filegrc 0.14.0 → 0.15.1

package/model/index.js

@@ -17,7 +17,8 @@ export const MODEL_CAPABILITY_VERSIONS = Object.freeze({
   "temporal-collection-reviews": 9,
   "reporting-routes": 9,
   "reporting-route-sets": 10,
-  "control-collection-oversight": 11
+  "control-collection-oversight": 11,
+  "retention-schedule-approval": 11
 });
 
 export function modelSupports(modelOrVersion, capability) {

package/model/v11.json

@@ -643,12 +643,12 @@
       ]
     },
     "retention-schedule-item": {
-      "title": "Retention schedule",
-      "description": "Confirm that every active information use has an approved or explicitly planned retention schedule item and that no schedule item invents an organization-specific period or disposition.",
+      "title": "Data Retention Schedule",
+      "description": "Approve the schedule document and its structured rows as one governed schedule. Include only actual information uses and keep undecided organization values planned.",
       "reviewPoints": [
-        "Confirm schedule coverage across Systems, Components, Vendors, source families, logs, backups, audit records, and the FileGRC repository.",
-        "Confirm every active item has an approved cutoff, retention period, disposition action, owner, approver, and exact reviewed source revisions.",
-        "Keep undecided periods and disposition behavior planned for management review."
+        "Review the Data Retention Schedule document, its Markdown, and every included structured row as one revision.",
+        "Confirm schedule coverage across the Systems, Components, Vendors, source families, logs, backups, audit records, and FileGRC records the organization actually uses.",
+        "Confirm every active item has an approved cutoff, retention period, disposition action, owner, approver, and exact reviewed source revisions; keep undecided behavior planned."
       ],
       "decisions": [
         "complete",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.14.0",
+  "version": "0.15.1",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/agent.js

@@ -82,7 +82,7 @@ export function buildAgentGuide(loaded, type, options = {}) {
     instructions: RESOURCE_INSTRUCTIONS[type] || definition.description,
     use: definition.description,
     purpose: definition.description,
-    programStep: resourceProgramContext(type),
+    programStep: resourceProgramContext(type, loaded.model),
     policyBasis: definition.guidance.policyBasis,
     cadence: definition.guidance.cadence,
     emptyState: definition.guidance.emptyState ?? null,

package/src/audit-preparation.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { modelSupports } from "../model/index.js";
 import { applicabilityReviewIsCurrent } from "./applicability-scope.js";
+import { selectDefaultAudit } from "./audit-selection.js";
 import { openPlaceholderCount, substantiveMarkdown } from "./content-readiness.js";
 import {
   coverageContains,
@@ -63,20 +64,21 @@ export async function assessAuditPreparation(input, options = {}) {
   const records = loaded.resources;
   const byId = new Map(records.map((record) => [record.id, record]));
   const audits = records.filter((record) => record.type === "audit");
+  const calendarAsOf = options.asOf || currentCalendarDate(loaded.workspace?.timezone || "UTC");
   const audit = options.auditId
     ? audits.find((record) => record.id === options.auditId)
     : options.selectDefault === false
       ? null
-      : audits.find((record) => !["complete", "closed", "canceled"].includes(record.status)) || audits[0];
+      : selectDefaultAudit(audits, calendarAsOf);
   if (options.auditId && !audit) throw new Error(`Audit "${options.auditId}" was not found.`);
 
