Tours — the set, and how we build and test it (proposed 2026-10-29)

Thread tours (prompt). Status: built 2026-10-29 (Mark: "Build all five"). All five tours walk clean: node scripts/tours-walk.mjs, 308 checks. Launcher: /pages/phase4/tours. What landed, and what changed from this plan, is in CYCLE.md's tours entry.

What makes a tour

• One person, one question. The title is the question that person asks, in their words.
• It starts where they are and ends with something changed: a machine reporting, a change staged in the draft, a drill run, a ceiling set. Then it points to the next tour.
• Four to six stops. Where they fit, each stop walks the OWASP tour's beats: Watch (what Qpoint sees), Tune (stage a change), Drill (simulate a violation through the real alert path), Prove (the evidence).
• Observe before Enforce in every tour that changes policy (the c125 brief's rule). That's guidance, not a lock.
• No overlap in purpose. Where two tours cover the same ground (common risks and OWASP), the stop is written once as data and each tour frames it differently.

The set, in the order a customer meets them

1 · Start here (c125 J1–J3)

1. Get the installer. Organization › Endpoints › Add endpoint: macOS, Windows or Linux, and the org's enrollment token. It says what the sensor installs and what it leaves alone, which answers endpoint-coexistence-proof.
2. Install on one test machine. The steps, and what to expect: the tray icon and the permission prompts.
3. Wait for the first signal. This step advances itself when the endpoint reports, from real state rather than a checkbox. It's a drill in reverse (tour-layer.md §5). If nothing arrives within a few minutes, it shows the troubleshooting path.
4. What that machine is running. Inventory, filtered to that endpoint: its harnesses, models, providers and MCP servers, and any personal accounts.
5. Next: roll it out. Deploy by MDM, with coverage shown as N of M against the people list. Hands off to tour 3.

Builds: an Add endpoint / installer mock (new), endpoint detail's "waiting for first signal" state, and a first-run world (c100 ?state=first-run, or c113's first-run@* shapes).

2 · Common AI risks

Plain language with no risk IDs. Each stop runs Watch → Tune → Drill.

1. Secrets and sensitive data reaching a model. P-SENS-DETECT, home.sensitive-data.
2. MCP servers and tools nobody reviewed. P-MCP, P-TOOL-APPROVAL, the github server.
3. Personal accounts and unsanctioned services. P-PROVIDERS.
4. Agents doing things with consequences: deletes, pushes, payments. The approval verbs.
5. Close: what Qpoint can't see, said honestly. Then hand off to tour 3, "turn the baseline on at Observe".

It reuses the OWASP tour's stop 1 and stop 2 steps where the risks match. The blocks are written once and the framing changes.

3 · Observe, then enforce (c125 J4–J7)

Uses c121's ?stage=adoption → established.

1. Stage the recommended baseline at Observe. The Policy Config draft and its Change impact.
2. Read what it would have caught: findings at Observe, and who'd be affected.
3. Pilot Enforce for one team through an exception, on Teams detail. It's the same exception you'd make by hand.
4. Watch the pilot: the team's findings, and no surprises.
5. Expand team by team. Evidence keeps accumulating, which points to tour 4's Prove.

4 · OWASP® Agentic Top 10

This one exists, with stops 1 and 2 written. To finish it:

• write stops 3–5 (W5);
• write the Prove beat (W6), ending at framework detail and the evidence export;
• write the close.

5 · AI spend

1. Where it goes: the Cost Center by team, model and harness, in $ or tokens.
2. Same work, cheaper model. Unit price, since the leaders change places between $ and tokens (c66's finding).
3. Seats you're paying twice for: personal accounts beside enterprise ones, and idle seats.
4. Cache rate and runaway sessions. The batch-day spike.
5. Set a ceiling at Observe (P-SPEND), with an alert rather than a block.

Builds: the Cost Center isn't composed in the lab (it's the catch-all page), so this needs a composed /cost mock, started from c66's /pages/cost-center-unit-toggle, plus a spend fixture.

Considered, not proposed

• Work a finding (findings-resolution-workflow): it's a task wizard more than a tour, and every Drill already ends at a finding. Later, as a c125 linear task.
• Know your fleet (inventory): folded into Start here stop 4 and tour 2's Watch beats.
• Prove it to an auditor: folded into tour 4's Prove. It becomes its own tour once the evidence export (X4) settles.

Build

• Content goes in data/tours/<id>.ts, the way OWASP's does. Pages gain only data-qp-ids.
• Write for the v4 panel, where the lede and the one action carry the step. Keep the full blocks for v1/v2 and the MCP guide.
• The adapter (useTourAdapter.ts) grows the context each tour reads: endpoints, teams, spend.
• Coordination: the panel-iterations thread is live in components/tour/ and useTour.ts. This thread stays out of them and works in data/tours/, the adapter and the mocks.
• Order: Start here → Observe, then enforce → Common risks → AI spend → OWASP stops 3–5.

Test

• A walk per tour, scripted (Playwright, like the capture system):
  • every step's route loads;
  • every ID it names resolves to a visible element (the W1 check, as a script);
  • there are no console errors;
  • stage and drill actions change the draft or the delivery log;
  • one screenshot per step.
• Then by hand in the browser, at v4 · Split · Dim, desktop and phone width.
• Captures under subject page/phase4-tour-<id>.

As built (differs from the plan)

• Common AI risks walks Watch → Drill, not Tune. Tuning is Observe, then enforce's job, so the two tours don't overlap. It ends at the delivery log ("who heard") and an honest close.
• Observe, then enforce walks c121's adoption stage and stages one change itself: Enforce for Finance on P-MCP and P-PROVIDERS.
• OWASP stop 5's Tune stages nothing. The kill switch is already live in the established world, so the step says so.

Open for Mark

1. Is the set right? Built as proposed.
2. The installer. The default is Organization › Endpoints › Add endpoint, plus a first-run card on Home that links there. Is there a real installer name and size to show (the qcontrol app)? Placeholders until then.