filegrc 0.14.0 → 0.15.1

package/src/program-readiness.js

@@ -32,6 +32,94 @@ import { assessSourceCoverageReadiness } from "./source-coverage.js";
 import { currentCalendarDate, timestampFromLocalDateTime } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
 
+export function calculateProgramProgress({
+  stages = [],
+  target = {},
+  evidenceReady = false,
+  operating = false,
+  asOf,
+  window = null
+} = {}) {
+  const typeTwo = target.goal === "soc-2-type-2";
+  const trackedWindow = normalizeProgressWindow(window || target.candidateCoverage, window ? "audit" : "candidate");
+  const windowStarted = Boolean(
+    typeTwo
+    && trackedWindow
+    && asOf
+    && trackedWindow.start <= asOf
+  );
+  const setupProgress = calculateSetupActionProgress(stages, target, Boolean(trackedWindow));
+  if (windowStarted) {
+    const totalDays = calendarDayDistance(trackedWindow.start, trackedWindow.end) + 1;
+    const elapsedDays = Math.min(
+      totalDays,
+      Math.max(0, calendarDayDistance(trackedWindow.start, asOf) + 1)
+    );
+    const percent = totalDays ? Math.round((elapsedDays / totalDays) * 100) : 0;
+    const complete = elapsedDays >= totalDays;
+    const healthy = Boolean(operating);
+    return {
+      mode: "operating-window",
+      label: trackedWindow.source === "audit" ? "Audit window" : "Operating window",
+      status: healthy ? complete ? "Window complete" : "Operating" : "Needs attention",
+      complete: elapsedDays,
+      total: totalDays,
+      remaining: Math.max(0, totalDays - elapsedDays),
+      percent,
+      unit: "day",
+      start: trackedWindow.start,
+      end: trackedWindow.end,
+      source: trackedWindow.source,
+      detail: complete
+        ? `${totalDays} of ${totalDays} days elapsed.`
+        : `Day ${elapsedDays} of ${totalDays}; ${Math.max(0, totalDays - elapsedDays)} days remain.`,
+      operating
+    };
+  }
+
+  return {
+    mode: "setup-progress",
+    label: "Program setup",
+    status: !setupProgress.remaining
+      ? evidenceReady && typeTwo && trackedWindow?.start > asOf
+        ? "Scheduled"
+        : evidenceReady ? "Evidence ready" : "Ready"
+      : evidenceReady && typeTwo ? "Ready to start" : "Needs work",
+    ...setupProgress,
+    unit: "action",
+    detail: setupProgress.remaining
+      ? `${setupProgress.complete} of ${setupProgress.total} required actions complete.`
+      : `All ${setupProgress.total} required actions are complete.`,
+    operating
+  };
+}
+
+function calculateSetupActionProgress(stages, target, windowMilestoneComplete) {
+  const units = new Map();
+  for (const currentStage of stages.filter(({ id }) => id !== "operation")) {
+    for (const current of currentStage.items || []) {
+      if (["info", "later"].includes(current.status) || current.progressUnit === false) continue;
+      const key = `${currentStage.id}:${current.progressUnitId || current.id}`;
+      const existing = units.get(key);
+      if (!existing || existing.status === "complete" && current.status !== "complete") {
+        units.set(key, current);
+      }
+    }
+  }
+
+  const setupUnits = [...units.values()];
+  const complete = setupUnits.filter(({ status }) => status === "complete").length;
+  const total = setupUnits.length + (target.goal === "soc-2-type-2" ? 1 : 0);
+  const completed = complete + (windowMilestoneComplete ? 1 : 0);
+  const remaining = Math.max(0, total - completed);
+  return {
+    complete: completed,
+    total,
+    remaining,
+    percent: total ? Math.round((completed / total) * 100) : 0
+  };
+}
+
 export async function assessProgramReadiness(input, options = {}) {
   const loaded = input?.resources && input?.model && input?.entries
     ? input
@@ -41,6 +129,15 @@ export async function assessProgramReadiness(input, options = {}) {
   const workspace = loaded.workspace || records.find((record) => record.type === "workspace");
   const program = resolveProgram(loaded, options.programId);
   const asOf = options.asOf || currentCalendarDate(workspace?.timezone || "UTC");
+  const requestedAudit = options.auditId
+    ? records.find((record) => record.type === "audit" && record.id === options.auditId)
+    : null;
+  const auditWindow = requestedAudit?.auditKind === "soc-2-type-2"
