create-filegrc 0.3.3 → 0.4.0

package/README.md

@@ -1,6 +1,6 @@
 # create-filegrc
 
-Create a Git-native filegrc workspace for a SOC 2 program:
+Create a Git-native filegrc workspace for a SOC 2 program. Use a dedicated private repository so browser-generated compliance commits stay separate from application development history.
 
 ```sh
 npx create-filegrc@latest company-grc
@@ -9,9 +9,9 @@ npm run validate
 npm run serve
 ```
 
-Setup asks for the legal organization name, the initial policy owner and their email, a security reporting address, and the program timezone. The generated private project includes a starter Security program, Program Readiness, a policy-driven Work Queue, Policy Events that add linked tasks, later audit preparation, evidence packets, and one dependency: `filegrc`.
+Setup asks for the legal organization name, the initial program lead and their organization job title and email, a security reporting address, and the program timezone. The generated Person records the lead’s actual position, while a separate dated Policy Owner Appointment owns the starter work. The generated private project includes a starter Security program, Program Readiness, a policy-driven Work Queue, Policy Events that add linked tasks, later audit preparation, evidence packets, and one dependency: `filegrc`.
 
-Creation has two layers. The five-record foundation contains workspace settings, the initial owner, the oversight team, renderer settings, and the filegrc system of record. The default `security` starter adds the framework references, proposed policies, controls, obligations, documents, and training records. Pass `--starter foundation` when you want to stop before selecting a framework.
+Creation has two layers. The six-record foundation contains workspace settings, the initial program lead, the Policy Owner Appointment, the oversight team, renderer settings, and the filegrc system of record. The default `security` starter adds the framework references, proposed policies, controls, obligations, documents, and training records. Pass `--starter foundation` when you want to stop before selecting a framework.
 
 For one noninteractive run, pass company and service fields together or use `--config setup.json`. The optional `setup` object defines the service boundary and management goal after installation. Use `--filegrc-package <directory>` to exercise unpublished local engine changes instead of installing the registry release. This writes a machine-local `file:` dependency, so replace it with a released version before sharing the generated workspace.
 