-  const calendarAsOf = options.asOf || currentCalendarDate(loaded.workspace?.timezone || "UTC");
   const formalPeriodEnd = audit?.auditKind === "soc-2-type-2" ? coverageEnd(audit.coverage) : null;
   const readinessAsOf = formalPeriodEnd && formalPeriodEnd < calendarAsOf ? formalPeriodEnd : calendarAsOf;
   const programReadiness = options.programReadiness || await assessProgramReadiness(loaded, {
     asOf: readinessAsOf,
     generatedAt: options.generatedAt,
-    programId: audit?.programId || options.programId
+    programId: audit?.programId || options.programId,
+    auditId: audit?.id
   });
   const documentActivations = audit && modelSupports(loaded.model, "governed-document-activation")
     ? await auditDocumentActivationAssessments(loaded, audit, byId, calendarAsOf)
@@ -746,6 +748,12 @@ function canonicalScopeValue(value) {
 function programFoundationStage(programReadiness, workspace, audit) {
   const needsOperatingPeriod = audit?.auditKind === "soc-2-type-2";
   const ready = needsOperatingPeriod ? programReadiness.operating : programReadiness.evidenceReady;
+  const setupRemaining = programReadiness.setupProgress?.remaining
+    ?? (programReadiness.progress?.mode === "setup-progress" ? programReadiness.progress.remaining : 0);
+  const activeWindow = programReadiness.progress?.mode === "operating-window";
+  const activeWindowLabel = programReadiness.progress?.source === "audit"
+    ? "audit window"
+    : "candidate operating period";
   return stage("program", "Program Readiness", "The management program can be prepared and operated without an audit record or CPA firm.", [
     item(
       "evidence-ready",
@@ -755,9 +763,13 @@ function programFoundationStage(programReadiness, workspace, audit) {
         ? needsOperatingPeriod
           ? `${programReadiness.target.label} is operating for the selected engagement.`
           : `${programReadiness.target.label} is evidence-ready.`
+        : needsOperatingPeriod && activeWindow
+          ? setupRemaining
+            ? `The ${activeWindowLabel} is active, but ${setupRemaining} required setup ${setupRemaining === 1 ? "action remains" : "actions remain"} across scope, policies, controls, and evidence preparation.`
+            : `The ${activeWindowLabel} is active, but current operating work needs attention before treating the engagement as management-ready.`
         : needsOperatingPeriod && programReadiness.evidenceReady
           ? "Start the candidate period and finish the current operating-readiness work before treating a Type 2 engagement as management-ready."
-          : `${programReadiness.counts.action} program-readiness actions remain across scope, policies, controls, and evidence preparation.`,
+          : `${setupRemaining} required setup ${setupRemaining === 1 ? "action remains" : "actions remain"} across scope, policies, controls, and evidence preparation.`,
       workspace || { type: "workspace" }
     )
   ]);

package/src/audit-selection.js

@@ -0,0 +1,33 @@
+export function selectDefaultAudit(audits = [], asOf = "") {
+  const terminal = new Set(["complete", "closed", "canceled", "delivered"]);
+  const coverageStart = (audit) => audit?.coverage?.startsOn
+    || audit?.coverage?.periodStart
+    || audit?.coverage?.on
+    || "";
+  const statusOrder = new Map([
+    ["planned", 0],
+    ["in-progress", 1],
+    ["fieldwork", 2],
+    ["report-draft", 3],
+    ["issued", 4],
+    ["delivered", 5],
+    ["complete", 6]
+  ]);
+  const open = audits.filter((audit) => !terminal.has(audit.status));
+  const candidates = [...(open.length ? open : audits)];
+  candidates.sort((left, right) => {
+    const leftStart = coverageStart(left);
+    const rightStart = coverageStart(right);
+    const leftStarted = Boolean(leftStart && (!asOf || leftStart <= asOf));
+    const rightStarted = Boolean(rightStart && (!asOf || rightStart <= asOf));
+    return Number(rightStarted) - Number(leftStarted)
+      || (leftStarted && rightStarted
+        ? rightStart.localeCompare(leftStart)
+        : leftStart && rightStart
+          ? leftStart.localeCompare(rightStart)
+          : Number(Boolean(rightStart)) - Number(Boolean(leftStart)))
+      || (statusOrder.get(right.status) ?? -1) - (statusOrder.get(left.status) ?? -1)
+      || String(left.id || "").localeCompare(String(right.id || ""));
+  });
+  return candidates[0] || null;
+}

