filegrc 0.16.16 → 0.16.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.16",
+  "version": "0.16.18",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/agent.js

@@ -122,13 +122,15 @@ export function buildAgentGuide(loaded, type, options = {}) {
     oneOf: definition.oneOf ?? [],
     markdown,
     workflow: [
-      "Inspect existing records and relation candidates before writing.",
+      "Inspect the recommended action, existing records, relationships, source Markdown, and available evidence. Do the research, drafting, record edits, and validation you can do yourself.",
       definition.singleton
         ? "Open the existing singleton record and update only gaps supported by facts from an authoritative source."
         : "Reuse and update a suitable existing record. Create a scaffold only when no record covers the work, then replace every null value and empty required array with facts from an authoritative source.",
       recommendedMarkdown.length
         ? "Keep model fields in JSON and use the recommended Markdown companion for the detailed work, decisions, results, exceptions, and follow-up that apply to this record."
         : "Keep the current facts and lifecycle state in JSON. Add optional Record Markdown only when the model fields cannot explain the record clearly.",
+      "If a material fact, external action, approval, or management decision is still missing, ask the user one specific question. State what you inspected, the exact missing input, and what it unlocks. Do not hand off FileGRC commands, routine record entry, or a vague request to confirm. Continue the workflow after the answer without asking for another handoff.",
+      ...(type === "control" ? ["Separate implementation from operation: document the working configuration, scope, owner, procedure, source, and enabled rules when its operation pattern needs them before marking Implemented. Record dated operating work and evidence only after a real cycle or event occurs; a ready schedule is not proof of operation."] : []),
       ...(type === "program" && modelSupports(loaded.model, "program-scope")
         ? ["Review Requirement applicability with npx filegrc review-applicability --type requirement --scaffold, then preview and apply the reviewed decisions as one validated batch."]
         : []),

package/src/cli.js

@@ -1743,7 +1743,7 @@ function agentOverview(model) {
     commit: "git diff --check && git diff && git add <reviewed-paths> && git commit -m <reason>"
   };
   return {
-    rule: "Treat data/ as the source of truth. Run guide before creating an unfamiliar type, validate after every write, review the Git diff, then commit a focused change.",
+    rule: "Treat data/ as the source of truth. Inspect existing records and sources, then do the research, edits, and validation you can do. Ask the user only for a specific material fact, external action, approval, or decision you cannot establish; explain what it unlocks and continue after the answer. Run guide before creating an unfamiliar type, validate every write, review the Git diff, and commit a focused change.",
     programPath: buildAgentProgramPath(model),
     actions: Object.fromEntries(Object.entries(commands).map(([name, command]) => [
       name,

package/src/obligation-rule.js

@@ -0,0 +1,20 @@
+export function obligationRule(obligation, byId, options = {}) {
+  const proposedId = options.includeProposed
+    ? [...(obligation.ruleIds || [])].reverse().find((id) => ["proposed", "approved"].includes(byId.get(id)?.status))
+    : null;
+  if (obligation?.scheduleMode !== "rule" && !proposedId) return null;
+  let rule = byId.get(obligation.activeRuleId || proposedId);
+  if (rule?.status === "active" && rule.effectiveAt && options.now && new Date(rule.effectiveAt) > new Date(options.now)) {
+    const prior = byId.get(rule.supersedesId);
+    return prior?.type === "obligation-rule"
+      && prior.obligationId === obligation.id
+      && ["active", "retired"].includes(prior.status)
+      ? prior
+      : null;
+  }
+  return rule?.type === "obligation-rule"
+    && rule.obligationId === obligation.id
+    && (rule.status === "active" || (options.includeProposed && ["proposed", "approved"].includes(rule.status)))
+    ? rule
+    : null;
+}

package/src/obligations.js

@@ -21,7 +21,8 @@ import {
 } from "./recurrence.js";
 import { currentCalendarDate, isRfc3339Timestamp, localDateTimeValue, timestampFromLocalDateTime } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
-import { obligationGovernedContent, obligationProgramStatus } from "./program-lifecycle.js";
+import { obligationRule } from "./obligation-rule.js";
+import { governedContentIsOperating, obligationGovernedContent, obligationProgramStatus } from "./program-lifecycle.js";
 import { resolveProgram } from "./program.js";
 import { currentPartyPeople } from "./parties.js";
 import { serializeWorkspaceMutation } from "./mutation.js";
@@ -84,9 +85,9 @@ export function planObligations(resources, options = {}) {
     throw new Error("Obligation planning requires programId when more than one Program is active.");
   }
   const asOf = requireDate(options.asOf ?? currentCalendarDate(workspace?.timezone || "UTC"), "as-of date");
-  const defaultNow = options.asOf
-    ? timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC")
-    : new Date().toISOString();
+  const defaultNow = asOf === currentCalendarDate(workspace?.timezone || "UTC")
+    ? new Date().toISOString()
+    : timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC");
   const now = requireTimestamp(options.now ?? defaultNow, "current timestamp");
   const through = requireDate(options.through ?? addCalendarDays(asOf, 90), "through date");
   const requestedFrom = options.from ? requireDate(options.from, "from date") : null;
@@ -102,7 +103,7 @@ export function planObligations(resources, options = {}) {
     && obligationBelongsToProgram(record, obligationProgram, model)
   ));
   const programStatusByObligationId = new Map(obligations.map((obligation) => [
-    obligation.id, obligationProgramStatus(obligation, byId, asOf, model)
+    obligation.id, obligationProgramStatus(obligation, byId, asOf, model, now)
   ]));
   const obligationIds = new Set(obligations.map(({ id }) => id));
   if (obligations.length > MAX_PLANNED_ITEMS) {
@@ -120,14 +121,17 @@ export function planObligations(resources, options = {}) {
   };
 
   for (const obligation of obligations) {
+    const selectedRule = byId.get(obligation.activeRuleId);
     const rule = obligation.scheduleMode === "rule"
       ? obligationRule(obligation, byId, { now, includeProposed: true })
+        || (selectedRule?.status === "active" && selectedRule.effectiveAt
+          && new Date(selectedRule.effectiveAt) > new Date(now) ? selectedRule : null)
       : null;
     const schedule = rule || obligation;
     const activity = obligationActivity(model, obligation);
     const expectedCompletionTypes = activity.completionResourceTypes;
     const programStatus = programStatusByObligationId.get(obligation.id);
-    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf) : null;
+    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf, model, now) : null;
     if (schedule.recurrence?.mode === "event" && schedule.recurrence.eventType) {
       const eventType = schedule.recurrence.eventType;
       const group = triggerGroups.get(eventType) ?? {
@@ -298,7 +302,7 @@ export function planObligations(resources, options = {}) {
     const overdueOn = addCalendarDays(dueWindowEnd, 1);
     const window = { dueWindowStart, dueWindowEnd, overdueOn };
     const programStatus = programStatusByObligationId.get(obligation.id);
-    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf) : null;
+    const programBlocker = programStatus === "proposed" ? obligationProgramBlocker(obligation, byId, asOf, model, now) : null;
     const activity = obligationActivity(model, obligation);
     const completedMemberIds = (occurrence.members || [])
       .filter(({ disposition, result }) => disposition === "expected" && result === "passed")
@@ -420,10 +424,17 @@ export function planObligations(resources, options = {}) {
   };
 }
 
