filegrc 0.3.0 → 0.3.2

package/README.md

@@ -20,13 +20,13 @@ npx filegrc serve
 npx filegrc setup --help
 npx filegrc build
 npx filegrc guide risk-assessment
-npx filegrc program-path --json
+npx filegrc program-path --next --json
 npx filegrc scaffold risk-assessment --title "2026 Annual Risk Assessment"
 npx filegrc list risk --json
 npx filegrc references risk-example --json
 npx filegrc describe risk
 npx filegrc search "access review"
-npx filegrc evidence-test-drafts
+npx filegrc evidence-test-drafts --preview --json
 npx filegrc program-readiness --summary --json
 npx filegrc program-readiness --require-ready
 npx filegrc audit-readiness audit-id
@@ -36,13 +36,13 @@ npx filegrc evidence-packet --start 2026-01-01 --end 2026-06-30 --audit audit-id
 
 `filegrc serve --help` prints bind, port, environment, and safety options without starting the server. The editable server defaults to `127.0.0.1:8787`; set `FILEGRC_HOST`, `FILEGRC_PORT`, or the matching flags when needed.
 
-`filegrc setup` provides the headless equivalent of browser onboarding. Run it without arguments for guided terminal setup, or pass all initial service-boundary fields and a management program goal as flags or a JSON payload. Selecting Type 1 or Type 2 updates the workspace goal and program scope. It does not create an audit record.
+`filegrc setup` provides the headless equivalent of browser onboarding. Run it without arguments for guided terminal setup, or pass all initial service-boundary fields and a management program goal as flags or a JSON payload. Add `--preview` to validate and inspect the planned service and workspace writes without saving. Add `--summary --json` for compact agent output. Selecting Type 1 or Type 2 updates the workspace goal and selected systems. Setup does not select framework records, link controls, create evidence, or create an audit record.
 
-`filegrc program-path` gives agents the renderer’s six-step order, exact page Instructions, Use, Policy Basis, commands, current state, and next actions. `filegrc guide <type>` repeats the matching page guidance and adds fields, relationship candidates, Markdown slots, and timing for that record type.
+`filegrc program-path --next --json` gives an agent the current step and first action without loading the full lifecycle. Use `--summary` for compact status across all six steps, `--current` for the full current-step guide, or no compact flag for every step. `filegrc guide <type>` repeats the matching page guidance and adds fields, relationship candidates, Markdown slots, and timing for that record type.
 
 `filegrc program-readiness` reports whether management can start a candidate Type 2 period. Add `--summary --json` for compact stage counts and next actions, or omit `--summary` for every readiness item. Use `--require-ready` in automation. The command does not require an audit ID or CPA firm.
 
-`filegrc evidence-test-drafts` creates missing draft tests for external evidence that does not already have a dedicated Step 5 record. When a Step 5 operating record exists, put the fixed artifact in an External Evidence record and link it from that operating record. Completing browser or CLI onboarding runs the same operation automatically.
+`filegrc evidence-test-drafts --preview --json` reports the missing draft tests for external evidence without writing them. Run `filegrc evidence-test-drafts` after confirming applicable controls and authoritative source Systems. When a Step 5 operating record exists, put the fixed artifact in an External Evidence record and link it from that operating record.
 
 `filegrc obligations` shows recurring work and a task-level preview for each Policy Event, including owners, deadlines, and requested proof. `filegrc trigger` adds the event and all of its Action Items to the Work Queue atomically, then prints the created task IDs and deadlines.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/agent.js

@@ -93,7 +93,7 @@ export function buildAgentGuide(loaded, type, options = {}) {
       "Inspect existing records and relation candidates before writing.",
       "Create a scaffold, then replace every null value and empty required array with facts from an authoritative source.",
       "Keep stable metadata in JSON and put the work performed, inputs, results, decisions, exceptions, and follow-up in the recommended Markdown companion.",
-      "Run filegrc validate, review the full Git diff, and commit the JSON, Markdown, and attachments together with a message that explains why the record changed."
+      "Run npx filegrc validate, review the full Git diff, and commit the JSON, Markdown, and attachments together with a message that explains why the record changed."
     ],
     completionChecks: [
       "The record describes work that actually occurred; planned work is not marked complete.",

package/src/cli.js

@@ -6,7 +6,7 @@ import { buildAgentGuide, findResourceReferences, listResourceTypes, scaffoldRes
 import { assessAuditPreparation, prepareAuditWorkspace } from "./audit-preparation.js";
 import { buildWorkspace } from "./build.js";
 import { generateEvidencePacket, prepareEvidencePacket } from "./evidence-packet.js";
-import { ensureEvidenceTestDrafts } from "./evidence-tests.js";
+import { ensureEvidenceTestDrafts, planEvidenceTestDrafts } from "./evidence-tests.js";
 import {
   addEvidenceAttachment,
   createResource,
@@ -28,7 +28,7 @@ import { assessProgramReadiness } from "./program-readiness.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { searchResources } from "./search.js";
 import { serveWorkspace } from "./server.js";
-import { setupWorkspace } from "./setup.js";
+import { planWorkspaceSetup, setupWorkspace, summarizeSetupResult } from "./setup.js";
 import { createAppState } from "./state.js";
 import { currentCalendarDate } from "./time.js";
 import { validateWorkspace } from "./validate.js";
@@ -37,10 +37,12 @@ import { loadWorkspace } from "./workspace.js";
 const BOOLEAN_FLAGS = new Set([
   "check-docs",
   "complete",
+  "current",
   "draft",
   "help",
   "json",
   "mutation",
+  "next",
   "preview",
   "require-ready",
   "summary",
@@ -83,15 +85,25 @@ export async function runCli(argv = process.argv.slice(2)) {
       ...(flags["program-goal"] !== undefined ? { programGoal: flags["program-goal"] } : {}),
       ...(flags.draft ? { draft: true } : {})
     });
-    const result = await setupWorkspace(root, setupInput);
-    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    const result = flags.preview
+      ? await planWorkspaceSetup(root, setupInput)
+      : await setupWorkspace(root, setupInput);
+    const output = flags.summary && !flags.preview ? summarizeSetupResult(result) : result;
+    if (flags.json) console.log(JSON.stringify(output, null, 2));
+    else if (flags.preview) {
+      console.log(`Setup preview: ${result.changes.system} system ${result.system.id}; update workspace target to ${result.target.assuranceGoal}.`);
+      console.log("No controls will be linked and no evidence drafts will be created.");
+    }
     else {
       console.log(`${result.draft ? "Saved draft scope" : "Completed initial setup"} for ${result.system.title}.`);
       console.log(`System: ${result.system.id} (${result.system.status})`);
+      if (result.draft) {
+        console.log("Planned and in scope means selected for scope review, not approved or active.");
+      }
       console.log(`Target: ${result.workspace.assuranceGoal}`);
-      console.log("Next: finish Step 1 by confirming people, criteria, commitments, vendors, and in-scope systems. Run filegrc program-path for the full path.");
+      console.log("Next: finish Step 1 by confirming people, criteria, commitments, vendors, and in-scope systems. Run npx filegrc program-path --next --json.");
     }
-    return result;
+    return output;
   }
   if (command === "build") {
     const result = await buildWorkspace(positionals[0] ?? root, { output: flags.output });
@@ -158,9 +170,10 @@ export async function runCli(argv = process.argv.slice(2)) {
     const auditId = positionals[0] || flags.audit;
     const auditReadiness = auditId ? await assessAuditPreparation(loaded, { auditId }) : null;
     const result = buildProgramPathResult(loaded.model, readiness, auditReadiness);
-    if (flags.json) console.log(JSON.stringify(result, null, 2));
-    else printProgramPath(result);
-    return result;
+    const output = selectProgramPathOutput(result, flags);
+    if (flags.json) console.log(JSON.stringify(output, null, 2));
+    else printProgramPathOutput(output, flags);
+    return output;
   }
   if (command === "scaffold") {
     const loaded = await loadWorkspace(root);
@@ -253,6 +266,29 @@ export async function runCli(argv = process.argv.slice(2)) {
     return output;
   }
   if (command === "evidence-test-drafts") {
+    if (flags.preview) {
+      const loaded = await loadWorkspace(root);
+      const plan = planEvidenceTestDrafts(loaded);
+      const result = {
+        schemaVersion: 1,
+        preview: true,
+        total: plan.length,
+        create: plan.filter(({ existing }) => !existing).map((item) => ({
+          familyId: item.familyId,
+          title: item.title,
+          testEvidenceKind: item.testEvidenceKind,
+          controlIds: item.controlIds
+        })),
+        existing: plan.filter(({ existing }) => existing).map(({ existing }) => ({
+          id: existing.id,
+          title: existing.title,
+          status: existing.status
+        }))
+      };
+      if (flags.json) console.log(JSON.stringify(result, null, 2));
+      else console.log(`Evidence draft preview: create ${result.create.length}; preserve ${result.existing.length}.`);
+      return result;
+    }
     const result = await ensureEvidenceTestDrafts(root);
     if (flags.json) console.log(JSON.stringify(result, null, 2));
     else console.log(`Created ${result.created.length} External Evidence test ${result.created.length === 1 ? "draft" : "drafts"}; ${result.total} required families are represented.`);
@@ -641,20 +677,20 @@ function printHelp() {
 
