filegrc 0.13.5 → 0.15.0

package/src/policy-activation.js

@@ -3,17 +3,21 @@ import { serializeWorkspaceMutation } from "./mutation.js";
 import { assessProgramReadiness } from "./program-readiness.js";
 import { currentCalendarDate } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
+import { modelSupports } from "../model/index.js";
 
 export async function scaffoldPolicyActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
   const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
-  const approved = readiness.policyActivations.filter(({ state }) => (
+  const oversightReady = controlOversightComplete(loaded, readiness);
+  const approved = (oversightReady ? readiness.policyActivations : []).filter(({ state }) => (
     ["approved-implementation-pending", "ready-to-activate"].includes(state)
   ));
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
   return {
     available: approved.length > 0,
-    message: approved.length
+    message: !oversightReady
+      ? "Complete the current Control collection review before Program Content Activation."
+      : approved.length
       ? `${approved.length} approved ${approved.length === 1 ? "Policy is" : "Policies are"} available for the Step 3 cutover.`
       : "No Policy is ready for activation. Finish Step 2 approval, then resolve its Step 3 implementation gaps.",
     nextCommand: approved.length ? null : "npx filegrc program-path --next --json",
@@ -26,6 +30,10 @@ export async function scaffoldPolicyActivation(input = process.cwd(), options =
 
 export async function planPolicyActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
+  const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
+  if (!controlOversightComplete(loaded, readiness)) {
+    throw new Error("Complete the current Control collection review before Program Content Activation.");
+  }
   const policyIds = [...new Set((options.policyIds || []).map(String))];
   if (!policyIds.length) throw new Error("Policy activation needs at least one approved Policy.");
   const effectiveOn = String(options.effectiveOn || "").trim();
@@ -67,6 +75,12 @@ export async function planPolicyActivation(input = process.cwd(), options = {})
   };
 }
 
+function controlOversightComplete(loaded, readiness) {
+  if (!modelSupports(loaded.model, "control-collection-oversight") || !readiness.scope.controlIds.length) return true;
+  return readiness.stages.find(({ id }) => id === "controls")?.items
+    .find(({ id }) => id === "collection-review-control")?.status === "complete";
+}
+
 export async function activatePolicies(input = process.cwd(), options = {}) {
   if (options.confirmed !== true) throw new Error("Review the Policy activation cutover and confirm the write.");
   return serializeWorkspaceMutation(input, async (root) => {

