filegrc 0.3.4 → 0.5.0

package/src/cli.js

@@ -4,9 +4,19 @@ import { createInterface } from "node:readline/promises";
 import { loadModel } from "../model/index.js";
 import { buildAgentGuide, findResourceReferences, listResourceTypes, scaffoldResourceMutation } from "./agent.js";
 import { assessAuditPreparation, prepareAuditWorkspace } from "./audit-preparation.js";
+import { createNextAuditCycle, planNextAuditCycle } from "./audit-transition.js";
+import {
+  applyApplicabilityReview,
+  planApplicabilityReview,
+  scaffoldApplicabilityReview
+} from "./batch-review.js";
+import {
+  applyCollectionReview,
+  planCollectionReview,
+  scaffoldCollectionReview
+} from "./collection-review.js";
 import { buildWorkspace } from "./build.js";
 import { generateEvidencePacket, prepareEvidencePacket } from "./evidence-packet.js";
-import { ensureEvidenceTestDrafts, planEvidenceTestDrafts } from "./evidence-tests.js";
 import {
   addEvidenceAttachment,
   createResource,
@@ -15,17 +25,27 @@ import {
   updateResource
 } from "./files.js";
 import { generateModelDocumentation } from "./model-docs.js";
+import { migrateModel, planModelMigration } from "./model-migration.js";
+import { normalizeResourceMutation } from "./mutation.js";
 import {
   completeObligationAction,
   completeObligationEvent,
   completeObligationOccurrence,
   createObligationEvent,
-  planObligations
+  planObligations,
+  scaffoldObligationCompletion
 } from "./obligations.js";
+import {
+  planExternalReviewerGovernance,
+  scaffoldExternalReviewerGovernance,
+  setupExternalReviewerGovernance
+} from "./external-reviewer.js";
 import { relativeToWorkspace, resolveDataPath } from "./paths.js";
-import { buildAgentProgramPath, policyEventName } from "./program-path.js";
-import { assessProgramReadiness } from "./program-readiness.js";
+import { buildAgentProgramPath } from "./program-path.js";
+import { assessEvidenceMap, assessProgramReadiness } from "./program-readiness.js";
+import { applyReconciliation, planReconciliation } from "./reconciliation.js";
 import { markdownEntries } from "./resource-markdown.js";
+import { effectiveResourceStatus } from "./resource-status.js";
 import { searchResources } from "./search.js";
 import { serveWorkspace } from "./server.js";
 import { planWorkspaceSetup, setupWorkspace, summarizeSetupResult } from "./setup.js";
@@ -34,9 +54,16 @@ import { createAppState } from "./state.js";
 import { currentCalendarDate } from "./time.js";
 import { validateWorkspace } from "./validate.js";
 import { loadWorkspace } from "./workspace.js";
+import {
+  assessWorkflow,
+  buildWorkflowDelta,
+  previewWorkflowMutation,
+  workflowForResource
+} from "./workflow.js";
 
