filegrc 0.8.0 → 0.9.1

package/src/model-migration.js

@@ -891,7 +891,11 @@ export async function planModelMigration(input = process.cwd(), options = {}) {
   const sourceVersion = String(loaded.workspace?.dataModelVersion || "");
   const requestedTarget = options.targetModelVersion
     ? String(options.targetModelVersion)
-    : sourceVersion === "1" ? V1_TARGET_MODEL_VERSION : sourceVersion === "2" ? "3" : sourceVersion === "3" ? "4" : ACTIVE_MODEL_VERSION;
+    : sourceVersion === "1" ? V1_TARGET_MODEL_VERSION
+      : sourceVersion === "2" ? "3"
+        : sourceVersion === "3" ? "4"
+          : sourceVersion === "4" ? "5"
+            : ACTIVE_MODEL_VERSION;
   if (sourceVersion === requestedTarget) return emptyPlan(sourceVersion, requestedTarget);
   if (sourceVersion === "1" && requestedTarget === "2") {
     return planV1ToV2Migration(input, options);
@@ -902,13 +906,16 @@ export async function planModelMigration(input = process.cwd(), options = {}) {
   if (sourceVersion === "3" && requestedTarget === "4") {
     return planV3ToV4Migration(loaded, options);
   }
-  if (sourceVersion === "4" && requestedTarget === ACTIVE_MODEL_VERSION) {
+  if (sourceVersion === "4" && requestedTarget === "5") {
     return planV4ToV5Migration(loaded, options);
   }
+  if (sourceVersion === "5" && requestedTarget === ACTIVE_MODEL_VERSION) {
+    return planV5ToV6Migration(loaded);
+  }
   if (sourceVersion === "1" && requestedTarget === ACTIVE_MODEL_VERSION) {
     throw new Error(
       "Model v1 workspaces must migrate to model v2 first. "
-      + "Preview and apply `npx filegrc migrate --to-model 2`, then migrate one version at a time through model v5."
+      + "Preview and apply `npx filegrc migrate --to-model 2`, then migrate one version at a time through model v6."
     );
   }
   throw new Error(`Model migration does not support v${sourceVersion} to v${requestedTarget}.`);
@@ -1702,6 +1709,144 @@ async function planV4ToV5Migration(loaded, options = {}) {
   };
 }
 
+async function planV5ToV6Migration(loaded) {
+  if (!loaded.workspace?.id) throw new Error("Model migration requires a valid Workspace record.");
+  const targetModel = loadModel("6");
+  const revisions = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
+  const automatic = [];
+  const reviewRequired = [];
+  const unsupported = [];
+  const missing = [];
+  const manualActions = [];
+  const updates = [];
+  const legacyTrainingIds = [];
+  const removedTrainingScheduleFields = [];
+  const obligations = loaded.resources.filter(({ type }) => type === "obligation");
+
+  for (const original of loaded.resources) {
+    if (original.type === "workspace") {
+      updates.push({ ...original, dataModelVersion: "6" });
+      automatic.push(classifiedChange(
+        "automatic",
+        original.id,
+        "dataModelVersion",
+        "Select model v6 and enable separate Training approval and activation."
+      ));
+      continue;
+    }
+    if (original.type !== "training") continue;
+    const record = { ...original };
+    if (record.approvedByIds) {
+      record.approverIds = record.approvedByIds;
+      delete record.approvedByIds;
+      automatic.push(classifiedChange(
+        "automatic",
+        record.id,
+        "approverIds",
+        "Use the common governed-content approver field."
+      ));
+    }
+    if (record.effectiveContentRevisions) {
+      record.approvedContentRevisions = record.effectiveContentRevisions;
+      delete record.effectiveContentRevisions;
+      automatic.push(classifiedChange(
+        "automatic",
+        record.id,
+        "approvedContentRevisions",
+        "Preserve the exact Training revision previously bound to approval and activation as the approved revision."
+      ));
+    }
+    const removedSchedule = {};
+    for (const field of ["assignmentTrigger", "completionWindowDays"]) {
+      if (record[field] === undefined) continue;
+      removedSchedule[field] = record[field];
+      delete record[field];
+    }
+    if (Object.keys(removedSchedule).length) {
+      const obligationIds = obligations.filter((obligation) => (
+        obligation.templateResourceId === record.id
+        || (obligation.scopeResourceIds || []).includes(record.id)
+      )).map(({ id }) => id);
+      removedTrainingScheduleFields.push({ trainingId: record.id, values: removedSchedule, obligationIds });
+      reviewRequired.push(classifiedChange(
+        "review-required",
+        record.id,
+        "assignmentSchedule",
+        `Training assignment schedules now belong only in Obligations. Confirm the removed ${Object.keys(removedSchedule).join(" and ")} values against ${obligationIds.length ? obligationIds.join(", ") : "a new Step 3 Obligation"}.`
+      ));
+    }
+    if (record.status === "draft" && record.effectiveOn) {
+      record.proposedEffectiveOn = record.effectiveOn;
+      delete record.effectiveOn;
+      reviewRequired.push(classifiedChange(
+        "review-required",
+        record.id,
+        "proposedEffectiveOn",
+        "Keep the draft Training date as proposed until the approved revision is activated in Step 3."
+      ));
+    }
+    if (["active", "retired"].includes(record.status) && record.approvedContentRevisions) {
+      record.activationBasis = "legacy-v5";
+      legacyTrainingIds.push(record.id);
+      reviewRequired.push(classifiedChange(
+        "review-required",
+        record.id,
+        "activationBasis",
+        "Preserve the combined model v5 Training approval and activation as legacy-v5. The migration does not invent a separate activation actor, date, or revision."
+      ));
+    }
+    updates.push(record);
+  }
+
+  const updatedById = new Map(updates.map((record) => [record.id, record]));
+  const migratedRecords = loaded.resources.map((record) => updatedById.get(record.id) || record);
+  await collectTargetValidationActions(loaded, migratedRecords, targetModel, missing, manualActions);
+  for (const item of [...missing, ...manualActions]) {
+    unsupported.push(classifiedChange(
+      "unsupported",
+      item.resourceId,
+      item.field,
+      item.message || `Resolve ${item.field} before applying the model v6 migration.`
+    ));
+  }
+  const ready = unsupported.length === 0;
+  return {
+    schemaVersion: 2,
+    sourceModelVersion: "5",
+    targetModelVersion: "6",
+    ready,
+    missing,
+    conflicts: [],
+    manualActions,
+    classifications: { automatic, reviewRequired, unsupported },
+    notes: reviewRequired,
+    migrationReport: { legacyTrainingIds, removedTrainingScheduleFields },
+    summary: {
+      create: 0,
+      update: updates.length,
+      automatic: automatic.length,
+      reviewRequired: reviewRequired.length,
+      unsupported: unsupported.length
+    },
+    fileDiff: {
+      create: [],
+      update: updates.map((record) => ({
+        type: record.type,
+        id: record.id,
+        before: loaded.resources.find(({ id }) => id === record.id),
+        after: record
+      }))
+    },
+    changes: {
+      create: [],
+      update: updates,
+      expectedRevisions: Object.fromEntries(updates.map(({ id }) => [id, revisions.get(id)])),
+      validateWholeWorkspace: true,
+      targetModelVersion: "6"
+    }
+  };
+}
+
 function normalizeDocumentScopeDecision(value) {
   const candidate = typeof value === "object" && value
     ? value.workflowScope || value.scope

