filegrc 0.13.5 → 0.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.13.5",
+  "version": "0.15.0",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/agent.js

@@ -82,7 +82,7 @@ export function buildAgentGuide(loaded, type, options = {}) {
     instructions: RESOURCE_INSTRUCTIONS[type] || definition.description,
     use: definition.description,
     purpose: definition.description,
-    programStep: resourceProgramContext(type),
+    programStep: resourceProgramContext(type, loaded.model),
     policyBasis: definition.guidance.policyBasis,
     cadence: definition.guidance.cadence,
     emptyState: definition.guidance.emptyState ?? null,

package/src/cli.js

@@ -553,7 +553,7 @@ export async function runCli(argv = process.argv.slice(2)) {
       : record.type === "requirement-mapping"
         ? [...new Set([...(record.sourceResourceIds || []), ...(record.targetResourceIds || [])])]
         : null;
-    if (!dependencyIds) throw new Error("Review bindings are available for Retention Schedule Items and Requirement Mappings.");
+    if (!dependencyIds) throw new Error("Review bindings are available for Retention Schedule records and Requirement Mappings.");
     const revisions = await resourceReviewRevisions(loaded, dependencyIds);
     const result = {
       resource: { type: record.type, id: record.id, title: record.title },

package/src/collection-review.js

@@ -11,6 +11,8 @@ import { createResourceId } from "./id.js";
 import { loadWorkspace } from "./workspace.js";
 import { resolveProgram } from "./program.js";
 import { currentCalendarDate } from "./time.js";
+import { currentPartyPeople } from "./parties.js";
+import { retentionScheduleApprovalIssues } from "./retention-schedule-approval.js";
 
 export { collectionRevision };
 