 const BOOLEAN_FLAGS = new Set([
   "allow-non-authoritative-writes",
+  "apply",
   "check-docs",
   "complete",
   "current",
@@ -47,7 +74,10 @@ const BOOLEAN_FLAGS = new Set([
   "next",
   "preview",
   "require-ready",
+  "require-healthy",
+  "scaffold",
   "summary",
+  "workflow",
   "write-docs",
   "yes"
 ]);
@@ -89,19 +119,19 @@ export async function runCli(argv = process.argv.slice(2)) {
       ...(flags.boundary !== undefined ? { boundary: flags.boundary } : {}),
       ...(flags.owner !== undefined ? { ownerId: flags.owner } : {}),
       ...(flags.criticality !== undefined ? { criticality: flags.criticality } : {}),
-      ...(flags.classification !== undefined ? { dataClassification: flags.classification } : {}),
+      ...(flags.classification !== undefined ? { classificationId: flags.classification } : {}),
       ...(flags["internet-exposed"] !== undefined ? { internetExposed: flags["internet-exposed"] } : {}),
       ...(flags["program-goal"] !== undefined ? { programGoal: flags["program-goal"] } : {}),
       ...(flags.draft ? { draft: true } : {})
     });
     const result = flags.preview
       ? await planWorkspaceSetup(root, setupInput)
-      : await setupWorkspace(root, setupInput);
+      : await withWorkflowDelta(root, () => setupWorkspace(root, setupInput));
     const output = flags.summary && !flags.preview ? summarizeSetupResult(result) : result;
     if (flags.json) console.log(JSON.stringify(output, null, 2));
     else if (flags.preview) {
       console.log(`Setup preview: ${result.changes.system} system ${result.system.id}; update workspace target to ${result.target.assuranceGoal}.`);
-      console.log("No controls will be linked and no evidence drafts will be created.");
+      console.log("No controls will be linked and no evidence records will be created.");
     }
     else {
       console.log(`${result.draft ? "Saved draft scope" : "Completed initial setup"} for ${result.system.title}.`);
@@ -144,6 +174,36 @@ export async function runCli(argv = process.argv.slice(2)) {
     else console.log(source);
     return;
   }
+  if (command === "migrate") {
+    const targetModel = String(flags["to-model"] || "");
+    if (!["2", "3"].includes(targetModel)) throw new Error("Pass --to-model 2 or --to-model 3.");
+    const options = {
+      jobTitle: flags["job-title"],
+      startsOn: flags["starts-on"],
+      targetModelVersion: targetModel
+    };
+    const plan = await planModelMigration(root, options);
+    if (!flags.preview && plan.sourceModelVersion !== plan.targetModelVersion && !flags.yes) {
+      throw new Error(`Review migrate --to-model ${targetModel} --preview --json, then pass --yes to apply the migration.`);
+    }
+    const result = flags.preview
+      ? plan
+      : plan.sourceModelVersion !== plan.targetModelVersion
+        ? await migrateModel(root, options)
+        : { ...plan, applied: false };
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else if (result.sourceModelVersion === result.targetModelVersion) {
+      console.log(`Workspace already uses model v${result.targetModelVersion}.`);
+    } else if (flags.preview) {
+      console.log(`Model migration preview: create ${result.summary.create}; update ${result.summary.update}.`);
+      console.log(result.ready
+        ? "Ready to apply. Rerun with --yes."
+        : `Needs review: ${result.missing.length} missing values, ${result.conflicts.length} conflicts, ${result.manualActions.length} manual actions.`);
+    } else {
+      console.log(`Migrated workspace from model v${result.sourceModelVersion} to v${result.targetModelVersion}.`);
+    }
+    return result;
+  }
   if (command === "describe") {
     const loaded = await loadWorkspace(root);
     const type = positionals[0];
@@ -184,6 +244,71 @@ export async function runCli(argv = process.argv.slice(2)) {
     else printProgramPathOutput(output, flags);
     return output;
   }
+  if (command === "workflow") {
+    const result = await assessWorkflow(root, {
+      auditId: positionals[0] || flags.audit,
+      asOf: flags["as-of"],
+      through: flags.through,
+      includeComplete: Boolean(flags.complete)
+    });
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else printWorkflow(result);
+    if (flags["require-ready"] && result.assessments.evidenceReadiness.status !== "complete") {
+      process.exitCode = 2;
+    }
+    return result;
+  }
+  if (command === "period-health") {
+    const coverage = flags.start || flags.end
+      ? { kind: "range", startsOn: flags.start, endsOn: flags.end }
+      : undefined;
+    const result = await assessWorkflow(root, {
+      auditId: positionals[0] || flags.audit,
+      asOf: flags["as-of"],
+      through: flags.end || flags.through,
+      coverage
+    });
+    const output = {
+      contractVersion: result.contractVersion,
+      dataModelVersion: result.dataModelVersion,
+      evaluatedAt: result.evaluatedAt,
+      input: result.input,
+      assessment: result.assessments.periodHealth,
+      findings: result.findings.filter(({ assessment }) => assessment === "period-health"),
+      workItems: result.workItems.filter((item) => (
+        ["overdue", "due", "scheduled", "blocked"].includes(item.state)
+      )),
+      recommended: result.recommended
+    };
+    if (flags.json) console.log(JSON.stringify(output, null, 2));
+    else {
+      console.log(`${output.assessment.status.toUpperCase()}: ${output.assessment.message}`);
+      for (const finding of output.findings) {
+        console.log(`${finding.state.toUpperCase()}\t${finding.title}\t${finding.message}`);
+      }
+    }
+    if (flags["require-healthy"] && output.assessment.status !== "complete") process.exitCode = 2;
+    return output;
+  }
+  if (command === "milestone-check") {
+    const loaded = await loadWorkspace(root);
+    const result = await assessWorkflow(loaded, { asOf: flags["as-of"] });
+    const target = loaded.workspace?.assuranceGoal === "none"
+      ? "structuralValidity"
+      : loaded.workspace?.candidateCoverage
+        ? "periodHealth"
+        : "evidenceReadiness";
+    const output = {
+      milestone: target,
+      assessment: result.assessments[target],
+      findingKeys: result.assessments[target].findingKeys,
+      evaluatedAt: result.evaluatedAt
+    };
+    if (flags.json) console.log(JSON.stringify(output, null, 2));
+    else console.log(`${target}: ${output.assessment.status.toUpperCase()} · ${output.assessment.message}`);
+    if (output.assessment.status !== "complete") process.exitCode = 2;
+    return output;
+  }
   if (command === "scaffold") {
     const loaded = await loadWorkspace(root);
     const type = positionals[0];
@@ -195,12 +320,25 @@ export async function runCli(argv = process.argv.slice(2)) {
     const loaded = await loadWorkspace(root);
     const type = positionals[0];
     if (type && !loaded.model.resources[type]) throw new Error(`Unknown resource type "${type}".`);
+    const asOf = currentCalendarDate(loaded.workspace.timezone);
     const records = loaded.resources
       .filter((record) => !type || record.type === type)
-      .sort((left, right) => `${left.type}:${left.title}:${left.id}`.localeCompare(`${right.type}:${right.title}:${right.id}`));
-    if (flags.json) console.log(JSON.stringify(records, null, 2));
-    else for (const record of records) console.log(`${record.id}\t${record.type}\t${record.status ?? ""}\t${record.title}`);
-    return records;
+      .sort((left, right) => `${left.type}:${left.title}:${left.id}`.localeCompare(`${right.type}:${right.title}:${right.id}`))
+      .map((record) => {
+        const effectiveStatus = effectiveResourceStatus(record, asOf);
+        return effectiveStatus && effectiveStatus !== record.status
+          ? { ...record, effectiveStatus }
+          : record;
+      });
+    const output = flags.workflow
+      ? {
+          records,
+          workflow: await assessWorkflow(loaded, { asOf })
+        }
+      : records;
+    if (flags.json) console.log(JSON.stringify(output, null, 2));
+    else for (const record of records) console.log(`${record.id}\t${record.type}\t${record.effectiveStatus ?? record.status ?? ""}\t${record.title}`);
+    return output;
   }
   if (command === "search") {
     const loaded = await loadWorkspace(root);
@@ -217,11 +355,12 @@ export async function runCli(argv = process.argv.slice(2)) {
       from: flags.from,
       through: flags.through,
       now: flags.now,
-      includeComplete: Boolean(flags.complete)
+      includeComplete: Boolean(flags.complete),
+      model: loaded.model
     });
     if (flags.json) console.log(JSON.stringify(result, null, 2));
     else {
-      console.log(`${result.counts.overdue} overdue, ${result.counts.due} due, ${result.counts.upcoming} upcoming, ${result.counts.proposed} starter proposals`);
+      console.log(`${result.counts.overdue} overdue, ${result.counts.blocked} blocked, ${result.counts.due} due, ${result.counts.upcoming} upcoming, ${result.counts.proposed} starter proposals`);
       for (const item of result.items) {
         const deadline = item.dueWindowEndAt || item.dueWindowEnd;
         if (!deadline) throw new Error(`Planned work "${item.title}" is missing a deadline.`);
@@ -230,13 +369,18 @@ export async function runCli(argv = process.argv.slice(2)) {
           item.dueWindowStartAt || item.dueWindowStart,
           deadline,
           item.title,
-          item.actionItemId || item.obligationId
+          item.actionItemId || item.obligationId,
+          item.actionItemId
+            ? item.status === "blocked"
+              ? `filegrc get ${item.actionItemId} --mutation`
+              : `filegrc complete-action ${item.actionItemId} --scaffold --completed-on YYYY-MM-DD`
+            : `filegrc complete ${item.obligationId} --scaffold --window-start ${item.dueWindowStart} --completed-on YYYY-MM-DD`
         ].join("\t"));
       }
       if (result.triggers.length) {
         console.log("\nPolicy Events:");
         for (const trigger of result.triggers) {
-          console.log(`${trigger.programStatus.toUpperCase()}\t${policyEventName(trigger.eventType)} (${trigger.eventType})\t${trigger.steps.length} Work Queue ${trigger.steps.length === 1 ? "task" : "tasks"}`);
+          console.log(`${trigger.programStatus.toUpperCase()}\t${trigger.title} (${trigger.eventType})\t${trigger.steps.length} Work Queue ${trigger.steps.length === 1 ? "task" : "tasks"}`);
           for (const step of trigger.steps) {
             const owners = step.ownerIds.length ? step.ownerIds.join(",") : "unassigned";
             const proof = step.completionResourceTypes.length ? step.completionResourceTypes.join("|") : "not specified";
@@ -262,7 +406,14 @@ export async function runCli(argv = process.argv.slice(2)) {
     }
     else {
       console.log(`${result.status.toUpperCase()}: ${result.progress.complete} of ${result.progress.total} program items complete`);
-      console.log(`${result.target.label}${result.target.candidatePeriodStart ? `, candidate period starts ${result.target.candidatePeriodStart}` : ""}`);
+      console.log(
+        `${result.target.label}`
+        + (result.target.candidateCoverage?.kind === "range"
+          ? `, candidate period starts ${result.target.candidateCoverage.startsOn}`
+          : result.target.candidateCoverage?.kind === "as-of"
+            ? `, candidate as-of date ${result.target.candidateCoverage.on}`
+            : "")
+      );
       for (const stage of result.stages) {
         console.log(`\n${stage.title}`);
         for (const item of stage.items) console.log(`${item.status.toUpperCase()}\t${item.title}\t${item.message}`);
@@ -274,33 +425,25 @@ export async function runCli(argv = process.argv.slice(2)) {
     if (flags["require-ready"] && !result.evidenceReady) process.exitCode = 2;
     return output;
   }
-  if (command === "evidence-test-drafts") {
-    if (flags.preview) {
-      const loaded = await loadWorkspace(root);
-      const plan = planEvidenceTestDrafts(loaded);
-      const result = {
-        schemaVersion: 1,
-        preview: true,
-        total: plan.length,
-        create: plan.filter(({ existing }) => !existing).map((item) => ({
-          familyId: item.familyId,
-          title: item.title,
-          testEvidenceKind: item.testEvidenceKind,
-          controlIds: item.controlIds
-        })),
-        existing: plan.filter(({ existing }) => existing).map(({ existing }) => ({
-          id: existing.id,
-          title: existing.title,
-          status: existing.status
-        }))
-      };
-      if (flags.json) console.log(JSON.stringify(result, null, 2));
-      else console.log(`Evidence draft preview: create ${result.create.length}; preserve ${result.existing.length}.`);
-      return result;
-    }
-    const result = await ensureEvidenceTestDrafts(root);
+  if (command === "evidence-map") {
+    const loaded = await loadWorkspace(root);
+    const result = await assessEvidenceMap(loaded, { asOf: flags["as-of"] });
     if (flags.json) console.log(JSON.stringify(result, null, 2));
-    else console.log(`Created ${result.created.length} External Evidence test ${result.created.length === 1 ? "draft" : "drafts"}; ${result.total} required families are represented.`);
+    else {
+      console.log(`${result.status.toUpperCase()}: ${result.counts.complete} mapped, ${result.counts.action} need action`);
+      for (const item of result.items) {
+        console.log(`${item.status.toUpperCase()}\t${item.title}\t${item.message}`);
+        if (item.status !== "action") continue;
+        if (item.sourceKinds?.length) console.log(`  Source role: ${item.sourceKinds.join(" or ")}`);
+        for (const source of item.sourceSystemChecks || []) {
+          const missing = Object.entries(source.checks)
+            .filter(([, passed]) => !passed)
+            .map(([name]) => evidenceSourceCheckName(name));
+          if (missing.length) console.log(`  ${source.sourceSystemId}: ${missing.join(", ")}`);
+        }
+        if (item.commands?.length) console.log(`  Next: ${item.commands[0]}`);
+      }
+    }
     return result;
   }
   if (command === "audit-readiness") {
@@ -322,24 +465,132 @@ export async function runCli(argv = process.argv.slice(2)) {
   if (command === "prepare-audit") {
     const auditId = positionals[0] || flags.audit;
     if (!auditId) throw new Error("An audit ID is required.");
-    const result = await prepareAuditWorkspace(root, { auditId });
+    const result = await withWorkflowDelta(root, () => prepareAuditWorkspace(root, { auditId }));
     if (flags.json) console.log(JSON.stringify(result, null, 2));
     else console.log(`Prepared ${result.auditId}: linked ${result.linkedDocumentIds.length} management documents and created ${result.createdPopulationIds.length} population records.`);
     return result;
   }
+  if (command === "reconcile") {
+    const result = flags.apply
+      ? await withWorkflowDelta(root, () => applyReconciliation(root, {
+        candidateId: flags.candidate,
+        transitionFingerprint: flags.candidate,
+        occurredOn: flags["occurred-on"],
+        occurredAt: flags["occurred-at"],
+        riskLevel: flags["risk-level"],
+        title: flags.title,
+        confirmed: flags.yes === true
+      }))
+      : await planReconciliation(root);
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else if (flags.apply) {
