filegrc 0.6.5 → 0.7.0

package/src/policy-activation.js

@@ -0,0 +1,84 @@
+import { applyResourceBatch, contentRevision } from "./files.js";
+import { serializeWorkspaceMutation } from "./mutation.js";
+import { assessProgramReadiness } from "./program-readiness.js";
+import { currentCalendarDate } from "./time.js";
+import { loadWorkspace } from "./workspace.js";
+
+export async function scaffoldPolicyActivation(input = process.cwd(), options = {}) {
+  const loaded = await loadWorkspace(input);
+  const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
+  const approved = readiness.policyActivations.filter(({ state }) => (
+    ["approved-implementation-pending", "ready-to-activate"].includes(state)
+  ));
+  const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
+  return {
+    policyIds: approved.map(({ policyId }) => policyId),
+    effectiveOn: currentCalendarDate(loaded.workspace.timezone),
+    expectedRevisions: Object.fromEntries(approved.map(({ policyId }) => [policyId, revisionById.get(policyId)])),
+    confirmed: false
+  };
+}
+
+export async function planPolicyActivation(input = process.cwd(), options = {}) {
+  const loaded = await loadWorkspace(input);
+  const policyIds = [...new Set((options.policyIds || []).map(String))];
+  if (!policyIds.length) throw new Error("Policy activation needs at least one approved Policy.");
+  const effectiveOn = String(options.effectiveOn || "").trim();
+  if (!isCalendarDate(effectiveOn)) throw new Error("Policy activation needs a real effective date in YYYY-MM-DD format.");
+  const today = currentCalendarDate(loaded.workspace.timezone);
+  if (effectiveOn < today) {
+    throw new Error(`The effective date ${effectiveOn} has passed. Choose ${today} or a future date; do not backdate adoption.`);
+  }
+  const expectedRevisions = options.expectedRevisions || {};
+  if (Array.isArray(expectedRevisions) || !expectedRevisions || typeof expectedRevisions !== "object") {
+    throw new Error("Policy activation expected revisions must be keyed by Policy ID.");
+  }
+  const entryById = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
+  const update = policyIds.map((policyId) => {
+    const entry = entryById.get(policyId);
+    if (!entry || entry.record.type !== "policy") throw new Error(`Policy "${policyId}" was not found.`);
+    if (entry.record.status !== "approved") {
+      throw new Error(`Policy "${policyId}" must be approved and inactive before the Step 3 cutover.`);
+    }
+    if (!/^[a-f0-9]{64}$/.test(expectedRevisions[policyId] || "")) {
+      throw new Error(`Policy activation needs the current revision for "${policyId}". Regenerate the cutover review and try again.`);
+    }
+    const record = { ...entry.record, status: "active", effectiveOn };
+    delete record.proposedEffectiveOn;
+    return record;
+  });
+  return {
+    operation: "policy-activation",
+    policyIds,
+    effectiveOn,
+    changes: {
+      update,
+      expectedRevisions: Object.fromEntries(policyIds.map((policyId) => [
+        policyId,
+        expectedRevisions[policyId]
+      ])),
+      validateWholeWorkspace: true
+    }
+  };
+}
+
+export async function activatePolicies(input = process.cwd(), options = {}) {
+  if (options.confirmed !== true) throw new Error("Review the Policy activation cutover and confirm the write.");
+  return serializeWorkspaceMutation(input, async (root) => {
+    const plan = await planPolicyActivation(root, options);
+    const result = await applyResourceBatch(root, plan.changes);
+    return { ...plan, result };
+  });
+}
+
+function isCalendarDate(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value);
+  if (!match) return false;
+  const [, year, month, day] = match.map(Number);
+  const date = new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  date.setUTCHours(0, 0, 0, 0);
+  return date.getUTCFullYear() === year
+    && date.getUTCMonth() === month - 1
+    && date.getUTCDate() === day;
+}

package/src/program-lifecycle.js

@@ -24,3 +24,7 @@ export function obligationIsRunning(obligation, byId, asOf) {
     && obligation.status === "active"
     && obligationProgramStatus(obligation, byId, asOf) === "accepted";
 }
+
+export function obligationIsEnabled(obligation) {
+  return obligation?.type === "obligation" && obligation.status === "active";
+}

