filegrc 0.9.2 → 0.11.0

package/src/obligations.js

@@ -37,6 +37,11 @@ const COMPLETION_TIMESTAMP_FIELDS = [
   "deprovisionedOn"
 ];
 const MAX_PLANNED_ITEMS = 10_000;
+const SCAFFOLDED_COMPLETION_TYPES = new Set([
+  "access-review", "attestation", "backup-test", "control-activity", "control-test",
+  "evidence", "exercise", "meeting", "penetration-test", "policy-review",
+  "risk-assessment", "vendor-review", "vulnerability-scan"
+]);
 
 export function planObligations(resources, options = {}) {
   const records = resources.map((item) => item?.record ?? item).filter(Boolean);
@@ -73,7 +78,7 @@ export function planObligations(resources, options = {}) {
   };
 
   for (const obligation of obligations) {
-    const activity = obligationActivity(model, obligation.activityType);
+    const activity = obligationActivity(model, obligation);
     const expectedCompletionTypes = activity.completionResourceTypes;
     const programStatus = obligationProgramStatus(obligation, byId, asOf, model);
     if (obligation.recurrence?.mode === "event" && obligation.recurrence.eventType) {
@@ -101,7 +106,7 @@ export function planObligations(resources, options = {}) {
         eventRiskLevels: obligation.eventRiskLevels || [],
         templateResourceId: obligation.templateResourceId || null,
         completionResourceTypes: expectedCompletionTypes,
-        completionType: activity.completionType,
+        completionType: preferredCompletionType(activity, obligation, byId),
         completionProfile: activity.completionProfile || null,
         programStatus,
         window: normalizedEventWindow(obligation.window)
@@ -155,7 +160,7 @@ export function planObligations(resources, options = {}) {
         controlIds: obligation.controlIds || [],
         scopeResourceIds: obligation.scopeResourceIds || [],
         completionResourceTypes: expectedCompletionTypes,
-        completionType: activity.completionType,
+        completionType: preferredCompletionType(activity, obligation, byId),
         completionProfile: activity.completionProfile || null,
         completionResourceIds: completions.map((record) => record.id),
         status,
@@ -313,6 +318,7 @@ export async function completeObligationOccurrence(input, options) {
   ));
   if (!obligation) throw new Error(`Obligation "${options?.obligationId ?? ""}" was not found.`);
   assertExpectedCompletionType(obligation, options?.record, loaded.model);
+  assertAttestationCompletionScope(obligation, options.record, loaded.resources);
   return createResourceAndLink(loaded.root, options.record, {
     type: "obligation",
     id: obligation.id,
@@ -342,8 +348,11 @@ export async function scaffoldObligationCompletion(input, options = {}) {
   const item = action
     ? plannedActionForScaffold(loaded, action, completedOn)
     : plannedOccurrenceForScaffold(loaded, obligation, options.windowStart, completedOn);
-  const activity = obligationActivity(loaded.model, obligation.activityType);
-  const type = activity.completionType;
+  const activity = obligationActivity(loaded.model, obligation);
+  const type = item.completionType || preferredCompletionType(activity, {
+    ...obligation,
+    subjectResourceIds: item.subjectResourceIds || []
+  }, new Map(loaded.resources.map((record) => [record.id, record])));
   if (!type) throw new Error(`Obligation "${obligation.id}" has no configured completion resource type.`);
 
