filegrc 0.16.16 → 0.16.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.16",
+  "version": "0.16.17",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/obligation-rule.js

@@ -0,0 +1,20 @@
+export function obligationRule(obligation, byId, options = {}) {
+  const proposedId = options.includeProposed
+    ? [...(obligation.ruleIds || [])].reverse().find((id) => ["proposed", "approved"].includes(byId.get(id)?.status))
+    : null;
+  if (obligation?.scheduleMode !== "rule" && !proposedId) return null;
+  let rule = byId.get(obligation.activeRuleId || proposedId);
+  if (rule?.status === "active" && rule.effectiveAt && options.now && new Date(rule.effectiveAt) > new Date(options.now)) {
+    const prior = byId.get(rule.supersedesId);
+    return prior?.type === "obligation-rule"
+      && prior.obligationId === obligation.id
+      && ["active", "retired"].includes(prior.status)
+      ? prior
+      : null;
+  }
+  return rule?.type === "obligation-rule"
+    && rule.obligationId === obligation.id
+    && (rule.status === "active" || (options.includeProposed && ["proposed", "approved"].includes(rule.status)))
+    ? rule
+    : null;
+}

package/src/obligations.js

@@ -21,7 +21,8 @@ import {
 } from "./recurrence.js";
 import { currentCalendarDate, isRfc3339Timestamp, localDateTimeValue, timestampFromLocalDateTime } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
-import { obligationGovernedContent, obligationProgramStatus } from "./program-lifecycle.js";
+import { obligationRule } from "./obligation-rule.js";
+import { governedContentIsOperating, obligationGovernedContent, obligationProgramStatus } from "./program-lifecycle.js";
 import { resolveProgram } from "./program.js";
 import { currentPartyPeople } from "./parties.js";
 import { serializeWorkspaceMutation } from "./mutation.js";
@@ -84,9 +85,9 @@ export function planObligations(resources, options = {}) {
     throw new Error("Obligation planning requires programId when more than one Program is active.");
   }
   const asOf = requireDate(options.asOf ?? currentCalendarDate(workspace?.timezone || "UTC"), "as-of date");
-  const defaultNow = options.asOf
-    ? timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC")
-    : new Date().toISOString();
+  const defaultNow = asOf === currentCalendarDate(workspace?.timezone || "UTC")
+    ? new Date().toISOString()
+    : timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC");
   const now = requireTimestamp(options.now ?? defaultNow, "current timestamp");
   const through = requireDate(options.through ?? addCalendarDays(asOf, 90), "through date");
   const requestedFrom = options.from ? requireDate(options.from, "from date") : null;
@@ -102,7 +103,7 @@ export function planObligations(resources, options = {}) {
     && obligationBelongsToProgram(record, obligationProgram, model)
   ));
   const programStatusByObligationId = new Map(obligations.map((obligation) => [
-    obligation.id, obligationProgramStatus(obligation, byId, asOf, model)
+    obligation.id, obligationProgramStatus(obligation, byId, asOf, model, now)
   ]));
   const obligationIds = new Set(obligations.map(({ id }) => id));
   if (obligations.length > MAX_PLANNED_ITEMS) {
@@ -120,14 +121,17 @@ export function planObligations(resources, options = {}) {
   };
 
   for (const obligation of obligations) {
+    const selectedRule = byId.get(obligation.activeRuleId);
     const rule = obligation.scheduleMode === "rule"
       ? obligationRule(obligation, byId, { now, includeProposed: true })
+        || (selectedRule?.status === "active" && selectedRule.effectiveAt
+          && new Date(selectedRule.effectiveAt) > new Date(now) ? selectedRule : null)
       : null;
     const schedule = rule || obligation;
     const activity = obligationActivity(model, obligation);
     const expectedCompletionTypes = activity.completionResourceTypes;
     const programStatus = programStatusByObligationId.get(obligation.id);
-    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf) : null;
+    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf, model, now) : null;
     if (schedule.recurrence?.mode === "event" && schedule.recurrence.eventType) {
       const eventType = schedule.recurrence.eventType;
       const group = triggerGroups.get(eventType) ?? {
@@ -298,7 +302,7 @@ export function planObligations(resources, options = {}) {
     const overdueOn = addCalendarDays(dueWindowEnd, 1);
     const window = { dueWindowStart, dueWindowEnd, overdueOn };
     const programStatus = programStatusByObligationId.get(obligation.id);
-    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf) : null;
+    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf, model, now) : null;
     const activity = obligationActivity(model, obligation);
     const completedMemberIds = (occurrence.members || [])
       .filter(({ disposition, result }) => disposition === "expected" && result === "passed")
@@ -420,10 +424,17 @@ export function planObligations(resources, options = {}) {
   };
 }
 
