filegrc 0.7.1 → 0.9.0

package/src/web.js

@@ -1,4 +1,5 @@
 import { createResourceId } from "./id.js";
+import { MODEL_CAPABILITY_VERSIONS } from "../model/index.js";
 import {
   calendarOccurrence,
   calendarOccurrenceIndex,
@@ -52,6 +53,8 @@ export function renderIndex(state = null) {
 export const APP_SCRIPT = String.raw`
 const root = document.querySelector("#app");
 let state;
+const MODEL_CAPABILITY_VERSIONS = ${JSON.stringify(MODEL_CAPABILITY_VERSIONS)};
+const modelSupports = (capability) => Number(state?.model?.modelVersion || 0) >= MODEL_CAPABILITY_VERSIONS[capability];
 const LIST_PAGE_SIZE = 25;
 const SEARCH_PAGE_SIZE = 25;
 const NAV_GROUP_STORAGE_KEY = "filegrc.sidebar.groups.v3";
@@ -173,7 +176,8 @@ function buildNavigation(route) {
         const current = route.type === type && (!contextualStageId || contextualStageId === stage.id);
         return '<a class="' + (direct ? "nav-direct " : "") + (current ? "current" : "") + '" href="#/resources/' + encodeURIComponent(type) + '"><span>' + esc(titleCase(definition.pluralTitle)) + '</span><span class="nav-control-slot" aria-hidden="true"></span></a>';
       }).join("") + (section.relatedLinks || []).map((link) => {
-        const current = route.type === link.type && contextualStageId === stage.id;
+        const current = route.type === link.type && contextualStageId === stage.id
+          || link.href === "#/stage/" + route.stageId;
         return '<a class="' + (direct ? "nav-direct " : "") + (current ? "current" : "") + '" href="' + esc(link.href) + '"><span>' + esc(link.label) + '</span><span class="nav-control-slot" aria-hidden="true"></span></a>';
       }).join("") + renderSidebarUtility(section.utility, route, direct);
       if (direct) return links;
@@ -242,7 +246,9 @@ function topbar(route) {
           ? "Work Queue"
           : route.name === "audit-packet"
             ? "Audit Readiness"
-            : state.model.resources[route.type]?.pluralTitle || "filegrc";
+            : route.name === "list" && route.type === "document"
+              ? documentListTitle(route.params)
+              : state.model.resources[route.type]?.pluralTitle || "filegrc";
   const repositoryLabel = state.repository?.mode === "trunk"
     ? state.repository.label
     : state.git.available ? ((state.git.branch || "detached") + " · " + state.git.shortCommit) : "Git unavailable";
@@ -353,12 +359,16 @@ function renderStageOverview(main, stageId, params = new URLSearchParams()) {
   const progress = stageProgress(stage);
   main.innerHTML = '<div class="page stage-overview-page"><nav class="breadcrumbs"><a href="#/">Overview</a><span>/</span><span>' + esc(stage.title) + '</span></nav>' +
     '<section class="stage-overview-hero"><div><p class="kicker">Step ' + esc(stage.number) + ' of 5</p><h2>' + esc(stage.title) + '</h2><p>' + esc(stage.summary) + '</p></div>' + stageProgressCard(progress) + '</section>' +
-    (stage.id === "policies" ? renderPolicyApprovalGuidance() : "") + renderStagePageIndex(stage) + (stage.id === "controls" ? renderPolicyActivationAssessments() + renderEvidenceReadiness() : "") + '</div>';
+    (stage.id === "policies" ? renderPolicyApprovalGuidance() + renderPoliciesTable() : renderStagePageIndex(stage)) + (stage.id === "controls" ? renderDocumentActivationAssessments() + renderPolicyActivationAssessments() + renderEvidenceReadiness() : "") + (stage.id === "audit" ? renderAuditDocumentActivationAssessments() : "") + '</div>';
   main.querySelector("[data-show-evidence-families]")?.addEventListener("click", (event) => {
     main.querySelectorAll("[data-evidence-family-extra]").forEach((card) => { card.hidden = false; });
     event.currentTarget.remove();
   });
   main.querySelector("[data-review-policy-activation]")?.addEventListener("click", openPolicyActivationDialog);
+  main.querySelector("[data-review-document-activation]")?.addEventListener("click", () => openDocumentActivationDialog());
+  main.querySelector("[data-review-audit-document-activation]")?.addEventListener("click", (event) => {
+    openDocumentActivationDialog(event.currentTarget.dataset.reviewAuditDocumentActivation);
+  });
 }
 
