Support owner-authorized nonmaterial amendments

docs/data-model.md

@@ -712,6 +712,22 @@ Key format: `namespace`.
 | `resolutionEvidenceIds` | array of id | No | References: `evidence` |
 | `authorizationKind` | enum | Conditional | Values: `access-grant`, `review-renewal`, `service-account-inventory` Required when `disposition` is `authorized`. Allowed when `disposition` is `authorized`. |
 
+### `nonmaterial-amendment-confirmations`
+
+| Property | Type | Required | Notes |
+| --- | --- | --- | --- |
+| `sameDestination` | boolean | No | Same underlying delivery destination |
+| `sameRecipients` | boolean | No | Same recipients |
+| `sameAccess` | boolean | No | Same access boundaries |
+| `sameAvailability` | boolean | No | Same fallback and availability behavior |
+| `sameDependencies` | boolean | No | Same system dependencies |
+
+### `reporting-route-withdrawal`
+
+| Property | Type | Required | Notes |
+| --- | --- | --- | --- |
+| `amendmentId` | id | Yes | References: `nonmaterial-amendment` |
+
 ## Common fields
 
 | Field | Type | Required | Meaning |
@@ -1544,7 +1560,7 @@ Instructions: Replace the reporting-route placeholders with real normal and fall
 
 Policy basis: A reporting channel is an email address, phone number, web form, in-person contact, or other destination people use to raise a concern. Policies and other approved decisions say when channels are required; this record stores the current contact details so governed text does not copy them.
 
-Timing: Choose the normal channel and a usable fallback, then commit the proposal before approval. Approve the exact committed pair with the actual authority, time, and verified fixed evidence of the approval event. Record cancellation evidence the same way. Create a successor when either channel changes instead of editing an approved set.
+Timing: Choose the normal channel and a usable fallback, then commit the proposal before approval. Approve the exact committed pair with the actual authority, time, and verified fixed evidence of the approval event. Record cancellation evidence the same way. Create a successor when either channel changes instead of editing an approved set. A verified equivalent email alias can instead use an owner-authorized nonmaterial amendment; the original set and its approval remain unchanged.
 
 Path: `data/reporting-route-sets/<id>.json`
 
@@ -1554,7 +1570,7 @@ Markdown companions:
 
 | Field | Type | Required | Notes |
 | --- | --- | --- | --- |
-| `status` | enum | Yes | Values: `draft`, `proposed`, `approved`, `canceled`, `historical` |
+| `status` | enum | Yes | Values: `draft`, `proposed`, `approved`, `canceled`, `historical`, `withdrawn` |
 | `programId` | id | Yes | References: `program` |
 | `purposeKey` | string (id) | Yes | Stable purpose key |
 | `purposeLabel` | string | Yes | Reports covered |
@@ -1569,6 +1585,38 @@ Markdown companions:
 | `cancellation` | object (`reporting-route-cancellation`) | Conditional | Managed by filegrc. Required when `status` is `canceled`. Allowed when `status` is `canceled`. |
 | `legacyRouteIds` | array of id | No | References: `reporting-route` Allowed when `status` is `historical`. |
 | `legacyBasis` | string | No | Allowed when `status` is `historical`. |
+| `withdrawal` | object (`reporting-route-withdrawal`) | Conditional | Managed by filegrc. Required when `status` is `withdrawn`. Allowed when `status` is `withdrawn`. |
+
+#### `nonmaterial-amendment`
+
+An owner-authorized administrative correction attached to an unchanged source record. It preserves the original approval and is not a new independent approval.
+
+Instructions: An owner-authorized administrative correction attached to an unchanged source record. It preserves the original approval and is not a new independent approval.
+
+Policy basis: Use only the model-defined categories and fields. The owner records why the correction preserves the approved decision. Changes to commitments, recipients, access, scope, timing, content or evidence conclusions keep their normal review.
+
+Timing: Record the actual decision time against committed source facts and fixed supporting evidence. Commit before relying on a correction. Preserve each decision; use another amendment or normal review for subsequent changes.
+
+Path: `data/nonmaterial-amendments/<id>.json`
+
+Record Markdown: available when needed as an implicit companion file.
+
+| Field | Type | Required | Notes |
+| --- | --- | --- | --- |
+| `targetResourceId` | id | Yes | Amended record References: `policy`, `document`, `training`, `retention-schedule-item`, `obligation-rule`, `control`, `component`, `vendor`, `reporting-route-set` |
+| `category` | enum | Yes | Values: `label-correction`, `reporting-email-alias` Values come from the `nonmaterialAmendments` registry. |
+| `sourceCommit` | string | Yes | Unchanged source revision |
+| `previousAmendmentId` | id | No | References: `nonmaterial-amendment` |
+| `fieldKey` | string | Yes | Corrected field |
+| `previousValue` | string | Yes |  |
+| `replacementValue` | string | Yes |  |
+| `amendedAt` | string | Yes | Actual amendment time |
+| `amendedById` | id | Yes | Owner making the decision References: `person` |
+| `authorityAppointmentId` | id | Yes | References: `appointment` |
+| `rationale` | string | Yes |  |
+| `evidenceIds` | array of id | No | References: `evidence` |
+| `confirmations` | object (`nonmaterial-amendment-confirmations`) | No |  |
+| `withdrawnProposalId` | id | No | References: `reporting-route-set` |
 