   const mutation = scaffoldResourceMutation(
@@ -369,10 +378,14 @@ export async function scaffoldObligationCompletion(input, options = {}) {
       activityType: obligation.activityType,
       completionResourceType: type,
       completionProfile: activity.completionProfile || null,
+      workItemStatus: item.status,
+      programStatus: item.programStatus || null,
       requiredFacts: loaded.model.completionProfiles?.[activity.completionProfile]?.requiredFacts || [],
       dueWindowStart: item.dueWindowStart || null,
       dueWindowEnd: item.dueWindowEnd || null,
-      instructions: "Replace every null or empty required value with the actual work performed. Keep the actual completion date and time, actors, result, scope, independent review, and supporting evidence. This revision makes the completed write safe against a stale Work Queue item."
+      instructions: item.status === "proposed" || item.programStatus === "proposed"
+        ? "This work is still a proposal. Resolve its governing Policy, Control, owner, and completion profile before recording completion."
+        : "Replace every null or empty required value with the actual work performed. Keep the actual completion date and time, actors, result, scope, independent review, and supporting evidence. This revision makes the completed write safe against a stale Work Queue item."
     }
   };
 }
@@ -394,6 +407,7 @@ export async function completeObligationAction(input, options) {
   assertExpectedCompletionType(obligation, options?.record, loaded.model);
   const completedOn = requireDate(options?.completedOn, "completion date");
   const event = loaded.resources.find((record) => record.type === "obligation-event" && record.id === action.sourceResourceId);
+  assertAttestationCompletionScope(obligation, options.record, loaded.resources, event);
   if (event?.occurredOn && completedOn < event.occurredOn) {
     throw new Error("The action completion date cannot be before its policy event date.");
   }
@@ -448,7 +462,7 @@ function assertExpectedCompletionType(obligation, record, model) {
   if (!record || typeof record !== "object" || Array.isArray(record)) {
     throw new Error("A completion resource record is required.");
   }
-  const expected = obligationActivity(model, obligation.activityType).completionResourceTypes;
+  const expected = obligationActivity(model, obligation).completionResourceTypes;
   if (expected.length && !expected.includes(record.type)) {
     throw new Error(
       `Obligation "${obligation.id}" expects a completion resource of type ${expected.join(" or ")}, not "${record.type ?? ""}".`
@@ -456,6 +470,28 @@ function assertExpectedCompletionType(obligation, record, model) {
   }
 }
 