@@ -19,6 +19,7 @@ For one noninteractive run, pass company and service fields together or use `--c
 {
   "companyName": "Example Company",
   "policyOwnerName": "Security Owner",
+  "policyOwnerJobTitle": "Chief Executive Officer",
   "policyOwnerEmail": "owner@example.com",
   "securityContactEmail": "security@example.com",
   "timezone": "America/Chicago",
@@ -38,9 +39,9 @@ For one noninteractive run, pass company and service fields together or use `--c
 npx create-filegrc@latest company-grc --config setup.json
 ```
 
-Generated workspaces also include layered `AGENTS.md` instructions and model-driven headless commands. `filegrc program-path` gives agents the same six steps, exact page guidance, current status, and next actions shown in the renderer. Agents can define program scope, approve policies, implement controls, test External Evidence, complete policy work, trigger event tasks, and prepare later audit packets through the same domain functions used by the renderer.
+Generated workspaces also include layered `AGENTS.md` instructions and model-driven headless commands. `filegrc program-path` gives agents the same five steps, exact page guidance, current status, and next actions shown in the renderer. Agents can define program scope, approve policies, implement controls and their evidence sources, complete policy work, trigger event tasks, and prepare later audit packets through the same domain functions used by the renderer.
 
-Git is initialized when needed. The browser can create local commits before a remote is configured.
+Git is initialized on `main` when needed. New workspaces use trunk mode with `main` and `origin`. Browser editing becomes available after that branch has an upstream; each save fast-forwards, validates, commits, and pushes automatically. Existing parent repositories are supported and never receive a nested Git repository.
 
 Creation output reports the resolved filegrc version, program timezone, starter record counts, whether installation ran, and whether the target joined an existing Git worktree or received a new repository.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

package/src/cli.js

@@ -30,9 +30,30 @@ export async function runCli(argv = process.argv.slice(2)) {
     `filegrc ${result.engineVersion}${result.enginePackage ? ` from ${result.enginePackage}` : ""}: ` +
     `${result.install === "installed" ? "installed" : "installation skipped"}`
   );
+  console.log("Use a dedicated private repository for your FileGRC workspace. The browser");
+  console.log("commits and pushes each saved program change, so a standalone repository keeps");
+  console.log("the compliance audit trail separate from application development history.");
   console.log(`Git: ${result.gitMode === "existing-worktree" ? "joined existing worktree" : "initialized new repository"}`);
-  if (result.gitDetached) {
-    console.log("Warning: detached HEAD detected. Check out a branch before using browser commit, pull, or push.");
+  if (result.gitMode === "existing-worktree") {
+    console.log("");
+    console.log("This FileGRC workspace joined an existing Git repository.");
+    console.log("");
+    console.log("FileGRC recommends a dedicated private repository because browser saves create");
+    console.log("frequent compliance commits. A standalone repository keeps the GRC audit trail");
+    console.log("separate from application development history.");
+    console.log("");
+    console.log("Monorepo mode remains supported. Browser Git operations will commit only files");
+    console.log("inside this FileGRC workspace.");
+  }
+  if (
+    result.gitMode === "existing-worktree"
+    && result.repository.mode === "trunk"
+    && (result.gitDetached || result.gitBranch !== result.repository.authoritativeBranch)
+  ) {
+    console.log("");
+    console.log("The browser will open in read-only mode until this workspace is available on");
+    console.log("the configured authoritative branch. File creation and CLI validation still");
+    console.log("work from this checkout.");
   }
   console.log(`Timezone: ${result.values.timezone}`);
   for (const stage of result.stages) {
@@ -97,17 +118,21 @@ function parseArgs(argv) {
     else if (name === "config") options.config = next();
     else if (name === "company-name") options.companyName = next();
     else if (name === "policy-owner-name") options.policyOwnerName = next();
+    else if (name === "policy-owner-job-title") options.policyOwnerJobTitle = next();
     else if (name === "policy-owner-email") options.policyOwnerEmail = next();
     else if (name === "security-contact-email") options.securityContactEmail = next();
     else if (name === "timezone") options.timezone = next();
     else if (name === "starter") options.starter = next();
     else if (name === "filegrc-version") options.filegrcVersion = next();
     else if (name === "filegrc-package") options.filegrcPackage = next();
+    else if (name === "repository-mode") options.repositoryMode = next();
+    else if (name === "authoritative-branch") options.authoritativeBranch = next();
+    else if (name === "repository-remote") options.repositoryRemote = next();
     else if (name === "service-name") setup.serviceName = next();
     else if (name === "boundary") setup.boundary = next();
     else if (name === "service-owner") setup.ownerId = next();
     else if (name === "criticality") setup.criticality = next();
-    else if (name === "classification") setup.dataClassification = next();
+    else if (name === "classification") setup.classificationId = next();
     else if (name === "internet-exposed") setup.internetExposed = booleanOption(next(), "internet-exposed");
     else if (name === "program-goal") setup.programGoal = next();
     else if (name === "setup-draft") setup.draft = true;
@@ -124,16 +149,20 @@ Create a filegrc workspace for a SOC 2 program.
 Options:
   --config <json-file|->            Read creation and optional setup values
   --company-name <legal-name>       Legal organization name
-  --policy-owner-name <name>        Initial policy owner
+  --policy-owner-name <name>        Initial program lead
+  --policy-owner-job-title <title>  Program lead's organization job title
   --policy-owner-email <email>      Policy owner's email address
   --security-contact-email <email>  Security reporting address
   --timezone <iana-timezone>        Program timezone, such as America/Chicago
   --starter <profile>               security (default) or foundation
   --filegrc-version <version>       Override resolved engine version
   --filegrc-package <directory>     Install an unpublished local filegrc package
+  --repository-mode <mode>          trunk (default) or manual
+  --authoritative-branch <name>     Browser write branch, defaults to main
+  --repository-remote <name>        Browser sync remote, defaults to origin
   --service-name <name>             Complete service setup after creation
   --boundary <description>          Initial service boundary
-  --service-owner <person-id>       Defaults to person-policy-owner
+  --service-owner <person-id>       Defaults to person-program-lead
   --criticality <level>             low, medium, high, or critical
   --classification <name>           Initial data classification
   --internet-exposed <bool>         true or false