filegrc 0.3.4 → 0.5.0

package/src/obligations.js

@@ -1,5 +1,9 @@
+import { createHash } from "node:crypto";
+import { scaffoldResourceMutation } from "./agent.js";
 import { createResourceId } from "./id.js";
 import { createResourceAndLink, createResources, updateResource } from "./files.js";
+import { loadModel } from "../model/index.js";
+import { coverageEnd } from "./coverage.js";
 import {
   addCalendarDays,
   calendarDayDifference,
@@ -8,7 +12,7 @@ import {
   parseCalendarDate,
   validCalendarRecurrence
 } from "./recurrence.js";
-import { isRfc3339Timestamp } from "./time.js";
+import { currentCalendarDate, isRfc3339Timestamp } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
 import { obligationProgramStatus } from "./program-lifecycle.js";
 
@@ -16,22 +20,32 @@ const COMPLETION_DATE_FIELDS = [
   "completedOn",
   "performedOn",
   "reviewedOn",
-  "assessmentDate",
-  "meetingDate",
-  "scheduledOn",
   "occurredOn",
   "collectedOn",
   "verifiedOn",
   "approvedOn",
   "submittedOn",
   "closedOn",
-  "reportDate",
-  "periodEnd"
+  "reportDate"
+];
+const COMPLETION_TIMESTAMP_FIELDS = [
+  "completedAt",
+  "endedAt",
+  "closedAt",
+  "provisionedOn",
+  "deprovisionedOn"
 ];
 const MAX_PLANNED_ITEMS = 10_000;
-const DEFAULT_EVENT_DEADLINE_DAYS = 30;
 
 export function planObligations(resources, options = {}) {
+  const records = resources.map((item) => item?.record ?? item).filter(Boolean);
+  const declaredModelVersion = records.find((record) => record.type === "workspace")?.dataModelVersion;
+  const model = options.model || (declaredModelVersion ? loadModel(declaredModelVersion) : null);
+  if (!model) {
+    throw new Error(
+      "Obligation planning requires options.model or a Workspace record with dataModelVersion."
+    );
+  }
   const asOf = requireDate(options.asOf ?? new Date().toISOString().slice(0, 10), "as-of date");
   const defaultNow = options.asOf ? `${asOf}T23:59:59Z` : new Date().toISOString();
   const now = requireTimestamp(options.now ?? defaultNow, "current timestamp");
@@ -39,9 +53,11 @@ export function planObligations(resources, options = {}) {
   const requestedFrom = options.from ? requireDate(options.from, "from date") : null;
   if (through < asOf && !requestedFrom) throw new Error("The through date must not be before the as-of date.");
   if (requestedFrom && through < requestedFrom) throw new Error("The through date must not be before the from date.");
-  const records = resources.map((item) => item?.record ?? item).filter(Boolean);
   const byId = new Map(records.map((record) => [record.id, record]));
-  const obligations = records.filter((record) => record.type === "obligation" && record.status === "active");
+  const obligations = records.filter((record) => (
+    record.type === "obligation"
+    && ["active", "proposed"].includes(record.status)
+  ));
   if (obligations.length > MAX_PLANNED_ITEMS) {
     throw new Error(`The obligation query must be narrowed; it includes more than ${MAX_PLANNED_ITEMS.toLocaleString("en-US")} active obligations.`);
   }
@@ -56,12 +72,15 @@ export function planObligations(resources, options = {}) {
   };
 
