filegrc 0.15.0 → 0.15.2

package/src/program-readiness.js

@@ -32,6 +32,100 @@ import { assessSourceCoverageReadiness } from "./source-coverage.js";
 import { currentCalendarDate, timestampFromLocalDateTime } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
 
+export function calculateProgramProgress({
+  stages = [],
+  target = {},
+  evidenceReady = false,
+  operating = false,
+  asOf,
+  window = null
+} = {}) {
+  const typeTwo = target.goal === "soc-2-type-2";
+  const trackedWindow = normalizeProgressWindow(window || target.candidateCoverage, window ? "audit" : "candidate");
+  const windowStarted = Boolean(
+    typeTwo
+    && trackedWindow
+    && asOf
+    && trackedWindow.start <= asOf
+  );
+  const setupProgress = calculateSetupActionProgress(stages, target, Boolean(trackedWindow));
+  if (windowStarted) {
+    const totalDays = calendarDayDistance(trackedWindow.start, trackedWindow.end) + 1;
+    const elapsedDays = Math.min(
+      totalDays,
+      Math.max(0, calendarDayDistance(trackedWindow.start, asOf) + 1)
+    );
+    const percent = totalDays ? Math.round((elapsedDays / totalDays) * 100) : 0;
+    const complete = elapsedDays >= totalDays;
+    const healthy = Boolean(operating);
+    return {
+      mode: "operating-window",
+      label: trackedWindow.source === "audit" ? "Audit window" : "Operating window",
+      status: healthy ? complete ? "Window complete" : "Operating" : "Needs attention",
+      complete: elapsedDays,
+      total: totalDays,
+      remaining: Math.max(0, totalDays - elapsedDays),
+      percent,
+      unit: "day",
+      start: trackedWindow.start,
+      end: trackedWindow.end,
+      source: trackedWindow.source,
+      detail: complete
+        ? `${totalDays} of ${totalDays} days elapsed.`
+        : `Day ${elapsedDays} of ${totalDays}; ${Math.max(0, totalDays - elapsedDays)} days remain.`,
+      operating
+    };
+  }
+
+  return {
+    mode: "setup-progress",
+    label: "Program setup",
+    status: !setupProgress.remaining
+      ? evidenceReady && typeTwo && trackedWindow?.start > asOf
+        ? "Scheduled"
+        : evidenceReady ? "Evidence ready" : "Ready"
+      : evidenceReady && typeTwo ? "Ready to start" : "Needs work",
+    ...setupProgress,
+    unit: "action",
+    detail: setupProgress.remaining
+      ? `${setupProgress.complete} of ${setupProgress.total} required actions complete.`
+      : `All ${setupProgress.total} required actions are complete.`,
+    operating
+  };
+}
+
+function calculateSetupActionProgress(stages, target, windowMilestoneComplete) {
+  const units = new Map();
+  for (const currentStage of stages.filter(({ id }) => id !== "operation")) {
+    for (const current of currentStage.items || []) {
+      if (current.progressUnit === false) continue;
+      const candidates = current.progressUnits?.length
+        ? current.progressUnits
+        : [current];
+      for (const candidate of candidates) {
+        if (["info", "later"].includes(candidate.status) || candidate.progressUnit === false) continue;
+        const key = `${currentStage.id}:${candidate.progressUnitId || current.progressUnitId || candidate.id || current.id}`;
+        const existing = units.get(key);
+        if (!existing || existing.status === "complete" && candidate.status !== "complete") {
+          units.set(key, candidate);
+        }
+      }
+    }
+  }
+
+  const setupUnits = [...units.values()];
+  const complete = setupUnits.filter(({ status }) => status === "complete").length;
+  const total = setupUnits.length + (target.goal === "soc-2-type-2" ? 1 : 0);
+  const completed = complete + (windowMilestoneComplete ? 1 : 0);
+  const remaining = Math.max(0, total - completed);
+  return {
+    complete: completed,
+    total,
+    remaining,
+    percent: total ? Math.round((completed / total) * 100) : 0
+  };
+}
+
 export async function assessProgramReadiness(input, options = {}) {
   const loaded = input?.resources && input?.model && input?.entries
     ? input
@@ -41,6 +135,15 @@ export async function assessProgramReadiness(input, options = {}) {
   const workspace = loaded.workspace || records.find((record) => record.type === "workspace");
   const program = resolveProgram(loaded, options.programId);
   const asOf = options.asOf || currentCalendarDate(workspace?.timezone || "UTC");
+  const requestedAudit = options.auditId
+    ? records.find((record) => record.type === "audit" && record.id === options.auditId)
+    : null;
+  const auditWindow = requestedAudit?.auditKind === "soc-2-type-2"
+    ? requestedAudit.coverage
+    : selectedAuditWindow(records, program, asOf);