@@ -63,11 +65,27 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
       currentRevision
     }
   );
+  const reviewerEligibility = resourceType === "control"
+    ? assessControlReviewers(loaded, records)
+    : resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")
+      ? assessRetentionScheduleReviewers(loaded, records)
+      : null;
+  const approvalIssues = resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")
+    ? retentionScheduleApprovalIssues(loaded, program, records, {
+        informationTypesReviewed: assessCollectionReview(loaded, "information-type", options).complete
+      })
+    : [];
+  const reviewersEligible = !reviewerEligibility || Boolean(
+    review?.reviewedByIds?.length
+    && review.reviewedByIds.every((id) => reviewerEligibility.eligibleReviewerIds.includes(id))
+  );
   const complete = Boolean(
     review?.status === "active"
     && allowedDecisions.includes(review.decision)
     && revisionMatches
     && temporalReview
+    && reviewersEligible
+    && !approvalIssues.length
   );
   const stale = Boolean(
     review?.status === "active"
@@ -86,8 +104,16 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
     collectionRevision: currentRevision,
     status: complete ? "current" : stale ? "stale" : "review-required",
     complete,
+    ...(reviewerEligibility || {}),
+    ...(approvalIssues.length ? { approvalIssues } : {}),
     message: complete
       ? `${configuration.title} were reviewed on ${review.reviewedOn}.`
+      : approvalIssues.length
+        ? approvalIssues[0].message
+      : revisionMatches && review?.status === "active" && !reviewersEligible
+        ? resourceType === "retention-schedule-item"
+          ? "Review the Data Retention Schedule again with a reviewer who does not own its governing document or an included schedule row."
+          : "Review the Control collection again with a reviewer who does not own an included Control or its enabled Obligation."
       : stale
         ? `${configuration.title} changed after the last confirmation. Review the current records again.`
         : !records.length && !allowsEmptyCollection
@@ -101,6 +127,7 @@ export async function scaffoldCollectionReview(input = process.cwd(), options =
   const program = resolveProgram(loaded, options.programId);
   const resourceType = requiredType(loaded, options.resourceType);
   const assessment = assessCollectionReview(loaded, resourceType, { programId: program.id });
+  await requireControlReviewReady(loaded, resourceType, program.id);
   const allowedDecisions = assessment.configuration.decisions || ["complete"];
   const now = options.now ? new Date(options.now) : new Date();
   if (Number.isNaN(now.getTime())) throw new Error("A valid Collection Review time is required.");
@@ -130,6 +157,9 @@ export async function scaffoldCollectionReview(input = process.cwd(), options =
     reviewedOn: priorReview?.reviewedOn
       ? currentCalendarDate(loaded.workspace.timezone, now)
       : null,
+    ...(resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")
+      ? { expectedCollectionRevision: assessment.collectionRevision }
+      : {}),
     ...(v4
       ? { authoritativeComponentId: preservedAuthoritativeSourceId }
       : { authoritativeSystemId: preservedAuthoritativeSourceId })
@@ -141,6 +171,14 @@ export async function planCollectionReview(input = process.cwd(), options = {})
   const program = resolveProgram(loaded, options.programId);
   const resourceType = requiredType(loaded, options.resourceType);
   const assessment = assessCollectionReview(loaded, resourceType, { programId: program.id });
+  if (options.expectedCollectionRevision && options.expectedCollectionRevision !== assessment.collectionRevision) {
+    throw new Error(`${assessment.configuration.title} changed after it was displayed. Reload and review the current revision before approving it.`);
+  }
+  if (resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval") && !options.expectedCollectionRevision) {
+    throw new Error("Data Retention Schedule approval requires the displayed collection revision. Reload or scaffold the current review before approving it.");
+  }
+  await requireControlReviewReady(loaded, resourceType, program.id);
+  await requireRetentionScheduleReady(loaded, resourceType, program);
   const configuration = assessment.configuration;
   const decision = String(options.decision || "").trim();
   const rationale = String(options.rationale || "").trim();
@@ -178,6 +216,20 @@ export async function planCollectionReview(input = process.cwd(), options = {})
   if (!rationale || !reviewedByIds.length || !reviewedOn) {
     throw new Error(`${configuration.title} review needs review notes, a reviewer, and a review date.`);
   }
+  if (resourceType === "control") {
+    const eligible = new Set(assessment.eligibleReviewerIds || []);
+    const conflicts = reviewedByIds.filter((id) => !eligible.has(id));
+    if (conflicts.length) {
+      throw new Error(`Control collection review needs a reviewer who does not own an included Control or its enabled Obligation: ${conflicts.join(", ")}.`);
+    }
+  }
+  if (resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")) {
+    const eligible = new Set(assessment.eligibleReviewerIds || []);
+    const conflicts = reviewedByIds.filter((id) => !eligible.has(id));
+    if (conflicts.length) {
+      throw new Error(`Data Retention Schedule approval needs a reviewer who does not own its governing document or an included schedule row: ${conflicts.join(", ")}.`);
+    }
+  }
   if (temporalReviews) {
     if (reviewedOn !== today) {
       throw new Error("A current Collection Review must use today's workspace-local review date. Reconstruct an older population from Git history instead of backdating today's files.");
@@ -270,6 +322,72 @@ export async function planCollectionReview(input = process.cwd(), options = {})
   };
 }
 