 Usage:
   filegrc serve [root] [--host 127.0.0.1] [--port 8787]
-  filegrc setup [setup.json|-] [setup options] [--draft] [--json]
+  filegrc setup [setup.json|-] [setup options] [--draft] [--preview] [--summary] [--json]
   filegrc build [root] [--output .filegrc/site]
   filegrc validate [root] [--json]
   filegrc model [--json|--write-docs|--check-docs]
   filegrc describe <resource-type>
   filegrc types [--json]
   filegrc guide [resource-type] [--id resource-id] [--json]
-  filegrc program-path [audit-id] [--as-of YYYY-MM-DD] [--json]
+  filegrc program-path [audit-id] [--as-of YYYY-MM-DD] [--summary|--next|--current] [--json]
   filegrc scaffold <resource-type> --title text [--id resource-id]
   filegrc list [resource-type] [--json]
   filegrc search <query> [--type resource-type] [--json]
   filegrc obligations [--as-of YYYY-MM-DD] [--from YYYY-MM-DD] [--through YYYY-MM-DD] [--now RFC3339] [--complete] [--json]
   filegrc program-readiness [--as-of YYYY-MM-DD] [--require-ready] [--summary] [--json]
-  filegrc evidence-test-drafts [--json]
+  filegrc evidence-test-drafts [--preview] [--json]
   filegrc audit-readiness [audit-id] [--require-ready] [--json]
   filegrc prepare-audit <audit-id> [--json]
   filegrc trigger <event-type> (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) [--subject resource-id[,resource-id]] [--title text] [--json]
@@ -707,6 +743,8 @@ Options:
   --internet-exposed <bool>   true or false
   --program-goal <goal>       none, readiness, type-1, or type-2
   --draft                     Save the service boundary as planned
+  --preview                   Validate and report planned writes without saving
+  --summary                   Omit full workspace relationship arrays
   --json                      Print the result as JSON
   --root <path>               Workspace path
   --help                      Show this help`);
@@ -741,7 +779,10 @@ and current readiness state. Pass an audit ID to include Step 6 status.
 Options:
   --audit <id>       Audit record to use for Step 6
   --as-of <date>     Evaluate readiness on YYYY-MM-DD
-  --json             Print the full agent-oriented path as JSON
+  --summary          Print compact status and the first action for all six steps
+  --next             Print only the current step and its first action
+  --current          Print the full guide for the current step only
+  --json             Print the selected path view as JSON
   --root <path>      Workspace path
   --help             Show this help`);
     return;
@@ -750,10 +791,12 @@ Options:
     console.log(`Usage:
   filegrc evidence-test-drafts [options]
 
-Create missing draft External Evidence records for collection that does not
-already have a dedicated Step 5 operating record. Existing tests are preserved.
+Preview or create missing draft External Evidence records for collection that
+does not already have a dedicated Step 5 operating record. Existing tests are
+preserved. Run after confirming applicable controls and source systems.
 
 Options:
+  --preview      Report proposed drafts without creating them
   --json         Print created and existing records as JSON
   --root <path>  Workspace path
   --help         Show this help`);
@@ -763,44 +806,48 @@ Options:
 }
 
 function agentOverview(model) {
+  const commands = {
+    help: "filegrc help",
+    version: "filegrc version",
+    serve: "filegrc serve [root]",
+    setup: "filegrc setup [setup.json|-] [--draft] [--preview] [--summary] [--json]",
+    build: "filegrc build [root]",
+    validate: "filegrc validate [root] --json",
+    model: "filegrc model --json",
+    describe: "filegrc describe <resource-type>",
+    types: "filegrc types --json",
+    guide: "filegrc guide [resource-type] --json",
+    programPath: "filegrc program-path [audit-id] --next --json",
+    scaffold: "filegrc scaffold <resource-type> --title <name>",
+    list: "filegrc list [resource-type] --json",
+    search: "filegrc search <query> --json",
+    obligations: "filegrc obligations --json",
+    programReadiness: "filegrc program-readiness --json",
+    evidenceTestDrafts: "filegrc evidence-test-drafts --preview --json",
+    auditReadiness: "filegrc audit-readiness <audit-id> --json",
+    prepareAudit: "filegrc prepare-audit <audit-id>",
+    trigger: "filegrc trigger <event-type> <date-or-time-and-subject-flags>",
+    evidencePacket: "filegrc evidence-packet --audit <audit-id> --preview --json",
+    get: "filegrc get <resource-id> [--mutation]",
+    references: "filegrc references <resource-id> --json",
+    create: "filegrc create <record-or-mutation.json>",
+    complete: "filegrc complete <obligation-id> <completion-mutation.json>",
+    completeAction: "filegrc complete-action <action-item-id> <completion-mutation.json> --completed-on <date>",
+    completeEvent: "filegrc complete-event <obligation-event-id> --completed-on <date>",
+    update: "filegrc update <resource-type> <id> <record-or-mutation.json>",
+    content: "filegrc content <resource-type> <id> [slot] [--write <markdown-file|->]",
+    attach: "filegrc attach <evidence-id> <source-file> [--name <file-name>]",
+    detach: "filegrc detach <evidence-id> <attachment-name> --yes",
+    delete: "filegrc delete <resource-type> <id> --yes",
+    commit: "git diff --check && git diff && git add <reviewed-paths> && git commit -m <reason>"
+  };
   return {
     rule: "Treat data/ as the source of truth. Run guide before creating an unfamiliar type, validate after every write, review the Git diff, then commit a focused change.",
     programPath: buildAgentProgramPath(model),
-    actions: {
-      help: "filegrc help",
-      version: "filegrc version",
-      serve: "filegrc serve [root]",
-      setup: "filegrc setup [setup.json|-] [--draft] [--json]",
-      build: "filegrc build [root]",
-      validate: "filegrc validate [root] --json",
-      model: "filegrc model --json",
-      describe: "filegrc describe <resource-type>",
-      types: "filegrc types --json",
-      guide: "filegrc guide [resource-type] --json",
-      programPath: "filegrc program-path [audit-id] --json",
-      scaffold: "filegrc scaffold <resource-type> --title <name>",
-      list: "filegrc list [resource-type] --json",
-      search: "filegrc search <query> --json",
-      obligations: "filegrc obligations --json",
-      programReadiness: "filegrc program-readiness --json",
-      evidenceTestDrafts: "filegrc evidence-test-drafts --json",
-      auditReadiness: "filegrc audit-readiness <audit-id> --json",
-      prepareAudit: "filegrc prepare-audit <audit-id>",
-      trigger: "filegrc trigger <event-type> <date-or-time-and-subject-flags>",
-      evidencePacket: "filegrc evidence-packet --audit <audit-id> --preview --json",
-      get: "filegrc get <resource-id> [--mutation]",
-      references: "filegrc references <resource-id> --json",
-      create: "filegrc create <record-or-mutation.json>",
-      complete: "filegrc complete <obligation-id> <completion-mutation.json>",
-      completeAction: "filegrc complete-action <action-item-id> <completion-mutation.json> --completed-on <date>",
-      completeEvent: "filegrc complete-event <obligation-event-id> --completed-on <date>",
-      update: "filegrc update <resource-type> <id> <record-or-mutation.json>",
-      content: "filegrc content <resource-type> <id> [slot] [--write <markdown-file|->]",
-      attach: "filegrc attach <evidence-id> <source-file> [--name <file-name>]",
-      detach: "filegrc detach <evidence-id> <attachment-name> --yes",
-      delete: "filegrc delete <resource-type> <id> --yes",
-      commit: "git diff --check && git diff && git add <reviewed-paths> && git commit -m <reason>"
-    },
+    actions: Object.fromEntries(Object.entries(commands).map(([name, command]) => [
+      name,
+      command.startsWith("filegrc ") ? `npx ${command}` : command
+    ])),
     resourceTypes: listResourceTypes(model).map(({ type, title, group }) => ({ type, title, group }))
   };
 }
@@ -851,12 +898,12 @@ function printAgentGuide(result) {
     for (const field of relationshipFields) {
       const hasCandidates = field.relation.candidates.length > 0;
       const suffix = field.relation.truncated && hasCandidates
-        ? `, … (${field.relation.candidateCount} total; use filegrc list)`
+        ? `, … (${field.relation.candidateCount} total; use npx filegrc list)`
         : "";
       const candidates = hasCandidates
         ? field.relation.candidates.join(", ") + suffix
         : field.relation.candidateCount
-          ? `use filegrc list (${field.relation.candidateCount} possible)`
+          ? `use npx filegrc list (${field.relation.candidateCount} possible)`
           : "none";
       console.log(`${field.name}\t${field.relation.types.join("|")}\t${candidates}`);
     }
@@ -923,15 +970,130 @@ function printProgramPath(result) {
   }
 }
 
