filegrc 0.3.3 → 0.3.4

package/README.md

@@ -34,7 +34,7 @@ npx filegrc prepare-audit audit-id
 npx filegrc evidence-packet --start 2026-01-01 --end 2026-06-30 --audit audit-id
 ```
 
-`filegrc serve --help` prints bind, port, environment, and safety options without starting the server. The editable server defaults to `127.0.0.1:8787`; set `FILEGRC_HOST`, `FILEGRC_PORT`, or the matching flags when needed.
+`filegrc serve --help` prints bind, port, environment, and safety options without starting the server. The editable server defaults to `127.0.0.1:8787`; set `FILEGRC_HOST`, `FILEGRC_PORT`, or the matching flags when needed. In trunk mode, browser saves synchronize, commit, and push from the authoritative branch. Use `--allow-non-authoritative-writes` for local development in a task checkout; the override never commits or pushes.
 
 `filegrc setup` provides the headless equivalent of browser onboarding. Run it without arguments for guided terminal setup, or pass all initial service-boundary fields and a management program goal as flags or a JSON payload. Add `--preview` to validate and inspect the planned service and workspace writes without saving. Add `--summary --json` for compact agent output. Selecting Type 1 or Type 2 updates the workspace goal and selected systems. Setup does not select framework records, link controls, create evidence, or create an audit record.
 
@@ -54,7 +54,7 @@ Use `filegrc attach <evidence-id> <source-file>` to copy a fixed evidence file u
 
 Use `filegrc detach <evidence-id> <attachment-name> --yes` for explicit removal. Evidence records with linked local attachments cannot be deleted.
 
-The package requires Node.js 20 or newer. It uses Git for authors, commit timestamps, messages, diffs, and revisions. Browser commits are explicit. Without a remote they remain local; with a remote the browser commits and pushes together. Browser pulls use rebase. Agents and terminal users use Git directly; the filegrc CLI does not wrap pull, commit, or push.
+The package requires Node.js 20 or newer. It uses Git for authors, commit timestamps, messages, diffs, and revisions. New workspaces use trunk mode, which fetches and fast-forwards before each browser mutation, validates and commits the saved change, then pushes. Existing settings without `repositoryMode` keep manual browser Git behavior. Agents and terminal users use Git directly; the filegrc CLI does not wrap pull, commit, or push.
 
 The editable server has no authentication and binds to loopback by default. Put it behind trusted authentication before exposing it on a network, or publish the read-only static build.
 

package/model/v1.json

@@ -104,17 +104,20 @@
       "pluralTitle": "Renderer settings",
       "group": "repository",
       "singleton": "renderer.json",
-      "description": "Optional local interface settings, including onboarding visibility and manually completed Step pages. Renderer settings are not required for SOC 2 and do not change compliance records.",
+      "description": "Optional local interface and browser repository settings, including onboarding visibility, manually completed Step pages, and authoritative-branch synchronization. Renderer settings are not required for SOC 2 and do not change compliance records.",
       "guidance": {
-        "policyBasis": "Renderer settings are a filegrc convenience, not a SOC 2 requirement, control, audit record, or substitute for evidence.",
-        "cadence": "Change it when the team wants to rerun or suppress an optional renderer workflow, then review and commit the resulting diff."
+        "policyBasis": "Renderer settings are a filegrc convenience, not a SOC 2 requirement, control, audit record, or substitute for evidence. Record lifecycle status represents approval; Git branches do not.",
+        "cadence": "Change it when the team wants to rerun or suppress an optional renderer workflow or change repository synchronization. Existing workspaces without repositoryMode keep manual browser Git behavior."
       },
       "required": ["showOnboarding"],
       "fields": {
         "showOnboarding": {"type":"boolean","label":"Show onboarding"},
-        "completedStagePageIds": {"type":"array","items":"string","label":"Manually completed program pages"}
+        "completedStagePageIds": {"type":"array","items":"string","label":"Manually completed program pages"},
+        "repositoryMode": {"type":"enum","values":["trunk","manual"],"label":"Repository mode"},
+        "authoritativeBranch": {"type":"string","format":"git-name","label":"Authoritative branch (defaults to main)"},
+        "repositoryRemote": {"type":"string","format":"git-name","label":"Repository remote (defaults to origin)"}
       },
-      "listFields": ["title","showOnboarding","completedStagePageIds"]
+      "listFields": ["title","showOnboarding","repositoryMode","authoritativeBranch","repositoryRemote","completedStagePageIds"]
     },
     "person": {
       "title": "Person",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/cli.js

@@ -36,6 +36,7 @@ import { validateWorkspace } from "./validate.js";
 import { loadWorkspace } from "./workspace.js";
 
 const BOOLEAN_FLAGS = new Set([
+  "allow-non-authoritative-writes",
   "check-docs",
   "complete",
   "current",
@@ -63,7 +64,8 @@ export async function runCli(argv = process.argv.slice(2)) {
   if (command === "serve") {
     const result = await serveWorkspace(positionals[0] ?? root, {
       host: flags.host ?? process.env.FILEGRC_HOST,
-      port: flags.port ?? process.env.FILEGRC_PORT
+      port: flags.port ?? process.env.FILEGRC_PORT,
+      allowNonAuthoritativeWrites: flags["allow-non-authoritative-writes"] === true
     });
     const stopped = new Promise((resolvePromise) => {
       const stop = () => {
@@ -683,7 +685,7 @@ function printHelp() {
   console.log(`filegrc - Git-native GRC workspace
 
 Usage:
-  filegrc serve [root] [--host 127.0.0.1] [--port 8787]
+  filegrc serve [root] [--host 127.0.0.1] [--port 8787] [--allow-non-authoritative-writes]
   filegrc setup [setup.json|-] [setup options] [--draft] [--preview] [--summary] [--json]
   filegrc build [root] [--output .filegrc/site]
   filegrc validate [root] [--json]
@@ -720,12 +722,15 @@ All commands accept --root <workspace>. Writes never create Git commits.`);
 function printCommandHelp(command) {
   if (command === "serve") {
     console.log(`Usage:
-  filegrc serve [root] [--host address] [--port number]
+  filegrc serve [root] [--host address] [--port number] [--allow-non-authoritative-writes]
 
 Options:
   --host <address>  Bind address. Defaults to FILEGRC_HOST or 127.0.0.1.
   --port <number>   Port. Defaults to FILEGRC_PORT or 8787. Use 0 for an available port.
   --root <path>     Workspace path when no positional root is given.
+  --allow-non-authoritative-writes
+                     Allow local browser writes from a task checkout. This explicit
+                     development override never commits or pushes.
   --help            Show this help without starting the server.
 
 Safety:

package/src/git-name.js

@@ -0,0 +1,16 @@
+export function isSafeGitName(value) {
+  const segments = value.split("/");
+  return Boolean(value)
+    && value !== "@"
+    && value !== "HEAD"
+    && !value.startsWith("-")
+    && !value.includes("..")
+    && !value.includes("@{")
+    && !/[\s~^:?*[\]\\\u0000-\u001f\u007f]/.test(value)
+    && segments.every((segment) => (
+      segment
+      && !segment.startsWith(".")
+      && !segment.endsWith(".")
+      && !segment.endsWith(".lock")
+    ));
+}

package/src/git.js

@@ -1,7 +1,14 @@
 import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { relative, resolve, sep } from "node:path";
+import { isSafeGitName } from "./git-name.js";
 import { serializeWorkspaceMutation } from "./mutation.js";
 import { resolveWorkspaceRoot } from "./paths.js";
 import { validateWorkspace } from "./validate.js";
+import { loadWorkspace } from "./workspace.js";
+
+const lastSuccessfulSynchronizations = new Map();
 
 export function getGitSummary(input = process.cwd()) {
   const root = resolveWorkspaceRoot(input);
@@ -120,6 +127,175 @@ export async function pushWorkspace(input = process.cwd()) {
   return serializeWorkspaceMutation(input, pushWorkspaceUnlocked);
 }
 
+export async function getBrowserRepositoryState(input = process.cwd(), options = {}) {
+  const root = resolveWorkspaceRoot(input);
+  const config = await getRepositoryConfig(root);
+  const gitSummary = getGitSummary(root);
+  if (config.mode !== "trunk") {
+    return {
+      mode: "manual",
+      authoritativeBranch: config.authoritativeBranch,
+      remote: config.remote,
+      developmentOverride: false,
+      status: "manual",
+      label: "Manual Git",
+      writesAllowed: !options.readOnly,
+      currentCommit: gitSummary.commit,
+      upstreamCommit: null,
+      ahead: null,
+      behind: null,
+      pendingCommits: [],
+      pendingCommitsFilegrcOnly: null,
+      lastSuccessfulSynchronization: lastSuccessfulSynchronizations.get(root) ?? null,
+      message: "Browser writes stay local until a user commits and synchronizes them."
+    };
+  }
+
+  const details = inspectTrunkRepository(root, config, gitSummary);
+  const developmentOverride = options.allowNonAuthoritativeWrites === true;
+  if (developmentOverride) {
+    return {
+      ...details,
+      developmentOverride: true,
+      writesAllowed: !options.readOnly,
+      status: "not-synced",
+      label: "Not synced",
+      message: "Development override is active. Browser writes stay local and FileGRC will not commit or push them."
