filegrc 0.16.7 → 0.16.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.7",
+  "version": "0.16.9",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/applicability-scope.js

@@ -21,7 +21,7 @@ const unorderedStringArrayFields = new Set([
   "tags"
 ]);
 
-export function applicabilityScopeRevision(record, program, resources, model) {
+export function applicabilityScopeRevision(record, program, resources, model, options = {}) {
   const selectedSystemIds = new Set(program?.systemIds || []);
   const selectedFrameworkIds = new Set(program?.frameworkIds || []);
   const selectedControlIds = new Set(program?.controlIds || []);
@@ -117,19 +117,19 @@ export function applicabilityScopeRevision(record, program, resources, model) {
     policies: resources
       .filter(({ type, id }) => type === "policy" && selectedPolicyIds.has(id))
       .sort(compareRecordIds)
-      .map((policy) => pick(policy, [
-        "id",
-        "status",
-        "policyKind",
-        "version",
-        "programRole",
-        "effectiveOn",
-        "requirementIds",
-        "audience",
-        "acknowledgementRequired",
-        "relatedDocumentIds",
-        "approvedContentRevisions"
-      ], model)),
+      .map((policy) => options.legacyPolicyStatus
+        ? pick({
+            ...policy,
+            status: options.legacyPolicyStatus === "approved" && ["in-review", "active"].includes(policy.status)
+              ? "approved" : policy.status,
+            effectiveOn: options.legacyPolicyStatus === "approved" && policy.status === "active"
+              ? undefined : policy.effectiveOn
+          }, [
+            "id", "status", "policyKind", "version", "programRole", "effectiveOn",
+            "requirementIds", "audience", "acknowledgementRequired",
+            "relatedDocumentIds", "approvedContentRevisions"
+          ], model)
+        : pick(policy, ["id", "requirementIds"], model)),
     requirements: resources
       .filter(({ type, frameworkId }) => type === "requirement" && selectedFrameworkIds.has(frameworkId))
       .sort(compareRecordIds)
@@ -165,14 +165,14 @@ export function applicabilityReviewIsCurrent(review, record, program, resources,
     && !review.scopeRevision.startsWith("filegrc:applicability-scope:")
     && Number(model?.modelVersion || 0) < 7
   ) return true;
-  return Boolean(
-    review?.scopeRevision
-    && revisionsMatch(
-      "applicability-scope",
-      review.scopeRevision,
-      applicabilityScopeRevision(record, program, resources, model)
-    )
-  );
+  if (!review?.scopeRevision) return false;
+  const matches = (revision) => revisionsMatch("applicability-scope", review.scopeRevision, revision);
+  if (matches(applicabilityScopeRevision(record, program, resources, model))) return true;
+  // Reviews written before the scope fix included Policy lifecycle fields. Accept
+  // that earlier fingerprint only when its material inputs still match.
+  if (matches(applicabilityScopeRevision(record, program, resources, model, { legacyPolicyStatus: "current" }))) return true;
+  return resources.some(({ type, status }) => type === "policy" && ["in-review", "active"].includes(status))
+    && matches(applicabilityScopeRevision(record, program, resources, model, { legacyPolicyStatus: "approved" }));
 }
 
 function pick(record, fields, model, objectType = null) {

package/src/audit-preparation.js

@@ -1831,6 +1831,9 @@ function item(id, status, title, message, resource = {}, options = {}) {
     message,
     ...(resource.type ? { resourceType: resource.type } : {}),
     ...(resource.id ? { resourceId: resource.id } : {}),
+    ...(resource.type ? { destination: resource.id
+      ? { kind: "record", resourceType: resource.type, resourceId: resource.id }
+      : { kind: "collection", resourceType: resource.type } } : {}),
     ...(options.commands?.length ? { commands: options.commands } : {}),
     ...(options.affectedActionItemIds?.length ? { affectedActionItemIds: options.affectedActionItemIds } : {}),
     ...(options.affectedEventIds?.length ? { affectedEventIds: options.affectedEventIds } : {}),

package/src/batch-review.js

@@ -40,6 +40,8 @@ export async function scaffoldApplicabilityReview(input = process.cwd(), options
       && applicabilityReviewIsCurrent(review, requirementById.get(review.requirementId), program, loaded.resources, loaded.model)
     ))
     .map(({ requirementId }) => requirementId));
+  const requirementReviews = new Map((program.requirementApplicability || [])
+    .map((review) => [review.requirementId, review]));
   const records = loaded.resources.filter((record) => (
     REVIEWABLE_TYPES.has(record.type)
     && (!requestedType || record.type === requestedType)
@@ -56,10 +58,18 @@ export async function scaffoldApplicabilityReview(input = process.cwd(), options
       .sort((left, right) => `${left.type}:${left.title}:${left.id}`.localeCompare(`${right.type}:${right.title}:${right.id}`))
       .map((record) => {
         const constraint = soc2RequirementApplicabilityConstraint(record, program, loaded.model.modelVersion);
+        const saved = record.type === "requirement" && modelSupports(loaded.model, "program-scope")
+          ? requirementReviews.get(record.id)
+          : record.applicabilityReview;
+        const prior = saved && ["applicable", "not-applicable", "externally-managed", "zero-population"].includes(saved.decision)
+          ? saved : null;
         return {
           id: record.id,
-          decision: constraint?.requiredDecision || null,
-          rationale: constraint?.defaultRationale || null,
+          decision: constraint?.requiredDecision || prior?.decision || null,
+          rationale: constraint?.requiredDecision && constraint.requiredDecision !== prior?.decision
+            ? constraint.defaultRationale || null
+            : prior?.rationale || constraint?.defaultRationale || null,
+          reviewStatus: prior ? "stale" : "missing",
           ...(constraint ? { constraint } : {})
         };
       })