+function assertAttestationCompletionScope(obligation, record, resources, event = null) {
+  if (record?.type !== "attestation") return;
+  const byId = new Map(resources.map((candidate) => [candidate.id, candidate]));
+  const eventPeople = (event?.subjectResourceIds || []).filter((id) => byId.get(id)?.type === "person");
+  const expectedPeople = eventPeople.length
+    ? eventPeople
+    : (obligation.scopeResourceIds || []).filter((id) => byId.get(id)?.type === "person");
+  if (expectedPeople.length && !expectedPeople.includes(record.personId)) {
+    throw new Error(`Attestation personId must name the Person in scope for Obligation "${obligation.id}".`);
+  }
+  const primarySubjects = [obligation.templateResourceId, ...(obligation.scopeResourceIds || [])]
+    .filter((id) => ["policy", "document", "training", "action-item"].includes(byId.get(id)?.type));
+  const allowedSubjects = new Set(primarySubjects.length ? primarySubjects : obligation.policyIds || []);
+  const actualSubjects = new Set(record.subjectResourceIds || []);
+  if (
+    actualSubjects.size !== allowedSubjects.size
+    || [...actualSubjects].some((id) => !allowedSubjects.has(id))
+  ) {
+    throw new Error(`Attestation subjects must name the exact authored content in scope for Obligation "${obligation.id}".`);
+  }
+}
+
 function plannedOccurrenceForScaffold(loaded, obligation, windowStart, completedOn) {
   const start = requireDate(windowStart, "occurrence window start");
   const plan = planObligations(loaded.resources, {
@@ -489,6 +525,7 @@ function plannedActionForScaffold(loaded, action, completedOn) {
 function applyCompletionScaffoldDefaults(record, context) {
   const { loaded, item, obligation, completedOn, activity } = context;
   const program = resolveProgram(loaded);
+  const byId = new Map(loaded.resources.map((candidate) => [candidate.id, candidate]));
   const responsiblePeople = currentPeopleForParties(loaded.resources, item.ownerIds || []);
   if (!responsiblePeople.length) {
     throw new Error(`Obligation "${obligation.id}" needs an active owner whose Appointment or Team resolves to a current Person.`);
@@ -554,19 +591,27 @@ function applyCompletionScaffoldDefaults(record, context) {
       evidenceIds: [],
       approvedOn: completedOn
     }),
-    attestation: () => ({
-      status: "completed",
-      subjectResourceIds: [...new Set([
+    attestation: () => {
+      const personId = (item.subjectResourceIds || []).find((id) => byId.get(id)?.type === "person")
+        || (obligation.scopeResourceIds || []).find((id) => byId.get(id)?.type === "person");
+      const primarySubjectIds = [...new Set([
         obligation.templateResourceId,
         ...(obligation.scopeResourceIds || [])
-      ].filter(Boolean))],
-      personId: responsiblePeople[0],
-      attestationKind: obligation.activityType || "completion",
-      assignedOn: item.dueWindowStart || completedOn,
-      dueOn: item.dueWindowEnd || completedOn,
-      completedOn,
-      attestationMethod: "git-approval"
-    }),
+      ].filter((id) => ["policy", "document", "training", "action-item"].includes(byId.get(id)?.type)))];
+      const subjectResourceIds = primarySubjectIds.length ? primarySubjectIds : [...(obligation.policyIds || [])];
+      if (!personId) throw new Error("An Attestation completion needs the Person who made the acknowledgement or completed the training.");
+      if (!subjectResourceIds.length) throw new Error("An Attestation completion needs the exact Policy, Document, Training, or Action Item content acknowledged.");
+      return {
+        status: "completed",
+        subjectResourceIds,
+        personId,
+        attestationKind: obligation.activityType || "completion",
+        assignedOn: item.dueWindowStart || completedOn,
+        dueOn: item.dueWindowEnd || completedOn,
+        completedOn,
+        attestationMethod: "git-approval"
+      };
+    },
     "access-review": () => {
       if (!systemIds.length) throw new Error("An Access Review completion needs an active in-scope System.");
       return {
@@ -621,22 +666,32 @@ function applyCompletionScaffoldDefaults(record, context) {
       evidenceIds: [],
       coverage
     }),
-    "control-activity": () => ({
-      ...common,
-      profileId: activity.completionProfile || obligation.activityType,
-      obligationId: obligation.id,
-      controlIds: item.controlIds || obligation.controlIds || [],
-      scopeResourceIds: (item.scopeResourceIds || obligation.scopeResourceIds || []).length
-        ? (item.scopeResourceIds || obligation.scopeResourceIds)
-        : [program.id],
-      performerIds: responsiblePeople,
-      completedAt: timestamp,
-      method: "",
-      result: "",
-      reviewerIds,
-      reviewedOn: completedOn,
-      ownerIds: item.ownerIds || obligation.ownerIds || []
-    }),
+    "control-activity": () => {
+      const allowedScopeTypes = new Set(
+        loaded.model.resources["control-activity"].fields.scopeResourceIds.relation || []
+      );
+      const requestedScopeIds = item.subjectResourceIds || item.scopeResourceIds || obligation.scopeResourceIds || [];
+      const validScopeIds = requestedScopeIds.filter((id) => allowedScopeTypes.has(byId.get(id)?.type));
+      const fallbackScopeIds = systemIds.length
+        ? systemIds
+        : (item.controlIds || obligation.controlIds || []).filter((id) => allowedScopeTypes.has(byId.get(id)?.type));
+      return {
+        ...common,
+        profileId: activity.completionProfile || obligation.activityType,
+        obligationId: obligation.id,
+        controlIds: item.controlIds || obligation.controlIds || [],
+        scopeResourceIds: validScopeIds.length
+          ? validScopeIds
+          : fallbackScopeIds.length ? fallbackScopeIds : [loaded.workspace.id],
+        performerIds: responsiblePeople,
+        completedAt: timestamp,
+        method: "",
+        result: "",
+        reviewerIds,
+        reviewedOn: completedOn,
+        ownerIds: item.ownerIds || obligation.ownerIds || []
+      };
+    },
     exercise: () => ({
       ...common,
       exerciseKind: item.title.toLowerCase().includes("continuity") ? "business-continuity" : "incident-response",
@@ -787,10 +842,16 @@ function planEventRun(event, actionItems, byId, asOf, now, model) {
     .map((record) => {
       const obligation = byId.get(record.obligationId);
       const expectedCompletionTypes = obligation?.type === "obligation"
-        ? obligationActivity(model, obligation.activityType).completionResourceTypes
+        ? obligationActivity(model, obligation).completionResourceTypes
         : [];
       const completionProfile = obligation?.type === "obligation"
-        ? obligationActivity(model, obligation.activityType).completionProfile || null
+        ? obligationActivity(model, obligation).completionProfile || null
+        : null;
+      const completionType = obligation?.type === "obligation"
+        ? preferredCompletionType(obligationActivity(model, obligation), {
+            ...obligation,
+            subjectResourceIds: event.subjectResourceIds || []
+          }, byId)
         : null;
       const completionIds = modelSupports(model, "guided-workflow")
         ? record.completionResourceIds || []
@@ -801,6 +862,7 @@ function planEventRun(event, actionItems, byId, asOf, now, model) {
         || matchingCompletionIds.length > 0;
       const complete = record.status === "done" && completionSatisfied;
       const window = plannedCompletionWindow(record.completionWindow);
+      const lateCompletion = complete && completionWasLate(record, matchingCompletionIds, byId, window);
       const timingStatus = complete
         ? "complete"
         : window.overdueAt && new Date(now) > new Date(window.overdueAt)
@@ -824,14 +886,17 @@ function planEventRun(event, actionItems, byId, asOf, now, model) {
         ownerIds: record.assigneeIds || [],
         policyIds: obligation?.policyIds || [],
         controlIds: obligation?.controlIds || [],
+        subjectResourceIds: event.subjectResourceIds || [],
         scopeResourceIds: obligation?.scopeResourceIds || [],
         templateResourceId: obligation?.templateResourceId || null,
         completionResourceIds: record.completionResourceIds || [],
         evidenceIds: record.evidenceIds || [],
         expectedCompletionTypes,
         completionProfile,
+        completionType,
         matchingCompletionIds,
         missingCompletion: record.status === "done" && !completionSatisfied,
+        lateCompletion,
         canceledAction: record.status === "canceled",
         recordedStatus: record.status,
         completedOn: record.completedOn || null,
@@ -870,6 +935,38 @@ function planEventRun(event, actionItems, byId, asOf, now, model) {
   };
 }
 