package/src/program-path.js

@@ -1,3 +1,5 @@
+import { ACTIVE_MODEL_VERSION, modelSupports } from "../model/index.js";
+
 export const RESOURCE_INSTRUCTIONS = {
   program: "Define one management compliance or assurance Program with its goal, bounded Systems, selected Frameworks, Requirement applicability decisions, Controls, owners, risk method, and candidate period.",
   person: "Record each person’s actual organizational job title. Keep named program authority, such as CISO, DPO, Policy Owner, or team chair, in dated Appointment records.",
@@ -105,13 +107,14 @@ export const PROGRAM_PATH = [
     id: "policies",
     number: 2,
     title: "Approve Policies",
-    description: "Review governed content and approvals",
-    summary: "Review and independently approve Policies, program Documents, and Training content.",
+    description: "Approve governed content and retention decisions",
+    summary: "Review and independently approve Policies, program Documents, Training content, and the Data Retention Schedule.",
     sections: [
-      { id: "policy-content", title: "Policies", description: "Review every program Policy, Document, and Training record in one table, then bind independent approval to each exact revision.", steps: ["Review each governed Markdown artifact and replace every organization placeholder.", "Confirm the owner, separate approver, linked Controls, audience, and intended values that apply to each artifact.", "Record approval and its date against the exact revision. Leave approved content inactive until its Step 3 implementation cutover."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/stage/policies" }], defaultOpen: true }
+      { id: "policy-content", title: "Policies", description: "Review every program Policy, Document, and Training record in one table, then bind independent approval to each exact revision.", steps: ["Review each governed Markdown artifact and replace every organization placeholder.", "Confirm the owner, separate approver, linked Controls, audience, and intended values that apply to each artifact.", "Record approval and its date against the exact revision. Leave approved content inactive until its Step 3 implementation cutover."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/policies" }], defaultOpen: true },
+      { id: "retention", title: "Data Retention Schedule", description: "Approve the schedule document and its structured rows as one governed schedule.", steps: ["Review the schedule policy, legal holds, exceptions, and disposal requirements.", "Define rows only for Information Types and operational sources the organization actually uses.", "Confirm the complete document-and-row revision with one schedule review."], types: [], utility: "retention-schedule", defaultOpen: true }
     ],
     resourceTypes: [],
-    supportingResourceTypes: ["policy", "document", "training"],
+    supportingResourceTypes: ["policy", "document", "training", "retention-schedule-item"],
     commands: [
       "filegrc guide policy --json",
       "filegrc guide document --json",
@@ -119,29 +122,33 @@ export const PROGRAM_PATH = [
       "filegrc list policy --json",
       "filegrc list document --json",
       "filegrc list training --json",
-      "filegrc get POLICY_ID --mutation"
+      "filegrc get POLICY_ID --mutation",
+      "filegrc guide retention-schedule-item --json",
+      "filegrc review-collection retention-schedule-item --scaffold"
     ]
   },
   {
     id: "controls",
     number: 3,
     title: "Implement Controls",
-    description: "Finish controls and their evidence sources",
-    summary: "Describe each Control and connect its evidence source.",
+    description: "Implement and prepare to operate",
+    summary: "Implement Controls, configure their operating schedules and evidence sources, then activate the approved program.",
     sections: [
-      { id: "catalog", title: "Control Catalog", description: "Implement approved requirements, configure retention and Obligations, activate approved program content, finish authoritative evidence sources, then activate the Policies at cutover.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components.", "Review every Retention Schedule Item against current information uses and approved sources. Do not infer periods or disposition behavior.", "Review and enable every calendar and event schedule as an Obligation. Enabled work remains dormant until its governing Policy is active.", "Confirm each source Component is active, has an evidence-source role and rationale in the Control's System scope, has current access owners, and includes repeatable retrieval instructions in Record Markdown.", "Implement every requirement linked from an approved program Document or Training record, then activate the unchanged approved revisions with separate activation dates and bindings.", "Use the activation review to inspect planned or partial Controls, inactive governed content, missing Components or sources, missing schedules, and unresolved Exceptions.", "Choose the approved Policies that should take effect, set the real effective date, and confirm the Step 3 cutover."], types: ["control", "complementary-control", "retention-schedule-item", "obligation"], defaultOpen: true }
+      { id: "controls", title: "Controls", description: "Implement the selected Controls and connect their scope, procedures, mappings, and operation patterns.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components."], types: ["control"], defaultOpen: true },
+      { id: "complementary-controls", title: "Complementary Controls", description: "Record customer or provider responsibilities that form part of the implementation boundary, or confirm there are none.", steps: ["Review whether an in-scope Control depends on a customer or carved-out provider action."], types: ["complementary-control"], defaultOpen: true },
+      { id: "evidence-sources", title: "Evidence Sources", description: "Check that every Control points to an authoritative source that can produce its expected evidence.", steps: ["Confirm each source Component is active, has the right evidence-source role, names current access owners, and includes repeatable retrieval instructions."], types: [], utility: "evidence-sources", defaultOpen: true },
+      { id: "obligations", title: "Obligations", description: "Configure the calendar and event schedules that operate the Controls.", steps: ["Review and enable every required calendar and event schedule."], types: ["obligation"], defaultOpen: true }
     ],
-    resourceTypes: ["control", "complementary-control", "retention-schedule-item", "obligation"],
+    resourceTypes: ["control", "complementary-control", "obligation"],
     commands: [
       "filegrc guide control --json",
       "filegrc list control --json",
       "filegrc get CONTROL_ID --mutation",
       "filegrc guide obligation --json",
-      "filegrc guide retention-schedule-item --json",
-      "filegrc review-collection retention-schedule-item --scaffold",
       "filegrc list obligation --json",
       "filegrc review-collection component --scaffold",
       "filegrc review-collection complementary-control --scaffold",
+      "filegrc review-collection control --scaffold",
       "filegrc activate-content --scaffold",
       "filegrc activate-policies --scaffold",
       "filegrc evidence-map --json",
@@ -259,8 +266,51 @@ export const PROGRAM_PATH = [
   }
 ];
 
