c147 review stop 2: the person's view

Written: 2026-11-13, after Phase 3. Reader: Mark. Status: at review stop 2 (Q7: the second of three). Each call has a default; a call you don't answer takes it.

What to look at

• The person's view, live: Findings on Nina's machine · on Priya's · a finding (try Ask IT) · a prevented one · Settings
• The copy beside it: the copy of S2 · the copy of S1; each person page has a "the copy ⇄" link in its lab bar
• Q4 on the prototype: the lab's S2 today · under Q4

Priya's machine: 12 Observed and open in five columns, the policy under each finding, no SLA clock; Prevented as one quiet group, a line per thing with its days, never 42 rows.

A finding for the person, after Ask IT: what happened, why the company's policy covers it, what she can do; her note joins the history as "you asked IT", and the finding stays open.

How much should qcontrol tell you: each position with what it would have announced on Priya's machine in 30 days (none, 8, 22); each kind under the chosen one; the tray counts only what needs her.

The prototype's S2 under Q4: Enforced findings resolved as prevented in the same moment, so the list opens on what is still open.

What Phase 3 built

• Findings (/pages/native/safety): the first-run card (Quietly is the default; Keep Quietly or Settings); Observed, open findings shown by default (ruling 9) in five columns (ruling 12), the policy named under each finding, never the person; Prevented, one quiet card with a count and a line per thing (ruling 10); Resolved when the company closes one. No SLA clock and no deadlines (ruling 11).
• A finding (/pages/native/safety-finding): the three questions in order (What happened · Why your company's policy covers this · What you can do), the person's own events (Ask for access, Ask IT) appended as from: person and never moving the status, What happened since in sentences with the person's lines marked, What's recorded.
• Settings (/pages/native/safety-settings): the one control (Quietly · When it matters · Teach me), each with what it would have announced on this machine, the kinds under it, the tray.
• Q4 on the prototype's S2 as a variant (?v.prevented=born); the default stays c121 D3 until you rule (call 2).
• Every person-facing string checked with the brand MCP's check-brand-voice (productUI): zero violations.

What the person's view shows

1. The default now has something to say. Nina opens on 13 open findings; Priya on 12, with the 42 prevented findings read as two lines.
2. One thing can be two findings. Sentry MCP on Priya's machine is open under the MCP policy and under the tool allow list: two policies, two findings, two rows.
3. The prototype's tool allow list names Read and Write only, so Grep, Glob, Edit, TodoWrite and WebFetch are findings on both machines. To a person these read as noise about ordinary tools.
4. The policies' "why" is written for practitioners. Nina reads that an unsanctioned server "can read, write or exfiltrate on the user's behalf".
5. HQ's half is empty on every machine. No world carries a training-assigned or follow-up event yet, so the person's view has never shown one.

Calls

1. The group names: Observed · Prevented · Resolved, the shared tongue's own words, with the warmth in the sentences under them. Default: yes.
2. Q4 becomes the prototype's default: S2 opens on every outcome and Enforced findings are resolved at birth, in the lab's model (a prevented event in the fixture). Default: yes, in Phase 4.
3. Prevented counts every stop ("45 times", repeats included); each line counts days. Default: yes.
4. One thing under two policies stays two findings; the finding page names the other ("Also under: Tools must be on the allow list"). Default: yes, the hint in Phase 4.
5. A plain "why" for the person: an optional why_plain on each policy (Qpoint writes a default, HQ may rewrite it), falling back to why. Default: yes, in the shape.
6. The noise control as built: three positions, Quietly the default, asked once at first run. Default: yes.
7. The person's verbs: Ask for access and Ask IT; Acknowledge appears only on a follow-up that asks for it. Default: yes.
8. The tool allow list (3): leave the prototype's configuration and raise it with Peterson with chatgpt.com. Default: yes.
9. HQ's half (5): Phase 4 adds one follow-up and one training assignment to the prototype's events for a person who is in a world (Priya), so the down direction is drawn on real rows. Default: yes.

Answered (Mark, 2026-11-13, walked)

Call 8, done the same evening: three entries in governance-policy-config.ts (P-TOOL-ALLOW), the worlds re-derived: Meridian 13 → 10 findings, pilot 54 → 51 (42 still prevented), minimal 7 → 6. Every c144 Simulation scenario plays the same tool findings as before (the phishing story's set adds Grep, now a harmless repeat). One authored replay fails, drill-personal-account (P-ACCT expected to stop the sign-in at b1, stops nothing); it raises no tool finding, so it isn't from this change: it came with the day's c144 and c133 commits, for their owners. The Phase 2 and 3 captures show the worlds before the widening; Phase 4 recaptures.