filegrc 0.2.0 → 0.3.1

package/src/cli.js

@@ -1,11 +1,12 @@
 import { readFile, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
 import { loadModel } from "../model/index.js";
 import { buildAgentGuide, findResourceReferences, listResourceTypes, scaffoldResourceMutation } from "./agent.js";
 import { assessAuditPreparation, prepareAuditWorkspace } from "./audit-preparation.js";
 import { buildWorkspace } from "./build.js";
 import { generateEvidencePacket, prepareEvidencePacket } from "./evidence-packet.js";
-import { ensureEvidenceTestDrafts } from "./evidence-tests.js";
+import { ensureEvidenceTestDrafts, planEvidenceTestDrafts } from "./evidence-tests.js";
 import {
   addEvidenceAttachment,
   createResource,
@@ -27,7 +28,7 @@ import { assessProgramReadiness } from "./program-readiness.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { searchResources } from "./search.js";
 import { serveWorkspace } from "./server.js";
-import { setupWorkspace } from "./setup.js";
+import { planWorkspaceSetup, setupWorkspace, summarizeSetupResult } from "./setup.js";
 import { createAppState } from "./state.js";
 import { currentCalendarDate } from "./time.js";
 import { validateWorkspace } from "./validate.js";
@@ -42,6 +43,7 @@ const BOOLEAN_FLAGS = new Set([
   "mutation",
   "preview",
   "require-ready",
+  "summary",
   "write-docs",
   "yes"
 ]);
@@ -60,7 +62,7 @@ export async function runCli(argv = process.argv.slice(2)) {
       host: flags.host ?? process.env.FILEGRC_HOST,
       port: flags.port ?? process.env.FILEGRC_PORT
     });
-    console.log(`FileGRC workspace: ${result.url}`);
+    console.log(`filegrc workspace: ${result.url}`);
     console.log(`Data: ${result.root}/data`);
     return await new Promise((resolvePromise) => {
       const stop = () => result.server.close(resolvePromise);
@@ -70,7 +72,7 @@ export async function runCli(argv = process.argv.slice(2)) {
   }
   if (command === "setup") {
     const payload = positionals[0] ? await readSetupPayload(positionals[0]) : {};
-    const result = await setupWorkspace(root, {
+    const setupInput = await completeInteractiveSetup(root, {
       ...payload,
       ...(flags["service-name"] !== undefined ? { serviceName: flags["service-name"] } : {}),
       ...(flags.boundary !== undefined ? { boundary: flags.boundary } : {}),
@@ -81,14 +83,22 @@ export async function runCli(argv = process.argv.slice(2)) {
       ...(flags["program-goal"] !== undefined ? { programGoal: flags["program-goal"] } : {}),
       ...(flags.draft ? { draft: true } : {})
     });
-    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    const result = flags.preview
+      ? await planWorkspaceSetup(root, setupInput)
+      : await setupWorkspace(root, setupInput);
+    const output = flags.summary && !flags.preview ? summarizeSetupResult(result) : result;
+    if (flags.json) console.log(JSON.stringify(output, null, 2));
+    else if (flags.preview) {
+      console.log(`Setup preview: ${result.changes.system} system ${result.system.id}; update workspace target to ${result.target.assuranceGoal}.`);
+      console.log("No controls will be linked and no evidence drafts will be created.");
+    }
     else {
       console.log(`${result.draft ? "Saved draft scope" : "Completed initial setup"} for ${result.system.title}.`);
       console.log(`System: ${result.system.id} (${result.system.status})`);
       console.log(`Target: ${result.workspace.assuranceGoal}`);
       console.log("Next: finish Step 1 by confirming people, criteria, commitments, vendors, and in-scope systems. Run filegrc program-path for the full path.");
     }
-    return result;
+    return output;
   }
   if (command === "build") {
     const result = await buildWorkspace(positionals[0] ?? root, { output: flags.output });
@@ -226,7 +236,15 @@ export async function runCli(argv = process.argv.slice(2)) {
   if (command === "program-readiness") {
     const loaded = await loadWorkspace(root);
     const result = await assessProgramReadiness(loaded, { asOf: flags["as-of"] });
-    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    const output = flags.summary ? summarizeProgramReadiness(result) : result;
+    if (flags.json) console.log(JSON.stringify(output, null, 2));
+    else if (flags.summary) {
+      console.log(`${result.status.toUpperCase()}: ${result.progress.complete} of ${result.progress.total} program items complete`);
+      for (const stage of output.stages) {
+        console.log(`${stage.status.toUpperCase()}\t${stage.title}\t${stage.counts.action} actions`);
+      }
+      if (output.firstAction) console.log(`Next: ${output.firstAction.title}\t${output.firstAction.message}`);
+    }
     else {
       console.log(`${result.status.toUpperCase()}: ${result.progress.complete} of ${result.progress.total} program items complete`);
       console.log(`${result.target.label}${result.target.candidatePeriodStart ? `, candidate period starts ${result.target.candidatePeriodStart}` : ""}`);
@@ -239,9 +257,32 @@ export async function runCli(argv = process.argv.slice(2)) {
       }
     }
     if (flags["require-ready"] && !result.evidenceReady) process.exitCode = 2;
-    return result;
+    return output;
   }
   if (command === "evidence-test-drafts") {
+    if (flags.preview) {
+      const loaded = await loadWorkspace(root);
+      const plan = planEvidenceTestDrafts(loaded);
+      const result = {
+        schemaVersion: 1,
+        preview: true,
+        total: plan.length,
+        create: plan.filter(({ existing }) => !existing).map((item) => ({
+          familyId: item.familyId,
+          title: item.title,
+          testEvidenceKind: item.testEvidenceKind,
+          controlIds: item.controlIds
+        })),
+        existing: plan.filter(({ existing }) => existing).map(({ existing }) => ({
+          id: existing.id,
+          title: existing.title,
+          status: existing.status
+        }))
+      };
+      if (flags.json) console.log(JSON.stringify(result, null, 2));
+      else console.log(`Evidence draft preview: create ${result.create.length}; preserve ${result.existing.length}.`);
+      return result;
+    }
     const result = await ensureEvidenceTestDrafts(root);
     if (flags.json) console.log(JSON.stringify(result, null, 2));
     else console.log(`Created ${result.created.length} External Evidence test ${result.created.length === 1 ? "draft" : "drafts"}; ${result.total} required families are represented.`);
@@ -554,6 +595,56 @@ async function readSetupPayload(path) {
   return parsed;
 }
 