+    };
+  }
+  return {
+    ...details,
+    developmentOverride: false,
+    writesAllowed: !options.readOnly && details.writesAllowed
+  };
+}
+
+export async function runBrowserMutation(input, options, task) {
+  return serializeWorkspaceMutation(input, async (root) => {
+    const config = await getRepositoryConfig(root);
+    if (config.mode !== "trunk" || options?.allowNonAuthoritativeWrites === true) {
+      return task(root);
+    }
+    return runTrunkMutationUnlocked(root, config, options, task);
+  });
+}
+
+export async function retryBrowserSync(input = process.cwd(), options = {}) {
+  return serializeWorkspaceMutation(input, async (root) => {
+    const config = await getRepositoryConfig(root);
+    if (config.mode !== "trunk") throw new Error("Retry sync is available only in trunk repository mode.");
+    if (options.allowNonAuthoritativeWrites === true) {
+      throw new Error("Retry sync is disabled while the development write override is active.");
+    }
+    const before = requireTrunkPreconditions(root, config, { allowAhead: true });
+    fetchConfiguredRemote(root, config.remote);
+    const synchronized = inspectTrunkRepository(root, config, getGitSummary(root));
+    if (synchronized.behind > 0 && synchronized.ahead > 0) {
+      throw new Error("The authoritative branch has diverged from its upstream. FileGRC will not merge or rebase it. Reconcile the repository with Git, then reload.");
+    }
+    if (synchronized.behind > 0) {
+      fastForwardConfiguredBranch(root, synchronized.upstream);
+    }
+    const ready = inspectTrunkRepository(root, config, getGitSummary(root));
+    if (ready.ahead > 0 && !ready.pendingCommitsFilegrcOnly) {
+      throw new Error("At least one commit ahead of upstream changes files outside this FileGRC workspace. FileGRC will not push it. Reconcile the repository with Git.");
+    }
+    if (ready.ahead > 0) pushConfiguredBranch(root, config);
+    const after = inspectTrunkRepository(root, config, getGitSummary(root));
+    if (after.ahead !== 0 || after.behind !== 0) {
+      throw new Error("The authoritative branch is still not synchronized. Reload the repository state before trying again.");
+    }
+    const synchronizedAt = new Date().toISOString();
+    lastSuccessfulSynchronizations.set(root, synchronizedAt);
+    return {
+      commit: after.currentCommit,
+      shortCommit: after.currentCommit?.slice(0, 8) ?? null,
+      branch: config.authoritativeBranch,
+      upstream: after.upstream,
+      synchronizedAt,
+      retriedCommits: before.ahead ?? 0
+    };
+  });
+}
+
+async function runTrunkMutationUnlocked(root, config, options, task) {
+  requireTrunkPreconditions(root, config);
+  fetchConfiguredRemote(root, config.remote);
+  let synchronized = inspectTrunkRepository(root, config, getGitSummary(root));
+  if (synchronized.ahead > 0 && synchronized.behind > 0) {
+    throw new Error("The authoritative branch has diverged from its upstream. FileGRC will not merge or rebase it. Reconcile the repository with Git, then reload.");
+  }
+  if (synchronized.ahead > 0) {
+    throw new Error("The authoritative branch has local commits waiting to be pushed. Use Retry sync before making another browser change.");
+  }
+  if (synchronized.behind > 0) {
+    fastForwardConfiguredBranch(root, synchronized.upstream);
+    synchronized = inspectTrunkRepository(root, config, getGitSummary(root));
+  }
+  if (synchronized.ahead !== 0 || synchronized.behind !== 0) {
+    throw new Error("The authoritative branch is not synchronized with its upstream. Reload after reconciling the repository with Git.");
+  }
+
+  let result;
+  let subject;
+  try {
+    result = await task(root);
+    subject = generatedCommitMessage(typeof options?.message === "function" ? options.message(result) : options?.message);
+    const validation = await validateWorkspace(root);
+    if (!validation.ok) {
+      throw new Error(`The workspace has ${validation.counts.errors} validation ${validation.counts.errors === 1 ? "error" : "errors"}. The browser change was rolled back.`);
+    }
+    assertNoOutsideWorktreeChanges(root);
+  } catch (error) {
+    try {
+      await rollbackWorkspaceChanges(root);
+    } catch (rollbackError) {
+      throw new Error(`${error.message} FileGRC could not roll back the workspace change. ${rollbackError.message} Later browser mutations are blocked until the Git worktree is reconciled.`);
+    }
+    throw error;
+  }
+
+  if (!getGitSummary(root).changes.length) {
+    throw new Error("The browser action did not change any FileGRC workspace files.");
+  }
+  if (!tryGit(root, ["config", "user.name"]) || !tryGit(root, ["config", "user.email"])) {
+    throw new Error("Configure git user.name and git user.email before browser changes can be committed. The saved files remain uncommitted and later browser changes are blocked.");
+  }
+  gitForWrite(root, ["add", "--all", "--", "."], "stage the FileGRC workspace change");
+  assertNoOutsideWorktreeChanges(root, false);
+  assertOnlyWorkspaceFilesStaged(root);
+  try {
+    gitForWrite(root, ["commit", "-m", subject, "--", "."], "create the FileGRC browser commit");
+  } catch (error) {
+    throw new Error(`${error.message} The saved files remain in the Git worktree and later browser changes are blocked.`);
+  }
+
+  const committed = getGitSummary(root);
+  let pushError = null;
+  try {
+    pushConfiguredBranch(root, config);
+  } catch (error) {
+    pushError = `${error.message} The local FileGRC commit was retained. Use Retry sync after the remote is available.`;
+  }
+  const after = inspectTrunkRepository(root, config, getGitSummary(root));
+  let synchronizedAt = null;
+  if (!pushError && after.ahead === 0 && after.behind === 0) {
+    synchronizedAt = new Date().toISOString();
+    lastSuccessfulSynchronizations.set(root, synchronizedAt);
+  }
+  return {
+    ...result,
+    synchronization: {
+      status: pushError ? "not-synced" : "synced",
+      commit: committed.commit,
+      shortCommit: committed.shortCommit,
+      upstream: after.upstream,
+      synchronizedAt,
+      pushError
+    }
+  };
+}
+
 async function commitWorkspaceUnlocked(root, message) {
   const subject = String(message ?? "").trim();
   if (!subject || subject.length > 200 || /[\u0000-\u001f\u007f]/.test(subject)) {
@@ -233,6 +409,299 @@ function syncReadySummary(root, action) {
   return summary;
 }
 
+async function getRepositoryConfig(root) {
+  const loaded = await loadWorkspace(root);
+  const renderer = loaded.resources.find(({ type, id }) => type === "renderer-settings" && id === "renderer-settings");
+  const mode = renderer?.repositoryMode === "trunk" ? "trunk" : "manual";
+  const authoritativeBranch = cleanGitName(renderer?.authoritativeBranch, "main");
+  const remote = cleanGitName(renderer?.repositoryRemote, "origin");
+  return {
+    mode,
+    authoritativeBranch,
+    remote,
+    configurationError: !isSafeGitName(authoritativeBranch)
+      ? "The configured authoritative branch is not a safe Git branch name. Update renderer settings before using browser writes."
+      : !isSafeGitName(remote)
+        ? "The configured repository remote is not a safe Git remote name. Update renderer settings before using browser writes."
+        : null
+  };
+}
+
+function inspectTrunkRepository(root, config, summary = getGitSummary(root)) {
+  const base = {
+    mode: "trunk",
+    authoritativeBranch: config.authoritativeBranch,
+    remote: config.remote,
+    currentCommit: summary.commit,
+    upstreamCommit: null,
+    upstream: summary.upstream,
+    ahead: null,
+    behind: null,
+    pendingCommits: [],
+    pendingCommitsFilegrcOnly: null,
+    lastSuccessfulSynchronization: lastSuccessfulSynchronizations.get(root) ?? null,
+    wholeWorktreeClean: summary.available ? wholeWorktreeClean(root) : null,
+    operationInProgress: summary.available ? repositoryOperation(root) : null,
+    writesAllowed: false
+  };
+  if (config.configurationError) {
+    return {
+      ...base,
+      status: "git-setup-required",
+      label: "Git setup required",
+      message: config.configurationError
+    };
+  }
+  if (!summary.available) {
+    return {
+      ...base,
+      status: "git-setup-required",
+      label: "Git setup required",
+      message: "Git is unavailable. Install Git and open this workspace from its authoritative repository checkout."
+    };
+  }
+  if (summary.branch !== config.authoritativeBranch) {
+    return {
+      ...base,
+      status: "read-only-checkout",
+      label: "Read-only checkout",
+      message: "This checkout is not the authoritative FileGRC branch. You can review the program here, but browser changes are disabled. Run FileGRC from the main checkout or use the explicit development override."