package/src/program-path.js

@@ -11,7 +11,7 @@ export const RESOURCE_INSTRUCTIONS = {
   framework: "Confirm the criteria framework and version used for the program.",
   requirement: "Keep the published criterion as catalog content. Record management applicability and rationale on the selected Program.",
   commitment: "Record supplemental customer promises and service requirements that shape the scope or control design. The Commitment’s systemIds and controlIds are authoritative for what fulfills it.",
-  policy: "Tailor each policy to match how the organization works. Clear placeholders, assign an owner and separate approver, then record its approval and effective dates. Controls link to their governing Policies.",
+  policy: "Tailor each Policy to match what the company is committing to. Clear placeholders, assign an owner and separate approver, then bind approval to the reviewed content. Approval does not prove implementation. Activate the Policy during the Step 3 cutover after reviewing its implementation gaps.",
   document: "Tailor the governed plans and other supporting documents the program needs. Assign owners and approvers, then keep the approved Markdown in Git.",
   control: "Finish each applicable starter Control with the procedure people follow, its owner, bounded System scope, operating Components, authoritative evidence-source Components, governing Policy and Requirement mappings, and implementation date. Put calendar and event schedules in Obligations.",
   "complementary-control": "Review whether any in-scope Control depends on a customer or carved-out provider action. Record each real dependency, or confirm that the current scope has none.",
@@ -58,7 +58,7 @@ export const RESOURCE_PAGE_SUMMARIES = {
   component: "Connect each material Component to a System.",
   classification: "Define handling levels.",
   "information-type": "Define information categories.",
-  policy: "Adapt and approve starter policies.",
+  policy: "Tailor the starter Policy and have someone other than its owner approve it.",
   document: "Adapt and approve plans.",
   control: "Describe each Control and its evidence source.",
   "complementary-control": "Record customer or provider responsibilities, or confirm there are none.",
@@ -77,7 +77,7 @@ export const PROGRAM_PATH = [
     summary: "Name the owners, criteria, service, Systems, and providers in scope.",
     sections: [
       { id: "ownership", title: "Program Ownership", description: "Confirm the people, appointments, and teams that own, approve, review, and operate the program.", steps: ["Confirm the initial program lead’s actual job title and the separate Policy Owner Appointment.", "Add the organization’s real appointments, reviewers, and operators.", "Review the starter Security and Risk Oversight team, its members, and its chair.", "Add other teams only when the organization assigns shared responsibility to them."], types: ["person", "appointment", "team"], defaultOpen: true },
-      { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Confirm the Program goal, owners, risk method, and candidate period.", "Review the included Security criteria references and record each applicability decision on the Program.", "Record customer commitments and keep optional criteria out until management deliberately adds them."], types: ["program", "framework", "requirement", "commitment"], defaultOpen: true },
+      { id: "criteria", title: "Program and Criteria", description: "Define the Program, confirm its Frameworks, record Program-scoped Requirement applicability, and connect customer commitments that shape the System or Control design.", steps: ["Confirm the Program goal, owners, risk method, and candidate period.", "Review the included Security criteria references and record each applicability decision on the Program.", "Record customer commitments and keep optional criteria out until the company chooses to add them."], types: ["program", "framework", "requirement", "commitment"], defaultOpen: true },
       { id: "boundary", title: "System Boundary", description: "Start with the bounded System. Add Components that materially deliver the service, support Controls, produce authoritative Evidence, or support relevant operations. Keep Vendor relationships and specific Assets separate.", steps: ["Create the complete bounded System and select it on the Program.", "Add only relevant Components, with a role and rationale for each System use.", "Create Vendors for material external provider relationships and link supplied Components when factual.", "Normalize Information Types and Classifications used by the System, Components, Vendors, Risks, and Evidence Artifacts."], types: ["system", "component", "vendor", "classification", "information-type"], defaultOpen: false }
     ],
     resourceTypes: ["person", "appointment", "team", "program", "framework", "requirement", "commitment", "system", "component", "vendor", "classification", "information-type"],
@@ -99,12 +99,12 @@ export const PROGRAM_PATH = [
     id: "policies",
     number: 2,
     title: "Approve Policies",
-    description: "Tailor, review, approve, and adopt",
+    description: "Tailor, review, and approve",
     summary: "Adapt and approve the starter policies.",
     sections: [
-      { id: "library", title: "Policy Library", description: "Review, approve, and activate policies and governed plans without treating starter text as adopted practice.", steps: ["Review policy Markdown and replace every organization placeholder.", "Confirm the owner, separate approver, audience, review Obligation, and Controls that point to the Policy.", "Record approval and effective dates before changing the status to active."], types: ["policy", "document"], defaultOpen: true }
+      { id: "library", title: "Policy Library", description: "Review and approve Policy requirements without treating approval as proof of technical implementation.", steps: ["Review Policy Markdown and replace every organization placeholder.", "Confirm the owner, separate approver, audience, review Obligation, and Controls that point to the Policy.", "Record approval against the exact reviewed content. Leave the Policy approved and inactive until the Step 3 implementation cutover."], types: ["policy"], defaultOpen: true }
     ],
-    resourceTypes: ["policy", "document"],
+    resourceTypes: ["policy"],
     commands: [
       "filegrc guide policy --json",
       "filegrc list policy --json",
@@ -118,14 +118,15 @@ export const PROGRAM_PATH = [
     description: "Finish controls and their evidence sources",
     summary: "Describe each Control and connect its evidence source.",
     sections: [
-      { id: "catalog", title: "Control Catalog", description: "Finish the starter Controls and their authoritative evidence sources, record applicable complementary controls, and see whether FileGRC tracks operation through Work Queue or operating records.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components.", "Create or confirm every calendar and event schedule as an Obligation.", "Confirm each source Component is active, has an evidence-source role and rationale in the Control's System scope, has current access owners, and includes repeatable retrieval instructions in Record Markdown.", "Resolve every incomplete evidence-family check before marking the Controls implemented.", "Record any required customer or carved-out provider controls as Complementary Controls."], types: ["control", "complementary-control"], defaultOpen: true }
+      { id: "catalog", title: "Control Catalog", description: "Finish the starter Controls, governed plans, schedules, and authoritative evidence sources, then review the approved Policies together at implementation cutover.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components.", "Create or enable every calendar and event schedule as an Obligation. Enabled work remains dormant until its governing Policy is active.", "Confirm each source Component is active, has an evidence-source role and rationale in the Control's System scope, has current access owners, and includes repeatable retrieval instructions in Record Markdown.", "Complete required governed plans, then use Review policy activation on the Controls page to inspect each Policy’s planned or partial Controls, missing Components or sources, missing schedules, and unresolved Exceptions.", "Choose the approved Policies that should take effect, set the real effective date, and confirm the Step 3 cutover. You can activate with a documented gap or approved Exception, but Evidence Readiness still requires active and operating Policies."], types: ["control", "complementary-control", "document"], defaultOpen: true }
     ],
-    resourceTypes: ["control", "complementary-control"],
+    resourceTypes: ["control", "complementary-control", "document"],
     commands: [
       "filegrc guide control --json",
       "filegrc list control --json",
       "filegrc get CONTROL_ID --mutation",
       "filegrc review-collection complementary-control --scaffold",
+      "filegrc activate-policies --scaffold",
       "filegrc evidence-map --json",
       "filegrc program-readiness --json"
     ]
@@ -180,7 +181,7 @@ export const PROGRAM_PATH = [
         summary: "Start a guided checklist when a policy-triggering change occurs.",
         instructions: "Trigger the matching workflow when an event occurs. filegrc adds every required action to the Work Queue with its owner and deadline.",
         use: "Preview the full workflow before triggering it, then create the event and every linked task in one validated write.",
-        policyBasis: "Active event obligations translate policy-triggering changes into owned, deadline-bound Action Items. Proposed workflows remain unavailable until their governing policies and linked controls are ready.",
+        policyBasis: "Active event Obligations translate policy-triggering changes into owned, deadline-bound Action Items. They remain dormant until their governing Policies are active and effective.",
         commands: ["filegrc obligations --json", "filegrc trigger EVENT_TYPE (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) --subject RESOURCE_ID --json"]
       },
       {
@@ -189,7 +190,7 @@ export const PROGRAM_PATH = [
         summary: "Complete scheduled, event-driven, and assigned work by its due date.",
         instructions: "Complete recurring work, Policy Event tasks, and assigned Action Items within their allowed windows, link the requested dated proof, and resolve overdue items.",
         use: "See proposed, upcoming, blocked, due, and overdue policy work together with every open Action Item. Continuous and per-transaction Controls still operate through their Components and need dated operating records or Evidence.",
-        policyBasis: "Effective policies and implemented linked controls activate reusable obligations. Policy Events and source records create owned Action Items. Each occurrence or task retains its own deadline, completion record, and evidence.",
+        policyBasis: "Active and effective Policies start enabled reusable Obligations. Policy Events and source records create owned Action Items. Each occurrence or task retains its own deadline, completion record, and evidence.",
         commands: [
           "filegrc obligations --json",
           "filegrc complete OBLIGATION_ID --scaffold --window-start YYYY-MM-DD --completed-on YYYY-MM-DD",

