filegrc 0.16.15 → 0.16.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.15",
+  "version": "0.16.17",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/agent.js

@@ -102,6 +102,7 @@ export function buildAgentGuide(loaded, type, options = {}) {
             allowedDecisions: collectionReview.configuration.decisions,
             status: collectionReview.status,
             recordCount: collectionReview.recordCount,
+            ...(collectionReview.changesSinceReview ? { changesSinceReview: collectionReview.changesSinceReview } : {}),
             command: `npx filegrc review-collection ${type} --scaffold`
           }
         : null

package/src/collection-changes.js

@@ -0,0 +1,158 @@
+import { readFileSync } from "node:fs";
+import { modelSupports } from "../model/index.js";
+import { authoritativeSourceRevisionValue, collectionRevisionInputs, collectionScopeRevisionFacts, scopedCollectionRecords } from "./collection-scope.js";
+import { collectionRevisionMatches } from "./collection-revision.js";
+import { getFileAtRevision } from "./git.js";
+import { reviewHistoricalWorkspace, reviewHistoryContext } from "./historical-workspace.js";
+import { markdownEntries } from "./resource-markdown.js";
+import { resolveProgram } from "./program.js";
+import { resolveDataPath } from "./paths.js";
+import { canonicalCalculatedRevision } from "./revisions.js";
+
+export function collectionChangesSinceReview(loaded, resourceType, review, programId) {
+  if (!/^[a-f0-9]{40,64}$/i.test(review?.scopeRevision || "") || !loaded.root) return unavailable("The reviewed Git snapshot is unavailable. Compare the current records with the prior review.");
+  const before = reviewHistoricalWorkspace(reviewHistoryContext(loaded.root, loaded), review.scopeRevision);
+  if (!before) return unavailable("The reviewed Git snapshot is unavailable. Compare the current records with the prior review.");
+  const workspaceWide = resourceType === "retention-schedule-item"
+    && modelSupports(loaded.model, "retention-schedule-approval");
+  let priorProgram = null;
+  let currentProgram = null;
+  try {
+    if (!workspaceWide) {
+      priorProgram = resolveProgram(before, programId);
+      currentProgram = resolveProgram(loaded, programId);
+    }
+  } catch {
+    return unavailable("The reviewed Program could not be reconstructed. Compare the current scope with the prior review.");
+  }
+  if (!collectionRevisionMatches(before, resourceType, review.collectionRevision, {
+    programId,
+    historicalCommit: review.scopeRevision,
+    authoritativeSourceId: review.authoritativeComponentId || review.authoritativeSystemId
+  })) {
+    return unavailable("The stored revision does not match the reviewed Git snapshot. Compare the current records with the prior review.");
+  }
+  const priorInputs = new Map(collectionRevisionInputs(before, resourceType, priorProgram)
+    .map((input) => [input.record.id, input]));
+  const currentInputs = new Map(collectionRevisionInputs(loaded, resourceType, currentProgram)
+    .map((input) => [input.record.id, input]));
+  const authoritativeSourceId = review.authoritativeComponentId || review.authoritativeSystemId;
+  for (const [source, inputs] of [[before, priorInputs], [loaded, currentInputs]]) {
+    const record = source.resources.find(({ id }) => id === authoritativeSourceId);
+    if (record) inputs.set(record.id, {
+      record,
+      value: authoritativeSourceRevisionValue(record),
+      includeContent: true
+    });
+  }
+  const priorMembers = new Set(scopedCollectionRecords(before, resourceType, priorProgram).map(({ id }) => id));
+  const currentMembers = new Set(scopedCollectionRecords(loaded, resourceType, currentProgram).map(({ id }) => id));
+  const changes = [];
+  for (const id of new Set([...priorInputs.keys(), ...currentInputs.keys()])) {
+    const prior = priorInputs.get(id);
+    const current = currentInputs.get(id);
+    const record = current?.record || prior?.record;
+    const fields = prior && current ? changedFields(prior.value, current.value, loaded.model, record.type) : [];
+    const contentChanged = prior && current && (prior.includeContent || current.includeContent)
+      ? changedContent(before, loaded, review.scopeRevision, prior.record, current.record)
+      : false;
+    const membershipChanged = priorMembers.has(id) !== currentMembers.has(id);
+    if (!prior || !current || fields.length || contentChanged || membershipChanged) {
+      changes.push({
+        id,
+        type: record.type,
+        title: record.title || id,
+        kind: !prior ? "added" : !current ? "removed" : "changed",
+        fields,
+        ...(contentChanged ? { contentChanged: true } : {}),
+        ...(membershipChanged ? { membershipChanged: true } : {})
+      });
+    }
+  }
+  const scopeFields = changedFields(
+    collectionScopeRevisionFacts(before, resourceType, priorProgram),
+    collectionScopeRevisionFacts(loaded, resourceType, currentProgram),
+    loaded.model,
+    "program"
+  );
+  if (!changes.length && !scopeFields.length) {
+    return unavailable("The stored revision does not match the reviewed Git snapshot. Compare the current records with the prior review.");
+  }
+  changes.sort((left, right) => left.type.localeCompare(right.type) || left.title.localeCompare(right.title) || left.id.localeCompare(right.id));
+  const overview = [
+    ...changes.slice(0, 3).map(describeChange),
+    ...(changes.length > 3 ? [`${changes.length - 3} more changed records`] : []),
+    ...(scopeFields.length ? [`Program scope (${scopeFields.join(", ")})`] : [])
+  ].join("; ");
+  const headlineParts = [
+    ...changes.slice(0, 2).map(describeShortChange),
+    ...(changes.length > 2 ? [`${changes.length - 2} more changed records`] : []),
+    ...(scopeFields.length ? [`Program scope: ${scopeFields.slice(0, 2).join(", ")}${scopeFields.length > 2 ? ", more" : ""}`] : [])
+  ];
+  return {
+    status: "available",
+    summary: `Changed since the last review: ${overview}.`,
+    headline: `${headlineParts.join("; ")}. Open the review for details.`,
+    changes,
+    scopeFields
+  };
+}
+
+function unavailable(summary) {
+  return { status: "unavailable", summary, headline: "Changes could not be reconstructed. Open the review for details.", changes: [], scopeFields: [] };
+}
+
+function describeChange(change) {
+  const name = `${change.title} (${change.type})`;
+  if (change.kind !== "changed") return `${name} ${change.kind === "added" ? "entered review scope" : "left review scope"}`;
+  const details = [...change.fields, ...(change.contentChanged ? ["Markdown"] : []), ...(change.membershipChanged ? ["collection membership"] : [])];
+  return `${name}: ${details.join(", ")}`;
+}
+
+function describeShortChange(change) {
+  const name = change.title.length > 44 ? `${change.title.slice(0, 43)}…` : change.title;
+  if (change.kind !== "changed") return `${name} ${change.kind === "added" ? "entered scope" : "left scope"}`;
+  const details = [...change.fields, ...(change.contentChanged ? ["Markdown"] : []), ...(change.membershipChanged ? ["membership"] : [])];
+  return `${name}: ${details.slice(0, 2).join(", ")}${details.length > 2 ? ", more" : ""}`;
+}
+
+function changedFields(before, after, model, type) {
+  const definitions = { ...model.commonFields, ...model.resources[type]?.fields };
+  return [...new Set([...Object.keys(before || {}), ...Object.keys(after || {})])]
+    .filter((field) => !sameValue(before?.[field], after?.[field]))
+    .map((field) => definitions[field]?.label || field.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/\bIds\b/g, "IDs").replace(/^./, (letter) => letter.toUpperCase()));
+}
+
+function sameValue(left, right) {
+  if (typeof left === "string" && typeof right === "string") {
+    return canonicalCalculatedRevision(left) === canonicalCalculatedRevision(right);
+  }
+  if (Array.isArray(left) && Array.isArray(right)) {
+    if (left.every((value) => typeof value === "string") && right.every((value) => typeof value === "string")) {
+      return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
+    }
+    return left.length === right.length && left.every((value, index) => sameValue(value, right[index]));
+  }
+  if (left && right && typeof left === "object" && typeof right === "object") {
+    const keys = new Set([...Object.keys(left), ...Object.keys(right)]);
+    return [...keys].every((key) => sameValue(left[key], right[key]));
+  }
+  return left === right;
+}
+
+function changedContent(before, current, commit, priorRecord, currentRecord) {
+  const priorPaths = markdownEntries(before.model, priorRecord).map(({ path }) => path);
+  const currentPaths = markdownEntries(current.model, currentRecord).map(({ path }) => path);
+  for (const path of new Set([...priorPaths, ...currentPaths])) {
+    const priorSource = priorPaths.includes(path)
+      ? before.historicalFiles?.get(`data/${path}`) ?? getFileAtRevision(before.root, commit, `data/${path}`)
+      : null;
+    let currentSource = null;
+    if (currentPaths.includes(path)) {
+      try { currentSource = readFileSync(resolveDataPath(current.root, path), "utf8"); }
+      catch (error) { if (error.code !== "ENOENT") throw error; }
+    }
+    if (priorSource !== currentSource) return true;
+  }
+  return false;
+}

package/src/collection-review.js

@@ -16,8 +16,9 @@ import { currentPartyPeople } from "./parties.js";
 import { retentionScheduleApprovalIssues } from "./retention-schedule-approval.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { resolveDataPath } from "./paths.js";
-import { calculateRevision, calculatedRevisionDiagnostic, revisionsMatch } from "./revisions.js";
+import { calculateRevision, calculatedRevisionDiagnostic, displayRevision, revisionsMatch } from "./revisions.js";
 import { personWasActiveOn } from "./soc2.js";
+import { collectionChangesSinceReview } from "./collection-changes.js";
 
 export { collectionRevision };
 
