filegrc 0.7.0 → 0.7.1

package/src/program-path.js

@@ -144,7 +144,7 @@ export const PROGRAM_PATH = [
       { id: "governance", title: "Governance", description: "Record formal reviews, oversight meetings, and approved policy or control exceptions.", steps: ["Complete scheduled policy reviews and oversight meetings.", "Record decisions, attendees, follow-up work, and evidence.", "Approve time-bound exceptions before the departure begins."], types: ["policy-review", "meeting", "exception"], defaultOpen: false },
       { id: "inventories", title: "Assets and Vendors", description: "Maintain the asset inventory and recurring reviews of supplier relationships during operation.", steps: ["Keep ownership, custody, status, and lifecycle current for important assets.", "Perform vendor reviews on schedule and after material supplier changes.", "Link fixed reports and review evidence to the operating records."], types: ["asset", "vendor-review"], defaultOpen: false },
       { id: "access-training", title: "Access and Training", description: "Inventory service accounts before recording access decisions, periodic reviews, assignments, and acknowledgements.", steps: ["Catalog service accounts that need separate tracking.", "Preserve access approvals and removals as they occur, then complete periodic access reviews and resolve exceptions.", "Assign training and retain acknowledgement evidence for the exact content revision."], types: ["service-account", "access-grant", "access-review", "training", "attestation"], defaultOpen: false },
-      { id: "security", title: "Security Operations", description: "Record vulnerability work, independent testing, and incident response activity for the period.", steps: ["Retain scan scope, results, vulnerabilities, remediation, and exceptions.", "Track penetration testing and follow-up findings.", "Start the incident workflow when a qualifying event occurs."], types: ["vulnerability-scan", "vulnerability", "penetration-test", "incident"], defaultOpen: false },
+      { id: "security", title: "Security Operations", description: "Record vulnerability work, applicable penetration testing, and incident response activity for the period.", steps: ["Retain scan scope, results, vulnerabilities, remediation, and exceptions.", "When the approved applicability review requires penetration testing, record the test and follow-up findings.", "Start the incident workflow when a qualifying event occurs."], types: ["vulnerability-scan", "vulnerability", "penetration-test", "incident"], defaultOpen: false },
       { id: "resilience", title: "Resilience", description: "Preserve proof that backups, restoration, continuity, and incident exercises work as designed.", steps: ["Record backup restoration tests and their results.", "Run continuity and incident exercises on schedule.", "Assign and close follow-up work from failed objectives or lessons learned."], types: ["backup-test", "exercise"], defaultOpen: false },
       { id: "issues", title: "Issues and Remediation", description: "Keep observations in the source report and track only confirmed gaps that need a separate remediation lifecycle.", steps: ["Create a Finding only when a confirmed gap needs its own owner, due date, status, or verified closure.", "Use the Finding itself for straightforward remediation; create Action Items only for separate assigned tasks.", "Work Action Items from Work Queue and close the Finding only after remediation is independently verified."], types: ["finding"], defaultOpen: false }
     ],

