Compliance Frameworks

The dashboard's framework content grew in pieces, one per cycle. Mark called it "a lot of Frankenstein stuff in the dashboard around frameworks", and the brief itemizes it:

• two places to activate a framework;
• three verbs for doing it;
• seven nouns;
• two evidence exports;
• three coverage models;
• a framework detail page that was never composed;
• NIST AI RMF missing from the lab data;
• a different framework list in every source.

The session also settled what the treatment should be:

• F1 Evidence, not compliance. Qpoint never claims to make you compliant.
• F2 The AppSec reader first. The box-checker's evidence is a byproduct.
• F3 Version every framework.
• F4 v1 is four frameworks: OWASP Top 10 for LLM Applications, NIST AI RMF 1.0 and SOC 2 TSC, plus the OWASP Top 10 for Agentic Applications 2026 (Mark, 2026-10-27: OWASP as one family, since Qpoint governs agents).

With regulators starting to require AI governance, the framework pages are where a customer first reads Qpoint's position. They need to say it plainly and consistently.

The framework pages are final in design, tuned by hand, and pass every check below:

• One place to manage tracking, with one verb. Track and Untrack, with Tracked and Untracked as its states, on Compliance and framework detail. Policies can also add a framework. Amended 2026-11-05: PR 5's verbs, and Mark's quick row on Policies.
• One noun, "framework", with each framework's kind (vulnerability list, attestation criteria, risk-management framework) and version shown. Two editions of one framework can coexist (F3, F7, X3).
• Enforcement Posture and Exceptions as two metrics, never "compliant". Enforcement Posture is how much of the work toward ideal is done, within what Qpoint can know and govern: a mapping is at ideal when its policy reaches the strongest mode it can. Exceptions read by direction: active, tighten, loosen, expiring (X5, X11). Amended 2026-11-05, Mark; replaces counts by state and "no percentage".
• Non-policy evidence is described separately (Sessions, Finding resolution, Policy Config history) and adds nothing to posture, so Qpoint's strongest evidence still has a place on the page. Amended 2026-11-05: PR 5.
• Each requirement has a plain-language "what this means for you" line, written for the AppSec reader (F2, F5).
• Framework detail is composed (S5, X6), with two lenses on one dataset: the policy map, and the audit view with its evidence (F6). There is one evidence export (X4).
• The lab fixture carries its five frameworks with versions, and every lab surface reads that one list (X7, X8). Amended 2026-11-05, Mark: ISO 27001 stays listed beside the v1 four.
• Tracking changes no policy and saves outside the draft. A separate, deliberate step on framework detail adds the framework's Off policies to the Policy Config draft at Observe, showing the change first. Amended 2026-11-05, Mark; replaces F8 as written.

The pages, in the order we'll redress them:

1. Compliance & Frameworks listing (/pages/phase4/mock/compliance; useComplianceMock.ts, live/ComplianceFrameworksListing.vue, live/ComplianceAttention.vue): the one place to track a framework.
2. Framework detail (/pages/phase4/framework-detail, S5): composed for the first time. It holds requirements, coverage counts, "what this means for you", the policy map and the audit view.
3. Evidence export (live/ComplianceEvidenceExport.vue, and live/ControlsEvidence.vue leaving Policies): one export.
4. Frameworks on a policy (part/PolicyFrameworks.vue, the chips in part/PolicyOverview.vue): read-only, linking to framework detail. This is coordinated with c126 stop 7.
5. The fixture (app/data/governance-fixture.ts): add NIST AI RMF 1.0, model versions and kinds, fill SOC 2's mappings, and make coverage() honest about partial fit.
6. Copy and the surface registry (app/data/governance-parts.ts): one noun and one verb, and S4/S4f/S5 renamed to match.

Each page runs the same loop:

1. A before capture.
2. An Illustrator export of the current page (/illustrator).
3. Mark reworks it in Illustrator.
4. We build it on a test page beside the current mock.
5. Compare the two.
6. Promote the new one into the lab.
7. Commit.

Out:

• the live qdash catalog and the backend PACKS list (X8 outside the lab). They are listed for the port, not changed here.
• frameworks beyond the v1 four (AIUC-1, CSA AICM, ISO 42001, the EU AI Act and the rest wait for phase 2 and later, per Peterson's sequence);
• the policy surfaces themselves (c126) and the wizard's framework step (c125);
• Peterson's View Frameworks / View a Framework intents. We review against them when they land, and intents-redline.md waits on them.