   for (const obligation of obligations) {
+    const activity = obligationActivity(model, obligation.activityType);
+    const expectedCompletionTypes = activity.completionResourceTypes;
     const programStatus = obligationProgramStatus(obligation, byId, asOf);
     if (obligation.recurrence?.mode === "event" && obligation.recurrence.eventType) {
       const eventType = obligation.recurrence.eventType;
       const group = triggerGroups.get(eventType) ?? {
         eventType,
-        prompt: obligation.triggerPrompt || humanize(eventType),
+        title: model.policyEvents?.[eventType]?.title || humanize(eventType),
+        prompt: obligation.triggerPrompt || model.policyEvents?.[eventType]?.title || humanize(eventType),
         policyIds: [],
         obligationIds: [],
         programStatus,
@@ -78,8 +97,11 @@ export function planObligations(resources, options = {}) {
         policyIds: obligation.policyIds || [],
         controlIds: obligation.controlIds || [],
         scopeResourceIds: obligation.scopeResourceIds || [],
+        eventRiskLevels: obligation.eventRiskLevels || [],
         templateResourceId: obligation.templateResourceId || null,
-        completionResourceTypes: obligation.completionResourceTypes || [],
+        completionResourceTypes: expectedCompletionTypes,
+        completionType: activity.completionType,
+        completionProfile: activity.completionProfile || null,
         programStatus,
         window: normalizedEventWindow(obligation.window)
       });
@@ -113,7 +135,7 @@ export function planObligations(resources, options = {}) {
         .filter((record) => (
           record
           && completionFallsInWindow(record, window)
-          && completionTypeMatches(record, obligation.completionResourceTypes)
+          && completionTypeMatches(record, expectedCompletionTypes)
         ));
       const timingStatus = occurrenceStatus(window, asOf, completions.length > 0);
       const status = timingStatus === "complete" || programStatus === "accepted" ? timingStatus : "proposed";
@@ -131,6 +153,9 @@ export function planObligations(resources, options = {}) {
         policyIds: obligation.policyIds || [],
         controlIds: obligation.controlIds || [],
         scopeResourceIds: obligation.scopeResourceIds || [],
+        completionResourceTypes: expectedCompletionTypes,
+        completionType: activity.completionType,
+        completionProfile: activity.completionProfile || null,
         completionResourceIds: completions.map((record) => record.id),
         status,
         timingStatus,
@@ -156,7 +181,14 @@ export function planObligations(resources, options = {}) {
     if (!actionsBySource.has(record.sourceResourceId)) actionsBySource.set(record.sourceResourceId, []);
     actionsBySource.get(record.sourceResourceId).push(record);
   }
-  const eventRuns = events.map((event) => planEventRun(event, actionsBySource.get(event.id) || [], byId, asOf, now));
+  const eventRuns = events.map((event) => planEventRun(
+    event,
+    actionsBySource.get(event.id) || [],
+    byId,
+    asOf,
+    now,
+    model
+  ));
   const eventItems = eventRuns
     .filter((run) => run.status !== "canceled")
     .flatMap((run) => run.actions)
@@ -169,12 +201,13 @@ export function planObligations(resources, options = {}) {
     throw new Error(`The obligation query must be narrowed; it exceeds ${MAX_PLANNED_ITEMS.toLocaleString("en-US")} planned items.`);
   }
   const items = [...calendarItems, ...eventItems, ...standaloneItems].sort(comparePlannedItems);
-  const counts = { overdue: 0, due: 0, upcoming: 0, proposed: 0, complete: 0 };
+  const counts = { overdue: 0, blocked: 0, due: 0, upcoming: 0, proposed: 0, complete: 0 };
   for (const item of items) {
     if (counts[item.status] !== undefined) counts[item.status] += 1;
   }
 
   return {
+    dataModelVersion: String(model.modelVersion),
     asOf,
     through,
     from: requestedFrom,
@@ -206,17 +239,28 @@ export async function createObligationEvent(input, options) {
   if (timestampDate && options?.occurredOn && occurredOn !== timestampDate) {
     throw new Error(`The event date must match the event timestamp in ${loaded.workspace.timezone}.`);
   }
+  const supportsRiskLevel = Boolean(loaded.model.resources["obligation-event"]?.fields?.riskLevel);
+  const riskLevel = supportsRiskLevel && eventType === "person-ended"
+    ? String(options?.riskLevel || "normal")
+    : null;
+  if (riskLevel && !["normal", "high"].includes(riskLevel)) {
+    throw new Error("A departure risk level must be normal or high.");
+  }
   const templates = records.filter((record) => (
     record.type === "obligation"
     && record.status === "active"
     && record.recurrence?.mode === "event"
     && record.recurrence.eventType === eventType
+    && (
+      !Array.isArray(record.eventRiskLevels)
+      || record.eventRiskLevels.includes(riskLevel)
+    )
   ));
   if (!eventType || templates.length === 0) throw new Error(`No active obligations use event type "${eventType}".`);
   if (templates.some((record) => obligationProgramStatus(record, byId, occurredOn) === "proposed")) {
     throw new Error(`Event type "${eventType}" still has starter proposals. Make every governing policy effective and implement at least one linked control before starting this workflow.`);
   }
-  if (templates.some((record) => Number.isInteger(normalizedEventWindow(record.window).endOffsetHours)) && !occurredAt) {
+  if (templates.some((record) => normalizedEventWindow(record.window).precision === "timestamp") && !occurredAt) {
     throw new Error(`Event type "${eventType}" has hour-based deadlines and requires an RFC 3339 occurredAt timestamp.`);
   }
   const subjectResourceIds = [...new Set((options.subjectResourceIds || []).map(String).filter(Boolean))];
@@ -230,7 +274,6 @@ export async function createObligationEvent(input, options) {
     existingIds.push(id);
     const window = eventWindow(obligation, occurredOn, occurredAt, loaded.workspace.timezone);
     return {
-      schemaVersion: 1,
       id,
       type: "action-item",
       title: obligation.title,
@@ -238,16 +281,11 @@ export async function createObligationEvent(input, options) {
       assigneeIds: obligation.ownerIds || [],
       sourceResourceId: eventId,
       obligationId: obligation.id,
-      description: eventActionDescription(obligation, eventType),
-      dueWindowStart: window.dueWindowStart,
-      ...(window.dueWindowEnd ? { dueWindowEnd: window.dueWindowEnd, dueOn: window.dueWindowEnd } : {}),
-      ...(window.overdueOn ? { overdueOn: window.overdueOn } : {}),
-      ...(window.dueWindowStartAt ? { dueWindowStartAt: window.dueWindowStartAt } : {}),
-      ...(window.dueWindowEndAt ? { dueWindowEndAt: window.dueWindowEndAt, overdueAt: window.dueWindowEndAt } : {})
+      description: eventActionDescription(obligation, eventType, loaded.model),
+      completionWindow: storedCompletionWindow(window, loaded.workspace.timezone)
     };
   });
   const event = {
-    schemaVersion: 1,
     id: eventId,
     type: "obligation-event",
     title,
@@ -255,6 +293,10 @@ export async function createObligationEvent(input, options) {
     eventType,
     occurredOn,
     ...(occurredAt ? { occurredAt } : {}),
+    ...(riskLevel ? { riskLevel } : {}),
+    ...(options.transitionFingerprint && loaded.model.resources["obligation-event"]?.fields?.transitionFingerprint
+      ? { transitionFingerprint: String(options.transitionFingerprint) }
+      : {}),
     ownerIds: [...new Set(templates.flatMap((record) => record.ownerIds || []))],
     obligationIds: templates.map((record) => record.id),
     ...(subjectResourceIds.length ? { subjectResourceIds } : {})
@@ -269,7 +311,7 @@ export async function completeObligationOccurrence(input, options) {
     record.type === "obligation" && record.id === options?.obligationId
   ));
   if (!obligation) throw new Error(`Obligation "${options?.obligationId ?? ""}" was not found.`);
-  assertExpectedCompletionType(obligation, options?.record);
+  assertExpectedCompletionType(obligation, options?.record, loaded.model);
   return createResourceAndLink(loaded.root, options.record, {
     type: "obligation",
     id: obligation.id,
@@ -278,6 +320,62 @@ export async function completeObligationOccurrence(input, options) {
   }, { content: options.content });
 }
 
