Cycle 144: Theatre Mode

Created: 2026-11-12 Focus: Tours the person's own agent can give over our MCP server. New here, at a level the person picks, from ELI5 to "I have networking degrees". AI, on your own machine, an AI primer with the person's computer as the subject. And the doomsday scenarios: stories of AI going wrong, played out in the dashboard on synthetic data, in theatre mode. Every theatre tour begins with the person and the agent switching synthetic data on together and ends with switching it off. Each scenario's beats double as acceptance tests for the dashboard. Mode: assemblage for the machinery: c125's guide and tour layer, c123's tours and drills, qnative's worlds, streams and native guide, c133's trainings and c137's messages are all present and not yet linked. Alchemy for theatre itself and for the register slider. Problems: problem:unreviewed-mcp-surface, problem:agent-identity-scoped-access, problem:unexplained-ai-spend (S6), and c125's candidate "Can a new customer self-onboard through a guided wizard and embedded documentation without a dedicated onboarding team?"Lineage: c125 (the MCP guide, the tour layer, its rules: actions stay with the person, the person's clicks win), c123 (the five tours, the drills), c131 / qnative c2 (the native guide and the two native tours), qnative c3 (worlds, conditions, streams), c133 (trainings), c137 (messages), c47 (pixel pawns), c142 (cycle tours, a sibling mode). Prompt: initial-prompt.md · Plan: plan.md · Scenarios: scenarios.md

Why

The guide can already walk someone to a policy and explain it. What it can't do yet is let a person see the thing the policy is for happen. Nobody wants a real breach to find out what the dashboard does in one. So the dashboard has to be able to put one on stage.

Pretend data in a security product is dangerous on its own. A screenshot of a fake finding can't be told from a real one. Theatre mode gives pretend data a beginning, an end and a label on every page in between, and the person and their agent start it and end it together.

Two more tours answer the people who aren't ready for any of that. New here explains the product at the level the person asks for. The AI primer explains AI using what is actually on their machine: its model is the brain, its harness is the agent, its tools are the hands. It also says where that metaphor breaks, because every break is where governance lives.

The same scenarios that teach also test. A beat says what the sensor would see and what each page should then show, so playing every scenario is a walk of the dashboard against a story.

The shape

Sketch: /cycles/design/sketches/c144-theatre

• The problem. People learn security by seeing an incident, and nobody can afford a real one. A pretend one that isn't labelled is its own hazard.
• The core idea. A scenario writes only what the sensor would see, beat by beat. The dashboard works out the rest through its real rules. Theatre is one switch for the whole dashboard: it's turned on and off together, and labelled on every page in between.
• The pieces. The catalog (learn and theatre tours), the scenario model (beats, replay at Enforce, gaps), the band and the switch, the register slider, the metaphor with its breaks, the marks and their style axis, and the guide's new verbs.
• The pattern we follow. Content as data drives the panel and the agent alike (c125). A drill is a one-beat scenario. No mock invents a row (c132 D6): scenarios copy across to the native app the way worlds do. The demo is the test.
• What stays open. The calls below. Also how theatre arrives in qdash, and whether a customer can write their own scenario.

Objective

(As ruled at review stop 0.)

1. The scenario model and theatre state in the lab: rewind, replay at Enforce, the band, the switch, and the guide's new verbs. Demoed at /pages/phase4/theatre.
2. Wave 1, all six scenarios (C8), S1 Phishing for financial records first. Each plays in the lab on the person's Next (C2), shows both seats (the operator's pages and the citizen's laptop in the native skin), passes a walk at Observe and at Enforce, and is played by Claude Code from one prompt. Each gap goes to c126.
3. New here at three registers (C4): I'm new to this, I work with computers, I have networking degrees, all written.
4. AI, on your own machine, in the native app on real data: the metaphor, its breaks, and today's marks (C5; the Cute ↔ Swiss axis is parked).
5. Show mode (C10): a tour or a scenario played through the real app, unattended and looping, always in theatre.

Scope

In: the scenario model and its data, theatre state and its band, the guide's additions on both surfaces, the walk scripts, the three registers, the primer with today's marks, the first six scenarios, show mode, and the gaps as catalog candidates.