+      console.log(`Reconciled ${result.candidate.eventType}: created ${result.event.id} and ${result.actions.length} linked tasks.`);
+    } else if (!result.candidates.length) {
+      console.log("No direct-file transitions need confirmation.");
+    } else {
+      for (const candidate of result.candidates) {
+        console.log(`${candidate.id}\t${candidate.eventType}\t${candidate.subject.title}\t${candidate.message}`);
+        console.log(`  ${candidate.action.command}`);
+      }
+    }
+    return result;
+  }
+  if (command === "external-reviewer-setup") {
+    if (flags.scaffold) {
+      const result = await scaffoldExternalReviewerGovernance(root);
+      console.log(JSON.stringify(result, null, 2));
+      return result;
+    }
+    const payload = await readSetupPayload(positionals[0]);
+    const options = {
+      ...payload,
+      confirmed: flags.yes === true
+    };
+    const result = flags.preview
+      ? await planExternalReviewerGovernance(root, options)
+      : await withWorkflowDelta(root, () => setupExternalReviewerGovernance(root, options));
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else if (flags.preview) {
+      console.log(`External reviewer governance preview: ${result.changes.create.length} records to create and ${result.changes.update.length} to update.`);
+    } else {
+      console.log(`Assigned external reviewer ${result.reviewerId} through ${result.appointmentIds.length} active Appointments.`);
+    }
+    return result;
+  }
+  if (command === "next-audit-cycle") {
+    const payload = await readSetupPayload(positionals[1]);
+    const options = {
+      ...payload,
+      priorAuditId: positionals[0] || flags.audit || payload.priorAuditId,
+      startsOn: flags.start || payload.startsOn,
+      endsOn: flags.end || payload.endsOn,
+      confirmed: flags.yes === true
+    };
+    const result = flags.preview
+      ? await planNextAuditCycle(root, options)
+      : await withWorkflowDelta(root, () => createNextAuditCycle(root, options));
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else if (flags.preview) {
+      console.log(`${result.operation} preview: ${result.audit.title}, ${result.audit.coverage.startsOn} through ${result.audit.coverage.endsOn}.`);
+    } else {
+      console.log(`Created ${result.audit.id}. Review carried-forward scope and period continuity before fieldwork.`);
+    }
+    return result;
+  }
+  if (command === "review-applicability") {
+    if (flags.scaffold) {
+      const result = await scaffoldApplicabilityReview(root, { type: flags.type });
+      console.log(JSON.stringify(result, null, 2));
+      return result;
+    }
+    const payload = await readSetupPayload(positionals[0]);
+    const options = { ...payload, confirmed: flags.yes === true };
+    const result = flags.preview
+      ? await planApplicabilityReview(root, options)
+      : await withWorkflowDelta(root, () => applyApplicabilityReview(root, options));
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else if (flags.preview) console.log(`Applicability preview: ${result.reviewedIds.length} decisions.`);
+    else console.log(`Recorded ${result.reviewedIds.length} reviewed applicability decisions.`);
+    return result;
+  }
+  if (command === "review-collection") {
+    const resourceType = positionals[0] || flags.type;
+    if (flags.scaffold) {
+      const result = await scaffoldCollectionReview(root, { resourceType });
+      console.log(JSON.stringify(result, null, 2));
+      return result;
+    }
+    const payload = await readSetupPayload(positionals[1]);
+    const options = {
+      ...payload,
+      resourceType: resourceType || payload.resourceType,
+      confirmed: flags.yes === true
+    };
+    const result = flags.preview
+      ? await planCollectionReview(root, options)
+      : await withWorkflowDelta(root, () => applyCollectionReview(root, options));
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else if (flags.preview) console.log(`Collection review preview: ${result.assessment.configuration.title}.`);
+    else console.log(`Confirmed ${result.assessment.configuration.title}.`);
+    return result;
+  }
   if (command === "trigger") {
-    const result = await createObligationEvent(root, {
+    const result = await withWorkflowDelta(root, () => createObligationEvent(root, {
       eventType: positionals[0],
       occurredOn: flags["occurred-on"],
       occurredAt: flags["occurred-at"],
+      riskLevel: flags["risk-level"],
       subjectResourceIds: String(flags.subject || "").split(",").map((value) => value.trim()).filter(Boolean),
       title: flags.title
-    });
+    }));
     if (flags.json) console.log(JSON.stringify(result, null, 2));
     else {
       console.log(`Work added to the Work Queue: ${result.actions.length} ${result.actions.length === 1 ? "task" : "tasks"} created for ${result.event.title}.`);
       console.log(`Event: obligation-event/${result.event.id}`);
-      for (const action of result.actions) console.log(`Task: action-item/${action.id}\t${action.title}\t${action.dueWindowEndAt || action.dueWindowEnd || action.overdueAt || action.overdueOn}`);
+      for (const action of result.actions) {
+        const deadline = action.completionWindow?.dueAt || action.completionWindow?.dueOn;
+        console.log(`Task: action-item/${action.id}\t${action.title}\t${deadline}`);
+      }
     }
     return result;
   }
@@ -391,8 +642,14 @@ export async function runCli(argv = process.argv.slice(2)) {
       console.log(JSON.stringify(mutation, null, 2));
       return mutation;
     }
-    console.log(JSON.stringify(record, null, 2));
-    return record;
+    const output = flags.workflow
+      ? {
+          record,
+          workflow: workflowForResource(await assessWorkflow(loaded), record.type, record.id)
+        }
+      : record;
+    console.log(JSON.stringify(output, null, 2));
+    return output;
   }
   if (command === "references") {
     const loaded = await loadWorkspace(root);
@@ -406,36 +663,65 @@ export async function runCli(argv = process.argv.slice(2)) {
     }
     return result;
   }
+  if (command === "preview-mutation") {
+    const payload = await readSetupPayload(positionals[0]);
+    const result = await previewWorkflowMutation(root, payload);
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else {
+      console.log(`${result.operation.toUpperCase()} preview for ${result.target.type}/${result.target.id}`);
+      console.log(`${result.workflowDelta.findings.added.length} findings added, ${result.workflowDelta.findings.removed.length} resolved, ${result.workflowDelta.findings.changed.length} changed.`);
+      if (result.workflow.recommended) console.log(`Next: ${result.workflow.recommended.title}`);
+      console.log("No workspace files were changed.");
+    }
+    return result;
+  }
   if (command === "create") {
     const mutation = await readMutation(positionals[0]);
-    const result = await createResource(root, mutation.record, { content: mutation.content });
-    if (flags.json) console.log(JSON.stringify({ record: result.record }, null, 2));
+    const result = await withWorkflowDelta(root, () => createResource(root, mutation.record, { content: mutation.content }));
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
     else console.log(`Created ${result.record.type}/${result.record.id}`);
     return result;
   }
   if (command === "complete") {
     const [obligationId, file] = positionals;
+    if (flags.scaffold) {
+      const result = await scaffoldObligationCompletion(root, {
+        obligationId,
+        windowStart: flags["window-start"],
+        completedOn: flags["completed-on"]
+      });
+      console.log(JSON.stringify(result, null, 2));
+      return result;
+    }
     const mutation = await readMutation(file);
-    const result = await completeObligationOccurrence(root, {
+    const result = await withWorkflowDelta(root, () => completeObligationOccurrence(root, {
       obligationId,
       record: mutation.record,
       content: mutation.content,
-      expectedRevision: flags["expected-revision"]
-    });
+      expectedRevision: expectedRevision(flags, mutation, `obligation/${obligationId}`)
+    }));
     if (flags.json) console.log(JSON.stringify(result, null, 2));
     else console.log(`Created ${result.created.type}/${result.created.id} and linked it to obligation/${obligationId}`);
     return result;
   }
   if (command === "complete-action") {
     const [actionItemId, file] = positionals;
+    if (flags.scaffold) {
+      const result = await scaffoldObligationCompletion(root, {
+        actionItemId,
+        completedOn: flags["completed-on"]
+      });
+      console.log(JSON.stringify(result, null, 2));
+      return result;
+    }
     const mutation = await readMutation(file);
-    const result = await completeObligationAction(root, {
+    const result = await withWorkflowDelta(root, () => completeObligationAction(root, {
       actionItemId,
       completedOn: flags["completed-on"],
       record: mutation.record,
       content: mutation.content,
-      expectedRevision: flags["expected-revision"]
-    });
+      expectedRevision: expectedRevision(flags, mutation, `action-item/${actionItemId}`)
+    }));
     if (flags.json) console.log(JSON.stringify(result, null, 2));
     else console.log(`Created ${result.created.type}/${result.created.id}, linked it to action-item/${actionItemId}, and marked the action done.`);
     return result;
@@ -443,24 +729,25 @@ export async function runCli(argv = process.argv.slice(2)) {
   if (command === "complete-event") {
     const eventId = positionals[0];
     if (!eventId) throw new Error("A Policy Event ID is required.");
-    const result = await completeObligationEvent(root, {
+    const result = await withWorkflowDelta(root, () => completeObligationEvent(root, {
       eventId,
       completedOn: flags["completed-on"],
-      expectedRevision: flags["expected-revision"]
-    });
-    if (flags.json) console.log(JSON.stringify({ record: result.record }, null, 2));
+      expectedRevision: requireExpectedRevision(flags, `obligation-event/${eventId}`)
+    }));
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
     else console.log(`Marked obligation-event/${eventId} complete.`);
     return result;
   }
   if (command === "update") {
     const [type, id, file] = positionals;
-    const mutation = await readMutation(file);
-    const result = await updateResource(root, type, id, mutation.record, {
+    const mutation = await readMutation(file, { requireRevision: true });
+    const result = await withWorkflowDelta(root, () => updateResource(root, type, id, mutation.record, {
       content: mutation.content,
       expectedRevision: mutation.revision,
-      expectedContentRevisions: mutation.contentRevisions
-    });
-    if (flags.json) console.log(JSON.stringify({ record: result.record }, null, 2));
+      expectedContentRevisions: mutation.contentRevisions,
+      requireExpectedContentRevisions: true
+    }));
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
     else console.log(`Updated ${result.record.type}/${result.record.id}`);
     return result;
   }
@@ -480,14 +767,21 @@ export async function runCli(argv = process.argv.slice(2)) {
       const state = await createAppState(root);
       const stateEntry = state.resources.find((item) => item.record.type === type && item.record.id === id);
       const existingContentRevision = stateEntry.content?.[slot.name]?.revision;
-      await updateResource(root, type, id, record, {
+      const mutationResult = await withWorkflowDelta(root, () => updateResource(root, type, id, record, {
         content: { [slot.name]: source },
         expectedRevision: stateEntry.revision,
         expectedContentRevisions: existingContentRevision
           ? { [slot.path]: flags["expected-revision"] ?? existingContentRevision }
           : undefined
-      });
-      const result = { type, id, slot: slot.name, path: `data/${slot.path}`, written: true };
+      }));
+      const result = {
+        type,
+        id,
+        slot: slot.name,
+        path: `data/${slot.path}`,
+        written: true,
+        workflowDelta: mutationResult.workflowDelta
+      };
       if (flags.json) console.log(JSON.stringify(result, null, 2));
       else console.log(`Updated ${result.path}`);
       return result;
@@ -507,14 +801,15 @@ export async function runCli(argv = process.argv.slice(2)) {
   if (command === "attach") {
     const [evidenceId, sourcePath] = positionals;
     if (!evidenceId || !sourcePath) throw new Error("An evidence ID and source file are required.");
-    const result = await addEvidenceAttachment(root, evidenceId, sourcePath, {
+    const result = await withWorkflowDelta(root, () => addEvidenceAttachment(root, evidenceId, sourcePath, {
       name: flags.name,
-      expectedRevision: flags["expected-revision"]
-    });
+      expectedRevision: requireExpectedRevision(flags, `evidence/${evidenceId}`)
+    }));
     const output = {
       evidenceId,
       path: `data/${result.dataRelativePath}`,
-      filePaths: result.record.filePaths
+      filePaths: result.record.filePaths,
+      workflowDelta: result.workflowDelta
     };
     if (flags.json) console.log(JSON.stringify(output, null, 2));
     else console.log(`Attached ${output.path} to evidence/${evidenceId}`);
@@ -524,13 +819,14 @@ export async function runCli(argv = process.argv.slice(2)) {
     const [evidenceId, attachment] = positionals;
     if (!evidenceId || !attachment) throw new Error("An evidence ID and attachment name are required.");
     if (!flags.yes) throw new Error("Pass --yes to confirm attachment removal.");
-    const result = await removeEvidenceAttachment(root, evidenceId, attachment, {
-      expectedRevision: flags["expected-revision"]
-    });
+    const result = await withWorkflowDelta(root, () => removeEvidenceAttachment(root, evidenceId, attachment, {
+      expectedRevision: requireExpectedRevision(flags, `evidence/${evidenceId}`)
+    }));
     const output = {
       evidenceId,
       removed: `data/${result.dataRelativePath}`,
-      filePaths: result.record.filePaths ?? []
+      filePaths: result.record.filePaths ?? [],
+      workflowDelta: result.workflowDelta
     };
     if (flags.json) console.log(JSON.stringify(output, null, 2));
     else console.log(`Detached and removed ${output.removed} from evidence/${evidenceId}`);
@@ -539,9 +835,13 @@ export async function runCli(argv = process.argv.slice(2)) {
   if (command === "delete") {
     const [type, id] = positionals;
     if (!flags.yes) throw new Error("Pass --yes to confirm deletion. Preserve historical records unless this is a mistake or uncommitted draft.");
-    await deleteResource(root, type, id, { expectedRevision: flags["expected-revision"] });
-    console.log(`Deleted ${type}/${id}`);
-    return;
+    const result = await withWorkflowDelta(root, () => deleteResource(root, type, id, {
+      expectedRevision: requireExpectedRevision(flags, `${type}/${id}`)
+    }));
+    const output = { deleted: true, type, id, workflowDelta: result.workflowDelta };
+    if (flags.json) console.log(JSON.stringify(output, null, 2));
+    else console.log(`Deleted ${type}/${id}`);
+    return output;
   }
   throw new Error(`Unknown command "${command}". Run filegrc help.`);
 }
@@ -567,37 +867,36 @@ function parseArgs(args) {
   return { positionals, flags };
 }
 
