filegrc 0.2.0 → 0.3.1

package/src/program-path.js

@@ -1,5 +1,5 @@
 export const RESOURCE_INSTRUCTIONS = {
-  person: "Confirm the people who will own, approve, review, or operate the program. Replace the starter names and contact details with the organization’s actual people.",
+  person: "Confirm the policy owner created during setup, then add the actual people who will approve, review, or operate the program.",
   team: "Review the starter Security and Risk Oversight team, including its members and chair. Add another team only when the organization assigns shared responsibility to it.",
   system: "Catalog all in-scope systems for the program. Treat anything that operates a control or produces evidence as a System, including software provided by a vendor (like HR software).",
   vendor: "Catalog the companies that provide in-scope software or services. Link each vendor-provided System to the company that provides it.",
@@ -14,7 +14,7 @@ export const RESOURCE_INSTRUCTIONS = {
   "risk-assessment": "Complete and approve an assessment of the risks to the in-scope service, systems, vendors, and commitments.",
   risk: "Record each risk identified by an assessment or operating activity. Assign an owner, rate it, and document the chosen response.",
   obligation: "Review the recurring work proposed by effective policies. Confirm who owns it, when it is due, and what proof completion requires.",
-  "obligation-event": "When a policy-triggering event occurs, record it here and complete the actions FileGRC creates for it.",
+  "obligation-event": "When a policy-triggering event occurs, record it here and complete the actions filegrc creates for it.",
   "policy-review": "Record scheduled and change-driven reviews of policies and governed documents, including the decision and any follow-up.",
   meeting: "Record required oversight meetings, including attendees, decisions, minutes, and follow-up work.",
   exception: "Record and approve any time-limited departure from a policy or control before the departure begins.",
@@ -64,13 +64,13 @@ export const PROGRAM_PATH = [
     description: "Ownership, criteria, and service boundary",
     summary: "Confirm the people and teams responsible for the program, set the management goal, review the criteria and customer commitments in scope, then define the customer-facing service, supporting systems, and supplier dependencies.",
     sections: [
-      { id: "ownership", title: "Program Ownership", description: "Confirm the people and teams that own, approve, review, and operate the program.", steps: ["Replace the starter people with the organization’s actual owners and reviewers.", "Review the starter Security and Risk Oversight team, its members, and its chair.", "Add other teams only when the organization assigns shared responsibility to them."], types: ["person", "team"], defaultOpen: true },
+      { id: "ownership", title: "Program Ownership", description: "Confirm the people and teams that own, approve, review, and operate the program.", steps: ["Confirm the policy owner created during setup, then add the organization’s actual reviewers and operators.", "Review the starter Security and Risk Oversight team, its members, and its chair.", "Add other teams only when the organization assigns shared responsibility to them."], types: ["person", "team"], defaultOpen: true },
       { id: "criteria", title: "Criteria", description: "Confirm the criteria used for the program, resolve whether each requirement applies, and record customer commitments that shape the service or control design.", steps: ["Review the included Security criteria references.", "Mark each requirement applicable or not applicable with a rationale.", "Record customer commitments and keep optional criteria out until management deliberately adds them."], types: ["framework", "requirement", "commitment"], defaultOpen: true },
       { id: "boundary", title: "Service Boundary", description: "Record the service and its supporting technology and providers. An application or platform is a System because it operates controls or produces evidence; the company providing it is a Vendor because contracts, due diligence, and supplier risk belong to that relationship.", steps: ["Create a Vendor record for each material provider.", "Create System records for the customer-facing service and each supporting application, platform, or internal system that is in scope or produces evidence, then connect vendor-provided Systems to their providers.", "Assign owners, classification, dependencies, and a clear in-scope decision to each System, and keep supplier reviews with the Vendor."], types: ["vendor", "system"], defaultOpen: false }
     ],
     resourceTypes: ["person", "team", "framework", "requirement", "commitment", "vendor", "system"],
     commands: [
-      "filegrc setup --help",
+      "filegrc setup",
       "filegrc guide person --json",
       "filegrc guide system --json",
       "filegrc list system --json"
@@ -99,7 +99,7 @@ export const PROGRAM_PATH = [
     description: "Tailor and finish the starter control set",
     summary: "Review the starter catalog against the scoped service, then give every applicable internal control an actual procedure, owner, system scope, cadence, policy and criteria mappings, authoritative evidence source, and implementation date. Mark it implemented only after the procedure is operating, then record any controls that customers or carved-out providers must perform.",
     sections: [
