filegrc 0.12.4 → 0.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.12.4",
+  "version": "0.13.0",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/program-amendment.js

@@ -172,13 +172,14 @@ export async function assessProgramAmendmentReadiness(loaded) {
   const commitments = loaded.resources.filter((record) => (
     record.type === "commitment" && !["superseded", "retired"].includes(record.status)
   ));
-  const sourceIds = new Set(commitments.flatMap((record) => record.sourceResourceIds || []));
+  const supplementalCommitments = commitments.filter((record) => (record.sourceResourceIds || []).length > 0);
+  const sourceIds = new Set(supplementalCommitments.flatMap((record) => record.sourceResourceIds || []));
   for (const record of loaded.resources) {
     if (["policy", "document"].includes(record.type) && record.programRole === "supporting" && !["superseded", "retired"].includes(record.status)) {
       sourceIds.add(record.id);
     }
   }
-  const sourceRecords = [...new Set([...sourceIds, ...commitments.map(({ id }) => id)])]
+  const sourceRecords = [...new Set([...sourceIds, ...supplementalCommitments.map(({ id }) => id)])]
     .map((id) => byId.get(id))
     .filter((record) => record && SOURCE_TYPES.has(record.type));
   const plans = await Promise.all(sourceRecords.map((record) => (

package/src/program-path.js

@@ -11,8 +11,8 @@ export const RESOURCE_INSTRUCTIONS = {
   framework: "Confirm the criteria framework and version used for the program.",
   requirement: "Keep the published criterion as catalog content. Record management applicability and rationale on the selected Program.",
   commitment: "Record supplemental customer promises and service requirements that shape the scope or control design. The Commitment’s systemIds and controlIds are authoritative for what fulfills it.",
-  "requirement-mapping": "Record a reviewed relationship among Requirements, Commitments, and Controls. Choose the comparison method and relationship explicitly, explain the rationale, and bind the review to every mapped source revision.",
-  "reporting-route-set": "Record the normal and fallback ways people send one kind of report, including where each channel goes and the role that keeps it usable. Commit the proposal before approval, use separate approval and ongoing authority Appointments, and create a successor when either channel changes.",
+  "requirement-mapping": "Use a Requirement Mapping when supplemental policies, contracts, privacy promises, frameworks, or other sources need explicit coverage semantics. Choose the comparison method and relationship, explain the rationale, and bind the review to every mapped source revision.",
+  "reporting-route-set": "Prepare the normal and fallback ways people will send each report required by proposed program content, including where each channel goes and the role that keeps it usable. Commit the proposal in Step 1, approve it before cutover, use separate approval and ongoing authority Appointments, and create a successor when either channel changes.",
   policy: "Tailor each Policy to match what the company is committing to. Clear placeholders, assign an owner and separate approver, then bind approval to the reviewed content. Approval does not prove implementation. Activate the Policy during the Step 3 cutover after reviewing its implementation gaps.",
   document: "Complete required program Documents in Step 2, assign an owner and separate approver, and bind approval to the intended values and exact Markdown. Implement the linked requirements and activate that approved revision in Step 3. Prepare Audit Documents in Step 5.",
   control: "Finish each applicable starter Control with the procedure people follow, its owner, bounded System scope, operating Components, authoritative evidence-source Components, governing Policy and Requirement mappings, and implementation date. Put calendar and event schedules in Obligations.",
@@ -82,8 +82,8 @@ export const PROGRAM_PATH = [
     description: "Ownership, criteria, and service boundary",
     summary: "Name the owners, criteria, service, Systems, and providers in scope.",
     sections: [
-      { id: "ownership", title: "Program Ownership", description: "Confirm who owns the program, plus the normal security reporting channel and its fallback.", steps: ["Confirm the initial program lead’s actual job title and the separate Policy Owner Appointment.", "Add the organization’s real appointments, reviewers, and operators.", "Review the starter Security and Risk Oversight team, its members, and its chair.", "Set a normal security reporting channel and a fallback, then commit that proposal before approval.", "Add other teams only when the organization assigns shared responsibility to them."], types: ["person", "appointment", "team", "reporting-route-set"], defaultOpen: true },
-      { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Confirm the Program goal, owners, risk method, and candidate period.", "Review the included Security criteria references and record each applicability decision on the Program.", "Record customer commitments and reviewed mappings. Keep optional criteria out until the company chooses to add them."], types: ["program", "framework", "requirement", "commitment", "requirement-mapping"], defaultOpen: true },
+      { id: "ownership", title: "Program Ownership", description: "Confirm who owns the program, plus the normal security reporting channel and its fallback.", steps: ["Confirm the initial program lead’s actual job title and the separate Policy Owner Appointment.", "Add the organization’s real appointments, reviewers, and operators.", "Review the starter Security and Risk Oversight team, its members, and its chair.", "Replace the starter reporting-channel placeholders, propose the set, and commit that proposal before Step 1 is complete. Approve it before the later implementation cutover.", "Add other teams only when the organization assigns shared responsibility to them."], types: ["person", "appointment", "team", "reporting-route-set"], defaultOpen: true },
+      { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Confirm the Program goal, owners, risk method, and candidate period.", "Review the included Security criteria references and record each applicability decision on the Program.", "Replace each planned service-commitment prompt with the actual promise or requirement. Use Requirement Mappings only when a supplemental source needs an explicit coverage comparison. Keep optional criteria out until the company chooses to add them."], types: ["program", "framework", "requirement", "commitment", "requirement-mapping"], defaultOpen: true },
       { id: "boundary", title: "System Boundary", description: "Start with the bounded System. Add Components that materially deliver the service, support Controls, produce authoritative Evidence, or support relevant operations. Keep Vendor relationships and specific Assets separate.", steps: ["Create the complete bounded System and select it on the Program.", "Add only relevant Components, with a role and rationale for each System use.", "Create Vendors for material external provider relationships and link supplied Components when factual.", "Normalize Information Types and Classifications used by the System, Components, Vendors, Risks, and Evidence Artifacts."], types: ["system", "component", "vendor", "classification", "information-type"], defaultOpen: false }
     ],
     resourceTypes: ["person", "appointment", "team", "reporting-route-set", "program", "framework", "requirement", "commitment", "requirement-mapping", "system", "component", "vendor", "classification", "information-type"],