-function obligationProgramBlocker(obligation, byId, asOf) {
+function obligationProgramBlocker(obligation, byId, asOf, model, now = `${asOf}T23:59:59Z`) {
   if (obligation.status !== "active") {
     return { type: "obligation", id: obligation.id, label: "Activate obligation" };
   }
+  if (obligation.scheduleMode === "rule" && !obligationRule(obligation, byId, { now })) {
+    const selectedRule = byId.get(obligation.activeRuleId);
+    return {
+      type: "obligation-rule", id: obligation.activeRuleId,
+      label: selectedRule?.status === "active" ? "Wait for rule effective time" : "Activate rule"
+    };
+  }
   if (currentPartyPeople(obligation.ownerIds || [], byId).size === 0) {
     return { type: "obligation", id: obligation.id, label: "Assign current owner" };
   }
@@ -433,6 +444,11 @@ function obligationProgramBlocker(obligation, byId, asOf) {
       return { type: "policy", id, label: "Activate policy" };
     }
   }
+  const inactiveContent = obligationGovernedContent(obligation, byId, model)
+    .find((record) => !governedContentIsOperating(record, asOf, model));
+  if (inactiveContent) {
+    return { type: inactiveContent.type, id: inactiveContent.id, label: `Activate ${inactiveContent.type}` };
+  }
   const controls = (obligation.controlIds || []).map((id) => byId.get(id)).filter(Boolean);
   if (controls.length && !controls.some(({ status }) => status === "implemented")) {
     return { type: "control", id: controls[0].id, label: "Implement control" };
@@ -466,6 +482,27 @@ async function createObligationEventUnlocked(input, options) {
   if (riskLevel && !["normal", "high"].includes(riskLevel)) {
     throw new Error("A departure risk level must be normal or high.");
   }
+  if (!occurredAt) {
+    const intradayCutover = records.find((record) => {
+      if (
+        record.type !== "obligation"
+        || !["active", "proposed"].includes(record.status)
+        || (program && !obligationBelongsToProgram(record, program, loaded.model))
+        || (Array.isArray(record.eventRiskLevels) && !record.eventRiskLevels.includes(riskLevel))
+      ) return false;
+      const rule = byId.get(record.activeRuleId);
+      return rule?.type === "obligation-rule"
+        && rule.status === "active"
+        && rule.recurrence?.mode === "event"
+        && rule.recurrence.eventType === eventType
+        && rule.effectiveAt
+        && timestampCalendarDate(rule.effectiveAt, loaded.workspace.timezone) === occurredOn;
+    });
+    if (intradayCutover) {
+      throw new Error(`Event type "${eventType}" requires occurredAt on ${occurredOn} because a linked rule takes effect during that date. Record the real event time with its timezone.`);
+    }
+  }
+  const eventTime = occurredAt || `${occurredOn}T23:59:59Z`;
   const eventSchedules = new Map();
   const templates = records.filter((record) => {
     if (
@@ -473,16 +510,43 @@ async function createObligationEventUnlocked(input, options) {
       || record.status !== "active"
       || (program && !obligationBelongsToProgram(record, program, loaded.model))
     ) return false;
-    const schedule = obligationRule(record, byId, { now: occurredAt || `${occurredOn}T23:59:59Z` }) || record;
+    const schedule = obligationRule(record, byId, { now: eventTime }) || record;
     const matches = schedule.recurrence?.mode === "event"
       && schedule.recurrence.eventType === eventType
       && (!Array.isArray(record.eventRiskLevels) || record.eventRiskLevels.includes(riskLevel));
     if (matches) eventSchedules.set(record.id, schedule);
     return matches;
   });
-  if (!eventType || templates.length === 0) throw new Error(`No active obligations use event type "${eventType}".`);
-  if (templates.some((record) => obligationProgramStatus(record, byId, occurredOn, loaded.model) === "proposed")) {
-    throw new Error(`Event type "${eventType}" still has starter proposals. Make every governing Policy and required governed-content record active and effective, then implement at least one linked Control before starting this workflow.`);
+  const proposed = records.find((record) => {
+    if (
+      record.type !== "obligation"
+      || !["active", "proposed"].includes(record.status)
+      || (program && !obligationBelongsToProgram(record, program, loaded.model))
+      || (Array.isArray(record.eventRiskLevels) && !record.eventRiskLevels.includes(riskLevel))
+    ) return false;
+    const rule = obligationRule(record, byId, { now: eventTime, includeProposed: true });
+    const selectedRule = byId.get(record.activeRuleId);
+    const futureRule = selectedRule?.status === "active" && selectedRule.effectiveAt
+      && new Date(selectedRule.effectiveAt) > new Date(eventTime);
+    const schedule = rule || (futureRule ? selectedRule : record);
+    return schedule.recurrence?.mode === "event"
+      && schedule.recurrence.eventType === eventType
+      && (record.status === "proposed" || (rule && rule.status !== "active") || (futureRule && !rule));
+  });
+  if (!eventType || templates.length === 0 || proposed) {
+    const selectedRule = byId.get(proposed?.activeRuleId);
+    const futureRule = selectedRule?.status === "active" && selectedRule.effectiveAt
+      && new Date(selectedRule.effectiveAt) > new Date(eventTime);
+    throw new Error(futureRule
+      ? `Event type "${eventType}" is dormant until rule ${selectedRule.id} takes effect at ${selectedRule.effectiveAt}. Trigger only a real event after that time.`
+      : proposed
+        ? `Event type "${eventType}" is still a proposed workflow (${proposed.id}). Confirm its owner, deadline, and required proof, then enable its rule in Step 3. It stays dormant until governing content is effective; trigger only a real event after cutover.`
+        : `No active obligations use event type "${eventType}".`);
+  }
+  const dormant = templates.find((record) => obligationProgramStatus(record, byId, occurredOn, loaded.model, eventTime) === "proposed");
+  if (dormant) {
+    const blocker = obligationProgramBlocker(dormant, byId, occurredOn, loaded.model, eventTime);
+    throw new Error(`Event type "${eventType}" is dormant until ${blocker?.label?.toLowerCase() || "its prerequisites are ready"}${blocker?.id ? ` (${blocker.id})` : ""}. Complete the cutover before starting event work; do not create a past event to prove a prospective Control.`);
   }
   if (templates.some((record) => normalizedEventWindow(eventSchedules.get(record.id)?.window).precision === "timestamp") && !occurredAt) {
     throw new Error(`Event type "${eventType}" has hour-based deadlines and requires an RFC 3339 occurredAt timestamp.`);
@@ -1893,26 +1957,7 @@ function obligationActivity(model, obligation) {
   };
 }
 
