filegrc 0.15.1 → 0.15.3

package/src/collection-scope.js

@@ -65,6 +65,77 @@ export function scopedCollectionRecords(loaded, resourceType, program) {
   ));
 }
 
+export function retentionScheduleReviewScope(loaded) {
+  const programs = loaded.resources.filter((record) => (
+    record.type === "program" && record.status !== "retired"
+  ));
+  return {
+    id: "workspace",
+    programIds: programs.map(({ id }) => id).sort(),
+    systemIds: [...new Set(programs.flatMap((record) => record.systemIds || []))],
+    controlIds: [...new Set(programs.flatMap((record) => record.controlIds || []))],
+    frameworkIds: [...new Set(programs.flatMap((record) => record.frameworkIds || []))]
+  };
+}
+
+const RECORD_PROPOSAL_COLLECTIONS = new Set([
+  "component",
+  "vendor",
+  "complementary-control",
+  "information-type"
+]);
+
+export function collectionRecordProposals(loaded, resourceType, records, program) {
+  if (!RECORD_PROPOSAL_COLLECTIONS.has(resourceType)) return [];
+  const currentRecords = records.filter((record) => collectionRecordIsCurrent(record));
+  const scopedIds = new Set(currentRecords.map(({ id }) => id));
+  const candidates = new Map(currentRecords.map((record) => [record.id, record]));
+  const activePrograms = loaded.resources.filter((record) => record.type === "program" && record.status !== "retired");
+  if (activePrograms.length === 1 && activePrograms[0].id === program?.id && ["component", "complementary-control"].includes(resourceType)) {
+    for (const record of loaded.resources) {
+      if (
+        record.type !== resourceType
+        || ["retired", "superseded"].includes(record.status)
+        || collectionRecordProposalComplete(record, loaded)
+      ) continue;
+      candidates.set(record.id, record);
+    }
+  }
+  return [...candidates.values()].map((record) => ({
+    resourceId: record.id,
+    title: record.title,
+    complete: scopedIds.has(record.id) && collectionRecordProposalComplete(record, loaded)
+  }));
+}
+
+function collectionRecordIsCurrent(record) {
+  if (record.type === "vendor") return !["deprecated", "terminated"].includes(record.status);
+  if (record.type === "information-type") return !["superseded", "retired"].includes(record.status);
+  if (record.type === "complementary-control") return !["superseded", "retired"].includes(record.status);
+  return record.status !== "retired";
+}
+
+function collectionRecordProposalComplete(record, loaded) {
+  if (record.type === "vendor") return record.status !== "evaluating";
+  if (record.type === "component") {
+    if (record.status === "planned") return false;
+    if (record.status === "retired") return true;
+    return record.status === "active"
+      && Boolean(String(record.description || "").trim())
+      && (record.ownerIds || []).length > 0
+      && (record.systemUses || []).length > 0
+      && (record.systemUses || []).every(({ roles, rationale }) => (
+        (roles || []).length > 0 && Boolean(String(rationale || "").trim())
+      ));
+  }
+  if (record.type === "information-type") {
+    if (record.status === "retired") return true;
+    const classification = loaded.resources.find(({ id, type }) => type === "classification" && id === record.classificationId);
+    return record.status === "active" && classification?.status === "active";
+  }
+  return record.status !== "planned";
+}
+
 export function selectScopedCollectionRecords(loaded, selector, program) {
   if (!selector?.resourceType) return [];
   return scopedCollectionRecords(loaded, selector.resourceType, program).filter((record) => (
@@ -231,7 +302,10 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
       .map(({ id }) => id));
   }
   if (resourceType === "retention-schedule-item" && !legacy && modelSupports(loaded.model, "retention-schedule-approval")) {
-    const uses = retentionUses(loaded, program || {});
+    const programs = program
+      ? [program]
+      : loaded.resources.filter((record) => record.type === "program" && record.status !== "retired");
+    const uses = programs.flatMap((candidate) => retentionUses(loaded, candidate));
     addIds(uses.map(({ resource }) => resource.id));
     addIds(uses.map(({ informationTypeId }) => informationTypeId));
     const schedules = loaded.resources
@@ -243,14 +317,14 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
       ))
     addIds(schedules.map(({ id }) => id));
     for (const schedule of schedules) {
-      addPartyIds([...(schedule.ownerIds || []), ...(schedule.approverIds || [])]);
+      addPartyIds(schedule.ownerIds || []);
     }
     for (const record of reviewed) {
       addIds([record.scheduleDocumentId]);
       addIds(record.informationTypeIds);
       addIds(record.scopeResourceIds);
       addIds(record.sourceResourceIds);
-      addPartyIds([...(record.ownerIds || []), ...(record.approvedByIds || [])]);
+      addPartyIds(record.ownerIds || []);
     }
   }
   if (resourceType === "complementary-control") {
@@ -267,14 +341,43 @@ export function collectionRevisionInputs(loaded, resourceType, program, options
   return [...records.values()].map((record) => ({
     record,
     value: reviewedIds.has(record.id)
-      ? record
-      : dependencyRevisionValue(resourceType, record, legacy),
+      ? resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")
+        ? retentionScheduleRowProposalValue(record)
+        : record
+      : resourceType === "retention-schedule-item"
+        && modelSupports(loaded.model, "retention-schedule-approval")
+        && record.type === "document"
+          ? retentionScheduleDocumentProposalValue(record)
+          : dependencyRevisionValue(resourceType, record, legacy),
     includeContent: legacy
       || reviewedIds.has(record.id)
       || dependencyContentAffectsRevision(resourceType, record.type)
   }));
 }
 