-function obligationProgramBlocker(obligation, byId, asOf) {
+function obligationProgramBlocker(obligation, byId, asOf, model, now = `${asOf}T23:59:59Z`) {
   if (obligation.status !== "active") {
     return { type: "obligation", id: obligation.id, label: "Activate obligation" };
   }
+  if (obligation.scheduleMode === "rule" && !obligationRule(obligation, byId, { now })) {
+    const selectedRule = byId.get(obligation.activeRuleId);
+    return {
+      type: "obligation-rule", id: obligation.activeRuleId,
+      label: selectedRule?.status === "active" ? "Wait for rule effective time" : "Activate rule"
+    };
+  }
   if (currentPartyPeople(obligation.ownerIds || [], byId).size === 0) {
     return { type: "obligation", id: obligation.id, label: "Assign current owner" };
   }
@@ -433,6 +444,11 @@ function obligationProgramBlocker(obligation, byId, asOf) {
       return { type: "policy", id, label: "Activate policy" };
     }
   }
+  const inactiveContent = obligationGovernedContent(obligation, byId, model)
+    .find((record) => !governedContentIsOperating(record, asOf, model));
+  if (inactiveContent) {
+    return { type: inactiveContent.type, id: inactiveContent.id, label: `Activate ${inactiveContent.type}` };
+  }
   const controls = (obligation.controlIds || []).map((id) => byId.get(id)).filter(Boolean);
   if (controls.length && !controls.some(({ status }) => status === "implemented")) {
     return { type: "control", id: controls[0].id, label: "Implement control" };
@@ -466,6 +482,27 @@ async function createObligationEventUnlocked(input, options) {
   if (riskLevel && !["normal", "high"].includes(riskLevel)) {
     throw new Error("A departure risk level must be normal or high.");
   }
+  if (!occurredAt) {
+    const intradayCutover = records.find((record) => {
+      if (
+        record.type !== "obligation"
+        || !["active", "proposed"].includes(record.status)
+        || (program && !obligationBelongsToProgram(record, program, loaded.model))
+        || (Array.isArray(record.eventRiskLevels) && !record.eventRiskLevels.includes(riskLevel))
+      ) return false;
+      const rule = byId.get(record.activeRuleId);
+      return rule?.type === "obligation-rule"
+        && rule.status === "active"
+        && rule.recurrence?.mode === "event"
+        && rule.recurrence.eventType === eventType
+        && rule.effectiveAt
+        && timestampCalendarDate(rule.effectiveAt, loaded.workspace.timezone) === occurredOn;
+    });
+    if (intradayCutover) {
+      throw new Error(`Event type "${eventType}" requires occurredAt on ${occurredOn} because a linked rule takes effect during that date. Record the real event time with its timezone.`);
+    }
+  }
+  const eventTime = occurredAt || `${occurredOn}T23:59:59Z`;
   const eventSchedules = new Map();
   const templates = records.filter((record) => {
     if (
@@ -473,16 +510,43 @@ async function createObligationEventUnlocked(input, options) {
       || record.status !== "active"
       || (program && !obligationBelongsToProgram(record, program, loaded.model))
     ) return false;
-    const schedule = obligationRule(record, byId, { now: occurredAt || `${occurredOn}T23:59:59Z` }) || record;
+    const schedule = obligationRule(record, byId, { now: eventTime }) || record;
     const matches = schedule.recurrence?.mode === "event"
       && schedule.recurrence.eventType === eventType
       && (!Array.isArray(record.eventRiskLevels) || record.eventRiskLevels.includes(riskLevel));
     if (matches) eventSchedules.set(record.id, schedule);
     return matches;
   });
-  if (!eventType || templates.length === 0) throw new Error(`No active obligations use event type "${eventType}".`);
-  if (templates.some((record) => obligationProgramStatus(record, byId, occurredOn, loaded.model) === "proposed")) {
-    throw new Error(`Event type "${eventType}" still has starter proposals. Make every governing Policy and required governed-content record active and effective, then implement at least one linked Control before starting this workflow.`);
+  const proposed = records.find((record) => {
+    if (
+      record.type !== "obligation"
+      || !["active", "proposed"].includes(record.status)
+      || (program && !obligationBelongsToProgram(record, program, loaded.model))
+      || (Array.isArray(record.eventRiskLevels) && !record.eventRiskLevels.includes(riskLevel))
+    ) return false;
+    const rule = obligationRule(record, byId, { now: eventTime, includeProposed: true });
+    const selectedRule = byId.get(record.activeRuleId);
+    const futureRule = selectedRule?.status === "active" && selectedRule.effectiveAt
+      && new Date(selectedRule.effectiveAt) > new Date(eventTime);
+    const schedule = rule || (futureRule ? selectedRule : record);
+    return schedule.recurrence?.mode === "event"
+      && schedule.recurrence.eventType === eventType
+      && (record.status === "proposed" || (rule && rule.status !== "active") || (futureRule && !rule));
+  });
+  if (!eventType || templates.length === 0 || proposed) {
+    const selectedRule = byId.get(proposed?.activeRuleId);
+    const futureRule = selectedRule?.status === "active" && selectedRule.effectiveAt
+      && new Date(selectedRule.effectiveAt) > new Date(eventTime);
+    throw new Error(futureRule
+      ? `Event type "${eventType}" is dormant until rule ${selectedRule.id} takes effect at ${selectedRule.effectiveAt}. Trigger only a real event after that time.`
+      : proposed
+        ? `Event type "${eventType}" is still a proposed workflow (${proposed.id}). Confirm its owner, deadline, and required proof, then enable its rule in Step 3. It stays dormant until governing content is effective; trigger only a real event after cutover.`
+        : `No active obligations use event type "${eventType}".`);
+  }
+  const dormant = templates.find((record) => obligationProgramStatus(record, byId, occurredOn, loaded.model, eventTime) === "proposed");
+  if (dormant) {
+    const blocker = obligationProgramBlocker(dormant, byId, occurredOn, loaded.model, eventTime);
+    throw new Error(`Event type "${eventType}" is dormant until ${blocker?.label?.toLowerCase() || "its prerequisites are ready"}${blocker?.id ? ` (${blocker.id})` : ""}. Complete the cutover before starting event work; do not create a past event to prove a prospective Control.`);
   }
   if (templates.some((record) => normalizedEventWindow(eventSchedules.get(record.id)?.window).precision === "timestamp") && !occurredAt) {
     throw new Error(`Event type "${eventType}" has hour-based deadlines and requires an RFC 3339 occurredAt timestamp.`);
@@ -1893,26 +1957,7 @@ function obligationActivity(model, obligation) {
   };
 }
 
-export function obligationRule(obligation, byId, options = {}) {
-  const proposedId = options.includeProposed
-    ? [...(obligation.ruleIds || [])].reverse().find((id) => ["proposed", "approved"].includes(byId.get(id)?.status))
-    : null;
-  if (obligation?.scheduleMode !== "rule" && !proposedId) return null;
-  let rule = byId.get(obligation.activeRuleId || proposedId);
-  if (rule?.status === "active" && rule.effectiveAt && options.now && new Date(rule.effectiveAt) > new Date(options.now)) {
-    const prior = byId.get(rule.supersedesId);
-    return prior?.type === "obligation-rule"
-      && prior.obligationId === obligation.id
-      && ["active", "retired"].includes(prior.status)
-      ? prior
-      : null;
-  }
-  return rule?.type === "obligation-rule"
-    && rule.obligationId === obligation.id
-    && (rule.status === "active" || (options.includeProposed && ["proposed", "approved"].includes(rule.status)))
-    ? rule
-    : null;
-}
+export { obligationRule } from "./obligation-rule.js";
 
 function currentOccurrence(records, occurrenceKey, obligationId, ruleId, window) {
   return records.find((record) => (

package/src/program-lifecycle.js

@@ -1,6 +1,7 @@
 import { currentPartyPeople } from "./parties.js";
 import { modelSupports } from "../model/index.js";
 import { revisionsMatch } from "./revisions.js";
+import { obligationRule } from "./obligation-rule.js";
 
 const requiredDocumentsByControlCache = new WeakMap();
 
@@ -131,8 +132,9 @@ function indexRequiredDocumentsByControl(byId, model) {
   return index;
 }
 
-export function obligationProgramStatus(obligation, byId, asOf, model) {
+export function obligationProgramStatus(obligation, byId, asOf, model, now = `${asOf}T23:59:59Z`) {
   if (obligation.status !== "active") return "proposed";
+  if (!obligationRuleIsEnabled(obligation, byId, now)) return "proposed";
   if (currentPartyPeople(obligation.ownerIds || [], byId).size === 0) return "proposed";
   const policyIds = obligation.policyIds || [];
   const policiesReady = policyIds.every((id) => {
@@ -153,12 +155,18 @@ export function obligationProgramStatus(obligation, byId, asOf, model) {
     : "proposed";
 }
 
