filegrc 0.16.13 → 0.16.14

package/model/v11.json

@@ -657,9 +657,9 @@
     },
     "control": {
       "title": "Control implementation oversight",
-      "description": "After Step 3 implementation work is complete and before program content activation, confirm that the implemented Controls selected for the Program are ready to operate. Repeat the review after a material Control or Program scope change.",
+      "description": "After Step 3 implementation work is complete and before program content activation, confirm that the implemented Controls selected for the Program are ready to operate. Handle later changes through affected Controls, event work, and scheduled program reviews.",
       "reviewPoints": [
-        "Perform this one collection review after Controls, evidence sources, and Obligations are ready, before management activates the approved program content.",
+        "Perform this one setup review after Controls, evidence sources, and Obligations are ready, before management activates the approved program content.",
         "Confirm owners, procedures, scope, operation patterns, mappings, Obligations, and authoritative evidence sources remain current.",
         "Record follow-up work separately when the review finds a gap."
       ],
@@ -2875,7 +2875,7 @@
       "description": "Management's actual Control implementation, mapped to Requirements, bounded Systems, operating Components, and authoritative evidence-source Components.",
       "guidance": {
         "policyBasis": "Controls translate approved Policies and applicable Requirements into owned procedures that management can operate and prove. FileGRC does not infer technical implementation from policy prose. Configuration facts belong in Controls, Components, Systems, Obligations, and Evidence.",
-        "cadence": "A Control owner may mark the Control implemented after recording its actual procedure, bounded System scope, operation pattern, authoritative evidence-source Components, implementation date, and enabled calendar or event Obligations. Confirm each source Component is active, has the evidence role required by the Control family and current access owners, and includes repeatable retrieval instructions in Record Markdown. Enabled Obligations remain dormant until all governing content is active and effective. Review the implemented Control collection periodically and after material changes.",
+        "cadence": "A Control owner may mark the Control implemented after recording its actual procedure, bounded System scope, operation pattern, authoritative evidence-source Components, implementation date, and enabled calendar or event Obligations. Confirm each source Component is active, has the evidence role required by the Control family and current access owners, and includes repeatable retrieval instructions in Record Markdown. Enabled Obligations remain dormant until all governing content is active and effective. Review affected Controls after material changes and use scheduled program reviews for periodic oversight.",
         "reviewPoints": [
           "Confirm the Control is needed for the applicable Requirements, Commitments, and service boundary.",
           "Describe what people actually do to operate the Control.",
@@ -8669,7 +8669,7 @@
       "description": "A logical operational or technical building block that materially delivers a System, supports a Control, produces authoritative Evidence, or supports relevant operations.",
       "guidance": {
         "policyBasis": "System boundaries and Control implementations need explicit operational building blocks and evidence sources.",
-        "cadence": "Create only when the capability materially participates in an in-scope System. Review after architecture, provider, Control, evidence, access, or continuity changes.",
+        "cadence": "Create only when the capability materially participates in an in-scope System. After a change, inspect its System uses and affected Controls. If the change is material to risk, data use, evidence, access, or continuity, assess it through the relevant System change Policy Event and its linked work. Follow the scheduled policy and program reviews; do not repeat setup collection reviews.",
         "reviewPoints": [
           "Choose at least one role for each related System and explain why the Component matters there.",
           "Link a Vendor only when that external organization primarily supplies this Component.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.13",
+  "version": "0.16.14",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/applicability-scope.js

@@ -29,12 +29,48 @@ const unorderedStringArrayFields = new Set([
 
 const applicabilityDecisionFields = {
   requirement: ["frameworkId", "reference", "description", "parentRequirementId"],
+  control: ["statement", "requirementIds", "code", "systemIds"],
+  commitment: ["commitmentKind", "statement", "systemIds", "sourceResourceIds", "requirementIds", "controlIds", "customerFacing", "reportingRouteRequirements"],
+  "complementary-control": ["responsibleParty", "statement", "systemIds", "vendorId", "requirementIds", "commitmentIds", "relatedControlIds", "sourceDocumentIds"]
+};
+const legacyApplicabilityDecisionFields = {
+  requirement: applicabilityDecisionFields.requirement,
   control: ["statement", "requirementIds", "code", "activity", "controlType", "operationMode", "operationPattern", "systemIds", "policyIds", "componentIds", "evidenceSourceComponentIds"],
   commitment: ["commitmentKind", "statement", "systemIds", "sourceResourceIds", "requirementIds", "controlIds", "customerFacing", "reportingRouteRequirements"],
   "complementary-control": ["responsibleParty", "statement", "systemIds", "vendorId", "requirementIds", "commitmentIds", "relatedControlIds", "sourceDocumentIds", "componentIds"]
 };
 