package/src/program-readiness.js

@@ -7,8 +7,14 @@ import { planObligations } from "./obligations.js";
 import { resolveDataPath } from "./paths.js";
 import { obligationIsEnabled, obligationIsRunning } from "./program-lifecycle.js";
 import { currentPartyPeople, partiesIndependent, partyPeople } from "./parties.js";
+import { assessPolicyLibraryUpgrades } from "./policy-library.js";
 import { programComponents, resolveProgram, selectedRequirementIds } from "./program.js";
 import { markdownEntries } from "./resource-markdown.js";
+import {
+  missingSoc2References,
+  REQUIRED_SOC2_DESCRIPTION_REFERENCES,
+  REQUIRED_SOC2_SECURITY_REFERENCES
+} from "./soc2.js";
 import { assessSourceCoverageReadiness } from "./source-coverage.js";
 import { currentCalendarDate } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
@@ -75,6 +81,7 @@ export async function assessProgramReadiness(input, options = {}) {
     && coverageStart(program.candidateCoverage) <= asOf
   );
   const obligations = planObligations(records, { asOf, through: asOf, model: loaded.model });
+  const policyLibrary = await assessPolicyLibraryUpgrades(loaded);
   const operating = evidenceReady && candidateStarted && stages.at(-1).counts.action === 0;
   const canStartCandidatePeriod = Boolean(
     evidenceReady
@@ -103,7 +110,10 @@ export async function assessProgramReadiness(input, options = {}) {
     canStartCandidatePeriod,
     suggestedCandidatePeriodStart: canStartCandidatePeriod ? asOf : null,
     policyActivations,
-    policyLibraryProposals: policyLibraryProposals(records),
+    policyLibraryProposals: [
+      ...policyLibrary.proposals,
+      ...legacyPolicyLibraryProposals(records)
+    ],
     progress: {
       complete,
       total: managedItems.length,
@@ -217,7 +227,7 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
   const completeSystems = scope.systems.filter((system) => (
     system.status === "active"
     && (String(model.modelVersion) === "4" ? system.purpose && system.boundary && (system.servicesProvided || []).length : system.description)
-    && system.classificationId
+    && (String(model.modelVersion) === "4" || system.classificationId)
     && (system.ownerIds || []).length
   ));
   items.push(item(
@@ -225,7 +235,7 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
     scope.systems.length && completeSystems.length === scope.systems.length ? "complete" : "action",
     "Define the service boundary",
     scope.systems.length
-      ? `${completeSystems.length} of ${scope.systems.length} program systems are active, explicitly in scope, owned, classified, and described.`
+      ? `${completeSystems.length} of ${scope.systems.length} program systems are active, explicitly in scope, owned, and described${String(model.modelVersion) === "4" ? "" : ", with a classification"}.`
       : "Select and describe every service and supporting system in the program boundary.",
     scope.systems[0] || { type: "system" }
   ));
@@ -281,22 +291,69 @@ function scopeStage(workspace, scope, records, byId, model, collectionReviews =
     && (String(model.modelVersion) === "4" ? !v4Decisions.has(record.id) || v4Decisions.get(record.id) === "undetermined" : record.applicability === "undetermined")
   ));
   const missingRequirements = applicableRequirements.filter((record) => !selectedRequirementIds.has(record.id));
+  const selectedDescriptionRequirements = scope.requirements.filter(isDescriptionRequirement);
+  const selectedTrustServicesRequirements = scope.requirements.filter((requirement) => !isDescriptionRequirement(requirement));
+  const unresolvedDescriptionRequirements = unresolvedRequirements.filter(isDescriptionRequirement);
+  const unresolvedTrustServicesRequirements = unresolvedRequirements.filter((requirement) => !isDescriptionRequirement(requirement));
+  const uncoveredRequirements = scope.requirements.filter((requirement) => (
+    !isDescriptionRequirement(requirement)
+    && !scope.controls.some((control) => (control.requirementIds || []).includes(requirement.id))
+  ));
+  const enforceSoc2Baseline = String(model.modelVersion) === "4"
+    && ["readiness", "soc-2-type-1", "soc-2-type-2"].includes(goal);
+  const selectedFrameworkRequirements = records.filter((record) => (
+    record.type === "requirement"