-      { id: "catalog", title: "Control Catalog", description: "Finish the starter controls, record applicable complementary controls, and see whether FileGRC tracks operation through Work Queue or evidence records.", steps: ["Open every planned control and confirm its mappings and suggested frequency.", "Write the real procedure in Record Markdown and add system scope and evidence sources.", "Record any required customer or carved-out provider controls as Complementary Controls."], types: ["control", "complementary-control"], defaultOpen: true }
+      { id: "catalog", title: "Control Catalog", description: "Finish the starter controls, record applicable complementary controls, and see whether filegrc tracks operation through Work Queue or evidence records.", steps: ["Open every planned control and confirm its mappings and suggested frequency.", "Write the real procedure in Record Markdown and add system scope and evidence sources.", "Record any required customer or carved-out provider controls as Complementary Controls."], types: ["control", "complementary-control"], defaultOpen: true }
     ],
     resourceTypes: ["control", "complementary-control"],
     commands: [
@@ -119,7 +119,7 @@ export const PROGRAM_PATH = [
     ],
     resourceTypes: ["evidence"],
     commands: [
-      "filegrc evidence-test-drafts --json",
+      "filegrc evidence-test-drafts --preview --json",
       "filegrc guide evidence --json",
       "filegrc list evidence --json",
       "filegrc program-readiness --json"
@@ -170,7 +170,7 @@ export const PROGRAM_PATH = [
       {
         id: "policy-events",
         title: "Policy Events",
-        instructions: "Trigger the matching workflow when an event occurs. FileGRC adds every required action to the Work Queue with its owner and deadline.",
+        instructions: "Trigger the matching workflow when an event occurs. filegrc adds every required action to the Work Queue with its owner and deadline.",
         use: "Preview the full workflow before triggering it, then create the event and every linked task in one validated write.",
         policyBasis: "Active event obligations translate policy-triggering changes into owned, deadline-bound Action Items. Proposed workflows remain unavailable until their governing policies and linked controls are ready.",
         commands: ["filegrc obligations --json", "filegrc trigger EVENT_TYPE (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) --subject RESOURCE_ID --json"]
@@ -201,14 +201,14 @@ export const PROGRAM_PATH = [
     summary: "After the program is collecting reliable evidence, create an Audit record for the real CPA engagement, keep the firm-agreed report period separate from management’s candidate dates, complete management documents, populations, requests, evidence delivery, and fieldwork, then preserve the findings, responses, opinion, and final report.",
     sections: [
       { id: "engagement", title: "Engagement", description: "Record the actual CPA engagement, formal scope and dates, requests, and management responses.", steps: ["Create the Audit after the CPA firm is engaged.", "Record the firm-agreed type, scope, systems, criteria, and dates.", "Track incoming requests and approved response material."], types: ["audit", "audit-request"], defaultOpen: true },
-      { id: "fieldwork", title: "Fieldwork", description: "Prepare management documents, reconcile Type 2 populations, review both evidence paths, support testing, and build the indexed packet.", steps: ["Initialize engagement-specific management documents and populations.", "Review dated FileGRC Evidence and verified External Evidence for the formal period.", "Reconcile complete populations, link samples, and resolve fieldwork requests and findings.", "Build the packet from a clean Git revision; it includes FileGRC records, Markdown, External Evidence, attachments, indexes, history, and checksums."], types: ["audit-population", "control-test"], utility: "audit-packet", defaultOpen: true }
+      { id: "fieldwork", title: "Fieldwork", description: "Prepare management documents, reconcile Type 2 populations, review both evidence paths, support testing, and build the indexed packet.", steps: ["Initialize engagement-specific management documents and populations.", "Review dated filegrc Evidence and verified External Evidence for the formal period.", "Reconcile complete populations, link samples, and resolve fieldwork requests and findings.", "Build the packet from a clean Git revision; it includes filegrc records, Markdown, External Evidence, attachments, indexes, history, and checksums."], types: ["audit-population", "control-test"], utility: "audit-packet", defaultOpen: true }
     ],
     resourceTypes: ["audit", "audit-request", "audit-population", "control-test"],
     utilities: [
       {
         id: "audit-packet",
         title: "Audit Evidence & Packet",
-        instructions: "Review FileGRC Evidence and External Evidence for the formal period, complete engagement preparation, and build the indexed audit packet.",
+        instructions: "Review filegrc Evidence and External Evidence for the formal period, complete engagement preparation, and build the indexed audit packet.",
         use: "Prepare management documents and populations, answer fieldwork requests, review both evidence paths, and compile a delivery bound to a clean Git revision.",
         policyBasis: "Management prepares the scoped records, evidence, populations, assertions, and responses. The CPA firm selects samples, evaluates evidence and exceptions, and issues the report.",
         commands: ["filegrc audit-readiness AUDIT_ID --json", "filegrc evidence-packet --audit AUDIT_ID --preview --json"]