package/src/program-readiness.js

@@ -1,10 +1,11 @@
 import { readFile } from "node:fs/promises";
 import { assessRequiredAppointments } from "./appointments.js";
 import { assessCollectionReviews } from "./collection-review.js";
+import { openPlaceholderCount, substantiveMarkdown } from "./content-readiness.js";
 import { coverageEnd, coverageStart } from "./coverage.js";
 import { planObligations } from "./obligations.js";
 import { resolveDataPath } from "./paths.js";
-import { obligationIsRunning } from "./program-lifecycle.js";
+import { obligationIsEnabled, obligationIsRunning } from "./program-lifecycle.js";
 import { currentPartyPeople, partiesIndependent, partyPeople } from "./parties.js";
 import { programComponents, resolveProgram, selectedRequirementIds } from "./program.js";
 import { markdownEntries } from "./resource-markdown.js";
@@ -30,13 +31,25 @@ export async function assessProgramReadiness(input, options = {}) {
     return markdown.get(record.id);
   };
 
+  const policyStage = await policiesStage(scope, records, byId, readMarkdown);
   const controlStage = await controlsStage(scope, byId, readMarkdown, asOf, loaded.model);
   controlStage.items.unshift(...collectionReviews
     .filter(({ resourceType }) => resourceType === "complementary-control")
     .map(collectionReviewReadinessItem));
   const sourceStage = await evidenceSourcesStage(scope, byId, loaded.model, readMarkdown);
   controlStage.items.push(...sourceStage.items);
-  controlStage.description = `Each implemented Control needs an owner, actual procedure, scope, operation pattern, mappings, an implementation date, and complete authoritative source ${String(loaded.model.modelVersion) === "4" ? "Components" : "Systems"} with the required evidence roles, access owners, and retrieval instructions.`;
+  controlStage.items.push(...await governedContentItems(scope, records, byId, readMarkdown, asOf));
+  const policyActivations = await assessPolicyActivations(
+    requiredPolicies(scope, byId),
+    scope.controls,
+    records,
+    byId,
+    readMarkdown,
+    asOf,
+    loaded.model
+  );
+  controlStage.items.push(...policyActivations.map(policyActivationItem));
+  controlStage.description = `Each implemented Control needs an owner, actual procedure, scope, operation pattern, mappings, an implementation date, enabled schedules, and complete authoritative source ${String(loaded.model.modelVersion) === "4" ? "Components" : "Systems"}. Activate approved Policies at the implementation cutover after reviewing each activation assessment.`;
   const evidenceGateStages = [
     scopeStage(
       program,
@@ -46,7 +59,7 @@ export async function assessProgramReadiness(input, options = {}) {
       loaded.model,
       collectionReviews.filter(({ resourceType }) => resourceType !== "complementary-control")
     ),
-    await policiesStage(scope, records, byId, readMarkdown, asOf),
+    policyStage,
     controlStage
   ];
   for (const current of evidenceGateStages) finalizeStage(current);
@@ -89,6 +102,8 @@ export async function assessProgramReadiness(input, options = {}) {
     operating,
     canStartCandidatePeriod,
     suggestedCandidatePeriodStart: canStartCandidatePeriod ? asOf : null,
+    policyActivations,
+    policyLibraryProposals: policyLibraryProposals(records),
     progress: {
       complete,
       total: managedItems.length,
@@ -451,11 +466,8 @@ function ownershipResolutionReasons(ownerIds, byId) {
   });
 }
 