+async function completeInteractiveSetup(root, payload) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return payload;
+  const loaded = await loadWorkspace(root);
+  const activePeople = loaded.resources.filter(({ type, status }) => type === "person" && status === "active");
+  if (!activePeople.length) throw new Error("Setup requires at least one active person who can own the service.");
+  const classifications = Object.keys(loaded.workspace.classificationDefinitions || {});
+  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  const result = { ...payload };
+  const askRequired = async (label, defaultValue = "") => {
+    const suffix = defaultValue ? ` [${defaultValue}]` : "";
+    let value = "";
+    while (!value) value = (await prompt.question(`${label}${suffix}: `)).trim() || defaultValue;
+    return value;
+  };
+  const askChoice = async (label, choices, defaultValue = "") => {
+    let value = "";
+    while (!choices.includes(value)) {
+      value = await askRequired(`${label} (${choices.join("/")})`, defaultValue);
+    }
+    return value;
+  };
+  try {
+    result.serviceName ||= await askRequired(
+      "Service name",
+      loaded.workspace.organizationName ? `${loaded.workspace.organizationName} service` : ""
+    );
+    result.boundary ||= await askRequired("Service boundary");
+    result.ownerId ||= await askChoice(
+      "Service owner ID",
+      activePeople.map(({ id }) => id),
+      activePeople[0].id
+    );
+    result.criticality ||= await askChoice("Criticality", ["low", "medium", "high", "critical"], "high");
+    result.dataClassification ||= classifications.length
+      ? await askChoice(
+        "Data classification",
+        classifications,
+        classifications.includes("Confidential") ? "Confidential" : classifications[0]
+      )
+      : await askRequired("Data classification");
+    if (result.internetExposed === undefined) {
+      result.internetExposed = (await askChoice("Internet exposed", ["yes", "no"])) === "yes";
+    }
+    result.programGoal ||= await askChoice("Program goal", ["none", "readiness", "type-1", "type-2"]);
+  } finally {
+    prompt.close();
+  }
+  return result;
+}
+
 async function readTextInput(path) {
   if (path === true || !path) throw new Error("Pass --write <markdown-file|->.");
   return path === "-" ? readStdin() : readFile(resolve(String(path)), "utf8");
@@ -576,11 +667,11 @@ async function printVersion() {
 }
 
 function printHelp() {
-  console.log(`FileGRC - Git-native GRC workspace
+  console.log(`filegrc - Git-native GRC workspace
 
