filegrc 0.12.1 → 0.12.2

package/model/v10.json

@@ -7485,6 +7485,71 @@
         "coverage"
       ]
     },
+    "reconciliation-dismissal": {
+      "title": "Reconciliation dismissal",
+      "pluralTitle": "Reconciliation dismissals",
+      "group": "repository",
+      "collection": "reconciliation-dismissals",
+      "description": "A reviewed decision that one exact Git transition candidate is a false positive and does not represent a real policy event.",
+      "guidance": {
+        "policyBasis": "Direct file changes can resemble real operational events. This record preserves the reviewer, date, rationale, and exact candidate fingerprint when management confirms that no event occurred.",
+        "cadence": "Create only from a current reconciliation candidate. A later change produces a different fingerprint and requires its own review."
+      },
+      "required": [
+        "transitionFingerprint",
+        "eventType",
+        "subjectResourceId",
+        "reviewedByIds",
+        "reviewedOn",
+        "rationale"
+      ],
+      "fields": {
+        "transitionFingerprint": {
+          "type": "string",
+          "label": "Transition fingerprint"
+        },
+        "eventType": {
+          "type": "string",
+          "label": "Candidate event type",
+          "filter": true
+        },
+        "subjectResourceId": {
+          "type": "id",
+          "relationGroup": "event-subject",
+          "label": "Candidate subject"
+        },
+        "reviewedByIds": {
+          "type": "array",
+          "items": "id",
+          "relation": [
+            "person"
+          ],
+          "label": "Reviewed by"
+        },
+        "reviewedOn": {
+          "type": "date",
+          "label": "Reviewed on"
+        },
+        "rationale": {
+          "type": "string",
+          "search": true
+        }
+      },
+      "listFields": [
+        "title",
+        "eventType",
+        "subjectResourceId",
+        "reviewedOn"
+      ],
+      "formFields": [
+        "transitionFingerprint",
+        "eventType",
+        "subjectResourceId",
+        "reviewedByIds",
+        "reviewedOn",
+        "rationale"
+      ]
+    },
     "collection-review": {
       "title": "Collection review",
       "pluralTitle": "Collection reviews",
@@ -9516,7 +9581,8 @@
       "vendor",
       "access-grant",
       "vulnerability",
-      "incident"
+      "incident",
+      "exception"
     ],
     "evidence-source-record": [
       "appointment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/cli.js

@@ -68,7 +68,7 @@ import {
 import { planProgramAmendment } from "./program-amendment.js";
 import { resolveProgram } from "./program.js";
 import { resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
-import { applyReconciliation, planReconciliation } from "./reconciliation.js";
+import { applyReconciliation, dismissReconciliation, planReconciliation } from "./reconciliation.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { effectiveResourceStatus } from "./resource-status.js";
 import { searchResources } from "./search.js";
@@ -617,7 +617,17 @@ export async function runCli(argv = process.argv.slice(2)) {
     return result;
   }
   if (command === "reconcile") {
-    const result = flags.apply
+    if (flags.apply && flags.dismiss) throw new Error("Choose either --apply or --dismiss for one reconciliation candidate.");
+    const result = flags.dismiss
+      ? await withWorkflowDelta(root, () => dismissReconciliation(root, {
+        candidateId: flags.candidate,
+        transitionFingerprint: flags.candidate,
+        reviewedById: flags.reviewer,
+        reviewedOn: flags["reviewed-on"],
+        rationale: flags.rationale,
+        confirmed: flags.yes === true
+      }))
+      : flags.apply
       ? await withWorkflowDelta(root, () => applyReconciliation(root, {
         candidateId: flags.candidate,
         transitionFingerprint: flags.candidate,
@@ -630,7 +640,9 @@ export async function runCli(argv = process.argv.slice(2)) {
       }))
       : await planReconciliation(root);
     if (flags.json) console.log(JSON.stringify(result, null, 2));
-    else if (flags.apply) {
+    else if (flags.dismiss) {
+      console.log(`Dismissed ${result.candidate.eventType}: recorded ${result.dismissal.id}.`);
+    } else if (flags.apply) {
       console.log(`Reconciled ${result.candidate.eventType}: created ${result.event.id} and ${result.actions.length} linked tasks.`);
     } else if (!result.candidates.length) {
       console.log("No direct-file transitions need confirmation.");
@@ -1328,7 +1340,7 @@ Usage:
   filegrc evidence-map [--as-of YYYY-MM-DD] [--json]
   filegrc audit-readiness [audit-id] [--as-of YYYY-MM-DD] [--require-ready] [--json]
   filegrc prepare-audit <audit-id> [--json]
-  filegrc reconcile [--preview|--apply --candidate fingerprint (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) --yes] [--program program-id] [--risk-level normal|high] [--json]
+  filegrc reconcile [--preview|--apply --candidate fingerprint (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) --yes|--dismiss --candidate fingerprint --reviewer person-id --reviewed-on YYYY-MM-DD --rationale text --yes] [--program program-id] [--risk-level normal|high] [--json]
   filegrc external-reviewer-setup --scaffold
   filegrc external-reviewer-setup <reviewer.json|-> [--preview|--yes] [--json]
   filegrc next-audit-cycle <prior-audit-id> [cycle.json|-] --start YYYY-MM-DD --end YYYY-MM-DD [--preview|--yes] [--json]

package/src/files.js

@@ -22,7 +22,8 @@ export const INTERNAL_WORKFLOW_CAPABILITIES = Object.freeze({
   collectionReviewReassessment: Symbol("collection-review-reassessment"),
   reportingRouteSetProposal: Symbol("reporting-route-set-proposal"),
   reportingRouteSetApproval: Symbol("reporting-route-set-approval"),
-  reportingRouteSetCancellation: Symbol("reporting-route-set-cancellation")
+  reportingRouteSetCancellation: Symbol("reporting-route-set-cancellation"),
+  reconciliationDismissal: Symbol("reconciliation-dismissal")
 });
 
 export async function createResource(input, record, options = {}) {
@@ -671,6 +672,9 @@ function assertImmutableWorkflowRecord(existing, next, options = {}, loaded = nu
   const preservesExisting = (allowed = []) => [...new Set([...Object.keys(existing), ...Object.keys(next)])].every((key) => (
     allowed.includes(key) || JSON.stringify(next[key]) === JSON.stringify(existing[key])
   ));
+  if (existing.type === "reconciliation-dismissal" && !preservesExisting()) {
+    throw new Error(`Reconciliation dismissal "${existing.id}" is immutable because it records a fingerprint-bound review decision.`);
+  }
   if (existing.type === "collection-review" && ["active", "retired"].includes(existing.status)) {
     const retirement = options.workflowCapability === INTERNAL_WORKFLOW_CAPABILITIES.collectionReviewReassessment
       && existing.status === "active"
@@ -908,6 +912,13 @@ function finalizedOccurrenceUsingProof(loaded, targetId) {
 }
 
 function assertSpecializedWorkflowCreate(record, options = {}, loaded = null) {
+  if (
+    record?.type === "reconciliation-dismissal"
+    && options.workflowCapability !== INTERNAL_WORKFLOW_CAPABILITIES.reconciliationDismissal
+    && options.lifecycleOperation !== "model-migration"
+  ) {
+    throw new Error(`Reconciliation dismissal "${record.id || ""}" is workflow-managed. Dismiss the current transition candidate instead of creating it directly.`);
+  }
   if (
     record?.type === "collection-review"
     && options.workflowCapability !== INTERNAL_WORKFLOW_CAPABILITIES.collectionReviewReassessment
@@ -984,7 +995,8 @@ async function deleteResourceUnlocked(input, type, id, options) {
   assertRevision(source, options.expectedRevision, "The record");
   const record = JSON.parse(source);
   if (
-    (record.type === "obligation-occurrence" && ["reconciled", "superseded"].includes(record.status))
+    record.type === "reconciliation-dismissal"
+    || (record.type === "obligation-occurrence" && ["reconciled", "superseded"].includes(record.status))
     || (record.type === "audit-population" && ["reconciled", "not-applicable", "superseded"].includes(record.status))
     || (record.type === "obligation-event" && ["complete", "canceled"].includes(record.status))
     || (record.type === "action-item" && record.obligationId && ["done", "canceled"].includes(record.status))