+function selectProgramPathOutput(result, flags) {
+  const modes = ["summary", "next", "current"].filter((name) => flags[name]);
+  if (modes.length > 1) throw new Error("Use only one of --summary, --next, or --current.");
+  if (flags.summary) return summarizeProgramPath(result);
+  if (flags.next) return nextProgramPath(result);
+  if (flags.current) {
+    const stage = result.stages.find(({ id }) => id === result.currentStep.id);
+    return { ...result, stages: stage ? [stage] : [] };
+  }
+  return result;
+}
+
+function summarizeProgramPath(result) {
+  return {
+    schemaVersion: result.schemaVersion,
+    asOf: result.asOf,
+    currentStep: result.currentStep,
+    evidenceReady: result.evidenceReady,
+    operating: result.operating,
+    stages: result.stages.map((stage) => ({
+      id: stage.id,
+      number: stage.number,
+      title: stage.title,
+      status: stage.status,
+      counts: stage.counts,
+      nextAction: summarizePathAction(stage.nextActions[0])
+    }))
+  };
+}
+
+function nextProgramPath(result) {
+  const stage = result.stages.find(({ id }) => id === result.currentStep.id);
+  const nextAction = stage?.nextActions[0];
+  return {
+    schemaVersion: result.schemaVersion,
+    asOf: result.asOf,
+    currentStep: result.currentStep,
+    evidenceReady: result.evidenceReady,
+    operating: result.operating,
+    step: stage ? {
+      id: stage.id,
+      number: stage.number,
+      title: stage.title,
+      status: stage.status,
+      summary: stage.summary,
+      nextAction: summarizePathAction(nextAction),
+      commands: nextActionCommands(stage, nextAction)
+    } : null
+  };
+}
+
+function summarizePathAction(action) {
+  if (!action) return null;
+  return {
+    id: action.id,
+    status: action.status,
+    title: action.title,
+    message: action.message,
+    ...(action.resourceType ? { resourceType: action.resourceType } : {}),
+    ...(action.resourceId ? { resourceId: action.resourceId } : {})
+  };
+}
+
+function nextActionCommands(stage, action) {
+  if (action?.commands?.length) return action.commands;
+  if (!action?.resourceType) return stage.commands;
+  const resourceType = shellArgument(action.resourceType);
+  const commands = [`npx filegrc guide ${resourceType} --json`];
+  if (action.resourceId) {
+    const resourceId = shellArgument(action.resourceId);
+    commands.push(`npx filegrc get ${resourceId} --mutation`);
+    commands.push(`npx filegrc update ${resourceType} ${resourceId} MUTATION.json --json`);
+  } else {
+    commands.push(`npx filegrc list ${resourceType} --json`);
+    commands.push(`npx filegrc scaffold ${resourceType} --title "NAME"`);
+    commands.push("npx filegrc create MUTATION.json --json");
+  }
+  return commands;
+}
+
+function shellArgument(value) {
+  const text = String(value);
+  return /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(text)
+    ? text
+    : `'${text.replaceAll("'", "'\\''")}'`;
+}
+
+function printProgramPathOutput(result, flags) {
+  if (flags.summary) {
+    console.log(`Current: Step ${result.currentStep.number}, ${result.currentStep.title}`);
+    for (const stage of result.stages) {
+      console.log(`${String(stage.status).toUpperCase()}\tStep ${stage.number}\t${stage.title}`);
+    }
+    const current = result.stages.find(({ id }) => id === result.currentStep.id);
+    if (current?.nextAction) console.log(`Next: ${current.nextAction.title} · ${current.nextAction.message}`);
+    return;
+  }
+  if (flags.next) {
+    console.log(`Current: Step ${result.currentStep.number}, ${result.currentStep.title}`);
+    if (result.step?.nextAction) {
+      console.log(`Next: ${result.step.nextAction.title} · ${result.step.nextAction.message}`);
+    }
+    for (const command of result.step?.commands || []) console.log(`  ${command}`);
+    return;
+  }
+  printProgramPath(result);
+}
+
 function summarizeProgramReadiness(result) {
-  const summarizeItem = (item) => item ? {
+  const ownership = result.stages
+    .flatMap((stage) => stage.items)
+    .find((item) => item.id === "program-ownership");
+  const summarizeItem = (item, options = {}) => item ? {
     id: item.id,
     status: item.status,
     title: item.title,
-    message: item.message,
+    ...(options.message === false ? {} : { message: item.message }),
     ...(item.resourceType ? { resourceType: item.resourceType } : {}),
     ...(item.resourceId ? { resourceId: item.resourceId } : {})
   } : null;
+  const unresolvedOwnership = ownership?.unresolvedAssignments || [];
+  const ownershipReasons = unresolvedOwnership
+    .flatMap((assignment) => assignment.reasons || [])
+    .reduce((counts, { reason }) => ({ ...counts, [reason]: (counts[reason] || 0) + 1 }), {});
   return {
     schemaVersion: result.schemaVersion,
     generatedAt: result.generatedAt,
@@ -947,13 +1109,18 @@ function summarizeProgramReadiness(result) {
     scopeCounts: Object.fromEntries(
       Object.entries(result.scope).map(([name, ids]) => [name.replace(/Ids$/, ""), ids.length])
     ),
+    unresolvedOwnership: {
+      count: unresolvedOwnership.length,
+      byReason: ownershipReasons,
+      resourceIds: unresolvedOwnership.map(({ resourceId }) => resourceId)
+    },
     firstAction: summarizeItem(result.firstAction),
     stages: result.stages.map((stage) => ({
       id: stage.id,
       title: stage.title,
       status: stage.status,
       counts: stage.counts,
-      firstAction: summarizeItem(stage.items.find(({ status }) => status === "action"))
+      firstAction: summarizeItem(stage.items.find(({ status }) => status === "action"), { message: false })
     }))
   };
 }

package/src/index.js

@@ -51,7 +51,7 @@ export {
 } from "./recurrence.js";
 export { searchResources, searchableValues } from "./search.js";
 export { createFilegrcServer, serveWorkspace } from "./server.js";
-export { normalizeSetupPayload, setupWorkspace } from "./setup.js";
+export { normalizeSetupPayload, planWorkspaceSetup, setupWorkspace, summarizeSetupResult } from "./setup.js";
 export { createAppState } from "./state.js";
 export { currentCalendarDate, formatCalendarDate, formatLocalDateTime } from "./time.js";
 export { validateWorkspace } from "./validate.js";

package/src/program-path.js

@@ -119,7 +119,7 @@ export const PROGRAM_PATH = [
     ],
     resourceTypes: ["evidence"],
     commands: [
-      "filegrc evidence-test-drafts --json",
+      "filegrc evidence-test-drafts --preview --json",
       "filegrc guide evidence --json",
       "filegrc list evidence --json",
       "filegrc program-readiness --json"
@@ -235,8 +235,8 @@ export function buildAgentProgramPath(model) {
         instructions: RESOURCE_INSTRUCTIONS[type] || definition.description,
         use: definition.description,
         policyBasis: definition.guidance.policyBasis,
-        guide: `filegrc guide ${type} --json`,
-        list: `filegrc list ${type} --json`
+        guide: `npx filegrc guide ${type} --json`,
+        list: `npx filegrc list ${type} --json`
       };
     });
     const utilityPages = (stage.utilities || []).map((utility, index) => ({
@@ -246,16 +246,21 @@ export function buildAgentProgramPath(model) {
       instructions: utility.instructions,
       use: utility.use,
       policyBasis: utility.policyBasis,
-      commands: utility.commands
+      commands: utility.commands.map(agentCommand)
     }));
     return {
       ...stage,
+      commands: stage.commands.map(agentCommand),
       pages: stage.id === "run" ? utilityPages : [...resourcePages, ...utilityPages],
       ...(stage.id === "run" ? { operatingRecords: resourcePages } : {})
     };
   });
 }
 