 function renderPolicyApprovalGuidance() {
@@ -370,7 +380,197 @@ function renderPolicyApprovalGuidance() {
       : "";
     return '<article><strong>' + esc(proposal.title) + '</strong><p>' + esc(proposal.message) + '</p>' + review + '<div class="evidence-map-references">' + proposal.policyIds.map((id) => formatReference(id)).join("") + '</div></article>';
   }).join("");
-  return '<section class="policy-lifecycle-note panel ' + (proposalRows ? "" : "single") + '"><div><p class="kicker">Policy approval</p><h3>Approve what your company is committing to</h3><p>Approval means your company reviewed and accepted the Policy. It does not mean the linked Controls are implemented yet.</p><p>Approve the Policy in Step 2. Build the Controls in Step 3, then activate the Policy from the Controls page when you are ready for it to take effect.</p></div>' + (proposalRows ? '<div class="policy-library-proposals">' + proposalRows + '</div>' : "") + '</section>';
+  return '<section class="policy-lifecycle-note panel ' + (proposalRows ? "" : "single") + '"><div><p class="kicker">Step 2 approval</p><h3>Approve the governed content</h3><p>Approval means your company reviewed and accepted the requirements and intended values in each Policy, program Document, and Training record. It does not mean the linked Controls are implemented yet.</p><p>Bind each approval to the exact Markdown revision here. Implement Controls and configure Obligations in Step 3, then activate each unchanged approved revision at implementation cutover.</p></div>' + (proposalRows ? '<div class="policy-library-proposals">' + proposalRows + '</div>' : "") + '</section>';
+}
+
+function renderPoliciesTable() {
+  const entries = state.resources.filter(({ record }) => (
+    record.type === "policy"
+    || record.type === "training"
+    || record.type === "document" && !auditSpecificDocument(record)
+  )).sort((left, right) => (
+    ["policy", "document", "training"].indexOf(left.record.type) - ["policy", "document", "training"].indexOf(right.record.type)
+    || left.record.title.localeCompare(right.record.title)
+  ));
+  const ownerNames = (record) => (record.ownerIds || []).map((id) => (
+    state.resources.find(({ record: candidate }) => candidate.id === id)?.record.title || id
+  ));
+  const approverNames = (record) => (record.approverIds || record.approvedByIds || []).map((id) => (
+    state.resources.find(({ record: candidate }) => candidate.id === id)?.record.title || id
+  ));
+  const typeLabel = (record) => record.type === "document" && record.documentKind
+    ? '<span>' + esc(state.model.resources.document.title) + '<small>' + esc(properCase(record.documentKind)) + '</small></span>'
+    : esc(state.model.resources[record.type].title);
+  const approval = (record) => {
+    const approvers = approverNames(record);
+    const bound = Boolean(record.approvedContentRevisions || record.effectiveContentRevisions);
+    if (!record.approvedOn || !approvers.length) return '<span class="muted">Not approved</span>';
+    return '<span>' + esc(record.approvedOn) + '<small>' + esc(approvers.join(", ")) + (bound ? ' · Revision bound' : '') + '</small></span>';
+  };
+  const row = (entry) => {
+    const record = entry.record;
+    const detail = '#/resource/' + encodeURIComponent(record.type) + '/' + encodeURIComponent(record.id) + '?stage=policies' + (record.type === "document" ? '&documentScope=program' : '');
+    const owners = ownerNames(record);
+    return '<tr data-policy-content-row data-history="' + (["superseded", "retired"].includes(record.status) ? 'true' : 'false') + '"><td data-label="Name" data-primary-field><a class="record-title" href="' + detail + '">' + esc(record.title) + '</a><small><code>' + esc(record.id) + '</code></small></td><td data-label="Type" class="policy-content-type">' + typeLabel(record) + '</td><td data-label="Owner">' + (owners.length ? esc(owners.join(", ")) : '<span class="muted">Missing</span>') + '</td><td data-label="Status">' + formatValue(displayStatus(record), "status", record.type, true) + '</td><td data-label="Approval" class="policy-content-approval">' + approval(record) + '</td><td data-label="Next action">' + policyContentWorkflowCell(entry) + '</td></tr>';
+  };
+  const add = !state.readOnly
+    ? '<details class="policy-content-add"><summary class="button primary">Add</summary><div><button type="button" data-add-policy-content="policy">Policy</button><button type="button" data-add-policy-content="document">Document</button><button type="button" data-add-policy-content="training">Training</button></div></details>'
+    : '';
+  const emptyRow = '<tr><td colspan="6">' + empty('No governed content has been created.') + '</td></tr>';
+  const html = '<section class="policy-content-table"><div class="section-head"><div><p class="kicker">Governed content</p><h2>Policies</h2><p>Review every program artifact in one place. Each row keeps its own type-specific fields and Git file.</p></div><div class="policy-content-tools"><label><span class="sr-only">Filter policies</span><input type="search" data-policy-content-search placeholder="Filter policies"></label><label class="history-toggle"><input type="checkbox" data-policy-content-history> Show retired</label>' + add + '</div></div><div class="record-table-wrap"><table class="record-table"><thead><tr><th>Name</th><th>Type</th><th>Owner</th><th>Status</th><th>Approval</th><th>Next action</th></tr></thead><tbody data-policy-content-body>' + (entries.length ? entries.map(row).join('') : emptyRow) + '</tbody></table></div><p class="policy-content-count" data-policy-content-count></p></section>';
+  queueMicrotask(() => wirePoliciesTable(entries.length));
+  return html;
+}
+
+function wirePoliciesTable(total) {
+  const table = root.querySelector('.policy-content-table');
+  if (!table) return;
+  const search = table.querySelector('[data-policy-content-search]');
+  const history = table.querySelector('[data-policy-content-history]');