+export async function scaffoldObligationCompletion(input, options = {}) {
+  const loaded = await loadWorkspace(input);
+  const action = options.actionItemId
+    ? loaded.resources.find((record) => record.type === "action-item" && record.id === options.actionItemId)
+    : null;
+  if (options.actionItemId && !action) {
+    throw new Error(`Action item "${options.actionItemId}" was not found.`);
+  }
+  const obligationId = action?.obligationId || options.obligationId;
+  const obligation = loaded.resources.find((record) => (
+    record.type === "obligation" && record.id === obligationId
+  ));
+  if (!obligation) throw new Error(`Obligation "${obligationId ?? ""}" was not found.`);
+
+  const completedOn = requireDate(
+    options.completedOn || currentCalendarDate(loaded.workspace.timezone),
+    "completion date"
+  );
+  const item = action
+    ? plannedActionForScaffold(loaded, action, completedOn)
+    : plannedOccurrenceForScaffold(loaded, obligation, options.windowStart, completedOn);
+  const activity = obligationActivity(loaded.model, obligation.activityType);
+  const type = activity.completionType;
+  if (!type) throw new Error(`Obligation "${obligation.id}" has no configured completion resource type.`);
+
+  const mutation = scaffoldResourceMutation(
+    loaded,
+    type,
+    `${item.title} · ${item.dueWindowStart || completedOn}`
+  );
+  applyCompletionScaffoldDefaults(mutation.record, {
+    loaded,
+    item,
+    obligation,
+    completedOn,
+    activity
+  });
+  const target = action || obligation;
+  const entry = loaded.entries.find(({ record }) => record.type === target.type && record.id === target.id);
+  return {
+    ...mutation,
+    revision: contentRevision(entry?.source || ""),
+    scaffold: {
+      target: { type: target.type, id: target.id },
+      obligationId: obligation.id,
+      activityType: obligation.activityType,
+      completionResourceType: type,
+      completionProfile: activity.completionProfile || null,
+      requiredFacts: loaded.model.completionProfiles?.[activity.completionProfile]?.requiredFacts || [],
+      dueWindowStart: item.dueWindowStart || null,
+      dueWindowEnd: item.dueWindowEnd || null,
+      instructions: "Replace every null or empty required value with the actual work performed. Keep the actual completion date and time, actors, result, scope, independent review, and supporting evidence. This revision makes the completed write safe against a stale Work Queue item."
+    }
+  };
+}
+
 export async function completeObligationAction(input, options) {
   const loaded = await loadWorkspace(input);
   const action = loaded.resources.find((record) => (
@@ -285,11 +383,14 @@ export async function completeObligationAction(input, options) {
   ));
   if (!action) throw new Error(`Action item "${options?.actionItemId ?? ""}" was not found.`);
   if (!action.obligationId) throw new Error(`Action item "${action.id}" is not linked to an obligation.`);
+  if (action.status === "blocked") {
+    throw new Error(`Action item "${action.id}" is blocked. Resolve its blockingResourceIds before completing it.`);
+  }
   const obligation = loaded.resources.find((record) => (
     record.type === "obligation" && record.id === action.obligationId
   ));
   if (!obligation) throw new Error(`Obligation "${action.obligationId}" was not found.`);
-  assertExpectedCompletionType(obligation, options?.record);
+  assertExpectedCompletionType(obligation, options?.record, loaded.model);
   const completedOn = requireDate(options?.completedOn, "completion date");
   const event = loaded.resources.find((record) => record.type === "obligation-event" && record.id === action.sourceResourceId);
   if (event?.occurredOn && completedOn < event.occurredOn) {
@@ -320,7 +421,8 @@ export async function completeObligationEvent(input, options) {
   const plan = planObligations(loaded.resources, {
     asOf: completedOn,
     through: completedOn,
-    includeComplete: true
+    includeComplete: true,
+    model: loaded.model
   });
   const run = plan.eventRuns.find((item) => item.id === event.id);
   if (!run || run.actions.length === 0) {
@@ -341,11 +443,11 @@ export async function completeObligationEvent(input, options) {
   });
 }
 