• prep (2026-10-26): meeting-prep.html (also published as an Artifact), intents-redline.md and research/frameworks-dossier.md, ahead of the session with Mark Peterson. See initial-prompt.md § What came back. intents-redline.md became our own gap-check the same day: Peterson revises the intents himself, and we check his draft against its §5 and suggest only what's missing.
• kick-off (2026-10-27): CYCLE.md written from Mark's kick-off prompt and the market-analyst brief, alongside c125 and c126. The cleanup is this cycle's Stage 2, not a new cycle, as the brief asked. Nothing built yet.
• before captures (2026-10-27): thread c123-before: c123-before-compliance-{established,adoption}, c123-before-framework-detail and c123-before-policies-frameworks-strip (with -full renders) in public/cycles/design/. Program scripts/shot-programs/c123-before.json. They show the Active/Available listing with its completeness % and Activate/Deactivate (X1, X2, X5), framework detail still an S5 record (X6), and the second activation strip on Policies (X1, X4).
• owasp-agentic (2026-10-27): thread owasp-agentic (prompt). The OWASP Top 10 for Agentic Applications 2026 read in full, with both LLM Top 10 editions, in research/owasp/ (PDFs, licensing README, close reading: every numbered mitigation tagged Enforced / Observed / Evidenced / Outside, the fit table ready for the fixture). owasp-agentic-tour.md maps each risk to a question, qdash surfaces and policies, and designs a c125 tour plus framework detail's "paper rail". UI concept canvas: https://claude.ai/artifact/V4qJ4c8sgfuTZv1nvcfmy1. All OWASP material is CC BY-SA 4.0 (ACS code Apache-2.0); no OWASP logo. Ruled the same day: Agentic joins v1 (F4 now four). It's in governance-fixture.ts as owasp-agentic (2026, risk taxonomy, untracked, ASI01–ASI10 from the reading's fit table), with short labels in FW_SHORT and FW_LABEL. It renders on the lab's compliance listing, framework detail and policy detail.
• ruling (2026-10-27): the cleanup runs at the page level. Mark looks at each page whole and names what feels off or hasn't caught up to our understanding. The X1–X11 checklist is a cross-check after his read, not the agenda. Illustrator exports follow his notes; they aren't prepared ahead.
• owasp-agentic, the addressable tour (2026-10-27): thread owasp-agentic. Mark redirected the tour from all ten risks to the parts Qpoint can most address, framed by the customer's concern. The spec is owasp-agentic-tour-v2.md: five concern-led stops, each with Watch, Tune and Prove beats. The concept canvas has a new v2 row of five static boards: the route, and the Watch and Tune beats of stop 1 (Source health) and stop 2 (MCP). Source health is seven checks per source, each passing, failing, not yet known or not applying, with counts above the list and no score. Each Tune beat uses the fixture's real controls (mode and advanced exceptions, PolicyModeState, P-PROVENANCE, the severity override) and tags the missing ones new: a per-server tool list, an approval verb set, sanctioning a skill, severity per scope. The spec's new "What the artboards decided" section records the panel's v2 anatomy, the fixture-like numbers, and three asks found by checking the fixture. The Prove boards aren't drawn yet; the tour runtime belongs to c125.
• owasp-agentic, the Drill beat and the lab tour (2026-10-27): thread owasp-agentic. Mark added a fourth beat, Drill: show the signals Qpoint would send for a violation, the card on Home that lights up, and the customer's notification settings, then Simulate violation to send real, clearly marked test messages through their channels. He wanted the tour layer as light as possible on the dashboard: IDs only, floating, and in a look of its own. He ruled the panel floats, the messages are real, drill receipts are kept, and row keys start light. He also asked to rebuild the canvas boards as lab mockups and keep the boards as sketches. Built:
  • The tour layer (components/tour/*, composables/useTour.ts, the adapter useTourAdapter.ts, content in data/tours/), mounted once in the governance-mock layout.
  • Four new composed mocks: Home, Sources, the github MCP server detail with its Policy section, and Integrations with the delivery log. Their data is in data/owasp-tour-fixture.ts and useNotificationsMock.ts, and data-qp-id attributes are their only tie to the tour.
  • The route page /pages/phase4/tour-owasp-agentic.
  • The Tune beats stage real changes in the shared draft, and the drills write to the delivery log.
  
  The spec's new § "The Drill beat, and the lab tour" maps each step to its page and lists the signals for stops 1 and 2. The protocol and the work packages for c125 are in c125 tour-layer.md.
• owasp-agentic, driven by the person's own agent (2026-10-29): asked from this cycle's session. Can the tours be driven over MCP by a user's agent? It's c125's runtime, so the write-up is c125's thread mcp-guide: mcp-guide-plan.md, W7 in tour-layer.md. The OWASP tour is its first test subject.
• tours, five of them (2026-10-29): thread tours (prompt, plan). Mark asked for four or five logical, clear tours, with a Start here among them. Each tour is one person with one question and ends with something changed. All five are written, built on the tour layer, and walked by script. Launcher: /pages/phase4/tours.