package/src/program-readiness.js

@@ -424,16 +424,32 @@ function reportingRouteSetItem(assessment) {
   const draft = assessment.routeSets.find(({ record }) => ["draft", "proposed"].includes(record.status));
   const required = assessment.requirements.length > 0;
   const proposed = assessment.proposedRequirements.length > 0;
-  const ready = assessment.issues.length === 0 && (!required || Boolean(current));
-  const needsAction = assessment.issues.length > 0;
+  const proposedPurposeKeys = [...new Set(assessment.proposedRequirements
+    .map(({ purposeKey }) => purposeKey)
+    .filter(Boolean))];
+  const preparedPurposeKeys = new Set(assessment.routeSets
+    .filter(({ record, committed, canceled, proposedRequirementIssues }) => (
+      ["proposed", "approved"].includes(record.status)
+      && committed
+      && !canceled
+      && proposedRequirementIssues.length === 0
+    ))
+    .map(({ record }) => record.purposeKey));
+  const unpreparedPurposeKeys = proposedPurposeKeys.filter((purposeKey) => !preparedPurposeKeys.has(purposeKey));
+  const ready = assessment.issues.length === 0
+    && (!required || Boolean(current))
+    && unpreparedPurposeKeys.length === 0;
+  const needsAction = assessment.issues.length > 0 || unpreparedPurposeKeys.length > 0;
   const target = current?.record || draft?.record || { type: "reporting-route-set" };
   let message;
-  if (needsAction) {
+  if (assessment.issues.length) {
     message = assessment.issues[0].message;
+  } else if (unpreparedPurposeKeys.length) {
+    message = `Complete and commit a Reporting Channel Set proposal for ${unpreparedPurposeKeys.join(", ")} before Step 1 is complete. Approval and effectiveness remain part of the later implementation cutover.`;
   } else if (required && ready && current) {
     message = `${current.record.title} is committed, effective, and has a current responsible Appointment. Assignments bind its Git commit.`;
-  } else if (!required && proposed && draft) {
-    message = "A draft or approved-but-inactive rule will require normal and fallback reporting channels later. Review them before that rule becomes active; this is not a current readiness gate.";
+  } else if (!required && proposed) {
+    message = "Every reporting-channel requirement in proposed program content has a committed Reporting Channel Set proposal. Approve the exact proposal before its governing content becomes active.";
   } else if (!required && draft) {
     message = "No approved rule currently requires these reporting channels. Keep the draft for review or remove it; it is not a readiness gate.";
   } else if (!required) {
@@ -443,12 +459,15 @@ function reportingRouteSetItem(assessment) {
   }
   return item(
     "security-reporting-route-set",
-    needsAction ? "action" : required ? ready ? "complete" : "action" : proposed && draft ? "later" : "info",
-    needsAction ? "Fix reporting channel requirements" : required ? "Approve required reporting channels" : proposed ? "Review proposed reporting channels" : "Reporting channels are not currently required",
+    needsAction ? "action" : required ? ready ? "complete" : "action" : proposed ? "complete" : "info",
+    needsAction ? "Prepare required reporting channels" : required ? "Approve required reporting channels" : proposed ? "Reporting channel proposals are ready" : "Reporting channels are not currently required",
     message,
     target,
     {
       requirements: assessment.requirements,
+      proposedRequirements: assessment.proposedRequirements,
+      proposedRequirementIssues: assessment.routeSets.flatMap(({ proposedRequirementIssues }) => proposedRequirementIssues),
+      unpreparedPurposeKeys,
       issues: assessment.issues,
       commands: [
         "npx filegrc reporting-route-sets --json",

package/src/reconciliation.js

@@ -456,6 +456,10 @@ export async function planReconciliation(input = process.cwd(), options = {}) {
 
 function reconciliationCandidate(loaded, transition, record, path, fingerprint, eventId, extra = {}) {
   const needsTimestamp = eventNeedsTimestamp(loaded, transition.eventType);
+  const requiredFacts = [
+    transition.eventType === "person-ended" ? "riskLevel" : null,
+    needsTimestamp ? "occurredAt" : "occurredOn"
+  ].filter(Boolean);
   return {
     id: `reconcile-${fingerprint.slice(0, 16)}`,
     eventId,
@@ -465,12 +469,13 @@ function reconciliationCandidate(loaded, transition, record, path, fingerprint,
     sourcePath: path,
     state: "needs-confirmation",
     message: transition.message,
-    requiredFacts: [
-      transition.eventType === "person-ended" ? "riskLevel" : null,
-      needsTimestamp ? "occurredAt" : "occurredOn"
-    ].filter(Boolean),
+    requiredFacts,
     action: {
-      kind: "command",
+      kind: "reconcile-transition",
+      candidateId: fingerprint,
+      eventType: transition.eventType,
+      subject: { type: record.type, id: record.id },
+      requiredFacts,
       command: reconciliationCommand(transition.eventType, record.id, fingerprint, needsTimestamp)
     },
     ...extra

package/src/reporting-route-integrity.js

@@ -14,6 +14,7 @@ import { appointmentWasAuthorizedOn } from "./soc2.js";
 import { isRfc3339Timestamp, localDateTimeValue, timestampFromLocalDateTime } from "./time.js";
 
 const CONTEMPORANEOUS_COMMIT_WINDOW_MS = 86_400_000;
+const REPORTING_ROUTE_REQUIREMENT_SOURCE_TYPES = new Set(["policy", "document", "commitment", "risk"]);
 
 export function reportingRouteRevision(record) {
   const effectiveFacts = {
@@ -103,10 +104,14 @@ export function reportingRouteAssertionTiming(loaded, routeSet, eventName) {
 
 export function reportingRouteFixedEvidence(records, subjectId, evidenceIds, at, timezone = "UTC", options = {}) {
   let date;
+  let availableDate;
   try {
     date = /^\d{4}-\d{2}-\d{2}$/.test(String(at || ""))
       ? String(at)
       : localDateTimeValue(instant(at, "Supported event time"), timezone).slice(0, 10);
+    availableDate = options.availableAt
+      ? localDateTimeValue(instant(options.availableAt, "Evidence availability time"), timezone).slice(0, 10)
+      : null;
   } catch {
     return [];
   }
@@ -119,6 +124,7 @@ export function reportingRouteFixedEvidence(records, subjectId, evidenceIds, at,
       || evidence.status !== "verified"
       || !arrayValue(evidence.sourceResourceIds).includes(subjectId)
       || !verifiedEvidenceComplete(evidence, personIds)
+      || (availableDate && (evidence.collectedOn > availableDate || evidence.verifiedOn > availableDate))
     ) return false;
     const coversDate = coverageContains(evidence.coverage, date)
       || [evidence.businessEventAt, evidence.sourceGeneratedAt].filter(Boolean).some((value) => {
@@ -274,6 +280,150 @@ export function reportingRouteRequirementAppliesToProgram(requirement, programId
     && arrayValue(requirement.programIds).includes(programId);
 }
 