+async function requireControlReviewReady(loaded, resourceType, programId) {
+  if (resourceType !== "control") return;
+  const { assessProgramReadiness } = await import("./program-readiness.js");
+  const readiness = await assessProgramReadiness(loaded, { programId });
+  const earlierItems = readiness.stages
+    .find(({ id }) => id === "controls")
+    ?.items.filter(({ id }) => (
+      id !== "collection-review-control"
+      && !id.startsWith("document-activation-")
+      && !id.startsWith("training-activation-")
+      && !id.startsWith("policy-activation-")
+    )) || [];
+  if (!earlierItems.length || earlierItems.some(({ status }) => status !== "complete")) {
+    throw new Error("Complete the Step 3 implementation work before recording the Control collection review. Program content activation follows this review.");
+  }
+}
+
+async function requireRetentionScheduleReady(loaded, resourceType, program) {
+  if (resourceType !== "retention-schedule-item" || !modelSupports(loaded.model, "retention-schedule-approval")) return;
+  const rows = scopedCollectionRecords(loaded, resourceType, program);
+  const approvalIssues = retentionScheduleApprovalIssues(loaded, program, rows, {
+    informationTypesReviewed: assessCollectionReview(loaded, "information-type", { programId: program.id }).complete
+  });
+  if (approvalIssues.length) throw new Error(approvalIssues[0].message);
+}
+
+function assessControlReviewers(loaded, controls) {
+  const byId = new Map(loaded.resources.map((record) => [record.id, record]));
+  const controlIds = new Set(controls.map(({ id }) => id));
+  const conflictIds = new Set();
+  for (const control of controls) {
+    for (const id of currentPartyPeople(control.ownerIds || [], byId)) conflictIds.add(id);
+  }
+  for (const obligation of loaded.resources.filter((record) => (
+    record.type === "obligation"
+    && record.status === "active"
+    && (record.controlIds || []).some((id) => controlIds.has(id))
+  ))) {
+    for (const id of currentPartyPeople(obligation.ownerIds || [], byId)) conflictIds.add(id);
+  }
+  const people = loaded.resources.filter(({ type, status }) => type === "person" && status === "active");
+  return {
+    eligibleReviewerIds: people.map(({ id }) => id).filter((id) => !conflictIds.has(id)),
+    reviewerConflictIds: people.map(({ id }) => id).filter((id) => conflictIds.has(id))
+  };
+}
+
+function assessRetentionScheduleReviewers(loaded, rows) {
+  const byId = new Map(loaded.resources.map((record) => [record.id, record]));
+  const conflictIds = new Set();
+  const schedules = loaded.resources.filter((record) => (
+    record.type === "document"
+    && record.documentKind === "schedule"
+    && record.workflowScope === "program"
+    && !["superseded", "retired"].includes(record.status)
+  ));
+  for (const record of [...schedules, ...rows]) {
+    for (const id of currentPartyPeople(record.ownerIds || [], byId)) conflictIds.add(id);
+  }
+  const people = loaded.resources.filter(({ type, status }) => type === "person" && status === "active");
+  return {
+    eligibleReviewerIds: people.map(({ id }) => id).filter((id) => !conflictIds.has(id)),
+    reviewerConflictIds: people.map(({ id }) => id).filter((id) => conflictIds.has(id))
+  };
+}
+
 function sameIds(left, right) {
   return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
 }

package/src/collection-revision.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { modelSupports } from "../model/index.js";
 import {
   authoritativeSourceRevisionValue,
   collectionRevisionInputs,
@@ -24,7 +25,8 @@ export function collectionRevisionMatches(loaded, resourceType, storedRevision,
   // Version 0.9.2 narrowed this hash basis. Keep unchanged 0.9.1 reviews valid
   // until management records a new review on the current basis.
   return storedRevision === currentRevision
-    || storedRevision === legacyCollectionRevision(loaded, resourceType, options);
+    || (resourceType !== "retention-schedule-item" || !modelSupports(loaded.model, "retention-schedule-approval"))
+      && storedRevision === legacyCollectionRevision(loaded, resourceType, options);
 }
 
 function calculateCollectionRevision(loaded, resourceType, options, legacy) {

package/src/collection-scope.js

@@ -1,10 +1,17 @@
 import { modelSupports } from "../model/index.js";
 import { programComponents, selectedRequirementIds } from "./program.js";
+import { retentionReviewResourceIds, retentionUses } from "./retention.js";
+import { documentIsAuditSpecific } from "./program-lifecycle.js";
 