+    ? requestedAudit.coverage
+    : selectedAuditWindow(records, program, asOf);
+  const progressWindow = requestedAudit?.auditKind === "soc-2-type-2"
+    ? normalizeProgressWindow(auditWindow, "audit")
+    : selectedProgressWindow(program?.candidateCoverage, auditWindow, asOf);
   const scope = programScope(program, records, byId, loaded.model, loaded);
   const collectionReviews = assessCollectionReviews(loaded, { programId: program.id });
   const markdown = new Map();
@@ -57,12 +154,19 @@ export async function assessProgramReadiness(input, options = {}) {
     .map(collectionReviewReadinessItem));
   const sourceStage = await evidenceSourcesStage(scope, byId, loaded.model, readMarkdown);
   controlStage.items.push(...sourceStage.items);
-  controlStage.items.push(...await assessRetentionReadiness(loaded, program, {
+  const retentionItems = await assessRetentionReadiness(loaded, program, {
     informationTypesReviewed: collectionReviews.find(({ resourceType }) => resourceType === "information-type")?.complete === true
-  }));
-  controlStage.items.push(...collectionReviews
+  });
+  const retentionReviewItems = collectionReviews
     .filter(({ resourceType }) => resourceType === "retention-schedule-item")
-    .map(collectionReviewReadinessItem));
+    .map(collectionReviewReadinessItem);
+  if (modelSupports(loaded.model, "retention-schedule-approval")) {
+    policyStage.items.push(...retentionItems.filter(({ id }) => !id.startsWith("retention-source-coverage-")));
+    controlStage.items.push(...retentionItems.filter(({ id }) => id.startsWith("retention-source-coverage-")));
+    policyStage.items.push(...retentionReviewItems);
+  } else {
+    controlStage.items.push(...retentionItems, ...retentionReviewItems);
+  }
   const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model);
   const policyActivations = await assessPolicyActivations(
     requiredPolicies(scope, byId),
@@ -116,26 +220,54 @@ export async function assessProgramReadiness(input, options = {}) {
   const evidenceReady = evidenceGateStages.every((current) => current.counts.action === 0);
   const stages = [
     ...evidenceGateStages,
-    await operationStage(loaded, program, scope, records, byId, asOf, evidenceReady, loaded.model)
+    await operationStage(loaded, program, scope, records, byId, asOf, evidenceReady, loaded.model, progressWindow)
   ];
   finalizeStage(stages.at(-1));
-  const candidateStarted = Boolean(
+  const periodStarted = Boolean(
     program?.assuranceGoal === "soc-2-type-2"
-    && program.candidateCoverage?.kind === "range"
-    && coverageStart(program.candidateCoverage) <= asOf
+    && progressWindow?.start <= asOf
   );
   const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, model: loaded.model });
   const policyLibrary = await assessPolicyLibraryUpgrades(loaded);
-  const operating = evidenceReady && candidateStarted && stages.at(-1).counts.action === 0;
+  const operating = Boolean(
+    evidenceReady
+    && periodStarted
+    && stages.at(-1).counts.action === 0
+  );
   const canStartCandidatePeriod = Boolean(
     evidenceReady
     && program?.assuranceGoal === "soc-2-type-2"
     && !program.candidateCoverage
+    && !periodStarted
   );
   const items = stages.flatMap((current) => current.items);
   const managedItems = items.filter((current) => !["info", "later"].includes(current.status));
   const complete = managedItems.filter((current) => current.status === "complete").length;
   const firstAction = items.find((current) => current.status === "action") || null;
+  const target = {
+    programId: program?.id || null,
+    goal: program?.assuranceGoal || "none",
+    label: assuranceGoalLabel(program?.assuranceGoal),
+    candidateCoverage: program?.candidateCoverage || null
+  };
+  const checkProgress = {
+    complete,
+    total: managedItems.length,
+    percent: managedItems.length ? Math.round((complete / managedItems.length) * 100) : 0
+  };
+  const progress = calculateProgramProgress({
+    stages,
+    target,
+    evidenceReady,
+    operating,
+    asOf,
+    window: progressWindow
+  });
+  const setupProgress = calculateSetupActionProgress(
+    stages,
+    target,
+    Boolean(progressWindow)
+  );
 