+    && scope.frameworks.some((framework) => framework.id === record.frameworkId)
+  ));
+  const securityRequirements = selectedFrameworkRequirements.filter(isSecurityRequirement);
+  const descriptionRequirements = selectedFrameworkRequirements.filter(isDescriptionRequirement);
+  const missingRequiredSecurityReferences = enforceSoc2Baseline
+    ? missingSoc2References(securityRequirements, REQUIRED_SOC2_SECURITY_REFERENCES)
+    : [];
+  const missingRequiredDescriptionReferences = enforceSoc2Baseline
+    ? missingSoc2References(descriptionRequirements, REQUIRED_SOC2_DESCRIPTION_REFERENCES)
+    : [];
+  const mandatoryRequirements = enforceSoc2Baseline
+    ? [...securityRequirements, ...descriptionRequirements].filter(({ reference }) => (
+        REQUIRED_SOC2_SECURITY_REFERENCES.includes(String(reference || "").toUpperCase())
+        || REQUIRED_SOC2_DESCRIPTION_REFERENCES.includes(String(reference || "").toUpperCase())
+      ))
+    : [];
+  const invalidMandatoryDecisions = mandatoryRequirements.filter((requirement) => (
+    v4Decisions.get(requirement.id) !== "applicable"
+  ));
   const criteriaComplete = Boolean(
     scope.frameworks.length
     && scope.requirements.length
     && scope.controls.length
     && !unresolvedRequirements.length
     && !missingRequirements.length
+    && !uncoveredRequirements.length
+    && !missingRequiredSecurityReferences.length
+    && !missingRequiredDescriptionReferences.length
+    && !invalidMandatoryDecisions.length
   );
   items.push(item(
     "criteria",
     criteriaComplete ? "complete" : "action",
-    "Confirm criteria and controls in scope",
+    "Confirm Trust Services criteria, Description Criteria, and Controls",
     criteriaComplete
-      ? `${scope.requirements.length} applicable criteria and ${scope.controls.length} controls are in the management program scope.`
-      : `Resolve the program criteria and controls. ${unresolvedRequirements.length} criteria remain undetermined and ${missingRequirements.length} applicable criteria are not selected.`,
+      ? `${selectedTrustServicesRequirements.length} applicable Trust Services criteria, ${selectedDescriptionRequirements.length} SOC 2 Description Criteria, and ${scope.controls.length} Controls are in scope. Every applicable Trust Services criterion has at least one selected Control; Description Criteria govern the system description and do not map to Controls.`
+      : missingRequiredSecurityReferences.length || missingRequiredDescriptionReferences.length
+        ? `Use the complete SOC 2 baseline. The selected Frameworks omit ${[
+            ...missingRequiredSecurityReferences,
+            ...missingRequiredDescriptionReferences
+          ].join(", ")}.`
+        : invalidMandatoryDecisions.length
+          ? `Mark all 33 Security Common Criteria and all nine Description Criteria applicable for this SOC 2 Program. ${invalidMandatoryDecisions.length} required ${invalidMandatoryDecisions.length === 1 ? "decision is" : "decisions are"} missing, undetermined, or not applicable.`
+          : `Resolve the program criteria and Controls. ${unresolvedTrustServicesRequirements.length} Trust Services applicability decisions and ${unresolvedDescriptionRequirements.length} Description Criteria decisions remain undetermined, ${missingRequirements.length} applicable criteria are not selected, and ${uncoveredRequirements.length} selected applicable Trust Services criteria have no selected Control. Description Criteria govern the system description and do not map to Controls.`,
     workspace || { type: "workspace" },
     {
+      unresolvedRequirementIds: unresolvedRequirements.map(({ id }) => id),
+      missingRequirementIds: missingRequirements.map(({ id }) => id),
+      uncoveredRequirementIds: uncoveredRequirements.map(({ id }) => id),
+      invalidMandatoryRequirementIds: invalidMandatoryDecisions.map(({ id }) => id),
+      missingRequiredReferences: [...missingRequiredSecurityReferences, ...missingRequiredDescriptionReferences],
       commands: [
         "npx filegrc review-applicability --scaffold --type requirement > decisions.json",
         "npx filegrc review-applicability decisions.json --preview --json",
@@ -808,7 +865,7 @@ function policyActivationItem(assessment) {
   );
 }
 
