Policies Final Pass

On Oct 23 the team walked the lab and asked for no changes, so the policy model is settled. But the lab got there by accretion over four sessions, and each fact about a policy now lives in more than one place:

• mode and severity are editable in the header and again in sections below;
• the listing rows open editors that the detail page also hosts;
• there are two histories;
• the listing is titled "Control Center" under a rail that says Policies.

None of these is wrong on its own. Together they are what the qdash port and the API (P-new-3, API-first) would inherit. Mark wants a slow, careful hand on each part before that happens.

Each aspect of the policy surfaces is walked, hand-tuned and signed off by Mark, one at a time. When the pass is done:

• One home per fact. Mode, Until, severity, exceptions, frameworks, findings, history and configuration each have exactly one editor. Every other mention is read-only and links to it (brief C1–C4).
• The listing is "Policies" and holds only policies. The frameworks strip, Custom controls and Evidence packet leave (C5). The frameworks parts go to c123.
• Dead parts are marked superseded and unlinked from the mock shell, with the trail kept (C6).
• The policy page shows what a policy evaluates: action types, explicit rules, and implicit questions with their defaults, plus what the admin may change on a built-in (O3–O5). We draw what the open items allow and record the rest as questions.
• The pilot reads as an exception (P-new-2): tightening to Enforce for one team is the obvious move from the policy page.
• The data chart exists (O8): every field the policy surfaces read, mapped to its one place in Policy Config.
• Nothing in the ruled model changes. If the pass finds a reason to change it, that goes to the next product session as a question, not into the lab.

The walk, in order, one aspect per stop:

1. Policies listing (/pages/phase4/mock/policies, useControlCenterMock.ts, live/Controls*.vue): the title, rows, the quick mode change routed into the draft (C2, C5).
2. Policy header (part/PolicyOverview.vue): a read-only summary, or the editor, but not both (C1).
3. Mode and Until (ModeUntil): on the policy and on exceptions, the same control.
4. Severity: organization severity next to Qpoint's recommendation.
5. Exceptions: reason when loosening, risk-exception language (P-new-1), the pilot exception, Change impact.
6. What's inside a policy: explicit and implicit rules, action types, editable vs fixed (O3–O5).
7. Frameworks on the policy: which requirements this policy serves. We link out to c123's treatment and don't re-host it.
8. Findings on the policy: Observed vs Enforced, and the link to Findings.
9. History (part/PolicyHistory.vue): Policy Config history filtered to this policy (C4).
10. Policy Config (/mock/policy-config/*): draft, Change impact, publish, versions, JSON, import, propagation.
11. Team Policies (part/TeamPolicies.vue): a derived, read-only view that links to each exception (C3).

Each stop runs the same loop:

1. A before capture.
2. Mark's walk and notes.
3. An Illustrator export of the region when the change is visual (/illustrator).
4. Mark reworks it by hand.
5. We build it on a test page beside the current one.
6. Compare the two.
7. Promote the new one into the lab.
8. Commit.

Out:

• the framework surfaces and the framework parts of these pages (c123);
• the policy catalog rename itself, until Rob's minimum set (O2) and the naming convention (O1) arrive. When they do, C7 becomes a stop of its own;
• the qdash port, which follows the pass.

• kick-off (2026-10-27): Stage 1 and Stage 2 written together from Mark's direction and the market-analyst brief, alongside c123 and c125. Nothing built yet. The tree already holds uncommitted lab edits in governance/mock/Bar.vue, PublishTray.vue, useGovernanceMock.ts and governance-parts.ts from an earlier session. Check whose they are before the first stop touches those files.
• before captures (2026-10-27): thread c126-before: c126-before-policies (stop 1), -policy-detail and -policy-detail-adoption (stops 2–9, P-MCP), -policy-config (stop 10), -policy-config-history (stop 9/10, C4) and -team-policies (stop 11), with -full renders, in public/cycles/design/. Program scripts/shot-programs/c126-before.json. These are the lab as c121 left it, before any stop.
• ruling (2026-10-27): the pass runs at the page level, not stop by stop. Mark looks at each page whole and names what feels off or hasn't caught up to our understanding. The eleven aspects and C1–C7 become a cross-check after his read. The pages, in order: Policies listing, policy detail, Policy Config (draft, history, config file), team Policies. Illustrator exports follow his notes; they aren't prepared ahead.
• intents PR 5 (2026-11-05): c123's thread intents-pr5 found three things on these pages: the frameworks strip has to go (already C5), the "Active frameworks" column and PolicyFrameworks need PR 5's terms, and framework-track leaves the Policy Config draft. Details in c123's plan, Phases 2 and 5. All three were built on these pages the same day; the title, Custom controls and the Evidence packet are still c126's.

From the brief, to settle at the stop they belong to:

1. Does a mode change from the listing open the policy, or write a draft change from the row? (C2, stop 1)
2. Does the header stay editable, as built for the severity picker, or become a summary? (C1, stop 2)
3. Are implicit rules part of the policy page or a list of their own? (O3, stop 6)
4. Are Rob's minimum set, the wizard's recommended baseline and the "standard" starter config the same artifact under three names? (O2/O7, shared with c125)
5. What does the qdash port need that the lab doesn't show yet: empty states, permissions, the lock while the shared draft is open?