filegrc 0.10.0 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/cli.js

@@ -53,7 +53,9 @@ import { activatePolicies, planPolicyActivation, scaffoldPolicyActivation } from
 import { applyPolicyLibraryUpgrade, assessPolicyLibraryUpgrades } from "./policy-library.js";
 import { buildAgentProgramPath } from "./program-path.js";
 import { assessEvidenceMap, assessProgramReadiness } from "./program-readiness.js";
+import { planProgramAmendment } from "./program-amendment.js";
 import { resolveProgram } from "./program.js";
+import { resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { applyReconciliation, planReconciliation } from "./reconciliation.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { effectiveResourceStatus } from "./resource-status.js";
@@ -462,6 +464,46 @@ export async function runCli(argv = process.argv.slice(2)) {
     if (flags["require-ready"] && !result.evidenceReady) process.exitCode = 2;
     return output;
   }
+  if (command === "program-amendment") {
+    const sourceResourceId = flags.source || positionals[0];
+    if (!sourceResourceId) throw new Error("Pass a source resource ID or --source resource-id.");
+    const result = await planProgramAmendment(root, { sourceResourceId });
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else {
+      console.log(`Program amendment review for ${result.source.title}`);
+      for (const [type, ids] of Object.entries(result.byResourceType)) console.log(`${type}\t${ids.join(",")}`);
+      for (const work of result.reviewWork) {
+        console.log(`REVIEW\t${work.resourceType}\t${work.resourceIds?.length ? work.resourceIds.join(",") + "\t" : ""}${work.message}`);
+      }
+    }
+    return result;
+  }
+  if (command === "review-bindings") {
+    const resourceId = positionals[0];
+    if (!resourceId) throw new Error("Pass a Retention Schedule Item or Requirement Mapping ID.");
+    const loaded = await loadWorkspace(root);
+    const record = loaded.resources.find(({ id }) => id === resourceId);
+    if (!record) throw new Error(`Resource "${resourceId}" was not found.`);
+    const dependencyIds = record.type === "retention-schedule-item"
+      ? retentionReviewResourceIds(record, loaded)
+      : record.type === "requirement-mapping"
+        ? [...new Set([...(record.sourceResourceIds || []), ...(record.targetResourceIds || [])])]
+        : null;
+    if (!dependencyIds) throw new Error("Review bindings are available for Retention Schedule Items and Requirement Mappings.");
+    const revisions = await resourceReviewRevisions(loaded, dependencyIds);
+    const result = {
+      resource: { type: record.type, id: record.id, title: record.title },
+      dependencyIds,
+      reviewedSourceRevisions: Object.fromEntries(revisions),
+      missingResourceIds: dependencyIds.filter((id) => !revisions.has(id))
+    };
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else {
+      console.log(`Review bindings for ${record.title}`);
+      for (const id of dependencyIds) console.log(`${revisions.has(id) ? "READY" : "MISSING"}\t${id}\t${revisions.get(id) || ""}`);
+    }
+    return result;
+  }
   if (command === "evidence-map") {
     const loaded = await loadWorkspace(root);
     const result = await assessEvidenceMap(loaded, { asOf: flags["as-of"], programId: flags.program });
@@ -1135,6 +1177,8 @@ Usage:
   filegrc search <query> [--type resource-type] [--json]
   filegrc obligations [--as-of YYYY-MM-DD] [--from YYYY-MM-DD] [--through YYYY-MM-DD] [--now RFC3339] [--complete] [--json]
   filegrc program-readiness [--as-of YYYY-MM-DD] [--require-ready] [--summary] [--json]
+  filegrc program-amendment <source-resource-id> [--json]
+  filegrc review-bindings <retention-or-mapping-id> [--json]
   filegrc evidence-map [--as-of YYYY-MM-DD] [--json]
   filegrc audit-readiness [audit-id] [--as-of YYYY-MM-DD] [--require-ready] [--json]
   filegrc prepare-audit <audit-id> [--json]
@@ -1222,7 +1266,8 @@ the repository Workspace, management Program, bounded Systems, operational Compo
 specific Assets, Vendors, normalized information, and Evidence Artifacts. Model v5 separates
 Document approval from activation and records program-versus-engagement scope. Model v6 gives
 Training the same approval and activation split and moves its schedule into Obligations. Model v7
-keeps issued historical Documents neutral and requires a current activation for legacy Training. v3 migration
+keeps issued historical Documents neutral and requires a current activation for legacy Training. Model v8
+adds structured retention schedule items, reviewed requirement mappings, source-linked Commitments, and custom obligations. v3 migration
 previews may require a decisions JSON file for ambiguous old Systems. v3 still creates planned
 core Appointments, removal of obsolete manual page state, classified review work,
 and dataModelVersion changed last. The command writes no Git commit.
@@ -1261,6 +1306,24 @@ Options:
   --help             Show this help`);
     return;
   }
+  if (command === "program-amendment") {
+    console.log(`Usage:
+  filegrc program-amendment <source-resource-id> [--json]
+
+Trace a Policy, Document, Framework, Requirement, or Commitment through its
+Commitments, mappings, Controls, Obligations, and retention rules. The command
+only reports review work. It does not infer or write management decisions.`);
+    return;
+  }
+  if (command === "review-bindings") {
+    console.log(`Usage:
+  filegrc review-bindings <retention-or-mapping-id> [--json]
+
+Calculate the exact current source revisions required by an active Retention
+Schedule Item or Requirement Mapping. Copy reviewedSourceRevisions into the
+record only after management completes the review.`);
+    return;
+  }
   if (command === "workflow") {
     console.log(`Usage:
   filegrc workflow [audit-id] [options]
@@ -1432,6 +1495,8 @@ function agentOverview(model) {
     search: "filegrc search <query> --json",
     obligations: "filegrc obligations --json",
     programReadiness: "filegrc program-readiness --json",
+    programAmendment: "filegrc program-amendment <source-resource-id> --json",
+    reviewBindings: "filegrc review-bindings <retention-or-mapping-id> --json",
     evidenceMap: "filegrc evidence-map --json",
     auditReadiness: "filegrc audit-readiness <audit-id> --json",
     prepareAudit: "filegrc prepare-audit <audit-id>",