+function retentionScheduleRowProposalValue(record) {
+  return Object.fromEntries(Object.entries(record).filter(([field]) => ![
+    "approvedByIds",
+    "approvedOn"
+  ].includes(field)));
+}
+
+function retentionScheduleDocumentProposalValue(record) {
+  return Object.fromEntries(Object.entries(record).filter(([field]) => ![
+    "status",
+    "approverIds",
+    "approvedOn",
+    "approvedContentRevisions",
+    "activationBasis",
+    "activatedByIds",
+    "activatedOn",
+    "activatedContentRevisions",
+    "effectiveOn",
+    "proposedEffectiveOn",
+    "statusTransition"
+  ].includes(field)));
+}
+
 export function collectionScopeRevisionFacts(loaded, resourceType, program) {
   if (!modelSupports(loaded.model, "program-scope")) {
     const common = { programId: program?.id ?? null };
@@ -296,6 +399,19 @@ export function collectionScopeRevisionFacts(loaded, resourceType, program) {
     }
     return common;
   }
+  if (resourceType === "retention-schedule-item" && modelSupports(loaded.model, "retention-schedule-approval")) {
+    const programs = loaded.resources
+      .filter((record) => record.type === "program" && record.status !== "retired")
+      .sort((left, right) => left.id.localeCompare(right.id));
+    return {
+      programIds: programs.map(({ id }) => id),
+      programs: programs.map((record) => ({
+        id: record.id,
+        systemIds: sorted(record.systemIds),
+        controlIds: sorted(record.controlIds)
+      }))
+    };
+  }
   const common = { programId: program?.id ?? null };
   if (resourceType === "framework") {
     return {

package/src/files.js

@@ -234,6 +234,12 @@ export async function applyGovernedContentActivationBatch(input, changes) {
   ));
 }
 