   return {
     program,
@@ -143,12 +275,7 @@ export async function assessProgramReadiness(input, options = {}) {
     dataModelVersion: String(loaded.model.modelVersion),
     generatedAt: options.generatedAt || new Date().toISOString(),
     asOf,
-    target: {
-      programId: program?.id || null,
-      goal: program?.assuranceGoal || "none",
-      label: assuranceGoalLabel(program?.assuranceGoal),
-      candidateCoverage: program?.candidateCoverage || null
-    },
+    target,
     status: operating ? "operating" : evidenceReady ? "evidence-ready" : "needs-work",
     evidenceReady,
     operating,
@@ -161,11 +288,9 @@ export async function assessProgramReadiness(input, options = {}) {
       ...policyLibrary.proposals,
       ...legacyPolicyLibraryProposals(records)
     ],
-    progress: {
-      complete,
-      total: managedItems.length,
-      percent: managedItems.length ? Math.round((complete / managedItems.length) * 100) : 0
-    },
+    progress,
+    setupProgress,
+    checkProgress,
     counts: countStatuses(items),
     firstAction,
     scope: {
@@ -717,6 +842,7 @@ async function policiesStage(scope, records, byId, readMarkdown, model) {
           : "Appoint a reviewer who is separate from the policy owner. The reviewer may be another person in the organization or an external person, and is separate from the CPA firm that may later perform the audit.",
       appointedReviewer || (reviewerNeedsAssignment ? governedRecords[0] : { type: "person" }),
       {
+        progressUnit: false,
         commands: [
           "npx filegrc list appointment --workflow --json",
           "npx filegrc guide appointment --json",
@@ -900,6 +1026,11 @@ function requiredGovernedDocuments(scope, records, byId, model) {
     && (
       linkedDocumentIds.has(record.id)
       || obligationDocumentIds.has(record.id)
+      || (
+        modelSupports(model, "retention-schedule-approval")
+        && record.documentKind === "schedule"
+        && record.workflowScope === "program"
+      )
       || (
         record.programRole === "required"
         && (record.controlIds || []).some((id) => selectedControlIds.has(id))
@@ -1456,7 +1587,7 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
   return stage("sources", "Control Evidence Sources", `Complete the authoritative ${modelSupports(model, "component-sources") ? "Components" : "Systems"} for every selected control family before marking the Controls implemented.`, items);
 }
 
-async function operationStage(loaded, workspace, scope, records, byId, asOf, evidenceReady, model) {
+async function operationStage(loaded, workspace, scope, records, byId, asOf, evidenceReady, model, progressWindow = null) {
   const goal = workspace?.assuranceGoal || "none";
   if (!evidenceReady) {
     return stage("operation", "Operate the Program", "Run the controls and preserve dated evidence after the Evidence Ready gate passes.", [
@@ -1488,12 +1619,9 @@ async function operationStage(loaded, workspace, scope, records, byId, asOf, evi
   }
 