  Tour	Steps	Pages
  Start here (day 0, c125 J1–J3)	6	a new Organization › Endpoints › Add endpoints page: installer per platform with placeholder names and sizes, enrollment token, one test machine, the first signal (a mock button stands in for the machine), what it runs, MDM rollout against the directory
  Common AI risks (week 1)	11	Watch then Drill for four plain-language risks: secrets, unreviewed MCP servers, personal accounts, actions with consequences; then who heard, and what Qpoint can't see. No risk IDs, nothing staged
  Observe, then enforce (weeks 2–6, c125 J4–J7)	8	c121's ?stage=adoption: baseline at Observe, the Observed findings, Engineering's pilot, then stages Enforce for Finance and reads its Change impact
  AI spend (ongoing)	6	the new Cost Center mock (mock/cost.vue, data/cost-tour-fixture.ts): $5,865 in 30 days, $1,543 a month to find (opus → sonnet $864, seats paid twice or idle $679), the Oct 21 runaway eval session, then stages P-SPEND at Observe with a $400/day fleet ceiling
  OWASP® Agentic (any time)	21	stops 3–5 written (W5), each with Watch, Tune, Drill and Prove (W6); the close rewritten

  • Three new drills in owasp-tour-fixture.ts: secret-to-model, personal-account, unapproved-delete. Every drill has a short label and an optional block (the policy that would stop it, and how "So, today" words it either way). The adapter's sentence reads block instead of assuming P-MCP.
  • Example cards follow the drill: sensitiveExample and sourcesExample read c.drills[id], so the panel thread's v5 scenario picker moves them.
  • TOUR_CATALOG in data/tours/index.ts ({ id, name, blurb }, customer order) feeds v4's tour menu.
  • New attach IDs: endpoints.add, endpoints.band, add.*, findings.list, policies.list, team.policies, policy-config.versions, cost.*.
  • One correction found by testing: OWASP stop 5's kill switch first staged P-MCP to Enforce. That's already live in the established world, so it staged nothing. The step now says it's on, and points at the draft's pending relaxation to Observe until Dec 1.
  • Test: node scripts/tours-walk.mjs (Playwright, fresh visit per tour, v4 · Split · Dim). For every step it checks that:
    • the step's page loads;
    • every region it names is there with a box;
    • its blocks read;
    • its stage grows the draft, or its drill lands in the log;
    • there are no console errors.
    
    It passed 308 checks, 0 failures. Sample shots are in tours-walk/.
  • Not done: phone width (the lab's mock shell is desktop-only), the formal /capture program, and the installer's real names and sizes.
  • Follow the page (same day, Mark): clicking Add endpoints during Start here now takes the tour to the installer step and highlights it. In components/tour/Host.vue (c125's file, edited with that thread's go-ahead), when the person reaches the next step's page by their own click, the tour advances. The URL is the only signal: pages stay tour-free, and the tour listens to no app events. A page that isn't the next step's leaves the tour where it is. The advance is recorded as the person's move. The walk checks all of this (39/39 on Start here).
  • Callouts that cover the step's own subject (same day, Mark): the installer's token callout sat over the Download buttons the step is about. c125's panel thread then made it a rule in components/tour/Float.vue: a callout treats the step's highlighted regions, Example frames and every callout's target as obstacles. It takes the first clear side, else the least covered. The per-step placement hint was dropped as redundant, and the type stays for awkward layouts.
  • Demo mode for recording (same day, Mark): ?demo=1, Shift+D, or Demo → on /pages/phase4/tours hides the lab's meta nav: the MOCK bar with the tour row, the Policy Config tray, the theme editor, the dashed mock buttons, the rail's mock footer and the DevTools button. The tour panel keeps Back, Next, minimize and ✕. composables/useLabDemo.ts sets html.qp-lab-demo while the lab layout is mounted. The pieces carry data-lab-chrome, so the rest of the site keeps its theme editor. The visit remembers the mode, and the param leaves the address bar. In demo, Start here's first signal arrives on its own 4 s after its section is in view.
  • Common AI risks reads violations on Findings (same day, Mark: "a much nicer place to see violations, especially for simulating specific violations"):
    • The tour opens on Findings.
    • Risk 1's Watch is the redactions (P-SENS-SANITIZE, 16 caught), and risk 3's is the personal account, both in the individual view.
    • Each Drill now lands on Findings filtered to the policy it would raise. Its Example is the page's own FindingsTable with the simulated findings (DRILL-1, …) on top of the real open ones. data/tours/drill-findings.ts builds them: the drill's raised signals become findings in a copy of the world, folded with RULED. Their outcome and count match the panel's "So, today" sentence.
    • Drills gained who (the person) and per-signal resource. findings.list now also marks the individual table and the empty states, so a policy with no findings yet still has a list to float the Example over.
  • The tours lead /pages/phase4/tour-iterations (same day, Mark: "option 5 is now the de-facto design"): each tour has Start and Demo in v5, with v1–v4 as earlier links. /pages/phase4/tours and the walk open v5 too. The walk passed 312 checks in v5.
  • Sticky nav and a stray callout (same day, Mark, on AI spend · Where it goes): the jump-pill nav (NavJumpPills' sticky row) stayed bright over the dim. When pinned, callouts could sit on it, and one callout pointed at the $/tokens toggle while it was hidden under the pinned title. Fixed in c125's files, with that thread's go-ahead:
    • useTourChromeBoxes covers a see-through sticky wrapper with its painted children, so the pill bar is tinted in flow and pinned.
    • The safe area in Host.vue stacks the chrome pinned at the top: the band, then the pills.
    • The glide measures the pinned stack instead of a fixed 120 px.
    • Float.vue draws no marker for a target that's under the pinned chrome or out of view.
    • The tour's callout now points at By model.
    
