filegrc 0.16.3 → 0.16.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/agent.js

@@ -1,7 +1,7 @@
 import { modelSupports } from "../model/index.js";
 import { createResourceId } from "./id.js";
 import { markdownEntries } from "./resource-markdown.js";
-import { RESOURCE_INSTRUCTIONS, resourceProgramContext } from "./program-path.js";
+import { RESOURCE_INSTRUCTIONS, RESOURCE_OUTPUTS, resourceProgramContext } from "./program-path.js";
 import { assessCollectionReview } from "./collection-review.js";
 import { resolveProgram } from "./program.js";
 
@@ -80,6 +80,7 @@ export function buildAgentGuide(loaded, type, options = {}) {
     title: definition.title,
     pluralTitle: definition.pluralTitle,
     instructions: RESOURCE_INSTRUCTIONS[type] || definition.description,
+    output: RESOURCE_OUTPUTS[type] || `A validated ${definition.title} record.`,
     use: definition.description,
     purpose: definition.description,
     programStep: resourceProgramContext(type, loaded.model),

package/src/audit-preparation.js

@@ -69,8 +69,13 @@ export async function assessAuditPreparation(input, options = {}) {
     ? audits.find((record) => record.id === options.auditId)
     : options.selectDefault === false
       ? null
-      : selectDefaultAudit(audits, calendarAsOf);
+      : selectDefaultAudit(options.programId && modelSupports(loaded.model, "program-scope")
+        ? audits.filter((record) => record.programId === options.programId)
+        : audits, calendarAsOf);
   if (options.auditId && !audit) throw new Error(`Audit "${options.auditId}" was not found.`);
+  if (audit && options.programId && modelSupports(loaded.model, "program-scope") && audit.programId !== options.programId) {
+    throw new Error(`Audit "${audit.id}" does not belong to Program "${options.programId}".`);
+  }
 
   const formalPeriodEnd = audit?.auditKind === "soc-2-type-2" ? coverageEnd(audit.coverage) : null;
   const readinessAsOf = formalPeriodEnd && formalPeriodEnd < calendarAsOf ? formalPeriodEnd : calendarAsOf;

package/src/cli.js

@@ -289,10 +289,11 @@ export async function runCli(argv = process.argv.slice(2)) {
     const audit = auditId ? loaded.resources.find(({ id, type }) => id === auditId && type === "audit") : null;
     const programId = flags.program || audit?.programId;
     const readiness = await assessProgramReadiness(loaded, { asOf: flags["as-of"], programId });
-    const auditReadiness = auditId ? await assessAuditPreparation(loaded, {
+    const auditReadiness = await assessAuditPreparation(loaded, {
       auditId,
-      asOf: flags["as-of"]
-    }) : null;
+      asOf: flags["as-of"],
+      programId
+    });
     const result = buildProgramPathResult(loaded.model, readiness, auditReadiness);
     const output = selectProgramPathOutput(result, flags);
     if (flags.json) console.log(JSON.stringify(output, null, 2));
@@ -458,15 +459,29 @@ export async function runCli(argv = process.argv.slice(2)) {
   if (command === "program-readiness") {
     const loaded = await loadWorkspace(root);
     const result = await assessProgramReadiness(loaded, { asOf: flags["as-of"], programId: flags.program });
-    const output = flags.summary ? summarizeProgramReadiness(result) : result;
+    if (flags.control && flags.summary) throw new Error("Use either --control or --summary for program-readiness.");
+    const controlItem = flags.control
+      ? result.stages.find(({ id }) => id === "controls")?.items.find(({ resourceType, resourceId }) => (
+          resourceType === "control" && resourceId === flags.control
+        ))
+      : null;
+    if (flags.control && !controlItem) throw new Error(`Control "${flags.control}" is not selected in this Program.`);
+    const output = controlItem
+      ? { asOf: result.asOf, programId: result.program?.id, ...controlItem }
+      : flags.summary ? summarizeProgramReadiness(result) : result;
     const headlineStatus = result.progress.status || result.status;
     if (flags.json) console.log(JSON.stringify(output, null, 2));
+    else if (controlItem) {
+      console.log(`${controlItem.status.toUpperCase()}\t${controlItem.title}`);
+      if (!controlItem.nextSteps?.length) console.log(`  ${controlItem.message}`);
+      printGuidanceSteps(controlItem);
+    }
     else if (flags.summary) {
       console.log(`${headlineStatus.toUpperCase()}: ${result.progress.label} ${result.progress.percent}%. ${result.progress.detail}`);
       for (const stage of output.stages) {
         console.log(`${stage.status.toUpperCase()}\t${stage.title}\t${stage.counts.action} checks need action`);
       }
-      if (output.firstAction) console.log(`Next: ${output.firstAction.title}\t${output.firstAction.message}`);
+      if (output.firstAction) printNextAction(output.firstAction);
     }
     else {
       console.log(`${headlineStatus.toUpperCase()}: ${result.progress.label} ${result.progress.percent}%. ${result.progress.detail}`);
@@ -480,7 +495,10 @@ export async function runCli(argv = process.argv.slice(2)) {
       );
       for (const stage of result.stages) {
         console.log(`\n${stage.title}`);
-        for (const item of stage.items) console.log(`${item.status.toUpperCase()}\t${item.title}\t${item.message}`);
+        for (const item of stage.items) {
+          console.log(`${item.status.toUpperCase()}\t${item.title}${item.nextSteps?.length ? "" : `\t${item.message}`}`);
+          printGuidanceSteps(item);
+        }
       }
       if (result.policyActivations.length) {
         console.log("\nPolicy activation assessments");
@@ -492,7 +510,7 @@ export async function runCli(argv = process.argv.slice(2)) {
         console.log(`\nEvidence Ready: management can start the candidate Type 2 period on or after ${result.suggestedCandidatePeriodStart || result.asOf}.`);
       }
     }
-    if (flags["require-ready"] && !result.evidenceReady) process.exitCode = 2;
+    if (flags["require-ready"] && (controlItem ? controlItem.status !== "complete" : !result.evidenceReady)) process.exitCode = 2;
     return output;
   }
   if (command === "reporting-route-sets") {
@@ -1347,7 +1365,7 @@ Usage:
   filegrc list [resource-type] [--workflow] [--json]
   filegrc search <query> [--type resource-type] [--json]
   filegrc obligations [--program program-id] [--as-of YYYY-MM-DD] [--from YYYY-MM-DD] [--through YYYY-MM-DD] [--now RFC3339] [--complete] [--json]
-  filegrc program-readiness [--as-of YYYY-MM-DD] [--require-ready] [--summary] [--json]
+  filegrc program-readiness [--as-of YYYY-MM-DD] [--require-ready] [--summary | --control CONTROL_ID] [--json]
   filegrc program-amendment <source-resource-id> [--json]
   filegrc review-bindings <retention-or-mapping-id> [--json]
   filegrc evidence-map [--as-of YYYY-MM-DD] [--json]
@@ -1365,7 +1383,7 @@ Usage:
   filegrc policy-library [--json | --accept proposal-id --proposal-revision revision --yes]
   filegrc trigger <event-type> (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) [--program program-id] [--risk-level normal|high] [--subject resource-id[,resource-id]] [--title text] [--json]
   filegrc evidence-packet [--audit audit-id | --program program-id] [--start YYYY-MM-DD] [--end YYYY-MM-DD] [--output .filegrc/path] [--preview] [--require-ready] [--json]
-  filegrc get [resource-type] <id> [--mutation]
+  filegrc get [resource-type] <id> [--mutation|--workflow]
   filegrc references <id> [--json]
   filegrc preview-mutation <preview.json|-> [--json]
   filegrc create <mutation.json|-> [--json]
@@ -1496,8 +1514,9 @@ source. No audit ID or CPA firm is required.
 Options:
   --program <id>     Program to assess when more than one active Program exists
   --as-of <date>     Evaluate effective dates and obligations on YYYY-MM-DD
-  --require-ready    Exit with code 2 unless the Evidence Ready gate passes
+  --require-ready    Exit with code 2 unless the selected Control, or the full program, is ready
   --summary          Omit item details and print stage counts and next actions
+  --control <id>     Show the current setup steps for one selected Control
   --json             Print the result as JSON
   --root <path>      Workspace path
   --help             Show this help`);
@@ -1749,6 +1768,7 @@ function printAgentGuide(result) {
     console.log(`Program step: ${result.programStep.order ? `Step ${result.programStep.order}` : `Step ${result.programStep.number}`} · ${result.programStep.title}`);
   }
   console.log(`Instructions: ${result.instructions}`);
+  console.log(`Output: ${result.output}`);
   console.log(`Use: ${result.use}`);
   console.log(`Policy basis: ${result.policyBasis}`);
   console.log(`Timing: ${result.cadence}`);
@@ -1810,23 +1830,21 @@ function buildProgramPathResult(model, readiness, auditReadiness) {
   const readinessById = new Map(readiness.stages.map((stage) => [stage.id, stage]));
   const stages = buildAgentProgramPath(model).map((stage) => {
     if (stage.id === "audit") {
-      const auditAction = auditReadiness?.firstAction || (
-        auditReadiness?.status === "not-started"
-          ? {
-              id: "create-audit",
-              status: "action",
-              title: "Create the planned CPA engagement",
-              message: "Create a planned Audit from the current management scope, then replace the remaining scaffold values with the CPA firm and firm-agreed scope and dates.",
-              resourceType: "audit",
-              commands: [
-                "npx filegrc guide audit --json",
-                "npx filegrc scaffold audit --title \"YEAR SOC 2 TYPE\" > audit-mutation.json",
-                "npx filegrc create audit-mutation.json --json",
-                "npx filegrc prepare-audit AUDIT_ID --json"
-              ]
-            }
-          : null
-      );
+      const auditAction = auditReadiness?.status === "not-started"
+        ? {
+            id: "create-audit",
+            status: "action",
+            title: "Record the CPA engagement",
+            message: "After engaging the CPA firm, create an Audit with the firm-agreed type, scope, and dates.",
+            resourceType: "audit",
+            commands: [
+              "npx filegrc guide audit --json",
+              "npx filegrc scaffold audit --title \"YEAR SOC 2 TYPE\" > audit-mutation.json",
+              "npx filegrc create audit-mutation.json --json",
+              "npx filegrc prepare-audit AUDIT_ID --json"
+            ]
+          }
+        : auditReadiness?.stages?.flatMap(({ items }) => items).find(({ status }) => status === "action") || null;
       return {
         ...stage,
         status: auditReadiness?.status || "not-started",
@@ -1866,12 +1884,29 @@ function buildProgramPathResult(model, readiness, auditReadiness) {
   };
 }
 
+function printGuidanceSteps(item) {
+  item.nextSteps?.forEach((step, index) => console.log(`  ${index + 1}. ${step}`));
+}
+
+function printNextAction(action) {
+  if (action.nextSteps?.length) {
+    console.log(`Next: ${action.title}`);
+    printGuidanceSteps(action);
+  } else {
+    console.log(`Next: ${action.title} · ${action.message}`);
+  }
+}
+
 function printProgramPath(result) {
   console.log(`Current: Step ${result.currentStep.number}, ${result.currentStep.title}`);
   console.log(`Evidence Ready: ${result.evidenceReady ? "yes" : "no"}; operating: ${result.operating ? "yes" : "no"}`);
   for (const stage of result.stages) {
     console.log(`\nStep ${stage.number}. ${stage.title} [${String(stage.status).toUpperCase()}]`);
     console.log(stage.summary);
+    for (const section of stage.sections) {
+      console.log(`  ${section.title}`);
+      section.steps.forEach((step, index) => console.log(`    ${index + 1}. ${step}`));
+    }
     for (const page of stage.pages) {
       console.log(`${page.order ? `Step ${page.order}` : "Operating area"} · ${page.title} (${page.type || `utility:${page.utility}`})`);
       console.log(`  ${page.summary}`);
@@ -1885,7 +1920,7 @@ function printProgramPath(result) {
     }
     console.log("Commands:");
     for (const command of stage.commands) console.log(`  ${command}`);
-    for (const action of stage.nextActions) console.log(`Next: ${action.title} · ${action.message}`);
+    for (const action of stage.nextActions) printNextAction(action);
   }
 }
 