+export function reportingRouteProposalIssues(records, routeSet, options = {}) {
+  return reportingRouteProposalIssuesForRequirements(
+    reportingRouteRequirementsForProposal(records, routeSet),
+    routeSet,
+    records,
+    options
+  );
+}
+
+export function reportingRouteRequirementsForProposal(records, routeSet, options = {}) {
+  return records.flatMap((source) => (
+    REPORTING_ROUTE_REQUIREMENT_SOURCE_TYPES.has(source.type)
+      && (
+        reportingRouteSourceMayBecomeEffective(source)
+        || reportingRouteSourceEffectiveAt(source, options.at, options.timezone)
+      )
+      ? (Array.isArray(source.reportingRouteRequirements) ? source.reportingRouteRequirements : [])
+        .filter((requirement) => (
+          requirement
+          && typeof requirement === "object"
+          && !Array.isArray(requirement)
+          && requirement.purposeKey === routeSet.purposeKey
+          && reportingRouteRequirementAppliesToProgram(requirement, routeSet.programId)
+        ))
+      : []
+  ));
+}
+
+function reportingRouteSourceEffectiveAt(source, at, timezone = "UTC") {
+  if (!at) return false;
+  try { return reportingRouteSourceEffective(source, at, timezone); } catch { return false; }
+}
+
+export function reportingRouteSupportIssues(requirements, routeSet, proposalRecords, currentRecords, options = {}) {
+  const proposalIssues = reportingRouteProposalIssuesForRequirements(
+    requirements,
+    routeSet,
+    proposalRecords,
+    { ...options, commit: options.proposalCommit }
+  );
+  const currentIssues = reportingRouteProposalIssuesForRequirements(
+    requirements,
+    routeSet,
+    currentRecords,
+    { ...options, commit: options.currentCommit }
+  );
+  return [...new Map([...proposalIssues, ...currentIssues].map((item) => [
+    `${item.code}\0${item.resourceId}\0${item.message}`,
+    item
+  ])).values()];
+}
+
+export function reportingRouteProposalIssuesForRequirements(requirements, routeSet, records, options = {}) {
+  const applicableRequirements = requirements.filter((requirement) => (
+    requirement
+    && typeof requirement === "object"
+    && !Array.isArray(requirement)
+    && requirement.purposeKey === routeSet.purposeKey
+    && reportingRouteRequirementAppliesToProgram(requirement, routeSet.programId)
+  ));
+  const issues = [];
+  const placeholder = (value) => /^(?:\[|tbd\b|todo\b|unknown\b|replace\b|complete before\b)/i.test(String(value || "").trim());
+  if (placeholder(routeSet.primaryLane?.destination)) {
+    issues.push({
+      code: "incomplete-reporting-route-proposal",
+      resourceId: routeSet.id,
+      message: `${routeSet.title} needs the real normal reporting destination before it can be proposed.`
+    });
+  }
+  if (applicableRequirements.some(({ requiredLanes }) => requiredLanes?.includes("alternate"))) {
+    if (!routeSet.alternateLane || placeholder(routeSet.alternateLane.destination)) {
+      issues.push({
+        code: "incomplete-reporting-route-proposal",
+        resourceId: routeSet.id,
+        message: `${routeSet.title} needs the real fallback reporting destination before it can be proposed.`
+      });
+    }
+  }
+  if (applicableRequirements.some(({ distinctChannels }) => distinctChannels)
+    && routeSet.alternateLane?.channelKind === routeSet.primaryLane?.channelKind) {
+    issues.push({
+      code: "reporting-route-channel-not-distinct",
+      resourceId: routeSet.id,
+      message: `${routeSet.title} needs different normal and fallback channel types before it can be proposed.`
+    });
+  }
+  if (applicableRequirements.some(({ independentDependencies }) => independentDependencies)
+    && !reportingRouteLanesIndependent(
+      routeSet,
+      records,
+      options.at || new Date(),
+      options
+    )) {
+    issues.push({
+      code: "reporting-route-dependencies-not-independent",
+      resourceId: routeSet.id,
+      message: `${routeSet.title} needs independent normal and fallback channel dependencies or an applicable Exception before it can be proposed.`
+    });
+  }
+  return issues;
+}
+
+export function reportingRouteLanesIndependent(record, records, at, options = {}) {
+  if (!record.alternateLane) return false;
+  for (const lane of [record.primaryLane, record.alternateLane]) {
+    if (!lane?.dependencyBasis) return false;
+    if (lane.dependencyBasis === "cataloged" && !lane.dependencySystemIds?.length) return false;
+    if (lane.dependencyBasis === "none" && !String(lane.dependencyRationale || "").trim()) return false;
+  }
+  const primary = new Set(record.primaryLane?.dependencySystemIds || []);
+  const overlap = (record.alternateLane.dependencySystemIds || []).filter((id) => primary.has(id));
+  if (!overlap.length) return true;
+  const timezone = options.timezone || record.approval?.timezone || "UTC";
+  let date;
+  let availableDate;
+  try {
+    date = localDateTimeValue(instant(at, "Reporting Route assessment time"), timezone).slice(0, 10);
+    availableDate = localDateTimeValue(
+      instant(options.availableAt || at, "Reporting Route support availability time"),
+      timezone
+    ).slice(0, 10);
+  } catch {
+    return false;
+  }
+  return records.some((candidate) => (
+    candidate.type === "exception"
+    && candidate.status === "approved"
+    && candidate.reportingRouteSetId === record.id
+    && candidate.reportingRouteLanePair === "primary-alternate"
+    && overlap.every((id) => candidate.dependencySystemIds?.includes(id))
+    && candidate.approval?.approvedOn <= date
+    && candidate.approval?.approvedOn <= availableDate
+    && candidate.approval?.expiresOn >= date
+    && reportingRouteFixedEvidence(
+      records,
+      candidate.id,
+      candidate.evidenceIds,
+      candidate.approval?.approvedOn,
+      timezone,
+      { root: options.root, commit: options.commit, availableAt: options.availableAt || at }
+    ).length > 0
+  ));
+}
+
 export function reportingRouteSourceEffective(source, at, timezone = "UTC") {
   const when = instant(at, "Source assessment time");
   if (!reportingRouteSourceMayApply(source)) return false;
@@ -299,6 +449,11 @@ export function reportingRouteSourceMayApply(source) {
   return false;
 }
 