    The walk passed 312/312 after the change.
  • Common AI risks' drills say what you're looking at (same day, Mark: "the 'simulate violation' button is confusing… we should have a few findings already in place"):
    • Each drill step now shows all your open findings (7), not one policy's list, which was often empty. The Example puts the simulated ones on top and is titled "Your open findings" in the v5 panel.
    • The panel's text says what each control does: "What if …? These are your open findings today. Tick Simulate to add the findings it would raise, at the top and marked Example; nothing is saved. Send test alerts to see who would hear about it."
    • The drill action is renamed Send test alerts, so it no longer shares a name with the Simulate box.
  • The tours walk real qdash pages (same day, Mark: "replace as many placeholder pages with real ones… exceptions like the installer page"; then "Use qdash's Findings"): see tours-real-pages.md for the map and what was done.
    • Findings, Home and the MCP Servers listing are now copies of qdash. MCP server detail, Integrations and Cost have qdash's page on top, with the tours' own sections below, marked new.
    • The governance Findings design moved to /mock/findings-design.
    • Sources and Add endpoints are tagged as concepts.
    • The drills' Examples are qdash's findings ledger.
    • The walk passed all five tours (304 checks).
  • Tour details, the same afternoon:
    • Start here's opening is titled "Install Qpoint on your first machine". The token callout is gone. The test machine is Morgans-MacBook-Pro, and "What it's running" uses qdash's DataMachine band pattern.
    • Findings drops qdash's severity cards.
    • Common AI risks: each risk ends at Simulate, and Send test alerts happens once, at "Would anyone hear about it?" on Integrations.
    • The panel's stop markers are clickable. The Policy Config tray hides while a tour runs.
    • The OWASP opening is rewritten: "evidence, not a compliance verdict".
    • Every step has its own title. Steps that shared one looked as if the panel hadn't moved. The walk now checks both points: the panel shows the step's title, and no two consecutive steps share a title.
    • OWASP no longer uses Sources (off the rail too). Stop 1, now "Supply chain", opens on Home's real Inventory section, with spots: a new step field, shown as panel buttons, each highlighting one area with a line on why it's a risk (MCP servers, skills, model providers, harnesses). It then continues to the MCP Servers listing. Stop 5 walks postmark-mcp-server's detail.
    • Scale-to-fit for wide Examples was built and removed, at Mark's call. Wide content is parked.
    • The walk passes all five tours (415 checks).
  • Demo, the glide and plain step names (same day, late):
    • Demo on the launcher and on tour-iterations now opens with ?draft=empty as well as ?demo=1, so the recorded pages carry none of the seed's proposed changes (c125's knob).
    • The glide is ease-in-out quint over 0.7–1.6 s by distance. Its slow start was the layer's * { scroll-behavior: smooth } (shared.css) turning each frame's scrollTo into a smooth scroll of its own; the glide now scrolls with behavior: 'instant'.
    • "Drill" and "Tune" are gone from what a person reads (Mark: "confusing and ambiguous"). A step gains short, a few words for what it does. The panel's Next names the next step ("Next: Simulate a look-alike →", "Next: Allow what's reviewed →"), or the next stop when the stop changes. The meta bar's beats read See it · Change it · What if · Prove it, and the launcher's chips use the short names. OWASP's stop 2 is "MCP servers and their tools".
    • The walk also checks that Next never shows a bare beat name. All five tours pass.
    • Landed as f351ccdf7c, with the c125 panel and mcp-guide threads' work on the shared tour files and c127's initial prompt, pushed on c123/owasp-agentic-tour and deployed. A cloud session had already pushed b3ebf9106f ("focus only what's specific") from an older Host.vue, so its change was reapplied by hand in the rebase: the OWASP opening rings nothing, stop 1's and stop 2's policy steps ring less, and Dim and Fade fall back to the ring when the focus covers more than about half the viewport. The walk passed 455 checks on the result. Stops 3 and 4 didn't exist when that commit was written, so their policy steps still ring two regions each.
• NIST AI RMF in the fixture (2026-10-27): nist-ai-rmf: version 1.0 (Jan 2023), the new kind risk-management framework, the source term subcategory ("Subcategories" on framework detail), untracked. It holds 18 subcategories: the 15 the dossier (§2e) says Qpoint can speak to, plus GOVERN 2.1, MEASURE 2.11 and MANAGE 4.3 as visible gaps. Labels abridge NIST AI 100-1 (a US government work), and the ids are NIST's own. This closes the "NIST AI RMF missing from the lab data" item. The layer's FrameworkIcon resolved "risk-management framework" through its risk alias to the risk-taxonomy warn icon. Fixed in q-nuxt-layer 0.9.36: a riskmanagement alias, listed first, takes the governance ribbon. All six consumer lockfiles are refreshed and committed, not pushed.