@@ -1953,6 +1988,7 @@ function summarizePathAction(action) {
     status: action.status,
     title: action.title,
     message: action.message,
+    ...(action.nextSteps?.length ? { nextSteps: action.nextSteps } : {}),
     ...(action.resourceType ? { resourceType: action.resourceType } : {}),
     ...(action.resourceId ? { resourceId: action.resourceId } : {})
   };
@@ -1998,13 +2034,13 @@ function printProgramPathOutput(result, flags) {
       console.log(`${String(stage.status).toUpperCase()}\tStep ${stage.number}\t${stage.title}`);
     }
     const current = result.stages.find(({ id }) => id === result.currentStep.id);
-    if (current?.nextAction) console.log(`Next: ${current.nextAction.title} · ${current.nextAction.message}`);
+    if (current?.nextAction) printNextAction(current.nextAction);
     return;
   }
   if (flags.next) {
     console.log(`Current: Step ${result.currentStep.number}, ${result.currentStep.title}`);
     if (result.step?.nextAction) {
-      console.log(`Next: ${result.step.nextAction.title} · ${result.step.nextAction.message}`);
+      printNextAction(result.step.nextAction);
     }
     for (const command of result.step?.commands || []) console.log(`  ${command}`);
     return;
@@ -2020,7 +2056,8 @@ function printWorkflow(result) {
   console.log(`\n${result.counts.findings.ready || 0} ready findings, ${result.counts.workItems.overdue || 0} overdue Work Items`);
   if (result.recommended) {
     console.log(`Next: ${result.recommended.title}`);
-    if (result.recommended.message) console.log(`  ${result.recommended.message}`);
+    if (!result.recommended.nextSteps?.length && result.recommended.message) console.log(`  ${result.recommended.message}`);
+    printGuidanceSteps(result.recommended);
     const command = result.recommended.nextAction?.command || result.recommended.actions?.[0]?.command;
     if (command) console.log(`  ${command}`);
   }
@@ -2035,6 +2072,7 @@ function summarizeProgramReadiness(result) {
     status: item.status,
     title: item.title,
     ...(options.message === false ? {} : { message: item.message }),
+    ...(item.nextSteps?.length ? { nextSteps: item.nextSteps } : {}),
     ...(item.resourceType ? { resourceType: item.resourceType } : {}),
     ...(item.resourceId ? { resourceId: item.resourceId } : {})
   } : null;

package/src/index.js

@@ -104,6 +104,7 @@ export {
   buildAgentProgramPath,
   PROGRAM_PATH,
   RESOURCE_INSTRUCTIONS,
+  RESOURCE_OUTPUTS,
   RESOURCE_PAGE_SUMMARIES,
   resourceProgramContext
 } from "./program-path.js";

package/src/program-path.js

@@ -1,53 +1,103 @@
 import { ACTIVE_MODEL_VERSION, modelSupports } from "../model/index.js";
 
 export const RESOURCE_INSTRUCTIONS = {
-  program: "Define one management compliance or assurance Program with its goal, bounded Systems, selected Frameworks, Requirement applicability decisions, Controls, owners, risk method, and candidate period.",
-  person: "Record each person’s actual organizational job title. Keep named program authority, such as CISO, DPO, Policy Owner, or team chair, in dated Appointment records.",
-  appointment: "Record one person’s dated appointment to a named organizational or program responsibility. Scope it to the workspace, a team, or the records governed by that appointment.",
-  team: "Review the starter Security and Risk Oversight team, including its members and chair. Membership and chairs are authoritative on the Team record.",
-  system: "Start with the complete bounded System management governs or the auditor will examine. Record its purpose, services, boundary, exclusions, Information Types, owners, and any applicable continuity objectives.",
-  component: "Add a Component only when it materially delivers a selected System, supports a Control, produces authoritative Evidence, or supports relevant operations. Give every System use a role and rationale.",
-  vendor: "Catalog material external provider relationships. Link a supplied Component when it meets the Component inclusion rules, but do not mirror every Vendor into a Component.",
-  classification: "Review the starter information-handling categories and ordering against management's actual protection decisions, then use the approved Classifications on inventory and Evidence Artifacts.",
-  "information-type": "Define a stable category of information and its default Classification, then link it from Systems, Components, and Vendors.",
-  framework: "Confirm the criteria framework and version used for the program.",
-  requirement: "Keep the published criterion as catalog content. Record management applicability and rationale on the selected Program.",
-  commitment: "Record supplemental customer promises and service requirements that shape the scope or control design. The Commitment’s systemIds and controlIds are authoritative for what fulfills it.",
-  "requirement-mapping": "Use a Requirement Mapping when supplemental policies, contracts, privacy promises, frameworks, or other sources need explicit coverage semantics. Choose the comparison method and relationship, explain the rationale, and bind the review to every mapped source revision.",
-  "reporting-route-set": "Prepare the normal and fallback ways people will send each report required by proposed program content, including where each channel goes and the role that keeps it usable. Commit the proposal in Step 1, approve it before cutover, use separate approval and ongoing authority Appointments, and create a successor when either channel changes.",
-  policy: "Tailor each Policy to match what the company is committing to. Clear placeholders, assign an owner and separate approver, then bind approval to the reviewed content. Approval does not prove implementation. Activate the Policy during the Step 3 cutover after reviewing its implementation gaps.",
-  document: "Complete required program Documents in Step 2, assign an owner and separate approver, and bind approval to the intended values and exact Markdown. Implement the linked requirements and activate that approved revision in Step 3. Prepare Audit Documents in Step 5.",
-  control: "Finish each applicable starter Control with the procedure people follow, its owner, bounded System scope, operating Components, authoritative evidence-source Components, governing Policy and Requirement mappings, and implementation date. Put calendar and event schedules in Obligations.",
-  "complementary-control": "Review whether any in-scope Control depends on a customer or carved-out provider action. Record each real dependency, or confirm that the current scope has none.",
-  evidence: "Create an Evidence Artifact when a real export, report, screenshot, signed file, or approved external reference exists. Select its authoritative source Component, link the Controls and operating records it supports, retain the fixed artifact or reference, and have another person verify it before audit use.",
-  "risk-assessment": "Complete and approve an assessment of the risks to the in-scope service, systems, vendors, and commitments.",
-  risk: "Record each risk identified by an assessment or operating activity. Assign an owner, rate it, document the chosen response, and link the Controls that treat it from the Risk record.",
-  obligation: "Review the recurring work proposed by effective policies. Confirm who owns it, when it is due, and what proof completion requires.",
-  "retention-schedule-item": "Use one structured row for each reviewed retention rule. Name its Information Types, scope, cutoff, period, disposition, sources, owner, and approval. Keep unknown organization values planned for management review.",
-  "obligation-event": "When a policy-triggering event occurs, record it here and complete the actions filegrc creates for it.",
-  "policy-review": "Record scheduled and change-driven reviews of policies and governed documents, including the decision and any follow-up.",
-  meeting: "Record required oversight meetings, including attendees, decisions, minutes, and follow-up work.",
-  exception: "Record and approve any time-limited departure from a policy or control before the departure begins.",
-  asset: "Keep the inventory of important devices, software, media, and records current, including ownership, custody, and status.",
-  "vendor-review": "Document due diligence before relying on a provider, then repeat the review on schedule or after a material change.",
-  "access-grant": "Record each person’s or service account’s access to a Component, including approval, provisioning, changes, and removal.",
-  "access-review": "Review access on schedule, record each decision, and assign any access changes that result.",
-  "service-account": "Catalog non-human accounts that need separate tracking, including their owner, purpose, System, privilege, and expiry.",
-  training: "Review and approve the exact Training content in Step 2, then activate the unchanged revision during Step 3 after its linked Controls and assignment Obligations are ready.",
-  attestation: "Record each person’s completion or acknowledgement against the exact policy or training revision.",
-  "vulnerability-scan": "Record each required scan, including its scope, timing, result, and evidence.",
-  vulnerability: "Track confirmed weaknesses that need separate remediation, acceptance, or closure.",
-  "penetration-test": "Record each penetration test, including its provider, scope, period, result, and evidence.",
-  incident: "Record qualifying security or privacy events and manage their response and follow-up.",
-  "backup-test": "Record each restore test, including the Systems tested, result, timing, evidence, and follow-up.",
-  exercise: "Record each incident or continuity exercise, including its objective, participants, result, and follow-up.",
-  finding: "Create a Finding only for a confirmed gap that needs separate remediation tracking. Keep the report details in the source record’s Markdown, then assign the Finding, set its due date, and verify closure.",
-  "action-item": "Create an Action Item only when follow-up needs its own assignee, deadline, and completion proof. Point it to the record that created the work, then work it from Work Queue.",
-  audit: "Create this record after engaging the CPA firm, then select the Program and record the agreed scope, criteria, Systems, subservice treatments, and report period. Control Tests and Evidence Artifacts link back with auditId or auditIds.",
-  "audit-request": "When FileGRC is the approved request tracker, record each request from the audit team, assign an owner and due date, and link the approved response and evidence.",
-  "data-request": "Record privacy or contractual requests when they apply to the audit scope or the organization’s commitments.",
-  "control-test": "Record a management Control Test only when management performs and reviews one. The CPA firm records its own independent testing separately.",
-  "audit-population": "Record each complete Type 2 population with its source Component, fixed export, query, count, and reconciliation."
+  program: "Set the Program goal, owners, Systems, Frameworks, criteria decisions, and risk method.",
+  person: "Record the person’s actual job title and current status.",
+  appointment: "Assign a named authority to one Person with its start date and scope.",
+  team: "Confirm the Team’s members and chair.",
+  system: "Define the service boundary, exclusions, owners, and information it handles.",
+  component: "Record a material service or evidence source and its role in each linked System.",
+  vendor: "Record each material external provider and the Components it supplies.",
+  classification: "Confirm the handling categories and apply them to information and evidence.",
+  "information-type": "Name a stable category of information, set its default Classification, and link its uses.",
+  framework: "Select the criteria Framework and version used by the Program.",
+  requirement: "Review whether this criterion applies to the Program and record the decision and rationale.",
+  commitment: "Record a real customer or service promise and link the Systems and Controls that fulfill it.",
+  "requirement-mapping": "Compare the supplemental source with the Requirement or Control, record the relationship and rationale, then review the source revisions.",
+  "reporting-route-set": "Replace the reporting-route placeholders with real normal and fallback channels, name the responsible role, and commit the proposal.",
+  policy: "Replace Policy placeholders with actual commitments, then have a separate approver approve the exact Markdown revision.",
+  document: "Complete the Document Markdown and intended values, assign an owner, and have a separate approver approve the exact revision.",
+  control: "Open this Control’s current next steps. Set up the activity, record how it works, and mark it Implemented when it works.",
+  "complementary-control": "Record each real customer or carved-out provider dependency, or confirm that the current scope has none.",
+  evidence: "Record a real artifact or approved reference, link its source and supported work, then have another person verify it.",
+  "risk-assessment": "Assess the in-scope service, record conclusions, and obtain an independent review.",
+  risk: "Name the threat and impact, assign an owner, rate the risk, and record its response.",
+  obligation: "Confirm the owner, cadence or trigger, deadline, and proof, then enable the rule when its Control is ready.",
+  "retention-schedule-item": "Set the Information Types, scope, cutoff, period, disposition, and sources for one retention rule.",
+  "obligation-event": "Record the actual event date and subject, then complete its linked Work Queue actions.",
+  "policy-review": "Record the review date, reviewer, decision, and any required follow-up.",
+  meeting: "Record attendees, decisions, minutes, and assigned follow-up for the meeting.",
+  exception: "Record the scope, owner, approval, and expiry before the departure begins.",
+  asset: "Record an important Asset’s owner, custody, location, and status.",
+  "vendor-review": "Review one Vendor’s current risk and evidence, then record the decision and follow-up.",
+  "access-grant": "Record the approved privilege, recipient, Component, and provisioning or removal dates.",
+  "access-review": "Review the current access list, record each decision, and assign the required changes.",
+  "service-account": "Record a non-human account’s owner, purpose, System, privilege, and expiry.",
+  training: "Complete the content and audience, then have a separate approver approve the exact revision.",
+  attestation: "Record the person’s dated acknowledgement of the exact active content revision.",
+  "vulnerability-scan": "Record the scan scope, date, result, and supporting evidence.",
+  vulnerability: "Track a confirmed weakness through its owner, response, and closure proof.",
+  "penetration-test": "Record the test provider, scope, period, results, evidence, and follow-up.",
+  incident: "Record the event, response decisions, dates, evidence, and follow-up.",
+  "backup-test": "Record the restore target, date, result, evidence, and follow-up.",
+  exercise: "Record the scenario, participants, date, result, and follow-up.",
+  finding: "Record a confirmed gap that needs its own owner, due date, remediation, and verified closure.",
+  "action-item": "Assign separate follow-up with an owner, deadline, source record, and completion proof.",
+  audit: "After engaging the CPA firm, record the agreed type, scope, Systems, criteria, and period.",
+  "audit-request": "Record the auditor’s request, owner, due date, and approved response.",
+  "data-request": "Record the request scope, decision, response, and supporting evidence.",
+  "control-test": "Record a management test only when it was performed and reviewed; link its result and evidence.",
+  "audit-population": "Record the complete Type 2 population, source query, count, fixed export, and reconciliation."
+};
+
+export const RESOURCE_OUTPUTS = {
+  program: "A Program record with the selected goal, scope, owners, criteria decisions, and risk method.",
+  person: "A Person record with their actual job title and current status.",
+  appointment: "A dated Appointment that names the holder, authority, and scope.",
+  team: "A Team record with its current members and chair.",
+  system: "A bounded System record with its services, data, owners, and exclusions.",
+  component: "A Component record linked to each System it supports, with a role and rationale.",
+  vendor: "A Vendor record for each material provider relationship.",
+  classification: "Reviewed handling categories used by the program's records.",
+  "information-type": "An Information Type with its default Classification and actual uses.",
+  framework: "The Framework and version selected for the Program.",
+  requirement: "A reviewed applicability decision on the Program for each selected Requirement.",
+  commitment: "A Commitment linked to the Systems and Controls that fulfill it.",
+  "requirement-mapping": "A reviewed mapping with its comparison, rationale, and source revisions.",
+  "reporting-route-set": "A proposed set of normal and fallback reporting routes with an owner and approval path.",
+  policy: "An independently approved Policy bound to its exact Markdown revision.",
+  document: "A governed Document with reviewed Markdown, an owner, and a separate approver.",
+  control: "An implemented Control with its actual procedure, scope, owner, source, and start date.",
+  "complementary-control": "A recorded customer or provider dependency, or a current review confirming none.",
+  evidence: "A verified Evidence Artifact linked to its source and supported work.",
+  "risk-assessment": "A completed, independently reviewed Risk Assessment with its conclusions.",
+  risk: "A rated Risk with an owner, response, and linked treatment Controls.",
+  obligation: "An enabled schedule or event rule with an owner, deadline, and required proof.",
+  "retention-schedule-item": "A reviewed retention row with its scope, cutoff, period, disposition, and sources.",
+  "obligation-event": "A dated Policy Event with its linked Work Queue actions.",
+  "policy-review": "A dated review with its decision, reviewer, and follow-up.",
+  meeting: "Meeting minutes with attendees, decisions, and assigned follow-up.",
+  exception: "A time-limited Exception with approval, scope, and expiry.",
+  asset: "An inventory record with the Asset's owner, custody, and status.",
+  "vendor-review": "A dated Vendor Review with a decision, evidence, and follow-up.",
+  "access-grant": "A current Access Grant showing approval, privilege, and lifecycle dates.",
+  "access-review": "A dated Access Review with decisions and assigned changes.",
+  "service-account": "A Service Account record with its owner, purpose, privilege, and expiry.",
+  training: "Approved Training content bound to its exact revision.",
+  attestation: "A person's dated acknowledgement bound to the exact content revision.",
+  "vulnerability-scan": "A dated scan record with scope, results, and linked evidence.",
+  vulnerability: "A tracked weakness with its owner, response, and closure proof.",
+  "penetration-test": "A test record with scope, provider, results, and follow-up.",
+  incident: "An Incident record with response decisions, dates, evidence, and follow-up.",
+  "backup-test": "A dated restore test with its result, evidence, and follow-up.",
+  exercise: "A dated exercise with participants, result, and follow-up.",
+  finding: "A confirmed Finding with an owner, due date, remediation, and verified closure.",
+  "action-item": "An assigned Action Item with a deadline and completion proof.",
+  audit: "An Audit record with the CPA-agreed type, scope, and period.",
+  "audit-request": "An owned Audit Request with a due date and approved response.",
+  "data-request": "A Data Request record with its scope, decision, and response.",
+  "control-test": "A reviewed management Control Test with results and linked evidence.",
+  "audit-population": "A reconciled Type 2 population linked to its fixed source export."
 };
 