package/src/index.js

@@ -115,7 +115,7 @@ export {
 } from "./recurrence.js";
 export { searchResources, searchableValues } from "./search.js";
 export { effectiveResourceStatus } from "./resource-status.js";
-export { applyReconciliation, planReconciliation } from "./reconciliation.js";
+export { applyReconciliation, dismissReconciliation, planReconciliation } from "./reconciliation.js";
 export { assessRequirementMappingReadiness } from "./requirement-mapping.js";
 export { assessRetentionReadiness, nearDuplicateInformationTypes, resourceReviewRevision, resourceReviewRevisions, retentionReviewResourceIds, retentionRuleIsCurrent, retentionUses } from "./retention.js";
 export { createFilegrcServer, serveWorkspace } from "./server.js";

package/src/obligations.js

@@ -1856,7 +1856,7 @@ function obligationActivity(model, obligation) {
   };
 }
 
-function obligationRule(obligation, byId, options = {}) {
+export function obligationRule(obligation, byId, options = {}) {
   const proposedId = options.includeProposed
     ? [...(obligation.ruleIds || [])].reverse().find((id) => ["proposed", "approved"].includes(byId.get(id)?.status))
     : null;

package/src/reconciliation.js

@@ -2,11 +2,13 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { modelSupports } from "../model/index.js";
-import { createObligationEvent } from "./obligations.js";
+import { createObligationEvent, obligationRule } from "./obligations.js";
+import { createResource, INTERNAL_WORKFLOW_CAPABILITIES } from "./files.js";
 import { getDataRecordHistoryIndex, getFileAtRevision, runGitCommandSync } from "./git.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { loadWorkspace } from "./workspace.js";
 import { serializeWorkspaceMutation } from "./mutation.js";
+import { currentCalendarDate } from "./time.js";
 
 const TRANSITIONS = {
   person: [
@@ -94,7 +96,7 @@ const TRANSITIONS = {
   }]
 };
 
-export async function planReconciliation(input = process.cwd()) {
+export async function planReconciliation(input = process.cwd(), options = {}) {
   const loaded = input?.entries && input?.resources && input?.model
     ? input
     : await loadWorkspace(input);
@@ -134,11 +136,24 @@ export async function planReconciliation(input = process.cwd()) {
     ? recordsAtRevision(loaded.root, `${reconciliationHistory[0]}^`)
     : new Map();
   const historyIndex = getDataRecordHistoryIndex(loaded.root);
+  const committedRecordIds = new Set(historyIndex.historiesById.keys());
+  const eventRecordSnapshots = new Map();
+  const recordsForEvent = (event) => {
+    if (eventRecordSnapshots.has(event.id)) return eventRecordSnapshots.get(event.id);
+    const history = historyIndex.historiesById.get(event.id) || [];
+    const firstCommit = history.at(-1)?.commit;
+    const records = firstCommit
+      ? [...recordsAtRevision(loaded.root, firstCommit).values()].map(({ record }) => record)
+      : loaded.resources;
+    eventRecordSnapshots.set(event.id, records);
+    return records;
+  };
   const currentMarkdownOwners = new Map();
   for (const entry of loaded.entries) {
     for (const markdown of markdownEntries(loaded.model, entry.record)) currentMarkdownOwners.set(`data/${markdown.path}`, entry);
   }
-  const candidates = [];
+  const rawCandidates = [];
+  const filteredCandidates = [];
   const examined = new Set();
 
   for (const commit of reconciliationHistory) {
@@ -186,22 +201,27 @@ export async function planReconciliation(input = process.cwd()) {
       ].join("\n");
       for (const transition of TRANSITIONS[record.type] || []) {
         if (!transition.applies(previous, current, { markdownChanged })) continue;
-        if (committedEventHandled(loaded.root, commit, commitPaths, transition.eventType, record.id, historicalRecords)) continue;
-        const fingerprint = transitionFingerprint({
-          baseRevision: commit,
+        const fingerprintInput = {
+          baseRevision: parentRevision(loaded.root, commit),
           eventType: transition.eventType,
           subjectId: record.id,
           path: recordPath,
           beforeSource,
           currentSource,
           markdownChanged
+        };
+        const fingerprint = transitionFingerprint(fingerprintInput);
+        const legacyCommittedFingerprint = transitionFingerprint({ ...fingerprintInput, baseRevision: commit });
+        const legacyWorkingFingerprint = transitionFingerprint({
+          ...fingerprintInput,
+          beforeSource: [previous ? JSON.stringify(previous) : "", ...changedMarkdownPaths.map((changed) => (
+            readRevisionSource(loaded.root, `${commit}^`, changed)
+          ))].join("\n")
         });
         const eventId = `obligation-event-git-${fingerprint.slice(0, 16)}`;
-        if (loaded.resources.some((item) => (
-          item.type === "obligation-event"
-          && (item.id === eventId || item.transitionFingerprint === fingerprint)
-        ))) continue;
-        candidates.push(reconciliationCandidate(
+        const handledFingerprints = [fingerprint, legacyCommittedFingerprint, legacyWorkingFingerprint];
+        const handledEventIds = handledFingerprints.map((value) => `obligation-event-git-${value.slice(0, 16)}`);
+        const candidate = reconciliationCandidate(
           loaded,
           transition,
           record,
@@ -209,7 +229,16 @@ export async function planReconciliation(input = process.cwd()) {
           fingerprint,
           eventId,
           { committedRevision: commit }
-        ));
+        );
+        rawCandidates.push(candidate);
+        if (!transitionHandled(loaded.resources, handledEventIds, handledFingerprints, {
+          eventType: transition.eventType,
+          subjectId: record.id,
+          includeDismissed: options.includeDismissed,
+          committedRecordIds,
+          timezone: loaded.workspace.timezone,
+          recordsForEvent
+        })) filteredCandidates.push(candidate);
       }
     }
   }
@@ -241,10 +270,10 @@ export async function planReconciliation(input = process.cwd()) {
     }));
     const previousMarkdown = changedMarkdownPaths.map((changed) => readHeadSource(loaded.root, changed));
     const currentSource = [currentEntry?.source || "", ...currentMarkdown].join("\n");
-    const beforeSource = [previous ? JSON.stringify(previous) : "", ...previousMarkdown].join("\n");
+    const beforeSource = [readHeadSource(loaded.root, previousRecordPath), ...previousMarkdown].join("\n");
     for (const transition of TRANSITIONS[record.type] || []) {
       if (!transition.applies(previous, current, { markdownChanged })) continue;
-      const fingerprint = transitionFingerprint({
+      const fingerprintInput = {
         baseRevision,
         eventType: transition.eventType,
         subjectId: record.id,
@@ -252,24 +281,40 @@ export async function planReconciliation(input = process.cwd()) {
         beforeSource,
         currentSource,
         markdownChanged
+      };
+      const fingerprint = transitionFingerprint(fingerprintInput);
+      const legacyFingerprint = transitionFingerprint({
+        ...fingerprintInput,
+        beforeSource: [previous ? JSON.stringify(previous) : "", ...previousMarkdown].join("\n")
       });
       const eventId = `obligation-event-git-${fingerprint.slice(0, 16)}`;
-      if (loaded.resources.some((item) => (
-        item.type === "obligation-event"
-        && (
-          item.id === eventId
-          || item.transitionFingerprint === fingerprint
-        )
-      ))) continue;
-      candidates.push(reconciliationCandidate(loaded, transition, record, path, fingerprint, eventId));
+      const legacyEventId = `obligation-event-git-${legacyFingerprint.slice(0, 16)}`;
+      const candidate = reconciliationCandidate(loaded, transition, record, path, fingerprint, eventId);
+      rawCandidates.push(candidate);
+      if (!transitionHandled(loaded.resources, [eventId, legacyEventId], [fingerprint, legacyFingerprint], {
+        eventType: transition.eventType,
+        subjectId: record.id,
+        includeDismissed: options.includeDismissed,
+        committedRecordIds,
+        timezone: loaded.workspace.timezone,
+        recordsForEvent
+      })) filteredCandidates.push(candidate);
     }
   }
-  return {
+  const result = {
     contractVersion: 1,
     gitRevision: gitRevision(loaded.root),
     changedPaths,
-    candidates: candidates.sort((a, b) => a.id.localeCompare(b.id))
+    candidates: (options.includeHandled ? rawCandidates : filteredCandidates)
+      .sort((a, b) => a.id.localeCompare(b.id))
   };
+  if (options.includeHandled) {
+    Object.defineProperty(result, "filteredPlan", {
+      value: { ...result, candidates: filteredCandidates.sort((a, b) => a.id.localeCompare(b.id)) },
+      enumerable: false
+    });
+  }
+  return result;
 }
 