-export function obligationRule(obligation, byId, options = {}) {
-  const proposedId = options.includeProposed
-    ? [...(obligation.ruleIds || [])].reverse().find((id) => ["proposed", "approved"].includes(byId.get(id)?.status))
-    : null;
-  if (obligation?.scheduleMode !== "rule" && !proposedId) return null;
-  let rule = byId.get(obligation.activeRuleId || proposedId);
-  if (rule?.status === "active" && rule.effectiveAt && options.now && new Date(rule.effectiveAt) > new Date(options.now)) {
-    const prior = byId.get(rule.supersedesId);
-    return prior?.type === "obligation-rule"
-      && prior.obligationId === obligation.id
-      && ["active", "retired"].includes(prior.status)
-      ? prior
-      : null;
-  }
-  return rule?.type === "obligation-rule"
-    && rule.obligationId === obligation.id
-    && (rule.status === "active" || (options.includeProposed && ["proposed", "approved"].includes(rule.status)))
-    ? rule
-    : null;
-}
+export { obligationRule } from "./obligation-rule.js";
 
 function currentOccurrence(records, occurrenceKey, obligationId, ruleId, window) {
   return records.find((record) => (

package/src/program-lifecycle.js

@@ -1,6 +1,7 @@
 import { currentPartyPeople } from "./parties.js";
 import { modelSupports } from "../model/index.js";
 import { revisionsMatch } from "./revisions.js";
+import { obligationRule } from "./obligation-rule.js";
 
 const requiredDocumentsByControlCache = new WeakMap();
 
@@ -131,8 +132,9 @@ function indexRequiredDocumentsByControl(byId, model) {
   return index;
 }
 
-export function obligationProgramStatus(obligation, byId, asOf, model) {
+export function obligationProgramStatus(obligation, byId, asOf, model, now = `${asOf}T23:59:59Z`) {
   if (obligation.status !== "active") return "proposed";
+  if (!obligationRuleIsEnabled(obligation, byId, now)) return "proposed";
   if (currentPartyPeople(obligation.ownerIds || [], byId).size === 0) return "proposed";
   const policyIds = obligation.policyIds || [];
   const policiesReady = policyIds.every((id) => {
@@ -153,12 +155,18 @@ export function obligationProgramStatus(obligation, byId, asOf, model) {
     : "proposed";
 }
 
-export function obligationIsRunning(obligation, byId, asOf, model) {
+export function obligationIsRunning(obligation, byId, asOf, model, now) {
   return obligation?.type === "obligation"
     && obligation.status === "active"
-    && obligationProgramStatus(obligation, byId, asOf, model) === "accepted";
+    && obligationProgramStatus(obligation, byId, asOf, model, now) === "accepted";
 }
 
 export function obligationIsEnabled(obligation) {
   return obligation?.type === "obligation" && obligation.status === "active";
 }
+
+export function obligationRuleIsEnabled(obligation, byId, now) {
+  return obligationIsEnabled(obligation)
+    && (obligation.scheduleMode !== "rule"
+      || obligationRule(obligation, byId, { now }) !== null);
+}

package/src/program-readiness.js

@@ -13,6 +13,7 @@ import {
   documentIsAuditSpecific,
   governedDocumentIsOperating,
   obligationIsEnabled,
+  obligationRuleIsEnabled,
   obligationIsRunning
 } from "./program-lifecycle.js";
 import { currentPartyPeople, partiesIndependent, partyPeople } from "./parties.js";
@@ -136,6 +137,10 @@ export async function assessProgramReadiness(input, options = {}) {
   const workspace = loaded.workspace || records.find((record) => record.type === "workspace");
   const program = resolveProgram(loaded, options.programId);
   const asOf = options.asOf || currentCalendarDate(workspace?.timezone || "UTC");
+  const currentDate = currentCalendarDate(workspace?.timezone || "UTC");
+  const asOfTime = asOf === currentDate
+    ? options.generatedAt || new Date().toISOString()
+    : timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC");
   const requestedAudit = options.auditId
     ? records.find((record) => record.type === "audit" && record.id === options.auditId)
     : null;
@@ -155,7 +160,7 @@ export async function assessProgramReadiness(input, options = {}) {
   };
 
   const policyStage = await policiesStage(scope, records, byId, readMarkdown, loaded.model);
-  const controlStage = await controlsStage(scope, byId, readMarkdown, asOf, loaded.model, loaded.root);
+  const controlStage = await controlsStage(scope, byId, readMarkdown, asOf, loaded.model, loaded.root, asOfTime);
   controlStage.items.unshift(...collectionReviews
     .filter(({ resourceType }) => resourceType === "complementary-control")
     .map(collectionReviewReadinessItem));
@@ -185,7 +190,7 @@ export async function assessProgramReadiness(input, options = {}) {
   } else {
     controlStage.items.push(...retentionItems, ...retentionReviewItems);
   }
-  const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model);
+  const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model, asOfTime);
   const policyActivations = await assessPolicyActivations(
     requiredPolicies(scope, byId),
     scope.controls,
@@ -193,7 +198,9 @@ export async function assessProgramReadiness(input, options = {}) {
     byId,
     readMarkdown,
     asOf,
-    loaded.model
+    loaded.model,
+    controlStage.items,
+    asOfTime
   );
   const controlOversight = collectionReviews.find(({ resourceType }) => resourceType === "control");
   const oversightEligible = Boolean(controlOversight && controlOversightEligible(controlStage.items));
@@ -268,7 +275,7 @@ export async function assessProgramReadiness(input, options = {}) {
     program?.assuranceGoal === "soc-2-type-2"
     && progressWindow?.start <= asOf
   );
-  const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, model: loaded.model });
+  const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, now: asOfTime, model: loaded.model });
   const policyLibrary = await assessPolicyLibraryUpgrades(loaded);
   const operating = Boolean(
     evidenceReady
@@ -1266,10 +1273,11 @@ function requiredGovernedDocuments(scope, records, byId, model) {
   ));
 }
 