 export function applicabilityScopeRevision(record, program, resources, model, options = {}) {
+  if (Number(model.modelVersion) >= 11 && !options.legacyDecisionScope) {
+    const linkedRequirements = resources.filter((candidate) => candidate.type === "requirement"
+      && (record.type === "requirement" ? candidate.id === record.id : (record.requirementIds || []).includes(candidate.id)));
+    const frameworkIds = new Set(linkedRequirements.map(({ frameworkId }) => frameworkId));
+    const scopedProgram = record.type === "requirement" ? {
+      ...program,
+      systemIds: [],
+      frameworkIds: (program?.frameworkIds || []).filter((id) => id === record.frameworkId),
+      requirementIds: (program?.requirementIds || []).filter((id) => id === record.id)
+    } : {
+      ...program,
+      systemIds: (program?.systemIds || []).filter((id) => (record.systemIds || []).includes(id)),
+      frameworkIds: (program?.frameworkIds || []).filter((id) => !frameworkIds.size || frameworkIds.has(id)),
+      requirementIds: (program?.requirementIds || []).filter((id) => linkedRequirements.some((candidate) => candidate.id === id))
+    };
+    const facts = {
+      modelVersion: model.modelVersion,
+      resource: applicabilityResourceFacts(record, model, options),
+      program: pick(scopedProgram || {}, ["id", "assuranceGoal", "systemIds", "frameworkIds", "requirementIds"], model, "program"),
+      requirements: linkedRequirements.sort(compareRecordIds).map((candidate) => pick(candidate,
+        ["id", "frameworkId", "reference", "description", "parentRequirementId"], model)),
+      frameworks: resources.filter(({ type, id }) => type === "framework" && frameworkIds.has(id))
+        .sort(compareRecordIds).map((candidate) => pick(candidate, ["id", "version", "status"], model)),
+      requirementDecisions: (record.type === "requirement" ? [] : program?.requirementApplicability || [])
+        .filter(({ requirementId }) => linkedRequirements.some(({ id }) => id === requirementId))
+        .map(({ requirementId, decision }) => ({ requirementId, decision }))
+        .sort((left, right) => left.requirementId.localeCompare(right.requirementId))
+    };
+    return calculateRevision("applicability-scope", stableJson(facts));
+  }
   const scopedResource = ["commitment", "control", "complementary-control"].includes(record?.type)
     && !options.legacyBroadScope && !options.legacyBroadCommitment;
   const linkedRequirementIds = new Set(record?.requirementIds || []);
@@ -204,10 +240,10 @@ function compareRecordIds(left, right) {
 
 function applicabilityResourceFacts(record, model, options) {
   const fields = Number(model.modelVersion) >= 11 && !options.legacyResourceProjection
-    ? applicabilityDecisionFields[record.type] : null;
+    ? (options.legacyDecisionScope ? legacyApplicabilityDecisionFields : applicabilityDecisionFields)[record.type] : null;
   if (!fields) return canonicalObject(model, record.type, Object.fromEntries(Object.entries(record)
     .filter(([field]) => !excludedResourceFields.has(field))));
-  const value = Object.fromEntries(["id", "type", "title", "externalIds", "extensions", ...fields]
+  const value = Object.fromEntries(["id", "type", ...(options.legacyDecisionScope ? ["title"] : []), "externalIds", "extensions", ...fields]
     .filter((field) => record[field] !== undefined).map((field) => [field, record[field]]));
   value.unavailable = ["not-applicable", "retired", "superseded"].includes(record.status);
   return canonicalObject(model, record.type, value);
@@ -226,10 +262,15 @@ export function applicabilityReviewIsCurrent(review, record, program, resources,
   if (Number(model.modelVersion) >= 11 && ["retired", "superseded"].includes(record?.status)) return false;
   const matches = (revision) => revisionsMatch("applicability-scope", review.scopeRevision, revision);
   if (matches(applicabilityScopeRevision(record, program, resources, model))) return true;
+  if (Number(model.modelVersion) >= 11 && matches(applicabilityScopeRevision(record, program, resources, model, {
+    legacyDecisionScope: true
+  }))) return true;
+  if (Number(model.modelVersion) >= 11 && applicabilityDecisionFields[record?.type]
+    && matches(applicabilityScopeRevision(record, program, resources, model, { legacyDecisionScope: true, legacyResourceProjection: true }))) return true;
   if (Number(model.modelVersion) >= 11 && applicabilityDecisionFields[record?.type]
     && matches(applicabilityScopeRevision(record, program, resources, model, { legacyResourceProjection: true }))) return true;
   if (["commitment", "control", "complementary-control"].includes(record?.type) && matches(applicabilityScopeRevision(
-    record, program, resources, model, { legacyBroadScope: true }
+    record, program, resources, model, { legacyDecisionScope: true, legacyBroadScope: true }
   ))) return true;
   if (Number(model.modelVersion) >= 11 && applicabilityDecisionFields[record?.type] && root && historicalScopedReviewMatches(
     review.scopeRevision, record, program, resources, model, root
@@ -242,6 +283,7 @@ export function applicabilityReviewIsCurrent(review, record, program, resources,
       for (const legacyPolicyWithoutEffectiveOn of [false, true]) {
         if (matches(applicabilityScopeRevision(record, program, resources, model, {
           legacyPolicyStatus,
+          legacyDecisionScope: true,
           legacyPolicyWithoutApprovalBinding,
           legacyPolicyWithoutEffectiveOn
         }))) return true;
@@ -260,7 +302,8 @@ export function applicabilityReviewIsCurrent(review, record, program, resources,
   for (const policy of policies) {
     for (const value of legacyPolicyAlternatives(policy)) {
       if (matches(applicabilityScopeRevision(record, program, resources, model, {
-        legacyPolicyOverrides: { [policy.id]: value }
+        legacyPolicyOverrides: { [policy.id]: value },
+        legacyDecisionScope: true
       }))) return true;
     }
   }
@@ -285,12 +328,14 @@ function historicalScopedReviewMatches(stored, record, program, resources, model
     if (!revisionsMatch("applicability-scope", current, applicabilityScopeRevision(
       historicalRecord, historicalProgram, historicalResources, historicalModel
     ))) continue;
-    for (const legacyBroadScope of [false, true]) {
-      for (const legacyResourceProjection of [false, true]) {
-        if (revisionsMatch("applicability-scope", stored, applicabilityScopeRevision(
-          historicalRecord, historicalProgram, historicalResources, historicalModel,
-          { legacyBroadScope, legacyResourceProjection }
-        ))) return true;
+    for (const legacyDecisionScope of [false, true]) {
+      for (const legacyBroadScope of [false, true]) {
+        for (const legacyResourceProjection of [false, true]) {
+          if (revisionsMatch("applicability-scope", stored, applicabilityScopeRevision(
+            historicalRecord, historicalProgram, historicalResources, historicalModel,
+            { legacyDecisionScope, legacyBroadScope, legacyResourceProjection }
+          ))) return true;
+        }
       }
     }
   }

