filegrc 0.16.0 → 0.16.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/applicability-scope.js

@@ -207,7 +207,7 @@ function canonicalFieldValue(model, value, field, name, revisionMap = false) {
       : value;
   }
   return typeof value === "string" && (revisionMap || CALCULATED_REVISION_FIELDS.has(name))
-    ? canonicalCalculatedRevision(value)
+    ? canonicalCalculatedRevision(value, name)
     : value;
 }
 

package/src/cli.js

@@ -1846,7 +1846,11 @@ function buildProgramPathResult(model, readiness, auditReadiness) {
       nextActions: (current?.items || []).filter((item) => item.status === "action")
     };
   });
-  const currentStep = stages.find((stage) => !["complete", "operating", "management-ready"].includes(stage.status)) || stages.at(-1);
+  const recommendedStage = readiness.stages.find((stage) => stage.items.includes(readiness.firstAction));
+  const recommendedId = recommendedStage?.id === "operation" ? "run" : recommendedStage?.id;
+  const currentStep = stages.find(({ id }) => id === recommendedId)
+    || stages.find((stage) => !["complete", "operating", "management-ready"].includes(stage.status))
+    || stages.at(-1);
   return {
     schemaVersion: 1,
     dataModelVersion: String(model.modelVersion),

package/src/collection-review-integrity.js

@@ -1,5 +1,5 @@
 import { loadModel } from "../model/index.js";
-import { collectionRevision } from "./collection-revision.js";
+import { collectionRevision, collectionRevisionMatches } from "./collection-revision.js";
 import { scopedCollectionRecords } from "./collection-scope.js";
 import { getDataFilesAtRevision, getFileAtRevision, getRecordIdentityHistory, hasGitRevision } from "./git.js";
 import { currentCalendarDate, isRfc3339Timestamp } from "./time.js";
@@ -70,7 +70,11 @@ export function historicalCollectionReviewSnapshot(root, record, model, timezone
     authoritativeSourceId: record.authoritativeComponentId
   });
   if (
-    !revisionsMatch("collection", record.collectionRevision, currentRevision)
+    !collectionRevisionMatches(snapshot, resourceType, record.collectionRevision, {
+      program,
+      authoritativeSourceId: record.authoritativeComponentId,
+      currentRevision
+    })
     || JSON.stringify([...(record.populationResourceIds || [])].sort()) !== JSON.stringify(collectionIds)
   ) return null;
   const selectedIds = selector

package/src/collection-revision.js

@@ -12,25 +12,37 @@ import { markdownEntries } from "./resource-markdown.js";
 import { CALCULATED_REVISION_FIELDS, CALCULATED_REVISION_MAP_FIELDS, calculateRevision, canonicalCalculatedRevision, revisionsMatch } from "./revisions.js";
 
 export function collectionRevision(loaded, resourceType, options = {}) {
-  return calculateCollectionRevision(loaded, resourceType, options, false);
+  return calculateCollectionRevision(loaded, resourceType, options, false, options.scopeHashInput || "legacy", options.scopeFactsInput || "legacy");
 }
 
 export function legacyCollectionRevision(loaded, resourceType, options = {}) {
-  return calculateCollectionRevision(loaded, resourceType, options, true);
+  return calculateCollectionRevision(loaded, resourceType, options, true, options.scopeHashInput || "legacy", options.scopeFactsInput || "legacy");
 }
 
 export function collectionRevisionMatches(loaded, resourceType, storedRevision, options = {}) {
   if (!storedRevision) return false;
   const currentRevision = options.currentRevision
     || collectionRevision(loaded, resourceType, options);
-  // Version 0.9.2 narrowed this hash basis. Keep unchanged 0.9.1 reviews valid
-  // until management records a new review on the current basis.
-  return revisionsMatch("collection", storedRevision, currentRevision)
-    || (resourceType !== "retention-schedule-item" || !modelSupports(loaded.model, "retention-schedule-approval"))
-      && revisionsMatch("collection", storedRevision, legacyCollectionRevision(loaded, resourceType, options));
+  // Accept both the pre-0.16 scope: input and the digest-only input used by
+  // 0.16.0, as well as the older collection basis from 0.9.1.
+  if (revisionsMatch("collection", storedRevision, currentRevision)) return true;
+  const allowOlderBasis = resourceType !== "retention-schedule-item"
+    || !modelSupports(loaded.model, "retention-schedule-approval");
+  for (const olderBasis of [false, true]) {
+    if (olderBasis && !allowOlderBasis) continue;
+    for (const scopeHashInput of ["legacy", "digest"]) {
+      for (const scopeFactsInput of ["legacy", "source"]) {
+        if (!olderBasis && scopeHashInput === "legacy" && scopeFactsInput === "legacy") continue;
+        if (revisionsMatch("collection", storedRevision, calculateCollectionRevision(
+          loaded, resourceType, options, olderBasis, scopeHashInput, scopeFactsInput
+        ))) return true;
+      }
+    }
+  }
+  return false;
 }
 