 function reconciliationCandidate(loaded, transition, record, path, fingerprint, eventId, extra = {}) {
@@ -341,30 +386,14 @@ function pairCommittedRecordRenames(root, commit, changes) {
   return [...changes.filter((change) => !paired.has(change)), ...replacements];
 }
 
-function committedEventHandled(root, commit, commitPaths, eventType, subjectId, historicalRecords) {
-  const requiredObligationIds = applicableEventObligationIds(
-    [...historicalRecords.values()].map(({ record }) => record),
-    eventType
-  );
-  return commitPaths.some((path) => {
-    if (!path.endsWith(".json")) return false;
-    const record = readRevisionRecord(root, commit, path);
-    const previous = readRevisionRecord(root, `${commit}^`, path);
-    return !previous
-      && record?.type === "obligation-event"
-      && record.eventType === eventType
-      && (record.subjectResourceIds || []).includes(subjectId)
-      && requiredObligationIds.every((id) => (record.obligationIds || []).includes(id));
-  });
-}
-
-function applicableEventObligationIds(records, eventType) {
+function applicableEventObligationIds(records, eventType, riskLevel, occurredAt) {
   const byId = new Map(records.map((record) => [record.id, record]));
   return records.filter((record) => {
     if (record.type !== "obligation" || record.status !== "active") return false;
-    const rule = byId.get(record.activeRuleId);
-    const schedule = rule?.type === "obligation-rule" && rule.status === "active" ? rule : record;
-    return schedule.recurrence?.mode === "event" && schedule.recurrence.eventType === eventType;
+    const schedule = obligationRule(record, byId, { now: occurredAt }) || record;
+    return schedule.recurrence?.mode === "event"
+      && schedule.recurrence.eventType === eventType
+      && (!Array.isArray(record.eventRiskLevels) || record.eventRiskLevels.includes(riskLevel));
   }).map(({ id }) => id);
 }
 
@@ -393,9 +422,7 @@ export async function applyReconciliation(input = process.cwd(), options = {}) {
   }
   return serializeWorkspaceMutation(input, async (root) => {
     const plan = await planReconciliation(root);
-    const candidate = plan.candidates.find(({ id, transitionFingerprint }) => (
-      id === options.candidateId || transitionFingerprint === options.transitionFingerprint
-    ));
+    const candidate = findCandidate(plan, options);
     if (!candidate) {
       throw new Error("The reconciliation candidate is missing or changed. Run reconcile --preview again.");
     }
@@ -417,6 +444,172 @@ export async function applyReconciliation(input = process.cwd(), options = {}) {
   });
 }
 