-function assertExpectedCompletionType(obligation, record) {
+function assertExpectedCompletionType(obligation, record, model) {
   if (!record || typeof record !== "object" || Array.isArray(record)) {
     throw new Error("A completion resource record is required.");
   }
-  const expected = obligation.completionResourceTypes ?? [];
+  const expected = obligationActivity(model, obligation.activityType).completionResourceTypes;
   if (expected.length && !expected.includes(record.type)) {
     throw new Error(
       `Obligation "${obligation.id}" expects a completion resource of type ${expected.join(" or ")}, not "${record.type ?? ""}".`
@@ -353,14 +455,287 @@ function assertExpectedCompletionType(obligation, record) {
   }
 }
 
+function plannedOccurrenceForScaffold(loaded, obligation, windowStart, completedOn) {
+  const start = requireDate(windowStart, "occurrence window start");
+  const plan = planObligations(loaded.resources, {
+    from: start,
+    asOf: completedOn,
+    through: start,
+    includeComplete: true,
+    model: loaded.model
+  });
+  const item = plan.calendarItems.find((candidate) => (
+    candidate.obligationId === obligation.id && candidate.dueWindowStart === start
+  ));
+  if (!item) {
+    throw new Error(`No ${obligation.id} occurrence starts on ${start}. Run filegrc obligations --json and use its dueWindowStart.`);
+  }
+  return item;
+}
+
+function plannedActionForScaffold(loaded, action, completedOn) {
+  const plan = planObligations(loaded.resources, {
+    asOf: completedOn,
+    through: completedOn,
+    includeComplete: true,
+    model: loaded.model
+  });
+  const item = plan.eventItems.find((candidate) => candidate.actionItemId === action.id);
+  if (!item) throw new Error(`Action item "${action.id}" is not an active Work Queue item.`);
+  return item;
+}
+
+function applyCompletionScaffoldDefaults(record, context) {
+  const { loaded, item, obligation, completedOn, activity } = context;
+  const responsiblePeople = currentPeopleForParties(loaded.resources, item.ownerIds || []);
+  if (!responsiblePeople.length) {
+    throw new Error(`Obligation "${obligation.id}" needs an active owner whose Appointment or Team resolves to a current Person.`);
+  }
+  const reviewer = loaded.resources.find((candidate) => (
+    candidate.type === "person"
+    && ["active", "external"].includes(candidate.status)
+    && !responsiblePeople.includes(candidate.id)
+  ));
+  const reviewerIds = reviewer ? [reviewer.id] : [];
+  const systemIds = loaded.resources
+    .filter((candidate) => (
+      candidate.type === "system"
+      && candidate.status !== "retired"
+      && (loaded.workspace.systemIds || []).includes(candidate.id)
+    ))
+    .map(({ id }) => id);
+  const vendorIds = loaded.resources
+    .filter((candidate) => candidate.type === "vendor" && candidate.status !== "terminated")
+    .map(({ id }) => id);
+  const timestamp = completedOn === new Date().toISOString().slice(0, 10)
+    ? new Date().toISOString()
+    : null;
+  const coverage = {
+    kind: "range",
+    startsOn: item.dueWindowStart || completedOn,
+    endsOn: item.dueWindowEnd || completedOn
+  };
+  const common = { status: "complete" };
+  const defaults = {
+    meeting: () => {
+      const team = completionTeam(loaded.resources, item.ownerIds || []);
+      if (!team) throw new Error("A Meeting completion needs an active Team with an active chair.");
+      return {
+        ...common,
+        teamId: team.id,
+        chairIds: currentPeopleForParties(loaded.resources, team.chairIds || []),
+        scheduledFor: completedOn,
+        startedAt: timestamp,
+        endedAt: timestamp,
+        attendeeIds: responsiblePeople
+      };
+    },
+    "policy-review": () => ({
+      ...common,
+      scopeResourceIds: obligation.scopeResourceIds || [],
+      reviewerIds,
+      completedOn,
+      outcome: "passed",
+      changesRequired: false,
+      evidenceIds: [],
+      coverage
+    }),
+    "risk-assessment": () => ({
+      ...common,
+      completedOn,
+      assessmentKind: "enterprise-risk",
+      scope: "In-scope SOC 2 systems and dependencies",
+      assessorIds: responsiblePeople,
+      reviewerIds,
+      methodology: loaded.workspace.riskMethodology?.method || "Documented risk methodology",
+      summary: "",
+      evidenceIds: [],
+      approvedOn: completedOn
+    }),
+    attestation: () => ({
+      status: "completed",
+      subjectResourceIds: [...new Set([
+        obligation.templateResourceId,
+        ...(obligation.scopeResourceIds || [])
+      ].filter(Boolean))],
+      personId: responsiblePeople[0],
+      attestationKind: obligation.activityType || "completion",
+      assignedOn: item.dueWindowStart || completedOn,
+      dueOn: item.dueWindowEnd || completedOn,
+      completedOn,
+      attestationMethod: "git-approval"
+    }),
+    "access-review": () => {
+      if (!systemIds.length) throw new Error("An Access Review completion needs an active in-scope System.");
+      return {
+        ...common,
+        completedOn,
+        reviewerIds: responsiblePeople,
+        systemIds,
+        scope: "Privileged, production, and important-system access",
+        outcome: "passed",
+        evidenceIds: [],
+        approvedByIds: reviewerIds,
+        approvedOn: completedOn,
+        coverage
+      };
+    },
+    "vulnerability-scan": () => ({
+      ...common,
+      scanKind: "vulnerability",
+      scope: "In-scope systems",
+      operatorIds: responsiblePeople,
+      scheduledFor: completedOn,
+      completedAt: timestamp,
+      systemIds,
+      resultSummary: "",
+      evidenceIds: [],
+      reviewerIds,
+      reviewedOn: completedOn
+    }),
+    "penetration-test": () => ({
+      ...common,
+      testKind: "independent",
