The common tongue
c1472026-11-13One finding, minted where the activity happened; the machine, the person and the plane each append their own events to it, and the record never changes.
Source: c147 initial-prompt.md (Mark, 2026-11-13: findings bubble up, trainings bubble down, one shape on both sides) and plan.md R1–R7, Q1–Q7; finding-shape.md §1–§8; the lab's model in governance-fixture.ts (c114, c121 D16); c133 event-shape.md; session f8d58bc9 (2026-11-12).
The sensor. It sees the activity, and a policy's mode decides whether it stops it. It mints the finding and writes detect, prevented and recurred. On a standalone machine, who raises findings is Tyler's question.
Drives. Writes their own events: asked IT, asked for access, acknowledged, training completed. Their events are proof and conversation; they never move the finding's status.
This machine's findings, copied from the lab's S2 and S1 first, then made the person's (Phase 3). The OS notification announces a finding as loudly as the person chose: Quietly, When it matters, Teach me.
up: the finding, whole, with every endpoint and person event
down: the plane's events on this machine's findings
Immutable once detected. Everything after is an event; the status is a fold over them. The same id on both sides.
Each says who wrote it (from: endpoint · person · plane). No side edits another's.
up: arrives as the same finding, never a copy
down: trainings, follow-ups, resolutions
Security or IT. Reads S2 (Open by default; prevented findings in a quiet group, Q4) and S1 (what happened, the history). Resolves with a reason; never edits a finding.
A policy's mode stops or records; a policy or an operator assigns a training (c133), which travels down as training-assigned. HQ's follow-up travels down in HQ's words.
Prevented counted as the policy working, never against a person (c128). An auditor reads: something went wrong, and it was corrected.
endpoint · Observed: a session ran under a personal account. Open.
plane · the policy assigns T-ACCT-1; it travels down onto the same finding.
person · the record goes up; the status does not move (c133 D9).
plane · Resolved, with the record as the reason. Something went wrong, and it was corrected.
endpoint · Enforced: a connection to an MCP server not on the list was blocked.
endpoint · in the same moment: born Resolved: prevented. Nothing to fix.
endpoint · the same policy, server and person that day: one finding, a count.
plane · Reports count it as the policy working; it never counts against the person.
enforcement-notice, from the plane and from qcontrol locally: detect, plus prevented when the activity was blocked.
training-assignment → training-assigned · censure → follow-up · contact-it → asked-it · acknowledgement → acknowledged · training-completed, unchanged.
identity-confirmation: standalone or connected (f8d58bc9) · sensor-state: Status and the tray icon (c131).
hq-notice · responsibility · diagnostics-request · diagnostics-sent · reply · connect-request · grant-notice. HQ uses email and Slack.