filegrc 0.8.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/cli.js

@@ -16,7 +16,14 @@ import {
   scaffoldCollectionReview
 } from "./collection-review.js";
 import { buildWorkspace } from "./build.js";
-import { activateDocuments, planDocumentActivation, scaffoldDocumentActivation } from "./document-activation.js";
+import {
+  activateDocuments,
+  activateGovernedContent,
+  planDocumentActivation,
+  planGovernedContentActivation,
+  scaffoldDocumentActivation,
+  scaffoldGovernedContentActivation
+} from "./document-activation.js";
 import { generateEvidencePacket, prepareEvidencePacket } from "./evidence-packet.js";
 import {
   addEvidenceAttachment,
@@ -184,7 +191,9 @@ export async function runCli(argv = process.argv.slice(2)) {
   }
   if (command === "migrate") {
     const targetModel = String(flags["to-model"] || "");
-    if (!["2", "3", "4", "5"].includes(targetModel)) throw new Error("Pass --to-model 2, --to-model 3, --to-model 4, or --to-model 5.");
+    if (!SUPPORTED_MODEL_VERSIONS.filter((version) => version !== "1").includes(targetModel)) {
+      throw new Error(`Pass --to-model ${SUPPORTED_MODEL_VERSIONS.filter((version) => version !== "1").join(", --to-model ")}.`);
+    }
     const migrationDecisions = flags.decisions
       ? JSON.parse(await readFile(resolve(String(flags.decisions)), "utf8"))
       : undefined;
@@ -644,6 +653,30 @@ export async function runCli(argv = process.argv.slice(2)) {
     else console.log(`Activated ${result.documentIds.length} governed Documents effective ${result.effectiveOn}.`);
     return result;
   }
+  if (command === "activate-content") {
+    if (flags.scaffold) {
+      const result = await scaffoldGovernedContentActivation(root, { programId: flags.program });
+      console.log(JSON.stringify(result, null, 2));
+      return result;
+    }
+    const payload = await readSetupPayload(positionals[0]);
+    const options = {
+      ...payload,
+      resourceIds: flags.resource ? String(flags.resource).split(",").filter(Boolean) : payload.resourceIds,
+      activatedByIds: flags["activated-by"] ? String(flags["activated-by"]).split(",").filter(Boolean) : payload.activatedByIds,
+      activatedOn: flags["activated-on"] || payload.activatedOn,
+      effectiveOn: flags["effective-on"] || payload.effectiveOn,
+      programId: flags.program || payload.programId,
+      confirmed: flags.yes === true
+    };
+    const result = flags.preview
+      ? await planGovernedContentActivation(root, options)
+      : await withWorkflowDelta(root, () => activateGovernedContent(root, options));
+    if (flags.json) console.log(JSON.stringify(result, null, 2));
+    else if (flags.preview) console.log(`Governed-content activation preview: ${result.resourceIds.length} records effective ${result.effectiveOn}.`);
+    else console.log(`Activated ${result.resourceIds.length} governed-content records effective ${result.effectiveOn}.`);
+    return result;
+  }
   if (command === "policy-library") {
     if (flags.yes && !flags.accept) {
       throw new Error("Pass --accept <proposal-id> with --yes after reviewing the policy-library diff.");
@@ -1082,7 +1115,7 @@ Usage:
   filegrc build [root] [--output .filegrc/site]
   filegrc validate [root] [--json]
   filegrc model [--json|--write-docs|--check-docs]
-  filegrc migrate --to-model <2|3|4|5> [--preview] [--decisions path] [--job-title text] [--starts-on YYYY-MM-DD] [--yes] [--json]
+  filegrc migrate --to-model <2|3|4|5|6> [--preview] [--decisions path] [--job-title text] [--starts-on YYYY-MM-DD] [--yes] [--json]
   filegrc describe <resource-type>
   filegrc types [--json]
   filegrc guide [resource-type] [--id resource-id] [--program program-id] [--json]
@@ -1105,6 +1138,7 @@ Usage:
   filegrc review-applicability [--scaffold --type requirement|control|commitment|complementary-control] [decisions.json|-] [--preview|--yes] [--json]
   filegrc review-collection <resource-type> [--scaffold | review.json|-] [--preview|--yes] [--json]
   filegrc activate-policies [--scaffold | activation.json|-] [--effective-on YYYY-MM-DD] [--preview|--yes] [--json]
+  filegrc activate-content [--scaffold | activation.json|-] [--program id] [--activated-by person-id] [--activated-on YYYY-MM-DD] [--effective-on YYYY-MM-DD] [--preview|--yes] [--json]
   filegrc activate-documents [--scaffold | activation.json|-] [--program id | --audit id] [--activated-by person-id] [--activated-on YYYY-MM-DD] [--effective-on YYYY-MM-DD] [--preview|--yes] [--json]
   filegrc policy-library [--json | --accept proposal-id --proposal-revision revision --yes]
   filegrc trigger <event-type> (--occurred-on YYYY-MM-DD | --occurred-at RFC3339) [--risk-level normal|high] [--subject resource-id[,resource-id]] [--title text] [--json]
@@ -1179,7 +1213,8 @@ Upgrade a workspace through an explicit, reviewable model boundary. Model v1
 workspaces migrate to v2 first. Continue one version at a time through v${ACTIVE_MODEL_VERSION}. v4 separates
 the repository Workspace, management Program, bounded Systems, operational Components,
 specific Assets, Vendors, normalized information, and Evidence Artifacts. Model v5 separates
-Document approval from activation and records program-versus-engagement scope. v3 migration
+Document approval from activation and records program-versus-engagement scope. Model v6 gives
+Training the same approval and activation split and moves its schedule into Obligations. v3 migration
 previews may require a decisions JSON file for ambiguous old Systems. v3 still creates planned
 core Appointments, removal of obsolete manual page state, classified review work,
 and dataModelVersion changed last. The command writes no Git commit.
@@ -1282,7 +1317,7 @@ Options:
   filegrc activate-documents --scaffold [--program id | --audit id]
   filegrc activate-documents <activation.json|-> [--audit id] [--activated-by person-id] [--activated-on YYYY-MM-DD] [--effective-on YYYY-MM-DD] [--preview|--yes] [--json]
 
