Overseer, ports, citizen
c1372026-11-10Two parties, four ports between them, one schema for every message, and the citizen's hand on the delivery.
Source: c137 plan.md (the parties, the ports, the bones, R1–R7, D1–D8 confirmed 2026-11-09); inventory.md (24 rows, 16 kept); bones.md §1–§8; ports.md §1–§2 and §5; c130 D9, ruled 2026-11-09; session 1b21a3ce (Mark Peterson's ask for local feedback with a path to IT; Tyler's OAuth-style Connect).
IT or security: writes policy, reads findings, sends notices. The product word comes from c0 (operator proposed); “overseer” never appears in a UI (D7).
Holds the record and the operator's view (D1). The sender label is a plane setting, default “HQ”. Two more settings: required on notices (off), the soft ceiling (3 a month).
Local mode, no plane: the enforcement notice and the sensor state come from here, the IT contact from its configuration.
notices · confirmations · censures · assignments · requests
acknowledgements · contact IT · training completed · diagnostics
Every message, kept with its state and thread; open threads first, ended ones under a fold. Controlled by the app: always on. The honesty line says what the settings held back.
A count of open messages and the one line that matters, under the sensor's state line. Controlled by the citizen: on · off.
One interruption per message, at delivery, through the OS's own centre; never repeated. Controlled by the citizen per type, with quiet hours; the OS's Focus is always honoured; required passes once.
The operator's inbox and Send, and the pages a message links to. Controlled by the overseer. Lands with c134 (Phase 4).
Out of V1; later through the plane's integrations, the operator's inbox first.
delivered as the citizen set it: off · inbox · tray · notify
acknowledge · reply · contact IT
“You” in the UI, the person in docs, end user only when talking to IT; “citizen” never appears in a UI (D7).
The inbox lives here, in a local store that syncs with the plane (D1). Messages are a resource through the plane source of the DataNozzle (D2).
Its notification centre, its permission, its Focus. The app adds only what the OS lacks: per type, per policy, quiet hours (R7).
“This machine is connected to HQ”: the receipt of Connect, and the one type that flows in V1 (D3). The schema, the inbox store, the OS plumbing, the per-type controls and the tray count ship with it, with c131 Phase 1.
A policy acted on this machine: what, why, how to reach IT (Peterson's message). From the plane, or from qcontrol in local mode. Flows in V1 if Tyler rules it in at G2 (Q12).
The reply back, with the message's context attached; the operator's answer lands in the same thread. In local mode, a mailto from qcontrol's configuration. With the enforcement notices, if ruled in.
hq-notice · censure · responsibility · training-assignment (c133) · diagnostics-request · sensor-state · reply · connect-request · grant-notice (c136). Sixteen rows kept of twenty-four.
The bones: one schema for every message (R1). The type is its purpose; the fields are its protocol.
One settings page in the native app. Everything on it is the person's; nothing on it changes the record (R3).
- Per type off · inbox · tray · notify, with the inventory's defaults; any type may go lower than its default. V1 (D3)
- Quiet hours the app's own gate in front of the OS's Focus; off by default, one preset: outside working hours.
- Mute a policy's notices or a thread, until 09:00 tomorrow; listed with a Lift.
- The single override a required message reaches you once whatever the settings say, must be acknowledged, and is counted: “HQ has sent this machine 2 required messages this month” (D4).
- “Why am I seeing this” on every card: the policy or the person that caused it, fixed at send time.
- The withheld count the inbox's honesty line: “3 notices went to your inbox quietly since 18:00.” Nothing hidden; control never erases the record.