package/src/obligations.js

@@ -14,7 +14,7 @@ import {
 } from "./recurrence.js";
 import { currentCalendarDate, isRfc3339Timestamp } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
-import { obligationGovernedDocuments, obligationProgramStatus } from "./program-lifecycle.js";
+import { obligationGovernedContent, obligationProgramStatus } from "./program-lifecycle.js";
 import { resolveProgram } from "./program.js";
 
 const COMPLETION_DATE_FIELDS = [
@@ -259,7 +259,7 @@ export async function createObligationEvent(input, options) {
   ));
   if (!eventType || templates.length === 0) throw new Error(`No active obligations use event type "${eventType}".`);
   if (templates.some((record) => obligationProgramStatus(record, byId, occurredOn, loaded.model) === "proposed")) {
-    throw new Error(`Event type "${eventType}" still has starter proposals. Make every governing Policy and required governed Document active and effective, then implement at least one linked Control before starting this workflow.`);
+    throw new Error(`Event type "${eventType}" still has starter proposals. Make every governing Policy and required governed-content record active and effective, then implement at least one linked Control before starting this workflow.`);
   }
   if (templates.some((record) => normalizedEventWindow(record.window).precision === "timestamp") && !occurredAt) {
     throw new Error(`Event type "${eventType}" has hour-based deadlines and requires an RFC 3339 occurredAt timestamp.`);
@@ -997,10 +997,10 @@ function obligationActivationDate(obligation, byId, model) {
     .filter((policy) => policy?.type === "policy")
     .map((policy) => policy.effectiveOn)
     .filter(Boolean);
-  const documentDates = obligationGovernedDocuments(obligation, byId, model)
-    .map((document) => document.effectiveOn)
+  const governedContentDates = obligationGovernedContent(obligation, byId, model)
+    .map((record) => record.effectiveOn)
     .filter(Boolean);
-  return [...policyDates, ...documentDates].sort().at(-1) || null;
+  return [...policyDates, ...governedContentDates].sort().at(-1) || null;
 }
 
 function relativeTiming(window, asOf) {

package/src/policy-library/information-security-policy-v2.md

@@ -242,13 +242,13 @@ Reported events receive an owner, assessment, and documented resolution or escal
 
 ## Business Continuity and Disaster Recovery Policy
 
-Each important System records approved recovery priorities and objectives, dependencies, responsible people, alternate communication and access needs, and a backup or alternate recovery approach. Management selects continuity strategies according to service commitments, business impact, data risk, dependencies, and technical capability.
+Each important System records recovery priorities, dependencies, responsible people, alternate communication and access needs, and a backup or alternate recovery approach suited to its commitments, business impact, data risk, dependencies, and technical capability. Numeric recovery targets are required only when an approved customer commitment, included Availability criterion, or management risk decision calls for them.
 
