Thread `intents-pr5`: the review list (2026-11-05)

Mark asked to review everything at the end, so the calls that would have waited on him were made with a default and collected here. Rulings are in intents-pr5-plan.md.

Everything is in the lab. It's committed locally on main, not pushed, and not deployed. qdash is untouched.

Where to look

Settled in the first pass (2026-11-05)

• Over time shows the score line above the modes.
• Reports read the lab's own findings: 7 open of 22, the same as the pages.
• Data protection and Egress are in the Findings report. Spend, shadow installs, versions and the fleet posture score stay out.
• Compliance Score is option A, and B–F are gone.
• The 100% example is untracked: press Track on Compliance to see it.
• A framework's bar goes red only when all of it is Off.
• The numbers read published state, not the draft.
• Policy pills read Off (layer, not yet released).
• The band's findings box counts the same as Compliance Score.
• Enforce-pilot thresholds stay placeholders: at most 2 observed violations, at least 200 monitored sessions, at least 90% coverage. Worth asking Peterson.

Calls made, to confirm or change

Enforcement Posture

3. Over time shows all available history, not the shared window (c128 D5). At the 30-day default the line is usually flat. The Compliance report shows both.

Compliance Score

6. Its base is seeded. It needs a real count of checks before any qdash port.

Reports

7. Download PDF is the browser's print, with the lab's chrome hidden. No generating queue or history list.
8. The window keeps calendar presets and compare. PR 6 lists 7, 30, 90 days and custom. Reports share the operator pages' picker (c128 D5).
9. The Team filter is partly seeded. Findings use their real team. Endpoints, sessions, data protection and egress split by fixed shares. Coverage over time stays organization-wide, and says so.
10. Reports are thin before September: the lab's findings begin Sep 20, and a longer window says so. Inventory, Data protection and Egress still run the full year.
11. Old links still work: /reports/posture shows Findings, and /reports/deployment shows Inventory.
12. The Board band is gone from the catalog, replaced by the Executive Summary.

Data the lab invented, and says so

14. SOC 2's mappings: 11 criteria, 10 mapped, from our dossier. Nobody has reviewed them, and PR 5 leaves the scope open.
15. Rows left out as barely relevant: LLM04, LLM08, ASI06 and ASI09, from notes reading "Mostly out of scope". It's a judgment, so it should have an owner.
16. History: policy modes before October, and mapping revisions, including the one that moves OWASP LLM from 22 to 25 mappings on Jun 1.

Policies

17. Still on the page, for c126: the "Control Center" title, Custom controls, and the Evidence packet (c128 says it comes out at the port). "Observe all" stays, because it goes through the draft.

To raise with Peterson

Nothing has been sent. Both intents are merged, so these are differences to reconcile, by updating the intents or the lab.

Also: PR 6 still says "enabled framework" and "disabled periods"; PR 5 keeps "framework toggles"; the app is "Qplane" in PR 6, and nowhere on the design side; and the older framework intents are still on main beside the new ones.

Known issues, left alone

• Dark mode: PolicyTag names can't be read, because the ink flips while the pill stays light. It's in the layer, and c123 already listed it.
• Hydration warning: the layer's DataDonutChart rounds one arc's last digit differently on server and client. Harmless.
• Sticky header: while scrolling framework detail, the pinned title overlaps the table's header row. Not checked against the earlier version.
• Narrow widths: the lab's rail doesn't collapse, so pages scroll sideways below about 900px, and Compliance's Kind column shrinks to its icon.
• Records behind: c128's data-inventory.md still maps the three old reports. Its plan.md carries a note at the top rather than a rewrite.

How it was checked

Captures: c123-after-* and c128-after-* in public/cycles/design/, from scripts/shot-programs/intents-pr5-after.json.