+  const progressWindow = requestedAudit?.auditKind === "soc-2-type-2"
+    ? normalizeProgressWindow(auditWindow, "audit")
+    : selectedProgressWindow(program?.candidateCoverage, auditWindow, asOf);
   const scope = programScope(program, records, byId, loaded.model, loaded);
   const collectionReviews = assessCollectionReviews(loaded, { programId: program.id });
   const markdown = new Map();
@@ -57,13 +160,24 @@ export async function assessProgramReadiness(input, options = {}) {
     .map(collectionReviewReadinessItem));
   const sourceStage = await evidenceSourcesStage(scope, byId, loaded.model, readMarkdown);
   controlStage.items.push(...sourceStage.items);
+  const retentionScheduleReview = collectionReviews.find(({ resourceType }) => resourceType === "retention-schedule-item");
   const retentionItems = await assessRetentionReadiness(loaded, program, {
-    informationTypesReviewed: collectionReviews.find(({ resourceType }) => resourceType === "information-type")?.complete === true
+    informationTypesReviewed: collectionReviews.find(({ resourceType }) => resourceType === "information-type")?.complete === true,
+    scheduleApproved: retentionScheduleReview?.complete === true
   });
-  const retentionReviewItems = collectionReviews
-    .filter(({ resourceType }) => resourceType === "retention-schedule-item")
-    .map(collectionReviewReadinessItem);
+  const retentionReviewItems = retentionScheduleReview
+    ? [collectionReviewReadinessItem(retentionScheduleReview)]
+    : [];
   if (modelSupports(loaded.model, "retention-schedule-approval")) {
+    const scheduleDocumentIds = new Set(records.filter((record) => (
+      record.type === "document"
+      && record.documentKind === "schedule"
+      && record.workflowScope === "program"
+      && !["superseded", "retired"].includes(record.status)
+    )).map(({ id }) => id));
+    policyStage.items = policyStage.items.filter(({ id }) => (
+      ![...scheduleDocumentIds].some((documentId) => id === `document-approval-${documentId}`)
+    ));
     policyStage.items.push(...retentionItems.filter(({ id }) => !id.startsWith("retention-source-coverage-")));
     controlStage.items.push(...retentionItems.filter(({ id }) => id.startsWith("retention-source-coverage-")));
     policyStage.items.push(...retentionReviewItems);
@@ -123,26 +237,54 @@ export async function assessProgramReadiness(input, options = {}) {
   const evidenceReady = evidenceGateStages.every((current) => current.counts.action === 0);
   const stages = [
     ...evidenceGateStages,
-    await operationStage(loaded, program, scope, records, byId, asOf, evidenceReady, loaded.model)
+    await operationStage(loaded, program, scope, records, byId, asOf, evidenceReady, loaded.model, progressWindow)
   ];
   finalizeStage(stages.at(-1));
-  const candidateStarted = Boolean(
+  const periodStarted = Boolean(
     program?.assuranceGoal === "soc-2-type-2"
-    && program.candidateCoverage?.kind === "range"
-    && coverageStart(program.candidateCoverage) <= asOf
+    && progressWindow?.start <= asOf
   );
   const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, model: loaded.model });
   const policyLibrary = await assessPolicyLibraryUpgrades(loaded);
-  const operating = evidenceReady && candidateStarted && stages.at(-1).counts.action === 0;
+  const operating = Boolean(
+    evidenceReady
+    && periodStarted
+    && stages.at(-1).counts.action === 0
+  );
   const canStartCandidatePeriod = Boolean(
     evidenceReady
     && program?.assuranceGoal === "soc-2-type-2"
     && !program.candidateCoverage
+    && !periodStarted
   );
   const items = stages.flatMap((current) => current.items);
   const managedItems = items.filter((current) => !["info", "later"].includes(current.status));
   const complete = managedItems.filter((current) => current.status === "complete").length;
   const firstAction = items.find((current) => current.status === "action") || null;
+  const target = {
+    programId: program?.id || null,
+    goal: program?.assuranceGoal || "none",
+    label: assuranceGoalLabel(program?.assuranceGoal),
+    candidateCoverage: program?.candidateCoverage || null
+  };
+  const checkProgress = {
+    complete,
+    total: managedItems.length,
+    percent: managedItems.length ? Math.round((complete / managedItems.length) * 100) : 0
+  };
+  const progress = calculateProgramProgress({
+    stages,
+    target,
+    evidenceReady,
+    operating,
+    asOf,
+    window: progressWindow
+  });
+  const setupProgress = calculateSetupActionProgress(
+    stages,
+    target,
+    Boolean(progressWindow)
+  );
 