+  const count = table.querySelector('[data-policy-content-count]');
+  const filter = () => {
+    const query = search.value.trim().toLowerCase();
+    let visible = 0;
+    table.querySelectorAll('[data-policy-content-row]').forEach((row) => {
+      const show = (history.checked || row.dataset.history !== 'true')
+        && (!query || row.textContent.toLowerCase().includes(query));
+      row.hidden = !show;
+      if (show) visible += 1;
+    });
+    count.textContent = visible + ' of ' + total + ' ' + pluralize('artifact', total);
+  };
+  search.addEventListener('input', filter);
+  history.addEventListener('change', filter);
+  table.querySelectorAll('[data-add-policy-content]').forEach((button) => {
+    button.addEventListener('click', () => openEditor(button.dataset.addPolicyContent));
+  });
+  filter();
+}
+
+function policyContentWorkflowCell(entry) {
+  const record = entry.record;
+  const items = recordWorkflowItems(record.type, record.id);
+  if (!items.length) return '<span class="record-workflow-clear">No calculated action</span>';
+  const item = items[0];
+  const href = workflowItemHref(item) || '#/resource/' + encodeURIComponent(record.type) + '/' + encodeURIComponent(record.id) + '?stage=policies';
+  const title = ["draft", "in-review"].includes(record.status)
+    ? "Complete and approve"
+    : record.status === "approved"
+      ? "Implement and activate"
+      : "Resolve readiness gaps";
+  return '<a class="record-workflow-action policy-content-next-action" href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(title) + '</strong><small>' + items.length + ' ' + pluralize('check', items.length) + '</small></span></a>';
+}
+
+function renderDocumentActivationAssessments() {
+  const assessments = [
+    ...(state.programReadiness?.documentActivations || []).map((item) => ({ ...item, resourceType: "document", resourceId: item.documentId })),
+    ...(state.programReadiness?.trainingActivations || []).map((item) => ({ ...item, resourceType: "training", resourceId: item.trainingId }))
+  ];
+  if (!assessments.length) return "";
+  const candidates = assessments.filter(({ state }) => state === "ready-to-activate");
+  const cards = assessments.map((assessment) => {
+    const operating = assessment.state === "active-and-operating";
+    const controls = assessment.missingImplementationControlIds.length
+      ? '<div class="policy-activation-gaps"><div><small>Controls still being implemented</small><div class="evidence-map-references">' + assessment.missingImplementationControlIds.map((id) => formatReference(id, "control")).join("") + '</div></div></div>'
+      : "";
+    const schedule = assessment.resourceType === "training" && !assessment.assignmentScheduled
+      ? '<p class="policy-activation-warning">Enable at least one assignment Obligation before activating this Training.</p>'
+      : '';
+    const detail = '#/resource/' + assessment.resourceType + '/' + encodeURIComponent(assessment.resourceId) + '?stage=controls' + (assessment.resourceType === "document" ? '&documentScope=program' : '');
+    return '<article class="policy-activation-card ' + esc(assessment.state) + '"><div class="evidence-map-card-head"><div><span class="badge ' + (operating ? "good" : "warn") + '">' + esc(assessment.label) + '</span><h3><a href="' + detail + '">' + esc(assessment.title) + '</a></h3></div><small>' + assessment.gapCount + ' ' + pluralize("gap", assessment.gapCount) + '</small></div>' + controls + schedule + '<div class="policy-activation-actions"><a class="button" href="' + detail + '">View ' + esc(properCase(assessment.resourceType)) + '</a></div></article>';
+  }).join("");
+  const action = candidates.length && !state.readOnly
+    ? '<div class="evidence-map-actions"><button class="button primary" type="button" data-review-document-activation>Review content activation</button></div>'
+    : "";
+  return '<section class="policy-activation"><div class="evidence-map-head"><div><p class="kicker">Program content cutover</p><h2>Activate approved program content</h2><p>After linked requirements are implemented and Training assignment Obligations are ready, activate each unchanged approved Document and Training record. FileGRC records a separate activation date and binds the exact activated revision.</p></div>' + action + '</div><div class="policy-activation-grid">' + cards + '</div></section>';
+}
+
+function renderAuditDocumentActivationAssessments() {
+  const audits = resourcesOfType("audit").map(({ record }) => record);
+  const audit = audits.find(({ status }) => !["complete", "closed", "canceled"].includes(status)) || audits[0];
+  const preparation = audit ? state.auditPreparations?.[audit.id] : null;
+  const assessments = preparation?.documentActivations || [];
+  if (!audit || !assessments.length) return "";
+  const candidates = assessments.filter(({ state }) => state === "ready-to-activate");
+  const cards = assessments.map((assessment) => {
+    const operating = assessment.state === "active-and-operating";
+    const issues = assessment.issues.length
+      ? '<ul class="policy-activation-warning">' + assessment.issues.map((issue) => '<li>' + esc(issue) + '</li>').join("") + '</ul>'
+      : "";
+    return '<article class="policy-activation-card ' + esc(assessment.state) + '"><div class="evidence-map-card-head"><div><span class="badge ' + (operating ? "good" : "warn") + '">' + esc(assessment.label) + '</span><h3><a href="#/resource/document/' + encodeURIComponent(assessment.documentId) + '?stage=audit&documentScope=audit">' + esc(assessment.title) + '</a></h3></div><small>' + assessment.gapCount + ' ' + pluralize("gap", assessment.gapCount) + '</small></div>' + issues + '<div class="policy-activation-actions"><a class="button" href="#/resource/document/' + encodeURIComponent(assessment.documentId) + '?stage=audit&documentScope=audit">View Document</a></div></article>';
+  }).join("");