package/src/cli.js

@@ -447,16 +447,17 @@ export async function runCli(argv = process.argv.slice(2)) {
     const loaded = await loadWorkspace(root);
     const result = await assessProgramReadiness(loaded, { asOf: flags["as-of"], programId: flags.program });
     const output = flags.summary ? summarizeProgramReadiness(result) : result;
+    const headlineStatus = result.progress.status || result.status;
     if (flags.json) console.log(JSON.stringify(output, null, 2));
     else if (flags.summary) {
-      console.log(`${result.status.toUpperCase()}: ${result.progress.complete} of ${result.progress.total} program items complete`);
+      console.log(`${headlineStatus.toUpperCase()}: ${result.progress.label} ${result.progress.percent}%. ${result.progress.detail}`);
       for (const stage of output.stages) {
-        console.log(`${stage.status.toUpperCase()}\t${stage.title}\t${stage.counts.action} actions`);
+        console.log(`${stage.status.toUpperCase()}\t${stage.title}\t${stage.counts.action} checks need action`);
       }
       if (output.firstAction) console.log(`Next: ${output.firstAction.title}\t${output.firstAction.message}`);
     }
     else {
-      console.log(`${result.status.toUpperCase()}: ${result.progress.complete} of ${result.progress.total} program items complete`);
+      console.log(`${headlineStatus.toUpperCase()}: ${result.progress.label} ${result.progress.percent}%. ${result.progress.detail}`);
       console.log(
         `${result.target.label}`
         + (result.target.candidateCoverage?.kind === "range"
@@ -2036,6 +2037,8 @@ function summarizeProgramReadiness(result) {
     suggestedCandidatePeriodStart: result.suggestedCandidatePeriodStart,
     target: result.target,
     progress: result.progress,
+    setupProgress: result.setupProgress,
+    checkProgress: result.checkProgress,
     counts: result.counts,
     scopeCounts: Object.fromEntries(
       Object.entries(result.scope).map(([name, ids]) => [name.replace(/Ids$/, ""), ids.length])

package/src/collection-review.js

@@ -12,6 +12,7 @@ import { loadWorkspace } from "./workspace.js";
 import { resolveProgram } from "./program.js";
 import { currentCalendarDate } from "./time.js";
 import { currentPartyPeople } from "./parties.js";
+import { retentionScheduleApprovalIssues } from "./retention-schedule-approval.js";
 
 export { collectionRevision };
 
@@ -66,7 +67,14 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
   );
   const reviewerEligibility = resourceType === "control"
     ? assessControlReviewers(loaded, records)
-    : null;
+    : resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")
+      ? assessRetentionScheduleReviewers(loaded, records)
+      : null;
+  const approvalIssues = resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")
+    ? retentionScheduleApprovalIssues(loaded, program, records, {
+        informationTypesReviewed: assessCollectionReview(loaded, "information-type", options).complete
+      })
+    : [];
   const reviewersEligible = !reviewerEligibility || Boolean(
     review?.reviewedByIds?.length
     && review.reviewedByIds.every((id) => reviewerEligibility.eligibleReviewerIds.includes(id))
@@ -77,6 +85,7 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
     && revisionMatches
     && temporalReview
     && reviewersEligible
+    && !approvalIssues.length
   );
   const stale = Boolean(
     review?.status === "active"
@@ -96,10 +105,15 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
     status: complete ? "current" : stale ? "stale" : "review-required",
     complete,
     ...(reviewerEligibility || {}),
+    ...(approvalIssues.length ? { approvalIssues } : {}),
     message: complete
       ? `${configuration.title} were reviewed on ${review.reviewedOn}.`
+      : approvalIssues.length
+        ? approvalIssues[0].message
       : revisionMatches && review?.status === "active" && !reviewersEligible
-        ? "Review the Control collection again with a reviewer who does not own an included Control or its enabled Obligation."
+        ? resourceType === "retention-schedule-item"
+          ? "Review the Data Retention Schedule again with a reviewer who does not own its governing document or an included schedule row."
+          : "Review the Control collection again with a reviewer who does not own an included Control or its enabled Obligation."
       : stale
         ? `${configuration.title} changed after the last confirmation. Review the current records again.`
         : !records.length && !allowsEmptyCollection
@@ -143,6 +157,9 @@ export async function scaffoldCollectionReview(input = process.cwd(), options =
     reviewedOn: priorReview?.reviewedOn
       ? currentCalendarDate(loaded.workspace.timezone, now)
       : null,
+    ...(resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")
+      ? { expectedCollectionRevision: assessment.collectionRevision }
+      : {}),
     ...(v4
       ? { authoritativeComponentId: preservedAuthoritativeSourceId }
       : { authoritativeSystemId: preservedAuthoritativeSourceId })
@@ -154,7 +171,14 @@ export async function planCollectionReview(input = process.cwd(), options = {})
   const program = resolveProgram(loaded, options.programId);
   const resourceType = requiredType(loaded, options.resourceType);
   const assessment = assessCollectionReview(loaded, resourceType, { programId: program.id });
+  if (options.expectedCollectionRevision && options.expectedCollectionRevision !== assessment.collectionRevision) {
+    throw new Error(`${assessment.configuration.title} changed after it was displayed. Reload and review the current revision before approving it.`);
+  }
+  if (resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval") && !options.expectedCollectionRevision) {
+    throw new Error("Data Retention Schedule approval requires the displayed collection revision. Reload or scaffold the current review before approving it.");
+  }
   await requireControlReviewReady(loaded, resourceType, program.id);
+  await requireRetentionScheduleReady(loaded, resourceType, program);
   const configuration = assessment.configuration;
   const decision = String(options.decision || "").trim();
   const rationale = String(options.rationale || "").trim();
@@ -199,6 +223,13 @@ export async function planCollectionReview(input = process.cwd(), options = {})
       throw new Error(`Control collection review needs a reviewer who does not own an included Control or its enabled Obligation: ${conflicts.join(", ")}.`);
     }
   }
+  if (resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")) {
+    const eligible = new Set(assessment.eligibleReviewerIds || []);
+    const conflicts = reviewedByIds.filter((id) => !eligible.has(id));
+    if (conflicts.length) {
+      throw new Error(`Data Retention Schedule approval needs a reviewer who does not own its governing document or an included schedule row: ${conflicts.join(", ")}.`);
+    }
+  }
   if (temporalReviews) {
     if (reviewedOn !== today) {
       throw new Error("A current Collection Review must use today's workspace-local review date. Reconstruct an older population from Git history instead of backdating today's files.");
@@ -308,6 +339,15 @@ async function requireControlReviewReady(loaded, resourceType, programId) {
   }
 }
 