-export function obligationIsRunning(obligation, byId, asOf, model) {
+export function obligationIsRunning(obligation, byId, asOf, model, now) {
   return obligation?.type === "obligation"
     && obligation.status === "active"
-    && obligationProgramStatus(obligation, byId, asOf, model) === "accepted";
+    && obligationProgramStatus(obligation, byId, asOf, model, now) === "accepted";
 }
 
 export function obligationIsEnabled(obligation) {
   return obligation?.type === "obligation" && obligation.status === "active";
 }
+
+export function obligationRuleIsEnabled(obligation, byId, now) {
+  return obligationIsEnabled(obligation)
+    && (obligation.scheduleMode !== "rule"
+      || obligationRule(obligation, byId, { now }) !== null);
+}

package/src/program-path.js

@@ -4,11 +4,11 @@ export const RESOURCE_INSTRUCTIONS = {
   program: "Set the Program goal, owners, Systems, Frameworks, criteria decisions, and risk method.",
   person: "Record the person’s actual job title and current status.",
   appointment: "Assign a named authority to one Person with its start date and scope.",
-  team: "Confirm the Team’s members and chair.",
+  team: "Use the current Person and Appointment records to set the Team’s members and chair; ask who holds a role only when those sources cannot establish it.",
   system: "Define the service boundary, exclusions, owners, and information it handles.",
   component: "Record a material service or evidence source and its role in each linked System.",
   vendor: "Record each material external provider and the Components it supplies.",
-  classification: "Confirm the handling categories and apply them to information and evidence.",
+  classification: "Use current Policy content and recorded information needs to propose handling categories, then apply the management decision to information and evidence. Ask about any category those sources do not settle.",
   "information-type": "Name a stable category of information, set its default Classification, and link its uses.",
   framework: "Select the criteria Framework and version used by the Program.",
   requirement: "Review whether this criterion applies to the Program and record the decision and rationale.",
@@ -22,7 +22,7 @@ export const RESOURCE_INSTRUCTIONS = {
   evidence: "Record a real artifact or approved reference, link its source and supported work, then have another person verify it.",
   "risk-assessment": "Assess the in-scope service, record conclusions, and obtain an independent review.",
   risk: "Name the threat and impact, assign an owner, rate the risk, and record its response.",
-  obligation: "Confirm the owner, cadence or trigger, deadline, and proof, then enable the rule when its Control is ready.",
+  obligation: "Read the linked Policy and Control, fill the owner, cadence or trigger, deadline, and proof from those sources, then enable the rule when its Control is ready. Ask only for an unresolved management choice.",
   "retention-schedule-item": "Set the Information Types, scope, cutoff, period, disposition, and sources for one retention rule.",
   "obligation-event": "Record the actual event date and subject, then complete its linked Work Queue actions.",
   "policy-review": "Record the review date, reviewer, decision, and any required follow-up.",
@@ -101,11 +101,11 @@ export const RESOURCE_OUTPUTS = {
 };
 
 export const RESOURCE_PAGE_SUMMARIES = {
-  person: "Confirm who works on the program.",
+  person: "Use current people already recorded; ask for a missing person's identity or role only when needed.",
   appointment: "Assign named authority.",
-  team: "Confirm shared owners and members.",
+  team: "Set shared owners and members from current People and Appointments.",
   program: "Choose the goal, scope, criteria, controls, owners, and risk method.",
-  framework: "Confirm the SOC 2 framework.",
+  framework: "Select the applicable SOC 2 framework and version from the installed catalog.",
   requirement: "Decide which SOC 2 criteria apply.",
   commitment: "Record customer promises that affect scope.",
   "requirement-mapping": "Review how supplemental promises relate to Requirements and Controls.",
@@ -134,8 +134,8 @@ export const PROGRAM_PATH = [
     description: "Ownership, criteria, and service boundary",
     summary: "A reviewed Program scope with owners, criteria, Systems, and material providers.",
     sections: [
-      { id: "ownership", title: "Program Ownership", description: "Confirm who owns the program, plus the normal security reporting channel and its fallback.", steps: ["Confirm the program lead, policy owner, independent reviewer, and oversight team.", "Replace the reporting-channel placeholders with real normal and fallback routes, then commit the proposal."], types: ["person", "appointment", "team", "reporting-route-set"], defaultOpen: true },
-      { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Set the Program goal, owners, risk method, and tentative timing.", "Review each selected criterion for this service and record its applicability decision.", "Replace the starter Commitment prompt with the real promise; add only needed supplemental mappings."], types: ["program", "framework", "requirement", "commitment", "requirement-mapping"], defaultOpen: true },
+      { id: "ownership", title: "Program Ownership", description: "Assign program owners and set the normal security reporting channel and its fallback.", steps: ["Inspect current People and Appointments, then assign the program lead, policy owner, independent reviewer, and oversight team. Ask only for missing assignments.", "Use the actual normal and fallback routes to replace reporting-channel placeholders, then commit the proposal."], types: ["person", "appointment", "team", "reporting-route-set"], defaultOpen: true },
+      { id: "criteria", title: "Program and Criteria", description: "Define the Program, select its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Set the Program goal, owners, risk method, and tentative timing from current records; ask for unresolved management choices.", "Compare each selected criterion with the service scope and record its applicability decision.", "Replace the starter Commitment prompt with the actual promise; add only needed supplemental mappings."], types: ["program", "framework", "requirement", "commitment", "requirement-mapping"], defaultOpen: true },
       { id: "boundary", title: "System Boundary", description: "Start with the bounded System. Add Components that materially deliver the service, support Controls, produce authoritative Evidence, or support relevant operations. Keep Vendor relationships and specific Assets separate.", steps: ["Define the service and exclusions in a bounded System selected by the Program.", "Add material Components and Vendors with their actual System relationships.", "Record the Information Types and Classifications the service uses."], types: ["system", "component", "vendor", "classification", "information-type"], defaultOpen: false }
     ],
     resourceTypes: ["person", "appointment", "team", "reporting-route-set", "program", "framework", "requirement", "commitment", "requirement-mapping", "system", "component", "vendor", "classification", "information-type"],
@@ -160,7 +160,7 @@ export const PROGRAM_PATH = [
     description: "Approve governed content and retention decisions",
     summary: "Approved Policies, program Documents, Training content, and retention decisions.",
     sections: [
-      { id: "policy-content", title: "Policies", description: "Approve the program's governing content.", instructions: "Open each Policy, program Document, and Training record. Replace placeholders, confirm the owner and intended values, then have a separate person approve the exact Markdown revision.", output: "Approved content bound to the reviewed revisions.", steps: ["Replace placeholders with the company's real rules, plans, and training material.", "Confirm the owner, separate approver, linked Controls, audience, and intended values.", "Record the independent approval and date against each exact Markdown revision."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/policies" }], defaultOpen: true },
+      { id: "policy-content", title: "Policies", description: "Approve the program's governing content.", instructions: "Open each Policy, program Document, and Training record. Draft from current approved decisions, replace placeholders, and resolve only material choices with management. A separate person then approves the exact Markdown revision.", output: "Approved content bound to the reviewed revisions.", steps: ["Draft the company's real rules, plans, and training material from current scope and approved decisions.", "Resolve missing owner, separate approver, Control links, audience, or intended values from authoritative records; ask only when a material decision remains.", "Have the independent approver review the exact Markdown revision and record their actual decision and date."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/policies" }], defaultOpen: true },
       { id: "retention", title: "Data Retention Schedule", description: "Approve the schedule document and its completed rows together.", steps: ["Review the governing schedule and any legal hold or exception rules.", "Complete a row for each distinct information use, cutoff, retention period, and disposition.", "Have a separate reviewer approve the complete document and row set."], types: [], utility: "retention-schedule", defaultOpen: true }
     ],
     resourceTypes: [],
@@ -184,7 +184,7 @@ export const PROGRAM_PATH = [
     description: "Implement and prepare to operate",
     summary: "Implemented Controls with ready evidence sources and enabled work schedules.",
     sections: [
-      { id: "controls", title: "Controls", description: "Put each selected Control into use and record what is actually in place.", steps: ["Open each Control for its specific setup action and current missing checks.", "Configure the activity and record its procedure, Systems, owner, and evidence sources.", "Mark it Implemented with its real start date after its sources and schedules are ready."], types: ["control"], defaultOpen: true },
+      { id: "controls", title: "Controls", description: "Put each selected Control into use and record its working design. Dated operating proof follows when work occurs.", steps: ["Open each Control, linked records, and current missing checks; do the setup that can be established from those sources.", "Configure the activity and record its procedure, Systems, owner, evidence sources, and any work rules its operation pattern requires.", "Mark it Implemented with its real start date when it works. Record later cycles and events separately with dated proof."], types: ["control"], defaultOpen: true },
       { id: "complementary-controls", title: "Complementary Controls", description: "Record customer or provider responsibilities that form part of the implementation boundary, or confirm there are none.", steps: ["Identify any customer or carved-out provider action an in-scope Control depends on.", "Record each dependency, or confirm that the current scope has none."], types: ["complementary-control"], defaultOpen: true },
       { id: "evidence-sources", title: "Evidence Sources", description: "Check that every Control points to an authoritative source that can produce its expected evidence.", steps: ["For each Control family, link an active Component with the required source kind, access owners, and retrieval instructions."], types: [], utility: "evidence-sources", defaultOpen: true },
       { id: "obligations", title: "Obligations", description: "Configure the calendar and event schedules that operate the Controls.", steps: ["Check the owner, trigger or cadence, due window, and required proof for each Obligation.", "Enable the rules that will run the implemented Controls."], types: ["obligation"], defaultOpen: true }