+    };
+  }
+  if (!summary.remotes.includes(config.remote)) {
+    return {
+      ...base,
+      status: "git-setup-required",
+      label: "Git setup required",
+      message: `The configured Git remote "${config.remote}" does not exist. Add it and configure the authoritative branch upstream before using browser writes.`
+    };
+  }
+  const expectedUpstream = `${config.remote}/${config.authoritativeBranch}`;
+  if (summary.upstream !== expectedUpstream) {
+    return {
+      ...base,
+      status: "git-setup-required",
+      label: "Git setup required",
+      message: `The authoritative branch must track ${expectedUpstream}. Configure that upstream with Git before using browser writes.`
+    };
+  }
+  const upstreamCommit = tryGit(root, ["rev-parse", expectedUpstream]) || null;
+  const counts = upstreamCommit ? aheadBehind(root, expectedUpstream) : { ahead: null, behind: null };
+  const pendingCommits = counts.ahead > 0 ? commitsAhead(root, expectedUpstream) : [];
+  const pendingCommitsFilegrcOnly = counts.ahead > 0 ? commitsOnlyTouchWorkspace(root, expectedUpstream) : true;
+  const details = {
+    ...base,
+    upstreamCommit,
+    ahead: counts.ahead,
+    behind: counts.behind,
+    pendingCommits,
+    pendingCommitsFilegrcOnly
+  };
+  if (base.operationInProgress) {
+    return {
+      ...details,
+      status: "not-synced",
+      label: "Not synced",
+      message: `A Git ${base.operationInProgress} is in progress. Finish or abort it with Git before using browser writes.`
+    };
+  }
+  if (!base.wholeWorktreeClean) {
+    return {
+      ...details,
+      status: "not-synced",
+      label: "Not synced",
+      message: "The Git worktree has uncommitted changes. Commit, discard, or move them with Git before using browser writes."
+    };
+  }
+  if (counts.ahead === null || counts.behind === null) {
+    return {
+      ...details,
+      status: "git-setup-required",
+      label: "Git setup required",
+      message: `The upstream ${expectedUpstream} is unavailable locally. Fetch ${config.remote} with Git, then reload.`
+    };
+  }
+  if (counts.ahead > 0 || counts.behind > 0) {
+    const external = counts.ahead > 0 && !pendingCommitsFilegrcOnly;
+    return {
+      ...details,
+      status: "not-synced",
+      label: "Not synced",
+      message: external
+        ? "A commit ahead of upstream changes files outside this FileGRC workspace. Reconcile it with Git. FileGRC will not push it."
+        : counts.ahead > 0 && counts.behind > 0
+          ? "The authoritative branch has diverged from upstream. Reconcile it with Git. FileGRC will not merge or rebase it."
+          : counts.ahead > 0
+            ? "FileGRC-only commits are waiting to be pushed. Use Retry sync."
+            : "The authoritative branch is behind upstream. The next browser mutation will fast-forward before writing.",
+      writesAllowed: counts.ahead === 0 && counts.behind > 0,
+      retrySafe: counts.ahead > 0 && counts.behind === 0 && pendingCommitsFilegrcOnly
+    };
+  }
+  return {
+    ...details,
+    status: "synced",
+    label: "Synced",
+    message: `The authoritative branch is synchronized with ${expectedUpstream}.`,
+    writesAllowed: true,
+    retrySafe: false
+  };
+}
+
+function requireTrunkPreconditions(root, config, options = {}) {
+  const summary = getGitSummary(root);
+  const state = inspectTrunkRepository(root, config, summary);
+  if (config.configurationError) throw new Error(state.message);
+  if (!summary.available) throw new Error(state.message);
+  if (summary.branch !== config.authoritativeBranch) throw new Error(state.message);
+  if (!summary.remotes.includes(config.remote)) throw new Error(state.message);
+  if (summary.upstream !== `${config.remote}/${config.authoritativeBranch}`) throw new Error(state.message);
+  if (state.operationInProgress) throw new Error(state.message);
+  if (!state.wholeWorktreeClean) throw new Error(state.message);
+  if (!options.allowAhead && state.ahead > 0) {
+    throw new Error("The authoritative branch has local commits waiting to be pushed. Use Retry sync before making another browser change.");
+  }
+  return state;
+}
+
+function fetchConfiguredRemote(root, remote) {
+  gitForWrite(root, ["fetch", "--prune", "--", remote], `fetch ${remote}`);
+}
+
+function fastForwardConfiguredBranch(root, upstream) {
+  gitForWrite(root, ["merge", "--ff-only", "--", upstream], `fast-forward from ${upstream}`);
+}
+
+function pushConfiguredBranch(root, config) {
+  gitForWrite(
+    root,
+    ["push", "--porcelain", "--", config.remote, `HEAD:refs/heads/${config.authoritativeBranch}`],
+    `push ${config.authoritativeBranch} to ${config.remote}`
+  );
+}
+
+function wholeWorktreeClean(root) {
+  return git(root, ["status", "--porcelain=v1"]) === "";
+}
+
+function repositoryOperation(root) {
+  for (const [name, gitPath] of [
+    ["merge", "MERGE_HEAD"],
+    ["rebase", "rebase-merge"],
+    ["rebase", "rebase-apply"],
+    ["cherry-pick", "CHERRY_PICK_HEAD"]
+  ]) {
+    const path = tryGit(root, ["rev-parse", "--git-path", gitPath]);
+    if (path && existsSync(resolve(root, path))) return name;
+  }
+  return null;
+}
+
+function aheadBehind(root, upstream) {
+  const output = tryGit(root, ["rev-list", "--left-right", "--count", `HEAD...${upstream}`]);
+  const [ahead, behind] = output.split(/\s+/).map(Number);
+  return Number.isInteger(ahead) && Number.isInteger(behind)
+    ? { ahead, behind }
+    : { ahead: null, behind: null };
+}
+
+function commitsAhead(root, upstream) {
+  return lines(tryGit(root, ["log", "--format=%H%x1f%s", `${upstream}..HEAD`])).map((line) => {
+    const [commit, subject] = line.split("\x1f");
+    return { commit, shortCommit: commit.slice(0, 8), subject };
+  });
+}
+
+function commitsOnlyTouchWorkspace(root, upstream) {
+  const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
+  const prefix = relative(topLevel, root).split(sep).join("/");
+  const commits = lines(tryGit(root, ["rev-list", `${upstream}..HEAD`]));
+  return commits.every((commit) => {
+    const paths = nulFields(tryGitRaw(topLevel, [
+      "diff-tree",
+      "--no-commit-id",
+      "--name-only",
+      "-z",
+      "-r",
+      "--root",
+      commit
+    ]));
+    return paths.length > 0 && paths.every((path) => pathInsideWorkspace(path, prefix));
+  });
+}
+
+function assertNoOutsideWorktreeChanges(root, rollbackExpected = true) {
+  const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
+  const prefix = relative(topLevel, root).split(sep).join("/");
+  const paths = statusPaths(topLevel);
+  if (paths.some((path) => !pathInsideWorkspace(path, prefix))) {
+    throw new Error(rollbackExpected
+      ? "Files outside this FileGRC workspace changed while the browser action was running. The FileGRC change was rolled back; reconcile the other Git work first."
+      : "Files outside this FileGRC workspace changed while the browser action was being staged. The saved FileGRC files remain uncommitted and later browser mutations are blocked; reconcile the Git worktree.");
+  }
+}
+
+function assertOnlyWorkspaceFilesStaged(root) {
+  const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
+  const prefix = relative(topLevel, root).split(sep).join("/");
+  const staged = nulFields(tryGitRaw(topLevel, [
+    "diff",
+    "--cached",
+    "--name-only",
+    "-z",
+    "--diff-filter=ACDMRTUXB"
+  ]));
+  if (!staged.length) throw new Error("The browser action did not stage any FileGRC workspace files.");
+  if (staged.some((path) => !pathInsideWorkspace(path, prefix))) {
+    throw new Error("Git has staged files outside this FileGRC workspace. FileGRC will not create a browser commit until those files are unstaged.");
+  }
+}
+
+async function rollbackWorkspaceChanges(root) {
+  gitForWrite(root, ["restore", "--staged", "--worktree", "--source=HEAD", "--", "."], "roll back the FileGRC workspace change");
+  const untracked = nulFields(tryGitRaw(root, ["ls-files", "-z", "--others", "--exclude-standard", "--", "."]));
+  for (const path of untracked) {
+    const absolute = resolve(root, path);
+    if (absolute === root || !absolute.startsWith(`${root}${sep}`)) continue;
+    await rm(absolute, { force: true });
+  }
+}
+
+function statusPaths(topLevel) {
+  const output = tryGitRaw(topLevel, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+  if (!output) return [];
+  const fields = nulFields(output);
+  const paths = [];
+  for (let index = 0; index < fields.length; index += 1) {
+    const field = fields[index];
+    if (!/^[ MADRCU?!]{2} /.test(field)) {
+      paths.push(field);
+      continue;
+    }
+    const status = field.slice(0, 2);
+    paths.push(field.slice(3));
+    if (/[RC]/.test(status) && fields[index + 1] !== undefined) paths.push(fields[++index]);
+  }
+  return paths;
+}
+
+function pathInsideWorkspace(path, prefix) {
+  return !prefix || path === prefix || path.startsWith(`${prefix}/`);
+}
+
+function generatedCommitMessage(value) {
+  const subject = String(value ?? "")
+    .replace(/[\u0000-\u001f\u007f]+/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+  return (subject || "Update FileGRC workspace").slice(0, 200);
+}
+
+function cleanGitName(value, fallback) {
+  const normalized = String(value ?? fallback).trim();
+  return normalized || fallback;
+}
+
 function parseLogLine(line) {
   if (!line) return null;
   const [commit, timestamp, author, subject] = line.split("\x1f");
@@ -261,6 +730,28 @@ function tryGit(cwd, args) {
   }
 }
 
+function tryGitRaw(cwd, args) {
+  try {
+    return gitRaw(cwd, args);
+  } catch {
+    return "";
+  }
+}
+
+function gitRaw(cwd, args) {
+  return execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 10_000,
+    maxBuffer: 20_000_000
+  });
+}
+
+function nulFields(source) {
+  return source ? source.split("\0").filter(Boolean) : [];
+}
+
 function gitForWrite(cwd, args, action = "create the commit") {
   try {
     return execFileSync("git", args, {
@@ -276,11 +767,18 @@ function gitForWrite(cwd, args, action = "create the commit") {
       }
     }).trim();
   } catch (error) {
-    const message = error.stderr?.trim() || error.stdout?.trim() || error.message;
+    const message = sanitizeGitErrorMessage(error.stderr?.trim() || error.stdout?.trim() || error.message);
     throw new Error(`Git could not ${action}. ${message}`);
   }
 }
 
+export function sanitizeGitErrorMessage(value) {
+  return String(value || "Git returned no error detail.")