+export async function dismissReconciliation(input = process.cwd(), options = {}) {
+  if (options.confirmed !== true) {
+    throw new Error("Dismissing a reconciliation candidate records a review decision. Preview the candidate and confirm the write.");
+  }
+  return serializeWorkspaceMutation(input, async (root) => {
+    const plan = await planReconciliation(root);
+    const candidate = findCandidate(plan, options);
+    if (!candidate) {
+      throw new Error("The reconciliation candidate is missing or changed. Run reconcile --preview again.");
+    }
+    const loaded = await loadWorkspace(root);
+    if (!loaded.model.resources["reconciliation-dismissal"]) {
+      throw new Error("Reconciliation dismissals require data model v10 or newer.");
+    }
+    const reviewedById = String(options.reviewedById || "").trim();
+    const reviewedOn = String(options.reviewedOn || "").trim();
+    const rationale = String(options.rationale || "").trim();
+    if (!loaded.resources.some((record) => (
+      record.type === "person" && record.id === reviewedById && record.status === "active"
+    ))) {
+      throw new Error("An active Person ID is required as the dismissal reviewer.");
+    }
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(reviewedOn)) {
+      throw new Error("The dismissal review date must use YYYY-MM-DD.");
+    }
+    if (reviewedOn !== currentCalendarDate(loaded.workspace.timezone)) {
+      throw new Error("The dismissal review date must be the current date in the workspace timezone.");
+    }
+    if (!rationale) throw new Error("A rationale is required to dismiss a reconciliation candidate.");
+    const record = {
+      id: `reconciliation-dismissal-${candidate.transitionFingerprint}`,
+      type: "reconciliation-dismissal",
+      title: `Dismiss ${candidate.eventType} for ${candidate.subject.title}`,
+      transitionFingerprint: candidate.transitionFingerprint,
+      eventType: candidate.eventType,
+      subjectResourceId: candidate.subject.id,
+      reviewedByIds: [reviewedById],
+      reviewedOn,
+      rationale
+    };
+    const result = await createResource(root, record, {
+      workflowCapability: INTERNAL_WORKFLOW_CAPABILITIES.reconciliationDismissal
+    });
+    return { candidate, dismissal: result.record, path: result.path };
+  });
+}
+
+function transitionHandled(resources, eventIds, fingerprints, transition) {
+  return resources.some((item) => (
+    item.type === "obligation-event"
+      ? (() => {
+        if (!eventIds.includes(item.id) && !fingerprints.includes(item.transitionFingerprint)) return false;
+        const records = transition.recordsForEvent?.(item) || resources;
+        const event = records.find((record) => record.id === item.id) || item;
+        return (eventIds.includes(event.id) || fingerprints.includes(event.transitionFingerprint))
+          && obligationEventHandlesTransition(event, records, transition.eventType, transition.subjectId, resources);
+      })()
+      : !transition.includeDismissed && reconciliationDismissalMatches(item, {
+        transitionFingerprint: fingerprints[0],
+        eventType: transition.eventType,
+        subject: { id: transition.subjectId }
+      }, resources, {
+        requireActiveReviewer: !transition.committedRecordIds.has(item.id),
+        timezone: transition.timezone
+      })
+  ));
+}
+
+function obligationEventHandlesTransition(event, records, eventType, subjectId, currentRecords = records) {
+  if (event?.type !== "obligation-event" || event.eventType !== eventType || event.status === "canceled") return false;
+  if (!(event.subjectResourceIds || []).includes(subjectId)) return false;
+  const currentEvent = currentRecords.find((record) => record.id === event.id);
+  if (
+    currentEvent?.type !== "obligation-event"
+    || currentEvent.eventType !== eventType
+    || currentEvent.status === "canceled"
+    || !(currentEvent.subjectResourceIds || []).includes(subjectId)
+    || currentEvent.riskLevel !== event.riskLevel
+    || currentEvent.occurredOn !== event.occurredOn
+    || currentEvent.occurredAt !== event.occurredAt
+  ) return false;
+  const occurredAt = event.occurredAt || (event.occurredOn ? `${event.occurredOn}T23:59:59Z` : undefined);
+  const requiredObligationIds = applicableEventObligationIds(records, eventType, event.riskLevel, occurredAt);
+  if (!requiredObligationIds.length) return false;
+  return requiredObligationIds.every((obligationId) => {
+    const historicalAction = records.find((record) => (
+      record.type === "action-item"
+      && record.sourceResourceId === event.id
+      && record.obligationId === obligationId
+      && record.status !== "canceled"
+    ));
+    return (event.obligationIds || []).includes(obligationId)
+      && (currentEvent.obligationIds || []).includes(obligationId)
+      && historicalAction
+      && currentRecords.some((record) => (
+      record.type === "action-item"
+      && record.id === historicalAction.id
+      && record.sourceResourceId === event.id
+      && record.obligationId === obligationId
+      && record.status !== "canceled"
+      ));
+  });
+}
+
+export function reconciliationDismissalMatches(record, candidate, resources, options = {}) {
+  if (record?.type !== "reconciliation-dismissal") return false;
+  const reviewers = Array.isArray(record.reviewedByIds) ? record.reviewedByIds : [];
+  return record.id === `reconciliation-dismissal-${candidate.transitionFingerprint}`
+    && record.transitionFingerprint === candidate.transitionFingerprint
+    && record.eventType === candidate.eventType
+    && record.subjectResourceId === candidate.subject.id
+    && reviewers.length === 1
+    && resources.some((item) => (
+      item.type === "person"
+      && item.id === reviewers[0]
+      && (!options.requireActiveReviewer || item.status === "active")
+    ))
+    && /^\d{4}-\d{2}-\d{2}$/.test(record.reviewedOn || "")
+    && (!options.requireActiveReviewer
+      || record.reviewedOn === currentCalendarDate(options.timezone || "UTC"))
+    && typeof record.rationale === "string"
+    && Boolean(record.rationale.trim());
+}
+
+export async function validateReconciliationDismissals(loaded, diagnostics) {
+  const dismissals = loaded.entries.filter(({ record }) => record.type === "reconciliation-dismissal");
+  if (!dismissals.length) return;
+  const raw = await planReconciliation(loaded, { includeHandled: true });
+  const committedRecordIds = new Set(getDataRecordHistoryIndex(loaded.root).historiesById.keys());
+  const seen = new Set();
+  for (const entry of dismissals) {
+    const candidate = raw.candidates.find(({ transitionFingerprint }) => (
+      transitionFingerprint === entry.record.transitionFingerprint
+    ));
+    if (
+      !candidate
+      || seen.has(entry.record.transitionFingerprint)
+      || !reconciliationDismissalMatches(entry.record, candidate, loaded.resources, {
+        requireActiveReviewer: !committedRecordIds.has(entry.record.id),
+        timezone: loaded.workspace.timezone
+      })
+    ) {
+      diagnostics.push({
+        severity: "error",
+        code: "invalid-reconciliation-dismissal",
+        path: `data/${entry.relativePath}`,
+        message: `Reconciliation dismissal "${entry.record.id}" must bind one current raw transition candidate to its exact fingerprint, event type, subject, and one active Person reviewer.`
+      });
+    }
+    seen.add(entry.record.transitionFingerprint);
+  }
+  return raw;
+}
+
+function parentRevision(root, commit) {
+  return runGit(root, ["rev-parse", `${commit}^`]) || commit;
+}
+
+function findCandidate(plan, options) {
+  return plan.candidates.find(({ id, transitionFingerprint }) => (
+    id === options.candidateId
+    || transitionFingerprint === options.candidateId
+    || transitionFingerprint === options.transitionFingerprint
+  ));
+}
+
 function gitChangedEntries(root) {
   const tracked = parseNameStatus(runGit(root, ["diff", "--name-status", "-M", "HEAD", "--", "data"]));
   const untracked = lines(runGit(root, ["ls-files", "--others", "--exclude-standard", "--", "data"]))

package/src/server.js

@@ -57,7 +57,7 @@ import {
 } from "./external-reviewer.js";
 import { isWithin, relativeToWorkspace, resolveWorkspacePath } from "./paths.js";
 import { activatePolicies } from "./policy-activation.js";
-import { applyReconciliation, planReconciliation } from "./reconciliation.js";
+import { applyReconciliation, dismissReconciliation, planReconciliation } from "./reconciliation.js";
 import { resourceReviewRevisions } from "./retention.js";
 import { createAppBootstrap, createAppState, createAppStateSection, createResourceDetail } from "./state.js";
 import { setupWorkspace } from "./setup.js";
@@ -190,6 +190,15 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
           confirmed: payload.confirmed === true
         })));
       }
+      if (request.method === "POST" && url.pathname === "/api/reconciliation/dismissal") {
+        const payload = await readJson(request);
+        return json(response, 201, await browserMutation(input, requestOptions, {
+          message: (result) => `Dismiss Git transition candidate: ${result.candidate?.eventType || payload.candidateId}`
+        }, () => dismissReconciliation(input, {
+          ...payload,
+          confirmed: payload.confirmed === true
+        })));
+      }
       if (request.method === "POST" && url.pathname === "/api/external-reviewer-governance/preview") {
         return json(response, 200, await planExternalReviewerGovernance(input, await readJson(request)));
       }

package/src/state.js

@@ -5,6 +5,7 @@ import { assessCollectionReviews } from "./collection-review.js";
 import { getBrowserRepositoryState, getRepositorySnapshot, getWorkspaceHistories } from "./git.js";
 import { renderMarkdown } from "./markdown.js";
 import { planObligations } from "./obligations.js";
+import { planReconciliation } from "./reconciliation.js";
 import { resolveDataPath, resolveWorkspaceRoot } from "./paths.js";
 import { assessProgramReadiness } from "./program-readiness.js";
 import { markdownEntries } from "./resource-markdown.js";
@@ -82,6 +83,7 @@ export async function createAppBootstrap(input = process.cwd(), options = {}) {
       counts: { errors: 0, warnings: 0 },
       diagnostics: []
     },
+    reconciliation: { contractVersion: 1, gitRevision: null, changedPaths: [], candidates: [] },
     obligations: { loading: true, items: [], triggers: [], counts: {} },
     collectionReviews: {},
     applicabilityConstraints: {},
@@ -116,6 +118,8 @@ export async function createAppStateSection(input, section, options = {}) {
       validateWorkspace(loaded),
       measureTiming("state-repository-snapshot", () => getRepositorySnapshot(loaded.root))
     ]);
+    const reconciliation = validation.reconciliation
+      ?? await measureTiming("state-reconciliation", () => planReconciliation(loaded));
     const git = { ...snapshot };
     delete git.root;
     const repository = await measureTiming("state-repository", () => getBrowserRepositoryState(loaded, {
@@ -128,6 +132,7 @@ export async function createAppStateSection(input, section, options = {}) {
       readOnly: Boolean(options.readOnly || (repository.mode === "trunk" && !repository.writesAllowed)),
       repository,
       git,
+      reconciliation,
       validation: {
         ok: validation.ok,
         counts: validation.counts,
@@ -294,6 +299,8 @@ async function createAppStateUnlocked(input, options) {
     now: options.now ?? generatedAt,
     model: loaded.model
   });
+  const reconciliation = validation.reconciliation
+    ?? await measureTiming("state-reconciliation", () => planReconciliation(loaded));
   const workflow = await measureTiming("state-workflow", () => assessWorkflow(loaded, {
     programId: activeProgram.id,
     asOf,
@@ -303,6 +310,7 @@ async function createAppStateUnlocked(input, options) {
       Object.entries(auditPreparations).filter(([id]) => id !== "none")
     ),
     obligations,
+    reconciliation,
     git,
     validation
   }));
@@ -337,6 +345,7 @@ async function createAppStateUnlocked(input, options) {
       diagnostics: validation.diagnostics
     },
     obligations,
+    reconciliation,
     collectionReviews,
     applicabilityConstraints,
     programReadiness,