 export const RESOURCE_PAGE_SUMMARIES = {
@@ -68,7 +118,7 @@ export const RESOURCE_PAGE_SUMMARIES = {
   "retention-schedule-item": "Review each structured retention rule.",
   policy: "Tailor the starter Policy and have someone other than its owner approve it.",
   document: "Adapt and approve plans.",
-  control: "Describe each Control and its evidence source.",
+  control: "Put each Control in place and record how it works.",
   "complementary-control": "Record customer or provider responsibilities, or confirm there are none.",
   audit: "Record the CPA engagement and scope.",
   "audit-request": "Track fieldwork requests and responses.",
@@ -82,11 +132,11 @@ export const PROGRAM_PATH = [
     number: 1,
     title: "Define Scope",
     description: "Ownership, criteria, and service boundary",
-    summary: "Name the owners, criteria, service, Systems, and providers in scope.",
+    summary: "A reviewed Program scope with owners, criteria, Systems, and material providers.",
     sections: [
-      { id: "ownership", title: "Program Ownership", description: "Confirm who owns the program, plus the normal security reporting channel and its fallback.", steps: ["Confirm the initial program lead’s actual job title and the separate Policy Owner Appointment.", "Add the organization’s real appointments, reviewers, and operators.", "Review the starter Security and Risk Oversight team, its members, and its chair.", "Replace the starter reporting-channel placeholders, propose the set, and commit that proposal before Step 1 is complete. Approve it before the later implementation cutover.", "Add other teams only when the organization assigns shared responsibility to them."], types: ["person", "appointment", "team", "reporting-route-set"], defaultOpen: true },
-      { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Confirm the Program goal, owners, risk method, and candidate period.", "Review the included Security criteria references and record each applicability decision on the Program.", "Replace each planned service-commitment prompt with the actual promise or requirement. Use Requirement Mappings only when a supplemental source needs an explicit coverage comparison. Keep optional criteria out until the company chooses to add them."], types: ["program", "framework", "requirement", "commitment", "requirement-mapping"], defaultOpen: true },
-      { id: "boundary", title: "System Boundary", description: "Start with the bounded System. Add Components that materially deliver the service, support Controls, produce authoritative Evidence, or support relevant operations. Keep Vendor relationships and specific Assets separate.", steps: ["Create the complete bounded System and select it on the Program.", "Add only relevant Components, with a role and rationale for each System use.", "Create Vendors for material external provider relationships and link supplied Components when factual.", "Normalize Information Types and Classifications used by the System, Components, Vendors, Risks, and Evidence Artifacts."], types: ["system", "component", "vendor", "classification", "information-type"], defaultOpen: false }
+      { id: "ownership", title: "Program Ownership", description: "Confirm who owns the program, plus the normal security reporting channel and its fallback.", steps: ["Confirm the program lead, policy owner, independent reviewer, and oversight team.", "Replace the reporting-channel placeholders with real normal and fallback routes, then commit the proposal."], types: ["person", "appointment", "team", "reporting-route-set"], defaultOpen: true },
+      { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Set the Program goal, owners, risk method, and tentative timing.", "Review each selected criterion for this service and record its applicability decision.", "Replace the starter Commitment prompt with the real promise; add only needed supplemental mappings."], types: ["program", "framework", "requirement", "commitment", "requirement-mapping"], defaultOpen: true },
+      { id: "boundary", title: "System Boundary", description: "Start with the bounded System. Add Components that materially deliver the service, support Controls, produce authoritative Evidence, or support relevant operations. Keep Vendor relationships and specific Assets separate.", steps: ["Define the service and exclusions in a bounded System selected by the Program.", "Add material Components and Vendors with their actual System relationships.", "Record the Information Types and Classifications the service uses."], types: ["system", "component", "vendor", "classification", "information-type"], defaultOpen: false }
     ],
     resourceTypes: ["person", "appointment", "team", "reporting-route-set", "program", "framework", "requirement", "commitment", "requirement-mapping", "system", "component", "vendor", "classification", "information-type"],
     commands: [
@@ -108,10 +158,10 @@ export const PROGRAM_PATH = [
     number: 2,
     title: "Approve Policies",
     description: "Approve governed content and retention decisions",
-    summary: "Review and independently approve Policies, program Documents, Training content, and the Data Retention Schedule.",
+    summary: "Approved Policies, program Documents, Training content, and retention decisions.",
     sections: [
-      { id: "policy-content", title: "Policies", description: "Review every program Policy, Document, and Training record in one table, then bind independent approval to each exact revision.", steps: ["Review each governed Markdown artifact and replace every organization placeholder.", "Confirm the owner, separate approver, linked Controls, audience, and intended values that apply to each artifact.", "Record approval and its date against the exact revision. Leave approved content inactive until its Step 3 implementation cutover."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/policies" }], defaultOpen: true },
-      { id: "retention", title: "Data Retention Schedule", description: "Complete each row proposal, then approve the document and all proposed rows once.", steps: ["Review the schedule policy, legal holds, exceptions, and disposal requirements.", "Have the owner finish each row for the Information Types and operational sources the organization actually uses.", "Trigger one independent approval only after the document and every row proposal are complete."], types: [], utility: "retention-schedule", defaultOpen: true }
+      { id: "policy-content", title: "Policies", description: "Approve the program's governing content.", instructions: "Open each Policy, program Document, and Training record. Replace placeholders, confirm the owner and intended values, then have a separate person approve the exact Markdown revision.", output: "Approved content bound to the reviewed revisions.", steps: ["Replace placeholders with the company's real rules, plans, and training material.", "Confirm the owner, separate approver, linked Controls, audience, and intended values.", "Record the independent approval and date against each exact Markdown revision."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/policies" }], defaultOpen: true },
+      { id: "retention", title: "Data Retention Schedule", description: "Approve the schedule document and its completed rows together.", steps: ["Review the governing schedule and any legal hold or exception rules.", "Complete a row for each distinct information use, cutoff, retention period, and disposition.", "Have a separate reviewer approve the complete document and row set."], types: [], utility: "retention-schedule", defaultOpen: true }
     ],
     resourceTypes: [],
     supportingResourceTypes: ["policy", "document", "training", "retention-schedule-item"],
@@ -132,12 +182,12 @@ export const PROGRAM_PATH = [
     number: 3,
     title: "Implement Controls",
     description: "Implement and prepare to operate",
-    summary: "Implement Controls, configure their operating schedules and evidence sources, then activate the approved program.",
+    summary: "Implemented Controls with ready evidence sources and enabled work schedules.",
     sections: [
-      { id: "controls", title: "Controls", description: "Implement the selected Controls and connect their scope, procedures, mappings, and operation patterns.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components."], types: ["control"], defaultOpen: true },
-      { id: "complementary-controls", title: "Complementary Controls", description: "Record customer or provider responsibilities that form part of the implementation boundary, or confirm there are none.", steps: ["Review whether an in-scope Control depends on a customer or carved-out provider action."], types: ["complementary-control"], defaultOpen: true },
-      { id: "evidence-sources", title: "Evidence Sources", description: "Check that every Control points to an authoritative source that can produce its expected evidence.", steps: ["Confirm each source Component is active, has the right evidence-source role, names current access owners, and includes repeatable retrieval instructions."], types: [], utility: "evidence-sources", defaultOpen: true },
-      { id: "obligations", title: "Obligations", description: "Configure the calendar and event schedules that operate the Controls.", steps: ["Review and enable every required calendar and event schedule."], types: ["obligation"], defaultOpen: true }
+      { id: "controls", title: "Controls", description: "Put each selected Control into use and record what is actually in place.", steps: ["Open each Control for its specific setup action and current missing checks.", "Configure the activity and record its procedure, Systems, owner, and evidence sources.", "Mark it Implemented with its real start date after its sources and schedules are ready."], types: ["control"], defaultOpen: true },
+      { id: "complementary-controls", title: "Complementary Controls", description: "Record customer or provider responsibilities that form part of the implementation boundary, or confirm there are none.", steps: ["Identify any customer or carved-out provider action an in-scope Control depends on.", "Record each dependency, or confirm that the current scope has none."], types: ["complementary-control"], defaultOpen: true },
+      { id: "evidence-sources", title: "Evidence Sources", description: "Check that every Control points to an authoritative source that can produce its expected evidence.", steps: ["For each Control family, link an active Component with the required source kind, access owners, and retrieval instructions."], types: [], utility: "evidence-sources", defaultOpen: true },
+      { id: "obligations", title: "Obligations", description: "Configure the calendar and event schedules that operate the Controls.", steps: ["Check the owner, trigger or cadence, due window, and required proof for each Obligation.", "Enable the rules that will run the implemented Controls."], types: ["obligation"], defaultOpen: true }
     ],
     resourceTypes: ["control", "complementary-control", "obligation"],
     commands: [
@@ -160,17 +210,17 @@ export const PROGRAM_PATH = [
     number: 4,
     title: "Operate the Program",
     description: "Run the work and retain dated proof",
-    summary: "Complete scheduled and event work. Keep dated proof.",
+    summary: "Dated operating records and linked proof for work actually performed.",
     sections: [
-      { id: "risk", title: "Risk", description: "Maintain the program’s risk assessments and risk register as the service, threats, suppliers, and control needs change.", steps: ["Complete and approve risk assessments on schedule and after material changes.", "Record risks that need treatment, acceptance, or ongoing tracking.", "Add or update controls when the assessment identifies a new or changed response."], types: ["risk-assessment", "risk"], defaultOpen: true },
-      { id: "queue", title: "Work Queue", description: "Complete recurring occurrences, Policy Event tasks, and assigned follow-up within their required windows.", steps: ["Complete due work within its allowed window and link dated proof.", "Start Policy Events when hiring, departures, incidents, or material changes occur.", "Resolve every other open Action Item from the same queue."], types: ["obligation-event", "data-request"], utility: "obligation-board", defaultOpen: true },
-      { id: "evidence", title: "Evidence Artifacts", description: "Create records only for real exports, reports, screenshots, signed files, or approved external references collected during operation.", steps: ["Create an Evidence Artifact when the artifact exists or an operating record needs fixed supporting proof.", "Select the authoritative source Component, link the Controls and source operating record, and retain the fixed attachment or approved reference.", "Record the collector and Classification, then have another person verify the artifact before audit use."], types: ["evidence"], defaultOpen: true },
-      { id: "governance", title: "Governance", description: "Record formal reviews, oversight meetings, and approved policy or control exceptions.", steps: ["Complete scheduled policy reviews and oversight meetings.", "Record decisions, attendees, follow-up work, and evidence.", "Approve time-bound exceptions before the departure begins."], types: ["policy-review", "meeting", "exception"], defaultOpen: false },
-      { id: "inventories", title: "Assets and Vendors", description: "Maintain the asset inventory and recurring reviews of supplier relationships during operation.", steps: ["Keep ownership, custody, status, and lifecycle current for important assets.", "Perform vendor reviews on schedule and after material supplier changes.", "Link fixed reports and review evidence to the operating records."], types: ["asset", "vendor-review"], defaultOpen: false },
-      { id: "access-training", title: "Access and Training Completion", description: "Inventory service accounts and retain access decisions, Training assignments, and acknowledgements produced during operation.", steps: ["Catalog service accounts that need separate tracking.", "Preserve access approvals and removals as they occur, then complete periodic access reviews and resolve exceptions.", "Retain each Training assignment and Attestation against the exact active content revision."], types: ["service-account", "access-grant", "access-review", "attestation"], defaultOpen: false },
-      { id: "security", title: "Security Operations", description: "Record vulnerability work, applicable penetration testing, and incident response activity for the period.", steps: ["Retain scan scope, results, vulnerabilities, remediation, and exceptions.", "When the approved applicability review requires penetration testing, record the test and follow-up findings.", "Start the incident workflow when a qualifying event occurs."], types: ["vulnerability-scan", "vulnerability", "penetration-test", "incident"], defaultOpen: false },
-      { id: "resilience", title: "Resilience", description: "Preserve proof that backups, restoration, continuity, and incident exercises work as designed.", steps: ["Record backup restoration tests and their results.", "Run continuity and incident exercises on schedule.", "Assign and close follow-up work from failed objectives or lessons learned."], types: ["backup-test", "exercise"], defaultOpen: false },
-      { id: "issues", title: "Issues and Remediation", description: "Keep observations in the source report and track only confirmed gaps that need a separate remediation lifecycle.", steps: ["Create a Finding only when a confirmed gap needs its own owner, due date, status, or verified closure.", "Use the Finding itself for straightforward remediation; create Action Items only for separate assigned tasks.", "Work Action Items from Work Queue and close the Finding only after remediation is independently verified."], types: ["finding"], defaultOpen: false }
+      { id: "risk", title: "Risk", description: "Maintain the program’s risk assessments and risk register as the service, threats, suppliers, and control needs change.", steps: ["Complete and approve the required Risk Assessments.", "Record each risk that needs a response, owner, and treatment Controls."], types: ["risk-assessment", "risk"], defaultOpen: true },
+      { id: "queue", title: "Work Queue", description: "Complete recurring occurrences, Policy Event tasks, and assigned follow-up within their required windows.", steps: ["Complete due Work Queue occurrences with dated proof.", "Trigger a Policy Event when its real-world event occurs, then complete the linked Action Items."], types: ["obligation-event", "data-request"], utility: "obligation-board", defaultOpen: true },
+      { id: "evidence", title: "Evidence Artifacts", description: "Create records only for real exports, reports, screenshots, signed files, or approved external references collected during operation.", steps: ["Create an Evidence Artifact only when a real file or approved external reference exists.", "Link its source Component, supported Controls and work record, and fixed artifact or reference.", "Record the collector and Classification, then verify the artifact."], types: ["evidence"], defaultOpen: true },
+      { id: "governance", title: "Governance", description: "Record formal reviews, oversight meetings, and approved policy or control exceptions.", steps: ["Complete scheduled policy reviews and oversight meetings with decisions and evidence.", "Create separate Action Items only for follow-up with its own owner and deadline.", "Approve any time-limited Exception before the departure begins."], types: ["policy-review", "meeting", "exception"], defaultOpen: false },
+      { id: "inventories", title: "Assets and Vendors", description: "Maintain the asset inventory and recurring reviews of supplier relationships during operation.", steps: ["Keep important Assets and Vendor relationships current.", "Complete Vendor Reviews on schedule or after material changes, with a decision and evidence."], types: ["asset", "vendor-review"], defaultOpen: false },
+      { id: "access-training", title: "Access and Training Completion", description: "Inventory service accounts and retain access decisions, Training assignments, and acknowledgements produced during operation.", steps: ["Catalog Service Accounts that need separate tracking.", "Record access decisions and removals as they occur; complete scheduled Access Reviews.", "Keep Training assignments and Attestations tied to the exact active content revision."], types: ["service-account", "access-grant", "access-review", "attestation"], defaultOpen: false },
+      { id: "security", title: "Security Operations", description: "Record vulnerability work, applicable penetration testing, and incident response activity for the period.", steps: ["Record required scans and tests with their real scope, results, and evidence.", "Track confirmed weaknesses and their remediation.", "Start the Incident workflow when a qualifying event occurs."], types: ["vulnerability-scan", "vulnerability", "penetration-test", "incident"], defaultOpen: false },
+      { id: "resilience", title: "Resilience", description: "Preserve proof that backups, restoration, continuity, and incident exercises work as designed.", steps: ["Run scheduled restore tests and continuity or incident exercises.", "Record the result and evidence, then assign follow-up for failed objectives."], types: ["backup-test", "exercise"], defaultOpen: false },
+      { id: "issues", title: "Issues and Remediation", description: "Keep observations in the source report and track only confirmed gaps that need a separate remediation lifecycle.", steps: ["Create a Finding for a confirmed gap that needs a separate owner, deadline, or closure review.", "Use Action Items only for separately assigned tasks.", "Close the Finding after remediation is independently verified."], types: ["finding"], defaultOpen: false }
     ],
     resourceTypes: [
       "risk-assessment",
@@ -238,10 +288,10 @@ export const PROGRAM_PATH = [
     number: 5,
     title: "Audit",
     description: "Firm, formal period, fieldwork, and report",
-    summary: "Track the CPA engagement, fieldwork, and evidence packet.",
+    summary: "A CPA engagement record and a reviewable, period-bound evidence packet.",
     sections: [
-      { id: "engagement", title: "Engagement", description: "Record the actual CPA engagement, formal scope and dates, requests, and management responses.", steps: ["Create the Audit after the CPA firm is engaged.", "Record the firm-agreed type, scope, systems, criteria, and dates.", "Track incoming requests and approved response material."], types: ["audit", "audit-request"], defaultOpen: true },
-      { id: "fieldwork", title: "Fieldwork", description: "Prepare Audit Documents, reconcile Type 2 populations, review both evidence paths, support testing, and build the indexed packet.", steps: ["Initialize and complete engagement-specific management Documents and populations.", "Approve and activate each Audit Document only when its engagement facts and timing are final.", "Review dated FileGRC operating records and verified Evidence Artifacts for the formal period.", "Reconcile complete populations, link samples, and resolve fieldwork requests and Findings.", "Build the packet from a clean Git revision; it includes FileGRC records, Markdown, Evidence Artifacts, attachments, indexes, history, and checksums."], types: ["audit-population", "control-test"], relatedLinks: [{ type: "document", label: "Audit Documents", href: "#/resources/document?stage=audit&documentScope=audit" }], utility: "audit-packet", defaultOpen: true }
+      { id: "engagement", title: "Engagement", description: "Record the actual CPA engagement, formal scope and dates, requests, and management responses.", steps: ["After engaging the CPA firm, create the Audit with its agreed type, scope, and date or period.", "Track firm requests with owners, due dates, and approved responses."], types: ["audit", "audit-request"], defaultOpen: true },
+      { id: "fieldwork", title: "Fieldwork", description: "Complete engagement documents, populations, requests, and the evidence packet.", steps: ["Complete engagement Documents and, for Type 2, reconcile each population to its fixed export.", "Review dated operating records and verified Evidence Artifacts for the agreed period; link samples and answer requests.", "Build and review the indexed packet from a clean Git revision."], types: ["audit-population", "control-test"], relatedLinks: [{ type: "document", label: "Audit Documents", href: "#/resources/document?stage=audit&documentScope=audit", summary: "Complete and approve engagement Documents, then link the required ones from each Audit.", instructions: "Complete each required engagement Document, link it from its Audit, obtain separate approval of the exact Markdown revision, then activate that approved revision for that Audit.", output: "Active Audit Documents linked to their Audits and bound to their approved revisions." }], utility: "audit-packet", defaultOpen: true }
     ],
     resourceTypes: ["audit", "audit-request", "audit-population", "control-test"],
     utilities: [
@@ -257,9 +307,12 @@ export const PROGRAM_PATH = [
     ],
     commands: [
       "filegrc guide audit --json",
+      "filegrc guide document --json",
+      "filegrc list document --json",
       "filegrc scaffold audit --title \"YEAR SOC 2 TYPE\"",
       "filegrc create AUDIT-MUTATION.json --json",
       "filegrc prepare-audit AUDIT_ID --json",
+      "filegrc activate-documents --scaffold --audit AUDIT_ID",
       "filegrc audit-readiness AUDIT_ID --json",
       "filegrc evidence-packet --audit AUDIT_ID --preview --json"
     ]
@@ -321,14 +374,27 @@ export function buildAgentProgramPath(model) {
         title: definition.pluralTitle,
         summary: RESOURCE_PAGE_SUMMARIES[type] || definition.description,
         instructions: RESOURCE_INSTRUCTIONS[type] || definition.description,
+        output: RESOURCE_OUTPUTS[type] || `A validated ${definition.title} record.`,
         use: definition.description,
         policyBasis: definition.guidance.policyBasis,
         guide: `npx filegrc guide ${type} --json`,
         list: `npx filegrc list ${type} --json`
       };
     });
+    const relatedPages = stage.sections.flatMap((section) => section.relatedLinks || [])
+      .filter((link) => link.instructions)
+      .map((link, index) => ({
+        order: `${stage.number}.${String.fromCharCode(97 + stage.resourceTypes.length + index)}`,
+        type: link.type,
+        title: link.label,
+        summary: link.summary,
+        instructions: link.instructions,
+        output: link.output,
+        guide: `npx filegrc program-path --json`,
+        list: `npx filegrc list ${link.type} --json`
+      }));
     const utilityPages = (stage.utilities || []).map((utility, index) => ({
-      order: stage.id === "run" ? null : `${stage.number}.${String.fromCharCode(97 + stage.resourceTypes.length + index)}`,
+      order: stage.id === "run" ? null : `${stage.number}.${String.fromCharCode(97 + stage.resourceTypes.length + relatedPages.length + index)}`,
       utility: utility.id,
       title: utility.title,
       summary: utility.summary,
@@ -340,7 +406,7 @@ export function buildAgentProgramPath(model) {
     return {
       ...stage,
       commands: stage.commands.map(agentCommand),
-      pages: stage.id === "run" ? utilityPages : [...resourcePages, ...utilityPages],
+      pages: stage.id === "run" ? utilityPages : [...resourcePages, ...relatedPages, ...utilityPages],
       ...(stage.id === "run" ? { operatingRecords: resourcePages } : {})
     };
   });