-Activate required governed plans and schedules in Step 3 after their linked
+Activate required program Documents in Step 3 after their linked
 Controls are implemented, or activate engagement Documents in Step 5 after
 their audit-specific facts are complete. Approval, activation, and effective
 dates remain separate, and activation binds its own exact Markdown revision.
@@ -1301,6 +1336,30 @@ Options:
   --help                 Show this help`);
     return;
   }
+  if (command === "activate-content") {
+    console.log(`Usage:
+  filegrc activate-content --scaffold [--program id]
+  filegrc activate-content <activation.json|-> [--resource id] [--activated-by person-id] [--activated-on YYYY-MM-DD] [--effective-on YYYY-MM-DD] [--preview|--yes] [--json]
+
+Activate approved program Documents and Training in Step 3 after their linked
+Controls are implemented and Training has an enabled assignment Obligation.
+Approval, activation, and effective dates remain separate, and activation binds
+the exact approved Markdown revision.
+
+Options:
+  --scaffold             Print the ready activation payload without writing
+  --program <id>         Program to assess when more than one active Program exists
+  --resource <id>        Comma-separated Document or Training IDs
+  --activated-by <id>    Active Person who performs the activation
+  --activated-on <date>  Actual activation date, which must be today
+  --effective-on <date>  Effective date on or after activation
+  --preview              Validate and show the atomic updates without writing
+  --yes                  Confirm and apply the reviewed activation
+  --json                 Print the result as JSON
+  --root <path>          Workspace path
+  --help                 Show this help`);
+    return;
+  }
   if (command === "policy-library") {
     console.log(`Usage:
   filegrc policy-library [--json]
@@ -1347,7 +1406,7 @@ function agentOverview(model) {
     build: "filegrc build [root]",
     validate: "filegrc validate [root] --json",
     model: "filegrc model --json",
-    migrate: "filegrc migrate --to-model 5 --preview --json",
+    migrate: "filegrc migrate --to-model 6 --preview --json",
     describe: "filegrc describe <resource-type>",
     types: "filegrc types --json",
     guide: "filegrc guide [resource-type] --json",
@@ -1367,6 +1426,7 @@ function agentOverview(model) {
     externalReviewerSetup: "filegrc external-reviewer-setup [--scaffold | <reviewer.json|-> --preview] --json",
     policyActivation: "filegrc activate-policies [--scaffold | <activation.json|-> --preview] --json",
     documentActivation: "filegrc activate-documents [--scaffold | <activation.json|-> --preview] --json",
+    governedContentActivation: "filegrc activate-content [--scaffold | <activation.json|-> --preview] --json",
     nextAuditCycle: "filegrc next-audit-cycle <prior-audit-id> --start <date> --end <date> --preview --json",
     reviewApplicability: "filegrc review-applicability <decisions.json|-> --preview --json",
     reviewCollection: "filegrc review-collection <resource-type> [--scaffold | <review.json|-> --preview] --json",
@@ -1520,6 +1580,7 @@ function buildProgramPathResult(model, readiness, auditReadiness) {
     operating: readiness.operating,
     policyActivations: readiness.policyActivations,
     documentActivations: readiness.documentActivations,
+    trainingActivations: readiness.trainingActivations,
     policyLibraryProposals: readiness.policyLibraryProposals,
     stages
   };
@@ -1730,6 +1791,14 @@ function summarizeProgramReadiness(result) {
       label,
       gapCount
     })),
+    trainingActivations: result.trainingActivations.map(({ trainingId, title, state, label, gapCount, assignmentScheduled }) => ({
+      trainingId,
+      title,
+      state,
+      label,
+      gapCount,
+      assignmentScheduled
+    })),
     policyLibraryProposals: result.policyLibraryProposals,
     unresolvedOwnership: {
       count: unresolvedOwnership.length,