 The Security Incident and Recovery Plan records activation, communication, response, recovery, and return-to-normal responsibilities. Management tests continuity and disaster recovery on the approved schedule, records results and findings, and tracks follow-up work.
 
 ## Backup and Restoration Policy
 
-Important Systems use backups or an approved alternate recovery approach that meets their recovery objectives. Management documents backup or alternate-recovery scope, frequency, retention, encryption and access needs, monitoring, failure response, procedures, and test schedules.
+Important Systems use backups or an approved alternate recovery approach suited to their recovery needs and any approved recovery targets. Management documents backup or alternate-recovery scope, frequency, retention, encryption and access needs, monitoring, failure response, procedures, and test schedules.
 
 Backup or recovery access is limited to authorized people and protected from the failures it is intended to address. Restoration or alternate recovery is validated on the approved schedule and after material change when prior results no longer represent the System. Policy adoption does not assert that every System uses daily backups or a fixed retention period.
 

package/src/policy-library.js

@@ -6,7 +6,7 @@ import { serializeWorkspaceMutation } from "./mutation.js";
 import { resolveDataPath } from "./paths.js";
 import { loadWorkspace } from "./workspace.js";
 
-export const INFORMATION_SECURITY_LIBRARY_PROPOSAL_ID = "consolidated-information-security-policy-v3";
+export const INFORMATION_SECURITY_LIBRARY_PROPOSAL_ID = "consolidated-information-security-policy-v4";
 export const STRONG_AUTHENTICATION_LIBRARY_PROPOSAL_ID = INFORMATION_SECURITY_LIBRARY_PROPOSAL_ID;
 
 const POLICY_ID = "policy-information-security";
@@ -42,28 +42,33 @@ const DOCUMENT_CONTENT_UPDATES = [
     id: "document-data-retention-schedule",
     path: "documents/document-data-retention-schedule.md",
     priorRevision: "45a408e8139bd57f42dda5ca5ae5c8cd4480b4e7bf08834f60058148a3a63475",
-    currentRevision: "d80b99ce53d1012cc169bbbc2afab8d0597bfbe9f30ac0812a8d5bbeb2ed9f90",
+    additionalPriorRevisions: new Set(["d80b99ce53d1012cc169bbbc2afab8d0597bfbe9f30ac0812a8d5bbeb2ed9f90"]),
+    currentRevision: "dd11857ae7d881f176bd93947ef3031c33c75ee41e3c0435198fd60c67a94cf7",
     replacements: [
       ["FileGRC detects the bracketed prompts as approval blockers. Remove each prompt only after replacing it with a reviewed fact.", "Remove each bracketed prompt only after replacing it with a reviewed fact."],
-      ["Record the authority, scope, owner, start date, and release decision outside this public template.", "Record the authority, scope, owner, start date, and release decision in controlled legal-hold records."]
+      ["Record the authority, scope, owner, start date, and release decision outside this public template.", "Record the authority, scope, owner, start date, and release decision in controlled legal-hold records."],
+      ["| Production backups or alternate recovery copies | [Complete before approval: Systems or Components] | [Complete before approval: owner] | Backup or recovery-copy creation | [Confirm or replace proposed default before approval: 30 days, adjusted to approved System recovery objectives] | [Complete before approval: expiration or disposal action] | [Complete before approval: continuity objective or risk decision] |", "| Production backups or alternate recovery copies | [Complete before approval: Systems or Components] | [Complete before approval: owner] | Backup or recovery-copy creation | [Confirm or replace proposed default before approval: 30 days, adjusted to approved System recovery needs] | [Complete before approval: expiration or disposal action] | [Complete before approval: recovery need, commitment, or risk decision] |"]
     ],
-    summary: "Keep FileGRC prompt handling in document guidance and make the Retention Schedule standalone."
+    summary: "Keep FileGRC prompt handling in document guidance, make the Retention Schedule standalone, and avoid assuming numeric recovery objectives."
   },
   {
     id: "document-security-incident-recovery-plan",
     path: "documents/document-security-incident-recovery-plan.md",
     priorRevision: "339ff564fa0ec26503c2498e8d3c44529957113cf782aa03ddb5b4e64c8f0404",
-    currentRevision: "51a19e22f3e0b31196371676297bfa843f96295d2f6c72e81a969ce7bafc36ae",
+    additionalPriorRevisions: new Set(["51a19e22f3e0b31196371676297bfa843f96295d2f6c72e81a969ce7bafc36ae"]),
+    currentRevision: "558b6fa71eaabf4ea3cfe77eaa24f827ad66a19a059085b2090e3c4a4d79cb50",
     replacements: [
       ["Controls, Components, Systems, Obligations, and Evidence hold the actual technical configuration and proof of operation.", "Supporting procedures, system records, and retained evidence document the actual technical configuration and operation."],
       ["If an incident raises a legal, privacy, or insurance question, the incident lead gets suitable advice at that time. FileGRC does not require pre-arranged counsel, in-house counsel, or a standing legal retainer.", "If an incident raises a legal, privacy, or insurance question, the incident lead obtains suitable advice at that time. A pre-arranged counsel relationship or standing legal retainer is required only when management determines that the organization's obligations and risk warrant one."],
       ["[Complete before activation: Link every important System and record its approved recovery time objective, recovery point objective, maximum tolerable downtime, dependencies, owner, and critical customer commitments in the System record.]", "[Complete before activation: Document every important System's approved recovery time objective, recovery point objective, maximum tolerable downtime, dependencies, owner, and critical customer commitments.]"],
+      ["[Complete before activation: Document every important System's approved recovery time objective, recovery point objective, maximum tolerable downtime, dependencies, owner, and critical customer commitments.]", "[Complete before activation: Identify every important System's recovery priority, dependencies, owner, backup or alternate recovery approach, and critical customer commitments. Record numeric recovery targets only when an approved commitment, included Availability criterion, or risk decision requires them.]"],
       ["For each important System, the applicable Control, Component, System, and Obligation records must identify:", "Supporting recovery documentation for each important System must identify:"],
       ["- Restore-validation method and governed schedule", "- Restore-validation method and approved schedule"],
+      ["- Dependencies, fallback paths, and validation steps", "- Dependencies, fallback paths, and validation steps\n- Any recovery targets required by an approved commitment, included Availability criterion, or risk decision"],
       ["[Confirm or replace before activation: The starter proposal for important production data is a daily backup, 30-day retention period, and annual restore validation. Record the approved choice for every important System in its Control, Component, System, Retention Schedule, and Obligation records.]", "[Confirm or replace before activation: The proposed starting point for important production data is a daily backup, 30-day retention period, and annual restore validation. Document the approved choice for every important System in its recovery procedures and the Data Retention Schedule.]"],
       ["on the approved governed schedule", "on the approved schedule"]
     ],
-    summary: "Express incident and recovery requirements as a standalone plan and keep FileGRC record-entry guidance outside it."
+    summary: "Express incident and recovery requirements as a standalone plan, keep FileGRC record-entry guidance outside it, and make numeric recovery targets conditional."
   },
   {
     id: "document-soc2-management-representation",
@@ -108,7 +113,8 @@ const PRIOR_STARTER_POLICY_REVISIONS = new Set([
   "18f5e7b7e417b494a5cd241751269b3aafeb3ad9129002308c84c1c84419ee31",
   "432ba5797c2d23e02a6b09d07f1a33db29337b4bcb3ee7d68ce8495dc7c7c01c",
   "6775e6907c2a094c5f48090b12af14cb78b20d1e45178cbb5d3bf02cabde59c6",
-  "992ef090273ae9bd25e729fe4a7a20817926f345cf7a01f242b877f319c4e342"
+  "992ef090273ae9bd25e729fe4a7a20817926f345cf7a01f242b877f319c4e342",
+  "355cad2754691f7a11ec10ae6ef0a6abeab6c428c51b49d32dfa3c12a2262e96"
 ]);
 