   const obligations = planObligations(records, { programId: workspace.id, asOf, through: asOf, model });
-  const start = workspace.candidateCoverage?.kind === "range"
-    ? coverageStart(workspace.candidateCoverage)
-    : null;
-  const end = workspace.candidateCoverage?.kind === "range"
-    ? coverageEnd(workspace.candidateCoverage)
-    : null;
+  const start = progressWindow?.start || null;
+  const end = progressWindow?.end || null;
+  const formalWindow = progressWindow?.source === "audit";
   const startStatus = !start ? "action" : start <= asOf ? "complete" : "later";
   const sourceCoverage = await assessSourceCoverageReadiness(loaded, scope.controls.map(({ id }) => id), workspace);
   const incompleteSourceCoverage = sourceCoverage.filter(({ complete }) => !complete);
@@ -1505,16 +1633,20 @@ async function operationStage(loaded, workspace, scope, records, byId, asOf, evi
       !start
         ? "Set the management candidate period start when the Evidence Ready gate passes. Do not backdate it."
         : start <= asOf
-          ? `Management began the candidate Type 2 evidence period on ${start}. This is not the auditor-agreed report period.`
+          ? formalWindow
+            ? `The auditor-agreed Type 2 period began on ${start}. Keep evidence collection and operating work current through the period.`
+            : `Management began the candidate Type 2 evidence period on ${start}. This is not the auditor-agreed report period.`
           : `Evidence collection is scheduled to begin on ${start}.`,
       workspace
     ),
     item(
       "candidate-period-end",
       end ? "complete" : start ? "later" : "info",
-      "Plan the candidate period end",
+      formalWindow ? "Confirm the auditor-agreed period end" : "Plan the candidate period end",
       end
-        ? `Management candidate period: ${start || "start not set"} through ${end}. The CPA firm may agree to different dates.`
+        ? formalWindow
+          ? `Auditor-agreed period: ${start || "start not set"} through ${end}.`
+          : `Management candidate period: ${start || "start not set"} through ${end}. The CPA firm may agree to different dates.`
         : "Add the management target end when useful. Starting reliable evidence collection is the immediate milestone.",
       workspace
     ),
@@ -1772,6 +1904,61 @@ function countStatuses(items) {
   return counts;
 }
 
+export function selectedAuditWindow(records, program, asOf) {
+  if (program?.assuranceGoal !== "soc-2-type-2") return null;
+  const candidates = records.filter((record) => (
+    record.type === "audit"
+    && record.auditKind === "soc-2-type-2"
+    && (!record.programId || record.programId === program.id)
+    && !["canceled", "closed", "complete", "delivered"].includes(record.status)
+    && normalizeProgressWindow(record.coverage)
+    && coverageStart(record.coverage) <= asOf
+  ));
+  const statusOrder = new Map([
+    ["planned", 0],
+    ["in-progress", 1],
+    ["fieldwork", 2],
+    ["report-draft", 3],
+    ["issued", 4]
+  ]);
+  candidates.sort((left, right) => (
+    coverageStart(right.coverage).localeCompare(coverageStart(left.coverage))
+    || (statusOrder.get(right.status) ?? -1) - (statusOrder.get(left.status) ?? -1)
+    || coverageEnd(right.coverage).localeCompare(coverageEnd(left.coverage))
+    || left.id.localeCompare(right.id)
+  ));
+  return candidates[0]?.coverage || null;
+}
+
+export function selectedProgressWindow(candidateCoverage, auditCoverage, asOf) {
+  const candidates = [
+    normalizeProgressWindow(candidateCoverage, "candidate"),
+    normalizeProgressWindow(auditCoverage, "audit")
+  ].filter((window) => window && (!asOf || window.start <= asOf));
+  candidates.sort((left, right) => (
+    right.start.localeCompare(left.start)
+    || Number(right.source === "audit") - Number(left.source === "audit")
+    || right.end.localeCompare(left.end)
+  ));
+  if (candidates.length) return candidates[0];
+  return normalizeProgressWindow(candidateCoverage, "candidate")
+    || normalizeProgressWindow(auditCoverage, "audit");
+}
+
+function normalizeProgressWindow(coverage, source = "candidate") {
+  const start = coverage?.start || coverageStart(coverage);
+  const end = coverage?.end || coverageEnd(coverage);
+  if (!start || !end || end < start) return null;
+  return { start, end, source: coverage?.source || source };
+}
+
+function calendarDayDistance(start, end) {
+  const startTime = Date.parse(`${start}T00:00:00Z`);
+  const endTime = Date.parse(`${end}T00:00:00Z`);
+  if (!Number.isFinite(startTime) || !Number.isFinite(endTime)) return 0;
+  return Math.round((endTime - startTime) / 86_400_000);
+}
+
 function shiftYear(value, offset) {
   const date = new Date(`${value}T00:00:00Z`);
   date.setUTCFullYear(date.getUTCFullYear() + offset);