Out:

• the qdash port, which follows once the lab holds;
• customer-written scenarios;
• extracting the tour layer to q-nuxt-layer (c125's W-packages own that);
• new policies (the gaps go to c126, which decides);
• the marks' style axis, Cute ↔ Swiss (parked by C5).

Review stop 0: ruled (2026-11-12)

Mark walked the nine calls, and a tenth, in another session (local_c9854e17, "Cycle tours skill modeling"), which relayed them here with his words quoted. Each Read line is that session's reading of his shorthand, which he saw and didn't correct. He said "Start Phase 1" after them. (He had also clicked Yes, on defaults here; the rulings are later and more specific, so they hold.)

Open, not a call: S1's cast puts Priya on mac-eng-07 (the lab's SUBJECTS, used across the drills and mocks), while the native pilot world names her laptop priya-x1. Under c132 D6 the two surfaces read the same world, so one name changes. Mark's to pick.

Key Changes

• opened (2026-11-12): from Mark's prompt, the same day. The survey found most of the machinery already built (initial-prompt.md § What already exists). Written the same day: plan.md (the catalog, the theatre rule, the scenario model, the register slider, the metaphor and its breaks, the marks, the MCP additions, the scenarios as tests, seven phases), scenarios.md (wave 1: six scenarios beat by beat, Mark's five plus a runaway loop; wave 2: thirteen more by who does it; seven gaps), and the sketch c144-theatre, captured. Nothing built yet. At review stop 0, with nine calls.
• Phase 1, the lab (2026-11-12), at review stop 1: built on the rulings, uncommitted. The pieces, each extending the c125 tour layer rather than standing beside it (Mark: "We already have a theatre harness–the tour guide"):
  • The scenario model (app/data/scenarios/): types.ts, detect.ts (one sensor event in, the policies it raises out, read from the world's own configuration: sanctioned list, pinned versions, detectors on, TLS floor, spend ceiling), play.ts (the world at beat N = live + the set + beats 1..N, folded by applicability(); Replay at Enforce as a user exception on theatre's copy). Wave 1, all six (C8), one file each; the five c123 drills ported as one-beat scenarios.
  • Theatre state (useTheatre): on/off, scenario, beat, replay; per tab (sessionStorage); ?theatre=<id>&beat=<n>&replay=<P> a way in for links and the walk. The governance mock's world is the play while theatre is on; staging, saving to the draft, publishing, rollback and import refuse.
  • The stage (components/theatre/): the band (ink, marquee bulbs; theatre's own material) and a frame round the window; the Theatre switch at the foot of the rail (picking a story starts its tour, C1); the panel's theatre note (waiting for the switch, the beat's findings and quiet policies, gaps, the replay picker and the trainings at the replay step); the three-stop register in the panel (C4).
  • Theatre tours (data/tours/theatre.ts): one per scenario, generated (curtain up, a step per beat, replay, curtain down), in TOURS and the catalog. Beats move on the person's Next (C2); S6's beats 3 and 4 move on by themselves; ?theatreTest=1 lets a harness run play beats.
  • The guide (qpoint-guide 0.4.0): list-tours' kind, data and scenario; tour-state's theatre and register; read-step's beat, played result and trainings; replay. No tool turns theatre on or off or plays a beat; set-register was built on the defaults and removed by C4.
  • Show mode (C10, brought forward at Mark's ask): useShow, ShowRunner, ShowControls, the list at /pages/phase4/show; a show runs in theatre, dwells ~8 s a step, loops, pauses on input, resumes after 3 idle minutes (or not), End show leaves you where it was.
  • Demo /pages/phase4/theatre (empty, minimal, typical, overflow, error; a scenario beat by beat at three registers; the replay matrix; every scenario's authored replays against the play).
  • Trainings (c133, use what exists): T-INJECT-1 on S1 (written for it by the "Cycle tours" session, 99865de0b0), T-MCP-1 on S2, T-SECRETS-1 on S3, each opened on the story's own finding. The four wave 1 wanted were written by c133 on 2026-11-13 (review-9-wave1.md) and are wired: T-PROVIDERS-1 on S5, T-PROVENANCE-1 on S2 and S3, T-APPROVAL-1 on S1, S3 and S4, T-SPEND-1 on S6. A stopped act's evidence now says what was attempted (Raise.ifStopped: "held for approval", "blocked at connect", "denied", "blocked on the way to"), so a replay's finding and its training agree. Native bundles each with its scenario.
  • Records: scenarios.md § As built (eight corrections the play made to the first draft: casts, five policies Off org-wide, three policies that can't enforce, sanitization that doesn't save S1, the PHI-only boundary); gap 1 rewritten (C9) and gap 8 added (a spend ceiling that can act). Priya's laptop renamed mac-eng-07 → priya-x1 across the lab and qnative's two training fixtures (the "Cycle tours" session's call, made on Mark's behalf: "your call").
  • Checked: scripts/theatre-check.mjs 176/0 (T1 every scenario's test lines and replays on Findings, 129; T2–T4 the guide, C2's exceptions, safety, 35; T5 Show mode, 12); tour-drive-check.mjs 187/1 (the one: example-complete, hidden since 2026-11-05); tours-walk.mjs 455/0 (theatre tours skipped there, walked by theatre-check).
  • Captured: scripts/shot-programs/c144-phase1.json, nine shots (c144-theatre-*, c144-show-*).