+  const action = candidates.length && !state.readOnly
+    ? '<div class="evidence-map-actions"><button class="button primary" type="button" data-review-audit-document-activation="' + esc(audit.id) + '">Review Step 5 activation</button></div>'
+    : "";
+  return '<section class="policy-activation audit-document-activation"><div class="evidence-map-head"><div><p class="kicker">Step 5 Document lifecycle</p><h2>Activate the engagement Documents</h2><p>After each engagement Document is complete and independently approved, record the Person who activates the unchanged approved revision for this Audit.</p></div>' + action + '</div><div class="policy-activation-grid">' + cards + '</div></section>';
+}
+
+function openDocumentActivationDialog(auditId = null) {
+  const candidates = (auditId
+    ? state.auditPreparations?.[auditId]?.documentActivations || []
+    : [
+        ...(state.programReadiness?.documentActivations || []).map((item) => ({ ...item, resourceType: "document", resourceId: item.documentId })),
+        ...(state.programReadiness?.trainingActivations || []).map((item) => ({ ...item, resourceType: "training", resourceId: item.trainingId }))
+      ]).filter(({ state }) => state === "ready-to-activate");
+  const entryById = new Map(state.resources
+    .filter(({ record }) => (auditId ? record.type === "document" : ["document", "training"].includes(record.type)) && record.status === "approved")
+    .map((entry) => [entry.record.id, entry]));
+  const ready = candidates.map((item) => auditId
+    ? { ...item, resourceType: "document", resourceId: item.documentId }
+    : item).filter(({ resourceId }) => entryById.has(resourceId));
+  if (!ready.length) return;
+  const activators = state.resources
+    .filter(({ record }) => record.type === "person" && record.status === "active")
+    .map(({ record }) => record);
+  const today = currentDate();
+  const dialog = document.createElement("dialog");
+  dialog.className = "commit-dialog event-dialog policy-activation-dialog";
+  dialog.setAttribute("aria-labelledby", "document-activation-dialog-title");
+  const step = auditId ? "Step 5" : "Step 3";
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">' + step + ' activation</p><h2 id="document-activation-dialog-title">Review governed content activation</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div>' +
+    '<p>' + (auditId ? 'These Audit Documents are complete and independently approved for the selected Audit.' : 'These program Documents and Training records already have independent Step 2 approvals, implemented linked requirements, and any required schedules.') + ' Activation records the Person who puts each unchanged approved revision into use.</p>' +
+    '<div class="policy-activation-selections">' + ready.map((assessment) => '<label class="policy-activation-selection"><input type="checkbox" name="resourceId" value="' + esc(assessment.resourceId) + '" checked><span><strong>' + esc(assessment.title) + '</strong><small>' + esc(properCase(assessment.resourceType)) + ' · Approved ' + esc(assessment.approvedOn) + (auditId ? ' · Engagement facts complete' : ' · Implementation ready') + '</small></span></label>').join("") + '</div>' +
+    '<label><span>Activated by</span><select name="activatedById" required><option value="">Select the Person who performs this activation</option>' + activators.map((person) => '<option value="' + esc(person.id) + '">' + esc(person.title) + '</option>').join("") + '</select></label>' +
+    '<label><span>Activation date</span><input name="activatedOn" type="date" value="' + esc(today) + '" readonly required></label>' +
+    '<label><span>Effective date</span><input name="effectiveOn" type="date" min="' + esc(today) + '" value="' + esc(today) + '" required></label>' +
+    '<div class="dialog-error" role="alert"></div><div class="dialog-actions"><span class="save-status" role="status" aria-live="polite"></span><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary">Activate selected content</button></div></form>';
+  document.body.append(dialog);
+  const close = () => dialog.close();
+  dialog.querySelector(".icon-button").addEventListener("click", close);
+  dialog.querySelector('[data-event="cancel"]').addEventListener("click", close);
+  dialog.addEventListener("close", () => dialog.remove(), { once: true });
+  dialog.querySelector("form").addEventListener("submit", async (event) => {
+    event.preventDefault();
+    if (!event.currentTarget.reportValidity() || dialog.dataset.mutationBusy === "true") return;
+    const resourceIds = [...event.currentTarget.querySelectorAll('[name="resourceId"]:checked')].map(({ value }) => value);
+    if (!resourceIds.length) {
+      dialog.querySelector(".dialog-error").textContent = "Select at least one approved artifact to activate.";
+      return;
+    }
+    setMutationBusy(dialog, true, "Activating…", "Activate selected content");
+    try {
+      const response = await localFetch(auditId ? "/api/document-activations" : "/api/governed-content-activations", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          ...(auditId ? { documentIds: resourceIds } : { resourceIds }),
+          ...(auditId ? { auditId } : {}),
+          activatedByIds: [event.currentTarget.elements.activatedById.value],
+          activatedOn: event.currentTarget.elements.activatedOn.value,
+          effectiveOn: event.currentTarget.elements.effectiveOn.value,
+          expectedRevisions: Object.fromEntries(resourceIds.map((resourceId) => [resourceId, entryById.get(resourceId).revision]))
+        })
+      });
+      if (!response.ok) throw new Error(await responseMessage(response));
+      applyMutationState(await response.json());
+      dialog.close();
+      render();
+    } catch (error) {
+      setMutationBusy(dialog, false, "", "Activate selected content");
+      dialog.querySelector(".dialog-error").textContent = error.message;
+    }
+  });
+  dialog.showModal();
 }
 