-export function buildAgentProgramPath(model) {
+export function programPathForModel(model = ACTIVE_MODEL_VERSION) {
+  if (modelSupports(model, "retention-schedule-approval")) return PROGRAM_PATH;
   return PROGRAM_PATH.map((stage) => {
+    if (stage.id === "policies") {
+      return {
+        ...stage,
+        description: "Review governed content and approvals",
+        summary: "Review and independently approve Policies, program Documents, and Training content.",
+        sections: [{
+          ...stage.sections[0],
+          relatedLinks: [{ type: "policy", label: "Policies", href: "#/stage/policies" }]
+        }],
+        supportingResourceTypes: stage.supportingResourceTypes.filter((type) => type !== "retention-schedule-item"),
+        commands: stage.commands.filter((command) => !command.includes("retention-schedule-item"))
+      };
+    }
+    if (stage.id === "controls") {
+      const retention = {
+        id: "retention",
+        title: "Retention Schedule",
+        description: "Review each retention rule against current information uses and approved sources.",
+        steps: ["Confirm scope, cutoff, period, disposition, sources, owner, and approval for each rule."],
+        types: ["retention-schedule-item"],
+        defaultOpen: true
+      };
+      return {
+        ...stage,
+        description: "Finish controls and their evidence sources",
+        summary: "Describe each Control and connect its evidence source.",
+        sections: [...stage.sections.slice(0, 3), retention, ...stage.sections.slice(3)],
+        resourceTypes: [...stage.resourceTypes.slice(0, 2), "retention-schedule-item", ...stage.resourceTypes.slice(2)],
+        commands: [
+          ...stage.commands.slice(0, 5),
+          "filegrc guide retention-schedule-item --json",
+          "filegrc review-collection retention-schedule-item --scaffold",
+          ...stage.commands.slice(5)
+        ]
+      };
+    }
+    return stage;
+  });
+}
+
+export function buildAgentProgramPath(model) {
+  return programPathForModel(model).map((stage) => {
     const programResourceTypes = [...stage.resourceTypes, ...(stage.supportingResourceTypes || [])]
       .filter((type) => model.resources[type]);
     const resourcePages = programResourceTypes.map((type, index) => {
@@ -300,8 +350,8 @@ function agentCommand(command) {
   return command.startsWith("filegrc ") ? `npx ${command}` : command;
 }
 
-export function resourceProgramContext(type) {
-  const stage = PROGRAM_PATH.find((candidate) => (
+export function resourceProgramContext(type, model) {
+  const stage = programPathForModel(model).find((candidate) => (
     candidate.resourceTypes.includes(type) || (candidate.supportingResourceTypes || []).includes(type)
   ));
   if (!stage) return null;