@@ -123,6 +124,9 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
     && review.collectionRevision
     && (!revisionMatches || !reviewScopeMatches)
   );
+  const changesSinceReview = stale
+    ? collectionChangesSinceReview(loaded, resourceType, review, program.id)
+    : null;
   return {
     resourceType,
     configuration,
@@ -134,6 +138,7 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
       : null,
     reviewEntries,
     collectionRevision: currentRevision,
+    changesSinceReview,
     revisionDiagnostic: calculatedRevisionDiagnostic("collection", review?.collectionRevision, currentRevision),
     status: complete ? "current" : stale ? "stale" : "review-required",
     complete,
@@ -143,7 +148,7 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
     message: complete
       ? `${configuration.title} were reviewed on ${review.reviewedOn}.`
       : approvalIssues.length
-        ? approvalIssues[0].message
+        ? `${approvalIssues[0].message}${changesSinceReview ? ` ${changesSinceReview.summary}` : ""}`
       : incompleteRecordProposals.length
         ? `Complete ${incompleteRecordProposals.length} ${configuration.title.toLowerCase()} ${incompleteRecordProposals.length === 1 ? "record proposal" : "record proposals"} before the collection review.`
       : revisionMatches && review?.status === "active" && !reviewersEligible
@@ -151,7 +156,7 @@ export function assessCollectionReview(loaded, resourceType, options = {}) {
           ? "Review the Data Retention Schedule again with a reviewer who does not own its governing document or an included schedule row."
           : "Review the Control collection again with a reviewer who does not own an included Control or its enabled Obligation."
       : stale
-        ? `${configuration.title} changed after the last confirmation. Stored revision: ${review.collectionRevision}. Current revision: ${currentRevision}. Review the current records again.`
+        ? `${configuration.title} changed after the last confirmation. ${changesSinceReview.summary} Stored revision: ${displayRevision(review.collectionRevision)}. Current revision: ${displayRevision(currentRevision)}. Review the current records again.`
         : !records.length && !allowsEmptyCollection
           ? `Add at least one ${loaded.model.resources[resourceType].title.toLowerCase()} before confirming this collection.`
         : `Review ${configuration.title.toLowerCase()} before this page can be ready.`
@@ -190,6 +195,7 @@ export async function scaffoldCollectionReview(input = process.cwd(), options =
     : null;
   return {
     resourceType,
+    ...(assessment.changesSinceReview ? { changesSinceReview: assessment.changesSinceReview } : {}),
     decision: priorDecisionStillValid ? priorReview.decision : (assessment.records.length
       ? "complete"
       : allowedDecisions.includes("zero-population") ? "zero-population" : null),

package/src/files.js

@@ -12,7 +12,7 @@ import { measureTiming } from "./timing.js";
 import { currentCalendarDate, timestampFromLocalDateTime } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
 import { validateWorkspace } from "./validate.js";
-import { calculateRevision, revisionsMatch } from "./revisions.js";
+import { calculateRevision, displayRevision, revisionsMatch } from "./revisions.js";
 
 export const INTERNAL_WORKFLOW_CAPABILITIES = Object.freeze({
   auditManagementReconciliation: Symbol("audit-management-reconciliation"),
@@ -1165,7 +1165,7 @@ async function prepareContentWrites(loaded, record, content, options = {}) {
 function assertRevision(source, expected, label) {
   const current = contentRevision(source);
   if (expected && !revisionsMatch("content", expected, current)) {
-    throw new Error(`${label} changed after you opened it. Stored revision: ${expected}. Current revision: ${current}. Reload the workspace and apply your change again.`);
+    throw new Error(`${label} changed after you opened it. Stored revision: ${displayRevision(expected)}. Current revision: ${displayRevision(current)}. Reload the workspace and apply your change again.`);
   }
 }
 

package/src/obligation-rule.js

@@ -0,0 +1,20 @@
+export function obligationRule(obligation, byId, options = {}) {
+  const proposedId = options.includeProposed
+    ? [...(obligation.ruleIds || [])].reverse().find((id) => ["proposed", "approved"].includes(byId.get(id)?.status))
+    : null;
+  if (obligation?.scheduleMode !== "rule" && !proposedId) return null;
+  let rule = byId.get(obligation.activeRuleId || proposedId);
+  if (rule?.status === "active" && rule.effectiveAt && options.now && new Date(rule.effectiveAt) > new Date(options.now)) {
+    const prior = byId.get(rule.supersedesId);
+    return prior?.type === "obligation-rule"
+      && prior.obligationId === obligation.id
+      && ["active", "retired"].includes(prior.status)
+      ? prior
+      : null;
+  }
+  return rule?.type === "obligation-rule"
+    && rule.obligationId === obligation.id
+    && (rule.status === "active" || (options.includeProposed && ["proposed", "approved"].includes(rule.status)))
+    ? rule
+    : null;
+}

package/src/obligations.js

@@ -21,7 +21,8 @@ import {
 } from "./recurrence.js";
 import { currentCalendarDate, isRfc3339Timestamp, localDateTimeValue, timestampFromLocalDateTime } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
-import { obligationGovernedContent, obligationProgramStatus } from "./program-lifecycle.js";
+import { obligationRule } from "./obligation-rule.js";
+import { governedContentIsOperating, obligationGovernedContent, obligationProgramStatus } from "./program-lifecycle.js";
 import { resolveProgram } from "./program.js";
 import { currentPartyPeople } from "./parties.js";
 import { serializeWorkspaceMutation } from "./mutation.js";
@@ -84,9 +85,9 @@ export function planObligations(resources, options = {}) {
     throw new Error("Obligation planning requires programId when more than one Program is active.");
   }
   const asOf = requireDate(options.asOf ?? currentCalendarDate(workspace?.timezone || "UTC"), "as-of date");
-  const defaultNow = options.asOf
-    ? timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC")
-    : new Date().toISOString();
+  const defaultNow = asOf === currentCalendarDate(workspace?.timezone || "UTC")
+    ? new Date().toISOString()
+    : timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC");
   const now = requireTimestamp(options.now ?? defaultNow, "current timestamp");
   const through = requireDate(options.through ?? addCalendarDays(asOf, 90), "through date");
   const requestedFrom = options.from ? requireDate(options.from, "from date") : null;
@@ -102,7 +103,7 @@ export function planObligations(resources, options = {}) {
     && obligationBelongsToProgram(record, obligationProgram, model)
   ));
   const programStatusByObligationId = new Map(obligations.map((obligation) => [
-    obligation.id, obligationProgramStatus(obligation, byId, asOf, model)
+    obligation.id, obligationProgramStatus(obligation, byId, asOf, model, now)
   ]));
   const obligationIds = new Set(obligations.map(({ id }) => id));
   if (obligations.length > MAX_PLANNED_ITEMS) {
@@ -120,14 +121,17 @@ export function planObligations(resources, options = {}) {
   };
 
   for (const obligation of obligations) {
+    const selectedRule = byId.get(obligation.activeRuleId);
     const rule = obligation.scheduleMode === "rule"
       ? obligationRule(obligation, byId, { now, includeProposed: true })
+        || (selectedRule?.status === "active" && selectedRule.effectiveAt
+          && new Date(selectedRule.effectiveAt) > new Date(now) ? selectedRule : null)
       : null;
     const schedule = rule || obligation;
     const activity = obligationActivity(model, obligation);
     const expectedCompletionTypes = activity.completionResourceTypes;
     const programStatus = programStatusByObligationId.get(obligation.id);
-    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf) : null;
+    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf, model, now) : null;
     if (schedule.recurrence?.mode === "event" && schedule.recurrence.eventType) {
       const eventType = schedule.recurrence.eventType;
       const group = triggerGroups.get(eventType) ?? {
@@ -298,7 +302,7 @@ export function planObligations(resources, options = {}) {
     const overdueOn = addCalendarDays(dueWindowEnd, 1);
     const window = { dueWindowStart, dueWindowEnd, overdueOn };
     const programStatus = programStatusByObligationId.get(obligation.id);
-    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf) : null;
+    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf, model, now) : null;
     const activity = obligationActivity(model, obligation);
     const completedMemberIds = (occurrence.members || [])
       .filter(({ disposition, result }) => disposition === "expected" && result === "passed")
@@ -420,10 +424,17 @@ export function planObligations(resources, options = {}) {
   };
 }
 
