filegrc 0.12.1 → 0.12.3

package/model/v10.json

@@ -7485,6 +7485,71 @@
         "coverage"
       ]
     },
+    "reconciliation-dismissal": {
+      "title": "Reconciliation dismissal",
+      "pluralTitle": "Reconciliation dismissals",
+      "group": "repository",
+      "collection": "reconciliation-dismissals",
+      "description": "A reviewed decision that one exact Git transition candidate is a false positive and does not represent a real policy event.",
+      "guidance": {
+        "policyBasis": "Direct file changes can resemble real operational events. This record preserves the reviewer, date, rationale, and exact candidate fingerprint when management confirms that no event occurred.",
+        "cadence": "Create only from a current reconciliation candidate. A later change produces a different fingerprint and requires its own review."
+      },
+      "required": [
+        "transitionFingerprint",
+        "eventType",
+        "subjectResourceId",
+        "reviewedByIds",
+        "reviewedOn",
+        "rationale"
+      ],
+      "fields": {
+        "transitionFingerprint": {
+          "type": "string",
+          "label": "Transition fingerprint"
+        },
+        "eventType": {
+          "type": "string",
+          "label": "Candidate event type",
+          "filter": true
+        },
+        "subjectResourceId": {
+          "type": "id",
+          "relationGroup": "event-subject",
+          "label": "Candidate subject"
+        },
+        "reviewedByIds": {
+          "type": "array",
+          "items": "id",
+          "relation": [
+            "person"
+          ],
+          "label": "Reviewed by"
+        },
+        "reviewedOn": {
+          "type": "date",
+          "label": "Reviewed on"
+        },
+        "rationale": {
+          "type": "string",
+          "search": true
+        }
+      },
+      "listFields": [
+        "title",
+        "eventType",
+        "subjectResourceId",
+        "reviewedOn"
+      ],
+      "formFields": [
+        "transitionFingerprint",
+        "eventType",
+        "subjectResourceId",
+        "reviewedByIds",
+        "reviewedOn",
+        "rationale"
+      ]
+    },
     "collection-review": {
       "title": "Collection review",
       "pluralTitle": "Collection reviews",
@@ -9516,7 +9581,8 @@
       "vendor",
       "access-grant",
       "vulnerability",
-      "incident"
+      "incident",
+      "exception"
     ],
     "evidence-source-record": [
       "appointment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/cli.js

@@ -68,7 +68,7 @@ import {
 import { planProgramAmendment } from "./program-amendment.js";
 import { resolveProgram } from "./program.js";
 import { resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
-import { applyReconciliation, planReconciliation } from "./reconciliation.js";
+import { applyReconciliation, dismissReconciliation, planReconciliation } from "./reconciliation.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { effectiveResourceStatus } from "./resource-status.js";
 import { searchResources } from "./search.js";
@@ -617,7 +617,17 @@ export async function runCli(argv = process.argv.slice(2)) {
     return result;
   }
   if (command === "reconcile") {
-    const result = flags.apply
+    if (flags.apply && flags.dismiss) throw new Error("Choose either --apply or --dismiss for one reconciliation candidate.");
+    const result = flags.dismiss
+      ? await withWorkflowDelta(root, () => dismissReconciliation(root, {
+        candidateId: flags.candidate,
+        transitionFingerprint: flags.candidate,
+        reviewedById: flags.reviewer,
+        reviewedOn: flags["reviewed-on"],
+        rationale: flags.rationale,
+        confirmed: flags.yes === true
+      }))
+      : flags.apply
       ? await withWorkflowDelta(root, () => applyReconciliation(root, {
         candidateId: flags.candidate,
         transitionFingerprint: flags.candidate,
@@ -630,7 +640,9 @@ export async function runCli(argv = process.argv.slice(2)) {
       }))
       : await planReconciliation(root);
     if (flags.json) console.log(JSON.stringify(result, null, 2));
-    else if (flags.apply) {
+    else if (flags.dismiss) {
+      console.log(`Dismissed ${result.candidate.eventType}: recorded ${result.dismissal.id}.`);
+    } else if (flags.apply) {
       console.log(`Reconciled ${result.candidate.eventType}: created ${result.event.id} and ${result.actions.length} linked tasks.`);
     } else if (!result.candidates.length) {
       console.log("No direct-file transitions need confirmation.");
@@ -1328,7 +1340,7 @@ Usage:
   filegrc evidence-map [--as-of YYYY-MM-DD] [--json]
   filegrc audit-readiness [audit-id] [--as-of YYYY-MM-DD] [--require-ready] [--json]
   filegrc prepare-audit <audit-id> [--json]
-  filegrc reconcile [--preview|--apply --candidate fingerprint (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) --yes] [--program program-id] [--risk-level normal|high] [--json]
+  filegrc reconcile [--preview|--apply --candidate fingerprint (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) --yes|--dismiss --candidate fingerprint --reviewer person-id --reviewed-on YYYY-MM-DD --rationale text --yes] [--program program-id] [--risk-level normal|high] [--json]
   filegrc external-reviewer-setup --scaffold
   filegrc external-reviewer-setup <reviewer.json|-> [--preview|--yes] [--json]
   filegrc next-audit-cycle <prior-audit-id> [cycle.json|-] --start YYYY-MM-DD --end YYYY-MM-DD [--preview|--yes] [--json]