-function policyLibraryProposals(records) {
+function legacyPolicyLibraryProposals(records) {
   const legacyIds = [
     "policy-anti-bribery-corruption",
     "policy-clear-desk-screen",
@@ -1253,6 +1310,16 @@ function assuranceGoalLabel(goal) {
   return "No assurance goal selected";
 }
 
+function isDescriptionRequirement(requirement) {
+  return (requirement?.tags || []).includes("description-criteria")
+    || /^DC\d+/i.test(requirement?.reference || "");
+}
+
+function isSecurityRequirement(requirement) {
+  const tags = requirement?.tags || [];
+  return tags.includes("security") || tags.includes("common-criteria") || /^CC\d+(?:\.|$)/i.test(requirement?.reference || "");
+}
+
 function stage(id, title, description, items) {
   return { id, title, description, items };
 }

package/src/setup.js

@@ -9,6 +9,7 @@ const CRITICALITIES = new Set(["low", "medium", "high", "critical"]);
 export async function setupWorkspace(input = process.cwd(), payload = {}) {
   const loaded = await loadWorkspace(input);
   const setup = normalizeSetupPayload(payload);
+  setup.classificationId = resolveClassificationId(loaded, setup.classificationId);
   validateSetup(loaded, setup);
   const plan = buildSetupRecords(loaded, setup);
   const updates = [
@@ -44,6 +45,7 @@ export async function setupWorkspace(input = process.cwd(), payload = {}) {
 export async function planWorkspaceSetup(input = process.cwd(), payload = {}) {
   const loaded = await loadWorkspace(input);
   const setup = normalizeSetupPayload(payload);
+  setup.classificationId = resolveClassificationId(loaded, setup.classificationId);
   validateSetup(loaded, setup);
   const plan = buildSetupRecords(loaded, setup);
   return {
@@ -137,6 +139,21 @@ function validateSetup(loaded, setup) {
   }
 }
 
+function resolveClassificationId(loaded, value) {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (!normalized) return value;
+  const candidates = String(loaded.model.modelVersion) === "4"
+    ? loaded.resources
+      .filter(({ type, status }) => type === "classification" && status === "active")
+      .map(({ id, title }) => ({ id, label: title }))
+    : Object.entries(loaded.workspace.classificationDefinitions || {})
+      .map(([id, label]) => ({ id, label }));
+  const matches = candidates.filter(({ id, label }) => (
+    id.toLowerCase() === normalized || String(label || "").trim().toLowerCase() === normalized
+  ));
+  return matches.length === 1 ? matches[0].id : value;
+}
+
 function findSetupSystem(resources, target, setup) {
   const scopedSystemIds = new Set(target.systemIds || []);
   return (setup.systemId && resources.find(({ type, id }) => type === "system" && id === setup.systemId))
@@ -227,7 +244,7 @@ function buildSetupRecords(loaded, setup) {
         title: `${setup.serviceName} service commitment`,
         status: "planned",
         commitmentKind: "service",
-        statement: "Replace this starter with the actual customer promise or approved service requirement before activation.",
+        statement: "[Complete before activation: State the actual customer promise or approved service requirement.]",
         systemIds: [systemId],
         ownerIds: [setup.ownerId],
         customerFacing: true,

