activecreated 2026-11-13· last activity 2026-11-13· mode: archaeology → assemblage (the finding already emerged in the governance lab; the work connects it to the native app, the trainings and the plane).
The native app's Safety & Security section as this machine's findings: design's phase-4 Findings copied first, then made the person's, in one finding shape the company's plane speaks too (findings bubble up, trainings and follow-ups bubble down).
New in this cycle: The lab's S1, the copy's source, for the side-by-side
Why
When qcontrol stops or records something on a laptop, the person sees a disruption and nothing else. c137 answered that with a message channel and an inbox; the Qpoint Product session of 2026-11-12 (f8d58bc9) found the inbox "another thing to check" against the homepage's promise of no changes for end users, and Mark agreed it should not be an inbox. The next day he saw that the notion already exists: design's findings, where a policy moment is recorded once, as Enforced or Observed, with a history of what was done about it. A finding is also what the company's plane records, so one shape can carry a policy moment from the machine to the plane and a correction back, gently: prevented is the softest case, and the person stays in the driver's seat.
Sketch: The common tongue, drawn 2026-11-13 in the design system; Mark's own drawings may replace it.
Objective
Done means: the finding's wire shape with its events and their origins (finding-shape.md), drawn as a sketch; findings derived into the native worlds; S2 and S1 copied into the native skin as this machine's view; the person's view (R4's prevented, the words, the person's verbs, the noise control) reviewed; the bubble up and down written in the prototype's shape (no plane work: the plane's findings are design's phase-4 prototype, Q6) and walked with Mark Peterson; the Findings page in qnative replacing c4's inbox, with a story per state.
Design site: the sketch (app/pages/cycles/design/sketches/), the native skin pages (app/pages/pages/native/), the worlds (app/data/worlds/), the lab's detector (app/data/scenarios/)
Sister projects:../qnative (types, nozzle, the Findings page, c4's inbox retired) through a qnative cycle; no plane work (Q6: the plane's findings are the design prototype); Tyler for one question, who raises findings on a standalone machine
Out: HQ's letters, censures, responsibilities and Send form (shelved with c137); email and Slack delivery; training content (c133); the plane's build (c134)
Key Changes
stage 1 (2026-11-13): opened from Mark's words in c137's inbox-rename thread and his four answers (close c137 into a new cycle; prevented is softest; every finding bubbles up, prevented softer; Findings replaces c4's inbox, keeps its plumbing). c137 closed into it.
kick-off (2026-11-13): Mark: "Kick off with a plan". plan.md: the pieces that exist (the lab's finding model, S1, S2, the detector, c133's training events, c4's plumbing), rulings R1–R7, five phases with three review stops, seven clarifying questions with defaults, six patterns (the finding as the protocol, event sourcing, just culture, near-miss reporting, honest security, one card per policy and resource).
questions walked (2026-11-13): Mark answered all seven (plan §5): the rail Safety & Security → Findings · Settings; Meridian first; findings derived by the lab's detector; an Enforced finding born Resolved: prevented (c121 D3 superseded; the prototype's S2 follows the shared shape); trainings as the event and the record only; no plane work, since the plane's findings already exist in the design prototype (Phase 4 rescoped to the native side of the shape); three review stops.
Phase 0, the shape (2026-11-13):finding-shape.md: the finding (immutable; id from a fingerprint of policy, resource, person and device; the outcome stamped once) and its append-only events with a new from (endpoint · person · plane) beside the lab's origin; thirteen event kinds by writer, six of them new (prevented, recurred, asked-it, asked-access, acknowledged, training-assigned, follow-up); the status rule (only the endpoint's prevented and the plane move status; the person's events are proof, c133 D9 generalised); the window (open-while-open for Observed, the day for prevented, repeats as recurred); up and down; two readers of one record; c137's fifteen types mapped (nine fold into the finding or Status); c133 re-homed (§9, and a note in c133's record); five calls for review stop 1. The sketch The common tongue (app/pages/cycles/design/sketches/c147-common-tongue.vue, registered in program-sketches.ts, captured as c147-sketch-common-tongue.png by c130-sketches-design.json), ## The shape above, and the story module app/data/stories/c147.ts wired in cycle-stories-mock.ts (twelve decisions). c137's story gained its closed date. Nothing committed; Phase 1 next.
