Post-Mortem Map

Incident pages today (c13 violation page, c16 findings) tell the story in stacked cards and tables. When an agent incident spans several actors — an agent, an unapproved MCP server, sensitive files, an external destination — the shape of what happened (who reached what, how far it went) is the first thing a responder needs and the thing tables convey slowest. The initial prompt carried an honest open question: is a visual map actually valuable here, or a solution looking for a problem?

1. Answer the gut-check question with real precedents → precedents.md. Verdict: the pattern is industry-standard (Defender attack story, Amazon Detective finding groups, SentinelOne Process Graph, CrowdStrike incident graph, Cortex XDR Causality View) — justified with conditions: map as orientation layer only, sequence in a timeline companion, observed-vs-inferred edges distinct, curated to the incident's actors. No incumbent draws the agent-incident version (MCP servers, repos, model endpoints as actors with policy state) — that part is open ground.
2. Goal-oriented design brief → briefs/post-mortem-map.md (type: wireframe) — actor/state vocabulary grounded in c16-fleet.ts / ai-agent-policies.ts, honesty constraints, success criteria, single incident page.

In (this pass — brief only)

• precedents.md — precedent survey + gut-check verdict
• briefs/post-mortem-map.md — design brief
• Cycle bookkeeping (this file, CYCLES.md)

Out (next pass)

• app/pages/c18/ wireframe pages (wf1: post-mortem-map-v1/incident.vue)
• app/data/c18-*.ts fixture, registry entries, c18 gallery, root index entry
• Mockups

Fixture data to be derived from app/data/c16-fleet.ts (findings, agents) and app/data/ai-agent-policies.ts (actor/trust vocabulary) when the wireframe pass runs.

• Initial prompt captured (initial-prompt.md)
• Precedent research + gut-check verdict (precedents.md)
• Design brief (briefs/post-mortem-map.md)
• wf1 wireframe: post-mortem-map-v1/incident.vue
• Review against brief