 export function scopedCollectionRecords(loaded, resourceType, program) {
   if (!modelSupports(loaded.model, "program-scope")) {
     return loaded.resources.filter((record) => record.type === resourceType);
   }
+  if (resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")) {
+    return loaded.resources.filter((record) => (
+      record.type === resourceType && !["retired", "superseded"].includes(record.status)
+    ));
+  }
   if (resourceType === "person") {
     return scopedProgramPeople(loaded, program);
   }
@@ -35,6 +42,7 @@ export function scopedCollectionRecords(loaded, resourceType, program) {
   const selected = {
     system: systemIds,
     component: componentIds,
+    control: controlIds,
     framework: new Set(scopedProgram.frameworkIds || []),
     "complementary-control": new Set(loaded.resources.filter((record) => (
       record.type === "complementary-control"
@@ -51,7 +59,9 @@ export function scopedCollectionRecords(loaded, resourceType, program) {
     )).map(({ id }) => id))
   }[resourceType];
   return loaded.resources.filter((record) => (
-    record.type === resourceType && (!selected || selected.has(record.id))
+    record.type === resourceType
+    && (!selected || selected.has(record.id))
+    && (resourceType !== "control" || record.status === "implemented")
   ));
 }
 
@@ -114,6 +124,20 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
       if (record) records.set(record.id, record);
     }
   };
+  const addPartyIds = (ids) => {
+    const pending = [...(ids || [])];
+    const visited = new Set();
+    while (pending.length) {
+      const id = pending.shift();
+      if (!id || visited.has(id)) continue;
+      visited.add(id);
+      const record = byId.get(id);
+      if (!record) continue;
+      records.set(record.id, record);
+      if (record.type === "team") pending.push(...(record.memberIds || []), ...(record.chairIds || []));
+      if (record.type === "appointment") pending.push(record.holderId);
+    }
+  };
 