Phase 1, findings in the worlds (2026-11-13):scripts/derive-world-findings.mts reads each world copy, turns what the sensor recorded into the lab's sensor events (every session's model request at its harness's host; every MCP server from the inventory, first seen with its later calls recurring; the three sessions the cut kept in detail: tool calls, egress, sensitive files), folds them through the design prototype's policies (the Oct 19 model under RULED, Q6) with c144's detector and applicability(), and writes a sidecar per world, app/data/worlds/findings/<name>.json, answering /api/policies and /api/findings in finding-shape.md's shape: fingerprinted ids, detect from the endpoint, prevented in the same moment for an Enforced finding, one recurred with the count. Its manifest says what the findings are against, what stayed quiet, and every gap. useNativeWorld() loads the sidecar after the world and falls back to it for a route the world doesn't serve, with a derivedNote for the footer; checked on :3000 (the sidecar loads, no console errors, the Inventory skin still fills). scripts/sync-worlds.sh re-derives after a recut. Results, Meridian first (Q2): meridian-day90 13 findings, all Observed (Nina is not a person in the prototype, so the org's modes apply: four unsanctioned MCP servers, Cursor's api2.cursor.sh as an unapproved provider, eight tools off the allow list); pilot 54, 42 of them Enforced and born Resolved: prevented (Priya is the prototype's own person in Engineering, where unapproved providers are blocked: Cursor and Codex CLI's chatgpt.com, one prevented finding per day under the day window); minimal 7 Observed; fresh none. What the derivation taught, for review stop 1: (1) every world's bridge says the machine is not connected, so a derived finding means "what this machine's activity raises once connected", and a prevented one is what the plane would have stopped; the manifest says so; (2) the day window gives Priya 42 prevented findings in 90 days, a real data point for finding-shape.md §10 call 3; (3) two naming bridges are written down, not guessed (the seed's MCP ids to the prototype's catalogue; its sensitive-file categories to the restricted-path detectors, where shell_history and git_config have no detector); (4) gaps for qnative: 4 sessions in Meridian and 13 in pilot report denied calls or sensitive opens the cut kept no detail for (a recut with detail derives them), and the seed carries no MCP versions and no consequential flag, so P-PROVENANCE and P-TOOL-APPROVAL can't be derived; (5) the prototype's provider list says openai.com, and Codex CLI signed in with ChatGPT talks to chatgpt.com, so it reads as unapproved. Nothing committed; Phase 2 (the copy) next.
Phase 2, the copy (2026-11-13): S2 and S1 copied into the native skin from the composed mocks (mock/findings-design, mock/finding-detail) on the derived findings: /pages/native/findings (the listing bar, the grouped ledger with the policy in context, the member table and its card, app/components/native/FindingsTable.vue) and /pages/native/finding-detail (title row, What happened | Why it violates, History, Details, Related Findings, Session, the honest absence), both through app/composables/useNativeFindings.ts, which folds a finding's events as the lab's findingRow() does, with the plane's SLA rubric from the sidecar (Phase 1's script now also carries each policy's words, frameworks and recommended severity). The rail gains Safety & Security → Findings · Settings (Q1; NativeWindow draws it where a mock links it, and the rail scrolls as the kit's does; a shield glyph in NativeIcon). In the operator's words and S2's defaults on purpose; the fleet → personal rules removed User, Team and Endpoint for the harness; decided, not copied: no Resolve and no mode link (the person never moves status), one harness and one framework with a count at 844 px. Registered (phase native, collapse c147-findings); checked on :3000 (no console errors after moving data-qp onto a cell); eight captures by scripts/shot-programs/c147-native-findings.json (the copy at 2× in the window, the lab's S2 and S1 beside). Review stop 1:review-1.md, thirteen calls with defaults; what the copy showed: the operator's defaults show a person nothing (Nina's findings all Observed, Priya's Enforced ones all prevented), the SLA's "past SLA" lands on the person, prevented reads as "0 open · 42 resolved", and S2's columns don't fit the native window.
review stop 1 ruled (2026-11-13): Mark: "Take the defaults". Twelve of the thirteen calls as their defaults (review-1.md §Answered): the shape's from, the person never moving status, the day window, prevented as kind and resolution; derived means "once connected"; chatgpt.com goes to Peterson; the recut is asked in Phase 5's brief; for Phase 3, Open with Observed shown, prevented as one quiet group with a count, no SLA clock or deadlines for the person, five columns; the rail scrolls. Call 5 (resolve on training completion) stays open until Peterson. Phase 3 next.
Phase 3, the person's view (2026-11-13): three native-skin pages on the same derived findings, beside the copy: /pages/native/safety (the first-run card, Quietly by default; Observed open by default in five columns with the policy under each finding and no SLA clock; Prevented as one quiet card, a line per thing with its days; Resolved), /pages/native/safety-finding (What happened · Why your company's policy covers this · What you can do with Ask for access and Ask IT, each a from: person event that never moves the status; What happened since in sentences; What's recorded) and /pages/native/safety-settings (the one control with what each position would have announced on this machine in 30 days, the kinds, the tray). The person's helpers in useNativeFindings.ts (personEvent, personStatus, nextStep, usePersonEvents stamped on the world's clock, useNoise, notificationsFor); the rail's Findings and Settings link the person's pages. Q4 on the prototype's S2 as a slot variant, ?v.prevented=born (Enforced resolved as prevented, every outcome by default, its own subtitle); the default is unchanged. Every new person-facing string voice-checked: zero violations. Checked on :3000 (Ask IT round trip, no console errors); seven captures by scripts/shot-programs/c147-native-person.json; registered. Review stop 2:review-2.md, nine calls with defaults; what it showed: the default now has something to say; one thing can be two findings (Sentry MCP); the prototype's tool allow list makes Grep and Glob findings; the policies' "why" is a practitioner's; HQ's half is empty on every machine.
