[{"data":1,"prerenderedAt":1123},["ShallowReactive",2],{"cycle-doc-design-c123-tours-plan.md":3},{"cycle":4,"project":7,"path":10,"title":11,"toc":12,"ast":20},{"id":5,"title":6},"c123","Compliance Frameworks",{"id":8,"label":9},"design","Design","tours-plan.md","Tours — the set, and how we build and test it (proposed 2026-10-29)",[13,14,15,16,17,18,19],"What makes a tour","The set, in the order a customer meets them","Considered, not proposed","Build","Test","As built (differs from the plan)","Open for Mark",{"type":21,"children":22},"root",[23,80,86,141,146,420,427,505,531,537,542,637,642,648,668,721,727,732,750,756,816,841,846,886,891,977,982,1050,1055,1088,1093],{"type":24,"tag":25,"props":26,"children":27},"element","p",{},[28,31,38,40,47,49,55,57,63,65,71,73,78],{"type":29,"value":30},"text","Thread ",{"type":24,"tag":32,"props":33,"children":35},"code",{"className":34},[],[36],{"type":29,"value":37},"tours",{"type":29,"value":39}," (",{"type":24,"tag":41,"props":42,"children":44},"a",{"href":43},"\u002Fcycles\u002Fdesign\u002Fc123\u002Fdoc\u002Ftours-prompt",[45],{"type":29,"value":46},"prompt",{"type":29,"value":48},"). Status: ",{"type":24,"tag":50,"props":51,"children":52},"strong",{},[53],{"type":29,"value":54},"built 2026-10-29",{"type":29,"value":56}," (Mark: \"Build all five\"). All five tours walk clean: ",{"type":24,"tag":32,"props":58,"children":60},{"className":59},[],[61],{"type":29,"value":62},"node scripts\u002Ftours-walk.mjs",{"type":29,"value":64},", 308 checks. Launcher: ",{"type":24,"tag":32,"props":66,"children":68},{"className":67},[],[69],{"type":29,"value":70},"\u002Fpages\u002Fphase4\u002Ftours",{"type":29,"value":72},". What landed, and what changed from this plan, is in CYCLE.md's ",{"type":24,"tag":32,"props":74,"children":76},{"className":75},[],[77],{"type":29,"value":37},{"type":29,"value":79}," entry.",{"type":24,"tag":81,"props":82,"children":84},"h2",{"id":83},"what-makes-a-tour",[85],{"type":29,"value":13},{"type":24,"tag":87,"props":88,"children":89},"ul",{},[90,101,111,121,131],{"type":24,"tag":91,"props":92,"children":93},"li",{},[94,99],{"type":24,"tag":50,"props":95,"children":96},{},[97],{"type":29,"value":98},"One person, one question.",{"type":29,"value":100}," The title is the question that person asks, in their words.",{"type":24,"tag":91,"props":102,"children":103},{},[104,109],{"type":24,"tag":50,"props":105,"children":106},{},[107],{"type":29,"value":108},"It starts where they are and ends with something changed:",{"type":29,"value":110}," a machine reporting, a change staged in the draft, a drill run, a ceiling set. Then it points to the next tour.",{"type":24,"tag":91,"props":112,"children":113},{},[114,119],{"type":24,"tag":50,"props":115,"children":116},{},[117],{"type":29,"value":118},"Four to six stops.",{"type":29,"value":120}," Where they fit, each stop walks the OWASP tour's beats: Watch (what Qpoint sees), Tune (stage a change), Drill (simulate a violation through the real alert path), Prove (the evidence).",{"type":24,"tag":91,"props":122,"children":123},{},[124,129],{"type":24,"tag":50,"props":125,"children":126},{},[127],{"type":29,"value":128},"Observe before Enforce",{"type":29,"value":130}," in every tour that changes policy (the c125 brief's rule). That's guidance, not a lock.",{"type":24,"tag":91,"props":132,"children":133},{},[134,139],{"type":24,"tag":50,"props":135,"children":136},{},[137],{"type":29,"value":138},"No overlap in purpose.",{"type":29,"value":140}," Where two tours cover the same ground (common risks and OWASP), the stop is written once as data and each tour frames it