package/src/program-readiness.js

@@ -1508,10 +1508,12 @@ function legacyPolicyLibraryProposals(records) {
 
 async function controlsStage(scope, byId, readMarkdown, asOf, model) {
   const items = [];
+  const families = selectedControlFamilies(scope.controls, model);
   if (!scope.controls.length) {
     items.push(item("control-scope", "action", "Select the program controls", "No controls are selected for the management program.", { type: "control" }));
   }
   for (const control of scope.controls) {
+    const controlFamilies = families.filter((family) => family.controls.some(({ id }) => id === control.id));
     const source = await readMarkdown(control);
     const sourceSystems = (
       modelSupports(model, "component-sources")
@@ -1523,6 +1525,18 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model) {
       && record.status !== "retired"
       && (record.controlIds || []).includes(control.id)
     ));
+    const sourceDetails = await Promise.all(sourceSystems.map(async (sourceRecord) => ({
+      record: sourceRecord,
+      instructions: await readMarkdown(sourceRecord)
+    })));
+    const missingSourceFamilies = controlFamilies.filter((family) => !sourceDetails.some(({ record, instructions }) => (
+      record.status === "active"
+      && (record.evidenceSourceKinds || []).length > 0
+      && (!family.sourceKinds.length || family.sourceKinds.some((kind) => (record.evidenceSourceKinds || []).includes(kind)))
+      && (record.evidenceOwnerIds || []).length > 0
+      && substantiveMarkdown(instructions)
+      && openPlaceholderCount(instructions) === 0
+    )));
     const checks = {
       ...(model.resources.control?.fields?.applicabilityReview ? {
         applicability: control.applicabilityReview?.decision === "applicable"
@@ -1534,6 +1548,9 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model) {
       scope: (control.systemIds || []).some((id) => scope.systems.some((system) => system.id === id)),
       operationPattern: Boolean(control.operationPattern),
       evidenceSource: sourceSystems.length > 0,
+      ...(modelSupports(model, "component-sources") ? {
+        evidenceSourceReady: missingSourceFamilies.length === 0
+      } : {}),
       implementationDate: Boolean(control.effectiveOn && control.effectiveOn <= asOf),
       ...(model.resources.control?.fields?.procedureRevision ? {
         procedureRevision: Boolean(control.procedureRevision),
@@ -1547,25 +1564,21 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model) {
       } : {})
     };
     const missing = Object.entries(checks).filter(([, value]) => !value).map(([name]) => controlCheckLabel(name));
+    const nextSteps = controlImplementationSteps(control, checks, {
+      missingSourceFamilies
+    });
     items.push(item(
       `control-${control.id}`,
       missing.length ? "action" : "complete",
       `${control.code ? `${control.code}: ` : ""}${control.title}`,
       missing.length
-        ? `Complete ${missing.length} ${missing.length === 1 ? "check" : "checks"} before implementation: ${missing.join(", ")}.`
+        ? nextSteps[0] || `Complete the remaining Control checks: ${missing.join(", ")}.`
         : `Implemented ${control.effectiveOn}; owned, scoped, scheduled, documented, mapped, and tied to ${sourceSystems.length} authoritative ${sourceSystems.length === 1 ? "source" : "sources"}.`,
       control,
       {
         checks,
-        commands: [
-          ...(Object.hasOwn(checks, "applicability") && !checks.applicability ? [
-            "npx filegrc review-applicability --scaffold --type control > control-decisions.json",
-            "npx filegrc review-applicability control-decisions.json --preview --json",
-            "npx filegrc review-applicability control-decisions.json --yes --json"
-          ] : []),
-          "npx filegrc evidence-map --json",
-          `npx filegrc get ${shellArgument(control.id)} --mutation`
-        ],
+        nextSteps,
+        commands: [`npx filegrc get ${shellArgument(control.id)} --mutation`],
         workQueue: queueSchedules.length ? {
           enabled: queueSchedules.filter(obligationIsEnabled).length,
           running: queueSchedules.filter((obligation) => obligationIsRunning(obligation, byId, asOf, model)).length,
@@ -1574,7 +1587,7 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model) {
       }
     ));
   }
-  return stage("controls", "Implement Controls", "Each implemented Control needs an owner, actual procedure, scope, operation pattern, evidence source, mappings, an implementation date, and any required Obligations enabled. Scheduled work stays dormant until its governing Policy, program Documents, and Training are active and effective.", items);
+  return stage("controls", "Implement Controls", "Put each selected Control in place, record how it works, and mark it Implemented when it is working.", items);
 }
 
 async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
@@ -1930,6 +1943,7 @@ function controlCheckLabel(name) {
     scope: "in-scope systems",
     operationPattern: "operation pattern",
     evidenceSource: "authoritative evidence source",
+    evidenceSourceReady: "usable evidence source",
     implementationDate: "implementation date",
     procedureRevision: "effective procedure revision",
     procedureEffective: "procedure effective date",
@@ -1939,6 +1953,76 @@ function controlCheckLabel(name) {
   })[name] || name;
 }
 
+const starterControlSetup = {
+  "control-security-governance": "Name a reviewer outside day-to-day security ownership and set up a quarterly security review.",
+  "control-policy-management": "Assign someone to maintain the Control list and a separate approver for policies and plans. Set up their review path.",
+  "control-security-communication": "Set up how the approved reporting routes, policy changes, and security notices reach staff and outside parties.",
+  "control-workforce-expectations": "Set up the checks, agreements, and policy acknowledgements required before someone receives sensitive access.",
+  "control-security-training": "Choose how new and existing workers receive security training, acknowledge the current material, and get reminders.",
+  "control-risk-assessment": "Use the Program's risk method to assess the scoped service and record the results in FileGRC Risk Assessments and Risks.",
+  "control-monitoring-remediation": "Define how Control problems are reported, reviewed, and verified closed. Use FileGRC Findings for gaps that need separate follow-up.",
+  "control-access-authorization": "Configure unique, least-privilege accounts in the identity system. Restrict account changes to authorized admins.",
+  "control-strong-authentication": "Turn on required MFA and secure sign-in settings for the in-scope Systems. Identify any gap that needs an approved Exception.",
+  "control-access-review-offboarding": "Confirm the identity system can produce a complete access list and admins can promptly remove or change permissions.",
+  "control-physical-workspace-security": "Decide how visitors, work areas, devices, and paper records are protected in the places your team actually works.",
+  "control-data-classification-inventory": "Apply the approved Classifications to important data in the in-scope Systems and record its location in the inventory.",
+  "control-encryption-transmission": "Configure encryption for in-scope data and devices, and assign who manages keys and approved transfer methods.",
+  "control-data-retention-disposal": "Apply the approved retention schedule to live, backup, and vendor-held data. Define how each class is deleted or destroyed.",
+  "control-inventory-configuration": "List important assets and owners, choose their secure settings, and decide how unsupported assets are handled.",
+  "control-endpoint-protection": "Apply the required device settings, updates, encryption, screen lock, and malware protection to devices that access company Systems.",
+  "control-network-security": "Restrict production network paths and remote access, and document the rules that allow traffic between environments.",
+  "control-change-management": "Set up a change path with risk review, testing, approval, deployment, and rollback for software and infrastructure changes.",
+  "control-vulnerability-management": "Choose what will be scanned, how often, who handles findings, and the target times for fixing them.",
+  "control-penetration-testing": "Decide whether independent testing is needed for this service. If it is, set its scope, cadence, and owner.",
+  "control-logging-monitoring": "Enable useful security logs and alerts for important Systems, protect them, and choose who responds to alerts.",
+  "control-incident-response": "Set up a way to report, assign, escalate, contain, and close security incidents using the approved response plan.",
+  "control-incident-exercise": "Choose a realistic incident scenario and an alert path to test, and assign the people who will run the exercise.",
+  "control-backup-restoration": "Choose what needs backup or another recovery path, configure it, and decide how restores will be tested.",
+  "control-continuity-exercise": "Set recovery priorities, contacts, and responsibilities, and choose how the continuity plan will be exercised.",
+  "control-vendor-due-diligence": "Set a security review and contract check before a new Vendor gets sensitive data or becomes a material dependency.",
+  "control-vendor-monitoring": "Choose which Vendors need ongoing review, who reviews them, and what information the review uses.",
+  "control-security-exceptions": "Document how an Exception is reviewed and approved before a departure from policy begins. Record actual decisions in FileGRC Exceptions."
+};
+
+export function controlImplementationSteps(control, checks, options = {}) {
+  const steps = [];
+  if (!checks.implemented) steps.push(starterControlSetup[control.id]
+    || `Set up this Control: ${control.activity || control.statement}`);
+  const record = [];
+  if (!checks.owner) record.push("choose an owner");
+  if (!checks.scope) record.push("select the Systems this covers");
+  if (!checks.operationPattern) record.push("set when it runs");
+  if (!checks.procedure) record.push("write who does what and when in Procedure");
+  if (!checks.evidenceSource) record.push("link the tool or system that can show it happened");
+  if (!checks.policyMapping && checks.policyMapping !== undefined) record.push("link the Policy it implements");
+  if (!checks.criteriaMapping && checks.criteriaMapping !== undefined) record.push("link the criteria it covers");
+  if (checks.implemented && !checks.implementationDate) record.push("enter the date it started working");
+  if (checks.implemented && (checks.procedureRevision === false || checks.procedureEffective === false)) {
+    record.push("record the Procedure revision and effective date");
+  }
+  if (record.length) steps.push(`In this Control, ${record.join("; ")}.`);
+  const sourceFamilies = options.missingSourceFamilies || [];
+  const sourceTargets = sourceFamilies.map((family) => `${family.title}${family.sourceKinds?.length ? ` (${family.sourceKinds.join(" or ")})` : ""}`);
+  const sourceStep = checks.evidenceSourceReady === false
+    ? `Cover the missing evidence families: ${sourceTargets.length ? sourceTargets.join(" and ") : "this Control"}. For each, link an active Component with the matching kind, evidence owners, and report retrieval instructions.`
+    : null;
+  const queueStep = checks.workQueue === false
+    ? "Enable a linked Obligation with the owner and schedule for this Control's recurring or event work."
+    : null;
+  if (!checks.implemented) {
+    if (sourceStep || queueStep) steps.push([sourceStep, queueStep].filter(Boolean).join(" "));
+    else if (checks.applicability === false) steps.push("Confirm this Control applies to the current Program scope with `review-applicability --scaffold --type control`.");
+    else steps.push(checks.procedureRevision === undefined
+      ? "When it works, mark this Control Implemented and enter its start date."
+      : "When it works, mark this Control Implemented. Enter its start date and the Procedure revision and effective date.");
+  } else {
+    if (sourceStep) steps.push(sourceStep);
+    if (queueStep) steps.push(queueStep);
+    if (checks.applicability === false) steps.push("Confirm this Control applies to the current Program scope with `review-applicability --scaffold --type control`.");
+  }
+  return steps;
+}
+
 function assuranceGoalLabel(goal) {
   if (goal === "soc-2-type-1") return "SOC 2 Type 1";
   if (goal === "soc-2-type-2") return "SOC 2 Type 2";

package/src/state.js

@@ -277,6 +277,7 @@ async function createAppStateUnlocked(input, options) {
     (audits.length ? audits : [null]).map(async (audit) => {
       const preparation = await assessAuditPreparation(loaded, {
         auditId: audit?.id,
+        programId: activeProgram.id,
         asOf,
         generatedAt,
         ...(audit ? {} : { programReadiness })

package/src/web.js

@@ -10,7 +10,7 @@ import {
   utcCalendarDate,
   validCalendarRecurrence
 } from "./recurrence.js";
-import { PROGRAM_PATH, programPathForModel, RESOURCE_INSTRUCTIONS, RESOURCE_PAGE_SUMMARIES } from "./program-path.js";
+import { PROGRAM_PATH, programPathForModel, RESOURCE_INSTRUCTIONS, RESOURCE_OUTPUTS, RESOURCE_PAGE_SUMMARIES } from "./program-path.js";
 import { formatCalendarDate, formatLocalDateTime } from "./time.js";
 
 export function dashboardProgramReadiness(programReadiness = {}) {
@@ -96,6 +96,7 @@ let READINESS_STAGES = SHARED_PROGRAM_STAGES.map((stage) => ({
   number: String(stage.number)
 }));
 const RESOURCE_GUIDE_INSTRUCTIONS = ${JSON.stringify(RESOURCE_INSTRUCTIONS)};
+const RESOURCE_GUIDE_OUTPUTS = ${JSON.stringify(RESOURCE_OUTPUTS)};
 const dashboardProgramReadiness = ${dashboardProgramReadiness.toString()};
 const workflowHrefBelongsToPage = ${workflowHrefBelongsToPage.toString()};
 const pageActionIdentity = ${pageActionIdentity.toString()};
@@ -246,6 +247,7 @@ function normalizeAppState(next) {
 function blockingStateSections(route) {
   if (route.name === "home") return ["program", "obligations", "workflow"];
   if (route.name === "repository") return ["repository"];
+  if (route.name === "list" && route.type === "control") return ["program"];
   if (route.name === "list" && route.type === "obligation") return ["obligations"];
   if (route.name === "obligations" || route.name === "stage" && route.stageId === "run") return ["program", "obligations"];
   if (route.name === "audit-packet") return ["repository", "program", "obligations", "audits"];
@@ -613,7 +615,7 @@ function renderStageOverview(main, stageId, params = new URLSearchParams()) {
   const progress = stageProgress(stage);
   main.innerHTML = '<div class="page stage-overview-page"><nav class="breadcrumbs"><a href="#/">Overview</a><span>/</span><span>' + esc(stage.title) + '</span></nav>' +
     '<section class="stage-overview-hero"><div><p class="kicker">Step ' + esc(stage.number) + ' of 5</p><h2>' + esc(stage.title) + '</h2><p>' + esc(stage.summary) + '</p></div>' + stageProgressCard(progress) + '</section>' +
-    renderStagePageIndex(stage) + (stage.id === "controls" ? renderFinishStepThree() : "") + (stage.id === "audit" ? renderAuditDocumentActivationAssessments() : "") + '</div>';
+    renderStageInstructions(stage) + renderStagePageIndex(stage) + (stage.id === "controls" ? renderFinishStepThree() : "") + (stage.id === "audit" ? renderAuditDocumentActivationAssessments() : "") + '</div>';
   main.querySelector("[data-show-evidence-families]")?.addEventListener("click", (event) => {
     main.querySelectorAll("[data-evidence-family-extra]").forEach((card) => { card.hidden = false; });
     event.currentTarget.remove();
@@ -634,7 +636,8 @@ function renderPoliciesPage(main, params = new URLSearchParams()) {
 }
 