package/src/validate.js

@@ -62,6 +62,7 @@ export async function validateWorkspace(input = process.cwd()) {
 async function validateWorkspaceUnmeasured(input) {
   const loaded = typeof input === "object" && input.entries ? input : await loadWorkspace(input);
   const diagnostics = [...loaded.diagnostics];
+  let reconciliation = null;
   const { byId } = indexResources(loaded.resources);
   const seen = new Map();
   const pathById = new Map(loaded.entries.map((entry) => [
@@ -216,8 +217,9 @@ async function validateWorkspaceUnmeasured(input) {
     validateCollectionReviewSet(loaded.resources, pathById, diagnostics);
   }
   if (modelSupports(loaded.model, "guided-workflow")) {
-    const { planReconciliation } = await import("./reconciliation.js");
-    const reconciliation = await planReconciliation(loaded);
+    const { planReconciliation, validateReconciliationDismissals } = await import("./reconciliation.js");
+    const rawReconciliation = await validateReconciliationDismissals(loaded, diagnostics);
+    reconciliation = rawReconciliation?.filteredPlan ?? await planReconciliation(loaded);
     for (const candidate of reconciliation.candidates.filter(({ committedRevision }) => committedRevision)) {
       diagnostics.push(warning(
         "unreconciled-committed-transition",
@@ -241,6 +243,10 @@ async function validateWorkspaceUnmeasured(input) {
     value: loaded,
     enumerable: false
   });
+  Object.defineProperty(result, "reconciliation", {
+    value: reconciliation,
+    enumerable: false
+  });
   return result;
 }
 

package/src/web.js

@@ -3121,10 +3121,11 @@ function renderRepository(main) {
   const validationBody = state.validation.diagnostics.length
     ? '<div class="diagnostics">' + state.validation.diagnostics.map((item) => '<div><span class="badge ' + item.severity + '">' + esc(properCase(item.severity)) + '</span><code>' + esc(item.path) + '</code><p>' + esc(item.message) + '</p></div>').join("") + '</div>'
     : empty("No validation problems.");
-  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">Audit trail</p><h2>Repository State</h2><p>' + repositoryInstructions + ' Git supplies authors, timestamps, messages, revisions, and file history.</p><p class="repository-sync-status" role="status" aria-live="polite"></p></div><div class="page-actions">' + pullButton + commitButton + pushButton + onboardingButton + settingsLink + '<a class="button" href="#/resource/workspace/workspace">Workspace settings</a></div></div><div class="dashboard-grid"><section class="panel"><div class="panel-head"><h3>Current Revision</h3></div><dl class="metadata"><div><dt>Branch</dt><dd>' + esc(state.git.branch || (state.git.available ? "Detached HEAD" : "Unavailable")) + '</dd></div><div><dt>Upstream</dt><dd>' + esc(state.git.upstream || "Not configured") + '</dd></div><div><dt>Remotes</dt><dd>' + esc(state.git.remotes?.join(", ") || "None configured") + '</dd></div><div><dt>Commit</dt><dd><code>' + esc(state.git.commit || "Unavailable") + '</code></dd></div><div><dt>Working tree</dt><dd>' + (state.git.clean === null ? "Unavailable" : state.git.clean ? "Clean" : "Has changes") + '</dd></div><div><dt>Generated</dt><dd>' + esc(formatLocalDateTime(state.generatedAt)) + '</dd></div></dl></section><section class="panel span-2"><div class="panel-head"><h3>Uncommitted Changes</h3></div>' + (state.git.changes?.length ? '<ul class="changes">' + state.git.changes.map((change) => '<li><code>' + esc(change) + '</code></li>').join("") + '</ul>' : empty(state.git.available ? "No uncommitted changes." : state.git.message)) + '</section><section class="panel span-2"><div class="panel-head"><h3>Validation</h3><span class="badge ' + (state.validation.ok ? "good" : "bad") + '">' + (state.validation.ok ? "Passing" : "Needs attention") + '</span></div>' + validationBody + '</section></div></div>';
+  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">Audit trail</p><h2>Repository State</h2><p>' + repositoryInstructions + ' Git supplies authors, timestamps, messages, revisions, and file history.</p><p class="repository-sync-status" role="status" aria-live="polite"></p></div><div class="page-actions">' + pullButton + commitButton + pushButton + onboardingButton + settingsLink + '<a class="button" href="#/resource/workspace/workspace">Workspace settings</a></div></div><div class="dashboard-grid"><section class="panel"><div class="panel-head"><h3>Current Revision</h3></div><dl class="metadata"><div><dt>Branch</dt><dd>' + esc(state.git.branch || (state.git.available ? "Detached HEAD" : "Unavailable")) + '</dd></div><div><dt>Upstream</dt><dd>' + esc(state.git.upstream || "Not configured") + '</dd></div><div><dt>Remotes</dt><dd>' + esc(state.git.remotes?.join(", ") || "None configured") + '</dd></div><div><dt>Commit</dt><dd><code>' + esc(state.git.commit || "Unavailable") + '</code></dd></div><div><dt>Working tree</dt><dd>' + (state.git.clean === null ? "Unavailable" : state.git.clean ? "Clean" : "Has changes") + '</dd></div><div><dt>Generated</dt><dd>' + esc(formatLocalDateTime(state.generatedAt)) + '</dd></div></dl></section><section class="panel span-2"><div class="panel-head"><h3>Uncommitted Changes</h3></div>' + (state.git.changes?.length ? '<ul class="changes">' + state.git.changes.map((change) => '<li><code>' + esc(change) + '</code></li>').join("") + '</ul>' : empty(state.git.available ? "No uncommitted changes." : state.git.message)) + '</section><section class="panel span-2"><div class="panel-head"><h3>Validation</h3><span class="badge ' + (state.validation.ok ? "good" : "bad") + '">' + (state.validation.ok ? "Passing" : "Needs attention") + '</span></div>' + validationBody + '</section>' + reconciliationPanel() + '</div></div>';
   main.querySelector("#commit-workspace")?.addEventListener("click", openCommitDialog);
   main.querySelectorAll("[data-git-action]").forEach((button) => button.addEventListener("click", () => runRepositoryGitAction(button.dataset.gitAction)));
   main.querySelector("#start-onboarding")?.addEventListener("click", requestOnboarding);
+  bindReconciliationDismissals(main);
 }
 