+export async function applyRetentionScheduleReviewBatch(input, changes) {
+  return serializeWorkspaceMutation(input, (root) => (
+    applyResourceBatchUnlocked(root, changes, "retention-schedule-approval")
+  ));
+}
+
 export async function applyModelMigrationBatch(input, changes) {
   return serializeWorkspaceMutation(input, (root) => (
     applyResourceBatchUnlocked(root, changes, "model-migration")
@@ -1231,7 +1237,13 @@ function assertGovernedContentLifecycleMutation(previousRecord, nextRecord, mode
   const title = getResourceDefinition(model, nextRecord.type).title;
   const approvedStatuses = new Set(["approved", "active", "superseded", "retired"]);
   const activatedStatuses = new Set(["active", "superseded", "retired"]);
-  if (approvedStatuses.has(previousRecord.status) && approvedStatuses.has(nextRecord.status)) {
+  const retentionScheduleReapproval = lifecycleOperation === "retention-schedule-approval"
+    && previousRecord.type === "document"
+    && previousRecord.documentKind === "schedule"
+    && previousRecord.workflowScope === "program"
+    && nextRecord.documentKind === "schedule"
+    && nextRecord.workflowScope === "program";
+  if (approvedStatuses.has(previousRecord.status) && approvedStatuses.has(nextRecord.status) && !retentionScheduleReapproval) {
     assertLifecycleFieldsUnchanged(previousRecord, nextRecord, [
       "approverIds",
       "approvedOn",

package/src/git.js

@@ -1774,6 +1774,92 @@ export async function prefetchBrowserRemote(
   return prefetch;
 }
 
+export async function synchronizeBrowserStartup(
+  input = process.cwd(),
+  options = {},
+) {
+  return serializeWorkspaceMutation(input, async (root) => {
+    const config = await getRepositoryConfig(root);
+    if (config.mode !== "trunk" || options.allowNonAuthoritativeWrites === true) {
+      return { status: "not-needed", updated: false };
+    }
+
+    const before = await requireTrunkPreconditionsAsync(root, config, {
+      allowAhead: true,
+    });
+    await fetchConfiguredRemote(root, config);
+    const synchronized = inspectTrunkRepository(
+      root,
+      config,
+      await getRepositorySnapshot(root, { fresh: true }),
+    );
+    if (synchronized.ahead > 0 || synchronized.behind === 0) {
+      return {
+        status: synchronized.ahead > 0 ? "blocked" : "current",
+        updated: false,
+        ahead: synchronized.ahead,
+        behind: synchronized.behind,
+        commit: synchronized.currentCommit,
+      };
+    }
+
+    const target = synchronized.upstreamCommit;
+    const incomingCommits = lines(
+      git(root, [
+        "rev-list",
+        "--reverse",
+        `${synchronized.currentCommit}..${target}`,
+      ]),
+    );
+    assertCommitsInsideWorkspace(root, incomingCommits);
+    for (const commit of incomingCommits) assertNoCommitWorkspaceContentFilters(root, commit);
+    assertExpectedCheckout(
+      root,
+      `refs/heads/${config.authoritativeBranch}`,
+      before.currentCommit,
+    );
+    await gitForWriteAsync(
+      root,
+      [
+        "-c",
+        "core.hooksPath=/dev/null",
+        "merge",
+        "--ff-only",
+        "--no-edit",
+        "--no-stat",
+        target,
+      ],
+      `fast-forward ${config.authoritativeBranch} at server startup`,
+      {
+        expectedCheckout: {
+          expectedRef: `refs/heads/${config.authoritativeBranch}`,
+          expectedCommit: before.currentCommit,
+        },
+        expectedNoOperation: true,
+      },
+    );
+    const after = inspectTrunkRepository(
+      root,
+      config,
+      await getRepositorySnapshot(root, { fresh: true }),
+    );
+    if (after.ahead !== 0 || after.behind !== 0 || after.currentCommit !== target) {
+      throw new Error(
+        "The authoritative branch changed while FileGRC fast-forwarded it. Reconcile the repository with Git, then restart FileGRC.",
+      );
+    }
+    const synchronizedAt = new Date().toISOString();
+    lastSuccessfulSynchronizations.set(root, synchronizedAt);
+    return {
+      status: "updated",
+      updated: true,
+      commit: after.currentCommit,
+      shortCommit: after.currentCommit.slice(0, 8),
+      synchronizedAt,
+    };
+  });
+}
+
 async function prefetchBrowserRemoteCoalesced(root, options) {
   const prepared = await serializeWorkspaceMutation(root, async () => {
     const config = await getRepositoryConfig(root);