package/src/document-activation.js

@@ -1,4 +1,4 @@
-import { applyDocumentActivationBatch, contentRevision } from "./files.js";
+import { applyDocumentActivationBatch, applyGovernedContentActivationBatch, contentRevision } from "./files.js";
 import { serializeWorkspaceMutation } from "./mutation.js";
 import { modelSupports } from "../model/index.js";
 import { assessAuditDocumentActivations } from "./audit-preparation.js";
@@ -10,16 +10,16 @@ import { loadWorkspace } from "./workspace.js";
 export async function scaffoldDocumentActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
   requireDocumentLifecycle(loaded);
-  const candidates = await activationCandidates(loaded, options);
+  const candidates = await activationCandidates(loaded, { ...options, documentsOnly: true });
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
   const today = currentCalendarDate(loaded.workspace.timezone);
   return {
-    documentIds: candidates.map(({ documentId }) => documentId),
+    documentIds: candidates.filter(({ resourceType }) => resourceType === "document").map(({ resourceId }) => resourceId),
     ...(options.auditId ? { auditId: options.auditId, workflowScope: "engagement" } : { workflowScope: "program" }),
     activatedByIds: [],
     activatedOn: today,
     effectiveOn: today,
-    expectedRevisions: Object.fromEntries(candidates.map(({ documentId }) => [documentId, revisionById.get(documentId)])),
+    expectedRevisions: Object.fromEntries(candidates.map(({ resourceId }) => [resourceId, revisionById.get(resourceId)])),
     confirmed: false
   };
 }
@@ -27,8 +27,8 @@ export async function scaffoldDocumentActivation(input = process.cwd(), options
 export async function planDocumentActivation(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
   requireDocumentLifecycle(loaded);
-  const documentIds = [...new Set((options.documentIds || []).map(String))];
-  if (!documentIds.length) throw new Error("Document activation needs at least one approved governed Document.");
+  const resourceIds = [...new Set((options.resourceIds || options.documentIds || []).map(String))];
+  if (!resourceIds.length) throw new Error("Governed-content activation needs at least one approved program Document or Training record.");
   const activatedByIds = [...new Set((options.activatedByIds || []).map(String))];
   if (!activatedByIds.length) throw new Error("Document activation needs the Person who performed the activation.");
   const activatedOn = String(options.activatedOn || "").trim();
@@ -44,11 +44,12 @@ export async function planDocumentActivation(input = process.cwd(), options = {}
   }
   const expectedRevisions = options.expectedRevisions || {};
   if (Array.isArray(expectedRevisions) || !expectedRevisions || typeof expectedRevisions !== "object") {
-    throw new Error("Document activation expected revisions must be keyed by Document ID.");
+    throw new Error("Governed-content activation expected revisions must be keyed by resource ID.");
   }
   const workflowScope = options.auditId ? "engagement" : "program";
+  const governedContentOperation = workflowScope === "program" && options.resourceIds !== undefined;
   const candidates = await activationCandidates(loaded, options);
-  const assessmentById = new Map(candidates.map((item) => [item.documentId, item]));
+  const assessmentById = new Map(candidates.map((item) => [item.resourceId, item]));
   const entryById = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
   const invalidActivatorIds = activatedByIds.filter((id) => {
     const person = entryById.get(id)?.record;
@@ -57,26 +58,28 @@ export async function planDocumentActivation(input = process.cwd(), options = {}
   if (invalidActivatorIds.length) {
     throw new Error(`Document activation needs active People as activators: ${invalidActivatorIds.join(", ")}.`);
   }
-  const update = documentIds.map((documentId) => {
-    const entry = entryById.get(documentId);
-    if (!entry || entry.record.type !== "document") throw new Error(`Document "${documentId}" was not found.`);
+  const update = resourceIds.map((resourceId) => {
+    const entry = entryById.get(resourceId);
+    const allowedTypes = governedContentOperation ? ["document", "training"] : ["document"];