 Usage:
   filegrc serve [root] [--host 127.0.0.1] [--port 8787]
-  filegrc setup [setup.json|-] [setup options] [--draft] [--json]
+  filegrc setup [setup.json|-] [setup options] [--draft] [--preview] [--summary] [--json]
   filegrc build [root] [--output .filegrc/site]
   filegrc validate [root] [--json]
   filegrc model [--json|--write-docs|--check-docs]
@@ -592,8 +683,8 @@ Usage:
   filegrc list [resource-type] [--json]
   filegrc search <query> [--type resource-type] [--json]
   filegrc obligations [--as-of YYYY-MM-DD] [--from YYYY-MM-DD] [--through YYYY-MM-DD] [--now RFC3339] [--complete] [--json]
-  filegrc program-readiness [--as-of YYYY-MM-DD] [--require-ready] [--json]
-  filegrc evidence-test-drafts [--json]
+  filegrc program-readiness [--as-of YYYY-MM-DD] [--require-ready] [--summary] [--json]
+  filegrc evidence-test-drafts [--preview] [--json]
   filegrc audit-readiness [audit-id] [--require-ready] [--json]
   filegrc prepare-audit <audit-id> [--json]
   filegrc trigger <event-type> (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) [--subject resource-id[,resource-id]] [--title text] [--json]
@@ -634,7 +725,8 @@ Safety:
   filegrc setup [setup.json|-] [options]
 
 Create or update the initial service boundary through the same validated operation
-used by browser onboarding. JSON keys use the camelCase forms shown below.
+used by browser onboarding. Run without input in an interactive terminal for guided
+setup. JSON keys use the camelCase forms shown below.
 
 Options:
   --service-name <name>       serviceName
@@ -645,6 +737,8 @@ Options:
   --internet-exposed <bool>   true or false
   --program-goal <goal>       none, readiness, type-1, or type-2
   --draft                     Save the service boundary as planned
+  --preview                   Validate and report planned writes without saving
+  --summary                   Omit full workspace relationship arrays
   --json                      Print the result as JSON
   --root <path>               Workspace path
   --help                      Show this help`);
@@ -662,6 +756,7 @@ is required.
 Options:
   --as-of <date>     Evaluate effective dates and obligations on YYYY-MM-DD
   --require-ready    Exit with code 2 unless the Evidence Ready gate passes
+  --summary          Omit item details and print stage counts and next actions
   --json             Print the result as JSON
   --root <path>      Workspace path
   --help             Show this help`);
@@ -687,10 +782,12 @@ Options:
     console.log(`Usage:
   filegrc evidence-test-drafts [options]
 
-Create missing draft External Evidence records for collection that does not
-already have a dedicated Step 5 operating record. Existing tests are preserved.
+Preview or create missing draft External Evidence records for collection that
+does not already have a dedicated Step 5 operating record. Existing tests are
+preserved. Run after confirming applicable controls and source systems.
 
 Options:
+  --preview      Report proposed drafts without creating them
   --json         Print created and existing records as JSON
   --root <path>  Workspace path
   --help         Show this help`);
@@ -707,7 +804,7 @@ function agentOverview(model) {
       help: "filegrc help",
       version: "filegrc version",
       serve: "filegrc serve [root]",
-      setup: "filegrc setup [setup.json|-] [--draft] [--json]",
+      setup: "filegrc setup [setup.json|-] [--draft] [--preview] [--summary] [--json]",
       build: "filegrc build [root]",
       validate: "filegrc validate [root] --json",
       model: "filegrc model --json",
@@ -720,7 +817,7 @@ function agentOverview(model) {
       search: "filegrc search <query> --json",
       obligations: "filegrc obligations --json",
       programReadiness: "filegrc program-readiness --json",
-      evidenceTestDrafts: "filegrc evidence-test-drafts --json",
+      evidenceTestDrafts: "filegrc evidence-test-drafts --preview --json",
       auditReadiness: "filegrc audit-readiness <audit-id> --json",
       prepareAudit: "filegrc prepare-audit <audit-id>",
       trigger: "filegrc trigger <event-type> <date-or-time-and-subject-flags>",
@@ -860,6 +957,46 @@ function printProgramPath(result) {
   }
 }
 