package/src/index.js

@@ -49,7 +49,8 @@ export {
   pullWorkspace,
   pushWorkspace,
   retryBrowserSync,
-  runBrowserMutation
+  runBrowserMutation,
+  synchronizeBrowserStartup
 } from "./git.js";
 export { generateModelDocumentation } from "./model-docs.js";
 export { renderMarkdown } from "./markdown.js";

package/src/obligation-members.js

@@ -0,0 +1,31 @@
+export function occurrenceMemberExceptionIsValid(member, occurrence, byId) {
+  const exception = byId.get(member.exceptionId);
+  const occurrenceStart = occurrence.coverage?.kind === "as-of"
+    ? occurrence.coverage.on
+    : occurrence.coverage?.startsOn;
+  const occurrenceEnd = occurrence.coverage?.kind === "as-of"
+    ? occurrence.coverage.on
+    : occurrence.coverage?.endsOn;
+  const exceptionCoversMember = exception?.scopeResourceIds?.includes(member.resourceId)
+    || exception?.scopeResourceIds?.includes(occurrence.obligationId);
+  const statusCoveredOccurrence = exception?.status === "approved"
+    || ["revoked", "closed"].includes(exception?.status)
+      && exception.resolution?.resolvedOn > occurrenceEnd;
+  return Boolean(
+    exception?.type === "exception"
+    && statusCoveredOccurrence
+    && exceptionCoversMember
+    && exception.approval?.approvedOn <= occurrenceStart
+    && exception.approval?.expiresOn >= occurrenceEnd
+  );
+}
+
+export function occurrenceMemberIsResolved(member, occurrence, byId, expectedCompletionIsValid = () => false) {
+  if (member.disposition === "expected") {
+    return member.result === "passed"
+      && (member.completionResourceIds || []).some((id) => expectedCompletionIsValid(id, member));
+  }
+  if (member.disposition === "exception") return occurrenceMemberExceptionIsValid(member, occurrence, byId);
+  if (member.disposition === "not-applicable") return Boolean(String(member.rationale || "").trim());
+  return false;
+}

package/src/obligations.js

@@ -29,6 +29,7 @@ import { serializeWorkspaceMutation } from "./mutation.js";
 import { collectionReviewRevision, historicalCollectionReviewSnapshot } from "./collection-review-integrity.js";
 import { bindAttestationReportingRouteSet, reportingRouteRevision } from "./reporting-route-integrity.js";
 import { selectScopedCollectionRecords } from "./collection-scope.js";
+import { occurrenceMemberIsResolved } from "./obligation-members.js";
 