package/src/retention-schedule-approval.js

@@ -0,0 +1,121 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { openPlaceholderCount, substantiveMarkdown } from "./content-readiness.js";
+import { markdownEntries } from "./resource-markdown.js";
+import { resolveDataPath } from "./paths.js";
+import { currentPartyPeople, partiesIndependent } from "./parties.js";
+import {
+  nearDuplicateInformationTypes,
+  resourceReviewRevisionsSync,
+  retentionReviewResourceIds,
+  retentionRuleIsCurrent,
+  retentionUses
+} from "./retention.js";
+
+export function retentionScheduleApprovalIssues(loaded, program, rows, options = {}) {
+  const byId = new Map(loaded.resources.map((record) => [record.id, record]));
+  const issues = [];
+  const planned = rows.filter(({ status }) => status === "planned");
+  if (planned.length) {
+    issues.push(issue("planned-retention-schedule-row", `Complete or retire every planned retention row before approving the schedule revision: ${planned[0].title}.`));
+  }
+  const schedules = loaded.resources.filter((record) => (
+    record.type === "document"
+    && record.documentKind === "schedule"
+    && record.workflowScope === "program"
+    && !["superseded", "retired"].includes(record.status)
+  ));
+  if (!schedules.length) {
+    issues.push(issue("missing-retention-schedule-document", "Add and approve the Data Retention Schedule document before approving the schedule revision."));
+  }
+  if (schedules.length !== 1) {
+    if (schedules.length) {
+      issues.push(issue("multiple-retention-schedule-documents", "Keep exactly one current program Data Retention Schedule document before approving the schedule revision."));
+    }
+  }
+  const schedule = schedules.length === 1 ? schedules[0] : null;
+  const scheduleContent = schedule ? primaryMarkdown(loaded, schedule) : "";
+  const linkedControl = schedule && (schedule.controlIds || []).some((id) => (program.controlIds || []).includes(id));
+  if (
+    schedule
+    && (!["approved", "active"].includes(schedule.status)
+    || !schedule.approvedOn
+    || !schedule.approvedContentRevisions
+    || currentPartyPeople(schedule.ownerIds || [], byId).size === 0
+    || !partiesIndependent(schedule.ownerIds, schedule.approverIds, byId)
+    || !linkedControl
+    || !substantiveMarkdown(scheduleContent)
+    || openPlaceholderCount(scheduleContent) > 0
+    || !approvalBindingsMatch(loaded, schedule))
+  ) {
+    issues.push(issue("unapproved-retention-schedule-document", "Complete and independently approve the Data Retention Schedule document before approving the complete schedule."));
+  }
+  const activeRows = rows.filter(({ status }) => status === "active");
+  const mismatched = schedule
+    ? activeRows.filter(({ scheduleDocumentId }) => scheduleDocumentId !== schedule.id)
+    : [];
+  if (mismatched.length) {
+    issues.push(issue("retention-row-wrong-schedule-document", `Link every active retention row to the current Data Retention Schedule document before approval: ${mismatched[0].title}.`));
+  }
+  const revisions = resourceReviewRevisionsSync(
+    loaded,
+    activeRows.flatMap((row) => retentionReviewResourceIds(row, loaded))
+  );
+  const incomplete = activeRows.filter((row) => !retentionRuleIsCurrent(row, revisions, byId, loaded));
+  if (incomplete.length) {
+    issues.push(issue("incomplete-retention-schedule-row", `Complete the retention decisions before approving the schedule revision: ${incomplete[0].title}.`));
+  }
+  const usableRows = activeRows.filter((row) => !incomplete.includes(row));
+  const uncovered = retentionUses(loaded, program).find((use) => !usableRows.some((row) => (
+    (row.informationTypeIds || []).includes(use.informationTypeId)
+    && ((row.scopeResourceIds || []).includes(use.resource.id) || (row.scopeResourceIds || []).includes(program.id))
+  )));
+  if (uncovered) {
+    issues.push(issue(
+      "uncovered-retention-information-use",
+      `${uncovered.resource.title} uses ${byId.get(uncovered.informationTypeId)?.title || uncovered.informationTypeId}, but no active, current retention schedule row covers both the type and scope.`
+    ));
+  }
+  if (nearDuplicateInformationTypes(loaded.resources).length && !options.informationTypesReviewed) {
+    issues.push(issue("unreviewed-similar-information-types", "Review similar Information Types before approving the Data Retention Schedule."));
+  }
+  return issues;
+}
+
+function issue(code, message) {
+  return { code, message };
+}
+
+function primaryMarkdown(loaded, record) {
+  const definition = loaded.model.resources[record.type];
+  const selected = markdownEntries(loaded.model, record).find((entry) => (
+    definition.markdown?.[entry.name]?.primary || entry.name === loaded.model.recordContent?.slot
+  ));
+  if (!selected) return "";
+  try {
+    return readFileSync(resolveDataPath(loaded.root, selected.path), "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function approvalBindingsMatch(loaded, record) {
+  const actual = {};
+  for (const entry of markdownEntries(loaded.model, record)) {
+    try {
+      actual[entry.path] = createHash("sha256")
+        .update(readFileSync(resolveDataPath(loaded.root, entry.path), "utf8"))
+        .digest("hex");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  const expected = record.approvedContentRevisions || {};
+  const actualKeys = Object.keys(actual).sort();
+  const expectedKeys = Object.keys(expected).sort();
+  return actualKeys.length === expectedKeys.length
+    && actualKeys.every((key, index) => (
+      key === expectedKeys[index]
+      && actual[key] === expected[key]
+    ));
+}

