SOA as document: replace export with publish workflow

Statements of Applicability are no longer exported as one-off PDFs.
Instead, each SOA owns a persistent document that accumulates versions
over time, following the same publish/approve lifecycle as authored
documents.

Publishing without approvers publishes immediately; publishing with
approvers creates a draft pending approval via the existing quorum
system. SOAs can also store default approvers that are pre-populated in
the publish dialog.

The SOA is removed from the snapshot system — applicability statements
are now queried directly (snapshot_id IS NULL) rather than through
snapshot copies.

A standalone migration script (cmd/migrate-soa-snapshots-to-documents)
converts existing SOA snapshots into documents with proper ProseMirror
content, preserving version history and approval decisions.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -6,7 +6,6 @@ package mcp_v1
 
 import (
 	"context"
-	"encoding/base64"
 	"errors"
 	"fmt"
 	"time"
@@ -2045,6 +2044,7 @@ func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolReque
 		}
 
 		documentFilter = coredata.NewDocumentFilter(query).
+			WithWriteModes(input.Filter.WriteModes).
 			WithDocumentTypes(input.Filter.DocumentTypes).
 			WithClassifications(input.Filter.Classifications).
 			WithStatus(input.Filter.Status)
@@ -2818,13 +2818,7 @@ func (r *Resolver) ListStatementsOfApplicabilityTool(ctx context.Context, req *m
 
 	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
 
-	noSnapshot := (*gid.GID)(nil)
-	filter := coredata.NewStatementOfApplicabilityFilter(&noSnapshot)
-	if input.Filter != nil {
-		filter = coredata.NewStatementOfApplicabilityFilter(&input.Filter.SnapshotID)
-	}
-
-	pg, err := prb.StatementsOfApplicability.ListForOrganizationID(ctx, input.OrganizationID, cursor, filter)
+	pg, err := prb.StatementsOfApplicability.ListForOrganizationID(ctx, input.OrganizationID, cursor)
 	if err != nil {
 		return nil, types.ListStatementsOfApplicabilityOutput{}, fmt.Errorf("failed to list statements of applicability: %w", err)
 	}
@@ -2855,7 +2849,6 @@ func (r *Resolver) AddStatementOfApplicabilityTool(ctx context.Context, req *mcp
 	soa, err := svc.StatementsOfApplicability.Create(ctx, probo.CreateStatementOfApplicabilityRequest{
 		OrganizationID: input.OrganizationID,
 		Name:           input.Name,
-		OwnerID:        input.OwnerID,
 	})
 	if err != nil {
 		return nil, types.AddStatementOfApplicabilityOutput{}, fmt.Errorf("failed to create statement of applicability: %w", err)
@@ -2874,7 +2867,6 @@ func (r *Resolver) UpdateStatementOfApplicabilityTool(ctx context.Context, req *
 	soa, err := svc.StatementsOfApplicability.Update(ctx, probo.UpdateStatementOfApplicabilityRequest{
 		StatementOfApplicabilityID: input.ID,
 		Name:                       input.Name,
-		OwnerID:                    input.OwnerID,
 	})
 	if err != nil {
 		return nil, types.UpdateStatementOfApplicabilityOutput{}, fmt.Errorf("failed to update statement of applicability: %w", err)
@@ -2900,27 +2892,6 @@ func (r *Resolver) DeleteStatementOfApplicabilityTool(ctx context.Context, req *
 	}, nil
 }
 