   return {
     program,
@@ -150,12 +292,7 @@ export async function assessProgramReadiness(input, options = {}) {
     dataModelVersion: String(loaded.model.modelVersion),
     generatedAt: options.generatedAt || new Date().toISOString(),
     asOf,
-    target: {
-      programId: program?.id || null,
-      goal: program?.assuranceGoal || "none",
-      label: assuranceGoalLabel(program?.assuranceGoal),
-      candidateCoverage: program?.candidateCoverage || null
-    },
+    target,
     status: operating ? "operating" : evidenceReady ? "evidence-ready" : "needs-work",
     evidenceReady,
     operating,
@@ -168,11 +305,9 @@ export async function assessProgramReadiness(input, options = {}) {
       ...policyLibrary.proposals,
       ...legacyPolicyLibraryProposals(records)
     ],
-    progress: {
-      complete,
-      total: managedItems.length,
-      percent: managedItems.length ? Math.round((complete / managedItems.length) * 100) : 0
-    },
+    progress,
+    setupProgress,
+    checkProgress,
     counts: countStatuses(items),
     firstAction,
     scope: {
@@ -277,7 +412,10 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
         ? `${completeComponents.length} of ${scope.components.length} Components have an active, owned, rationalized role in the selected Systems.`
         : "No Components are selected. This is valid only when the bounded Systems do not rely on a separately managed service-delivery, Control-support, evidence-source, or supporting-operations building block.",
       scope.components[0] || { type: "component" },
-      { componentIds: scope.components.map(({ id }) => id) }
+      {
+        componentIds: scope.components.map(({ id }) => id),
+        progressUnit: false
+      }
     ));
   }
 
@@ -444,7 +582,7 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   return stage("scope", "Define Scope", "Set program ownership, the management objective, service boundary, criteria, controls, and dependencies.", items);
 }
 