• phase4-simple, framework detail composed (2026-11-03): thread phase4-simple (prompts). Started as a short list of page notes from Mark and became the first composed framework detail (X6), plus one verb on two of the three framework surfaces (X1, X2). Commits d9dac5fd95 and c400dd2afe, on layer 0.9.37.
  • Framework detail is composed. Its body moved out of the record page into part/FrameworkDetail.vue, which the record page and a new mock share: /pages/phase4/mock/compliance/detail, opened from Compliance's "Details + Configuration" and registered as S5's mock. The mock runs on the shared world, so its numbers can differ from the record page's (6 open findings against 4 on OWASP LLM). Track there stages a framework-track change in the Policy Config draft.
  • The table runs full width: Item · Coverage · "Policies governing this item" · Findings. The header follows the source's term ("…this control", "…this criterion"). Policies are PolicyTags with a status, which reads inactive when the policy is not in scope, observed at observe, and enforced at configured or confirmed. Findings are open counts by severity, in the Findings ledger's box. The capability and Gap columns are gone, and the Gaps section keeps the reasons. The filter is the standard FilterTriggerBar, and the search box is gone.
  • "Risk" leaves the page, except the kind. OWASP's entries read Items (sourceTerm: 'item'), which sets aside D8's source's-own-term for OWASP only; ISO, SOC 2 and NIST keep theirs. The OWASP descriptions say "security issues". The kind label still reads "risk taxonomy", awaiting a word (proposed: "Top 10 list"), and "NIST AI Risk Management Framework" is a name.
  • The summary band went from label-over-number cells to DataMachines, picked from three revisions at /pages/phase4/framework-summary (kept for comparison): Coverage as a segment bar (A; black, grey, white), Mapped policies as a donut (B; green, orange, grey), Open findings as the severity box (C). Tracked left the band. With nothing mapped, Open findings shows a grey 0, not a green one. The table's coverage dots and the "What coverage means" text match the bar. The guidance disclaimer moved from under the title to a footnote under Gaps.
  • Track is a state, not a toggle. Mark didn't understand the black Tracked button: it read as a status, stopped tracking without asking, and changed nothing on the page. Now it's a quiet "Tracked" with a separate Stop tracking link that asks first. Compliance reads "Tracked frameworks" and Track / Stop tracking. F8 (tracking stages policies at Observe) is still not built, so Track still changes no policy.
  • Tables shrink with the page. Compliance (min 560px) and Control Policies (min 600px) moved to fixed layout: columns keep their shares and shrink together, text ends in an ellipsis with the full text on hover, and numbers and actions stay whole. Compliance's compliance figures clip rather than ellipsize. This took three tries on Compliance. The first truncated only the name column, the second squeezed it to 29px or folded Kind to its icon, and Mark then asked for every column to give way. Framework detail stays in auto layout; its policy pills truncate through max-w-0.
  • Smaller: Compliance's section headers use qdash's h2 text-24; the mock rail stays lit on sub pages and on surfaces that name it as nav; mock/compliance.vue became mock/compliance/index.vue at the same URL.
  • Layer 0.9.37 (0d1ea8c): PolicyTag gains status, and UxTableListSorter's label is a truncating span, unchanged in auto-layout tables. Only design's lockfile moved; bob-wire, www and qdash are still on 0.9.36.
  • Deploy: my own npm run deploy built, then stopped at "Build produced no index.html" and pushed nothing. A second deploy had started at 12:32 in the same checkout, and c129 records the collision. That run shipped c400dd2afe as d39dd67b12 on deploy, with 23 uncommitted paths from other sessions. bd48264c3e (c129, from 0a2cb25691) has since replaced it and carries this work too.
  • Checked by hand in the browser at 768–1600px, in light mode, and by curling the deployed pages. No capture program was run, and there are no after captures yet.
  • Still open:
    • Policies' frameworks strip still says "Activate Frameworks" and "Activate All", so X1/X2 aren't finished.
    • Compliance still shows completeness as a percentage (X5).
    • PolicyTag names can't be read in dark mode: the name's ink flips while the pill stays light. This predates the thread and now shows on framework detail in the site's dark theme.
    • Evidence export is c128's: it removed the export from the Compliance mock, in its own uncommitted work.
• posture-score, two compliance metrics (2026-11-04): thread posture-score (prompt, plan). Coverage and the completeness % give way to two metrics, which Mark asked for as an amendment to F1's "no percentage". Not yet taken to Peterson; hold any org-wide number and any qdash port until then. Uncommitted, not deployed.