+export function reportingRouteSourceMayBecomeEffective(source) {
+  return REPORTING_ROUTE_REQUIREMENT_SOURCE_TYPES.has(source?.type)
+    && !["superseded", "retired", "closed", "archived"].includes(source.status);
+}
+
 export function reportingRouteSetInterval(routeSet) {
   if (!["approved", "canceled"].includes(routeSet?.status) || !routeSet.approval?.effectiveAt) return null;
   return {
@@ -524,6 +679,32 @@ export function reportingRouteHistory(loaded, routeSetId) {
   return getDataRecordHistoryIndex(loaded.root).historiesById.get(routeSetId) || [];
 }
 
+export function reportingRouteExactHistoryEntry(loaded, routeSet, head) {
+  return reportingRouteHistory(loaded, routeSet.id).find((summary) => {
+    if (head && !isDataHistoryAncestor(loaded, summary.commit, head)) return false;
+    const source = getFileAtRevision(loaded.root, summary.commit, summary.path);
+    try { return source && JSON.stringify(JSON.parse(source)) === JSON.stringify(routeSet); } catch { return false; }
+  }) || null;
+}
+
+export function reportingRouteCommitTimestamp(loaded, routeSetId, commit) {
+  return reportingRouteHistory(loaded, routeSetId)
+    .find(({ commit: changedAt }) => changedAt === commit)?.timestamp || null;
+}
+
+export function reportingRouteProposalAssessmentTime(timestamp, assessmentAt = new Date()) {
+  let commitAt;
+  let assessedAt;
+  try {
+    commitAt = instant(timestamp, "Proposal commit time");
+    assessedAt = instant(assessmentAt, "Proposal assessment time");
+  } catch {
+    return null;
+  }
+  if (commitAt.getTime() > assessedAt.getTime() + CONTEMPORANEOUS_COMMIT_WINDOW_MS) return null;
+  return commitAt > assessedAt ? assessedAt : commitAt;
+}
+
 export function recordsAtRevision(loaded, commit) {
   const index = getDataRecordHistoryIndex(loaded.root);
   const records = [];

package/src/reporting-route-sets.js

@@ -3,14 +3,25 @@ import { applyResourceBatch, INTERNAL_WORKFLOW_CAPABILITIES, updateResource } fr
 import {
   effectiveReportingRouteRequirements as deriveEffectiveReportingRouteRequirements,
   reportingRouteAssertionTiming,
+  reportingRouteCommitTimestamp,
   reportingRouteEventCommit,
   reportingRouteEventAuthorityIssue,
   reportingRouteEventAuthorityIssueAtCommit,
+  reportingRouteExactHistoryEntry,
   reportingRouteFixedEvidence,
+  reportingRouteLanesIndependent,
   reportingRouteOngoingAuthorities,
+  reportingRouteProposalIssues,
+  reportingRouteProposalAssessmentTime,
+  reportingRouteProposalIssuesForRequirements,
   reportingRouteRecordAtRevision,
+  reportingRouteRequirementAppliesToProgram,
+  reportingRouteRequirementsForProposal,
+  reportingRouteSupportIssues,
+  recordsAtRevision,
   reportingRouteSourceEffective,
   reportingRouteSourceMayApply,
+  reportingRouteSourceMayBecomeEffective,
   reportingRouteSourceAppliesToProgram
 } from "./reporting-route-integrity.js";
 import { localDateTimeValue } from "./time.js";
@@ -23,6 +34,8 @@ const SOURCE_TYPES = new Set(["policy", "document", "commitment", "risk"]);
 const MAX_PERIOD_BOUNDARIES = 512;
 const PERIOD_REPOSITORY_SNAPSHOT = Symbol("filegrc.reportingRoutePeriodRepositorySnapshot");
 