   if (resourceType === "framework") {
     addIds(program?.systemIds);
@@ -139,6 +163,66 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
       addIds((record.informationUses || []).map(({ informationTypeId }) => informationTypeId));
     }
   }
+  if (resourceType === "control") {
+    const obligations = loaded.resources.filter((record) => (
+      record.type === "obligation"
+      && record.status === "active"
+      && (record.controlIds || []).some((id) => reviewedIds.has(id))
+    ));
+    const controlCodes = new Set(reviewed.map(({ code }) => code).filter(Boolean));
+    const sourceFamilyIds = new Set((loaded.model.evidenceSourceFamilies || [])
+      .filter((family) => (family.controlCodes || []).some((code) => controlCodes.has(code)))
+      .map(({ id }) => id));
+    const sourceCoverage = loaded.resources.filter((record) => (
+      record.type === "source-coverage"
+      && record.status !== "retired"
+      && sourceFamilyIds.has(record.sourceFamilyId)
+    ));
+    const policyIds = new Set(reviewed.flatMap((record) => record.policyIds || []));
+    const policies = loaded.resources.filter((record) => (
+      record.type === "policy"
+      && policyIds.has(record.id)
+      && record.programRole !== "conditional"
+      && !["superseded", "retired"].includes(record.status)
+    ));
+    const governedIds = new Set([
+      ...policies.flatMap((record) => record.relatedDocumentIds || []),
+      ...obligations.flatMap((record) => [
+        ...(record.scopeResourceIds || []),
+        ...(record.templateResourceId ? [record.templateResourceId] : [])
+      ])
+    ]);
+    const governedContent = loaded.resources.filter((record) => (
+      ["document", "training"].includes(record.type)
+      && !["superseded", "retired"].includes(record.status)
+      && (governedIds.has(record.id) || (record.controlIds || []).some((id) => reviewedIds.has(id)))
+      && (record.type !== "document" || !documentIsAuditSpecific(record, loaded.model))
+    ));
+    addIds(program?.systemIds);
+    addIds(obligations.map(({ id }) => id));
+    addIds(sourceCoverage.map(({ id }) => id));
+    addIds(policies.map(({ id }) => id));
+    addIds(governedContent.map(({ id }) => id));
+    for (const record of reviewed) {
+      addIds(record.componentIds);
+      addIds(record.evidenceSourceComponentIds);
+      addPartyIds(record.ownerIds);
+    }
+    for (const obligation of obligations) addPartyIds(obligation.ownerIds);
+    for (const record of [...policies, ...governedContent]) {
+      addPartyIds([...(record.ownerIds || []), ...(record.approverIds || []), ...(record.approvedByIds || [])]);
+    }
+    for (const coverage of sourceCoverage) {
+      addIds([coverage.componentId]);
+      addIds(coverage.readinessTestEvidenceIds);
+      addIds(coverage.retentionScheduleItemIds);
+      addPartyIds([...(coverage.ownerIds || []), ...(coverage.retrieverIds || [])]);
+      for (const rule of (coverage.retentionScheduleItemIds || []).map((id) => byId.get(id)).filter(Boolean)) {
+        addIds(retentionReviewResourceIds(rule, loaded));
+        addPartyIds([...(rule.ownerIds || []), ...(rule.approvedByIds || [])]);
+      }
+    }
+  }
   if (resourceType === "information-type" && !legacy) {
     addIds(program?.systemIds);
     addIds(programComponents(loaded, program || {}).map(({ id }) => id));
@@ -146,6 +230,29 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
       .filter((record) => record.type === "vendor" && record.status !== "retired")
       .map(({ id }) => id));
   }
+  if (resourceType === "retention-schedule-item" && !legacy && modelSupports(loaded.model, "retention-schedule-approval")) {
+    const uses = retentionUses(loaded, program || {});
+    addIds(uses.map(({ resource }) => resource.id));
+    addIds(uses.map(({ informationTypeId }) => informationTypeId));
+    const schedules = loaded.resources
+      .filter((record) => (
+        record.type === "document"
+        && record.documentKind === "schedule"
+        && record.workflowScope === "program"
+        && !["superseded", "retired"].includes(record.status)
+      ))
+    addIds(schedules.map(({ id }) => id));
+    for (const schedule of schedules) {
+      addPartyIds([...(schedule.ownerIds || []), ...(schedule.approverIds || [])]);
+    }
+    for (const record of reviewed) {
+      addIds([record.scheduleDocumentId]);
+      addIds(record.informationTypeIds);
+      addIds(record.scopeResourceIds);
+      addIds(record.sourceResourceIds);
+      addPartyIds([...(record.ownerIds || []), ...(record.approvedByIds || [])]);
+    }
+  }
   if (resourceType === "complementary-control") {
     addIds(program?.systemIds);
     addIds(program?.controlIds);
@@ -202,12 +309,20 @@ export function collectionScopeRevisionFacts(loaded, resourceType, program) {
   if (resourceType === "system") {
     return { ...common, systemIds: sorted(program?.systemIds) };
   }
-  if (resourceType === "component" || resourceType === "complementary-control") {