package/src/audit-preparation.js

@@ -690,18 +690,24 @@ function scopeRecordsChangedSinceRevision(loaded, audit, historicalAudit) {
       historical = null;
     }
     if (
-      !scopeRecordIsRelevant(current, audit)
-      && !scopeRecordIsRelevant(historical, historicalAudit)
+      !scopeRecordIsRelevant(current, audit, loaded)
+      && !scopeRecordIsRelevant(historical, historicalAudit, loaded)
     ) continue;
-    if (JSON.stringify(canonicalScopeValue(current)) !== JSON.stringify(canonicalScopeValue(historical))) changed.push(path);
+    if (JSON.stringify(canonicalScopeValue(auditScopeRecordValue(current)))
+      !== JSON.stringify(canonicalScopeValue(auditScopeRecordValue(historical)))) changed.push(path);
   }
   return changed;
 }
 
-function scopeRecordIsRelevant(record, audit) {
+function scopeRecordIsRelevant(record, audit, loaded) {
   if (!record || !audit) return false;
   const selectedSystemIds = new Set(audit.systemIds || []);
-  const selectedFrameworkIds = new Set(audit.frameworkIds || []);
+  if (["commitment", "complementary-control"].includes(record.type)
+    && (record.systemIds || []).some((id) => selectedSystemIds.has(id))) return true;
+  if (record.type === "requirement" && (audit.frameworkIds || []).includes(record.frameworkId)) return true;
+  if (record.type === "component" && (record.systemUses || []).some(({ systemId, roles }) => (
+    selectedSystemIds.has(systemId) && (roles || []).includes("service-delivery")
+  ))) return true;
   const selectedIds = new Set([
     audit.programId,
     ...(audit.frameworkIds || []),
@@ -714,15 +720,36 @@ function scopeRecordIsRelevant(record, audit) {
     ...auditSubserviceVendorIds(audit),
     ...auditSubserviceComponentIds(audit)
   ].filter(Boolean));
-  if (selectedIds.has(record.id)) return true;
-  if (record.type === "requirement") return selectedFrameworkIds.has(record.frameworkId);
-  if (["commitment", "complementary-control"].includes(record.type)) {
-    return (record.systemIds || []).some((id) => selectedSystemIds.has(id));
+  const selectedControls = new Set(audit.controlIds || []);
+  for (const control of loaded.resources.filter(({ type, id }) => type === "control" && selectedControls.has(id))) {
+    for (const id of control.evidenceSourceComponentIds || []) selectedIds.add(id);
   }
-  if (record.type === "component") {
-    return (record.systemUses || []).some(({ systemId }) => selectedSystemIds.has(systemId));
-  }
-  return false;
+  return selectedIds.has(record.id);
+}
+
+const AUDIT_SCOPE_RECORD_FIELDS = {
+  program: ["id", "status", "assuranceGoal"],
+  framework: ["id", "version", "status", "publisher", "sourceReference", "effectiveOn", "retiredOn"],
+  requirement: ["id", "frameworkId", "reference", "description", "parentRequirementId"],
+  system: ["id", "status", "purpose", "servicesProvided", "boundary", "exclusions", "criticality", "ownerIds", "informationTypeIds", "classificationId", "internetExposed", "continuityObjectives"],
+  control: ["id", "status", "statement", "requirementIds", "code", "activity", "controlType", "systemIds", "ownerIds", "effectiveOn", "retiredOn", "operationMode", "operationPattern", "componentIds", "evidenceSourceComponentIds", "policyIds", "procedureRevision", "procedureEffectiveOn"],
+  commitment: ["id", "status", "commitmentKind", "statement", "systemIds", "requirementIds", "controlIds", "customerFacing", "sourceResourceIds", "effectiveOn", "ownerIds", "reportingRouteRequirements"],
+  "complementary-control": ["id", "status", "statement", "systemIds", "relatedControlIds", "responsibleParty", "vendorId", "componentIds", "commitmentIds", "sourceDocumentIds", "requirementIds", "effectiveOn"],