package/src/collection-scope.js

@@ -131,6 +131,13 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
       addIds((record.informationUses || []).map(({ informationTypeId }) => informationTypeId));
     }
   }
+  if (resourceType === "information-type" && !legacy) {
+    addIds(program?.systemIds);
+    addIds(programComponents(loaded, program || {}).map(({ id }) => id));
+    addIds(loaded.resources
+      .filter((record) => record.type === "vendor" && record.status !== "retired")
+      .map(({ id }) => id));
+  }
   if (resourceType === "complementary-control") {
     addIds(program?.systemIds);
     addIds(program?.controlIds);
@@ -229,6 +236,11 @@ const dependencyFields = {
     classification: ["id", "type", "status", "rank", "description", "handlingRequirements"],
     "information-type": ["id", "type", "status", "classificationId", "description"]
   },
+  "information-type": {
+    system: ["id", "type", "status", "informationTypeIds"],
+    component: ["id", "type", "status", "systemUses", "informationUses"],
+    vendor: ["id", "type", "status", "informationTypeIds"]
+  },
   "complementary-control": {
     system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
     control: ["id", "type", "status", "statement", "activity", "systemIds", "componentIds", "evidenceSourceComponentIds"],

package/src/git.js

@@ -390,8 +390,8 @@ function unavailableSnapshot(error, extra = {}) {
 }
 
 export async function getBrowserRepositoryState(input = process.cwd(), options = {}) {
-  const root = resolveWorkspaceRoot(input);
-  const config = await getRepositoryConfig(root);
+  const root = input?.entries && input?.root ? input.root : resolveWorkspaceRoot(input);
+  const config = await getRepositoryConfig(input);
   const gitSummary = options.repositorySnapshot ?? await getRepositorySnapshot(root);
   if (config.mode !== "trunk") {
     return {
@@ -852,8 +852,8 @@ function syncReadySummary(root, action) {
   return summary;
 }
 