 const CONTROL_UPDATES = [
@@ -325,6 +331,28 @@ const CONTROL_UPDATES = [
     },
     summary: "Add conditional service-health and capacity monitoring without prescribing a monitoring product."
   },
+  {
+    id: "control-backup-restoration",
+    prior: [{
+      statement: "Each important System has backup scope, frequency, retention, monitoring, and restore validation that meet its approved recovery objectives, or a documented alternate recovery approach when backups are not the chosen safeguard.",
+      activity: "Record System recovery objectives and backup or alternate recovery procedures, monitor the chosen safeguards, and validate recovery on the approved schedule."
+    }],
+    next: {
+      statement: "Each important System has risk-based backup or alternate recovery scope, frequency, retention, monitoring, and restore validation suited to its recovery needs and any approved recovery targets.",
+      activity: "Record backup or alternate recovery procedures, monitor the chosen safeguards, and validate recovery on the approved schedule."
+    },
+    summary: "Keep backup and recovery risk-based without requiring numeric recovery targets for Security-only scope."
+  },
+  {
+    id: "control-continuity-exercise",
+    prior: [{
+      activity: "Maintain the plan, contacts, recovery objectives, exercises, results, and follow-up work."
+    }],
+    next: {
+      activity: "Maintain the plan, contacts, recovery priorities, exercises, results, and follow-up work."
+    },
+    summary: "Keep continuity exercises focused on recovery priorities without assuming numeric recovery targets."
+  },
   {
     id: "control-vendor-due-diligence",
     prior: [{
@@ -515,8 +543,11 @@ async function buildPolicyLibraryPlan(loaded) {
     const source = await readResourceSource(loaded, TRAINING_CONTENT_PATH);
     const rawSourceRevision = contentRevision(source);
     const sourceRevision = normalizedTrainingRevision(source, loaded.workspace?.organizationName);
-    if (["active", "retired"].includes(trainingEntry.record.status)) {
-      skipped.push(skippedItem(TRAINING_ID, "adopted", "Active and retired Training content is never changed by a starter-library proposal."));
+    const adoptedStatuses = modelSupports(loaded.model, "governed-training-activation")
+      ? ["approved", "active", "superseded", "retired"]
+      : ["active", "retired"];
+    if (adoptedStatuses.includes(trainingEntry.record.status)) {
+      skipped.push(skippedItem(TRAINING_ID, "adopted", "Approved, active, superseded, and retired Training content is never changed by a starter-library proposal."));
     } else if (sourceRevision === CURRENT_TRAINING_REVISION) {
       skipped.push(skippedItem(TRAINING_ID, "current", "The Security Awareness Training already contains the current starter language."));
     } else if (!PRIOR_TRAINING_REVISIONS.has(sourceRevision)) {
@@ -563,7 +594,8 @@ async function buildPolicyLibraryPlan(loaded) {
       skipped.push(skippedItem(documentUpdate.id, "current", "The governed Document already contains the current standalone starter language."));
       continue;
     }
-    if (sourceRevision !== documentUpdate.priorRevision) {
+    if (sourceRevision !== documentUpdate.priorRevision
+      && !documentUpdate.additionalPriorRevisions?.has(sourceRevision)) {
       skipped.push(skippedItem(documentUpdate.id, "customized", "The governed Document differs from the recognized prior starter, so FileGRC will not rewrite it."));
       continue;
     }