  • Native S1 (Mark: "Yes, both now"), built in qnative on its existing tour guide by a background agent of this session; uncommitted (qnative HEAD still 880451a). Pieces:
    • the tour crates/app/tours/theatre-phishing-financial-records.json, after New to Qpoint and This machine in the catalog;
    • nozzle/src/theatre.rs: each beat's events added to the pilot world in the stream scripts' shape, and going back rebuilds;
    • the curtain on the existing synthetic switch (the tray's world, Dev › Source);
    • the band and frame;
    • the guide's theatre state, C2's refusals, replay and QPOINT_THEATRE_TEST;
    • T-INJECT-1 bundled for the replay step;
    • 13 theatre_* story tests. cargo test --workspace 202/0. Launch: cargo dev -- --data synthetic --world meridian-day90 --tour theatre-phishing-financial-records. Not done natively: findings drawn per beat (no policy engine; the panel names the lab's), Status, Inventory and cost folding the story, theatre's messages (C6), S2–S6. Captures: scripts/shot-programs/c144-native-theatre.json.
  • Review fixes the same night (Mark, trying it):
    • the panel flapped side to side at the replay step: it rang its own replay picker. Fixed by ringing Findings, and the tour now never rings inside its own panel (queryTarget);
    • the register is a select ("a select that can be changed rather than omnipresent buttons"), in a tour config that opens and closes from the panel's header ("hide this behind a tour config");
    • the panel's title is one line ending in an ellipsis, the full name on hover, and its three icons (config, minimize, end) sit closer together ("a scrolling title, or one that ends in elipses … we can move the icons closer together");
    • the README's Tours and theatre section says how to run all of it, the native app included (Mark: "update the README with clear instructions").
    • "Simulation mode", not theatre ("let's call it simulation mode instead of theatre, keep the icon"). The product's words changed: the switch, the panel, the tours (Simulation · …, steps Start / Finish), the guide's instructions and errors, the concept, the README. Code ids, URLs (?theatre=) and the API's theatre fields keep the name.
    • The band became the simulation panel ("keep it stylistically closer to the tour … the info panel that opens / closes at the bottom of the app"). It's in the tour's material (#0099ff on white). One line is always there (Simulation · synthetic data · nothing here is happening on your machine, the story, the beat, Leave simulation), and Info opens the rest (what a simulation is, the logline, the set, the replay picker when no tour holds it). The frame is a thin line in the tour's blue.
    • Each beat points at what it brought ("I didn't quite understand what was being pointed at", on S3). A beat rings the Findings rows its own test lines name, with a callout in Mark's words: "See: at 09:30 Qpoint noticed a policy was broken: Restricted file access. This is where it shows in the dashboard. It can also send a message to Slack #sec-alerts" (the lab's connected channels that take the severity). A beat that raises nothing points at the story's clock, and the tour panel says why: off stage, a quiet policy, or a setting that doesn't cover it.
    • "Click here" callouts ("callouts like 'Click Here' "). TourCallout.click draws a bold label with a large arrow nudging toward its target; show(ctx) hides it once it's done. Used at Start ("Click here to start the simulation") and Finish.
    • Native, the same round (uncommitted): the rename, and the band moved into the footer (one line, always there) and the Info View (the story, the beat, "Stopped at", the source, Leave simulation) in the tour's blue; a new story app-theatre-info; cargo test --workspace 202/0; recaptured, 14 shots. "Click here" isn't native yet: the native callout has no such style, and the switch is in the tray, outside the window. The Info View's sentence about publishing and the draft came from the lab and didn't fit the native app; at Mark's yes it now reads "When it ends, the app goes back to the data it showed before" (tests 202/0, recaptured).
    • Checks after: theatre-check 182/0 (each beat now also checks it points at what it brought), tour-drive-check 187/1 (example-complete, as before), tours-walk 455/0.
    • One click in the tour ("let's make the switching on of the story a single click in the tour"). The Start step's panel has Start the simulation, and Finish has End the simulation: a tour action of kind simulation, the person's click (C1 holds: the guide can't press it). Each shows only until its goal is met, and the rail's switch still works. The Click here arrows at Start and Finish gave way to the buttons. theatre-check 184/0. Native: sent to the native agent.
    • The highlight in dark mode, and a blur ("the overlay should lighten the page allowing the highlighted section be stay dark … is there a blur we could apply?"). In dark mode the tour's overlay now lightens (white at 32%), and an optional backdrop blur softens the page outside the highlighted regions (TourDim's blur). Knobs for the experiment: ?dimTint=&dimStrength=&dimBlur=&lookMode=, and a comparison page /pages/phase4/tour-highlight (six looks side by side in dark mode, plus a tunable one). Mark picks; the native overlay follows.