-async function getRepositoryConfig(root) {
-  const loaded = await loadWorkspace(root);
+async function getRepositoryConfig(input) {
+  const loaded = input?.entries && input?.root ? input : await loadWorkspace(input);
   const renderer = loaded.resources.find(({ type, id }) => type === "renderer-settings" && id === "renderer-settings");
   const mode = renderer?.repositoryMode;
   const authoritativeBranch = cleanGitName(renderer?.authoritativeBranch);

package/src/index.js

@@ -82,6 +82,7 @@ export {
   setupExternalReviewerGovernance
 } from "./external-reviewer.js";
 export { assessEvidenceMap, assessProgramReadiness } from "./program-readiness.js";
+export { planProgramAmendment } from "./program-amendment.js";
 export {
   buildAgentProgramPath,
   PROGRAM_PATH,
@@ -99,6 +100,8 @@ export {
 export { searchResources, searchableValues } from "./search.js";
 export { effectiveResourceStatus } from "./resource-status.js";
 export { applyReconciliation, planReconciliation } from "./reconciliation.js";
+export { assessRequirementMappingReadiness } from "./requirement-mapping.js";
+export { assessRetentionReadiness, nearDuplicateInformationTypes, resourceReviewRevision, resourceReviewRevisions, retentionReviewResourceIds, retentionRuleIsCurrent, retentionUses } from "./retention.js";
 export { createFilegrcServer, serveWorkspace } from "./server.js";
 export { normalizeSetupPayload, planWorkspaceSetup, setupWorkspace, summarizeSetupResult } from "./setup.js";
 export { createAppState, createResourceDetail } from "./state.js";

package/src/model-migration.js

@@ -896,9 +896,10 @@ export async function planModelMigration(input = process.cwd(), options = {}) {
     : sourceVersion === "1" ? V1_TARGET_MODEL_VERSION
       : sourceVersion === "2" ? "3"
         : sourceVersion === "3" ? "4"
-          : sourceVersion === "4" ? "5"
-            : sourceVersion === "5" ? "6"
-              : ACTIVE_MODEL_VERSION;
+            : sourceVersion === "4" ? "5"
+              : sourceVersion === "5" ? "6"
+                : sourceVersion === "6" ? "7"
+                  : ACTIVE_MODEL_VERSION;
   if (sourceVersion === requestedTarget) return emptyPlan(sourceVersion, requestedTarget);
   if (sourceVersion === "1" && requestedTarget === "2") {
     return planV1ToV2Migration(input, options);
@@ -915,9 +916,12 @@ export async function planModelMigration(input = process.cwd(), options = {}) {
   if (sourceVersion === "5" && requestedTarget === "6") {
     return planV5ToV6Migration(loaded);
   }
-  if (sourceVersion === "6" && requestedTarget === ACTIVE_MODEL_VERSION) {
+  if (sourceVersion === "6" && requestedTarget === "7") {
     return planV6ToV7Migration(loaded);
   }
+  if (sourceVersion === "7" && requestedTarget === ACTIVE_MODEL_VERSION) {
+    return planV7ToV8Migration(loaded);
+  }
   if (sourceVersion === "1" && requestedTarget === ACTIVE_MODEL_VERSION) {
     throw new Error(
       "Model v1 workspaces must migrate to model v2 first. "
@@ -2034,6 +2038,158 @@ async function planV6ToV7Migration(loaded) {
   };
 }
 