 const COMPLETION_DATE_FIELDS = [
   "completedOn",
@@ -214,8 +215,22 @@ export function planObligations(resources, options = {}) {
       const completedMemberIds = new Set((reconciliation?.members || [])
         .filter((member) => member.result === "passed" && member.disposition === "expected")
         .map((member) => member.resourceId));
+      const resolvedMemberIds = new Set((reconciliation?.members || [])
+        .filter((member) => occurrenceMemberIsResolved(member, reconciliation, byId, (completionId) => {
+          const completion = byId.get(completionId);
+          return completionTypeMatches(completion, expectedCompletionTypes)
+            && completionMatchesMember(completion, activity.aggregate?.completionMemberField, member.resourceId)
+            && completionFallsInWindow(completion, window, rule?.timezone || workspace?.timezone || "UTC")
+            && completionPassesActivity(completion, activity);
+        }))
+        .map((member) => member.resourceId));
+      const resolutionsComplete = membershipFinal
+        && expectedMemberIds.every((resourceId) => resolvedMemberIds.has(resourceId));
+      const conclusionValid = ["complete", "complete-with-exceptions", "zero-population"].includes(reconciliation?.conclusion)
+        && resolutionsComplete;
       const successful = reconciliation
-        ? reconciliation.status === "reconciled" && ["complete", "complete-with-exceptions", "zero-population"].includes(reconciliation.conclusion)
+        ? reconciliation.status === "reconciled"
+          && conclusionValid
         : legacyCompletions.length > 0;
       const timingStatus = occurrenceStatus(window, asOf, successful);
       const status = timingStatus === "complete" || programStatus === "accepted" ? timingStatus : "proposed";
@@ -244,6 +259,9 @@ export function planObligations(resources, options = {}) {
         completionResourceIds,
         expectedMemberIds,
         completedMemberIds: [...completedMemberIds],
+        resolvedMemberIds: [...resolvedMemberIds],
+        resolutionsComplete,
+        conclusionValid,
         expectedCount: reconciliation?.status === "open" && !membershipFinal
           ? expectedMemberIds.length
           : reconciliation?.expectedCount ?? expectedMemberIds.length,
@@ -282,8 +300,20 @@ export function planObligations(resources, options = {}) {
     const completedMemberIds = (occurrence.members || [])
       .filter(({ disposition, result }) => disposition === "expected" && result === "passed")
       .map(({ resourceId }) => resourceId);
+    const resolvedMemberIds = (occurrence.members || [])
+      .filter((member) => occurrenceMemberIsResolved(member, occurrence, byId, (completionId) => {
+        const completion = byId.get(completionId);
+        return completionTypeMatches(completion, activity.completionResourceTypes)
+          && completionMatchesMember(completion, activity.aggregate?.completionMemberField, member.resourceId)
+          && completionFallsInWindow(completion, window, rule.timezone || workspace?.timezone || "UTC")
+          && completionPassesActivity(completion, activity);
+      }))
+      .map(({ resourceId }) => resourceId);
+    const resolutionsComplete = (occurrence.members || []).every(({ resourceId }) => resolvedMemberIds.includes(resourceId));
+    const conclusionValid = ["complete", "complete-with-exceptions", "zero-population"].includes(occurrence.conclusion)
+      && resolutionsComplete;
     const successful = occurrence.status === "reconciled"
-      && ["complete", "complete-with-exceptions", "zero-population"].includes(occurrence.conclusion);
+      && conclusionValid;
     const timingStatus = occurrenceStatus(window, asOf, successful);
     if (timingStatus === "complete" && !options.includeComplete) continue;
     calendarItems.push({
@@ -307,6 +337,9 @@ export function planObligations(resources, options = {}) {
       completionResourceIds: [...new Set((occurrence.members || []).flatMap(({ completionResourceIds = [] }) => completionResourceIds))],
       expectedMemberIds: (occurrence.members || []).map(({ resourceId }) => resourceId),
       completedMemberIds,
+      resolvedMemberIds,
+      resolutionsComplete,
+      conclusionValid,
       expectedCount: occurrence.expectedCount,
       completedCount: occurrence.completedCount,
       membershipFinal: true,
@@ -1750,8 +1783,8 @@ function plannedCompletionWindow(window) {
   };
 }
 
-function completionFallsInWindow(record, window) {
-  const date = completionDate(record);
+function completionFallsInWindow(record, window, timezone = "UTC") {
+  const date = completionDate(record, timezone);
   return Boolean(date && date >= window.dueWindowStart && date <= window.dueWindowEnd);
 }
 
@@ -1765,11 +1798,11 @@ function completionTypeMatches(record, expectedTypes = []) {
   return Boolean(record && (expectedTypes.length === 0 || expectedTypes.includes(record.type)));
 }
 