package/src/program-readiness.js

@@ -13,6 +13,7 @@ import {
   documentIsAuditSpecific,
   governedDocumentIsOperating,
   obligationIsEnabled,
+  obligationRuleIsEnabled,
   obligationIsRunning
 } from "./program-lifecycle.js";
 import { currentPartyPeople, partiesIndependent, partyPeople } from "./parties.js";
@@ -136,6 +137,10 @@ export async function assessProgramReadiness(input, options = {}) {
   const workspace = loaded.workspace || records.find((record) => record.type === "workspace");
   const program = resolveProgram(loaded, options.programId);
   const asOf = options.asOf || currentCalendarDate(workspace?.timezone || "UTC");
+  const currentDate = currentCalendarDate(workspace?.timezone || "UTC");
+  const asOfTime = asOf === currentDate
+    ? options.generatedAt || new Date().toISOString()
+    : timestampFromLocalDateTime(`${asOf}T23:59:59`, workspace?.timezone || "UTC");
   const requestedAudit = options.auditId
     ? records.find((record) => record.type === "audit" && record.id === options.auditId)
     : null;
@@ -155,7 +160,7 @@ export async function assessProgramReadiness(input, options = {}) {
   };
 
   const policyStage = await policiesStage(scope, records, byId, readMarkdown, loaded.model);
-  const controlStage = await controlsStage(scope, byId, readMarkdown, asOf, loaded.model, loaded.root);
+  const controlStage = await controlsStage(scope, byId, readMarkdown, asOf, loaded.model, loaded.root, asOfTime);
   controlStage.items.unshift(...collectionReviews
     .filter(({ resourceType }) => resourceType === "complementary-control")
     .map(collectionReviewReadinessItem));
@@ -185,7 +190,7 @@ export async function assessProgramReadiness(input, options = {}) {
   } else {
     controlStage.items.push(...retentionItems, ...retentionReviewItems);
   }
-  const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model);
+  const governedContent = await governedContentItems(scope, records, byId, readMarkdown, asOf, loaded.model, asOfTime);
   const policyActivations = await assessPolicyActivations(
     requiredPolicies(scope, byId),
     scope.controls,
@@ -193,7 +198,9 @@ export async function assessProgramReadiness(input, options = {}) {
     byId,
     readMarkdown,
     asOf,
-    loaded.model
+    loaded.model,
+    controlStage.items,
+    asOfTime
   );
   const controlOversight = collectionReviews.find(({ resourceType }) => resourceType === "control");
   const oversightEligible = Boolean(controlOversight && controlOversightEligible(controlStage.items));
@@ -210,7 +217,7 @@ export async function assessProgramReadiness(input, options = {}) {
       ? item
       : { ...item, status: "blocked", message: `Complete the Control collection review before activation. ${item.message}` };
   }));
-  controlStage.description = `Each implemented Control needs an owner, actual procedure, scope, operation pattern, mappings, an implementation date, enabled Obligations, and complete authoritative source ${modelSupports(loaded.model, "component-sources") ? "Components" : "Systems"}. When implementation is ready, perform one review of the implemented Control collection. Management then activates the unchanged approved program content as the Step 3 cutover.`;
+  controlStage.description = `Each implemented Control needs an owner, actual procedure, scope, operation pattern, mappings, an implementation date, enabled Obligations for scheduled or event work, and complete authoritative source ${modelSupports(loaded.model, "component-sources") ? "Components" : "Systems"}. When implementation is ready, perform one review of the implemented Control collection. Management then activates the unchanged approved program content as the Step 3 cutover.`;
   const scopeReadinessStage = scopeStage(
       program,
       scope,
@@ -268,7 +275,7 @@ export async function assessProgramReadiness(input, options = {}) {
     program?.assuranceGoal === "soc-2-type-2"
     && progressWindow?.start <= asOf
   );
-  const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, model: loaded.model });
+  const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, now: asOfTime, model: loaded.model });
   const policyLibrary = await assessPolicyLibraryUpgrades(loaded);
   const operating = Boolean(
     evidenceReady
@@ -589,7 +596,7 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   items.push(item(
     "criteria",
     criteriaComplete ? "complete" : "action",
-    "Confirm Trust Services criteria, Description Criteria, and Controls",
+    "Resolve criteria decisions and Control coverage",
     criteriaComplete
       ? `${selectedTrustServicesRequirements.length} applicable Trust Services criteria, ${selectedDescriptionRequirements.length} SOC 2 Description Criteria, and ${scope.controls.length} Controls are in scope. Every applicable Trust Services criterion has at least one selected Control; Description Criteria govern the system description and do not map to Controls.`
       : missingRequiredSecurityReferences.length || missingRequiredDescriptionReferences.length
@@ -985,7 +992,7 @@ function programOwnershipItem(records, byId) {
   return item(
     "program-ownership",
     complete ? "complete" : "action",
-    "Confirm program owners and oversight",
+    "Assign program owners and oversight",
     complete
       ? `${currentOwners.size} current ${currentOwners.size === 1 ? "person owns" : "people own"} the program records.${oversight ? " Security and Risk Oversight has a separate current chair." : ""}`
       : detail.join(" "),
@@ -1266,10 +1273,11 @@ function requiredGovernedDocuments(scope, records, byId, model) {
   ));
 }
 
-async function governedContentItems(scope, records, byId, readMarkdown, asOf, model) {
+async function governedContentItems(scope, records, byId, readMarkdown, asOf, model, asOfTime) {
   const enabledObligations = records.filter((record) => (
     record.type === "obligation" && obligationIsEnabled(record)
   ));
+  const operatingSchedules = enabledObligations.filter((record) => obligationRuleIsEnabled(record, byId, asOfTime));
   const requiredGovernedIds = new Set(enabledObligations.flatMap((record) => [
     ...(record.scopeResourceIds || []),
     ...(record.templateResourceId ? [record.templateResourceId] : [])
@@ -1332,7 +1340,7 @@ async function governedContentItems(scope, records, byId, readMarkdown, asOf, mo
           owner: currentPartyPeople(record.ownerIds, byId).size > 0,
           active: record.status === "active",
           requirementsImplemented: linkedControlIds.length > 0 && missingImplementationControlIds.length === 0,
-          assignmentScheduled: enabledObligations.some((obligation) => (
+          assignmentScheduled: operatingSchedules.some((obligation) => (
             obligation.templateResourceId === record.id
             || (obligation.scopeResourceIds || []).includes(record.id)
           )),
@@ -1459,7 +1467,7 @@ function documentActivationLabel(state) {
   })[state] || state;
 }
 