+    .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s@]+@/gi, "$1[redacted]@")
+    .replace(/([?&](?:access[_-]?token|auth|key|password|secret|token)=)[^&\s]+/gi, "$1[redacted]")
+    .replace(/\b(authorization:\s*)(?:basic|bearer)\s+\S+/gi, "$1[redacted]");
+}
+
 function tryGitForWrite(cwd, args) {
   try {
     gitForWrite(cwd, args);

package/src/index.js

@@ -18,11 +18,14 @@ export {
 export {
   commitAndPushWorkspace,
   commitWorkspace,
+  getBrowserRepositoryState,
   getFileHistory,
   getGitSummary,
   getWorkspaceHistories,
   pullWorkspace,
-  pushWorkspace
+  pushWorkspace,
+  retryBrowserSync,
+  runBrowserMutation
 } from "./git.js";
 export { generateModelDocumentation } from "./model-docs.js";
 export { renderMarkdown } from "./markdown.js";

package/src/mutation.js

@@ -1,11 +1,14 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { resolveWorkspaceRoot } from "./paths.js";
 
 const mutationQueues = new Map();
+const activeMutation = new AsyncLocalStorage();
 
 export function serializeWorkspaceMutation(input, task) {
   const root = resolveWorkspaceRoot(input);
+  if (activeMutation.getStore() === root) return task(root);
   const previous = mutationQueues.get(root) ?? Promise.resolve();
-  const run = previous.catch(() => {}).then(() => task(root));
+  const run = previous.catch(() => {}).then(() => activeMutation.run(root, () => task(root)));
   let tracked;
   tracked = run.finally(() => {
     if (mutationQueues.get(root) === tracked) mutationQueues.delete(root);

package/src/server.js

@@ -7,7 +7,15 @@ import { generateEvidencePacket, prepareEvidencePacket } from "./evidence-packet
 import { ensureEvidenceTestDrafts } from "./evidence-tests.js";
 import { FAVICON_PNG, LOGO_MARK_PNG } from "./favicon.js";
 import { createResource, deleteResource, updateContent, updateResource } from "./files.js";
-import { commitAndPushWorkspace, getFileHistory, pullWorkspace, pushWorkspace } from "./git.js";
+import {
+  commitAndPushWorkspace,
+  getBrowserRepositoryState,
+  getFileHistory,
+  pullWorkspace,
+  pushWorkspace,
+  retryBrowserSync,
+  runBrowserMutation
+} from "./git.js";
 import { completeObligationOccurrence, createObligationEvent, planObligations } from "./obligations.js";
 import { isWithin, relativeToWorkspace, resolveWorkspacePath } from "./paths.js";
 import { createAppState } from "./state.js";
@@ -26,7 +34,9 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
         return json(response, 403, { error: "Cross-origin writes are not allowed." });
       }
       if (request.method === "GET" && url.pathname === "/api/state") {
-        return json(response, 200, await createAppState(input));
+        return json(response, 200, await createAppState(input, {
+          allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites
+        }));
       }
       if (request.method === "GET" && url.pathname === "/api/history") {
         const path = url.searchParams.get("path");
@@ -44,17 +54,22 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
         }));
       }
       if (request.method === "POST" && url.pathname === "/api/obligation-events") {
-        return json(response, 201, await createObligationEvent(input, await readJson(request)));
+        const payload = await readJson(request);
+        return json(response, 201, await browserMutation(input, options, {
+          message: (result) => `Create policy event: ${result.event?.title || payload.title || payload.eventType}`
+        }, () => createObligationEvent(input, payload)));
       }
       if (request.method === "POST" && url.pathname === "/api/obligation-completions") {
         const payload = await readJson(request);
         if (!safeSegment(payload.obligationId)) return json(response, 400, { error: "A safe obligation ID is required." });
-        const result = await completeObligationOccurrence(input, {
+        const result = await browserMutation(input, options, {
+          message: () => `Complete ${resourceTypeLabel(payload.record?.type)}: ${payload.record?.title || payload.obligationId}`
+        }, () => completeObligationOccurrence(input, {
           obligationId: payload.obligationId,
           record: payload.record,
           content: payload.content,
           expectedRevision: payload.revision
-        });
+        }));
         return json(response, 201, result);
       }
       if (request.method === "GET" && url.pathname === "/api/evidence-packet") {
@@ -82,34 +97,54 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
         });
       }
       if (request.method === "POST" && url.pathname === "/api/audit-preparation") {
-        return json(response, 201, await prepareAuditWorkspace(input, await readJson(request)));
+        const payload = await readJson(request);
+        return json(response, 201, await browserMutation(input, options, {
+          message: () => `Prepare audit: ${payload.auditId || "engagement"}`
+        }, () => prepareAuditWorkspace(input, payload)));
       }
       if (request.method === "POST" && url.pathname === "/api/evidence-test-drafts") {
-        return json(response, 201, await ensureEvidenceTestDrafts(input));
+        return json(response, 201, await browserMutation(input, options, {
+          message: "Create evidence collection test drafts"
+        }, () => ensureEvidenceTestDrafts(input)));
       }
       if (request.method === "POST" && url.pathname === "/api/setup") {
-        return json(response, 200, await setupWorkspace(input, await readJson(request)));
+        const payload = await readJson(request);
+        return json(response, 200, await browserMutation(input, options, {
+          message: (result) => `${payload.draft === true ? "Save onboarding draft" : "Complete onboarding"} for ${result.workspace.organizationName}`
+        }, () => setupWorkspace(input, payload)));
       }
       if (request.method === "POST" && url.pathname === "/api/resources") {
         const payload = await readJson(request);
         const record = payload.record ?? payload;
-        const result = await createResource(input, record, { content: payload.record ? payload.content : undefined });
-        return json(response, 201, { record: result.record });
+        const result = await browserMutation(input, options, {
+          message: () => `Create ${resourceTypeLabel(record.type)}: ${record.title || record.id}`
+        }, () => createResource(input, record, { content: payload.record ? payload.content : undefined }));
+        return json(response, 201, { record: result.record, synchronization: result.synchronization });
       }
       if (request.method === "POST" && url.pathname === "/api/commit") {
+        await requireManualBrowserGit(input, options);
         const payload = await readJson(request);
         return json(response, 201, await commitAndPushWorkspace(input, payload.message));
       }
       if (request.method === "POST" && url.pathname === "/api/git/pull") {
+        await requireManualBrowserGit(input, options);
         return json(response, 200, await pullWorkspace(input));
       }
       if (request.method === "POST" && url.pathname === "/api/git/push") {
+        await requireManualBrowserGit(input, options);
         return json(response, 200, await pushWorkspace(input));
       }
+      if (request.method === "POST" && url.pathname === "/api/git/retry-sync") {
+        return json(response, 200, await retryBrowserSync(input, {
+          allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites
+        }));
+      }
       if (request.method === "PUT" && url.pathname === "/api/content") {
         const payload = await readJson(request);
-        const result = await updateContent(input, payload.path, payload.source, { expectedRevision: payload.revision });
-        return json(response, 200, { path: result.dataRelativePath });
+        const result = await browserMutation(input, options, {
+          message: () => `Update content: ${payload.path}`
+        }, () => updateContent(input, payload.path, payload.source, { expectedRevision: payload.revision }));
+        return json(response, 200, { path: result.dataRelativePath, synchronization: result.synchronization });
       }
       const match = /^\/api\/resource\/([^/]+)\/([^/]+)$/.exec(url.pathname);
       if (match) {
@@ -124,16 +159,26 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
         if (request.method === "PUT") {
           const payload = await readJson(request);
           const record = payload.record ?? payload;
-          const result = await updateResource(input, type, id, record, {
+          const result = await browserMutation(input, options, {
+            message: () => `Update ${resourceTypeLabel(type)}: ${record.title || id}`
+          }, () => updateResource(input, type, id, record, {
             content: payload.record ? payload.content : undefined,
             expectedRevision: payload.revision,
             expectedContentRevisions: payload.contentRevisions
-          });
-          return json(response, 200, { record: result.record });
+          }));
+          return json(response, 200, { record: result.record, synchronization: result.synchronization });
         }
         if (request.method === "DELETE") {
-          const result = await deleteResource(input, type, id, { expectedRevision: url.searchParams.get("revision") });
