/ ISO Compliance Report — AAMOS Platform

Executive Summary

Säkerhetsstatus — Live 2026-05-02

# ─── P0 FIX 1: JWT Fallback-Secret (auth-routes.js rad 19, 156, 2114) ──────────
sed -i "s/ || 'amos-fallback-secret'//g" /opt/amos/api/auth-routes.js
grep "AMOS_JWT_SECRET" /opt/amos/.env || echo "⚠️ SAKNAS — lägg till AMOS_JWT_SECRET i .env omedelbart"
grep "amos-fallback-secret" /opt/amos/api/auth-routes.js && echo "FORTFARANDE KVAR" || echo "✅ Borttaget"

# ─── P0 FIX 2: Microservices som amos-user (systemd overrides) ──────────────────
for svc in operations analytics commerce cto people; do
  mkdir -p /etc/systemd/system/amos-${svc}.service.d/
  cat > /etc/systemd/system/amos-${svc}.service.d/override.conf << EOF
[Service]
User=amos
Group=amos
NoNewPrivileges=true
ProtectSystem=strict
PrivateTmp=true
EOF
done
systemctl daemon-reload
systemctl restart amos-operations amos-analytics amos-commerce amos-cto amos-people
ps aux | grep "amos-" | grep -v grep | awk '{print $1, $NF}'

# ─── P1 FIX: Content-Security-Policy i nginx ────────────────────────────────────
echo 'add_header Content-Security-Policy "default-src '"'"'self'"'"'; script-src '"'"'self'"'"' '"'"'unsafe-inline'"'"'; style-src '"'"'self'"'"' '"'"'unsafe-inline'"'"'; img-src '"'"'self'"'"' data: https:; connect-src '"'"'self'"'"' https://api.wavult.com; frame-ancestors '"'"'none'"'"'" always;' \
  >> /etc/nginx/conf.d/wavult-headers.conf
nginx -t && systemctl reload nginx && echo "✅ CSP aktivt"

ISO 42001:2023 — Kontrollstatus (Live API 2026-05-02)

ISO 9001:2015 — Quality Management System

ISO 9001 — Prioriterade åtgärder (väg till 70%)

System Sync Status — Dokumentmatris

Förklaring: ✅ Finns och synkad · 🔶 Delvis (chunks/indirekt) · — Saknas helt

Konkreta sync-kommandon

source /home/bernt/.openclaw/secrets/credentials.env
GITEA_HOST="wavult-api-alb-2055020040.eu-north-1.elb.amazonaws.com"
GITEA_H="Host: git.wavult.com"
REPO="wavult-group/amos-regulatory-kb"

# ─── STEG 1: Klona amos-regulatory-kb och synka TÜV-dokument ───────────────────
GIT_SSL_NO_VERIFY=true git -c "http.extraHeader=${GITEA_H}" \
  clone "https://wavult:${GITEA_PASS}@${GITEA_HOST}/${REPO}.git" /tmp/reg-kb-sync

mkdir -p /tmp/reg-kb-sync/tuv-internal/

# Kopiera alla TÜV-interna dokument
for doc in TUV_AUDIT_READINESS TUV_GAP_ANALYSIS TUV_AUDIT_REPORT_2026-04-27 \
           TUV_INVESTOR_AUDIT_2026-04-27 TUV_SYSTEM_ARCHITECTURE \
           AMOS_CONSTITUTION RISK_MANAGEMENT_PROCEDURE INCIDENT_RESPONSE SYSTEM_DEFINITION; do
  cp /opt/amos/data/${doc}.md /tmp/reg-kb-sync/tuv-internal/
done

# Skapa dokumentkontroll-index (ISO 9001 §7.5)
cat > /tmp/reg-kb-sync/tuv-internal/INDEX.md << 'INDEXEOF'
# Internal Document Register — ISO 9001 §7.5 Document Control
| Dokument | Version | Godkänd av | Datum | Nästa review |
|---|---|---|---|---|
| TUV_AUDIT_READINESS.md | 1.0 | Erik Svensson | 2026-04-27 | 2026-07-27 |
| TUV_GAP_ANALYSIS.md | 1.0 | Erik Svensson | 2026-04-27 | 2026-07-27 |
| TUV_AUDIT_REPORT_2026-04-27.md | 1.0 | Erik Svensson | 2026-04-27 | 2026-07-27 |
| TUV_INVESTOR_AUDIT_2026-04-27.md | 1.0 | Erik Svensson | 2026-04-27 | 2026-10-27 |
| TUV_SYSTEM_ARCHITECTURE.md | 1.0 | Erik Svensson | 2026-04-27 | 2026-07-27 |
| AMOS_CONSTITUTION.md | 1.0 | Erik Svensson | 2026-04-27 | 2026-07-27 |
| RISK_MANAGEMENT_PROCEDURE.md | 1.0 | Erik Svensson | 2026-04-27 | 2026-07-27 |
| INCIDENT_RESPONSE.md | 1.0 | Erik Svensson | 2026-04-27 | 2026-07-27 |
| SYSTEM_DEFINITION.md | 1.0 | Erik Svensson | 2026-04-27 | 2026-07-27 |
INDEXEOF

