Close Competitor Security Compliance Certification Gaps
Identify which security and compliance certifications Jaah’s competitors have — SOC 2, HIPAA, ISO 27001, etc. — and close the gap. Without breaking anything :)
Subtasks
- [business_analysis] Close Competitor Security Compliance Certification Gaps Settled: close 6 gaps vs 15 AI-coding competitors to audit-ready + owner-action bar — ISO 27001, SOC 2 Type II in-house evidence crons, ISO 42001, /legal/trust + doc-request flow, GDPR RoPA/DPIA, sourced snapshot. FedRAMP out; HIPAA already ahead.
- [architecture] Close Competitor Security Compliance Certification Gaps 9 children: C1 evidence layout + dev bucket; C2/C3 13 collectors seeded ON (DB/GitHub, AWS read-only IAM); C4 trust+NDA pages; C5 request queue (approve/decline only); C6/C7 ISO 27001/42001; C8 GDPR; C9 snapshot. Gaps: R-PROSPECT-RET, I-15.
- [plan] Close Competitor Security Compliance Certification Gaps 9 coders on the architect's 9 boundaries (6220–6228), one phase, explicit deps. Migrations chained C5→C2→C3. Trust page lists only true statuses; each later child upgrades its own line. Critic passed after 3 MAJOR fixes.
- Evidence layout and bucket everywhere packages/evidence single-homes CONTROLS (+control-checks); CP store.file; evidence bucket on every env (moved blocks keep main's lock). Full gate green; PR #5383 merged; dev deploy applied (bucket unlocked, EVIDENCE_BUCKET set). Main plan unobserved (owner-gated).
- Trust document request flow Trust document request form + operator approve/decline queue shipped (PR #5388), plus a console CSP fix for reCAPTCHA found on dev (PR #5390). Full gate green, both dev deploys succeeded. Live dev submit deferred: reCAPTCHA refuses automated browsers; the API suite covers it.
- GDPR record of processing, DPIA Added GDPR RoPA (Art. 30) and model-provider DPIA (GDPR-OA-1), indexed, trust GDPR line added. Full gate green, PR #5392 merged; dev deploy green on next run (first rollout flaked). Deferred: HubSpot vendor row, unclassed data; UI suggestions in report (task create 403).
- Evidence collector framework, DB/GitHub collectors 6 SOC 2 evidence collectors as enabled daily crons (#5393, #5394, #5395 merged; full gate green; dev deploys ok). Live on dev: 4 pass with s3:// keys, 2 GitHub fail with "credential not set". Alarm Task unverified on dev: no cto project there (follow-up).
- AWS evidence collectors and IAM 7 AWS SOC 2 evidence collectors + read-only IAM shipped (#5397; fixes #5400, #5407), full gate green ×3, dev deploys ok. Dev boundary applied via org/ (inputs now in repo). All 7 run on dev: 3 pass, 4 drift, none AccessDenied.
- ISO 27001 SoA, ISMS, checker ISO 27001 SoA (93 Annex A + clauses 4–10), ISMS doc, 5 R-ISO risk rows, generalized tools/iso_crosswalk.py in quick gate; trust line → Readiness. Full gate green, PR #5409 merged, dev Jaah Deploy succeeded. Follow-ups in report.
- ISO 42001 AIMS and inventory ISO 42001 AIMS, full AI inventory and SoA (38 Annex A) added, plus 4 R-ISO42 risks and a crosswalk gate check; trust line moved to Readiness. PR #5411 merged; dev deploy passed on re-deploy. Full gate green except one host-env guard test. Follow-ups named in report.
- [finish] Close Competitor Security Compliance Certification Gaps All 9 children merged and deployed to dev, and the epic's ask is met to the audit-ready bar. I checked the trust page on dev. Filed 4 follow-ups: 6270 (cron alarms target the missing "cto" project, so drift is silent), 6271 (cron projection race on deploy), 6272 (DeepSeek missing from trust and vendor docs), 6273 (UI suggestions).
- Cron alarms file into project "cto", which exists Fixed the Alarm project save, which 422'd on dev for any project outside org zero. PR #5465 merged; full gate green; dev deploy OK. On dev a drifting backups run filed one hidden alarm, #5009 in jaah, and a re-run refreshed it. Deferred: owner sets it on prod (I-16); pickers truncate.
- New system crons are not scheduled after a rolling A projection pass that skips an enabled cron with an unregistered type now enqueues one follow-up pass 60s later (at most 10 per chain). PR #5419 merged; dev deploy succeeded; all 13 evidence crons on dev show a next run. Full gate: one unrelated live-cast test failed; it passes alone. Deferred: Automations list UI suggestions (in report).
- UI suggestions from epic 6213 verification (legal Shipped 17/19 UI items in #5425 (13 and 15 already worked on dev); #5431 fixed the failing dev rollouts with a 60s ECS health-check grace. Full gate green, Jaah Deploy green on dev, screenshots in report.
Artifacts
Activity
- Created
- Runner started
- Ready
- Ready
- Ready
- Runner started
- Awaiting response
- Awaiting response
- Awaiting response
- Awaiting response
- Runner resumed
- Awaiting response
- Awaiting response
- Awaiting response
- Awaiting response
- Runner resumed
- Runner ended (done)
- Runner started
- Awaiting response
- Awaiting response
- Awaiting response
- Awaiting response
- Awaiting response
- Runner resumed
- Runner ended (done)
- Runner started
- Draft
- Draft
- Draft
- Draft
- Draft
- Draft
- Draft
- Draft
- Ready
- Ready
- Ready
- Ready
- Ready
- Ready
- Ready
- Ready
- Runner ended (done)
- Runner started
- Runner ended (done)
- Runner started
- Runner ended (done)
- Runner started
- Runner started
- Runner ended (done)
- Runner ended (done)
- Runner started
- Awaiting response
- Awaiting response
- Runner resumed
- Runner ended (done)
- Runner started
- Runner ended (done)
- Runner started
- Runner ended (done)
- Runner started
- Ready
- Ready
- Ready
- Runner ended (done)
- Runner started
- Runner started
- Runner started
- Runner ended (done)
- Runner ended (done)
- Ready
- Run
- Runner started
- Ready
- Runner started
- Ready
- Runner started
- Runner ended (done)
- Runner ended (done)