SOC 2 is not a single checklist. It is a framework defined by the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. For Mercurial-based workflows, every commit, branch, and push interacts with these criteria. Each must be tracked. Each must be protected.
Mercurial stores code in distributed repositories.