 function renderTrunkRepository(main) {
@@ -3148,9 +3149,63 @@ function renderTrunkRepository(main) {
   const validationBody = state.validation.diagnostics.length
     ? '<div class="diagnostics">' + state.validation.diagnostics.map((item) => '<div><span class="badge ' + item.severity + '">' + esc(properCase(item.severity)) + '</span><code>' + esc(item.path) + '</code><p>' + esc(item.message) + '</p></div>').join("") + '</div>'
     : empty("No validation problems.");
-  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">Audit trail</p><h2>Repository State</h2><p>Browser saves use one authoritative branch. Record status represents draft, proposal, approval, and retirement; Git branches do not.</p><p class="repository-sync-status" role="status" aria-live="polite"></p></div><div class="page-actions">' + retryButton + onboardingButton + settingsLink + '<a class="button" href="#/resource/workspace/workspace">Workspace settings</a></div></div><section class="panel repository-state-banner"><span class="status-dot ' + repositoryStatusTone(repository.status) + '"></span><div><p class="kicker">Repository status</p><h3>' + esc(repository.label) + '</h3><p>' + esc(repository.message) + '</p></div></section><div class="dashboard-grid"><section class="panel"><div class="panel-head"><h3>Configured Repository</h3></div><dl class="metadata"><div><dt>Branch</dt><dd>' + esc(repository.authoritativeBranch) + '</dd></div><div><dt>Remote</dt><dd>' + esc(repository.remote) + '</dd></div><div><dt>Checkout</dt><dd>' + esc(state.git.branch || (state.git.available ? "Detached HEAD" : "Unavailable")) + '</dd></div><div><dt>Upstream</dt><dd>' + esc(repository.upstream || "Not configured") + '</dd></div></dl></section><section class="panel"><div class="panel-head"><h3>Synchronization</h3></div><dl class="metadata"><div><dt>Current commit</dt><dd><code>' + esc(repository.currentCommit || "Unavailable") + '</code></dd></div><div><dt>Upstream commit</dt><dd><code>' + esc(repository.upstreamCommit || "Unavailable") + '</code></dd></div><div><dt>Ahead</dt><dd>' + esc(repository.ahead ?? "Unknown") + '</dd></div><div><dt>Behind</dt><dd>' + esc(repository.behind ?? "Unknown") + '</dd></div><div><dt>Last sync</dt><dd>' + esc(lastSync) + '</dd></div></dl></section><section class="panel"><div class="panel-head"><h3>Safety Checks</h3></div><dl class="metadata"><div><dt>Whole worktree</dt><dd>' + (repository.wholeWorktreeClean === null ? "Unavailable" : repository.wholeWorktreeClean ? "Clean" : "Has changes") + '</dd></div><div><dt>Git operation</dt><dd>' + esc(repository.operationInProgress || "None") + '</dd></div><div><dt>Pending scope</dt><dd>' + (repository.pendingCommitsFilegrcOnly === false ? "Includes external files" : repository.pendingCommits?.length ? "FileGRC only" : "None") + '</dd></div></dl></section><section class="panel span-2"><div class="panel-head"><h3>Pending FileGRC-only Commits</h3></div>' + pending + '</section><section class="panel span-2"><div class="panel-head"><h3>Validation</h3><span class="badge ' + (state.validation.ok ? "good" : "bad") + '">' + (state.validation.ok ? "Passing" : "Needs attention") + '</span></div>' + validationBody + '</section></div></div>';
+  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">Audit trail</p><h2>Repository State</h2><p>Browser saves use one authoritative branch. Record status represents draft, proposal, approval, and retirement; Git branches do not.</p><p class="repository-sync-status" role="status" aria-live="polite"></p></div><div class="page-actions">' + retryButton + onboardingButton + settingsLink + '<a class="button" href="#/resource/workspace/workspace">Workspace settings</a></div></div><section class="panel repository-state-banner"><span class="status-dot ' + repositoryStatusTone(repository.status) + '"></span><div><p class="kicker">Repository status</p><h3>' + esc(repository.label) + '</h3><p>' + esc(repository.message) + '</p></div></section><div class="dashboard-grid"><section class="panel"><div class="panel-head"><h3>Configured Repository</h3></div><dl class="metadata"><div><dt>Branch</dt><dd>' + esc(repository.authoritativeBranch) + '</dd></div><div><dt>Remote</dt><dd>' + esc(repository.remote) + '</dd></div><div><dt>Checkout</dt><dd>' + esc(state.git.branch || (state.git.available ? "Detached HEAD" : "Unavailable")) + '</dd></div><div><dt>Upstream</dt><dd>' + esc(repository.upstream || "Not configured") + '</dd></div></dl></section><section class="panel"><div class="panel-head"><h3>Synchronization</h3></div><dl class="metadata"><div><dt>Current commit</dt><dd><code>' + esc(repository.currentCommit || "Unavailable") + '</code></dd></div><div><dt>Upstream commit</dt><dd><code>' + esc(repository.upstreamCommit || "Unavailable") + '</code></dd></div><div><dt>Ahead</dt><dd>' + esc(repository.ahead ?? "Unknown") + '</dd></div><div><dt>Behind</dt><dd>' + esc(repository.behind ?? "Unknown") + '</dd></div><div><dt>Last sync</dt><dd>' + esc(lastSync) + '</dd></div></dl></section><section class="panel"><div class="panel-head"><h3>Safety Checks</h3></div><dl class="metadata"><div><dt>Whole worktree</dt><dd>' + (repository.wholeWorktreeClean === null ? "Unavailable" : repository.wholeWorktreeClean ? "Clean" : "Has changes") + '</dd></div><div><dt>Git operation</dt><dd>' + esc(repository.operationInProgress || "None") + '</dd></div><div><dt>Pending scope</dt><dd>' + (repository.pendingCommitsFilegrcOnly === false ? "Includes external files" : repository.pendingCommits?.length ? "FileGRC only" : "None") + '</dd></div></dl></section><section class="panel span-2"><div class="panel-head"><h3>Pending FileGRC-only Commits</h3></div>' + pending + '</section><section class="panel span-2"><div class="panel-head"><h3>Validation</h3><span class="badge ' + (state.validation.ok ? "good" : "bad") + '">' + (state.validation.ok ? "Passing" : "Needs attention") + '</span></div>' + validationBody + '</section>' + reconciliationPanel() + '</div></div>';
   main.querySelectorAll("[data-git-action]").forEach((button) => button.addEventListener("click", () => runRepositoryGitAction(button.dataset.gitAction)));
   main.querySelector("#start-onboarding")?.addEventListener("click", requestOnboarding);
+  bindReconciliationDismissals(main);
+}
+
+function reconciliationPanel() {
+  const candidates = state.reconciliation?.candidates || [];
+  if (!candidates.length) return "";
+  const items = candidates.map((candidate) => '<article class="reconciliation-candidate"><div><span class="badge warn">Review</span><strong>' + esc(titleCase(candidate.eventType)) + '</strong><p>' + esc(candidate.message) + '</p><small><code>' + esc(candidate.sourcePath) + '</code> · fingerprint <code>' + esc(candidate.transitionFingerprint) + '</code></small></div><div class="reconciliation-actions"><button class="button" type="button" data-dismiss-reconciliation="' + esc(candidate.transitionFingerprint) + '" ' + (state.readOnly ? 'disabled title="Writes are not available in this repository state"' : "") + '>Dismiss false positive</button><code>' + esc(candidate.action.command) + '</code></div></article>').join("");
+  return '<section class="panel span-2 reconciliation-panel"><div class="panel-head"><div><p class="kicker">Git transition review</p><h3>Transitions Need Confirmation</h3></div><span class="badge warn">' + candidates.length + '</span></div><p>Confirm real events with the shown command. Dismiss only when the exact Git change does not represent a real event.</p><div class="reconciliation-candidates">' + items + '</div></section>';
+}
+
+function bindReconciliationDismissals(main) {
+  main.querySelectorAll("[data-dismiss-reconciliation]").forEach((button) => button.addEventListener("click", () => {
+    const candidate = state.reconciliation?.candidates?.find((item) => item.transitionFingerprint === button.dataset.dismissReconciliation);
+    if (candidate) openReconciliationDismissal(candidate);
+  }));
+}
+
+function openReconciliationDismissal(candidate) {
+  const people = resourcesOfType("person").filter(({ record }) => record.status === "active");
+  const dialog = document.createElement("dialog");
+  dialog.className = "commit-dialog event-dialog";
+  dialog.setAttribute("aria-labelledby", "reconciliation-dismissal-title");
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">False-positive review</p><h2 id="reconciliation-dismissal-title">Dismiss ' + esc(titleCase(candidate.eventType)) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>This decision applies only to fingerprint <code>' + esc(candidate.transitionFingerprint) + '</code>. A later change creates a new candidate.</p><label><span>Reviewer</span><select name="reviewedById" required><option value="">Select a Person</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '">' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Reviewed on</span><input name="reviewedOn" type="date" required value="' + esc(currentDate()) + '"></label><label><span>Rationale</span><textarea name="rationale" rows="4" required placeholder="Explain why this Git change does not represent a real event."></textarea></label><div class="dialog-error" role="alert"></div><div class="save-status" role="status" aria-live="polite"></div><div class="dialog-actions"><button type="button" class="button" data-dismiss-dialog>Cancel</button><button type="submit" class="button primary" id="save-reconciliation-dismissal">Record dismissal</button></div></form>';
+  document.body.append(dialog);
+  dialog.showModal();
+  dialog.querySelector(".icon-button").addEventListener("click", () => dialog.close());
+  dialog.querySelector("[data-dismiss-dialog]").addEventListener("click", () => dialog.close());
+  dialog.addEventListener("close", () => dialog.remove());
+  dialog.querySelector("form").addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const form = event.currentTarget;
+    if (!form.reportValidity()) return;
+    try {
+      setMutationBusy(dialog, true, "Recording…", "Record dismissal");
+      const response = await localFetch("/api/reconciliation/dismissal", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          candidateId: candidate.transitionFingerprint,
+          reviewedById: form.elements.reviewedById.value,
+          reviewedOn: form.elements.reviewedOn.value,
+          rationale: form.elements.rationale.value,
+          confirmed: true
+        })
+      });
+      if (!response.ok) throw new Error(await responseMessage(response));
+      applyMutationState(await response.json());
+      dialog.close();
+      render();
+    } catch (error) {
+      setMutationBusy(dialog, false, "", "Record dismissal");
+      dialog.querySelector(".dialog-error").textContent = error.message;
+    }
+  });
 }
 