-async function readMutation(path) {
+async function withWorkflowDelta(root, task) {
+  const before = await assessWorkflow(root);
+  const result = await task();
+  const after = await assessWorkflow(root);
+  return {
+    ...result,
+    workflowDelta: buildWorkflowDelta(before, after)
+  };
+}
+
+async function readMutation(path, options = {}) {
   if (!path) throw new Error("A JSON file path or - is required.");
   const source = path === "-" ? await readStdin() : await readFile(resolve(path), "utf8");
-  const parsed = JSON.parse(source);
-  if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") {
-    throw new Error("A resource record or { record, content } mutation object is required.");
-  }
-  if (!Object.hasOwn(parsed, "record")) {
-    return { record: parsed, content: undefined, revision: undefined, contentRevisions: undefined };
-  }
-  if (!parsed.record || Array.isArray(parsed.record) || typeof parsed.record !== "object") {
-    throw new Error("Mutation record must be a JSON object.");
-  }
-  if (parsed.content !== undefined && (Array.isArray(parsed.content) || typeof parsed.content !== "object" || parsed.content === null)) {
-    throw new Error("Mutation content must be an object keyed by Markdown slot.");
-  }
-  if (parsed.revision !== undefined && typeof parsed.revision !== "string") {
-    throw new Error("Mutation revision must be a string.");
+  return normalizeResourceMutation(JSON.parse(source), options);
+}
+
+function requireExpectedRevision(flags, target) {
+  const revision = flags["expected-revision"];
+  if (typeof revision !== "string" || revision.length === 0) {
+    throw new Error(`--expected-revision is required when changing ${target}. Reload the resource and try again.`);
   }
-  if (
-    parsed.contentRevisions !== undefined
-    && (Array.isArray(parsed.contentRevisions) || typeof parsed.contentRevisions !== "object" || parsed.contentRevisions === null)
-  ) {
-    throw new Error("Mutation contentRevisions must be an object keyed by data-relative Markdown path.");
+  return revision;
+}
+
+function expectedRevision(flags, mutation, target) {
+  const revision = flags["expected-revision"] || mutation.revision;
+  if (typeof revision !== "string" || revision.length === 0) {
+    throw new Error(`A mutation revision or --expected-revision is required when changing ${target}. Reload the resource and try again.`);
   }
-  return {
-    record: parsed.record,
-    content: parsed.content,
-    revision: parsed.revision,
-    contentRevisions: parsed.contentRevisions
-  };
+  return revision;
 }
 