+function summarizeProgramReadiness(result) {
+  const ownership = result.stages
+    .flatMap((stage) => stage.items)
+    .find((item) => item.id === "program-ownership");
+  const summarizeItem = (item) => item ? {
+    id: item.id,
+    status: item.status,
+    title: item.title,
+    message: item.message,
+    ...(item.resourceType ? { resourceType: item.resourceType } : {}),
+    ...(item.resourceId ? { resourceId: item.resourceId } : {}),
+    ...(item.unresolvedAssignments?.length ? { unresolvedAssignments: item.unresolvedAssignments } : {})
+  } : null;
+  return {
+    schemaVersion: result.schemaVersion,
+    generatedAt: result.generatedAt,
+    asOf: result.asOf,
+    status: result.status,
+    evidenceReady: result.evidenceReady,
+    operating: result.operating,
+    canStartCandidatePeriod: result.canStartCandidatePeriod,
+    suggestedCandidatePeriodStart: result.suggestedCandidatePeriodStart,
+    target: result.target,
+    progress: result.progress,
+    counts: result.counts,
+    scopeCounts: Object.fromEntries(
+      Object.entries(result.scope).map(([name, ids]) => [name.replace(/Ids$/, ""), ids.length])
+    ),
+    unresolvedOwnership: ownership?.unresolvedAssignments || [],
+    firstAction: summarizeItem(result.firstAction),
+    stages: result.stages.map((stage) => ({
+      id: stage.id,
+      title: stage.title,
+      status: stage.status,
+      counts: stage.counts,
+      firstAction: summarizeItem(stage.items.find(({ status }) => status === "action"))
+    }))
+  };
+}
+
 function eventWindowText(window) {
   if (Number.isInteger(window?.endOffsetHours)) {
     return window.endOffsetHours === 0 ? "due at event time" : `due within ${window.endOffsetHours} hours`;

package/src/evidence-packet.js

@@ -245,7 +245,7 @@ export async function prepareEvidencePacket(input, options = {}) {
     end,
     timezone: loaded.workspace.timezone
   });
-  const fileGRCRecords = datedRecords.filter((record) => (
+  const filegrcRecords = datedRecords.filter((record) => (
     !NON_EVIDENCE_RECORD_TYPES.has(record.type)
     && controlIdsForRecord(byId.get(record.id), byId).size
   ));
@@ -319,7 +319,7 @@ export async function prepareEvidencePacket(input, options = {}) {
     },
     summary: {
       datedRecords: datedRecords.length,
-      fileGRCRecords: fileGRCRecords.length,
+      filegrcRecords: filegrcRecords.length,
       records: packetRecords.length,
       policies: policyIds.size,
       controls: controlIds.size,
@@ -335,7 +335,7 @@ export async function prepareEvidencePacket(input, options = {}) {
       warnings: warningCount
     },
     datedRecords: datedRecords.sort((a, b) => a.primaryDate.localeCompare(b.primaryDate) || byTitle(a, b)),
-    fileGRCRecords: fileGRCRecords.sort((a, b) => a.primaryDate.localeCompare(b.primaryDate) || byTitle(a, b)),
+    filegrcRecords: filegrcRecords.sort((a, b) => a.primaryDate.localeCompare(b.primaryDate) || byTitle(a, b)),
     policies: [...policyIds].map((id) => recordSummary(byId.get(id))).filter(Boolean).sort(byTitle),
     controls: [...controlIds].map((id) => recordSummary(byId.get(id))).filter(Boolean).sort(byTitle),
     obligations,
@@ -557,7 +557,7 @@ async function writeChecksums(output, files) {
 
