Compliance Pack Mapping

This document maps operator-facing compliance pack controls to the implemented Stella Ops evidence and audit mechanisms. Sprint SPRINT_20260518_051 creates the initial GDPR capsule privacy mapping here; later tasks in that sprint fill in SAR export, erasure, and data-residency examples.

GDPR Capsule Privacy Boundary

EvidenceLocker capsule payloads must not carry raw PII. The current field inventory and proposed remediation owners are maintained in docs/modules/evidence-locker/architecture.md.

Initial mapping:

Subject Access Foundation Example

The Platform SAR endpoint returns the canonical actor identity projection plus typed per-service projections (Authority, Timeline, EvidenceLocker, Notify), each routed through an ISubjectAccessServiceJoiner. Joiners that lack a configured projection source report deferred with an explicit machine-readable reason instead of silently omitting the service, so an operator and a DPO can both audit “which controllers have been queried successfully” without guessing.

Findings remains explicitly deferred with findings_actor_pii_lift_pending; its adoption is the follow-on sprint SPRINT_NNN_Findings_actor_pii_lift.

The bundle carries a content-bound sha256 digest in the signature field. The offline CLI verifier reads the bundle, strips the signature property, re-canonicalises the remaining JSON in original record order with JsonIgnoreCondition.WhenWritingNull, recomputes the SHA-256, and compares against the embedded value:

stella verify sar /path/to/sar-bundle.json
stella verify sar /path/to/sar-bundle.json --output json

Exit code 0 indicates the bundle has not been mutated since the platform emitted it; any non-zero exit code means the bundle’s integrity is in doubt.

Promotion of the integrity proof from a content digest to a true Ed25519 DSSE signature is tracked in SPRINT_NNN_Web_actor_identity_consumer, together with the operator console adoption.

Worked Art. 17 Erasure Example

1. Operator submits an Art. 17 erasure for actorRef=01HXYZ on tenant T.
2. Platform's actor identity client calls EraseAsync(T, 01HXYZ, requestedBy=02OPRT):
   - shared.actor_identity row for (T, 01HXYZ) is updated:
       display_name=NULL, email=NULL, ip_first_seen=NULL,
       ip_last_seen=NULL, user_agent_last=NULL,
       erased_at=now(), erased_by=02OPRT,
       erasure_audit_id=<UUID>.
   - Unified audit event `actor.identity.erased` is emitted with the audit id.
3. Any future GET /api/v1/operator/sar/01HXYZ returns the erased projection
   (PII fields null + required `erased` discriminator). EvidenceLocker
   capsules referencing actorRef 01HXYZ still verify because no PII was
   ever signed into them.
4. If any capsule was sealed before sprint 20260518_051 was deployed and
   contains residual PII (detected by the LegacyCapsulePiiAuditService),
   the erasure response includes partial:true plus the
   `actor.erasure.legacy_capsule_refused` audit event. The retention basis is
   GDPR Art. 17(3)(b) primary (and Art. 17(3)(e) secondary where a legal-claims
   rationale exists), mapped per capsule class to a concrete DORA/NIS2/CRA
   retention obligation. Article 23 is NOT relied upon in the requester-facing
   response (`article_23_relied_upon: false`). The embedded PII is tomb-stoned
   on all ordinary read paths. See
   `docs/modules/evidence-locker/legacy-capsule-erasure-policy.md` and
   `docs/legal/legacy-capsule-retention-map.md` (DPO decision D-051-01).