package/src/files.js

@@ -22,7 +22,8 @@ export const INTERNAL_WORKFLOW_CAPABILITIES = Object.freeze({
   collectionReviewReassessment: Symbol("collection-review-reassessment"),
   reportingRouteSetProposal: Symbol("reporting-route-set-proposal"),
   reportingRouteSetApproval: Symbol("reporting-route-set-approval"),
-  reportingRouteSetCancellation: Symbol("reporting-route-set-cancellation")
+  reportingRouteSetCancellation: Symbol("reporting-route-set-cancellation"),
+  reconciliationDismissal: Symbol("reconciliation-dismissal")
 });
 
 export async function createResource(input, record, options = {}) {
@@ -671,6 +672,9 @@ function assertImmutableWorkflowRecord(existing, next, options = {}, loaded = nu
   const preservesExisting = (allowed = []) => [...new Set([...Object.keys(existing), ...Object.keys(next)])].every((key) => (
     allowed.includes(key) || JSON.stringify(next[key]) === JSON.stringify(existing[key])
   ));
+  if (existing.type === "reconciliation-dismissal" && !preservesExisting()) {
+    throw new Error(`Reconciliation dismissal "${existing.id}" is immutable because it records a fingerprint-bound review decision.`);
+  }
   if (existing.type === "collection-review" && ["active", "retired"].includes(existing.status)) {
     const retirement = options.workflowCapability === INTERNAL_WORKFLOW_CAPABILITIES.collectionReviewReassessment
       && existing.status === "active"
@@ -908,6 +912,13 @@ function finalizedOccurrenceUsingProof(loaded, targetId) {
 }
 
 function assertSpecializedWorkflowCreate(record, options = {}, loaded = null) {
+  if (
+    record?.type === "reconciliation-dismissal"
+    && options.workflowCapability !== INTERNAL_WORKFLOW_CAPABILITIES.reconciliationDismissal
+    && options.lifecycleOperation !== "model-migration"
+  ) {
+    throw new Error(`Reconciliation dismissal "${record.id || ""}" is workflow-managed. Dismiss the current transition candidate instead of creating it directly.`);
+  }
   if (
     record?.type === "collection-review"
     && options.workflowCapability !== INTERNAL_WORKFLOW_CAPABILITIES.collectionReviewReassessment
@@ -984,7 +995,8 @@ async function deleteResourceUnlocked(input, type, id, options) {
   assertRevision(source, options.expectedRevision, "The record");
   const record = JSON.parse(source);
   if (
-    (record.type === "obligation-occurrence" && ["reconciled", "superseded"].includes(record.status))
+    record.type === "reconciliation-dismissal"
+    || (record.type === "obligation-occurrence" && ["reconciled", "superseded"].includes(record.status))
     || (record.type === "audit-population" && ["reconciled", "not-applicable", "superseded"].includes(record.status))
     || (record.type === "obligation-event" && ["complete", "canceled"].includes(record.status))
     || (record.type === "action-item" && record.obligationId && ["done", "canceled"].includes(record.status))