+function agentCommand(command) {
+  return command.startsWith("filegrc ") ? `npx ${command}` : command;
+}
+
 export function resourceProgramContext(type) {
   const stage = PROGRAM_PATH.find((candidate) => (
     candidate.resourceTypes.includes(type) || (candidate.supportingResourceTypes || []).includes(type)

package/src/program-readiness.js

@@ -203,10 +203,20 @@ function programOwnershipItem(records, byId) {
     && ![...oversightChairs].some((id) => policyOwnerIds.has(id))
   );
   const complete = currentOwners.size > 0 && unresolved.length === 0 && oversightComplete;
+  const unresolvedAssignments = unresolved.map((record) => ({
+    resourceType: record.type,
+    resourceId: record.id,
+    title: record.title,
+    ownerIds: record.ownerIds || [],
+    reasons: ownershipResolutionReasons(record.ownerIds || [], byId)
+  }));
   const detail = [];
   if (!currentOwners.size) detail.push("No current person owns the program records.");
-  if (unresolved.length) detail.push(`${unresolved.length} ownership ${unresolved.length === 1 ? "assignment does" : "assignments do"} not resolve to a current person.`);
+  if (unresolved.length) {
+    detail.push(`${unresolved.length} ${unresolved.length === 1 ? "record has" : "records have"} no current person owner.`);
+  }
   if (!oversightComplete) detail.push("Finish and activate Security and Risk Oversight with a current chair who is separate from policy ownership.");
+  const oversightId = oversight?.id ? shellArgument(oversight.id) : null;
   return item(
     "program-ownership",
     complete ? "complete" : "action",
@@ -214,10 +224,40 @@ function programOwnershipItem(records, byId) {
     complete
       ? `${currentOwners.size} current ${currentOwners.size === 1 ? "person owns" : "people own"} the program records.${oversight ? " Security and Risk Oversight has a separate current chair." : ""}`
       : detail.join(" "),
-    !oversightComplete ? oversight : unresolved[0] || { type: "person" }
+    !oversightComplete ? oversight : unresolved[0] || { type: "person" },
+    {
+      unresolvedAssignments,
+      ...(!oversightComplete && oversight ? {
+        commands: [
+          "npx filegrc guide person --json",
+          "npx filegrc list person --json",
+          'npx filegrc scaffold person --title "REVIEWER NAME" | npx filegrc create - --json',
+          `npx filegrc get ${oversightId} --mutation`,
+          `npx filegrc update team ${oversightId} MUTATION.json --json`
+        ]
+      } : {})
+    }
   );
 }
 
+function ownershipResolutionReasons(ownerIds, byId) {
+  if (!ownerIds.length) return [{ ownerId: null, reason: "missing-owner" }];
+  return ownerIds.flatMap((ownerId) => {
+    const owner = byId.get(ownerId);
+    if (!owner) return [{ ownerId, reason: "missing-record" }];
+    if (owner.type === "person" && owner.status !== "active") {
+      return [{ ownerId, reason: "inactive-person" }];
+    }
+    if (owner.type === "team" && owner.status !== "active") {
+      return [{ ownerId, reason: "inactive-team" }];
+    }
+    if (currentPartyPeople([ownerId], byId).size === 0) {
+      return [{ ownerId, reason: owner.type === "team" ? "team-has-no-current-members" : "no-current-person" }];
+    }
+    return [];
+  });
+}
+
 async function policiesStage(scope, byId, readMarkdown, asOf) {
   const linkedPolicyIds = new Set(scope.controls.flatMap((control) => control.policyIds || []));
   const policies = [...linkedPolicyIds].map((id) => byId.get(id)).filter((record) => (
@@ -228,15 +268,30 @@ async function policiesStage(scope, byId, readMarkdown, asOf) {
     .flatMap((policy) => [...currentPartyPeople(policy.approverIds || [], byId)])
     .map((id) => byId.get(id))
     .find(Boolean);
+  const policyOwnerIds = new Set(policies.flatMap((policy) => (
+    [...partyPeople(policy.ownerIds || [], byId)]
+  )));
+  const oversight = byId.get("team-security-risk-oversight");
+  const availableReviewer = oversight?.type === "team" && oversight.status === "active"
+    ? [...currentPartyPeople(oversight.chairIds || [], byId)]
+      .filter((id) => !policyOwnerIds.has(id))
+      .map((id) => byId.get(id))
+      .find(Boolean)
+    : null;
+  const reviewerNeedsAssignment = !appointedReviewer && availableReviewer && policies.length;
   const items = [
     item(
       "independent-reviewer",
       appointedReviewer ? "complete" : "action",
-      "Appoint the independent policy reviewer",
+      reviewerNeedsAssignment
+        ? "Assign the independent policy reviewer"
+        : "Appoint the independent policy reviewer",
       appointedReviewer
         ? `${appointedReviewer.title} is recorded as a reviewer separate from policy ownership.`
-        : "Appoint a reviewer who is separate from the policy owner. The reviewer may be another person in the organization or an external person, and is separate from the CPA firm that may later perform the audit.",
-      appointedReviewer || { type: "person" }
+        : reviewerNeedsAssignment
+          ? `${availableReviewer.title} chairs Security and Risk Oversight. Assign this person as approver on each policy after review.`
+          : "Appoint a reviewer who is separate from the policy owner. The reviewer may be another person in the organization or an external person, and is separate from the CPA firm that may later perform the audit.",
+      appointedReviewer || (reviewerNeedsAssignment ? policies[0] : { type: "person" })
     )
   ];
   if (!policies.length) {
@@ -639,6 +694,13 @@ function item(id, status, title, message, resource = {}, details = {}) {
   };
 }
 
+function shellArgument(value) {
+  const text = String(value);
+  return /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(text)
+    ? text
+    : `'${text.replaceAll("'", "'\\''")}'`;
+}
+
 function countStatuses(items) {
   const counts = { complete: 0, action: 0, later: 0, info: 0 };
   for (const current of items) counts[current.status] = (counts[current.status] || 0) + 1;

package/src/setup.js

@@ -1,5 +1,4 @@
 import { createResource, updateResource } from "./files.js";
-import { ensureEvidenceTestDrafts } from "./evidence-tests.js";
 import { createResourceId } from "./id.js";
 import { loadWorkspace } from "./workspace.js";
 
@@ -10,81 +9,64 @@ export async function setupWorkspace(input = process.cwd(), payload = {}) {
   const loaded = await loadWorkspace(input);
   const setup = normalizeSetupPayload(payload);
   validateSetup(loaded, setup);
+  const plan = buildSetupRecords(loaded, setup);
 