  • Compliance Posture is how well we are set up, now: each person a mapped policy reaches counts by the mode they actually get (Enforce 1, Observe 0.25, Off 0), and a live advanced exception takes 10 points off. A policy that can only observe counts fully when observing. A row averages its policies, a framework averages its addressable rows. Green at exactly 100%, red under 25%, orange between. policyPosture(), requirementPosture(), frameworkPosture() in governance-fixture.ts.
  • Compliance Score is findings against what was checked, over 30 days, counting distinct findings and any older one still open. Check and session counts are seeded and marked projected; Qpoint doesn't count them yet. Six display options sit behind ?v.score= (?parts=1 shows the swap): A box + base (default), B two numbers, C sessions, D percent, E rate, F 0–100. scoreOf(), part/ComplianceScoreCell.vue.
  • Framework detail (part/FrameworkDetail.vue, shared with the record page): the Coverage machine and column went, as did the heading, filter and count above the table. Columns read Name · Enforcement Posture · Compliance Posture · Compliance Score, with Findings folded into Score and the two metrics sortable. Mapped policies became Enforcement Posture in the band and the table. Items Qpoint can't address leave the table and stay under Gaps (Mark, 2026-11-04), so SOC 2 shows an empty table and its three gaps. The pill now shows the policy's own mode, because standing() read "enforced" for a policy that is Off with one enforcing exception.
  • Compliance listing: Compliance Posture and Compliance Score replace Total Violations and the completeness %, which closes X5. Findings count once per framework. The two sorters now really sort. The plan left Score blank on untracked frameworks; it shows there, as Violations did.
  • Checked: scripts/c123-metrics-check.mts (24 checks), scripts/tours-walk.mjs (455 passed), and in the browser at 900–1500px in light, with dark seen on framework detail only at a glance. No captures yet.
  • Still open: pick a Score option; the band's Open findings (open only) and the row Score (window plus open) count differently, so OWASP LLM reads 5 High against 7 High on the listing; "Mostly out of scope" rows that still map to a policy stay in the table; a real count of checks needs the backend; the rest of the plan's "where else" list.
• intents-pr5, evaluation and plan (2026-11-05): thread intents-pr5 (prompt, evaluation, plan). Peterson's framework intents landed as qpoint-io/intents PR 5, merged by Mark the same day, and the review this cycle's scope promised is done. Nothing is built, and nothing in this thread is committed.
  • PR 5 excludes what posture-score built: a subject-weighted, exception-adjusted %, and compliance scoring. It defines one measure, Policy enforcement posture: Off / Observe / Enforce per policy-to-control mapping, by published default mode, with exceptions as annotations. On that rule OWASP LLM reads 5 / 21 / 2 of 28 mappings (18 / 75 / 7) where the bar says 50%.
  • It also reverses F8, c118 A6 and Q10: tracking changes no policy and saves outside the draft.
  • Of the redline's six asks, the split, version pinning and most of per-mapping provenance landed. Evidence as a mapping target, the four coverage states and tracking moving Off to Observe were declined.
  • Rulings the same day (Mark), all in the plan. Merging an intent doesn't rule over design work, so where these differ from PR 5 or PR 6, they hold in the lab and the differences are his to raise.
    • Posture measures what Qpoint can know and govern. Enforcement Posture is progress toward each policy's best possible mode, so 100% can mean everything possible is at Observe. Exceptions get their own metric, led by direction. Established OWASP LLM reads 40%, 10 of 25 mappings at ideal, 10 policies to change.
    • Tracking changes nothing, and a separate button stages Off policies at Observe. F8 retires as written.
    • On the page: Controls on every framework; columns Control · Policies · Enforcement Posture · Compliance Score; green at 100%, orange for work left, red only when a policy is Off.
    • Compliance Score stays as built, seeded and marked projected, and out of Reports.
    • All five frameworks stay listed. Untracked ones show name and description only.
    • Reports: PR 6's four, as living pages rather than generated PDFs (c128).
  • Committed: 0d01a2ea9c (posture-score as built) and b228984aea (Findings fixed layout), both local. This thread's documents aren't committed, and Phase 1 is next.
• intents-pr5, Phase 1: the shared calculation (2026-11-05): thread intents-pr5. The model is in governance-fixture.ts; the pages don't read it until Phases 3 and 4, and the Nov 4 functions stay until they do.
  • New: enforcementPosture, rowEnforcement, exceptionsRead, postureHistory, policyModeAt, controlGroups. A limited row is marked limited (OWASP LLM04, LLM08, ASI06, ASI09). Frameworks gain a source link, native groups, mapping revisions and a tracking log, which applyChange now writes.