-function reportingRouteSetItem(assessment) {
+export function reportingRouteSetItem(assessment) {
   const current = assessment.routeSets.find(({ effective, canceled }) => effective && !canceled);
   const draft = assessment.routeSets.find(({ record }) => ["draft", "proposed"].includes(record.status));
   const required = assessment.requirements.length > 0;
@@ -453,13 +591,18 @@ function reportingRouteSetItem(assessment) {
     .map(({ purposeKey }) => purposeKey)
     .filter(Boolean))];
   const preparedPurposeKeys = new Set(assessment.routeSets
-    .filter(({ record, committed, canceled, proposedRequirementIssues }) => (
-      ["proposed", "approved"].includes(record.status)
+    .filter(({ record, committed, effective, canceled, proposedRequirementIssues }) => (
+      (["proposed", "approved"].includes(record.status) || effective)
       && committed
       && !canceled
       && proposedRequirementIssues.length === 0
     ))
     .map(({ record }) => record.purposeKey));
+  const requiredPurposeKeys = new Set(assessment.requirements.map(({ purposeKey }) => purposeKey).filter(Boolean));
+  const purposeKeys = [...new Set([
+    ...requiredPurposeKeys,
+    ...proposedPurposeKeys
+  ])];
   const unpreparedPurposeKeys = proposedPurposeKeys.filter((purposeKey) => !preparedPurposeKeys.has(purposeKey));
   const ready = assessment.issues.length === 0
     && (!required || Boolean(current))
@@ -494,6 +637,42 @@ function reportingRouteSetItem(assessment) {
       proposedRequirementIssues: assessment.routeSets.flatMap(({ proposedRequirementIssues }) => proposedRequirementIssues),
       unpreparedPurposeKeys,
       issues: assessment.issues,
+      progressUnits: purposeKeys.flatMap((purposeKey) => {
+        const purposeResourceIds = new Set([
+          ...assessment.routeSets.filter(({ record }) => record.purposeKey === purposeKey).map(({ record }) => record.id),
+          ...assessment.requirements.filter((requirement) => requirement.purposeKey === purposeKey).map(({ sourceId }) => sourceId),
+          ...assessment.proposedRequirements.filter((requirement) => requirement.purposeKey === purposeKey).map(({ sourceId }) => sourceId)
+        ].filter(Boolean));
+        const purposeIssues = assessment.issues.filter(({ resourceId }) => (
+          resourceId === assessment.programId || purposeResourceIds.has(resourceId)
+        ));
+        const approvedSet = assessment.routeSets.find(({ record, effective, canceled }) => (
+          record.purposeKey === purposeKey && effective && !canceled
+        ));
+        const proposedSet = assessment.routeSets.find(({ record, effective, canceled }) => (
+          record.purposeKey === purposeKey
+          && !canceled
+          && (effective || ["proposed", "approved"].includes(record.status))
+        ));
+        const proposalComplete = Boolean(
+          (approvedSet || proposedSet?.committed)
+          && proposedSet?.proposedRequirementIssues.length === 0
+        );
+        return [
+          {
+            id: `reporting-route-proposal-${purposeKey}`,
+            status: proposalComplete ? "complete" : "action",
+            title: `${proposedSet?.record.title || purposeKey} proposal`
+          },
+          {
+            id: `reporting-route-approval-${purposeKey}`,
+            status: approvedSet && purposeIssues.length === 0
+              ? "complete"
+              : requiredPurposeKeys.has(purposeKey) ? "action" : "later",
+            title: `${proposedSet?.record.title || purposeKey} approval`
+          }
+        ];
+      }),
       commands: [
         "npx filegrc reporting-route-sets --json",
         "npx filegrc reporting-route-set --scaffold"
@@ -529,6 +708,11 @@ function reportingRouteItem(records, byId, asOf, timezone = "UTC") {
 }
 
 function collectionReviewReadinessItem(assessment) {
+  const proposalUnits = (assessment.recordProposals || []).map((proposal) => ({
+    id: `${assessment.resourceType}-proposal-${proposal.resourceId}`,
+    status: proposal.complete ? "complete" : "action",
+    title: `${proposal.title} proposal`
+  }));
   return item(
     `collection-review-${assessment.resourceType}`,
     assessment.complete ? "complete" : "action",
@@ -540,6 +724,18 @@ function collectionReviewReadinessItem(assessment) {
     {
       resourceType: assessment.resourceType,
       reviewPoints: assessment.configuration.reviewPoints,
+      ...(proposalUnits.length ? {
+        progressUnits: [
+          ...proposalUnits,
+          {
+            id: `${assessment.resourceType}-collection-review`,
+            status: proposalUnits.every(({ status }) => status === "complete")
+              ? assessment.complete ? "complete" : "action"
+              : "blocked",
+            title: `${assessment.configuration.title} collection review`
+          }
+        ]
+      } : {}),
       commands: [
         `npx filegrc review-collection ${assessment.resourceType} --scaffold`,
         `npx filegrc review-collection ${assessment.resourceType} REVIEW.json --preview --json`
@@ -724,6 +920,7 @@ async function policiesStage(scope, records, byId, readMarkdown, model) {
           : "Appoint a reviewer who is separate from the policy owner. The reviewer may be another person in the organization or an external person, and is separate from the CPA firm that may later perform the audit.",
       appointedReviewer || (reviewerNeedsAssignment ? governedRecords[0] : { type: "person" }),
       {
+        progressUnit: false,
         commands: [
           "npx filegrc list appointment --workflow --json",
           "npx filegrc guide appointment --json",
@@ -1468,7 +1665,7 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
   return stage("sources", "Control Evidence Sources", `Complete the authoritative ${modelSupports(model, "component-sources") ? "Components" : "Systems"} for every selected control family before marking the Controls implemented.`, items);
 }
 