    • Temporary look controls, web only ("would you mind creating temp controls so I can dial in the opacity, color and blur amount?" … "just in the web view for starters"): TourLookControls, on any lab page with ?lookControls=1. It has a colour picker with presets, opacity, blur, a light/dark switch, Reset and Copy values. It drives the host's look live through shared state (qp-tour-look-knobs) and is linked from /pages/phase4/tour-highlight as Dial it in live.
    • The dark-mode look, picked (Mark, with the live controls): "#7281ca at 44% · blur 1px" is the dark default (TourHost DARK_TINT, DARK_STRENGTH, DARK_BLUR; the controls' Reset follows). Light mode stays #73858f at 60%, no blur. Sent to native: the same tint and opacity, and the blur if GPUI can draw one.
    • Dark mode, finished by eye:
      • "let's add a dark ring around the hole": TourDim draws a ring just outside each cut-out, #080a14 at 3 px in dark mode, none in light mode;
      • "the text can be a shade lighter of cyan": the v4 tour's words in dark mode are #5cc2ff (--tour-text-dark), and so are the simulation panel's; fills and outlines keep #0099ff;
      • "Let's make titles white": dark-mode titles are white (--tour-title-dark).
      • "let's make the circle white with cyan text", then "the number in the disc black, and black weight … a cyan outline 4ps thick": in dark mode the callout's number disc is white, its number black at weight 900, with a 4 px #0099ff ring (.tour-disc). The look controls gained Ring (colour, width), Text and Titles. All of it was sent to native.
    • The callout disc, settled (after white with a black number and a ring): "let's return to cyan bg, white text, bigger font, still black weight". The #0099ff disc with a white number at weight 900, bigger (36 px with a 20 px number; small 26/15).
    • Numbers only where they match ("WE should only show a number when it corrosponds, and we should show that same number to the point we are making"; then "the correlation is much better!"). A beat has one numbered callout per row it brings, in the order of its test lines, and each row gets its own highlight. The tour panel lists the same findings with the same numbers. A callout that matches nothing has no number. Every finding a beat raises now has its test line (sanitization added to S1, S2 and S5), so each gets its number. theatre-check 190/0.
    • "Simulation on", quiet, in the panel's chrome ("let's add the simulation on thing much more subtle and part of the panel chrome"): a small mask and "Simulation on/off" at the right of the panel's step-count row; the heading inside the step's note is gone.
    • Native, round 3 (uncommitted, cargo test --workspace 208/0):
      • the one-click Start/End in the panel (a simulation action);
      • the callout pointer: the engine was right, and two tours' data aimed the callout at the wrong card (Providers aimed at Tokens; Tools ringed one card and pointed at another). Fixed, with a story test of every callout's pointer in two worlds and two sizes. Models and Tools callouts at 1120 px still hide under the tour panel; that stays open;
      • the dark look (no blur: GPUI can't draw a backdrop blur without a renderer change). The disc revert, the numbering rule and the quiet mark were sent the same night.
    • The panel's policies look like Findings' rows ("it also might make sense to show the policy inline display component when we are talking about that … IE, these should look the same"): in the tour panel each finding is now its severity ribbon, the policy's name and its id, as the Findings row draws them, with its number and its outcome.
    • Each finding in its own box ("draw a box around this item and change the 1 finding at 9:30 text so that the two correlate"). Each box carries its number, "New finding at 09:30", the policy and the outcome, and the loose count line is gone. The note itself is no longer a box.
    • Dark-mode polish (Mark):
      • "make the outline color a bit lighter": the finding boxes' outline is rgb(150 214 255) at 55%;
      • "make the simulation on lighter blue with a white dot instead of that icon": the panel's mark is a white dot and lighter blue words;
      • "the unhighlighted steppers are too dark": the stop bar's other segments are rgb(150 214 255) at 35%. All in tour-material.css; the two that apply natively were sent.
    • Native, round 4 (uncommitted, 209/0): the cyan disc, numbers dropped where nothing in the native panel matches them (ten callouts across the three tours, new-to-qpoint.json included, the other session's committed tour), and the quiet "Simulation on" mark.
    • Native, round 5 ("let's propagate these changes to the native app"; uncommitted, 212/0):
      • the dot and the lighter stepper;
      • each lab finding in its own box, labelled honestly ("In the lab: new finding at 09:05"), with a new QGUIkit PolicyRibbon;
      • the register as a dropdown in a settings drawer;
      • the one-line title and the 28 px icons. Recaptured: c144-native-theatre.json, 17 shots, including the drawer and the highlight in both modes.
    • Native Help mode ("turning help mode off doesn't change anything if the panel is still open, make sure that actually changes the mode"): off only changed what the open panel says over empty space, and whether it reopens. Sent to the native agent: the switch takes effect at once, both ways, with tests.
    • Point only at what matters (Mark, on the native start: "what are we highlighting here? What are we saying? what really matters, let's be clearer"):
      • the lab's Start and Finish steps ring nothing (the panel's button is the action);