package/src/program-readiness.js

@@ -57,14 +57,20 @@ export async function assessProgramReadiness(input, options = {}) {
     .map(collectionReviewReadinessItem));
   const sourceStage = await evidenceSourcesStage(scope, byId, loaded.model, readMarkdown);
   controlStage.items.push(...sourceStage.items);
-  controlStage.items.push(...await assessRetentionReadiness(loaded, program, {
+  const retentionItems = await assessRetentionReadiness(loaded, program, {
     informationTypesReviewed: collectionReviews.find(({ resourceType }) => resourceType === "information-type")?.complete === true
-  }));
-  controlStage.items.push(...collectionReviews
+  });
+  const retentionReviewItems = collectionReviews
     .filter(({ resourceType }) => resourceType === "retention-schedule-item")
-    .map(collectionReviewReadinessItem));
+    .map(collectionReviewReadinessItem);
+  if (modelSupports(loaded.model, "retention-schedule-approval")) {
+    policyStage.items.push(...retentionItems.filter(({ id }) => !id.startsWith("retention-source-coverage-")));
+    controlStage.items.push(...retentionItems.filter(({ id }) => id.startsWith("retention-source-coverage-")));
+    policyStage.items.push(...retentionReviewItems);
+  } else {
+    controlStage.items.push(...retentionItems, ...retentionReviewItems);
+  }
   const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model);
-  controlStage.items.push(...governedContent.items);
   const policyActivations = await assessPolicyActivations(
     requiredPolicies(scope, byId),
     scope.controls,
@@ -74,8 +80,22 @@ export async function assessProgramReadiness(input, options = {}) {
     asOf,
     loaded.model
   );
-  controlStage.items.push(...policyActivations.map(policyActivationItem));
-  controlStage.description = `Each implemented Control needs an owner, actual procedure, scope, operation pattern, mappings, an implementation date, enabled Obligations, and complete authoritative source ${modelSupports(loaded.model, "component-sources") ? "Components" : "Systems"}. Activate unchanged approved program Documents and Training after their requirements are implemented, then activate approved Policies at the implementation cutover.`;
+  const controlOversight = collectionReviews.find(({ resourceType }) => resourceType === "control");
+  const oversightEligible = Boolean(controlOversight && controlOversightEligible(controlStage.items));
+  if (oversightEligible) {
+    controlStage.items.push(collectionReviewReadinessItem(controlOversight));
+  }
+  const oversightCurrent = oversightEligible && controlOversight.complete === true;
+  controlStage.items.push(...governedContent.items.map((item) => oversightCurrent || item.status === "complete"
+    ? item
+    : { ...item, status: "blocked", message: `Complete the Control collection review before activation. ${item.message}` }));
+  controlStage.items.push(...policyActivations.map((assessment) => {
+    const item = policyActivationItem(assessment);
+    return oversightCurrent || item.status === "complete"
+      ? item
+      : { ...item, status: "blocked", message: `Complete the Control collection review before activation. ${item.message}` };
+  }));
+  controlStage.description = `Each implemented Control needs an owner, actual procedure, scope, operation pattern, mappings, an implementation date, enabled Obligations, and complete authoritative source ${modelSupports(loaded.model, "component-sources") ? "Components" : "Systems"}. When implementation is ready, perform one review of the implemented Control collection. Management then activates the unchanged approved program content as the Step 3 cutover.`;
   const scopeReadinessStage = scopeStage(
       program,
       scope,
@@ -166,6 +186,10 @@ export async function assessProgramReadiness(input, options = {}) {
   };
 }
 
+export function controlOversightEligible(items) {
+  return items.length > 0 && items.every(({ status }) => status === "complete");
+}
+
 export async function assessEvidenceMap(input, options = {}) {
   const readiness = await assessProgramReadiness(input, options);
   const evidenceItems = readiness.stages
@@ -883,6 +907,11 @@ function requiredGovernedDocuments(scope, records, byId, model) {
     && (
       linkedDocumentIds.has(record.id)
       || obligationDocumentIds.has(record.id)
+      || (
+        modelSupports(model, "retention-schedule-approval")
+        && record.documentKind === "schedule"
+        && record.workflowScope === "program"
+      )
       || (
         record.programRole === "required"
         && (record.controlIds || []).some((id) => selectedControlIds.has(id))
@@ -1300,12 +1329,7 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model) {
       implementationDate: Boolean(control.effectiveOn && control.effectiveOn <= asOf),
       ...(model.resources.control?.fields?.procedureRevision ? {
         procedureRevision: Boolean(control.procedureRevision),
-        procedureEffective: Boolean(control.procedureEffectiveOn && control.procedureEffectiveOn <= asOf),
-        implementationReview: Boolean(
-          control.implementationReviewedOn
-          && control.implementationReviewedOn <= asOf
-          && partiesIndependent(control.ownerIds, control.implementationReviewedByIds, byId)
-        )
+        procedureEffective: Boolean(control.procedureEffectiveOn && control.procedureEffectiveOn <= asOf)
       } : {}),
       policyMapping: (control.policyIds || []).length > 0,
       criteriaMapping: (control.requirementIds || []).length > 0,
@@ -1699,7 +1723,6 @@ function controlCheckLabel(name) {
     implementationDate: "implementation date",
     procedureRevision: "effective procedure revision",
     procedureEffective: "procedure effective date",
-    implementationReview: "independent implementation review",
     policyMapping: "policy mapping",
     criteriaMapping: "criteria mapping",
     workQueue: "running Obligation schedules"