package/src/program-lifecycle.js

@@ -38,6 +38,31 @@ export function governedDocumentIsOperating(document, asOf, model) {
   );
 }
 
+export function governedTrainingIsOperating(training, asOf, model) {
+  if (training?.type !== "training" || training.status !== "active") return false;
+  if (!training.effectiveOn || training.effectiveOn > asOf) return false;
+  if (!modelSupports(model, "governed-training-activation")) return true;
+  if (training.activationBasis === "legacy-v5") {
+    return Boolean(training.approvedOn && training.approvedContentRevisions);
+  }
+  return Boolean(
+    training.activationBasis === "recorded"
+    && training.approvedOn
+    && training.approvedContentRevisions
+    && training.activatedOn
+    && training.activatedOn <= asOf
+    && (training.activatedByIds || []).length
+    && training.activatedContentRevisions
+    && contentRevisionBindingsMatch(training.approvedContentRevisions, training.activatedContentRevisions)
+  );
+}
+
+export function governedContentIsOperating(record, asOf, model) {
+  if (record?.type === "document") return governedDocumentIsOperating(record, asOf, model);
+  if (record?.type === "training") return governedTrainingIsOperating(record, asOf, model);
+  return false;
+}
+
 export function contentRevisionBindingsMatch(left, right) {
   if (!left || !right || Array.isArray(left) || Array.isArray(right)) return false;
   const normalize = (value) => Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
@@ -66,6 +91,19 @@ export function obligationGovernedDocuments(obligation, byId, model) {
     ));
 }
 
+export function obligationGovernedContent(obligation, byId, model) {
+  const documents = obligationGovernedDocuments(obligation, byId, model);
+  if (!modelSupports(model, "governed-training-activation")) return documents;
+  const directIds = [
+    ...(obligation.scopeResourceIds || []),
+    ...(obligation.templateResourceId ? [obligation.templateResourceId] : [])
+  ];
+  const training = [...new Set(directIds)]
+    .map((id) => byId.get(id))
+    .filter((record) => record?.type === "training" && !["superseded", "retired"].includes(record.status));
+  return [...documents, ...training];
+}
+
 function indexRequiredDocumentsByControl(byId, model) {
   const modelVersion = String(model?.modelVersion || "");
   const cached = requiredDocumentsByControlCache.get(byId);
@@ -99,9 +137,9 @@ export function obligationProgramStatus(obligation, byId, asOf, model) {
       && policy.effectiveOn <= asOf;
   });
   if (!policiesReady) return "proposed";
-  const governedDocumentsReady = obligationGovernedDocuments(obligation, byId, model)
-    .every((document) => governedDocumentIsOperating(document, asOf, model));
-  if (!governedDocumentsReady) return "proposed";
+  const governedContentReady = obligationGovernedContent(obligation, byId, model)
+    .every((record) => governedContentIsOperating(record, asOf, model));
+  if (!governedContentReady) return "proposed";
   const controlIds = obligation.controlIds || [];
   if (!controlIds.length) return "accepted";
   return controlIds.some((id) => byId.get(id)?.type === "control" && byId.get(id).status === "implemented")