-function obligationProgramBlocker(obligation, byId, asOf) {
+function obligationProgramBlocker(obligation, byId, asOf, model, now = `${asOf}T23:59:59Z`) {
   if (obligation.status !== "active") {
     return { type: "obligation", id: obligation.id, label: "Activate obligation" };
   }
+  if (obligation.scheduleMode === "rule" && !obligationRule(obligation, byId, { now })) {
+    const selectedRule = byId.get(obligation.activeRuleId);
+    return {
+      type: "obligation-rule", id: obligation.activeRuleId,
+      label: selectedRule?.status === "active" ? "Wait for rule effective time" : "Activate rule"
+    };
+  }
   if (currentPartyPeople(obligation.ownerIds || [], byId).size === 0) {
     return { type: "obligation", id: obligation.id, label: "Assign current owner" };
   }
@@ -433,6 +444,11 @@ function obligationProgramBlocker(obligation, byId, asOf) {
       return { type: "policy", id, label: "Activate policy" };
     }
   }
+  const inactiveContent = obligationGovernedContent(obligation, byId, model)
+    .find((record) => !governedContentIsOperating(record, asOf, model));
+  if (inactiveContent) {
+    return { type: inactiveContent.type, id: inactiveContent.id, label: `Activate ${inactiveContent.type}` };
+  }
   const controls = (obligation.controlIds || []).map((id) => byId.get(id)).filter(Boolean);
   if (controls.length && !controls.some(({ status }) => status === "implemented")) {
     return { type: "control", id: controls[0].id, label: "Implement control" };
@@ -466,6 +482,27 @@ async function createObligationEventUnlocked(input, options) {
   if (riskLevel && !["normal", "high"].includes(riskLevel)) {
     throw new Error("A departure risk level must be normal or high.");
   }
+  if (!occurredAt) {
+    const intradayCutover = records.find((record) => {
+      if (
+        record.type !== "obligation"
+        || !["active", "proposed"].includes(record.status)
+        || (program && !obligationBelongsToProgram(record, program, loaded.model))
+        || (Array.isArray(record.eventRiskLevels) && !record.eventRiskLevels.includes(riskLevel))
+      ) return false;
+      const rule = byId.get(record.activeRuleId);
+      return rule?.type === "obligation-rule"
+        && rule.status === "active"
+        && rule.recurrence?.mode === "event"
+        && rule.recurrence.eventType === eventType
+        && rule.effectiveAt
+        && timestampCalendarDate(rule.effectiveAt, loaded.workspace.timezone) === occurredOn;
+    });
+    if (intradayCutover) {
+      throw new Error(`Event type "${eventType}" requires occurredAt on ${occurredOn} because a linked rule takes effect during that date. Record the real event time with its timezone.`);
+    }
+  }
+  const eventTime = occurredAt || `${occurredOn}T23:59:59Z`;
   const eventSchedules = new Map();
   const templates = records.filter((record) => {
     if (
@@ -473,16 +510,43 @@ async function createObligationEventUnlocked(input, options) {
       || record.status !== "active"
       || (program && !obligationBelongsToProgram(record, program, loaded.model))
     ) return false;
-    const schedule = obligationRule(record, byId, { now: occurredAt || `${occurredOn}T23:59:59Z` }) || record;
+    const schedule = obligationRule(record, byId, { now: eventTime }) || record;
     const matches = schedule.recurrence?.mode === "event"
       && schedule.recurrence.eventType === eventType
       && (!Array.isArray(record.eventRiskLevels) || record.eventRiskLevels.includes(riskLevel));
     if (matches) eventSchedules.set(record.id, schedule);
     return matches;
   });
-  if (!eventType || templates.length === 0) throw new Error(`No active obligations use event type "${eventType}".`);
-  if (templates.some((record) => obligationProgramStatus(record, byId, occurredOn, loaded.model) === "proposed")) {
-    throw new Error(`Event type "${eventType}" still has starter proposals. Make every governing Policy and required governed-content record active and effective, then implement at least one linked Control before starting this workflow.`);
+  const proposed = records.find((record) => {
+    if (
+      record.type !== "obligation"
+      || !["active", "proposed"].includes(record.status)
+      || (program && !obligationBelongsToProgram(record, program, loaded.model))
+      || (Array.isArray(record.eventRiskLevels) && !record.eventRiskLevels.includes(riskLevel))
+    ) return false;
+    const rule = obligationRule(record, byId, { now: eventTime, includeProposed: true });
+    const selectedRule = byId.get(record.activeRuleId);
+    const futureRule = selectedRule?.status === "active" && selectedRule.effectiveAt
+      && new Date(selectedRule.effectiveAt) > new Date(eventTime);
+    const schedule = rule || (futureRule ? selectedRule : record);
+    return schedule.recurrence?.mode === "event"
+      && schedule.recurrence.eventType === eventType
+      && (record.status === "proposed" || (rule && rule.status !== "active") || (futureRule && !rule));
+  });
+  if (!eventType || templates.length === 0 || proposed) {
+    const selectedRule = byId.get(proposed?.activeRuleId);
+    const futureRule = selectedRule?.status === "active" && selectedRule.effectiveAt
+      && new Date(selectedRule.effectiveAt) > new Date(eventTime);
+    throw new Error(futureRule
+      ? `Event type "${eventType}" is dormant until rule ${selectedRule.id} takes effect at ${selectedRule.effectiveAt}. Trigger only a real event after that time.`
+      : proposed
+        ? `Event type "${eventType}" is still a proposed workflow (${proposed.id}). Confirm its owner, deadline, and required proof, then enable its rule in Step 3. It stays dormant until governing content is effective; trigger only a real event after cutover.`
+        : `No active obligations use event type "${eventType}".`);
+  }
+  const dormant = templates.find((record) => obligationProgramStatus(record, byId, occurredOn, loaded.model, eventTime) === "proposed");
+  if (dormant) {
+    const blocker = obligationProgramBlocker(dormant, byId, occurredOn, loaded.model, eventTime);
+    throw new Error(`Event type "${eventType}" is dormant until ${blocker?.label?.toLowerCase() || "its prerequisites are ready"}${blocker?.id ? ` (${blocker.id})` : ""}. Complete the cutover before starting event work; do not create a past event to prove a prospective Control.`);
   }
   if (templates.some((record) => normalizedEventWindow(eventSchedules.get(record.id)?.window).precision === "timestamp") && !occurredAt) {
     throw new Error(`Event type "${eventType}" has hour-based deadlines and requires an RFC 3339 occurredAt timestamp.`);
@@ -1893,26 +1957,7 @@ function obligationActivity(model, obligation) {
   };
 }
 
-export function obligationRule(obligation, byId, options = {}) {
-  const proposedId = options.includeProposed
-    ? [...(obligation.ruleIds || [])].reverse().find((id) => ["proposed", "approved"].includes(byId.get(id)?.status))
-    : null;
-  if (obligation?.scheduleMode !== "rule" && !proposedId) return null;
-  let rule = byId.get(obligation.activeRuleId || proposedId);
-  if (rule?.status === "active" && rule.effectiveAt && options.now && new Date(rule.effectiveAt) > new Date(options.now)) {
-    const prior = byId.get(rule.supersedesId);
-    return prior?.type === "obligation-rule"
-      && prior.obligationId === obligation.id
-      && ["active", "retired"].includes(prior.status)
-      ? prior
-      : null;
-  }
-  return rule?.type === "obligation-rule"
-    && rule.obligationId === obligation.id
-    && (rule.status === "active" || (options.includeProposed && ["proposed", "approved"].includes(rule.status)))
-    ? rule
-    : null;
-}
+export { obligationRule } from "./obligation-rule.js";
 
 function currentOccurrence(records, occurrenceKey, obligationId, ruleId, window) {
   return records.find((record) => (

package/src/program-lifecycle.js

@@ -1,6 +1,7 @@
 import { currentPartyPeople } from "./parties.js";
 import { modelSupports } from "../model/index.js";
 import { revisionsMatch } from "./revisions.js";
+import { obligationRule } from "./obligation-rule.js";
 
 const requiredDocumentsByControlCache = new WeakMap();
 
@@ -131,8 +132,9 @@ function indexRequiredDocumentsByControl(byId, model) {
   return index;
 }
 
-export function obligationProgramStatus(obligation, byId, asOf, model) {
+export function obligationProgramStatus(obligation, byId, asOf, model, now = `${asOf}T23:59:59Z`) {
   if (obligation.status !== "active") return "proposed";
+  if (!obligationRuleIsEnabled(obligation, byId, now)) return "proposed";
   if (currentPartyPeople(obligation.ownerIds || [], byId).size === 0) return "proposed";
   const policyIds = obligation.policyIds || [];
   const policiesReady = policyIds.every((id) => {
@@ -153,12 +155,18 @@ export function obligationProgramStatus(obligation, byId, asOf, model) {
     : "proposed";
 }
 