-  let current = loaded;
-  let system = findSetupSystem(current.resources, setup);
-  const systemId = system?.id || createResourceId("system", setup.serviceName, current.resources.map(({ id }) => id));
-  system = {
-    ...(system || {}),
-    schemaVersion: 1,
-    id: systemId,
-    type: "system",
-    title: setup.serviceName,
-    status: setup.draft ? system?.status || "planned" : (system?.status === "planned" ? "active" : system?.status || "active"),
-    criticality: setup.criticality,
-    ownerIds: [setup.ownerId],
-    description: setup.boundary,
-    systemKind: system?.systemKind || "service",
-    dataClassification: setup.dataClassification,
-    internetExposed: setup.internetExposed,
-    inScope: true
-  };
-  await upsertResource(current.root, current.resources.find(({ id }) => id === systemId), system);
-
-  current = await loadWorkspace(current.root);
-  const linkedControlIds = [];
-  for (const control of current.resources.filter(({ type, status }) => (
-    type === "control" && !["not-applicable", "retired"].includes(status)
-  ))) {
-    if ((control.systemIds || []).includes(systemId)) continue;
-    await updateResource(current.root, "control", control.id, {
-      ...control,
-      systemIds: [...new Set([...(control.systemIds || []), systemId])]
-    });
-    linkedControlIds.push(control.id);
-  }
+  await upsertResource(loaded.root, plan.existingSystem, plan.system);
+  await updateResource(loaded.root, "workspace", plan.workspace.id, plan.workspace);
+  if (plan.renderer) await updateResource(loaded.root, plan.renderer.type, plan.renderer.id, plan.renderer);
 
-  current = await loadWorkspace(current.root);
-  const existingWorkspace = current.resources.find(({ type }) => type === "workspace");
-  if (!existingWorkspace) throw new Error("The workspace settings record was not found.");
-  const workspace = {
-    ...existingWorkspace,
-    assuranceGoal: assuranceGoalFromSetup(setup.programGoal),
-    frameworkIds: current.resources
-      .filter(({ type, status }) => type === "framework" && status === "active")
-      .map(({ id }) => id),
-    requirementIds: current.resources
-      .filter(({ type, applicability }) => type === "requirement" && applicability === "applicable")
-      .map(({ id }) => id),
-    controlIds: current.resources
-      .filter(({ type, status }) => type === "control" && !["not-applicable", "retired"].includes(status))
-      .map(({ id }) => id),
-    systemIds: [...new Set([...(existingWorkspace.systemIds || []), systemId])]
+  return {
+    draft: setup.draft,
+    system: plan.system,
+    workspace: plan.workspace,
+    renderer: plan.renderer,
+    linkedControlIds: [],
+    evidenceTestDraftIds: [],
+    onboardingComplete: !setup.draft
   };
-  await updateResource(current.root, "workspace", workspace.id, workspace);
-
-  current = await loadWorkspace(current.root);
-  const renderer = current.resources.find(({ type }) => type === "renderer-settings");
-  if (renderer) {
-    await updateResource(current.root, renderer.type, renderer.id, {
-      ...renderer,
-      showOnboarding: setup.draft
-    });
-  }
-  const evidenceTestDrafts = setup.draft
-    ? { created: [], existing: [], total: 0 }
-    : await ensureEvidenceTestDrafts(current.root);
+}
 
+export async function planWorkspaceSetup(input = process.cwd(), payload = {}) {
+  const loaded = await loadWorkspace(input);
+  const setup = normalizeSetupPayload(payload);
+  validateSetup(loaded, setup);
+  const plan = buildSetupRecords(loaded, setup);
   return {
+    schemaVersion: 1,
+    preview: true,
     draft: setup.draft,
-    system,
-    workspace,
-    linkedControlIds,
-    evidenceTestDraftIds: evidenceTestDrafts.created.map(({ id }) => id),
+    changes: {
+      system: plan.existingSystem ? "update" : "create",
+      workspace: "update",
+      renderer: plan.renderer ? "update" : "unchanged",
+      controls: 0,
+      evidenceDrafts: 0
+    },
+    system: setupSystemSummary(plan.system),
+    target: setupTargetSummary(plan.workspace),
+    renderer: plan.renderer ? setupRendererSummary(plan.renderer) : null,
     onboardingComplete: !setup.draft
   };
 }
 
+export function summarizeSetupResult(result) {
+  return {
+    schemaVersion: 1,
+    preview: false,
+    draft: result.draft,
+    changes: {
+      system: "saved",
+      workspace: "updated",
+      controls: result.linkedControlIds?.length || 0,
+      evidenceDrafts: result.evidenceTestDraftIds?.length || 0
+    },
+    system: setupSystemSummary(result.system),
+    target: setupTargetSummary(result.workspace),
+    renderer: result.renderer ? setupRendererSummary(result.renderer) : null,
+    onboardingComplete: result.onboardingComplete
+  };
+}
+
 export function normalizeSetupPayload(payload = {}) {
   if (!payload || Array.isArray(payload) || typeof payload !== "object") {
     throw new Error("Setup input must be a JSON object.");
@@ -146,6 +128,44 @@ function findSetupSystem(resources, setup) {
     ));
 }
 
+function buildSetupRecords(loaded, setup) {
+  const existingSystem = findSetupSystem(loaded.resources, setup);
+  const systemId = existingSystem?.id || createResourceId(
+    "system",
+    setup.serviceName,
+    loaded.resources.map(({ id }) => id)
+  );
+  const system = {
+    ...(existingSystem || {}),
+    schemaVersion: 1,
+    id: systemId,
+    type: "system",
+    title: setup.serviceName,
+    status: setup.draft
+      ? existingSystem?.status || "planned"
+      : existingSystem?.status === "planned"
+        ? "active"
+        : existingSystem?.status || "active",
+    criticality: setup.criticality,
+    ownerIds: [setup.ownerId],
+    description: setup.boundary,
+    systemKind: existingSystem?.systemKind || "service",
+    dataClassification: setup.dataClassification,
+    internetExposed: setup.internetExposed,
+    inScope: true
+  };
+  const existingWorkspace = loaded.resources.find(({ type }) => type === "workspace");
+  if (!existingWorkspace) throw new Error("The workspace settings record was not found.");
+  const workspace = {
+    ...existingWorkspace,
+    assuranceGoal: assuranceGoalFromSetup(setup.programGoal),
+    systemIds: [...new Set([...(existingWorkspace.systemIds || []), systemId])]
+  };
+  const existingRenderer = loaded.resources.find(({ type }) => type === "renderer-settings");
+  const renderer = existingRenderer ? { ...existingRenderer, showOnboarding: setup.draft } : null;
+  return { existingSystem, system, workspace, renderer };
+}
+
 async function upsertResource(root, existing, record) {
   return existing
     ? updateResource(root, record.type, record.id, record)
@@ -159,6 +179,31 @@ function assuranceGoalFromSetup(goal) {
   return "none";
 }
 
+function setupSystemSummary(system) {
+  return { ...system };
+}
+
+function setupTargetSummary(workspace) {
+  return {
+    assuranceGoal: workspace.assuranceGoal,
+    systemIds: [...(workspace.systemIds || [])],
+    scopeCounts: {
+      systems: workspace.systemIds?.length || 0,
+      frameworks: workspace.frameworkIds?.length || 0,
+      requirements: workspace.requirementIds?.length || 0,
+      controls: workspace.controlIds?.length || 0
+    }
+  };
+}
+
+function setupRendererSummary(renderer) {
+  return {
+    id: renderer.id,
+    type: renderer.type,
+    showOnboarding: renderer.showOnboarding
+  };
+}
+
 function booleanValue(value, name) {
   if (value === true || value === false) return value;
   if (value === "true") return true;