differently.",{"type":24,"tag":81,"props":142,"children":144},{"id":143},"the-set-in-the-order-a-customer-meets-them",[145],{"type":29,"value":14},{"type":24,"tag":147,"props":148,"children":149},"table",{},[150,189],{"type":24,"tag":151,"props":152,"children":153},"thead",{},[154],{"type":24,"tag":155,"props":156,"children":157},"tr",{},[158,164,169,174,179,184],{"type":24,"tag":159,"props":160,"children":161},"th",{},[162],{"type":29,"value":163},"#",{"type":24,"tag":159,"props":165,"children":166},{},[167],{"type":29,"value":168},"Tour",{"type":24,"tag":159,"props":170,"children":171},{},[172],{"type":29,"value":173},"The question",{"type":24,"tag":159,"props":175,"children":176},{},[177],{"type":29,"value":178},"When",{"type":24,"tag":159,"props":180,"children":181},{},[182],{"type":29,"value":183},"Who",{"type":24,"tag":159,"props":185,"children":186},{},[187],{"type":29,"value":188},"Problems",{"type":24,"tag":190,"props":191,"children":192},"tbody",{},[193,242,296,336,378],{"type":24,"tag":155,"props":194,"children":195},{},[196,202,210,215,220,225],{"type":24,"tag":197,"props":198,"children":199},"td",{},[200],{"type":29,"value":201},"1",{"type":24,"tag":197,"props":203,"children":204},{},[205],{"type":24,"tag":50,"props":206,"children":207},{},[208],{"type":29,"value":209},"Start here",{"type":24,"tag":197,"props":211,"children":212},{},[213],{"type":29,"value":214},"Is Qpoint running, and what is it seeing?",{"type":24,"tag":197,"props":216,"children":217},{},[218],{"type":29,"value":219},"Day 0",{"type":24,"tag":197,"props":221,"children":222},{},[223],{"type":29,"value":224},"The trial admin, with nobody from Qpoint on the call",{"type":24,"tag":197,"props":226,"children":227},{},[228,234,236],{"type":24,"tag":32,"props":229,"children":231},{"className":230},[],[232],{"type":29,"value":233},"sensor-coverage-gap",{"type":29,"value":235},", ",{"type":24,"tag":32,"props":237,"children":239},{"className":238},[],[240],{"type":29,"value":241},"unknown-agent-fleet",{"type":24,"tag":155,"props":243,"children":244},{},[245,250,258,263,268,273],{"type":24,"tag":197,"props":246,"children":247},{},[248],{"type":29,"value":249},"2",{"type":24,"tag":197,"props":251,"children":252},{},[253],{"type":24,"tag":50,"props":254,"children":255},{},[256],{"type":29,"value":257},"Common AI risks",{"type":24,"tag":197,"props":259,"children":260},{},[261],{"type":29,"value":262},"What could go wrong with AI here, and what does Qpoint do about each?",{"type":24,"tag":197,"props":264,"children":265},{},[266],{"type":29,"value":267},"Week 1",{"type":24,"tag":197,"props":269,"children":270},{},[271],{"type":29,"value":272},"The security or IT lead who doesn't read frameworks",{"type":24,"tag":197,"props":274,"children":275},{},[276,282,283,289,290],{"type":24,"tag":32,"props":277,"children":279},{"className":278},[],[280],{"type":29,"value":281},"unreviewed-mcp-surface",{"type":29,"value":235},{"type":24,"tag":32,"props":284,"children":286},{"className":285},[],[287],{"type":29,"value":288},"personal-vs-enterprise-accounts",{"type":29,"value":235},{"type":24,"tag":32,"props":291,"children":293},{"className":292},[],[294],{"type":29,"value":295},"unsanctioned-external-services",{"type":24,"tag":155,"props":297,"children":298},{},[299,304,312,317,322,327],{"type":24,"tag":197,"props":300,"children":301},{},[302],{"type":29,"value":303},"3",{"type":24,"tag":197,"props":305,"children":306},{},[307],{"type":24,"tag":50,"props":308,"children":309},{},[310],{"type":29,"value":311},"Observe, then enforce",{"type":24,"tag":197,"props":313,"children":314},{},[315],{"type":29,"value":316},"How do I turn protection on without breaking anyone's work?",{"type":24,"tag":197,"props":318,"children":319},{},[320],{"type":29,"value":321},"Weeks 2–6",{"type":24,"tag":197,"props":323,"children":324},{},[325],{"type":29,"value":326},"The same admin, now with a