-export function obligationIsRunning(obligation, byId, asOf, model) {
+export function obligationIsRunning(obligation, byId, asOf, model, now) {
   return obligation?.type === "obligation"
     && obligation.status === "active"
-    && obligationProgramStatus(obligation, byId, asOf, model) === "accepted";
+    && obligationProgramStatus(obligation, byId, asOf, model, now) === "accepted";
 }
 
 export function obligationIsEnabled(obligation) {
   return obligation?.type === "obligation" && obligation.status === "active";
 }
+
+export function obligationRuleIsEnabled(obligation, byId, now) {
+  return obligationIsEnabled(obligation)
+    && (obligation.scheduleMode !== "rule"
+      || obligationRule(obligation, byId, { now }) !== null);
+}

package/src/program-readiness.js

@@ -13,6 +13,7 @@ import {
   documentIsAuditSpecific,
   governedDocumentIsOperating,
   obligationIsEnabled,
+  obligationRuleIsEnabled,
   obligationIsRunning
 } from "./program-lifecycle.js";
 import { currentPartyPeople, partiesIndependent, partyPeople } from "./parties.js";
@@ -136,6 +137,10 @@ export async function assessProgramReadiness(input, options = {}) {
   const workspace = loaded.workspace || records.find((record) => record.type === "workspace");
   const program = resolveProgram(loaded, options.programId);
   const asOf = options.asOf || currentCalendarDate(workspace?.timezone || "UTC");
+  const currentDate = currentCalendarDate(workspace?.timezone || "UTC");
+  const asOfTime = asOf === currentDate
+    ? options.generatedAt || new Date().toISOString()
+    : timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC");
   const requestedAudit = options.auditId
     ? records.find((record) => record.type === "audit" && record.id === options.auditId)
     : null;
@@ -155,7 +160,7 @@ export async function assessProgramReadiness(input, options = {}) {
   };
 
   const policyStage = await policiesStage(scope, records, byId, readMarkdown, loaded.model);
-  const controlStage = await controlsStage(scope, byId, readMarkdown, asOf, loaded.model, loaded.root);
+  const controlStage = await controlsStage(scope, byId, readMarkdown, asOf, loaded.model, loaded.root, asOfTime);
   controlStage.items.unshift(...collectionReviews
     .filter(({ resourceType }) => resourceType === "complementary-control")
     .map(collectionReviewReadinessItem));
@@ -185,7 +190,7 @@ export async function assessProgramReadiness(input, options = {}) {
   } else {
     controlStage.items.push(...retentionItems, ...retentionReviewItems);
   }
-  const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model);
+  const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model, asOfTime);
   const policyActivations = await assessPolicyActivations(
     requiredPolicies(scope, byId),
     scope.controls,
@@ -193,7 +198,9 @@ export async function assessProgramReadiness(input, options = {}) {
     byId,
     readMarkdown,
     asOf,
-    loaded.model
+    loaded.model,
+    controlStage.items,
+    asOfTime
   );
   const controlOversight = collectionReviews.find(({ resourceType }) => resourceType === "control");
   const oversightEligible = Boolean(controlOversight && controlOversightEligible(controlStage.items));
@@ -268,7 +275,7 @@ export async function assessProgramReadiness(input, options = {}) {
     program?.assuranceGoal === "soc-2-type-2"
     && progressWindow?.start <= asOf
   );
-  const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, model: loaded.model });
+  const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, now: asOfTime, model: loaded.model });
   const policyLibrary = await assessPolicyLibraryUpgrades(loaded);
   const operating = Boolean(
     evidenceReady
@@ -794,7 +801,9 @@ export function collectionReviewReadinessItem(assessment) {
           : `Review ${assessment.configuration.title.toLowerCase()}`,
     proposalAction
       ? `Complete ${firstIncomplete.title} before reviewing ${assessment.configuration.title.toLowerCase()}.`
-      : assessment.message,
+      : assessment.approvalIssues?.length || pendingRetentionRow || needsFirstRecord
+        ? assessment.message
+        : assessment.changesSinceReview?.headline || assessment.message,
     proposalAction
       ? { id: firstIncomplete.resourceId, type: assessment.resourceType }
       : needsFirstRecord ? { type: assessment.resourceType }
@@ -1264,10 +1273,11 @@ function requiredGovernedDocuments(scope, records, byId, model) {
   ));
 }
 
-async function governedContentItems(scope, records, byId, readMarkdown, asOf, model) {
+async function governedContentItems(scope, records, byId, readMarkdown, asOf, model, asOfTime) {
   const enabledObligations = records.filter((record) => (
     record.type === "obligation" && obligationIsEnabled(record)
   ));
+  const operatingSchedules = enabledObligations.filter((record) => obligationRuleIsEnabled(record, byId, asOfTime));
   const requiredGovernedIds = new Set(enabledObligations.flatMap((record) => [
     ...(record.scopeResourceIds || []),
     ...(record.templateResourceId ? [record.templateResourceId] : [])
@@ -1330,7 +1340,7 @@ async function governedContentItems(scope, records, byId, readMarkdown, asOf, mo
           owner: currentPartyPeople(record.ownerIds, byId).size > 0,
           active: record.status === "active",
           requirementsImplemented: linkedControlIds.length > 0 && missingImplementationControlIds.length === 0,
-          assignmentScheduled: enabledObligations.some((obligation) => (
+          assignmentScheduled: operatingSchedules.some((obligation) => (
             obligation.templateResourceId === record.id
             || (obligation.scopeResourceIds || []).includes(record.id)
           )),
@@ -1457,7 +1467,7 @@ function documentActivationLabel(state) {
   })[state] || state;
 }
 
-async function assessPolicyActivations(policies, controls, records, byId, readMarkdown, asOf, model) {
+async function assessPolicyActivations(policies, controls, records, byId, readMarkdown, asOf, model, controlItems, asOfTime) {
   const sourceType = modelSupports(model, "component-sources") ? "component" : "system";
   const sourceField = modelSupports(model, "component-sources") ? "evidenceSourceComponentIds" : "evidenceSourceIds";
   const assessments = [];
@@ -1467,6 +1477,11 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
     const plannedOrPartialControlIds = linkedControls
       .filter((control) => ["planned", "partially-implemented"].includes(control.status))
       .map(({ id }) => id);
+    const missingLaunchControlIds = linkedControls
+      .filter((control) => controlItems.some((item) => (
+        item.id === `control-${control.id}` && item.implementationState === "implemented-with-gaps"
+      )))
+      .map(({ id }) => id);
     const missingComponentControlIds = modelSupports(model, "component-sources")
       ? linkedControls.filter((control) => ![
           ...(control.componentIds || []),
@@ -1495,7 +1510,7 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
       ["scheduled", "event-driven", "mixed"].includes(control.operationPattern)
       && !records.some((record) => (
         record.type === "obligation"
-        && obligationIsEnabled(record)
+        && obligationRuleIsEnabled(record, byId, asOfTime)
         && (record.controlIds || []).includes(control.id)
         && (record.policyIds || []).includes(policy.id)
       ))
@@ -1538,6 +1553,7 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
         : null
     ].filter(Boolean);
     const gapCount = plannedOrPartialControlIds.length
+      + missingLaunchControlIds.length
       + missingComponentControlIds.length
       + missingEvidenceSourceControlIds.length
       + missingScheduleControlIds.length
@@ -1562,6 +1578,7 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
       proposedEffectiveOn: policy.proposedEffectiveOn || null,
       linkedControlIds,
       plannedOrPartialControlIds,
+      missingLaunchControlIds,
       missingComponentControlIds,
       missingEvidenceSourceControlIds,
       missingScheduleControlIds,
@@ -1594,6 +1611,7 @@ function policyActivationLabel(state) {
 function policyActivationItem(assessment) {
   const counts = [
     [assessment.plannedOrPartialControlIds.length, "planned or partial Controls"],
+    [assessment.missingLaunchControlIds.length, "implemented Controls with launch gaps"],
     [assessment.missingComponentControlIds.length, "Controls missing active Components"],
     [assessment.missingEvidenceSourceControlIds.length, "Controls missing ready evidence sources"],
     [assessment.missingScheduleControlIds.length, "Controls missing enabled Obligations"],
@@ -1642,7 +1660,7 @@ function legacyPolicyLibraryProposals(records) {
   }];
 }
 
-async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null) {
+async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null, asOfTime) {
   const items = [];
   const families = selectedControlFamilies(scope.controls, model);
   if (!scope.controls.length) {
@@ -1696,12 +1714,24 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null
       criteriaMapping: (control.requirementIds || []).length > 0,
       ...(["scheduled", "event-driven", "mixed"].includes(control.operationPattern) ? {
         workQueue: queueSchedules.length > 0
-          && queueSchedules.some(obligationIsEnabled)
+          && queueSchedules.some((obligation) => obligationRuleIsEnabled(obligation, byId, asOfTime))
       } : {})
     };
+    const launchChecks = Object.fromEntries(Object.entries(checks).filter(([name]) => ![
+      "implemented", "implementationDate"
+    ].includes(name)));
+    const launchReady = Object.values(launchChecks).every(Boolean);
+    const implementationState = control.status === "implemented"
+      ? Object.values(checks).every(Boolean) ? "implemented" : "implemented-with-gaps"
+      : control.status === "partially-implemented" ? "partial"
+        : launchReady ? "ready-to-implement" : "planned";
     const missing = Object.entries(checks).filter(([, value]) => !value).map(([name]) => controlCheckLabel(name));
     const nextSteps = controlImplementationSteps(control, checks, {
-      missingSourceFamilies
+      missingSourceFamilies,
+      targets: [...new Set([
+        ...(control.systemIds || []),
+        ...(control.componentIds || [])
+      ].map((id) => byId.get(id)?.title).filter(Boolean))]
     });
     items.push(item(
       `control-${control.id}`,
@@ -1713,17 +1743,20 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null
       control,
       {
         checks,
+        launchChecks,
+        implementationState,
+        implementationAssertion: "Implemented means the stated control works for the named Systems, its owner and procedure match current practice, and its evidence sources can produce proof. Scheduled or event-driven Controls have at least one enabled linked Obligation. It does not assert that a scheduled cycle or event has already occurred. Record dated operating proof when it does.",
         nextSteps,
         commands: [`npx filegrc get ${shellArgument(control.id)} --mutation`],
         workQueue: queueSchedules.length ? {
-          enabled: queueSchedules.filter(obligationIsEnabled).length,
-          running: queueSchedules.filter((obligation) => obligationIsRunning(obligation, byId, asOf, model)).length,
+          enabled: queueSchedules.filter((obligation) => obligationRuleIsEnabled(obligation, byId, asOfTime)).length,
+          running: queueSchedules.filter((obligation) => obligationIsRunning(obligation, byId, asOf, model, asOfTime)).length,
           total: queueSchedules.length
         } : null
       }
     ));
   }
-  return stage("controls", "Implement Controls", "Put each selected Control in place, record how it works, and mark it Implemented when it is working.", items);
+  return stage("controls", "Implement Controls", "Put each selected Control in place. Check its launch conditions, then mark it Implemented when it is working. Dated proof follows during operation.", items);
 }
 