-function calculateCollectionRevision(loaded, resourceType, options, legacy) {
+function calculateCollectionRevision(loaded, resourceType, options, legacy, scopeHashInput = "legacy", scopeFactsInput = "legacy") {
   const workspaceWideRetentionReview = resourceType === "retention-schedule-item"
     && modelSupports(loaded.model, "retention-schedule-approval")
     && !legacy;
@@ -55,7 +67,7 @@ function calculateCollectionRevision(loaded, resourceType, options, legacy) {
     .map(({ record, value, includeContent }) => ({
       id: record.id,
       revision: createHash("sha256")
-        .update(JSON.stringify(canonicalRecordValue(loaded.model, record.type, value)))
+        .update(JSON.stringify(canonicalRecordValue(loaded.model, record.type, value, scopeHashInput)))
         .digest("hex"),
       contentRevisions: (legacy || includeContent ? markdownEntries(loaded.model, record) : []).flatMap(({ path }) => {
         try {
@@ -68,35 +80,46 @@ function calculateCollectionRevision(loaded, resourceType, options, legacy) {
       })
     }))
     .sort((left, right) => left.id.localeCompare(right.id));
-  const workspaceScope = collectionScopeRevisionFacts(loaded, resourceType, program);
+  const scopeFacts = collectionScopeRevisionFacts(loaded, resourceType, program);
+  const workspaceScope = scopeFactsInput === "source" ? scopeFacts : canonicalScopeFacts(scopeFacts);
   const source = JSON.stringify({ resourceType, records, workspaceScope });
   return legacy
     ? createHash("sha256").update(source).digest("hex")
     : calculateRevision("collection", source);
 }
 
-function canonicalRecordValue(model, resourceType, value) {
+function canonicalScopeFacts(value, field = null) {
+  if (Array.isArray(value)) return value.map((item) => canonicalScopeFacts(item));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, canonicalScopeFacts(item, key)]));
+  }
+  return field === "scopeRevision" && typeof value === "string"
+    ? canonicalCalculatedRevision(value, field)
+    : value;
+}
+
+function canonicalRecordValue(model, resourceType, value, scopeHashInput) {
   const fields = {
     ...model.commonFields,
     ...model.resources[resourceType]?.fields
   };
-  return canonicalObject(model, value, fields);
+  return canonicalObject(model, value, fields, false, scopeHashInput);
 }
 
-function canonicalObject(model, value, fields = {}, revisionMap = false) {
+function canonicalObject(model, value, fields = {}, revisionMap = false, scopeHashInput = "legacy") {
   return Object.fromEntries(Object.keys(value).sort().map((name) => [
     name,
-    canonicalFieldValue(model, value[name], fields[name], name, revisionMap)
+    canonicalFieldValue(model, value[name], fields[name], name, revisionMap, scopeHashInput)
   ]));
 }
 