+async function requireRetentionScheduleReady(loaded, resourceType, program) {
+  if (resourceType !== "retention-schedule-item" || !modelSupports(loaded.model, "retention-schedule-approval")) return;
+  const rows = scopedCollectionRecords(loaded, resourceType, program);
+  const approvalIssues = retentionScheduleApprovalIssues(loaded, program, rows, {
+    informationTypesReviewed: assessCollectionReview(loaded, "information-type", { programId: program.id }).complete
+  });
+  if (approvalIssues.length) throw new Error(approvalIssues[0].message);
+}
+
 function assessControlReviewers(loaded, controls) {
   const byId = new Map(loaded.resources.map((record) => [record.id, record]));
   const controlIds = new Set(controls.map(({ id }) => id));
@@ -329,6 +369,25 @@ function assessControlReviewers(loaded, controls) {
   };
 }
 
+function assessRetentionScheduleReviewers(loaded, rows) {
+  const byId = new Map(loaded.resources.map((record) => [record.id, record]));
+  const conflictIds = new Set();
+  const schedules = loaded.resources.filter((record) => (
+    record.type === "document"
+    && record.documentKind === "schedule"
+    && record.workflowScope === "program"
+    && !["superseded", "retired"].includes(record.status)
+  ));
+  for (const record of [...schedules, ...rows]) {
+    for (const id of currentPartyPeople(record.ownerIds || [], byId)) conflictIds.add(id);
+  }
+  const people = loaded.resources.filter(({ type, status }) => type === "person" && status === "active");
+  return {
+    eligibleReviewerIds: people.map(({ id }) => id).filter((id) => !conflictIds.has(id)),
+    reviewerConflictIds: people.map(({ id }) => id).filter((id) => conflictIds.has(id))
+  };
+}
+
 function sameIds(left, right) {
   return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
 }

package/src/collection-revision.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { modelSupports } from "../model/index.js";
 import {
   authoritativeSourceRevisionValue,
   collectionRevisionInputs,
@@ -24,7 +25,8 @@ export function collectionRevisionMatches(loaded, resourceType, storedRevision,
   // Version 0.9.2 narrowed this hash basis. Keep unchanged 0.9.1 reviews valid
   // until management records a new review on the current basis.
   return storedRevision === currentRevision
-    || storedRevision === legacyCollectionRevision(loaded, resourceType, options);
+    || (resourceType !== "retention-schedule-item" || !modelSupports(loaded.model, "retention-schedule-approval"))
+      && storedRevision === legacyCollectionRevision(loaded, resourceType, options);
 }
 