-function completionDate(record) {
+function completionDate(record, timezone = "UTC") {
   const coverageDate = coverageEnd(record.coverage);
   if (parseCalendarDate(coverageDate)) return coverageDate;
   for (const field of COMPLETION_TIMESTAMP_FIELDS) {
-    if (isRfc3339Timestamp(record[field])) return record[field].slice(0, 10);
+    if (isRfc3339Timestamp(record[field])) return currentCalendarDate(timezone, new Date(record[field]));
   }
   for (const field of COMPLETION_DATE_FIELDS) {
     if (parseCalendarDate(record[field])) return record[field];

package/src/program-path.js

@@ -111,7 +111,7 @@ export const PROGRAM_PATH = [
     summary: "Review and independently approve Policies, program Documents, Training content, and the Data Retention Schedule.",
     sections: [
       { id: "policy-content", title: "Policies", description: "Review every program Policy, Document, and Training record in one table, then bind independent approval to each exact revision.", steps: ["Review each governed Markdown artifact and replace every organization placeholder.", "Confirm the owner, separate approver, linked Controls, audience, and intended values that apply to each artifact.", "Record approval and its date against the exact revision. Leave approved content inactive until its Step 3 implementation cutover."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/policies" }], defaultOpen: true },
-      { id: "retention", title: "Data Retention Schedule", description: "Approve the schedule document and its structured rows as one governed schedule.", steps: ["Review the schedule policy, legal holds, exceptions, and disposal requirements.", "Define rows only for Information Types and operational sources the organization actually uses.", "Confirm the complete document-and-row revision with one schedule review."], types: [], utility: "retention-schedule", defaultOpen: true }
+      { id: "retention", title: "Data Retention Schedule", description: "Complete each row proposal, then approve the document and all proposed rows once.", steps: ["Review the schedule policy, legal holds, exceptions, and disposal requirements.", "Have the owner finish each row for the Information Types and operational sources the organization actually uses.", "Trigger one independent approval only after the document and every row proposal are complete."], types: [], utility: "retention-schedule", defaultOpen: true }
     ],
     resourceTypes: [],
     supportingResourceTypes: ["policy", "document", "training", "retention-schedule-item"],

package/src/program-readiness.js

@@ -98,11 +98,17 @@ function calculateSetupActionProgress(stages, target, windowMilestoneComplete) {
   const units = new Map();
   for (const currentStage of stages.filter(({ id }) => id !== "operation")) {
     for (const current of currentStage.items || []) {
-      if (["info", "later"].includes(current.status) || current.progressUnit === false) continue;
-      const key = `${currentStage.id}:${current.progressUnitId || current.id}`;
-      const existing = units.get(key);
-      if (!existing || existing.status === "complete" && current.status !== "complete") {
-        units.set(key, current);
+      if (current.progressUnit === false) continue;
+      const candidates = current.progressUnits?.length
+        ? current.progressUnits
+        : [current];
+      for (const candidate of candidates) {
+        if (["info", "later"].includes(candidate.status) || candidate.progressUnit === false) continue;
+        const key = `${currentStage.id}:${candidate.progressUnitId || current.progressUnitId || candidate.id || current.id}`;
+        const existing = units.get(key);
+        if (!existing || existing.status === "complete" && candidate.status !== "complete") {
+          units.set(key, candidate);
+        }
       }
     }
   }
@@ -154,13 +160,24 @@ export async function assessProgramReadiness(input, options = {}) {
     .map(collectionReviewReadinessItem));
   const sourceStage = await evidenceSourcesStage(scope, byId, loaded.model, readMarkdown);
   controlStage.items.push(...sourceStage.items);
+  const retentionScheduleReview = collectionReviews.find(({ resourceType }) => resourceType === "retention-schedule-item");
   const retentionItems = await assessRetentionReadiness(loaded, program, {
-    informationTypesReviewed: collectionReviews.find(({ resourceType }) => resourceType === "information-type")?.complete === true
+    informationTypesReviewed: collectionReviews.find(({ resourceType }) => resourceType === "information-type")?.complete === true,
+    scheduleApproved: retentionScheduleReview?.complete === true
   });
-  const retentionReviewItems = collectionReviews
-    .filter(({ resourceType }) => resourceType === "retention-schedule-item")
-    .map(collectionReviewReadinessItem);
+  const retentionReviewItems = retentionScheduleReview
+    ? [collectionReviewReadinessItem(retentionScheduleReview)]
+    : [];
   if (modelSupports(loaded.model, "retention-schedule-approval")) {
+    const scheduleDocumentIds = new Set(records.filter((record) => (
+      record.type === "document"
+      && record.documentKind === "schedule"
+      && record.workflowScope === "program"
+      && !["superseded", "retired"].includes(record.status)
+    )).map(({ id }) => id));
+    policyStage.items = policyStage.items.filter(({ id }) => (
+      ![...scheduleDocumentIds].some((documentId) => id === `document-approval-${documentId}`)
+    ));
     policyStage.items.push(...retentionItems.filter(({ id }) => !id.startsWith("retention-source-coverage-")));
     controlStage.items.push(...retentionItems.filter(({ id }) => id.startsWith("retention-source-coverage-")));
     policyStage.items.push(...retentionReviewItems);
@@ -395,7 +412,10 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
         ? `${completeComponents.length} of ${scope.components.length} Components have an active, owned, rationalized role in the selected Systems.`
         : "No Components are selected. This is valid only when the bounded Systems do not rely on a separately managed service-delivery, Control-support, evidence-source, or supporting-operations building block.",
       scope.components[0] || { type: "component" },
-      { componentIds: scope.components.map(({ id }) => id) }
+      {
+        componentIds: scope.components.map(({ id }) => id),
+        progressUnit: false
+      }
     ));
   }
 