 async function readSetupPayload(path) {
@@ -643,11 +942,11 @@ async function completeInteractiveSetup(root, payload) {
       activePeople[0].id
     );
     result.criticality ||= await askChoice("Criticality", ["low", "medium", "high", "critical"], "high");
-    result.dataClassification ||= classifications.length
+    result.classificationId ||= classifications.length
       ? await askChoice(
         "Data classification",
         classifications,
-        classifications.includes("Confidential") ? "Confidential" : classifications[0]
+        classifications.includes("confidential") ? "confidential" : classifications[0]
       )
       : await askRequired("Data classification");
     if (result.internetExposed === undefined) {
@@ -690,31 +989,44 @@ Usage:
   filegrc build [root] [--output .filegrc/site]
   filegrc validate [root] [--json]
   filegrc model [--json|--write-docs|--check-docs]
+  filegrc migrate --to-model <2|3> [--preview] [--job-title text] [--starts-on YYYY-MM-DD] [--yes] [--json]
   filegrc describe <resource-type>
   filegrc types [--json]
   filegrc guide [resource-type] [--id resource-id] [--json]
   filegrc program-path [audit-id] [--as-of YYYY-MM-DD] [--summary|--next|--current] [--json]
+  filegrc workflow [audit-id] [--as-of YYYY-MM-DD] [--through YYYY-MM-DD] [--complete] [--require-ready] [--json]
+  filegrc period-health [audit-id] [--start YYYY-MM-DD --end YYYY-MM-DD] [--as-of YYYY-MM-DD] [--require-healthy] [--json]
+  filegrc milestone-check [--as-of YYYY-MM-DD] [--json]
   filegrc scaffold <resource-type> --title text [--id resource-id]
-  filegrc list [resource-type] [--json]
+  filegrc list [resource-type] [--workflow] [--json]
   filegrc search <query> [--type resource-type] [--json]
   filegrc obligations [--as-of YYYY-MM-DD] [--from YYYY-MM-DD] [--through YYYY-MM-DD] [--now RFC3339] [--complete] [--json]
   filegrc program-readiness [--as-of YYYY-MM-DD] [--require-ready] [--summary] [--json]
-  filegrc evidence-test-drafts [--preview] [--json]
+  filegrc evidence-map [--as-of YYYY-MM-DD] [--json]
   filegrc audit-readiness [audit-id] [--require-ready] [--json]
   filegrc prepare-audit <audit-id> [--json]
-  filegrc trigger <event-type> (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) [--subject resource-id[,resource-id]] [--title text] [--json]
+  filegrc reconcile [--preview|--apply --candidate fingerprint (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) --yes] [--risk-level normal|high] [--json]
+  filegrc external-reviewer-setup --scaffold
+  filegrc external-reviewer-setup <reviewer.json|-> [--preview|--yes] [--json]
+  filegrc next-audit-cycle <prior-audit-id> [cycle.json|-] --start YYYY-MM-DD --end YYYY-MM-DD [--preview|--yes] [--json]
+  filegrc review-applicability [--scaffold --type requirement|control|commitment|complementary-control] [decisions.json|-] [--preview|--yes] [--json]
+  filegrc review-collection <resource-type> [--scaffold | review.json|-] [--preview|--yes] [--json]
+  filegrc trigger <event-type> (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) [--risk-level normal|high] [--subject resource-id[,resource-id]] [--title text] [--json]
   filegrc evidence-packet [--audit audit-id] [--start YYYY-MM-DD] [--end YYYY-MM-DD] [--output .filegrc/path] [--preview] [--require-ready] [--json]
   filegrc get [resource-type] <id> [--mutation]
   filegrc references <id> [--json]
-  filegrc create <record-or-mutation.json|-> [--json]
+  filegrc preview-mutation <preview.json|-> [--json]
+  filegrc create <mutation.json|-> [--json]
+  filegrc complete <obligation-id> --scaffold --window-start YYYY-MM-DD [--completed-on YYYY-MM-DD]
   filegrc complete <obligation-id> <completion-record.json|-> [--expected-revision hash] [--json]
+  filegrc complete-action <action-item-id> --scaffold [--completed-on YYYY-MM-DD]
   filegrc complete-action <action-item-id> <completion-record.json|-> --completed-on YYYY-MM-DD [--expected-revision hash] [--json]
-  filegrc complete-event <obligation-event-id> --completed-on YYYY-MM-DD [--expected-revision hash] [--json]
-  filegrc update <resource-type> <id> <record-or-mutation.json|-> [--json]
+  filegrc complete-event <obligation-event-id> --completed-on YYYY-MM-DD --expected-revision hash [--json]
+  filegrc update <resource-type> <id> <mutation.json|-> [--json]
   filegrc content <resource-type> <id> [slot] [--write markdown-file|-] [--expected-revision hash] [--json]
-  filegrc attach <evidence-id> <source-file> [--name file-name] [--expected-revision hash] [--json]
-  filegrc detach <evidence-id> <attachment-name> --yes [--expected-revision hash] [--json]
-  filegrc delete <resource-type> <id> --yes [--expected-revision hash]
+  filegrc attach <evidence-id> <source-file> --expected-revision hash [--name file-name] [--json]
+  filegrc detach <evidence-id> <attachment-name> --yes --expected-revision hash [--json]
+  filegrc delete <resource-type> <id> --yes --expected-revision hash
 