 function calculateCollectionRevision(loaded, resourceType, options, legacy) {

package/src/collection-scope.js

@@ -1,12 +1,17 @@
 import { modelSupports } from "../model/index.js";
 import { programComponents, selectedRequirementIds } from "./program.js";
-import { retentionReviewResourceIds } from "./retention.js";
+import { retentionReviewResourceIds, retentionUses } from "./retention.js";
 import { documentIsAuditSpecific } from "./program-lifecycle.js";
 
 export function scopedCollectionRecords(loaded, resourceType, program) {
   if (!modelSupports(loaded.model, "program-scope")) {
     return loaded.resources.filter((record) => record.type === resourceType);
   }
+  if (resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")) {
+    return loaded.resources.filter((record) => (
+      record.type === resourceType && !["retired", "superseded"].includes(record.status)
+    ));
+  }
   if (resourceType === "person") {
     return scopedProgramPeople(loaded, program);
   }
@@ -225,6 +230,29 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
       .filter((record) => record.type === "vendor" && record.status !== "retired")
       .map(({ id }) => id));
   }
+  if (resourceType === "retention-schedule-item" && !legacy && modelSupports(loaded.model, "retention-schedule-approval")) {
+    const uses = retentionUses(loaded, program || {});
+    addIds(uses.map(({ resource }) => resource.id));
+    addIds(uses.map(({ informationTypeId }) => informationTypeId));
+    const schedules = loaded.resources
+      .filter((record) => (
+        record.type === "document"
+        && record.documentKind === "schedule"
+        && record.workflowScope === "program"
+        && !["superseded", "retired"].includes(record.status)
+      ))
+    addIds(schedules.map(({ id }) => id));
+    for (const schedule of schedules) {
+      addPartyIds([...(schedule.ownerIds || []), ...(schedule.approverIds || [])]);
+    }
+    for (const record of reviewed) {
+      addIds([record.scheduleDocumentId]);
+      addIds(record.informationTypeIds);
+      addIds(record.scopeResourceIds);
+      addIds(record.sourceResourceIds);
+      addPartyIds([...(record.ownerIds || []), ...(record.approvedByIds || [])]);
+    }
+  }
   if (resourceType === "complementary-control") {
     addIds(program?.systemIds);
     addIds(program?.controlIds);
@@ -351,6 +379,21 @@ const dependencyFields = {
     component: ["id", "type", "status", "systemUses", "informationUses"],
     vendor: ["id", "type", "status", "informationTypeIds"]
   },
+  "retention-schedule-item": {
+    document: ["id", "type", "documentKind", "workflowScope", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "controlIds"],
+    policy: ["id", "type", "status", "programRole", "ownerIds", "approverIds", "approvedOn", "approvedContentRevisions", "controlIds"],
+    requirement: ["id", "type", "title", "frameworkId", "reference", "description"],
+    commitment: ["id", "type", "status", "commitmentKind", "statement", "effectiveOn"],
+    control: ["id", "type", "status", "statement", "systemIds", "componentIds"],
+    "information-type": ["id", "type", "status", "classificationId", "description"],
+    system: ["id", "type", "status", "informationTypeIds"],
+    component: ["id", "type", "status", "systemUses", "informationUses"],
+    vendor: ["id", "type", "status", "informationTypeIds"],
+    "source-coverage": ["id", "type", "status", "sourceFamilyId", "coverageKind", "scopeResourceIds", "retentionScheduleItemIds", "componentId"],
+    person: ["id", "type", "status", "affiliation", "jobTitle"],
+    team: ["id", "type", "status", "memberIds", "chairIds"],
+    appointment: ["id", "type", "status", "appointmentKind", "scopeResourceIds", "holderId", "startsOn", "endsOn"]
+  },
   "complementary-control": {
     system: ["id", "type", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
     control: ["id", "type", "status", "statement", "activity", "systemIds", "componentIds", "evidenceSourceComponentIds"],
@@ -382,6 +425,7 @@ const dependencyContentTypes = {
   vendor: new Set(["document"]),
   component: new Set(["system"]),
   control: new Set(["system", "component", "obligation", "source-coverage", "evidence", "retention-schedule-item", "document", "policy", "training"]),
+  "retention-schedule-item": new Set(["document", "policy"]),
   "complementary-control": new Set(["system", "control", "document", "component"])
 };
 