+    if (!entry || !allowedTypes.includes(entry.record.type)) throw new Error(`Governed content "${resourceId}" was not found in the ${workflowScope} workflow.`);
+    const resourceTitle = loaded.model.resources[entry.record.type].title;
     if (entry.record.status !== "approved") {
-      throw new Error(`Document "${documentId}" must be independently approved before its separate ${workflowScope === "engagement" ? "Step 5" : "Step 3"} activation.`);
+      throw new Error(`${resourceTitle} "${resourceId}" must be independently approved before its separate ${workflowScope === "engagement" ? "Step 5" : "Step 3"} activation.`);
     }
-    if (entry.record.workflowScope !== workflowScope) {
-      throw new Error(`Document "${documentId}" belongs to the ${entry.record.workflowScope} workflow, not ${workflowScope}.`);
+    if (entry.record.type === "document" && entry.record.workflowScope !== workflowScope) {
+      throw new Error(`Document "${resourceId}" belongs to the ${entry.record.workflowScope} workflow, not ${workflowScope}.`);
     }
-    const assessment = assessmentById.get(documentId);
+    const assessment = assessmentById.get(resourceId);
     if (assessment?.state !== "ready-to-activate") {
       const missing = assessment?.missingImplementationControlIds || [];
       throw new Error(
         missing.length
-          ? `Document "${documentId}" cannot be activated until linked Controls are implemented: ${missing.join(", ")}.`
-          : `Document "${documentId}" is not ready for ${workflowScope === "engagement" ? "Step 5" : "Step 3"} activation.`
+          ? `${resourceTitle} "${resourceId}" cannot be activated until linked Controls are implemented: ${missing.join(", ")}.`
+          : `${resourceTitle} "${resourceId}" is not ready for ${workflowScope === "engagement" ? "Step 5" : "Step 3"} activation.`
       );
     }
-    if (!/^[a-f0-9]{64}$/.test(expectedRevisions[documentId] || "")) {
-      throw new Error(`Document activation needs the current record revision for "${documentId}". Regenerate the activation review and try again.`);
+    if (!/^[a-f0-9]{64}$/.test(expectedRevisions[resourceId] || "")) {
+      throw new Error(`Governed-content activation needs the current record revision for "${resourceId}". Regenerate the activation review and try again.`);
     }
     const record = {
       ...entry.record,
@@ -91,16 +94,18 @@ export async function planDocumentActivation(input = process.cwd(), options = {}
     return record;
   });
   return {
-    operation: "document-activation",
+    operation: governedContentOperation ? "governed-content-activation" : "document-activation",
     workflowScope,
     ...(options.auditId ? { auditId: options.auditId } : {}),
-    documentIds,
+    resourceIds,
+    documentIds: update.filter(({ type }) => type === "document").map(({ id }) => id),
+    trainingIds: update.filter(({ type }) => type === "training").map(({ id }) => id),
     activatedByIds,
     activatedOn,
     effectiveOn,
     changes: {
       update,
-      expectedRevisions: Object.fromEntries(documentIds.map((documentId) => [documentId, expectedRevisions[documentId]])),
+      expectedRevisions: Object.fromEntries(resourceIds.map((resourceId) => [resourceId, expectedRevisions[resourceId]])),
       validateWholeWorkspace: true
     }
   };
@@ -111,21 +116,52 @@ async function activationCandidates(loaded, options) {
     return (await assessAuditDocumentActivations(loaded, {
       auditId: options.auditId,
       asOf: currentCalendarDate(loaded.workspace.timezone)
-    })).filter(({ state }) => state === "ready-to-activate");
+    })).filter(({ state }) => state === "ready-to-activate")
+      .map((item) => ({ ...item, resourceType: "document", resourceId: item.documentId }));
   }
   const readiness = await assessProgramReadiness(loaded, { programId: options.programId });
-  return readiness.documentActivations.filter(({ state }) => state === "ready-to-activate");
+  return [
+    ...readiness.documentActivations.map((item) => ({ ...item, resourceType: "document", resourceId: item.documentId })),
+    ...(!options.documentsOnly ? (readiness.trainingActivations || []).map((item) => ({ ...item, resourceType: "training", resourceId: item.trainingId })) : [])
+  ].filter(({ state }) => state === "ready-to-activate");
 }
 
