abewheel · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026
diff --git a/docs/architecture.md b/docs/architecture.md
@@ -873,3 +873,17 @@ preparation; no interface infers proof retention from a resource type. Source da
 expiration remains separate from retained control proof. The application names the
 approved Information Types, purpose, cutoff fit, disposal implementation and holds,
 without editing the rule or its independent approval.
+
+### Operating work and historical context
+
+The shared workflow distinguishes a live duty from dormant planning and historical proof. After setup review, a planned inventory proposal stays scheduled unless an implemented Control, active information processing or another live dependency makes pre-use work necessary. Provisioned setup accounts remain separately accountable without activating a service. Supporting inventory narrative changes remain context; real typed processing, scope and exposure changes keep their normal checks. Open reviewed Risks remain scheduled to their actual review or treatment checkpoint; keeping a Risk open does not itself create a completion assignment.
+
+A finalized superseding Obligation occurrence can replace a historical proof assignment only through the exact Program, Obligation, coverage and member chain. The successor must have passed with completed proof. The former proof remains immutable, and another live assignment keeps it actionable.
+
+Git commit counts are context, not evidence that a business change needs remediation. Period-impact checks compare operating facts and every Markdown companion, including the first substantive in-period change. Label-only edits, trailing whitespace and added rehearsal Evidence links do not create impact work. A dated `periodImpactReview` binds the current substantive revision, actual reviewers, effective business date, conclusion and continuity rationale. A later substantive edit makes that review stale. Its binding includes ordered meaningful source states, so a change and return to old bytes still needs review; unrelated commits, harmless formatting and committing already-reviewed working facts do not stale it. Exact normal Control design reviews and owner data-use decisions can satisfy the same checks when their accepted proof and source snapshots cover the current semantic lineage. A no-material-change decision also answers only the explicitly listed reconciliation materiality questions, bound to their exact transitions; it cannot suppress a different or later change. The review does not approve governed content, waive source coverage, accept Risk or complete a Policy Event. Required approvals, interval checks and event dispositions keep their separate normal checks.
+
+Never-effective Obligation Rules may be withdrawn with actual actors, date and reason. This preserves any prior approval without inventing an effective interval. Active or operated rules require normal retirement and prospective replacement. Withdrawal of an unchanged proposal explicitly excluded from an independently approved schedule set does not reopen that approval.
+
+Raw edit-envelope export reads the target JSON and its companion bytes and revisions only. It does not calculate unrelated workflow or Git history. Actual mutation validation and stale-write protection remain unchanged.
+
+The new optional source shapes require explicit adoption of a dependency and lockfile for FileGRC 0.21.6 or newer. Shared actions and structural validation enforce the same minimum; unchanged older workspaces remain readable. Correcting a mistaken older pin restores current validity without rewriting business decisions. Historical snapshots retain their actual reader limitation and cannot supply a typed review as though the older reader supported it.
diff --git a/docs/data-model.md b/docs/data-model.md
@@ -738,6 +738,19 @@ Key format: `namespace`.
 | `holdsPreserved` | boolean | Yes | All approved holds and required records remain protected. |
 | `noConflictingDuties` | boolean | Yes | No legal, contractual or other duty conflicts with this application. |
 
+### `period-impact-review`
+
+| Property | Type | Required | Notes |
+| --- | --- | --- | --- |
+| `reviewedByIds` | array of id | Yes | References: `person` |
+| `reviewedOn` | date | Yes |  |
+| `effectiveOn` | date | Yes |  |
+| `conclusion` | enum | Yes | Values: `no-material-change`, `material-change-reviewed` |
+| `rationale` | string | Yes |  |
+| `reviewedRevision` | string | Yes |  |
+| `reviewedTransitionKeys` | array of string | No |  |
+| `policyEventIds` | array of id | No | References: `obligation-event` |
+
 ## Common fields
 
 | Field | Type | Required | Meaning |
@@ -977,6 +990,7 @@ Markdown companions:
 | `procedureEffectiveOn` | date | No | Procedure effective date |
 | `componentIds` | array of id | No | Operating and supporting Components References: `component` |
 | `evidenceSourceComponentIds` | array of id | Conditional | Authoritative evidence-source Components References: `component` Required when `status` is `implemented`. |
+| `periodImpactReview` | object (`period-impact-review`) | No | Period impact review |
 