-async function governedContentItems(scope, records, byId, readMarkdown, asOf, model) {
+async function governedContentItems(scope, records, byId, readMarkdown, asOf, model, asOfTime) {
   const enabledObligations = records.filter((record) => (
     record.type === "obligation" && obligationIsEnabled(record)
   ));
+  const operatingSchedules = enabledObligations.filter((record) => obligationRuleIsEnabled(record, byId, asOfTime));
   const requiredGovernedIds = new Set(enabledObligations.flatMap((record) => [
     ...(record.scopeResourceIds || []),
     ...(record.templateResourceId ? [record.templateResourceId] : [])
@@ -1332,7 +1340,7 @@ async function governedContentItems(scope, records, byId, readMarkdown, asOf, mo
           owner: currentPartyPeople(record.ownerIds, byId).size > 0,
           active: record.status === "active",
           requirementsImplemented: linkedControlIds.length > 0 && missingImplementationControlIds.length === 0,
-          assignmentScheduled: enabledObligations.some((obligation) => (
+          assignmentScheduled: operatingSchedules.some((obligation) => (
             obligation.templateResourceId === record.id
             || (obligation.scopeResourceIds || []).includes(record.id)
           )),
@@ -1459,7 +1467,7 @@ function documentActivationLabel(state) {
   })[state] || state;
 }
 
-async function assessPolicyActivations(policies, controls, records, byId, readMarkdown, asOf, model) {
+async function assessPolicyActivations(policies, controls, records, byId, readMarkdown, asOf, model, controlItems, asOfTime) {
   const sourceType = modelSupports(model, "component-sources") ? "component" : "system";
   const sourceField = modelSupports(model, "component-sources") ? "evidenceSourceComponentIds" : "evidenceSourceIds";
   const assessments = [];
@@ -1469,6 +1477,11 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
     const plannedOrPartialControlIds = linkedControls
       .filter((control) => ["planned", "partially-implemented"].includes(control.status))
       .map(({ id }) => id);
+    const missingLaunchControlIds = linkedControls
+      .filter((control) => controlItems.some((item) => (
+        item.id === `control-${control.id}` && item.implementationState === "implemented-with-gaps"
+      )))
+      .map(({ id }) => id);
     const missingComponentControlIds = modelSupports(model, "component-sources")
       ? linkedControls.filter((control) => ![
           ...(control.componentIds || []),
@@ -1497,7 +1510,7 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
       ["scheduled", "event-driven", "mixed"].includes(control.operationPattern)
       && !records.some((record) => (
         record.type === "obligation"
-        && obligationIsEnabled(record)
+        && obligationRuleIsEnabled(record, byId, asOfTime)
         && (record.controlIds || []).includes(control.id)
         && (record.policyIds || []).includes(policy.id)
       ))
@@ -1540,6 +1553,7 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
         : null
     ].filter(Boolean);
     const gapCount = plannedOrPartialControlIds.length
+      + missingLaunchControlIds.length
       + missingComponentControlIds.length
       + missingEvidenceSourceControlIds.length
       + missingScheduleControlIds.length
@@ -1564,6 +1578,7 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
       proposedEffectiveOn: policy.proposedEffectiveOn || null,
       linkedControlIds,
       plannedOrPartialControlIds,
+      missingLaunchControlIds,
       missingComponentControlIds,
       missingEvidenceSourceControlIds,
       missingScheduleControlIds,
@@ -1596,6 +1611,7 @@ function policyActivationLabel(state) {
 function policyActivationItem(assessment) {
   const counts = [
     [assessment.plannedOrPartialControlIds.length, "planned or partial Controls"],
+    [assessment.missingLaunchControlIds.length, "implemented Controls with launch gaps"],
     [assessment.missingComponentControlIds.length, "Controls missing active Components"],
     [assessment.missingEvidenceSourceControlIds.length, "Controls missing ready evidence sources"],
     [assessment.missingScheduleControlIds.length, "Controls missing enabled Obligations"],
@@ -1644,7 +1660,7 @@ function legacyPolicyLibraryProposals(records) {
   }];
 }
 
-async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null) {
+async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null, asOfTime) {
   const items = [];
   const families = selectedControlFamilies(scope.controls, model);
   if (!scope.controls.length) {
@@ -1698,12 +1714,24 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null
       criteriaMapping: (control.requirementIds || []).length > 0,
       ...(["scheduled", "event-driven", "mixed"].includes(control.operationPattern) ? {
         workQueue: queueSchedules.length > 0
-          && queueSchedules.some(obligationIsEnabled)
+          && queueSchedules.some((obligation) => obligationRuleIsEnabled(obligation, byId, asOfTime))
       } : {})
     };
+    const launchChecks = Object.fromEntries(Object.entries(checks).filter(([name]) => ![
+      "implemented", "implementationDate"
+    ].includes(name)));
+    const launchReady = Object.values(launchChecks).every(Boolean);
+    const implementationState = control.status === "implemented"
+      ? Object.values(checks).every(Boolean) ? "implemented" : "implemented-with-gaps"
+      : control.status === "partially-implemented" ? "partial"
+        : launchReady ? "ready-to-implement" : "planned";
     const missing = Object.entries(checks).filter(([, value]) => !value).map(([name]) => controlCheckLabel(name));
     const nextSteps = controlImplementationSteps(control, checks, {
-      missingSourceFamilies
+      missingSourceFamilies,
+      targets: [...new Set([
+        ...(control.systemIds || []),
+        ...(control.componentIds || [])
+      ].map((id) => byId.get(id)?.title).filter(Boolean))]
     });
     items.push(item(
       `control-${control.id}`,
@@ -1715,17 +1743,20 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null
       control,
       {
         checks,
+        launchChecks,
+        implementationState,
+        implementationAssertion: "Implemented means the stated control works for the named Systems, its owner and procedure match current practice, and its evidence sources can produce proof. Scheduled or event-driven Controls have at least one enabled linked Obligation. It does not assert that a scheduled cycle or event has already occurred. Record dated operating proof when it does.",
         nextSteps,
         commands: [`npx filegrc get ${shellArgument(control.id)} --mutation`],
         workQueue: queueSchedules.length ? {
-          enabled: queueSchedules.filter(obligationIsEnabled).length,
-          running: queueSchedules.filter((obligation) => obligationIsRunning(obligation, byId, asOf, model)).length,
+          enabled: queueSchedules.filter((obligation) => obligationRuleIsEnabled(obligation, byId, asOfTime)).length,
+          running: queueSchedules.filter((obligation) => obligationIsRunning(obligation, byId, asOf, model, asOfTime)).length,
           total: queueSchedules.length
         } : null
       }
     ));
   }
-  return stage("controls", "Implement Controls", "Put each selected Control in place, record how it works, and mark it Implemented when it is working.", items);
+  return stage("controls", "Implement Controls", "Put each selected Control in place. Check its launch conditions, then mark it Implemented when it is working. Dated proof follows during operation.", items);
 }
 