+  component: ["id", "status", "componentKind", "description", "environment", "vendorId", "systemUses", "informationUses", "evidenceSourceKinds", "ownerIds", "evidenceOwnerIds", "criticality", "classificationId", "internetExposed", "continuityObjectives"],
+  vendor: ["id", "category", "status", "criticality", "classificationId", "informationTypeIds", "standardAgreement", "agreementDocumentId", "startDate", "endDate"],
+  appointment: ["id", "status", "appointmentKind", "holderId", "scopeResourceIds", "startsOn", "endsOn"]
+};
+
+function auditScopeRecordValue(record) {
+  if (!record) return null;
+  const fields = AUDIT_SCOPE_RECORD_FIELDS[record.type] || ["id", "type", "status"];
+  return {
+    ...Object.fromEntries(fields.filter((field) => record[field] !== undefined)
+      .map((field) => [field, record[field]])),
+    ...(["control", "commitment", "complementary-control"].includes(record.type)
+      ? { unavailable: ["not-applicable", "retired", "superseded"].includes(record.status) }
+      : {})
+  };
 }
 
 function auditSubserviceVendorIds(audit) {

package/src/collection-review.js

@@ -2,7 +2,8 @@ import { readFile } from "node:fs/promises";
 import { modelSupports } from "../model/index.js";
 import {
   collectionRevision,
-  collectionRevisionMatches
+  collectionReviewDecisionMatches,
+  reviewedControlConflictIds
 } from "./collection-revision.js";
 import { collectionRecordProposals, retentionScheduleReviewScope, scopedCollectionRecords } from "./collection-scope.js";
 import { applyResourceBatch, applyRetentionScheduleReviewBatch, contentRevision, INTERNAL_WORKFLOW_CAPABILITIES } from "./files.js";
@@ -62,15 +63,17 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
     && review.coverage.on === review.reviewedOn
     && review.knowledgeCutoffAt
     && Array.isArray(review.populationResourceIds)
-    && sameIds(review.populationResourceIds, records.map(({ id }) => id))
+    && (resourceType !== "retention-schedule-item" && Number(loaded.model.modelVersion) >= 11
+      || sameIds(review.populationResourceIds, records.map(({ id }) => id)))
   );
   const allowsEmptyCollection = allowedDecisions.some((decision) => (
     decision === "zero-population" || decision === "externally-managed"
   ));
-  const revisionMatches = collectionRevisionMatches(
+  const revisionMatches = collectionReviewDecisionMatches(
     loaded,
     resourceType,
-    review?.collectionRevision,
+    review,
+    records,
     {
       programId: program.id,
       authoritativeSourceId,
@@ -92,11 +95,14 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
     : [];
   const recordProposals = collectionRecordProposals(loaded, resourceType, records, program);
   const incompleteRecordProposals = recordProposals.filter(({ complete: ready }) => !ready);
+  const reviewerConflicts = resourceType === "control" && Number(loaded.model.modelVersion) >= 11 && review
+    ? reviewedControlConflictIds(loaded, review)
+    : reviewerEligibility?.reviewerConflictIds || [];
   const reviewersEligible = !reviewerEligibility || Boolean(
     review?.reviewedByIds?.length
     && review.reviewedByIds.every((id) => (
       personWasActiveOn(loaded.resources.find((record) => record.id === id), review.reviewedOn)
-      && !reviewerEligibility.reviewerConflictIds.includes(id)
+      && !reviewerConflicts.includes(id)
     ))
   );
   const reviewScopeMatches = !workspaceWideRetentionReview
@@ -108,7 +114,8 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
     && temporalReview
     && reviewScopeMatches
     && reviewersEligible
-    && !incompleteRecordProposals.length
+    && (resourceType !== "retention-schedule-item" && Number(loaded.model.modelVersion) >= 11
+      || !incompleteRecordProposals.length)
     && !approvalIssues.length
   );
   const stale = Boolean(