+      scope: "In-scope systems and service boundary",
+      coverage: { kind: "as-of", on: completedOn },
+      ownerIds: responsiblePeople,
+      outcome: "passed",
+      evidenceIds: [],
+      systemIds,
+      completedOn,
+      reviewerIds,
+      reviewedOn: completedOn
+    }),
+    "control-test": () => ({
+      ...common,
+      controlId: obligation.controlIds?.[0] || null,
+      testKinds: [obligation.activityType || "control-operation"],
+      performedBy: "management",
+      testerIds: responsiblePeople,
+      reviewerIds,
+      completedOn,
+      reviewedOn: completedOn,
+      outcome: "passed",
+      evidenceIds: [],
+      coverage
+    }),
+    "control-activity": () => ({
+      ...common,
+      profileId: activity.completionProfile || obligation.activityType,
+      obligationId: obligation.id,
+      controlIds: item.controlIds || obligation.controlIds || [],
+      scopeResourceIds: (item.scopeResourceIds || obligation.scopeResourceIds || []).length
+        ? (item.scopeResourceIds || obligation.scopeResourceIds)
+        : [loaded.workspace.id],
+      performerIds: responsiblePeople,
+      completedAt: timestamp,
+      method: "",
+      result: "",
+      reviewerIds,
+      reviewedOn: completedOn,
+      ownerIds: item.ownerIds || obligation.ownerIds || []
+    }),
+    exercise: () => ({
+      ...common,
+      exerciseKind: item.title.toLowerCase().includes("continuity") ? "business-continuity" : "incident-response",
+      scheduledFor: completedOn,
+      facilitatorIds: responsiblePeople,
+      objective: item.title,
+      outcome: "passed",
+      evidenceIds: [],
+      systemIds,
+      completedAt: timestamp
+    }),
+    "backup-test": () => {
+      if (!systemIds.length) throw new Error("A Backup Test completion needs an active in-scope System.");
+      return {
+        ...common,
+        systemIds,
+        scheduledFor: completedOn,
+        operatorIds: responsiblePeople,
+        reviewerIds,
+        outcome: "passed",
+        evidenceIds: [],
+        completedAt: timestamp
+      };
+    },
+    "vendor-review": () => {
+      const subjectVendor = (item.subjectResourceIds || []).find((id) => vendorIds.includes(id));
+      if (!subjectVendor && !vendorIds.length) throw new Error("A Vendor Review completion needs an active Vendor.");
+      return {
+        ...common,
+        vendorId: subjectVendor || vendorIds[0],
+        reviewerIds: responsiblePeople,
+        completedOn,
+        decision: "approved",
+        evidenceIds: [],
+        coverage
+      };
+    }
+  };
+  const values = defaults[record.type]?.() || {
+    status: "collected",
+    artifactKind: "business-record",
+    artifactSubtype: obligation.activityType || "control-operation",
+    sourceKind: "authored-record",
+    sourceDescription: "Internal control operation",
+    collectedOn: completedOn,
+    collectorIds: responsiblePeople,
+    classificationId: defaultClassificationId(loaded.workspace),
+    coverage,
+    controlIds: item.controlIds || obligation.controlIds || [],
+    sourceResourceIds: [obligation.id]
+  };
+  Object.assign(record, values);
+}
+
+function currentPeopleForParties(resources, ids = [], seen = new Set()) {
+  const byId = new Map(resources.map((record) => [record.id, record]));
+  const people = [];
+  for (const id of ids) {
+    if (seen.has(id)) continue;
+    seen.add(id);
+    const party = byId.get(id);
+    if (party?.type === "person" && ["active", "external"].includes(party.status)) people.push(party.id);
+    if (party?.type === "team" && party.status === "active") {
+      people.push(...currentPeopleForParties(resources, [...(party.memberIds || []), ...(party.chairIds || [])], seen));
+    }
+    if (party?.type === "appointment" && party.status === "active") {
+      people.push(...currentPeopleForParties(resources, [party.holderId], seen));
+    }
+  }
+  return [...new Set(people)];
+}
+
+function completionTeam(resources, ownerIds) {
+  const owners = new Set(ownerIds);
+  const teams = resources.filter((record) => record.type === "team");
+  const owned = teams.filter((record) => owners.has(record.id));
+  return (owned.length ? owned : teams).find((record) => (
+    record.status === "active"
+    && currentPeopleForParties(resources, record.chairIds || []).length
+  )) || null;
+}
+
+function defaultClassificationId(workspace) {
+  const definitions = workspace.classificationDefinitions || {};
+  return Object.hasOwn(definitions, "internal") ? "internal" : Object.keys(definitions)[0] || "";
+}
+
+function contentRevision(source) {
+  return createHash("sha256").update(source).digest("hex");
+}
+
 function calendarWindow(recurrence, configuredWindow, index) {
   const occurrence = calendarOccurrence(recurrence, index);
   const next = calendarOccurrence(recurrence, index + 1);
   if (!occurrence || !next) return null;
-  const startOffset = Number.isInteger(configuredWindow?.startOffsetDays) ? configuredWindow.startOffsetDays : 0;
+  const startOffset = configuredWindow?.precision === "date" && Number.isInteger(configuredWindow.startsAfter)
+    ? configuredWindow.startsAfter
+    : 0;
   const dueWindowStart = addCalendarDays(occurrence, startOffset);
-  const dueWindowEnd = Number.isInteger(configuredWindow?.endOffsetDays)
-    ? addCalendarDays(occurrence, configuredWindow.endOffsetDays)
+  const dueWindowEnd = configuredWindow?.precision === "date" && Number.isInteger(configuredWindow.dueAfter)
+    ? addCalendarDays(occurrence, configuredWindow.dueAfter)
     : addCalendarDays(next, -1);
   const overdueOn = dueWindowEnd ? addCalendarDays(dueWindowEnd, 1) : null;
   if (!dueWindowStart || !dueWindowEnd || !overdueOn) return null;
@@ -373,10 +748,10 @@ function calendarWindow(recurrence, configuredWindow, index) {
 