-          return json(response, 200, { deleted: true, type, id, deletedContent: result.deletedContent });
+          const result = await browserMutation(input, options, {
+            message: () => `Delete ${resourceTypeLabel(type)}: ${id}`
+          }, () => deleteResource(input, type, id, { expectedRevision: url.searchParams.get("revision") }));
+          return json(response, 200, {
+            deleted: true,
+            type,
+            id,
+            deletedContent: result.deletedContent,
+            synchronization: result.synchronization
+          });
         }
       }
       if (request.method === "GET" && url.pathname === "/favicon.png") return text(response, 200, FAVICON_PNG, "image/png");
@@ -185,7 +230,10 @@ export async function serveWorkspace(input = process.cwd(), options = {}) {
   }
   const loaded = await loadWorkspace(input);
   getResourceDefinition(loaded.model, "workspace");
-  const server = createFilegrcServer(loaded.root, { allowedHosts: [host] });
+  const server = createFilegrcServer(loaded.root, {
+    allowedHosts: [host],
+    allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites === true
+  });
   await new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen(port, host, resolve);
@@ -198,6 +246,26 @@ export async function serveWorkspace(input = process.cwd(), options = {}) {
   };
 }
 
+function browserMutation(input, options, mutationOptions, task) {
+  return runBrowserMutation(input, {
+    ...mutationOptions,
+    allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites === true
+  }, task);
+}
+
+async function requireManualBrowserGit(input, options) {
+  const repository = await getBrowserRepositoryState(input, {
+    allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites
+  });
+  if (repository.mode === "trunk") {
+    throw new Error("Browser commit, pull, and push controls are disabled in trunk mode. Saved changes synchronize automatically.");
+  }
+}
+
+function resourceTypeLabel(value) {
+  return String(value || "record").replaceAll("-", " ");
+}
+
 async function readJson(request) {
   const chunks = [];
   let size = 0;
@@ -296,7 +364,7 @@ function statusFor(error) {
   if (/exceeds 2 MB/i.test(error.message)) return 413;
   if (/changed after you opened|source changed|revision changed/i.test(error.message)) return 409;
   if (/already exists|target file already exists/i.test(error.message)) return 409;
-  if (/Git could not (?:pull|push)|upstream branch|multiple remotes|no Git remote|check out a branch|before trying to (?:pull|push)/i.test(error.message)) return 409;
+  if (/Git could not|upstream branch|multiple remotes|no Git remote|configured repository remote|safe Git name|check out a branch|before trying to (?:pull|push)|authoritative branch|not synchronized|not synced|diverged|waiting to be pushed|Retry sync|outside this FileGRC workspace|worktree has uncommitted changes|development write override|browser commit, pull, and push/i.test(error.message)) return 409;
   if (/not found|ENOENT/i.test(error.message)) return 404;
   if (/invalid|required|unsafe|match|workspace|singleton|commit message|no changes|git history|git user|unknown resource type|must use|must be|content path|data path|path leaves|valid .*date|not found|no active obligations|end date|through date|already exists|EEXIST/i.test(error.message)) return 400;
   return 500;

package/src/state.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { assessAuditPreparation } from "./audit-preparation.js";
-import { getGitSummary, getWorkspaceHistories } from "./git.js";
+import { getBrowserRepositoryState, getGitSummary, getWorkspaceHistories } from "./git.js";
 import { renderMarkdown } from "./markdown.js";
 import { planObligations } from "./obligations.js";
 import { resolveDataPath } from "./paths.js";
@@ -42,6 +42,10 @@ export async function createAppState(input = process.cwd(), options = {}) {
 
   const git = getGitSummary(loaded.root);
   delete git.root;
+  const repository = await getBrowserRepositoryState(loaded.root, {
+    readOnly: options.readOnly,
+    allowNonAuthoritativeWrites: options.allowNonAuthoritativeWrites
+  });
   const workspace = loaded.workspace ?? {
     schemaVersion: 1,
     dataModelVersion: loaded.model.modelVersion,
@@ -70,7 +74,8 @@ export async function createAppState(input = process.cwd(), options = {}) {
   ));
   return {
     generatedAt,
-    readOnly: Boolean(options.readOnly),
+    readOnly: Boolean(options.readOnly || (repository.mode === "trunk" && !repository.writesAllowed)),
+    repository,
     workspace,
     model: loaded.model,
     resources: entries,

package/src/validate.js

@@ -1,5 +1,6 @@
 import { stat } from "node:fs/promises";
 import { getResourceDefinition } from "../model/index.js";
+import { isSafeGitName } from "./git-name.js";
 import { isCanonicalDataPath, resolveDataPath } from "./paths.js";
 import { parseCalendarDate, validCalendarRecurrence } from "./recurrence.js";
 import { obligationIsRunning } from "./program-lifecycle.js";
@@ -476,6 +477,7 @@ function validateValue(name, value, field, model, path, diagnostics) {
   }
   if (field.format === "email" && !EMAIL_PATTERN.test(value)) fail("must be an email address.");
   if (field.format === "timezone" && !isTimezone(value)) fail("must be an IANA time zone.");
+  if (field.format === "git-name" && !isSafeGitName(value)) fail("must be a safe Git name.");
 }
 
 function validateNumericRange(value, field, fail) {

package/src/web.js

@@ -217,7 +217,19 @@ function topbar(route) {
           : route.name === "audit-packet"
             ? "Audit Readiness"
             : state.model.resources[route.type]?.pluralTitle || "filegrc";
-  return '<button class="mobile-nav" type="button" aria-label="Open navigation" aria-controls="sidebar-navigation" aria-expanded="false">☰</button><div><small class="eyebrow">' + esc(state.workspace.organizationName) + '</small><h1>' + esc(titleCase(title)) + '</h1></div><label class="search"><span aria-hidden="true">⌕</span><input id="global-search" type="search" placeholder="Search records" aria-label="Search records"><kbd>/</kbd></label><div class="topbar-status"><a class="validation-chip" href="#/repository"><span class="status-dot ' + (state.validation.ok ? "good" : "bad") + '"></span>' + (state.validation.ok ? "Data valid" : state.validation.counts.errors + " validation errors") + '</a><a class="repo-chip" href="#/repository"><span class="status-dot ' + (state.git.clean ? "good" : "warn") + '"></span>' + esc(state.git.available ? ((state.git.branch || "detached") + " · " + state.git.shortCommit) : "Git unavailable") + '</a></div>';
+  const repositoryLabel = state.repository?.mode === "trunk"
+    ? state.repository.label
+    : state.git.available ? ((state.git.branch || "detached") + " · " + state.git.shortCommit) : "Git unavailable";
+  const repositoryTone = state.repository?.mode === "trunk"
+    ? repositoryStatusTone(state.repository.status)
+    : state.git.clean ? "good" : "warn";
+  return '<button class="mobile-nav" type="button" aria-label="Open navigation" aria-controls="sidebar-navigation" aria-expanded="false">☰</button><div><small class="eyebrow">' + esc(state.workspace.organizationName) + '</small><h1>' + esc(titleCase(title)) + '</h1></div><label class="search"><span aria-hidden="true">⌕</span><input id="global-search" type="search" placeholder="Search records" aria-label="Search records"><kbd>/</kbd></label><div class="topbar-status"><a class="validation-chip" href="#/repository"><span class="status-dot ' + (state.validation.ok ? "good" : "bad") + '"></span>' + (state.validation.ok ? "Data valid" : state.validation.counts.errors + " validation errors") + '</a><a class="repo-chip" href="#/repository"><span class="status-dot ' + repositoryTone + '"></span>' + esc(repositoryLabel) + '</a></div>';
+}
+
+function repositoryStatusTone(status) {
+  if (status === "synced") return "good";
+  if (status === "syncing") return "neutral";
+  return "warn";
 }
 
 function renderHome(main) {
@@ -1132,6 +1144,7 @@ function renderOrganization(main) {
 }
 
 function renderRepository(main) {
+  if (state.repository?.mode === "trunk") return renderTrunkRepository(main);
   const settings = rendererSettingsEntry();
   const settingsLink = settings ? '<a class="button" href="#/resource/renderer-settings/' + encodeURIComponent(settings.record.id) + '">Renderer settings</a>' : "";
   const onboardingButton = settings && !state.readOnly ? '<button class="button" type="button" id="start-onboarding">Run onboarding</button>' : "";
@@ -1177,12 +1190,41 @@ function renderRepository(main) {
   main.querySelector("#start-onboarding")?.addEventListener("click", requestOnboarding);
 }
 
+function renderTrunkRepository(main) {
+  const repository = state.repository;
+  const settings = rendererSettingsEntry();
+  const settingsLink = settings ? '<a class="button" href="#/resource/renderer-settings/' + encodeURIComponent(settings.record.id) + '">Renderer settings</a>' : "";
+  const onboardingButton = settings && repository.writesAllowed
+    ? '<button class="button" type="button" id="start-onboarding">Run onboarding</button>'
+    : "";
+  const retryButton = repository.retrySafe
+    ? '<button class="button primary" type="button" data-git-action="retry-sync">Retry sync</button>'
+    : "";
+  const pending = repository.pendingCommitsFilegrcOnly === false
+    ? empty("Ahead commits include files outside this FileGRC workspace. Reconcile them with Git.")
