filegrc 0.13.4 → 0.14.0

package/README.md

@@ -44,13 +44,13 @@ npx filegrc policy-library
 
 The command shows an exact diff only when the current text still matches the prior starter default. It skips customized, approved, active, superseded, and retired Policy content. Accept one named proposal revision only with the command printed by the review, which includes `--accept`, `--proposal-revision`, and `--yes`. Acceptance fails if the proposal changed after review. It changes only the listed defaults and does not approve a Policy, activate it, or mark a Control implemented.
 
-The normal runtime uses data model v6. Start a model v5 upgrade with a read-only preview:
+The normal runtime uses data model v11. Existing model v10 workspaces start with a read-only preview:
 
 ```sh
-npx filegrc migrate --to-model 6 --preview --json
+npx filegrc migrate --to-model 11 --preview --json
 ```
 
-Review every automatic, review-required, and unsupported item. Model v6 gives Training the same separate approval and activation lifecycle as other governed content. It preserves active model v5 Training with a visible legacy basis and removes Training schedule fields, because Obligations now own assignment timing. Resolve unsupported items before applying the same migration with `--yes`. The [model v6 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v6.md) documents the review.
+Review every automatic, review-required, and unsupported item. Model v11 removes the old per-Control implementation approval fields. Owners can record implementation directly, while periodic Control oversight uses one Collection Review at the end of Step 3. Policy, Document, and Training approvals stay independent. Resolve unsupported items before applying the same migration with `--yes`. The [model v11 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v11.md) documents the review.
 
 A model v2 workspace must migrate to v3 first:
 