+function completionWasLate(action, completionIds, byId, window) {
+  if (window.dueWindowEndAt) {
+    const completedAt = completionIds
+      .map((id) => completionTimestamp(byId.get(id)))
+      .filter(Boolean)
+      .sort()[0];
+    if (completedAt) return new Date(completedAt) > new Date(window.dueWindowEndAt);
+    return !action.completedOn || action.completedOn >= window.dueWindowEndAt.slice(0, 10);
+  }
+  return Boolean(window.dueWindowEnd && action.completedOn && action.completedOn > window.dueWindowEnd);
+}
+
+function completionTimestamp(record) {
+  if (!record) return null;
+  return record.completedAt || record.occurredAt || record.collectedAt || record.verifiedAt || null;
+}
+
+function preferredCompletionType(activity, item, byId) {
+  const primary = activity.completionType;
+  const hasPersonSubject = [...(item.subjectResourceIds || []), ...(item.scopeResourceIds || [])]
+    .some((id) => byId.get(id)?.type === "person");
+  const hasAuthoredSubject = [item.templateResourceId, ...(item.scopeResourceIds || [])]
+    .some((id) => ["policy", "document", "training", "action-item"].includes(byId.get(id)?.type))
+    || (item.policyIds || []).some((id) => byId.get(id)?.type === "policy");
+  if (primary === "attestation" && (!hasPersonSubject || !hasAuthoredSubject) && activity.completionResourceTypes.includes("evidence")) {
+    return "evidence";
+  }
+  if (SCAFFOLDED_COMPLETION_TYPES.has(primary)) return primary;
+  if (activity.completionResourceTypes.includes("evidence")) return "evidence";
+  return primary;
+}
+
 function planStandaloneAction(record, byId, asOf, now) {
   const source = byId.get(record.sourceResourceId);
   const window = plannedCompletionWindow(record.completionWindow);
@@ -1038,17 +1135,23 @@ function comparePlannedItems(a, b) {
 function eventActionDescription(obligation, eventType, model) {
   const policy = obligation.policyIds?.length ? ` Policy sources: ${obligation.policyIds.join(", ")}.` : "";
   const scope = obligation.scopeResourceIds?.length ? ` Review scoped resources: ${obligation.scopeResourceIds.join(", ")}.` : "";
-  const expected = obligationActivity(model, obligation.activityType).completionResourceTypes;
+  const expected = obligationActivity(model, obligation).completionResourceTypes;
   const completion = expected.length
     ? ` Link completion records of type ${expected.join(", ")} and any evidence before marking this done.`
     : " Link the completion record and evidence before marking this done.";
   return `Triggered by ${eventType}.${policy}${scope}${completion}`;
 }
 