 #### `control-test`
 
@@ -1161,6 +1175,7 @@ Record Markdown: available when needed as an implicit companion file.
 | `evidenceIds` | array of id | No | References: `evidence` |
 | `statusTransition` | object (`status-transition`) | Conditional | Required when `status` is one of `ended`. Allowed when `status` is one of `ended`. |
 | `independenceRationale` | string | No | Independence rationale |
+| `periodImpactReview` | object (`period-impact-review`) | No | Period impact review |
 
 #### `team`
 
@@ -1284,6 +1299,7 @@ Markdown companions:
 | `programRole` | enum | No | Program role Values: `required`, `conditional`, `alternative`, `supporting` |
 | `proposedEffectiveOn` | date | No | Proposed effective date Allowed when `status` is one of `draft`, `in-review`, `approved`. |
 | `reportingRouteRequirements` | array of object (`reporting-route-requirement`) | No | Reporting route requirements |
+| `periodImpactReview` | object (`period-impact-review`) | No | Period impact review |
 
 #### `policy-review`
 
@@ -1970,6 +1986,7 @@ Record Markdown: shown by default as an implicit companion file.
 | `internetExposed` | boolean | No |  |
 | `continuityObjectives` | object (`continuity-objectives`) | No |  |
 | `statusTransition` | object (`status-transition`) | Conditional | Required when `status` is one of `deprecated`, `retired`. Allowed when `status` is one of `deprecated`, `retired`. |
+| `periodImpactReview` | object (`period-impact-review`) | No | Period impact review |
 
 #### `asset`
 
@@ -2160,6 +2177,7 @@ Markdown companions:
 | `classificationId` | id | No | Highest classification References: `classification` |
 | `continuityObjectives` | object (`continuity-objectives`) | No |  |
 | `statusTransition` | object (`status-transition`) | Conditional | Required when `status` is one of `deprecated`, `retired`. Allowed when `status` is one of `deprecated`, `retired`. |
+| `periodImpactReview` | object (`period-impact-review`) | No | Period impact review |
 
 ### Security Operations
 
@@ -2520,6 +2538,7 @@ Record Markdown: shown by default as an implicit companion file.
 | `statusTransition` | object (`status-transition`) | Conditional | Required when `status` is `retired`. Allowed when `status` is `retired`. |
 | `componentId` | id | Conditional | Authoritative Component References: `component` Required when `coverageKind` is `external-component` and `status` is `active`. |
 | `retrievalMethodKey` | string (id) | No | Retrieval method key |
+| `periodImpactReview` | object (`period-impact-review`) | No | Period impact review |
 
 #### `control-activity`
 
@@ -2704,15 +2723,15 @@ Instructions: One immutable reviewed revision of an Obligation schedule, populat
 
 Policy basis: A reusable schedule must be reviewed before it governs work. The rule records the exact management rationale or authoritative source used for that decision.
 
-Timing: Create a proposed revision, review it, then activate it at a real effective time. Never backdate a late decision or rewrite a prior effective rule.
+Timing: Create a proposed revision, review it, then activate it at a real effective time. Never backdate a late decision or rewrite a prior effective rule. Withdraw a proposed or approved rule that never took effect with its actual decision actors, date, and reason. Preserve any approval and the withdrawn proposal; withdrawal does not approve a schedule or cancel an effective rule.
 
 Path: `data/obligation-rules/<id>.json`
 
 Record Markdown: available when needed as an implicit companion file.
 
 | Field | Type | Required | Notes |
 | --- | --- | --- | --- |
-| `status` | enum | Yes | Values: `proposed`, `approved`, `active`, `retired` |
+| `status` | enum | Yes | Values: `proposed`, `approved`, `active`, `retired`, `withdrawn` |
 | `obligationId` | id | Yes | References: `obligation` |
 | `activityDefinitionVersion` | string | No |  |
 | `recurrence` | object (`recurrence`) | Yes |  |
@@ -2729,6 +2748,9 @@ Record Markdown: available when needed as an implicit companion file.
 | `retiredOn` | date | Conditional | Required when `status` is `retired`. |
 | `preparationPurpose` | enum | No | Preparation purpose Values: `operation`, `applicability-review`, `test-execution` |
 | `completionCoverage` | enum | No | Required proof coverage Values: `point-in-time`, `whole-period` |
+| `withdrawnByIds` | array of id | Conditional | References: `person` Required when `status` is `withdrawn`. |
+| `withdrawnOn` | date | Conditional | Required when `status` is `withdrawn`. |
+| `withdrawalReason` | string | Conditional | Required when `status` is `withdrawn`. |
 