package/src/program-readiness.js

@@ -2,6 +2,7 @@ import { readFile } from "node:fs/promises";
 import { planObligations } from "./obligations.js";
 import { resolveDataPath } from "./paths.js";
 import { obligationIsRunning } from "./program-lifecycle.js";
+import { currentPartyPeople, partiesIndependent, partyPeople } from "./parties.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { currentCalendarDate } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
@@ -33,7 +34,7 @@ export async function assessProgramReadiness(input, options = {}) {
     [...sourceStage.items, ...collectionStage.items]
   );
   const evidenceGateStages = [
-    scopeStage(workspace, scope, records),
+    scopeStage(workspace, scope, records, byId),
     await policiesStage(scope, byId, readMarkdown, asOf),
     await controlsStage(scope, byId, readMarkdown, asOf),
     evidenceStage
@@ -116,7 +117,7 @@ function programScope(workspace, records, byId) {
   };
 }
 
-function scopeStage(workspace, scope, records) {
+function scopeStage(workspace, scope, records, byId) {
   const items = [];
   const goal = workspace?.assuranceGoal || "none";
   items.push(item(
@@ -129,6 +130,8 @@ function scopeStage(workspace, scope, records) {
     workspace || { type: "workspace" }
   ));
 
+  items.push(programOwnershipItem(records, byId));
+
   const completeSystems = scope.systems.filter((system) => (
     system.status === "active"
     && system.inScope === true
@@ -175,7 +178,75 @@ function scopeStage(workspace, scope, records) {
     workspace || { type: "workspace" }
   ));
 
-  return stage("scope", "Define Scope", "Set the management objective, service boundary, criteria, controls, and dependencies.", items);
+  return stage("scope", "Define Scope", "Set program ownership, the management objective, service boundary, criteria, controls, and dependencies.", items);
+}
+
+function programOwnershipItem(records, byId) {
+  const ownedRecords = records.filter((record) => (
+    ["policy", "control", "obligation"].includes(record.type)
+    && !["retired", "superseded", "not-applicable"].includes(record.status)
+  ));
+  const unresolved = ownedRecords.filter((record) => currentPartyPeople(record.ownerIds, byId).size === 0);
+  const currentOwners = new Set(ownedRecords.flatMap((record) => [...currentPartyPeople(record.ownerIds, byId)]));
+  const oversight = byId.get("team-security-risk-oversight");
+  const policyOwnerIds = new Set(records
+    .filter((record) => record.type === "policy" && !["retired", "superseded"].includes(record.status))
+    .flatMap((record) => [...partyPeople(record.ownerIds || [], byId)]));
+  const oversightChairs = oversight?.type === "team"
+    ? currentPartyPeople(oversight.chairIds || [], byId)
+    : new Set();
+  const oversightComplete = !oversight || (
+    oversight.type === "team"
+    && oversight.status === "active"
+    && currentPartyPeople(oversight.memberIds || [], byId).size > 0
+    && oversightChairs.size > 0
+    && ![...oversightChairs].some((id) => policyOwnerIds.has(id))
+  );
+  const complete = currentOwners.size > 0 && unresolved.length === 0 && oversightComplete;
+  const unresolvedAssignments = unresolved.map((record) => ({
+    resourceType: record.type,
+    resourceId: record.id,
+    title: record.title,
+    ownerIds: record.ownerIds || [],
+    reasons: ownershipResolutionReasons(record.ownerIds || [], byId)
+  }));
+  const detail = [];
+  if (!currentOwners.size) detail.push("No current person owns the program records.");
+  if (unresolved.length) {
+    detail.push(
+      `${unresolved.length} ${unresolved.length === 1 ? "record has" : "records have"} no current person owner: ` +
+      `${unresolvedAssignments.map(({ title, resourceId }) => `${title} (${resourceId})`).join(", ")}.`
+    );
+  }
+  if (!oversightComplete) detail.push("Finish and activate Security and Risk Oversight with a current chair who is separate from policy ownership.");
+  return item(
+    "program-ownership",
+    complete ? "complete" : "action",
+    "Confirm program owners and oversight",
+    complete
+      ? `${currentOwners.size} current ${currentOwners.size === 1 ? "person owns" : "people own"} the program records.${oversight ? " Security and Risk Oversight has a separate current chair." : ""}`
+      : detail.join(" "),
+    !oversightComplete ? oversight : unresolved[0] || { type: "person" },
+    { unresolvedAssignments }
+  );
+}
+
+function ownershipResolutionReasons(ownerIds, byId) {
+  if (!ownerIds.length) return [{ ownerId: null, reason: "missing-owner" }];
+  return ownerIds.flatMap((ownerId) => {
+    const owner = byId.get(ownerId);
+    if (!owner) return [{ ownerId, reason: "missing-record" }];
+    if (owner.type === "person" && owner.status !== "active") {
+      return [{ ownerId, reason: "inactive-person" }];
+    }
+    if (owner.type === "team" && owner.status !== "active") {
+      return [{ ownerId, reason: "inactive-team" }];
+    }
+    if (currentPartyPeople([ownerId], byId).size === 0) {
+      return [{ ownerId, reason: owner.type === "team" ? "team-has-no-current-members" : "no-current-person" }];
+    }
+    return [];
+  });
 }
 