+    : repository.pendingCommits?.length
+    ? '<ul class="changes">' + repository.pendingCommits.map((commit) => '<li><code>' + esc(commit.shortCommit) + '</code> ' + esc(commit.subject) + '</li>').join("") + '</ul>'
+    : empty("No FileGRC commits are waiting to be pushed.");
+  const lastSync = repository.lastSuccessfulSynchronization
+    ? formatLocalDateTime(repository.lastSuccessfulSynchronization)
+    : "No successful sync recorded by this server";
+  const override = repository.developmentOverride
+    ? '<div class="repository-override"><span class="status-dot warn"></span><div><strong>Development write override active</strong><p>Browser writes stay local. FileGRC will not fetch, commit, or push while this server uses <code>--allow-non-authoritative-writes</code>.</p></div></div>'
+    : "";
+  const validationBody = state.validation.diagnostics.length
+    ? '<div class="diagnostics">' + state.validation.diagnostics.map((item) => '<div><span class="badge ' + item.severity + '">' + esc(properCase(item.severity)) + '</span><code>' + esc(item.path) + '</code><p>' + esc(item.message) + '</p></div>').join("") + '</div>'
+    : empty("No validation problems.");
+  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">Audit trail</p><h2>Repository State</h2><p>Browser saves use one authoritative branch. Record status represents draft, proposal, approval, and retirement; Git branches do not.</p><p class="repository-sync-status" role="status" aria-live="polite"></p></div><div class="page-actions">' + retryButton + onboardingButton + settingsLink + '<a class="button" href="#/resource/workspace/workspace">Workspace settings</a></div></div>' + override + '<section class="panel repository-state-banner"><span class="status-dot ' + repositoryStatusTone(repository.status) + '"></span><div><p class="kicker">Repository status</p><h3>' + esc(repository.label) + '</h3><p>' + esc(repository.message) + '</p></div></section><div class="dashboard-grid"><section class="panel"><div class="panel-head"><h3>Configured Repository</h3></div><dl class="metadata"><div><dt>Branch</dt><dd>' + esc(repository.authoritativeBranch) + '</dd></div><div><dt>Remote</dt><dd>' + esc(repository.remote) + '</dd></div><div><dt>Checkout</dt><dd>' + esc(state.git.branch || (state.git.available ? "Detached HEAD" : "Unavailable")) + '</dd></div><div><dt>Upstream</dt><dd>' + esc(repository.upstream || "Not configured") + '</dd></div></dl></section><section class="panel"><div class="panel-head"><h3>Synchronization</h3></div><dl class="metadata"><div><dt>Current commit</dt><dd><code>' + esc(repository.currentCommit || "Unavailable") + '</code></dd></div><div><dt>Upstream commit</dt><dd><code>' + esc(repository.upstreamCommit || "Unavailable") + '</code></dd></div><div><dt>Ahead</dt><dd>' + esc(repository.ahead ?? "Unknown") + '</dd></div><div><dt>Behind</dt><dd>' + esc(repository.behind ?? "Unknown") + '</dd></div><div><dt>Last sync</dt><dd>' + esc(lastSync) + '</dd></div></dl></section><section class="panel"><div class="panel-head"><h3>Safety Checks</h3></div><dl class="metadata"><div><dt>Whole worktree</dt><dd>' + (repository.wholeWorktreeClean === null ? "Unavailable" : repository.wholeWorktreeClean ? "Clean" : "Has changes") + '</dd></div><div><dt>Git operation</dt><dd>' + esc(repository.operationInProgress || "None") + '</dd></div><div><dt>Pending scope</dt><dd>' + (repository.pendingCommitsFilegrcOnly === false ? "Includes external files" : repository.pendingCommits?.length ? "FileGRC only" : "None") + '</dd></div></dl></section><section class="panel span-2"><div class="panel-head"><h3>Pending FileGRC-only Commits</h3></div>' + pending + '</section><section class="panel span-2"><div class="panel-head"><h3>Validation</h3><span class="badge ' + (state.validation.ok ? "good" : "bad") + '">' + (state.validation.ok ? "Passing" : "Needs attention") + '</span></div>' + validationBody + '</section></div></div>';
+  main.querySelectorAll("[data-git-action]").forEach((button) => button.addEventListener("click", () => runRepositoryGitAction(button.dataset.gitAction)));
+  main.querySelector("#start-onboarding")?.addEventListener("click", requestOnboarding);
+}
+
 async function runRepositoryGitAction(action) {
   const buttons = [...document.querySelectorAll("[data-git-action]")];
   const disabled = buttons.map((button) => button.disabled);
   const active = buttons.find((button) => button.dataset.gitAction === action);
   const status = document.querySelector(".repository-sync-status");
-  const label = action === "pull" ? "Pulling…" : "Pushing…";
+  const label = action === "pull" ? "Pulling…" : action === "retry-sync" ? "Syncing…" : "Pushing…";
   if (status) {
     status.textContent = "";
     status.classList.remove("error");
@@ -1200,10 +1242,12 @@ async function runRepositoryGitAction(action) {
       ? result.updated
         ? "Pulled " + result.upstream + " with rebase at " + result.shortCommit + "."
         : result.branch + " is current with " + result.upstream + "."
-      : "Pushed " + result.shortCommit + " to " + result.upstream + ".";
+      : action === "retry-sync"
+        ? "Synchronized " + result.shortCommit + " with " + result.upstream + "."
+        : "Pushed " + result.shortCommit + " to " + result.upstream + ".";
   } catch (cause) {
     buttons.forEach((button, index) => { button.disabled = disabled[index]; });
-    if (active) active.textContent = action === "pull" ? "Pull with rebase" : "Push";
+    if (active) active.textContent = action === "pull" ? "Pull with rebase" : action === "retry-sync" ? "Retry sync" : "Push";
     if (status) {
       status.textContent = cause.message;
       status.classList.add("error");
@@ -1413,8 +1457,9 @@ function onboardingSteps() {
     points: [
       "Use the UI, an editor, the CLI, or an agent; every path changes the same files.",
       "JSON holds structured records. Markdown holds policies, plans, minutes, and other long-form work.",
-      "Repository pulls with rebase, then commits and pushes reviewed changes together.",
-      "Agents and terminal users run git pull --rebase, git commit, and git push directly.",
+      "In trunk mode, each browser save fast-forwards, validates, creates one focused commit, and pushes it.",
+      "Record status represents approval. Draft, proposed, approved, and retired records all stay on the authoritative branch.",
+      "Agents and terminal users continue to manage Git explicitly.",
       "The dashboard derives program status from the current repository state."
     ]
   };
@@ -1562,14 +1607,12 @@ function onboardingSetupForm() {
     currentSystem ? "Updates system " + currentSystem.title + "." : "Creates a new in-scope system.",
     "Records a management program goal without creating an audit engagement."
   ].filter(Boolean).join(" ");
-  const gitStatus = state.git.available && !state.git.branch
-    ? '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Detached HEAD detected</strong><small>Setup changes can be saved, but browser commits, pulls, and pushes are disabled until you check out a branch.</small></span></div>'
-    : state.git.available && state.git.remotes?.length
-    ? '<div class="onboarding-git-status"><span class="status-dot good"></span><span><strong>Git repository and remote detected</strong><small>Setup changes will appear in the workspace diff. Browser commits push to the configured remote.</small></span></div>'
-    : state.git.available
-      ? '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Git remote needed</strong><small>Saving and local commits still work. Add a remote before the browser can push.</small></span></div>'
-      : '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Git setup needed</strong><small>Saving still works. Run <code>git init</code> at the workspace root before your first compliance commit.</small></span></div>';
-  return '<p class="onboarding-body">' + esc(onboardingSteps().at(-1).body) + '</p>' + gitStatus + '<form id="onboarding-setup" class="onboarding-form"><label class="wide"><span>Service name</span><input name="serviceName" required maxlength="200" value="' + esc(onboardingDraft.serviceName) + '" placeholder="Customer-facing application"></label><label class="wide"><span>Scope description</span><textarea name="scope" required maxlength="2000" placeholder="What the service does and which production boundary is in scope">' + esc(onboardingDraft.scope) + '</textarea></label><label><span>Accountable owner</span><select name="ownerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === onboardingDraft.ownerId ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Business criticality</span><select name="criticality" required>' + ["low", "medium", "high", "critical"].map((value) => '<option value="' + value + '" ' + (value === onboardingDraft.criticality ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Highest data classification</span><select name="dataClassification" required>' + classifications.map((value) => '<option value="' + esc(value) + '" ' + (value === onboardingDraft.dataClassification ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Internet exposed</span><select name="internetExposed" required><option value="true" ' + (onboardingDraft.internetExposed === "true" ? "selected" : "") + '>Yes</option><option value="false" ' + (onboardingDraft.internetExposed === "false" ? "selected" : "") + '>No</option></select></label><label class="wide"><span>Program goal</span><select name="programGoal" required><option value="none" ' + (onboardingDraft.programGoal === "none" ? "selected" : "") + '>No Assurance Goal Yet</option><option value="readiness" ' + (onboardingDraft.programGoal === "readiness" ? "selected" : "") + '>Program Readiness</option><option value="type-1" ' + (onboardingDraft.programGoal === "type-1" ? "selected" : "") + '>SOC 2 Type 1</option><option value="type-2" ' + (onboardingDraft.programGoal === "type-2" ? "selected" : "") + '>SOC 2 Type 2</option></select><small>This records management intent only. It does not create an engagement or establish the formal report period.</small></label></form><p class="onboarding-write-note">' + esc(existing) + ' Save draft marks the service Planned and In scope. It is selected for scope review, but it is not approved or active. Saving writes JSON files but does not commit them. Complete the remaining Step 1 pages next.</p>';
