create-filegrc 0.16.18 → 0.16.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.16.18",
+  "version": "0.16.20",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

package/src/index.js

@@ -524,13 +524,13 @@ async function runCombinedSetup(target, input) {
 async function writeMinimalLockfile(target, name, versionRange) {
   const lock = {
     name,
-    version: "0.16.18",
+    version: "0.16.20",
     lockfileVersion: 3,
     requires: true,
     packages: {
       "": {
         name,
-        version: "0.16.18",
+        version: "0.16.20",
         dependencies: { filegrc: versionRange }
       }
     }

package/template/data/AGENTS.md

@@ -107,6 +107,8 @@ When `guide` returns a collection review requirement, review the listed type-spe
 
 Use Retention Schedule records as the structured rows of the Data Retention Schedule. Keep a row `planned` until management has approved its Information Types, scope, cutoff, period, disposition action, instructions, sources, approver, date, and reviewed source revisions. Run `npx filegrc program-readiness --json` after changing an information use, source-coverage record, Commitment, Policy, or other source. FileGRC may identify missing or stale decisions, but it must never infer an organization-specific period or deletion behavior.
 
+When a row or Commitment relies on one section of a consolidated Policy or Document, set `sourceSectionHeadings` to map the source ID to its exact Markdown heading. Then run `npx filegrc review-bindings ROW_ID --json` for a row and record the returned revisions after reviewing that section. An edit elsewhere in the source leaves the decision current; a change to the selected section requires review. Omit a section heading when the whole source governs the decision. A pending Policy amendment remains a proposal until its revised content is approved.
+
 Store a relationship only on its authoritative record. Control Tests store `auditId`; Evidence Artifacts store `auditIds`; Commitments store `systemIds` and `controlIds`; Controls store `policyIds`, `requirementIds`, `systemIds`, `componentIds`, and `evidenceSourceComponentIds`; Risks store `controlIds`; Components store their `vendorId` and `systemUses`; Reporting Channel Sets store the normal and fallback ways people send a report, the rules requiring them, and the responsible role. Use `references` to inspect derived inbound links.
 
 Use explicit business dates. Git records when a file changed, but it does not replace `occurredOn`, `scheduledFor`, `completedOn`, `approvedOn`, or similar fields.

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "{{project_name}}",
-  "version": "0.16.18",
+  "version": "0.16.20",
   "private": true,
   "description": "filegrc workspace for a SOC 2 program",
   "type": "module",