+export { reportingRouteLanesIndependent };
+
 export async function assessReportingRouteSets(input = process.cwd(), options = {}) {
   const loaded = typeof input === "object" && input?.resources ? input : await loadWorkspace(input);
   if (!loaded.model.resources?.["reporting-route-set"]) {
@@ -46,13 +59,19 @@ export async function assessReportingRouteSets(input = process.cwd(), options =
   const requirements = deriveEffectiveReportingRouteRequirements(loaded.resources, at, programId, timezone);
   const proposedRequirements = loaded.resources.flatMap((source) => (
     SOURCE_TYPES.has(source.type)
+      && reportingRouteSourceMayBecomeEffective(source)
       && (!programId || reportingRouteSourceAppliesToProgram(
         source,
         loaded.resources.find(({ type, id }) => type === "program" && id === programId),
         loaded.resources
       ))
       ? (Array.isArray(source.reportingRouteRequirements) ? source.reportingRouteRequirements : [])
-        .filter((requirement) => requirement && typeof requirement === "object" && !Array.isArray(requirement))
+        .filter((requirement) => (
+          requirement
+          && typeof requirement === "object"
+          && !Array.isArray(requirement)
+          && (!programId || reportingRouteRequirementAppliesToProgram(requirement, programId))
+        ))
         .map((requirement) => ({
         ...requirement,
         sourceId: source.id,
@@ -66,7 +85,10 @@ export async function assessReportingRouteSets(input = process.cwd(), options =
   ));
   const repository = options[PERIOD_REPOSITORY_SNAPSHOT]
     || await getRepositorySnapshot(loaded.root, { fresh: true });
-  const assessments = routeSets.map((record) => assessRouteSet(record, loaded, at, repository));
+  const assessments = routeSets.map((record) => ({
+    ...assessRouteSet(record, loaded, at, repository),
+    ...proposedRequirementAssessment(record, loaded, repository, proposedRequirements, at, timezone)
+  }));
   const issues = loaded.resources.flatMap((source) => {
     if (!SOURCE_TYPES.has(source.type) || !Object.hasOwn(source, "reportingRouteRequirements")) return [];
     if (!reportingRouteSourceMayApply(source)) return [];
@@ -118,7 +140,10 @@ export async function assessReportingRouteSets(input = process.cwd(), options =
     if (requirement.distinctChannels && route.alternateLane?.channelKind === route.primaryLane?.channelKind) {
       issues.push(issue("reporting-route-channel-not-distinct", route.id, `${requirement.sourceId} requires different normal and fallback channel types.`));
     }
-    if (requirement.independentDependencies && !reportingRouteLanesIndependent(route, loaded.resources, at)) {
+    if (requirement.independentDependencies && !reportingRouteLanesIndependent(route, loaded.resources, at, {
+      timezone,
+      root: loaded.root
+    })) {
       issues.push(issue("reporting-route-dependencies-not-independent", route.id, `${requirement.sourceId} requires independent channel dependencies or an applicable Exception.`));
     }
   }
@@ -331,6 +356,12 @@ export async function proposeReportingRouteSet(input, options = {}) {
   const loaded = await loadWorkspace(input);
   const entry = routeEntry(loaded, options.routeSetId);
   if (entry.record.status !== "draft") throw new Error(`Reporting Channel Set "${entry.record.id}" must be draft before it is proposed.`);
+  const proposalIssues = reportingRouteProposalIssues(loaded.resources, entry.record, {
+    at: new Date(),
+    timezone: loaded.workspace?.timezone || "UTC",
+    root: loaded.root
+  });
+  if (proposalIssues.length) throw new Error(proposalIssues[0].message);
   const result = await updateResource(loaded.root, entry.record.type, entry.record.id, {
     ...entry.record,
     status: "proposed"
@@ -347,12 +378,38 @@ export async function approveReportingRouteSet(input, options = {}) {
   if (entry.record.status !== "proposed") throw new Error(`Reporting Channel Set "${entry.record.id}" must be proposed before approval.`);
   const proposalCommit = fullCommit(options.proposalCommit, "Proposal commit");
   assertProposalMatches(loaded, entry, proposalCommit);
+  const proposalRecords = recordsAtRevision(loaded, proposalCommit);
+  const proposalTimestamp = reportingRouteCommitTimestamp(loaded, entry.record.id, proposalCommit);
+  if (!proposalTimestamp) throw new Error(`Proposal commit ${proposalCommit} is not present in Reporting Channel Set history.`);
+  const proposalAssessmentAt = reportingRouteProposalAssessmentTime(proposalTimestamp, new Date());
+  if (!proposalAssessmentAt) throw new Error("Proposal commit time is too far in the future to establish a reliable proposal.");
+  const proposalIssues = reportingRouteProposalIssues(proposalRecords, entry.record, {
+    at: proposalAssessmentAt,
+    timezone: proposalRecords.find(({ type }) => type === "workspace")?.timezone || loaded.workspace?.timezone || "UTC",
+    root: loaded.root,
+    commit: proposalCommit
+  });
+  if (proposalIssues.length) throw new Error(proposalIssues[0].message);
   const approvedAt = pastOrPresentTimestamp(options.approvedAt, "Approval time");
   const effectiveAt = instant(options.effectiveAt, "Effective time");
   const timezone = timezoneName(options.timezone);
   assertTimestampZone(options.approvedAt, timezone, "Approval time");
   assertTimestampZone(options.effectiveAt, timezone, "Effective time");
   if (effectiveAt < approvedAt) throw new Error("A Reporting Channel Set cannot become effective before it is approved.");
+  const cutoverIssues = reportingRouteSupportIssues(
+    reportingRouteRequirementsForProposal(loaded.resources, entry.record, { at: effectiveAt, timezone }),
+    entry.record,
+    proposalRecords,
+    loaded.resources,
+    {
+      at: effectiveAt,
+      availableAt: approvedAt,
+      timezone,
+      root: loaded.root,
+      proposalCommit
+    }
+  );
+  if (cutoverIssues.length) throw new Error(cutoverIssues[0].message);
   const authority = approvalAuthority(loaded, entry.record, options, approvedAt, timezone);
   const approvalEvidenceIds = [...new Set(options.evidenceIds || [])];
   if (!reportingRouteFixedEvidence(
@@ -527,6 +584,83 @@ function assessRouteSet(record, loaded, at, repository) {
   if (COMMIT_REQUIRED_STATUSES.has(record.status) && !committed) {
     issues.push(issue("reporting-route-commit-required", record.id, `${record.title} must be committed before this lifecycle state can be relied on.`));
   }
+  const proposalEntry = loaded.entries.find(({ record: candidate }) => candidate.id === record.id);
+  const historicalProposal = ["approved", "canceled"].includes(record.status)
+    && proposalEntry
+    && /^[a-f0-9]{40}$/i.test(String(record.proposalCommit || ""))
+    ? reportingRouteRecordAtRevision(loaded, proposalEntry, record.proposalCommit)
+    : null;
+  if (record.status === "proposed") {
+    const proposalHistory = committed && repository.commit
+      ? reportingRouteExactHistoryEntry(loaded, record, repository.commit)
+      : null;
+    const proposalRecords = proposalHistory ? recordsAtRevision(loaded, proposalHistory.commit) : loaded.resources;
+    const proposalRecord = proposalHistory
+      ? proposalRecords.find(({ id }) => id === record.id) || record
+      : record;
+    const proposalAssessmentAt = proposalHistory
+      ? reportingRouteProposalAssessmentTime(proposalHistory.timestamp, at)
+      : at;
+    if (proposalHistory && !proposalAssessmentAt) {
+      issues.push(issue("invalid-reporting-route-proposal-time", record.id, "The proposal commit time is too far in the future to establish a reliable proposal."));
+    }
+    issues.push(...reportingRouteProposalIssues(proposalRecords, proposalRecord, {
+      at: proposalAssessmentAt || at,
+      timezone: proposalRecords.find(({ type }) => type === "workspace")?.timezone || loaded.workspace?.timezone || "UTC",
+      root: loaded.root,
+      commit: proposalHistory?.commit
+    }));
+  } else if (historicalProposal) {
+    const proposalRecords = recordsAtRevision(loaded, record.proposalCommit);
+    const proposalTimestamp = reportingRouteCommitTimestamp(loaded, record.id, record.proposalCommit);
+    const proposalAssessmentAt = proposalTimestamp
+      ? reportingRouteProposalAssessmentTime(proposalTimestamp, at)
+      : null;
+    if (!proposalTimestamp) {
+      issues.push(issue("invalid-reporting-route-proposal", record.id, "The proposal commit must be an exact Reporting Channel Set history entry."));
+    } else if (!proposalAssessmentAt) {
+      issues.push(issue("invalid-reporting-route-proposal-time", record.id, "The proposal commit time is too far in the future to establish a reliable proposal."));
+    } else {
+      const proposalIssues = reportingRouteProposalIssues(
+        proposalRecords,
+        historicalProposal,
+        {
+          at: proposalAssessmentAt,
+          timezone: proposalRecords.find(({ type }) => type === "workspace")?.timezone || loaded.workspace?.timezone || "UTC",
+          root: loaded.root,
+          commit: record.proposalCommit
+        }
+      );
+      issues.push(...proposalIssues);
+      if (!proposalIssues.length) {
+        const approvalCommit = reportingRouteEventCommit(loaded, record, "approval");
+        const approvalRecords = approvalCommit ? recordsAtRevision(loaded, approvalCommit) : loaded.resources;
+        const liveCommit = record.status === "canceled"
+          ? reportingRouteEventCommit(loaded, record, "cancellation")
+          : null;
+        const liveRecords = liveCommit ? recordsAtRevision(loaded, liveCommit) : loaded.resources;
+        const cutoverAt = record.approval?.effectiveAt || record.approval?.approvedAt || at;
+        const cutoverTimezone = record.approval?.timezone || loaded.workspace?.timezone || "UTC";
+        issues.push(...reportingRouteSupportIssues(
+          reportingRouteRequirementsForProposal(approvalRecords, record, {
+            at: cutoverAt,
+            timezone: cutoverTimezone
+          }),
+          record,
+          proposalRecords,
+          liveRecords,
+          {
+            at: cutoverAt,
+            availableAt: record.approval?.approvedAt || at,
+            timezone: cutoverTimezone,
+            root: loaded.root,
+            proposalCommit: record.proposalCommit,
+            currentCommit: liveCommit
+          }
+        ));
+      }
+    }
+  }
   if (record.status === "approved" && record.approval && repository.commit && !isDataHistoryAncestor(loaded, record.proposalCommit, repository.commit)) {
     issues.push(issue("invalid-reporting-route-proposal-lineage", record.id, "The approved revision must descend from the exact committed proposal."));
   }
@@ -576,6 +710,26 @@ function assessRouteSet(record, loaded, at, repository) {
   };
 }
 