 function controlMatrixCsv(packet) {
   return csv([
-    ["Control ID", "Code", "Control", "Control Statement", "Operating Activity", "Status", "Effective On", "Frequency", "Operation Mode", "System IDs", "Requirement IDs", "Policy IDs", "Risk IDs", "FileGRC Evidence IDs", "External Evidence IDs", "Control Test IDs", "Test Outcomes", "Population IDs", "Population Counts", "Sample Sizes", "Exception Counts", "Population Evidence IDs", "Sample Evidence IDs"],
+    ["Control ID", "Code", "Control", "Control Statement", "Operating Activity", "Status", "Effective On", "Frequency", "Operation Mode", "System IDs", "Requirement IDs", "Policy IDs", "Risk IDs", "filegrc Evidence IDs", "External Evidence IDs", "Control Test IDs", "Test Outcomes", "Population IDs", "Population Counts", "Sample Sizes", "Exception Counts", "Population Evidence IDs", "Sample Evidence IDs"],
     ...packet.controlCoverage.map((control) => [
       control.id,
       control.code,
@@ -592,15 +592,15 @@ function packetHandlingMarkdown(packet) {
     "",
     `Evidence classifications: ${packet.handling.classifications.join(", ") || "none recorded"}`,
     `External references present: ${packet.handling.containsExternalReferences ? "yes" : "no"}`,
-    "Encrypted by FileGRC: no",
+    "Encrypted by filegrc: no",
     "",
     "Review every included record and attachment for secrets, unnecessary personal data, customer data, and material outside the audit scope before transfer.",
     "",
-    "Review `external-evidence-index.csv` before delivery. It identifies references that FileGRC did not copy. Reconcile those items to the auditor portal or other approved system so the engagement team can confirm it received the same evidence indexed here.",
+    "Review `external-evidence-index.csv` before delivery. It identifies references that filegrc did not copy. Reconcile those items to the auditor portal or other approved system so the engagement team can confirm it received the same evidence indexed here.",
     "",
     "Transfer this directory through the auditor's approved encrypted channel. Do not email an unencrypted packet. Give access only to the engagement team and retain or remove exported copies under the organization's evidence-retention rules.",
     "",
-    "After transfer, enter the packet directory and run `shasum -a 256 -c SHA256SUMS` or `sha256sum -c SHA256SUMS`. FileGRC does not sign or encrypt the packet because those operations require organization-controlled keys and transfer-system choices.",
+    "After transfer, enter the packet directory and run `shasum -a 256 -c SHA256SUMS` or `sha256sum -c SHA256SUMS`. filegrc does not sign or encrypt the packet because those operations require organization-controlled keys and transfer-system choices.",
     ""
   ].join("\n");
 }
@@ -972,7 +972,7 @@ function packetGaps({
     if (controlNeedsExternalEvidence(control, model) && !coverage.evidenceIds.length) {
       gaps.push(gap("error", "control-missing-external-evidence", `${coverage.code || coverage.title} relies on an external system but has no linked External Evidence in the packet.`, coverage.id));
     } else if (!controlNeedsExternalEvidence(control, model) && !coverage.operatingRecordIds.length) {
-      gaps.push(gap("error", "control-missing-filegrc-evidence", `${coverage.code || coverage.title} has no dated FileGRC operating record in the packet.`, coverage.id));
+      gaps.push(gap("error", "control-missing-filegrc-evidence", `${coverage.code || coverage.title} has no dated filegrc operating record in the packet.`, coverage.id));
     }
     if (audit?.auditKind !== "soc-2-type-1" && coverage.status === "implemented" && !coverage.operatingRecordIds.length && coverage.operationMode !== "automated") {
       gaps.push(gap("warning", "control-missing-operating-record", `${coverage.code || coverage.title} has no dated operating record in the packet period.`, coverage.id));
@@ -1523,7 +1523,7 @@ function recordSummary(record) {
 