fleet",{"type":24,"tag":197,"props":328,"children":329},{},[330],{"type":24,"tag":32,"props":331,"children":333},{"className":332},[],[334],{"type":29,"value":335},"safe-to-enforce",{"type":24,"tag":155,"props":337,"children":338},{},[339,344,354,359,364,369],{"type":24,"tag":197,"props":340,"children":341},{},[342],{"type":29,"value":343},"4",{"type":24,"tag":197,"props":345,"children":346},{},[347,352],{"type":24,"tag":50,"props":348,"children":349},{},[350],{"type":29,"value":351},"OWASP® Agentic Top 10",{"type":29,"value":353}," (exists)",{"type":24,"tag":197,"props":355,"children":356},{},[357],{"type":29,"value":358},"How do my agents measure up against the paper, and what's my evidence?",{"type":24,"tag":197,"props":360,"children":361},{},[362],{"type":29,"value":363},"Any time",{"type":24,"tag":197,"props":365,"children":366},{},[367],{"type":29,"value":368},"The AppSec reader (F2)",{"type":24,"tag":197,"props":370,"children":371},{},[372],{"type":24,"tag":32,"props":373,"children":375},{"className":374},[],[376],{"type":29,"value":377},"prove-posture-over-time",{"type":24,"tag":155,"props":379,"children":380},{},[381,386,394,399,404,409],{"type":24,"tag":197,"props":382,"children":383},{},[384],{"type":29,"value":385},"5",{"type":24,"tag":197,"props":387,"children":388},{},[389],{"type":24,"tag":50,"props":390,"children":391},{},[392],{"type":29,"value":393},"AI spend",{"type":24,"tag":197,"props":395,"children":396},{},[397],{"type":29,"value":398},"Who's spending what on AI, and where can we save?",{"type":24,"tag":197,"props":400,"children":401},{},[402],{"type":29,"value":403},"Ongoing",{"type":24,"tag":197,"props":405,"children":406},{},[407],{"type":29,"value":408},"Eng manager, IT, finance",{"type":24,"tag":197,"props":410,"children":411},{},[412,418],{"type":24,"tag":32,"props":413,"children":415},{"className":414},[],[416],{"type":29,"value":417},"unexplained-ai-spend",{"type":29,"value":419}," (recurring, two companies)",{"type":24,"tag":421,"props":422,"children":424},"h3",{"id":423},"_1-start-here-c125-j1j3",[425],{"type":29,"value":426},"1 · Start here (c125 J1–J3)",{"type":24,"tag":428,"props":429,"children":430},"ol",{},[431,457,467,485,495],{"type":24,"tag":91,"props":432,"children":433},{},[434,439,441,447,449,455],{"type":24,"tag":50,"props":435,"children":436},{},[437],{"type":29,"value":438},"Get the installer.",{"type":29,"value":440}," Organization › Endpoints › ",{"type":24,"tag":442,"props":443,"children":444},"em",{},[445],{"type":29,"value":446},"Add endpoint",{"type":29,"value":448},": macOS, Windows or Linux, and the org's enrollment token. It says what the sensor installs and what it leaves alone, which answers ",{"type":24,"tag":32,"props":450,"children":452},{"className":451},[],[453],{"type":29,"value":454},"endpoint-coexistence-proof",{"type":29,"value":456},".",{"type":24,"tag":91,"props":458,"children":459},{},[460,465],{"type":24,"tag":50,"props":461,"children":462},{},[463],{"type":29,"value":464},"Install on one test machine.",{"type":29,"value":466}," The steps, and what to expect: the tray icon and the permission prompts.",{"type":24,"tag":91,"props":468,"children":469},{},[470,475,477,483],{"type":24,"tag":50,"props":471,"children":472},{},[473],{"type":29,"value":474},"Wait for the first signal.",{"type":29,"value":476}," This step advances itself when the endpoint reports, from real state rather than a checkbox. It's a drill in reverse (",{"type":24,"tag":32,"props":478,"children":480},{"className":479},[],[481],{"type":29,"value":482},"tour-layer.md",{"type":29,"value":484}," §5). If nothing arrives within a few minutes, it shows the troubleshooting path.",{"type":24,"tag":91,"props":486,"children":487},{},[488,493],{"type":24,"tag":50,"props":489,"children":490},{},[491],{"type":29,"value":492},"What that machine is running.",{"type":29,"value":494}," Inventory, filtered to that endpoint: its harnesses, models, providers and MCP servers, and any personal accounts.",{"type":24,"tag":91,"props":496,"children":497},{},[498,503],{"type":24,"tag":50,"props":499,"children":500},{},[501],{"type":29,"value":502},"Next: roll it out.",{"type":29,"value":504}," Deploy by MDM, with coverage shown as N of M against the people list. Hands off to tour 3.",{"type":24,"tag":25,"props":506,"children":507},{},[508,513,515,521,523,529],{"type":24,"tag":442,"props":509,"children":510},{},[511],{"type":29,"value":512},"Builds:",{"type":29,"value":514}," an Add endpoint \u002F installer mock (new), endpoint detail's \"waiting for first signal\" state, and a first-run world (c100 ",{"type":24,"tag":32,"props":516,"children":518},{"className":517},[],[519],{"type":29,"value":520},"?state=first-run",{"type":29,"value":522},", or c113's ",{"type":24,"tag":32,"props":524,"children":526},{"className":525},[],[527],{"type":29,"value":528},"first-run@*",{"type":29,"value":530}," shapes).",{"type":24,"tag":421,"props":532,"children":534},{"id":533},"_2-common-ai-risks",[535],{"type":29,"value":536},"2 · Common AI risks",{"type":24,"tag":25,"props":538,"children":539},{},[540],{"type":29,"value":541},"Plain language with no risk IDs. Each stop runs Watch → Tune → Drill.",{"type":24,"tag":428,"props":543,"children":544},{},[545,569,601,617,627],{"type":24,"tag":91,"props":546,"children":547},{},[548,553,555,561,562,568],{"type":24,"tag":50,"props":549,"children":550},{},[551],{"type":29,"value":552},"Secrets and sensitive data reaching a model.",{"type":29,"value":554}," ",{"type":24,"tag":32,"props":556,"children":558},{"className":557},[],[559],{"type":29,"value":560},"P-SENS-DETECT",{"type":29,"value":235},{"type":24,"tag":32,"props":563,"children":565},{"className":564},[],[566],{"type":29,"value":567},"home.sensitive-data",{"type":29,"value":456},{"type":24,"tag":91,"props":570,"children":571},{},[572,577,578,584,585,591,593,599],{"type":24,"tag":50,"props":573,"children":574},{},[575],{"type":29,"value":576},"MCP servers and tools nobody reviewed.",{"type":29,"value":554},{"type":24,"tag":32,"props":579,"children":581},{"className":580},[],[582],{"type":29,"value":583},"P-MCP",{"type":29,"value":235},{"type":24,"tag":32,"props":586,"children":588},{"className":587},[],[589],{"type":29,"value":590},"P-TOOL-APPROVAL",{"type":29,"value":592},", the ",{"type":24,"tag":32,"props":594,"children":596},{"className":595},[],[597],{"type":29,"value":598},"github",{"type":29,"value":600}," server.",{"type":24,"tag":91,"props":602,"children":603},{},[604,609,610,616],{"type":24,"tag":50,"props":605,"children":606},{},[607],{"type":29,"value":608},"Personal accounts and unsanctioned services.",{"type":29,"value":554},{"type":24,"tag":32,"props":611,"children":613},{"className":612},[],[614],{"type":29,"value":615},"P-PROVIDERS",{"type":29,"value":456},{"type":24,"tag":91,"props":618,"children":619},{},[620,625],{"type":24,"tag":50,"props":621,"children":622},{},[623],{"type":29,"value":624},"Agents doing things with consequences:",{"type":29,"value":626}," deletes, pushes, payments. The approval verbs.",{"type":24,"tag":91,"props":628,"children":629},{},[630,635],{"type":24,"tag":50,"props":631,"children":632},{},[633],{"type":29,"value":634},"Close: what Qpoint can't see,",{"type":29,"value":636}," said honestly. Then hand off to tour 3, \"turn the baseline on at Observe\".",{"type":24,"tag":25,"props":638,"children":639},{},[640],{"type":29,"value":641},"It reuses the OWASP tour's stop 1 and stop 2 steps where the risks match. The blocks are written once and the framing changes.",{"type":24,"tag":421,"props":643,"children":645},{"id":644},"_3-observe-then-enforce-c125-j4j7",[646],{"type":29,"value":647},"3 · Observe, then enforce (c125 J4–J7)",{"type":24,"tag":25,"props":649,"children":650},{},[651,653,659,661,667],{"type":29,"value":652},"Uses c121's ",{"type":24,"tag":32,"props":654,"children":656},{"className":655},[],[657],{"type":29,"value":658},"?stage=adoption",{"type":29,"value":660}," → ",{"type":24,"tag":32,"props":662,"children":664},{"className":663},[],[665],{"type":29,"value":666},"established",{"type":29,"value":456},{"type":24,"tag":428,"props":669,"children":670},{},[671,681,691,701,711],{"type":24,"tag":91,"props":672,"children":673},{},[674,679],{"type":24,"tag":50,"props":675,"children":676},{},[677],{"type":29,"value":678},"Stage the recommended baseline at Observe.",{"type":29,"value":680}," The Policy Config draft and its Change impact.",{"type":24,"tag":91,"props":682,"children":683},{},[684,689],{"type":24,"tag":50,"props":685,"children":686},{},[687],{"type":29,"value":688},"Read what it would have caught:",{"type":29,"value":690}," findings at Observe, and who'd be affected.",{"type":24,"tag":91,"props":692,"children":693},{},[694,699],{"type":24,"tag":50,"props":695,"children":696},{},[697],{"type":29,"value":698},"Pilot Enforce for one team through an exception,",{"type":29,"value":700}," on Teams detail. It's the same exception you'd make by hand.",{"type":24,"tag":91,"props":702,"children":703},{},[704,709],{"type":24,"tag":50,"props":705,"children":706},{},[707],{"type":29,"value":708},"Watch the pilot:",{"type":29,"value":710}," the team's findings, and no surprises.",{"type":24,"tag":91,"props":712,"children":713},{},[714,719],{"type":24,"tag":50,"props":715,"children":716},{},[717],{"type":29,"value":718},"Expand team by team.",{"type":29,"value":720}," Evidence keeps accumulating, which points to tour 4's Prove.",{"type":24,"tag":421,"props":722,"children":724},{"id":723},"_4-owasp-agentic-top-10",[725],{"type":29,"value":726},"4 · OWASP® Agentic Top 10",{"type":24,"tag":25,"props":728,"children":729},{},[730],{"type":29,"value":731},"This one exists, with stops 1 and 2 written. To finish it:",{"type":24,"tag":87,"props":733,"children":734},{},[735,740,745],{"type":24,"tag":91,"props":736,"children":737},{},[738],{"type":29,"value":739},"write stops 3–5 (W5);",{"type":24,"tag":91,"props":741,"children":742},{},[743],{"type":29,"value":744},"write the Prove beat (W6), ending at framework detail and the evidence export;",{"type":24,"tag":91,"props":746,"children":747},{},[748],{"type":29,"value":749},"write the close.",{"type":24,"tag":421,"props":751,"children":753},{"id":752},"_5-ai-spend",[754],{"type":29,"value":755},"5 · AI spend",{"type":24,"tag":428,"props":757,"children":758},{},[759,769,779,789,799],{"type":24,"tag":91,"props":760,"children":761},{},[762,767],{"type":24,"tag":50,"props":763,"children":764},{},[765],{"type":29,"value":766},"Where it goes:",{"type":29,"value":768}," the Cost Center by team, model and harness, in $ or tokens.",{"type":24,"tag":91,"props":770,"children":771},{},[772,777],{"type":24,"tag":50,"props":773,"children":774},{},[775],{"type":29,"value":776},"Same work, cheaper model.",{"type":29,"value":778}," Unit price, since the leaders change places between $ and tokens (c66's finding).",{"type":24,"tag":91,"props":780,"children":781},{},[782,787],{"type":24,"tag":50,"props":783,"children":784},{},[785],{"type":29,"value":786},"Seats you're paying twice for:",{"type":29,"value":788}," personal accounts beside enterprise ones, and idle seats.",{"type":24,"tag":91,"props":790,"children":791},{},[792,797],{"type":24,"tag":50,"props":793,"children":794},{},[795],{"type":29,"value":796},"Cache rate and runaway sessions.",{"type":29,"value":798}," The batch-day spike.",{"type":24,"tag":91,"props":800,"children":801},{},[802,807,808,814],{"type":24,"tag":50,"props":803,"children":804},{},[805],{"type":29,"value":806},"Set a ceiling at Observe",{"type":29,"value":39},{"type":24,"tag":32,"props":809,"children":811},{"className":810},[],[812],{"type":29,"value":813},"P-SPEND",{"type":29,"value":815},"), with an alert rather than a block.",{"type":24,"tag":25,"props":817,"children":818},{},[819,823,825,831,833,839],{"type":24,"tag":442,"props":820,"children":821},{},[822],{"type":29,"value":512},{"type":29,"value":824}," the