      • the replay step rings only the row of the policy that stops the story, with a callout saying where and why.
      • The native tour's whole-list and whole-page rings were sent to the agent: each beat rings the session or tool call it added, with a callout saying what happened then.
    • Off-screen moments as scenes ("should we be showing an screen like in remediation training instead of trying to show someting in the dashboard? WE could have a page that's blank and shows scenes", then "Draw all the scenes"):
      • a beat that happens off the machine names a c133 training scene (ScenarioBeat.scene), and its tour step goes to a blank scene page, /pages/phase4/mock/scene;
      • the page shows the moment ("Off screen · 02:40 · beat 1 of 5"), the scene drawn large and the beat's line at the person's register, with the simulation panel still along the bottom;
      • five new scenes, drawn the trainings' way (pawns, sketch boxes, one flow arrow) and catalogued in data/trainings/scenes.ts: skill-update (S3 b1), share-request (S4 b1), public-link (S4 b4), ticket-card (S5 b1) and stranger-asks (S5 b3); S1 b1 uses T-INJECT-1's hidden-instruction;
      • read-step tells the guide a beat is off screen, and the check confirms the scene page shows the right scene;
      • native S1's email beat was sent to the agent.
    • Native, rounds 6–8 (uncommitted, 218/0):
      • Help mode: the switch now takes effect at once, both ways. A page change closes the panel when it's off.
      • Each beat points at the one row it added: the TH-S1 row, then the Grep, Read and gmail.send calls, with "New at…" callouts. Start, b1 and Finish ring nothing.
      • A native scene page (/simulation/scene): S1 b1 shows T-INJECT-1's hidden-instruction image. S3–S5's scenes still need exporting.
      • "Off on what page": the walk tests found no real desync. The cause was two copies running: the guide went to the old build, which grabbed port 7891 first. One bug fixed: Back did nothing once the simulation was off.
      • A single-instance guard: a second launch brings the running copy forward and exits (QPOINT_ALLOW_SECOND=1 overrides).
      • Still open: the scene page's image overflows its space, sent back the same night.
    • Native S1's session page, checked with Mark ("are these pages correct?" … "let's proceed"):
      • the beat's model request was missing from the page, so it gets its own row, ringed;
      • the session showed $0, so the stories' model requests now carry a cost (costUsd: S1 0.05, S2 0.08, S3 0.06, S4 0.19, S5 0.002), the lab half done here;
      • "Cursor CLI" against the lab's Cursor goes to the pilot world's own harness for Priya (the world wins, reported back);
      • raw {"summary":…} JSON in the transcript is replaced by plain text;
      • three caveat paragraphs become one quiet line, with the detail in Info. All native-side items were sent to the agent.
    • Native, rounds 9–10 (uncommitted, 221/0):
      • the scene page fits beside the tour at any size (tested at four sizes, in light and dark, with the placeholder);
      • beat 4's model request is its own row (Claude Sonnet · api.anthropic.com · 14.2k tokens · $0.05 · carries: bank account, SSN), ringed with the Read;
      • the session shows $0.05;
      • plain-text arguments;
      • one caveat line, the rest in Info;
      • overlapping highlights merge into one ring. Harness: the pilot world has Priya only on Cursor CLI (cursor-agent, 20 sessions), so the native app says Cursor CLI. Whether the lab follows (c132 D6: the world wins) is Mark's call. Recaptured.
    • Native committed (2026-11-13, at Mark's ask relayed by "Live activity viewer parity", which builds on the tour next): qnative 32c9b03 (trainings: T-INJECT-1, priya-x1) and d94716f (simulation mode, S1 in the tour guide), on main, pushed since. The design half followed at Mark's "Yes, commit design".
    • Native callout pointers ("the pointer is often in the wrong place", This machine tour on Providers): sent to the native agent with the screenshot.
• New to Qpoint, Mark's review (2026-11-13; qnative e4fc308, pushed): Mark reviewed the native New to Qpoint tour live and sent the changes one by one, all built in qnative. They extend this cycle's tour layer: the highlight looks, callouts and panel.
  • Copy. Status's callout is now "The dot turns green when the sensor is working." Its description had a focused edit, Sensor's callout was relaxed, and the chip reads "Is it running?".
  • Rail mark. The step's row in the rail can be marked five ways (RailMark: off, hole, ring, clear, note). It's off until Mark picks one.
  • Help. The Ask the guide and Info View highlights take in their whole sections. Ask the guide has a "Connect your agent" callout, and Info View's chip has "Try it".
  • Activity. The step has no highlight. Each chart and Recent Work has a numbered, titled callout, and the panel lists them with each card's figure.
  • Callouts. They have a light-blue outline, avoid each other, and follow their target while the page scrolls. That last fix isn't verified live.
  • Panel.
    • The hovered stop's name shows under the bars.
    • A grape "Click me" pill sits on an outline round the step's chips.
    • The panel can be undocked into a draggable card, from its left-edge grip, its header, or the guide's set-view docked.
  • Status page. The dot is 26 px, and the machine shows as the endpoint chip.
  