 async function policiesStage(scope, byId, readMarkdown, asOf) {
@@ -183,14 +254,11 @@ async function policiesStage(scope, byId, readMarkdown, asOf) {
   const policies = [...linkedPolicyIds].map((id) => byId.get(id)).filter((record) => (
     record?.type === "policy" && !["superseded", "retired"].includes(record.status)
   ));
-  const approvers = policies.flatMap((policy) => partyPeople(policy.approverIds || [], byId))
+  const appointedReviewer = policies
+    .filter((policy) => partiesIndependent(policy.ownerIds, policy.approverIds, byId))
+    .flatMap((policy) => [...currentPartyPeople(policy.approverIds || [], byId)])
     .map((id) => byId.get(id))
-    .filter(Boolean);
-  const appointedReviewer = approvers.find((person) => (
-    ["active", "external"].includes(person.status)
-    && person.email
-    && !(person.id === "person-independent-approver" && ["Independent Approver", "Independent Reviewer"].includes(person.title))
-  ));
+    .find(Boolean);
   const items = [
     item(
       "independent-reviewer",
@@ -199,7 +267,7 @@ async function policiesStage(scope, byId, readMarkdown, asOf) {
       appointedReviewer
         ? `${appointedReviewer.title} is recorded as a reviewer separate from policy ownership.`
         : "Appoint a reviewer who is separate from the policy owner. The reviewer may be another person in the organization or an external person, and is separate from the CPA firm that may later perform the audit.",
-      appointedReviewer || { type: "person", id: "person-independent-approver" }
+      appointedReviewer || { type: "person" }
     )
   ];
   if (!policies.length) {
@@ -355,7 +423,7 @@ function evidenceCollectionStage(scope, records, byId, model) {
           ? `${capture.title} is a draft. Open it, select the authoritative source System, collect the named artifact, and have another person verify it.`
           : capture
             ? `${capture.title} is ${capture.status} but must be verified before this family is ready.`
-          : `Run and verify one test export or test capture from an authoritative source outside FileGRC, then link it to a family control.`,
+          : `Run and verify one test export or test capture from an authoritative source outside filegrc, then link it to a family control.`,
       capture || { type: "evidence" },
       {
         familyId: family.id,
@@ -549,26 +617,6 @@ function substantiveMarkdown(source) {
   return (source.match(/[\p{L}\p{N}][\p{L}\p{N}'’-]*/gu) || []).length >= 10;
 }
 