Cost Center isn't composed in the lab (it's the catch-all page), so this needs a composed ",{"type":24,"tag":32,"props":826,"children":828},{"className":827},[],[829],{"type":29,"value":830},"\u002Fcost",{"type":29,"value":832}," mock, started from c66's ",{"type":24,"tag":32,"props":834,"children":836},{"className":835},[],[837],{"type":29,"value":838},"\u002Fpages\u002Fcost-center-unit-toggle",{"type":29,"value":840},", plus a spend fixture.",{"type":24,"tag":81,"props":842,"children":844},{"id":843},"considered-not-proposed",[845],{"type":29,"value":15},{"type":24,"tag":87,"props":847,"children":848},{},[849,866,876],{"type":24,"tag":91,"props":850,"children":851},{},[852,857,858,864],{"type":24,"tag":50,"props":853,"children":854},{},[855],{"type":29,"value":856},"Work a finding",{"type":29,"value":39},{"type":24,"tag":32,"props":859,"children":861},{"className":860},[],[862],{"type":29,"value":863},"findings-resolution-workflow",{"type":29,"value":865},"): it's a task wizard more than a tour, and every Drill already ends at a finding. Later, as a c125 linear task.",{"type":24,"tag":91,"props":867,"children":868},{},[869,874],{"type":24,"tag":50,"props":870,"children":871},{},[872],{"type":29,"value":873},"Know your fleet",{"type":29,"value":875}," (inventory): folded into Start here stop 4 and tour 2's Watch beats.",{"type":24,"tag":91,"props":877,"children":878},{},[879,884],{"type":24,"tag":50,"props":880,"children":881},{},[882],{"type":29,"value":883},"Prove it to an auditor:",{"type":29,"value":885}," folded into tour 4's Prove. It becomes its own tour once the evidence export (X4) settles.",{"type":24,"tag":81,"props":887,"children":889},{"id":888},"build",[890],{"type":29,"value":16},{"type":24,"tag":87,"props":892,"children":893},{},[894,915,920,933,967],{"type":24,"tag":91,"props":895,"children":896},{},[897,899,905,907,913],{"type":29,"value":898},"Content goes in ",{"type":24,"tag":32,"props":900,"children":902},{"className":901},[],[903],{"type":29,"value":904},"data\u002Ftours\u002F\u003Cid>.ts",{"type":29,"value":906},", the way OWASP's does. Pages gain only ",{"type":24,"tag":32,"props":908,"children":910},{"className":909},[],[911],{"type":29,"value":912},"data-qp-id",{"type":29,"value":914},"s.",{"type":24,"tag":91,"props":916,"children":917},{},[918],{"type":29,"value":919},"Write for the v4 panel, where the lede and the one action carry the step. Keep the full blocks for v1\u002Fv2 and the MCP guide.",{"type":24,"tag":91,"props":921,"children":922},{},[923,925,931],{"type":29,"value":924},"The adapter (",{"type":24,"tag":32,"props":926,"children":928},{"className":927},[],[929],{"type":29,"value":930},"useTourAdapter.ts",{"type":29,"value":932},") grows the context each tour reads: endpoints, teams, spend.",{"type":24,"tag":91,"props":934,"children":935},{},[936,941,943,949,951,957,959,965],{"type":24,"tag":50,"props":937,"children":938},{},[939],{"type":29,"value":940},"Coordination:",{"type":29,"value":942}," the panel-iterations thread is live in ",{"type":24,"tag":32,"props":944,"children":946},{"className":945},[],[947],{"type":29,"value":948},"components\u002Ftour\u002F",{"type":29,"value":950}," and ",{"type":24,"tag":32,"props":952,"children":954},{"className":953},[],[955],{"type":29,"value":956},"useTour.ts",{"type":29,"value":958},". This thread stays out of them and works in ",{"type":24,"tag":32,"props":960,"children":962},{"className":961},[],[963],{"type":29,"value":964},"data\u002Ftours\u002F",{"type":29,"value":966},", the adapter and the mocks.",{"type":24,"tag":91,"props":968,"children":969},{},[970,975],{"type":24,"tag":50,"props":971,"children":972},{},[973],{"type":29,"value":974},"Order:",{"type":29,"value":976}," Start here → Observe, then enforce → Common risks → AI spend → OWASP stops 3–5.",{"type":24,"tag":81,"props":978,"children":980},{"id":979},"test",[981],{"type":29,"value":17},{"type":24,"tag":87,"props":983,"children":984},{},[985,1023,1033],{"type":24,"tag":91,"props":986,"children":987},{},[988,993,995],{"type":24,"tag":50,"props":989,"children":990},{},[991],{"type":29,"value":992},"A walk per tour",{"type":29,"value":994},", scripted (Playwright, like the capture system):\n",{"type":24,"tag":87,"props":996,"children":997},{},[998,1003,1008,1013,1018],{"type":24,"tag":91,"props":999,"children":1000},{},[1001],{"type":29,"value":1002},"every step's route loads;",{"type":24,"tag":91,"props":1004,"children":1005},{},[1006],{"type":29,"value":1007},"every ID it names resolves to a visible element (the W1 check, as a script);",{"type":24,"tag":91,"props":1009,"children":1010},{},[1011],{"type":29,"value":1012},"there are no console errors;",{"type":24,"tag":91,"props":1014,"children":1015},{},[1016],{"type":29,"value":1017},"stage and drill actions change the draft or the delivery log;",{"type":24,"tag":91,"props":1019,"children":1020},{},[1021],{"type":29,"value":1022},"one screenshot per step.",{"type":24,"tag":91,"props":1024,"children":1025},{},[1026,1031],{"type":24,"tag":50,"props":1027,"children":1028},{},[1029],{"type":29,"value":1030},"Then by hand in the browser,",{"type":29,"value":1032}," at v4 · Split · Dim, desktop and phone width.",{"type":24,"tag":91,"props":1034,"children":1035},{},[1036,1041,1043,1049],{"type":24,"tag":50,"props":1037,"children":1038},{},[1039],{"type":29,"value":1040},"Captures",{"type":29,"value":1042}," under subject ",{"type":24,"tag":32,"props":1044,"children":1046},{"className":1045},[],[1047],{"type":29,"value":1048},"page\u002Fphase4-tour-\u003Cid>",{"type":29,"value":456},{"type":24,"tag":81,"props":1051,"children":1053},{"id":1052},"as-built-differs-from-the-plan",[1054],{"type":29,"value":18},{"type":24,"tag":87,"props":1056,"children":1057},{},[1058,1068,1078],{"type":24,"tag":91,"props":1059,"children":1060},{},[1061,1066],{"type":24,"tag":50,"props":1062,"children":1063},{},[1064],{"type":29,"value":1065},"Common AI risks walks Watch → Drill, not Tune.",{"type":29,"value":1067}," Tuning is Observe, then enforce's job, so the two tours don't overlap. It ends at the delivery log (\"who heard\") and an honest close.",{"type":24,"tag":91,"props":1069,"children":1070},{},[1071,1076],{"type":24,"tag":50,"props":1072,"children":1073},{},[1074],{"type":29,"value":1075},"Observe, then enforce walks c121's adoption stage",{"type":29,"value":1077}," and stages one change itself: Enforce for Finance on P-MCP and P-PROVIDERS.",{"type":24,"tag":91,"props":1079,"children":1080},{},[1081,1086],{"type":24,"tag":50,"props":1082,"children":1083},{},[1084],{"type":29,"value":1085},"OWASP stop 5's Tune stages nothing.",{"type":29,"value":1087}," The kill switch is already live in the established world, so the step says so.",{"type":24,"tag":81,"props":1089,"children":1091},{"id":1090},"open-for-mark",[1092],{"type":29,"value":19},{"type":24,"tag":428,"props":1094,"children":1095},{},[1096,1107],{"type":24,"tag":91,"props":1097,"children":1098},{},[1099,1105],{"type":24,"tag":1100,"props":1101,"children":1102},"del",{},[1103],{"type":29,"value":1104},"Is the set right?",{"type":29,"value":1106}," Built as proposed.",{"type":24,"tag":91,"props":1108,"children":1109},{},[1110,1115,1117,1121],{"type":24,"tag":50,"props":1111,"children":1112},{},[1113],{"type":29,"value":1114},"The installer.",{"type":29,"value":1116}," The default is Organization › Endpoints › ",{"type":24,"tag":442,"props":1118,"children":1119},{},[1120],{"type":29,"value":446},{"type":29,"value":1122},", plus a first-run card on Home that links there. Is there a real installer name and size to show (the qcontrol app)? Placeholders until then.",1794599403479]