 async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
@@ -1737,10 +1770,6 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
       .map((id) => byId.get(id))
       .filter((record) => (
         record?.type === sourceType
-        && (
-          !(record.evidenceSourceKinds || []).length
-          || family.sourceKinds.some((kind) => (record.evidenceSourceKinds || []).includes(kind))
-        )
       ));
     const completeSources = [];
     const sourceChecks = [];
@@ -1778,7 +1807,7 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
     const coveredControls = controlMappings.filter(({ complete }) => complete);
     const complete = completeSources.length > 0 && coveredControls.length === family.controls.length;
     const commands = [
-      ...(selectedSources.length
+      ...(complete ? [] : selectedSources.length
         ? sourceChecks.filter(({ complete: sourceComplete }) => !sourceComplete).flatMap((sourceCheck) => {
             const sourceId = sourceCheck.sourceComponentId || sourceCheck.sourceSystemId;
             return [
@@ -2085,21 +2114,21 @@ function controlCheckLabel(name) {
     procedureEffective: "procedure effective date",
     policyMapping: "policy mapping",
     criteriaMapping: "criteria mapping",
-    workQueue: "running Obligation schedules"
+    workQueue: "enabled Obligation rules (work starts after cutover)"
   })[name] || name;
 }
 
 const starterControlChecks = {
-  "control-security-governance": "Open the security review calendar and attendee roles. Check a reviewer separate from owners and operators examines risks, incidents, findings, and overdue work on the approved schedule.",
-  "control-policy-management": "Open the Control inventory and a recently revised Policy. Check owners are named, the approver is separate, and the change went through review before approval.",
-  "control-security-communication": "Trace how a security notice or Policy change reaches staff and affected outside parties. Check that the approved reporting routes can be used.",
+  "control-security-governance": "Set a security review calendar and name a reviewer separate from the owners. Make sure the agenda covers risks, incidents, findings, and overdue work when those records exist.",
+  "control-policy-management": "Name Control owners and a separate Policy approver. Set the path for reviewing and approving future Policy changes before they take effect.",
+  "control-security-communication": "Set working normal and fallback routes for security notices and Policy changes to staff and affected outside parties.",
   "control-workforce-expectations": "Review onboarding for roles with sensitive access. Check that required screening, agreements, and Policy acknowledgements happen before access.",
-  "control-security-training": "Compare the worker roster with training assignments. Check starters and role changes get training on time, with repeats tied to current content and the approved schedule.",
-  "control-risk-assessment": "Open the risk assessment against in-scope Systems and Vendors. Check threats, fraud, dependencies, and changes have owners and high risks get the required review.",
-  "control-monitoring-remediation": "Open the latest Control review, or schedule the first. Check incidents, test results, Exceptions, and overdue work, with owners and verified closure for gaps.",
+  "control-security-training": "Set up the worker roster, training audience, assignment rule, and owner. Check that starters and role changes will receive the approved content on time.",
+  "control-risk-assessment": "Set the risk assessment scope for the in-scope Systems and Vendors. Name who reviews threats, fraud, dependencies, changes, and high risks.",
+  "control-monitoring-remediation": "Schedule the first Control review. Name who will inspect incidents, tests, Exceptions, overdue work, and follow-up closure when those records exist.",
   "control-access-authorization": "Open access lists for in-scope Systems and Vendor tools. Check that accounts use unique identities and only needed permissions, and new grants require a business reason and approval.",
   "control-strong-authentication": "Open the System and Vendor lists. For each tool used for production, source code, email, identity, or sensitive data, check MFA, unique accounts, default credentials, and admin roles.",
-  "control-access-review-offboarding": "Export access lists from key Systems and Vendor tools. Check privileged and other access reviews meet their approved schedules, and departures lose access within the required window.",
+  "control-access-review-offboarding": "Confirm access lists can be exported from key Systems and Vendor tools. Assign the first access review and the owner who will remove access when a departure occurs.",
   "control-physical-workspace-security": "Walk through actual work areas and visitor access. Check who can enter nonpublic spaces and how devices, papers, screens, and conversations are protected.",
   "control-data-classification-inventory": "List important data stores in Systems and Vendor tools. Check each has an owner, classification, approved purpose, and recorded location.",
   "control-encryption-transmission": "For Systems, Vendor tools, and devices holding Confidential or Restricted data, check encryption at rest and in transit and who can manage the keys.",
@@ -2107,22 +2136,24 @@ const starterControlChecks = {
   "control-inventory-configuration": "Compare actual services, devices, software, service accounts, Vendors, and data stores with the inventory. Check owners, secure settings, and unsupported assets.",
   "control-endpoint-protection": "Review devices allowed into company Systems. Check encryption, screen lock, updates, and malware protection against the approved settings.",
   "control-network-security": "Open production network and remote-access rules. Check each path has a business reason, approved authentication, and separation; identify rules due for review.",
-  "control-change-management": "Follow a software or infrastructure change from request to deployment. Check the path includes risk review, testing, approval, and a way to recover.",
+  "control-change-management": "Set the path for software and infrastructure changes: risk review, testing, approval, deployment, and recovery. Check teams use it for the next real change.",
   "control-vulnerability-management": "List internet-facing and important Systems. Check each has vulnerability scan coverage or another approved check, and findings have owners and target dates.",
   "control-penetration-testing": "Review the service's exposure, major changes, and customer commitments. Decide whether independent testing is needed and, if so, set its scope and cadence.",
   "control-logging-monitoring": "For each important System, open security logs, alert rules, and service-health checks where needed. Check retention and whether test alerts reach an owner.",
   "control-incident-response": "Walk through how a worker reports an incident. Check who triages, escalates, contains, communicates, and closes it using the approved plan.",
-  "control-incident-exercise": "Send a test alert through a representative incident path. Check acknowledgement, escalation, and fallback, then record participants, failures, and follow-up.",
-  "control-backup-restoration": "For each important System, inspect backup or alternate recovery settings and failure alerts. Run or review a restore test against its recovery needs.",
+  "control-incident-exercise": "Set the incident exercise owner, scenario, and schedule. Check the reporting, escalation, and fallback paths are ready for the first exercise.",
+  "control-backup-restoration": "For each important System, inspect backup or alternate recovery settings and failure alerts. Schedule the first restore test against its recovery needs.",
   "control-continuity-exercise": "Review recovery priorities, contacts, and owners. Check the plan covers loss of an important System or provider and has an exercise date.",
-  "control-vendor-due-diligence": "Open the Vendor list. For each with sensitive data or a material service role, check its security review and contract terms; review older Vendors already in use.",
-  "control-vendor-monitoring": "Open critical and high-risk Vendors. Check each has a current review, an owner for open issues, and timely reassessment after a material change or incident.",
+  "control-vendor-due-diligence": "Identify Vendors with sensitive data or a material service role. Set the review and contract checks before approving a new Vendor; triage existing Vendors for the first review.",
+  "control-vendor-monitoring": "Identify critical and high-risk Vendors, assign review owners and cadence, and set a reassessment trigger for material changes or incidents.",
   "control-security-exceptions": "Review departures from security rules. Check each has a reason, owner, risk assessment, compensating measure, approval, and expiry or review date."
 };
 
 export function controlImplementationSteps(control, checks, options = {}) {
   const steps = [];
-  if (!checks.implemented) steps.push(starterControlChecks[control.id]
+  if (!checks.implemented) steps.push(control.id === "control-strong-authentication" && options.targets?.length
+    ? `Ensure MFA and unique accounts are enabled for ${options.targets.join(", ")}; check default credentials and admin roles.`
+    : starterControlChecks[control.id]
     || "Inspect the systems, people, vendors, or work this Control covers. Compare current practice with its statement and fix any gaps.");
   const record = [];
   if (!checks.owner) record.push("choose an owner");
@@ -2132,8 +2163,8 @@ export function controlImplementationSteps(control, checks, options = {}) {
   if (!checks.evidenceSource) record.push("link the tool or system that can show it happened");
   if (!checks.policyMapping && checks.policyMapping !== undefined) record.push("link the Policy it implements");
   if (!checks.criteriaMapping && checks.criteriaMapping !== undefined) record.push("link the criteria it covers");
-  if (checks.implemented && !checks.implementationDate) record.push("enter the date it started working");
-  if (checks.implemented && (checks.procedureRevision === false || checks.procedureEffective === false)) {
+  if (!checks.implementationDate) record.push("record the actual date it starts working when marking Implemented");
+  if (checks.procedureRevision === false || checks.procedureEffective === false) {
     record.push("record the Procedure revision and effective date");
   }
   if (record.length) steps.push(`In this Control, ${record.join("; ")}.`);
@@ -2148,9 +2179,7 @@ export function controlImplementationSteps(control, checks, options = {}) {
   if (!checks.implemented) {
     if (sourceStep || queueStep) steps.push([sourceStep, queueStep].filter(Boolean).join(" "));
     else if (checks.applicability === false) steps.push("Confirm this Control applies to the current Program scope with `review-applicability --scaffold --type control`.");
-    else steps.push(checks.procedureRevision === undefined
-      ? "When it works, mark this Control Implemented and enter its start date."
-      : "When it works, mark this Control Implemented. Enter its start date and the Procedure revision and effective date.");
+    else steps.push("When these launch conditions hold, mark the Control Implemented. This asserts the practice works now; record proof from future cycles and events as they occur.");
   } else {
     if (sourceStep) steps.push(sourceStep);
     if (queueStep) steps.push(queueStep);

package/src/revisions.js

@@ -42,6 +42,12 @@ export function revisionDigest(kind, value) {
   return null;
 }
 
