Session View

qcontrol records everything a session viewer needs and shows none of it. The qdash sessions table exists, every event is indexed by session_id with full JSON payloads, and the inventory page promises "click a session for its full profile" — the link goes nowhere. The qevents taxonomy is richer than qdash materializes: dialogue text (post-redaction, with roles), structured tool identity (builtin/MCP/skill) with allow/block/redact decisions, MCP lifecycle, file access, egress decisions, per-turn cost. Market evidence ranks the need: platform/SRE self-service debugging and CISO audit/forensics are the loudest signals; the engineer reading their own session is the daily user. Full analysis: framing-plan.md.

Design the session view mocks-first: a /sessions list + /session/:id detail built on the four-altitude ladder (receipt → chapters → turns → raw events) with a semantically framed transcript — typed beats (ask, clarification, decision, action burst, outcome, violation, error/retry, handoff) visually treated for scanning via a spine/gutter grammar. Converge to a composed ship candidate with states & scale coverage and a component audit, ready for the qcontrol handoff.

• Fixture sessions: hand-crafted scenarios (clean / blocked-tool / sensitive-file / runaway-cost) + dogfood-captured real sessions via qcontrol run --sink file://
• session-anatomy-v1 — one rich fixture at all four altitudes on one page
• session-transcript-ideas — semantic-beat spine/gutter bake-off
• session-timeline-ideas — timeline/scrubber treatment bake-off (scrub-first, animation as garnish)
• session-footprint-ideas — actor-map aspect, native SVG only
• session-receipt-v1 — the compliance artifact as a designed document (first graduate)
• Converge: session-view-v1 list → detail, states & scale, component audit
• Beat classification: mechanically derived only (role + adjacency + decision events)
• Out of scope: live tail ("maybe someday" — scrub-first keeps the door open), qmap/qflow integration (layered on later behind the playhead protocol), LLM-derived summaries, qcontrol implementation

• 2026-08-20 — Cycle created; initial-prompt captured.
• 2026-08-20 — Framing plan (framing-plan.md): qcontrol data model verified at source (qevents/qdash), audiences ranked from market-analyst calls, four-altitude ladder hypothesis, playhead-as-protocol strategy, honest qmap/qflow fit read, semantic-transcript beat vocabulary, proposed arc. Seven questions ruled by Mark (engineer-first, no live, /sessions home, full text with standing considerations, dogfood fixtures, no engines yet, mechanical derivation only). CYCLE.md written — formal kick-off.
• 2026-08-20 — Fixtures + mechanical derivation (app/data/session-fixtures.ts): four authored scenario sessions at qevents grain — clean-run (webhook retry, 3 chapters, 40 events), blocked-tool (prod warehouse blocked → readonly reroute), sensitive-file (~/.aws/credentials redacted + high finding), runaway-cost (8-cycle error loop, $34.75, user interrupt) — plus the reference implementation of the mechanical-only ruling: deriveBeats (role + adjacency + decision events → ask/clarification/decision/action/outcome/violation/error/handoff), deriveChapters (ask→outcome brackets, ask text as title), sessionTotals. Verified: strict tsc clean; derived spines read correctly (e.g. blocked-tool: ask → decision → action → violation → decision → action → clarification → … → handoff; MCP bootstrap surfaces as a "Session start" chapter — the Cisco lifecycle-visibility point falls out for free).
• 2026-08-20 — session-anatomy-v1 (/pages/session-anatomy-v1, new sessions registry group): the four-altitude ladder as a live mock — receipt (designed evidence document: what happened ¶-lines, exceptions, accounting, derivation footer), chapters (ask→outcome cards wearing beat-glyph spines: ● ○ ◆ ▸ ✓ ✗ ▲ ■), semantic transcript (full dialogue text, collapsed expandable action bursts, violations/errors in place, spine down the left), raw events (the qdash events-table grain everything above derives from). Scenario picker swaps all four fixtures through the whole ladder. Verified: SSR clean, captured to public/cycles/c77/ (content + full, luminance-checked).
• 2026-08-20 — session-transcript-chat (/pages/session-transcript-chat): chat-grammar bake-off per Mark's familiarity direction — four borrowed idioms rendering the same derived beats: messenger bubbles (dialogue warm, machinery whispered), team channel (the pass's discovery: policy as an app persona — violations land as the red-bar Slack alerts engineers already know), agent console (the engineer's native tongue, no skim layer), and the carried candidate chat wearing the spine (channel rows for dialogue, beat-glyph rail for machinery — one rail, two readings). Three laws recorded: familiarity is the ramp not the destination; policy is a speaker; machinery stays one glance away, never zero. Verified: SSR clean, captured (content + full, luminance-checked).

A permanent register for tensions we're deliberately carrying, not resolving now. Revisit at every convergence step.

• Privacy vs. oversight. We show full prompt text for now (it arrives post-redaction), but the metadata-only / restricted-view stance is a real product question. Design so the restricted view is subtraction, not a redesign. Redaction should be a visible element (chips showing something was withheld and by which policy) — it's the 92% enterprise mandate.
• The need to summarize. Long sessions will overwhelm every altitude below the receipt. Mechanical chapter segmentation (ask→outcome brackets) is the current answer; watch where it fails.
• LLM-derived titles/summaries (parked). Liked, not allowed yet — everything stays mechanically derived and auditable this cycle. If revived: clearly marked, never load-bearing, respecting the c67 drawn line on prompt mining.
• Diff-shaped outcomes (data ask). Before/after file content isn't captured upstream; outcomes are the weakest layer. Feed this to qcontrol's roadmap rather than compensating in UI.