package/src/index.js

@@ -86,7 +86,7 @@ export {
   scaffoldExternalReviewerGovernance,
   setupExternalReviewerGovernance
 } from "./external-reviewer.js";
-export { assessEvidenceMap, assessProgramReadiness } from "./program-readiness.js";
+export { assessEvidenceMap, assessProgramReadiness, calculateProgramProgress } from "./program-readiness.js";
 export {
   approveReportingRouteSet,
   assessReportingRoutePeriod,

package/src/program-path.js

@@ -1,3 +1,5 @@
+import { ACTIVE_MODEL_VERSION, modelSupports } from "../model/index.js";
+
 export const RESOURCE_INSTRUCTIONS = {
   program: "Define one management compliance or assurance Program with its goal, bounded Systems, selected Frameworks, Requirement applicability decisions, Controls, owners, risk method, and candidate period.",
   person: "Record each person’s actual organizational job title. Keep named program authority, such as CISO, DPO, Policy Owner, or team chair, in dated Appointment records.",
@@ -105,13 +107,14 @@ export const PROGRAM_PATH = [
     id: "policies",
     number: 2,
     title: "Approve Policies",
-    description: "Review governed content and approvals",
-    summary: "Review and independently approve Policies, program Documents, and Training content.",
+    description: "Approve governed content and retention decisions",
+    summary: "Review and independently approve Policies, program Documents, Training content, and the Data Retention Schedule.",
     sections: [
-      { id: "policy-content", title: "Policies", description: "Review every program Policy, Document, and Training record in one table, then bind independent approval to each exact revision.", steps: ["Review each governed Markdown artifact and replace every organization placeholder.", "Confirm the owner, separate approver, linked Controls, audience, and intended values that apply to each artifact.", "Record approval and its date against the exact revision. Leave approved content inactive until its Step 3 implementation cutover."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/stage/policies" }], defaultOpen: true }
+      { id: "policy-content", title: "Policies", description: "Review every program Policy, Document, and Training record in one table, then bind independent approval to each exact revision.", steps: ["Review each governed Markdown artifact and replace every organization placeholder.", "Confirm the owner, separate approver, linked Controls, audience, and intended values that apply to each artifact.", "Record approval and its date against the exact revision. Leave approved content inactive until its Step 3 implementation cutover."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/policies" }], defaultOpen: true },
+      { id: "retention", title: "Data Retention Schedule", description: "Approve the schedule document and its structured rows as one governed schedule.", steps: ["Review the schedule policy, legal holds, exceptions, and disposal requirements.", "Define rows only for Information Types and operational sources the organization actually uses.", "Confirm the complete document-and-row revision with one schedule review."], types: [], utility: "retention-schedule", defaultOpen: true }
     ],
     resourceTypes: [],
-    supportingResourceTypes: ["policy", "document", "training"],
+    supportingResourceTypes: ["policy", "document", "training", "retention-schedule-item"],
     commands: [
       "filegrc guide policy --json",
       "filegrc guide document --json",
@@ -119,30 +122,29 @@ export const PROGRAM_PATH = [
       "filegrc list policy --json",
       "filegrc list document --json",
       "filegrc list training --json",
-      "filegrc get POLICY_ID --mutation"
+      "filegrc get POLICY_ID --mutation",
+      "filegrc guide retention-schedule-item --json",
+      "filegrc review-collection retention-schedule-item --scaffold"
     ]
   },
   {
     id: "controls",
     number: 3,
     title: "Implement Controls",
-    description: "Finish controls and their evidence sources",
-    summary: "Describe each Control and connect its evidence source.",
+    description: "Implement and prepare to operate",
+    summary: "Implement Controls, configure their operating schedules and evidence sources, then activate the approved program.",
     sections: [
       { id: "controls", title: "Controls", description: "Implement the selected Controls and connect their scope, procedures, mappings, and operation patterns.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components."], types: ["control"], defaultOpen: true },
       { id: "complementary-controls", title: "Complementary Controls", description: "Record customer or provider responsibilities that form part of the implementation boundary, or confirm there are none.", steps: ["Review whether an in-scope Control depends on a customer or carved-out provider action."], types: ["complementary-control"], defaultOpen: true },
       { id: "evidence-sources", title: "Evidence Sources", description: "Check that every Control points to an authoritative source that can produce its expected evidence.", steps: ["Confirm each source Component is active, has the right evidence-source role, names current access owners, and includes repeatable retrieval instructions."], types: [], utility: "evidence-sources", defaultOpen: true },
-      { id: "retention", title: "Retention Schedule", description: "Review each retention rule against current information uses and approved sources.", steps: ["Confirm scope, cutoff, period, disposition, sources, owner, and approval for each rule."], types: ["retention-schedule-item"], defaultOpen: true },
       { id: "obligations", title: "Obligations", description: "Configure the calendar and event schedules that operate the Controls.", steps: ["Review and enable every required calendar and event schedule."], types: ["obligation"], defaultOpen: true }
     ],
-    resourceTypes: ["control", "complementary-control", "retention-schedule-item", "obligation"],
+    resourceTypes: ["control", "complementary-control", "obligation"],
     commands: [
       "filegrc guide control --json",
       "filegrc list control --json",
       "filegrc get CONTROL_ID --mutation",
       "filegrc guide obligation --json",
-      "filegrc guide retention-schedule-item --json",
-      "filegrc review-collection retention-schedule-item --scaffold",
       "filegrc list obligation --json",
       "filegrc review-collection component --scaffold",
       "filegrc review-collection complementary-control --scaffold",
@@ -264,8 +266,51 @@ export const PROGRAM_PATH = [
   }
 ];
 