+export function displayRevision(value) {
+  const text = String(value || "");
+  const match = /^(?:filegrc:[a-z-]+:v\d+:sha256:|scope:)?([a-f0-9]{64})$/.exec(text);
+  return match ? match[1].slice(0, 12) : text;
+}
+
 export function revisionsMatch(kind, stored, current) {
   const storedDigest = revisionDigest(kind, stored);
   const currentDigest = revisionDigest(kind, current);

package/src/state.js

@@ -370,6 +370,7 @@ function serializeCollectionReviewAssessment(assessment) {
     status: assessment.status,
     complete: assessment.complete,
     message: assessment.message,
+    ...(assessment.changesSinceReview ? { changesSinceReview: assessment.changesSinceReview } : {}),
     ...(assessment.recordProposals ? { recordProposals: assessment.recordProposals } : {}),
     ...(assessment.incompleteRecordProposals ? { incompleteRecordProposals: assessment.incompleteRecordProposals } : {}),
     ...(assessment.eligibleReviewerIds ? { eligibleReviewerIds: assessment.eligibleReviewerIds } : {}),

package/src/validate.js

@@ -21,7 +21,7 @@ import {
 } from "./recurrence.js";
 import { resourceReviewRevisionMatches, resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { retentionScheduleApprovalIssues } from "./retention-schedule-approval.js";
-import { obligationIsEnabled } from "./program-lifecycle.js";
+import { obligationIsEnabled, obligationRuleIsEnabled } from "./program-lifecycle.js";
 import { currentPartyPeople, partyPeople } from "./parties.js";
 import { isMarkdownChoice, markdownEntries } from "./resource-markdown.js";
 import { currentCalendarDate, isRfc3339Timestamp, localDateTimeValue, timestampFromLocalDateTime } from "./time.js";
@@ -46,7 +46,7 @@ import {
 } from "./reporting-route-integrity.js";
 import { validateWorkflowHistoryIntegrity } from "./workflow-history-integrity.js";
 import { occurrenceMemberExceptionIsValid } from "./obligation-members.js";
-import { calculateRevision, revisionDigest, revisionsMatch } from "./revisions.js";
+import { calculateRevision, displayRevision, revisionDigest, revisionsMatch } from "./revisions.js";
 
 let fingerprintFileReadObserver = null;
 
@@ -222,7 +222,7 @@ async function validateWorkspaceUnmeasured(input) {
     validateIndependentApproval(record, byId, displayPath, diagnostics);
     validateCompletedObligationEvent(record, byId, loaded.model, displayPath, diagnostics);
     validateActionObligationRule(record, byId, displayPath, diagnostics);
-    validateImplementedControlSchedules(record, obligationsByControl, displayPath, diagnostics);
+    validateImplementedControlSchedules(record, obligationsByControl, byId, new Date().toISOString(), displayPath, diagnostics);
     serialContentDiagnosticTasks.push(async () => {
       const markdownDiagnostics = [];
       const approvalDiagnostics = [];
@@ -1538,7 +1538,7 @@ function assertFingerprintBudget(options, uncachedBytes) {
   }
 }
 
-function validateImplementedControlSchedules(record, obligationsByControl, path, diagnostics) {
+function validateImplementedControlSchedules(record, obligationsByControl, byId, now, path, diagnostics) {
   if (record.type !== "control" || record.status !== "implemented") return;
   const schedules = obligationsByControl.get(record.id) || [];
   if (!schedules.length) {
@@ -1550,16 +1550,20 @@ function validateImplementedControlSchedules(record, obligationsByControl, path,
     ));
     return;
   }
-  if (schedules.some(obligationIsEnabled)) return;
-  const stopped = schedules.filter((obligation) => !obligationIsEnabled(obligation));
+  if (schedules.some((obligation) => obligationRuleIsEnabled(obligation, byId, now))) return;
+  const stopped = schedules.filter((obligation) => !obligationRuleIsEnabled(obligation, byId, now));
   const paused = stopped.filter((obligation) => obligation.status === "paused");
   const proposed = stopped.filter((obligation) => obligation.status === "proposed");
+  const pendingRules = stopped.filter((obligation) => obligationIsEnabled(obligation) && obligation.scheduleMode === "rule");
   const reasons = [
     proposed.length
       ? `${proposed.length} linked ${proposed.length === 1 ? "schedule is" : "schedules are"} still proposed. Enable ${proposed.length === 1 ? "it" : "them"} before implementing the control; the schedule will remain dormant until its governing Policy is active and effective.`
       : "",
     paused.length
       ? `${paused.length} linked ${paused.length === 1 ? "schedule is" : "schedules are"} paused. Enable ${paused.length === 1 ? "it" : "them"} before implementing the control.`
+      : "",
+    pendingRules.length
+      ? `${pendingRules.length} linked ${pendingRules.length === 1 ? "rule is" : "rules are"} not active. Activate the selected rule before implementing the control.`
       : ""
   ].filter(Boolean).join(" ");
   diagnostics.push(error(
@@ -2028,7 +2032,7 @@ function validateRequirementMapping(record, loaded, currentReviewRevisions, path
 
 function revisionMismatchDetails(ids, stored, current) {
   return ids.map((id) => (
-    `${id} (stored: ${stored[id] || "missing"}; current: ${current.get(id) || "missing"})`
+    `${id} (stored: ${displayRevision(stored[id]) || "missing"}; current: ${displayRevision(current.get(id)) || "missing"})`
   )).join(", ");
 }
 

package/src/web.js

@@ -1098,6 +1098,7 @@ function renderPolicyActivationAssessments() {
     return '<article class="policy-activation-card ' + esc(assessment.state) + '"><div class="evidence-map-card-head"><div><span class="badge ' + (operating ? "good" : "warn") + '">' + esc(assessment.label) + '</span><h3><a href="#/resource/policy/' + encodeURIComponent(assessment.policyId) + '">' + esc(assessment.title) + '</a></h3></div><small>' + assessment.gapCount + ' ' + pluralize("gap", assessment.gapCount) + '</small></div>' + warnings +
       '<div class="policy-activation-gaps">' +
       gapGroup("Planned or partial Controls", assessment.plannedOrPartialControlIds, "control") +
+      gapGroup("Implemented Controls with launch gaps", assessment.missingLaunchControlIds || [], "control") +
       gapGroup("Missing active Components", assessment.missingComponentControlIds, "control") +
       gapGroup("Missing ready evidence sources", assessment.missingEvidenceSourceControlIds, "control") +
       gapGroup("Missing enabled Obligations", assessment.missingScheduleControlIds, "control") +
@@ -1212,9 +1213,9 @@ function workflowGuidance(options = {}) {
   const renderRow = (item) => {
     const href = workflowItemHref(item);
     const guidance = options.type === "control" && item.nextSteps?.length
-      ? '<ol class="control-next-steps">' + item.nextSteps.map((step) => '<li>' + esc(step) + '</li>').join("") + '</ol>'
+      ? '<p class="workflow-status">' + esc(controlLaunchLabel(item.implementationState)) + '</p><ol class="control-next-steps">' + item.nextSteps.map((step) => '<li>' + esc(step) + '</li>').join("") + '</ol><small>' + esc(item.implementationAssertion || "") + '</small>'
       : '<small>' + esc(item.message || workflowItemDetail(item)) + '</small>';
-    const body = '<span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong>' + guidance + '</span>';
+    const body = '<span class="workflow-finding-status ' + esc(item.state) + '">' + esc(options.type === "control" && item.implementationState ? controlLaunchLabel(item.implementationState).split(":")[0] : properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong>' + guidance + '</span>';
     return href ? '<a href="' + href + '">' + body + '</a>' : '<div>' + body + '</div>';
   };
   const rows = visible.map(renderRow).join("");
@@ -1226,7 +1227,27 @@ function workflowGuidance(options = {}) {
   return '<section class="workflow-guidance panel detail-support-panel detail-workflow-panel"><div class="panel-head"><div><p class="kicker">To-do</p><h3>' + esc(options.title || "Checklist") + '</h3></div><span class="badge ' + (blocking.length ? "warn" : "good") + '">' + (blocking.length ? "Needs work" : "Current") + '</span></div><p class="workflow-status">' + esc(status) + (completionRequirements ? '. ' + completionRequirements : "") + '</p><div class="workflow-findings">' + rows + '</div>' + more + '</section>';
 }
 
