c133 · Phase 5 review stop: the hand-off and the library (2026-11-12)

For: Mark. This is the stop at the end of Phase 5: Phase 4's two small things are fixed, D34's reorder is in the file, the hand-off to c134 and c131 is written (handoff.md), and the library is mocked in the lab. Seven calls for you at the end; the items waiting on others are listed after them.

Where to look

Captures: thread "Phase 5 · T-MCP-1's choices reordered (D34)" (scripts/shot-programs/c133-p5-reorder.json, two shots) and thread "Phase 5 · the training library" (scripts/shot-programs/c133-p5-library.json, five shots).

What was done

1. The two small things (commit e1851bdfb6). Corrections in Reports read "0 in this window" for a record at the cutoff because the lab has two clocks: the reports' data ends on 29 October (REPORT_EDGES.anchor), and the lab writes a record at the world's clock, 1 November. A window that runs to the reports' last day of data now runs to the cutoff; a closed window (last month) still reads 0. The section's source line names training.completed.* (D27).
2. D34 (commit c3a45d491f). T-MCP-1's choices reordered: the right one sits third, first, second, third (q-need kept its order). No word changed, so the version stays 1 (D31); the content hash moved from 59b77beacc0f… to ed4d2679c3cd…. The voice check passed on the check as User A reads it; the preview page passes on 77 texts. publish.md's example names the new hash.
3. The hand-off: handoff.md, for c134 and for c131 and qnative c4. qnative c4 already has training-assignment, training-completed and start-training as types; its Start training answers "not on this build yet" (crates/app/src/messaging.rs:468).
4. The library: a lab mock in the qdash shell, /pages/phase4/mock/training-library. It lists every published training from the collection with its minutes, its policy, what it covers (the training's own matters sentence) and the person's record: Assigned (a finding of theirs waits; Start opens the training on that finding), Recorded (the latest record; Take it again), or No record (Take it on your own). A training on its own has no Assignment stop, the same check and retake, the record shown before it is written, and one audit row. Registered under the collapse c133-training; the phase-4 index lists it in its Trainings section. Every new sentence went through check-brand-voice (productUI) with zero violations: the page's own words, the record card's two new lines, and the three trainings as read on their own.

How a training reads on its own

A training is written for a finding (R2), and every file's slots expect one. The library fills it without one, in app/data/trainings/library.ts:

• From the reader: their machine, their team, their name.
• From the policy: its name and its owner. For MCP, the sanctioned list, plus a server the organisation allows another team under an exception (Vanta MCP, GRC's). For secrets, the detectors and the check that is off, and the policy's first detector (an AWS access key) for the kind of secret.
• Our words, in code: "your agent" and "a personal account", where a slot names the finding's own thing.
• Left out: a step or question whose text or drawing still needs the finding. The page says how many steps remain and why.

slots.ts was refactored so the finding's fill and the library's fill share the policy-level helpers (ownerOf, serverSlots, detectorSlots). The 20 training pages on five findings and the preview page render identically before and after.

The calls for you

1. Library words. The derived reading is honest but thinner, most of all for secrets (two steps). The options:
   • (a) Keep the derived reading: no new words, and the left-out steps are the ones about a machine.
   • (b) Give each file words for the library: a library: paragraph on its finding-bound steps, or a # Library section. This changes the parser, the authoring format, the skill and the hash.
   • (c) No self-taken trainings: the library lists only what a person has a finding for.
   
   Proposed: (a) now, and (b) only for the secrets step "What to do about this key" if two steps feel too short there.
2. The self-taken record and D24. It has no finding_id, no message_id and no assigner. D24's association works by person and policy, so the plane can still show it on the person's earlier findings under that policy. Proposed: show it there ("taken on their own on "), but it answers no finding in Reports; only a completion that names a finding answers one. The library sends a person with a waiting finding to the assignment (Start), so the case arises only with no finding or after a record. The alternative is to count it as answering every open finding of theirs under the policy.
3. The event's name: training.completed.self, by D27's rule that the type says who asked (here nobody did). The alternatives are a bare training.completed or .library. Proposed: .self, and Tyler names it with D22–D27.
4. What the record names. A record on its own names the published training's version and hash, though the person read a subset. The subset is derived from that text and from the absence of a finding, so the pair still identifies what was read, and the check line (3 of 3) says how many questions. Proposed: keep. The alternative is a second hash over the library reading.
5. Self-taken completions in Reports: today they count in no section. Proposed: not now. A count in Corrections ("taken on their own: n", no names, D10) later, if operators ask.
6. The contact line on its own. The file's contact.how names the message that brought the person, and on its own there is none. The library page writes one line for every training: "Questions about this training or the policy? Ask IT, or , who owns the policy ." When the owner is IT, it says "Ask IT." Proposed: keep the page's line. The alternative is a contact.library field in each file.
7. The examples the library reads. On its own, the MCP lesson names Vanta MCP (the server GRC's exception allows) and the secrets lesson an AWS access key (the policy's first detector). They are the organisation's facts, not another person's finding, so D10 holds. Proposed: keep.

Waiting on others (the hand-off's open items)

• Tyler on D22–D27 (event-shape.md §8): the crate, the event names with .self, retention against report windows, and whether the app or the plane ends the assignment message.
• c134: the person's frame for the training page and the library (plan, question 5); where the JSON lands at release and the step that copies it (D29; not built); D2's training field and an owner on the policy (c121).
• qnative c4: Start training opens the plane's training URL once c134 names the route and the plane connection signs the browser in (c131 D13).
• Peterson: personnel data (D10) and the self-report (D33).
• The brief's PR in market-analyst (Phase 0).

Small things found on the way

• The dates. D28–D37 and the Phases 3–4 review carry 2026-11-12, the UTC date (the captures' capturedAt), while the local clock read the evening of 2026-11-11. Phase 5's records use 2026-11-12 to keep the order.
• A second dev server, briefly. At the start of this phase the browser tool's preview_start started a second dev server on :3001, although :3000 answered. It was stopped within a minute. :3000 kept answering, and nothing else was touched.

Ruled (2026-11-12)

Mark walked the seven calls in the c142 session (the cycle tours) and ruled them the same day as D38–D44 (plan.md):

1. Library words: (b), words per file (D38), not the proposed (a). Each file gets its own words for a reading with no finding. This changes the parser, authoring.md, the /training skill and each file's hash. The build proposes the form and whether the version moves.
2. The self-taken record: as proposed (D39). Shown on the person's earlier findings under that policy; it answers no finding in Reports.
3. training.completed.self: as proposed (D40), with Mark's note: "this could be used to further demonstrate a strong posture when high. We can offer training around areas that are confusing to a user and categorize as training self." That opens trainings on a topic rather than a finding (plan.md, clarifying question 6).
4. What the record names: as proposed (D41). Version and hash, no second hash; under D38 the hash covers the library words.
5. Self-taken completions in Reports: counted in Posture as a strength (D42), following the note on call 3, in place of the proposed "not now". Counts only, no names (D10); not in Corrections.
6. The contact line: as proposed (D43). The library page's line.
7. The examples: as proposed (D44). The organisation's own facts.

What this leaves to build (Phase 6, when Mark kicks it off): the library words in the three files and the parser, format, skill and hash that carry them (D38); the self-taken record on the person's findings in the lab (D39); a self-taken count in the lab's Posture report (D42); and a proposal for trainings on a topic (clarifying question 6).