package/src/program-readiness.js

@@ -493,12 +493,17 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   const requirementById = new Map(records
     .filter(({ type }) => type === "requirement")
     .map((record) => [record.id, record]));
-  const v4Decisions = new Map((workspace?.requirementApplicability || [])
+  const reviewedRequirements = (workspace?.requirementApplicability || [])
     .filter((decision) => (
       requirementById.has(decision.requirementId)
       && applicabilityReviewIsCurrent(decision, requirementById.get(decision.requirementId), workspace, records, model)
-    ))
-    .map((decision) => [decision.requirementId, decision.decision]));
+    ));
+  const v4Decisions = new Map(reviewedRequirements.map((decision) => [decision.requirementId, decision.decision]));
+  const staleRequirementIds = new Set((workspace?.requirementApplicability || [])
+    .filter((decision) => requirementById.has(decision.requirementId)
+      && ["applicable", "not-applicable"].includes(decision.decision)
+      && !v4Decisions.has(decision.requirementId))
+    .map(({ requirementId }) => requirementId));
   const applicableRequirements = records.filter((record) => (
     record.type === "requirement"
     && scope.frameworks.some((framework) => framework.id === record.frameworkId)
@@ -514,6 +519,8 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   const selectedTrustServicesRequirements = scope.requirements.filter((requirement) => !isDescriptionRequirement(requirement));
   const unresolvedDescriptionRequirements = unresolvedRequirements.filter(isDescriptionRequirement);
   const unresolvedTrustServicesRequirements = unresolvedRequirements.filter((requirement) => !isDescriptionRequirement(requirement));
+  const staleRequirements = unresolvedRequirements.filter(({ id }) => staleRequirementIds.has(id));
+  const missingDecisionRequirements = unresolvedRequirements.filter(({ id }) => !staleRequirementIds.has(id));
   const uncoveredRequirements = scope.requirements.filter((requirement) => (
     !isDescriptionRequirement(requirement)
     && !scope.controls.some((control) => (control.requirementIds || []).includes(requirement.id))
@@ -541,6 +548,8 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   const invalidMandatoryDecisions = mandatoryRequirements.filter((requirement) => (
     v4Decisions.get(requirement.id) !== "applicable"
   ));
+  const invalidMandatoryStaleCount = invalidMandatoryDecisions.filter(({ id }) => staleRequirementIds.has(id)).length;
+  const invalidMandatoryOtherCount = invalidMandatoryDecisions.length - invalidMandatoryStaleCount;
   const criteriaComplete = Boolean(
     scope.frameworks.length
     && scope.requirements.length
@@ -564,11 +573,13 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
             ...missingRequiredDescriptionReferences
           ].join(", ")}.`
         : invalidMandatoryDecisions.length
-          ? `Mark all 33 Security Common Criteria and all nine Description Criteria applicable for this SOC 2 Program. ${invalidMandatoryDecisions.length} required ${invalidMandatoryDecisions.length === 1 ? "decision is" : "decisions are"} missing, undetermined, or not applicable.`
-          : `Resolve the program criteria and Controls. ${unresolvedTrustServicesRequirements.length} Trust Services applicability decisions and ${unresolvedDescriptionRequirements.length} Description Criteria decisions remain undetermined, ${missingRequirements.length} applicable criteria are not selected, and ${uncoveredRequirements.length} selected applicable Trust Services criteria have no selected Control. Description Criteria govern the system description and do not map to Controls.`,
+          ? `Mark all 33 Security Common Criteria and all nine Description Criteria applicable for this SOC 2 Program. ${invalidMandatoryDecisions.length} required ${invalidMandatoryDecisions.length === 1 ? "decision needs" : "decisions need"} attention: ${invalidMandatoryStaleCount} prior reviews are stale and ${invalidMandatoryOtherCount} are missing, undetermined, or not applicable.`
+          : `Resolve the program criteria and Controls. ${missingDecisionRequirements.length} applicability decisions are missing or undetermined and ${staleRequirements.length} prior reviews are stale. ${unresolvedTrustServicesRequirements.length} Trust Services criteria and ${unresolvedDescriptionRequirements.length} Description Criteria need current decisions, ${missingRequirements.length} applicable criteria are not selected, and ${uncoveredRequirements.length} selected applicable Trust Services criteria have no selected Control. Description Criteria govern the system description and do not map to Controls.`,
     workspace || { type: "workspace" },
     {
       unresolvedRequirementIds: unresolvedRequirements.map(({ id }) => id),
+      staleRequirementIds: staleRequirements.map(({ id }) => id),
+      missingDecisionRequirementIds: missingDecisionRequirements.map(({ id }) => id),
       missingRequirementIds: missingRequirements.map(({ id }) => id),
       uncoveredRequirementIds: uncoveredRequirements.map(({ id }) => id),
       invalidMandatoryRequirementIds: invalidMandatoryDecisions.map(({ id }) => id),
@@ -763,9 +774,23 @@ export function collectionReviewReadinessItem(assessment) {
       ? { id: firstIncomplete.resourceId, type: assessment.resourceType }
       : needsFirstRecord ? { type: assessment.resourceType }
         : approvalAction ? { type: approvalAction.resourceType, ...(approvalAction.resourceId ? { id: approvalAction.resourceId } : {}) }
-          : assessment.review || { type: assessment.resourceType },
+          : { type: assessment.resourceType },
     {
       resourceType: approvalAction?.resourceType || assessment.resourceType,
+      ...(!proposalAction && !needsFirstRecord && !approvalAction && assessment.review?.id
+        ? { subject: { type: "collection-review", id: assessment.review.id } }
+        : {}),
+      destination: proposalAction
+        ? { kind: "record", resourceType: assessment.resourceType, resourceId: firstIncomplete.resourceId }
+        : needsFirstRecord
+          ? { kind: "collection", resourceType: assessment.resourceType, create: true }
+          : approvalAction
+            ? approvalAction.reviewCollection
+              ? { kind: "collection-review", resourceType: approvalAction.resourceType }
+              : approvalAction.resourceId
+              ? { kind: "record", resourceType: approvalAction.resourceType, resourceId: approvalAction.resourceId }
+              : { kind: "collection", resourceType: approvalAction.resourceType, ...(approvalAction.createResource ? { create: true, scheduleDocument: true } : {}) }
+            : { kind: "collection-review", resourceType: assessment.resourceType },
       reviewPoints: assessment.configuration.reviewPoints,
       ...(approvalAction?.createResource ? { createResource: true } : {}),
       ...(pendingRetentionRow && !proposalAction ? { unresolvedAssignments: [{
@@ -831,6 +856,7 @@ function collectionApprovalIssueAction(assessment) {
   if (issue.code === "unreviewed-similar-information-types") return {
     title: "Review similar Information Types",
     resourceType: "information-type",
+    reviewCollection: true,
     commands: ["npx filegrc list information-type --workflow --json", "npx filegrc review-collection information-type --scaffold > REVIEW.json", "npx filegrc review-collection information-type REVIEW.json --preview --json", "npx filegrc review-collection information-type REVIEW.json --yes --json"]
   };
   return {

