filegrc 0.4.0 → 0.5.0

package/src/setup.js

@@ -18,7 +18,10 @@ export async function setupWorkspace(input = process.cwd(), payload = {}) {
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, entry.revision]));
 
   await applyResourceBatch(loaded.root, {
-    create: plan.existingSystem ? [] : [plan.system],
+    create: [
+      ...(plan.existingSystem ? [] : [plan.system]),
+      ...(plan.commitment ? [plan.commitment] : [])
+    ],
     update: updates,
     expectedRevisions: Object.fromEntries(updates.map((record) => [record.id, revisionById.get(record.id)])),
     validateWholeWorkspace: true
@@ -29,6 +32,7 @@ export async function setupWorkspace(input = process.cwd(), payload = {}) {
     system: plan.system,
     workspace: plan.workspace,
     renderer: plan.renderer,
+    commitment: plan.commitment,
     linkedControlIds: [],
     onboardingComplete: !setup.draft
   };
@@ -47,11 +51,13 @@ export async function planWorkspaceSetup(input = process.cwd(), payload = {}) {
       system: plan.existingSystem ? "update" : "create",
       workspace: "update",
       renderer: plan.renderer ? "update" : "unchanged",
-      controls: 0
+      controls: 0,
+      commitment: plan.commitment ? "create" : "unchanged"
     },
     system: setupSystemSummary(plan.system),
     target: setupTargetSummary(plan.workspace),
     renderer: plan.renderer ? setupRendererSummary(plan.renderer) : null,
+    commitment: plan.commitment || null,
     onboardingComplete: !setup.draft
   };
 }
@@ -64,11 +70,13 @@ export function summarizeSetupResult(result) {
     changes: {
       system: "saved",
       workspace: "updated",
-      controls: result.linkedControlIds?.length || 0
+      controls: result.linkedControlIds?.length || 0,
+      commitment: result.commitment ? "saved" : "unchanged"
     },
     system: setupSystemSummary(result.system),
     target: setupTargetSummary(result.workspace),
     renderer: result.renderer ? setupRendererSummary(result.renderer) : null,
+    commitment: result.commitment || null,
     onboardingComplete: result.onboardingComplete
   };
 }
@@ -168,7 +176,31 @@ function buildSetupRecords(loaded, setup) {
   };
   const existingRenderer = loaded.resources.find(({ type }) => type === "renderer-settings");
   const renderer = existingRenderer ? { ...existingRenderer, showOnboarding: setup.draft } : null;
-  return { existingSystem, system, workspace, renderer };
+  const existingCommitment = loaded.resources.find((record) => (
+    record.type === "commitment"
+    && !["superseded", "retired"].includes(record.status)
+    && (record.systemIds || []).includes(systemId)
+  ));
+  const commitment = String(loaded.model.modelVersion) === "3" && !existingCommitment
+    ? {
+        id: createResourceId(
+          "commitment",
+          `${setup.serviceName} service commitment`,
+          loaded.resources.map(({ id }) => id)
+        ),
+        type: "commitment",
+        title: `${setup.serviceName} service commitment`,
+        status: "planned",
+        commitmentKind: "service",
+        statement: "Replace this starter with the actual customer promise or approved service requirement before activation.",
+        systemIds: [systemId],
+        ownerIds: [setup.ownerId],
+        customerFacing: true,
+        ...(workspace.requirementIds?.length ? { requirementIds: [...workspace.requirementIds] } : {}),
+        ...(workspace.controlIds?.length ? { controlIds: [...workspace.controlIds] } : {})
+      }
+    : null;
+  return { existingSystem, system, workspace, renderer, commitment };
 }
 