 function packetMarkdown(packet) {
   const readiness = packet.readiness.status === "delivery-ready"
-    ? "FileGRC management checks passed. The engagement team still determines whether the evidence is sufficient and appropriate."
+    ? "filegrc management checks passed. The engagement team still determines whether the evidence is sufficient and appropriate."
     : `${packet.readiness.errors} errors and ${packet.readiness.warnings} warnings require review. This is a draft packet.`;
   const periodLabel = packet.period.basis === "as-of"
     ? `as of ${packet.period.start}`
@@ -1543,7 +1543,7 @@ function packetMarkdown(packet) {
     "",
     "## Coverage",
     "",
-    `- ${packet.summary.fileGRCRecords} FileGRC Evidence records`,
+    `- ${packet.summary.filegrcRecords} filegrc Evidence records`,
     `- ${packet.summary.obligationOccurrences} recurring obligation occurrences`,
     `- ${packet.summary.eventRuns} event runs`,
     `- ${packet.summary.evidence} External Evidence records`,
@@ -1554,7 +1554,7 @@ function packetMarkdown(packet) {
     `- ${packet.summary.systems} in-scope systems`,
     `- ${packet.summary.sourceSystems} cataloged source systems`,
     "",
-    "Open `index.html` for the auditor-oriented index. `control-matrix.csv` cross-references criteria, controls, FileGRC Evidence, External Evidence, and tests. `source-system-index.csv` identifies the systems of record used to produce External Evidence. `external-evidence-index.csv` lists material that must be delivered or accessed outside this packet. For Type 2, `population-index.csv` records management's population reconciliation and fixed source exports. FileGRC records, governed Markdown, fixed attachments, and committed historical versions are included in their respective directories.",
+    "Open `index.html` for the auditor-oriented index. `control-matrix.csv` cross-references criteria, controls, filegrc Evidence, External Evidence, and tests. `source-system-index.csv` identifies the systems of record used to produce External Evidence. `external-evidence-index.csv` lists material that must be delivered or accessed outside this packet. For Type 2, `population-index.csv` records management's population reconciliation and fixed source exports. filegrc records, governed Markdown, fixed attachments, and committed historical versions are included in their respective directories.",
     "",
     "After transfer, enter the packet directory and run `shasum -a 256 -c SHA256SUMS` or `sha256sum -c SHA256SUMS`. The checksum file covers every other packet file.",
     ""
@@ -1569,7 +1569,7 @@ function packetHtml(packet) {
     : "<p>None.</p>";
   const gaps = packet.gaps.length
     ? `<ul>${packet.gaps.map((item) => `<li class="${item.severity}"><strong>${escapeHtml(item.severity)}</strong> ${escapeHtml(item.message)}</li>`).join("")}</ul>`
-    : "<p>FileGRC management checks passed. The engagement team still evaluates sufficiency and appropriateness.</p>";
+    : "<p>filegrc management checks passed. The engagement team still evaluates sufficiency and appropriateness.</p>";
   const engagementDate = packet.period.basis === "as-of"
     ? `As of ${escapeHtml(packet.period.start)}`
     : `${escapeHtml(packet.period.start)} through ${escapeHtml(packet.period.end)}`;
@@ -1592,25 +1592,25 @@ function packetHtml(packet) {
     ? packet.eventRuns.map((run) => `<article><h3><a href="records/obligation-event/${encodeURIComponent(run.id)}.json">${escapeHtml(run.title)}</a></h3><p>${escapeHtml(run.occurredAt || run.occurredOn)} · ${escapeHtml(run.status)} · ${run.completeCount} of ${run.actions.length} complete</p><table><thead><tr><th>Required action</th><th>Policy cutoff</th><th>Status</th></tr></thead><tbody>${run.actions.map((action) => `<tr><td><a href="records/action-item/${encodeURIComponent(action.actionItemId)}.json">${escapeHtml(action.title)}</a></td><td>${escapeHtml(action.dueWindowEndAt || action.dueWindowEnd)}</td><td>${escapeHtml(action.status)}</td></tr>`).join("")}</tbody></table></article>`).join("")
     : "<p>No event workflows intersect this period.</p>";
   const recordsById = new Map(packet.records.map((record) => [record.id, record]));
-  const fileGRCRecords = packet.fileGRCRecords.length
-    ? `<table><thead><tr><th>Date</th><th>FileGRC record</th><th>Latest committed change</th></tr></thead><tbody>${packet.fileGRCRecords.map((item) => {
+  const filegrcRecords = packet.filegrcRecords.length
+    ? `<table><thead><tr><th>Date</th><th>filegrc record</th><th>Latest committed change</th></tr></thead><tbody>${packet.filegrcRecords.map((item) => {
       const history = recordsById.get(item.id)?.history?.[0];
       const source = history
         ? `${history.timestamp} · ${history.author} · ${history.subject}`
         : "No committed file history";
       return `<tr><td>${escapeHtml(item.primaryDate)}</td><td><a href="records/${encodeURIComponent(item.type)}/${encodeURIComponent(item.id)}.json">${escapeHtml(item.title)}</a><br><small>${escapeHtml(item.type)}</small></td><td>${escapeHtml(source)}</td></tr>`;
     }).join("")}</tbody></table>`
-    : "<p>No FileGRC Evidence records matched this period.</p>";
+    : "<p>No filegrc Evidence records matched this period.</p>";
   const controlCoverage = packet.controlCoverage.length