-function obligationActivity(model, activityType) {
+function obligationActivity(model, obligation) {
+  const activityType = typeof obligation === "string" ? obligation : obligation?.activityType;
   const activity = model.obligationActivities?.[activityType];
   if (!activity) throw new Error(`Unknown obligation activity type "${activityType ?? ""}".`);
-  return activity;
+  if (activityType !== "custom") return activity;
+  return {
+    ...activity,
+    ...(obligation?.customActivity || {}),
+    completionType: obligation?.customActivity?.completionResourceTypes?.[0] || activity.completionType
+  };
 }
 
 function requireDate(value, label) {

package/src/policy-activation.js

@@ -12,6 +12,11 @@ export async function scaffoldPolicyActivation(input = process.cwd(), options =
   ));
   const revisionById = new Map(loaded.entries.map((entry) => [entry.record.id, contentRevision(entry.source)]));
   return {
+    available: approved.length > 0,
+    message: approved.length
+      ? `${approved.length} approved ${approved.length === 1 ? "Policy is" : "Policies are"} available for the Step 3 cutover.`
+      : "No Policy is ready for activation. Finish Step 2 approval, then resolve its Step 3 implementation gaps.",
+    nextCommand: approved.length ? null : "npx filegrc program-path --next --json",
     policyIds: approved.map(({ policyId }) => policyId),
     effectiveOn: currentCalendarDate(loaded.workspace.timezone),
     expectedRevisions: Object.fromEntries(approved.map(({ policyId }) => [policyId, revisionById.get(policyId)])),