 #### `obligation-occurrence`
 

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "filegrc-monorepo",
-  "version": "0.21.5",
+  "version": "0.21.6",
   "private": true,
   "workspaces": [
     "packages/filegrc",

diff --git a/packages/create-filegrc/package.json b/packages/create-filegrc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.21.5",
+  "version": "0.21.6",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

diff --git a/packages/create-filegrc/src/index.js b/packages/create-filegrc/src/index.js
@@ -524,13 +524,13 @@ async function runCombinedSetup(target, input) {
 async function writeMinimalLockfile(target, name, versionRange) {
   const lock = {
     name,
-    version: "0.21.5",
+    version: "0.21.6",
     lockfileVersion: 3,
     requires: true,
     packages: {
       "": {
         name,
-        version: "0.21.5",
+        version: "0.21.6",
         dependencies: { filegrc: versionRange }
       }
     }

diff --git a/packages/create-filegrc/template/AGENTS.md b/packages/create-filegrc/template/AGENTS.md
@@ -184,6 +184,16 @@ Present “Continue to content activation without Autopilot” as the clear seco
 
 Program records, owners, Person email addresses, and dates remain authoritative in Git. Autopilot stores notification settings and Person-to-Slack links in its database. Manage those settings in the [Autopilot dashboard](https://app.filegrc.com). Keep credentials out of Git. Users perform control work, record events, and retain evidence locally.
 
+## Operating changes and unused proposals
+
+Keep planned inventory separate from operating work. A dormant proposal is not an activation task, but complete its normal supplier, access and evidence checks before actual use. Keep an ongoing Risk open with its actual response, owner and review/treatment checkpoints.
+
+Withdraw a never-effective schedule proposal with `npx filegrc withdraw-obligation-rule RULE_ID --scaffold --json`, then preview and apply the actual decision. Do not fabricate approval or activation dates. Preserve active rules and their normal retirement workflow.
+
+When a procedure or operating fact changes during the observation period, use `npx filegrc review-period-impact RESOURCE_ID --scaffold --json`. Record the actual effective business date, reviewers and impact/continuity conclusion, reusing review work already done. Preview with `--preview` and apply with `--yes`. This review binds substantive facts, companion procedures and their meaningful history; later substantive edits or change-and-revert cycles make it stale. Exact accepted operating reviews may already cover the change, so inspect the shared result before creating another review. It does not replace independent approval, source coverage, required Policy Events or Evidence verification. Label-only changes and added rehearsal Evidence links do not create a review merely because Git has several commits.
+
+These actions require model v13 and an explicit FileGRC 0.21.6 or newer dependency and lockfile. Upgrade hosted readers before adopting their new source fields; existing records need no migration or repeat approval. A newer hosted reader cannot authorize new shapes under an older repository pin. If an earlier manual edit used the fields too soon, repair the current dependency and preserve the disclosed historical format limitation instead of rewriting business dates or approvals.
+
 ## Work Queue and Policy Events
 
 Run `npx filegrc obligations --json` to see scheduled work, event tasks, owners, deadlines, and requested proof. Its `workQueue` includes dated source-record work such as risk reviews, treatments and Exception expirations; top-level `items` and `counts` retain the obligation-only view. In Step 4, record the work shown there. Use `npx filegrc guide obligation --json` and `data/AGENTS.md` for the completion and event-trigger commands. The resulting dated operating record or completed Action Item is the output.

diff --git a/packages/create-filegrc/template/package.json b/packages/create-filegrc/template/package.json
@@ -1,6 +1,6 @@
 {
   "name": "{{project_name}}",
-  "version": "0.21.5",
+  "version": "0.21.6",
   "private": true,
   "description": "filegrc workspace for a SOC 2 program",
   "type": "module",