package/src/retention-schedule-approval.js

@@ -0,0 +1,121 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { openPlaceholderCount, substantiveMarkdown } from "./content-readiness.js";
+import { markdownEntries } from "./resource-markdown.js";
+import { resolveDataPath } from "./paths.js";
+import { currentPartyPeople, partiesIndependent } from "./parties.js";
+import {
+  nearDuplicateInformationTypes,
+  resourceReviewRevisionsSync,
+  retentionReviewResourceIds,
+  retentionRuleIsCurrent,
+  retentionUses
+} from "./retention.js";
+
+export function retentionScheduleApprovalIssues(loaded, program, rows, options = {}) {
+  const byId = new Map(loaded.resources.map((record) => [record.id, record]));
+  const issues = [];
+  const planned = rows.filter(({ status }) => status === "planned");
+  if (planned.length) {
+    issues.push(issue("planned-retention-schedule-row", `Complete or retire every planned retention row before approving the schedule revision: ${planned[0].title}.`));
+  }
+  const schedules = loaded.resources.filter((record) => (
+    record.type === "document"
+    && record.documentKind === "schedule"
+    && record.workflowScope === "program"
+    && !["superseded", "retired"].includes(record.status)
+  ));
+  if (!schedules.length) {
+    issues.push(issue("missing-retention-schedule-document", "Add and approve the Data Retention Schedule document before approving the schedule revision."));
+  }
+  if (schedules.length !== 1) {
+    if (schedules.length) {
+      issues.push(issue("multiple-retention-schedule-documents", "Keep exactly one current program Data Retention Schedule document before approving the schedule revision."));
+    }
+  }
+  const schedule = schedules.length === 1 ? schedules[0] : null;
+  const scheduleContent = schedule ? primaryMarkdown(loaded, schedule) : "";
+  const linkedControl = schedule && (schedule.controlIds || []).some((id) => (program.controlIds || []).includes(id));
+  if (
+    schedule
+    && (!["approved", "active"].includes(schedule.status)
+    || !schedule.approvedOn
+    || !schedule.approvedContentRevisions
+    || currentPartyPeople(schedule.ownerIds || [], byId).size === 0
+    || !partiesIndependent(schedule.ownerIds, schedule.approverIds, byId)
+    || !linkedControl
+    || !substantiveMarkdown(scheduleContent)
+    || openPlaceholderCount(scheduleContent) > 0
+    || !approvalBindingsMatch(loaded, schedule))
+  ) {
+    issues.push(issue("unapproved-retention-schedule-document", "Complete and independently approve the Data Retention Schedule document before approving the complete schedule."));
+  }
+  const activeRows = rows.filter(({ status }) => status === "active");
+  const mismatched = schedule
+    ? activeRows.filter(({ scheduleDocumentId }) => scheduleDocumentId !== schedule.id)
+    : [];
+  if (mismatched.length) {
+    issues.push(issue("retention-row-wrong-schedule-document", `Link every active retention row to the current Data Retention Schedule document before approval: ${mismatched[0].title}.`));
+  }
+  const revisions = resourceReviewRevisionsSync(
+    loaded,
+    activeRows.flatMap((row) => retentionReviewResourceIds(row, loaded))
+  );
+  const incomplete = activeRows.filter((row) => !retentionRuleIsCurrent(row, revisions, byId, loaded));
+  if (incomplete.length) {
+    issues.push(issue("incomplete-retention-schedule-row", `Complete the retention decisions before approving the schedule revision: ${incomplete[0].title}.`));
+  }
+  const usableRows = activeRows.filter((row) => !incomplete.includes(row));
+  const uncovered = retentionUses(loaded, program).find((use) => !usableRows.some((row) => (
+    (row.informationTypeIds || []).includes(use.informationTypeId)
+    && ((row.scopeResourceIds || []).includes(use.resource.id) || (row.scopeResourceIds || []).includes(program.id))
+  )));
+  if (uncovered) {
+    issues.push(issue(
+      "uncovered-retention-information-use",
+      `${uncovered.resource.title} uses ${byId.get(uncovered.informationTypeId)?.title || uncovered.informationTypeId}, but no active, current retention schedule row covers both the type and scope.`
+    ));
+  }
+  if (nearDuplicateInformationTypes(loaded.resources).length && !options.informationTypesReviewed) {
+    issues.push(issue("unreviewed-similar-information-types", "Review similar Information Types before approving the Data Retention Schedule."));
+  }
+  return issues;
+}
+
+function issue(code, message) {
+  return { code, message };
+}
+
+function primaryMarkdown(loaded, record) {
+  const definition = loaded.model.resources[record.type];
+  const selected = markdownEntries(loaded.model, record).find((entry) => (
+    definition.markdown?.[entry.name]?.primary || entry.name === loaded.model.recordContent?.slot
+  ));
+  if (!selected) return "";
+  try {
+    return readFileSync(resolveDataPath(loaded.root, selected.path), "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function approvalBindingsMatch(loaded, record) {
+  const actual = {};
+  for (const entry of markdownEntries(loaded.model, record)) {
+    try {
+      actual[entry.path] = createHash("sha256")
+        .update(readFileSync(resolveDataPath(loaded.root, entry.path), "utf8"))
+        .digest("hex");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  const expected = record.approvedContentRevisions || {};
+  const actualKeys = Object.keys(actual).sort();
+  const expectedKeys = Object.keys(expected).sort();
+  return actualKeys.length === expectedKeys.length
+    && actualKeys.every((key, index) => (
+      key === expectedKeys[index]
+      && actual[key] === expected[key]
+    ));
+}