-async function assessPolicyActivations(policies, controls, records, byId, readMarkdown, asOf, model) {
+async function assessPolicyActivations(policies, controls, records, byId, readMarkdown, asOf, model, controlItems, asOfTime) {
   const sourceType = modelSupports(model, "component-sources") ? "component" : "system";
   const sourceField = modelSupports(model, "component-sources") ? "evidenceSourceComponentIds" : "evidenceSourceIds";
   const assessments = [];
@@ -1469,6 +1477,11 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
     const plannedOrPartialControlIds = linkedControls
       .filter((control) => ["planned", "partially-implemented"].includes(control.status))
       .map(({ id }) => id);
+    const missingLaunchControlIds = linkedControls
+      .filter((control) => controlItems.some((item) => (
+        item.id === `control-${control.id}` && item.implementationState === "implemented-with-gaps"
+      )))
+      .map(({ id }) => id);
     const missingComponentControlIds = modelSupports(model, "component-sources")
       ? linkedControls.filter((control) => ![
           ...(control.componentIds || []),
@@ -1497,7 +1510,7 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
       ["scheduled", "event-driven", "mixed"].includes(control.operationPattern)
       && !records.some((record) => (
         record.type === "obligation"
-        && obligationIsEnabled(record)
+        && obligationRuleIsEnabled(record, byId, asOfTime)
         && (record.controlIds || []).includes(control.id)
         && (record.policyIds || []).includes(policy.id)
       ))
@@ -1540,6 +1553,7 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
         : null
     ].filter(Boolean);
     const gapCount = plannedOrPartialControlIds.length
+      + missingLaunchControlIds.length
       + missingComponentControlIds.length
       + missingEvidenceSourceControlIds.length
       + missingScheduleControlIds.length
@@ -1564,6 +1578,7 @@ async function assessPolicyActivations(policies, controls, records, byId, readMa
       proposedEffectiveOn: policy.proposedEffectiveOn || null,
       linkedControlIds,
       plannedOrPartialControlIds,
+      missingLaunchControlIds,
       missingComponentControlIds,
       missingEvidenceSourceControlIds,
       missingScheduleControlIds,
@@ -1596,6 +1611,7 @@ function policyActivationLabel(state) {
 function policyActivationItem(assessment) {
   const counts = [
     [assessment.plannedOrPartialControlIds.length, "planned or partial Controls"],
+    [assessment.missingLaunchControlIds.length, "implemented Controls with launch gaps"],
     [assessment.missingComponentControlIds.length, "Controls missing active Components"],
     [assessment.missingEvidenceSourceControlIds.length, "Controls missing ready evidence sources"],
     [assessment.missingScheduleControlIds.length, "Controls missing enabled Obligations"],
@@ -1603,7 +1619,7 @@ function policyActivationItem(assessment) {
     [assessment.unresolvedExceptionIds.length, "unresolved Exceptions"]
   ].filter(([count]) => count).map(([count, label]) => `${count} ${label}`);
   const message = assessment.state === "active-and-operating"
-    ? `Active and effective ${assessment.effectiveOn}; all ${assessment.linkedControlIds.length} linked Controls are implemented with Components, evidence sources, and enabled Obligations.`
+    ? `Active and effective ${assessment.effectiveOn}; all ${assessment.linkedControlIds.length} linked Controls are implemented with Components, evidence sources, and enabled Obligations where scheduled or event work requires them.`
     : assessment.state === "ready-to-activate"
       ? "Implementation checks are complete. Include this approved Policy in the Step 3 cutover when you are ready for it to take effect."
       : `${assessment.label}: ${counts.join(", ") || assessment.timingWarnings.join(" ")}. ${assessment.activationWarning || ""}`.trim();
@@ -1644,7 +1660,7 @@ function legacyPolicyLibraryProposals(records) {
   }];
 }
 
-async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null) {
+async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null, asOfTime) {
   const items = [];
   const families = selectedControlFamilies(scope.controls, model);
   if (!scope.controls.length) {
@@ -1698,12 +1714,24 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null
       criteriaMapping: (control.requirementIds || []).length > 0,
       ...(["scheduled", "event-driven", "mixed"].includes(control.operationPattern) ? {
         workQueue: queueSchedules.length > 0
-          && queueSchedules.some(obligationIsEnabled)
+          && queueSchedules.some((obligation) => obligationRuleIsEnabled(obligation, byId, asOfTime))
       } : {})
     };
+    const launchChecks = Object.fromEntries(Object.entries(checks).filter(([name]) => ![
+      "implemented", "implementationDate"
+    ].includes(name)));
+    const launchReady = Object.values(launchChecks).every(Boolean);
+    const implementationState = control.status === "implemented"
+      ? Object.values(checks).every(Boolean) ? "implemented" : "implemented-with-gaps"
+      : control.status === "partially-implemented" ? "partial"
+        : launchReady ? "ready-to-implement" : "planned";
     const missing = Object.entries(checks).filter(([, value]) => !value).map(([name]) => controlCheckLabel(name));
     const nextSteps = controlImplementationSteps(control, checks, {
-      missingSourceFamilies
+      missingSourceFamilies,
+      targets: [...new Set([
+        ...(control.systemIds || []),
+        ...(control.componentIds || [])
+      ].map((id) => byId.get(id)?.title).filter(Boolean))]
     });
     items.push(item(
       `control-${control.id}`,
@@ -1715,17 +1743,20 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model, root = null
       control,
       {
         checks,
+        launchChecks,
+        implementationState,
+        implementationAssertion: "Implemented means the stated control works for the named Systems, its owner and procedure match current practice, and its evidence sources can produce proof. Scheduled or event-driven Controls have at least one enabled linked Obligation. It does not assert that a scheduled cycle or event has already occurred. Record dated operating proof when it does.",
         nextSteps,
         commands: [`npx filegrc get ${shellArgument(control.id)} --mutation`],
         workQueue: queueSchedules.length ? {
-          enabled: queueSchedules.filter(obligationIsEnabled).length,
-          running: queueSchedules.filter((obligation) => obligationIsRunning(obligation, byId, asOf, model)).length,
+          enabled: queueSchedules.filter((obligation) => obligationRuleIsEnabled(obligation, byId, asOfTime)).length,
+          running: queueSchedules.filter((obligation) => obligationIsRunning(obligation, byId, asOf, model, asOfTime)).length,
           total: queueSchedules.length
         } : null
       }
     ));
   }
-  return stage("controls", "Implement Controls", "Put each selected Control in place, record how it works, and mark it Implemented when it is working.", items);
+  return stage("controls", "Implement Controls", "Put each selected Control in place. Check its launch conditions, then mark it Implemented when it is working. Dated proof follows during operation.", items);
 }
 
 async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
@@ -1739,10 +1770,6 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
       .map((id) => byId.get(id))
       .filter((record) => (
         record?.type === sourceType
-        && (
-          !(record.evidenceSourceKinds || []).length
-          || family.sourceKinds.some((kind) => (record.evidenceSourceKinds || []).includes(kind))
-        )
       ));
     const completeSources = [];
     const sourceChecks = [];
@@ -1780,7 +1807,7 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
     const coveredControls = controlMappings.filter(({ complete }) => complete);
     const complete = completeSources.length > 0 && coveredControls.length === family.controls.length;
     const commands = [
-      ...(selectedSources.length
+      ...(complete ? [] : selectedSources.length
         ? sourceChecks.filter(({ complete: sourceComplete }) => !sourceComplete).flatMap((sourceCheck) => {
             const sourceId = sourceCheck.sourceComponentId || sourceCheck.sourceSystemId;
             return [
@@ -2087,21 +2114,21 @@ function controlCheckLabel(name) {
     procedureEffective: "procedure effective date",
     policyMapping: "policy mapping",
     criteriaMapping: "criteria mapping",
-    workQueue: "running Obligation schedules"
+    workQueue: "enabled Obligation rules (work starts after cutover)"
   })[name] || name;
 }
 