+async function planV7ToV8Migration(loaded) {
+  if (!loaded.workspace?.id) throw new Error("Model migration requires a valid Workspace record.");
+  const targetModel = loadModel("8");
+  const revisions = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
+  const automatic = [];
+  const reviewRequired = [];
+  const unsupported = [];
+  const missing = [];
+  const manualActions = [];
+  const updates = [];
+
+  for (const original of loaded.resources) {
+    const record = structuredClone(original);
+    let changed = false;
+    if (original.type === "workspace") {
+      record.dataModelVersion = "8";
+      changed = true;
+      automatic.push(classifiedChange("automatic", original.id, "dataModelVersion", "Select model v8."));
+    }
+    if (original.type === "component" && Array.isArray(original.informationUses)) {
+      record.informationUses = original.informationUses.map((use) => {
+        if (!Array.isArray(use.activities)) return use;
+        const migrated = { ...use, processingOperations: use.activities };
+        delete migrated.activities;
+        return migrated;
+      });
+      changed = true;
+      automatic.push(classifiedChange(
+        "automatic",
+        original.id,
+        "informationUses",
+        "Rename information-use activities to the standard processingOperations term without changing the recorded values."
+      ));
+    }
+    if (original.type === "commitment" && Array.isArray(original.sourceDocumentIds)) {
+      record.sourceResourceIds = [...new Set([
+        ...(record.sourceResourceIds || []),
+        ...original.sourceDocumentIds
+      ])];
+      delete record.sourceDocumentIds;
+      changed = true;
+      automatic.push(classifiedChange(
+        "automatic",
+        original.id,
+        "sourceResourceIds",
+        "Preserve source Document links in the broader source-resource relationship."
+      ));
+    }
+    if (original.type === "source-coverage" && typeof original.retention === "string") {
+      record.retentionNotes = original.retention;
+      delete record.retention;
+      changed = true;
+      automatic.push(classifiedChange(
+        "automatic",
+        original.id,
+        "retentionNotes",
+        "Preserve the prior narrative retention statement as notes without treating it as an approved schedule rule."
+      ));
+    }
+    if (original.type === "audit" && typeof original.retentionDecision === "string") {
+      record.retentionNotes = original.retentionDecision;
+      delete record.retentionDecision;
+      changed = true;
+      automatic.push(classifiedChange(
+        "automatic",
+        original.id,
+        "retentionNotes",
+        "Preserve the prior audit retention decision as notes without inferring a structured retention rule."
+      ));
+    }
+    if (changed) updates.push(record);
+  }
+
+  for (const record of loaded.resources) {
+    if (record.type === "source-coverage" && record.status === "active") {
+      reviewRequired.push(classifiedChange(
+        "review-required",
+        record.id,
+        "retentionScheduleItemIds",
+        "Management must select or create an approved retention schedule item for this source coverage."
+      ));
+    }
+    if (record.type === "component" && record.informationUses?.length) {
+      reviewRequired.push(classifiedChange(
+        "review-required",
+        record.id,
+        "informationUses",
+        "Review every Information Type use against the structured retention schedule."
+      ));
+    }
+    if (["system", "vendor"].includes(record.type) && record.informationTypeIds?.length) {
+      reviewRequired.push(classifiedChange(
+        "review-required",
+        record.id,
+        "informationTypeIds",
+        `Review every Information Type used by this ${record.type === "system" ? "System" : "Vendor"} against the structured retention schedule.`
+      ));
+    }
+  }
+
+  const updatedById = new Map(updates.map((record) => [record.id, record]));
+  const migratedRecords = loaded.resources.map((record) => updatedById.get(record.id) || record);
+  await collectTargetValidationActions(loaded, migratedRecords, targetModel, missing, manualActions);
+  for (const item of [...missing, ...manualActions]) {
+    unsupported.push(classifiedChange(
+      "unsupported",
+      item.resourceId,
+      item.field,
+      item.message || `Resolve ${item.field} before applying the model v8 migration.`
+    ));
+  }
+  const ready = unsupported.length === 0;
+  return {
+    schemaVersion: 2,
+    sourceModelVersion: "7",
+    targetModelVersion: "8",
+    ready,
+    missing,
+    conflicts: [],
+    manualActions,
+    classifications: { automatic, reviewRequired, unsupported },
+    notes: [
+      "The migration never chooses a retention period, cutoff, or disposition action.",
+      "Review-required items remain visible after migration through program readiness."
+    ],
+    migrationReport: {},
+    summary: {
+      create: 0,
+      update: updates.length,
+      automatic: automatic.length,
+      reviewRequired: reviewRequired.length,
+      unsupported: unsupported.length
+    },
+    fileDiff: {
+      create: [],
+      update: updates.map((record) => ({
+        type: record.type,
+        id: record.id,
+        before: loaded.resources.find(({ id }) => id === record.id),
+        after: record
+      }))
+    },
+    changes: {
+      create: [],
+      update: updates,
+      expectedRevisions: Object.fromEntries(updates.map(({ id }) => [id, revisions.get(id)])),
+      validateWholeWorkspace: true,
+      targetModelVersion: "8"
+    }
+  };
+}
+
 function normalizeDocumentScopeDecision(value) {
   const candidate = typeof value === "object" && value
     ? value.workflowScope || value.scope