-function canonicalFieldValue(model, value, field, name, revisionMap = false) {
+function canonicalFieldValue(model, value, field, name, revisionMap = false, scopeHashInput = "legacy") {
   if (Array.isArray(value)) {
     const objectType = field?.itemObjectType;
     const itemFields = objectType ? model.objectTypes?.[objectType]?.properties : undefined;
     const items = value.map((item) => (
       item && typeof item === "object" && !Array.isArray(item)
-        ? canonicalObject(model, item, itemFields)
+        ? canonicalObject(model, item, itemFields, false, scopeHashInput)
         : item
     ));
     return field?.type === "array"
@@ -105,10 +128,10 @@ function canonicalFieldValue(model, value, field, name, revisionMap = false) {
   }
   if (value && typeof value === "object") {
     const objectType = field?.objectType;
-    return canonicalObject(model, value, objectType ? model.objectTypes?.[objectType]?.properties : undefined, CALCULATED_REVISION_MAP_FIELDS.has(name));
+    return canonicalObject(model, value, objectType ? model.objectTypes?.[objectType]?.properties : undefined, CALCULATED_REVISION_MAP_FIELDS.has(name), scopeHashInput);
   }
   return typeof value === "string" && (revisionMap || CALCULATED_REVISION_FIELDS.has(name))
-    ? canonicalCalculatedRevision(value)
+    ? canonicalCalculatedRevision(value, name, scopeHashInput)
     : value;
 }
 

package/src/collection-scope.js

@@ -65,6 +65,24 @@ export function scopedCollectionRecords(loaded, resourceType, program) {
   ));
 }
 
+// These records can change which members enter a collection even when they
+// are not part of its current revision inputs yet.
+const COLLECTION_MEMBERSHIP_SOURCES = {
+  person: ["workspace", "program", "appointment", "team", "system", "component", "vendor", "control", "policy", "document", "obligation"],
+  vendor: ["program", "system", "component", "audit"],
+  component: ["program", "system", "control"],
+  "complementary-control": ["program", "system", "component", "control"],
+  "information-type": ["program", "system", "component", "vendor"],
+  "retention-schedule-item": ["program", "system", "component", "vendor", "control", "information-type", "source-coverage"],
+  framework: ["program"],
+  system: ["program"],
+  control: ["program"]
+};
+
+export function collectionMembershipSourceTypes(resourceType) {
+  return COLLECTION_MEMBERSHIP_SOURCES[resourceType] || [];
+}
+
 export function retentionScheduleReviewScope(loaded) {
   const programs = loaded.resources.filter((record) => (
     record.type === "program" && record.status !== "retired"

package/src/program-amendment.js

@@ -1,5 +1,5 @@
 import { findResourceReferences } from "./agent.js";
-import { resourceReviewRevision, resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
+import { resourceReviewRevision, resourceReviewRevisionMatches, resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { loadWorkspace } from "./workspace.js";
 
 const SOURCE_TYPES = new Set(["policy", "document", "framework", "requirement", "commitment"]);
@@ -114,7 +114,8 @@ export async function planProgramAmendment(input, options = {}) {
     && reviewBindingsDiffer(
       [...new Set([...(record.sourceResourceIds || []), ...(record.targetResourceIds || [])])],
       record.reviewedSourceRevisions,
-      currentReviewRevisions
+      currentReviewRevisions,
+      loaded
     )
   ));
   if (staleMappings.length) {
@@ -127,7 +128,7 @@ export async function planProgramAmendment(input, options = {}) {
   const retention = related.filter((record) => (
     record.type === "retention-schedule-item"
     && record.status === "active"
-    && reviewBindingsDiffer(retentionReviewResourceIds(record, loaded), record.reviewedSourceRevisions, currentReviewRevisions)
+    && reviewBindingsDiffer(retentionReviewResourceIds(record, loaded), record.reviewedSourceRevisions, currentReviewRevisions, loaded)
   ));
   if (retention.length) {
     missing.push({
@@ -160,10 +161,10 @@ export async function planProgramAmendment(input, options = {}) {
   };
 }
 
-function reviewBindingsDiffer(expectedIds, reviewed = {}, current) {
+function reviewBindingsDiffer(expectedIds, reviewed = {}, current, loaded) {
   const expected = new Set(expectedIds);
   if (Object.keys(reviewed).length !== expected.size) return true;
-  return [...expected].some((id) => !current.get(id) || reviewed[id] !== current.get(id));
+  return [...expected].some((id) => !resourceReviewRevisionMatches(loaded, current, id, reviewed[id]));
 }
 