-func (r *Resolver) ExportStatementOfApplicabilityPDFTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ExportStatementOfApplicabilityPDFInput) (*mcp.CallToolResult, types.ExportStatementOfApplicabilityPDFOutput, error) {
-	r.MustAuthorize(ctx, input.ID, probo.ActionStatementOfApplicabilityExport)
-
-	svc := r.ProboService(ctx, input.ID)
-
-	soa, err := svc.StatementsOfApplicability.Get(ctx, input.ID)
-	if err != nil {
-		return nil, types.ExportStatementOfApplicabilityPDFOutput{}, fmt.Errorf("failed to get statement of applicability: %w", err)
-	}
-
-	pdfData, err := svc.StatementsOfApplicability.ExportPDF(ctx, input.ID)
-	if err != nil {
-		return nil, types.ExportStatementOfApplicabilityPDFOutput{}, fmt.Errorf("failed to export statement of applicability PDF: %w", err)
-	}
-
-	return nil, types.ExportStatementOfApplicabilityPDFOutput{
-		PdfBase64: base64.StdEncoding.EncodeToString(pdfData),
-		Filename:  soa.Name + ".pdf",
-	}, nil
-}
-
 func (r *Resolver) ListApplicabilityStatementsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListApplicabilityStatementsInput) (*mcp.CallToolResult, types.ListApplicabilityStatementsOutput, error) {
 	r.MustAuthorize(ctx, input.StatementOfApplicabilityID, probo.ActionApplicabilityStatementList)
 
@@ -3935,3 +3906,19 @@ func (r *Resolver) DeleteDocumentDraftTool(ctx context.Context, req *mcp.CallToo
 		Document: types.NewDocument(document),
 	}, nil
 }
+
+func (r *Resolver) PublishStatementOfApplicabilityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishStatementOfApplicabilityInput) (*mcp.CallToolResult, types.PublishStatementOfApplicabilityOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionStatementOfApplicabilityPublish)
+
+	svc := r.ProboService(ctx, input.ID)
+
+	document, documentVersion, err := svc.GeneratedDocuments.PublishStatementOfApplicability(ctx, input.ID, input.ApproverIds)
+	if err != nil {
+		return nil, types.PublishStatementOfApplicabilityOutput{}, fmt.Errorf("cannot publish statement of applicability: %w", err)
+	}
+
+	return nil, types.PublishStatementOfApplicabilityOutput{
+		DocumentID:        document.ID,
+		DocumentVersionID: documentVersion.ID,
+	}, nil
+}

pkg/server/api/mcp/v1/specification.yaml

@@ -5144,6 +5144,7 @@ components:
         - RECORD
         - REPORT
         - TEMPLATE
+        - STATEMENT_OF_APPLICABILITY
       go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.DocumentType
 
     DocumentClassification:
@@ -5170,6 +5171,13 @@ components:
         - ARCHIVED
       go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.DocumentStatus
 
+    DocumentWriteMode:
+      type: string
+      enum:
+        - AUTHORED
+        - GENERATED
+      go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.DocumentWriteMode
+
     DocumentVersionSignatureState:
       type: string
       enum:
@@ -5244,6 +5252,7 @@ components:
         - id
         - organization_id
         - trust_center_visibility
+        - write_mode
         - status
         - created_at
         - updated_at
@@ -5267,6 +5276,9 @@ components:
         trust_center_visibility:
           $ref: "#/components/schemas/TrustCenterVisibility"
           description: Trust center visibility
+        write_mode:
+          $ref: "#/components/schemas/DocumentWriteMode"
+          description: Write mode (authored or generated)
         status:
           $ref: "#/components/schemas/DocumentStatus"
           description: Document status
@@ -5419,6 +5431,11 @@ components:
             query:
               type: string
               description: Search query
+            write_modes:
+              type: array
+              items:
+                $ref: "#/components/schemas/DocumentWriteMode"
+              description: Filter by write mode (AUTHORED or GENERATED)
             trust_center_visibilities:
               type: array
               items:
@@ -6119,7 +6136,6 @@ components:
         - id
         - organization_id
         - name
-        - owner_id
         - created_at
         - updated_at
       properties:
@@ -6132,14 +6148,11 @@ components:
         name:
           type: string
           description: Statement of applicability name
-        owner_id:
-          $ref: "#/components/schemas/GID"
-          description: Owner profile ID
-        snapshot_id:
+        document_id:
           anyOf:
             - $ref: "#/components/schemas/GID"
             - type: "null"
-          description: Snapshot ID
+          description: Associated document ID
         created_at:
           type: string
           format: date-time
@@ -6211,7 +6224,6 @@ components:
       required:
         - organization_id
         - name
-        - owner_id
       properties:
         organization_id:
           $ref: "#/components/schemas/GID"
@@ -6219,9 +6231,6 @@ components:
         name:
           type: string
           description: Statement of applicability name
-        owner_id:
-          $ref: "#/components/schemas/GID"
-          description: Owner profile ID
 