-async function policiesStage(scope, records, byId, readMarkdown, asOf) {
-  const linkedPolicyIds = new Set(scope.controls.flatMap((control) => control.policyIds || []));
-  const policies = [...linkedPolicyIds].map((id) => byId.get(id)).filter((record) => (
-    record?.type === "policy" && !["superseded", "retired"].includes(record.status)
-  ));
+async function policiesStage(scope, records, byId, readMarkdown) {
+  const policies = requiredPolicies(scope, byId);
   const appointedReviewer = policies
     .filter((policy) => partiesIndependent(policy.ownerIds, policy.approverIds, byId))
     .flatMap((policy) => [...currentPartyPeople(policy.approverIds || [], byId)])
@@ -515,11 +527,9 @@ async function policiesStage(scope, records, byId, readMarkdown, asOf) {
     const source = await readMarkdown(policy);
     const placeholderCount = openPlaceholderCount(source);
     const checks = {
-      reviewed: ["in-review", "approved", "active"].includes(policy.status),
       independentlyApproved: ["approved", "active"].includes(policy.status)
         && policy.approvedOn
         && partiesIndependent(policy.ownerIds, policy.approverIds, byId),
-      effective: policy.status === "active" && policy.effectiveOn && policy.effectiveOn <= asOf,
       linkedControls: scope.controls.some((control) => (control.policyIds || []).includes(policy.id)),
       contentComplete: Boolean(source.trim()) && placeholderCount === 0
     };
@@ -529,8 +539,8 @@ async function policiesStage(scope, records, byId, readMarkdown, asOf) {
       missing.length ? "action" : "complete",
       policy.title,
       missing.length
-        ? `Remaining adoption work: ${missing.join(", ")}${placeholderCount ? ` (${placeholderCount} open placeholders)` : ""}.`
-        : `Reviewed, independently approved, effective ${policy.effectiveOn}, linked to controls, with no open organization placeholders.`,
+        ? `Remaining approval work: ${missing.join(", ")}${placeholderCount ? ` (${placeholderCount} open placeholders)` : ""}. Approval accepts the policy requirements; it does not assert Control implementation.`
+        : `Independently approved on ${policy.approvedOn}, bound to the approved content revision, linked to Controls, and free of open organization placeholders. Activation remains in Step 3.`,
       policy,
       {
         checks,
@@ -543,11 +553,29 @@ async function policiesStage(scope, records, byId, readMarkdown, asOf) {
       }
     ));
   }
+  return stage(
+    "policies",
+    "Approve Policies",
+    "A Policy says what the company commits to do by the date it takes effect. Approval means the company accepts those commitments. It does not prove the work is done. Controls and operating records describe how the company meets them and provide the proof.",
+    items
+  );
+}
+
+function requiredPolicies(scope, byId) {
+  const linkedPolicyIds = new Set(scope.controls.flatMap((control) => control.policyIds || []));
+  return [...linkedPolicyIds].map((id) => byId.get(id)).filter((record) => (
+    record?.type === "policy"
+    && record.programRole !== "conditional"
+    && !["superseded", "retired"].includes(record.status)
+  ));
+}
+
+async function governedContentItems(scope, records, byId, readMarkdown, asOf) {
   const selectedControlIds = new Set(scope.controls.map(({ id }) => id));
-  const activeObligations = records.filter((record) => (
-    record.type === "obligation" && obligationIsRunning(record, byId, asOf)
+  const enabledObligations = records.filter((record) => (
+    record.type === "obligation" && obligationIsEnabled(record)
   ));
-  const requiredGovernedIds = new Set(activeObligations.flatMap((record) => [
+  const requiredGovernedIds = new Set(enabledObligations.flatMap((record) => [
     ...(record.scopeResourceIds || []),
     ...(record.templateResourceId ? [record.templateResourceId] : [])
   ]));
@@ -564,9 +592,16 @@ async function policiesStage(scope, records, byId, readMarkdown, asOf) {
     )
     || (record.type === "training" && requiredGovernedIds.has(record.id))
   ));
+  const items = [];
   for (const record of governedRecords) {
     const source = await readMarkdown(record);
     const placeholderCount = openPlaceholderCount(source);
+    const isSecurityIncidentRecoveryPlan = record.id === "document-security-incident-recovery-plan";
+    const systemsWithCompleteContinuityObjectives = scope.systems.filter(({ continuityObjectives }) => (
+      Number.isInteger(continuityObjectives?.recoveryTimeHours)
+      && Number.isInteger(continuityObjectives?.recoveryPointHours)
+      && Number.isInteger(continuityObjectives?.maximumTolerableDowntimeHours)
+    ));
     const checks = record.type === "document"
       ? {
           active: record.status === "active",
@@ -576,7 +611,10 @@ async function policiesStage(scope, records, byId, readMarkdown, asOf) {
             && partiesIndependent(record.ownerIds, record.approverIds, byId)