 function eventWindow(obligation, occurredOn, occurredAt, timezone) {
   const configuredWindow = normalizedEventWindow(obligation.window);
-  if (Number.isInteger(configuredWindow.endOffsetHours) && occurredAt) {
-    const startOffset = Number.isInteger(configuredWindow.startOffsetHours) ? configuredWindow.startOffsetHours : 0;
+  if (configuredWindow.precision === "timestamp" && occurredAt) {
+    const startOffset = Number.isInteger(configuredWindow.startsAfter) ? configuredWindow.startsAfter : 0;
     const dueWindowStartAt = addHours(occurredAt, startOffset);
-    const dueWindowEndAt = addHours(occurredAt, configuredWindow.endOffsetHours);
+    const dueWindowEndAt = addHours(occurredAt, configuredWindow.dueAfter);
     return {
       dueWindowStart: timestampCalendarDate(dueWindowStartAt, timezone),
       dueWindowEnd: timestampCalendarDate(dueWindowEndAt, timezone),
@@ -386,9 +761,9 @@ function eventWindow(obligation, occurredOn, occurredAt, timezone) {
       overdueAt: dueWindowEndAt
     };
   }
-  const startOffset = Number.isInteger(configuredWindow.startOffsetDays) ? configuredWindow.startOffsetDays : 0;
+  const startOffset = Number.isInteger(configuredWindow.startsAfter) ? configuredWindow.startsAfter : 0;
   const dueWindowStart = addCalendarDays(occurredOn, startOffset);
-  const dueWindowEnd = addCalendarDays(occurredOn, configuredWindow.endOffsetDays);
+  const dueWindowEnd = addCalendarDays(occurredOn, configuredWindow.dueAfter);
   const overdueOn = dueWindowEnd ? addCalendarDays(dueWindowEnd, 1) : null;
   if (!dueWindowStart || !dueWindowEnd || !overdueOn) {
     throw new Error("Event deadline dates must fall within the supported calendar range.");
@@ -400,42 +775,26 @@ function eventWindow(obligation, occurredOn, occurredAt, timezone) {
   };
 }
 