package/src/retention.js

@@ -1,8 +1,10 @@
+import { readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { contentRevision } from "./files.js";
 import { resolveDataPath } from "./paths.js";
 import { programComponents } from "./program.js";
 import { markdownEntries } from "./resource-markdown.js";
+import { modelSupports } from "../model/index.js";
 
 export async function assessRetentionReadiness(loaded, program, options = {}) {
   if (!loaded.model.resources["retention-schedule-item"]) return [];
@@ -113,7 +115,7 @@ export async function resourceReviewRevisions(loaded, ids) {
     const entry = entries.get(id);
     if (!entry || reviewing.has(id)) return null;
     reviewing.add(id);
-    const parts = [entry.source];
+    const parts = [reviewSource(loaded, entry)];
     for (const markdown of markdownEntries(loaded.model, entry.record)) {
       try {
         parts.push(await readFile(resolveDataPath(loaded.root, markdown.path), "utf8"));
@@ -136,6 +138,37 @@ export async function resourceReviewRevisions(loaded, ids) {
   return new Map([...revisions].filter(([id]) => wanted.has(id)));
 }
 
+export function resourceReviewRevisionsSync(loaded, ids) {
+  const wanted = new Set(ids);
+  const entries = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
+  const revisions = new Map();
+  const reviewing = new Set();
+  const review = (id) => {
+    if (revisions.has(id)) return revisions.get(id);
+    const entry = entries.get(id);
+    if (!entry || reviewing.has(id)) return null;
+    reviewing.add(id);
+    const parts = [reviewSource(loaded, entry)];
+    for (const markdown of markdownEntries(loaded.model, entry.record)) {
+      try {
+        parts.push(readFileSync(resolveDataPath(loaded.root, markdown.path), "utf8"));
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+    for (const sourceId of [...new Set(entry.record.sourceResourceIds || [])].sort()) {
+      const revision = review(sourceId);
+      if (revision) parts.push(`${sourceId}:${revision}`);
+    }
+    reviewing.delete(id);
+    const revision = contentRevision(parts.join("\n"));
+    revisions.set(id, revision);
+    return revision;
+  };
+  for (const id of wanted) review(id);
+  return new Map([...revisions].filter(([id]) => wanted.has(id)));
+}
+
 export function retentionUses(loaded, program) {
   const systemIds = new Set(program.systemIds || []);
   const componentIds = new Set(programComponents(loaded, program).map(({ id }) => id));
@@ -157,6 +190,28 @@ export function retentionUses(loaded, program) {
   return [...new Map(uses.map((use) => [`${use.resource.id}:${use.informationTypeId}`, use])).values()];
 }
 