-export function buildAgentProgramPath(model) {
+export function programPathForModel(model = ACTIVE_MODEL_VERSION) {
+  if (modelSupports(model, "retention-schedule-approval")) return PROGRAM_PATH;
   return PROGRAM_PATH.map((stage) => {
+    if (stage.id === "policies") {
+      return {
+        ...stage,
+        description: "Review governed content and approvals",
+        summary: "Review and independently approve Policies, program Documents, and Training content.",
+        sections: [{
+          ...stage.sections[0],
+          relatedLinks: [{ type: "policy", label: "Policies", href: "#/stage/policies" }]
+        }],
+        supportingResourceTypes: stage.supportingResourceTypes.filter((type) => type !== "retention-schedule-item"),
+        commands: stage.commands.filter((command) => !command.includes("retention-schedule-item"))
+      };
+    }
+    if (stage.id === "controls") {
+      const retention = {
+        id: "retention",
+        title: "Retention Schedule",
+        description: "Review each retention rule against current information uses and approved sources.",
+        steps: ["Confirm scope, cutoff, period, disposition, sources, owner, and approval for each rule."],
+        types: ["retention-schedule-item"],
+        defaultOpen: true
+      };
+      return {
+        ...stage,
+        description: "Finish controls and their evidence sources",
+        summary: "Describe each Control and connect its evidence source.",
+        sections: [...stage.sections.slice(0, 3), retention, ...stage.sections.slice(3)],
+        resourceTypes: [...stage.resourceTypes.slice(0, 2), "retention-schedule-item", ...stage.resourceTypes.slice(2)],
+        commands: [
+          ...stage.commands.slice(0, 5),
+          "filegrc guide retention-schedule-item --json",
+          "filegrc review-collection retention-schedule-item --scaffold",
+          ...stage.commands.slice(5)
+        ]
+      };
+    }
+    return stage;
+  });
+}
+
+export function buildAgentProgramPath(model) {
+  return programPathForModel(model).map((stage) => {
     const programResourceTypes = [...stage.resourceTypes, ...(stage.supportingResourceTypes || [])]
       .filter((type) => model.resources[type]);
     const resourcePages = programResourceTypes.map((type, index) => {
@@ -305,8 +350,8 @@ function agentCommand(command) {
   return command.startsWith("filegrc ") ? `npx ${command}` : command;
 }
 
-export function resourceProgramContext(type) {
-  const stage = PROGRAM_PATH.find((candidate) => (
+export function resourceProgramContext(type, model) {
+  const stage = programPathForModel(model).find((candidate) => (
     candidate.resourceTypes.includes(type) || (candidate.supportingResourceTypes || []).includes(type)
   ));
   if (!stage) return null;