-function planEventRun(event, actionItems, byId, asOf, now) {
+function planEventRun(event, actionItems, byId, asOf, now, model) {
   const actions = actionItems
     .map((record) => {
       const obligation = byId.get(record.obligationId);
-      const expectedCompletionTypes = obligation?.completionResourceTypes || [];
-      const linkedCompletionIds = [...new Set([
-        ...(record.completionResourceIds || []),
-        ...(record.evidenceIds || [])
-      ])];
+      const expectedCompletionTypes = obligation?.type === "obligation"
+        ? obligationActivity(model, obligation.activityType).completionResourceTypes
+        : [];
+      const completionProfile = obligation?.type === "obligation"
+        ? obligationActivity(model, obligation.activityType).completionProfile || null
+        : null;
+      const completionIds = String(model.modelVersion) === "3"
+        ? record.completionResourceIds || []
+        : [...(record.completionResourceIds || []), ...(record.evidenceIds || [])];
+      const linkedCompletionIds = [...new Set(completionIds)];
       const matchingCompletionIds = linkedCompletionIds.filter((id) => completionTypeMatches(byId.get(id), expectedCompletionTypes));
       const completionSatisfied = expectedCompletionTypes.length === 0
         || matchingCompletionIds.length > 0;
       const complete = record.status === "done" && completionSatisfied;
-      const configuredWindow = normalizedEventWindow(obligation?.window);
-      const fallbackEndOffsetDays = Number.isInteger(configuredWindow.endOffsetDays)
-        ? configuredWindow.endOffsetDays
-        : Math.ceil(configuredWindow.endOffsetHours / 24);
-      const dueWindowStart = record.dueWindowStart || event.occurredOn;
-      const dueWindowEnd = record.dueWindowEnd || record.dueOn || addCalendarDays(event.occurredOn, fallbackEndOffsetDays);
-      const dueWindowStartAt = record.dueWindowStartAt
-        || (event.occurredAt && Number.isInteger(configuredWindow.startOffsetHours)
-          ? addHours(event.occurredAt, configuredWindow.startOffsetHours)
-          : null);
-      const dueWindowEndAt = record.dueWindowEndAt
-        || (event.occurredAt && Number.isInteger(configuredWindow.endOffsetHours)
-          ? addHours(event.occurredAt, configuredWindow.endOffsetHours)
-          : null);
-      const window = {
-        dueWindowStart,
-        dueWindowEnd,
-        overdueOn: record.overdueOn || (dueWindowEnd ? addCalendarDays(dueWindowEnd, 1) : null),
-        dueWindowStartAt,
-        dueWindowEndAt,
-        overdueAt: record.overdueAt || dueWindowEndAt
-      };
-      const status = complete
+      const window = plannedCompletionWindow(record.completionWindow);
+      const timingStatus = complete
         ? "complete"
         : window.overdueAt && new Date(now) > new Date(window.overdueAt)
           ? "overdue"
@@ -446,6 +805,7 @@ function planEventRun(event, actionItems, byId, asOf, now) {
             : window.dueWindowStart <= asOf
               ? "due"
               : "upcoming";
+      const status = record.status === "blocked" ? "blocked" : timingStatus;
       return {
         key: record.id,
         kind: "event",
@@ -453,6 +813,7 @@ function planEventRun(event, actionItems, byId, asOf, now) {
         actionItemId: record.id,
         obligationId: record.obligationId,
         title: record.title,
+        activityType: obligation?.activityType || null,
         ownerIds: record.assigneeIds || [],
         policyIds: obligation?.policyIds || [],
         controlIds: obligation?.controlIds || [],
@@ -461,12 +822,16 @@ function planEventRun(event, actionItems, byId, asOf, now) {
         completionResourceIds: record.completionResourceIds || [],
         evidenceIds: record.evidenceIds || [],
         expectedCompletionTypes,
+        completionProfile,
         matchingCompletionIds,
         missingCompletion: record.status === "done" && !completionSatisfied,
         canceledAction: record.status === "canceled",
         recordedStatus: record.status,
         completedOn: record.completedOn || null,
+        blockingResourceIds: record.blockingResourceIds || [],
+        blockingReason: actionBlockingReason(record, byId),
         status,
+        timingStatus,
         ...window,
         ...relativeTiming(window, asOf),
         ...relativeTimestampTiming(window, now)
@@ -478,6 +843,8 @@ function planEventRun(event, actionItems, byId, asOf, now) {
       ? "complete"
       : actions.some((item) => item.status === "overdue")
         ? "overdue"
+        : actions.some((item) => item.status === "blocked")
+          ? "blocked"
         : actions.length > 0 && actions.every((item) => item.status === "upcoming")
           ? "upcoming"
           : "due";
@@ -498,20 +865,9 @@ function planEventRun(event, actionItems, byId, asOf, now) {
 
 function planStandaloneAction(record, byId, asOf, now) {
   const source = byId.get(record.sourceResourceId);
-  const dueWindowEnd = record.dueWindowEnd || record.dueOn || null;
-  const dueWindowStart = record.dueWindowStart || dueWindowEnd;
-  const dueWindowEndAt = record.dueWindowEndAt || null;
-  const dueWindowStartAt = record.dueWindowStartAt || dueWindowEndAt;
-  const window = {
-    dueWindowStart,
-    dueWindowEnd,
-    overdueOn: record.overdueOn || (dueWindowEnd ? addCalendarDays(dueWindowEnd, 1) : null),
-    dueWindowStartAt,
-    dueWindowEndAt,
-    overdueAt: record.overdueAt || dueWindowEndAt
-  };
+  const window = plannedCompletionWindow(record.completionWindow);
   const complete = ["done", "canceled"].includes(record.status);
-  const status = complete
+  const timingStatus = complete
     ? "complete"
     : window.overdueAt && new Date(now) > new Date(window.overdueAt)
       ? "overdue"
@@ -522,6 +878,7 @@ function planStandaloneAction(record, byId, asOf, now) {
           : window.dueWindowStart && window.dueWindowStart > asOf
             ? "upcoming"
             : "due";
+  const status = record.status === "blocked" ? "blocked" : timingStatus;
   return {
     key: record.id,
     kind: "action",
@@ -536,34 +893,72 @@ function planStandaloneAction(record, byId, asOf, now) {
     evidenceIds: record.evidenceIds || [],
     recordedStatus: record.status,
     completedOn: record.completedOn || null,
+    blockingResourceIds: record.blockingResourceIds || [],
+    blockingReason: actionBlockingReason(record, byId),
     status,
+    timingStatus,
     ...window,
     ...relativeTiming(window, asOf),
     ...relativeTimestampTiming(window, now)
   };
 }
 