package/src/retention.js

@@ -1,8 +1,10 @@
+import { readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { contentRevision } from "./files.js";
 import { resolveDataPath } from "./paths.js";
 import { programComponents } from "./program.js";
 import { markdownEntries } from "./resource-markdown.js";
+import { modelSupports } from "../model/index.js";
 
 export async function assessRetentionReadiness(loaded, program, options = {}) {
   if (!loaded.model.resources["retention-schedule-item"]) return [];
@@ -30,22 +32,42 @@ export async function assessRetentionReadiness(loaded, program, options = {}) {
       ]
     }
   ));
-  items.push(...uses.map((use) => {
-    const matches = usableRules.filter((rule) => ruleCoversUse(rule, use, program));
+  const usesByInformationType = new Map();
+  for (const use of uses) {
+    const grouped = usesByInformationType.get(use.informationTypeId) || [];
+    grouped.push(use);
+    usesByInformationType.set(use.informationTypeId, grouped);
+  }
+  items.push(...[...usesByInformationType].map(([informationTypeId, informationTypeUses]) => {
+    const uncoveredUses = informationTypeUses.filter((use) => (
+      !usableRules.some((rule) => ruleCoversUse(rule, use, program))
+    ));
+    const matches = usableRules.filter((rule) => (
+      informationTypeUses.some((use) => ruleCoversUse(rule, use, program))
+    ));
+    const informationTypeTitle = byId.get(informationTypeId)?.title || informationTypeId;
+    const affectedTitles = uncoveredUses.map(({ resource }) => resource.title);
+    const affectedSummary = affectedTitles.length > 3
+      ? `${affectedTitles.slice(0, 3).join(", ")}, and ${affectedTitles.length - 3} more`
+      : affectedTitles.join(", ");
     return readinessItem(
-      `retention-use-${use.resource.id}-${use.informationTypeId}`,
-      matches.length ? "complete" : "action",
-      `Decide retention for ${byId.get(use.informationTypeId)?.title || use.informationTypeId}`,
-      matches.length
-        ? `${use.resource.title} is covered by ${matches.map(({ title }) => title).join(", ")}.`
-        : `${use.resource.title} uses this Information Type, but no active, current retention schedule item covers both the type and scope. Management must choose the cutoff, period, and disposition.`,
-      use.resource,
+      `retention-use-${informationTypeId}`,
+      uncoveredUses.length ? "action" : "complete",
+      `Decide retention for ${informationTypeTitle}`,
+      uncoveredUses.length
+        ? `${affectedTitles.length} in-scope ${affectedTitles.length === 1 ? "resource uses" : "resources use"} this Information Type without an active, current retention decision, including ${affectedSummary}. Management must choose the cutoff, period, disposition, and whether one program-wide rule or separate scoped rules apply.`
+        : `All ${informationTypeUses.length} in-scope ${informationTypeUses.length === 1 ? "use is" : "uses are"} covered by ${matches.map(({ title }) => title).join(", ")}.`,