 function renderPolicyActivationAssessments() {
@@ -390,7 +590,8 @@ function renderPolicyActivationAssessments() {
       gapGroup("Planned or partial Controls", assessment.plannedOrPartialControlIds, "control") +
       gapGroup("Missing active Components", assessment.missingComponentControlIds, "control") +
       gapGroup("Missing ready evidence sources", assessment.missingEvidenceSourceControlIds, "control") +
-      gapGroup("Missing enabled schedules", assessment.missingScheduleControlIds, "control") +
+      gapGroup("Missing enabled Obligations", assessment.missingScheduleControlIds, "control") +
+      gapGroup("Inactive governed Documents", assessment.missingGovernedDocumentIds || [], "document") +
       gapGroup("Unresolved Exceptions", assessment.unresolvedExceptionIds, "exception") +
       gapGroup("Documented Exceptions", assessment.documentedExceptionIds, "exception") + '</div>' +
       (assessment.activationWarning ? '<p class="policy-activation-warning">' + esc(assessment.activationWarning) + '</p>' : "") +
@@ -418,6 +619,7 @@ function openPolicyActivationDialog() {
       [assessment.missingComponentControlIds.length, "missing Components"],
       [assessment.missingEvidenceSourceControlIds.length, "missing evidence sources"],
       [assessment.missingScheduleControlIds.length, "missing schedules"],
+      [(assessment.missingGovernedDocumentIds || []).length, "inactive governed Documents"],
       [assessment.unresolvedExceptionIds.length, "unresolved Exceptions"]
     ].filter(([count]) => count).map(([count, label]) => count + " " + label).join(" · ");
     return '<label class="policy-activation-selection"><input type="checkbox" name="policyId" value="' + esc(assessment.policyId) + '" checked><span><strong>' + esc(assessment.title) + '</strong><small>' + esc(assessment.label) + (details ? " · " + details : " · No implementation gaps") + '</small></span></label>';
@@ -426,7 +628,7 @@ function openPolicyActivationDialog() {
   dialog.className = "commit-dialog event-dialog policy-activation-dialog";
   dialog.setAttribute("aria-labelledby", "policy-activation-dialog-title");
   dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Step 3 cutover</p><h2 id="policy-activation-dialog-title">Review policy activation</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div>' +
-    '<p>Choose which approved Policies should take effect. Enabled schedules stay dormant until the effective date and until their linked Controls are implemented.</p>' +
+    '<p>Choose which approved Policies should take effect. Enabled schedules stay dormant until the effective date, their linked Controls are implemented, and required governed Documents are active and effective.</p>' +
     '<div class="policy-activation-selections">' + candidateRows + '</div>' +
     '<section class="policy-activation-review-warning"><strong>Activation with gaps</strong><p>You can activate a Policy with documented gaps or Exceptions. The gaps stay open, Controls keep their current status, and Evidence Readiness stays incomplete.</p></section>' +
     '<label><span>Effective date</span><input name="effectiveOn" type="date" min="' + esc(today) + '" value="' + esc(today) + '" required></label>' +
@@ -593,7 +795,7 @@ function openCollectionReviewDialog(type) {
   if (!assessment) return;
   const configuration = assessment.configuration;
   const people = resourcesOfType("person").filter(({ record }) => record.status === "active");
-  const v4 = String(state.model.modelVersion) === "4";
+  const v4 = modelSupports("program-scope");
   const sourceType = v4 ? "component" : "system";
   const systems = resourcesOfType(sourceType).filter(({ record }) => record.status === "active");
   const allowedDecisions = configuration.decisions || ["complete"];
@@ -830,6 +1032,9 @@ function stagePageDestinations(stage) {
 }
 