 function assuranceGoalFromSetup(goal) {

package/src/source-coverage.js

@@ -0,0 +1,61 @@
+export function sourceCoverageComplete(record, loaded) {
+  if (!record?.validFrom || !record.collectionCadence || !record.retention || !record.reconciliationMethod) {
+    return false;
+  }
+  if (record.coverageKind === "external-system" && (!record.systemId || !(record.retrieverIds || []).length)) {
+    return false;
+  }
+  if (["not-applicable", "zero-population"].includes(record.coverageKind) && !record.applicabilityReview) {
+    return false;
+  }
+  if (loaded.workspace?.candidateCoverage && !(record.readinessTestEvidenceIds || []).length) {
+    return false;
+  }
+  if (loaded.workspace?.candidateCoverage) {
+    const tests = (record.readinessTestEvidenceIds || []).map((id) => (
+      loaded.resources.find((resource) => resource.id === id && resource.type === "evidence")
+    ));
+    if (tests.some((test) => (
+      !test
+      || test.readinessTest !== true
+      || test.retrievalResult !== "passed"
+      || test.accessConfirmed !== true
+      || !(test.coveredSourceFamilyIds || []).includes(record.sourceFamilyId)
+      || (record.coverageKind === "external-system" && !(
+        test.sourceSystemId === record.systemId
+        || (test.systemIds || []).includes(record.systemId)
+      ))
+    ))) return false;
+  }
+  return true;
+}
+
+export function assessSourceCoverageReadiness(loaded, selectedControlIds = []) {
+  if (!loaded.model.resources["source-coverage"]) return [];
+  const selected = new Set(selectedControlIds);
+  const selectedControlCodes = new Set(loaded.resources
+    .filter((record) => (
+      record.type === "control"
+      && selected.has(record.id)
+      && !["not-applicable", "retired"].includes(record.status)
+    ))
+    .map(({ code }) => code)
+    .filter(Boolean));
+  return (loaded.model.evidenceSourceFamilies || [])
+    .filter((family) => family.controlCodes.some((code) => selectedControlCodes.has(code)))
+    .map((family) => {
+      const records = loaded.resources.filter((record) => (
+        record.type === "source-coverage"
+        && record.sourceFamilyId === family.id
+        && record.status !== "retired"
+      ));
+      const record = records.find(({ status }) => status === "active")
+        || records.find(({ status }) => status === "planned")
+        || null;
+      return {
+        family,
+        record,
+        complete: Boolean(record?.status === "active" && sourceCoverageComplete(record, loaded))
+      };
+    });
+}

package/src/state.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { assessAuditPreparation } from "./audit-preparation.js";
+import { assessCollectionReviews } from "./collection-review.js";
 import { getBrowserRepositoryState, getGitSummary, getWorkspaceHistories } from "./git.js";
 import { renderMarkdown } from "./markdown.js";
 import { planObligations } from "./obligations.js";
@@ -10,6 +11,7 @@ import { markdownEntries } from "./resource-markdown.js";
 import { currentCalendarDate } from "./time.js";
 import { serializeWorkspaceMutation } from "./mutation.js";
 import { fingerprintWorkspace, validateWorkspace } from "./validate.js";
+import { assessWorkflow } from "./workflow.js";
 
 const renderedMarkdownCache = new Map();
 const MAX_RENDERED_MARKDOWN_CACHE_ENTRIES = 1_000;
@@ -73,6 +75,38 @@ async function createAppStateUnlocked(input, options) {
       return [audit?.id || "none", preparation];
     })
   ));
+  const obligations = planObligations(entries, {
+    asOf,
+    now: options.now ?? generatedAt,
+    model: loaded.model
+  });
+  const workflow = await assessWorkflow(loaded, {
+    asOf,
+    evaluatedAt: generatedAt,
+    programReadiness,
+    auditPreparations: Object.fromEntries(
+      Object.entries(auditPreparations).filter(([id]) => id !== "none")
+    ),
+    obligations,
+    git,
+    validation
+  });
+  const collectionReviews = Object.fromEntries(
+    assessCollectionReviews(loaded).map((assessment) => [
+      assessment.resourceType,
+      {
+        resourceType: assessment.resourceType,
+        configuration: assessment.configuration,
+        recordCount: assessment.recordCount,
+        review: assessment.review,
+        reviewRevision: assessment.reviewRevision,
+        collectionRevision: assessment.collectionRevision,
+        status: assessment.status,
+        complete: assessment.complete,
+        message: assessment.message
+      }
+    ])
+  );
   return {
     generatedAt,
     asOf,
@@ -86,9 +120,11 @@ async function createAppStateUnlocked(input, options) {
       counts: validation.counts,
       diagnostics: validation.diagnostics
     },
-    obligations: planObligations(entries, { asOf, now: options.now ?? generatedAt, model: loaded.model }),
+    obligations,
+    collectionReviews,
     programReadiness,
     auditPreparations,
+    workflow,
     git
   };
 }