-async function operationStage(loaded, workspace, scope, records, byId, asOf, evidenceReady, model) {
+async function operationStage(loaded, workspace, scope, records, byId, asOf, evidenceReady, model, progressWindow = null) {
   const goal = workspace?.assuranceGoal || "none";
   if (!evidenceReady) {
     return stage("operation", "Operate the Program", "Run the controls and preserve dated evidence after the Evidence Ready gate passes.", [
@@ -1500,12 +1697,9 @@ async function operationStage(loaded, workspace, scope, records, byId, asOf, evi
   }
 
   const obligations = planObligations(records, { programId: workspace.id, asOf, through: asOf, model });
-  const start = workspace.candidateCoverage?.kind === "range"
-    ? coverageStart(workspace.candidateCoverage)
-    : null;
-  const end = workspace.candidateCoverage?.kind === "range"
-    ? coverageEnd(workspace.candidateCoverage)
-    : null;
+  const start = progressWindow?.start || null;
+  const end = progressWindow?.end || null;
+  const formalWindow = progressWindow?.source === "audit";
   const startStatus = !start ? "action" : start <= asOf ? "complete" : "later";
   const sourceCoverage = await assessSourceCoverageReadiness(loaded, scope.controls.map(({ id }) => id), workspace);
   const incompleteSourceCoverage = sourceCoverage.filter(({ complete }) => !complete);
@@ -1517,16 +1711,20 @@ async function operationStage(loaded, workspace, scope, records, byId, asOf, evi
       !start
         ? "Set the management candidate period start when the Evidence Ready gate passes. Do not backdate it."
         : start <= asOf
-          ? `Management began the candidate Type 2 evidence period on ${start}. This is not the auditor-agreed report period.`
+          ? formalWindow
+            ? `The auditor-agreed Type 2 period began on ${start}. Keep evidence collection and operating work current through the period.`
+            : `Management began the candidate Type 2 evidence period on ${start}. This is not the auditor-agreed report period.`
           : `Evidence collection is scheduled to begin on ${start}.`,
       workspace
     ),
     item(
       "candidate-period-end",
       end ? "complete" : start ? "later" : "info",
-      "Plan the candidate period end",
+      formalWindow ? "Confirm the auditor-agreed period end" : "Plan the candidate period end",
       end
-        ? `Management candidate period: ${start || "start not set"} through ${end}. The CPA firm may agree to different dates.`
+        ? formalWindow
+          ? `Auditor-agreed period: ${start || "start not set"} through ${end}.`
+          : `Management candidate period: ${start || "start not set"} through ${end}. The CPA firm may agree to different dates.`
         : "Add the management target end when useful. Starting reliable evidence collection is the immediate milestone.",
       workspace
     ),
@@ -1784,6 +1982,61 @@ function countStatuses(items) {
   return counts;
 }
 