package/src/program-path.js

@@ -3,7 +3,7 @@ export const RESOURCE_INSTRUCTIONS = {
   person: "Record each person’s actual organizational job title. Keep named program authority, such as CISO, DPO, Policy Owner, or team chair, in dated Appointment records.",
   appointment: "Record one person’s dated appointment to a named organizational or program responsibility. Scope it to the workspace, a team, or the records governed by that appointment.",
   team: "Review the starter Security and Risk Oversight team, including its members and chair. Membership and chairs are authoritative on the Team record.",
-  system: "Start with the complete bounded System management governs or the auditor will examine. Record its purpose, services, boundary, exclusions, Information Types, owners, and continuity objectives.",
+  system: "Start with the complete bounded System management governs or the auditor will examine. Record its purpose, services, boundary, exclusions, Information Types, owners, and any applicable continuity objectives.",
   component: "Add a Component only when it materially delivers a selected System, supports a Control, produces authoritative Evidence, or supports relevant operations. Give every System use a role and rationale.",
   vendor: "Catalog material external provider relationships. Link a supplied Component when it meets the Component inclusion rules, but do not mirror every Vendor into a Component.",
   classification: "Define an ordered information-handling category used by inventory and Evidence Artifacts.",
@@ -12,7 +12,7 @@ export const RESOURCE_INSTRUCTIONS = {
   requirement: "Keep the published criterion as catalog content. Record management applicability and rationale on the selected Program.",
   commitment: "Record supplemental customer promises and service requirements that shape the scope or control design. The Commitment’s systemIds and controlIds are authoritative for what fulfills it.",
   policy: "Tailor each Policy to match what the company is committing to. Clear placeholders, assign an owner and separate approver, then bind approval to the reviewed content. Approval does not prove implementation. Activate the Policy during the Step 3 cutover after reviewing its implementation gaps.",
-  document: "Complete required governed plans and schedules in Step 2, assign an owner and separate approver, and bind approval to the intended values and exact Markdown. Implement the linked requirements and activate that approved revision in Step 3. Prepare audit-specific Documents in Step 5.",
+  document: "Complete required program Documents in Step 2, assign an owner and separate approver, and bind approval to the intended values and exact Markdown. Implement the linked requirements and activate that approved revision in Step 3. Prepare Audit Documents in Step 5.",
   control: "Finish each applicable starter Control with the procedure people follow, its owner, bounded System scope, operating Components, authoritative evidence-source Components, governing Policy and Requirement mappings, and implementation date. Put calendar and event schedules in Obligations.",
   "complementary-control": "Review whether any in-scope Control depends on a customer or carved-out provider action. Record each real dependency, or confirm that the current scope has none.",
   evidence: "Create an Evidence Artifact when a real export, report, screenshot, signed file, or approved external reference exists. Select its authoritative source Component, link the Controls and operating records it supports, retain the fixed artifact or reference, and have another person verify it before audit use.",
@@ -28,7 +28,7 @@ export const RESOURCE_INSTRUCTIONS = {
   "access-grant": "Record each person’s or service account’s access to a Component, including approval, provisioning, changes, and removal.",
   "access-review": "Review access on schedule, record each decision, and assign any access changes that result.",
   "service-account": "Catalog non-human accounts that need separate tracking, including their owner, purpose, System, privilege, and expiry.",
-  training: "Maintain the training content people must complete, along with its audience, timing, and passing requirements.",
+  training: "Review and approve the exact Training content in Step 2, then activate the unchanged revision during Step 3 after its linked Controls and assignment Obligations are ready.",
   attestation: "Record each person’s completion or acknowledgement against the exact policy or training revision.",
   "vulnerability-scan": "Record each required scan, including its scope, timing, result, and evidence.",
   vulnerability: "Track confirmed weaknesses that need separate remediation, acceptance, or closure.",
@@ -98,20 +98,21 @@ export const PROGRAM_PATH = [
   {
     id: "policies",
     number: 2,
-    title: "Approve Policies and Plans",
-    description: "Tailor requirements, intended values, and approvals",
-    summary: "Adapt and independently approve Policies and required governed Documents.",
+    title: "Approve Policies",
+    description: "Review governed content and approvals",
+    summary: "Review and independently approve Policies, program Documents, and Training content.",
     sections: [
-      { id: "library", title: "Policy Library", description: "Review and approve Policy requirements without treating approval as proof of technical implementation.", steps: ["Review Policy Markdown and replace every organization placeholder.", "Confirm the owner, separate approver, audience, review Obligation, and Controls that point to the Policy.", "Record approval against the exact reviewed content. Leave the Policy approved and inactive until the Step 3 implementation cutover."], types: ["policy"], defaultOpen: true },
-      { id: "governed-documents", title: "Governed Plans and Schedules", description: "Complete the intended values in each required program plan or schedule and obtain independent approval of the exact revision before implementation.", steps: ["Review each required plan or schedule and replace every organization placeholder with the intended owner, timing, threshold, scope, or response value.", "Confirm the Document owner, separate approver, linked Controls, and review schedule.", "Record approval and its date against the exact Markdown revision. Leave the Document approved until its linked requirements are implemented in Step 3."], types: [], relatedLinks: [{ type: "document", label: "Governed plans and schedules", href: "#/resources/document?stage=policies&documentScope=program" }], defaultOpen: true }