+function proposedRequirementAssessment(record, loaded, repository, requirements, at, timezone) {
+  const history = repository.commit
+    ? reportingRouteExactHistoryEntry(loaded, record, repository.commit)
+    : null;
+  const records = history ? recordsAtRevision(loaded, history.commit) : loaded.resources;
+  return {
+    proposedRequirementIssues: reportingRouteProposalIssuesForRequirements(
+      requirements,
+      record,
+      records,
+      {
+        at: history ? reportingRouteProposalAssessmentTime(history.timestamp, at) || at : at,
+        timezone,
+        root: loaded.root,
+        commit: history?.commit
+      }
+    )
+  };
+}
+
 function committedRecordMatches(loaded, record, commit) {
   const entry = loaded.entries.find(({ record: candidate }) => candidate.id === record.id);
   const historical = entry ? reportingRouteRecordAtRevision(loaded, entry, commit) : null;
@@ -677,28 +831,6 @@ function approvalAuthority(loaded, routeSet, options, at, timezone) {
   return appointment;
 }
 
-export function reportingRouteLanesIndependent(record, records, at) {
-  if (!record.alternateLane) return false;
-  for (const lane of [record.primaryLane, record.alternateLane]) {
-    if (!lane?.dependencyBasis) return false;
-    if (lane.dependencyBasis === "cataloged" && !lane.dependencySystemIds?.length) return false;
-    if (lane.dependencyBasis === "none" && !String(lane.dependencyRationale || "").trim()) return false;
-  }
-  const primary = new Set(record.primaryLane?.dependencySystemIds || []);
-  const overlap = (record.alternateLane.dependencySystemIds || []).filter((id) => primary.has(id));
-  if (!overlap.length) return true;
-  const date = localDateTimeValue(at, record.approval?.timezone || "UTC").slice(0, 10);
-  return records.some((candidate) => (
-    candidate.type === "exception"
-    && candidate.status === "approved"
-    && candidate.reportingRouteSetId === record.id
-    && candidate.reportingRouteLanePair === "primary-alternate"
-    && overlap.every((id) => candidate.dependencySystemIds?.includes(id))
-    && candidate.approval?.approvedOn <= date
-    && candidate.approval?.expiresOn >= date
-  ));
-}
-
 function routeEntry(loaded, id) {
   const entry = loaded.entries.find(({ record }) => record.type === "reporting-route-set" && record.id === id);
   if (!entry) throw new Error(`Reporting Channel Set "${id || ""}" was not found.`);

package/src/validate.js

@@ -30,10 +30,17 @@ import { collectionReviewRevision, historicalCollectionReviewSnapshot } from "./
 import {
   reportingRouteRevision,
   reportingRouteBindingExpectationForValidation,
+  reportingRouteCommitTimestamp,
   reportingRouteEventCommit,
   reportingRouteEventAuthorityIssueAtCommit,
+  reportingRouteExactHistoryEntry,
   reportingRouteFixedEvidence,
-  reportingRouteRecordAtRevision
+  reportingRouteProposalIssues,
+  reportingRouteProposalAssessmentTime,
+  reportingRouteRecordAtRevision,
+  reportingRouteRequirementsForProposal,
+  reportingRouteSupportIssues,
+  recordsAtRevision
 } from "./reporting-route-integrity.js";
 import { validateWorkflowHistoryIntegrity } from "./workflow-history-integrity.js";
 
