Refresh policies, risk register, boundary docs

Epic 5329 ask (verbatim): "Analyze current code, processes and documentation and close the gap to being SOC 2 compliant. Humans can participate but only where it cannot be avoided legally. Ask questions, but do not offload any work that you are technically able to do." Sources: PRD (Task 5330) and architecture (Task 5331) of epic 5329 — read them with `task_read` / `task_read_artifact` for full context. Target is **Type I readiness** (D2). Binding operator decisions (PRD §2, verbatim): "D1 ... Agents deliver everything to `develop` through PRs. Roman alone opens and merges develop→master promotion PRs and signs." "D5 AWS boundary: Prod is in the AWS Organization (account `jaah-main` 366008913850). Ground truth is code, terraform and live AWS reached through `jaah/system/bootstrap-admin`, not the old docs." "D7 Evidence collection: One-off check only." "D8 Paging destination: Slack + email." "D9 Legacy account 210352747749: Leave it, out of scope." "D10 Security Hub bar: Only HIGH/CRITICAL." AS2 (verbatim, the only legally unavoidable human acts): "signing (policy approvals, risk acceptances, attestations, confidentiality terms); contracting (auditor, pentest firm, any NDA); legal review of the public legal pages; the Security owner's personal participation where SOC 2 needs a named accountable person: management review, tabletop, training, and the endpoint self-check of his own phone and workstation; the promotion merge (D1)." Credentials: `jaah/system/bootstrap-admin` (read-only AWS checks via `OrganizationAccountAccessRole`, explicit `--region`); confirm with `task_credential_list` first (missing = BLOCKER ask). ## Requirement (verbatim from PRD) "### R1 ... **AC1.2** Every place that misstates the AWS boundary is corrected. This includes: `portfolio/projects/jaah.md` § AWS access; the system description; the checklist's "State on" paragraph. These docs must say prod is in `jaah-main` 366008913850, and must say the legacy account is outside the boundary and out of scope. *Verify:* `grep -rn 210352747749 docs/compliance portfolio/projects/jaah.md` shows the legacy account named only as "legacy, outside the boundary"." "### R8 — Policies, risk, review and assessment, prepared to the signature (CC1–CC5; OA-13, OA-14, OA-15, OA-24, G-31, G-32, G-38) - **AC8.1** Each of the twelve policies has been re-checked against live state. Every control row that says *in build* is either live with a path, or removed. Each policy is ready for approval: header complete, version bumped where a number changed. *Verify:* `grep -n "in build" docs/policies/{information-security,acceptable-use,access-control,risk-management,vendor-management,data-classification-retention,encryption-key-management,logging-monitoring,hr-security,asset-management,bc-dr,incident-response}.md` returns nothing, or each hit points at an open R-item in this epic. - **AC8.2** The risk register is refreshed against live findings: new rows for the gaps found here that this epic does not fix (legacy-account data D9, Security Hub MEDIUM/LOW D10, the evidence-automation gap D7); stale rows corrected." "### R9 ... **AC9.2** Background screening of a sole owner-founder is a risk-register row, with Roman's self-attestation as the compensating control." "### R7 ... **AC7.4** The standing `bootstrap-admin` AdministratorAccess key in the management account is handled one of two ways ... (b) it is recorded as a risk-register row with compensating controls, for Roman to sign. *Verify:* ... the register row exists." ## Scope and approach (from the settled architecture) Architecture A8 — this child is the SOLE writer of the twelve policies and of pinned risk rows `R-SOC-1..7` in this wave (other children cite these IDs). - **Risk rows** in `docs/compliance/risk-register.md`: R-SOC-1 bastion public IPv4 (I4: EIP kept because behind NAT the tailnet subnet router falls back to DERP relaying; Security Hub finding suppressed citing this row); R-SOC-2 bootstrap-admin standing AdministratorAccess key with compensating controls (AC7.4 option b; DA1 — follow-up "replace with role" deferred); R-SOC-3 Slack alarm path depends on the CP, email is the independent path (P6); R-SOC-4 legacy account data (D9); R-SOC-5 Security Hub MEDIUM 65 / LOW 16 (D10); R-SOC-6 recurring evidence