 function policyContentGuide() {
-  return '<section class="page-guide resource-guide-popover" id="resource-guide" role="dialog" aria-label="How to use Policies" hidden><div><span>Instructions</span><p>Open each Policy, program Document, and Training record. Replace starter placeholders, review its Markdown, and confirm its owner, separate approver, relationships, and intended values.</p></div><div><span>Approval</span><p>Bind approval to the exact Markdown revision. Keep approved content inactive until Step 3 confirms implementation and records the activation cutover.</p></div><div><span>Included here</span><p>Use this page for governed program content. The Data Retention Schedule has its own Step 2 page because its document and structured rows are approved together.</p></div></section>';
+  const section = READINESS_STAGES.find(({ id }) => id === "policies")?.sections.find(({ id }) => id === "policy-content");
+  return '<section class="page-guide resource-guide-popover" id="resource-guide" role="dialog" aria-label="How to use Policies" hidden><div><span>Do now</span><p>' + esc(section?.instructions || "Review and approve the program's governing content.") + '</p></div><div><span>Output</span><p>' + esc(section?.output || "Approved content bound to the reviewed revisions.") + '</p></div></section>';
 }
 
 function renderRetentionSchedulePage(main, params = new URLSearchParams()) {
@@ -846,7 +849,7 @@ function renderPolicyApprovalGuidance() {
       : "";
     return '<article><strong>' + esc(proposal.title) + '</strong><p>' + esc(proposal.message) + '</p>' + review + '<div class="evidence-map-references">' + proposal.policyIds.map((id) => formatReference(id)).join("") + '</div></article>';
   }).join("");
-  return '<section class="policy-lifecycle-note panel ' + (proposalRows ? "" : "single") + '"><div><p class="kicker">Step 2 approval</p><h3>Approve the governed content</h3><p>Approval means your company reviewed and accepted the requirements and intended values in each Policy, program Document, and Training record. It does not mean the linked Controls are implemented yet.</p><p>Bind each approval to the exact Markdown revision here. Implement Controls and configure Obligations in Step 3, then activate each unchanged approved revision at implementation cutover.</p></div>' + (proposalRows ? '<div class="policy-library-proposals">' + proposalRows + '</div>' : "") + '</section>';
+  return '<section class="policy-lifecycle-note panel ' + (proposalRows ? "" : "single") + '"><div><p class="kicker">Step 2 approval</p><h3>Approve the governed content</h3><p>Replace placeholders and confirm the intended values. Have a separate approver review the exact Markdown revision and record the approval date.</p></div>' + (proposalRows ? '<div class="policy-library-proposals">' + proposalRows + '</div>' : "") + '</section>';
 }
 
 function renderPoliciesTable(params = new URLSearchParams()) {
@@ -963,7 +966,8 @@ function renderDocumentActivationAssessments() {
 }
 
 function renderAuditDocumentActivationAssessments() {
-  const audits = resourcesOfType("audit").map(({ record }) => record);
+  const audits = resourcesOfType("audit").map(({ record }) => record)
+    .filter((record) => !state.selectedProgramId || record.programId === state.selectedProgramId);
   const audit = selectDefaultAudit(audits, state.programReadiness?.asOf || currentDate());
   const preparation = audit ? state.auditPreparations?.[audit.id] : null;
   const assessments = preparation?.documentActivations || [];
@@ -1182,7 +1186,10 @@ function workflowGuidance(options = {}) {
   const visible = items.slice(0, 6);
   const renderRow = (item) => {
     const href = workflowItemHref(item);
-    const body = '<span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(item.message || workflowItemDetail(item)) + '</small></span>';
+    const guidance = options.type === "control" && item.nextSteps?.length
+      ? '<ol class="control-next-steps">' + item.nextSteps.map((step) => '<li>' + esc(step) + '</li>').join("") + '</ol>'
+      : '<small>' + esc(item.message || workflowItemDetail(item)) + '</small>';
+    const body = '<span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong>' + guidance + '</span>';
     return href ? '<a href="' + href + '">' + body + '</a>' : '<div>' + body + '</div>';
   };
   const rows = visible.map(renderRow).join("");
@@ -1750,6 +1757,12 @@ function renderStagePageIndex(stage) {
   return '<section class="stage-pages" aria-label="Step ' + esc(stage.number) + ' pages"><div class="stage-page-grid">' + cards + '</div></section>';
 }
 
+function renderStageInstructions(stage) {
+  return '<details class="stage-instructions"><summary>How to complete Step ' + esc(stage.number) + '</summary><div class="stage-instructions-body">' + stage.sections.map((section) => (
+    '<section><h3>' + esc(section.title) + '</h3><ol>' + section.steps.map((step) => '<li>' + esc(step) + '</li>').join("") + '</ol></section>'
+  )).join("") + '</div></details>';
+}
+
 function stagePageDestinations(stage) {
   return stage.sections.flatMap((section) => sectionDestinations(section)
     .filter((destination) => destination.utility !== "obligation-board")
@@ -1820,7 +1833,7 @@ function derivedStagePageState(stage, destination) {
   if (
     stage.id === "audit"
     && state.workflow?.assessments?.auditReadiness?.status === "not-started"
-    && (destination.type === "audit" || destination.utility === "audit-packet")
+    && (destination.type === "audit" || destination.type === "document" && destination.href.includes("documentScope=audit") || destination.utility === "audit-packet")
   ) {
     return { complete: false, label: "No engagement" };
   }
@@ -1855,6 +1868,11 @@ function derivedStagePageState(stage, destination) {
       ? { complete: true, label: "Reviewed" }
       : { complete: false, label: "Review scope" };
   }
+  if (stage.id === "audit" && destination.type === "document" && destination.href.includes("documentScope=audit")) {
+    if (!resourcesOfType("document").some(({ record }) => auditSpecificDocument(record))) {
+      return { complete: false, countsTowardProgress: false, label: "Only if needed" };
+    }
+  }
   if (destination.type && resourcesOfType(destination.type).length === 0) {
     return { complete: false, countsTowardProgress: false, label: "Only if needed" };
   }
@@ -2005,7 +2023,7 @@ function sectionDestinations(section) {
     destinations.push({ type, kind: "Record page", label: titleCase(definition.pluralTitle), href: "#/resources/" + encodeURIComponent(type), description: definition.description });
   }
   for (const link of section.relatedLinks || []) {
-    destinations.push({ type: link.type, kind: "Record page", label: link.label, href: link.href, description: section.description });
+    destinations.push({ type: link.type, kind: "Record page", label: link.label, href: link.href, description: link.summary || section.description });
   }
   if (section.utility === "obligation-board") destinations.push({ utility: section.utility, kind: "Working page", label: "Work Queue", href: "#/stage/run", description: "Complete recurring work, Policy Event tasks, and assigned follow-up with its due windows and linked proof." });
   if (section.utility === "evidence-sources") destinations.push({ utility: section.utility, kind: "Coverage page", label: "Evidence Sources", href: "#/evidence-sources", description: section.description });
@@ -2083,6 +2101,7 @@ function renderObligations(main, params = new URLSearchParams()) {
     : "";
   main.innerHTML = '<div class="page obligation-board-page stage-overview-page"><nav class="breadcrumbs"><a href="#/">Overview</a><span>/</span><span>' + esc(stage.title) + '</span></nav>' +
     '<section class="stage-overview-hero"><div><p class="kicker">Step ' + esc(stage.number) + ' of 5</p><h2>' + esc(stage.title) + '</h2><p>' + esc(stage.summary) + '</p></div>' + stageProgressCard(stageProgress(stage)) + '</section>' +
+    renderStageInstructions(stage) +
     feedback +
     operationGate +
     activeOperation +
@@ -2744,6 +2763,13 @@ function openNextAuditCycleDialog(prior) {
   });
 }
 
+function controlApplicabilityPending(record) {
+  if (!record.applicabilityReview) return true;
+  const item = state.programReadiness?.stages?.find(({ id }) => id === "controls")?.items
+    .find(({ resourceType, resourceId }) => resourceType === "control" && resourceId === record.id);
+  return item?.checks?.applicability === false;
+}
+
 function openApplicabilityReviewDialog(type, entries) {
   const definition = state.model.resources[type];
   const reviewPoints = definition?.guidance?.reviewPoints || [];
@@ -2752,8 +2778,9 @@ function openApplicabilityReviewDialog(type, entries) {
   const pending = entries.filter(({ record }) => (
     type === "requirement" && modelSupports("program-scope")
       ? !reviewedRequirements.has(record.id)
-      : !record.applicabilityReview
-    || type === "requirement" && record.applicability === "undetermined"
+      : type === "control"
+        ? controlApplicabilityPending(record)
+        : !record.applicabilityReview || type === "requirement" && record.applicability === "undetermined"
   ));
   const dialog = document.createElement("dialog");
   dialog.className = "commit-dialog applicability-dialog";
@@ -3102,7 +3129,9 @@ function renderList(main, type, params = new URLSearchParams()) {
   const hasPendingApplicability = entries.some(({ record }) => (
     type === "requirement" && modelSupports("program-scope")
       ? !reviewedRequirements.has(record.id)
-      : !record.applicabilityReview || type === "requirement" && record.applicability === "undetermined"
+      : type === "control"
+        ? controlApplicabilityPending(record)
+        : !record.applicabilityReview || type === "requirement" && record.applicability === "undetermined"
   ));
   const applicabilityButton = !state.readOnly
     && ["requirement", "control", "commitment", "complementary-control"].includes(type)
@@ -3112,8 +3141,11 @@ function renderList(main, type, params = new URLSearchParams()) {
   const guideTrigger = '<button class="guide-trigger" id="resource-guide-trigger" type="button" aria-label="About ' + esc(definition.pluralTitle) + '" aria-haspopup="dialog" aria-controls="resource-guide" aria-expanded="false"><svg viewBox="0 0 20 20" aria-hidden="true"><circle cx="10" cy="10" r="8"></circle><path d="M7.8 7.5a2.4 2.4 0 1 1 3.25 2.25c-.7.31-1.05.72-1.05 1.5v.25M10 14.5v.1"></path></svg></button>';
   const listTools = '<div class="list-tools list-header-tools"><label><span class="sr-only">Filter list</span><input id="list-search" type="search" placeholder="Filter ' + esc(definition.pluralTitle.toLowerCase()) + '"></label>' +
     filters.map(({ name, label, values }) => '<select class="field-filter" data-field="' + esc(name) + '" aria-label="Filter by ' + esc(label.toLowerCase()) + '"><option value="">Any ' + esc(properCase(label)) + '</option>' + values.map((value) => '<option value="' + esc(value) + '">' + esc(filterOptionLabel(value)) + '</option>').join("") + '</select>').join("") + '<span id="result-count" aria-live="polite">' + entries.length + ' records</span>' + applicabilityButton + createButton + '</div>';
-  const pageSummary = STAGE_PAGE_SUMMARIES[type] || definition.description;
-  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">' + esc(listStage?.title || groupTitle(definition.group)) + '</p><div class="page-title-line"><h2>' + esc(titleCase(listTitle)) + '</h2>' + guideTrigger + '</div><p>' + esc(pageSummary) + '</p></div>' + listTools + '</div>' + resourceGuide(type) +
+  const relatedGuidance = type === "document" && documentScope === "audit"
+    ? listStage?.sections.flatMap((section) => section.relatedLinks || []).find((link) => link.type === "document" && link.instructions)
+    : null;
+  const pageSummary = relatedGuidance?.summary || STAGE_PAGE_SUMMARIES[type] || definition.description;
+  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">' + esc(listStage?.title || groupTitle(definition.group)) + '</p><div class="page-title-line"><h2>' + esc(titleCase(listTitle)) + '</h2>' + guideTrigger + '</div><p>' + esc(pageSummary) + '</p></div>' + listTools + '</div>' + resourceGuide(type, relatedGuidance) +
     collectionReviewPanel(type) +
     '<section class="record-table-wrap"><table class="record-table"><thead><tr><th>' + esc(fieldLabel(type, "title")) + '</th>' + fields.map((name) => '<th>' + esc(fieldLabel(type, name)) + '</th>').join("") + '<th>Next action</th><th>Git file</th></tr></thead><tbody id="record-rows"></tbody></table></section>' +
     '<nav class="pagination list-pagination" aria-label="' + esc(definition.pluralTitle) + ' pages" hidden><button class="button" type="button" data-page="previous">Previous</button><span class="page-status" aria-live="polite"></span><button class="button" type="button" data-page="next">Next</button></nav></div>';
@@ -3316,7 +3348,7 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
   });
   const mayDelete = !state.readOnly && !routeSetLocked && !definition.singleton;
   const recordMenu = '<details class="record-overflow"><summary aria-label="More record actions" title="More record actions"><svg viewBox="0 0 18 4" aria-hidden="true"><circle cx="2" cy="2" r="2"></circle><circle cx="9" cy="2" r="2"></circle><circle cx="16" cy="2" r="2"></circle></svg></summary><div class="record-overflow-menu" aria-label="Record actions"><button type="button" data-record-modal="info">Record info</button><button type="button" data-record-modal="connections">Connections</button><button type="button" data-record-modal="history"' + (entry.historyLoaded === false ? ' disabled' : '') + '>File history' + (entry.historyLoaded === false ? ' (loading)' : '') + '</button>' + (mayDelete ? '<div class="record-overflow-separator"></div><button class="danger-text" type="button" data-delete-resource>Delete record</button>' : '') + '</div></details>';
-  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="' + collectionHref + '">' + esc(collectionLabel) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + reportingRouteSetActions + auditCycleAction + auditPopulationCorrectionAction + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + governanceActions + lifecycleActions + issueActions + addRecordContentAction + (!state.readOnly && !routeSetLocked ? '<button class="button" id="edit-resource">Edit</button>' : "") + recordMenu + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + '">' + detailMain + supportPanels + '</div></div>';
+  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="' + collectionHref + '">' + esc(collectionLabel) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + reportingRouteSetActions + auditCycleAction + auditPopulationCorrectionAction + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + governanceActions + lifecycleActions + issueActions + addRecordContentAction + (!state.readOnly && !routeSetLocked ? '<button class="button" id="edit-resource">Edit</button>' : "") + recordMenu + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + (type === "control" ? " detail-control" : "") + '">' + detailMain + supportPanels + '</div></div>';
   main.querySelectorAll("[data-completion-requirements]").forEach((button) => button.addEventListener("click", () => openCompletionRequirementsDialog(button.dataset.completionRequirements)));
   main.querySelector("#edit-resource")?.addEventListener("click", () => openEditor(type, entry));
   main.querySelectorAll("[data-record-modal]").forEach((button) => button.addEventListener("click", () => {
@@ -4251,11 +4283,11 @@ function zonedTimestampFromLocal(value, timezone) {
   return value + offset;
 }
 
