filegrc 0.13.5 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.13.5",
+  "version": "0.14.0",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/cli.js

@@ -553,7 +553,7 @@ export async function runCli(argv = process.argv.slice(2)) {
       : record.type === "requirement-mapping"
         ? [...new Set([...(record.sourceResourceIds || []), ...(record.targetResourceIds || [])])]
         : null;
-    if (!dependencyIds) throw new Error("Review bindings are available for Retention Schedule Items and Requirement Mappings.");
+    if (!dependencyIds) throw new Error("Review bindings are available for Retention Schedule records and Requirement Mappings.");
     const revisions = await resourceReviewRevisions(loaded, dependencyIds);
     const result = {
       resource: { type: record.type, id: record.id, title: record.title },

package/src/collection-review.js

@@ -11,6 +11,7 @@ import { createResourceId } from "./id.js";
 import { loadWorkspace } from "./workspace.js";
 import { resolveProgram } from "./program.js";
 import { currentCalendarDate } from "./time.js";
+import { currentPartyPeople } from "./parties.js";
 
 export { collectionRevision };
 
@@ -63,11 +64,19 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
       currentRevision
     }
   );
+  const reviewerEligibility = resourceType === "control"
+    ? assessControlReviewers(loaded, records)
+    : null;
+  const reviewersEligible = !reviewerEligibility || Boolean(
+    review?.reviewedByIds?.length
+    && review.reviewedByIds.every((id) => reviewerEligibility.eligibleReviewerIds.includes(id))
+  );
   const complete = Boolean(
     review?.status === "active"
     && allowedDecisions.includes(review.decision)
     && revisionMatches
     && temporalReview
+    && reviewersEligible
   );
   const stale = Boolean(
     review?.status === "active"
@@ -86,8 +95,11 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
     collectionRevision: currentRevision,
     status: complete ? "current" : stale ? "stale" : "review-required",
     complete,
+    ...(reviewerEligibility || {}),
     message: complete
       ? `${configuration.title} were reviewed on ${review.reviewedOn}.`
+      : revisionMatches && review?.status === "active" && !reviewersEligible
+        ? "Review the Control collection again with a reviewer who does not own an included Control or its enabled Obligation."
       : stale
         ? `${configuration.title} changed after the last confirmation. Review the current records again.`
         : !records.length && !allowsEmptyCollection
@@ -101,6 +113,7 @@ export async function scaffoldCollectionReview(input = process.cwd(), options =
   const program = resolveProgram(loaded, options.programId);
   const resourceType = requiredType(loaded, options.resourceType);
   const assessment = assessCollectionReview(loaded, resourceType, { programId: program.id });
+  await requireControlReviewReady(loaded, resourceType, program.id);
   const allowedDecisions = assessment.configuration.decisions || ["complete"];
   const now = options.now ? new Date(options.now) : new Date();
   if (Number.isNaN(now.getTime())) throw new Error("A valid Collection Review time is required.");
@@ -141,6 +154,7 @@ export async function planCollectionReview(input = process.cwd(), options = {})
   const program = resolveProgram(loaded, options.programId);
   const resourceType = requiredType(loaded, options.resourceType);
   const assessment = assessCollectionReview(loaded, resourceType, { programId: program.id });
+  await requireControlReviewReady(loaded, resourceType, program.id);
   const configuration = assessment.configuration;
   const decision = String(options.decision || "").trim();
   const rationale = String(options.rationale || "").trim();
@@ -178,6 +192,13 @@ export async function planCollectionReview(input = process.cwd(), options = {})
   if (!rationale || !reviewedByIds.length || !reviewedOn) {
     throw new Error(`${configuration.title} review needs review notes, a reviewer, and a review date.`);
   }
+  if (resourceType === "control") {
+    const eligible = new Set(assessment.eligibleReviewerIds || []);
+    const conflicts = reviewedByIds.filter((id) => !eligible.has(id));
+    if (conflicts.length) {
+      throw new Error(`Control collection review needs a reviewer who does not own an included Control or its enabled Obligation: ${conflicts.join(", ")}.`);
+    }
+  }
   if (temporalReviews) {
     if (reviewedOn !== today) {
       throw new Error("A current Collection Review must use today's workspace-local review date. Reconstruct an older population from Git history instead of backdating today's files.");
@@ -270,6 +291,44 @@ export async function planCollectionReview(input = process.cwd(), options = {})
   };
 }
 