+      { id: "policy-content", title: "Policies", description: "Review every program Policy, Document, and Training record in one table, then bind independent approval to each exact revision.", steps: ["Review each governed Markdown artifact and replace every organization placeholder.", "Confirm the owner, separate approver, linked Controls, audience, and intended values that apply to each artifact.", "Record approval and its date against the exact revision. Leave approved content inactive until its Step 3 implementation cutover."], types: [], relatedLinks: [{ type: "policy", label: "Policies", href: "#/stage/policies" }], defaultOpen: true }
     ],
-    resourceTypes: ["policy"],
-    supportingResourceTypes: ["document"],
+    resourceTypes: [],
+    supportingResourceTypes: ["policy", "document", "training"],
     commands: [
       "filegrc guide policy --json",
       "filegrc guide document --json",
+      "filegrc guide training --json",
       "filegrc list policy --json",
       "filegrc list document --json",
+      "filegrc list training --json",
       "filegrc get POLICY_ID --mutation"
     ]
   },
@@ -122,15 +123,17 @@ export const PROGRAM_PATH = [
     description: "Finish controls and their evidence sources",
     summary: "Describe each Control and connect its evidence source.",
     sections: [
-      { id: "catalog", title: "Control Catalog", description: "Implement the approved requirements, activate required governed Documents, finish the authoritative evidence sources, then review the approved Policies together at implementation cutover.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components.", "Create or enable every calendar and event schedule as an Obligation. Enabled work remains dormant until its governing Policy is active.", "Confirm each source Component is active, has an evidence-source role and rationale in the Control's System scope, has current access owners, and includes repeatable retrieval instructions in Record Markdown.", "Implement every requirement linked from an approved governed plan or schedule, then activate the unchanged approved Document with a separate activation date and revision.", "Use Review policy activation on the Controls page to inspect each Policy’s planned or partial Controls, inactive governed Documents, missing Components or sources, missing schedules, and unresolved Exceptions.", "Choose the approved Policies that should take effect, set the real effective date, and confirm the Step 3 cutover. You can activate with a documented gap or approved Exception, but Evidence Readiness still requires active and operating Policies and Documents."], types: ["control", "complementary-control"], relatedLinks: [{ type: "document", label: "Activate governed plans and schedules", href: "#/resources/document?stage=controls&documentScope=program" }], defaultOpen: true }
+      { id: "catalog", title: "Control Catalog", description: "Implement approved requirements, configure Obligations, activate approved program content, finish authoritative evidence sources, then activate the Policies at cutover.", steps: ["Open every planned Control and confirm its mappings and operation pattern.", "Write the real procedure in Record Markdown, add bounded System scope, and map the operating and authoritative evidence-source Components.", "Review and enable every calendar and event schedule as an Obligation. Enabled work remains dormant until its governing Policy is active.", "Confirm each source Component is active, has an evidence-source role and rationale in the Control's System scope, has current access owners, and includes repeatable retrieval instructions in Record Markdown.", "Implement every requirement linked from an approved program Document or Training record, then activate the unchanged approved revisions with separate activation dates and bindings.", "Use the activation review to inspect planned or partial Controls, inactive governed content, missing Components or sources, missing schedules, and unresolved Exceptions.", "Choose the approved Policies that should take effect, set the real effective date, and confirm the Step 3 cutover."], types: ["control", "complementary-control", "obligation"], defaultOpen: true }
     ],
-    resourceTypes: ["control", "complementary-control"],
+    resourceTypes: ["control", "complementary-control", "obligation"],
     commands: [
       "filegrc guide control --json",
       "filegrc list control --json",
       "filegrc get CONTROL_ID --mutation",
+      "filegrc guide obligation --json",
+      "filegrc list obligation --json",
       "filegrc review-collection complementary-control --scaffold",
-      "filegrc activate-documents --scaffold",
+      "filegrc activate-content --scaffold",
       "filegrc activate-policies --scaffold",
       "filegrc evidence-map --json",
       "filegrc program-readiness --json"
@@ -144,11 +147,11 @@ export const PROGRAM_PATH = [
     summary: "Complete scheduled and event work. Keep dated proof.",
     sections: [
       { id: "risk", title: "Risk", description: "Maintain the program’s risk assessments and risk register as the service, threats, suppliers, and control needs change.", steps: ["Complete and approve risk assessments on schedule and after material changes.", "Record risks that need treatment, acceptance, or ongoing tracking.", "Add or update controls when the assessment identifies a new or changed response."], types: ["risk-assessment", "risk"], defaultOpen: true },
-      { id: "queue", title: "Work Queue", description: "Complete recurring work, Policy Event tasks, and assigned follow-up within their required windows.", steps: ["Review proposed work while policies are drafts.", "Complete due work within its allowed window and link dated proof.", "Start Policy Events when hiring, departures, incidents, or material changes occur; every other open Action Item appears here automatically."], types: ["obligation", "obligation-event", "data-request"], utility: "obligation-board", defaultOpen: true },
+      { id: "queue", title: "Work Queue", description: "Complete recurring occurrences, Policy Event tasks, and assigned follow-up within their required windows.", steps: ["Complete due work within its allowed window and link dated proof.", "Start Policy Events when hiring, departures, incidents, or material changes occur.", "Resolve every other open Action Item from the same queue."], types: ["obligation-event", "data-request"], utility: "obligation-board", defaultOpen: true },
       { id: "evidence", title: "Evidence Artifacts", description: "Create records only for real exports, reports, screenshots, signed files, or approved external references collected during operation.", steps: ["Create an Evidence Artifact when the artifact exists or an operating record needs fixed supporting proof.", "Select the authoritative source Component, link the Controls and source operating record, and retain the fixed attachment or approved reference.", "Record the collector and Classification, then have another person verify the artifact before audit use."], types: ["evidence"], defaultOpen: true },