 All commands accept --root <workspace>. Writes never create Git commits.`);
 }
@@ -751,7 +1063,7 @@ Options:
   --boundary <description>    boundary
   --owner <person-id>         ownerId
   --criticality <level>       low, medium, high, or critical
-  --classification <name>     dataClassification
+  --classification <level>    public, internal, confidential, or restricted
   --internet-exposed <bool>   true or false
   --program-goal <goal>       none, readiness, type-1, or type-2
   --draft                     Save the service boundary as planned
@@ -762,14 +1074,36 @@ Options:
   --help                      Show this help`);
     return;
   }
+  if (command === "migrate") {
+    console.log(`Usage:
+  filegrc migrate --to-model <2|3> [options]
+
+Upgrade a workspace through an explicit, reviewable model boundary. Model v1
+workspaces migrate to v2 first. Model v2 workspaces migrate to v3 with planned
+core Appointments, removal of obsolete manual page state, classified review work,
+and dataModelVersion changed last. The command writes no Git commit.
+
+Options:
+  --to-model <version>  Required target model; 2 for legacy v1 migration, 3 for the active model
+  --preview             Show the complete atomic record plan without writing
+  --job-title <title>   Actual job title for the former Policy Owner seed person
+  --starts-on <date>    Effective date of a new Policy Owner Appointment
+  --yes                 Apply the reviewed migration
+  --json                Print the plan or result as JSON
+  --root <path>         Workspace path
+  --help                Show this help
+
+Start with:
+  npx filegrc migrate --to-model 3 --preview --json`);
+    return;
+  }
   if (command === "program-readiness") {
     console.log(`Usage:
   filegrc program-readiness [options]
 
