feat(phase-3): workstream 6 — SOC 2 Type II Preparation

Implements all 22 WS6 tasks completing Phase 3 Enterprise.

Column-level encryption (AES-256-CBC, Vault-backed key) via EncryptionService
applied to credentials.secret_hash, credentials.vault_path,
webhook_subscriptions.vault_secret_path, and agent_did_keys.vault_key_path.
Backward-compatible: isEncrypted() guard skips decryption for existing
plaintext rows until next read-write cycle.

Audit chain integrity (CC7.2): AuditRepository computes SHA-256 Merkle hash
on every INSERT (hash = SHA-256(eventId+timestamp+action+outcome+agentId+orgId+prevHash)).
AuditVerificationService walks the full chain verifying hash continuity.
AuditChainVerificationJob runs hourly; sets agentidp_audit_chain_integrity
Prometheus gauge to 1 (pass) or 0 (fail).

TLS enforcement (CC6.7): TLSEnforcementMiddleware registered as first
middleware in Express stack; 301 redirect on non-https X-Forwarded-Proto
in production.

SecretsRotationJob (CC9.2): hourly scan for credentials expiring within 7
days; increments agentidp_credentials_expiring_soon_total.

ComplianceController + routes: GET /audit/verify (auth+audit:read scope,
30/min rate-limit); GET /compliance/controls (public, Cache-Control 60s).
ComplianceStatusStore: module-level map updated by jobs, consumed by controller.

Prometheus: 2 new metrics (agentidp_credentials_expiring_soon_total,
agentidp_audit_chain_integrity); 6 alerting rules in alerts.yml.

Compliance docs: soc2-controls-matrix.md, encryption-runbook.md,
audit-log-runbook.md, incident-response.md, secrets-rotation.md.

Tests: 557 unit tests passing (35 suites); 26 new tests (EncryptionService,
AuditVerificationService); 19 compliance integration tests. TypeScript clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/repositories/AuditRepository.test.ts

@@ -65,12 +65,16 @@ describe('AuditRepository', () => {
     };
 
     it('should insert a row and return a mapped IAuditEvent', async () => {
-      (pool.query as jest.Mock).mockResolvedValueOnce({ rows: [AUDIT_ROW], rowCount: 1 });
+      // create() first SELECTs the previous hash, then INSERTs the new event
+      (pool.query as jest.Mock)
+        .mockResolvedValueOnce({ rows: [], rowCount: 0 }) // SELECT hash (no previous event)
+        .mockResolvedValueOnce({ rows: [AUDIT_ROW], rowCount: 1 }); // INSERT
 
       const result = await repo.create(eventInput);
 
-      expect(pool.query).toHaveBeenCalledTimes(1);
-      const [sql, params] = (pool.query as jest.Mock).mock.calls[0] as [string, unknown[]];
+      expect(pool.query).toHaveBeenCalledTimes(2);
+      // Second call is the INSERT
+      const [sql, params] = (pool.query as jest.Mock).mock.calls[1] as [string, unknown[]];
       expect(sql).toContain('INSERT INTO audit_events');
       expect(params).toContain(eventInput.agentId);
       expect(params).toContain(eventInput.action);
@@ -81,11 +85,15 @@ describe('AuditRepository', () => {
     });
 
     it('should JSON-stringify the metadata field', async () => {
-      (pool.query as jest.Mock).mockResolvedValueOnce({ rows: [AUDIT_ROW], rowCount: 1 });
+      // create() first SELECTs the previous hash, then INSERTs the new event
+      (pool.query as jest.Mock)
+        .mockResolvedValueOnce({ rows: [], rowCount: 0 }) // SELECT hash (no previous event)
+        .mockResolvedValueOnce({ rows: [AUDIT_ROW], rowCount: 1 }); // INSERT
 
       await repo.create(eventInput);
 
-      const [, params] = (pool.query as jest.Mock).mock.calls[0] as [string, unknown[]];
+      // Second call is the INSERT
+      const [, params] = (pool.query as jest.Mock).mock.calls[1] as [string, unknown[]];
       // metadata param should be a JSON string
       const metadataParam = params.find((p) => typeof p === 'string' && p.startsWith('{'));
       expect(metadataParam).toBe(JSON.stringify(eventInput.metadata));