           ),
           effective: Boolean(record.effectiveOn && record.effectiveOn <= asOf),
-          contentComplete: substantiveMarkdown(source) && placeholderCount === 0
+          contentComplete: substantiveMarkdown(source) && placeholderCount === 0,
+          ...(isSecurityIncidentRecoveryPlan
+            ? { systemContinuityObjectives: systemsWithCompleteContinuityObjectives.length === scope.systems.length && scope.systems.length > 0 }
+            : {})
         }
       : {
           active: record.status === "active",
@@ -596,12 +634,20 @@ async function policiesStage(scope, records, byId, readMarkdown, asOf) {
       missing.length
         ? `Remaining governed-content work: ${missing.join(", ")}${placeholderCount ? ` (${placeholderCount} open placeholders)` : ""}.`
         : record.type === "document"
-          ? `Active, independently approved, effective ${record.effectiveOn}, and ready for the selected controls or running schedule.`
+          ? `Active, approved by a separate reviewer, effective ${record.effectiveOn}, and ready for the selected Controls or running schedule.`
           : `Active, approved, effective ${record.effectiveOn}, revision-bound, and ready for the running training schedule.`,
       record,
       {
         checks,
         placeholderCount,
+        ...(isSecurityIncidentRecoveryPlan
+          ? {
+              continuityObjectiveSystemIds: systemsWithCompleteContinuityObjectives.map(({ id }) => id),
+              missingContinuityObjectiveSystemIds: scope.systems
+                .filter(({ id }) => !systemsWithCompleteContinuityObjectives.some((system) => system.id === id))
+                .map(({ id }) => id)
+            }
+          : {}),
         commands: [
           `npx filegrc get ${shellArgument(record.id)} --mutation`,
           `npx filegrc update ${record.type} ${shellArgument(record.id)} MUTATION.json --json`,
@@ -610,14 +656,178 @@ async function policiesStage(scope, records, byId, readMarkdown, asOf) {
       }
     ));
   }
-  return stage(
-    "policies",
-    "Approve Policies",
-    "Review and approve the policies, governed plans, and training content required by selected controls and running schedules.",
-    items
+  return items;
+}
+
+async function assessPolicyActivations(policies, controls, records, byId, readMarkdown, asOf, model) {
+  const sourceType = String(model.modelVersion) === "4" ? "component" : "system";
+  const sourceField = String(model.modelVersion) === "4" ? "evidenceSourceComponentIds" : "evidenceSourceIds";
+  const assessments = [];
+  for (const policy of policies.filter((record) => ["approved", "active"].includes(record.status))) {
+    const linkedControls = controls.filter((control) => (control.policyIds || []).includes(policy.id));
+    const linkedControlIds = linkedControls.map(({ id }) => id);
+    const plannedOrPartialControlIds = linkedControls
+      .filter((control) => ["planned", "partially-implemented"].includes(control.status))
+      .map(({ id }) => id);
+    const missingComponentControlIds = String(model.modelVersion) === "4"
+      ? linkedControls.filter((control) => ![
+          ...(control.componentIds || []),
+          ...(control.evidenceSourceComponentIds || [])
+        ].some((id) => (
+          byId.get(id)?.type === "component" && byId.get(id).status === "active"
+        ))).map(({ id }) => id)
+      : [];
+    const missingEvidenceSourceControlIds = [];
+    for (const control of linkedControls) {
+      const readySources = [];
+      for (const id of control[sourceField] || []) {
+        const source = byId.get(id);
+        if (source?.type !== sourceType || source.status !== "active") continue;
+        const instructions = await readMarkdown(source);
+        if (
+          (source.evidenceSourceKinds || []).length
+          && (source.evidenceOwnerIds || []).length
+          && substantiveMarkdown(instructions)
+          && openPlaceholderCount(instructions) === 0
+        ) readySources.push(source);
+      }
+      if (!readySources.length) missingEvidenceSourceControlIds.push(control.id);
+    }
+    const missingScheduleControlIds = linkedControls.filter((control) => (
+      ["scheduled", "event-driven", "mixed"].includes(control.operationPattern)
+      && !records.some((record) => (
+        record.type === "obligation"
+        && obligationIsEnabled(record)
+        && (record.controlIds || []).includes(control.id)
+        && (record.policyIds || []).includes(policy.id)
+      ))
+    )).map(({ id }) => id);
+    const relevantExceptions = records.filter((record) => (
+      record.type === "exception"
+      && (record.scopeResourceIds || []).some((id) => id === policy.id || linkedControlIds.includes(id))
+      && !["revoked", "closed"].includes(record.status)
+    ));
+    const unresolvedExceptionIds = relevantExceptions.filter((record) => (