package/src/web.js

@@ -1519,7 +1519,7 @@ function renderOnboardingStep() {
   const finalActions = onboardingStep === steps.length - 1
     ? '<button class="button" type="button" data-onboarding="draft">Save draft</button><button class="button primary" type="button" data-onboarding="next">Complete setup</button>'
     : '<button class="button primary" type="button" data-onboarding="next">Next</button>';
-  onboardingDialog.innerHTML = '<div class="onboarding-progress" style="--onboarding-step-count:' + steps.length + '" aria-label="Onboarding step ' + (onboardingStep + 1) + ' of ' + steps.length + '">' + progress + '</div><div class="onboarding-head"><p class="kicker">' + esc(step.kicker) + ' · ' + (onboardingStep + 1) + ' of ' + steps.length + '</p><h2 id="onboarding-title">' + esc(titleCase(step.title)) + '</h2></div>' + body + '<div class="dialog-error" role="alert"></div><div class="dialog-actions onboarding-actions"><button class="button text-button onboarding-skip" type="button" data-onboarding="skip">Skip onboarding</button>' + (onboardingStep ? '<button class="button" type="button" data-onboarding="back">Back</button>' : "") + finalActions + '</div>';
+  onboardingDialog.innerHTML = '<div class="onboarding-progress" style="--onboarding-step-count:' + steps.length + '" aria-label="Onboarding step ' + (onboardingStep + 1) + ' of ' + steps.length + '">' + progress + '</div><div class="onboarding-scroll"><div class="onboarding-head"><p class="kicker">' + esc(step.kicker) + ' · ' + (onboardingStep + 1) + ' of ' + steps.length + '</p><h2 id="onboarding-title">' + esc(titleCase(step.title)) + '</h2></div>' + body + '<div class="dialog-error" role="alert"></div></div><div class="dialog-actions onboarding-actions"><button class="button text-button onboarding-skip" type="button" data-onboarding="skip">Skip onboarding</button>' + (onboardingStep ? '<button class="button" type="button" data-onboarding="back">Back</button>' : "") + finalActions + '</div>';
   onboardingDialog.querySelector('[data-onboarding="skip"]').addEventListener("click", cancelOnboarding);
   onboardingDialog.querySelector('[data-onboarding="back"]')?.addEventListener("click", () => {
     captureOnboardingForm();
@@ -1569,7 +1569,7 @@ function onboardingSetupForm() {
     : state.git.available
       ? '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Git remote needed</strong><small>Saving and local commits still work. Add a remote before the browser can push.</small></span></div>'
       : '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Git setup needed</strong><small>Saving still works. Run <code>git init</code> at the workspace root before your first compliance commit.</small></span></div>';
-  return '<p class="onboarding-body">' + esc(onboardingSteps().at(-1).body) + '</p>' + gitStatus + '<form id="onboarding-setup" class="onboarding-form"><label class="wide"><span>Service name</span><input name="serviceName" required maxlength="200" value="' + esc(onboardingDraft.serviceName) + '" placeholder="Customer-facing application"></label><label class="wide"><span>Scope description</span><textarea name="scope" required maxlength="2000" placeholder="What the service does and which production boundary is in scope">' + esc(onboardingDraft.scope) + '</textarea></label><label><span>Accountable owner</span><select name="ownerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === onboardingDraft.ownerId ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Business criticality</span><select name="criticality" required>' + ["low", "medium", "high", "critical"].map((value) => '<option value="' + value + '" ' + (value === onboardingDraft.criticality ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Highest data classification</span><select name="dataClassification" required>' + classifications.map((value) => '<option value="' + esc(value) + '" ' + (value === onboardingDraft.dataClassification ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Internet exposed</span><select name="internetExposed" required><option value="true" ' + (onboardingDraft.internetExposed === "true" ? "selected" : "") + '>Yes</option><option value="false" ' + (onboardingDraft.internetExposed === "false" ? "selected" : "") + '>No</option></select></label><label class="wide"><span>Program goal</span><select name="programGoal" required><option value="none" ' + (onboardingDraft.programGoal === "none" ? "selected" : "") + '>No Assurance Goal Yet</option><option value="readiness" ' + (onboardingDraft.programGoal === "readiness" ? "selected" : "") + '>Program Readiness</option><option value="type-1" ' + (onboardingDraft.programGoal === "type-1" ? "selected" : "") + '>SOC 2 Type 1</option><option value="type-2" ' + (onboardingDraft.programGoal === "type-2" ? "selected" : "") + '>SOC 2 Type 2</option></select><small>This records management intent only. It does not create an engagement or establish the formal report period.</small></label></form><p class="onboarding-write-note">' + esc(existing) + ' Save draft keeps the system planned. Saving writes JSON files but does not commit them. Complete the remaining Step 1 pages next.</p>';
+  return '<p class="onboarding-body">' + esc(onboardingSteps().at(-1).body) + '</p>' + gitStatus + '<form id="onboarding-setup" class="onboarding-form"><label class="wide"><span>Service name</span><input name="serviceName" required maxlength="200" value="' + esc(onboardingDraft.serviceName) + '" placeholder="Customer-facing application"></label><label class="wide"><span>Scope description</span><textarea name="scope" required maxlength="2000" placeholder="What the service does and which production boundary is in scope">' + esc(onboardingDraft.scope) + '</textarea></label><label><span>Accountable owner</span><select name="ownerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === onboardingDraft.ownerId ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Business criticality</span><select name="criticality" required>' + ["low", "medium", "high", "critical"].map((value) => '<option value="' + value + '" ' + (value === onboardingDraft.criticality ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Highest data classification</span><select name="dataClassification" required>' + classifications.map((value) => '<option value="' + esc(value) + '" ' + (value === onboardingDraft.dataClassification ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Internet exposed</span><select name="internetExposed" required><option value="true" ' + (onboardingDraft.internetExposed === "true" ? "selected" : "") + '>Yes</option><option value="false" ' + (onboardingDraft.internetExposed === "false" ? "selected" : "") + '>No</option></select></label><label class="wide"><span>Program goal</span><select name="programGoal" required><option value="none" ' + (onboardingDraft.programGoal === "none" ? "selected" : "") + '>No Assurance Goal Yet</option><option value="readiness" ' + (onboardingDraft.programGoal === "readiness" ? "selected" : "") + '>Program Readiness</option><option value="type-1" ' + (onboardingDraft.programGoal === "type-1" ? "selected" : "") + '>SOC 2 Type 1</option><option value="type-2" ' + (onboardingDraft.programGoal === "type-2" ? "selected" : "") + '>SOC 2 Type 2</option></select><small>This records management intent only. It does not create an engagement or establish the formal report period.</small></label></form><p class="onboarding-write-note">' + esc(existing) + ' Save draft marks the service Planned and In scope. It is selected for scope review, but it is not approved or active. Saving writes JSON files but does not commit them. Complete the remaining Step 1 pages next.</p>';
 }
 
