filegrc 0.13.4 → 0.13.5

package/model/v10.json

@@ -1436,9 +1436,9 @@
         "policyBasis": "Policies rely on governed documents for detailed plans, schedules, procedures, charters, and reports. Approval accepts the intended values and exact content. Activation records that the linked requirements were implemented and the approved Document was put into use.",
         "cadence": "Complete required program Documents in Step 2, obtain approval from a reviewer who is separate from the owner, implement their linked requirements in Step 3, then activate the unchanged approved revision. Follow the linked review Obligation after activation. Prepare Audit Documents in Step 5, then approve and activate each one there as separate revision-bound updates.",
         "reviewPoints": [
-          "Keep companion Markdown to the policy, procedure, evidence, or narrative the Document records. Put FileGRC instructions and derived actions in the UI or guides unless FileGRC is the subject.",
+          "Make the companion Markdown read as a finished policy, procedure, evidence record, or narrative.",
           "Replace every bracketed prompt with a reviewed fact before approval, activation, signing, or delivery.",
-          "Use ordinary business language; keep resource relationships in this record and its supporting records."
+          "Write in ordinary business language. Add resource relationships to this record, not its Markdown."
         ],
         "sourceResourceIds": [
           "policy-information-security",
@@ -1771,9 +1771,9 @@
         "cadence": "Create an Evidence Artifact only for a real retained artifact or approved reference. Identify its source Component or source records, Controls, collection and verification facts, coverage, revision, and classification.",
         "emptyState": "No Evidence Artifacts have been collected. Add one only when a real retained artifact or approved external reference exists.",
         "reviewPoints": [
-          "For a signed management representation, use artifactKind signed-record and artifactSubtype signed-management-representation.",
-          "For that representation, record the signing time in businessEventAt; use collectedOn for when FileGRC received it.",
-          "For a final CPA report, use artifactKind third-party-report and artifactSubtype soc2-report, then record its issuance time in sourceGeneratedAt."
+          "For a signed management representation, choose \"Signed Record\" for \"Artifact Kind\" and enter \"signed-management-representation\" for \"Artifact Subtype\".",
+          "Enter when the representation was signed in \"Business event time\". Use \"Collected On\" for the date you received it.",
+          "For a final CPA report, choose \"Third Party Report\" for \"Artifact Kind\", enter \"soc2-report\" for \"Artifact Subtype\", and enter when the CPA firm issued it in \"Source generation time\"."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -2545,7 +2545,7 @@
         "reviewPoints": [
           "Decide whether this criterion applies to the selected service, Trust Services Categories, customer commitments, and planned audit.",
           "Explain the decision using current service and system scope facts, not a generic statement.",
-          "Before marking it not applicable, confirm that no in-scope promise or control objective depends on it."
+          "Before choosing \"Not Applicable\", confirm that no in-scope promise or Control objective depends on it."
         ]
       },
       "required": [
@@ -2592,7 +2592,7 @@
         "reviewPoints": [
           "Confirm the statement reflects a real customer promise, service requirement, or approved business objective that applies to the current scope.",
           "Confirm which parts of the service the promise or objective affects.",
-          "Use an external, zero-population, or not-applicable conclusion only when it is factually true for the current scope."
+          "Use \"External\", \"Zero Population\", or \"Not Applicable\" only when it is true for the current scope."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -2737,7 +2737,7 @@
         "reviewPoints": [
           "Confirm that the linked Control actually depends on a customer or carved-out provider action.",
           "Make the statement specific enough for the responsible party to perform and for the system description to explain.",
-          "Before marking it not applicable, confirm that management is not responsible for the action."
+          "Before choosing \"Not Applicable\", confirm that management is not responsible for the action."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -2866,8 +2866,8 @@
         "cadence": "A Control may be implemented while its governing Policy, required program Document, or Training is approved but inactive. Before marking it implemented, record its owner, actual procedure in Record Markdown, bounded System scope, operation pattern, authoritative evidence-source Components, implementation date, and enabled calendar or event Obligations. Confirm each source Component is active, has the evidence role required by the Control family and current access owners, and includes repeatable retrieval instructions in Record Markdown. Enabled Obligations remain dormant until all of their governing content is active and effective.",
         "reviewPoints": [
           "Confirm the Control is needed for the applicable Requirements, Commitments, and service boundary.",
-          "Describe the actual procedure. Put starter-selection and FileGRC record-entry instructions in the UI or guides, unless FileGRC is an operating Component or evidence source.",
-          "Use not applicable, external, or zero population only when it is true for the current scope."
+          "Describe what people actually do to operate the Control.",
+          "Use \"Not Applicable\", \"External\", or \"Zero Population\" only when it is true for the current scope."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -4389,9 +4389,9 @@
         "policyBasis": "The information security policy requires security training and added role-specific instruction when a person’s responsibilities or data access warrant it.",
         "cadence": "Approve the exact training content in Step 2. During Step 3, finish the linked Controls and Obligations, then activate the unchanged approved revision. Assign training through Obligations at onboarding, annually, and after relevant material changes or incidents.",
         "reviewPoints": [
-          "Keep workforce material focused on required behavior. Put FileGRC commands, record-entry instructions, and data-model terms in guides and assignments.",
-          "Do not imply every user needs a paid product or that customer MFA applies without an approved requirement.",
-          "Bind each completion to the exact revision the person reviewed."
+          "Write the training for the people who must follow it and state the behavior you expect.",
+          "Include product-license or customer MFA requirements only when an approved requirement calls for them.",
+          "Link each completion to the exact Training revision the person completed."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -8065,7 +8065,7 @@
         "reviewPoints": [
           "Decide whether this source family applies to the current scope and audit period.",
           "Confirm the chosen source can produce the complete population or evidence needed.",
-          "Use not applicable or zero population only when that conclusion is factually true."
+          "Use \"Not Applicable\" or \"Zero Population\" only when it is true."
         ]
       },
       "required": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.13.4",
+  "version": "0.13.5",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/program-readiness.js