+async function requireControlReviewReady(loaded, resourceType, programId) {
+  if (resourceType !== "control") return;
+  const { assessProgramReadiness } = await import("./program-readiness.js");
+  const readiness = await assessProgramReadiness(loaded, { programId });
+  const earlierItems = readiness.stages
+    .find(({ id }) => id === "controls")
+    ?.items.filter(({ id }) => (
+      id !== "collection-review-control"
+      && !id.startsWith("document-activation-")
+      && !id.startsWith("training-activation-")
+      && !id.startsWith("policy-activation-")
+    )) || [];
+  if (!earlierItems.length || earlierItems.some(({ status }) => status !== "complete")) {
+    throw new Error("Complete the Step 3 implementation work before recording the Control collection review. Program content activation follows this review.");
+  }
+}
+
+function assessControlReviewers(loaded, controls) {
+  const byId = new Map(loaded.resources.map((record) => [record.id, record]));
+  const controlIds = new Set(controls.map(({ id }) => id));
+  const conflictIds = new Set();
+  for (const control of controls) {
+    for (const id of currentPartyPeople(control.ownerIds || [], byId)) conflictIds.add(id);
+  }
+  for (const obligation of loaded.resources.filter((record) => (
+    record.type === "obligation"
+    && record.status === "active"
+    && (record.controlIds || []).some((id) => controlIds.has(id))
+  ))) {
+    for (const id of currentPartyPeople(obligation.ownerIds || [], byId)) conflictIds.add(id);
+  }
+  const people = loaded.resources.filter(({ type, status }) => type === "person" && status === "active");
+  return {
+    eligibleReviewerIds: people.map(({ id }) => id).filter((id) => !conflictIds.has(id)),
+    reviewerConflictIds: people.map(({ id }) => id).filter((id) => conflictIds.has(id))
+  };
+}
+
 function sameIds(left, right) {
   return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
 }

package/src/collection-scope.js

@@ -1,5 +1,7 @@
 import { modelSupports } from "../model/index.js";
 import { programComponents, selectedRequirementIds } from "./program.js";
+import { retentionReviewResourceIds } from "./retention.js";
+import { documentIsAuditSpecific } from "./program-lifecycle.js";
 
 export function scopedCollectionRecords(loaded, resourceType, program) {
   if (!modelSupports(loaded.model, "program-scope")) {
@@ -35,6 +37,7 @@ export function scopedCollectionRecords(loaded, resourceType, program) {
   const selected = {
     system: systemIds,
     component: componentIds,
+    control: controlIds,
     framework: new Set(scopedProgram.frameworkIds || []),
     "complementary-control": new Set(loaded.resources.filter((record) => (
       record.type === "complementary-control"
@@ -51,7 +54,9 @@ export function scopedCollectionRecords(loaded, resourceType, program) {
     )).map(({ id }) => id))
   }[resourceType];
   return loaded.resources.filter((record) => (
-    record.type === resourceType && (!selected || selected.has(record.id))
+    record.type === resourceType
+    && (!selected || selected.has(record.id))
+    && (resourceType !== "control" || record.status === "implemented")
   ));
 }
 
@@ -114,6 +119,20 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
       if (record) records.set(record.id, record);
     }
   };
+  const addPartyIds = (ids) => {
+    const pending = [...(ids || [])];
+    const visited = new Set();
+    while (pending.length) {
+      const id = pending.shift();
+      if (!id || visited.has(id)) continue;
+      visited.add(id);
+      const record = byId.get(id);
+      if (!record) continue;
+      records.set(record.id, record);
+      if (record.type === "team") pending.push(...(record.memberIds || []), ...(record.chairIds || []));
+      if (record.type === "appointment") pending.push(record.holderId);
+    }
+  };
 