package/src/soc2.js

@@ -0,0 +1,227 @@
+import { coverageEnd, coverageStart } from "./coverage.js";
+
+export const REQUIRED_SOC2_DESCRIPTION_REFERENCES = Array.from(
+  { length: 9 },
+  (_, index) => `DC${index + 1}`
+);
+
+export const REQUIRED_SOC2_SECURITY_REFERENCES = [
+  "CC1.1",
+  "CC1.2",
+  "CC1.3",
+  "CC1.4",
+  "CC1.5",
+  "CC2.1",
+  "CC2.2",
+  "CC2.3",
+  "CC3.1",
+  "CC3.2",
+  "CC3.3",
+  "CC3.4",
+  "CC4.1",
+  "CC4.2",
+  "CC5.1",
+  "CC5.2",
+  "CC5.3",
+  "CC6.1",
+  "CC6.2",
+  "CC6.3",
+  "CC6.4",
+  "CC6.5",
+  "CC6.6",
+  "CC6.7",
+  "CC6.8",
+  "CC7.1",
+  "CC7.2",
+  "CC7.3",
+  "CC7.4",
+  "CC7.5",
+  "CC8.1",
+  "CC9.1",
+  "CC9.2"
+];
+
+const SOC2_PROGRAM_GOALS = new Set([
+  "readiness",
+  "soc-2-type-1",
+  "soc-2-type-2"
+]);
+
+export function soc2RequirementApplicabilityConstraint(requirement, program, modelVersion = "4") {
+  if (
+    String(modelVersion) !== "4"
+    || requirement?.type !== "requirement"
+    || !SOC2_PROGRAM_GOALS.has(program?.assuranceGoal)
+  ) return null;
+  const reference = String(requirement.reference || "").trim().toUpperCase();
+  const security = REQUIRED_SOC2_SECURITY_REFERENCES.includes(reference);
+  const description = REQUIRED_SOC2_DESCRIPTION_REFERENCES.includes(reference);
+  if (!security && !description) return null;
+  const family = security ? "Security Common Criteria" : "SOC 2 Description Criteria";
+  return {
+    requiredDecision: "applicable",
+    allowedDecisions: ["applicable"],
+    message: `${reference} is required for the selected SOC 2 Security program.`,
+    defaultRationale: `${reference} is part of the required ${family} baseline for the selected ${soc2GoalLabel(program.assuranceGoal)} Program.`
+  };
+}
+
+function soc2GoalLabel(goal) {
+  if (goal === "soc-2-type-1") return "SOC 2 Type 1";
+  if (goal === "soc-2-type-2") return "SOC 2 Type 2";
+  return "SOC 2 readiness";
+}
+
+export function missingSoc2References(requirements, requiredReferences) {
+  const references = new Set(requirements.map(({ reference }) => String(reference || "").trim().toUpperCase()));
+  return requiredReferences.filter((reference) => !references.has(reference));
+}
+
+export function recordWasInUseDuringAudit(record, engagementStart, engagementEnd) {
+  if (!record) return false;
+  if (record.type === "vendor") {
+    if (!["active", "deprecated", "terminated"].includes(record.status)) return false;
+    const endedOn = record.endDate || (record.status === "terminated" ? record.statusTransition?.changedOn : null);
+    if (engagementEnd && record.startDate && record.startDate > engagementEnd) return false;
+    if (engagementStart && endedOn && endedOn < engagementStart) return false;
+    if (record.status === "terminated" && engagementStart && !endedOn) return false;
+    return true;
+  }
+  if (["active", "deprecated"].includes(record.status)) return true;
+  if (!engagementStart) return false;
+  if (["component", "system"].includes(record.type) && record.status === "retired") {
+    return Boolean(record.statusTransition?.changedOn && record.statusTransition.changedOn >= engagementStart);
+  }
+  return false;
+}
+
+export function auditorWasEngaged(auditor, audit) {
+  const engagementStart = audit?.managementAcknowledgedOn
+    || audit?.fieldworkStart
+    || coverageStart(audit?.coverage);
+  const engagementEnd = audit?.reportDate
+    || audit?.fieldworkEnd
+    || coverageEnd(audit?.coverage);
+  if (!recordWasInUseDuringAudit(auditor, engagementStart, engagementEnd)) return false;
+  const endedOn = auditor.endDate || (auditor.status === "terminated" ? auditor.statusTransition?.changedOn : null);
+  if (engagementStart && auditor.startDate && auditor.startDate > engagementStart) return false;
+  if (engagementEnd && endedOn && endedOn < engagementEnd) return false;
+  return true;
+}
+
+export function personWasActiveOn(person, on) {
+  if (person?.type !== "person" || !on) return false;
+  if (person.startDate && person.startDate > on) return false;
+  const endedOn = person.endDate || (person.status === "inactive" ? person.statusTransition?.changedOn : null);
+  if (endedOn && endedOn < on) return false;
+  return person.status === "active" || (person.status === "inactive" && Boolean(endedOn));
+}
+
+export function appointmentWasAuthorizedOn(appointment, on, byId) {
+  if (appointment?.type !== "appointment" || !on || !["active", "ended"].includes(appointment.status)) return false;