 async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
@@ -1739,10 +1770,6 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
       .map((id) => byId.get(id))
       .filter((record) => (
         record?.type === sourceType
-        && (
-          !(record.evidenceSourceKinds || []).length
-          || family.sourceKinds.some((kind) => (record.evidenceSourceKinds || []).includes(kind))
-        )
       ));
     const completeSources = [];
     const sourceChecks = [];
@@ -1780,7 +1807,7 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
     const coveredControls = controlMappings.filter(({ complete }) => complete);
     const complete = completeSources.length > 0 && coveredControls.length === family.controls.length;
     const commands = [
-      ...(selectedSources.length
+      ...(complete ? [] : selectedSources.length
         ? sourceChecks.filter(({ complete: sourceComplete }) => !sourceComplete).flatMap((sourceCheck) => {
             const sourceId = sourceCheck.sourceComponentId || sourceCheck.sourceSystemId;
             return [
@@ -2087,21 +2114,21 @@ function controlCheckLabel(name) {
     procedureEffective: "procedure effective date",
     policyMapping: "policy mapping",
     criteriaMapping: "criteria mapping",
-    workQueue: "running Obligation schedules"
+    workQueue: "enabled Obligation rules (work starts after cutover)"
   })[name] || name;
 }
 
 const starterControlChecks = {
-  "control-security-governance": "Open the security review calendar and attendee roles. Check a reviewer separate from owners and operators examines risks, incidents, findings, and overdue work on the approved schedule.",
-  "control-policy-management": "Open the Control inventory and a recently revised Policy. Check owners are named, the approver is separate, and the change went through review before approval.",
-  "control-security-communication": "Trace how a security notice or Policy change reaches staff and affected outside parties. Check that the approved reporting routes can be used.",
+  "control-security-governance": "Set a security review calendar and name a reviewer separate from the owners. Make sure the agenda covers risks, incidents, findings, and overdue work when those records exist.",
+  "control-policy-management": "Name Control owners and a separate Policy approver. Set the path for reviewing and approving future Policy changes before they take effect.",
+  "control-security-communication": "Set working normal and fallback routes for security notices and Policy changes to staff and affected outside parties.",
   "control-workforce-expectations": "Review onboarding for roles with sensitive access. Check that required screening, agreements, and Policy acknowledgements happen before access.",
-  "control-security-training": "Compare the worker roster with training assignments. Check starters and role changes get training on time, with repeats tied to current content and the approved schedule.",
-  "control-risk-assessment": "Open the risk assessment against in-scope Systems and Vendors. Check threats, fraud, dependencies, and changes have owners and high risks get the required review.",
-  "control-monitoring-remediation": "Open the latest Control review, or schedule the first. Check incidents, test results, Exceptions, and overdue work, with owners and verified closure for gaps.",
+  "control-security-training": "Set up the worker roster, training audience, assignment rule, and owner. Check that starters and role changes will receive the approved content on time.",
+  "control-risk-assessment": "Set the risk assessment scope for the in-scope Systems and Vendors. Name who reviews threats, fraud, dependencies, changes, and high risks.",
+  "control-monitoring-remediation": "Schedule the first Control review. Name who will inspect incidents, tests, Exceptions, overdue work, and follow-up closure when those records exist.",
   "control-access-authorization": "Open access lists for in-scope Systems and Vendor tools. Check that accounts use unique identities and only needed permissions, and new grants require a business reason and approval.",
   "control-strong-authentication": "Open the System and Vendor lists. For each tool used for production, source code, email, identity, or sensitive data, check MFA, unique accounts, default credentials, and admin roles.",
-  "control-access-review-offboarding": "Export access lists from key Systems and Vendor tools. Check privileged and other access reviews meet their approved schedules, and departures lose access within the required window.",
+  "control-access-review-offboarding": "Confirm access lists can be exported from key Systems and Vendor tools. Assign the first access review and the owner who will remove access when a departure occurs.",
   "control-physical-workspace-security": "Walk through actual work areas and visitor access. Check who can enter nonpublic spaces and how devices, papers, screens, and conversations are protected.",
   "control-data-classification-inventory": "List important data stores in Systems and Vendor tools. Check each has an owner, classification, approved purpose, and recorded location.",
   "control-encryption-transmission": "For Systems, Vendor tools, and devices holding Confidential or Restricted data, check encryption at rest and in transit and who can manage the keys.",
@@ -2109,22 +2136,24 @@ const starterControlChecks = {
   "control-inventory-configuration": "Compare actual services, devices, software, service accounts, Vendors, and data stores with the inventory. Check owners, secure settings, and unsupported assets.",
   "control-endpoint-protection": "Review devices allowed into company Systems. Check encryption, screen lock, updates, and malware protection against the approved settings.",
   "control-network-security": "Open production network and remote-access rules. Check each path has a business reason, approved authentication, and separation; identify rules due for review.",
-  "control-change-management": "Follow a software or infrastructure change from request to deployment. Check the path includes risk review, testing, approval, and a way to recover.",
+  "control-change-management": "Set the path for software and infrastructure changes: risk review, testing, approval, deployment, and recovery. Check teams use it for the next real change.",
   "control-vulnerability-management": "List internet-facing and important Systems. Check each has vulnerability scan coverage or another approved check, and findings have owners and target dates.",
   "control-penetration-testing": "Review the service's exposure, major changes, and customer commitments. Decide whether independent testing is needed and, if so, set its scope and cadence.",
   "control-logging-monitoring": "For each important System, open security logs, alert rules, and service-health checks where needed. Check retention and whether test alerts reach an owner.",
   "control-incident-response": "Walk through how a worker reports an incident. Check who triages, escalates, contains, communicates, and closes it using the approved plan.",
-  "control-incident-exercise": "Send a test alert through a representative incident path. Check acknowledgement, escalation, and fallback, then record participants, failures, and follow-up.",
-  "control-backup-restoration": "For each important System, inspect backup or alternate recovery settings and failure alerts. Run or review a restore test against its recovery needs.",
+  "control-incident-exercise": "Set the incident exercise owner, scenario, and schedule. Check the reporting, escalation, and fallback paths are ready for the first exercise.",
+  "control-backup-restoration": "For each important System, inspect backup or alternate recovery settings and failure alerts. Schedule the first restore test against its recovery needs.",
   "control-continuity-exercise": "Review recovery priorities, contacts, and owners. Check the plan covers loss of an important System or provider and has an exercise date.",
-  "control-vendor-due-diligence": "Open the Vendor list. For each with sensitive data or a material service role, check its security review and contract terms; review older Vendors already in use.",
-  "control-vendor-monitoring": "Open critical and high-risk Vendors. Check each has a current review, an owner for open issues, and timely reassessment after a material change or incident.",
+  "control-vendor-due-diligence": "Identify Vendors with sensitive data or a material service role. Set the review and contract checks before approving a new Vendor; triage existing Vendors for the first review.",
+  "control-vendor-monitoring": "Identify critical and high-risk Vendors, assign review owners and cadence, and set a reassessment trigger for material changes or incidents.",
   "control-security-exceptions": "Review departures from security rules. Check each has a reason, owner, risk assessment, compensating measure, approval, and expiry or review date."
 };
 
