# SOC2 Baseline Pack (Common Criteria)

**ID**: `soc2-baseline`
**Version**: `1.0.0`
**Author**: Assay Project

## Overview
This pack provides a set of **Evidence Invariants** that map to the AICPA Trust Services Criteria (TSC) for Security (Common Criteria).

It DOES NOT verify the effectiveness of your controls. Instead, it verifies the **presence, completeness, and integrity of the evidence** generated by your controls.

### Invariants

All checks in this pack are **invariants** (they must *always* be true).

| Rule ID | Check | TSC Reference | Description |
|---------|-------|--------------|-------------|
| `invariant.accountability` | `event_type_exists` | CC6.1 | Ensures systems/artifacts are registered in the inventory (Accountability). |
| `invariant.change_lifecycle` | `event_pairs` | CC7.2 | Ensures change events have matching start/finish pairs (Completeness). |
| `invariant.decision_record` | `event_type_exists` | CC8.1 | Ensures automated policy decisions (gates) are recorded (Audit Trail). |

## Disclaimer
> [!IMPORTANT]
> This pack is for **evidence gathering** purposes only. Passing these checks does not constitute SOC2 compliance or an audit opinion. It confirms that your CI/CD pipeline is generating the *minimum viable evidence* required to support an audit.
>
> This pack is **not affiliated with, endorsed by, or sponsored by AICPA**. AICPA Trust Services Criteria (TSC) names and identifiers are used for reference and mapping convenience only. Mappings provided in this pack represent community/Assay interpretations and are not official AICPA guidance.

## Usage
```bash
# Lint a bundle against SOC2 requirements
assay evidence lint --bundle my-bundle.tar.gz --pack soc2-baseline
```