package/src/validate.js

@@ -73,7 +73,13 @@ async function validateWorkspaceUnmeasured(input) {
     validateRecord(record, definition, loaded.model, displayPath, diagnostics);
     validateDateRanges(record, displayPath, diagnostics);
     if (record.type === "appointment") validateAppointment(record, byId, displayPath, diagnostics);
+    if (record.type === "collection-review") {
+      validateCollectionReview(record, loaded.model, loaded.resources, byId, displayPath, diagnostics);
+    }
     if (record.type === "obligation") validateObligation(record, loaded.model, byId, displayPath, diagnostics);
+    if (record.type === "action-item") {
+      validateCompletedObligationAction(record, byId, loaded.model, displayPath, diagnostics);
+    }
     if (record.type === "obligation-event") validatePolicyEvent(record, loaded.model, byId, displayPath, diagnostics);
     if (record.type === "evidence") validateEvidencePaths(record, displayPath, diagnostics);
     validateCoverage(record, displayPath, diagnostics);
@@ -148,6 +154,46 @@ async function validateWorkspaceUnmeasured(input) {
   };
 }
 
+function validateCollectionReview(record, model, resources, byId, path, diagnostics) {
+  if (record.status !== "active") return;
+  const configuration = model.collectionReviews?.[record.resourceType];
+  if (!configuration) return;
+  const allowedDecisions = configuration.decisions || ["complete"];
+  if (!allowedDecisions.includes(record.decision)) {
+    diagnostics.push(error(
+      "invalid-collection-review-decision",
+      path,
+      `${configuration.title} review must use one of: ${allowedDecisions.join(", ")}.`
+    ));
+    return;
+  }
+  const recordCount = resources.filter(({ type }) => type === record.resourceType).length;
+  if (!recordCount && record.decision === "complete") {
+    diagnostics.push(error(
+      "invalid-collection-review-decision",
+      path,
+      `${configuration.title} has no records and cannot use the complete conclusion.`
+    ));
+  }
+  if (recordCount && record.decision === "zero-population") {
+    diagnostics.push(error(
+      "invalid-collection-review-decision",
+      path,
+      `${configuration.title} has ${recordCount} records and cannot use the zero-population conclusion.`
+    ));
+  }
+  if (
+    record.decision === "externally-managed"
+    && byId.get(record.authoritativeSystemId)?.status !== "active"
+  ) {
+    diagnostics.push(error(
+      "inactive-authoritative-system",
+      path,
+      `${configuration.title} must name an active authoritative System for an externally managed conclusion.`
+    ));
+  }
+}
+
 export async function fingerprintWorkspace(input = process.cwd()) {
   const loaded = typeof input === "object" && input.entries ? input : await loadWorkspace(input);
   const hash = createHash("sha256");
@@ -288,7 +334,10 @@ function validateCompletedObligationEvent(record, byId, model, path, diagnostics
       ? model.obligationActivities?.[obligation.activityType]?.completionResourceTypes || []
       : [];
     if (!expectedTypes.length) continue;
-    const linked = [...new Set([...(action.completionResourceIds || []), ...(action.evidenceIds || [])])]
+    const completionIds = String(model.modelVersion) === "3"
+      ? action.completionResourceIds || []
+      : [...(action.completionResourceIds || []), ...(action.evidenceIds || [])];
+    const linked = [...new Set(completionIds)]
       .map((id) => byId.get(id))
       .filter(Boolean);
     if (!linked.some((item) => expectedTypes.includes(item.type))) {
@@ -301,6 +350,27 @@ function validateCompletedObligationEvent(record, byId, model, path, diagnostics
   }
 }
 