-    return {
+  if (resourceType === "component" || resourceType === "complementary-control" || resourceType === "control") {
+    const scope = {
       ...common,
       systemIds: sorted(program?.systemIds),
       controlIds: sorted(program?.controlIds)
     };
+    return resourceType === "control" ? {
+      ...scope,
+      assuranceGoal: program?.assuranceGoal ?? null,
+      frameworkIds: sorted(program?.frameworkIds),
+      requirementIds: sorted(selectedRequirementIds(program || {}, loaded.model)),
+      requirementApplicability: program?.requirementApplicability || [],
+      riskMethodology: program?.riskMethodology || null
+    } : scope;
   }
   return common;
 }
@@ -244,11 +359,41 @@ const dependencyFields = {
     classification: ["id", "type", "status", "rank", "description", "handlingRequirements"],
     "information-type": ["id", "type", "status", "classificationId", "description"]
   },
+  control: {
+    system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
+    component: ["id", "type", "status", "componentKind", "description", "ownerIds", "systemUses", "evidenceSourceKinds", "evidenceOwnerIds"],
+    obligation: ["id", "type", "status", "activityType", "scheduleMode", "ownerIds", "activeRuleId", "policyIds", "controlIds", "ruleIds"],
+    "source-coverage": ["id", "type", "status", "sourceFamilyId", "coverageKind", "scopeResourceIds", "excludedPopulation", "retrieverIds", "collectionCadence", "retentionScheduleItemIds", "reconciliationMethod", "validFrom", "validThrough", "applicabilityReview", "readinessTestEvidenceIds", "ownerIds", "componentId"],
+    evidence: ["id", "type", "status", "artifactKind", "readinessTest", "retrievalResult", "accessConfirmed", "coveredSourceFamilyIds", "sourceComponentId", "componentIds", "systemIds", "collectedOn", "collectorIds", "verifierIds", "verifiedOn"],
+    "retention-schedule-item": ["id", "type", "status", "description", "informationTypeIds", "scopeResourceIds", "scheduleDocumentId", "sourceResourceIds", "ownerIds", "approvedByIds", "approvedOn", "reviewedSourceRevisions", "cutoff", "retentionPeriod", "dispositionAction", "dispositionInstructions"],
+    document: ["id", "type", "documentKind", "workflowScope", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "controlIds"],
+    policy: ["id", "type", "programRole", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "relatedDocumentIds", "controlIds"],
+    training: ["id", "type", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "controlIds"],
+    "information-type": ["id", "type", "status", "classificationId", "description"],
+    person: ["id", "type", "status", "affiliation", "jobTitle"],
+    team: ["id", "type", "status", "memberIds", "chairIds"],
+    appointment: ["id", "type", "status", "appointmentKind", "scopeResourceIds", "holderId", "startsOn", "endsOn"]
+  },
   "information-type": {
     system: ["id", "type", "status", "informationTypeIds"],
     component: ["id", "type", "status", "systemUses", "informationUses"],
     vendor: ["id", "type", "status", "informationTypeIds"]
   },
+  "retention-schedule-item": {
+    document: ["id", "type", "documentKind", "workflowScope", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "controlIds"],
+    policy: ["id", "type", "status", "programRole", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "controlIds"],
+    requirement: ["id", "type", "title", "frameworkId", "reference", "description"],
+    commitment: ["id", "type", "status", "commitmentKind", "statement", "effectiveOn"],
+    control: ["id", "type", "status", "statement", "systemIds", "componentIds"],
+    "information-type": ["id", "type", "status", "classificationId", "description"],
+    system: ["id", "type", "status", "informationTypeIds"],
+    component: ["id", "type", "status", "systemUses", "informationUses"],
+    vendor: ["id", "type", "status", "informationTypeIds"],
+    "source-coverage": ["id", "type", "status", "sourceFamilyId", "coverageKind", "scopeResourceIds", "retentionScheduleItemIds", "componentId"],
+    person: ["id", "type", "status", "affiliation", "jobTitle"],
+    team: ["id", "type", "status", "memberIds", "chairIds"],
+    appointment: ["id", "type", "status", "appointmentKind", "scopeResourceIds", "holderId", "startsOn", "endsOn"]
+  },
   "complementary-control": {
     system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
     control: ["id", "type", "status", "statement", "activity", "systemIds", "componentIds", "evidenceSourceComponentIds"],
@@ -279,6 +424,8 @@ const dependencyContentTypes = {
   framework: new Set(["system"]),
   vendor: new Set(["document"]),
   component: new Set(["system"]),
+  control: new Set(["system", "component", "obligation", "source-coverage", "evidence", "retention-schedule-item", "document", "policy", "training"]),
+  "retention-schedule-item": new Set(["document", "policy"]),
   "complementary-control": new Set(["system", "control", "document", "component"])
 };
 