package/src/policy-library/data-retention-schedule-v2.md

@@ -0,0 +1,25 @@
+# Data Retention Schedule
+
+## Use
+
+This schedule records how long {{company_name}} keeps important record classes and what happens when each period ends. The policy owner and data owners must complete the organization-specific rows before approval.
+
+Retention periods may come from law, contract, tax, audit, security, or a documented business need. Use the longest applicable period, but do not keep data indefinitely without a reason.
+
+## Schedule
+
+The structured Retention Schedule Items linked to this document are its schedule rows. Each approved item must name the covered Information Types and operational scope, owner, cutoff, period, disposition action, instructions, and authority. Planned items are review prompts and are not approved retention behavior.
+
+Management must cover important information used by Systems, Components, and Vendors, including security logs, backups or alternate recovery copies, governance records, audit evidence, customer and service records, and incident records when those classes exist. No starter period or disposition action is an approved organization value.
+
+## Holds and exceptions
+
+An approved legal hold, investigation, or preservation duty suspends normal deletion for the affected records. Record the authority, scope, owner, start date, and release decision in controlled legal-hold records.
+
+Any retention exception needs a reason, owner, approval, compensating safeguards, and expiration or next review date.
+
+## Review and disposal evidence
+
+Review this schedule at least annually and within 30 days after a material change to systems, data use, vendors, contracts, or applicable duties. The approver must be separate from the owner.
+
+For material disposal work, retain a record of the record class, source, date range, method, completion date, responsible person, exceptions, and verification.