     AddStatementOfApplicabilityOutput:
       type: object
@@ -6242,9 +6251,6 @@ components:
         name:
           type: string
           description: Statement of applicability name
-        owner_id:
-          $ref: "#/components/schemas/GID"
-          description: Owner profile ID
 
     UpdateStatementOfApplicabilityOutput:
       type: object
@@ -6272,7 +6278,8 @@ components:
           $ref: "#/components/schemas/GID"
           description: Deleted statement of applicability ID
 
-    ExportStatementOfApplicabilityPDFInput:
+
+    PublishStatementOfApplicabilityInput:
       type: object
       required:
         - id
@@ -6280,19 +6287,24 @@ components:
         id:
           $ref: "#/components/schemas/GID"
           description: Statement of applicability ID
+        approver_ids:
+          type: array
+          items:
+            $ref: "#/components/schemas/GID"
+          description: Optional approver profile IDs. If provided, creates a draft pending approval instead of publishing immediately.
 
-    ExportStatementOfApplicabilityPDFOutput:
+    PublishStatementOfApplicabilityOutput:
       type: object
       required:
-        - pdf_base64
-        - filename
+        - document_id
+        - document_version_id
       properties:
-        pdf_base64:
-          type: string
-          description: Base64-encoded PDF content
-        filename:
-          type: string
-          description: Suggested filename for the PDF
+        document_id:
+          $ref: "#/components/schemas/GID"
+          description: Created or updated document ID
+        document_version_id:
+          $ref: "#/components/schemas/GID"
+          description: Created document version ID
 
     ApplicabilityStatementOrderField:
       type: string
@@ -8597,15 +8609,14 @@ tools:
       $ref: "#/components/schemas/DeleteStatementOfApplicabilityInput"
     outputSchema:
       $ref: "#/components/schemas/DeleteStatementOfApplicabilityOutput"
-  - name: exportStatementOfApplicabilityPDF
-    description: Export a statement of applicability as a PDF document
+  - name: publishStatementOfApplicability
+    description: Publish a statement of applicability as a document. If a document already exists, a new version is created.
     hints:
-      readonly: true
-      idempotent: true
+      readonly: false
     inputSchema:
-      $ref: "#/components/schemas/ExportStatementOfApplicabilityPDFInput"
+      $ref: "#/components/schemas/PublishStatementOfApplicabilityInput"
     outputSchema:
-      $ref: "#/components/schemas/ExportStatementOfApplicabilityPDFOutput"
+      $ref: "#/components/schemas/PublishStatementOfApplicabilityOutput"
   - name: listApplicabilityStatements
     description: List all applicability statements for a statement of applicability
     hints:

pkg/server/api/mcp/v1/types/document.go

@@ -47,6 +47,7 @@ func NewDocument(d *coredata.Document) *Document {
 		OrganizationID:        d.OrganizationID,
 		CurrentPublishedMajor: d.CurrentPublishedMajor,
 		CurrentPublishedMinor: d.CurrentPublishedMinor,
+		WriteMode:             d.WriteMode,
 		TrustCenterVisibility: d.TrustCenterVisibility,
 		Status:                d.Status,
 		ArchivedAt:            d.ArchivedAt,

pkg/server/api/mcp/v1/types/statement_of_applicability.go

@@ -23,8 +23,7 @@ func NewStatementOfApplicability(s *coredata.StatementOfApplicability) *Statemen
 		ID:             s.ID,
 		OrganizationID: s.OrganizationID,
 		Name:           s.Name,
-		OwnerID:        s.OwnerID,
-		SnapshotID:     s.SnapshotID,
+		DocumentID:     s.DocumentID,
 		CreatedAt:      s.CreatedAt,
 		UpdatedAt:      s.UpdatedAt,
 	}