   if (resourceType === "framework") {
     addIds(program?.systemIds);
@@ -139,6 +158,66 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
       addIds((record.informationUses || []).map(({ informationTypeId }) => informationTypeId));
     }
   }
+  if (resourceType === "control") {
+    const obligations = loaded.resources.filter((record) => (
+      record.type === "obligation"
+      && record.status === "active"
+      && (record.controlIds || []).some((id) => reviewedIds.has(id))
+    ));
+    const controlCodes = new Set(reviewed.map(({ code }) => code).filter(Boolean));
+    const sourceFamilyIds = new Set((loaded.model.evidenceSourceFamilies || [])
+      .filter((family) => (family.controlCodes || []).some((code) => controlCodes.has(code)))
+      .map(({ id }) => id));
+    const sourceCoverage = loaded.resources.filter((record) => (
+      record.type === "source-coverage"
+      && record.status !== "retired"
+      && sourceFamilyIds.has(record.sourceFamilyId)
+    ));
+    const policyIds = new Set(reviewed.flatMap((record) => record.policyIds || []));
+    const policies = loaded.resources.filter((record) => (
+      record.type === "policy"
+      && policyIds.has(record.id)
+      && record.programRole !== "conditional"
+      && !["superseded", "retired"].includes(record.status)
+    ));
+    const governedIds = new Set([
+      ...policies.flatMap((record) => record.relatedDocumentIds || []),
+      ...obligations.flatMap((record) => [
+        ...(record.scopeResourceIds || []),
+        ...(record.templateResourceId ? [record.templateResourceId] : [])
+      ])
+    ]);
+    const governedContent = loaded.resources.filter((record) => (
+      ["document", "training"].includes(record.type)
+      && !["superseded", "retired"].includes(record.status)
+      && (governedIds.has(record.id) || (record.controlIds || []).some((id) => reviewedIds.has(id)))
+      && (record.type !== "document" || !documentIsAuditSpecific(record, loaded.model))
+    ));
+    addIds(program?.systemIds);
+    addIds(obligations.map(({ id }) => id));
+    addIds(sourceCoverage.map(({ id }) => id));
+    addIds(policies.map(({ id }) => id));
+    addIds(governedContent.map(({ id }) => id));
+    for (const record of reviewed) {
+      addIds(record.componentIds);
+      addIds(record.evidenceSourceComponentIds);
+      addPartyIds(record.ownerIds);
+    }
+    for (const obligation of obligations) addPartyIds(obligation.ownerIds);
+    for (const record of [...policies, ...governedContent]) {
+      addPartyIds([...(record.ownerIds || []), ...(record.approverIds || []), ...(record.approvedByIds || [])]);
+    }
+    for (const coverage of sourceCoverage) {
+      addIds([coverage.componentId]);
+      addIds(coverage.readinessTestEvidenceIds);
+      addIds(coverage.retentionScheduleItemIds);
+      addPartyIds([...(coverage.ownerIds || []), ...(coverage.retrieverIds || [])]);
+      for (const rule of (coverage.retentionScheduleItemIds || []).map((id) => byId.get(id)).filter(Boolean)) {
+        addIds(retentionReviewResourceIds(rule, loaded));
+        addPartyIds([...(rule.ownerIds || []), ...(rule.approvedByIds || [])]);
+      }
+    }
+  }
   if (resourceType === "information-type" && !legacy) {
     addIds(program?.systemIds);
     addIds(programComponents(loaded, program || {}).map(({ id }) => id));
@@ -202,12 +281,20 @@ export function collectionScopeRevisionFacts(loaded, resourceType, program) {
   if (resourceType === "system") {
     return { ...common, systemIds: sorted(program?.systemIds) };
   }
-  if (resourceType === "component" || resourceType === "complementary-control") {
-    return {
+  if (resourceType === "component" || resourceType === "complementary-control" || resourceType === "control") {
+    const scope = {
       ...common,
       systemIds: sorted(program?.systemIds),
       controlIds: sorted(program?.controlIds)
     };
+    return resourceType === "control" ? {
+      ...scope,
+      assuranceGoal: program?.assuranceGoal ?? null,
+      frameworkIds: sorted(program?.frameworkIds),
+      requirementIds: sorted(selectedRequirementIds(program || {}, loaded.model)),
+      requirementApplicability: program?.requirementApplicability || [],
+      riskMethodology: program?.riskMethodology || null
+    } : scope;
   }
   return common;
 }
@@ -244,6 +331,21 @@ const dependencyFields = {
     classification: ["id", "type", "status", "rank", "description", "handlingRequirements"],
     "information-type": ["id", "type", "status", "classificationId", "description"]
   },
+  control: {
+    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
+    component: ["id", "type", "status", "componentKind", "description", "ownerIds", "systemUses", "evidenceSourceKinds", "evidenceOwnerIds"],
+    obligation: ["id", "type", "status", "activityType", "scheduleMode", "ownerIds", "activeRuleId", "policyIds", "controlIds", "ruleIds"],
+    "source-coverage": ["id", "type", "status", "sourceFamilyId", "coverageKind", "scopeResourceIds", "excludedPopulation", "retrieverIds", "collectionCadence", "retentionScheduleItemIds", "reconciliationMethod", "validFrom", "validThrough", "applicabilityReview", "readinessTestEvidenceIds", "ownerIds", "componentId"],
+    evidence: ["id", "type", "status", "artifactKind", "readinessTest", "retrievalResult", "accessConfirmed", "coveredSourceFamilyIds", "sourceComponentId", "componentIds", "systemIds", "collectedOn", "collectorIds", "verifierIds", "verifiedOn"],
+    "retention-schedule-item": ["id", "type", "status", "description", "informationTypeIds", "scopeResourceIds", "scheduleDocumentId", "sourceResourceIds", "ownerIds", "approvedByIds", "approvedOn", "reviewedSourceRevisions", "cutoff", "retentionPeriod", "dispositionAction", "dispositionInstructions"],
+    document: ["id", "type", "documentKind", "workflowScope", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "controlIds"],
+    policy: ["id", "type", "programRole", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "relatedDocumentIds", "controlIds"],
+    training: ["id", "type", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "controlIds"],
+    "information-type": ["id", "type", "status", "classificationId", "description"],
+    person: ["id", "type", "status", "affiliation", "jobTitle"],
+    team: ["id", "type", "status", "memberIds", "chairIds"],
+    appointment: ["id", "type", "status", "appointmentKind", "scopeResourceIds", "holderId", "startsOn", "endsOn"]
+  },
   "information-type": {
     system: ["id", "type", "status", "informationTypeIds"],
     component: ["id", "type", "status", "systemUses", "informationUses"],
@@ -279,6 +381,7 @@ const dependencyContentTypes = {
   framework: new Set(["system"]),
   vendor: new Set(["document"]),
   component: new Set(["system"]),
+  control: new Set(["system", "component", "obligation", "source-coverage", "evidence", "retention-schedule-item", "document", "policy", "training"]),
   "complementary-control": new Set(["system", "control", "document", "component"])
 };
 