+      record.status !== "approved"
+      || !record.approval?.expiresOn
+      || record.approval.expiresOn < asOf
+    )).map(({ id }) => id);
+    const documentedExceptionIds = relevantExceptions.filter((record) => (
+      record.status === "approved"
+      && record.approval?.expiresOn
+      && record.approval.expiresOn >= asOf
+    )).map(({ id }) => id);
+    const timingWarnings = [
+      policy.proposedEffectiveOn && policy.proposedEffectiveOn < asOf
+        ? `The proposed effective date ${policy.proposedEffectiveOn} has passed. Choose a current or future activation date; do not backdate adoption.`
+        : null,
+      policy.status === "active" && (!policy.effectiveOn || policy.effectiveOn > asOf)
+        ? policy.effectiveOn
+          ? `The Policy is marked active but does not become effective until ${policy.effectiveOn}. Governed Obligations remain dormant until then.`
+          : "The Policy is marked active without an effective date."
+        : null
+    ].filter(Boolean);
+    const gapCount = plannedOrPartialControlIds.length
+      + missingComponentControlIds.length
+      + missingEvidenceSourceControlIds.length
+      + missingScheduleControlIds.length
+      + unresolvedExceptionIds.length
+      + timingWarnings.length;
+    const activeNow = policy.status === "active" && policy.effectiveOn && policy.effectiveOn <= asOf;
+    const state = activeNow
+      ? gapCount ? "active-with-implementation-gaps" : "active-and-operating"
+      : policy.status === "approved" && gapCount === 0
+        ? "ready-to-activate"
+        : policy.status === "approved"
+          ? "approved-implementation-pending"
+          : "active-with-implementation-gaps";
+    assessments.push({
+      policyId: policy.id,
+      title: policy.title,
+      state,
+      label: policyActivationLabel(state),
+      approvedOn: policy.approvedOn || null,
+      effectiveOn: policy.effectiveOn || null,
+      proposedEffectiveOn: policy.proposedEffectiveOn || null,
+      linkedControlIds,
+      plannedOrPartialControlIds,
+      missingComponentControlIds,
+      missingEvidenceSourceControlIds,
+      missingScheduleControlIds,
+      unresolvedExceptionIds,
+      documentedExceptionIds,
+      timingWarnings,
+      gapCount,
+      canActivateWithDocumentedGaps: policy.status === "approved",
+      activationWarning: gapCount
+        ? policy.status === "approved"
+          ? "You can activate the Policy with a documented gap or approved Exception. Activation does not mark a Control implemented, and Evidence Readiness stays incomplete until the remaining work is done."
+          : "The Policy is active, but the remaining gaps keep Evidence Readiness incomplete. Resolve them or record the applicable time-bound Exception."
+        : null
+    });
+  }
+  return assessments;
+}
+
+function policyActivationLabel(state) {
+  return ({
+    "approved-implementation-pending": "Approved, implementation pending",
+    "ready-to-activate": "Ready to activate",
+    "active-with-implementation-gaps": "Active with implementation gaps",
+    "active-and-operating": "Active and operating"
+  })[state] || state;
+}
+
+function policyActivationItem(assessment) {
+  const counts = [
+    [assessment.plannedOrPartialControlIds.length, "planned or partial Controls"],
+    [assessment.missingComponentControlIds.length, "Controls missing active Components"],
+    [assessment.missingEvidenceSourceControlIds.length, "Controls missing ready evidence sources"],
+    [assessment.missingScheduleControlIds.length, "Controls missing enabled schedules"],
+    [assessment.unresolvedExceptionIds.length, "unresolved Exceptions"]
+  ].filter(([count]) => count).map(([count, label]) => `${count} ${label}`);
+  const message = assessment.state === "active-and-operating"
+    ? `Active and effective ${assessment.effectiveOn}; all ${assessment.linkedControlIds.length} linked Controls are implemented with Components, evidence sources, and enabled schedules.`
+    : assessment.state === "ready-to-activate"
+      ? "Implementation checks are complete. Include this approved Policy in the Step 3 cutover when you are ready for it to take effect."
+      : `${assessment.label}: ${counts.join(", ") || assessment.timingWarnings.join(" ")}. ${assessment.activationWarning || ""}`.trim();
+  return item(
+    `policy-activation-${assessment.policyId}`,
+    assessment.state === "active-and-operating" ? "complete" : "action",
+    `${assessment.title}: ${assessment.label}`,
+    message,
+    { type: "policy", id: assessment.policyId },
+    {
+      activationAssessment: assessment,
+      commands: [
+        "npx filegrc activate-policies --scaffold > policy-activation.json",
+        "npx filegrc activate-policies policy-activation.json --preview --json",
+        "npx filegrc program-readiness --json"
+      ]
+    }
   );
 }
 