  Captures are in rail-mark/. Mark's idea of a tour that connects and configures the app opened as c145 (stage 1: initial-prompt.md and plan.md with four rulings to make). That work came from the "Live activity viewer parity" session.
• Committed, deployed and prepared for archive (2026-11-13):
  • Committed: the lab work, at Mark's "Yes, commit design", as design 8414bc08cc: 106 files, only c144's lines from the shared files, other sessions' work left alone.
  • Trainings: c133 wrote the four trainings wave 1 wanted (463237c3a1, review-9-wave1.md). They are wired in b3251694bb. In the same commit, a stopped act's evidence reads as attempted. theatre-check 190/0.
  • Pushed and deployed at Mark's "Yes, push and deploy".
  • Records: Mark asked to "update any histories in prep to be archived", so the Outcome below, the HISTORY.md entry and the story are written.
  • Calls walked at the close (Mark: "walk any questions here then let's proceed"):
    • Priya's harness: "Cursor CLI in both". The lab follows the pilot world (c132 D6). SUBJECTS.priya, her S-6 session and S1's cast and test lines say Cursor CLI.
    • The temporary look controls: "Keep behind the flag". ?lookControls=1 stays a lab tool.
    • The native Models and Tools callouts under the tour panel at 1120 px go to qnative c12 Punch List, item 2.
    • The carried-forward phases: "Open stage 1 now". They become c149, Simulation Mode, Both Seats, stage 1.
  • Closed: c144 is drained from CYCLES.md and its HISTORY.md entry written.