package/src/document-activation.js

@@ -10,12 +10,18 @@ import { loadWorkspace } from "./workspace.js";
 export async function scaffoldDocumentActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
   requireDocumentLifecycle(loaded);
-  const candidates = await activationCandidates(loaded, { ...options, documentsOnly: true });
+  const readiness = options.auditId ? null : await assessProgramReadiness(loaded, { programId: options.programId });
+  const oversightReady = options.auditId || controlOversightComplete(loaded, readiness);
+  const candidates = oversightReady
+    ? await activationCandidates(loaded, { ...options, documentsOnly: true })
+    : [];
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
   const today = currentCalendarDate(loaded.workspace.timezone);
   return {
     available: candidates.length > 0,
-    message: candidates.length
+    message: !oversightReady
+      ? "Complete the current Control collection review before Program Content Activation."
+      : candidates.length
       ? `${candidates.length} approved ${candidates.length === 1 ? "Document is" : "Documents are"} ready to activate.`
       : `No ${options.auditId ? "engagement Document" : "program Document"} is ready to activate. Review the current readiness actions first.`,
     nextCommand: candidates.length ? null : options.auditId
@@ -34,6 +40,12 @@ export async function scaffoldDocumentActivation(input = process.cwd(), options
 export async function planDocumentActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
   requireDocumentLifecycle(loaded);
+  if (!options.auditId && modelSupports(loaded.model, "control-collection-oversight")) {
+    const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
+    if (!controlOversightComplete(loaded, readiness)) {
+      throw new Error("Complete the current Control collection review before Program Content Activation.");
+    }
+  }
   const resourceIds = [...new Set((options.resourceIds || options.documentIds || []).map(String))];
   if (!resourceIds.length) throw new Error("Governed-content activation needs at least one approved program Document or Training record.");
   const activatedByIds = [...new Set((options.activatedByIds || []).map(String))];
@@ -118,6 +130,12 @@ export async function planDocumentActivation(input = process.cwd(), options = {}
   };
 }
 