 function captureOnboardingForm() {
@@ -2598,12 +2598,12 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .readiness-map{margin:14px 0;background:var(--panel);border:1px solid var(--line);border-radius:11px;padding:20px 22px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.readiness-map-head{display:grid;grid-template-columns:minmax(220px,1fr) minmax(320px,420px);gap:28px;align-items:center;margin-bottom:17px}.readiness-map-head h3{font-size:18px;margin:5px 0 0}.readiness-progress-summary{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:8px 14px;align-items:center}.readiness-progress-summary>div{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:3px 12px;align-items:baseline}.readiness-progress-summary>div>span{color:var(--muted);font-size:9.6px;font-weight:700;text-transform:uppercase;letter-spacing:.08em}.readiness-progress-summary>div>strong{font-size:9.6px;font-weight:700;line-height:1.2}.readiness-progress-summary .progress,.readiness-progress-summary small{grid-column:1/-1}.readiness-progress-summary small{color:var(--muted);font-size:9.6px}.readiness-progress-summary>.button{white-space:nowrap}.readiness-flow{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:7px}.readiness-flow a{display:grid;grid-template-columns:23px minmax(0,1fr);column-gap:8px;align-content:start;min-width:0;padding:11px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft);text-decoration:none}.readiness-flow a:hover{border-color:var(--accent-light);background:var(--accent-soft)}.readiness-flow a>span{grid-row:1/4;display:grid;place-items:center;width:23px;height:23px;border-radius:50%;background:var(--primary-gradient);color:#fff;font-size:9.6px;font-weight:800}.readiness-flow strong{font-size:12px;line-height:1.25}.readiness-flow small{grid-column:2;color:var(--muted);font-size:9.6px;line-height:1.4;margin-top:3px}.readiness-state{grid-column:2;justify-self:start;margin-top:8px;padding:3px 6px;border-radius:99px;background:var(--surface-muted);color:var(--muted);font-size:8.4px;line-height:1.2}.readiness-state.good{background:#dcefe4;color:#125733}.readiness-state.warn{background:#f6e8c9;color:#79500f}.readiness-state.bad{background:#f7dfdc;color:#873027}.audit-engagement{display:grid;grid-template-columns:minmax(210px,1fr) minmax(260px,1.25fr) auto;gap:20px;align-items:center;padding:14px 15px;border-radius:8px;background:var(--surface-soft)}.audit-engagement strong{font-size:13.2px}.audit-engagement p,.audit-engagement li{color:var(--muted);font-size:10.8px;line-height:1.5}.audit-engagement p{margin:5px 0 0}.audit-engagement ul{margin:0;padding-left:18px}.audit-engagement .button{white-space:nowrap;text-decoration:none}.resource-directory{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:10px}.resource-directory>section{min-width:0;padding:12px;border-radius:8px;background:var(--surface-soft)}.resource-directory h4{margin:0 0 7px;color:var(--muted);font-size:10.8px;text-transform:uppercase;letter-spacing:.08em}.resource-directory a{display:flex;justify-content:space-between;gap:10px;padding:5px 0;border-top:1px solid var(--line);font-size:10.8px;text-decoration:none}.resource-directory a:first-of-type{border-top:0}.resource-directory a:hover span{color:var(--accent)}.resource-directory a strong{color:var(--muted);font-size:9.6px}.record-prose{max-width:790px}.record-prose section{padding:0 0 20px}.record-prose section+section{padding-top:20px;border-top:1px solid var(--line)}.record-prose h3{margin:0 0 7px;color:var(--muted);font-size:10.8px;text-transform:uppercase;letter-spacing:.08em}.record-prose p{margin:0;font-size:16.8px;line-height:1.65;white-space:pre-wrap}.connections-panel .panel-head>span{display:grid;place-items:center;min-width:22px;height:22px;border-radius:99px;background:var(--surface-muted);color:var(--muted);font-size:9.6px}.connections{display:grid}.connections a{display:block;padding:9px 0;border-top:1px solid var(--line);text-decoration:none}.connections a:first-child{padding-top:0;border-top:0}.connections strong,.connections small{display:block}.connections strong{font-size:12px}.connections small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.4}.connections a:hover strong{color:var(--accent)}.connections-more{margin:9px 0 0;color:var(--muted);font-size:9.6px;line-height:1.4}.external-source{display:flex;align-items:flex-start;justify-content:space-between;gap:8px;color:var(--accent);text-decoration:none}.external-source span,.external-source strong,.external-source small{display:block}.external-source strong{font-size:12px;line-height:1.35}.external-source small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.35;overflow-wrap:anywhere}.external-source b{font-size:13.2px}.external-source:hover strong{text-decoration:underline}
 .page-title-line{display:flex;align-items:center;gap:8px}.guide-trigger{display:grid;place-items:center;width:24px;height:24px;flex:0 0 auto;padding:0;border:1px solid var(--line);border-radius:50%;background:var(--panel);color:var(--muted);cursor:pointer}.guide-trigger svg{width:16px;height:16px;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round}.guide-trigger:hover{border-color:var(--accent-light);color:var(--accent)}.guide-trigger:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.page-guide{display:grid;grid-template-columns:1.05fr 1.25fr 1fr;gap:0;margin:0;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.resource-guide-popover{position:fixed;z-index:40;overflow:auto;box-shadow:0 18px 50px rgba(0,0,24,.24)}.resource-guide-popover[hidden]{display:none}.page-guide>div{padding:14px 16px;border-left:1px solid var(--line);min-width:0}.page-guide>div:first-child{border-left:0}.page-guide>div>span{display:block;color:var(--accent);text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780;margin-bottom:6px}.page-guide p{color:var(--muted);font-size:12px;line-height:1.5;margin:0}.guide-links{display:flex;flex-wrap:wrap;gap:5px;margin-top:8px}.guide-links a{color:var(--accent);background:var(--accent-soft);border-radius:99px;padding:4px 7px;text-decoration:none;font-size:9.6px;font-weight:700}
 .operation-tracking{display:grid;gap:2px;min-width:0;text-decoration:none}.operation-tracking strong,.operation-tracking small{display:block;overflow-wrap:anywhere}.operation-tracking small{color:var(--muted);line-height:1.35}.operation-tracking.running strong{color:#176143}.operation-tracking.waiting strong,.operation-tracking.mixed strong{color:var(--amber)}.operation-tracking.paused strong{color:var(--red)}a.operation-tracking:hover strong{text-decoration:underline}
-.page-actions{display:flex;align-items:center;justify-content:flex-end;gap:7px;flex-wrap:wrap}.repository-sync-status{min-height:18px;margin:7px 0 0;color:var(--muted);font-size:13.2px}.repository-sync-status.error{color:var(--red)}.onboarding-dialog{width:min(470px,calc(100vw - 30px));max-height:calc(100vh - 32px);margin:0;border:1px solid var(--line);border-radius:13px;padding:0;background:var(--panel);color:var(--ink);box-shadow:0 28px 90px rgba(0,0,24,.38);overflow:auto}.onboarding-dialog::backdrop{background:transparent;backdrop-filter:none}.onboarding-shade{position:fixed;inset:0;z-index:60;pointer-events:none}.onboarding-shade span{position:absolute;background:rgba(0,0,24,.58)}.onboarding-progress{display:grid;grid-template-columns:repeat(var(--onboarding-step-count),1fr);gap:5px;padding:18px 24px 0}.onboarding-progress span{height:3px;border-radius:3px;background:var(--surface-muted)}.onboarding-progress span.active{background:var(--accent-light)}.onboarding-head{padding:22px 25px 0}.onboarding-head h2{font-family:Georgia,serif;font-size:30px;font-weight:500;letter-spacing:-.015em;margin:8px 0 0}.onboarding-body{color:var(--muted);font-size:14.4px;line-height:1.6;margin:13px 25px 0}.onboarding-body+.onboarding-body{margin-top:8px}.onboarding-points{display:grid;gap:9px;margin:18px 25px 4px;padding-left:19px}.onboarding-points li{font-size:13.2px;line-height:1.5;padding-left:3px}.onboarding-sections{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin:16px 25px 4px}.onboarding-sections section{padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.onboarding-sections strong{font-size:13.2px}.onboarding-sections p{margin:6px 0 0;color:var(--muted);font-size:12px;line-height:1.5}.onboarding-actions{padding:12px 25px 23px}.onboarding-skip{margin-right:auto;color:var(--muted);text-transform:none;letter-spacing:0;font-size:13.2px}.onboarding-form{display:grid;grid-template-columns:1fr 1fr;gap:13px;margin:18px 25px 0}.onboarding-form label{display:block;min-width:0}.onboarding-form label.wide{grid-column:1/-1}.onboarding-form label>span{display:block;color:var(--ink);font-size:12px;font-weight:720;margin-bottom:6px}.onboarding-form input,.onboarding-form select,.onboarding-form textarea{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.onboarding-form textarea{min-height:78px;resize:vertical}.onboarding-form small{display:block;color:var(--muted);font-size:10.8px;line-height:1.45;margin-top:5px}.onboarding-write-note{color:var(--muted);font-size:10.8px;line-height:1.5;margin:12px 25px 0}.onboarding-dialog>.dialog-error{margin:8px 25px 0}.onboarding-focus{outline:4px solid var(--accent-light)!important;outline-offset:5px;scroll-margin-top:102px}