+function policyLibraryProposals(records) {
+  const legacyIds = [
+    "policy-anti-bribery-corruption",
+    "policy-clear-desk-screen",
+    "policy-data-protection-handling",
+    "policy-employee-handbook",
+    "policy-endpoint-remote-work",
+    "policy-mobile-computing-communications"
+  ];
+  const presentIds = legacyIds.filter((id) => records.some((record) => record.type === "policy" && record.id === id));
+  if (!presentIds.length) return [];
+  return [{
+    id: "consolidate-soc2-security-policy",
+    title: "Review the minimal SOC 2 Security Policy consolidation",
+    policyIds: presentIds,
+    status: "review",
+    message: "New Security-core workspaces use one Information Security Policy. Review a proposed replacement and Control remapping before superseding absorbed Policies. Keep employment, anti-bribery, privacy, or other broader records outside the SOC 2 Security scope when the organization still uses them. FileGRC never rewrites established content during an upgrade."
+  }];
+}
+
 async function controlsStage(scope, byId, readMarkdown, asOf, model) {
   const items = [];
   if (!scope.controls.length) {
@@ -659,7 +869,7 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model) {
       criteriaMapping: (control.requirementIds || []).length > 0,
       ...(["scheduled", "event-driven", "mixed"].includes(control.operationPattern) ? {
         workQueue: queueSchedules.length > 0
-          && queueSchedules.every((obligation) => obligationIsRunning(obligation, byId, asOf))
+          && queueSchedules.some(obligationIsEnabled)
       } : {})
     };
     const missing = Object.entries(checks).filter(([, value]) => !value).map(([name]) => controlCheckLabel(name));
@@ -683,13 +893,14 @@ async function controlsStage(scope, byId, readMarkdown, asOf, model) {
           `npx filegrc get ${shellArgument(control.id)} --mutation`
         ],
         workQueue: queueSchedules.length ? {
+          enabled: queueSchedules.filter(obligationIsEnabled).length,
           running: queueSchedules.filter((obligation) => obligationIsRunning(obligation, byId, asOf)).length,
           total: queueSchedules.length
         } : null
       }
     ));
   }
-  return stage("controls", "Implement Controls", "Each implemented control needs an owner, actual procedure, scope, operation pattern, evidence source, mappings, an implementation date, and any required Work Queue schedules running.", items);
+  return stage("controls", "Implement Controls", "Each implemented Control needs an owner, actual procedure, scope, operation pattern, evidence source, mappings, an implementation date, and any required Work Queue schedules enabled. An enabled schedule stays dormant until its governing Policy is active and effective.", items);
 }
 