+  const gitStatus = state.repository?.mode === "trunk"
+    ? '<div class="onboarding-git-status ' + (state.repository.status === "synced" ? "" : "warning") + '"><span class="status-dot ' + repositoryStatusTone(state.repository.status) + '"></span><span><strong>' + esc(state.repository.label) + '</strong><small>' + esc(state.repository.status === "synced" ? "Completing onboarding will save its related workspace, system, and renderer changes in one commit and push it." : state.repository.message) + '</small></span></div>'
+    : state.git.available && state.git.branch
+      ? '<div class="onboarding-git-status"><span class="status-dot good"></span><span><strong>Manual repository mode</strong><small>Setup changes will stay local until you commit and synchronize them.</small></span></div>'
+      : '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Git setup needed</strong><small>Manual-mode writes still work, but Git history is unavailable until the repository is configured.</small></span></div>';
+  return '<p class="onboarding-body">' + esc(onboardingSteps().at(-1).body) + '</p>' + gitStatus + '<form id="onboarding-setup" class="onboarding-form"><label class="wide"><span>Service name</span><input name="serviceName" required maxlength="200" value="' + esc(onboardingDraft.serviceName) + '" placeholder="Customer-facing application"></label><label class="wide"><span>Scope description</span><textarea name="scope" required maxlength="2000" placeholder="What the service does and which production boundary is in scope">' + esc(onboardingDraft.scope) + '</textarea></label><label><span>Accountable owner</span><select name="ownerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === onboardingDraft.ownerId ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Business criticality</span><select name="criticality" required>' + ["low", "medium", "high", "critical"].map((value) => '<option value="' + value + '" ' + (value === onboardingDraft.criticality ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Highest data classification</span><select name="dataClassification" required>' + classifications.map((value) => '<option value="' + esc(value) + '" ' + (value === onboardingDraft.dataClassification ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Internet exposed</span><select name="internetExposed" required><option value="true" ' + (onboardingDraft.internetExposed === "true" ? "selected" : "") + '>Yes</option><option value="false" ' + (onboardingDraft.internetExposed === "false" ? "selected" : "") + '>No</option></select></label><label class="wide"><span>Program goal</span><select name="programGoal" required><option value="none" ' + (onboardingDraft.programGoal === "none" ? "selected" : "") + '>No Assurance Goal Yet</option><option value="readiness" ' + (onboardingDraft.programGoal === "readiness" ? "selected" : "") + '>Program Readiness</option><option value="type-1" ' + (onboardingDraft.programGoal === "type-1" ? "selected" : "") + '>SOC 2 Type 1</option><option value="type-2" ' + (onboardingDraft.programGoal === "type-2" ? "selected" : "") + '>SOC 2 Type 2</option></select><small>This records management intent only. It does not create an engagement or establish the formal report period.</small></label></form><p class="onboarding-write-note">' + esc(existing) + ' Save draft marks the service Planned and In scope. It is selected for scope review, but it is not approved or active. ' + (state.repository?.mode === "trunk" ? "The browser saves and synchronizes the related files together." : "Manual mode leaves the files for you to commit.") + ' Complete the remaining Step 1 pages next.</p>';
 }
 
 function captureOnboardingForm() {
@@ -2562,10 +2605,35 @@ async function responseMessage(response) {
   try { return JSON.parse(source).error || source; } catch { return source; }
 }
 async function localFetch(url, options) {
+  const method = String(options?.method || "GET").toUpperCase();
+  const synchronizing = state?.repository?.mode === "trunk"
+    && ["POST", "PUT", "DELETE"].includes(method)
+    && url !== "/api/evidence-packet";
+  const chip = synchronizing ? document.querySelector(".repo-chip") : null;
+  const previousChip = chip?.innerHTML;
+  let repositoryRefreshed = false;
+  if (chip) chip.innerHTML = '<span class="status-dot neutral"></span>Syncing';
   try {
-    return await fetch(url, options);
+    const response = await fetch(url, options);
+    if (synchronizing && !response.ok) {
+      try {
+        const stateResponse = await fetch("/api/state");
+        if (stateResponse.ok) {
+          state = await stateResponse.json();
+          if (chip?.isConnected) {
+            chip.innerHTML = '<span class="status-dot ' + repositoryStatusTone(state.repository.status) + '"></span>' + esc(state.repository.label);
+            repositoryRefreshed = true;
+          }
+        }
+      } catch {
+        // The original response contains the useful mutation error.
+      }
+    }
+    return response;
   } catch {
     throw new Error("The filegrc server is unavailable. Restart npm run serve, or pnpm dev in the monorepo, and try again.");
+  } finally {
+    if (!repositoryRefreshed && chip?.isConnected && previousChip) chip.innerHTML = previousChip;
   }
 }
 async function fetchJson(url, options) { const response = await localFetch(url, options); if (!response.ok) throw new Error(await responseMessage(response)); return response.json(); }
@@ -2598,7 +2666,7 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .readiness-map{margin:14px 0;background:var(--panel);border:1px solid var(--line);border-radius:11px;padding:20px 22px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.readiness-map-head{display:grid;grid-template-columns:minmax(220px,1fr) minmax(320px,420px);gap:28px;align-items:center;margin-bottom:17px}.readiness-map-head h3{font-size:18px;margin:5px 0 0}.readiness-progress-summary{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:8px 14px;align-items:center}.readiness-progress-summary>div{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:3px 12px;align-items:baseline}.readiness-progress-summary>div>span{color:var(--muted);font-size:9.6px;font-weight:700;text-transform:uppercase;letter-spacing:.08em}.readiness-progress-summary>div>strong{font-size:9.6px;font-weight:700;line-height:1.2}.readiness-progress-summary .progress,.readiness-progress-summary small{grid-column:1/-1}.readiness-progress-summary small{color:var(--muted);font-size:9.6px}.readiness-progress-summary>.button{white-space:nowrap}.readiness-flow{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:7px}.readiness-flow a{display:grid;grid-template-columns:23px minmax(0,1fr);column-gap:8px;align-content:start;min-width:0;padding:11px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft);text-decoration:none}.readiness-flow a:hover{border-color:var(--accent-light);background:var(--accent-soft)}.readiness-flow a>span{grid-row:1/4;display:grid;place-items:center;width:23px;height:23px;border-radius:50%;background:var(--primary-gradient);color:#fff;font-size:9.6px;font-weight:800}.readiness-flow strong{font-size:12px;line-height:1.25}.readiness-flow small{grid-column:2;color:var(--muted);font-size:9.6px;line-height:1.4;margin-top:3px}.readiness-state{grid-column:2;justify-self:start;margin-top:8px;padding:3px 6px;border-radius:99px;background:var(--surface-muted);color:var(--muted);font-size:8.4px;line-height:1.2}.readiness-state.good{background:#dcefe4;color:#125733}.readiness-state.warn{background:#f6e8c9;color:#79500f}.readiness-state.bad{background:#f7dfdc;color:#873027}.audit-engagement{display:grid;grid-template-columns:minmax(210px,1fr) minmax(260px,1.25fr) auto;gap:20px;align-items:center;padding:14px 15px;border-radius:8px;background:var(--surface-soft)}.audit-engagement strong{font-size:13.2px}.audit-engagement p,.audit-engagement li{color:var(--muted);font-size:10.8px;line-height:1.5}.audit-engagement p{margin:5px 0 0}.audit-engagement ul{margin:0;padding-left:18px}.audit-engagement .button{white-space:nowrap;text-decoration:none}.resource-directory{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:10px}.resource-directory>section{min-width:0;padding:12px;border-radius:8px;background:var(--surface-soft)}.resource-directory h4{margin:0 0 7px;color:var(--muted);font-size:10.8px;text-transform:uppercase;letter-spacing:.08em}.resource-directory a{display:flex;justify-content:space-between;gap:10px;padding:5px 0;border-top:1px solid var(--line);font-size:10.8px;text-decoration:none}.resource-directory a:first-of-type{border-top:0}.resource-directory a:hover span{color:var(--accent)}.resource-directory a strong{color:var(--muted);font-size:9.6px}.record-prose{max-width:790px}.record-prose section{padding:0 0 20px}.record-prose section+section{padding-top:20px;border-top:1px solid var(--line)}.record-prose h3{margin:0 0 7px;color:var(--muted);font-size:10.8px;text-transform:uppercase;letter-spacing:.08em}.record-prose p{margin:0;font-size:16.8px;line-height:1.65;white-space:pre-wrap}.connections-panel .panel-head>span{display:grid;place-items:center;min-width:22px;height:22px;border-radius:99px;background:var(--surface-muted);color:var(--muted);font-size:9.6px}.connections{display:grid}.connections a{display:block;padding:9px 0;border-top:1px solid var(--line);text-decoration:none}.connections a:first-child{padding-top:0;border-top:0}.connections strong,.connections small{display:block}.connections strong{font-size:12px}.connections small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.4}.connections a:hover strong{color:var(--accent)}.connections-more{margin:9px 0 0;color:var(--muted);font-size:9.6px;line-height:1.4}.external-source{display:flex;align-items:flex-start;justify-content:space-between;gap:8px;color:var(--accent);text-decoration:none}.external-source span,.external-source strong,.external-source small{display:block}.external-source strong{font-size:12px;line-height:1.35}.external-source small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.35;overflow-wrap:anywhere}.external-source b{font-size:13.2px}.external-source:hover strong{text-decoration:underline}