-function resourceGuide(type) {
+function resourceGuide(type, pageGuidance = null) {
   const definition = state.model.resources[type];
   const guidance = definition?.guidance;
   if (!definition || !guidance) return "";
-  const instructions = RESOURCE_GUIDE_INSTRUCTIONS[type] || definition.description;
+  const instructions = pageGuidance?.instructions || RESOURCE_GUIDE_INSTRUCTIONS[type] || definition.description;
   const sources = (guidance.sourceResourceIds || [])
     .map((id) => state.resources.find(({ record }) => record.id === id))
     .filter(Boolean);
@@ -4266,7 +4298,8 @@ function resourceGuide(type) {
   const reviewGuide = reviewPoints.length
     ? '<div class="guide-review"><span>When reviewing</span><ul>' + reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></div>'
     : "";
-  return '<section class="page-guide resource-guide-popover" id="resource-guide" role="dialog" aria-label="How to use ' + esc(definition.pluralTitle) + '" hidden><div><span>Instructions</span><p>' + esc(instructions) + '</p></div><div><span>Use</span><p>' + esc(definition.description) + '</p></div><div><span>Policy basis</span><p>' + esc(guidance.policyBasis) + '</p>' + sourceLinks + '</div>' + reviewGuide + '</section>';
+  const output = pageGuidance?.output || RESOURCE_GUIDE_OUTPUTS[type] || 'A validated ' + definition.title + ' record.';
+  return '<section class="page-guide resource-guide-popover" id="resource-guide" role="dialog" aria-label="How to use ' + esc(definition.pluralTitle) + '" hidden><div><span>Do now</span><p>' + esc(instructions) + '</p></div><div><span>Output</span><p>' + esc(output) + '</p></div><div><span>Policy basis</span><p>' + esc(guidance.policyBasis) + '</p>' + sourceLinks + '</div>' + reviewGuide + '</section>';
 }
 