-    ? `<p><a href="control-matrix.csv">Download control matrix CSV</a></p><table><thead><tr><th>Control</th><th>Status and scope</th><th>Criteria</th><th>FileGRC Evidence</th><th>External Evidence</th><th>Tests</th></tr></thead><tbody>${packet.controlCoverage.map((control) => `<tr><td><a href="records/control/${encodeURIComponent(control.id)}.json">${escapeHtml(control.code || control.id)}</a><small>${escapeHtml(control.title)}</small></td><td>${escapeHtml(control.status)}<small>${control.systemIds.map(escapeHtml).join(", ") || "No system scope"}</small></td><td>${control.requirementIds.map(escapeHtml).join("<br>") || "None"}</td><td>${control.operatingRecordIds.length}</td><td>${control.evidenceIds.length}</td><td>${control.tests.length}</td></tr>`).join("")}</tbody></table>`
+    ? `<p><a href="control-matrix.csv">Download control matrix CSV</a></p><table><thead><tr><th>Control</th><th>Status and scope</th><th>Criteria</th><th>filegrc Evidence</th><th>External Evidence</th><th>Tests</th></tr></thead><tbody>${packet.controlCoverage.map((control) => `<tr><td><a href="records/control/${encodeURIComponent(control.id)}.json">${escapeHtml(control.code || control.id)}</a><small>${escapeHtml(control.title)}</small></td><td>${escapeHtml(control.status)}<small>${control.systemIds.map(escapeHtml).join(", ") || "No system scope"}</small></td><td>${control.requirementIds.map(escapeHtml).join("<br>") || "None"}</td><td>${control.operatingRecordIds.length}</td><td>${control.evidenceIds.length}</td><td>${control.tests.length}</td></tr>`).join("")}</tbody></table>`
     : "<p>No controls were selected.</p>";
-  const readinessLabel = packet.readiness.status === "delivery-ready" ? "FileGRC management checks passed" : "Draft, do not deliver";
+  const readinessLabel = packet.readiness.status === "delivery-ready" ? "filegrc management checks passed" : "Draft, do not deliver";
   const packetDate = packet.period.basis === "as-of"
     ? `As of ${escapeHtml(packet.period.start)}`
     : `${escapeHtml(packet.period.start)} through ${escapeHtml(packet.period.end)}`;
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Evidence packet</title><style>
 body{font:14px/1.5 system-ui,sans-serif;color:#161825;max-width:1120px;margin:auto;padding:40px;background:#f7f8fc}header,section{background:#fff;border:1px solid #dfe3ef;border-radius:10px;padding:24px;margin:14px 0}h1,h2{margin-top:0}h1{font-size:26px}h2{font-size:17px}ul{padding-left:20px}li{margin:8px 0}small{display:block;color:#656c7e}.attachment{margin-right:10px;font-size:12px}.error{color:#8a2f28}.warning{color:#76500d}.readiness{display:inline-block;padding:5px 9px;border-radius:999px;background:#f7e4e2;color:#7a2520;font-weight:700}.readiness.ready{background:#e2f1e8;color:#245d3b}table{width:100%;border-collapse:collapse}th,td{padding:9px;border:1px solid #dfe3ef;text-align:left;vertical-align:top}code{overflow-wrap:anywhere}dl{display:grid;grid-template-columns:max-content 1fr;gap:8px 16px}dt{font-weight:700}dd{margin:0}
-</style></head><body><header><p>SOC 2 evidence packet</p><span class="readiness ${packet.readiness.status === "delivery-ready" ? "ready" : ""}">${escapeHtml(readinessLabel)}</span><h1>${packetDate}</h1><p>${escapeHtml(packet.workspace.organizationName)} · revision <code>${escapeHtml(packet.revision.commit || "uncommitted")}</code></p></header>${section("Engagement scope", engagement)}${section("Review status", gaps)}${section("Control coverage", controlCoverage)}${section("Systems of record", sourceSystems)}${packet.period.basis === "period" ? section("Management population reconciliation", populations) : ""}${packet.period.basis === "period" ? section("Recurring obligation coverage", obligations) : ""}${packet.period.basis === "period" ? section("Event workflow coverage", eventRuns) : ""}${section("Policies", links(packet.policies))}${section("FileGRC Evidence", fileGRCRecords)}${section("External Evidence", evidence)}${section("Integrity and history", "<p>Verify all transferred files with <code>SHA256SUMS</code>. Committed prior versions are under <code>history/</code> with an index that records their source paths and Git metadata.</p>")}</body></html>`;
+</style></head><body><header><p>SOC 2 evidence packet</p><span class="readiness ${packet.readiness.status === "delivery-ready" ? "ready" : ""}">${escapeHtml(readinessLabel)}</span><h1>${packetDate}</h1><p>${escapeHtml(packet.workspace.organizationName)} · revision <code>${escapeHtml(packet.revision.commit || "uncommitted")}</code></p></header>${section("Engagement scope", engagement)}${section("Review status", gaps)}${section("Control coverage", controlCoverage)}${section("Systems of record", sourceSystems)}${packet.period.basis === "period" ? section("Management population reconciliation", populations) : ""}${packet.period.basis === "period" ? section("Recurring obligation coverage", obligations) : ""}${packet.period.basis === "period" ? section("Event workflow coverage", eventRuns) : ""}${section("Policies", links(packet.policies))}${section("filegrc Evidence", filegrcRecords)}${section("External Evidence", evidence)}${section("Integrity and history", "<p>Verify all transferred files with <code>SHA256SUMS</code>. Committed prior versions are under <code>history/</code> with an index that records their source paths and Git metadata.</p>")}</body></html>`;
 }
 