 Report whether management has defined scope, activated policies, implemented
-controls, configured authoritative evidence sources, and verified test collection
-for external evidence without a dedicated Step 5 record. No audit ID or CPA firm
-is required.
+controls, and mapped every selected control to a configured authoritative evidence
+source. No audit ID or CPA firm is required.
 
 Options:
   --as-of <date>     Evaluate effective dates and obligations on YYYY-MM-DD
@@ -780,18 +1114,37 @@ Options:
   --help             Show this help`);
     return;
   }
+  if (command === "workflow") {
+    console.log(`Usage:
+  filegrc workflow [audit-id] [options]
+
+Return the shared assessment envelope used by browser, HTTP, CLI, static, and
+agent workflows. Results include named assessments, normalized findings,
+deterministic Work Items, and one recommended next action.
+
+Options:
+  --audit <id>       Limit audit assessments to one engagement
+  --as-of <date>     Evaluate on YYYY-MM-DD
+  --through <date>   Include scheduled work through YYYY-MM-DD
+  --complete         Include completed Work Items
+  --require-ready    Exit with code 2 unless Evidence Readiness passes
+  --json             Print the versioned result envelope
+  --root <path>      Workspace path
+  --help             Show this help`);
+    return;
+  }
   if (command === "program-path") {
     console.log(`Usage:
   filegrc program-path [audit-id] [options]
 
-Show the same six-step SOC 2 lifecycle used by the renderer. Each step includes
+Show the same five-step SOC 2 lifecycle used by the renderer. Each step includes
 its exact page instructions, Use and Policy Basis context, resource commands,
-and current readiness state. Pass an audit ID to include Step 6 status.
+and current readiness state. Pass an audit ID to include Step 5 status.
 
 Options:
-  --audit <id>       Audit record to use for Step 6
+  --audit <id>       Audit record to use for Step 5
   --as-of <date>     Evaluate readiness on YYYY-MM-DD
-  --summary          Print compact status and the first action for all six steps
+  --summary          Print compact status and the first action for all five steps
   --next             Print only the current step and its first action
   --current          Print the full guide for the current step only
   --json             Print the selected path view as JSON
@@ -799,18 +1152,18 @@ Options:
   --help             Show this help`);
     return;
   }
-  if (command === "evidence-test-drafts") {
+  if (command === "evidence-map") {
     console.log(`Usage:
-  filegrc evidence-test-drafts [options]
+  filegrc evidence-map [options]
 
-Preview or create missing draft External Evidence records for collection that
-does not already have a dedicated Step 5 operating record. Existing tests are
-preserved. Run after confirming applicable controls and source systems.
+Inspect the evidence-source checks included in Control implementation. Each item
+reports the required source roles, linked Controls, authoritative source Systems,
+per-record checks, and exact edit commands. This diagnostic is read-only.
 
 Options:
-  --preview      Report proposed drafts without creating them
-  --json         Print created and existing records as JSON
-  --root <path>  Workspace path
+  --as-of <date>  Evaluate the map on YYYY-MM-DD
+  --json          Print the map as JSON
+  --root <path>   Workspace path
   --help         Show this help`);
     return;
   }
@@ -826,27 +1179,37 @@ function agentOverview(model) {
     build: "filegrc build [root]",
     validate: "filegrc validate [root] --json",
     model: "filegrc model --json",
+    migrate: "filegrc migrate --to-model 3 --preview --json",
     describe: "filegrc describe <resource-type>",
     types: "filegrc types --json",
     guide: "filegrc guide [resource-type] --json",
     programPath: "filegrc program-path [audit-id] --next --json",
+    workflow: "filegrc workflow [audit-id] --json",
+    periodHealth: "filegrc period-health [audit-id] --require-healthy --json",
+    milestoneCheck: "filegrc milestone-check --json",
     scaffold: "filegrc scaffold <resource-type> --title <name>",
     list: "filegrc list [resource-type] --json",
     search: "filegrc search <query> --json",
     obligations: "filegrc obligations --json",
     programReadiness: "filegrc program-readiness --json",
-    evidenceTestDrafts: "filegrc evidence-test-drafts --preview --json",
+    evidenceMap: "filegrc evidence-map --json",
     auditReadiness: "filegrc audit-readiness <audit-id> --json",
     prepareAudit: "filegrc prepare-audit <audit-id>",
+    reconcile: "filegrc reconcile --preview --json",
+    externalReviewerSetup: "filegrc external-reviewer-setup [--scaffold | <reviewer.json|-> --preview] --json",
+    nextAuditCycle: "filegrc next-audit-cycle <prior-audit-id> --start <date> --end <date> --preview --json",
+    reviewApplicability: "filegrc review-applicability <decisions.json|-> --preview --json",
+    reviewCollection: "filegrc review-collection <resource-type> [--scaffold | <review.json|-> --preview] --json",
     trigger: "filegrc trigger <event-type> <date-or-time-and-subject-flags>",
     evidencePacket: "filegrc evidence-packet --audit <audit-id> --preview --json",
     get: "filegrc get <resource-id> [--mutation]",
     references: "filegrc references <resource-id> --json",
-    create: "filegrc create <record-or-mutation.json>",
+    previewMutation: "filegrc preview-mutation <preview.json> --json",
+    create: "filegrc create <mutation.json>",
     complete: "filegrc complete <obligation-id> <completion-mutation.json>",
     completeAction: "filegrc complete-action <action-item-id> <completion-mutation.json> --completed-on <date>",
     completeEvent: "filegrc complete-event <obligation-event-id> --completed-on <date>",
-    update: "filegrc update <resource-type> <id> <record-or-mutation.json>",
+    update: "filegrc update <resource-type> <id> <mutation.json>",
     content: "filegrc content <resource-type> <id> [slot] [--write <markdown-file|->]",
     attach: "filegrc attach <evidence-id> <source-file> [--name <file-name>]",
     detach: "filegrc detach <evidence-id> <attachment-name> --yes",
@@ -884,6 +1247,17 @@ function printAgentGuide(result) {
   console.log(`Policy basis: ${result.policyBasis}`);
   console.log(`Timing: ${result.cadence}`);
   console.log(`JSON: ${result.location}`);
+  if (result.reviewRequirements.collectionReview) {
+    const review = result.reviewRequirements.collectionReview;
+    console.log(`\nCollection review: ${review.title} (${review.status}, ${review.recordCount} ${review.recordCount === 1 ? "record" : "records"})`);
+    console.log(review.description);
+    for (const point of review.reviewPoints) console.log(`- ${point}`);
+    console.log(`Action: ${review.command}`);
+  }
+  if (result.reviewRequirements.recordReviewPoints.length) {
+    console.log("\nWhen reviewing each record:");
+    for (const point of result.reviewRequirements.recordReviewPoints) console.log(`- ${point}`);
+  }
   console.log("\nRequired fields:");
   for (const field of result.requiredAtCreation) console.log(formatGuideField(field));
   if (result.conditionalRequirements.length) {
@@ -922,17 +1296,36 @@ function printAgentGuide(result) {
   }
   console.log("\nWorkflow:");
   result.workflow.forEach((step, index) => console.log(`${index + 1}. ${step}`));
+  console.log("\nCompletion checks:");
+  result.completionChecks.forEach((check) => console.log(`- ${check}`));
 }
 