package/src/collection-revision.js

@@ -4,14 +4,16 @@ import { modelSupports } from "../model/index.js";
 import {
   authoritativeSourceRevisionValue,
   collectionRevisionInputs,
-  collectionScopeRevisionFacts
+  collectionScopeRevisionFacts,
+  scopedCollectionRecords
 } from "./collection-scope.js";
 import { resolveDataPath } from "./paths.js";
 import { getFileAtRevision } from "./git.js";
 import { reviewHistoricalWorkspace, reviewHistoryCommits, reviewHistoryContext } from "./historical-workspace.js";
 import { resolveProgram } from "./program.js";
+import { currentPartyPeople } from "./parties.js";
 import { markdownEntries } from "./resource-markdown.js";
-import { CALCULATED_REVISION_FIELDS, CALCULATED_REVISION_MAP_FIELDS, calculateRevision, canonicalCalculatedRevision, revisionsMatch } from "./revisions.js";
+import { CALCULATED_REVISION_FIELDS, CALCULATED_REVISION_MAP_FIELDS, calculateRevision, canonicalCalculatedRevision, revisionDigest, revisionsMatch } from "./revisions.js";
 
 export function collectionRevision(loaded, resourceType, options = {}) {
   return calculateCollectionRevision(loaded, resourceType, options, false, options.scopeHashInput || "legacy", options.scopeFactsInput || "legacy");
@@ -44,6 +46,96 @@ export function collectionRevisionMatches(loaded, resourceType, storedRevision,
   return historicallyEquivalentCollection(loaded, resourceType, storedRevision, options, currentRevision);
 }
 
+// Ordinary Collection Reviews record that setup was completed. Their original
+// population remains evidence of what management reviewed at that time;
+// subsequent operating records are assessed by their own workflows. The Data
+// Retention Schedule is an approval of exact content and keeps its binding.
+export function collectionReviewDecisionMatches(loaded, resourceType, review, records, options = {}) {
+  if (!review) return false;
+  if (resourceType === "retention-schedule-item" || Number(loaded.model.modelVersion) < 11) {
+    return collectionRevisionMatches(loaded, resourceType, review.collectionRevision, options);
+  }
+  if (!revisionDigest("collection", review.collectionRevision) || review.status !== "active") return false;
+  if (!originalCollectionReviewMatches(loaded, resourceType, review, options)) return false;
+  if (review.decision === "zero-population") return records.length === 0;
+  if (review.decision === "complete") return records.length > 0;
+  if (review.decision === "externally-managed") {
+    const id = review.authoritativeComponentId || review.authoritativeSystemId;
+    return loaded.resources.some((record) => record.id === id && record.status === "active");
+  }
+  return collectionRevisionMatches(loaded, resourceType, review.collectionRevision, options);
+}
+
+function originalCollectionReviewMatches(loaded, resourceType, review, options) {
+  const currentRevision = options.currentRevision || collectionRevision(loaded, resourceType, options);
+  if (revisionsMatch("collection", review.collectionRevision, currentRevision)) {
+    if (!review.populationResourceIds) return true;
+    const program = options.program || resolveProgram(loaded, options.programId || review.scopeResourceIds?.[0]);
+    const currentPopulation = scopedCollectionRecords(loaded, resourceType, program).map(({ id }) => id).sort();
+    const reviewedPopulation = [...review.populationResourceIds].sort();
+    return currentPopulation.length === reviewedPopulation.length
+      && currentPopulation.every((id, index) => id === reviewedPopulation[index]);
+  }
+  if (!loaded.root || !review.scopeRevision) {
+    return collectionRevisionMatches(loaded, resourceType, review.collectionRevision, { ...options, currentRevision });
+  }
+  const snapshot = reviewHistoricalWorkspace(reviewHistoryContext(loaded.root, loaded), review.scopeRevision);
+  if (!snapshot) return false;
+  const programId = options.programId || options.program?.id || review.scopeResourceIds?.[0];
+  let program;
+  try {
+    program = resolveProgram(snapshot, programId);
+  } catch {
+    return false;
+  }
+  const currentProgram = resolveProgram(loaded, programId);
+  const selectionField = {
+    framework: "frameworkIds",
+    system: "systemIds",
+    component: "systemIds",
+    control: "controlIds"
+  }[resourceType];
+  if (selectionField && JSON.stringify([...(program[selectionField] || [])].sort())
+    !== JSON.stringify([...(currentProgram[selectionField] || [])].sort())) return false;
+  const population = scopedCollectionRecords(snapshot, resourceType, program).map(({ id }) => id).sort();
+  const reviewedPopulation = [...(review.populationResourceIds || [])].sort();
+  if (review.populationResourceIds && (
+    population.length !== reviewedPopulation.length
+    || population.some((id, index) => id !== reviewedPopulation[index])
+  )) return false;
+  return collectionRevisionMatches(snapshot, resourceType, review.collectionRevision, {
+    programId,
+    authoritativeSourceId: options.authoritativeSourceId,
+    historicalCommit: review.scopeRevision
+  });
+}
+
+export function reviewedControlConflictIds(loaded, review) {
+  const snapshot = loaded.root && /^[a-f0-9]{40,64}$/i.test(review?.scopeRevision || "")
+    ? reviewHistoricalWorkspace(reviewHistoryContext(loaded.root, loaded), review.scopeRevision)
+    : null;
+  const source = snapshot || loaded;
+  let program;
+  try {
+    program = resolveProgram(source, review.scopeResourceIds?.[0]);
+  } catch {
+    return [];
+  }
+  const controls = scopedCollectionRecords(source, "control", program);
+  const controlIds = new Set(controls.map(({ id }) => id));
+  const byId = new Map(source.resources.map((record) => [record.id, record]));
+  const conflicts = new Set();
+  for (const record of [
+    ...controls,
+    ...source.resources.filter((record) => record.type === "obligation"
+      && record.status === "active"
+      && (record.controlIds || []).some((id) => controlIds.has(id)))
+  ]) {
+    for (const id of currentPartyPeople(record.ownerIds || [], byId)) conflicts.add(id);
+  }
+  return [...conflicts].sort();
+}
+
 function historicallyEquivalentCollection(loaded, resourceType, stored, options, current) {
   if (!loaded.root) return false;
   const context = reviewHistoryContext(loaded.root, loaded);