  • Established world: OWASP LLM 40% (10 of 25, 10 policies to change; 7 exceptions: 3 tighten, 2 loosen, 2 neutral, 1 expiring); OWASP Agentic 40%; NIST AI RMF 47%; ISO 27001 50%; SOC 2 41%. With a pilot running, OWASP LLM reads 32% with 5 exceptions, all tightening.
  • Seeded, and marked so: policy modes before October (POSTURE_SOURCE: on through the spring, enforcing from July, agreeing with c128's report world), and mapping revisions, including one that moves OWASP LLM from 22 to 25 mappings on Jun 1. History before Jan 12, or before a framework's first mapping, is unavailable.
  • SOC 2 now has 11 criteria, 10 of them mapped. A lab proposal from research/frameworks-dossier.md §3e, not a reviewed mapping: PR 5 leaves SOC 2's fixed scope open. This is the one visible change: SOC 2 shows data on Compliance, framework detail and policy detail, still under the Nov 4 formula until Phase 3.
  • Calls made: a framework's bar goes red only when all of it is Off, because nearly every framework holds something Off; a row goes red when any of its policies is. labelsAbridged on the framework replaces the plan's officialTitle, rather than writing official text from memory.
  • Checked: scripts/c123-metrics-check.mts (62 checks), scripts/tours-walk.mjs (455 passed), and in the browser. "A draft change moves nothing" can only be checked in the browser, so it moves to Phase 2.
  • Found: the layer's DataDonutChart rounds an arc differently on server and client in the last digit, which logs a hydration warning on SOC 2's framework detail. Harmless, and not from this work.
• intents-pr5, Phase 2: tracking leaves the draft (2026-11-05): thread intents-pr5.
  • Track and Untrack apply at once, by whoever is acting, through trackFramework, and add no Policy Config line: framework-track is now in OPERATIONAL, and its draft handling is gone. No policy moves.
  • One verb: Untrack replaces Stop tracking on Compliance and framework detail. It asks first, on both, and says what it hides: "It leaves dashboards and new reports. No policy changes, and its history is kept."
  • Who tracked it: framework detail reads "Tracked by Dana (security admin), Apr 6, 2026", with History behind it listing actor, date and previous and new state.
  • The staging step (D3): on a tracked framework with something Off, framework detail offers "Add 4 to the draft at Observe". It lists each policy with Off → Observe first, then adds ordinary mode-set lines. They go straight into the shared draft through addToDraft, leaving the person's own unsaved edits alone. It reads published state, so the draft can't change what it says is Off. It's hidden when nothing is Off or the framework is untracked. Untrack never undoes it. The record page has no draft, so it doesn't offer this.
  • Checked: a new scripts/c123-track-walk.mjs (35 checks) walks all of it in a browser, through publishing, where the page finally moves. scripts/c123-metrics-check.mts (62) and scripts/tours-walk.mjs (455) still pass. Desktop width, light mode only.
  • Known and left: the OWASP tour's close still says Track stages policies (Phase 7, through c125). D4's "10 policies to change" link waits on Phase 5, when Policies learns to filter by framework. The band and rows still show the Nov 4 metrics until Phases 3 and 4, and they follow ?preview=draft until then.
• intents-pr5, Phases 3–8: the pages (2026-11-05): thread intents-pr5. Mark moved his review to the end, so these ran without stops. The open calls are in intents-pr5-review.md.
  • Compliance listing: Enforcement Posture, Exceptions and Compliance Score on tracked frameworks; name, publisher, edition and description on untracked ones. "Instrumented", the dead Add button and the auto-tagged claim are gone. Tracked / Untracked.
  • Framework detail is recomposed in PR 5's parts: the framework with a source link and mapping revision; both metrics and open findings; the staging step; the exceptions themselves; controls in native groups with rationale on every row, and limited rows marked; posture over time with mapping marks and reconstructed ranges; what isn't mapped; supporting evidence. Columns read Control · Policies · Enforcement Posture · Compliance Score. The Nov 4 weighted posture is gone from the fixture.
  • Policies: the frameworks strip leaves (X1, X2), a framework no longer "requires" a policy, and the band's "policies to change" opens the listing narrowed to them. The policy's Frameworks section reads Control and Untracked, with why each is mapped.
  • Reports (with c128): four living pages from PR 6. See c128.
  • Tours and guide: the OWASP close no longer says Track stages policies, and points at the Compliance report instead of the evidence export. The guide's Framework term no longer says "covered" and "gaps", and it gains Enforcement Posture.
  • Redline closed: see intents-redline.md.