 function stagePageSummary(destination) {
+  if (destination.section && !destination.section.types.includes(destination.type)) {
+    return destination.description || destination.section.description || "";
+  }
   const summaryKey = destination.type || "utility:" + destination.utility;
   const section = destination.section || (destination.type
     ? readinessStageForType(destination.type)?.sections.find((candidate) => candidate.types.includes(destination.type))
@@ -917,6 +1122,13 @@ function stagePageItems(stage, destination) {
         && item.code === "governance.appointment.independent-policy-reviewer"
     )
   ));
+  if (stage.id === "policies" && destination.href === "#/stage/policies") {
+    return items.sort((left, right) => (
+      workflowItemStatePriority(left) - workflowItemStatePriority(right)
+      || (left.priority ?? workflowItemPriority(left)) - (right.priority ?? workflowItemPriority(right))
+      || left.key.localeCompare(right.key)
+    ));
+  }
   return items.filter((item) => {
     if (
       destination.type === "requirement"
@@ -1032,6 +1244,9 @@ function sectionDestinations(section) {
     if (!definition) continue;
     destinations.push({ type, kind: "Record page", label: titleCase(definition.pluralTitle), href: "#/resources/" + encodeURIComponent(type), description: definition.description });
   }
+  for (const link of section.relatedLinks || []) {
+    destinations.push({ type: link.type, kind: "Record page", label: link.label, href: link.href, description: section.description });
+  }
   if (section.utility === "obligation-board") destinations.push({ utility: section.utility, kind: "Working page", label: "Work Queue", href: "#/stage/run", description: "Complete recurring work, Policy Event tasks, and assigned follow-up with its due windows and linked proof." });
   if (section.utility === "audit-packet") destinations.push({ utility: section.utility, kind: "Working page", label: "Audit Evidence & Packet", href: "#/audit-packet", description: "Review filegrc Evidence and Evidence Artifacts, prepare fieldwork, and build the indexed packet." });
   return destinations;
@@ -1590,7 +1805,7 @@ function openApplicabilityReviewDialog(type, entries) {
   const people = resourcesOfType("person").filter(({ record }) => record.status === "active");
   const reviewedRequirements = reviewedRequirementIds();
   const pending = entries.filter(({ record }) => (
-    type === "requirement" && String(state.model.modelVersion) === "4"
+    type === "requirement" && modelSupports("program-scope")
       ? !reviewedRequirements.has(record.id)
       : !record.applicabilityReview
     || type === "requirement" && record.applicability === "undetermined"
@@ -1662,7 +1877,7 @@ function openApplicabilityReviewDialog(type, entries) {
       reviewedOn: form.elements.reviewedOn.value,
       expectedRevisions: Object.fromEntries([
         ...entries.filter((entry) => decisionIds.has(entry.record.id)).map((entry) => [entry.record.id, entry.revision]),
-        ...(type === "requirement" && String(state.model.modelVersion) === "4"
+        ...(type === "requirement" && modelSupports("program-scope")
           ? state.resources.filter(({ record }) => record.id === activeProgram().id).map((entry) => [entry.record.id, entry.revision])
           : [])
       ])
@@ -1910,8 +2125,15 @@ function eventStepSummary(step) {
 function renderList(main, type, params = new URLSearchParams()) {
   const definition = state.model.resources[type];
   if (!definition) return renderNotFound(main);
-  const listStage = readinessStageForType(type);
-  const entries = resourcesOfType(type);
+  const listStage = READINESS_STAGES.find(({ id }) => id === params.get("stage")) || readinessStageForType(type);
+  const documentScope = type === "document" ? params.get("documentScope") : null;
+  const listTitle = type === "document" ? documentListTitle(params) : definition.pluralTitle;
+  const entries = resourcesOfType(type).filter(({ record }) => (
+    !documentScope || (documentScope === "audit") === auditSpecificDocument(record)
+  ));
+  const detailContext = params.get("stage")
+    ? "?stage=" + encodeURIComponent(params.get("stage")) + (documentScope ? "&documentScope=" + encodeURIComponent(documentScope) : "")
+    : "";
   const requestedPage = Number(params.get("page"));
   let pageNumber = Number.isInteger(requestedPage) && requestedPage > 0 ? requestedPage : 1;
   const fields = [...new Set([
@@ -1929,7 +2151,7 @@ function renderList(main, type, params = new URLSearchParams()) {
   const createButton = !state.readOnly && !definition.singleton && !collectionNeedsFirstRecord(type) && resourceCreationAllowed(type) ? '<button class="button primary" id="new-resource">New ' + esc(definition.title.toLowerCase()) + '</button>' : "";
   const reviewedRequirements = reviewedRequirementIds();
   const hasPendingApplicability = entries.some(({ record }) => (
-    type === "requirement" && String(state.model.modelVersion) === "4"
+    type === "requirement" && modelSupports("program-scope")
       ? !reviewedRequirements.has(record.id)
       : !record.applicabilityReview || type === "requirement" && record.applicability === "undetermined"
   ));
@@ -1941,7 +2163,7 @@ function renderList(main, type, params = new URLSearchParams()) {
   const guideTrigger = '<button class="guide-trigger" id="resource-guide-trigger" type="button" aria-label="About ' + esc(definition.pluralTitle) + '" aria-haspopup="dialog" aria-controls="resource-guide" aria-expanded="false"><svg viewBox="0 0 20 20" aria-hidden="true"><circle cx="10" cy="10" r="8"></circle><path d="M7.8 7.5a2.4 2.4 0 1 1 3.25 2.25c-.7.31-1.05.72-1.05 1.5v.25M10 14.5v.1"></path></svg></button>';
   const listTools = '<div class="list-tools list-header-tools"><label><span class="sr-only">Filter list</span><input id="list-search" type="search" placeholder="Filter ' + esc(definition.pluralTitle.toLowerCase()) + '"></label>' +
     filters.map(({ name, label, values }) => '<select class="field-filter" data-field="' + esc(name) + '" aria-label="Filter by ' + esc(label.toLowerCase()) + '"><option value="">Any ' + esc(properCase(label)) + '</option>' + values.map((value) => '<option value="' + esc(value) + '">' + esc(filterOptionLabel(value)) + '</option>').join("") + '</select>').join("") + '<span id="result-count" aria-live="polite">' + entries.length + ' records</span>' + applicabilityButton + createButton + '</div>';
-  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">' + esc(listStage?.title || groupTitle(definition.group)) + '</p><div class="page-title-line"><h2>' + esc(titleCase(definition.pluralTitle)) + '</h2>' + guideTrigger + '</div></div>' + listTools + '</div>' + resourceGuide(type) +
+  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">' + esc(listStage?.title || groupTitle(definition.group)) + '</p><div class="page-title-line"><h2>' + esc(titleCase(listTitle)) + '</h2>' + guideTrigger + '</div></div>' + listTools + '</div>' + resourceGuide(type) +
     collectionReviewPanel(type) +
     '<section class="record-table-wrap"><table class="record-table"><thead><tr><th>' + esc(fieldLabel(type, "title")) + '</th>' + fields.map((name) => '<th>' + esc(fieldLabel(type, name)) + '</th>').join("") + '<th>Next action</th><th>Git file</th></tr></thead><tbody id="record-rows"></tbody></table></section>' +
     '<nav class="pagination list-pagination" aria-label="' + esc(definition.pluralTitle) + ' pages" hidden><button class="button" type="button" data-page="previous">Previous</button><span class="page-status" aria-live="polite"></span><button class="button" type="button" data-page="next">Next</button></nav></div>';
@@ -1959,7 +2181,7 @@ function renderList(main, type, params = new URLSearchParams()) {
     const start = (pageNumber - 1) * LIST_PAGE_SIZE;
     const visible = filtered.slice(start, start + LIST_PAGE_SIZE);
     main.querySelector("#result-count").textContent = filtered.length + (filtered.length === 1 ? " record" : " records");
-    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$operationTracking" ? controlOperationTracking(entry.record) : name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? displayStatus(entry.record) : entry.record[name], name, type, true)) + '</td>').join("") + '<td data-label="Next action">' + recordWorkflowCell(type, entry) + '</td><td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 3) + '">' + empty(entries.length ? "No records match this filter." : collectionEmptyState(type, definition)) + '</td></tr>';
+    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + detailContext + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$operationTracking" ? controlOperationTracking(entry.record) : name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? displayStatus(entry.record) : entry.record[name], name, type, true)) + '</td>').join("") + '<td data-label="Next action">' + recordWorkflowCell(type, entry) + '</td><td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 3) + '">' + empty(entries.length ? "No records match this filter." : collectionEmptyState(type, definition)) + '</td></tr>';
     pagination.hidden = totalPages === 1;
     previous.disabled = pageNumber === 1;
     next.disabled = pageNumber === totalPages;
@@ -1971,6 +2193,8 @@ function renderList(main, type, params = new URLSearchParams()) {
   main.querySelectorAll(".field-filter").forEach((select) => { select.value = params.get(select.dataset.field) || ""; });
   const syncRoute = (mode = "replace") => {
     const next = new URLSearchParams();
+    if (params.get("stage")) next.set("stage", params.get("stage"));
+    if (documentScope) next.set("documentScope", documentScope);
     const query = main.querySelector("#list-search").value.trim();
     if (query) next.set("q", query);
     main.querySelectorAll(".field-filter").forEach((select) => { if (select.value) next.set(select.dataset.field, select.value); });
@@ -2010,6 +2234,22 @@ function renderList(main, type, params = new URLSearchParams()) {
   }
 }
 