@@ -194,6 +194,7 @@ function programScope(program, records, byId, model, loaded) {
     return records.filter(fallback);
   };
   return {
+    program,
     systems: (program?.systemIds || [])
       .map((id) => byId.get(id))
       .filter((record) => record?.type === "system" && record.status !== "retired"),

package/src/web.js

@@ -880,7 +880,7 @@ function workflowGuidance(options = {}) {
   const rows = visible.map(renderRow).join("");
   const remaining = items.slice(visible.length);
   const more = remaining.length
-    ? '<details class="workflow-guidance-more"><summary>Show ' + remaining.length + ' more ' + pluralize("item", remaining.length) + '</summary><div class="workflow-findings workflow-findings-more">' + remaining.map(renderRow).join("") + '</div><p><code>filegrc workflow --json</code> returns this same checklist for CLI and agent use.</p></details>'
+    ? '<details class="workflow-guidance-more"><summary>Show ' + remaining.length + ' more ' + pluralize("item", remaining.length) + '</summary><div class="workflow-findings workflow-findings-more">' + remaining.map(renderRow).join("") + '</div></details>'
     : "";
   const completionRequirements = options.type && resourceReviewCriteria(options.type, { trigger: true });
   return '<section class="workflow-guidance panel detail-support-panel detail-workflow-panel"><div class="panel-head"><div><p class="kicker">To-do</p><h3>' + esc(options.title || "Checklist") + '</h3></div><span class="badge ' + (blocking.length ? "warn" : "good") + '">' + (blocking.length ? "Needs work" : "Current") + '</span></div><p class="workflow-status">' + esc(status) + (completionRequirements ? '. ' + completionRequirements : "") + '</p><div class="workflow-findings">' + rows + '</div>' + more + '</section>';
@@ -964,7 +964,7 @@ function openCompletionRequirementsDialog(type) {
   if (!reviewPoints.length) return;
   const dialog = document.createElement("dialog");
   dialog.className = "alert-dialog completion-requirements-dialog";
-  dialog.innerHTML = '<div class="dialog-head"><div><p class="kicker">Completion requirements</p><h2>' + esc(titleCase(definition.title)) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>Check these before considering this record complete.</p><ul>' + reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul><div class="dialog-actions"><button type="button" class="button primary">Close</button></div>';
+  dialog.innerHTML = '<div class="dialog-head"><div><p class="kicker">Completion requirements</p><h2>' + esc(titleCase(definition.title)) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>Before you finish this record, make sure:</p><ul>' + reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul><div class="dialog-actions"><button type="button" class="button primary">Close</button></div>';
   document.body.append(dialog);
   const close = () => dialog.close();
   dialog.querySelectorAll("button").forEach((button) => button.addEventListener("click", close));