Follow-ons

• A policy display component coloured by the finding's status (Mark, 2026-11-12, noted for a follow-on cycle, not this one). In his words: "we should probably be consistent and use our policy display component here, or build a version that shows hot/warm/cool status. But let's make that a follow on cycle rather than addressing here", and "I'm imagining the new work looking exactly like the current displaoy component does, but getting colors depending on the status of the finding".
  • Today: the Findings rows draw the policy by hand in governance/live/FindingsLedger.vue: SecurityPolicyRibbon, with its state from sevRibbon(severity) (hot/warm/tepid), then the name and the id. The tour panel now copies that markup (theatre/StepNote.vue). The layer has the pill PolicyTag and PolicyRibbonMark beside it.
  • The cycle: one component that looks exactly like that display, with its colours set by the finding's status, used by Findings, the tour panel and anywhere else a policy is named.

Outcome

Closed 2026-11-13, after Phases 0, 1 and 5 and native S1. Review stop 1 happened live, one round at a time, rather than as a single stop.

• Made:
  • The scenario model. A story is written only as what the sensor would see, beat by beat. The world's own rules derive the findings (detect.ts, play.ts), and Replay at Enforce is an exception on the simulation's copy. Wave 1 has all six stories, and the five drills are one-beat scenarios.
  • Simulation mode in the lab (renamed from theatre):
    • the person's one click starts and ends it, and the person's Next moves the beats;
    • the simulation panel runs along the foot of every page;
    • each beat rings the rows it brought, numbered to match the finding boxes in the tour panel;
    • off-screen beats show as training scenes on a blank page (five new scenes);
    • the replay rings the row that stops the story;
    • seven c133 trainings open on the story's own finding.
  • Show mode (C10): a story or tour plays unattended, in simulation, and loops.
  • The guide's contract (qpoint-guide 0.4.0): the guide reads the simulation and waits for the person. It never turns the simulation on and never plays a beat.
  • The tour's dark-mode look: #7281ca at 44% with a 1 px blur, a dark ring, lighter cyan text and white titles, dialled in by Mark with temporary look controls.
  • Native S1 in qnative's tour guide (d94716f, 32c9b03): the nozzle plays the beats into the pilot world. It also has a scene page and a single-instance guard, with 221 tests.
  • Checks: theatre-check 190/0, tours-walk 455/0, tour-drive-check 187/1 (the known example-complete).
• What the play taught. Playing the stories corrected the first draft in eight places (scenarios.md § As built). Three policies can't enforce, and spend has no action. Five policies are Off org-wide. Sanitization doesn't save S1, and the data boundary prohibits PHI only. These went to c126 as gaps, with gap 8: a spend ceiling that can act.
• Not done, carried forward to c149, Simulation Mode, Both Seats, opened at stage 1:
  • Phase 2, both seats: the citizen's laptop beside the operator's pages, the simulation's own messages (C6), and a harness playing S1 from one prompt;
  • Phase 3: New here at three registers. The native New to Qpoint tour exists, at one register;
  • Phase 4: the AI primer (this-machine.json grown into it);
  • Phase 6 for S2–S6 natively, with their scenes exported and c133's four new trainings bundled;
  • Phase 7: what goes to the layer and to qdash;
  • the open calls, ruled at the close:
    • Priya is on Cursor CLI in both surfaces;
    • the look controls stay behind their flag;
    • the native callouts under the panel go to qnative c12 item 2;
  • the follow-on above: the policy display coloured by the finding's status. It stays its own cycle, not part of c149.
• Lessons:
  • The world derives, the story doesn't. A story that writes only what the sensor sees tests the dashboard and the story at once. The play caught eight mistakes that a hand-written list of findings would have kept.
  • Point at one thing, and number only what matches. "What are we highlighting here?" came from callouts aimed at whole regions instead of at the row a beat added. The numbers made sense once each one appeared in both the page and the panel.
  • Off screen belongs on a scene. An email arriving or a skill republished overnight can't be pointed at in a dashboard. A blank page with a training scene shows it.
  • Rule out a stale copy before diagnosing a desync. Two native copies on one guide port looked like a desync. A single-instance guard ended it.