create-filegrc 0.20.8 → 0.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.20.8",
+  "version": "0.21.0",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

package/src/defaults.js

@@ -1136,7 +1136,7 @@ export function baselineRecordFiles(effectiveDate, starter = "security") {
       ? { ...obligation.recurrence, anchorDate: effectiveDate }
       : obligation.recurrence,
     ...(obligation.window ? { window: obligation.window } : {}),
-    ...(starterObligationSelector(obligation.id) ? { selector: starterObligationSelector(obligation.id) } : {}),
+    ...(starterObligationSelector(obligation.id) ? { selector: starterObligationSelector(obligation.id), completionCoverage: "point-in-time" } : {}),
     ...(obligation.id === "obligation-annual-penetration-test" ? { preparationPurpose: "applicability-review" }
       : ["backup-test", "exercise", "penetration-test", "vulnerability-scan", "security-scan", "alert-path-test"].includes(obligation.activityType) ? { preparationPurpose: "test-execution" } : {}),
     rationale: starterObligationRationale(obligation.id),
@@ -1221,7 +1221,7 @@ function starterObligationSelector(obligationId) {
   return definition ? {
     ...definition,
     membershipMode: "as-of",
-    cutoff: "window-end"
+    cutoff: obligationId === "obligation-annual-critical-vendor-review" ? "window-end" : "review-date"
   } : null;
 }
 

package/src/index.js

@@ -524,13 +524,13 @@ async function runCombinedSetup(target, input) {
 async function writeMinimalLockfile(target, name, versionRange) {
   const lock = {
     name,
-    version: "0.20.8",
+    version: "0.21.0",
     lockfileVersion: 3,
     requires: true,
     packages: {
       "": {
         name,
-        version: "0.20.8",
+        version: "0.21.0",
         dependencies: { filegrc: versionRange }
       }
     }

package/template/AGENTS.md

@@ -188,6 +188,8 @@ Program records, owners, Person email addresses, and dates remain authoritative
 
 Run `npx filegrc obligations --json` to see scheduled work, event tasks, owners, deadlines, and requested proof. In Step 4, record the work shown there. Use `npx filegrc guide obligation --json` and `data/AGENTS.md` for the completion and event-trigger commands. The resulting dated operating record or completed Action Item is the output.
 
+A periodic review or test may inspect a point in time without claiming continuous coverage. Read [Obligation population timing](https://github.com/Alignbase/filegrc/blob/main/docs/obligation-population-timing.md) before choosing `completionCoverage` and selector cutoff. A `review-date` snapshot requires the actual `--population-as-of` observation date and committed scope. A `whole-period` duty requires explicit proof range coverage after the recurrence period ends. Preserve existing end-cutoff campaigns and unfinished members. Waiting means current member work is recorded but the population is still open; final reconciliation remains required. Use `npx filegrc correct-obligation-rule RULE_ID --scaffold --json` for a reviewed successor correcting an inappropriate open snapshot rule, preserving the original window, proofs and approvals. Upgrade local and hosted readers to the 0.21 line before adopting these optional model v13 fields.
+
 ## Headless Markdown
 
 Create and update JSON plus Markdown in one mutation envelope when practical. You can also inspect or replace a companion directly:

package/template/README.md

@@ -61,3 +61,5 @@ Your team performs the control work and reviews responses before submission. An
 For a nonmaterial administrative correction, choose **Nonmaterial amendment** on a supported record page or run `npx filegrc amend-nonmaterial RESOURCE_ID --scaffold`. The owner can correct an administrative label or a verified equivalent reporting email alias while preserving the original record and approval. Changes to commitments, recipients, access, scope, schedules, governed content or evidence conclusions keep their normal reviews.
 
 The nonmaterial amendment workflow is available from FileGRC 0.19.0 with model v13. Existing workspaces need no model migration. The 0.19 runtime also reads existing 0.18 workspaces; 0.18 runtimes reject repositories pinned to 0.19, so hosted services must approve and install the new runtime before owners adopt these records.
+
+Periodic reviews, population cutoffs, and whole-period proof have separate meanings. See the [Obligation population timing guide](https://github.com/Alignbase/filegrc/blob/main/docs/obligation-population-timing.md) before choosing or correcting a schedule.

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "{{project_name}}",
-  "version": "0.20.8",
+  "version": "0.21.0",
   "private": true,
   "description": "filegrc workspace for a SOC 2 program",
   "type": "module",