 export function controlImplementationSteps(control, checks, options = {}) {
   const steps = [];
-  if (!checks.implemented) steps.push(starterControlChecks[control.id]
+  if (!checks.implemented) steps.push(control.id === "control-strong-authentication" && options.targets?.length
+    ? `Ensure MFA and unique accounts are enabled for ${options.targets.join(", ")}; check default credentials and admin roles.`
+    : starterControlChecks[control.id]
     || "Inspect the systems, people, vendors, or work this Control covers. Compare current practice with its statement and fix any gaps.");
   const record = [];
   if (!checks.owner) record.push("choose an owner");
@@ -2134,8 +2163,8 @@ export function controlImplementationSteps(control, checks, options = {}) {
   if (!checks.evidenceSource) record.push("link the tool or system that can show it happened");
   if (!checks.policyMapping && checks.policyMapping !== undefined) record.push("link the Policy it implements");
   if (!checks.criteriaMapping && checks.criteriaMapping !== undefined) record.push("link the criteria it covers");
-  if (checks.implemented && !checks.implementationDate) record.push("enter the date it started working");
-  if (checks.implemented && (checks.procedureRevision === false || checks.procedureEffective === false)) {
+  if (!checks.implementationDate) record.push("record the actual date it starts working when marking Implemented");
+  if (checks.procedureRevision === false || checks.procedureEffective === false) {
     record.push("record the Procedure revision and effective date");
   }
   if (record.length) steps.push(`In this Control, ${record.join("; ")}.`);
@@ -2150,9 +2179,7 @@ export function controlImplementationSteps(control, checks, options = {}) {
   if (!checks.implemented) {
     if (sourceStep || queueStep) steps.push([sourceStep, queueStep].filter(Boolean).join(" "));
     else if (checks.applicability === false) steps.push("Confirm this Control applies to the current Program scope with `review-applicability --scaffold --type control`.");
-    else steps.push(checks.procedureRevision === undefined
-      ? "When it works, mark this Control Implemented and enter its start date."
-      : "When it works, mark this Control Implemented. Enter its start date and the Procedure revision and effective date.");
+    else steps.push("When these launch conditions hold, mark the Control Implemented. This asserts the practice works now; record proof from future cycles and events as they occur.");
   } else {
     if (sourceStep) steps.push(sourceStep);
     if (queueStep) steps.push(queueStep);

package/src/validate.js

@@ -21,7 +21,7 @@ import {
 } from "./recurrence.js";
 import { resourceReviewRevisionMatches, resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { retentionScheduleApprovalIssues } from "./retention-schedule-approval.js";
-import { obligationIsEnabled } from "./program-lifecycle.js";
+import { obligationIsEnabled, obligationRuleIsEnabled } from "./program-lifecycle.js";
 import { currentPartyPeople, partyPeople } from "./parties.js";
 import { isMarkdownChoice, markdownEntries } from "./resource-markdown.js";
 import { currentCalendarDate, isRfc3339Timestamp, localDateTimeValue, timestampFromLocalDateTime } from "./time.js";
@@ -222,7 +222,7 @@ async function validateWorkspaceUnmeasured(input) {
     validateIndependentApproval(record, byId, displayPath, diagnostics);
     validateCompletedObligationEvent(record, byId, loaded.model, displayPath, diagnostics);
     validateActionObligationRule(record, byId, displayPath, diagnostics);
-    validateImplementedControlSchedules(record, obligationsByControl, displayPath, diagnostics);
+    validateImplementedControlSchedules(record, obligationsByControl, byId, new Date().toISOString(), displayPath, diagnostics);
     serialContentDiagnosticTasks.push(async () => {
       const markdownDiagnostics = [];
       const approvalDiagnostics = [];
@@ -1538,7 +1538,7 @@ function assertFingerprintBudget(options, uncachedBytes) {
   }
 }
 