 ### Risk
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc-monorepo",
-  "version": "0.18.16",
+  "version": "0.19.0",
   "private": true,
   "workspaces": [
     "packages/filegrc",

packages/create-filegrc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-filegrc",
-  "version": "0.18.16",
+  "version": "0.19.0",
   "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {

packages/create-filegrc/src/index.js

@@ -524,13 +524,13 @@ async function runCombinedSetup(target, input) {
 async function writeMinimalLockfile(target, name, versionRange) {
   const lock = {
     name,
-    version: "0.18.16",
+    version: "0.19.0",
     lockfileVersion: 3,
     requires: true,
     packages: {
       "": {
         name,
-        version: "0.18.16",
+        version: "0.19.0",
         dependencies: { filegrc: versionRange }
       }
     }

packages/create-filegrc/template/AGENTS.md

@@ -258,3 +258,9 @@ Do not loosen validation to make a bad record pass. Fix the record or update the
 Model v12 requires a complete Program Obligation schedule-set review before activation. Use `npx filegrc review-collection obligation --program PROGRAM_ID --scaffold`, record adopted rules, replacements, retired duplicates, and intentionally inapplicable proposals, then preview and save the exact revision with an independent reviewer. Reporting Channel Sets need independent approval in Step 1; Step 3 verifies their effective coverage and usability at cutover. Existing model v11 workspaces preview `npx filegrc migrate --to-model 12 --preview --json`. See the [model v12 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v12.md).
 
 Model v13 checks completed full-program risk assessment, current workforce training and policy acknowledgements, and actual provider-access reconciliation when selected Controls require them. Retrieval rehearsals prove collection access; they do not complete baseline work. Operating ownership reuses substantive Control procedures and unchanged approved program Documents without a separate Document or duplicate approval. Run `npx filegrc program-readiness --json` for exact gaps, candidates and normal mutation commands shared with the browser. Existing v13 repositories update the engine within the 0.18 release line; no new model migration is needed. Existing v12 repositories preview `npx filegrc migrate --to-model 13 --preview --json` before applying the upgrade. Active programs repair current gaps with actual dates and preserve historical activation and reviews. Material content, schedule and retention changes keep their normal reviews. See the [model v13 upgrade guide](https://github.com/Alignbase/filegrc/blob/main/docs/upgrading-to-model-v13.md).
+
+## Nonmaterial administrative amendments
+
+Use `npx filegrc amend-nonmaterial RESOURCE_ID --scaffold` for a model-supported administrative label correction or verified equivalent reporting email alias. Fill the actual owner, scoped authority, rationale, time and supporting fixed evidence; preview with `--preview`, then save with `--yes` and commit. The source record, Markdown and independent approval remain unchanged. `get RESOURCE_ID --workflow --json` includes the current administrative view and amendment IDs. The browser exposes the same action on supported record pages.
+
+Email aliases require the owner to confirm the same underlying destination, recipients, access boundaries, availability and dependencies. This decision does not independently verify its Evidence or create a new independent approval. A matching proposed alias successor may be withdrawn atomically. Never use an amendment for changed commitments, recipients, access, scope, retention periods, cadence, deadlines, governed prose or evidence conclusions. Keep those normal reviews. Preserve committed amendments and the observations and captures supporting them; correct them through a subsequent amendment. Later independent verification may add verification metadata without rewriting those observations.

packages/create-filegrc/template/README.md

@@ -57,3 +57,7 @@ FileGRC manages GRC records and audit evidence. Your infrastructure, identity, m
 Your team performs the control work and reviews responses before submission. An independent CPA firm performs the SOC 2 examination, judges evidence sufficiency, and issues the report. Using FileGRC alone does not establish compliance.
 
 [Learn more](https://filegrc.com) · [Source code](https://github.com/Alignbase/filegrc) · [Report an issue](https://github.com/Alignbase/filegrc/issues)
+
+For a nonmaterial administrative correction, choose **Nonmaterial amendment** on a supported record page or run `npx filegrc amend-nonmaterial RESOURCE_ID --scaffold`. The owner can correct an administrative label or a verified equivalent reporting email alias while preserving the original record and approval. Changes to commitments, recipients, access, scope, schedules, governed content or evidence conclusions keep their normal reviews.
+
+The nonmaterial amendment workflow is available from FileGRC 0.19.0 with model v13. Existing workspaces need no model migration. The 0.19 runtime also reads existing 0.18 workspaces; 0.18 runtimes reject repositories pinned to 0.19, so hosted services must approve and install the new runtime before owners adopt these records.

packages/create-filegrc/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "{{project_name}}",
-  "version": "0.18.16",
+  "version": "0.19.0",
   "private": true,
   "description": "filegrc workspace for a SOC 2 program",
   "type": "module",