  • Checked: 108 browser checks, 45 calculation, 455 tours, 9 time window. Dark at 1400px and light at 800px looked at. Captures c123-after-*, c128-after-*.
  • PR 6 merged the same day (6df1426), with the content this work read.
• intents-pr5, Mark's notes (2026-11-05): thread intents-pr5, ahead of the decisions review.
  • A 100% example: example-complete, "Example: everything at ideal", tracked, made of the eight policy-to-control mappings the established world has at ideal. Clearly labelled as a lab example, and it shows in the reports because it's tracked. It reads 100% with 3 exceptions, 2 of them loosening, and with a pilot running it drops to 75%, because nothing enforces by default there.
  • Exceptions as a donut in the band, in the same colours as the chart, with expiring in the footer.
  • Over time became one part, part/PostureOverTime.vue, and moved to the top of framework detail for one pass.
  • The Compliance report carries it too: "The whole record" sits under each framework's window line, whatever the window, with mapping changes and reconstructed ranges.
  • Checked: 123 browser checks, 48 calculation.
• intents-pr5, first review decisions (2026-11-05, Mark): thread intents-pr5.
  • The score joins Over time: a % line above the modes, on framework detail and in the Compliance report. Percentage charts now always read 0 to 100, so 40% sits at 40%. Mark tried it at 48px, found that too short, and went back to 110px.
  • Over time moves to the bottom of framework detail (Mark). It was at the top for one pass.
  • Not mapped by Qpoint and Supporting evidence are gone from framework detail (Mark). Controls with no policy are now only counted, in "How these are worked out".
  • Reports read the lab's own findings: 7 open of 22, the same as the pages, with their real teams, outcomes, reopens and reasons. c128's seeded 571 are gone, and with them the 188 against 22.
  • Data protection and Egress go into the Findings report, beyond PR 6. They're still seeded, scaled by team share. Spend, shadow installs, versions and the fleet posture score stay out.
  • Compliance Score is option A: severity box over seeded checks. Options B–F, the switch and their fields are gone.
  • The 100% example is untracked: out of the reports, and one Track away on Compliance.
  • Checked: 130 browser checks, 47 calculation, 455 tours.
• intents-pr5, second review decisions (2026-11-05, Mark): thread intents-pr5.
  • Kept as built: a framework's bar goes red only when all of it is Off; the numbers read published state, not the draft; the Enforce-pilot thresholds stay flagged placeholders.
  • Policy pills read Off, not Inactive: PolicyTag's label, in the layer. Committed in q-nuxt-layer, not yet released, so the deployed site needs a release to show it.
  • The band's findings box matches Compliance Score: the last 30 days plus anything still open. OWASP LLM reads 7 High and 1 Med, with 6 still open, as the listing does.
• intents-pr5, loosening reads orange (2026-11-05, Mark): everywhere: the Exceptions donut and chart, Policy Config's lines, Change impact, the Policy Config tray, Teams, team Policies and the reason prompts. This changes c121 D8's red. Red stays for what's actually blocked or failed: a refused edit, Publish is blocked, a failed import.
• intents-pr5, light green for can-only-observe (2026-11-05, Mark): in the band's bar and Over time's mode chart, a mapping on a policy that can only observe shows light green, because there's nothing left to tighten. Green shades are done, and orange and grey are work left, so 100% is all greens. Applied per mapping at every score, not only at 100%. observeOnly and modeLine in the fixture, so the band and the Compliance and Executive reports word the counts the same way. The listing's and rows' bars stay one colour, for the %.
• intents-pr5, a quick framework row on Policies (2026-11-05, Mark): part/PoliciesFrameworks.vue shows tracked frameworks with their % and offers Add framework, which tracks at once and changes no policy. Untrack stays on Compliance and framework detail. "Activate All", "Enable Required Policies" and the old % complete stay gone. This relaxes X1's one place to track.

From the brief. The ones this cycle has to answer are marked †.

1. † Control vs policy. Does framework detail show a requirement or control layer above policies (Peterson's "control intents"), or keep c114 D4? F6's policy map almost forces an answer.
2. † What covers a requirement besides policies? Name the evidence sources.
3. Version migration. Does a tracked 2025 edition show "new edition available"? Can an admin track both at once?
4. Untracked frameworks. Can they be browsed with "what would be covered", as a sales and onboarding aid?
5. Two audiences, one export? Does the box-checker get a questionnaire-shaped export?
6. Regulations vs frameworks. The EU AI Act and the CRA are laws. Do they go in the same list, or under a separate "obligations" notion?
7. Starter configs vs frameworks. Is a PCI DSS starter config a tracked framework, or an import? This is shared with c126 O7 and c125.