← Design · c147

review-1.md

c147 review stop 1: the shape, the worlds and the copy

Contents
  1. What to look at
  2. What the copy shows
  3. Calls
  4. Answered (Mark, 2026-11-13: "Take the defaults")
  5. Not built, on purpose

Written: 2026-11-13, after Phases 0–2. Reader: Mark. Status: at review stop 1 (Q7: the first of three). Each call has a default; a call you don't answer takes it.

What to look at

Meridian under S2's defaultsNina's machine under S2's own defaults, Open and Enforced: every one of her 13 findings is Observed, so the copy opens on the zero state.

A group openObserved included, one group open: the policy in context, the plane's remediation deadlines, the member table with the harness where S2 has the subject.

Priya's machinePriya's machine with everything included: the provider policy reads 0 open and 42 resolved, the prevented findings; the MCP group reads 4 past SLA in red.

A prevented findingS1 copied, on a prevented finding: detected → open, prevented → resolved: prevented, recurred the same day; Details without User, Team and Endpoint.

What the copy shows

  1. The operator's defaults show a person nothing. S2 opens on Open and Enforced (c121 D3). Nina's findings are all Observed and Priya's Enforced ones are all prevented, so both machines open on a zero state. The filter that suits a security team's worklist hides exactly what one person has.
  2. The operator's pressure lands on the person. Remediation deadlines and "3 PAST SLA" in red on Nina's own machine, for findings she can't resolve. This is what "prison" looks like in a table.
  3. Prevented is correct and invisible. "0 open · 42 resolved" is true and says nothing to Priya about what was kept safe.
  4. The words are a practitioner's: Why it violates, Applies via, Policy Config v12 at detection, Enforced and Observed.
  5. S2's columns don't fit the native window. At 844 px the harness and framework columns collapse to one pill and a count, and the member table squeezes the finding's name to a few letters.
  6. What the fleet → personal rules removed holds up: without User, Team and Endpoint the rows lose nothing a person needs, since the header says once whose machine it is.

Calls

From the shape (finding-shape.md §10):

  1. from beside the lab's origin. Default: yes.
  2. The person never moves a finding's status. Default: yes; the plane resolves.
  3. The window. Phase 1's data point: the day window gives Priya 42 prevented findings in 90 days; per policy and resource while the mode holds would give two. Default: keep the day window in the shape; the person's view groups them (call 10).
  4. prevented as an event kind and a resolution. Default: yes.
  5. A policy that resolves a finding on training completion. Default: open until Peterson.

From the worlds (Phase 1):

  1. Derived means "once connected". Every world's machine is unconnected; the sidecar says so. Default: keep, labelled.
  2. chatgpt.com. The prototype's provider list says openai.com, and Codex CLI signed in with ChatGPT talks to chatgpt.com, so 23 of Priya's prevented findings come from one domain the list doesn't name. Default: leave the prototype's list as it is and raise it with Peterson as a real policy question.
  3. The recut, for qnative. 4 sessions in Meridian and 13 in pilot report policy events with no detail; the seed has no MCP versions and no consequential flag. Default: ask in Phase 5's brief.

From the copy (Phase 2), for Phase 3:

  1. The person's defaults: Open by default with Observed shown (Q4 already supersedes D3); prevented in its own quiet group. Default: yes.
  2. Prevented as a group with a count ("Kept safe 42 times: Cursor and Codex CLI to unapproved providers"), never 42 rows. Default: yes.
  3. The SLA clock and the deadlines leave the person's view; the shape keeps them for the plane. Default: yes.
  4. Fewer columns for the person: severity, the finding, the harness, when, status. Default: yes.
  5. The rail scrolls once Safety & Security joins it, as the kit's Sidebar does. Default: accept.

Answered (Mark, 2026-11-13: "Take the defaults")

#Ruled
1from (endpoint · person · plane) sits beside the lab's origin on every event.
2The person never moves a finding's status; the plane resolves.
3The shape keeps the day window for prevented findings; the person's view groups them (10).
4prevented is both an event kind and a resolution.
5Open: a policy that resolves a finding on training completion waits for Peterson.
6Derived findings mean "once connected", and the sidecar says so.
7The prototype's provider list stays as it is; chatgpt.com goes to Peterson as a policy question.
8The recut (session detail, MCP versions, the consequential flag) is asked in Phase 5's brief.
9The person's view opens on Open with Observed shown; prevented findings sit in their own quiet group.
10Prevented is one group with a count, never a row per finding.
11The SLA clock and the remediation deadlines leave the person's view; the shape keeps them for the plane.
12The person's member table: severity, the finding, the harness, when, status.
13The rail scrolls once Safety & Security joins it.

Phase 3 builds 9–12 with the words, the noise control and the person's own events.

Not built, on purpose

The person's words, the noise control, the person's own events and the group names are Phase 3's. The lab's S2 and S1 are untouched; Q4's change to the prototype's S2 (prevented resolved at birth, Open by default) is shown at review stop 2.

Qpoint Brand Style Guide