+function actionBlockingReason(record, byId) {
+  if (record.status !== "blocked") return null;
+  const blockers = (record.blockingResourceIds || []).map((id) => byId.get(id)?.title || id);
+  return blockers.length
+    ? `Blocked by ${blockers.join(", ")}.`
+    : "The Action Item is marked blocked but has no blocking resource.";
+}
+
+function storedCompletionWindow(window, timezone) {
+  if (window.dueWindowEndAt) {
+    return {
+      precision: "timestamp",
+      startsAt: window.dueWindowStartAt,
+      dueAt: window.dueWindowEndAt,
+      overdueAt: window.overdueAt || window.dueWindowEndAt,
+      timezone
+    };
+  }
+  return {
+    precision: "date",
+    startsOn: window.dueWindowStart,
+    dueOn: window.dueWindowEnd,
+    overdueOn: window.overdueOn
+  };
+}
+
+function plannedCompletionWindow(window) {
+  if (window?.precision === "timestamp") {
+    return {
+      dueWindowStart: timestampCalendarDate(window.startsAt, window.timezone),
+      dueWindowEnd: timestampCalendarDate(window.dueAt, window.timezone),
+      overdueOn: timestampCalendarDate(window.overdueAt, window.timezone),
+      dueWindowStartAt: window.startsAt,
+      dueWindowEndAt: window.dueAt,
+      overdueAt: window.overdueAt
+    };
+  }
+  return {
+    dueWindowStart: window?.startsOn || null,
+    dueWindowEnd: window?.dueOn || null,
+    overdueOn: window?.overdueOn || null,
+    dueWindowStartAt: null,
+    dueWindowEndAt: null,
+    overdueAt: null
+  };
+}
+
 function completionFallsInWindow(record, window) {
   const date = completionDate(record);
   return Boolean(date && date >= window.dueWindowStart && date <= window.dueWindowEnd);
 }
 
 function normalizedEventWindow(configuredWindow) {
-  const window = configuredWindow && !Array.isArray(configuredWindow) && typeof configuredWindow === "object"
+  return configuredWindow && !Array.isArray(configuredWindow) && typeof configuredWindow === "object"
     ? configuredWindow
     : {};
-  if (Number.isInteger(window.endOffsetDays) || Number.isInteger(window.endOffsetHours)) return window;
-  if (Number.isInteger(window.startOffsetHours)) {
-    return {
-      ...window,
-      endOffsetHours: window.startOffsetHours + (DEFAULT_EVENT_DEADLINE_DAYS * 24)
-    };
-  }
-  return {
-    ...window,
-    startOffsetDays: Number.isInteger(window.startOffsetDays) ? window.startOffsetDays : 0,
-    endOffsetDays: DEFAULT_EVENT_DEADLINE_DAYS
-  };
 }
 
 function completionTypeMatches(record, expectedTypes = []) {
@@ -571,6 +966,11 @@ function completionTypeMatches(record, expectedTypes = []) {
 }
 
 function completionDate(record) {
+  const coverageDate = coverageEnd(record.coverage);
+  if (parseCalendarDate(coverageDate)) return coverageDate;
+  for (const field of COMPLETION_TIMESTAMP_FIELDS) {
+    if (isRfc3339Timestamp(record[field])) return record[field].slice(0, 10);
+  }
   for (const field of COMPLETION_DATE_FIELDS) {
     if (parseCalendarDate(record[field])) return record[field];
   }
@@ -618,22 +1018,29 @@ function relativeTimestampTiming(window, now) {
 }
 
 function comparePlannedItems(a, b) {
-  const rank = { overdue: 0, due: 1, upcoming: 2, proposed: 3, complete: 4 };
+  const rank = { overdue: 0, blocked: 1, due: 2, upcoming: 3, proposed: 4, complete: 5 };
   return (rank[a.status] - rank[b.status])
     || String(a.overdueAt || a.overdueOn || a.dueWindowEndAt || a.dueWindowEnd || a.dueWindowStartAt || a.dueWindowStart)
       .localeCompare(String(b.overdueAt || b.overdueOn || b.dueWindowEndAt || b.dueWindowEnd || b.dueWindowStartAt || b.dueWindowStart))
     || a.title.localeCompare(b.title);
 }
 
-function eventActionDescription(obligation, eventType) {
+function eventActionDescription(obligation, eventType, model) {
   const policy = obligation.policyIds?.length ? ` Policy sources: ${obligation.policyIds.join(", ")}.` : "";
   const scope = obligation.scopeResourceIds?.length ? ` Review scoped resources: ${obligation.scopeResourceIds.join(", ")}.` : "";
-  const completion = obligation.completionResourceTypes?.length
-    ? ` Link completion records of type ${obligation.completionResourceTypes.join(", ")} and any evidence before marking this done.`
+  const expected = obligationActivity(model, obligation.activityType).completionResourceTypes;
+  const completion = expected.length
+    ? ` Link completion records of type ${expected.join(", ")} and any evidence before marking this done.`
     : " Link the completion record and evidence before marking this done.";
   return `Triggered by ${eventType}.${policy}${scope}${completion}`;
 }
 
+function obligationActivity(model, activityType) {
+  const activity = model.obligationActivities?.[activityType];
+  if (!activity) throw new Error(`Unknown obligation activity type "${activityType ?? ""}".`);
+  return activity;
+}
+
 function requireDate(value, label) {
   if (!parseCalendarDate(value)) throw new Error(`A valid ${label} is required.`);
   return value;