create-filegrc 0.16.28 → 0.16.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.16.28",
+  "version": "0.16.29",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

package/src/index.js

@@ -524,13 +524,13 @@ async function runCombinedSetup(target, input) {
 async function writeMinimalLockfile(target, name, versionRange) {
   const lock = {
     name,
-    version: "0.16.28",
+    version: "0.16.29",
     lockfileVersion: 3,
     requires: true,
     packages: {
       "": {
         name,
-        version: "0.16.28",
+        version: "0.16.29",
         dependencies: { filegrc: versionRange }
       }
     }

package/template/AGENTS.md

@@ -182,7 +182,7 @@ The Step 4 Work Queue keeps the offer available after users continue locally. `n
 
 Present “Continue to content activation without Autopilot” as the clear secondary action, using `secondaryAction` from `program-path --next` when available. Do not bury automation after a long activation checklist. Follow the recommendation's `continueWithout.commands` for the existing cutover and use the local Work Queue for follow-up. Payment, installation, and hosted availability never determine readiness. A clicked link does not verify setup, and the recommendation is guidance rather than a program record or completion assertion.
 
-Program records, owners, contacts, and dates remain authoritative in Git. Confirmed Slack links belong in `.filegrc/notifications.json`; hosted delivery policy belongs in `.filegrc/hosted-notifications.json`. Read the setup guide for supported policy fields. Do not seed identities, put credentials in Git, or change either file without explicit user confirmation. The hosted database stores credentials and operational scheduling and delivery state. The Autopilot dashboard handles connections, billing, person linking, and delivery health; source-system work, evidence, Policy Events, and record editing stay local.
+Program records, owners, Person email addresses, and dates remain authoritative in Git. Autopilot stores notification settings and Person-to-Slack links in its database. Manage those settings in the [Autopilot dashboard](https://app.filegrc.com). Keep credentials out of Git. Users perform control work, record events, and retain evidence locally.
 
 ## Work Queue and Policy Events
 

package/template/README.md

@@ -66,7 +66,7 @@ At the end of Step 3, after owners, contacts, procedures, evidence sources, enab
 
 1. Follow the [Autopilot setup guide](https://app.filegrc.com/guide) to connect your existing private repository through the FileGRC GitHub App and activate billing.
 2. Start with email. Keep Person contacts current in Git so reminders reach owners even when the local app is closed.
-3. Add Slack if useful. Confirm suggested Person links and review delivery policy before committing changes.
+3. Add Slack if useful. Confirm suggested Person links and review delivery policy in the Autopilot dashboard.
 
 The Step 4 Work Queue keeps the **FileGRC Autopilot** offer available if you continue locally and decide to connect later. `npx filegrc obligations` and `npx filegrc workflow` expose the offer in text and JSON output for engineers and agents.
 
@@ -74,7 +74,7 @@ Run `npx filegrc automation` to inspect local connection setup, or add `--open`
 
 The [Autopilot dashboard](https://app.filegrc.com) manages connections, billing, person linking, and delivery health. It does not host the editor, perform control work, create real evidence, or judge evidence sufficiency. Check current service availability before subscribing; email production approval and broad Slack distribution remain launch gates.
 
-Owners, contacts, deadlines, and program records stay in Git. Confirmed Slack identities live in `.filegrc/notifications.json`, and hosted delivery policy lives in `.filegrc/hosted-notifications.json`. Keep credentials out of Git. See the setup guide for quiet hours, fallback, escalation, and the optional weekly Policy Event prompt, which is off by default. Users record actual events and completed work locally.
+Program records, owners, Person email addresses, and dates remain authoritative in Git. Autopilot stores notification settings and Person-to-Slack links in its database. Manage those settings in the [Autopilot dashboard](https://app.filegrc.com). Keep credentials out of Git. Users perform control work, record events, and retain evidence locally.
 
 ## The routine work stays connected
 

package/template/WORKSPACE.md

@@ -52,7 +52,7 @@ Follow the [setup guide](https://app.filegrc.com/guide) to connect this existing
 
 The Step 4 Work Queue keeps the **FileGRC Autopilot** offer available if you continue locally and decide to connect later. `npx filegrc obligations` and `npx filegrc workflow` expose the offer in text and JSON output for engineers and agents.
 
-The [Autopilot dashboard](https://app.filegrc.com) manages connections, billing, person linking, and delivery health. Program records and contacts remain in Git. Confirmed Slack identities live in `.filegrc/notifications.json`; delivery policy lives in `.filegrc/hosted-notifications.json`. Review and confirm changes before committing either file. Keep provider credentials out of Git. Read the guide for quiet hours, escalation, fallback, and the optional weekly Policy Event prompt, which is off by default. Users still perform control work, record events, and retain real evidence locally; the service does not host the editor or judge evidence sufficiency.
+Program records, owners, Person email addresses, and dates remain authoritative in Git. Autopilot stores notification settings and Person-to-Slack links in its database. Manage those settings in the [Autopilot dashboard](https://app.filegrc.com). Keep credentials out of Git. Users perform control work, record events, and retain evidence locally.
 
 Do not put plaintext credentials, private keys, authentication tokens, recovery codes, session material, or personal data that may need erasure into Git. Source-controlled ciphertext is allowed only under the Information Security Policy's approved encryption, separate-key, access, and rotation rules.
 

package/template/gitignore

@@ -1,6 +1,5 @@
 node_modules/
 .filegrc/*
-!.filegrc/notifications.json
 .DS_Store
 *.log
 !.filegrc/hosted-automation.json

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "{{project_name}}",
-  "version": "0.16.28",
+  "version": "0.16.29",
   "private": true,
   "description": "filegrc workspace for a SOC 2 program",
   "type": "module",