 export async function activateDocuments(input = process.cwd(), options = {}) {
   if (options.confirmed !== true) throw new Error("Review the governed Document activation and confirm the write.");
   return serializeWorkspaceMutation(input, async (root) => {
     const plan = await planDocumentActivation(root, options);
-    const result = await applyDocumentActivationBatch(root, plan.changes);
+    const result = plan.operation === "governed-content-activation"
+      ? await applyGovernedContentActivationBatch(root, plan.changes)
+      : await applyDocumentActivationBatch(root, plan.changes);
     return { ...plan, result };
   });
 }
 
+export async function scaffoldGovernedContentActivation(input = process.cwd(), options = {}) {
+  const loaded = await loadWorkspace(input);
+  requireDocumentLifecycle(loaded);
+  if (!modelSupports(loaded.model, "governed-training-activation")) {
+    throw new Error("Unified governed-content activation requires a model v6 workspace.");
+  }
+  const candidates = await activationCandidates(loaded, { ...options, auditId: undefined });
+  const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
+  const today = currentCalendarDate(loaded.workspace.timezone);
+  return {
+    resourceIds: candidates.map(({ resourceId }) => resourceId),
+    documentIds: candidates.filter(({ resourceType }) => resourceType === "document").map(({ resourceId }) => resourceId),
+    trainingIds: candidates.filter(({ resourceType }) => resourceType === "training").map(({ resourceId }) => resourceId),
+    workflowScope: "program",
+    activatedByIds: [],
+    activatedOn: today,
+    effectiveOn: today,
+    expectedRevisions: Object.fromEntries(candidates.map(({ resourceId }) => [resourceId, revisionById.get(resourceId)])),
+    confirmed: false
+  };
+}
+
+export const planGovernedContentActivation = planDocumentActivation;
+export const activateGovernedContent = activateDocuments;
+
 function requireDocumentLifecycle(loaded) {
   if (!modelSupports(loaded.model, "governed-document-activation")) {
     throw new Error("Separate governed Document approval and activation requires a model v5 workspace.");

package/src/files.js

@@ -211,6 +211,12 @@ export async function applyDocumentActivationBatch(input, changes) {
   ));
 }
 
+export async function applyGovernedContentActivationBatch(input, changes) {
+  return serializeWorkspaceMutation(input, (root) => (
+    applyResourceBatchUnlocked(root, changes, "governed-content-activation")
+  ));
+}
+
 export async function applyModelMigrationBatch(input, changes) {
   return serializeWorkspaceMutation(input, (root) => (
     applyResourceBatchUnlocked(root, changes, "model-migration")
@@ -270,10 +276,10 @@ async function applyResourceBatchUnlocked(input, changes = {}, lifecycleOperatio
     throw new Error("The model-migration lifecycle operation requires a cross-model resource batch.");
   }
   if (
-    lifecycleOperation === "document-activation"
+    ["document-activation", "governed-content-activation"].includes(lifecycleOperation)
     && (targetModelVersion || changes.validateWholeWorkspace !== true)
   ) {
-    throw new Error("The document-activation lifecycle operation requires same-model whole-workspace validation.");
+    throw new Error("The governed-content activation lifecycle operation requires same-model whole-workspace validation.");
   }