@@ -902,6 +909,29 @@ function validateReportingRouteSets(loaded, byId, pathById, diagnostics) {
   }
   for (const route of routeSets) {
     const path = pathById.get(route.id);
+    if (route.status === "proposed") {
+      const proposalHistory = repository.commit
+        ? reportingRouteExactHistoryEntry(loaded, route, repository.commit)
+        : null;
+      const proposalRecords = proposalHistory ? recordsAtRevision(loaded, proposalHistory.commit) : loaded.resources;
+      const proposalRecord = proposalHistory
+        ? proposalRecords.find(({ id }) => id === route.id) || route
+        : route;
+      const proposalAssessmentAt = proposalHistory
+        ? reportingRouteProposalAssessmentTime(proposalHistory.timestamp, new Date())
+        : new Date();
+      if (proposalHistory && !proposalAssessmentAt) {
+        diagnostics.push(error("invalid-reporting-route-proposal-time", path, "The proposal commit time is too far in the future to establish a reliable proposal."));
+      }
+      for (const issue of reportingRouteProposalIssues(proposalRecords, proposalRecord, {
+        at: proposalAssessmentAt || new Date(),
+        timezone: proposalRecords.find(({ type }) => type === "workspace")?.timezone || loaded.workspace?.timezone || "UTC",
+        root: loaded.root,
+        commit: proposalHistory?.commit
+      })) {
+        diagnostics.push(error(issue.code, path, issue.message));
+      }
+    }
     if (["draft", "proposed", "approved"].includes(route.status)) {
       const key = `${route.programId}\0${route.purposeKey}`;
       const current = currentByPurpose.get(key) || { approved: [], pending: [] };
@@ -937,6 +967,60 @@ function validateReportingRouteSets(loaded, byId, pathById, diagnostics) {
     const proposal = entry ? reportingRouteRecordAtRevision(loaded, entry, route.proposalCommit) : null;
     if (!proposal || proposal.status !== "proposed" || !sameRouteProposal(proposal, route)) {
       diagnostics.push(error("changed-reporting-route-proposal", path, "The approved Route Set facts must exactly match the committed proposal; only managed approval fields may differ."));
+    } else {
+      const proposalRecords = recordsAtRevision(loaded, route.proposalCommit);
+      const proposalTimestamp = reportingRouteCommitTimestamp(loaded, route.id, route.proposalCommit);
+      const proposalAssessmentAt = proposalTimestamp
+        ? reportingRouteProposalAssessmentTime(proposalTimestamp, new Date())
+        : null;
+      if (!proposalTimestamp) {
+        diagnostics.push(error("invalid-reporting-route-proposal", path, "The proposal commit must be an exact Reporting Channel Set history entry."));
+      } else if (!proposalAssessmentAt) {
+        diagnostics.push(error("invalid-reporting-route-proposal-time", path, "The proposal commit time is too far in the future to establish a reliable proposal."));
+      } else {
+        const proposalIssues = reportingRouteProposalIssues(
+          proposalRecords,
+          proposal,
+          {
+            at: proposalAssessmentAt,
+            timezone: proposalRecords.find(({ type }) => type === "workspace")?.timezone || loaded.workspace?.timezone || "UTC",
+            root: loaded.root,
+            commit: route.proposalCommit
+          }
+        );
+        for (const issue of proposalIssues) {
+          diagnostics.push(error(issue.code, path, issue.message));
+        }
+        if (!proposalIssues.length) {
+          const approvalCommit = reportingRouteEventCommit(loaded, route, "approval");
+          const approvalRecords = approvalCommit ? recordsAtRevision(loaded, approvalCommit) : loaded.resources;
+          const liveCommit = route.status === "canceled"
+            ? reportingRouteEventCommit(loaded, route, "cancellation")
+            : null;
+          const liveRecords = liveCommit ? recordsAtRevision(loaded, liveCommit) : loaded.resources;
+          const cutoverAt = route.approval?.effectiveAt || route.approval?.approvedAt || new Date();
+          const cutoverTimezone = route.approval?.timezone || loaded.workspace?.timezone || "UTC";
+          for (const issue of reportingRouteSupportIssues(
+            reportingRouteRequirementsForProposal(approvalRecords, route, {
+              at: cutoverAt,
+              timezone: cutoverTimezone
+            }),
+            route,
+            proposalRecords,
+            liveRecords,
+            {
+              at: cutoverAt,
+              availableAt: route.approval?.approvedAt || new Date(),
+              timezone: cutoverTimezone,
+              root: loaded.root,
+              proposalCommit: route.proposalCommit,
+              currentCommit: liveCommit
+            }
+          )) {
+            diagnostics.push(error(issue.code, path, issue.message));
+          }
+        }
+      }
     }
     for (const markdown of markdownEntries(loaded.model, route)) {
       const currentPath = `data/${markdown.path}`;