-function partiesIndependent(ownerIds = [], approverIds = [], byId) {
-  const owners = new Set(partyPeople(ownerIds, byId));
-  const approvers = partyPeople(approverIds, byId);
-  return owners.size > 0 && approvers.length > 0 && !approvers.some((id) => owners.has(id));
-}
-
-function partyPeople(ids = [], byId, seen = new Set()) {
-  const people = [];
-  for (const id of ids) {
-    if (seen.has(id)) continue;
-    seen.add(id);
-    const record = byId.get(id);
-    if (record?.type === "person") people.push(id);
-    if (record?.type === "team") {
-      people.push(...partyPeople([...(record.memberIds || []), ...(record.chairIds || [])], byId, seen));
-    }
-  }
-  return [...new Set(people)];
-}
-
 function policyCheckLabel(name) {
   return ({
     reviewed: "draft review",

package/src/server.js

@@ -15,7 +15,7 @@ import { setupWorkspace } from "./setup.js";
 import { loadWorkspace } from "./workspace.js";
 import { APP_SCRIPT, APP_STYLES, renderIndex } from "./web.js";
 
-export function createFileGRCServer(input = process.cwd(), options = {}) {
+export function createFilegrcServer(input = process.cwd(), options = {}) {
   return createHttpServer(async (request, response) => {
     try {
       if (!expectedHost(request, options.allowedHosts)) {
@@ -184,7 +184,7 @@ export async function serveWorkspace(input = process.cwd(), options = {}) {
   }
   const loaded = await loadWorkspace(input);
   getResourceDefinition(loaded.model, "workspace");
-  const server = createFileGRCServer(loaded.root, { allowedHosts: [host] });
+  const server = createFilegrcServer(loaded.root, { allowedHosts: [host] });
   await new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen(port, host, resolve);

package/src/setup.js

@@ -1,5 +1,4 @@
 import { createResource, updateResource } from "./files.js";
-import { ensureEvidenceTestDrafts } from "./evidence-tests.js";
 import { createResourceId } from "./id.js";
 import { loadWorkspace } from "./workspace.js";
 
@@ -10,81 +9,61 @@ export async function setupWorkspace(input = process.cwd(), payload = {}) {
   const loaded = await loadWorkspace(input);
   const setup = normalizeSetupPayload(payload);
   validateSetup(loaded, setup);
+  const plan = buildSetupRecords(loaded, setup);
 
-  let current = loaded;
-  let system = findSetupSystem(current.resources, setup);
-  const systemId = system?.id || createResourceId("system", setup.serviceName, current.resources.map(({ id }) => id));
-  system = {
-    ...(system || {}),
-    schemaVersion: 1,
-    id: systemId,
-    type: "system",
-    title: setup.serviceName,
-    status: setup.draft ? system?.status || "planned" : (system?.status === "planned" ? "active" : system?.status || "active"),
-    criticality: setup.criticality,
-    ownerIds: [setup.ownerId],
-    description: setup.boundary,
-    systemKind: system?.systemKind || "service",
-    dataClassification: setup.dataClassification,
-    internetExposed: setup.internetExposed,
-    inScope: true
-  };
-  await upsertResource(current.root, current.resources.find(({ id }) => id === systemId), system);
-
-  current = await loadWorkspace(current.root);
-  const linkedControlIds = [];
-  for (const control of current.resources.filter(({ type, status }) => (
-    type === "control" && !["not-applicable", "retired"].includes(status)
-  ))) {
-    if ((control.systemIds || []).includes(systemId)) continue;
-    await updateResource(current.root, "control", control.id, {
-      ...control,
-      systemIds: [...new Set([...(control.systemIds || []), systemId])]
-    });
-    linkedControlIds.push(control.id);
-  }
+  await upsertResource(loaded.root, plan.existingSystem, plan.system);
+  await updateResource(loaded.root, "workspace", plan.workspace.id, plan.workspace);
+  if (plan.renderer) await updateResource(loaded.root, plan.renderer.type, plan.renderer.id, plan.renderer);
 