 .page-title-line{display:flex;align-items:center;gap:8px}.guide-trigger{display:grid;place-items:center;width:24px;height:24px;flex:0 0 auto;padding:0;border:1px solid var(--line);border-radius:50%;background:var(--panel);color:var(--muted);cursor:pointer}.guide-trigger svg{width:16px;height:16px;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round}.guide-trigger:hover{border-color:var(--accent-light);color:var(--accent)}.guide-trigger:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.page-guide{display:grid;grid-template-columns:1.05fr 1.25fr 1fr;gap:0;margin:0;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.resource-guide-popover{position:fixed;z-index:40;overflow:auto;box-shadow:0 18px 50px rgba(0,0,24,.24)}.resource-guide-popover[hidden]{display:none}.page-guide>div{padding:14px 16px;border-left:1px solid var(--line);min-width:0}.page-guide>div:first-child{border-left:0}.page-guide>div>span{display:block;color:var(--accent);text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780;margin-bottom:6px}.page-guide p{color:var(--muted);font-size:12px;line-height:1.5;margin:0}.guide-links{display:flex;flex-wrap:wrap;gap:5px;margin-top:8px}.guide-links a{color:var(--accent);background:var(--accent-soft);border-radius:99px;padding:4px 7px;text-decoration:none;font-size:9.6px;font-weight:700}
 .operation-tracking{display:grid;gap:2px;min-width:0;text-decoration:none}.operation-tracking strong,.operation-tracking small{display:block;overflow-wrap:anywhere}.operation-tracking small{color:var(--muted);line-height:1.35}.operation-tracking.running strong{color:#176143}.operation-tracking.waiting strong,.operation-tracking.mixed strong{color:var(--amber)}.operation-tracking.paused strong{color:var(--red)}a.operation-tracking:hover strong{text-decoration:underline}
-.page-actions{display:flex;align-items:center;justify-content:flex-end;gap:7px;flex-wrap:wrap}.repository-sync-status{min-height:18px;margin:7px 0 0;color:var(--muted);font-size:13.2px}.repository-sync-status.error{color:var(--red)}.onboarding-dialog{width:min(470px,calc(100vw - 30px));max-height:calc(100vh - 32px);margin:0;border:1px solid var(--line);border-radius:13px;padding:0;background:var(--panel);color:var(--ink);box-shadow:0 28px 90px rgba(0,0,24,.38);overflow:hidden}.onboarding-dialog[open]{display:flex;flex-direction:column}.onboarding-dialog::backdrop{background:transparent;backdrop-filter:none}.onboarding-shade{position:fixed;inset:0;z-index:60;pointer-events:none}.onboarding-shade span{position:absolute;background:rgba(0,0,24,.58)}.onboarding-progress{display:grid;flex:0 0 auto;grid-template-columns:repeat(var(--onboarding-step-count),1fr);gap:5px;padding:18px 24px 0}.onboarding-progress span{height:3px;border-radius:3px;background:var(--surface-muted)}.onboarding-progress span.active{background:var(--accent-light)}.onboarding-scroll{min-height:0;overflow-y:auto}.onboarding-head{padding:22px 25px 0}.onboarding-head h2{font-family:Georgia,serif;font-size:30px;font-weight:500;letter-spacing:-.015em;margin:8px 0 0}.onboarding-body{color:var(--muted);font-size:14.4px;line-height:1.6;margin:13px 25px 0}.onboarding-body+.onboarding-body{margin-top:8px}.onboarding-points{display:grid;gap:9px;margin:18px 25px 4px;padding-left:19px}.onboarding-points li{font-size:13.2px;line-height:1.5;padding-left:3px}.onboarding-sections{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin:16px 25px 4px}.onboarding-sections section{padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.onboarding-sections strong{font-size:13.2px}.onboarding-sections p{margin:6px 0 0;color:var(--muted);font-size:12px;line-height:1.5}.onboarding-actions{flex:0 0 auto;padding:12px 25px 23px;border-top:1px solid var(--line);background:var(--panel)}.onboarding-skip{margin-right:auto;color:var(--muted);text-transform:none;letter-spacing:0;font-size:13.2px}.onboarding-form{display:grid;grid-template-columns:1fr 1fr;gap:13px;margin:18px 25px 0}.onboarding-form label{display:block;min-width:0}.onboarding-form label.wide{grid-column:1/-1}.onboarding-form label>span{display:block;color:var(--ink);font-size:12px;font-weight:720;margin-bottom:6px}.onboarding-form input,.onboarding-form select,.onboarding-form textarea{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.onboarding-form textarea{min-height:78px;resize:vertical}.onboarding-form small{display:block;color:var(--muted);font-size:10.8px;line-height:1.45;margin-top:5px}.onboarding-write-note{color:var(--muted);font-size:10.8px;line-height:1.5;margin:12px 25px 16px}.onboarding-scroll>.dialog-error{margin:8px 25px 0}.onboarding-focus{outline:4px solid var(--accent-light)!important;outline-offset:5px;scroll-margin-top:102px}
+.page-actions{display:flex;align-items:center;justify-content:flex-end;gap:7px;flex-wrap:wrap}.repository-sync-status{min-height:18px;margin:7px 0 0;color:var(--muted);font-size:13.2px}.repository-sync-status.error{color:var(--red)}.repository-state-banner,.repository-override{display:flex;align-items:flex-start;gap:13px;margin-bottom:14px}.repository-state-banner>.status-dot,.repository-override>.status-dot{margin-top:5px}.repository-state-banner h3{margin:3px 0 5px}.repository-state-banner p:last-child,.repository-override p{margin:0;color:var(--muted);line-height:1.5}.repository-override{padding:14px 17px;border:1px solid #e9c888;border-radius:9px;background:#fff8e8;font-size:13.2px}.repository-override strong{display:block;margin-bottom:4px}.onboarding-dialog{width:min(470px,calc(100vw - 30px));max-height:calc(100vh - 32px);margin:0;border:1px solid var(--line);border-radius:13px;padding:0;background:var(--panel);color:var(--ink);box-shadow:0 28px 90px rgba(0,0,24,.38);overflow:hidden}.onboarding-dialog[open]{display:flex;flex-direction:column}.onboarding-dialog::backdrop{background:transparent;backdrop-filter:none}.onboarding-shade{position:fixed;inset:0;z-index:60;pointer-events:none}.onboarding-shade span{position:absolute;background:rgba(0,0,24,.58)}.onboarding-progress{display:grid;flex:0 0 auto;grid-template-columns:repeat(var(--onboarding-step-count),1fr);gap:5px;padding:18px 24px 0}.onboarding-progress span{height:3px;border-radius:3px;background:var(--surface-muted)}.onboarding-progress span.active{background:var(--accent-light)}.onboarding-scroll{min-height:0;overflow-y:auto}.onboarding-head{padding:22px 25px 0}.onboarding-head h2{font-family:Georgia,serif;font-size:30px;font-weight:500;letter-spacing:-.015em;margin:8px 0 0}.onboarding-body{color:var(--muted);font-size:14.4px;line-height:1.6;margin:13px 25px 0}.onboarding-body+.onboarding-body{margin-top:8px}.onboarding-points{display:grid;gap:9px;margin:18px 25px 4px;padding-left:19px}.onboarding-points li{font-size:13.2px;line-height:1.5;padding-left:3px}.onboarding-sections{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin:16px 25px 4px}.onboarding-sections section{padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.onboarding-sections strong{font-size:13.2px}.onboarding-sections p{margin:6px 0 0;color:var(--muted);font-size:12px;line-height:1.5}.onboarding-actions{flex:0 0 auto;padding:12px 25px 23px;border-top:1px solid var(--line);background:var(--panel)}.onboarding-skip{margin-right:auto;color:var(--muted);text-transform:none;letter-spacing:0;font-size:13.2px}.onboarding-form{display:grid;grid-template-columns:1fr 1fr;gap:13px;margin:18px 25px 0}.onboarding-form label{display:block;min-width:0}.onboarding-form label.wide{grid-column:1/-1}.onboarding-form label>span{display:block;color:var(--ink);font-size:12px;font-weight:720;margin-bottom:6px}.onboarding-form input,.onboarding-form select,.onboarding-form textarea{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.onboarding-form textarea{min-height:78px;resize:vertical}.onboarding-form small{display:block;color:var(--muted);font-size:10.8px;line-height:1.45;margin-top:5px}.onboarding-write-note{color:var(--muted);font-size:10.8px;line-height:1.5;margin:12px 25px 16px}.onboarding-scroll>.dialog-error{margin:8px 25px 0}.onboarding-focus{outline:4px solid var(--accent-light)!important;outline-offset:5px;scroll-margin-top:102px}
 .page-intro,.detail-head{align-items:center;margin-bottom:12px}.actions{align-items:center}.detail-head>div:first-child{min-width:0}.detail-head h2{margin:7px 0}.detail-head .header-breadcrumbs{margin:0;font-size:10.8px;line-height:normal;min-height:11px;align-items:center}.header-breadcrumbs span:last-child{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:60ch}
 @media(max-width:1200px){.readiness-flow{grid-template-columns:repeat(3,minmax(0,1fr))}.audit-engagement{grid-template-columns:1fr 1fr}.audit-engagement .button{grid-column:1/-1;justify-self:start}}
 @media(max-width:1100px){.search{display:none}.topbar-status{margin-left:auto}.metrics{grid-template-columns:repeat(2,1fr)}.dashboard-grid,.organization-grid{grid-template-columns:repeat(2,1fr)}.catalog{grid-template-columns:repeat(3,1fr)}.span-2{grid-column:span 2}.resource-directory{grid-template-columns:repeat(2,minmax(0,1fr))}}