package/src/document-activation.js

@@ -10,12 +10,18 @@ import { loadWorkspace } from "./workspace.js";
 export async function scaffoldDocumentActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
   requireDocumentLifecycle(loaded);
-  const candidates = await activationCandidates(loaded, { ...options, documentsOnly: true });
+  const readiness = options.auditId ? null : await assessProgramReadiness(loaded, { programId: options.programId });
+  const oversightReady = options.auditId || controlOversightComplete(loaded, readiness);
+  const candidates = oversightReady
+    ? await activationCandidates(loaded, { ...options, documentsOnly: true })
+    : [];
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
   const today = currentCalendarDate(loaded.workspace.timezone);
   return {
     available: candidates.length > 0,
-    message: candidates.length
+    message: !oversightReady
+      ? "Complete the current Control collection review before Program Content Activation."
+      : candidates.length
       ? `${candidates.length} approved ${candidates.length === 1 ? "Document is" : "Documents are"} ready to activate.`
       : `No ${options.auditId ? "engagement Document" : "program Document"} is ready to activate. Review the current readiness actions first.`,
     nextCommand: candidates.length ? null : options.auditId
@@ -34,6 +40,12 @@ export async function scaffoldDocumentActivation(input = process.cwd(), options
 export async function planDocumentActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
   requireDocumentLifecycle(loaded);
+  if (!options.auditId && modelSupports(loaded.model, "control-collection-oversight")) {
+    const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
+    if (!controlOversightComplete(loaded, readiness)) {
+      throw new Error("Complete the current Control collection review before Program Content Activation.");
+    }
+  }
   const resourceIds = [...new Set((options.resourceIds || options.documentIds || []).map(String))];
   if (!resourceIds.length) throw new Error("Governed-content activation needs at least one approved program Document or Training record.");
   const activatedByIds = [...new Set((options.activatedByIds || []).map(String))];
@@ -118,6 +130,12 @@ export async function planDocumentActivation(input = process.cwd(), options = {}
   };
 }
 
+function controlOversightComplete(loaded, readiness) {
+  if (!modelSupports(loaded.model, "control-collection-oversight") || !readiness.scope.controlIds.length) return true;
+  return readiness.stages.find(({ id }) => id === "controls")?.items
+    .find(({ id }) => id === "collection-review-control")?.status === "complete";
+}
+
 async function activationCandidates(loaded, options) {
   if (options.auditId) {
     return (await assessAuditDocumentActivations(loaded, {
@@ -150,12 +168,18 @@ export async function scaffoldGovernedContentActivation(input = process.cwd(), o
   if (!modelSupports(loaded.model, "governed-training-activation")) {
     throw new Error("Unified governed-content activation requires a model v6 or later workspace.");
   }
-  const candidates = await activationCandidates(loaded, { ...options, auditId: undefined });
+  const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
+  const oversightReady = controlOversightComplete(loaded, readiness);
+  const candidates = oversightReady
+    ? await activationCandidates(loaded, { ...options, auditId: undefined })
+    : [];
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
   const today = currentCalendarDate(loaded.workspace.timezone);
   return {
     available: candidates.length > 0,
-    message: candidates.length
+    message: !oversightReady
+      ? "Complete the current Control collection review before Program Content Activation."
+      : candidates.length
       ? `${candidates.length} approved governed-content ${candidates.length === 1 ? "record is" : "records are"} ready to activate.`
       : "No program Document or Training record is ready to activate. Review the current readiness actions first.",
     nextCommand: candidates.length ? null : "npx filegrc program-path --next --json",