-function validateImplementedControlSchedules(record, obligationsByControl, path, diagnostics) {
+function validateImplementedControlSchedules(record, obligationsByControl, byId, now, path, diagnostics) {
   if (record.type !== "control" || record.status !== "implemented") return;
   const schedules = obligationsByControl.get(record.id) || [];
   if (!schedules.length) {
@@ -1550,16 +1550,20 @@ function validateImplementedControlSchedules(record, obligationsByControl, path,
     ));
     return;
   }
-  if (schedules.some(obligationIsEnabled)) return;
-  const stopped = schedules.filter((obligation) => !obligationIsEnabled(obligation));
+  if (schedules.some((obligation) => obligationRuleIsEnabled(obligation, byId, now))) return;
+  const stopped = schedules.filter((obligation) => !obligationRuleIsEnabled(obligation, byId, now));
   const paused = stopped.filter((obligation) => obligation.status === "paused");
   const proposed = stopped.filter((obligation) => obligation.status === "proposed");
+  const pendingRules = stopped.filter((obligation) => obligationIsEnabled(obligation) && obligation.scheduleMode === "rule");
   const reasons = [
     proposed.length
       ? `${proposed.length} linked ${proposed.length === 1 ? "schedule is" : "schedules are"} still proposed. Enable ${proposed.length === 1 ? "it" : "them"} before implementing the control; the schedule will remain dormant until its governing Policy is active and effective.`
       : "",
     paused.length
       ? `${paused.length} linked ${paused.length === 1 ? "schedule is" : "schedules are"} paused. Enable ${paused.length === 1 ? "it" : "them"} before implementing the control.`
+      : "",
+    pendingRules.length
+      ? `${pendingRules.length} linked ${pendingRules.length === 1 ? "rule is" : "rules are"} not active. Activate the selected rule before implementing the control.`
       : ""
   ].filter(Boolean).join(" ");
   diagnostics.push(error(

package/src/web.js

@@ -1098,6 +1098,7 @@ function renderPolicyActivationAssessments() {
     return '<article class="policy-activation-card ' + esc(assessment.state) + '"><div class="evidence-map-card-head"><div><span class="badge ' + (operating ? "good" : "warn") + '">' + esc(assessment.label) + '</span><h3><a href="#/resource/policy/' + encodeURIComponent(assessment.policyId) + '">' + esc(assessment.title) + '</a></h3></div><small>' + assessment.gapCount + ' ' + pluralize("gap", assessment.gapCount) + '</small></div>' + warnings +
       '<div class="policy-activation-gaps">' +
       gapGroup("Planned or partial Controls", assessment.plannedOrPartialControlIds, "control") +
+      gapGroup("Implemented Controls with launch gaps", assessment.missingLaunchControlIds || [], "control") +
       gapGroup("Missing active Components", assessment.missingComponentControlIds, "control") +
       gapGroup("Missing ready evidence sources", assessment.missingEvidenceSourceControlIds, "control") +
       gapGroup("Missing enabled Obligations", assessment.missingScheduleControlIds, "control") +
@@ -1212,9 +1213,9 @@ function workflowGuidance(options = {}) {
   const renderRow = (item) => {
     const href = workflowItemHref(item);
     const guidance = options.type === "control" && item.nextSteps?.length
-      ? '<ol class="control-next-steps">' + item.nextSteps.map((step) => '<li>' + esc(step) + '</li>').join("") + '</ol>'
+      ? '<p class="workflow-status">' + esc(controlLaunchLabel(item.implementationState)) + '</p><ol class="control-next-steps">' + item.nextSteps.map((step) => '<li>' + esc(step) + '</li>').join("") + '</ol><small>' + esc(item.implementationAssertion || "") + '</small>'
       : '<small>' + esc(item.message || workflowItemDetail(item)) + '</small>';
-    const body = '<span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong>' + guidance + '</span>';
+    const body = '<span class="workflow-finding-status ' + esc(item.state) + '">' + esc(options.type === "control" && item.implementationState ? controlLaunchLabel(item.implementationState).split(":")[0] : properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong>' + guidance + '</span>';
     return href ? '<a href="' + href + '">' + body + '</a>' : '<div>' + body + '</div>';
   };
   const rows = visible.map(renderRow).join("");
@@ -1226,7 +1227,27 @@ function workflowGuidance(options = {}) {
   return '<section class="workflow-guidance panel detail-support-panel detail-workflow-panel"><div class="panel-head"><div><p class="kicker">To-do</p><h3>' + esc(options.title || "Checklist") + '</h3></div><span class="badge ' + (blocking.length ? "warn" : "good") + '">' + (blocking.length ? "Needs work" : "Current") + '</span></div><p class="workflow-status">' + esc(status) + (completionRequirements ? '. ' + completionRequirements : "") + '</p><div class="workflow-findings">' + rows + '</div>' + more + '</section>';
 }
 