+function auditSpecificDocument(record) {
+  if (record.type !== "document") return false;
+  if (modelSupports("document-workflow-scope")) return record.workflowScope === "engagement";
+  const kinds = new Set([
+    ...(state.model.auditReadiness?.managementDocuments || []).map(({ kind }) => kind),
+    "soc2-engagement-terms"
+  ]);
+  return kinds.has(record.documentKind);
+}
+
+function documentListTitle(params = new URLSearchParams()) {
+  if (params.get("documentScope") === "audit") return "Audit Documents";
+  if (params.get("documentScope") === "program") return "Program Documents";
+  return "Documents";
+}
+
 function renderDetail(main, type, id, params = new URLSearchParams()) {
   const entry = resourcesOfType(type).find(({ record }) => record.id === id);
   const definition = state.model.resources[type];
@@ -3393,12 +3633,18 @@ function editorField(type, name, field, value, required, editing, oneOfRequired
   }
   if (field.type === "enum" || field.type === "rating" || field.type === "outcome") {
     const values = field.values || (field.type === "rating" ? state.model.primitives.rating : state.model.primitives.outcome) || [];
-    const availableValues = type === "policy" && name === "status" && value !== "active"
+    const activationManagedType = ["policy", "document"].includes(type)
+      || (type === "training" && Boolean(state.model.resources.training?.fields?.activatedContentRevisions));
+    const availableValues = activationManagedType && name === "status" && value !== "active"
       ? values.filter((item) => item !== "active")
       : values;
     control = '<select><option value="">Select</option>' + availableValues.map((item) => '<option value="' + esc(item) + '" ' + (value === item ? "selected" : "") + '>' + esc(properCase(item)) + '</option>').join("") + '</select>';
-    const enumHelp = type === "policy" && name === "status"
-      ? "Step 2 ends at Approved. Activate approved Policies from the Step 3 Controls-page cutover."
+    const enumHelp = activationManagedType && name === "status"
+      ? type === "document"
+        ? "Approval ends at Approved. Activate program Documents from Step 3 after implementation, and engagement Documents from Step 5 after their Audit facts are complete."
+        : type === "training"
+          ? "Step 2 ends at Approved. Activate Training from Step 3 after its Controls and assignment Obligation are ready."
+        : "Step 2 ends at Approved. Activate approved Policies from the Step 3 Controls-page cutover."
       : help;
     return fieldWrap(name, "string", label, requiredMark, control, enumHelp, required);
   }
@@ -4503,6 +4749,7 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .workflow-findings>a:hover{border-color:var(--accent-light);box-shadow:0 3px 9px rgba(21,40,33,.05)}.workflow-findings>a:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.stage-page-card-head{align-items:flex-start}.stage-page-completion-state{flex:0 0 auto;max-width:150px;padding:5px 8px;border-radius:99px;background:#f7e9cf;color:#855717;font-size:9.6px;font-weight:750;line-height:1.25;text-align:right}.stage-page-completion-state.complete{background:#ddefe5;color:#176143}.obligation-card.workflow-target{outline:2px solid var(--focus);outline-offset:3px}.obligation-card-foot{flex-wrap:wrap}.obligation-card-foot .obligation-links{flex:1 1 120px}
 .evidence-attachments .panel-head{align-items:flex-start}.evidence-attachments .panel-head h3{margin:0}.evidence-attachments .panel-head p{margin:4px 0 0;color:var(--muted);font-size:10px}.evidence-attachments ul{list-style:none;margin:0;padding:0}.evidence-attachments li{display:flex;align-items:center;justify-content:space-between;gap:10px;padding:9px 0;border-top:1px solid var(--line)}.evidence-attachments li:first-child{border-top:0}.evidence-attachments strong,.evidence-attachments small{display:block}.evidence-attachments strong{font-size:11px}.evidence-attachments small{margin-top:2px;color:var(--muted);font-size:9px;overflow-wrap:anywhere}.evidence-attachments .attachment-empty{display:block;color:var(--muted);font-size:10px;line-height:1.45}.danger-text{color:var(--red)}
 .policy-lifecycle-note.single{grid-template-columns:1fr}
+.policy-content-table{margin-top:22px}.policy-content-table>.section-head{align-items:end}.policy-content-table>.section-head h2{font:500 27.6px Georgia,serif;margin:5px 0 6px}.policy-content-table>.section-head p:not(.kicker){max-width:720px;margin:0;color:var(--muted);font-size:12px;line-height:1.5}.policy-content-tools{display:flex;align-items:center;justify-content:flex-end;gap:9px;flex-wrap:wrap}.policy-content-tools input[type="search"]{min-width:210px;border:1px solid var(--line);border-radius:7px;background:var(--field);padding:9px 11px}.history-toggle{display:flex;align-items:center;gap:6px;color:var(--muted);font-size:11px}.policy-content-add{position:relative}.policy-content-add>summary{list-style:none}.policy-content-add>summary::-webkit-details-marker{display:none}.policy-content-add>div{position:absolute;right:0;z-index:5;display:grid;min-width:150px;margin-top:6px;padding:5px;border:1px solid var(--line);border-radius:8px;background:var(--panel);box-shadow:var(--shadow)}.policy-content-add button{border:0;border-radius:5px;background:transparent;padding:8px 10px;color:var(--ink);text-align:left;cursor:pointer}.policy-content-add button:hover{background:var(--accent-soft)}.policy-content-type span,.policy-content-approval span{display:block}.policy-content-type small,.policy-content-approval small{display:block;margin-top:3px;color:var(--muted);font-size:9.6px}.policy-content-count{margin:9px 2px 0;color:var(--muted);font-size:10.8px;text-align:right}
 .policy-library-proposals{min-width:0}.policy-library-proposals article,.policy-library-proposals details{min-width:0}.policy-library-proposals pre{box-sizing:border-box;max-width:100%;overflow:auto;padding:9px;border:1px solid var(--line);border-radius:6px;background:var(--paper);font-size:9px;line-height:1.45}
 .policy-activation-actions{display:flex;justify-content:flex-end;margin-top:14px;padding-top:12px;border-top:1px solid var(--line)}
 .policy-activation-review-warning{margin-top:14px;padding:12px 14px;border:1px solid #d8bd78;border-radius:8px;background:#fff8e8}.policy-activation-review-warning>strong{font-size:12px}.policy-activation-review-warning ul{display:grid;gap:5px;margin:9px 0;padding-left:20px;font-size:10.8px}.policy-activation-review-warning p{margin:9px 0 0;color:#6d4917;font-size:11px;line-height:1.5}