 function buildProgramPathResult(model, readiness, auditReadiness) {
   const readinessById = new Map(readiness.stages.map((stage) => [stage.id, stage]));
   const stages = buildAgentProgramPath(model).map((stage) => {
     if (stage.id === "audit") {
+      const auditAction = auditReadiness?.firstAction || (
+        auditReadiness?.status === "not-started"
+          ? {
+              id: "create-audit",
+              status: "action",
+              title: "Create the planned CPA engagement",
+              message: "Create a planned Audit from the current management scope, then replace the remaining scaffold values with the CPA firm and firm-agreed scope and dates.",
+              resourceType: "audit",
+              commands: [
+                "npx filegrc guide audit --json",
+                "npx filegrc scaffold audit --title \"YEAR SOC 2 TYPE\" > audit-mutation.json",
+                "npx filegrc create audit-mutation.json --json",
+                "npx filegrc prepare-audit AUDIT_ID --json"
+              ]
+            }
+          : null
+      );
       return {
         ...stage,
         status: auditReadiness?.status || "not-started",
         counts: auditReadiness?.counts || null,
-        nextActions: auditReadiness?.firstAction ? [auditReadiness.firstAction] : []
+        nextActions: auditAction ? [auditAction] : []
       };
     }
     const readinessId = stage.id === "run" ? "operation" : stage.id;
@@ -950,6 +1343,7 @@ function buildProgramPathResult(model, readiness, auditReadiness) {
   const currentStep = stages.find((stage) => !["complete", "operating", "management-ready"].includes(stage.status)) || stages.at(-1);
   return {
     schemaVersion: 1,
+    dataModelVersion: String(model.modelVersion),
     asOf: readiness.asOf,
     currentStep: { id: currentStep.id, number: currentStep.number, title: currentStep.title },
     evidenceReady: readiness.evidenceReady,
@@ -966,14 +1360,13 @@ function printProgramPath(result) {
     console.log(stage.summary);
     for (const page of stage.pages) {
       console.log(`${page.order ? `Step ${page.order}` : "Operating area"} · ${page.title} (${page.type || `utility:${page.utility}`})`);
-      console.log(`  Instructions: ${page.instructions}`);
-      console.log(`  Use: ${page.use}`);
-      console.log(`  Policy basis: ${page.policyBasis}`);
+      console.log(`  ${page.summary}`);
+      if (page.guide) console.log(`  Details: ${page.guide}`);
     }
     if (stage.operatingRecords?.length) {
       console.log("Operating record guides:");
       for (const record of stage.operatingRecords) {
-        console.log(`  ${record.type}\t${record.instructions}\t${record.guide}`);
+        console.log(`  ${record.type}\t${record.summary}\t${record.guide}`);
       }
     }
     console.log("Commands:");
@@ -997,6 +1390,7 @@ function selectProgramPathOutput(result, flags) {
 function summarizeProgramPath(result) {
   return {
     schemaVersion: result.schemaVersion,
+    dataModelVersion: result.dataModelVersion,
     asOf: result.asOf,
     currentStep: result.currentStep,
     evidenceReady: result.evidenceReady,
@@ -1017,6 +1411,7 @@ function nextProgramPath(result) {
   const nextAction = stage?.nextActions[0];
   return {
     schemaVersion: result.schemaVersion,
+    dataModelVersion: result.dataModelVersion,
     asOf: result.asOf,
     currentStep: result.currentStep,
     evidenceReady: result.evidenceReady,
@@ -1069,6 +1464,15 @@ function shellArgument(value) {
     : `'${text.replaceAll("'", "'\\''")}'`;
 }
 
+function evidenceSourceCheckName(name) {
+  return ({
+    active: "activate source",
+    sourceRole: "add source role",
+    accessOwners: "add access owner",
+    retrievalInstructions: "add retrieval instructions"
+  })[name] || name;
+}
+
 function printProgramPathOutput(result, flags) {
   if (flags.summary) {
     console.log(`Current: Step ${result.currentStep.number}, ${result.currentStep.title}`);
@@ -1090,6 +1494,20 @@ function printProgramPathOutput(result, flags) {
   printProgramPath(result);
 }
 
+function printWorkflow(result) {
+  console.log(`Workflow contract v${result.contractVersion}, model v${result.dataModelVersion}`);
+  for (const [name, assessment] of Object.entries(result.assessments)) {
+    console.log(`${String(assessment.status).toUpperCase()}\t${name}\t${assessment.message}`);
+  }
+  console.log(`\n${result.counts.findings.ready || 0} ready findings, ${result.counts.workItems.overdue || 0} overdue Work Items`);
+  if (result.recommended) {
+    console.log(`Next: ${result.recommended.title}`);
+    if (result.recommended.message) console.log(`  ${result.recommended.message}`);
+    const command = result.recommended.nextAction?.command || result.recommended.actions?.[0]?.command;
+    if (command) console.log(`  ${command}`);
+  }
+}
+
 function summarizeProgramReadiness(result) {
   const ownership = result.stages
     .flatMap((stage) => stage.items)
@@ -1138,13 +1556,10 @@ function summarizeProgramReadiness(result) {
 }
 
 function eventWindowText(window) {
-  if (Number.isInteger(window?.endOffsetHours)) {
-    return window.endOffsetHours === 0 ? "due at event time" : `due within ${window.endOffsetHours} hours`;
-  }
-  if (Number.isInteger(window?.endOffsetDays)) {
-    return window.endOffsetDays === 0 ? "due on event date" : `due within ${window.endOffsetDays} days`;
-  }
-  return "due within 30 days";
+  if (!Number.isInteger(window?.dueAfter)) return "deadline not configured";
+  const unit = window.precision === "timestamp" ? "hour" : "day";
+  if (window.dueAfter === 0) return window.precision === "timestamp" ? "due at event time" : "due on event date";
+  return `due within ${window.dueAfter} ${unit}${window.dueAfter === 1 ? "" : "s"}`;
 }
 
 function formatGuideField(field) {