September 13 updates

[pete-gov]

Rules Content Changes

• AGU-AGC-LIA: Updates the Agency Liaison Program reference URL from /preview/2026/agencies/support/liaisons to /2026/agencies/support/liaisons.
• AGU-USE-ABU: Updates the authorization guidance reference URL to https://www.fedramp.gov/2026/agencies/use.
• CCM-OCR-AVL: Clarifies that listed Ongoing Certification Report contents are required “if applicable,” depending on certification type or class, and adds structured metadata for the existing 3-month reporting interval.
• CCM-QTR-SAR: Adds structured timeframe metadata for the existing recommendation to schedule Quarterly Reviews 3–10 business days after releasing an Ongoing Certification Report.
• CPO-CSO-OVR, CPO-CSO-MTD, CPO-CSO-OSA, and CPO-CSF-CPM: Moves the Rev5 default grace date from January 1 to July 1, 2027, at FRR.CPO.info.rev5.effective.date.grace.default, retaining until_next_assessment: true.
• CPO-CSF-CPM: Structurally narrows Rev5 subset applicability from classes A–D to B–D at FRR.CPO.info.rev5.subsets.CSF.applicability.classes.
• FRC-CCL-UCC, FRC-CCL-DCC, and FRC-CCL-DNP: Structurally narrows certification-class-change applicability from classes A–D to B–D at FRR.FRC.info.subsets.CCL.applicability.classes; upgrade and downgrade notes still mention transitions involving Class A.
• IEC-CSO-OIR: Removes the duplicated “the” from all four class-specific incident-reporting statements.
• IVV-CSF-MCA: Adds structured metadata for the existing requirement to include all applicable Rev5 controls in independent assessments every 3 years.
• MKT-CAS-RFR: Adds structured metadata for the existing requirement that advisors respond to FedRAMP or GSA requests within 5 business days.
• MKT-IIP-DLA: Adds structured metadata for the existing 2-year deadline to demonstrate a scheduled Class B, C, or D assessment after initial listing.
• VDR-TFR-NMV: Adds structured metadata for the existing requirement to verify and validate non-machine-based information resources at least every 3 months.

Schema And Structure Changes

• Breaking: Extends top-level FRR timeframe structure in schemas/fedramp-consolidated-rules.schema.json from timeframe_type plus timeframe_num to either that pair or timeframe_type plus timeframe_num_min and timeframe_num_max; consumers assuming every typed timeframe contains timeframe_num must support ranges, and the previous schema rejects the updated CCM-QTR-SAR.

Tooling And Test Changes

• Separates information-analysis guidance in AGENTS.md from maintenance instructions in the new tools/AGENTS-TOOLS.md, including rules-edit guardrails, test boundaries, command side effects, and changelog requirements.
• Reworks README.md and tools/README.md to distinguish dataset consumption from developer maintenance and document setup, commands, fixer/export behavior, hook writes and staging, offline checks, the stale URL-test alias, and Bun version differences.