+function controlOversightComplete(loaded, readiness) {
+  if (!modelSupports(loaded.model, "control-collection-oversight") || !readiness.scope.controlIds.length) return true;
+  return readiness.stages.find(({ id }) => id === "controls")?.items
+    .find(({ id }) => id === "collection-review-control")?.status === "complete";
+}
+
 async function activationCandidates(loaded, options) {
   if (options.auditId) {
     return (await assessAuditDocumentActivations(loaded, {
@@ -150,12 +168,18 @@ export async function scaffoldGovernedContentActivation(input = process.cwd(), o
   if (!modelSupports(loaded.model, "governed-training-activation")) {
     throw new Error("Unified governed-content activation requires a model v6 or later workspace.");
   }
-  const candidates = await activationCandidates(loaded, { ...options, auditId: undefined });
+  const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
+  const oversightReady = controlOversightComplete(loaded, readiness);
+  const candidates = oversightReady
+    ? await activationCandidates(loaded, { ...options, auditId: undefined })
+    : [];
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
   const today = currentCalendarDate(loaded.workspace.timezone);
   return {
     available: candidates.length > 0,
-    message: candidates.length
+    message: !oversightReady
+      ? "Complete the current Control collection review before Program Content Activation."
+      : candidates.length
       ? `${candidates.length} approved governed-content ${candidates.length === 1 ? "record is" : "records are"} ready to activate.`
       : "No program Document or Training record is ready to activate. Review the current readiness actions first.",
     nextCommand: candidates.length ? null : "npx filegrc program-path --next --json",

package/src/model-migration.js

@@ -901,7 +901,8 @@ export async function planModelMigration(input = process.cwd(), options = {}) {
               : sourceVersion === "6" ? "7"
                 : sourceVersion === "7" ? "8"
                   : sourceVersion === "8" ? "9"
-                    : ACTIVE_MODEL_VERSION;
+                    : sourceVersion === "9" ? "10"
+                      : ACTIVE_MODEL_VERSION;
   if (sourceVersion === requestedTarget) return emptyPlan(sourceVersion, requestedTarget);
   if (sourceVersion === "1" && requestedTarget === "2") {
     return planV1ToV2Migration(input, options);
@@ -927,9 +928,12 @@ export async function planModelMigration(input = process.cwd(), options = {}) {
   if (sourceVersion === "8" && requestedTarget === "9") {
     return planV8ToV9Migration(loaded);
   }
-  if (sourceVersion === "9" && requestedTarget === ACTIVE_MODEL_VERSION) {
+  if (sourceVersion === "9" && requestedTarget === "10") {
     return planV9ToV10Migration(loaded);
   }
+  if (sourceVersion === "10" && requestedTarget === ACTIVE_MODEL_VERSION) {
+    return planV10ToV11Migration(loaded);
+  }
   if (sourceVersion === "1" && requestedTarget === ACTIVE_MODEL_VERSION) {
     throw new Error(
       "Model v1 workspaces must migrate to model v2 first. "
@@ -2406,6 +2410,70 @@ async function planV9ToV10Migration(loaded) {
   };
 }
 