 export async function assessProgramAmendmentReadiness(loaded) {

package/src/program-readiness.js

@@ -3,6 +3,7 @@ import { modelSupports } from "../model/index.js";
 import { applicabilityReviewIsCurrent } from "./applicability-scope.js";
 import { assessRequiredAppointments } from "./appointments.js";
 import { assessCollectionReviews } from "./collection-review.js";
+import { collectionMembershipSourceTypes, collectionRevisionInputs, collectionScopeRevisionFacts } from "./collection-scope.js";
 import { openPlaceholderCount, substantiveMarkdown } from "./content-readiness.js";
 import { coverageEnd, coverageStart } from "./coverage.js";
 import { planObligations } from "./obligations.js";
@@ -233,6 +234,7 @@ export async function assessProgramReadiness(input, options = {}) {
     policyStage,
     controlStage
   ];
+  const prioritizedSetupItems = prioritizeReviewDependencies(evidenceGateStages, loaded, program);
   for (const current of evidenceGateStages) finalizeStage(current);
   const evidenceReady = evidenceGateStages.every((current) => current.counts.action === 0);
   const stages = [
@@ -260,7 +262,8 @@ export async function assessProgramReadiness(input, options = {}) {
   const items = stages.flatMap((current) => current.items);
   const managedItems = items.filter((current) => !["info", "later"].includes(current.status));
   const complete = managedItems.filter((current) => current.status === "complete").length;
-  const firstAction = items.find((current) => current.status === "action") || null;
+  const firstAction = [...prioritizedSetupItems, ...stages.at(-1).items]
+    .find((current) => current.status === "action") || null;
   const target = {
     programId: program?.id || null,
     goal: program?.assuranceGoal || "none",
@@ -1966,6 +1969,50 @@ function finalizeStage(current) {
   current.status = current.counts.action ? "action" : current.counts.later ? "later" : "complete";
 }
 
+// A collection confirmation can be performed early, but an unfinished input
+// would make it stale again. Derive the ordering from the same revision inputs
+// used to decide whether that confirmation is current.
+export function prioritizeReviewDependencies(stages, loaded, program) {
+  const items = stages.flatMap(({ items }) => items);
+  const edges = new Map(items.map((_, index) => [index, new Set()]));
+  const indegree = items.map(() => 0);
+  for (const [reviewIndex, review] of items.entries()) {
+    if (review.status !== "action" || !review.id.startsWith("collection-review-")) continue;
+    const resourceType = review.id.slice("collection-review-".length);
+    if (!loaded.model.collectionReviews?.[resourceType]) continue;
+    const inputTypes = new Set(collectionRevisionInputs(loaded, resourceType, program)
+      .map(({ record }) => record.type));
+    for (const type of collectionMembershipSourceTypes(resourceType)) inputTypes.add(type);
+    const scopeFacts = collectionScopeRevisionFacts(loaded, resourceType, program);
+    if (Object.keys(scopeFacts).some((key) => key !== "programId")) inputTypes.add("program");
+    for (const key of Object.keys(scopeFacts)) {
+      if (!key.endsWith("Ids")) continue;
+      const type = key.slice(0, -3).replace(/([a-z])([A-Z])/g, "$1-$2").toLowerCase();
+      if (loaded.model.resources?.[type]) inputTypes.add(type);
+    }
+    for (const [sourceIndex, source] of items.entries()) {
+      if (sourceIndex === reviewIndex || source.status !== "action"
+        || source.id.startsWith("collection-review-")
+        || !inputTypes.has(source.resourceType)) continue;
+      edges.get(sourceIndex).add(reviewIndex);
+      indegree[reviewIndex]++;
+    }
+  }
+  const remaining = new Set(items.map((_, index) => index));
+  const ordered = [];
+  while (remaining.size) {
+    const next = [...remaining].find((index) => indegree[index] === 0);
+    if (next === undefined) break;
+    remaining.delete(next);
+    ordered.push(items[next]);
+    for (const dependent of edges.get(next)) indegree[dependent]--;
+  }
+  if (ordered.length !== items.length) return items;
+  const rank = new Map(ordered.map((item, index) => [item, index]));
+  for (const stage of stages) stage.items.sort((left, right) => rank.get(left) - rank.get(right));
+  return ordered;
+}
+
 function item(id, status, title, message, resource = {}, details = {}) {
   return {
     id,