   const writeModel = targetModelVersion ? loadModel(targetModelVersion) : loaded.model;
   const deferValidation = workspaceValidationDeferred();
@@ -347,14 +353,14 @@ async function applyResourceBatchUnlocked(input, changes = {}, lifecycleOperatio
     const nextRecord = hasContentUpdate
       ? await prepareApprovalBinding(loaded, record, recordContentWrites, existing.record)
       : record;
-    assertDocumentLifecycleMutation(existing.record, nextRecord, loaded.model, lifecycleOperation);
+    assertGovernedContentLifecycleMutation(existing.record, nextRecord, loaded.model, lifecycleOperation);
     writes.push({ operation: path === previousPath ? "update" : "move-update", path, previousPath, record: nextRecord, previous, fileMode: mode });
   }
   for (const resourceId of Object.keys(contentUpdates)) {
     if (preparedContentIds.has(resourceId)) continue;
     const existing = existingById.get(resourceId);
     if (!existing) throw new Error(`Resource "${resourceId}" was not found.`);
-    if (approvalBound(existing.record)) {
+    if (approvalBound(existing.record, loaded.model)) {
       throw new Error(`Batch content for approved or active resource "${resourceId}" needs a matching resource update and validation of its approval binding.`);
     }
     contentWrites.push(...await prepareContentWrites(loaded, existing.record, contentUpdates[resourceId], {
@@ -607,7 +613,7 @@ async function updateResourceUnlocked(input, type, id, record, options) {
   });
   const existing = loaded.entries.find(({ record: candidate }) => candidate.id === id)?.record;
   const nextRecord = await prepareApprovalBinding(loaded, record, contentWrites, existing);
-  assertDocumentLifecycleMutation(existing, nextRecord, loaded.model, null);
+  assertGovernedContentLifecycleMutation(existing, nextRecord, loaded.model, null);
   try {
     for (const item of contentWrites) await writeTextAtomic(item.path, item.source);
     await writeAtomic(path, nextRecord);
@@ -820,13 +826,16 @@ async function prepareApprovalBinding(loaded, record, contentWrites, previousRec
   const bindingFields = contentBindingFields(record, loaded.model);
   if (!bindingFields.length) return record;
   if (
-    record.type === "document"
-    && modelSupports(loaded.model, "governed-document-activation")
+    (
+      record.type === "document" && modelSupports(loaded.model, "governed-document-activation")
+      || record.type === "training" && modelSupports(loaded.model, "governed-training-activation")
+    )
     && record.status === "active"
     && previousRecord?.status !== "active"
   ) {
-    const step = documentIsAuditSpecific(record, loaded.model) ? "Step 5" : "Step 3";
-    throw new Error(`Document "${record.id}" must use the dedicated ${step} Document activation operation after approval.`);
+    const step = record.type === "document" && documentIsAuditSpecific(record, loaded.model) ? "Step 5" : "Step 3";
+    const title = getResourceDefinition(loaded.model, record.type).title;
+    throw new Error(`${title} "${record.id}" must use the dedicated ${step} ${title} activation operation after approval.`);
   }
   const nextRecord = structuredClone(record);
   const proposed = new Map(contentWrites.map((item) => [item.dataRelativePath, item.source]));
@@ -861,14 +870,19 @@ async function prepareApprovalBinding(loaded, record, contentWrites, previousRec
   return nextRecord;
 }
 