+function controlLaunchLabel(state) {
+  return ({
+    planned: "Planned: launch conditions remain",
+    partial: "Partially implemented: launch conditions remain",
+    "ready-to-implement": "Launch checks ready: confirm it works, then record the start date",
+    "implemented-with-gaps": "Implemented with gaps: fix the launch checks",
+    implemented: "Implemented"
+  })[state] || "Control launch";
+}
+
+function controlLaunchState(id) {
+  return state.programReadiness?.stages?.find(({ id: stageId }) => stageId === "controls")?.items
+    .find(({ id: itemId }) => itemId === "control-" + id)?.implementationState;
+}
+
 function recordCompletionState(record) {
+  if (record.type === "control") {
+    const item = state.programReadiness?.stages?.find(({ id }) => id === "controls")?.items
+      .find(({ id }) => id === "control-" + record.id);
+    if (item?.implementationState === "implemented") return '<section class="record-completion-state panel detail-support-panel"><p class="kicker">Control launch</p><h3>Implemented</h3><p>' + esc(item.implementationAssertion) + '</p><p>Dated evidence belongs to the operating work that produces it.</p></section>';
+  }
   const completeStatuses = new Set(["approved", "active", "complete", "completed", "closed", "done", "reconciled"]);
   if (!completeStatuses.has(record.status)) return "";
   return '<section class="record-completion-state panel detail-support-panel"><p class="kicker">Record status</p><h3>' + esc(properCase(record.status)) + '</h3><p>This record has no direct next step.</p></section>';
@@ -1408,8 +1429,13 @@ function recordWorkflowCell(type, entry, detailContext = "") {
   const item = items[0];
   let href = workflowItemHref(item) || "#/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(entry.record.id);
   if (detailContext && href.startsWith("#/resource/" + encodeURIComponent(type) + "/") && !href.includes("?")) href += detailContext;
-  const title = type === "control" ? "Finish implementation" : item.title;
-  return '<a class="record-workflow-action" href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(title) + '</strong><small>' + esc(stagePageItemDetail(item)) + (items.length > 1 ? " +" + (items.length - 1) + " more" : "") + '</small></span></a>';
+  const title = type === "control"
+    ? item.implementationState === "implemented-with-gaps" ? "Fix Control launch gaps" : "Finish implementation"
+    : item.title;
+  const statusLabel = type === "control" && item.implementationState
+    ? controlLaunchLabel(item.implementationState).split(":")[0]
+    : properCase(item.state);
+  return '<a class="record-workflow-action" href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(statusLabel) + '</span><span><strong>' + esc(title) + '</strong><small>' + esc(stagePageItemDetail(item)) + (items.length > 1 ? " +" + (items.length - 1) + " more" : "") + '</small></span></a>';
 }
 
 function openCollectionReviewDialog(type) {
@@ -1839,7 +1865,7 @@ function stagePageCard(stage, destination, index) {
   const taskPreview = items.length
     ? '<div class="stage-page-tasks">' + items.slice(0, 3).map((item) => {
         const href = destination.utility === "evidence-sources" ? destination.href : item.href || workflowItemHref(item) || destination.href;
-        return '<a href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(stagePageItemDetail(item)) + '</small></span></a>';
+        return '<a href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(item.implementationState ? controlLaunchLabel(item.implementationState).split(":")[0] : properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(stagePageItemDetail(item)) + '</small></span></a>';
       }).join("") + (items.length > 3 ? '<small class="stage-page-tasks-more">+' + (items.length - 3) + ' more on this page</small>' : "") + '</div>'
     : "";
   return '<article class="stage-page-card ' + (complete ? "complete" : "") + '"><div class="stage-page-card-head"><div><small>' + esc(stepLabel) + '</small><h3>' + esc(destination.label) + '</h3></div><div class="stage-page-card-actions">' + completionState + '<a class="stage-page-open" href="' + destination.href + '" aria-label="Open ' + esc(destination.label) + '"><span>Open ›</span></a></div></div><p>' + esc(summary) + '</p>' + taskPreview + '</article>';
@@ -2277,8 +2303,9 @@ function policyEventTrigger(trigger, index, collapsed = false, scope = "events")
   const tooltipId = "policy-event-tooltip-" + scope + "-" + index;
   const proposed = trigger.programStatus === "proposed";
   const unavailable = state.readOnly || proposed;
+  const blocker = trigger.steps.find(({ programBlocker }) => programBlocker)?.programBlocker;
   const availability = proposed
-    ? "Available after its governing policies are effective, at least one linked control is implemented, and every task has a current owner."
+    ? "Dormant until " + (blocker ? blocker.label.toLowerCase() + " (" + blocker.id + ")" : "its governing content is active and effective") + ". Use this workflow for the first real event after cutover."
     : state.readOnly
       ? "Open this workspace in writable mode to trigger the workflow."
       : trigger.steps.length + " " + pluralize("task", trigger.steps.length) + " will be added to the Work Queue.";
@@ -3219,7 +3246,7 @@ function renderList(main, type, params = new URLSearchParams()) {
     const start = (pageNumber - 1) * LIST_PAGE_SIZE;
     const visible = filtered.slice(start, start + LIST_PAGE_SIZE);
     main.querySelector("#result-count").textContent = filtered.length + (filtered.length === 1 ? " record" : " records");
-    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + detailContext + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? displayStatus(entry.record) : entry.record[name], name, type, true)) + '</td>').join("") + '<td data-label="Next action">' + recordWorkflowCell(type, entry) + '</td><td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 3) + '">' + empty(entries.length ? "No records match this filter." : collectionEmptyState(type, definition)) + '</td></tr>';
+    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + detailContext + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? type === "control" ? controlLaunchState(entry.record.id) || displayStatus(entry.record) : displayStatus(entry.record) : entry.record[name], name, type, true)) + '</td>').join("") + '<td data-label="Next action">' + recordWorkflowCell(type, entry) + '</td><td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 3) + '">' + empty(entries.length ? "No records match this filter." : collectionEmptyState(type, definition)) + '</td></tr>';
     pagination.hidden = totalPages === 1;
     previous.disabled = pageNumber === 1;
     next.disabled = pageNumber === totalPages;

package/src/workflow.js

@@ -1139,6 +1139,11 @@ function normalizeFinding(code, item, context) {
     title: item.title,
     message: item.message,
     ...(item.nextSteps?.length ? { nextSteps: item.nextSteps } : {}),
+    ...(item.implementationState ? {
+      implementationState: item.implementationState,
+      launchChecks: item.launchChecks,
+      implementationAssertion: item.implementationAssertion
+    } : {}),
     ...(item.checks ? { unmetChecks: Object.entries(item.checks)
       .filter(([, passed]) => passed === false)
       .map(([name]) => name) } : {}),