+      { type: "retention-schedule-item" },
       {
-        informationTypeId: use.informationTypeId,
+        informationTypeId,
+        affectedResourceIds: uncoveredUses.map(({ resource }) => resource.id),
+        retentionScopeResourceIds: uncoveredUses.length === informationTypeUses.length
+          ? [program.id]
+          : uncoveredUses.map(({ resource }) => resource.id),
         retentionScheduleItemIds: matches.map(({ id }) => id),
         commands: [
           "npx filegrc guide retention-schedule-item --json",
-          `npx filegrc scaffold retention-schedule-item --title ${shellArgument(`Retention for ${byId.get(use.informationTypeId)?.title || use.informationTypeId}`)}`
+          `npx filegrc scaffold retention-schedule-item --title ${shellArgument(`Retention for ${informationTypeTitle}`)}`
         ]
       }
     );
@@ -113,7 +135,7 @@ export async function resourceReviewRevisions(loaded, ids) {
     const entry = entries.get(id);
     if (!entry || reviewing.has(id)) return null;
     reviewing.add(id);
-    const parts = [entry.source];
+    const parts = [reviewSource(loaded, entry)];
     for (const markdown of markdownEntries(loaded.model, entry.record)) {
       try {
         parts.push(await readFile(resolveDataPath(loaded.root, markdown.path), "utf8"));
@@ -136,6 +158,37 @@ export async function resourceReviewRevisions(loaded, ids) {
   return new Map([...revisions].filter(([id]) => wanted.has(id)));
 }
 
+export function resourceReviewRevisionsSync(loaded, ids) {
+  const wanted = new Set(ids);
+  const entries = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
+  const revisions = new Map();
+  const reviewing = new Set();
+  const review = (id) => {
+    if (revisions.has(id)) return revisions.get(id);
+    const entry = entries.get(id);
+    if (!entry || reviewing.has(id)) return null;
+    reviewing.add(id);
+    const parts = [reviewSource(loaded, entry)];
+    for (const markdown of markdownEntries(loaded.model, entry.record)) {
+      try {
+        parts.push(readFileSync(resolveDataPath(loaded.root, markdown.path), "utf8"));
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+    for (const sourceId of [...new Set(entry.record.sourceResourceIds || [])].sort()) {
+      const revision = review(sourceId);
+      if (revision) parts.push(`${sourceId}:${revision}`);
+    }
+    reviewing.delete(id);
+    const revision = contentRevision(parts.join("\n"));
+    revisions.set(id, revision);
+    return revision;
+  };
+  for (const id of wanted) review(id);
+  return new Map([...revisions].filter(([id]) => wanted.has(id)));
+}
+
 export function retentionUses(loaded, program) {
   const systemIds = new Set(program.systemIds || []);
   const componentIds = new Set(programComponents(loaded, program).map(({ id }) => id));
@@ -157,6 +210,28 @@ export function retentionUses(loaded, program) {
   return [...new Map(uses.map((use) => [`${use.resource.id}:${use.informationTypeId}`, use])).values()];
 }
 