package/src/web.js

@@ -174,7 +174,7 @@ function desiredStateSections(route) {
   const sections = new Set(["repository", ...blockingStateSections(route)]);
   if (route.name === "list" && (["requirement", "requirement-mapping"].includes(route.type) || state.model.collectionReviews?.[route.type])) sections.add("program");
   if (route.name === "detail" && ["policy", "document", "training", "control", "component", "requirement-mapping", "retention-schedule-item"].includes(route.type)) sections.add("program");
-  if (route.name === "detail" && ["policy", "document", "framework", "requirement", "commitment", "system", "component", "vendor", "information-type", "source-coverage", "requirement-mapping", "retention-schedule-item"].includes(route.type)) sections.add("workflow");
+  if (route.name === "detail") sections.add("workflow");
   if (route.name === "detail" && ["obligation", "action-item", "obligation-event"].includes(route.type)) sections.add("obligations");
   if (route.name === "detail" && route.type === "audit") sections.add("audits");
   return [...sections];
@@ -1001,10 +1001,12 @@ function workflowItemHref(item) {
   if (source && ["assigned-work", "obligation-occurrence"].includes(item.kind)) {
     return "#/stage/run?work=" + encodeURIComponent(source.type + ":" + source.id);
   }
-  const commands = [
-    ...(item.actions || []).map((action) => action.command),
-    item.nextAction?.command
-  ].filter(Boolean);
+  const actions = [...(item.actions || []), item.nextAction].filter(Boolean);
+  const reconciliationAction = actions.find((action) => action.kind === "reconcile-transition");
+  if (reconciliationAction?.candidateId) {
+    return "#/stage/run?reconcile=" + encodeURIComponent(reconciliationAction.candidateId);
+  }
+  const commands = actions.map((action) => action.command).filter(Boolean);
   if (item.createResourceType && state.model.resources[item.createResourceType]) {
     const params = new URLSearchParams({ new: "1" });
     if (item.title) params.set("title", item.createResourceType === "commitment"
@@ -1612,6 +1614,16 @@ function renderObligations(main, params = new URLSearchParams()) {
       if (requestedEvent) main.querySelector('[data-start-event="' + CSS.escape(requestedEvent) + '"]')?.click();
     });
   }
+  const requestedReconciliation = params.get("reconcile");
+  if (requestedReconciliation) {
+    queueMicrotask(() => {
+      const candidate = state.reconciliation?.candidates?.find((item) => (
+        item.transitionFingerprint === requestedReconciliation
+        || item.id === requestedReconciliation
+      ));
+      if (candidate) openReconciliationConfirmation(candidate);
+    });
+  }
   const requestedWork = params.get("work");
   if (requestedWork) {
     queueMicrotask(() => {
@@ -3274,6 +3286,67 @@ function openReconciliationDismissal(candidate) {
   });
 }
 
+function openReconciliationConfirmation(candidate) {
+  if (document.querySelector('[data-reconciliation-confirmation="' + CSS.escape(candidate.transitionFingerprint) + '"]')) return;
+  const writeDisabled = state.readOnly
+    ? ' disabled title="Writes are not available in this repository state"'
+    : "";
+  const needsTimestamp = (candidate.requiredFacts || []).includes("occurredAt");
+  const eventField = needsTimestamp
+    ? '<label><span>Event time <small>your local time</small></span><input name="occurredAt" type="datetime-local" required value="' + esc(currentLocalDateTime()) + '"></label>'
+    : '<label><span>Event date</span><input name="occurredOn" type="date" required value="' + esc(currentDate()) + '"></label>';
+  const riskField = (candidate.requiredFacts || []).includes("riskLevel")
+    ? '<label><span>Departure risk</span><select name="riskLevel" required><option value="normal">Normal</option><option value="high">High or involuntary</option></select></label>'
+    : "";
+  const dialog = document.createElement("dialog");
+  dialog.className = "commit-dialog event-dialog";
+  dialog.dataset.reconciliationConfirmation = candidate.transitionFingerprint;
+  dialog.setAttribute("aria-labelledby", "reconciliation-confirmation-title");
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Git transition review</p><h2 id="reconciliation-confirmation-title">' + esc(policyEventName(candidate.eventType)) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>' + esc(candidate.message) + '</p><section class="event-dialog-steps"><div><strong>' + esc(candidate.subject.title || candidate.subject.id) + '</strong><small>' + esc(candidate.sourcePath) + '</small></div></section>' + eventField + riskField + '<label><span>Workflow name <small>optional</small></span><input name="title" maxlength="200" placeholder="' + esc(policyEventName(candidate.eventType)) + '"' + writeDisabled + '></label>' + (state.readOnly ? '<p class="dialog-note">Open this workspace in the local writable renderer or use the CLI to confirm or dismiss this transition.</p>' : "") + '<div class="dialog-error" role="alert"></div><div class="save-status" role="status" aria-live="polite"></div><div class="dialog-actions"><button type="button" class="button" data-dismiss-candidate' + writeDisabled + '>Dismiss false positive</button><button type="button" class="button" data-dismiss-dialog>Cancel</button><button type="submit" class="button primary"' + writeDisabled + '>Confirm and add work</button></div></form>';
+  document.body.append(dialog);
+  dialog.showModal();
+  dialog.querySelector(".icon-button").addEventListener("click", () => dialog.close());
+  dialog.querySelector("[data-dismiss-dialog]").addEventListener("click", () => dialog.close());
+  dialog.querySelector("[data-dismiss-candidate]").addEventListener("click", () => {
+    dialog.close();
+    openReconciliationDismissal(candidate);
+  });
+  dialog.addEventListener("close", () => dialog.remove());
+  dialog.querySelector("form").addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const form = event.currentTarget;
+    if (!form.reportValidity()) return;
+    try {
+      setMutationBusy(dialog, true, "Confirming…", "Confirm and add work");
+      const response = await localFetch("/api/reconciliation", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          candidateId: candidate.transitionFingerprint,
+          occurredOn: form.elements.occurredOn?.value || undefined,
+          occurredAt: form.elements.occurredAt?.value ? new Date(form.elements.occurredAt.value).toISOString() : undefined,
+          riskLevel: form.elements.riskLevel?.value || undefined,
+          title: form.elements.title.value,
+          confirmed: true
+        })
+      });
+      if (!response.ok) throw new Error(await responseMessage(response));
+      const created = await response.json();
+      policyEventFeedback = {
+        name: policyEventName(candidate.eventType),
+        taskCount: created.actions?.length || 0
+      };
+      applyMutationState(created);
+      dialog.close();
+      history.replaceState(null, "", "#/stage/run");
+      render();
+    } catch (error) {
+      setMutationBusy(dialog, false, "", "Confirm and add work");
+      dialog.querySelector(".dialog-error").textContent = error.message;
+    }
+  });
+}
+
 async function runRepositoryGitAction(action) {
   const buttons = [...document.querySelectorAll("[data-git-action]")];
   const disabled = buttons.map((button) => button.disabled);