package/src/state.js

@@ -17,6 +17,7 @@ import { measureTiming } from "./timing.js";
 import { soc2RequirementApplicabilityConstraint } from "./soc2.js";
 import { modelSupports } from "../model/index.js";
 import { calculateRevision } from "./revisions.js";
+import { applicabilityReviewIsCurrent } from "./applicability-scope.js";
 
 const renderedMarkdownCache = new Map();
 const MAX_RENDERED_MARKDOWN_CACHE_ENTRIES = 1_000;
@@ -87,6 +88,7 @@ export async function createAppBootstrap(input = process.cwd(), options = {}) {
     obligations: { loading: true, items: [], triggers: [], counts: {} },
     collectionReviews: {},
     applicabilityConstraints: {},
+    applicabilityReviewStatuses: {},
     programReadiness: null,
     auditPreparations: {},
     workflow: { loading: true, findings: [], workItems: [], assessments: {} },
@@ -156,7 +158,8 @@ export async function createAppStateSection(input, section, options = {}) {
       applicabilityConstraints: Object.fromEntries(loaded.resources.flatMap((record) => {
         const constraint = soc2RequirementApplicabilityConstraint(record, activeProgram, loaded.model.modelVersion);
         return constraint ? [[record.id, constraint]] : [];
-      }))
+      })),
+      applicabilityReviewStatuses: assessApplicabilityReviewStatuses(loaded, activeProgram)
     };
   }
   if (section === "obligations") {
@@ -330,6 +333,7 @@ async function createAppStateUnlocked(input, options) {
     reconciliation,
     collectionReviews,
     applicabilityConstraints,
+    applicabilityReviewStatuses: assessApplicabilityReviewStatuses(loaded, activeProgram),
     programReadiness,
     auditPreparations,
     workflow,
@@ -337,6 +341,21 @@ async function createAppStateUnlocked(input, options) {
   };
 }
 
+function assessApplicabilityReviewStatuses(loaded, program) {
+  const decisions = new Map((program.requirementApplicability || []).map((review) => [review.requirementId, review]));
+  return Object.fromEntries(loaded.resources
+    .filter(({ type }) => ["requirement", "control", "commitment", "complementary-control"].includes(type))
+    .map((record) => {
+      const review = record.type === "requirement" && modelSupports(loaded.model, "program-scope")
+        ? decisions.get(record.id)
+        : record.applicabilityReview;
+      return [record.id, !review || !["applicable", "not-applicable", "externally-managed", "zero-population"].includes(review.decision)
+        ? "missing" : applicabilityReviewIsCurrent(
+        review, record, program, loaded.resources, loaded.model
+      ) ? "current" : "stale"];
+    }));
+}
+
 function serializeCollectionReviewAssessment(assessment) {
   return {
     resourceType: assessment.resourceType,

package/src/web.js

@@ -53,6 +53,38 @@ export function pageActionIdentity(href = "", fallback = "") {
   return route.startsWith("#/resource/") ? route : fallback || href;
 }
 