 async function runRepositoryGitAction(action) {
@@ -5576,6 +5631,7 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .page-title-line{display:flex;align-items:center;gap:8px}.guide-trigger{display:grid;place-items:center;width:24px;height:24px;flex:0 0 auto;padding:0;border:1px solid var(--line);border-radius:50%;background:var(--panel);color:var(--muted);cursor:pointer}.guide-trigger svg{width:16px;height:16px;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round}.guide-trigger:hover{border-color:var(--accent-light);color:var(--accent)}.guide-trigger:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.page-guide{display:grid;grid-template-columns:1.05fr 1.25fr 1fr;gap:0;margin:0;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.resource-guide-popover{position:fixed;z-index:40;overflow:auto;box-shadow:0 18px 50px rgba(0,0,24,.24)}.resource-guide-popover[hidden]{display:none}.page-guide>div{padding:14px 16px;border-left:1px solid var(--line);min-width:0}.page-guide>div:first-child{border-left:0}.page-guide>div>span{display:block;color:var(--accent);text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780;margin-bottom:6px}.page-guide p{color:var(--muted);font-size:12px;line-height:1.5;margin:0}.page-guide>.guide-review{grid-column:1/-1;border-top:1px solid var(--line);border-left:0}.guide-review ul{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:5px 28px;margin:0;padding-left:18px;color:var(--muted);font-size:11px;line-height:1.45}.guide-links{display:flex;flex-wrap:wrap;gap:5px;margin-top:8px}.guide-links a{color:var(--accent);background:var(--accent-soft);border-radius:99px;padding:4px 7px;text-decoration:none;font-size:9.6px;font-weight:700}
 .operation-tracking{display:grid;gap:2px;min-width:0;text-decoration:none}.operation-tracking strong,.operation-tracking small{display:block;overflow-wrap:anywhere}.operation-tracking small{color:var(--muted);line-height:1.35}.operation-tracking.running strong{color:#176143}.operation-tracking.waiting strong,.operation-tracking.mixed strong{color:var(--amber)}.operation-tracking.paused strong{color:var(--red)}a.operation-tracking:hover strong{text-decoration:underline}
 .page-actions{display:flex;align-items:center;justify-content:flex-end;gap:7px;flex-wrap:wrap}.repository-sync-status{min-height:18px;margin:7px 0 0;color:var(--muted);font-size:13.2px}.repository-sync-status.error{color:var(--red)}.repository-sync-alert{display:flex;align-items:flex-start;gap:9px;padding:10px 22px;border-bottom:1px solid #e9c888;background:#fff8e8;color:var(--ink);font-size:12px;line-height:1.45}.repository-sync-alert.syncing{border-color:var(--line);background:var(--surface-soft)}.repository-sync-alert .status-dot{flex:0 0 auto;margin-top:4px}.repository-sync-alert a{margin-left:auto;white-space:nowrap}.repository-state-banner,.repository-override{display:flex;align-items:flex-start;gap:13px;margin-bottom:14px}.repository-state-banner>.status-dot,.repository-override>.status-dot{margin-top:5px}.repository-state-banner h3{margin:3px 0 5px}.repository-state-banner p:last-child,.repository-override p{margin:0;color:var(--muted);line-height:1.5}.repository-override{padding:14px 17px;border:1px solid #e9c888;border-radius:9px;background:#fff8e8;font-size:13.2px}.repository-override strong{display:block;margin-bottom:4px}.onboarding-dialog{width:min(470px,calc(100vw - 30px));max-height:calc(100vh - 32px);margin:0;border:1px solid var(--line);border-radius:13px;padding:0;background:var(--panel);color:var(--ink);box-shadow:0 28px 90px rgba(0,0,24,.38);overflow:hidden}.onboarding-dialog[open]{display:flex;flex-direction:column}.onboarding-dialog::backdrop{background:transparent;backdrop-filter:none}.onboarding-shade{position:fixed;inset:0;z-index:60;pointer-events:none}.onboarding-shade span{position:absolute;background:rgba(0,0,24,.58)}.onboarding-progress{display:grid;flex:0 0 auto;grid-template-columns:repeat(var(--onboarding-step-count),1fr);gap:5px;padding:18px 24px 0}.onboarding-progress span{height:3px;border-radius:3px;background:var(--surface-muted)}.onboarding-progress span.active{background:var(--accent-light)}.onboarding-scroll{min-height:0;overflow-y:auto}.onboarding-head{padding:22px 25px 0}.onboarding-head h2{font-family:Georgia,serif;font-size:30px;font-weight:500;letter-spacing:-.015em;margin:8px 0 0}.onboarding-body{color:var(--muted);font-size:14.4px;line-height:1.6;margin:13px 25px 0}.onboarding-body+.onboarding-body{margin-top:8px}.onboarding-points{display:grid;gap:9px;margin:18px 25px 4px;padding-left:19px}.onboarding-points li{font-size:13.2px;line-height:1.5;padding-left:3px}.onboarding-sections{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin:16px 25px 4px}.onboarding-sections section{padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.onboarding-sections strong{font-size:13.2px}.onboarding-sections p{margin:6px 0 0;color:var(--muted);font-size:12px;line-height:1.5}.onboarding-actions{flex:0 0 auto;flex-wrap:wrap;padding:12px 25px 23px;border-top:1px solid var(--line);background:var(--panel)}.onboarding-skip{margin-right:auto;color:var(--muted);text-transform:none;letter-spacing:0;font-size:13.2px}.onboarding-form{display:grid;grid-template-columns:1fr 1fr;gap:13px;margin:18px 25px 0}.onboarding-form label{display:block;min-width:0}.onboarding-form label.wide{grid-column:1/-1}.onboarding-form label>span{display:block;color:var(--ink);font-size:12px;font-weight:720;margin-bottom:6px}.onboarding-form input,.onboarding-form select,.onboarding-form textarea{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.onboarding-form textarea{min-height:78px;resize:vertical}.onboarding-form small{display:block;color:var(--muted);font-size:10.8px;line-height:1.45;margin-top:5px}.onboarding-write-note{color:var(--muted);font-size:10.8px;line-height:1.5;margin:12px 25px 16px}.onboarding-scroll>.dialog-error{margin:8px 25px 0}.onboarding-focus{outline:4px solid var(--accent-light)!important;outline-offset:5px;scroll-margin-top:102px}
+.reconciliation-panel>p{margin:0 0 12px;color:var(--muted);font-size:12px;line-height:1.5}.reconciliation-candidates{display:grid;gap:9px}.reconciliation-candidate{display:grid;grid-template-columns:minmax(0,1fr) minmax(280px,.8fr);gap:16px;padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.reconciliation-candidate strong{margin-left:8px;font-size:13.2px}.reconciliation-candidate p{margin:7px 0;color:var(--muted);font-size:12px;line-height:1.5}.reconciliation-candidate small{display:block;overflow-wrap:anywhere;color:var(--muted);font-size:9.6px}.reconciliation-actions{display:grid;gap:8px;justify-items:end;align-content:center}.reconciliation-actions>code{max-width:100%;overflow-wrap:anywhere;color:var(--muted);font-size:9.6px;text-align:right}
 .onboarding-save-status{color:var(--muted);font-size:10.8px;line-height:1.35}.onboarding-save-status:empty{display:none}.onboarding-save-status:not(:empty){order:-1;flex-basis:100%;margin-bottom:4px}.onboarding-retry-sync{margin-top:9px}.detail-loading{color:var(--muted)}
 .save-status{min-height:16px;color:var(--muted);font-size:10.8px;line-height:1.35}
 .page-intro,.detail-head{align-items:center;margin-bottom:12px}.actions{align-items:center}.detail-head>div:first-child{min-width:0}.detail-head h2{margin:7px 0}.detail-head .header-breadcrumbs{margin:0;font-size:10.8px;line-height:normal;min-height:11px;align-items:center}.header-breadcrumbs span:last-child{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:60ch}
@@ -5588,6 +5644,7 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 @media(max-width:760px){.setup-banner,.page-guide,.stage-overview-hero,.relationship-note,.group-destination-card,.stage-page-grid,.evidence-map-expectation,.evidence-map-links,.external-evidence-list,.policy-lifecycle-note{grid-template-columns:1fr}.context-workflow,.evidence-map-head{align-items:stretch;flex-direction:column}.evidence-map-actions{flex-wrap:wrap}.page-guide>div{border-left:0;border-top:1px solid var(--line)}.page-guide>div:first-child{border-top:0}.group-overview-head{display:block}.stage-progress-card,.stage-status-link{margin-top:15px}.destination-rollup{text-align:left}.form-grid{grid-template-columns:1fr}.record-table{min-width:0}.record-table thead{display:none}.record-table,.record-table tbody,.record-table tr{display:block}.record-table tr{padding:8px 12px;border-bottom:1px solid var(--line)}.record-table tr:last-child{border-bottom:0}.record-table td:not([data-label]){display:block}.record-table td[data-label]{display:grid;grid-template-columns:105px minmax(0,1fr);gap:10px;border:0;padding:7px 0;align-items:start}.record-table td[data-label]::before{content:attr(data-label);color:#75817b;text-transform:uppercase;letter-spacing:.07em;font-size:9.6px;font-weight:700}.record-table td[data-primary-field]{display:block;padding:8px 0 10px}.record-table td[data-primary-field]::before{display:none}.content-label{align-items:flex-start}.editor form{padding:18px}.diagnostics>div{grid-template-columns:58px minmax(0,1fr)}.diagnostics p{grid-column:1/-1}.changes code{overflow-wrap:anywhere}.onboarding-dialog{max-height:56vh}}
 .detail-grid aside .panel{width:100%;max-height:min(520px,65vh);overflow:auto;overscroll-behavior:contain;scrollbar-gutter:stable}.detail-grid aside .workflow-guidance,.detail-grid aside .resource-review-criteria{margin:0}.detail-grid aside .resource-review-criteria{padding:21px}.detail-grid aside .detail-workflow-panel{max-height:min(440px,60vh)}.detail-grid aside .detail-review-panel{max-height:min(300px,50vh)}.detail-grid aside .workflow-findings,.detail-grid aside .resource-review-criteria ul{grid-template-columns:1fr}.detail-support-stack{display:grid;min-width:0;gap:14px;align-content:start}
 @media(max-width:760px){.detail-grid aside{order:-1}}
+@media(max-width:760px){.reconciliation-candidate{grid-template-columns:1fr}.reconciliation-actions{justify-items:start}.reconciliation-actions>code{text-align:left}}
 @media(max-width:760px){.detail-grid-structured .detail-support-columns{display:flex;flex-direction:column}.detail-grid-structured .detail-support-stack{display:contents}.detail-grid-structured .detail-history-panel{order:1}}
 @media(max-width:760px){.guide-review ul,.resource-review-criteria ul{grid-template-columns:1fr}.collection-review-head,.collection-review-foot{align-items:stretch;flex-direction:column}.record-workflow-action{min-width:0}}
 @media(max-width:520px){.onboarding-form,.onboarding-sections,.setup-steps{grid-template-columns:1fr}.onboarding-form label.wide{grid-column:auto}.onboarding-actions{flex-wrap:wrap}.onboarding-skip{width:100%;order:3;margin:3px 0 0}.readiness-flow{grid-template-columns:1fr}.obligation-card-foot{align-items:flex-start;flex-direction:column}.obligation-action{align-self:flex-start}}