       { id: "governance", title: "Governance", description: "Record formal reviews, oversight meetings, and approved policy or control exceptions.", steps: ["Complete scheduled policy reviews and oversight meetings.", "Record decisions, attendees, follow-up work, and evidence.", "Approve time-bound exceptions before the departure begins."], types: ["policy-review", "meeting", "exception"], defaultOpen: false },
       { id: "inventories", title: "Assets and Vendors", description: "Maintain the asset inventory and recurring reviews of supplier relationships during operation.", steps: ["Keep ownership, custody, status, and lifecycle current for important assets.", "Perform vendor reviews on schedule and after material supplier changes.", "Link fixed reports and review evidence to the operating records."], types: ["asset", "vendor-review"], defaultOpen: false },
-      { id: "access-training", title: "Access and Training", description: "Inventory service accounts before recording access decisions, periodic reviews, assignments, and acknowledgements.", steps: ["Catalog service accounts that need separate tracking.", "Preserve access approvals and removals as they occur, then complete periodic access reviews and resolve exceptions.", "Assign training and retain acknowledgement evidence for the exact content revision."], types: ["service-account", "access-grant", "access-review", "training", "attestation"], defaultOpen: false },
+      { id: "access-training", title: "Access and Training Completion", description: "Inventory service accounts and retain access decisions, Training assignments, and acknowledgements produced during operation.", steps: ["Catalog service accounts that need separate tracking.", "Preserve access approvals and removals as they occur, then complete periodic access reviews and resolve exceptions.", "Retain each Training assignment and Attestation against the exact active content revision."], types: ["service-account", "access-grant", "access-review", "attestation"], defaultOpen: false },
       { id: "security", title: "Security Operations", description: "Record vulnerability work, applicable penetration testing, and incident response activity for the period.", steps: ["Retain scan scope, results, vulnerabilities, remediation, and exceptions.", "When the approved applicability review requires penetration testing, record the test and follow-up findings.", "Start the incident workflow when a qualifying event occurs."], types: ["vulnerability-scan", "vulnerability", "penetration-test", "incident"], defaultOpen: false },
       { id: "resilience", title: "Resilience", description: "Preserve proof that backups, restoration, continuity, and incident exercises work as designed.", steps: ["Record backup restoration tests and their results.", "Run continuity and incident exercises on schedule.", "Assign and close follow-up work from failed objectives or lessons learned."], types: ["backup-test", "exercise"], defaultOpen: false },
       { id: "issues", title: "Issues and Remediation", description: "Keep observations in the source report and track only confirmed gaps that need a separate remediation lifecycle.", steps: ["Create a Finding only when a confirmed gap needs its own owner, due date, status, or verified closure.", "Use the Finding itself for straightforward remediation; create Action Items only for separate assigned tasks.", "Work Action Items from Work Queue and close the Finding only after remediation is independently verified."], types: ["finding"], defaultOpen: false }
@@ -156,7 +159,6 @@ export const PROGRAM_PATH = [
     resourceTypes: [
       "risk-assessment",
       "risk",
-      "obligation",
       "obligation-event",
       "data-request",
       "evidence",
@@ -168,7 +170,6 @@ export const PROGRAM_PATH = [
       "service-account",
       "access-grant",
       "access-review",
-      "training",
       "attestation",
       "vulnerability-scan",
       "vulnerability",
@@ -222,7 +223,7 @@ export const PROGRAM_PATH = [
     summary: "Track the CPA engagement, fieldwork, and evidence packet.",
     sections: [
       { id: "engagement", title: "Engagement", description: "Record the actual CPA engagement, formal scope and dates, requests, and management responses.", steps: ["Create the Audit after the CPA firm is engaged.", "Record the firm-agreed type, scope, systems, criteria, and dates.", "Track incoming requests and approved response material."], types: ["audit", "audit-request"], defaultOpen: true },
-      { id: "fieldwork", title: "Fieldwork", description: "Prepare audit-specific Documents, reconcile Type 2 populations, review both evidence paths, support testing, and build the indexed packet.", steps: ["Initialize and complete engagement-specific management Documents and populations.", "Approve and activate each audit-specific Document only when its engagement facts and timing are final.", "Review dated FileGRC operating records and verified Evidence Artifacts for the formal period.", "Reconcile complete populations, link samples, and resolve fieldwork requests and Findings.", "Build the packet from a clean Git revision; it includes FileGRC records, Markdown, Evidence Artifacts, attachments, indexes, history, and checksums."], types: ["audit-population", "control-test"], relatedLinks: [{ type: "document", label: "Audit-specific Documents", href: "#/resources/document?stage=audit&documentScope=audit" }], utility: "audit-packet", defaultOpen: true }
+      { id: "fieldwork", title: "Fieldwork", description: "Prepare Audit Documents, reconcile Type 2 populations, review both evidence paths, support testing, and build the indexed packet.", steps: ["Initialize and complete engagement-specific management Documents and populations.", "Approve and activate each Audit Document only when its engagement facts and timing are final.", "Review dated FileGRC operating records and verified Evidence Artifacts for the formal period.", "Reconcile complete populations, link samples, and resolve fieldwork requests and Findings.", "Build the packet from a clean Git revision; it includes FileGRC records, Markdown, Evidence Artifacts, attachments, indexes, history, and checksums."], types: ["audit-population", "control-test"], relatedLinks: [{ type: "document", label: "Audit Documents", href: "#/resources/document?stage=audit&documentScope=audit" }], utility: "audit-packet", defaultOpen: true }
     ],
     resourceTypes: ["audit", "audit-request", "audit-population", "control-test"],
     utilities: [