+function reviewSource(loaded, entry) {
+  if (
+    modelSupports(loaded.model, "retention-schedule-approval")
+    && entry.record.type === "document"
+    && entry.record.documentKind === "schedule"
+    && entry.record.workflowScope === "program"
+  ) {
+    const approved = structuredClone(entry.record);
+    if (approved.status === "active") approved.status = "approved";
+    for (const field of [
+      "activationBasis",
+      "activatedByIds",
+      "activatedOn",
+      "activatedContentRevisions",
+      "effectiveOn",
+      "proposedEffectiveOn"
+    ]) delete approved[field];
+    return JSON.stringify(approved);
+  }
+  return entry.source;
+}
+
 export function nearDuplicateInformationTypes(records) {
   const types = records.filter((record) => record.type === "information-type" && !["retired", "superseded"].includes(record.status));
   const pairs = [];

package/src/state.js

@@ -150,17 +150,7 @@ export async function createAppStateSection(input, section, options = {}) {
       collectionReviews: Object.fromEntries(
         assessCollectionReviews(loaded, { programId: activeProgram.id }).map((assessment) => [
           assessment.resourceType,
-          {
-            resourceType: assessment.resourceType,
-            configuration: assessment.configuration,
-            recordCount: assessment.recordCount,
-            review: assessment.review,
-            reviewRevision: assessment.reviewRevision,
-            collectionRevision: assessment.collectionRevision,
-            status: assessment.status,
-            complete: assessment.complete,
-            message: assessment.message
-          }
+          serializeCollectionReviewAssessment(assessment)
         ])
       ),
       applicabilityConstraints: Object.fromEntries(loaded.resources.flatMap((record) => {
@@ -318,17 +308,7 @@ async function createAppStateUnlocked(input, options) {
   const collectionReviews = Object.fromEntries(
     assessCollectionReviews(loaded, { programId: activeProgram.id }).map((assessment) => [
       assessment.resourceType,
-      {
-        resourceType: assessment.resourceType,
-        configuration: assessment.configuration,
-        recordCount: assessment.recordCount,
-        review: assessment.review,
-        reviewRevision: assessment.reviewRevision,
-        collectionRevision: assessment.collectionRevision,
-        status: assessment.status,
-        complete: assessment.complete,
-        message: assessment.message
-      }
+      serializeCollectionReviewAssessment(assessment)
     ])
   );
   return {
@@ -356,6 +336,23 @@ async function createAppStateUnlocked(input, options) {
   };
 }
 
+function serializeCollectionReviewAssessment(assessment) {
+  return {
+    resourceType: assessment.resourceType,
+    configuration: assessment.configuration,
+    recordCount: assessment.recordCount,
+    review: assessment.review,
+    reviewRevision: assessment.reviewRevision,
+    collectionRevision: assessment.collectionRevision,
+    status: assessment.status,
+    complete: assessment.complete,
+    message: assessment.message,
+    ...(assessment.eligibleReviewerIds ? { eligibleReviewerIds: assessment.eligibleReviewerIds } : {}),
+    ...(assessment.reviewerConflictIds ? { reviewerConflictIds: assessment.reviewerConflictIds } : {}),
+    ...(assessment.approvalIssues ? { approvalIssues: assessment.approvalIssues } : {})
+  };
+}
+
 export async function createResourceDetail(input, type, id, options = {}) {
   if (input?.entries && input?.root) return createResourceDetailFromLoaded(input, type, id, options);
   return serializeWorkspaceMutation(input, async (root) => {