package/src/model-docs.js

@@ -47,7 +47,7 @@ export function generateModelDocumentation(model) {
     "",
     "## Collection review confirmations",
     "",
-    "FileGRC derives record issues, but it cannot infer that management reviewed an apparently complete or empty collection. Each configured collection review records the conclusion, reviewer, date, current scope revision, and exact collection revision. A record or material scope change makes the confirmation stale.",
+    "FileGRC derives record issues, but it cannot infer that management finished an apparently complete or empty setup collection. Each configured collection review records the conclusion, reviewer, date, scope revision, and reviewed collection revision. Routine operating changes do not reopen a completed setup confirmation. The Data Retention Schedule keeps exact approval bindings.",
     "",
     "| Resource type | Review | Allowed conclusions | What to review |",
     "| --- | --- | --- | --- |",

package/src/program-readiness.js

@@ -242,6 +242,27 @@ export async function assessProgramReadiness(input, options = {}) {
     ...evidenceGateStages,
     await operationStage(loaded, program, scope, records, byId, asOf, evidenceReady, loaded.model, progressWindow)
   ];
+  for (const assessment of collectionReviews.filter(({ resourceType, complete }) => (
+    complete && resourceType !== "retention-schedule-item"
+  ))) {
+    for (const proposal of assessment.incompleteRecordProposals || []) {
+      stages.at(-1).items.push(item(
+        `operating-${assessment.resourceType}-${proposal.resourceId}`,
+        "action",
+        `Finish ${proposal.title}`,
+        "Finish or retire this new record, check its affected Systems and Controls, and start a change event only if the change is material under an approved Policy.",
+        { type: assessment.resourceType, id: proposal.resourceId, title: proposal.title },
+        {
+          resourceType: assessment.resourceType,
+          destination: { kind: "record", resourceType: assessment.resourceType, resourceId: proposal.resourceId },
+          commands: [
+            `npx filegrc guide ${assessment.resourceType} --json`,
+            `npx filegrc get ${shellArgument(proposal.resourceId)} --mutation`
+          ]
+        }
+      ));
+    }
+  }
   finalizeStage(stages.at(-1));
   const periodStarted = Boolean(
     program?.assuranceGoal === "soc-2-type-2"
@@ -408,14 +429,17 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
         && String(rationale || "").trim()
       ))
     ));
+    const componentSetupComplete = collectionReviews.find(({ resourceType }) => resourceType === "component")?.complete === true;
     items.push(item(
       "system-components",
-      scope.components.length === completeComponents.length ? "complete" : "action",
-      "Confirm scoped Components",
-      scope.components.length
+      componentSetupComplete || scope.components.length === completeComponents.length ? "complete" : "action",
+      "Define scoped Component roles",
+      componentSetupComplete
+        ? "The initial Component scope was confirmed. Complete later Component changes through their own record and event work."
+        : scope.components.length
         ? `${completeComponents.length} of ${scope.components.length} Components have an active, owned, rationalized role in the selected Systems.`
         : "No Components are selected. This is valid only when the bounded Systems do not rely on a separately managed service-delivery, Control-support, evidence-source, or supporting-operations building block.",
-      scope.components[0] || { type: "component" },
+      scope.components.find((component) => !completeComponents.includes(component)) || scope.components[0] || { type: "component" },
       {
         componentIds: scope.components.map(({ id }) => id),
         progressUnit: false
@@ -723,7 +747,7 @@ function reportingRouteItem(records, byId, asOf, timezone = "UTC") {
 }
 