package/src/policy-library.js

@@ -42,14 +42,18 @@ const DOCUMENT_CONTENT_UPDATES = [
     id: "document-data-retention-schedule",
     path: "documents/document-data-retention-schedule.md",
     priorRevision: "45a408e8139bd57f42dda5ca5ae5c8cd4480b4e7bf08834f60058148a3a63475",
-    additionalPriorRevisions: new Set(["d80b99ce53d1012cc169bbbc2afab8d0597bfbe9f30ac0812a8d5bbeb2ed9f90"]),
-    currentRevision: "dd11857ae7d881f176bd93947ef3031c33c75ee41e3c0435198fd60c67a94cf7",
+    additionalPriorRevisions: new Set([
+      "d80b99ce53d1012cc169bbbc2afab8d0597bfbe9f30ac0812a8d5bbeb2ed9f90",
+      "dd11857ae7d881f176bd93947ef3031c33c75ee41e3c0435198fd60c67a94cf7"
+    ]),
+    currentRevision: "4a48c15a4e20e4f29028cf2ff8597315eb51878814120125b5268356b923c9db",
+    currentSourcePath: "./policy-library/data-retention-schedule-v2.md",
     replacements: [
       ["FileGRC detects the bracketed prompts as approval blockers. Remove each prompt only after replacing it with a reviewed fact.", "Remove each bracketed prompt only after replacing it with a reviewed fact."],
       ["Record the authority, scope, owner, start date, and release decision outside this public template.", "Record the authority, scope, owner, start date, and release decision in controlled legal-hold records."],
       ["| Production backups or alternate recovery copies | [Complete before approval: Systems or Components] | [Complete before approval: owner] | Backup or recovery-copy creation | [Confirm or replace proposed default before approval: 30 days, adjusted to approved System recovery objectives] | [Complete before approval: expiration or disposal action] | [Complete before approval: continuity objective or risk decision] |", "| Production backups or alternate recovery copies | [Complete before approval: Systems or Components] | [Complete before approval: owner] | Backup or recovery-copy creation | [Confirm or replace proposed default before approval: 30 days, adjusted to approved System recovery needs] | [Complete before approval: expiration or disposal action] | [Complete before approval: recovery need, commitment, or risk decision] |"]
     ],
-    summary: "Keep FileGRC prompt handling in document guidance, make the Retention Schedule standalone, and avoid assuming numeric recovery objectives."
+    summary: "Move schedule rows into structured records and keep organization-specific periods and disposition choices under management review."
   },
   {
     id: "document-security-incident-recovery-plan",
@@ -592,31 +596,51 @@ async function buildPolicyLibraryPlan(loaded) {
     }
     if (sourceRevision === documentUpdate.currentRevision) {
       skipped.push(skippedItem(documentUpdate.id, "current", "The governed Document already contains the current standalone starter language."));
-      continue;
-    }
-    if (sourceRevision !== documentUpdate.priorRevision
+    } else if (sourceRevision !== documentUpdate.priorRevision
       && !documentUpdate.additionalPriorRevisions?.has(sourceRevision)) {
       skipped.push(skippedItem(documentUpdate.id, "customized", "The governed Document differs from the recognized prior starter, so FileGRC will not rewrite it."));
-      continue;
+    } else {
+      const nextSource = documentUpdate.currentSourcePath
+        ? materializeDocument(
+            await readFile(new URL(documentUpdate.currentSourcePath, import.meta.url), "utf8"),
+            loaded.workspace?.organizationName
+          )
+        : documentUpdate.replacements.reduce((current, [prior, next]) => current.replace(prior, next), source);
+      if (normalizedDocumentRevision(nextSource, loaded.workspace?.organizationName) !== documentUpdate.currentRevision) {
+        throw new Error(`The ${documentUpdate.id} starter update does not produce the current governed Document.`);
+      }
+      proposalChanges.push({
+        resourceType: "document",
+        resourceId: documentUpdate.id,
+        path: displayPath,
+        summary: documentUpdate.summary,
+        diff: fullReplacementDiff(displayPath, source, nextSource)
+      });
+      contentUpdates[documentUpdate.id] = { content: nextSource };
+      expectedContentRevisions[documentUpdate.id] = {
+        [documentUpdate.path]: rawSourceRevision
+      };
     }
-    const nextSource = documentUpdate.replacements.reduce(
-      (current, [prior, next]) => current.replace(prior, next),
-      source
-    );
-    if (normalizedDocumentRevision(nextSource, loaded.workspace?.organizationName) !== documentUpdate.currentRevision) {
-      throw new Error(`The ${documentUpdate.id} starter update does not produce the current governed Document.`);
+    if (documentUpdate.id === "document-data-retention-schedule") {
+      const expectedControlIds = ["control-logging-monitoring", "control-backup-restoration"];
+      const requiredControlIds = expectedControlIds.filter((id) => byId.get(id)?.record.type === "control");
+      for (const id of expectedControlIds.filter((id) => !requiredControlIds.includes(id))) {
+        skipped.push(skippedItem(id, "missing", `The starter ${id} Control is not present, so FileGRC did not add a dangling schedule relationship.`));
+      }
+      const nextControlIds = [...new Set([...(entry.record.controlIds || []), ...requiredControlIds])];
+      if (!sameValue(entry.record.controlIds || [], nextControlIds)) {
+        updates.push({ ...entry.record, controlIds: nextControlIds });
+        expectedRevisions[entry.record.id] = entry.revision;
+        const jsonPath = "data/documents/document-data-retention-schedule.json";
+        proposalChanges.push({
+          resourceType: "document",
+          resourceId: entry.record.id,
+          path: jsonPath,
+          summary: "Link the schedule to logging and backup Controls while preserving existing Control relationships.",
+          diff: replacementDiff(jsonPath, [["controlIds", entry.record.controlIds || [], nextControlIds]])
+        });
+      }
     }
-    proposalChanges.push({
-      resourceType: "document",
-      resourceId: documentUpdate.id,
-      path: displayPath,
-      summary: documentUpdate.summary,
-      diff: fullReplacementDiff(displayPath, source, nextSource)
-    });
-    contentUpdates[documentUpdate.id] = { content: nextSource };
-    expectedContentRevisions[documentUpdate.id] = {
-      [documentUpdate.path]: rawSourceRevision
-    };
   }
 
   for (const controlUpdate of CONTROL_UPDATES) {
@@ -816,6 +840,10 @@ function materializePolicy(source, organizationName, securityContact) {
     .replaceAll("{{security_contact_email}}", securityContact || "security@example.com");
 }
 
+function materializeDocument(source, organizationName) {
+  return source.replaceAll("{{company_name}}", organizationName || "Organization");
+}
+
 function securityContactFromPolicy(source) {
   return source.match(/through the primary route at ([^\r\n]+?) or the usable alternate route documented/)?.[1];
 }