+function validateCompletedObligationAction(record, byId, model, path, diagnostics) {
+  if (
+    String(model.modelVersion) !== "3"
+    || record.status !== "done"
+    || !record.obligationId
+  ) return;
+  const obligation = byId.get(record.obligationId);
+  if (obligation?.type !== "obligation") return;
+  const expectedTypes = model.obligationActivities?.[obligation.activityType]?.completionResourceTypes || [];
+  if (!expectedTypes.length) return;
+  const linked = [...new Set(record.completionResourceIds || [])]
+    .map((id) => byId.get(id))
+    .filter(Boolean);
+  if (linked.some((item) => expectedTypes.includes(item.type))) return;
+  diagnostics.push(error(
+    "missing-obligation-completion",
+    path,
+    `A done Action Item linked to "${obligation.id}" needs completionResourceIds containing ${expectedTypes.join(" or ")}.`
+  ));
+}
+
 function validateEvidencePaths(record, path, diagnostics) {
   const expectedPrefix = `evidence/${record.id}/`;
   for (const filePath of record.filePaths || []) {
@@ -381,6 +451,23 @@ function validateObligation(record, model, byId, path, diagnostics) {
         "Event recurrence must use a policy event defined by the model."
       ));
     }
+    if (record.eventRiskLevels?.length) {
+      if (recurrence.eventType !== "person-ended") {
+        diagnostics.push(error(
+          "invalid-obligation-event-filter",
+          path,
+          "eventRiskLevels may be used only with the person-ended Policy Event."
+        ));
+      }
+      const invalid = record.eventRiskLevels.filter((value) => !["normal", "high"].includes(value));
+      if (invalid.length) {
+        diagnostics.push(error(
+          "invalid-obligation-event-filter",
+          path,
+          `Departure risk filters must be normal or high, not ${invalid.join(", ")}.`
+        ));
+      }
+    }
   } else {
     diagnostics.push(error(
       "invalid-obligation-recurrence",
@@ -577,7 +664,8 @@ async function validateAttestationBinding(record, model, root, byId, path, diagn
 }
 
 async function validateApprovalBinding(record, model, root, path, diagnostics) {
-  if (!approvalBound(record) || !record.approvedContentRevisions) return;
+  const bindingField = approvalBindingField(record, model);
+  if (!bindingField || !approvalBound(record) || !record[bindingField]) return;
   const actual = {};
   for (const item of markdownEntries(model, record)) {
     try {
@@ -587,7 +675,7 @@ async function validateApprovalBinding(record, model, root, path, diagnostics) {
       if (error.code !== "ENOENT") throw error;
     }
   }
-  const expected = record.approvedContentRevisions;
+  const expected = record[bindingField];
   const paths = [...new Set([...Object.keys(actual), ...Object.keys(expected)])].sort();
   const invalid = paths.filter((item) => (
     !/^[a-f0-9]{64}$/.test(String(expected[item] || ""))
@@ -605,9 +693,18 @@ async function validateApprovalBinding(record, model, root, path, diagnostics) {
 function approvalBound(record) {
   if (record.type === "policy") return ["approved", "active", "superseded", "retired"].includes(record.status);
   if (record.type === "document") return ["active", "superseded", "retired"].includes(record.status);
+  if (record.type === "training") return ["active", "retired"].includes(record.status);
   return false;
 }
 
+function approvalBindingField(record, model) {
+  if (["policy", "document"].includes(record.type)) return "approvedContentRevisions";
+  if (record.type === "training" && model.resources.training?.fields?.effectiveContentRevisions) {
+    return "effectiveContentRevisions";
+  }
+  return null;
+}
+
 function validateCoverage(record, path, diagnostics) {
   const coverage = record.type === "workspace" ? record.candidateCoverage : record.coverage;
   if (!coverage) return;