 export function collectionReviewReadinessItem(assessment) {
-  const firstIncomplete = assessment.incompleteRecordProposals?.[0]
+  const firstIncomplete = !assessment.complete && assessment.incompleteRecordProposals?.[0]
     || assessment.recordProposals?.find(({ complete }) => !complete);
   const needsFirstRecord = assessment.recordCount === 0
     && !(assessment.configuration.decisions || []).some((decision) => ["zero-population", "externally-managed"].includes(decision));
@@ -734,7 +758,7 @@ export function collectionReviewReadinessItem(assessment) {
   const approvalAction = !proposalAction && !pendingRetentionRow
     ? collectionApprovalIssueAction(assessment)
     : null;
-  const proposalUnits = (assessment.recordProposals || []).map((proposal) => ({
+  const proposalUnits = (assessment.complete ? [] : assessment.recordProposals || []).map((proposal) => ({
     id: `${assessment.resourceType}-proposal-${proposal.resourceId}`,
     status: proposal.complete ? "complete" : "action",
     title: `${proposal.title} proposal`

package/src/validate.js

@@ -6,7 +6,8 @@ import { getResourceDefinition, modelSupports } from "../model/index.js";
 import { collectionRecordProposals, retentionScheduleReviewScope, scopedCollectionRecords, selectScopedCollectionRecords } from "./collection-scope.js";
 import {
   collectionRevision,
-  collectionRevisionMatches
+  collectionReviewDecisionMatches,
+  reviewedControlConflictIds
 } from "./collection-revision.js";
 import { isSafeGitName } from "./git-name.js";
 import { getFileBufferAtRevision, getFileObjectIdAtRevision, getFilePathAtRevision, getGitSummary, getWorkingFileObjectId, hasGitRevision, isDataHistoryAncestor } from "./git.js";
@@ -1276,10 +1277,11 @@ function validateCollectionReview(record, loaded, byId, path, diagnostics) {
       ? record.authoritativeComponentId || record.authoritativeSystemId
       : null
   });
-  const current = collectionRevisionMatches(
+  const current = collectionReviewDecisionMatches(
     loaded,
     record.resourceType,
-    record.collectionRevision,
+    record,
+    scopedCollectionRecords(loaded, record.resourceType, program),
     {
       program,
       authoritativeSourceId: record.decision === "externally-managed"
@@ -1288,6 +1290,7 @@ function validateCollectionReview(record, loaded, byId, path, diagnostics) {
       currentRevision
     }
   );
+  const originalPopulationCurrent = current && revisionsMatch("collection", record.collectionRevision, currentRevision);
   if (current && workspaceWideRetentionReview && !sameStringIds(record.scopeResourceIds, retentionScope.programIds)) {
     diagnostics.push(error(
       "invalid-retention-schedule-review-scope",
@@ -1295,7 +1298,7 @@ function validateCollectionReview(record, loaded, byId, path, diagnostics) {
       "The current Data Retention Schedule review must cover every active Program as one workspace-wide approval."
     ));
   }
-  if (current && incompleteProposals.length) {
+  if (originalPopulationCurrent && incompleteProposals.length) {
     diagnostics.push(error(
       "incomplete-collection-review-proposals",
       path,
@@ -1303,19 +1306,7 @@ function validateCollectionReview(record, loaded, byId, path, diagnostics) {
     ));
   }
   if (current && record.resourceType === "control") {
-    const controls = scopedCollectionRecords(loaded, "control", program);
-    const controlIds = new Set(controls.map(({ id }) => id));
-    const conflictIds = new Set();
-    for (const control of controls) {
-      for (const id of currentPartyPeople(control.ownerIds || [], byId)) conflictIds.add(id);
-    }
-    for (const obligation of loaded.resources.filter((candidate) => (
-      candidate.type === "obligation"
-      && candidate.status === "active"
-      && (candidate.controlIds || []).some((id) => controlIds.has(id))
-    ))) {
-      for (const id of currentPartyPeople(obligation.ownerIds || [], byId)) conflictIds.add(id);
-    }
+    const conflictIds = new Set(reviewedControlConflictIds(loaded, record));
     const conflictedReviewers = (record.reviewedByIds || []).filter((id) => conflictIds.has(id));
     if (conflictedReviewers.length) {
       diagnostics.push(error(
@@ -1369,7 +1360,8 @@ function validateCollectionReview(record, loaded, byId, path, diagnostics) {
       || record.coverage.on !== record.reviewedOn
       || !isRfc3339Timestamp(record.knowledgeCutoffAt)
       || currentCalendarDate(loaded.workspace.timezone, new Date(record.knowledgeCutoffAt)) !== record.reviewedOn
-      || (current && JSON.stringify([...record.populationResourceIds].sort()) !== JSON.stringify(currentPopulationIds))
+      || (current && (record.resourceType === "retention-schedule-item" || Number(model.modelVersion) < 11)
+        && JSON.stringify([...record.populationResourceIds].sort()) !== JSON.stringify(currentPopulationIds))
     )) {
       diagnostics.push(error(
         "invalid-current-collection-review",
@@ -1431,14 +1423,15 @@ function collectionReviewIsCurrent(loaded, resourceType, program) {
   ));
   if (!review || !(loaded.model.collectionReviews?.[resourceType]?.decisions || ["complete"]).includes(review.decision)) return false;
   const records = scopedCollectionRecords(loaded, resourceType, program);
-  const revisionMatches = collectionRevisionMatches(loaded, resourceType, review.collectionRevision, { program });
+  const revisionMatches = collectionReviewDecisionMatches(loaded, resourceType, review, records, { program });
   if (!modelSupports(loaded.model, "temporal-collection-reviews")) return revisionMatches;
   return revisionMatches
     && review.coverage?.kind === "as-of"
     && review.coverage.on === review.reviewedOn
     && Boolean(review.knowledgeCutoffAt)
     && Array.isArray(review.populationResourceIds)
-    && JSON.stringify([...review.populationResourceIds].sort()) === JSON.stringify(records.map(({ id }) => id).sort());
+    && (resourceType !== "retention-schedule-item" && Number(loaded.model.modelVersion) >= 11
+      || JSON.stringify([...review.populationResourceIds].sort()) === JSON.stringify(records.map(({ id }) => id).sort()));
 }
 