package/src/obligations.js

@@ -78,7 +78,7 @@ export function planObligations(resources, options = {}) {
   };
 
   for (const obligation of obligations) {
-    const activity = obligationActivity(model, obligation.activityType);
+    const activity = obligationActivity(model, obligation);
     const expectedCompletionTypes = activity.completionResourceTypes;
     const programStatus = obligationProgramStatus(obligation, byId, asOf, model);
     if (obligation.recurrence?.mode === "event" && obligation.recurrence.eventType) {
@@ -348,7 +348,7 @@ export async function scaffoldObligationCompletion(input, options = {}) {
   const item = action
     ? plannedActionForScaffold(loaded, action, completedOn)
     : plannedOccurrenceForScaffold(loaded, obligation, options.windowStart, completedOn);
-  const activity = obligationActivity(loaded.model, obligation.activityType);
+  const activity = obligationActivity(loaded.model, obligation);
   const type = item.completionType || preferredCompletionType(activity, {
     ...obligation,
     subjectResourceIds: item.subjectResourceIds || []
@@ -462,7 +462,7 @@ function assertExpectedCompletionType(obligation, record, model) {
   if (!record || typeof record !== "object" || Array.isArray(record)) {
     throw new Error("A completion resource record is required.");
   }
-  const expected = obligationActivity(model, obligation.activityType).completionResourceTypes;
+  const expected = obligationActivity(model, obligation).completionResourceTypes;
   if (expected.length && !expected.includes(record.type)) {
     throw new Error(
       `Obligation "${obligation.id}" expects a completion resource of type ${expected.join(" or ")}, not "${record.type ?? ""}".`
@@ -842,13 +842,13 @@ function planEventRun(event, actionItems, byId, asOf, now, model) {
     .map((record) => {
       const obligation = byId.get(record.obligationId);
       const expectedCompletionTypes = obligation?.type === "obligation"
-        ? obligationActivity(model, obligation.activityType).completionResourceTypes
+        ? obligationActivity(model, obligation).completionResourceTypes
         : [];
       const completionProfile = obligation?.type === "obligation"
-        ? obligationActivity(model, obligation.activityType).completionProfile || null
+        ? obligationActivity(model, obligation).completionProfile || null
         : null;
       const completionType = obligation?.type === "obligation"
-        ? preferredCompletionType(obligationActivity(model, obligation.activityType), {
+        ? preferredCompletionType(obligationActivity(model, obligation), {
             ...obligation,
             subjectResourceIds: event.subjectResourceIds || []
           }, byId)
@@ -1135,17 +1135,23 @@ function comparePlannedItems(a, b) {
 function eventActionDescription(obligation, eventType, model) {
   const policy = obligation.policyIds?.length ? ` Policy sources: ${obligation.policyIds.join(", ")}.` : "";
   const scope = obligation.scopeResourceIds?.length ? ` Review scoped resources: ${obligation.scopeResourceIds.join(", ")}.` : "";
-  const expected = obligationActivity(model, obligation.activityType).completionResourceTypes;
+  const expected = obligationActivity(model, obligation).completionResourceTypes;
   const completion = expected.length
     ? ` Link completion records of type ${expected.join(", ")} and any evidence before marking this done.`
     : " Link the completion record and evidence before marking this done.";
   return `Triggered by ${eventType}.${policy}${scope}${completion}`;
 }
 
-function obligationActivity(model, activityType) {
+function obligationActivity(model, obligation) {
+  const activityType = typeof obligation === "string" ? obligation : obligation?.activityType;
   const activity = model.obligationActivities?.[activityType];
   if (!activity) throw new Error(`Unknown obligation activity type "${activityType ?? ""}".`);
-  return activity;
+  if (activityType !== "custom") return activity;
+  return {
+    ...activity,
+    ...(obligation?.customActivity || {}),
+    completionType: obligation?.customActivity?.completionResourceTypes?.[0] || activity.completionType
+  };
 }
 