+  if (!appointment.startsOn || appointment.startsOn > on) return false;
+  if (appointment.endsOn && appointment.endsOn < on) return false;
+  return personWasActiveOn(byId.get(appointment.holderId), on);
+}
+
+export function signatoryAppointmentIssue(audit, byId) {
+  if (!audit?.reportDate) {
+    return {
+      code: "signatory-authority-date-missing",
+      message: "Record the CPA report date before confirming who had authority to sign management's assertion and written representations."
+    };
+  }
+  const ids = audit.signatoryAppointmentIds || [];
+  if (!ids.length) {
+    return {
+      code: "signatory-authority-missing",
+      message: "Link the dated authority Appointment for each management assertion and representation signer."
+    };
+  }
+  const permittedScopes = new Set([
+    "workspace",
+    audit.id,
+    audit.programId,
+    ...(audit.systemIds || []),
+    ...[...byId.values()].filter((record) => record.type === "organization").map(({ id }) => id)
+  ].filter(Boolean));
+  const invalid = ids.filter((id) => {
+    const appointment = byId.get(id);
+    return !appointmentWasAuthorizedOn(appointment, audit.reportDate, byId)
+      || !(appointment.scopeResourceIds || []).some((scopeId) => permittedScopes.has(scopeId));
+  });
+  if (invalid.length) {
+    return {
+      code: "signatory-authority-invalid",
+      message: `Confirm that ${invalid.join(", ")} names a dated Appointment whose holder was active and whose scope covered the workspace, Program, or Audit on ${audit.reportDate}.`
+    };
+  }
+  return null;
+}
+
+export function soc2ReportEvidenceIssue(evidence, audit, modelVersion = "4") {
+  if (
+    evidence?.type !== "evidence"
+    || evidence.status !== "verified"
+    || evidence.artifactKind !== "third-party-report"
+    || evidence.artifactSubtype !== "soc2-report"
+  ) {
+    return {
+      code: "invalid-audit-report-evidence",
+      message: `${evidence?.title || audit?.title || "The audit"} must be verified third-party-report Evidence with subtype soc2-report for the issued SOC 2 report.`
+    };
+  }
+  const issuedOn = (String(modelVersion) === "4"
+    ? evidence.sourceGeneratedAt
+    : evidence.sourceGeneratedAt || evidence.businessEventAt || evidence.collectedOn
+  )?.slice(0, 10);
+  if (!issuedOn) {
+    return {
+      code: "audit-report-date-missing",
+      message: `Record the issued SOC 2 report's actual issuance timestamp in ${evidence.title}'s sourceGeneratedAt field.`
+    };
+  }
+  if (audit?.reportDate && issuedOn !== audit.reportDate) {
+    return {
+      code: "audit-report-date-mismatch",
+      message: `${evidence.title} is dated ${issuedOn}, which does not match the Audit reportDate ${audit.reportDate}.`
+    };
+  }
+  if (audit?.reportDate && audit.opinionDate && audit.opinionDate !== audit.reportDate) {
+    return {
+      code: "audit-opinion-date-mismatch",
+      message: `The Audit opinionDate ${audit.opinionDate} does not match reportDate ${audit.reportDate}. Reconcile both dates to the issued CPA report.`
+    };
+  }
+  return null;
+}
+
+export function subsequentEventsReviewIssue(audit) {
+  const review = audit?.subsequentEventsReview;
+  if (!review) {
+    return {
+      code: "subsequent-events-review-missing",
+      message: "Review incidents, changes, findings, fraud, legal matters, subservice coverage, representations, and other relevant events through the CPA report date."
+    };
+  }
+  if (!(review.reviewedByIds || []).length || !String(review.conclusion || "").trim()) {
+    return {
+      code: "subsequent-events-review-incomplete",
+      message: "The subsequent-events review must name its reviewers and record management's conclusion."
+    };
+  }
+  const requiredThroughOn = audit.reportDate || audit.fieldworkEnd || audit.coverage?.endsOn || audit.coverage?.on;
+  if (!review.throughOn || (requiredThroughOn && review.throughOn < requiredThroughOn)) {
+    return {
+      code: "subsequent-events-period-incomplete",
+      message: `The subsequent-events review must cover through ${requiredThroughOn || "the latest engagement date"}${audit.reportDate ? ", the CPA report date" : ""}.`
+    };
+  }
+  if (!review.reviewedOn || review.reviewedOn < review.throughOn) {
+    return {
+      code: "subsequent-events-review-date-invalid",
+      message: "The subsequent-events review date must be on or after the date through which events were reviewed."
+    };
+  }
+  return null;
+}

