create-filegrc 0.3.4 → 0.5.0

package/README.md

@@ -9,9 +9,9 @@ npm run validate
 npm run serve
 ```
 
-Setup asks for the legal organization name, the initial policy owner and their email, a security reporting address, and the program timezone. The generated private project includes a starter Security program, Program Readiness, a policy-driven Work Queue, Policy Events that add linked tasks, later audit preparation, evidence packets, and one dependency: `filegrc`.
+Setup asks for the legal organization name, the initial program lead and their organization job title and email, a security reporting address, and the program timezone. The generated Person records the lead’s actual position, while a separate dated Policy Owner Appointment owns the starter work. The generated private project includes a starter Security program, Program Readiness, a policy-driven Work Queue, Policy Events that add linked tasks, later audit preparation, evidence packets, and one dependency: `filegrc`.
 
-Creation has two layers. The five-record foundation contains workspace settings, the initial owner, the oversight team, renderer settings, and the filegrc system of record. The default `security` starter adds the framework references, proposed policies, controls, obligations, documents, and training records. Pass `--starter foundation` when you want to stop before selecting a framework.
+Creation has two layers. The six-record foundation contains workspace settings, the initial program lead, the Policy Owner Appointment, the oversight team, renderer settings, and the filegrc system of record. The default `security` starter adds the framework references, proposed policies, controls, obligations, documents, and training records. Pass `--starter foundation` when you want to stop before selecting a framework.
 
 For one noninteractive run, pass company and service fields together or use `--config setup.json`. The optional `setup` object defines the service boundary and management goal after installation. Use `--filegrc-package <directory>` to exercise unpublished local engine changes instead of installing the registry release. This writes a machine-local `file:` dependency, so replace it with a released version before sharing the generated workspace.
 
@@ -19,6 +19,7 @@ For one noninteractive run, pass company and service fields together or use `--c
 {
   "companyName": "Example Company",
   "policyOwnerName": "Security Owner",
+  "policyOwnerJobTitle": "Chief Executive Officer",
   "policyOwnerEmail": "owner@example.com",
   "securityContactEmail": "security@example.com",
   "timezone": "America/Chicago",
@@ -38,7 +39,7 @@ For one noninteractive run, pass company and service fields together or use `--c
 npx create-filegrc@latest company-grc --config setup.json
 ```
 
-Generated workspaces also include layered `AGENTS.md` instructions and model-driven headless commands. `filegrc program-path` gives agents the same six steps, exact page guidance, current status, and next actions shown in the renderer. Agents can define program scope, approve policies, implement controls, test External Evidence, complete policy work, trigger event tasks, and prepare later audit packets through the same domain functions used by the renderer.
+Generated workspaces also include layered `AGENTS.md` instructions and model-driven headless commands. `filegrc program-path` gives agents the same five steps, exact page guidance, current status, and next actions shown in the renderer. Agents can define program scope, approve policies, implement controls and their evidence sources, complete policy work, trigger event tasks, and prepare later audit packets through the same domain functions used by the renderer.
 
 Git is initialized on `main` when needed. New workspaces use trunk mode with `main` and `origin`. Browser editing becomes available after that branch has an upstream; each save fast-forwards, validates, commits, and pushes automatically. Existing parent repositories are supported and never receive a nested Git repository.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.3.4",
+  "version": "0.5.0",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

package/src/cli.js

@@ -68,6 +68,10 @@ export async function runCli(argv = process.argv.slice(2)) {
   console.log("");
   console.log(`  cd ${shellQuote(result.target)}`);
   if (options.install === false) console.log("  npm install");
+  if (result.gitMode !== "existing-worktree") {
+    console.log("  git add .");
+    console.log('  git commit -m "Initialize FileGRC program"');
+  }
   if (!result.setup) console.log("  npx filegrc setup");
   if (result.setup) console.log("  npx filegrc program-path --next --json");
   console.log("  npm run validate");
@@ -84,7 +88,9 @@ export async function runCli(argv = process.argv.slice(2)) {
     ? `  1. Confirm the selected assurance goal with management: ${assuranceGoalLabel(result.setup.target.assuranceGoal)}.`
     : "  1. Select and confirm the assurance goal.");
   console.log("  2. Appoint an independent reviewer who is separate from the policy owner.");
-  console.log("Review the generated records, then commit the approved baseline.");
+  console.log(result.gitMode === "existing-worktree"
+    ? "Review the generated records and commit only this workspace's approved baseline."
+    : "Connect the dedicated private origin and push main before using browser writes.");
 }
 
 function shellQuote(value) {
@@ -118,6 +124,7 @@ function parseArgs(argv) {
     else if (name === "config") options.config = next();
     else if (name === "company-name") options.companyName = next();
     else if (name === "policy-owner-name") options.policyOwnerName = next();
+    else if (name === "policy-owner-job-title") options.policyOwnerJobTitle = next();
     else if (name === "policy-owner-email") options.policyOwnerEmail = next();
     else if (name === "security-contact-email") options.securityContactEmail = next();
     else if (name === "timezone") options.timezone = next();
@@ -131,7 +138,7 @@ function parseArgs(argv) {
     else if (name === "boundary") setup.boundary = next();
     else if (name === "service-owner") setup.ownerId = next();
     else if (name === "criticality") setup.criticality = next();
-    else if (name === "classification") setup.dataClassification = next();
+    else if (name === "classification") setup.classificationId = next();
     else if (name === "internet-exposed") setup.internetExposed = booleanOption(next(), "internet-exposed");
     else if (name === "program-goal") setup.programGoal = next();
     else if (name === "setup-draft") setup.draft = true;
@@ -148,7 +155,8 @@ Create a filegrc workspace for a SOC 2 program.
 Options:
   --config <json-file|->            Read creation and optional setup values
   --company-name <legal-name>       Legal organization name
-  --policy-owner-name <name>        Initial policy owner
+  --policy-owner-name <name>        Initial program lead
+  --policy-owner-job-title <title>  Program lead's organization job title
   --policy-owner-email <email>      Policy owner's email address
   --security-contact-email <email>  Security reporting address
   --timezone <iana-timezone>        Program timezone, such as America/Chicago
@@ -160,7 +168,7 @@ Options:
   --repository-remote <name>        Browser sync remote, defaults to origin
   --service-name <name>             Complete service setup after creation
   --boundary <description>          Initial service boundary
-  --service-owner <person-id>       Defaults to person-policy-owner
+  --service-owner <person-id>       Defaults to person-program-lead
   --criticality <level>             low, medium, high, or critical
   --classification <name>           Initial data classification
   --internet-exposed <bool>         true or false