+export function resolveWorkflowDestination(destination, options = {}) {
+  if (!destination?.resourceType) return "";
+  if (options.resourceTypes && !options.resourceTypes[destination.resourceType]) return "";
+  const type = encodeURIComponent(destination.resourceType);
+  if (destination.kind === "record") {
+    const exists = !options.resources || options.resources.some((entry) => {
+      const record = entry.record || entry;
+      return record.type === destination.resourceType && record.id === destination.resourceId;
+    });
+    return destination.resourceId && exists
+      ? `#/resource/${type}/${encodeURIComponent(destination.resourceId)}${destination.edit ? "?edit=1" : ""}`
+      : resolveWorkflowDestination({ kind: "collection", resourceType: destination.resourceType }, options);
+  }
+  if (destination.kind === "collection-review") {
+    if (destination.resourceType === "retention-schedule-item" && options.retentionScheduleApproval) {
+      return "#/retention-schedule";
+    }
+    return `#/resources/${type}?review-collection=1`;
+  }
+  if (destination.kind === "collection") {
+    const create = destination.create && !options.readOnly;
+    if (destination.resourceType === "retention-schedule-item" && options.retentionScheduleApproval) {
+      return create ? "#/retention-schedule?new=1" : "#/retention-schedule";
+    }
+    if (destination.resourceType === "document" && create && destination.scheduleDocument) {
+      return "#/resources/document?new=1&documentScope=program&documentKind=schedule&programRole=required&title=Data%20Retention%20Schedule";
+    }
+    return `#/resources/${type}${create ? "?new=1" : ""}`;
+  }
+  return "";
+}
+
 export function renderIndex(state = null) {
   const snapshot = state
     ? `<script id="filegrc-data" type="application/json">${safeJson(state)}</script>`
@@ -100,6 +132,7 @@ const RESOURCE_GUIDE_OUTPUTS = ${JSON.stringify(RESOURCE_OUTPUTS)};
 const dashboardProgramReadiness = ${dashboardProgramReadiness.toString()};
 const workflowHrefBelongsToPage = ${workflowHrefBelongsToPage.toString()};
 const pageActionIdentity = ${pageActionIdentity.toString()};
+const resolveWorkflowDestination = ${resolveWorkflowDestination.toString()};
 const selectDefaultAudit = ${selectDefaultAudit.toString()};
 const STAGE_PAGE_SUMMARIES = ${JSON.stringify({
   ...RESOURCE_PAGE_SUMMARIES,
@@ -247,7 +280,8 @@ function normalizeAppState(next) {
 function blockingStateSections(route) {
   if (route.name === "home") return ["program", "obligations", "workflow"];
   if (route.name === "repository") return ["repository"];
-  if (route.name === "list" && route.type === "control") return ["program"];
+  if (route.name === "list" && ["requirement", "control", "commitment", "complementary-control"].includes(route.type)) return ["program"];
+  if (route.name === "detail" && ["program", "requirement", "control", "commitment", "complementary-control"].includes(route.type)) return ["program"];
   if (route.name === "list" && route.type === "obligation") return ["obligations"];
   if (route.name === "obligations" || route.name === "stage" && route.stageId === "run") return ["program", "obligations"];
   if (route.name === "audit-packet") return ["repository", "program", "obligations", "audits"];
@@ -416,12 +450,6 @@ function activeProgram() {
     || state.workspace;
 }
 
-function reviewedRequirementIds() {
-  return new Set((activeProgram().requirementApplicability || [])
-    .filter(({ decision }) => ["applicable", "not-applicable"].includes(decision))
-    .map(({ requirementId }) => requirementId));
-}
-
 function renderSidebarUtility(utility, route, direct = false) {
   const directClass = direct ? "nav-direct " : "";
   if (utility === "obligation-board") return "";
@@ -791,11 +819,7 @@ function renderRetentionScheduleIssues() {
   ));
   if (!actions.length) return "";
   return '<section class="retention-issues"><div class="section-head"><div><p class="kicker">Before approval</p><h2>Items to resolve</h2></div></div><div class="retention-issue-list">' + actions.map((item) => {
-    const href = item.href || (item.id?.startsWith("retention-use-")
-      ? retentionScheduleItemHref(item)
-      : item.resourceId && item.resourceType
-        ? '#/resource/' + encodeURIComponent(item.resourceType) + '/' + encodeURIComponent(item.resourceId)
-        : '#/resources/' + encodeURIComponent(item.resourceType || "retention-schedule-item"));
+    const href = item.href || workflowItemHref(item) || "#/retention-schedule";
     return '<a href="' + href + '"><span><strong>' + esc(item.title) + '</strong><small>' + esc(item.message) + '</small></span><b>Review</b></a>';
   }).join("") + '</div></section>';
 }
@@ -1291,9 +1315,7 @@ function renderFinishStepThree() {
   ));
   const next = implementationItems.find(({ status }) => status !== "complete");
   if (!oversightItem) {
-    const href = next?.id?.startsWith("collection-review-") && next.resourceType
-      ? "#/resources/" + encodeURIComponent(next.resourceType) + "?review-collection=1"
-      : next?.id?.startsWith("source-family-")
+    const href = next?.id?.startsWith("source-family-")
         ? "#/evidence-sources"
         : next ? workflowItemHref({ ...next, state: next.status }) || "#/resources/control" : "#/resources/control";
     return '<section class="finish-step panel blocked"><div><p class="kicker">Finish Step 3</p><h2>Complete implementation first</h2><p>' + esc(next?.message || "Finish the Step 3 work areas before the final review becomes available.") + '</p></div><a class="button primary" href="' + esc(href) + '">Continue implementation</a></section>';
@@ -1495,6 +1517,16 @@ function openCollectionReviewDialog(type) {
 }
 