-  current = await loadWorkspace(current.root);
-  const existingWorkspace = current.resources.find(({ type }) => type === "workspace");
-  if (!existingWorkspace) throw new Error("The workspace settings record was not found.");
-  const workspace = {
-    ...existingWorkspace,
-    assuranceGoal: assuranceGoalFromSetup(setup.programGoal),
-    frameworkIds: current.resources
-      .filter(({ type, status }) => type === "framework" && status === "active")
-      .map(({ id }) => id),
-    requirementIds: current.resources
-      .filter(({ type, applicability }) => type === "requirement" && applicability === "applicable")
-      .map(({ id }) => id),
-    controlIds: current.resources
-      .filter(({ type, status }) => type === "control" && !["not-applicable", "retired"].includes(status))
-      .map(({ id }) => id),
-    systemIds: [...new Set([...(existingWorkspace.systemIds || []), systemId])]
+  return {
+    draft: setup.draft,
+    system: plan.system,
+    workspace: plan.workspace,
+    linkedControlIds: [],
+    evidenceTestDraftIds: [],
+    onboardingComplete: !setup.draft
   };
-  await updateResource(current.root, "workspace", workspace.id, workspace);
-
-  current = await loadWorkspace(current.root);
-  const renderer = current.resources.find(({ type }) => type === "renderer-settings");
-  if (renderer) {
-    await updateResource(current.root, renderer.type, renderer.id, {
-      ...renderer,
-      showOnboarding: setup.draft
-    });
-  }
-  const evidenceTestDrafts = setup.draft
-    ? { created: [], existing: [], total: 0 }
-    : await ensureEvidenceTestDrafts(current.root);
+}
 
+export async function planWorkspaceSetup(input = process.cwd(), payload = {}) {
+  const loaded = await loadWorkspace(input);
+  const setup = normalizeSetupPayload(payload);
+  validateSetup(loaded, setup);
+  const plan = buildSetupRecords(loaded, setup);
   return {
+    schemaVersion: 1,
+    preview: true,
     draft: setup.draft,
-    system,
-    workspace,
-    linkedControlIds,
-    evidenceTestDraftIds: evidenceTestDrafts.created.map(({ id }) => id),
+    changes: {
+      system: plan.existingSystem ? "update" : "create",
+      workspace: "update",
+      renderer: plan.renderer ? "update" : "unchanged",
+      controls: 0,
+      evidenceDrafts: 0
+    },
+    system: setupSystemSummary(plan.system),
+    target: setupTargetSummary(plan.workspace),
     onboardingComplete: !setup.draft
   };
 }
 
+export function summarizeSetupResult(result) {
+  return {
+    schemaVersion: 1,
+    preview: false,
+    draft: result.draft,
+    changes: {
+      system: "saved",
+      workspace: "updated",
+      controls: result.linkedControlIds?.length || 0,
+      evidenceDrafts: result.evidenceTestDraftIds?.length || 0
+    },
+    system: setupSystemSummary(result.system),
+    target: setupTargetSummary(result.workspace),
+    onboardingComplete: result.onboardingComplete
+  };
+}
+
 export function normalizeSetupPayload(payload = {}) {
   if (!payload || Array.isArray(payload) || typeof payload !== "object") {
     throw new Error("Setup input must be a JSON object.");
@@ -146,6 +125,44 @@ function findSetupSystem(resources, setup) {
     ));
 }
 
+function buildSetupRecords(loaded, setup) {
+  const existingSystem = findSetupSystem(loaded.resources, setup);
+  const systemId = existingSystem?.id || createResourceId(
+    "system",
+    setup.serviceName,
+    loaded.resources.map(({ id }) => id)
+  );
+  const system = {
+    ...(existingSystem || {}),
+    schemaVersion: 1,
+    id: systemId,
+    type: "system",
+    title: setup.serviceName,
+    status: setup.draft
+      ? existingSystem?.status || "planned"
+      : existingSystem?.status === "planned"
+        ? "active"
+        : existingSystem?.status || "active",
+    criticality: setup.criticality,
+    ownerIds: [setup.ownerId],
+    description: setup.boundary,
+    systemKind: existingSystem?.systemKind || "service",
+    dataClassification: setup.dataClassification,
+    internetExposed: setup.internetExposed,
+    inScope: true
+  };
+  const existingWorkspace = loaded.resources.find(({ type }) => type === "workspace");
+  if (!existingWorkspace) throw new Error("The workspace settings record was not found.");
+  const workspace = {
+    ...existingWorkspace,
+    assuranceGoal: assuranceGoalFromSetup(setup.programGoal),
+    systemIds: [...new Set([...(existingWorkspace.systemIds || []), systemId])]
+  };
+  const existingRenderer = loaded.resources.find(({ type }) => type === "renderer-settings");
+  const renderer = existingRenderer ? { ...existingRenderer, showOnboarding: setup.draft } : null;
+  return { existingSystem, system, workspace, renderer };
+}
+
 async function upsertResource(root, existing, record) {
   return existing
     ? updateResource(root, record.type, record.id, record)
@@ -159,6 +176,27 @@ function assuranceGoalFromSetup(goal) {
   return "none";
 }
 