review stop 2 walked (2026-11-13): Mark ruled the nine calls (review-2.md §Answered): Observed · Prevented · Resolved; Q4 the prototype's default in Phase 4; prevented counts every stop; two findings stay two rows with an "Also under" hint; a why_plain on each policy. Three changed from the defaults: the company sets the noise default per team (the person can still change it); a third verb, "This was a mistake" (the plane resolves with False positive, or doesn't); the prototype's tool allow list widened now (Grep, Glob, WebFetch as built-in read-only tools, in governance-policy-config.ts; worlds re-derived: Meridian 10, pilot 51 with 42 prevented, minimal 6; every Simulation scenario plays the same tool findings; drill-personal-account's failing replay predates this, from the day's c144/c133 commits). Real rows for Priya from HQ in Phase 4. Phase 4 next.
Phase 4, up and down (2026-11-13, night):Q4 in the prototype's model:foldFinding() writes a prevented event after detect for every Enforced finding (prevented added to the event kinds, the resolutions and the label maps; the lab's qdash copy maps it to a block); S2 (mock/findings-design) opens on every outcome, the variant gone; the native copy follows; three prototype findings change (F-D, F-E, F-F). Down on real rows:app/data/plane-c147.ts (the plane's moves, matched to derived findings by policy and resource; the per-team noise defaults) merged by the derivation: T-MCP-1 suggested on Priya's Linear MCP finding, Dana's follow-up on her Postgres MCP finding; /api/plane-settings. A plain why for all nineteen policies (WHY_PLAIN, whyPlain, whyPlainOf(); why_plain in /api/policies). The person's view: From HQ first; HQ's words as written with Acknowledge; the training opened in the browser; "Also under"; "This was a mistake" (reported-mistake); the company's noise default on the first-run card and in Settings. finding-shape.md §3, §4, §6a updated; peterson.md, nine questions. Checks: c123 metrics 49/49, tours walk 455/0; Simulation's check 184/6 and the tour drive check 186/2 (the c144 session's numbers; my run crashed on a page timeout after 102/6), all eight from Q4, answered to the c144 session that the ruling comes first. Eighteen captures (eight of the copy, ten of the person's view). Review stop 3:review-3.md, six calls with defaults, the first being Simulation under Q4.
review stop 3 walked (2026-11-13, night): Mark ruled the six (review-3.md §Answered): the simulation shows prevented rows beside the open ones and its test lines expect them (c149 builds it; the c144 session told); the plane's moves stay hand-authored; the per-team noise defaults stay, Peterson asked who sets them; "This was a mistake" stays quiet. Changed from the defaults: Phase 5 briefed now (qnative-brief.md: types, the nozzle's three routes, the detector ported to Rust and tested against the lab's sidecars, the person's event store, the pages by /native-port, c4 retired, stories, the recut); and the three open questions decided now: a finished training closes its finding by the policy, "Resolved: training completed", HQ can reopen (revises c133 D9 for policy-assigned trainings; noted in c133's record); chatgpt.com is a different provider, so Priya's 23 prevented findings stand; on a standalone machine the app raises findings from the sensor's events (the Tyler question withdrawn). finding-shape.md §3, §4, §6 and peterson.md (3 and 7 now his rulings to confirm) updated.
committed (2026-11-13): Phases 0–4, the three review stops and c137's close in 81f3ee59ee (69 files; unpushed, not deployed); the commit unblocks c149's build of the simulation's prevented rows.
Drawn as The common tongue on 2026-11-13; the record behind it is finding-shape.md.
The problem. When qcontrol stops or records something on a laptop, the person sees a disruption and nothing else (enforcement-without-local-context). c137's answer, a message channel and an inbox, read as "another thing to check" at the 2026-11-12 Product session (f8d58bc9), against the homepage's promise of no changes for end users.
The core idea. A finding is the one shape a policy moment takes on both sides. It is minted on the machine where the activity happened, never changes, and travels up whole; three writers append events to it (the endpoint, the person, the plane), and the status is a fold over them. Nothing is edited, so the two sides never disagree about what happened, only about what has arrived. Prevented is the softest case: born resolved, counted as the policy working, never against the person.