package/src/workflow-history-integrity.js

@@ -15,6 +15,7 @@ import { currentCalendarDate, isRfc3339Timestamp, timestampFromLocalDateTime } f
 import { recordsAtRevision, reportingRouteFixedEvidence } from "./reporting-route-integrity.js";
 
 const FINAL_STATUSES = new Map([
+  ["reconciliation-dismissal", new Set([undefined])],
   ["collection-review", new Set(["active", "retired"])],
   ["obligation-rule", new Set(["active", "retired"])],
   ["obligation-occurrence", new Set(["reconciled", "superseded"])],
@@ -96,6 +97,21 @@ export async function validateWorkflowHistoryIntegrity(loaded, diagnostics) {
       ));
       continue;
     }
+    if (
+      entry.record.type === "reconciliation-dismissal"
+      && !validInitialReconciliationDismissal(
+        historical,
+        loaded,
+        historiesById,
+        workspaceTimezoneAtRevision(loaded, historical.commit)
+      )
+    ) {
+      diagnostics.push(integrityError(
+        entry,
+        `Reconciliation dismissal "${entry.record.id}" must first be committed with exactly one active Person reviewer.`
+      ));
+      continue;
+    }
     if (
       entry.record.type === "exception"
       && historical.record.reportingRouteSetId
@@ -354,6 +370,21 @@ function validInitialCollectionReview(historical, timezone) {
     );
 }
 
+function validInitialReconciliationDismissal(historical, loaded, historiesById, timezone) {
+  const reviewerIds = historical.record.reviewedByIds || [];
+  if (reviewerIds.length !== 1) return false;
+  const reviewer = recordAtRevision(
+    loaded,
+    historical.commit,
+    reviewerIds[0],
+    historiesById.get(reviewerIds[0]) || []
+  )?.record;
+  return reviewer?.type === "person"
+    && reviewer.status === "active"
+    && isRfc3339Timestamp(historical.timestamp)
+    && historical.record.reviewedOn === currentCalendarDate(timezone, new Date(historical.timestamp));
+}
+
 function legacyCollectionReview(loaded, historical) {
   if (historical.legacyBaseline && historical.record.status === "active" && !historical.record.knowledgeCutoffAt) {
     return true;