+function reviewSource(loaded, entry) {
+  if (
+    modelSupports(loaded.model, "retention-schedule-approval")
+    && entry.record.type === "document"
+    && entry.record.documentKind === "schedule"
+    && entry.record.workflowScope === "program"
+  ) {
+    const approved = structuredClone(entry.record);
+    if (approved.status === "active") approved.status = "approved";
+    for (const field of [
+      "activationBasis",
+      "activatedByIds",
+      "activatedOn",
+      "activatedContentRevisions",
+      "effectiveOn",
+      "proposedEffectiveOn"
+    ]) delete approved[field];
+    return JSON.stringify(approved);
+  }
+  return entry.source;
+}
+
 export function nearDuplicateInformationTypes(records) {
   const types = records.filter((record) => record.type === "information-type" && !["retired", "superseded"].includes(record.status));
   const pairs = [];

package/src/state.js

@@ -150,17 +150,7 @@ export async function createAppStateSection(input, section, options = {}) {
       collectionReviews: Object.fromEntries(
         assessCollectionReviews(loaded, { programId: activeProgram.id }).map((assessment) => [
           assessment.resourceType,
-          {
-            resourceType: assessment.resourceType,
-            configuration: assessment.configuration,
-            recordCount: assessment.recordCount,
-            review: assessment.review,
-            reviewRevision: assessment.reviewRevision,
-            collectionRevision: assessment.collectionRevision,
-            status: assessment.status,
-            complete: assessment.complete,
-            message: assessment.message
-          }
+          serializeCollectionReviewAssessment(assessment)
         ])
       ),
       applicabilityConstraints: Object.fromEntries(loaded.resources.flatMap((record) => {
@@ -318,17 +308,7 @@ async function createAppStateUnlocked(input, options) {
   const collectionReviews = Object.fromEntries(
     assessCollectionReviews(loaded, { programId: activeProgram.id }).map((assessment) => [
       assessment.resourceType,
-      {
-        resourceType: assessment.resourceType,
-        configuration: assessment.configuration,
-        recordCount: assessment.recordCount,
-        review: assessment.review,
-        reviewRevision: assessment.reviewRevision,
-        collectionRevision: assessment.collectionRevision,
-        status: assessment.status,
-        complete: assessment.complete,
-        message: assessment.message
-      }
+      serializeCollectionReviewAssessment(assessment)
     ])
   );
   return {
@@ -356,6 +336,23 @@ async function createAppStateUnlocked(input, options) {
   };
 }
 
+function serializeCollectionReviewAssessment(assessment) {
+  return {
+    resourceType: assessment.resourceType,
+    configuration: assessment.configuration,
+    recordCount: assessment.recordCount,
+    review: assessment.review,
+    reviewRevision: assessment.reviewRevision,
+    collectionRevision: assessment.collectionRevision,
+    status: assessment.status,
+    complete: assessment.complete,
+    message: assessment.message,
+    ...(assessment.eligibleReviewerIds ? { eligibleReviewerIds: assessment.eligibleReviewerIds } : {}),
+    ...(assessment.reviewerConflictIds ? { reviewerConflictIds: assessment.reviewerConflictIds } : {}),
+    ...(assessment.approvalIssues ? { approvalIssues: assessment.approvalIssues } : {})
+  };
+}
+
 export async function createResourceDetail(input, type, id, options = {}) {
   if (input?.entries && input?.root) return createResourceDetailFromLoaded(input, type, id, options);
   return serializeWorkspaceMutation(input, async (root) => {