The pieces. The finding (id from a fingerprint of policy, resource, person and device; the outcome stamped once, c121 D16). Its events by writer: detect, prevented, recurred from the endpoint; asked-it, asked-access, acknowledged, training-completed from the person; training-assigned, follow-up, resolve, reevaluate, reopen from the plane. The native app's Safety & Security → Findings · Settings, with the noise control on c4's plumbing. The plane is the design prototype (Q6): S2 Open by default, S1's history, Reports counting prevented.
The pattern we follow. Modularity as purpose plus protocol: the endpoint and the plane are two modules and the finding with its events is the protocol between them; each side's internals stay free. Event sourcing, which the lab's model already is. Just culture: prevented is consoled, observed is coached, and only a repeated, knowing pattern gets HQ's follow-up. Replicate first: the person's view starts as a copy of S2 and S1.
What stays open. Five calls in finding-shape.md §10 for review stop 1 (the writer field, the person never moving status, the window, prevented as kind and resolution, a policy that resolves on training completion). Tyler's question: who raises findings on a standalone machine. The person's words and the group names wait for Phase 3.
Visual record
20 captures — heroes, page slices, and full-page renders. Click to view.
Phase 3 · the person's view of the same findings, beside the copy
2026-11-13· 10 captureslatest
Nina's machine in the person's view: the first-run card (Quietly, the default), Observed open by default in five columns with the policy under each finding and no SLA clock. open page →history · 2 moments →Priya's machine: the first-run card says Teach me is the default her company chose for Engineering; From HQ lists the suggested training and Dana's note; 9 Observed and open; Prevented as one quiet group, a line per thing, never 42 rows. open page →history · 2 moments →Linear MCP on Nina's machine for the person: what happened, why the company's policy covers it, what she can do (Ask for access, Ask IT), what happened since in sentences, what is recorded. open page →history · 2 moments →After Ask IT: the note joins the history as "you asked IT" and the finding stays open; asking never changes the finding. open page →history · 2 moments →A prevented finding for the person: nothing left the machine, nothing to fix, recorded as prevented and never counted against her; Ask for access if her work needs chatgpt.com. open page →history · 2 moments →Settings on Priya's machine: her company chose Teach me for Engineering, hers to change; each position with what it would have announced in 30 days; the tray counts the one thing that needs her, Dana's note. open page →The prototype's S2 with Q4 in the model (Phase 4): the blocked findings F-D, F-E and F-F read Resolved: prevented from the moment they were detected; the list opens on every outcome. open page →history · 2 moments →Dana's follow-up on Priya's Postgres MCP finding, shown as HQ wrote it, with Acknowledge; "Also under" names the same server's other finding; What you can do now offers "This was a mistake". open page →history · 2 moments →After Acknowledge and "This was a mistake": both join the history as the person's own lines; the finding stays open until the plane resolves it. open page →history · 2 moments →A training the policy suggested on Priya's Linear MCP finding: three minutes, hers to take when it suits her, opened in the browser (Q5: the event and the record in the native V1). open page →history · 2 moments →
Phase 2 · the copy of S2 and S1 in the native skin, on the derived findings
2026-11-13· 8 captures
meridian-day90 under S2's own defaults (Open · Enforced, c121 D3): all 13 of Nina's findings are Observed, so the copy opens on the zero state that names them. The rail's new section: Safety & Security → Findings · Settings. open page →history · 2 moments →meridian-day90 with Observed included: three policy groups (Unsanctioned MCP server in use, the tool allow list, unapproved providers), the harnesses that raised them, the frameworks that map them; the Subject column is gone (rule 3), the header says once whose machine. open page →history · 2 moments →A group open: the policy in context (its description, severity, mode for Nina), the upcoming remediation deadlines from the plane's SLA rubric, and the member table with the harness where S2 has the subject. No Resolve: the person never moves a finding's status. open page →history · 2 moments →pilot (Priya, Engineering) with everything included: 54 findings, 42 of them Enforced and born Resolved: prevented under the provider policy (Cursor and Codex CLI, one a day under the day window), 12 Observed and open. open page →history · 2 moments →S1 copied: Linear MCP on Nina's machine, Observed and Open; What happened | Why it violates; History with the machine's own events (detected, then recurred nine times); Details without User, Team and Endpoint; Related Findings; Session. open page →history · 2 moments →A prevented finding on Priya's machine: Enforced at detection and Resolved: prevented in the same moment, then recurred the same day; the history reads detected → open, prevented → resolved: prevented. open page →history · 2 moments →The source: the lab's composed S2 on the prototype's own world, Observed included, in the qdash shell. open page →history · 2 moments →The source: the lab's composed S1 on F-E, Linear MCP blocked at detection, in the qdash shell. open page →
Sketches — the structures, drawn in the design system
2026-11-10· 2 captures
One finding, minted where the activity happened; the machine, the person and the plane each append their own events to it, and the record never changes. open page →open page →