package/src/workflow.js

@@ -1,6 +1,7 @@
 import { cp, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { modelSupports } from "../model/index.js";
 import { assessRequiredAppointments } from "./appointments.js";
 import { assessSourceCoverageReadiness } from "./source-coverage.js";
 import { coverageEnd, coverageStart } from "./coverage.js";
@@ -93,7 +94,7 @@ async function assessWorkflowUnmeasured(input, options = {}) {
   if (options.auditId && selectedAuditRecords[0]?.programId && selectedAuditRecords[0].programId !== programRecord.id) {
     throw new Error(`Audit "${options.auditId}" belongs to Program "${selectedAuditRecords[0].programId}", not "${programRecord.id}".`);
   }
-  const audits = String(loaded.model.modelVersion) === "4"
+  const audits = modelSupports(loaded.model, "program-scope")
     ? selectedAuditRecords.filter(({ programId }) => programId === programRecord.id)
     : selectedAuditRecords;
   const timezone = options.timezone || workspace?.timezone || "UTC";
@@ -539,7 +540,11 @@ function finalizationFields(record, model) {
       ["reviewDueOn", record.status === "active"],
       ["nonExpiringRationale", record.status === "active" && !record.expiresOn]
     ],
-    training: [
+    training: modelSupports(model, "governed-training-activation") ? [
+      ["approvedContentRevisions", ["approved", "active"].includes(record.status)],
+      ["activatedContentRevisions", record.status === "active" && record.activationBasis !== "legacy-v5"],
+      ["effectiveOn", record.status === "active"]
+    ] : [
       ["effectiveContentRevisions", record.status === "active"],
       ["effectiveOn", record.status === "active"]
     ],
@@ -633,7 +638,7 @@ function appointmentFinding(kind, template, record, state, requiredness) {
 }
 
 function sourceCoverageFindings(loaded, program) {
-  const selected = String(loaded.model.modelVersion) === "4"
+  const selected = modelSupports(loaded.model, "program-scope")
     ? new Set(program?.controlIds || [])
     : null;
   const selectedControlIds = loaded.resources
@@ -880,7 +885,7 @@ async function assessPeriodHealth(loaded, options) {
 }
 
 function auditLifecycleFindings(loaded, audits, program) {
-  if (!["3", "4"].includes(String(loaded.model.modelVersion))) return [];
+  if (!modelSupports(loaded.model, "guided-workflow")) return [];
   const target = program || resolveProgram(loaded);
   const byId = new Map(loaded.resources.map((record) => [record.id, record]));
   const findings = [];
@@ -939,7 +944,7 @@ function auditLifecycleFindings(loaded, audits, program) {
         subsequentEventsIssue.message
       ));
     }
-    const signatoryIssue = String(loaded.model.modelVersion) === "4" && lateStage
+    const signatoryIssue = modelSupports(loaded.model, "program-scope") && lateStage
       ? signatoryAppointmentIssue(audit, byId)
       : null;
     if (signatoryIssue) {
@@ -1239,6 +1244,8 @@ function buildAssessments({ program, audits, auditPreparations, obligationPlan,
     && !findings.some((finding) => finding.assessment === "audit-closure" && blockingFinding(finding));
   const deliveryFindingKeys = findingKeys(findings, "delivery-readiness");
   const policyActivations = program.policyActivations || [];
+  const documentActivations = program.documentActivations || [];
+  const trainingActivations = program.trainingActivations || [];
   const policiesOperating = policyActivations.length > 0
     && policyActivations.every(({ state }) => state === "active-and-operating");
   return {
@@ -1269,6 +1276,30 @@ function buildAssessments({ program, audits, auditPreparations, obligationPlan,
       findingKeys: findingKeys(findings, "program-configuration", ({ key }) => key.includes(".policy-activation-")),
       policies: policyActivations
     },
+    documentActivation: {
+      status: documentActivations.length && documentActivations.every(({ state }) => state === "active-and-operating")
+        ? "complete"
+        : documentActivations.length ? "needs-work" : "not-started",
+      message: documentActivations.length && documentActivations.every(({ state }) => state === "active-and-operating")
+        ? "Every required governed Document is separately approved, activated, effective, and operating."
+        : documentActivations.length
+          ? "Approve required program Documents in Step 2, implement their linked requirements, then activate their exact revisions in Step 3."
+          : "No required governed Document activation is configured.",
+      findingKeys: findingKeys(findings, "program-configuration", ({ key }) => key.includes(".document-")),
+      documents: documentActivations
+    },
+    trainingActivation: {
+      status: trainingActivations.length && trainingActivations.every(({ state }) => state === "active-and-operating")
+        ? "complete"
+        : trainingActivations.length ? "needs-work" : "not-started",
+      message: trainingActivations.length && trainingActivations.every(({ state }) => state === "active-and-operating")
+        ? "Every required Training record is separately approved, activated, effective, scheduled, and operating."
+        : trainingActivations.length
+          ? "Approve Training in Step 2, implement its Controls and assignment Obligation, then activate its exact revision in Step 3."
+          : "No required Training activation is configured.",
+      findingKeys: findingKeys(findings, "program-configuration", ({ key }) => key.includes(".training-")),
+      training: trainingActivations
+    },
     policyLibraryReview: {
       status: program.policyLibraryProposals?.length ? "review" : "current",
       message: program.policyLibraryProposals?.length
@@ -1634,7 +1665,7 @@ function shellArgument(value) {
 
 function recordAssessment(type) {
   if (["audit", "audit-request", "audit-population"].includes(type)) return "audit-readiness";
-  if (["action-item", "obligation", "obligation-event", "control-activity"].includes(type)) return "period-health";
+  if (["action-item", "obligation-event", "control-activity"].includes(type)) return "period-health";
   return "program-configuration";
 }
 
@@ -1643,7 +1674,7 @@ function recordStage(type) {
     return "scope";
   }
   if (["policy", "document", "training"].includes(type)) return "policies";
-  if (["control", "complementary-control", "source-coverage"].includes(type)) return "controls";
+  if (["control", "complementary-control", "source-coverage", "obligation"].includes(type)) return "controls";
   if (["audit", "audit-request", "audit-population"].includes(type)) return "audit";
   return "operate";
 }

package/src/workspace.js

@@ -2,8 +2,13 @@ import { readFile, readdir } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
 import { loadModel } from "../model/index.js";
 import { resolveWorkspaceRoot } from "./paths.js";
+import { measureTiming } from "./timing.js";
 
 export async function loadWorkspace(input = process.cwd()) {
+  return measureTiming("workspace-load", () => loadWorkspaceUnmeasured(input));
+}
+
+async function loadWorkspaceUnmeasured(input) {
   const root = resolveWorkspaceRoot(input);
   const dataRoot = join(root, "data");
   const diagnostics = [];