package/src/state.js

@@ -8,11 +8,13 @@ import { planObligations } from "./obligations.js";
 import { resolveDataPath, resolveWorkspaceRoot } from "./paths.js";
 import { assessProgramReadiness } from "./program-readiness.js";
 import { markdownEntries } from "./resource-markdown.js";
+import { resolveProgram } from "./program.js";
 import { currentCalendarDate } from "./time.js";
 import { serializeWorkspaceMutation } from "./mutation.js";
 import { fingerprintWorkspace, validateWorkspace } from "./validate.js";
 import { assessWorkflow } from "./workflow.js";
 import { measureTiming } from "./timing.js";
+import { soc2RequirementApplicabilityConstraint } from "./soc2.js";
 
 const renderedMarkdownCache = new Map();
 const MAX_RENDERED_MARKDOWN_CACHE_ENTRIES = 1_000;
@@ -82,6 +84,11 @@ async function createAppStateUnlocked(input, options) {
     asOf,
     generatedAt
   }));
+  const activeProgram = resolveProgram(loaded);
+  const applicabilityConstraints = Object.fromEntries(loaded.resources.flatMap((record) => {
+    const constraint = soc2RequirementApplicabilityConstraint(record, activeProgram, loaded.model.modelVersion);
+    return constraint ? [[record.id, constraint]] : [];
+  }));
   const audits = loaded.resources.filter((record) => record.type === "audit");
   const auditPreparations = await measureTiming("state-audit-preparation", async () => Object.fromEntries(await Promise.all(
     (audits.length ? audits : [null]).map(async (audit) => {
@@ -140,6 +147,7 @@ async function createAppStateUnlocked(input, options) {
     },
     obligations,
     collectionReviews,
+    applicabilityConstraints,
     programReadiness,
     auditPreparations,
     workflow,

package/src/validate.js

@@ -370,9 +370,19 @@ function validateControlComponents(record, byId, path, diagnostics) {
 }
 
 function validateAuditSubservices(record, byId, path, diagnostics) {
+  const selectedSystemIds = new Set(record.systemIds || []);
+  const seenComponentIds = new Set();
   for (const [index, treatment] of (record.subserviceTreatments || []).entries()) {
     for (const componentId of treatment.componentIds || []) {
       const component = byId.get(componentId);
+      if (seenComponentIds.has(componentId)) {
+        diagnostics.push(error(
+          "duplicate-subservice-component",
+          path,
+          `subserviceTreatments[${index}] repeats Component "${componentId}" in more than one treatment.`
+        ));
+      }
+      seenComponentIds.add(componentId);
       if (component?.type === "component" && component.vendorId !== treatment.vendorId) {
         diagnostics.push(error(
           "subservice-vendor-mismatch",
@@ -380,6 +390,16 @@ function validateAuditSubservices(record, byId, path, diagnostics) {
           `subserviceTreatments[${index}] Component "${componentId}" is not supplied by Vendor "${treatment.vendorId}".`
         ));
       }
+      if (
+        component?.type === "component"
+        && !(component.systemUses || []).some(({ systemId }) => selectedSystemIds.has(systemId))
+      ) {
+        diagnostics.push(error(
+          "subservice-component-outside-audit-scope",
+          path,
+          `subserviceTreatments[${index}] Component "${componentId}" has no use in a System selected by this Audit.`
+        ));
+      }
     }
   }
 }