 const starterControlChecks = {
-  "control-security-governance": "Open the security review calendar and attendee roles. Check a reviewer separate from owners and operators examines risks, incidents, findings, and overdue work on the approved schedule.",
-  "control-policy-management": "Open the Control inventory and a recently revised Policy. Check owners are named, the approver is separate, and the change went through review before approval.",
-  "control-security-communication": "Trace how a security notice or Policy change reaches staff and affected outside parties. Check that the approved reporting routes can be used.",
+  "control-security-governance": "Set a security review calendar and name a reviewer separate from the owners. Make sure the agenda covers risks, incidents, findings, and overdue work when those records exist.",
+  "control-policy-management": "Name Control owners and a separate Policy approver. Set the path for reviewing and approving future Policy changes before they take effect.",
+  "control-security-communication": "Set working normal and fallback routes for security notices and Policy changes to staff and affected outside parties.",
   "control-workforce-expectations": "Review onboarding for roles with sensitive access. Check that required screening, agreements, and Policy acknowledgements happen before access.",
-  "control-security-training": "Compare the worker roster with training assignments. Check starters and role changes get training on time, with repeats tied to current content and the approved schedule.",
-  "control-risk-assessment": "Open the risk assessment against in-scope Systems and Vendors. Check threats, fraud, dependencies, and changes have owners and high risks get the required review.",
-  "control-monitoring-remediation": "Open the latest Control review, or schedule the first. Check incidents, test results, Exceptions, and overdue work, with owners and verified closure for gaps.",
+  "control-security-training": "Set up the worker roster, training audience, assignment rule, and owner. Check that starters and role changes will receive the approved content on time.",
+  "control-risk-assessment": "Set the risk assessment scope for the in-scope Systems and Vendors. Name who reviews threats, fraud, dependencies, changes, and high risks.",
+  "control-monitoring-remediation": "Schedule the first Control review. Name who will inspect incidents, tests, Exceptions, overdue work, and follow-up closure when those records exist.",
   "control-access-authorization": "Open access lists for in-scope Systems and Vendor tools. Check that accounts use unique identities and only needed permissions, and new grants require a business reason and approval.",
   "control-strong-authentication": "Open the System and Vendor lists. For each tool used for production, source code, email, identity, or sensitive data, check MFA, unique accounts, default credentials, and admin roles.",
-  "control-access-review-offboarding": "Export access lists from key Systems and Vendor tools. Check privileged and other access reviews meet their approved schedules, and departures lose access within the required window.",
+  "control-access-review-offboarding": "Check whether key Systems and Vendor tools can export access lists. Set the first access review and name who removes access after a departure.",
   "control-physical-workspace-security": "Walk through actual work areas and visitor access. Check who can enter nonpublic spaces and how devices, papers, screens, and conversations are protected.",
   "control-data-classification-inventory": "List important data stores in Systems and Vendor tools. Check each has an owner, classification, approved purpose, and recorded location.",
   "control-encryption-transmission": "For Systems, Vendor tools, and devices holding Confidential or Restricted data, check encryption at rest and in transit and who can manage the keys.",
@@ -2109,33 +2136,35 @@ const starterControlChecks = {
   "control-inventory-configuration": "Compare actual services, devices, software, service accounts, Vendors, and data stores with the inventory. Check owners, secure settings, and unsupported assets.",
   "control-endpoint-protection": "Review devices allowed into company Systems. Check encryption, screen lock, updates, and malware protection against the approved settings.",
   "control-network-security": "Open production network and remote-access rules. Check each path has a business reason, approved authentication, and separation; identify rules due for review.",
-  "control-change-management": "Follow a software or infrastructure change from request to deployment. Check the path includes risk review, testing, approval, and a way to recover.",
+  "control-change-management": "Set the path for software and infrastructure changes: risk review, testing, approval, deployment, and recovery. Check teams use it for the next real change.",
   "control-vulnerability-management": "List internet-facing and important Systems. Check each has vulnerability scan coverage or another approved check, and findings have owners and target dates.",
   "control-penetration-testing": "Review the service's exposure, major changes, and customer commitments. Decide whether independent testing is needed and, if so, set its scope and cadence.",
   "control-logging-monitoring": "For each important System, open security logs, alert rules, and service-health checks where needed. Check retention and whether test alerts reach an owner.",
   "control-incident-response": "Walk through how a worker reports an incident. Check who triages, escalates, contains, communicates, and closes it using the approved plan.",
-  "control-incident-exercise": "Send a test alert through a representative incident path. Check acknowledgement, escalation, and fallback, then record participants, failures, and follow-up.",
-  "control-backup-restoration": "For each important System, inspect backup or alternate recovery settings and failure alerts. Run or review a restore test against its recovery needs.",
+  "control-incident-exercise": "Set the incident exercise owner, scenario, and schedule. Check the reporting, escalation, and fallback paths are ready for the first exercise.",
+  "control-backup-restoration": "For each important System, inspect backup or alternate recovery settings and failure alerts. Schedule the first restore test against its recovery needs.",
   "control-continuity-exercise": "Review recovery priorities, contacts, and owners. Check the plan covers loss of an important System or provider and has an exercise date.",
-  "control-vendor-due-diligence": "Open the Vendor list. For each with sensitive data or a material service role, check its security review and contract terms; review older Vendors already in use.",
-  "control-vendor-monitoring": "Open critical and high-risk Vendors. Check each has a current review, an owner for open issues, and timely reassessment after a material change or incident.",
+  "control-vendor-due-diligence": "Identify Vendors with sensitive data or a material service role. Set the review and contract checks before approving a new Vendor; triage existing Vendors for the first review.",
+  "control-vendor-monitoring": "Identify critical and high-risk Vendors, assign review owners and cadence, and set a reassessment trigger for material changes or incidents.",
   "control-security-exceptions": "Review departures from security rules. Check each has a reason, owner, risk assessment, compensating measure, approval, and expiry or review date."
 };
 
 export function controlImplementationSteps(control, checks, options = {}) {
   const steps = [];
-  if (!checks.implemented) steps.push(starterControlChecks[control.id]
-    || "Inspect the systems, people, vendors, or work this Control covers. Compare current practice with its statement and fix any gaps.");
+  if (!checks.implemented) steps.push(control.id === "control-strong-authentication" && options.targets?.length
+    ? `Ensure MFA and unique accounts are enabled for ${options.targets.join(", ")}; check default credentials and admin roles.`
+    : starterControlChecks[control.id]
+    || `Inspect the Systems, people, Vendors, and work linked to ${control.title || control.id}. Compare the actual configuration with this Control's statement and fix the specific gaps.`);
   const record = [];
-  if (!checks.owner) record.push("choose an owner");
-  if (!checks.scope) record.push("select the Systems this covers");
-  if (!checks.operationPattern) record.push("set when it runs");
-  if (!checks.procedure) record.push("write who does what and when in Procedure");
-  if (!checks.evidenceSource) record.push("link the tool or system that can show it happened");
+  if (!checks.owner) record.push("assign the actual owner from existing People or Appointments");
+  if (!checks.scope) record.push("link the in-scope Systems already in the Program");
+  if (!checks.operationPattern) record.push("record whether it runs continuously, per transaction, on a schedule, or after an event");
+  if (!checks.procedure) record.push("write the current actors, configuration, and procedure in Record Markdown");
+  if (!checks.evidenceSource) record.push("link the authoritative Component that can produce proof");
   if (!checks.policyMapping && checks.policyMapping !== undefined) record.push("link the Policy it implements");
   if (!checks.criteriaMapping && checks.criteriaMapping !== undefined) record.push("link the criteria it covers");
-  if (checks.implemented && !checks.implementationDate) record.push("enter the date it started working");
-  if (checks.implemented && (checks.procedureRevision === false || checks.procedureEffective === false)) {
+  if (!checks.implementationDate) record.push("record the date the working implementation took effect when marking Implemented");
+  if (checks.procedureRevision === false || checks.procedureEffective === false) {
     record.push("record the Procedure revision and effective date");
   }
   if (record.length) steps.push(`In this Control, ${record.join("; ")}.`);
@@ -2145,18 +2174,16 @@ export function controlImplementationSteps(control, checks, options = {}) {
     ? `Cover the missing evidence families: ${sourceTargets.length ? sourceTargets.join(" and ") : "this Control"}. For each, link an active Component with the matching kind, evidence owners, and report retrieval instructions.`
     : null;
   const queueStep = checks.workQueue === false
-    ? "Check the linked Obligations. Enable one with the owner and schedule for this Control's recurring or event work, or add one if none covers it."
+    ? "Inspect linked Obligations and their Policy basis. Enable a suitable existing rule with its owner and deadline, or add a rule only if no existing one covers this work. A scheduled rule does not prove a cycle occurred."
     : null;
   if (!checks.implemented) {
     if (sourceStep || queueStep) steps.push([sourceStep, queueStep].filter(Boolean).join(" "));
-    else if (checks.applicability === false) steps.push("Confirm this Control applies to the current Program scope with `review-applicability --scaffold --type control`.");
-    else steps.push(checks.procedureRevision === undefined
-      ? "When it works, mark this Control Implemented and enter its start date."
-      : "When it works, mark this Control Implemented. Enter its start date and the Procedure revision and effective date.");
+    else if (checks.applicability === false) steps.push("Compare this Control with the current Program scope and record its applicability decision with `review-applicability --scaffold --type control`; ask management only if the decision cannot be established from the scope and commitments.");
+    else steps.push("When these launch conditions hold, mark the Control Implemented with its real effective date. Record dated proof later, when a cycle or event actually occurs.");
   } else {
     if (sourceStep) steps.push(sourceStep);
     if (queueStep) steps.push(queueStep);
-    if (checks.applicability === false) steps.push("Confirm this Control applies to the current Program scope with `review-applicability --scaffold --type control`.");
+    if (checks.applicability === false) steps.push("Compare this Control with the current Program scope and record its applicability decision with `review-applicability --scaffold --type control`; ask management only if the decision cannot be established from the scope and commitments.");
   }
   return steps;
 }