@@ -562,7 +582,7 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   return stage("scope", "Define Scope", "Set program ownership, the management objective, service boundary, criteria, controls, and dependencies.", items);
 }
 
-function reportingRouteSetItem(assessment) {
+export function reportingRouteSetItem(assessment) {
   const current = assessment.routeSets.find(({ effective, canceled }) => effective && !canceled);
   const draft = assessment.routeSets.find(({ record }) => ["draft", "proposed"].includes(record.status));
   const required = assessment.requirements.length > 0;
@@ -571,13 +591,18 @@ function reportingRouteSetItem(assessment) {
     .map(({ purposeKey }) => purposeKey)
     .filter(Boolean))];
   const preparedPurposeKeys = new Set(assessment.routeSets
-    .filter(({ record, committed, canceled, proposedRequirementIssues }) => (
-      ["proposed", "approved"].includes(record.status)
+    .filter(({ record, committed, effective, canceled, proposedRequirementIssues }) => (
+      (["proposed", "approved"].includes(record.status) || effective)
       && committed
       && !canceled
       && proposedRequirementIssues.length === 0
     ))
     .map(({ record }) => record.purposeKey));
+  const requiredPurposeKeys = new Set(assessment.requirements.map(({ purposeKey }) => purposeKey).filter(Boolean));
+  const purposeKeys = [...new Set([
+    ...requiredPurposeKeys,
+    ...proposedPurposeKeys
+  ])];
   const unpreparedPurposeKeys = proposedPurposeKeys.filter((purposeKey) => !preparedPurposeKeys.has(purposeKey));
   const ready = assessment.issues.length === 0
     && (!required || Boolean(current))
@@ -612,6 +637,42 @@ function reportingRouteSetItem(assessment) {
       proposedRequirementIssues: assessment.routeSets.flatMap(({ proposedRequirementIssues }) => proposedRequirementIssues),
       unpreparedPurposeKeys,
       issues: assessment.issues,
+      progressUnits: purposeKeys.flatMap((purposeKey) => {
+        const purposeResourceIds = new Set([
+          ...assessment.routeSets.filter(({ record }) => record.purposeKey === purposeKey).map(({ record }) => record.id),
+          ...assessment.requirements.filter((requirement) => requirement.purposeKey === purposeKey).map(({ sourceId }) => sourceId),
+          ...assessment.proposedRequirements.filter((requirement) => requirement.purposeKey === purposeKey).map(({ sourceId }) => sourceId)
+        ].filter(Boolean));
+        const purposeIssues = assessment.issues.filter(({ resourceId }) => (
+          resourceId === assessment.programId || purposeResourceIds.has(resourceId)
+        ));
+        const approvedSet = assessment.routeSets.find(({ record, effective, canceled }) => (
+          record.purposeKey === purposeKey && effective && !canceled
+        ));
+        const proposedSet = assessment.routeSets.find(({ record, effective, canceled }) => (
+          record.purposeKey === purposeKey
+          && !canceled
+          && (effective || ["proposed", "approved"].includes(record.status))
+        ));
+        const proposalComplete = Boolean(
+          (approvedSet || proposedSet?.committed)
+          && proposedSet?.proposedRequirementIssues.length === 0
+        );
+        return [
+          {
+            id: `reporting-route-proposal-${purposeKey}`,
+            status: proposalComplete ? "complete" : "action",
+            title: `${proposedSet?.record.title || purposeKey} proposal`
+          },
+          {
+            id: `reporting-route-approval-${purposeKey}`,
+            status: approvedSet && purposeIssues.length === 0
+              ? "complete"
+              : requiredPurposeKeys.has(purposeKey) ? "action" : "later",
+            title: `${proposedSet?.record.title || purposeKey} approval`
+          }
+        ];
+      }),
       commands: [
         "npx filegrc reporting-route-sets --json",
         "npx filegrc reporting-route-set --scaffold"
@@ -646,10 +707,34 @@ function reportingRouteItem(records, byId, asOf, timezone = "UTC") {
   );
 }
 