+export function selectedAuditWindow(records, program, asOf) {
+  if (program?.assuranceGoal !== "soc-2-type-2") return null;
+  const candidates = records.filter((record) => (
+    record.type === "audit"
+    && record.auditKind === "soc-2-type-2"
+    && (!record.programId || record.programId === program.id)
+    && !["canceled", "closed", "complete", "delivered"].includes(record.status)
+    && normalizeProgressWindow(record.coverage)
+    && coverageStart(record.coverage) <= asOf
+  ));
+  const statusOrder = new Map([
+    ["planned", 0],
+    ["in-progress", 1],
+    ["fieldwork", 2],
+    ["report-draft", 3],
+    ["issued", 4]
+  ]);
+  candidates.sort((left, right) => (
+    coverageStart(right.coverage).localeCompare(coverageStart(left.coverage))
+    || (statusOrder.get(right.status) ?? -1) - (statusOrder.get(left.status) ?? -1)
+    || coverageEnd(right.coverage).localeCompare(coverageEnd(left.coverage))
+    || left.id.localeCompare(right.id)
+  ));
+  return candidates[0]?.coverage || null;
+}
+
+export function selectedProgressWindow(candidateCoverage, auditCoverage, asOf) {
+  const candidates = [
+    normalizeProgressWindow(candidateCoverage, "candidate"),
+    normalizeProgressWindow(auditCoverage, "audit")
+  ].filter((window) => window && (!asOf || window.start <= asOf));
+  candidates.sort((left, right) => (
+    right.start.localeCompare(left.start)
+    || Number(right.source === "audit") - Number(left.source === "audit")
+    || right.end.localeCompare(left.end)
+  ));
+  if (candidates.length) return candidates[0];
+  return normalizeProgressWindow(candidateCoverage, "candidate")
+    || normalizeProgressWindow(auditCoverage, "audit");
+}
+
+function normalizeProgressWindow(coverage, source = "candidate") {
+  const start = coverage?.start || coverageStart(coverage);
+  const end = coverage?.end || coverageEnd(coverage);
+  if (!start || !end || end < start) return null;
+  return { start, end, source: coverage?.source || source };
+}
+
+function calendarDayDistance(start, end) {
+  const startTime = Date.parse(`${start}T00:00:00Z`);
+  const endTime = Date.parse(`${end}T00:00:00Z`);
+  if (!Number.isFinite(startTime) || !Number.isFinite(endTime)) return 0;
+  return Math.round((endTime - startTime) / 86_400_000);
+}
+
 function shiftYear(value, offset) {
   const date = new Date(`${value}T00:00:00Z`);
   date.setUTCFullYear(date.getUTCFullYear() + offset);