package/src/validate.js

@@ -19,8 +19,9 @@ import {
   validCalendarRecurrence
 } from "./recurrence.js";
 import { resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
+import { retentionScheduleApprovalIssues } from "./retention-schedule-approval.js";
 import { obligationIsEnabled } from "./program-lifecycle.js";
-import { partyPeople } from "./parties.js";
+import { currentPartyPeople, partyPeople } from "./parties.js";
 import { isMarkdownChoice, markdownEntries } from "./resource-markdown.js";
 import { currentCalendarDate, isRfc3339Timestamp, localDateTimeValue, timestampFromLocalDateTime } from "./time.js";
 import { recordTiming } from "./timing.js";
@@ -1273,6 +1274,55 @@ function validateCollectionReview(record, loaded, byId, path, diagnostics) {
       currentRevision
     }
   );
+  if (current && record.resourceType === "control") {
+    const controls = scopedCollectionRecords(loaded, "control", program);
+    const controlIds = new Set(controls.map(({ id }) => id));
+    const conflictIds = new Set();
+    for (const control of controls) {
+      for (const id of currentPartyPeople(control.ownerIds || [], byId)) conflictIds.add(id);
+    }
+    for (const obligation of loaded.resources.filter((candidate) => (
+      candidate.type === "obligation"
+      && candidate.status === "active"
+      && (candidate.controlIds || []).some((id) => controlIds.has(id))
+    ))) {
+      for (const id of currentPartyPeople(obligation.ownerIds || [], byId)) conflictIds.add(id);
+    }
+    const conflictedReviewers = (record.reviewedByIds || []).filter((id) => conflictIds.has(id));
+    if (conflictedReviewers.length) {
+      diagnostics.push(error(
+        "conflicted-control-collection-reviewer",
+        path,
+        `A Control collection reviewer cannot own an included Control or its enabled Obligation: ${conflictedReviewers.join(", ")}.`
+      ));
+    }
+  }
+  if (current && record.resourceType === "retention-schedule-item" && modelSupports(model, "retention-schedule-approval")) {
+    const rows = scopedCollectionRecords(loaded, record.resourceType, program);
+    for (const issue of retentionScheduleApprovalIssues(loaded, program || {}, rows, {
+      informationTypesReviewed: collectionReviewIsCurrent(loaded, "information-type", program)
+    })) {
+      diagnostics.push(error(issue.code, path, issue.message));
+    }
+    const owners = new Set();
+    for (const candidate of loaded.resources.filter((candidate) => (
+      candidate.type === "document"
+        && candidate.documentKind === "schedule"
+        && candidate.workflowScope === "program"
+        && !["superseded", "retired"].includes(candidate.status)
+        || rows.includes(candidate)
+    ))) {
+      for (const id of currentPartyPeople(candidate.ownerIds || [], byId)) owners.add(id);
+    }
+    const conflictedReviewers = (record.reviewedByIds || []).filter((id) => owners.has(id));
+    if (conflictedReviewers.length) {
+      diagnostics.push(error(
+        "conflicted-retention-schedule-reviewer",
+        path,
+        `A Data Retention Schedule reviewer cannot own its governing document or an included schedule row: ${conflictedReviewers.join(", ")}.`
+      ));
+    }
+  }
   if (modelSupports(model, "temporal-collection-reviews")) {
     const temporalValues = [record.coverage, record.knowledgeCutoffAt, record.populationResourceIds];
     const hasTemporalBinding = temporalValues.every((value) => value !== undefined && value !== null);
@@ -1341,6 +1391,25 @@ function validateCollectionReview(record, loaded, byId, path, diagnostics) {
   }
 }
 
+function collectionReviewIsCurrent(loaded, resourceType, program) {
+  const review = loaded.resources.find((record) => (
+    record.type === "collection-review"
+    && record.resourceType === resourceType
+    && record.status === "active"
+    && (!modelSupports(loaded.model, "program-scope") || (record.scopeResourceIds || []).includes(program?.id))
+  ));
+  if (!review || !(loaded.model.collectionReviews?.[resourceType]?.decisions || ["complete"]).includes(review.decision)) return false;
+  const records = scopedCollectionRecords(loaded, resourceType, program);
+  const revisionMatches = collectionRevisionMatches(loaded, resourceType, review.collectionRevision, { program });
+  if (!modelSupports(loaded.model, "temporal-collection-reviews")) return revisionMatches;
+  return revisionMatches
+    && review.coverage?.kind === "as-of"
+    && review.coverage.on === review.reviewedOn
+    && Boolean(review.knowledgeCutoffAt)
+    && Array.isArray(review.populationResourceIds)
+    && JSON.stringify([...review.populationResourceIds].sort()) === JSON.stringify(records.map(({ id }) => id).sort());
+}
+
 function validateCollectionReviewSet(resources, pathById, diagnostics) {
   const current = new Map();
   for (const review of resources.filter((record) => record.type === "collection-review" && record.status !== "retired")) {