 function requireDate(value, label) {

package/src/policy-library/data-retention-schedule-v2.md

@@ -0,0 +1,25 @@
+# Data Retention Schedule
+
+## Use
+
+This schedule records how long {{company_name}} keeps important record classes and what happens when each period ends. The policy owner and data owners must complete the organization-specific rows before approval.
+
+Retention periods may come from law, contract, tax, audit, security, or a documented business need. Use the longest applicable period, but do not keep data indefinitely without a reason.
+
+## Schedule
+
+The structured Retention Schedule Items linked to this document are its schedule rows. Each approved item must name the covered Information Types and operational scope, owner, cutoff, period, disposition action, instructions, and authority. Planned items are review prompts and are not approved retention behavior.
+
+Management must cover important information used by Systems, Components, and Vendors, including security logs, backups or alternate recovery copies, governance records, audit evidence, customer and service records, and incident records when those classes exist. No starter period or disposition action is an approved organization value.
+
+## Holds and exceptions
+
+An approved legal hold, investigation, or preservation duty suspends normal deletion for the affected records. Record the authority, scope, owner, start date, and release decision in controlled legal-hold records.
+
+Any retention exception needs a reason, owner, approval, compensating safeguards, and expiration or next review date.
+
+## Review and disposal evidence
+
+Review this schedule at least annually and within 30 days after a material change to systems, data use, vendors, contracts, or applicable duties. The approver must be separate from the owner.
+
+For material disposal work, retain a record of the record class, source, date range, method, completion date, responsible person, exceptions, and verification.