package/src/retention-schedule-approval.js

@@ -3,7 +3,7 @@ import { readFileSync } from "node:fs";
 import { openPlaceholderCount, substantiveMarkdown } from "./content-readiness.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { resolveDataPath } from "./paths.js";
-import { currentPartyPeople, partiesIndependent } from "./parties.js";
+import { currentPartyPeople } from "./parties.js";
 import {
   nearDuplicateInformationTypes,
   resourceReviewRevisionsSync,
@@ -26,7 +26,7 @@ export function retentionScheduleApprovalIssues(loaded, program, rows, options =
     && !["superseded", "retired"].includes(record.status)
   ));
   if (!schedules.length) {
-    issues.push(issue("missing-retention-schedule-document", "Add and approve the Data Retention Schedule document before approving the schedule revision."));
+    issues.push(issue("missing-retention-schedule-document", "Add the Data Retention Schedule document before requesting approval of the complete schedule."));
   }
   if (schedules.length !== 1) {
     if (schedules.length) {
@@ -38,17 +38,22 @@ export function retentionScheduleApprovalIssues(loaded, program, rows, options =
   const linkedControl = schedule && (schedule.controlIds || []).some((id) => (program.controlIds || []).includes(id));
   if (
     schedule
-    && (!["approved", "active"].includes(schedule.status)
-    || !schedule.approvedOn
-    || !schedule.approvedContentRevisions
-    || currentPartyPeople(schedule.ownerIds || [], byId).size === 0
-    || !partiesIndependent(schedule.ownerIds, schedule.approverIds, byId)
+    && (currentPartyPeople(schedule.ownerIds || [], byId).size === 0
     || !linkedControl
     || !substantiveMarkdown(scheduleContent)
-    || openPlaceholderCount(scheduleContent) > 0
+    || openPlaceholderCount(scheduleContent) > 0)
+  ) {
+    issues.push(issue("incomplete-retention-schedule-document", "Complete the Data Retention Schedule document, its owner, linked Control, and Markdown before requesting approval of the complete schedule."));
+  }
+  if (
+    schedule
+    && options.approvalReview
+    && (!["approved", "active"].includes(schedule.status)
+    || schedule.approvedOn !== options.approvalReview.reviewedOn
+    || !sameIds(schedule.approverIds, options.approvalReview.reviewedByIds)
     || !approvalBindingsMatch(loaded, schedule))
   ) {
-    issues.push(issue("unapproved-retention-schedule-document", "Complete and independently approve the Data Retention Schedule document before approving the complete schedule."));
+    issues.push(issue("invalid-retention-schedule-approval-binding", "The Data Retention Schedule document no longer matches the recorded whole-schedule approval. Review and approve the current complete schedule again."));
   }
   const activeRows = rows.filter(({ status }) => status === "active");
   const mismatched = schedule
@@ -65,15 +70,20 @@ export function retentionScheduleApprovalIssues(loaded, program, rows, options =
   if (incomplete.length) {
     issues.push(issue("incomplete-retention-schedule-row", `Complete the retention decisions before approving the schedule revision: ${incomplete[0].title}.`));
   }
-  const usableRows = activeRows.filter((row) => !incomplete.includes(row));
-  const uncovered = retentionUses(loaded, program).find((use) => !usableRows.some((row) => (
+  const proposedRows = rows.filter(rowProposesCoverage);
+  const scopedPrograms = program.programIds
+    ? program.programIds.map((id) => byId.get(id)).filter((record) => record?.type === "program")
+    : [program];
+  const uncovered = scopedPrograms.flatMap((candidate) => (
+    retentionUses(loaded, candidate).map((use) => ({ ...use, programId: candidate.id }))
+  )).find((use) => !proposedRows.some((row) => (
     (row.informationTypeIds || []).includes(use.informationTypeId)
-    && ((row.scopeResourceIds || []).includes(use.resource.id) || (row.scopeResourceIds || []).includes(program.id))
+    && ((row.scopeResourceIds || []).includes(use.resource.id) || (row.scopeResourceIds || []).includes(use.programId))
   )));
   if (uncovered) {
     issues.push(issue(
       "uncovered-retention-information-use",
-      `${uncovered.resource.title} uses ${byId.get(uncovered.informationTypeId)?.title || uncovered.informationTypeId}, but no active, current retention schedule row covers both the type and scope.`
+      `${uncovered.resource.title} uses ${byId.get(uncovered.informationTypeId)?.title || uncovered.informationTypeId}, but no proposed retention schedule row covers both the type and scope.`
     ));
   }
   if (nearDuplicateInformationTypes(loaded.resources).length && !options.informationTypesReviewed) {
@@ -82,6 +92,10 @@ export function retentionScheduleApprovalIssues(loaded, program, rows, options =
   return issues;
 }
 
+function sameIds(left = [], right = []) {
+  return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
+}
+
 function issue(code, message) {
   return { code, message };
 }
@@ -99,6 +113,14 @@ function primaryMarkdown(loaded, record) {
   }
 }
 
+function rowProposesCoverage(row) {
+  return Boolean(
+    (row.informationTypeIds || []).length
+    && (row.scopeResourceIds || []).length
+    && row.scheduleDocumentId
+  );
+}
+
 function approvalBindingsMatch(loaded, record) {
   const actual = {};
   for (const entry of markdownEntries(loaded.model, record)) {
@@ -114,8 +136,5 @@ function approvalBindingsMatch(loaded, record) {
   const actualKeys = Object.keys(actual).sort();
   const expectedKeys = Object.keys(expected).sort();
   return actualKeys.length === expectedKeys.length
-    && actualKeys.every((key, index) => (
-      key === expectedKeys[index]
-      && actual[key] === expected[key]
-    ));
+    && actualKeys.every((key, index) => key === expectedKeys[index] && actual[key] === expected[key]);
 }