+async function planV10ToV11Migration(loaded) {
+  if (!loaded.workspace?.id) throw new Error("Model migration requires a valid Workspace record.");
+  const targetModel = loadModel("11");
+  const revisions = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
+  const automatic = [];
+  const reviewRequired = [];
+  const unsupported = [];
+  const missing = [];
+  const manualActions = [];
+  const updates = [];
+  for (const original of loaded.resources) {
+    const record = structuredClone(original);
+    let changed = false;
+    if (record.type === "workspace") {
+      record.dataModelVersion = "11";
+      automatic.push(classifiedChange("automatic", record.id, "dataModelVersion", "Select model v11."));
+      changed = true;
+    }
+    if (record.type === "control") {
+      for (const field of ["implementationReviewedByIds", "implementationReviewedOn"]) {
+        if (!Object.hasOwn(record, field)) continue;
+        delete record[field];
+        automatic.push(classifiedChange("automatic", record.id, field, "Remove the obsolete per-Control implementation review field. Control oversight now uses a periodic Collection Review."));
+        changed = true;
+      }
+    }
+    if (changed) updates.push(record);
+  }
+  const updatedById = new Map(updates.map((record) => [record.id, record]));
+  const migratedRecords = loaded.resources.map((record) => updatedById.get(record.id) || record);
+  await collectTargetValidationActions(loaded, migratedRecords, targetModel, missing, manualActions);
+  for (const item of [...missing, ...manualActions]) {
+    unsupported.push(classifiedChange("unsupported", item.resourceId, item.field, item.message));
+  }
+  return {
+    schemaVersion: 2,
+    sourceModelVersion: "10",
+    targetModelVersion: "11",
+    ready: unsupported.length === 0,
+    missing,
+    conflicts: [],
+    manualActions,
+    classifications: { automatic, reviewRequired, unsupported },
+    notes: [
+      "Control owners can mark Controls implemented without a separate per-Control implementation reviewer.",
+      "Periodic Control oversight is recorded as a Git-bound Collection Review over the Program's selected Controls.",
+      "Policy, Document, and Training approval independence remains unchanged."
+    ],
+    migrationReport: {},
+    summary: { create: 0, update: updates.length, automatic: automatic.length, reviewRequired: 0, unsupported: unsupported.length },
+    fileDiff: {
+      create: [],
+      update: updates.map((record) => ({ type: record.type, id: record.id, before: loaded.resources.find(({ id }) => id === record.id), after: record }))
+    },
+    changes: {
+      create: [],
+      update: updates,
+      expectedRevisions: Object.fromEntries(updates.map(({ id }) => [id, revisions.get(id)])),
+      validateWholeWorkspace: true,
+      targetModelVersion: "11"
+    }
+  };
+}
+
 function normalizeDocumentScopeDecision(value) {
   const candidate = typeof value === "object" && value
     ? value.workflowScope || value.scope

package/src/policy-activation.js

@@ -3,17 +3,21 @@ import { serializeWorkspaceMutation } from "./mutation.js";
 import { assessProgramReadiness } from "./program-readiness.js";
 import { currentCalendarDate } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
+import { modelSupports } from "../model/index.js";
 
 export async function scaffoldPolicyActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
   const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
-  const approved = readiness.policyActivations.filter(({ state }) => (
+  const oversightReady = controlOversightComplete(loaded, readiness);
+  const approved = (oversightReady ? readiness.policyActivations : []).filter(({ state }) => (
     ["approved-implementation-pending", "ready-to-activate"].includes(state)
   ));
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
   return {
     available: approved.length > 0,
-    message: approved.length
+    message: !oversightReady
+      ? "Complete the current Control collection review before Program Content Activation."
+      : approved.length
       ? `${approved.length} approved ${approved.length === 1 ? "Policy is" : "Policies are"} available for the Step 3 cutover.`
       : "No Policy is ready for activation. Finish Step 2 approval, then resolve its Step 3 implementation gaps.",
     nextCommand: approved.length ? null : "npx filegrc program-path --next --json",
@@ -26,6 +30,10 @@ export async function scaffoldPolicyActivation(input = process.cwd(), options =
 
 export async function planPolicyActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
+  const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
+  if (!controlOversightComplete(loaded, readiness)) {
+    throw new Error("Complete the current Control collection review before Program Content Activation.");
+  }
   const policyIds = [...new Set((options.policyIds || []).map(String))];
   if (!policyIds.length) throw new Error("Policy activation needs at least one approved Policy.");
   const effectiveOn = String(options.effectiveOn || "").trim();
@@ -67,6 +75,12 @@ export async function planPolicyActivation(input = process.cwd(), options = {})
   };
 }
 
+function controlOversightComplete(loaded, readiness) {
+  if (!modelSupports(loaded.model, "control-collection-oversight") || !readiness.scope.controlIds.length) return true;
+  return readiness.stages.find(({ id }) => id === "controls")?.items
+    .find(({ id }) => id === "collection-review-control")?.status === "complete";
+}
+
 export async function activatePolicies(input = process.cwd(), options = {}) {
   if (options.confirmed !== true) throw new Error("Review the Policy activation cutover and confirm the write.");
   return serializeWorkspaceMutation(input, async (root) => {