package/src/model-migration.js

@@ -901,7 +901,8 @@ export async function planModelMigration(input = process.cwd(), options = {}) {
               : sourceVersion === "6" ? "7"
                 : sourceVersion === "7" ? "8"
                   : sourceVersion === "8" ? "9"
-                    : ACTIVE_MODEL_VERSION;
+                    : sourceVersion === "9" ? "10"
+                      : ACTIVE_MODEL_VERSION;
   if (sourceVersion === requestedTarget) return emptyPlan(sourceVersion, requestedTarget);
   if (sourceVersion === "1" && requestedTarget === "2") {
     return planV1ToV2Migration(input, options);
@@ -927,9 +928,12 @@ export async function planModelMigration(input = process.cwd(), options = {}) {
   if (sourceVersion === "8" && requestedTarget === "9") {
     return planV8ToV9Migration(loaded);
   }
-  if (sourceVersion === "9" && requestedTarget === ACTIVE_MODEL_VERSION) {
+  if (sourceVersion === "9" && requestedTarget === "10") {
     return planV9ToV10Migration(loaded);
   }
+  if (sourceVersion === "10" && requestedTarget === ACTIVE_MODEL_VERSION) {
+    return planV10ToV11Migration(loaded);
+  }
   if (sourceVersion === "1" && requestedTarget === ACTIVE_MODEL_VERSION) {
     throw new Error(
       "Model v1 workspaces must migrate to model v2 first. "
@@ -2406,6 +2410,70 @@ async function planV9ToV10Migration(loaded) {
   };
 }
 
+async function planV10ToV11Migration(loaded) {
+  if (!loaded.workspace?.id) throw new Error("Model migration requires a valid Workspace record.");
+  const targetModel = loadModel("11");
+  const revisions = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
+  const automatic = [];
+  const reviewRequired = [];
+  const unsupported = [];
+  const missing = [];
+  const manualActions = [];
+  const updates = [];
+  for (const original of loaded.resources) {
+    const record = structuredClone(original);
+    let changed = false;
+    if (record.type === "workspace") {
+      record.dataModelVersion = "11";
+      automatic.push(classifiedChange("automatic", record.id, "dataModelVersion", "Select model v11."));
+      changed = true;
+    }
+    if (record.type === "control") {
+      for (const field of ["implementationReviewedByIds", "implementationReviewedOn"]) {
+        if (!Object.hasOwn(record, field)) continue;
+        delete record[field];
+        automatic.push(classifiedChange("automatic", record.id, field, "Remove the obsolete per-Control implementation review field. Control oversight now uses a periodic Collection Review."));
+        changed = true;
+      }
+    }
+    if (changed) updates.push(record);
+  }
+  const updatedById = new Map(updates.map((record) => [record.id, record]));
+  const migratedRecords = loaded.resources.map((record) => updatedById.get(record.id) || record);
+  await collectTargetValidationActions(loaded, migratedRecords, targetModel, missing, manualActions);
+  for (const item of [...missing, ...manualActions]) {
+    unsupported.push(classifiedChange("unsupported", item.resourceId, item.field, item.message));
+  }
+  return {
+    schemaVersion: 2,
+    sourceModelVersion: "10",
+    targetModelVersion: "11",
+    ready: unsupported.length === 0,
+    missing,
+    conflicts: [],
+    manualActions,
+    classifications: { automatic, reviewRequired, unsupported },
+    notes: [
+      "Control owners can mark Controls implemented without a separate per-Control implementation reviewer.",
+      "Periodic Control oversight is recorded as a Git-bound Collection Review over the Program's selected Controls.",
+      "Policy, Document, and Training approval independence remains unchanged."
+    ],
+    migrationReport: {},
+    summary: { create: 0, update: updates.length, automatic: automatic.length, reviewRequired: 0, unsupported: unsupported.length },
+    fileDiff: {
+      create: [],
+      update: updates.map((record) => ({ type: record.type, id: record.id, before: loaded.resources.find(({ id }) => id === record.id), after: record }))
+    },
+    changes: {
+      create: [],
+      update: updates,
+      expectedRevisions: Object.fromEntries(updates.map(({ id }) => [id, revisions.get(id)])),
+      validateWholeWorkspace: true,
+      targetModelVersion: "11"
+    }
+  };
+}
+
 function normalizeDocumentScopeDecision(value) {
   const candidate = typeof value === "object" && value
     ? value.workflowScope || value.scope