 function workflowItemHref(item) {
+  const destinationOptions = {
+    retentionScheduleApproval: modelSupports("retention-schedule-approval"),
+    readOnly: state.readOnly,
+    resourceTypes: state.model.resources,
+    resources: state.resources
+  };
+  const destinationHref = (destination) => resolveWorkflowDestination(destination, destinationOptions);
+  if (item.destination) {
+    return destinationHref(item.destination);
+  }
   const source = item.source?.id && item.source?.type && item.source.type !== "unknown"
     ? item.source
     : null;
@@ -1523,19 +1555,18 @@ function workflowItemHref(item) {
     && item.subject?.id
     && state.resources.some(({ record }) => record.type === applicabilityType && record.id === item.subject.id)
   ) {
-    return "#/resource/" + encodeURIComponent(applicabilityType) + "/" + encodeURIComponent(item.subject.id);
+    return destinationHref({ kind: "record", resourceType: applicabilityType, resourceId: item.subject.id });
   }
   if (commands.some((command) => command.includes(" scaffold retention-schedule-item"))) {
     return retentionScheduleItemHref(item);
   }
   if (applicabilityType && state.model.resources[applicabilityType]) {
-    return "#/resources/" + encodeURIComponent(applicabilityType) + "?review=1";
+    return destinationHref({ kind: "collection", resourceType: applicabilityType }) + "?review=1";
   }
   const collectionReviewCommand = commands.find((command) => command.includes(" review-collection "));
   const collectionReviewType = collectionReviewCommand?.match(/review-collection\s+([a-z0-9-]+)/)?.[1];
   if (collectionReviewType && state.model.collectionReviews?.[collectionReviewType]) {
-    if (collectionReviewType === "retention-schedule-item" && modelSupports("retention-schedule-approval")) return "#/retention-schedule";
-    return "#/resources/" + encodeURIComponent(collectionReviewType) + "?review-collection=1";
+    return destinationHref({ kind: "collection-review", resourceType: collectionReviewType });
   }
   if (
     commands.some((command) => command.includes(" get ") && command.includes(" --mutation"))
@@ -1543,25 +1574,25 @@ function workflowItemHref(item) {
     && item.subject?.type
     && state.model.resources[item.subject.type]
   ) {
-    return "#/resource/" + encodeURIComponent(item.subject.type) + "/" + encodeURIComponent(item.subject.id) + "?edit=1";
+    return destinationHref({ kind: "record", resourceType: item.subject.type, resourceId: item.subject.id, edit: true });
   }
   if (commands.some((command) => command.includes(" external-reviewer-setup"))) {
     const reviewer = resourcesOfType("appointment")
       .find(({ record }) => record.appointmentKind === "independent-policy-reviewer");
-    if (reviewer) return "#/resource/appointment/" + encodeURIComponent(reviewer.record.id);
+    if (reviewer) return destinationHref({ kind: "record", resourceType: "appointment", resourceId: reviewer.record.id });
   }
   if (commands.some((command) => command.includes(" evidence-map"))) return "#/stage/controls";
   const reference = item.subject?.id && item.subject?.type
     ? item.subject
     : source;
   if (reference && reference.type !== "unknown") {
-    return "#/resource/" + encodeURIComponent(reference.type) + "/" + encodeURIComponent(reference.id);
+    return destinationHref({ kind: "record", resourceType: reference.type, resourceId: reference.id });
   }
   const missingType = item.subject?.type && state.model.resources[item.subject.type]
     ? item.subject.type
     : null;
   if (missingType) {
-    return "#/resources/" + encodeURIComponent(missingType) + (state.readOnly ? "" : "?new=1");
+    return destinationHref({ kind: "collection", resourceType: missingType, create: !state.readOnly });
   }
   if (item.auditId) return "#/audit-packet?auditId=" + encodeURIComponent(item.auditId);
   const stage = {
@@ -1719,13 +1750,9 @@ function retentionSchedulePageItems() {
         ...item,
         key: item.id,
         state: "ready",
-        href: item.id === "collection-review-retention-schedule-item"
-          ? retentionCollectionActionHref(item)
-          : item.id?.startsWith("retention-use-")
+        href: item.id?.startsWith("retention-use-")
             ? retentionScheduleItemHref(item)
-            : item.resourceId && item.resourceType
-              ? '#/resource/' + encodeURIComponent(item.resourceType) + '/' + encodeURIComponent(item.resourceId)
-              : workflowItemHref(item) || "#/retention-schedule",
+            : workflowItemHref(item) || "#/retention-schedule",
         subject: item.resourceId && item.resourceType
           ? { type: item.resourceType, id: item.resourceId }
           : item.subject
@@ -1733,19 +1760,6 @@ function retentionSchedulePageItems() {
   ]);
 }
 
-function retentionCollectionActionHref(item) {
-  if (item.resourceType === "document") return item.resourceId
-    ? '#/resource/document/' + encodeURIComponent(item.resourceId) + '?stage=policies'
-    : item.createResource
-      ? '#/resources/document?new=1&documentScope=program&documentKind=schedule&programRole=required&title=Data%20Retention%20Schedule'
-      : '#/resources/document';
-  if (item.resourceType === "information-type") return '#/resources/information-type?review-collection=1';
-  if (item.resourceType === "retention-schedule-item" && item.resourceId && item.resourceId !== item.id) {
-    return '#/resource/retention-schedule-item/' + encodeURIComponent(item.resourceId) + '?stage=policies';
-  }
-  return "#/retention-schedule";
-}
-
 function distinctPageActionItems(items) {
   const distinct = new Map();
   for (const item of items) {
@@ -2778,24 +2792,28 @@ function openNextAuditCycleDialog(prior) {
 }
 
 function controlApplicabilityPending(record) {
+  if (state.applicabilityReviewStatuses?.[record.id]) {
+    return state.applicabilityReviewStatuses[record.id] !== "current";
+  }
   if (!record.applicabilityReview) return true;
   const item = state.programReadiness?.stages?.find(({ id }) => id === "controls")?.items
     .find(({ resourceType, resourceId }) => resourceType === "control" && resourceId === record.id);
   return item?.checks?.applicability === false;
 }
 
