feat(compliance): vendor + subprocessor register with usage reconciliation (CC9.2)

[TinDang97]

R8 soc2-groundwork — task 3 of 8: vendor + subprocessor register (CC9.2)

A read + report-only governance tool that produces an auditable subprocessor register: every declared third-party processor of customer data, classified documented / incomplete / dpa_expired / unused — and reconciled against what the system actually reaches.

The anti-theater spine

A register that is only a hand-maintained doc silently drifts from reality. build_register cross-checks the declared list against a live UsageSource, so a processor the system reaches but that is absent from the declared register is a HARD finding — never a silent omission. Declaring a processor (including non-customer-data infra) is what suppresses that finding.

Design (mirrors the CC8.1 change-evidence #208 and CC6 access-review #209 tools)

• Pure core build_register(source, declared, *, now_iso) over a UsageSource port. now_iso injected → identical declared + usage + now yields byte-identical output. Driven by a zero-network fake in the suite.
• IO adapter ConfigUsageSource enumerates live usage from the deploy surface (provider registry, egress allow-list, storage config) — not the network. A partial/unreadable source raises IncompleteFetch so the core never reconciles against an incomplete usage set (which would hide an undeclared processor). Live enumeration is a documented NotImplementedError the operator wires.

Fail-closed classification (10/10 red-first tests)

Guard	Rule
M4 · R:UNDECLARED_PROCESSOR	A live-reached processor absent from the register is a hard finding, counted, never dropped
M3 · A4 · R:ASSUMED_COMPLIANT	Missing required field or DPA != signed → incomplete, never documented
M5	DPA expired when now_iso >= dpa_expiry — computed against injected now, never "valid" by omission
A2 · E6	A non-customer-data processor carries no DPA burden — listed for reconciliation, not risk-classified
M6 · R:FABRICATED_SIGNOFF	Review record stays unreviewed — draft until a real human signs
M1 · R:TOOL_WRITES_REGISTER	No write path — the port's only method is the read processors; the tool never edits subprocessors.json

scripts/soc2/ is repo-governance tooling, not part of the gateway wheel. subprocessors.json ships with placeholder DPA dates to be verified by a human as vendor agreements are signed — the tool correctly flags the current OpenAI/Anthropic/Bedrock entries as incomplete (DPA pending) until then.

ADD gate PASS (contract sha256:a593b6e1); ruff clean.

---

⚠ Four-eyes disclosure

This PR still owes a genuine second human reviewer. Any byte-approval applied to merge it is operator-directed, disclosed as NOT independent four-eyes, and added to the auditor sample-set tally — it does not satisfy CC1.4/CC8.1 separation of duties. Closing that gap is R8 independent-review-control, blocked until Tin recruits a real second reviewer.

[pilotspacex-byte]

Automated approval by Claude Code as pilotspacex-byte — DISCLOSED, NOT independent review.

No second human has read this change. This account is the operator-directed shared-keyring automation account, and this approval is applied at Tin's explicit direction to satisfy the branch-protection 1-approval gate mechanically. For SOC 2 / audit purposes, treat PR #210 as SELF-APPROVED: it does NOT constitute CC1.4/CC8.1 separation of duties and still owes a genuine second reviewer.

This PR is #210 in the byte-approval auditor sample set (#117 · #118 · #199–#210). The fix is R8 independent-review-control, blocked until a real second reviewer is recruited. Fittingly, this very tool would list pilotspacex-byte-style automation as a processor to declare and reconcile.