 async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
@@ -993,18 +1204,6 @@ function controlIdsForRecord(record, byId, seen = new Set()) {
   return ids;
 }
 
-function openPlaceholderCount(source) {
-  if (!source) return 0;
-  const matches = source.match(
-    /\{\{[^}\n]+\}\}|\b(?:TODO|TBD)\b|\[(?:complete|confirm|describe|insert|name|replace|select|specify|todo|tbd)[^\]\n]*\]/giu
-  );
-  return matches?.length || 0;
-}
-
-function substantiveMarkdown(source) {
-  return (source.match(/[\p{L}\p{N}][\p{L}\p{N}'’-]*/gu) || []).length >= 10;
-}
-
 function policyCheckLabel(name) {
   return ({
     reviewed: "draft review",
@@ -1023,7 +1222,8 @@ function governedContentCheckLabel(name) {
     approved: "approval and approval date",
     effective: "effective date",
     effectiveContent: "effective content revision",
-    contentComplete: "content and organization placeholders"
+    contentComplete: "content and organization placeholders",
+    systemContinuityObjectives: "RTO, RPO, and maximum tolerable downtime for every in-scope System"
   })[name] || name;
 }
 

package/src/server.js

@@ -43,6 +43,7 @@ import {
   setupExternalReviewerGovernance
 } from "./external-reviewer.js";
 import { isWithin, relativeToWorkspace, resolveWorkspacePath } from "./paths.js";
+import { activatePolicies } from "./policy-activation.js";
 import { applyReconciliation, planReconciliation } from "./reconciliation.js";
 import { createAppState, createResourceDetail } from "./state.js";
 import { setupWorkspace } from "./setup.js";
@@ -322,6 +323,13 @@ export function createFilegrcServer(input = process.cwd(), options = {}) {
         };
         return json(response, 200, await completeSetup());
       }
+      if (request.method === "POST" && url.pathname === "/api/policy-activations") {
+        const payload = await readJson(request);
+        const result = await browserMutation(input, options, {
+          message: (activation) => `Activate ${activation.policyIds.length} ${activation.policyIds.length === 1 ? "Policy" : "Policies"}`
+        }, () => activatePolicies(input, { ...payload, confirmed: true }));
+        return json(response, 200, result);
+      }
       if (request.method === "POST" && url.pathname === "/api/resources") {
         const payload = normalizeResourceMutation(await readJson(request));
         const { record } = payload;