package/src/requirement-mapping.js

@@ -1,5 +1,4 @@
-import { resourceReviewRevisions } from "./retention.js";
-import { revisionsMatch } from "./revisions.js";
+import { resourceReviewRevisionMatches, resourceReviewRevisions } from "./retention.js";
 
 export async function assessRequirementMappingReadiness(loaded) {
   if (!loaded.model.resources["requirement-mapping"]) return [];
@@ -18,7 +17,7 @@ export async function assessRequirementMappingReadiness(loaded) {
       ...(mapping.targetResourceIds || [])
     ])];
     const staleIds = mappedIds.filter((id) => (
-      !revisions.get(id) || !revisionsMatch("content", mapping.reviewedSourceRevisions?.[id], revisions.get(id))
+      !resourceReviewRevisionMatches(loaded, revisions, id, mapping.reviewedSourceRevisions?.[id])
     )).concat(Object.keys(mapping.reviewedSourceRevisions || {}).filter((id) => !mappedIds.includes(id)));
     const structurallyComplete = mappingStructureIsComplete(mapping);
     const complete = mapping.status === "active" && structurallyComplete && staleIds.length === 0;

package/src/retention.js

@@ -154,7 +154,7 @@ export async function resourceReviewRevision(loaded, resourceId) {
   return (await resourceReviewRevisions(loaded, [resourceId])).get(resourceId) || null;
 }
 
-export async function resourceReviewRevisions(loaded, ids) {
+export async function resourceReviewRevisions(loaded, ids, scopeHashInput = "legacy") {
   const wanted = new Set(ids);
   const entries = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
   const revisions = new Map();
@@ -164,7 +164,7 @@ export async function resourceReviewRevisions(loaded, ids) {
     const entry = entries.get(id);
     if (!entry || reviewing.has(id)) return null;
     reviewing.add(id);
-    const parts = [reviewSource(loaded, entry)];
+    const parts = [reviewSource(loaded, entry, scopeHashInput)];
     for (const markdown of markdownEntries(loaded.model, entry.record)) {
       try {
         parts.push(await readFile(resolveDataPath(loaded.root, markdown.path), "utf8"));
@@ -187,7 +187,7 @@ export async function resourceReviewRevisions(loaded, ids) {
   return new Map([...revisions].filter(([id]) => wanted.has(id)));
 }
 
-export function resourceReviewRevisionsSync(loaded, ids) {
+export function resourceReviewRevisionsSync(loaded, ids, scopeHashInput = "legacy") {
   const wanted = new Set(ids);
   const entries = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
   const revisions = new Map();
@@ -197,7 +197,7 @@ export function resourceReviewRevisionsSync(loaded, ids) {
     const entry = entries.get(id);
     if (!entry || reviewing.has(id)) return null;
     reviewing.add(id);
-    const parts = [reviewSource(loaded, entry)];
+    const parts = [reviewSource(loaded, entry, scopeHashInput)];
     for (const markdown of markdownEntries(loaded.model, entry.record)) {
       try {
         parts.push(readFileSync(resolveDataPath(loaded.root, markdown.path), "utf8"));
@@ -218,6 +218,16 @@ export function resourceReviewRevisionsSync(loaded, ids) {
   return new Map([...revisions].filter(([id]) => wanted.has(id)));
 }
 
+export function resourceReviewRevisionMatches(loaded, revisions, id, stored) {
+  const current = revisions.get(id);
+  if (!current || !revisionDigest("content", stored)) return false;
+  if (revisionsMatch("content", stored, current)) return true;
+  // Version 0.16.0 used a bare digest as the hash input for scopeRevision.
+  // Read that binding without changing the legacy scope: basis restored here.
+  const compatible = resourceReviewRevisionsSync(loaded, [id], "digest").get(id);
+  return revisionsMatch("content", stored, compatible);
+}
+
 export function retentionUses(loaded, program) {
   const systemIds = new Set(program.systemIds || []);
   const componentIds = new Set(programComponents(loaded, program).map(({ id }) => id));
@@ -239,7 +249,7 @@ export function retentionUses(loaded, program) {
   return [...new Map(uses.map((use) => [`${use.resource.id}:${use.informationTypeId}`, use])).values()];
 }
 