+function controlLaunchLabel(state) {
+  return ({
+    planned: "Planned: launch conditions remain",
+    partial: "Partially implemented: launch conditions remain",
+    "ready-to-implement": "Launch checks ready: confirm it works, then record the start date",
+    "implemented-with-gaps": "Implemented with gaps: fix the launch checks",
+    implemented: "Implemented"
+  })[state] || "Control launch";
+}
+
+function controlLaunchState(id) {
+  return state.programReadiness?.stages?.find(({ id: stageId }) => stageId === "controls")?.items
+    .find(({ id: itemId }) => itemId === "control-" + id)?.implementationState;
+}
+
 function recordCompletionState(record) {
+  if (record.type === "control") {
+    const item = state.programReadiness?.stages?.find(({ id }) => id === "controls")?.items
+      .find(({ id }) => id === "control-" + record.id);
+    if (item?.implementationState === "implemented") return '<section class="record-completion-state panel detail-support-panel"><p class="kicker">Control launch</p><h3>Implemented</h3><p>' + esc(item.implementationAssertion) + '</p><p>Dated evidence belongs to the operating work that produces it.</p></section>';
+  }
   const completeStatuses = new Set(["approved", "active", "complete", "completed", "closed", "done", "reconciled"]);
   if (!completeStatuses.has(record.status)) return "";
   return '<section class="record-completion-state panel detail-support-panel"><p class="kicker">Record status</p><h3>' + esc(properCase(record.status)) + '</h3><p>This record has no direct next step.</p></section>';
@@ -1251,7 +1272,7 @@ function collectionReviewPanel(type, force = false) {
     : "";
   const reviewSummary = current && !reviewBlocker
     ? '<p class="collection-review-result"><strong>' + esc(properCase(assessment.review.decision)) + '</strong><span>Reviewed ' + esc(formatCalendarDate(assessment.review.reviewedOn)) + (reviewerNames.length ? " by " + esc(reviewerNames.join(", ")) : "") + "." + reviewNote + '</span></p>'
-    : '<p class="collection-review-result"><strong>' + (scheduleBlocker ? "Complete schedule first" : proposalBlocker ? "Complete proposals first" : needsFirstRecord ? "Records required" : assessment.status === "stale" ? "Review again" : "Review required") + '</strong><span>' + esc(reviewBlocker || assessment.message) + '</span></p>';
+    : '<p class="collection-review-result"><strong>' + (scheduleBlocker ? "Complete schedule first" : proposalBlocker ? "Complete proposals first" : needsFirstRecord ? "Records required" : assessment.status === "stale" ? "Review again" : "Review required") + '</strong><span>' + esc(reviewBlocker || (assessment.status === "stale" && assessment.changesSinceReview ? "Check what changed since the last review, then confirm the current records." : assessment.message)) + '</span></p>';
   const compactReviewSummary = current && !reviewBlocker
     ? '<p class="collection-review-result"><strong>' + esc(properCase(assessment.review.decision)) + '</strong><span>Reviewed ' + esc(formatCalendarDate(assessment.review.reviewedOn)) + (reviewerNames.length ? " by " + esc(reviewerNames.join(", ")) : "") + ".</span></p>"
     : reviewSummary;
@@ -1270,8 +1291,11 @@ function collectionReviewPanel(type, force = false) {
   const summary = current
     ? '<div class="collection-review-current-row"><div class="collection-review-complete-summary"><span class="kicker">' + (scheduleReview ? "Approved schedule" : "Scope confirmation") + '</span>' + compactReviewSummary + '</div>' + details + action + '</div>'
     : details;
+  const changes = !current && assessment.status === "stale" && !reviewBlocker
+    ? collectionReviewChangesHtml(assessment.changesSinceReview)
+    : "";
   return '<section class="collection-review-panel panel ' + (current ? "current" : "required") + '">' + summary +
-    (current ? "" : '<div class="collection-review-foot">' + reviewSummary + action + '</div>') + '</section>';
+    changes + (current ? "" : '<div class="collection-review-foot">' + reviewSummary + action + '</div>') + '</section>';
 }
 
 function retentionScheduleApprovalBlocker() {
@@ -1405,8 +1429,13 @@ function recordWorkflowCell(type, entry, detailContext = "") {
   const item = items[0];
   let href = workflowItemHref(item) || "#/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(entry.record.id);
   if (detailContext && href.startsWith("#/resource/" + encodeURIComponent(type) + "/") && !href.includes("?")) href += detailContext;
-  const title = type === "control" ? "Finish implementation" : item.title;
-  return '<a class="record-workflow-action" href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(title) + '</strong><small>' + esc(stagePageItemDetail(item)) + (items.length > 1 ? " +" + (items.length - 1) + " more" : "") + '</small></span></a>';
+  const title = type === "control"
+    ? item.implementationState === "implemented-with-gaps" ? "Fix Control launch gaps" : "Finish implementation"
+    : item.title;
+  const statusLabel = type === "control" && item.implementationState
+    ? controlLaunchLabel(item.implementationState).split(":")[0]
+    : properCase(item.state);
+  return '<a class="record-workflow-action" href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(statusLabel) + '</span><span><strong>' + esc(title) + '</strong><small>' + esc(stagePageItemDetail(item)) + (items.length > 1 ? " +" + (items.length - 1) + " more" : "") + '</small></span></a>';
 }
 
 function openCollectionReviewDialog(type) {
@@ -1452,9 +1481,10 @@ function openCollectionReviewDialog(type) {
   const saveDescription = scheduleReview
     ? 'Approve the governing document and ' + assessment.recordCount + ' current ' + pluralize("schedule row", assessment.recordCount) + ' as one revision. A later document, row, or material scope change requires another approval.'
     : 'Confirm ' + assessment.recordCount + ' current ' + pluralize("record", assessment.recordCount) + '. If the collection or material scope changes, FileGRC will ask for another review.';
+  const changes = collectionReviewChangesHtml(assessment.changesSinceReview);
   const confirmSubmit = '<button type="submit" class="button primary">Confirm and save</button>';
   const submit = scheduleReview ? '<button type="submit" class="button primary">Approve schedule</button>' : confirmSubmit;
-  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">' + dialogKicker + '</p><h2 id="collection-review-dialog-title">' + esc(dialogTitle) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>' + esc(configuration.description) + '</p><section class="event-dialog-steps collection-review-checks"><strong>' + checklistLabel + '</strong><ul>' + configuration.reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></section>' + reviewerHelp + '<div class="form-grid"><label><span>Conclusion</span><select name="decision" required>' + decisions + '</select></label><label><span>Reviewer</span><select name="reviewerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + ((assessment.review?.reviewedByIds || []).includes(record.id) ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Reviewed on</span><input name="reviewedOn" type="date" required value="' + esc(currentDate()) + '"></label><label data-authoritative-system><span>Authoritative ' + (v4 ? "Component" : "System") + '</span><select name="authoritativeSourceId"><option value="">Select</option>' + systems.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (preservedAuthoritativeSourceId === record.id ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label class="full"><span>Review notes</span><textarea name="rationale" rows="3" required placeholder="Note what you confirmed and any scope decision that needs context.">' + esc(assessment.review?.rationale || "") + '</textarea></label></div><div class="workflow-preview"><strong>What this saves</strong><p>' + esc(saveDescription) + '</p></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><span class="save-status review-save-status" role="status" aria-live="polite"></span><button type="button" class="button" data-event="cancel">Cancel</button>' + submit + '</div></form>';
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">' + dialogKicker + '</p><h2 id="collection-review-dialog-title">' + esc(dialogTitle) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>' + esc(configuration.description) + '</p>' + changes + '<section class="event-dialog-steps collection-review-checks"><strong>' + checklistLabel + '</strong><ul>' + configuration.reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></section>' + reviewerHelp + '<div class="form-grid"><label><span>Conclusion</span><select name="decision" required>' + decisions + '</select></label><label><span>Reviewer</span><select name="reviewerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + ((assessment.review?.reviewedByIds || []).includes(record.id) ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Reviewed on</span><input name="reviewedOn" type="date" required value="' + esc(currentDate()) + '"></label><label data-authoritative-system><span>Authoritative ' + (v4 ? "Component" : "System") + '</span><select name="authoritativeSourceId"><option value="">Select</option>' + systems.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (preservedAuthoritativeSourceId === record.id ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label class="full"><span>Review notes</span><textarea name="rationale" rows="3" required placeholder="Note what you confirmed and any scope decision that needs context.">' + esc(assessment.review?.rationale || "") + '</textarea></label></div><div class="workflow-preview"><strong>What this saves</strong><p>' + esc(saveDescription) + '</p></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><span class="save-status review-save-status" role="status" aria-live="polite"></span><button type="button" class="button" data-event="cancel">Cancel</button>' + submit + '</div></form>';
   document.body.append(dialog);
   dialog.showModal();
   const form = dialog.querySelector("form");
@@ -1516,6 +1546,23 @@ function openCollectionReviewDialog(type) {
   });
 }
 