package/src/program-path.js

@@ -129,7 +129,11 @@ export const PROGRAM_PATH = [
     description: "Finish controls and their evidence sources",
     summary: "Describe each Control and connect its evidence source.",
     sections: [
-      { id: "catalog", title: "Control Catalog", description: "Implement approved requirements, configure retention and Obligations, activate approved program content, finish authoritative evidence sources, then activate the Policies at cutover.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components.", "Review every Retention Schedule Item against current information uses and approved sources. Do not infer periods or disposition behavior.", "Review and enable every calendar and event schedule as an Obligation. Enabled work remains dormant until its governing Policy is active.", "Confirm each source Component is active, has an evidence-source role and rationale in the Control's System scope, has current access owners, and includes repeatable retrieval instructions in Record Markdown.", "Implement every requirement linked from an approved program Document or Training record, then activate the unchanged approved revisions with separate activation dates and bindings.", "Use the activation review to inspect planned or partial Controls, inactive governed content, missing Components or sources, missing schedules, and unresolved Exceptions.", "Choose the approved Policies that should take effect, set the real effective date, and confirm the Step 3 cutover."], types: ["control", "complementary-control", "retention-schedule-item", "obligation"], defaultOpen: true }
+      { id: "controls", title: "Controls", description: "Implement the selected Controls and connect their scope, procedures, mappings, and operation patterns.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components."], types: ["control"], defaultOpen: true },
+      { id: "complementary-controls", title: "Complementary Controls", description: "Record customer or provider responsibilities that form part of the implementation boundary, or confirm there are none.", steps: ["Review whether an in-scope Control depends on a customer or carved-out provider action."], types: ["complementary-control"], defaultOpen: true },
+      { id: "evidence-sources", title: "Evidence Sources", description: "Check that every Control points to an authoritative source that can produce its expected evidence.", steps: ["Confirm each source Component is active, has the right evidence-source role, names current access owners, and includes repeatable retrieval instructions."], types: [], utility: "evidence-sources", defaultOpen: true },
+      { id: "retention", title: "Retention Schedule", description: "Review each retention rule against current information uses and approved sources.", steps: ["Confirm scope, cutoff, period, disposition, sources, owner, and approval for each rule."], types: ["retention-schedule-item"], defaultOpen: true },
+      { id: "obligations", title: "Obligations", description: "Configure the calendar and event schedules that operate the Controls.", steps: ["Review and enable every required calendar and event schedule."], types: ["obligation"], defaultOpen: true }
     ],
     resourceTypes: ["control", "complementary-control", "retention-schedule-item", "obligation"],
     commands: [
@@ -142,6 +146,7 @@ export const PROGRAM_PATH = [
       "filegrc list obligation --json",
       "filegrc review-collection component --scaffold",
       "filegrc review-collection complementary-control --scaffold",
+      "filegrc review-collection control --scaffold",
       "filegrc activate-content --scaffold",
       "filegrc activate-policies --scaffold",
       "filegrc evidence-map --json",

package/src/program-readiness.js

@@ -64,7 +64,6 @@ export async function assessProgramReadiness(input, options = {}) {
     .filter(({ resourceType }) => resourceType === "retention-schedule-item")
     .map(collectionReviewReadinessItem));
   const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model);
-  controlStage.items.push(...governedContent.items);
   const policyActivations = await assessPolicyActivations(
     requiredPolicies(scope, byId),
     scope.controls,
@@ -74,8 +73,22 @@ export async function assessProgramReadiness(input, options = {}) {
     asOf,
     loaded.model
   );
-  controlStage.items.push(...policyActivations.map(policyActivationItem));
-  controlStage.description = `Each implemented Control needs an owner, actual procedure, scope, operation pattern, mappings, an implementation date, enabled Obligations, and complete authoritative source ${modelSupports(loaded.model, "component-sources") ? "Components" : "Systems"}. Activate unchanged approved program Documents and Training after their requirements are implemented, then activate approved Policies at the implementation cutover.`;
+  const controlOversight = collectionReviews.find(({ resourceType }) => resourceType === "control");
+  const oversightEligible = Boolean(controlOversight && controlOversightEligible(controlStage.items));
+  if (oversightEligible) {
+    controlStage.items.push(collectionReviewReadinessItem(controlOversight));
+  }
+  const oversightCurrent = oversightEligible && controlOversight.complete === true;
+  controlStage.items.push(...governedContent.items.map((item) => oversightCurrent || item.status === "complete"
+    ? item
+    : { ...item, status: "blocked", message: `Complete the Control collection review before activation. ${item.message}` }));
+  controlStage.items.push(...policyActivations.map((assessment) => {
+    const item = policyActivationItem(assessment);
+    return oversightCurrent || item.status === "complete"
+      ? item
+      : { ...item, status: "blocked", message: `Complete the Control collection review before activation. ${item.message}` };
+  }));
+  controlStage.description = `Each implemented Control needs an owner, actual procedure, scope, operation pattern, mappings, an implementation date, enabled Obligations, and complete authoritative source ${modelSupports(loaded.model, "component-sources") ? "Components" : "Systems"}. When implementation is ready, perform one review of the implemented Control collection. Management then activates the unchanged approved program content as the Step 3 cutover.`;
   const scopeReadinessStage = scopeStage(
       program,
       scope,
@@ -166,6 +179,10 @@ export async function assessProgramReadiness(input, options = {}) {
   };
 }
 