-function reviewSource(loaded, entry) {
+function reviewSource(loaded, entry, scopeHashInput = "legacy") {
   if (
     modelSupports(loaded.model, "retention-schedule-approval")
     && entry.record.type === "document"
@@ -261,7 +271,7 @@ function reviewSource(loaded, entry) {
     ]) delete approved[field];
     return JSON.stringify(approved);
   }
-  return canonicalCalculatedRevisionJson(entry.source);
+  return canonicalCalculatedRevisionJson(entry.source, scopeHashInput);
 }
 
 export function nearDuplicateInformationTypes(records) {
@@ -327,7 +337,7 @@ export function retentionRuleIsCurrent(rule, revisions, byId = new Map(), loaded
   const dependencyIds = retentionReviewResourceIds(rule, loaded);
   if (Object.keys(rule.reviewedSourceRevisions).length !== dependencyIds.length) return false;
   return dependencyIds.every((id) => (
-    revisions.get(id) && revisionsMatch("content", rule.reviewedSourceRevisions?.[id], revisions.get(id))
+    resourceReviewRevisionMatches(loaded, revisions, id, rule.reviewedSourceRevisions?.[id])
   ));
 }
 

package/src/revisions.js

@@ -59,8 +59,17 @@ export function calculatedRevisionDiagnostic(kind, stored, current) {
   };
 }
 
-export function canonicalCalculatedRevision(value) {
+export function canonicalCalculatedRevision(value, field = null, scopeHashInput = "legacy") {
   const text = String(value || "");
+  // Legacy applicability reviews stored their scope digest with a `scope:`
+  // label. Keep that exact hash input when a newer scheme labels the same
+  // decision, including when the review is embedded in another source record.
+  if (field === "scopeRevision" && scopeHashInput === "legacy") {
+    const scopeDigest = revisionDigest("applicability-scope", text);
+    if (scopeDigest && (text.startsWith("scope:") || text.startsWith(PREFIXES["applicability-scope"]))) {
+      return `scope:${scopeDigest}`;
+    }
+  }
   // Keep the original digest as the calculation input. Merely installing a
   // scheme-aware engine must not stale a decision made over unchanged facts.
   if (/^[a-f0-9]{64}$/.test(text)) return text;
@@ -71,22 +80,22 @@ export function canonicalCalculatedRevision(value) {
 
 // Preserve JSON layout because older resource-review bindings hashed the exact
 // source bytes. Only scheme labels in model-defined revision slots may change.
-export function canonicalCalculatedRevisionJson(source) {
+export function canonicalCalculatedRevisionJson(source, scopeHashInput = "legacy") {
   const fieldNames = [...CALCULATED_REVISION_FIELDS].join("|");
   const mapNames = [...CALCULATED_REVISION_MAP_FIELDS].join("|");
   const stringValue = /("(?:\\.|[^"\\])*")(\s*:\s*)("(?:\\.|[^"\\])*")/g;
-  const canonicalValue = (quoted) => {
+  const canonicalValue = (quoted, field) => {
     const value = JSON.parse(quoted);
-    const canonical = canonicalCalculatedRevision(value);
+    const canonical = canonicalCalculatedRevision(value, field, scopeHashInput);
     return canonical === value ? quoted : JSON.stringify(canonical);
   };
   return source
     .replace(new RegExp(`("(?:${fieldNames})")(\\s*:\\s*)("(?:\\\\.|[^"\\\\])*")`, "g"),
-      (_match, key, separator, value) => `${key}${separator}${canonicalValue(value)}`)
+      (_match, key, separator, value) => `${key}${separator}${canonicalValue(value, JSON.parse(key))}`)
     .replace(new RegExp(`("(?:${mapNames})")(\\s*:\\s*\\{)([^{}]*)(\\})`, "g"),
       (_match, key, opening, body, closing) => (
         `${key}${opening}${body.replace(stringValue, (_pair, name, separator, value) => (
-          `${name}${separator}${canonicalValue(value)}`
+          `${name}${separator}${canonicalValue(value, JSON.parse(name))}`
         ))}${closing}`
       ));
 }