cd /tmp/reg-kb-sync
git config user.email "bernt@wavult.com" && git config user.name "Bernt"
git add tuv-internal/
git commit -m "docs: sync internal documents from AMOS KB [2026-05-02]

Source: /opt/amos/data/ (bernt.wavult.com)
Standard: ISO 9001 §7.5 Document Control
Reviewed-by: Bernt (AMOS AI Security Agent)"

GIT_SSL_NO_VERIFY=true git -c "http.extraHeader=${GITEA_H}" \
  push "https://wavult:${GITEA_PASS}@${GITEA_HOST}/${REPO}.git" HEAD:main
cd / && rm -rf /tmp/reg-kb-sync

# ─── STEG 2: Kopiera AI-POLICY från regulatory-kb → AMOS KB ────────────────────
git --git-dir=/var/git/repos/wavult-group/amos-regulatory-kb.git \
  show HEAD:tuv-certification/AI-POLICY.md > /opt/amos/data/AI-POLICY.md
git --git-dir=/var/git/repos/wavult-group/amos-regulatory-kb.git \
  show HEAD:tuv-certification/TUV-AI-CERTIFICATION-ROADMAP.md \
  > /opt/amos/data/TUV_CERTIFICATION_ROADMAP.md
echo "Synkat från regulatory-kb: $(ls /opt/amos/data/AI-POLICY.md /opt/amos/data/TUV_CERTIFICATION_ROADMAP.md)"

# ─── STEG 3: Re-indexera TÜV-dokument i AAMOS Intelligence ────────────────────
node /opt/aamos-intelligence/indexer.mjs --source=regulatory-kb --force 2>&1 | tail -10

# ─── STEG 4: Skapa audit_events tabell i RDS ────────────────────────────────────
# (ersätt $DATABASE_URL med korrekt DSN från /opt/amos/.env)
source /opt/amos/.env
psql "${DATABASE_URL}" << 'SQLEOF'
CREATE TABLE IF NOT EXISTS audit_events (
  id            UUID         PRIMARY KEY DEFAULT gen_random_uuid(),
  trace_id      UUID         NOT NULL,
  timestamp     TIMESTAMPTZ  NOT NULL DEFAULT now(),
  user_id       TEXT,
  role          TEXT,
  action        TEXT         NOT NULL,
  gecl_grade    CHAR(1),
  policy_result TEXT,
  status        TEXT,
  payload_hash  TEXT,
  artifact_id   TEXT,
  force_majeure BOOLEAN      DEFAULT FALSE,
  created_at    TIMESTAMPTZ  DEFAULT now()
);
CREATE INDEX IF NOT EXISTS idx_audit_trace_id  ON audit_events(trace_id);
CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON audit_events(timestamp DESC);
CREATE INDEX IF NOT EXISTS idx_audit_user_id   ON audit_events(user_id);
COMMENT ON TABLE audit_events IS '5-field audit log — ISO 42001 A.11.3 / SOC2 PI1.1 / ISO 9001 §7.5';
SELECT 'audit_events table ready: ' || COUNT(*) FROM audit_events;
SQLEOF

# ─── VERIFIERING ────────────────────────────────────────────────────────────────
echo "=== Sync-verifiering $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
git --git-dir=/var/git/repos/wavult-group/amos-regulatory-kb.git \
  ls-tree HEAD tuv-internal/ 2>/dev/null | wc -l | xargs echo "  tuv-internal/ filer:"
ls /opt/amos/data/AI-POLICY.md 2>/dev/null && echo "  AI-POLICY.md: OK" || echo "  AI-POLICY.md: SAKNAS"

Sync gap-matris — prioritering

Riskregister — Nuläge 2026-05-02

Prioriterad Åtgärdsplan — Väg till Pre-Assessment Q3 2026

Appendix — Datakällor och metodologi