 function setupResourceGuide(main) {
@@ -6486,6 +6519,7 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .brand{flex:0 0 auto;margin-bottom:18px}.sidebar-nav{--nav-control-width:14px;flex:1;min-height:0;overflow-x:hidden;overflow-y:auto;overscroll-behavior:contain;padding-right:1px}.nav-home{margin-bottom:10px}.nav-stage>.nav-heading{display:grid;grid-template-columns:24px minmax(0,1fr) var(--nav-control-width);gap:6px;align-items:center;padding:7px 6px;border-radius:7px;color:#d5d9ed;text-align:left;text-transform:none;letter-spacing:0}.nav-stage>.nav-heading:hover{background:rgba(255,255,255,.08);color:#fff}.nav-stage-number{display:grid;place-items:center;width:22px;height:22px;border:1px solid rgba(255,255,255,.26);border-radius:50%;font-size:9.6px}.nav-stage-copy,.nav-stage-copy strong,.nav-stage-copy small{display:block;min-width:0}.nav-stage-copy strong{font-size:12px;line-height:1.25}.nav-stage-copy small{margin-top:2px;color:#aeb6d8;font-size:9.6px;line-height:1.25;font-weight:500}.nav-stage>.nav-items{margin:2px 0 8px 17px;padding:1px 0 5px 12px;border-left:1px solid rgba(255,255,255,.14)}.nav-subgroup>.nav-subheading,.nav-subgroup>.nav-items a{width:100%;display:grid;grid-template-columns:minmax(0,1fr) var(--nav-control-width);gap:6px;align-items:center;padding-right:6px}.nav-subgroup>.nav-subheading{border:0;background:none;padding-top:7px;padding-bottom:4px;padding-left:7px;color:#919bc4;text-align:left;text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780;cursor:pointer}.nav-control,.nav-control-slot{justify-self:end;width:var(--nav-control-width);text-align:right}.nav-subgroup>.nav-items{padding:1px 0 4px 3px}.nav-subgroup>.nav-items a{padding-top:6px;padding-bottom:6px;padding-left:8px;font-size:13.2px}.nav-group.open>.nav-heading>.chevron:before,.nav-group.open>.nav-subheading>.chevron:before{transform:rotate(45deg)}.nav-stage.open>.nav-items>.nav-subgroup:not(.open)>.nav-items{display:none}.sidebar-footer{flex:0 0 auto;margin:10px -18px -18px;padding:10px 18px 14px;background:#000024;border-top:1px solid rgba(255,255,255,.14)}.organization-nav{display:grid;grid-template-columns:32px minmax(0,1fr) 12px;gap:9px;align-items:center;padding:8px;border-radius:8px;color:#eef1ff;text-decoration:none}.organization-nav:hover,.organization-nav.current{background:rgba(255,255,255,.11)}.organization-mark{display:grid;place-items:center;width:32px;height:32px;border:1px solid rgba(255,255,255,.25);border-radius:50%;background:rgba(255,255,255,.08);font-size:13.2px;font-weight:800}.organization-nav strong,.organization-nav small{display:block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.organization-nav strong{font-size:12px}.organization-nav small{margin-top:2px;color:#aeb6d8;font-size:9.6px}.organization-arrow{color:#aeb6d8;font-size:19.2px}.organization-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:14px}.organization-links{display:grid}.organization-links a{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:12px 0;border-top:1px solid var(--line);text-decoration:none}.organization-links a:first-child{padding-top:0;border-top:0}.organization-links strong,.organization-links small{display:block}.organization-links strong{font-size:13.2px}.organization-links small{margin-top:3px;color:var(--muted);font-size:10.8px;line-height:1.4}.organization-links b{color:var(--accent);font-size:13.2px}.organization-links a:hover strong{color:var(--accent)}
 .nav-stage>.nav-items>a.nav-direct{display:grid;grid-template-columns:minmax(0,1fr) var(--nav-control-width);gap:6px;align-items:center;width:100%;padding:6px 6px 6px 7px;font-size:13.2px}
 .nav-heading-row{display:grid;grid-template-columns:minmax(0,1fr) 24px;gap:2px;align-items:stretch}.nav-heading-row>.nav-heading{display:grid;grid-template-columns:24px minmax(0,1fr);gap:6px;align-items:center;width:100%;padding:7px 6px;border-radius:7px;color:#d5d9ed;text-align:left;text-transform:none;letter-spacing:0;text-decoration:none}.nav-heading-row>.nav-heading:hover,.nav-heading-row>.nav-heading.current{background:rgba(255,255,255,.1);color:#fff}.nav-toggle{display:grid;place-items:center;width:24px;height:auto;min-height:100%;padding:0;border:0;border-radius:6px;background:none;color:#aeb6d8;cursor:pointer}.nav-toggle:hover{background:rgba(255,255,255,.1);color:#fff}.nav-chevron{display:block;width:12px;height:12px;place-self:center;fill:none;stroke:currentColor;stroke-width:1.5;stroke-linecap:round;stroke-linejoin:round;transition:transform .15s}.nav-subheading-row{display:grid;grid-template-columns:minmax(0,1fr) 22px;gap:2px;align-items:center;width:100%;padding:0;border:0;border-radius:6px;background:none;color:#919bc4;cursor:pointer}.nav-subheading-row:hover{background:rgba(255,255,255,.1);color:#fff}.nav-subheading-row>.nav-subheading{display:flex;align-items:center;min-width:0;padding:7px;color:inherit;text-align:left;text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780}.nav-group.open>.nav-heading-row .nav-chevron,.nav-group.open>.nav-subheading-row .nav-chevron{transform:rotate(90deg)}
+.stage-instructions{margin-top:14px;padding:0 18px;background:var(--panel);border:1px solid var(--line);border-radius:10px}.stage-instructions>summary{padding:14px 0;cursor:pointer;font-size:12px;font-weight:700}.stage-instructions-body{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:18px;padding:2px 0 18px}.stage-instructions h3{margin:0 0 7px;font-size:12px}.stage-instructions ol{margin:0;padding-left:20px}.stage-instructions li{margin:0 0 6px;color:var(--muted);font-size:11px;line-height:1.5}
 .stage-overview-hero{display:grid;grid-template-columns:minmax(0,1fr) 300px;gap:28px;align-items:center;padding:26px 28px;background:var(--panel);border:1px solid var(--line);border-radius:12px;box-shadow:var(--shadow)}.stage-overview-hero h2,.group-overview-head h2{font:500 37.2px Georgia,serif;margin:7px 0}.stage-overview-hero>div>p:not(.kicker),.group-overview-head>div>p:not(.kicker){max-width:760px;color:var(--muted);font-size:14.4px;line-height:1.55;margin:0}.stage-progress-card{padding:15px 17px;background:var(--paper);border:1px solid var(--line);border-radius:9px}.stage-progress-card>div:first-child{display:flex;align-items:center;justify-content:space-between;margin-bottom:11px}.stage-progress-card>div:first-child>strong{font:500 33.6px Georgia,serif}.stage-progress-card p{color:var(--muted);font-size:10.8px;line-height:1.45;margin:9px 0 0}.badge.neutral{background:#e5e8f2;color:#555e73}.stage-overview-layout{display:grid;grid-template-columns:320px minmax(0,1fr);gap:15px;margin-top:15px;align-items:start}.stage-plan ol,.group-plan ol{display:grid;gap:12px;padding-left:20px;margin:0}.stage-plan li,.group-plan li{padding-left:4px;color:var(--ink);font-size:13.2px;line-height:1.5}.stage-groups{min-width:0}.stage-groups>.section-head{margin:4px 0 13px}.stage-group-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.stage-group-card{position:relative;display:block;min-height:138px;padding:18px 38px 17px 18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;text-decoration:none;box-shadow:0 2px 8px rgba(21,40,33,.025)}.stage-group-card:hover{border-color:var(--accent-light)}.stage-group-card h3{font-size:15.6px;margin:0 0 7px}.stage-group-card p{color:var(--muted);font-size:12px;line-height:1.5;margin:0}.stage-group-card small{display:block;color:var(--accent);font-size:9.6px;font-weight:700;margin-top:12px}.stage-group-arrow{position:absolute;right:16px;top:16px;color:var(--accent);font-size:24px}.group-overview-head{display:flex;justify-content:space-between;align-items:end;gap:25px;margin-bottom:15px}.stage-status-link{display:grid;grid-template-columns:auto auto;align-items:center;gap:4px 12px;min-width:155px;padding:12px 14px;background:var(--panel);border:1px solid var(--line);border-radius:9px;text-decoration:none}.stage-status-link>strong{font:500 28.8px Georgia,serif;text-align:right}.stage-status-link>small{grid-column:1/-1;color:var(--muted);font-size:9.6px;text-align:right}.relationship-note{display:grid;grid-template-columns:250px minmax(0,1fr);gap:20px;align-items:center;margin-bottom:15px;padding:17px 20px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:10px}.relationship-note h3{font-size:15.6px;margin:5px 0 0}.relationship-note>p{color:var(--muted);font-size:12px;line-height:1.55;margin:0}.relationship-note code{font-size:10.8px}.group-plan{margin-bottom:24px}.group-related-links{display:flex;align-items:center;gap:8px;margin-top:18px;padding-top:14px;border-top:1px solid var(--line)}.group-related-links>span{color:var(--muted);font-size:10.8px;margin-right:auto}.group-destinations>.section-head{margin-bottom:12px}.group-destination-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:11px}.group-destination-card{display:grid;grid-template-columns:minmax(0,1fr) 100px;gap:16px;min-height:150px;padding:18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;text-decoration:none;box-shadow:0 2px 8px rgba(21,40,33,.025)}.group-destination-card:hover{border-color:var(--accent-light)}.group-destination-card h3{font-size:15.6px;margin:5px 0 7px}.group-destination-card p:not(.kicker){color:var(--muted);font-size:10.8px;line-height:1.5;margin:0}.destination-rollup{align-self:center;text-align:right}.destination-rollup strong,.destination-rollup small{display:block}.destination-rollup strong{font:500 32.4px Georgia,serif}.destination-rollup small{color:var(--muted);font-size:9.6px;line-height:1.35;margin-top:3px}