+function applicabilityPending(record) {
+  if (state.applicabilityReviewStatuses?.[record.id]) {
+    return state.applicabilityReviewStatuses[record.id] !== "current";
+  }
+  return record.type === "control" ? controlApplicabilityPending(record)
+    : !record.applicabilityReview || record.type === "requirement" && record.applicability === "undetermined";
+}
+
 function openApplicabilityReviewDialog(type, entries) {
   const definition = state.model.resources[type];
   const reviewPoints = definition?.guidance?.reviewPoints || [];
   const people = resourcesOfType("person").filter(({ record }) => record.status === "active");
-  const reviewedRequirements = reviewedRequirementIds();
-  const pending = entries.filter(({ record }) => (
-    type === "requirement" && modelSupports("program-scope")
-      ? !reviewedRequirements.has(record.id)
-      : type === "control"
-        ? controlApplicabilityPending(record)
-        : !record.applicabilityReview || type === "requirement" && record.applicability === "undetermined"
-  ));
+  const pending = entries.filter(({ record }) => applicabilityPending(record));
   const dialog = document.createElement("dialog");
   dialog.className = "commit-dialog applicability-dialog";
   dialog.setAttribute("aria-labelledby", "applicability-dialog-title");
@@ -2805,10 +2823,19 @@ function openApplicabilityReviewDialog(type, entries) {
     const decisions = constraint?.allowedDecisions || (type === "requirement"
       ? ["applicable", "not-applicable"]
       : ["applicable", "not-applicable", "externally-managed", "zero-population"]);
-    const selected = constraint?.requiredDecision || "";
+    const prior = type === "requirement" && modelSupports("program-scope")
+      ? (activeProgram().requirementApplicability || []).find(({ requirementId }) => requirementId === entry.record.id)
+      : entry.record.applicabilityReview;
+    const selected = constraint?.requiredDecision || (state.applicabilityReviewStatuses?.[entry.record.id] === "stale" ? prior?.decision : "") || "";
+    const rationale = constraint?.requiredDecision && constraint.requiredDecision !== prior?.decision
+      ? constraint.defaultRationale || ""
+      : state.applicabilityReviewStatuses?.[entry.record.id] === "stale"
+        ? prior?.rationale || constraint?.defaultRationale || ""
+        : constraint?.defaultRationale || "";
     const options = decisions.map((decision) => '<option value="' + esc(decision) + '" ' + (decision === selected ? "selected" : "") + '>' + esc(properCase(decision)) + '</option>').join("");
     const note = constraint ? '<small class="applicability-constraint">' + esc(constraint.message) + '</small>' : "";
-    return '<div class="applicability-row" data-review-id="' + esc(entry.record.id) + '"><div><strong>' + esc(entry.record.title) + '</strong><small>' + esc(entry.record.code || entry.record.id) + '</small>' + note + '</div><select name="decision"><option value="">Review later</option>' + options + '</select><input name="rationale" value="' + esc(constraint?.defaultRationale || "") + '" placeholder="Decision rationale"></div>';
+    const stale = state.applicabilityReviewStatuses?.[entry.record.id] === "stale";
+    return '<div class="applicability-row" data-review-id="' + esc(entry.record.id) + '"><div><strong>' + esc(entry.record.title) + '</strong><small>' + esc(entry.record.code || entry.record.id) + (stale ? '<small>Prior review is stale. Confirm this decision against the current scope.</small>' : '') + note + '</div><select name="decision"><option value="">Review later</option>' + options + '</select><input name="rationale" value="' + esc(rationale) + '" placeholder="Decision rationale"></div>';
   }).join("");
   const reviewChecks = reviewPoints.length
     ? '<section class="collection-review-checks"><strong>Before deciding</strong><ul>' + reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></section>'
@@ -2816,7 +2843,7 @@ function openApplicabilityReviewDialog(type, entries) {
   const baselineNote = constrainedCount
     ? '<p class="applicability-baseline-note"><strong>' + constrainedCount + ' required baseline ' + pluralize("criterion", constrainedCount) + '.</strong> FileGRC has prefilled the only decision compatible with the selected SOC 2 Security goal and a review rationale. Leave an item at Review later only when management is not ready to record it.</p>'
     : '<p>Record only decisions reviewed against the current service scope. Leave an item at Review later when management has not decided it.</p>';
-  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Batch review</p><h2 id="applicability-dialog-title">Review ' + esc(definition.pluralTitle) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div>' + baselineNote + reviewChecks + '<div class="form-grid review-context"><label><span>Reviewer</span><select name="reviewerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '">' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Reviewed on</span><input name="reviewedOn" type="date" required value="' + esc(currentDate()) + '"></label></div><div class="applicability-rows">' + (rows || empty("Every record already has a reviewed applicability decision.")) + '</div><div class="workflow-preview" role="status"></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><span class="save-status review-save-status" role="status" aria-live="polite"></span><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary" data-preview-review ' + (pending.length ? "" : "disabled") + '>Preview decisions</button></div></form>';
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Batch review</p><h2 id="applicability-dialog-title">' + (pending.some(({ record }) => state.applicabilityReviewStatuses?.[record.id] === "stale") ? 'Reconfirm' : 'Review') + ' ' + esc(definition.pluralTitle) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div>' + baselineNote + reviewChecks + '<div class="form-grid review-context"><label><span>Reviewer</span><select name="reviewerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '">' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Reviewed on</span><input name="reviewedOn" type="date" required value="' + esc(currentDate()) + '"></label></div><div class="applicability-rows">' + (rows || empty("Every record already has a reviewed applicability decision.")) + '</div><div class="workflow-preview" role="status"></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><span class="save-status review-save-status" role="status" aria-live="polite"></span><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary" data-preview-review ' + (pending.length ? "" : "disabled") + '>Preview decisions</button></div></form>';
   document.body.append(dialog);
   dialog.showModal();
   const form = dialog.querySelector("form");
@@ -3009,11 +3036,7 @@ function renderAuditPreparation(preparation) {
   const status = preparation.status === "management-ready" ? "Management work complete" : preparation.counts.action + " actions remaining";
   const stages = preparation.stages.map((stage) => {
     const items = stage.items.map((item) => {
-      const href = item.resourceId
-        ? '#/resource/' + encodeURIComponent(item.resourceType) + '/' + encodeURIComponent(item.resourceId)
-        : item.resourceType
-          ? '#/resources/' + encodeURIComponent(item.resourceType)
-          : "";
+      const href = workflowItemHref(item);