-function collectionReviewReadinessItem(assessment) {
+export function collectionReviewReadinessItem(assessment) {
+  const proposalUnits = (assessment.recordProposals || []).map((proposal) => ({
+    id: `${assessment.resourceType}-proposal-${proposal.resourceId}`,
+    status: proposal.complete ? "complete" : "action",
+    title: `${proposal.title} proposal`
+  }));
+  const proposalBatchComplete = proposalUnits.every(({ status }) => status === "complete");
+  const scheduleApprovalBlocked = assessment.resourceType === "retention-schedule-item"
+    && proposalUnits.some(({ status }) => status !== "complete");
+  const batchProgressUnits = assessment.resourceType !== "retention-schedule-item" && proposalUnits.length
+    ? [
+        {
+          id: `${assessment.resourceType}-proposal-batch`,
+          status: proposalBatchComplete ? "complete" : "action",
+          title: `${assessment.configuration.title} proposals`
+        },
+        {
+          id: `${assessment.resourceType}-collection-review`,
+          status: proposalBatchComplete
+            ? assessment.complete ? "complete" : "action"
+            : "blocked",
+          title: `${assessment.configuration.title} collection review`
+        }
+      ]
+    : null;
   return item(
     `collection-review-${assessment.resourceType}`,
-    assessment.complete ? "complete" : "action",
+    assessment.complete ? "complete" : scheduleApprovalBlocked ? "blocked" : "action",
     assessment.status === "stale"
       ? `Review ${assessment.configuration.title.toLowerCase()} again`
       : `Review ${assessment.configuration.title.toLowerCase()}`,
@@ -658,6 +743,7 @@ function collectionReviewReadinessItem(assessment) {
     {
       resourceType: assessment.resourceType,
       reviewPoints: assessment.configuration.reviewPoints,
+      ...(batchProgressUnits ? { progressUnits: batchProgressUnits } : {}),
       commands: [
         `npx filegrc review-collection ${assessment.resourceType} --scaffold`,
         `npx filegrc review-collection ${assessment.resourceType} REVIEW.json --preview --json`
@@ -1568,6 +1654,7 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
         : `${coveredControls.length} of ${family.controls.length} selected controls have an active authoritative ${componentSources ? "Component" : "System"} with the required source role, access owners, and extraction instructions.`,
       completeSources[0] || selectedSources[0] || { type: sourceType },
       {
+        progressUnit: false,
         familyId: family.id,
         sourceKinds: family.sourceKinds,
         controlIds: family.controls.map((control) => control.id),