 .collection-review-panel{margin:16px 0 22px}.collection-review-panel.required{border-color:#d8bd78}.collection-review-panel.current{border-color:#b9dac6}.collection-review-head{display:flex;align-items:flex-start;justify-content:space-between;gap:24px}.collection-review-head h3{margin:4px 0 6px}.collection-review-head p:not(.kicker){max-width:900px;margin:0;color:var(--muted);font-size:11px;line-height:1.5}.collection-review-panel details{margin-top:13px;padding:10px 12px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft)}.collection-review-panel summary{cursor:pointer;font-size:11px;font-weight:750}.collection-review-panel ul,.collection-review-checks ul{margin:9px 0 0;padding-left:20px;color:var(--muted);font-size:10.4px;line-height:1.55}.collection-review-foot{display:flex;align-items:center;justify-content:space-between;gap:20px;margin-top:13px}.collection-review-result{display:flex;align-items:baseline;gap:8px;margin:0}.collection-review-result strong{font-size:11px}.collection-review-result span{color:var(--muted);font-size:10.4px}.collection-review-checks{margin:13px 0;padding:11px 13px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft)}.collection-review-checks>strong{font-size:11px}.event-dialog-steps.collection-review-checks{margin:15px 0 0;padding:10px;border:0}.collection-review-dialog textarea{box-sizing:border-box;width:100%;resize:vertical}.review-save-status{margin-right:auto;color:var(--muted);font-size:11px}.resource-review-criteria{margin:16px 0 22px;padding:13px 15px;border:1px solid var(--line);border-radius:8px;background:var(--panel)}.resource-review-criteria>strong{font-size:11px}.resource-review-criteria ul{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:5px 28px;margin:9px 0 0;padding-left:20px;color:var(--muted);font-size:10.4px;line-height:1.5}.commit-dialog .resource-review-criteria{margin:12px 0;background:var(--surface-soft)}.record-workflow-action{display:grid;grid-template-columns:auto minmax(140px,1fr);gap:7px;align-items:start;min-width:240px;text-decoration:none}.record-workflow-action strong,.record-workflow-action small{display:block}.record-workflow-action strong{font-size:10.4px}.record-workflow-action small{margin-top:2px;color:var(--muted);font-size:9.2px;line-height:1.35}.record-workflow-clear{color:var(--muted);font-size:10px;white-space:nowrap}.workflow-guidance{margin:16px 0 22px}.workflow-guidance .panel-head{align-items:flex-start;margin-bottom:12px}.workflow-guidance .panel-head h3{margin:4px 0}.workflow-guidance .panel-head p:not(.kicker){margin:4px 0 0;color:var(--muted);font-size:11px}.workflow-findings{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:7px}.workflow-findings>a,.workflow-findings>div{display:grid;grid-template-columns:auto minmax(0,1fr);gap:9px;align-items:start;padding:10px 11px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft);text-decoration:none}.workflow-findings strong,.workflow-findings small{display:block}.workflow-findings strong{font-size:11px}.workflow-findings small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.4}.workflow-finding-status{min-width:62px;padding:3px 5px;border-radius:99px;background:var(--accent-soft);color:var(--accent);font-size:8.4px;font-weight:750;text-align:center;text-transform:uppercase;letter-spacing:.04em}.workflow-finding-status.overdue,.workflow-finding-status.blocked{background:#f5ded9;color:#8d352c}.workflow-finding-status.ready,.workflow-finding-status.due,.workflow-finding-status.open{background:#f7e9cf;color:#855717}.workflow-finding-status.complete{background:#ddefe5;color:#176143}.workflow-guidance-more{margin:10px 0 0;color:var(--muted);font-size:9.6px}.workflow-guidance-more>summary{cursor:pointer;font-weight:750}.workflow-findings-more{margin-top:9px}.workflow-guidance-more>p{margin:8px 0 0}.context-workflow{display:flex;align-items:center;justify-content:space-between;gap:24px;margin:-8px 0 18px;padding:17px 19px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:10px}.context-workflow h3{font-size:16px;margin:4px 0 5px}.context-workflow p:not(.kicker){color:var(--muted);font-size:12px;line-height:1.5;margin:0;max-width:850px}.context-workflow .button{white-space:nowrap}.policy-lifecycle-note{display:grid;grid-template-columns:minmax(0,1.5fr) minmax(260px,1fr);gap:24px;margin-top:18px}.policy-lifecycle-note h3{margin:5px 0 8px}.policy-lifecycle-note p:not(.kicker),.policy-library-proposals p{color:var(--muted);font-size:11px;line-height:1.55}.policy-library-proposals{display:grid;gap:8px}.policy-library-proposals article{padding:11px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.policy-library-proposals p{margin:5px 0 8px}.policy-activation{display:grid;gap:12px;margin-top:22px}.policy-activation-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.policy-activation-card{padding:17px 18px;border:1px solid #d8bd78;border-radius:10px;background:var(--panel)}.policy-activation-card.active-and-operating{border-color:#b9dac6}.policy-activation-card h3{margin:7px 0 0}.policy-activation-gaps{display:grid;gap:9px;margin-top:13px}.policy-activation-gaps>div{padding-top:8px;border-top:1px solid var(--line)}.policy-activation-gaps small{display:block;margin-bottom:6px;color:var(--muted);font-size:9.6px;font-weight:700;text-transform:uppercase;letter-spacing:.05em}.policy-activation-warning{margin:11px 0 0;padding:9px 10px;border-radius:7px;background:#f7e9cf;color:#6d4917;font-size:10.4px;line-height:1.45}.evidence-map{display:grid;gap:12px;margin-top:18px}.evidence-map-head{display:flex;align-items:center;justify-content:space-between;gap:24px;padding:20px 22px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:11px}.evidence-map-head>div:first-child{max-width:760px}.evidence-map-head h2{font:500 24px Georgia,serif;margin:5px 0 7px}.evidence-map-head p:not(.kicker){color:var(--muted);font-size:12px;line-height:1.55;margin:0}.evidence-map-actions{display:flex;gap:8px}.evidence-map-card{padding:18px 20px;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.evidence-map-card.complete{border-color:#b9dac6}.evidence-map-card-head{display:flex;align-items:start;justify-content:space-between;gap:20px}.evidence-map-card-head h3{font-size:16px;margin:7px 0 0}.evidence-map-card-head>small{color:var(--muted);font-size:10px;text-align:right}.evidence-map-card>p{color:var(--muted);font-size:12px;line-height:1.55;margin:12px 0}.evidence-map-expectation{display:grid;grid-template-columns:120px minmax(0,1fr);gap:12px;padding:8px 0;border-top:1px solid var(--line);font-size:11px;line-height:1.5}.evidence-map-expectation strong{color:var(--muted);font-size:9.6px;text-transform:uppercase;letter-spacing:.06em}.evidence-map-expectation code{background:var(--paper);border-radius:4px;padding:2px 5px}.evidence-map-links{display:grid;grid-template-columns:minmax(220px,1fr) minmax(280px,1.2fr);gap:20px;margin-top:13px;padding-top:13px;border-top:1px solid var(--line)}.evidence-map-links>div>small{display:block;color:var(--muted);font-size:9.6px;font-weight:700;text-transform:uppercase;letter-spacing:.06em;margin-bottom:7px}.evidence-map-references,.evidence-map-sources{display:flex;flex-wrap:wrap;gap:5px}.evidence-map-source{display:flex;align-items:center;gap:7px;padding:7px 9px;background:var(--paper);border:1px solid var(--line);border-radius:7px;font-size:11px;text-decoration:none}.evidence-map-source.complete{border-color:#b9dac6;background:#edf7f1}.evidence-map-source small{color:var(--muted);font-size:9px}.evidence-map-status{padding:9px 11px;background:var(--paper);border-radius:7px}.evidence-map-empty{padding:24px;background:var(--panel);border:1px solid var(--line);border-radius:10px}.evidence-map-empty h3{margin:6px 0}.evidence-map-empty p:not(.kicker){color:var(--muted);font-size:12px;margin:0 0 14px}.stage-pages{margin-top:24px}.stage-page-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.stage-page-card{position:relative;display:flex;flex-direction:column;min-width:0;padding:18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025);transition:border-color .15s,box-shadow .15s}.stage-page-card:hover{border-color:var(--accent-light);box-shadow:0 5px 16px rgba(21,40,33,.07)}.stage-page-card.complete{border-color:#b9dac6}.stage-page-card-head{display:flex;align-items:center;justify-content:space-between;gap:18px}.stage-page-card-head h3{font-size:15.6px;line-height:1.35;margin:4px 0 0}.stage-page-card-head>div>small{display:block;color:var(--accent);font-size:9.6px;font-weight:700}.stage-page-card>p{color:var(--muted);font-size:12px;line-height:1.5;margin:13px 0 0}.stage-page-tasks{position:relative;z-index:2;display:grid;gap:6px;margin-top:13px}.stage-page-tasks>a{display:grid;grid-template-columns:auto minmax(0,1fr);gap:8px;align-items:start;padding:9px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft);text-decoration:none}.stage-page-tasks>a:hover{border-color:var(--accent-light)}.stage-page-tasks strong,.stage-page-tasks small{display:block}.stage-page-tasks strong{font-size:10.8px}.stage-page-tasks small{margin-top:2px;color:var(--muted);font-size:9.4px;line-height:1.35}.stage-page-tasks-more{color:var(--muted);font-size:9.4px}.stage-page-rollup{display:flex;flex:0 0 104px;flex-direction:column;justify-content:center;text-align:right}.stage-page-rollup strong,.stage-page-rollup small{display:block}.stage-page-rollup strong{font:500 24px Georgia,serif}.stage-page-rollup small{color:var(--muted);font-size:9.6px;line-height:1.35;margin-top:2px}.stage-page-card-foot{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-top:auto;padding-top:15px}.stage-page-completion-state{color:var(--muted);font-size:10.8px}.stage-page-completion-state.complete{color:#176143;font-weight:700}.stage-page-open{color:var(--accent);font-size:12px;font-weight:700}.work-queue-section{margin-top:28px}.work-queue-section>.section-head{align-items:end}
 .stage-page-card-actions{display:flex;align-items:center;gap:10px}.stage-page-card-actions .stage-page-open{white-space:nowrap}.stage-page-open::after{content:"";position:absolute;inset:0;z-index:1;border-radius:10px}.stage-page-open:focus-visible::after{outline:2px solid var(--focus);outline-offset:2px}.stage-page-open>span{position:relative;z-index:2}
@@ -6669,6 +6703,7 @@ dialog::backdrop{background:rgba(0,0,24,.62)}
 @media(max-width:760px){.record-table td:has(.relation){min-width:0}.record-table td[data-label]>.relation{grid-column:2}}
 @media(max-width:760px){.diagnostics>div{grid-template-columns:max-content minmax(0,1fr)}}
 .workflow-guidance .workflow-status{margin:4px 0 12px;color:var(--muted);font-size:10px}.workflow-completion-requirements{display:inline;appearance:none;-webkit-appearance:none;white-space:nowrap;padding:0;border:0;background:none;color:var(--accent);font:inherit;font-weight:750;cursor:pointer;text-decoration:underline;text-underline-offset:2px}.workflow-completion-requirements:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.completion-requirements-dialog ul{margin:14px 0 0;padding-left:20px;color:var(--muted);font-size:12px;line-height:1.55}
+.control-next-steps{margin:8px 0 9px;padding-left:18px;font-size:12px;line-height:1.5}.control-next-steps li+li{margin-top:7px}.detail-control aside .detail-workflow-panel{max-height:none;overflow:visible}
 .record-completion-state{background:var(--surface-soft)}.record-completion-state h3{margin:4px 0 5px;font-size:16.8px}.record-completion-state p:last-child{margin:0;color:var(--muted);font-size:11px;line-height:1.45}
 `;
 

package/src/workflow.js

@@ -1128,6 +1128,7 @@ function normalizeFinding(code, item, context) {
     severity: findingSeverity(state, context.assessment),
     title: item.title,
     message: item.message,
+    ...(item.nextSteps?.length ? { nextSteps: item.nextSteps } : {}),
     ...(item.resourceId ? { resourceId: item.resourceId } : {}),
     ...(item.createResourceType ? { createResourceType: item.createResourceType } : {}),
     ...(item.sourceResourceIds ? { sourceResourceIds: item.sourceResourceIds } : {}),