package/src/validate.js

@@ -18,7 +18,7 @@ import {
   parseCalendarDate,
   validCalendarRecurrence
 } from "./recurrence.js";
-import { resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
+import { resourceReviewRevisionMatches, resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { retentionScheduleApprovalIssues } from "./retention-schedule-approval.js";
 import { obligationIsEnabled } from "./program-lifecycle.js";
 import { currentPartyPeople, partyPeople } from "./parties.js";
@@ -156,7 +156,7 @@ async function validateWorkspaceUnmeasured(input) {
       validateObligationOccurrence(record, loaded.model, loaded.resources, loaded.entries, loaded.root, loaded.workspace.timezone, byId, asOf, displayPath, diagnostics);
     }
     if (record.type === "retention-schedule-item") validateRetentionScheduleItem(record, loaded, byId, currentReviewRevisions, displayPath, diagnostics);
-    if (record.type === "requirement-mapping") validateRequirementMapping(record, currentReviewRevisions, displayPath, diagnostics);
+    if (record.type === "requirement-mapping") validateRequirementMapping(record, loaded, currentReviewRevisions, displayPath, diagnostics);
     if (record.type === "action-item") {
       validateCompletedObligationAction(record, byId, loaded.model, displayPath, diagnostics);
     }
@@ -1998,7 +1998,7 @@ function validateRetentionScheduleItem(record, loaded, byId, currentReviewRevisi
   const sources = retentionReviewResourceIds(record, loaded);
   const revisions = record.reviewedSourceRevisions || {};
   const missing = sources.filter((id) => (
-    !currentReviewRevisions.get(id) || !revisionsMatch("content", revisions[id], currentReviewRevisions.get(id))
+    !resourceReviewRevisionMatches(loaded, currentReviewRevisions, id, revisions[id])
   )).concat(Object.keys(revisions).filter((id) => !sources.includes(id)));
   if (missing.length) {
     diagnostics.push(error(
@@ -2009,7 +2009,7 @@ function validateRetentionScheduleItem(record, loaded, byId, currentReviewRevisi
   }
 }
 
-function validateRequirementMapping(record, currentReviewRevisions, path, diagnostics) {
+function validateRequirementMapping(record, loaded, currentReviewRevisions, path, diagnostics) {
   const overlap = (record.sourceResourceIds || []).filter((id) => (record.targetResourceIds || []).includes(id));
   if (overlap.length) {
     diagnostics.push(error(
@@ -2022,7 +2022,7 @@ function validateRequirementMapping(record, currentReviewRevisions, path, diagno
   const mappedIds = [...new Set([...(record.sourceResourceIds || []), ...(record.targetResourceIds || [])])];
   const revisions = record.reviewedSourceRevisions || {};
   const missing = mappedIds.filter((id) => (
-    !currentReviewRevisions.get(id) || !revisionsMatch("content", revisions[id], currentReviewRevisions.get(id))
+    !resourceReviewRevisionMatches(loaded, currentReviewRevisions, id, revisions[id])
   )).concat(Object.keys(revisions).filter((id) => !mappedIds.includes(id)));
   if (missing.length) {
     diagnostics.push(error(

package/src/web.js

@@ -589,6 +589,13 @@ function readinessOverview() {
 }
 
 function nextProgramStageHref() {
+  const firstAction = state.programReadiness?.firstAction;
+  const recommendedStage = state.programReadiness?.stages?.find((stage) => stage.items.some((item) => (
+    item.id === firstAction?.id && item.resourceId === firstAction?.resourceId
+  )));
+  if (recommendedStage) {
+    return "#/stage/" + encodeURIComponent(recommendedStage.id === "operation" ? "run" : recommendedStage.id);
+  }
   const nextStage = READINESS_STAGES.find((stage) => {
     const progress = stageProgress(stage);
     return progress.complete < progress.total;

package/src/workflow-history-integrity.js

@@ -836,7 +836,7 @@ function canonicalJson(value, field = null, revisionMap = false) {
   if (Array.isArray(value)) return value.map((item) => canonicalJson(item));
   if (!value || typeof value !== "object") {
     return typeof value === "string" && (revisionMap || CALCULATED_REVISION_FIELDS.has(field))
-      ? canonicalCalculatedRevision(value)
+      ? canonicalCalculatedRevision(value, field)
       : value;
   }
   return Object.fromEntries(Object.keys(value).sort().map((key) => [