+.page-actions{display:flex;align-items:center;justify-content:flex-end;gap:7px;flex-wrap:wrap}.repository-sync-status{min-height:18px;margin:7px 0 0;color:var(--muted);font-size:13.2px}.repository-sync-status.error{color:var(--red)}.onboarding-dialog{width:min(470px,calc(100vw - 30px));max-height:calc(100vh - 32px);margin:0;border:1px solid var(--line);border-radius:13px;padding:0;background:var(--panel);color:var(--ink);box-shadow:0 28px 90px rgba(0,0,24,.38);overflow:hidden}.onboarding-dialog[open]{display:flex;flex-direction:column}.onboarding-dialog::backdrop{background:transparent;backdrop-filter:none}.onboarding-shade{position:fixed;inset:0;z-index:60;pointer-events:none}.onboarding-shade span{position:absolute;background:rgba(0,0,24,.58)}.onboarding-progress{display:grid;flex:0 0 auto;grid-template-columns:repeat(var(--onboarding-step-count),1fr);gap:5px;padding:18px 24px 0}.onboarding-progress span{height:3px;border-radius:3px;background:var(--surface-muted)}.onboarding-progress span.active{background:var(--accent-light)}.onboarding-scroll{min-height:0;overflow-y:auto}.onboarding-head{padding:22px 25px 0}.onboarding-head h2{font-family:Georgia,serif;font-size:30px;font-weight:500;letter-spacing:-.015em;margin:8px 0 0}.onboarding-body{color:var(--muted);font-size:14.4px;line-height:1.6;margin:13px 25px 0}.onboarding-body+.onboarding-body{margin-top:8px}.onboarding-points{display:grid;gap:9px;margin:18px 25px 4px;padding-left:19px}.onboarding-points li{font-size:13.2px;line-height:1.5;padding-left:3px}.onboarding-sections{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin:16px 25px 4px}.onboarding-sections section{padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.onboarding-sections strong{font-size:13.2px}.onboarding-sections p{margin:6px 0 0;color:var(--muted);font-size:12px;line-height:1.5}.onboarding-actions{flex:0 0 auto;padding:12px 25px 23px;border-top:1px solid var(--line);background:var(--panel)}.onboarding-skip{margin-right:auto;color:var(--muted);text-transform:none;letter-spacing:0;font-size:13.2px}.onboarding-form{display:grid;grid-template-columns:1fr 1fr;gap:13px;margin:18px 25px 0}.onboarding-form label{display:block;min-width:0}.onboarding-form label.wide{grid-column:1/-1}.onboarding-form label>span{display:block;color:var(--ink);font-size:12px;font-weight:720;margin-bottom:6px}.onboarding-form input,.onboarding-form select,.onboarding-form textarea{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.onboarding-form textarea{min-height:78px;resize:vertical}.onboarding-form small{display:block;color:var(--muted);font-size:10.8px;line-height:1.45;margin-top:5px}.onboarding-write-note{color:var(--muted);font-size:10.8px;line-height:1.5;margin:12px 25px 16px}.onboarding-scroll>.dialog-error{margin:8px 25px 0}.onboarding-focus{outline:4px solid var(--accent-light)!important;outline-offset:5px;scroll-margin-top:102px}
 .page-intro,.detail-head{align-items:center;margin-bottom:12px}.actions{align-items:center}.detail-head>div:first-child{min-width:0}.detail-head h2{margin:7px 0}.detail-head .header-breadcrumbs{margin:0;font-size:10.8px;line-height:normal;min-height:11px;align-items:center}.header-breadcrumbs span:last-child{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:60ch}
 @media(max-width:1200px){.readiness-flow{grid-template-columns:repeat(3,minmax(0,1fr))}.audit-engagement{grid-template-columns:1fr 1fr}.audit-engagement .button{grid-column:1/-1;justify-self:start}}
 @media(max-width:1100px){.search{display:none}.topbar-status{margin-left:auto}.metrics{grid-template-columns:repeat(2,1fr)}.dashboard-grid,.organization-grid{grid-template-columns:repeat(2,1fr)}.catalog{grid-template-columns:repeat(3,1fr)}.span-2{grid-column:span 2}.resource-directory{grid-template-columns:repeat(2,minmax(0,1fr))}}
 @media(max-width:760px){.shell{display:block}.sidebar{transform:translateX(-100%);transition:.2s;box-shadow:8px 0 30px rgba(0,0,0,.2)}.sidebar.shown{transform:translateX(0)}.workspace{min-width:0}.mobile-nav{display:block;border:0;background:none;font-size:24px}.topbar{height:72px;padding:0 16px}.topbar>div:first-of-type{min-width:0}.topbar-status{display:none}.search{display:flex;max-width:none}.search kbd,.topbar .eyebrow{display:none}.page{padding:20px 15px 60px}.hero{display:block;padding:23px}.hero-meta{margin-top:22px;flex-wrap:wrap}.metrics,.dashboard-grid,.organization-grid{grid-template-columns:1fr}.span-2{grid-column:auto}.catalog{grid-template-columns:repeat(2,1fr)}.detail-grid{grid-template-columns:1fr}.page-intro,.detail-head{display:block}.page-intro>.button,.actions{margin-top:15px}.page-intro>.list-header-tools{justify-content:flex-start;margin:15px 0 0}.list-header-tools label{max-width:none}.record-table{min-width:720px}.readiness-map{padding:17px}.readiness-map-head{grid-template-columns:1fr;gap:8px}.readiness-flow{grid-template-columns:repeat(2,minmax(0,1fr))}.audit-engagement{grid-template-columns:1fr}.audit-engagement .button{grid-column:auto}.resource-directory{grid-template-columns:1fr}}
-@media(max-width:760px){.setup-banner,.page-guide,.stage-overview-hero,.relationship-note,.group-destination-card,.stage-page-grid{grid-template-columns:1fr}.page-guide>div{border-left:0;border-top:1px solid var(--line)}.page-guide>div:first-child{border-top:0}.group-overview-head{display:block}.stage-progress-card,.stage-status-link{margin-top:15px}.destination-rollup{text-align:left}.form-grid{grid-template-columns:1fr}.record-table{min-width:0}.record-table thead{display:none}.record-table,.record-table tbody,.record-table tr{display:block}.record-table tr{padding:8px 12px;border-bottom:1px solid var(--line)}.record-table tr:last-child{border-bottom:0}.record-table td:not([data-label]){display:block}.record-table td[data-label]{display:grid;grid-template-columns:105px minmax(0,1fr);gap:10px;border:0;padding:7px 0;align-items:start}.record-table td[data-label]::before{content:attr(data-label);color:#75817b;text-transform:uppercase;letter-spacing:.07em;font-size:9.6px;font-weight:700}.record-table td[data-primary-field]{display:block;padding:8px 0 10px}.record-table td[data-primary-field]::before{display:none}.content-label{align-items:flex-start}.editor form{padding:18px}.diagnostics>div{grid-template-columns:58px minmax(0,1fr)}.diagnostics p{grid-column:1/-1}.changes code{overflow-wrap:anywhere}.onboarding-dialog{max-height:56vh}.onboarding-actions{position:sticky;bottom:0;background:var(--panel);border-top:1px solid var(--line)}}
+@media(max-width:760px){.setup-banner,.page-guide,.stage-overview-hero,.relationship-note,.group-destination-card,.stage-page-grid{grid-template-columns:1fr}.page-guide>div{border-left:0;border-top:1px solid var(--line)}.page-guide>div:first-child{border-top:0}.group-overview-head{display:block}.stage-progress-card,.stage-status-link{margin-top:15px}.destination-rollup{text-align:left}.form-grid{grid-template-columns:1fr}.record-table{min-width:0}.record-table thead{display:none}.record-table,.record-table tbody,.record-table tr{display:block}.record-table tr{padding:8px 12px;border-bottom:1px solid var(--line)}.record-table tr:last-child{border-bottom:0}.record-table td:not([data-label]){display:block}.record-table td[data-label]{display:grid;grid-template-columns:105px minmax(0,1fr);gap:10px;border:0;padding:7px 0;align-items:start}.record-table td[data-label]::before{content:attr(data-label);color:#75817b;text-transform:uppercase;letter-spacing:.07em;font-size:9.6px;font-weight:700}.record-table td[data-primary-field]{display:block;padding:8px 0 10px}.record-table td[data-primary-field]::before{display:none}.content-label{align-items:flex-start}.editor form{padding:18px}.diagnostics>div{grid-template-columns:58px minmax(0,1fr)}.diagnostics p{grid-column:1/-1}.changes code{overflow-wrap:anywhere}.onboarding-dialog{max-height:56vh}}
 @media(max-width:520px){.onboarding-form,.onboarding-sections,.setup-steps{grid-template-columns:1fr}.onboarding-form label.wide{grid-column:auto}.onboarding-actions{flex-wrap:wrap}.onboarding-skip{width:100%;order:3;margin:3px 0 0}.readiness-flow{grid-template-columns:1fr}.obligation-card-foot{align-items:flex-start;flex-direction:column}.obligation-action{align-self:flex-start}}
 @media(min-width:761px){.detail-grid{grid-template-columns:minmax(270px,1fr) minmax(0,2fr)}.detail-grid aside{grid-column:1;grid-row:1}.detail-main{grid-column:2;grid-row:1}}
 @media(min-width:761px){.detail-grid.detail-grid-structured{grid-template-columns:1fr}.detail-grid-structured aside{grid-column:1;grid-row:1;grid-template-columns:repeat(auto-fit,minmax(320px,1fr))}.detail-grid-structured aside>.panel{align-self:start}}