       const content = '<span class="preparation-status ' + esc(item.status) + '" aria-hidden="true">' + preparationStatusMark(item.status) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(item.message) + '</small></span>';
       return href ? '<a href="' + href + '">' + content + '</a>' : '<div>' + content + '</div>';
     }).join("");
@@ -3139,18 +3162,12 @@ function renderList(main, type, params = new URLSearchParams()) {
     return { name, label: field.label || humanize(name), values };
   }).filter(({ values }) => values.length > 1);
   const createButton = !state.readOnly && !definition.singleton && !collectionNeedsFirstRecord(type) && resourceCreationAllowed(type) ? '<button class="button primary" id="new-resource">New ' + esc(definition.title.toLowerCase()) + '</button>' : "";
-  const reviewedRequirements = reviewedRequirementIds();
-  const hasPendingApplicability = entries.some(({ record }) => (
-    type === "requirement" && modelSupports("program-scope")
-      ? !reviewedRequirements.has(record.id)
-      : type === "control"
-        ? controlApplicabilityPending(record)
-        : !record.applicabilityReview || type === "requirement" && record.applicability === "undetermined"
-  ));
+  const hasPendingApplicability = entries.some(({ record }) => applicabilityPending(record));
+  const hasStaleApplicability = entries.some(({ record }) => state.applicabilityReviewStatuses?.[record.id] === "stale");
   const applicabilityButton = !state.readOnly
     && ["requirement", "control", "commitment", "complementary-control"].includes(type)
     && hasPendingApplicability
-    ? '<button class="button" id="review-applicability">Review applicability</button>'
+    ? '<button class="button" id="review-applicability">' + (hasStaleApplicability ? 'Reconfirm applicability' : 'Review applicability') + '</button>'
     : "";
   const guideTrigger = '<button class="guide-trigger" id="resource-guide-trigger" type="button" aria-label="About ' + esc(definition.pluralTitle) + '" aria-haspopup="dialog" aria-controls="resource-guide" aria-expanded="false"><svg viewBox="0 0 20 20" aria-hidden="true"><circle cx="10" cy="10" r="8"></circle><path d="M7.8 7.5a2.4 2.4 0 1 1 3.25 2.25c-.7.31-1.05.72-1.05 1.5v.25M10 14.5v.1"></path></svg></button>';
   const listTools = '<div class="list-tools list-header-tools"><label><span class="sr-only">Filter list</span><input id="list-search" type="search" placeholder="Filter ' + esc(definition.pluralTitle.toLowerCase()) + '"></label>' +
@@ -3299,6 +3316,9 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
     && !fields[name]?.content
     && !narrativeNames.has(name)
   ));
+  if (type === "program" && !Object.hasOwn(entry.record, "requirementApplicability")) {
+    visible.push(["requirementApplicability", []]);
+  }
   const content = Object.entries(entry.content);
   const narrativeContent = narrative.length
     ? '<div class="content-label"><span>Record</span></div><div class="record-prose">' + narrative.map(([name, value]) => '<section><h3>' + esc(titleCase(fields[name]?.label || humanize(name))) + '</h3><p>' + esc(value) + '</p></section>').join("") + '</div>'
@@ -3353,7 +3373,7 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
     : "";
   const attachmentPanel = type === "evidence" ? evidenceAttachmentPanel(entry) : "";
   const recordFieldsPanel = visible.length
-    ? '<section class="panel detail-support-panel detail-metadata-panel"><div class="panel-head"><h3>Record details</h3></div><dl class="metadata">' + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type) + '</dd></div>').join("") + '</dl></section>'
+    ? '<section class="panel detail-support-panel detail-metadata-panel"><div class="panel-head"><h3>Record details</h3></div><dl class="metadata">' + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type, false, entry.record) + '</dd></div>').join("") + '</dl></section>'
     : "";
   const supportPanels = renderDetailSupport({
     hasRecordBody,
@@ -3362,9 +3382,17 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
     attachmentPanel
   });
   const mayDelete = !state.readOnly && !routeSetLocked && !definition.singleton;
+  const applicabilityStatus = state.applicabilityReviewStatuses?.[entry.record.id];
+  const applicabilityAction = !state.readOnly && ["requirement", "control", "commitment", "complementary-control"].includes(type)
+    && ["stale", "missing"].includes(applicabilityStatus)
+    ? '<a class="button" href="#/resources/' + encodeURIComponent(type) + '?review=1">' + (applicabilityStatus === "stale" ? "Reconfirm" : "Review") + ' applicability</a>'
+    : "";
   const recordMenu = '<details class="record-overflow"><summary aria-label="More record actions" title="More record actions"><svg viewBox="0 0 18 4" aria-hidden="true"><circle cx="2" cy="2" r="2"></circle><circle cx="9" cy="2" r="2"></circle><circle cx="16" cy="2" r="2"></circle></svg></summary><div class="record-overflow-menu" aria-label="Record actions"><button type="button" data-record-modal="info">Record info</button><button type="button" data-record-modal="connections">Connections</button><button type="button" data-record-modal="history"' + (entry.historyLoaded === false ? ' disabled' : '') + '>File history' + (entry.historyLoaded === false ? ' (loading)' : '') + '</button>' + (mayDelete ? '<div class="record-overflow-separator"></div><button class="danger-text" type="button" data-delete-resource>Delete record</button>' : '') + '</div></details>';
-  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="' + collectionHref + '">' + esc(collectionLabel) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + reportingRouteSetActions + auditCycleAction + auditPopulationCorrectionAction + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + governanceActions + lifecycleActions + issueActions + addRecordContentAction + (!state.readOnly && !routeSetLocked ? '<button class="button" id="edit-resource">Edit</button>' : "") + recordMenu + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + (type === "control" ? " detail-control" : "") + '">' + detailMain + supportPanels + '</div></div>';
+  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="' + collectionHref + '">' + esc(collectionLabel) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + reportingRouteSetActions + auditCycleAction + auditPopulationCorrectionAction + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + governanceActions + lifecycleActions + issueActions + applicabilityAction + addRecordContentAction + (!state.readOnly && !routeSetLocked ? '<button class="button" id="edit-resource">Edit</button>' : "") + recordMenu + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + (type === "control" ? " detail-control" : "") + '">' + detailMain + supportPanels + '</div></div>';
   main.querySelectorAll("[data-completion-requirements]").forEach((button) => button.addEventListener("click", () => openCompletionRequirementsDialog(button.dataset.completionRequirements)));
+  main.querySelector("[data-select-program-for-review]")?.addEventListener("click", () => {
+    selectProgram(entry.record.id, "#/resources/requirement?review=1");
+  });
   main.querySelector("#edit-resource")?.addEventListener("click", () => openEditor(type, entry));
   main.querySelectorAll("[data-record-modal]").forEach((button) => button.addEventListener("click", () => {
     button.closest("details")?.removeAttribute("open");
@@ -5770,17 +5798,21 @@ function openContentEditor(entry, name) {
   });
 }
 