-function assertDocumentLifecycleMutation(previousRecord, nextRecord, model, lifecycleOperation) {
+function assertGovernedContentLifecycleMutation(previousRecord, nextRecord, model, lifecycleOperation) {
   if (lifecycleOperation === "model-migration") return;
+  const governedTraining = previousRecord?.type === "training"
+    && nextRecord?.type === "training"
+    && modelSupports(model, "governed-training-activation");
+  const governedDocument = previousRecord?.type === "document"
+    && nextRecord?.type === "document"
+    && modelSupports(model, "governed-document-activation");
   if (
     !previousRecord
-    || previousRecord.type !== "document"
-    || nextRecord?.type !== "document"
-    || !modelSupports(model, "governed-document-activation")
+    || (!governedDocument && !governedTraining)
   ) return;
+  const title = getResourceDefinition(model, nextRecord.type).title;
   const approvedStatuses = new Set(["approved", "active", "superseded", "retired"]);
   const activatedStatuses = new Set(["active", "superseded", "retired"]);
   if (approvedStatuses.has(previousRecord.status) && approvedStatuses.has(nextRecord.status)) {
@@ -876,7 +890,7 @@ function assertDocumentLifecycleMutation(previousRecord, nextRecord, model, life
       "approverIds",
       "approvedOn",
       "approvedContentRevisions"
-    ], "approval");
+    ], "approval", title);
   }
   if (activatedStatuses.has(previousRecord.status) && activatedStatuses.has(nextRecord.status)) {
     assertLifecycleFieldsUnchanged(previousRecord, nextRecord, [
@@ -885,26 +899,26 @@ function assertDocumentLifecycleMutation(previousRecord, nextRecord, model, life
       "activatedOn",
       "activatedContentRevisions",
       "effectiveOn"
-    ], "activation");
+    ], "activation", title);
   }
   if (
     nextRecord.status === "active"
     && previousRecord.status !== "active"
-    && lifecycleOperation !== "document-activation"
+    && !["document-activation", "governed-content-activation"].includes(lifecycleOperation)
   ) {
-    const step = documentIsAuditSpecific(nextRecord, model) ? "Step 5" : "Step 3";
-    throw new Error(`Document "${nextRecord.id}" must use the dedicated ${step} Document activation operation after approval.`);
+    const step = governedDocument && documentIsAuditSpecific(nextRecord, model) ? "Step 5" : "Step 3";
+    throw new Error(`${title} "${nextRecord.id}" must use the dedicated ${step} ${title} activation operation after approval.`);
   }
 }
 