package/src/workflow.js

@@ -460,14 +460,14 @@ function recordIncompleteReason(record, loaded, program) {
     };
   }
   const messages = {
-    draft: "Complete the record, its relationships, and required Markdown before review.",
-    planned: "Check this planned record against the actual program, then complete its finalization checks.",
-    proposed: "Review the proposed work, owner, schedule, and completion requirements before activation.",
-    "in-review": "Complete independent review and bind the approval to the exact content revision.",
-    open: "Complete or formally dispose of this open work with the required proof.",
+    draft: "Add the required details, relationships, and Markdown before review.",
+    planned: "Check this planned record against how your program works, then add the missing details.",
+    proposed: "Confirm the work, owner, schedule, and completion requirements before activation.",
+    "in-review": "Have an independent reviewer approve the exact content revision.",
+    open: "Complete this work with the required proof, or formally close it without completion.",
     "in-progress": "Finish the work, record the result, and link the completion proof.",
     blocked: "Resolve the recorded blockers before completing this work.",
-    "partially-implemented": "Finish the remaining control design, operation, source, and scheduling work."
+    "partially-implemented": "Finish the Control procedure, evidence sources, and schedules."
   };
   if (!messages[record.status]) return null;
   const requiredness = recordFinalizationRequiredness(record, loaded, program);
@@ -484,7 +484,7 @@ function recordIncompleteReason(record, loaded, program) {
     state: requiredness === "conditional" ? "scheduled" : "ready",
     requiredness,
     message: requiredness === "conditional"
-      ? "Keep this starter in draft until its recorded audience, program role, or audit stage applies. Finalize or retire it when that decision is made."
+      ? "Keep this starter in \"Draft\" until its audience, program role, or audit stage applies. Complete it when it applies; otherwise retire it."
       : messages[record.status]
   };
 }
@@ -533,7 +533,7 @@ function finalizationFields(record, model, resources, program) {
     fields.push({
       field: "applicabilityReview",
       requiredness: "required",
-      message: "Record or refresh the applicability decision, rationale, reviewer, and date. FileGRC records the current material scope automatically."
+      message: "Review applicability against the current service scope, then record the decision, rationale, reviewer, and date."
     });
   }
   if (record.type === "policy" && model.resources.policy?.fields?.programRole && !record.programRole) {
@@ -694,7 +694,7 @@ async function sourceCoverageFindings(loaded, program) {
             ? record.status === "active"
               ? "Add missing source details and link a passed retrieval test after setting a candidate period."
               : "Finish the source decision, retrieval method, retention, validity dates, and pre-period dry run after setting a candidate period."
-            : "Create a source-coverage record and choose FileGRC, an external authoritative System, zero population, or not applicable.",
+            : "Create a Source Coverage record and choose FileGRC, an external authoritative System, \"Zero Population\", or \"Not Applicable\".",
         subject: { type: "source-coverage", ...(record ? { id: record.id } : {}) },
         dependencies: [],
         actions: record