automation deferred to Drata (D7); R-SOC-7 sole-founder background screening with Roman's self-attestation (AC9.2). Correct stale rows against live state. - **Policies:** re-check every "in build" control row in the twelve `docs/policies/*.md` against live state (AWS read-only + code paths); make each live-with-a-path or remove it, or point it at the open R-item/child of this epic that delivers it. Also reclassify every "owner action" row in the twelve policies (e.g. `bc-dr.md:32` restore, `bc-dr.md:73` org apply/Vault Lock/`BACKUP_ACCOUNT_ID`, `access-control.md:47-49` rulesets/machine users) against AS2: an agent-doable row becomes agent work pointing at the epic child that delivers it; only AS2 acts stay "owner action". Bump versions where a number changed; complete headers. (Rows that point at a child are flipped to `live` with a path by the readiness close-out child after prod verification.) Rewrite `logging-monitoring` and `incident-response` paging text for Slack (via the CP alarm relay) + email (D8, DA2/DA4), naming R-SOC-3. - **Boundary fix (AC1.2):** prod is `jaah-main` 366008913850; legacy 210352747749 is outside the boundary and out of scope — in `portfolio/projects/jaah.md` § AWS access, `docs/compliance/system-description.md`, and ONLY the "State on" paragraph of `docs/compliance/readiness-checklist.md` (the close-out child owns the rest of the checklist). Out of scope: Epic-wide fences (PRD §6, verbatim): "No agent merges or pushes to `master`. No agent approves its own promotion. No agent applies to prod any change not yet promoted. Delivery is a PR to `develop` (D1)." "No contact with any outside party: no emails, Slack messages to externals, vendor portals, NDA click-throughs or RFPs sent; no contracts; no new vendor or subprocessor, which also excludes PagerDuty/Opsgenie and Drata (D3, D7, D8)." "Legacy account 210352747749 is untouched." "Out of scope: Security Hub MEDIUM and LOW findings (D10) — registered only; evidence automation: no new crons, workflows or collectors whose purpose is recurring evidence (D7); Type II, the observation window, the audit, auditor engagement; `compliance_locks` and the vault-lock *compliance* mode." "No change to the console Compliance page, `portfolio/registry.toml` or `portfolio/engine/`" (epic 5303 owns them). "No change to dev's control plane or account beyond what an R-item strictly needs." "No secret value in any doc, register, evidence object or report." "No weakening of an existing control to make a check pass." This child: Do not touch the rest of `readiness-checklist.md`, the public legal pages (`docs/compliance/public/`), the console Compliance page, `portfolio/registry.toml`, `portfolio/engine/`. No status re-labelled without a live check. No secret values. Done means: - AC1.2 — oracle: `grep -rn 210352747749 docs/compliance portfolio/projects/jaah.md` — every hit reads as legacy/outside the boundary; `grep -n 366008913850` hits the AWS-access section and the system description. - AC8.1 — oracle: the `grep -n "in build" docs/policies/{…12 files…}.md` command above returns nothing or only lines naming an open R-item of epic 5329; AND `grep -n -i "owner action" docs/policies/{…12 files…}.md` — every hit is an AS2 act (sign, contract, legal review, attend, merge promotion, own-device check), each listed in the report with its AS2 reason; each policy header shows owner/approval/version/review fields filled; the report lists, per policy, the live check run for each changed control row. - AC8.2 / AC9.2 / AC7.4(b) — oracle: `grep -n "R-SOC-[1-7]" docs/compliance/risk-register.md` shows seven rows each with likelihood, impact, treatment, compensating controls and owner; the R-SOC-2 row names its compensating controls concretely as verified live (e.g. MFA on the management root, key held only in the credential store, CloudTrail alerting), not generic. - Paging text — oracle: `logging-monitoring.md` and `incident-response.md` name Slack (CP relay) + email, no SMS/phone, and cite R-SOC-3. - `python3 tools/check_context.py` and `./dc check full` green; PR merged to `develop`.

PR #4656 merged: 12 policies re-checked live (AS2-only owner actions, in-build rows → epic children, Slack+email paging), R-SOC-1..7 added, R-10/WB-C3 closed, prod boundary = jaah-main. CI gate green; local full gate flaky under host load.