package/src/validate.js

@@ -21,7 +21,7 @@ import {
 } from "./recurrence.js";
 import { resourceReviewRevisionMatches, resourceReviewRevisions, retentionReviewResourceIds } from "./retention.js";
 import { retentionScheduleApprovalIssues } from "./retention-schedule-approval.js";
-import { obligationIsEnabled } from "./program-lifecycle.js";
+import { obligationIsEnabled, obligationRuleIsEnabled } from "./program-lifecycle.js";
 import { currentPartyPeople, partyPeople } from "./parties.js";
 import { isMarkdownChoice, markdownEntries } from "./resource-markdown.js";
 import { currentCalendarDate, isRfc3339Timestamp, localDateTimeValue, timestampFromLocalDateTime } from "./time.js";
@@ -222,7 +222,7 @@ async function validateWorkspaceUnmeasured(input) {
     validateIndependentApproval(record, byId, displayPath, diagnostics);
     validateCompletedObligationEvent(record, byId, loaded.model, displayPath, diagnostics);
     validateActionObligationRule(record, byId, displayPath, diagnostics);
-    validateImplementedControlSchedules(record, obligationsByControl, displayPath, diagnostics);
+    validateImplementedControlSchedules(record, obligationsByControl, byId, new Date().toISOString(), displayPath, diagnostics);
     serialContentDiagnosticTasks.push(async () => {
       const markdownDiagnostics = [];
       const approvalDiagnostics = [];
@@ -1538,7 +1538,7 @@ function assertFingerprintBudget(options, uncachedBytes) {
   }
 }
 
-function validateImplementedControlSchedules(record, obligationsByControl, path, diagnostics) {
+function validateImplementedControlSchedules(record, obligationsByControl, byId, now, path, diagnostics) {
   if (record.type !== "control" || record.status !== "implemented") return;
   const schedules = obligationsByControl.get(record.id) || [];
   if (!schedules.length) {
@@ -1550,16 +1550,20 @@ function validateImplementedControlSchedules(record, obligationsByControl, path,
     ));
     return;
   }
-  if (schedules.some(obligationIsEnabled)) return;
-  const stopped = schedules.filter((obligation) => !obligationIsEnabled(obligation));
+  if (schedules.some((obligation) => obligationRuleIsEnabled(obligation, byId, now))) return;
+  const stopped = schedules.filter((obligation) => !obligationRuleIsEnabled(obligation, byId, now));
   const paused = stopped.filter((obligation) => obligation.status === "paused");
   const proposed = stopped.filter((obligation) => obligation.status === "proposed");
+  const pendingRules = stopped.filter((obligation) => obligationIsEnabled(obligation) && obligation.scheduleMode === "rule");
   const reasons = [
     proposed.length
       ? `${proposed.length} linked ${proposed.length === 1 ? "schedule is" : "schedules are"} still proposed. Enable ${proposed.length === 1 ? "it" : "them"} before implementing the control; the schedule will remain dormant until its governing Policy is active and effective.`
       : "",
     paused.length
       ? `${paused.length} linked ${paused.length === 1 ? "schedule is" : "schedules are"} paused. Enable ${paused.length === 1 ? "it" : "them"} before implementing the control.`
+      : "",
+    pendingRules.length
+      ? `${pendingRules.length} linked ${pendingRules.length === 1 ? "rule is" : "rules are"} not active. Activate the selected rule before implementing the control.`
       : ""
   ].filter(Boolean).join(" ");
   diagnostics.push(error(

package/src/web.js

@@ -1098,6 +1098,7 @@ function renderPolicyActivationAssessments() {
     return '<article class="policy-activation-card ' + esc(assessment.state) + '"><div class="evidence-map-card-head"><div><span class="badge ' + (operating ? "good" : "warn") + '">' + esc(assessment.label) + '</span><h3><a href="#/resource/policy/' + encodeURIComponent(assessment.policyId) + '">' + esc(assessment.title) + '</a></h3></div><small>' + assessment.gapCount + ' ' + pluralize("gap", assessment.gapCount) + '</small></div>' + warnings +
       '<div class="policy-activation-gaps">' +
       gapGroup("Planned or partial Controls", assessment.plannedOrPartialControlIds, "control") +
+      gapGroup("Implemented Controls with launch gaps", assessment.missingLaunchControlIds || [], "control") +
       gapGroup("Missing active Components", assessment.missingComponentControlIds, "control") +
       gapGroup("Missing ready evidence sources", assessment.missingEvidenceSourceControlIds, "control") +
       gapGroup("Missing enabled Obligations", assessment.missingScheduleControlIds, "control") +
@@ -1212,9 +1213,9 @@ function workflowGuidance(options = {}) {
   const renderRow = (item) => {
     const href = workflowItemHref(item);
     const guidance = options.type === "control" && item.nextSteps?.length
-      ? '<ol class="control-next-steps">' + item.nextSteps.map((step) => '<li>' + esc(step) + '</li>').join("") + '</ol>'
+      ? '<p class="workflow-status">' + esc(controlLaunchLabel(item.implementationState)) + '</p><ol class="control-next-steps">' + item.nextSteps.map((step) => '<li>' + esc(step) + '</li>').join("") + '</ol><small>' + esc(item.implementationAssertion || "") + '</small>'
       : '<small>' + esc(item.message || workflowItemDetail(item)) + '</small>';
-    const body = '<span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong>' + guidance + '</span>';
+    const body = '<span class="workflow-finding-status ' + esc(item.state) + '">' + esc(options.type === "control" && item.implementationState ? controlLaunchLabel(item.implementationState).split(":")[0] : properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong>' + guidance + '</span>';
     return href ? '<a href="' + href + '">' + body + '</a>' : '<div>' + body + '</div>';
   };
   const rows = visible.map(renderRow).join("");
@@ -1226,7 +1227,27 @@ function workflowGuidance(options = {}) {
   return '<section class="workflow-guidance panel detail-support-panel detail-workflow-panel"><div class="panel-head"><div><p class="kicker">To-do</p><h3>' + esc(options.title || "Checklist") + '</h3></div><span class="badge ' + (blocking.length ? "warn" : "good") + '">' + (blocking.length ? "Needs work" : "Current") + '</span></div><p class="workflow-status">' + esc(status) + (completionRequirements ? '. ' + completionRequirements : "") + '</p><div class="workflow-findings">' + rows + '</div>' + more + '</section>';
 }
 
+function controlLaunchLabel(state) {
+  return ({
+    planned: "Planned: launch conditions remain",
+    partial: "Partially implemented: launch conditions remain",
+    "ready-to-implement": "Launch checks ready: check the live configuration, then record its start date",
+    "implemented-with-gaps": "Implemented with gaps: fix the launch checks",
+    implemented: "Implemented"
+  })[state] || "Control launch";
+}
+
+function controlLaunchState(id) {
+  return state.programReadiness?.stages?.find(({ id: stageId }) => stageId === "controls")?.items
+    .find(({ id: itemId }) => itemId === "control-" + id)?.implementationState;
+}
+
 function recordCompletionState(record) {
+  if (record.type === "control") {
+    const item = state.programReadiness?.stages?.find(({ id }) => id === "controls")?.items
+      .find(({ id }) => id === "control-" + record.id);
+    if (item?.implementationState === "implemented") return '<section class="record-completion-state panel detail-support-panel"><p class="kicker">Control launch</p><h3>Implemented</h3><p>' + esc(item.implementationAssertion) + '</p><p>Dated evidence belongs to the operating work that produces it.</p></section>';
+  }
   const completeStatuses = new Set(["approved", "active", "complete", "completed", "closed", "done", "reconciled"]);
   if (!completeStatuses.has(record.status)) return "";
   return '<section class="record-completion-state panel detail-support-panel"><p class="kicker">Record status</p><h3>' + esc(properCase(record.status)) + '</h3><p>This record has no direct next step.</p></section>';
@@ -1408,8 +1429,13 @@ function recordWorkflowCell(type, entry, detailContext = "") {
   const item = items[0];
   let href = workflowItemHref(item) || "#/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(entry.record.id);
   if (detailContext && href.startsWith("#/resource/" + encodeURIComponent(type) + "/") && !href.includes("?")) href += detailContext;
-  const title = type === "control" ? "Finish implementation" : item.title;
-  return '<a class="record-workflow-action" href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(title) + '</strong><small>' + esc(stagePageItemDetail(item)) + (items.length > 1 ? " +" + (items.length - 1) + " more" : "") + '</small></span></a>';
+  const title = type === "control"
+    ? item.implementationState === "implemented-with-gaps" ? "Fix Control launch gaps" : "Finish implementation"
+    : item.title;
+  const statusLabel = type === "control" && item.implementationState
+    ? controlLaunchLabel(item.implementationState).split(":")[0]
+    : properCase(item.state);
+  return '<a class="record-workflow-action" href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(statusLabel) + '</span><span><strong>' + esc(title) + '</strong><small>' + esc(stagePageItemDetail(item)) + (items.length > 1 ? " +" + (items.length - 1) + " more" : "") + '</small></span></a>';
 }
 