+function setupSystemSummary(system) {
+  return {
+    id: system.id,
+    title: system.title,
+    status: system.status,
+    inScope: system.inScope
+  };
+}
+
+function setupTargetSummary(workspace) {
+  return {
+    assuranceGoal: workspace.assuranceGoal,
+    scopeCounts: {
+      systems: workspace.systemIds?.length || 0,
+      frameworks: workspace.frameworkIds?.length || 0,
+      requirements: workspace.requirementIds?.length || 0,
+      controls: workspace.controlIds?.length || 0
+    }
+  };
+}
+
 function booleanValue(value, name) {
   if (value === true || value === false) return value;
   if (value === "true") return true;

package/src/state.js

@@ -47,7 +47,7 @@ export async function createAppState(input = process.cwd(), options = {}) {
     dataModelVersion: loaded.model.modelVersion,
     id: "workspace",
     type: "workspace",
-    title: "FileGRC workspace",
+    title: "filegrc workspace",
     organizationName: "Workspace configuration unavailable",
     timezone: "UTC"
   };

package/src/validate.js

@@ -3,6 +3,7 @@ import { getResourceDefinition } from "../model/index.js";
 import { isCanonicalDataPath, resolveDataPath } from "./paths.js";
 import { parseCalendarDate, validCalendarRecurrence } from "./recurrence.js";
 import { obligationIsRunning } from "./program-lifecycle.js";
+import { partyPeople } from "./parties.js";
 import { isMarkdownChoice, markdownEntries } from "./resource-markdown.js";
 import { currentCalendarDate, isRfc3339Timestamp } from "./time.js";
 import { indexResources, loadWorkspace } from "./workspace.js";
@@ -223,9 +224,10 @@ function validateEvidencePaths(record, path, diagnostics) {
 }
 
 function validateIndependentApproval(record, byId, path, diagnostics) {
-  if (!["policy", "document"].includes(record.type) || !(record.approverIds || []).length) return;
-  const owners = expandPeople(record.ownerIds || [], byId);
-  const approvers = expandPeople(record.approverIds || [], byId);
+  if (!["policy", "document"].includes(record.type)) return;
+  if (!(record.approverIds || []).length) return;
+  const owners = partyPeople(record.ownerIds || [], byId);
+  const approvers = partyPeople(record.approverIds || [], byId);
   const overlap = [...owners].filter((id) => approvers.has(id));
   if (overlap.length) {
     diagnostics.push(error(
@@ -234,37 +236,6 @@ function validateIndependentApproval(record, byId, path, diagnostics) {
       `Approvers must be separate from owners, including through team membership: ${overlap.join(", ")}.`
     ));
   }
-  if (["approved", "active"].includes(record.status)) {
-    const incompleteStarterApprover = [...approvers]
-      .map((id) => byId.get(id))
-      .find((person) => (
-        person?.id === "person-independent-approver"
-        && ["Independent Approver", "Independent Reviewer"].includes(person.title)
-      ));
-    if (incompleteStarterApprover) {
-      diagnostics.push(error(
-        "independent-approver-not-appointed",
-        path,
-        `The selected approver "${incompleteStarterApprover.title}" is still the starter placeholder. Open People and replace it with the reviewer's actual name before approving this record. The reviewer may be internal or external but must be separate from the owner.`
-      ));
-    }
-  }
-}
-
-function expandPeople(ids, byId, seen = new Set()) {
-  const people = new Set();
-  for (const id of ids) {
-    if (seen.has(id)) continue;
-    seen.add(id);
-    const record = byId.get(id);
-    if (record?.type === "person") people.add(id);
-    if (record?.type === "team") {
-      for (const personId of expandPeople([...(record.memberIds || []), ...(record.chairIds || [])], byId, seen)) {
-        people.add(personId);
-      }
-    }
-  }
-  return people;
 }
 
 function validateObligation(record, path, diagnostics) {