+export function controlOversightEligible(items) {
+  return items.length > 0 && items.every(({ status }) => status === "complete");
+}
+
 export async function assessEvidenceMap(input, options = {}) {
   const readiness = await assessProgramReadiness(input, options);
   const evidenceItems = readiness.stages
@@ -1300,12 +1317,7 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model) {
       implementationDate: Boolean(control.effectiveOn && control.effectiveOn <= asOf),
       ...(model.resources.control?.fields?.procedureRevision ? {
         procedureRevision: Boolean(control.procedureRevision),
-        procedureEffective: Boolean(control.procedureEffectiveOn && control.procedureEffectiveOn <= asOf),
-        implementationReview: Boolean(
-          control.implementationReviewedOn
-          && control.implementationReviewedOn <= asOf
-          && partiesIndependent(control.ownerIds, control.implementationReviewedByIds, byId)
-        )
+        procedureEffective: Boolean(control.procedureEffectiveOn && control.procedureEffectiveOn <= asOf)
       } : {}),
       policyMapping: (control.policyIds || []).length > 0,
       criteriaMapping: (control.requirementIds || []).length > 0,
@@ -1699,7 +1711,6 @@ function controlCheckLabel(name) {
     implementationDate: "implementation date",
     procedureRevision: "effective procedure revision",
     procedureEffective: "procedure effective date",
-    implementationReview: "independent implementation review",
     policyMapping: "policy mapping",
     criteriaMapping: "criteria mapping",
     workQueue: "running Obligation schedules"

package/src/validate.js

@@ -20,7 +20,7 @@ import {
 } from "./recurrence.js";
 import { resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { obligationIsEnabled } from "./program-lifecycle.js";
-import { partyPeople } from "./parties.js";
+import { currentPartyPeople, partyPeople } from "./parties.js";
 import { isMarkdownChoice, markdownEntries } from "./resource-markdown.js";
 import { currentCalendarDate, isRfc3339Timestamp, localDateTimeValue, timestampFromLocalDateTime } from "./time.js";
 import { recordTiming } from "./timing.js";
@@ -1273,6 +1273,29 @@ function validateCollectionReview(record, loaded, byId, path, diagnostics) {
       currentRevision
     }
   );
+  if (current && record.resourceType === "control") {
+    const controls = scopedCollectionRecords(loaded, "control", program);
+    const controlIds = new Set(controls.map(({ id }) => id));
+    const conflictIds = new Set();
+    for (const control of controls) {
+      for (const id of currentPartyPeople(control.ownerIds || [], byId)) conflictIds.add(id);
+    }
+    for (const obligation of loaded.resources.filter((candidate) => (
+      candidate.type === "obligation"
+      && candidate.status === "active"
+      && (candidate.controlIds || []).some((id) => controlIds.has(id))
+    ))) {
+      for (const id of currentPartyPeople(obligation.ownerIds || [], byId)) conflictIds.add(id);
+    }
+    const conflictedReviewers = (record.reviewedByIds || []).filter((id) => conflictIds.has(id));
+    if (conflictedReviewers.length) {
+      diagnostics.push(error(
+        "conflicted-control-collection-reviewer",
+        path,
+        `A Control collection reviewer cannot own an included Control or its enabled Obligation: ${conflictedReviewers.join(", ")}.`
+      ));
+    }
+  }
   if (modelSupports(model, "temporal-collection-reviews")) {
     const temporalValues = [record.coverage, record.knowledgeCutoffAt, record.populationResourceIds];
     const hasTemporalBinding = temporalValues.every((value) => value !== undefined && value !== null);