← Design · c123
tours-real-pages.md
Tours — which pages are real (2026-10-29)
Thread tours. Mark: "let's analyze and replace as many placeholder pages with real ones… This will help our demo make sense to those familiar with our live dashboard." Exceptions like the installer page, which doesn't exist yet.
Every lab page the five tours walk, against qdash (../qcontrol/crates/qdash/ui, feat/new-pages):
| Lab page | Tours | What it is today | qdash has | Proposal |
|---|---|---|---|---|
| Organization › Endpoints | start-here, observe-enforce, owasp | copy of qdash's page (c121) + an "Add endpoints" button | yes | keep; the button is new |
| Organization › Teams › detail | observe-enforce | copy (c118) + the c118 Policies section | yes | keep |
| Policies (Control Center) | observe-enforce | copy (c114) | yes | keep |
| Compliance | owasp | copy (c114), minus two cards Mark discarded | yes | keep |
| Home | common-risks, owasp | lab composition: six cards (findings, sensitive data, machines, sources, MCP servers, sessions) | yes: the c109 index (Inventory / Organization / Activity micros) with no findings or sources cards | replace with qdash's Home; the drills' Examples move to Findings, as Common AI risks already does |
| Inventory › MCP Servers (listing) | — | not in the lab | yes | add a copy; Common AI risks' MCP stop uses it instead of Sources |
| Inventory › MCP server detail | common-risks, owasp | lab composition for OWASP stop 2: watch band, consequence tools ledger, Policy section (Tune) | yes: header, tiles, tools, harnesses | replace the top with qdash's detail; keep the Policy section below it, marked new |
| Integrations | common-risks, owasp | lab composition: channels + delivery log (drills) | yes: connectors + live | replace with qdash's page; add the delivery log below, marked new |
| Cost Center | ai-spend | lab composition (this thread) from c66's replica | yes: tiles, breakdown, tables, guardrail | replace the top with qdash's page; the tour's unit price, seats and runaway sections follow, marked new |
| Findings | observe-enforce, common-risks, owasp | lab design (c114 S2, c121 rulings: Observed / Enforced, grouped by policy) | yes, the older "Security Findings" worklist | decide: the tours need Observed / Enforced, which only the new design has |
| Policy Config (history, proposed changes) | observe-enforce, owasp | lab design (c118/c121: the draft, Change impact, versions) | no | keep; label as new |
| Inventory › Sources | common-risks, owasp | concept (c123 OWASP, 2026-10-27); three of its seven checks don't exist | no | keep for OWASP only, labelled concept; out of Common AI risks |
| Organization › Endpoints › Add endpoints | start-here | concept (this thread): installer, token, first signal | no | keep, labelled concept (Mark's exception) |
"Copy" means the page's markup is lifted from qdash and fed from the lab's world instead of the API. "Marked new" means a small tag on the section, in the same vocabulary the OWASP spec uses for product asks.
Done (same day; Mark ruled: "Use qdash's Findings")
| Page | Now |
|---|---|
| Findings | copy of qdash's Security Findings: cards, filter bar, ledger by control (data/qdash/findings.ts toQdashFindings over the lab world; local adjudication). The governance design is at /mock/findings-design |
| Home | copy of qdash's index: 33 micros under qdash's keys (data/qdash/home-index.ts) |
| MCP Servers | listing copied (new route); the detail has qdash on top, with the tour's consequence and Policy sections below, marked new |
| Integrations | qdash's connectors and Live on top; routing and the delivery log below, marked new |
| Cost Center | qdash's tiles, guardrail (P-SPEND), chart and tables on top; the tour's unit price, seats and spike below, marked new |
| Sources | no tour uses it now, and it's off the rail (still reachable by URL); OWASP stop 1 walks the MCP Servers listing, and stop 5 walks postmark-mcp-server's detail |
| Add endpoints | tagged "Concept · not in qdash yet" (the one concept page left in a tour) |
What the tours changed:
- Common AI risks' MCP stop walks the MCP Servers listing, not Sources.
- Every Drill's Example is qdash's Findings ledger, with the simulated findings as groups on top (
drill-findings.ts). - OWASP's drills and its data stop moved from Home's cards to Findings.
- The Observed / Enforced wording is gone from the copy: qdash has Open / Closed / All.
- AI spend's callout points at sorting the Model table by Tokens.
The numbers agree across pages:
- Home's MCP micros read the MCP listing's fixture (14 servers, 12 observed and 2 configured-only, 32.8k calls, 99 tools).
- Integrations' counts read the lab's 22 findings (21 high, 1 medium), 1,284 sessions and 14 MCP servers.
The walk passed all five tours: 178 checks + 126 for OWASP, 0 failures.
Open: app/data/app-map.ts (c125 mcp-guide) still names the old IDs. That session was sent the full list.