 function openCollectionReviewDialog(type) {
@@ -1839,7 +1865,7 @@ function stagePageCard(stage, destination, index) {
   const taskPreview = items.length
     ? '<div class="stage-page-tasks">' + items.slice(0, 3).map((item) => {
         const href = destination.utility === "evidence-sources" ? destination.href : item.href || workflowItemHref(item) || destination.href;
-        return '<a href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(stagePageItemDetail(item)) + '</small></span></a>';
+        return '<a href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(item.implementationState ? controlLaunchLabel(item.implementationState).split(":")[0] : properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(stagePageItemDetail(item)) + '</small></span></a>';
       }).join("") + (items.length > 3 ? '<small class="stage-page-tasks-more">+' + (items.length - 3) + ' more on this page</small>' : "") + '</div>'
     : "";
   return '<article class="stage-page-card ' + (complete ? "complete" : "") + '"><div class="stage-page-card-head"><div><small>' + esc(stepLabel) + '</small><h3>' + esc(destination.label) + '</h3></div><div class="stage-page-card-actions">' + completionState + '<a class="stage-page-open" href="' + destination.href + '" aria-label="Open ' + esc(destination.label) + '"><span>Open ›</span></a></div></div><p>' + esc(summary) + '</p>' + taskPreview + '</article>';
@@ -2277,8 +2303,9 @@ function policyEventTrigger(trigger, index, collapsed = false, scope = "events")
   const tooltipId = "policy-event-tooltip-" + scope + "-" + index;
   const proposed = trigger.programStatus === "proposed";
   const unavailable = state.readOnly || proposed;
+  const blocker = trigger.steps.find(({ programBlocker }) => programBlocker)?.programBlocker;
   const availability = proposed
-    ? "Available after its governing policies are effective, at least one linked control is implemented, and every task has a current owner."
+    ? "Dormant until " + (blocker ? blocker.label.toLowerCase() + " (" + blocker.id + ")" : "its governing content is active and effective") + ". Use this workflow for the first real event after cutover."
     : state.readOnly
       ? "Open this workspace in writable mode to trigger the workflow."
       : trigger.steps.length + " " + pluralize("task", trigger.steps.length) + " will be added to the Work Queue.";
@@ -3219,7 +3246,7 @@ function renderList(main, type, params = new URLSearchParams()) {
     const start = (pageNumber - 1) * LIST_PAGE_SIZE;
     const visible = filtered.slice(start, start + LIST_PAGE_SIZE);
     main.querySelector("#result-count").textContent = filtered.length + (filtered.length === 1 ? " record" : " records");
-    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + detailContext + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? displayStatus(entry.record) : entry.record[name], name, type, true)) + '</td>').join("") + '<td data-label="Next action">' + recordWorkflowCell(type, entry) + '</td><td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 3) + '">' + empty(entries.length ? "No records match this filter." : collectionEmptyState(type, definition)) + '</td></tr>';
+    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + detailContext + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? type === "control" ? controlLaunchState(entry.record.id) || displayStatus(entry.record) : displayStatus(entry.record) : entry.record[name], name, type, true)) + '</td>').join("") + '<td data-label="Next action">' + recordWorkflowCell(type, entry) + '</td><td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 3) + '">' + empty(entries.length ? "No records match this filter." : collectionEmptyState(type, definition)) + '</td></tr>';
     pagination.hidden = totalPages === 1;
     previous.disabled = pageNumber === 1;
     next.disabled = pageNumber === totalPages;

package/src/workflow.js

@@ -466,13 +466,17 @@ function recordIncompleteReason(record, loaded, program) {
     return {
       state: "ready",
       requiredness: appointmentRequiredness(record, loaded.model),
-      message: "Assign a holder, confirm the authority and independence needed, then activate this Appointment on its actual start date."
+      message: "Check current People and scoped Appointments, assign a qualified holder, and record the actual authority and start date. Ask management only if the holder or independence decision is unresolved."
     };
   }
   const messages = {
     draft: "Add the required details, relationships, and Markdown before review.",
     planned: "Check this planned record against how your program works, then add the missing details.",
-    proposed: "Confirm the work, owner, schedule, and completion requirements before activation.",
+    proposed: ["obligation", "obligation-rule"].includes(record.type)
+      ? "Read the linked Policy and Control, fill the actual owner, schedule, deadline, and proof requirement, then activate the rule. Ask management only for a choice those sources do not settle."
+      : record.type === "reporting-route-set"
+        ? "Fill the normal and fallback reporting routes from approved contact details, commit the proposal, and obtain the required separate approval before it takes effect. Ask only for missing route or authority decisions."
+        : "Inspect the source facts and type guide, complete the proposal, and obtain the required review or approval before activation.",
     "in-review": "Have an independent reviewer approve the exact content revision.",
     open: "Complete this work with the required proof, or formally close it without completion.",
     "in-progress": "Finish the work, record the result, and link the completion proof.",
@@ -724,7 +728,7 @@ function reconciliationFindings(reconciliation) {
     state: "ready",
     severity: "warning",
     requiredness: "conditional",
-    title: `Confirm ${fieldLabel(candidate.eventType)}`,
+    title: `Resolve ${fieldLabel(candidate.eventType)} transition`,
     message: candidate.message,
     subject: candidate.subject,
     fieldPath: candidate.sourcePath,
@@ -1139,6 +1143,11 @@ function normalizeFinding(code, item, context) {
     title: item.title,
     message: item.message,
     ...(item.nextSteps?.length ? { nextSteps: item.nextSteps } : {}),
+    ...(item.implementationState ? {
+      implementationState: item.implementationState,
+      launchChecks: item.launchChecks,
+      implementationAssertion: item.implementationAssertion
+    } : {}),
     ...(item.checks ? { unmetChecks: Object.entries(item.checks)
       .filter(([, passed]) => passed === false)
       .map(([name]) => name) } : {}),
@@ -1625,12 +1634,12 @@ function periodFinding(key, title, message, state, subject, actions, dependencie
 function auditClosureNextStep(status) {
   const steps = {
     planned: {
-      title: "Confirm the engagement and start audit preparation",
-      message: "Link the agreed engagement terms, confirm scope and management acknowledgement, then move the audit to in progress."
+      title: "Record the agreed engagement and start audit preparation",
+      message: "Read the signed engagement terms, link them, record the agreed scope and management acknowledgement, then move the audit to in progress. Ask for missing terms or acknowledgement only if unavailable."
     },
     "in-progress": {
       title: "Begin fieldwork",
-      message: "Finish management preparation, confirm the fieldwork dates, and move the audit to fieldwork when the CPA firm begins testing."
+      message: "Finish management preparation, record the fieldwork dates agreed with the CPA firm, and move the audit to fieldwork when testing begins. Ask for the dates only if they are not in the engagement correspondence."
     },
     fieldwork: {
       title: "Finish fieldwork and prepare the report",
@@ -1642,7 +1651,7 @@ function auditClosureNextStep(status) {
     },
     issued: {
       title: "Record final report delivery",
-      message: "Confirm the issued report evidence, opinion, report date, authorized recipient, and delivery receipt, then move the audit to delivered."
+      message: "Read the issued report and delivery record, enter the opinion, report date, authorized recipient, and receipt, then move the audit to delivered. Ask only for missing delivery facts."
     },
     delivered: {
       title: "Close the audit",