 async function writePacketFile(output, relativePath, source, files) {

package/src/git.js

@@ -227,7 +227,7 @@ async function pushWorkspaceUnlocked(root) {
 
 function syncReadySummary(root, action) {
   const summary = getGitSummary(root);
-  if (!summary.available) throw new Error(`Git history is unavailable for this workspace, so FileGRC cannot ${action}.`);
+  if (!summary.available) throw new Error(`Git history is unavailable for this workspace, so filegrc cannot ${action}.`);
   if (!summary.branch) throw new Error(`Check out a branch before trying to ${action}.`);
   if (!summary.clean) throw new Error(`Commit or discard workspace changes before trying to ${action}.`);
   return summary;

package/src/index.js

@@ -50,8 +50,8 @@ export {
   nextCalendarOccurrence
 } from "./recurrence.js";
 export { searchResources, searchableValues } from "./search.js";
-export { createFileGRCServer, serveWorkspace } from "./server.js";
-export { normalizeSetupPayload, setupWorkspace } from "./setup.js";
+export { createFilegrcServer, serveWorkspace } from "./server.js";
+export { normalizeSetupPayload, planWorkspaceSetup, setupWorkspace, summarizeSetupResult } from "./setup.js";
 export { createAppState } from "./state.js";
 export { currentCalendarDate, formatCalendarDate, formatLocalDateTime } from "./time.js";
 export { validateWorkspace } from "./validate.js";

package/src/model-docs.js

@@ -67,7 +67,7 @@ export function generateModelDocumentation(model) {
     "",
     ...model.evidenceSourceFamilies.map((item) => (
       item.collectionTestRequired === false
-        ? `- **${item.title}** (${item.sourceKinds.map((kind) => `\`${kind}\``).join(", ")}): ${item.description} FileGRC operating records: ${item.operationRecordTypes.map((type) => `\`${type}\``).join(", ")}. No separate collection test is required. ${item.timing}`
+        ? `- **${item.title}** (${item.sourceKinds.map((kind) => `\`${kind}\``).join(", ")}): ${item.description} filegrc operating records: ${item.operationRecordTypes.map((type) => `\`${type}\``).join(", ")}. No separate collection test is required. ${item.timing}`
         : `- **${item.title}** (${item.sourceKinds.map((kind) => `\`${kind}\``).join(", ")}): ${item.description} Test external collection: ${item.testPrompt} ${item.timing}`
     )),
     "",

package/src/parties.js

@@ -0,0 +1,46 @@
+const CURRENT_PERSON_STATUSES = new Set(["active", "external"]);
+const CURRENT_TEAM_STATUSES = new Set(["active"]);
+
+export function partyPeople(ids = [], byId, options = {}, seen = new Set()) {
+  const people = new Set();
+  for (const id of ids) {
+    if (seen.has(id)) continue;
+    seen.add(id);
+    const record = byId.get(id);
+    if (
+      record?.type === "person"
+      && (!options.personStatuses || options.personStatuses.has(record.status))
+    ) {
+      people.add(id);
+    }
+    if (
+      record?.type === "team"
+      && (!options.teamStatuses || options.teamStatuses.has(record.status))
+    ) {
+      for (const personId of partyPeople(
+        [...(record.memberIds || []), ...(record.chairIds || [])],
+        byId,
+        options,
+        seen
+      )) {
+        people.add(personId);
+      }
+    }
+  }
+  return people;
+}
+
+export function currentPartyPeople(ids = [], byId) {
+  return partyPeople(ids, byId, {
+    personStatuses: CURRENT_PERSON_STATUSES,
+    teamStatuses: CURRENT_TEAM_STATUSES
+  });
+}
+
+export function partiesIndependent(ownerIds = [], approverIds = [], byId) {
+  const owners = partyPeople(ownerIds, byId);
+  const approvers = partyPeople(approverIds, byId);
+  return owners.size > 0
+    && approvers.size > 0
+    && ![...owners].some((id) => approvers.has(id));
+}

package/src/paths.js

@@ -15,7 +15,7 @@ export function resolveWorkspaceRoot(input = process.cwd()) {
     current = parent;
   }
 
-  throw new Error("No FileGRC workspace was found from the requested path.");
+  throw new Error("No filegrc workspace was found from the requested path.");
 }
 
 export function isWithin(parent, candidate) {

package/src/program-lifecycle.js

@@ -1,4 +1,7 @@
+import { currentPartyPeople } from "./parties.js";
+
 export function obligationProgramStatus(obligation, byId, asOf) {
+  if (currentPartyPeople(obligation.ownerIds || [], byId).size === 0) return "proposed";
   const policyIds = obligation.policyIds || [];
   const policiesReady = policyIds.every((id) => {
     const policy = byId.get(id);