+function collectionReviewChangesHtml(changes) {
+  if (!changes) return "";
+  if (changes.status !== "available") {
+    return '<section class="collection-review-change-list"><strong>What changed since the last review</strong><p>' + esc(changes.summary) + '</p></section>';
+  }
+  const rows = changes.changes.map((change) => {
+    const details = change.kind !== "changed" ? change.kind === "added" ? "entered review scope" : "left review scope" : [
+      ...change.fields,
+      ...(change.contentChanged ? ["Markdown"] : []),
+      ...(change.membershipChanged ? ["collection membership"] : [])
+    ].join(", ");
+    return '<li><strong>' + esc(change.title) + '</strong> <span>(' + esc(change.type) + ')</span>: ' + esc(details) + '</li>';
+  });
+  if (changes.scopeFields?.length) rows.push('<li><strong>Program scope</strong>: ' + esc(changes.scopeFields.join(", ")) + '</li>');
+  return '<section class="collection-review-change-list"><strong>What changed since the last review</strong><p>Check these changes before recording a new conclusion.</p><ul>' + rows.join("") + '</ul></section>';
+}
+
 function workflowItemHref(item) {
   const destinationOptions = {
     retentionScheduleApproval: modelSupports("retention-schedule-approval"),
@@ -1818,7 +1865,7 @@ function stagePageCard(stage, destination, index) {
   const taskPreview = items.length
     ? '<div class="stage-page-tasks">' + items.slice(0, 3).map((item) => {
         const href = destination.utility === "evidence-sources" ? destination.href : item.href || workflowItemHref(item) || destination.href;
-        return '<a href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(stagePageItemDetail(item)) + '</small></span></a>';
+        return '<a href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(item.implementationState ? controlLaunchLabel(item.implementationState).split(":")[0] : properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(stagePageItemDetail(item)) + '</small></span></a>';
       }).join("") + (items.length > 3 ? '<small class="stage-page-tasks-more">+' + (items.length - 3) + ' more on this page</small>' : "") + '</div>'
     : "";
   return '<article class="stage-page-card ' + (complete ? "complete" : "") + '"><div class="stage-page-card-head"><div><small>' + esc(stepLabel) + '</small><h3>' + esc(destination.label) + '</h3></div><div class="stage-page-card-actions">' + completionState + '<a class="stage-page-open" href="' + destination.href + '" aria-label="Open ' + esc(destination.label) + '"><span>Open ›</span></a></div></div><p>' + esc(summary) + '</p>' + taskPreview + '</article>';
@@ -2256,8 +2303,9 @@ function policyEventTrigger(trigger, index, collapsed = false, scope = "events")
   const tooltipId = "policy-event-tooltip-" + scope + "-" + index;
   const proposed = trigger.programStatus === "proposed";
   const unavailable = state.readOnly || proposed;
+  const blocker = trigger.steps.find(({ programBlocker }) => programBlocker)?.programBlocker;
   const availability = proposed
-    ? "Available after its governing policies are effective, at least one linked control is implemented, and every task has a current owner."
+    ? "Dormant until " + (blocker ? blocker.label.toLowerCase() + " (" + blocker.id + ")" : "its governing content is active and effective") + ". Use this workflow for the first real event after cutover."
     : state.readOnly
       ? "Open this workspace in writable mode to trigger the workflow."
       : trigger.steps.length + " " + pluralize("task", trigger.steps.length) + " will be added to the Work Queue.";
@@ -3198,7 +3246,7 @@ function renderList(main, type, params = new URLSearchParams()) {
     const start = (pageNumber - 1) * LIST_PAGE_SIZE;
     const visible = filtered.slice(start, start + LIST_PAGE_SIZE);
     main.querySelector("#result-count").textContent = filtered.length + (filtered.length === 1 ? " record" : " records");
-    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + detailContext + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? displayStatus(entry.record) : entry.record[name], name, type, true)) + '</td>').join("") + '<td data-label="Next action">' + recordWorkflowCell(type, entry) + '</td><td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 3) + '">' + empty(entries.length ? "No records match this filter." : collectionEmptyState(type, definition)) + '</td></tr>';
+    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + detailContext + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? type === "control" ? controlLaunchState(entry.record.id) || displayStatus(entry.record) : displayStatus(entry.record) : entry.record[name], name, type, true)) + '</td>').join("") + '<td data-label="Next action">' + recordWorkflowCell(type, entry) + '</td><td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 3) + '">' + empty(entries.length ? "No records match this filter." : collectionEmptyState(type, definition)) + '</td></tr>';
     pagination.hidden = totalPages === 1;
     previous.disabled = pageNumber === 1;
     next.disabled = pageNumber === totalPages;
@@ -6584,6 +6632,7 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .stage-page-card-actions{display:flex;align-items:center;gap:10px}.stage-page-card-actions .stage-page-open{white-space:nowrap}.stage-page-open::after{content:"";position:absolute;inset:0;z-index:1;border-radius:10px}.stage-page-open:focus-visible::after{outline:2px solid var(--focus);outline-offset:2px}.stage-page-open>span{position:relative;z-index:2}
 .workflow-findings>a:hover{border-color:var(--accent-light);box-shadow:0 3px 9px rgba(21,40,33,.05)}.workflow-findings>a:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.stage-page-card-head{align-items:flex-start}.stage-page-completion-state{flex:0 0 auto;max-width:150px;padding:5px 8px;border-radius:99px;background:#f7e9cf;color:#855717;font-size:9.6px;font-weight:750;line-height:1.25;text-align:right}.stage-page-completion-state.complete{background:#ddefe5;color:#176143}.obligation-card.workflow-target{outline:2px solid var(--focus);outline-offset:3px}.obligation-card-foot{flex-wrap:wrap}.obligation-card-foot .obligation-links{flex:1 1 120px}
 .collection-review-panel.current details{margin-top:8px}.collection-review-detail-content{margin-top:10px}.collection-review-complete-summary{display:flex;align-items:baseline;gap:10px}.collection-review-complete-summary>.kicker{margin:0;white-space:nowrap}.collection-review-panel.current .collection-review-foot{justify-content:flex-end;margin-top:8px}
+.collection-review-change-list{margin:14px 0;padding:12px 14px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft)}.collection-review-change-list>strong{font-size:11px}.collection-review-change-list p{margin:7px 0 0;color:var(--muted);font-size:11px;line-height:1.5}.collection-review-change-list ul{max-height:180px;overflow:auto;margin:9px 0 0;padding-left:20px;font-size:11px;line-height:1.55}.collection-review-change-list li+li{margin-top:5px}.collection-review-change-list li span{color:var(--muted)}
 .collection-review-current-row{display:flex;align-items:center;gap:10px;flex-wrap:wrap}.collection-review-panel.current .collection-review-details{flex:0 0 auto;margin:0;padding:0;border:0;background:transparent}.collection-review-panel.current .collection-review-details>summary{color:var(--accent);white-space:nowrap}.collection-review-panel.current .collection-review-details[open]{flex-basis:100%;order:3;padding:10px 12px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft)}.collection-review-panel.current .collection-review-details[open]>summary{margin-bottom:10px}.collection-review-panel.current .collection-review-details[open] .collection-review-detail-content{margin-top:0}.collection-review-panel.current .button{margin-left:auto}
 @media(max-width:520px){.collection-review-complete-summary{flex:1 1 180px;min-width:0;flex-wrap:wrap}.collection-review-complete-summary .collection-review-result{min-width:0;flex-wrap:wrap}.collection-review-complete-summary .collection-review-result span{overflow-wrap:anywhere}.collection-review-panel.current .button{margin-left:0}}
 @media(max-width:520px){.stage-page-card-head{align-items:stretch;flex-direction:column;gap:10px}.stage-page-card-actions{justify-content:space-between}}

package/src/workflow.js

@@ -26,6 +26,7 @@ import { assessAuditPreparation } from "./audit-preparation.js";
 import { assessProgramReadiness } from "./program-readiness.js";
 import { resolveProgram } from "./program.js";
 import { resourceReviewRevisions, retentionReviewResourceIds, retentionRuleIsCurrent } from "./retention.js";
+import { displayRevision } from "./revisions.js";
 import { signatoryAppointmentIssue, soc2ReportEvidenceIssue, subsequentEventsReviewIssue } from "./soc2.js";
 import { planReconciliation } from "./reconciliation.js";
 import { documentIsAuditSpecific } from "./program-lifecycle.js";
@@ -544,8 +545,8 @@ function finalizationFields(record, model, resources, program, root) {
       field: "applicabilityReview",
       requiredness: "required",
       message: record.applicabilityReview?.scopeRevision
-        ? `Review applicability against the current service scope. Stored revision: ${record.applicabilityReview.scopeRevision}. Current revision: ${currentRevision}. Then record the decision, rationale, reviewer, and date.`
-        : `Review applicability against the current service scope. Current revision: ${currentRevision}. Then record the decision, rationale, reviewer, and date.`
+        ? `Review applicability against the current service scope. Stored revision: ${displayRevision(record.applicabilityReview.scopeRevision)}. Current revision: ${displayRevision(currentRevision)}. Then record the decision, rationale, reviewer, and date.`
+        : `Review applicability against the current service scope. Current revision: ${displayRevision(currentRevision)}. Then record the decision, rationale, reviewer, and date.`
     });
   }
   if (record.type === "policy" && model.resources.policy?.fields?.programRole && !record.programRole) {
@@ -1138,6 +1139,11 @@ function normalizeFinding(code, item, context) {
     title: item.title,
     message: item.message,
     ...(item.nextSteps?.length ? { nextSteps: item.nextSteps } : {}),
+    ...(item.implementationState ? {
+      implementationState: item.implementationState,
+      launchChecks: item.launchChecks,
+      implementationAssertion: item.implementationAssertion
+    } : {}),
     ...(item.checks ? { unmetChecks: Object.entries(item.checks)
       .filter(([, passed]) => passed === false)
       .map(([name]) => name) } : {}),