarks (push) Has been cancelled
CI / Output-Quality Gate (eval A/B) (push) Has been cancelled
CI / Documentation (push) Has been cancelled
CI / CI Green (push) Has been cancelled
JetBrains Plugin / Actionlint (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript-typescript) (push) Has been cancelled
CodeQL / Analyze (rust) (push) Has been cancelled
JetBrains Plugin / Validation (push) Has been cancelled
JetBrains Plugin / Build (push) Has been cancelled
JetBrains Plugin / Test (push) Has been cancelled
Security Check / Security Scan (push) Has been cancelled
86 lines
3.7 KiB
TOML
86 lines
3.7 KiB
TOML
# SOC 2 (Trust Services Criteria) → LeanCTX mapping matrix (GL #424, H3 Epic A).
|
|
#
|
|
# Scope: TSC criteria where the context pipeline is in the audit boundary —
|
|
# logical access to the pipeline's capabilities, monitoring of its
|
|
# operation, confidentiality of what flows through it. Entity-level
|
|
# criteria (governance, risk assessment, HR) are out of scope.
|
|
|
|
framework = "soc2"
|
|
title = "SOC 2 — AICPA Trust Services Criteria (2017, revised 2022 points of focus)"
|
|
version_pin = "TSC 2017 incl. 2022 revised points of focus"
|
|
pinned_on = "2026-06-11"
|
|
review_cycle_months = 6
|
|
disclaimer = "LeanCTX is tooling support for compliance work — not legal advice. A SOC 2 report covers an organisation's controls as a whole; LeanCTX provides enforceable controls and evidence for the context-pipeline slice."
|
|
reference_pack = "soc2-context"
|
|
|
|
[[controls]]
|
|
id = "SOC2-CC6.1"
|
|
clause = "CC6.1"
|
|
requirement = "Logical access security: access to protected resources is restricted to authorized users"
|
|
mechanism = "pack_rule"
|
|
leanctx = "Role-based capability gate (default-deny) over every tool invocation; pack allow/deny_tools narrow the surface further"
|
|
evidence = "capability check results + denied-call audit entries"
|
|
coverage = "full"
|
|
test = "soc2_cc61_default_deny_capability_gate"
|
|
|
|
[[controls]]
|
|
id = "SOC2-CC6.6"
|
|
clause = "CC6.6"
|
|
requirement = "Boundaries of the system are protected against external threats"
|
|
mechanism = "pack_rule"
|
|
leanctx = "Network egress tools deniable by pack (deny_tools); path jail keeps reads inside the project boundary, violations audited"
|
|
evidence = "pack deny list + path_jail_violation audit entries"
|
|
coverage = "full"
|
|
test = "soc2_cc66_egress_deniable_and_path_jailed"
|
|
|
|
[[controls]]
|
|
id = "SOC2-CC7.2"
|
|
clause = "CC7.2"
|
|
requirement = "System operations are monitored to detect anomalies and security events"
|
|
mechanism = "audit_event"
|
|
leanctx = "Typed security events (security_violation, secret_detected, rate_limited, budget_exceeded) recorded in the tamper-evident trail and exported as governance events"
|
|
evidence = "audit entries by event_type + OCP event stream"
|
|
coverage = "full"
|
|
test = "soc2_cc72_security_events_are_typed_and_recorded"
|
|
|
|
[[controls]]
|
|
id = "SOC2-CC7.1"
|
|
clause = "CC7.1"
|
|
requirement = "Configuration changes and vulnerabilities are identified"
|
|
mechanism = "audit_event"
|
|
leanctx = "Role changes are first-class audit events (role_changed); policy packs are versioned files whose changes are git diffs"
|
|
evidence = "role_changed entries + pack version history"
|
|
coverage = "partial"
|
|
gap = "Vulnerability management of the host system is outside the pipeline boundary"
|
|
test = "soc2_cc71_role_changes_are_audited"
|
|
|
|
[[controls]]
|
|
id = "SOC2-C1.1"
|
|
clause = "C1.1 (Confidentiality)"
|
|
requirement = "Confidential information is identified and protected"
|
|
mechanism = "pack_rule"
|
|
leanctx = "Named redaction patterns (credentials + regulated identifiers) strip confidential material before it enters model context"
|
|
evidence = "redaction fixtures matched by resolved patterns in CI"
|
|
coverage = "full"
|
|
test = "soc2_c11_confidential_material_redacted"
|
|
|
|
[[controls]]
|
|
id = "SOC2-CC8.1"
|
|
clause = "CC8.1"
|
|
requirement = "Changes to infrastructure and software are authorized, tested and approved"
|
|
mechanism = "none"
|
|
leanctx = "Change management is an organisational process; pack changes being git-reviewable supports it but approval workflows live in the VCS"
|
|
evidence = "n/a"
|
|
coverage = "none"
|
|
gap = "Use VCS branch protection + review rules for pack changes"
|
|
|
|
[[controls]]
|
|
id = "SOC2-A1.2"
|
|
clause = "A1.2 (Availability)"
|
|
requirement = "Environmental protections, backup and recovery are in place"
|
|
mechanism = "none"
|
|
leanctx = "Availability of the host environment is out of scope for a context pipeline"
|
|
evidence = "n/a"
|
|
coverage = "none"
|
|
gap = "Host/platform responsibility"
|