+async function selectProgram(programId, destination = null) {
+  const selectionGeneration = ++programSelectionGeneration;
+  const response = await fetch("/api/state/bootstrap?programId=" + encodeURIComponent(programId));
+  if (!response.ok) throw new Error(await responseMessage(response));
+  if (selectionGeneration !== programSelectionGeneration) return;
+  state = normalizeAppState(await response.json());
+  stateSectionRequests.clear();
+  if (destination) history.replaceState(null, "", destination);
+  render();
+  loadStateForRoute();
+}
+
 function bindCommon() {
-  root.querySelector("[data-program-select]")?.addEventListener("change", async (event) => {
-    const programId = event.currentTarget.value;
-    const selectionGeneration = ++programSelectionGeneration;
-    const response = await fetch("/api/state/bootstrap?programId=" + encodeURIComponent(programId));
-    if (!response.ok) throw new Error(await responseMessage(response));
-    if (selectionGeneration !== programSelectionGeneration) return;
-    state = normalizeAppState(await response.json());
-    stateSectionRequests.clear();
-    render();
-    loadStateForRoute();
+  root.querySelector("[data-program-select]")?.addEventListener("change", (event) => {
+    selectProgram(event.currentTarget.value);
   });
   root.querySelectorAll(".nav-toggle, .nav-subgroup-toggle").forEach((button) => button.addEventListener("click", () => {
     const group = button.closest(".nav-group");
@@ -6070,14 +6102,22 @@ function conditionMatchesValues(condition, valueFor) {
 function conditionValueMatches(actual, expected) {
   return Array.isArray(expected) ? expected.includes(actual) : actual === expected;
 }
-function formatValue(value, field, type, compact = false) {
+function formatValue(value, field, type, compact = false, record = null) {
   if (value === undefined || value === null || value === "") return '<span class="muted">Not set</span>';
   const definition = fieldDefinition(type, field);
   if (type === "program" && field === "requirementApplicability" && Array.isArray(value)) {
-    const reviewed = value.filter(({ decision }) => ["applicable", "not-applicable"].includes(decision)).length;
-    const pending = value.length - reviewed;
-    const label = reviewed + " reviewed" + (pending ? " · " + pending + " to review" : "");
-    return '<a class="tag relation" href="#/resources/requirement' + (pending ? "?review=1" : "") + '">' + esc(label) + '</a>';
+    if (record && record.id !== state.selectedProgramId) {
+      return '<button class="button" type="button" data-select-program-for-review="' + esc(record.id) + '">Select this Program to review applicability</button>';
+    }
+    const frameworkIds = new Set(record?.frameworkIds || activeProgram().frameworkIds || []);
+    const requirementIds = state.resources.filter(({ record: candidate }) => (
+      candidate.type === "requirement" && frameworkIds.has(candidate.frameworkId)
+    )).map(({ record: candidate }) => candidate.id);
+    const reviewed = requirementIds.filter((id) => state.applicabilityReviewStatuses?.[id] === "current").length;
+    const stale = requirementIds.filter((id) => state.applicabilityReviewStatuses?.[id] === "stale").length;
+    const pending = requirementIds.length - reviewed - stale;
+    const label = reviewed + " reviewed" + (stale ? " · " + stale + " stale" : "") + (pending ? " · " + pending + " to review" : "");
+    return '<a class="tag relation" href="#/resources/requirement' + (stale || pending ? "?review=1" : "") + '">' + esc(label) + '</a>';
   }
   if (definition?.type === "date") return esc(formatCalendarDate(value));
   if (definition?.type === "timestamp") return esc(formatLocalDateTime(value));

package/src/workflow.js

@@ -1115,9 +1115,9 @@ export function packetDeliveryIssue(delivery) {
 
 function normalizeFinding(code, item, context) {
   const state = findingState(item.status);
-  const subject = item.resourceType
+  const subject = item.subject || (item.resourceType
     ? { type: item.resourceType, ...(item.resourceId ? { id: item.resourceId } : {}) }
-    : null;
+    : null);
   const dependencies = (item.unresolvedAssignments || []).map((assignment) => ({
     type: assignment.resourceType,
     id: assignment.resourceId,
@@ -1138,6 +1138,7 @@ function normalizeFinding(code, item, context) {
       .filter(([, passed]) => passed === false)
       .map(([name]) => name) } : {}),
     ...(item.resourceId ? { resourceId: item.resourceId } : {}),
+    ...(item.destination ? { destination: item.destination } : {}),
     ...(item.createResourceType ? { createResourceType: item.createResourceType } : {}),
     ...(item.sourceResourceIds ? { sourceResourceIds: item.sourceResourceIds } : {}),
     ...(item.informationTypeId ? { informationTypeId: item.informationTypeId } : {}),