Policy Changesets

Today every policy edit takes effect the moment it's made. Mark asked for the firewall admin's "candidate config vs running config": edit freely across pages, then deploy, discard or send for approval as one versioned unit, with a summary first.

A model (Revision, Changeset, Change, ChangesetEvent) and mocks M1–M6, built over c114's fixture and ported to qdash with c114.

• Plan, M1 and M2 (2026-10-19, 0662e9898): the changeset model; the floating dirty indicator (M1) at /pages/phase4/changeset-indicator; the review page (M2) at /pages/phase4/changeset-summary.
• Version labels (2026-10-19, 7967b1208): major.minor labels, an approval band, and a quieter version line.
• Mark ruled D1 (personal, named changesets), D3 (approval as a risk-based org setting), D4 (all configuration goes through a changeset, exceptions included) and D9 (design now, port with c114), all on 2026-10-19, before that afternoon's product session.

The proposal was overtaken within hours. The 2026-10-19 product session constrained publishing to a single draft, two more days of sessions settled it as one shared draft with no approval, and c121 built that on 2026-10-23. M1 and M2 stand as the superseded trail.

What survived, and where it lives now:

• Making a change is separate from publishing it. It's the cycle's premise, and it's now Locally Staged Edits → Save to draft → Publish (c118 L8, c121 D4).
• The net diff (C2). Toggling a setting there and back drops out of the summary. → c118, one staged edit per setting.
• One org-wide revision per publish (D6) and the review page (M2), together with deployed is not in effect (M6). → c121 Policy Config: Proposed Changes, History with propagation.
• Configuration goes through the draft, operations don't (C7, D4). Resolving a finding stays immediate (c121 D10).

What didn't survive:

• major.minor labels. Versions are integers (c121 D2).
• Restore as a new changeset (D5). Rollback moves the live pointer, logged as its own event (c118 W.9).

Product-session decisions

What the Qpoint Product sessions decided about publishing, as it bears on this proposal. Attendees: Mark Parson, Mark Peterson (advisor), Rob Genova, Tyler Flint. Transcripts are extracted in market-analyst: 04e3d850 (2026-10-14), 154b2679 (2026-10-19), 5c8785e2 (2026-10-21). Status words: ruled, direction, open, superseded. A later session wins over an earlier one. Recorded 2026-10-26.

The story. This cycle answered the request as asked: a pull-request model, with personal drafts, approval and conflict detection. The sessions kept the request's spine (stage, version, summarise, publish deliberately) and cut everything that comes from several people editing at once. Tyler on Oct 19: changesets are "the hardest thing", because concurrent edits conflict across tables. Mark Peterson on Oct 21: "we could get away with just a single draft", and ask customers how many people edit and how often before adding more.

• Policy changes are staged, versioned, reviewed and deployed deliberately, not applied as live toggles (Oct 14). Ruled, still standing. It's this cycle's premise.
• Personal, named changesets with conflicts detected at deploy (D1, ruled the morning of Oct 19). Superseded. The same day's session limited publishing to one draft at a time. → c121 D4.
• Approval as a risk-based org setting (D3). Superseded for v1. Oct 19 said approvers aren't needed for beta. Oct 21 said possibly a per-org setting later, and Mark Peterson's v1 scope (Oct 23) has none. → c121 D4.
• Several server drafts, each promoted as a version, with an emergency draft promoted ahead (Mark's walk, Oct 21 morning, c118 W.8). Superseded that afternoon by one shared draft. Mark's multi-draft exploration is parked in git, not behind a knob. → c121 D5.
• Publish with a note, and easy rollback, are the non-negotiables (Oct 19). Ruled, built in c121.
• The whole configuration is one versioned file, "Policy Config", viewable as JSON, with import (Oct 21), plus upload, and starter configs per industry (Oct 23). Ruled / direction. → c121 D13, D26.
• Conflict handling, approvals and promotion from test endpoints come back only with evidence: multiple admins editing often, a customer asking, or enforcement going GA. Direction.