@@ -66,7 +66,7 @@ A model v1 workspace must migrate to v2 first:
 npx filegrc migrate --to-model 2 --preview --json
 ```
 
-Follow the [model v2 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v2.md), then run the model v3, v4, v5, and v6 previews in order.
+Follow the [model v2 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v2.md), then migrate one model version at a time through model v11.
 
 `filegrc serve --help` prints bind, port, environment, and safety options without starting the server. The editable server prefers `127.0.0.1:8787` and chooses another available port when that port is occupied. Set `FILEGRC_HOST`, `FILEGRC_PORT`, or the matching flags when needed. In trunk mode, browser saves synchronize, commit, and push from the authoritative branch. Use `--allow-non-authoritative-writes` for local development in a task checkout; the override never commits or pushes.
 

package/model/index.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 
-export const ACTIVE_MODEL_VERSION = "10";
-export const SUPPORTED_MODEL_VERSIONS = Object.freeze(["2", "3", "4", "5", "6", "7", "8", "9", ACTIVE_MODEL_VERSION]);
+export const ACTIVE_MODEL_VERSION = "11";
+export const SUPPORTED_MODEL_VERSIONS = Object.freeze(["2", "3", "4", "5", "6", "7", "8", "9", "10", ACTIVE_MODEL_VERSION]);
 export const MODEL_CAPABILITY_VERSIONS = Object.freeze({
   "guided-workflow": 3,
   "program-scope": 4,
@@ -16,7 +16,8 @@ export const MODEL_CAPABILITY_VERSIONS = Object.freeze({
   "rolled-up-obligations": 9,
   "temporal-collection-reviews": 9,
   "reporting-routes": 9,
-  "reporting-route-sets": 10
+  "reporting-route-sets": 10,
+  "control-collection-oversight": 11
 });
 
 export function modelSupports(modelOrVersion, capability) {
@@ -31,9 +32,9 @@ export function modelSupports(modelOrVersion, capability) {
 export function loadModel(version = ACTIVE_MODEL_VERSION) {
   const requested = String(version);
   if (!SUPPORTED_MODEL_VERSIONS.includes(requested)) {
-    const migrationTarget = requested === "1" ? "2" : requested === "2" ? "3" : requested === "3" ? "4" : requested === "4" ? "5" : requested === "5" ? "6" : requested === "6" ? "7" : requested === "7" ? "8" : requested === "8" ? "9" : "10";
+    const migrationTarget = requested === "1" ? "2" : requested === "2" ? "3" : requested === "3" ? "4" : requested === "4" ? "5" : requested === "5" ? "6" : requested === "6" ? "7" : requested === "7" ? "8" : requested === "8" ? "9" : requested === "9" ? "10" : "11";
     throw new Error(
-      `Unsupported data model version "${requested}". This filegrc release supports models v2 through v10. `
+      `Unsupported data model version "${requested}". This filegrc release supports models v2 through v11. `
       + `Run \`npx filegrc migrate --to-model ${migrationTarget} --preview --json\` from the workspace root.`
     );
   }

package/model/v10.json

@@ -1436,9 +1436,9 @@
         "policyBasis": "Policies rely on governed documents for detailed plans, schedules, procedures, charters, and reports. Approval accepts the intended values and exact content. Activation records that the linked requirements were implemented and the approved Document was put into use.",
         "cadence": "Complete required program Documents in Step 2, obtain approval from a reviewer who is separate from the owner, implement their linked requirements in Step 3, then activate the unchanged approved revision. Follow the linked review Obligation after activation. Prepare Audit Documents in Step 5, then approve and activate each one there as separate revision-bound updates.",
         "reviewPoints": [
-          "Keep companion Markdown to the policy, procedure, evidence, or narrative the Document records. Put FileGRC instructions and derived actions in the UI or guides unless FileGRC is the subject.",
+          "Make the companion Markdown read as a finished policy, procedure, evidence record, or narrative.",
           "Replace every bracketed prompt with a reviewed fact before approval, activation, signing, or delivery.",
-          "Use ordinary business language; keep resource relationships in this record and its supporting records."
+          "Write in ordinary business language. Add resource relationships to this record, not its Markdown."
         ],
         "sourceResourceIds": [
           "policy-information-security",
@@ -1771,9 +1771,9 @@
         "cadence": "Create an Evidence Artifact only for a real retained artifact or approved reference. Identify its source Component or source records, Controls, collection and verification facts, coverage, revision, and classification.",
         "emptyState": "No Evidence Artifacts have been collected. Add one only when a real retained artifact or approved external reference exists.",
         "reviewPoints": [
-          "For a signed management representation, use artifactKind signed-record and artifactSubtype signed-management-representation.",
-          "For that representation, record the signing time in businessEventAt; use collectedOn for when FileGRC received it.",
-          "For a final CPA report, use artifactKind third-party-report and artifactSubtype soc2-report, then record its issuance time in sourceGeneratedAt."
+          "For a signed management representation, choose \"Signed Record\" for \"Artifact Kind\" and enter \"signed-management-representation\" for \"Artifact Subtype\".",
+          "Enter when the representation was signed in \"Business event time\". Use \"Collected On\" for the date you received it.",
+          "For a final CPA report, choose \"Third Party Report\" for \"Artifact Kind\", enter \"soc2-report\" for \"Artifact Subtype\", and enter when the CPA firm issued it in \"Source generation time\"."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -2545,7 +2545,7 @@
         "reviewPoints": [
           "Decide whether this criterion applies to the selected service, Trust Services Categories, customer commitments, and planned audit.",
           "Explain the decision using current service and system scope facts, not a generic statement.",
-          "Before marking it not applicable, confirm that no in-scope promise or control objective depends on it."
+          "Before choosing \"Not Applicable\", confirm that no in-scope promise or Control objective depends on it."
         ]
       },
       "required": [
@@ -2592,7 +2592,7 @@
         "reviewPoints": [
           "Confirm the statement reflects a real customer promise, service requirement, or approved business objective that applies to the current scope.",
           "Confirm which parts of the service the promise or objective affects.",
-          "Use an external, zero-population, or not-applicable conclusion only when it is factually true for the current scope."
+          "Use \"External\", \"Zero Population\", or \"Not Applicable\" only when it is true for the current scope."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -2737,7 +2737,7 @@
         "reviewPoints": [
           "Confirm that the linked Control actually depends on a customer or carved-out provider action.",
           "Make the statement specific enough for the responsible party to perform and for the system description to explain.",
-          "Before marking it not applicable, confirm that management is not responsible for the action."
+          "Before choosing \"Not Applicable\", confirm that management is not responsible for the action."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -2866,8 +2866,8 @@
         "cadence": "A Control may be implemented while its governing Policy, required program Document, or Training is approved but inactive. Before marking it implemented, record its owner, actual procedure in Record Markdown, bounded System scope, operation pattern, authoritative evidence-source Components, implementation date, and enabled calendar or event Obligations. Confirm each source Component is active, has the evidence role required by the Control family and current access owners, and includes repeatable retrieval instructions in Record Markdown. Enabled Obligations remain dormant until all of their governing content is active and effective.",
         "reviewPoints": [
           "Confirm the Control is needed for the applicable Requirements, Commitments, and service boundary.",
-          "Describe the actual procedure. Put starter-selection and FileGRC record-entry instructions in the UI or guides, unless FileGRC is an operating Component or evidence source.",
-          "Use not applicable, external, or zero population only when it is true for the current scope."
+          "Describe what people actually do to operate the Control.",
+          "Use \"Not Applicable\", \"External\", or \"Zero Population\" only when it is true for the current scope."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -4389,9 +4389,9 @@
         "policyBasis": "The information security policy requires security training and added role-specific instruction when a person’s responsibilities or data access warrant it.",
         "cadence": "Approve the exact training content in Step 2. During Step 3, finish the linked Controls and Obligations, then activate the unchanged approved revision. Assign training through Obligations at onboarding, annually, and after relevant material changes or incidents.",
         "reviewPoints": [
-          "Keep workforce material focused on required behavior. Put FileGRC commands, record-entry instructions, and data-model terms in guides and assignments.",
-          "Do not imply every user needs a paid product or that customer MFA applies without an approved requirement.",
-          "Bind each completion to the exact revision the person reviewed."
+          "Write the training for the people who must follow it and state the behavior you expect.",
+          "Include product-license or customer MFA requirements only when an approved requirement calls for them.",
+          "Link each completion to the exact Training revision the person completed."
         ],
         "sourceResourceIds": [
           "policy-information-security"
@@ -8065,7 +8065,7 @@
         "reviewPoints": [
           "Decide whether this source family applies to the current scope and audit period.",
           "Confirm the chosen source can produce the complete population or evidence needed.",
-          "Use not applicable or zero population only when that conclusion is factually true."
+          "Use \"Not Applicable\" or \"Zero Population\" only when it is true."
         ]
       },
       "required": [