 function validateCollectionReviewSet(resources, pathById, diagnostics) {

package/src/web.js

@@ -1239,7 +1239,7 @@ function collectionReviewPanel(type, force = false) {
   const current = assessment.status === "current";
   const scheduleReview = type === "retention-schedule-item" && modelSupports("retention-schedule-approval");
   const scheduleBlocker = scheduleReview ? retentionScheduleApprovalBlocker() : null;
-  const proposalBlocker = assessment.incompleteRecordProposals?.length
+  const proposalBlocker = !current && assessment.incompleteRecordProposals?.length
     ? "Complete " + assessment.incompleteRecordProposals.length + " record " + (assessment.incompleteRecordProposals.length === 1 ? "proposal" : "proposals") + " before the collection review."
     : null;
   const reviewBlocker = scheduleBlocker || proposalBlocker;
@@ -1263,7 +1263,7 @@ function collectionReviewPanel(type, force = false) {
       ? '<a class="button primary" href="#/resources/' + encodeURIComponent(type) + '?new=1">Add first ' + esc(state.model.resources[type].title.toLowerCase()) + '</a>'
       : '<button class="button ' + (current ? "" : "primary") + '" type="button" data-review-collection="' + esc(type) + '">' + (current ? scheduleReview ? "Approve a new revision" : "Review again" : scheduleReview ? "Review and approve schedule" : "Review and confirm") + '</button>';
   const status = reviewBlocker ? "Not ready" : current ? "Reviewed" : needsFirstRecord ? "Records required" : assessment.status === "stale" ? "Stale" : "Review required";
-  const proposalSummary = assessment.recordProposals?.length
+  const proposalSummary = !current && assessment.recordProposals?.length
     ? '<p class="collection-review-proposal-summary"><strong>' + assessment.recordProposals.filter(({ complete }) => complete).length + ' of ' + assessment.recordProposals.length + ' record proposals complete.</strong> The collection review follows every proposal.</p>'
     : "";
   const details = '<details ' + (current ? 'class="collection-review-details"' : "open") + '><summary>' + (current ? scheduleReview ? "Show approved revision" : "Show scope confirmation" : "What to review") + '</summary><div class="collection-review-detail-content"><div class="collection-review-head"><div><p class="kicker">' + (scheduleReview ? "Schedule approval" : "Scope confirmation") + '</p><h3>' + esc(configuration.title) + '</h3><p>' + esc(configuration.description) + '</p></div><span class="badge ' + (current ? "good" : "warn") + '">' + status + '</span></div>' + proposalSummary + '<ul>' + configuration.reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul>' + (current ? reviewSummary : "") + '</div></details>';