docs(add): R8 intake — soc2-groundwork (internal readiness, 1.0.0 held)

[TinDang97]

docs(add): R8 intake — soc2-groundwork (internal readiness, 1.0.0 held)

Freezes the R8 milestone direction (CARD sha256:75a11da4). Intake only — the milestone doc + frozen CARD; per-task build loops follow separately.

R8 brings Hydroa to internal SOC 2 readiness: the technical controls a Type I audit samples are running and producing evidence, so an auditor engagement starts from a defensible posture rather than a scramble. 1.0.0 is HELD for a real attestation — this milestone delivers readiness, never the tag.

Scope (Tin-approved 2026-08-14, AskUserQuestion ×3)

Broad: change-management + access + evidence-export plus the enterprise-trust items (pentest, SLO+runbooks, security-debt-closure) that R7 skipped when evals came forward. No independent reviewer recruited yet; no auditor engaged (internal readiness only).

8 tasks / exit criteria (sequenced recruit-first)

#	Task	Control	Exit gist
1	independent-review-control	CC1.4/CC8.1	Headline, gated on a real 2nd human — last 5 merges approved by a genuine second person, byte-approval retired
2	access-review-and-least-privilege	CC6.1–6.3	Every principal enumerated + justified; stale grant removed; pilotspacex-byte disposition decided
3	change-management-evidence-export	CC8.1	Auto-map each merge → green ci+dashboard on the merged sha + approver
4	external-pentest	CC4.1/CC7.1	Real external test; a finding = HARD-STOP
5	slo-and-incident-runbooks	CC7.2–7.5	SLOs + runbooks; pgvector runbook walked on a real target; kind-e2e masked gate resolved
6	security-debt-closure	CC-various	#27/#31/#51 + masked-gate residue, dual-verified
7	vendor-subprocessor-register	CC9.2	Every upstream provider: data-flow / retention / ZDR posture
8	readiness-assessment	synthesis	Controls → CC6/7/8/9 with ready/gap; explicitly not an attestation

Two load-bearing risks

• The four-eyes evidence is a disclosed gap only a recruited human can close — the milestone must not fake it with a procedure.
• A readiness milestone drifts into theater — every control ships with its first real evidence cycle (a genuine approval, an actual access removal, an alert that fires), never just a written doc.

Out of scope

The audit engagement + Type I window, full GRC/policy authorship, and the 1.0.0 cut.

⚠ Four-eyes note (self-referential)

Merging this PR via byte-approval adds another entry to the very tally (#117/#118/#199–#206) this milestone exists to close. Recorded honestly; independent-review-control is the fix.

[pilotspacex-byte]

Operator-directed approval via the pilotspacex-byte account to satisfy the required-review gate on a solo-maintainer repo. DISCLOSED and NOT independent four-eyes review: same operator who authored the change, using a second GitHub account. It evidences a green required check on the merged artifact, not a genuine second reviewer. NOTE the irony recorded on the PR: this is the R8 intake whose independent-review-control task exists to RETIRE exactly this self-approval path. Added to the auditor sample set (#117/#118/#199-#207); still owes a real second human with write access before the SOC 2 audit.