package/src/policy-library.js

@@ -42,14 +42,18 @@ const DOCUMENT_CONTENT_UPDATES = [
     id: "document-data-retention-schedule",
     path: "documents/document-data-retention-schedule.md",
     priorRevision: "45a408e8139bd57f42dda5ca5ae5c8cd4480b4e7bf08834f60058148a3a63475",
-    additionalPriorRevisions: new Set(["d80b99ce53d1012cc169bbbc2afab8d0597bfbe9f30ac0812a8d5bbeb2ed9f90"]),
-    currentRevision: "dd11857ae7d881f176bd93947ef3031c33c75ee41e3c0435198fd60c67a94cf7",
+    additionalPriorRevisions: new Set([
+      "d80b99ce53d1012cc169bbbc2afab8d0597bfbe9f30ac0812a8d5bbeb2ed9f90",
+      "dd11857ae7d881f176bd93947ef3031c33c75ee41e3c0435198fd60c67a94cf7"
+    ]),
+    currentRevision: "4a48c15a4e20e4f29028cf2ff8597315eb51878814120125b5268356b923c9db",
+    currentSourcePath: "./policy-library/data-retention-schedule-v2.md",
     replacements: [
       ["FileGRC detects the bracketed prompts as approval blockers. Remove each prompt only after replacing it with a reviewed fact.", "Remove each bracketed prompt only after replacing it with a reviewed fact."],
       ["Record the authority, scope, owner, start date, and release decision outside this public template.", "Record the authority, scope, owner, start date, and release decision in controlled legal-hold records."],
       ["| Production backups or alternate recovery copies | [Complete before approval: Systems or Components] | [Complete before approval: owner] | Backup or recovery-copy creation | [Confirm or replace proposed default before approval: 30 days, adjusted to approved System recovery objectives] | [Complete before approval: expiration or disposal action] | [Complete before approval: continuity objective or risk decision] |", "| Production backups or alternate recovery copies | [Complete before approval: Systems or Components] | [Complete before approval: owner] | Backup or recovery-copy creation | [Confirm or replace proposed default before approval: 30 days, adjusted to approved System recovery needs] | [Complete before approval: expiration or disposal action] | [Complete before approval: recovery need, commitment, or risk decision] |"]
     ],
-    summary: "Keep FileGRC prompt handling in document guidance, make the Retention Schedule standalone, and avoid assuming numeric recovery objectives."
+    summary: "Move schedule rows into structured records and keep organization-specific periods and disposition choices under management review."
   },
   {
     id: "document-security-incident-recovery-plan",
@@ -592,31 +596,51 @@ async function buildPolicyLibraryPlan(loaded) {
     }
     if (sourceRevision === documentUpdate.currentRevision) {
       skipped.push(skippedItem(documentUpdate.id, "current", "The governed Document already contains the current standalone starter language."));
-      continue;
-    }
-    if (sourceRevision !== documentUpdate.priorRevision
+    } else if (sourceRevision !== documentUpdate.priorRevision
       && !documentUpdate.additionalPriorRevisions?.has(sourceRevision)) {
       skipped.push(skippedItem(documentUpdate.id, "customized", "The governed Document differs from the recognized prior starter, so FileGRC will not rewrite it."));
-      continue;
+    } else {
+      const nextSource = documentUpdate.currentSourcePath
+        ? materializeDocument(
+            await readFile(new URL(documentUpdate.currentSourcePath, import.meta.url), "utf8"),
+            loaded.workspace?.organizationName
+          )
+        : documentUpdate.replacements.reduce((current, [prior, next]) => current.replace(prior, next), source);
+      if (normalizedDocumentRevision(nextSource, loaded.workspace?.organizationName) !== documentUpdate.currentRevision) {
+        throw new Error(`The ${documentUpdate.id} starter update does not produce the current governed Document.`);
+      }
+      proposalChanges.push({
+        resourceType: "document",
+        resourceId: documentUpdate.id,
+        path: displayPath,
+        summary: documentUpdate.summary,
+        diff: fullReplacementDiff(displayPath, source, nextSource)
+      });
+      contentUpdates[documentUpdate.id] = { content: nextSource };
+      expectedContentRevisions[documentUpdate.id] = {
+        [documentUpdate.path]: rawSourceRevision
+      };
     }
-    const nextSource = documentUpdate.replacements.reduce(
-      (current, [prior, next]) => current.replace(prior, next),
-      source
-    );
-    if (normalizedDocumentRevision(nextSource, loaded.workspace?.organizationName) !== documentUpdate.currentRevision) {
-      throw new Error(`The ${documentUpdate.id} starter update does not produce the current governed Document.`);
+    if (documentUpdate.id === "document-data-retention-schedule") {
+      const expectedControlIds = ["control-logging-monitoring", "control-backup-restoration"];
+      const requiredControlIds = expectedControlIds.filter((id) => byId.get(id)?.record.type === "control");
+      for (const id of expectedControlIds.filter((id) => !requiredControlIds.includes(id))) {
+        skipped.push(skippedItem(id, "missing", `The starter ${id} Control is not present, so FileGRC did not add a dangling schedule relationship.`));
+      }
+      const nextControlIds = [...new Set([...(entry.record.controlIds || []), ...requiredControlIds])];
+      if (!sameValue(entry.record.controlIds || [], nextControlIds)) {
+        updates.push({ ...entry.record, controlIds: nextControlIds });
+        expectedRevisions[entry.record.id] = entry.revision;
+        const jsonPath = "data/documents/document-data-retention-schedule.json";
+        proposalChanges.push({
+          resourceType: "document",
+          resourceId: entry.record.id,
+          path: jsonPath,
+          summary: "Link the schedule to logging and backup Controls while preserving existing Control relationships.",
+          diff: replacementDiff(jsonPath, [["controlIds", entry.record.controlIds || [], nextControlIds]])
+        });
+      }
     }
-    proposalChanges.push({
-      resourceType: "document",
-      resourceId: documentUpdate.id,
-      path: displayPath,
-      summary: documentUpdate.summary,
-      diff: fullReplacementDiff(displayPath, source, nextSource)
-    });
-    contentUpdates[documentUpdate.id] = { content: nextSource };
-    expectedContentRevisions[documentUpdate.id] = {
-      [documentUpdate.path]: rawSourceRevision
-    };
   }
 
   for (const controlUpdate of CONTROL_UPDATES) {
@@ -816,6 +840,10 @@ function materializePolicy(source, organizationName, securityContact) {
     .replaceAll("{{security_contact_email}}", securityContact || "security@example.com");
 }
 
+function materializeDocument(source, organizationName) {
+  return source.replaceAll("{{company_name}}", organizationName || "Organization");
+}
+
 function securityContactFromPolicy(source) {
   return source.match(/through the primary route at ([^\r\n]+?) or the usable alternate route documented/)?.[1];
 }