-function assertLifecycleFieldsUnchanged(previousRecord, nextRecord, fields, eventLabel) {
+function assertLifecycleFieldsUnchanged(previousRecord, nextRecord, fields, eventLabel, resourceTitle) {
   const changed = fields.filter((field) => (
     JSON.stringify(previousRecord[field] ?? null) !== JSON.stringify(nextRecord[field] ?? null)
   ));
   if (!changed.length) return;
   throw new Error(
-    `Document "${nextRecord.id}" ${eventLabel} facts are immutable after the event: ${changed.join(", ")}. `
-    + `Move the Document back to ${eventLabel === "approval" ? "draft" : "approved"} and record a new lifecycle event.`
+    `${resourceTitle} "${nextRecord.id}" ${eventLabel} facts are immutable after the event: ${changed.join(", ")}. `
+    + `Move the ${resourceTitle} back to ${eventLabel === "approval" ? "draft" : "approved"} and record a new lifecycle event.`
   );
 }
 
@@ -940,13 +954,15 @@ async function prepareAttestationBinding(loaded, record, previousRecord = null)
   return nextRecord;
 }
 
-function approvalBound(record) {
+function approvalBound(record, model) {
   if (!record || !["policy", "document", "training"].includes(record.type)) return false;
   const statuses = record.type === "policy"
     ? ["approved", "active", "superseded", "retired"]
     : record.type === "document"
       ? ["approved", "active", "superseded", "retired"]
-      : ["active", "retired"];
+      : modelSupports(model || 0, "governed-training-activation")
+        ? ["approved", "active", "superseded", "retired"]
+        : ["active", "retired"];
   return statuses.includes(record.status);
 }
 
@@ -955,7 +971,7 @@ function contentBindingFields(record, model) {
   if (["policy", "document"].includes(record?.type)) {
     fields.push({
       field: "approvedContentRevisions",
-      bound: approvalBound,
+      bound: (candidate) => approvalBound(candidate, model),
       label: record.type === "policy" ? "approve or activate" : "approve"
     });
   }
@@ -970,7 +986,20 @@ function contentBindingFields(record, model) {
     });
   }
   if (record?.type === "training" && model.resources.training?.fields?.effectiveContentRevisions) {
-    fields.push({ field: "effectiveContentRevisions", bound: approvalBound, label: "approve or activate" });
+    fields.push({ field: "effectiveContentRevisions", bound: (candidate) => approvalBound(candidate, model), label: "approve or activate" });
+  }
+  if (record?.type === "training" && model.resources.training?.fields?.approvedContentRevisions) {
+    fields.push({ field: "approvedContentRevisions", bound: (candidate) => approvalBound(candidate, model), label: "approve" });
+  }
+  if (record?.type === "training" && model.resources.training?.fields?.activatedContentRevisions) {
+    fields.push({
+      field: "activatedContentRevisions",
+      bound: (candidate) => (
+        ["active", "superseded", "retired"].includes(candidate?.status)
+        && candidate.activationBasis === "recorded"
+      ),
+      label: "activate"
+    });
   }
   return fields;
 }

package/src/index.js

@@ -54,7 +54,14 @@ export { generateModelDocumentation } from "./model-docs.js";
 export { renderMarkdown } from "./markdown.js";
 export { migrateModel, planModelMigration } from "./model-migration.js";
 export { activatePolicies, planPolicyActivation, scaffoldPolicyActivation } from "./policy-activation.js";
-export { activateDocuments, planDocumentActivation, scaffoldDocumentActivation } from "./document-activation.js";
+export {
+  activateDocuments,
+  activateGovernedContent,
+  planDocumentActivation,
+  planGovernedContentActivation,
+  scaffoldDocumentActivation,
+  scaffoldGovernedContentActivation
+} from "./document-activation.js";
 export {
   applyPolicyLibraryUpgrade,
   assessPolicyLibraryUpgrades,