Cycles by week
Week of Nov 2

3 started, 1 closed, 23 carried live.

Busiest record: c123 Compliance Frameworks (12 entries) · 68 carried cycles have gone quiet · layer v0.9.37 → v0.9.37

Started
3
Still open
91
Closed
1
Record entries
36
Commits
36
Captures
9
Releases · deploys
4
After: two metrics on OWASP LLM, and untracked frameworks with name and description only
c123Compliance Frameworks4 captures · 12 log entries — the week's busiest recordSee all 4 shots ↓

Compliance & Frameworks after intents PR 5: Enforcement Posture, Exceptions and Compliance Score on tracked frameworks; name and description on untracked

Commits

36 commits across 4 repos, on each repo's checked-out branch.

Cycles

Started 3

c129Deploy Build Time

Keep npm run deploy short as the lab grows. The prerender crawler renders every page it can reach, and the build's time goes wherever the crawl goes.

started Nov 34 in the log
c128Reports

A time-windowed Reports section for qdash. It gives C-level people, auditors and others who see data but get no controls what the dashboard already shows, as documents they can hand on. The two categories are Security (Posture) and IT (Inventory, Deployment status). Every report reads one window: rolling, calendar or custom from–to, with a comparison period.

started Nov 311 in the log

Still open 23

c126Policies Final Pass

A final, hand-tuned pass over the policy surfaces in the phase-4 lab. We walk each aspect in turn (the listing, the policy header, mode and Until, severity, exceptions, frameworks, findings, history, Policy Config, team Policies) and sand each one by hand. Along the way, each fact about a policy gets one home, and every other place summarizes it and links there.

started Oct 272 wks · moved this week1 in the log
c125Operations Wizard

A tour-guide and self-documenting tool that attaches cleanly to any part of the UI, so the UI becomes the documentation. It has a hover help mode (after Ableton Live's Info View), a numbered-marker overlay for explaining a screen, step-by-step tours that move across pages and highlight what matters, and an AI tour guide over MCP from the start. Its first tour is the operations journey from the 2026-10-26 product session: install to enforcing on a pilot team.

started Oct 272 wks · moved this week
c124Cycle Stories

Make the cycle detail page tell the cycle's story at a glance: why it happened, what changed (before → after, in plain words), and who made it better. External market specialists are credited first. Every outcome traces back through its decision to the meeting or conversation it came from. Collaborators get their own unlisted pages, where attributions and accolades build up.

started Oct 262 wks · moved this week
c123Compliance Frameworks

Give the frameworks a good bath and a redress. We finalize the framework page designs and tune their details from the latest designs and what Mark Peterson made clear on 2026-10-26: Qpoint gives evidence, not compliance, under emerging regulatory pressure to govern AI. Most of the work is by hand. We export the current page to Illustrator, Mark reworks it there, and we build the result on a test page. The brief's Frankenstein list (X1–X11) is the checklist for the cleanup.

started Oct 262 wks · moved this week12 in the log
c114Governance Phase II

Build the Phase II governance dashboard for qdash around the object model the ../intents repo describes, so that Findings, Policies, Scope, Groups, Exceptions, Enforcement and Frameworks appear as one coherent system rather than fourteen features

started Oct 95 wks · moved this week
c111Cycles by Week

A weekly view of the cycle atlas (started · still open · closed per week) beside the existing numerical view, plus a week details page designed as a _meta mock

started Oct 55 wks · moved this week1 in the log
c101Qmap Surface

Fold qmap into DataSurfaceSection. Draw a thing's Surface (what it reaches) as a scene of pixel pawns, as a second view beside the lists (Map ⇄ List). This starts with a design brief to a designer.

started Sep 286 wks · moved this week7 in the log
c122Early-Stage Documentation

Tame our own design history before telling it. Catalog the Qpoint Design drive (sketches, Illustrator, Photoshop, InDesign, Sketch, Figma) so every file can be found, previewed and traced to its original. Tie each file to a cycle where one exists, otherwise to a startup phase and design generation. Write down an ingestion protocol that ends in a story. Then give the cycle detail page a story-first design pass.

started Oct 233 wks · quiet 1
c121Governance v1 Scope

Build the decisions from the week of Oct 19 into the phase-4 lab (/pages/phase4/mock/*). The governing scope is Mark Peterson's v1 guidelines: an exception changes mode only, publication is the whole shared draft, and resolving a finding records a decision.

started Oct 233 wks · quiet 1
c115Briefs

A /briefs section on the design site, off the main menu, with one page per brief handed to a collaborator outside the org

started Oct 134 wks · quiet 1
c105Cost Center

Re-evaluate the qdash /cost page against what the backend now serves, and re-draw it on the Organization / Inventory listing pattern

started Oct 16 wks · quiet 1
c100Landing Pages

Design the three qdash "Design in progress" landings: Home /, /inventory and /team. Each is a 30 ft (300 ft for Home) view of its domain, made more of images than of text.

started Sep 286 wks · quiet 1
c12Micro ProblemsMarket Analyst

Reshape market-analyst into a design tool first — the source of truth for Qpoint's problem space — by adding a micro-problem layer (use case → micro problem → observations) on top of the existing market lens, with a curated registry, extraction-proposed candidates, computed standing, product surfaces, document intake, and briefs/stories that cite problems.

started Sep 217 wks · quiet 1
c119Logo Downloads

Downloadable logos on /brand/logo. Pick a logo, a format (SVG · PNG · GIF · JPG, in that order of preference) and a color (White · Black · Grape), then download a pre-built file generated from black master SVGs.

started Oct 203 wks · quiet 2
c117Prometheus

An ideas cycle. Gather sourced material on the Prometheus story as an analogue for AI; on ancient attitudes to fire; on David Deutsch and Karl Popper's error correction, set against our problem formation; and on modern voices about AI, from doom to salvation

started Oct 203 wks · quiet 2
c7avoma-notesMarket Analyst

Explore and integrate Avoma notes data into extraction pipeline and dashboard visualizations.

started Feb 25parked
c4refinementMarket Analyst

Refine how extracted data is displayed in the dashboard and improve extraction quality where gaps exist.

started Feb 24parked
c3oauthMarket Analyst

Add Google OAuth to restrict dashboard access to @qpoint.io team members.

started Feb 20parked
c69Operating System

Methods & tooling retro — evaluate how we work against the design methodology, restore order, modernize the skill/agent tooling, and make the philosophy load-bearing

started Aug 15parked
c62build-partner

Build-partner portal — research, ideation, and a plan for a page that makes partners insiders

started Aug 8parked
c55agent-market-definition

Align the qcontrol agent-monitoring dashboard to specific personas and find market alignment — hypothesis-first, validated against calls later.

started Jul 24parked

Closed 1

c78fleet-overview-reports

Design the four product reports (Compliance, SLA Insights, Inventory, Board) and the fleet overview landing page as a summary of them.

closed Nov 3 · started Aug 20

Pages & components

What this week's captures picture — 9 pages · 6 first captured this week. Each links to its evolution: every moment it was shot, across cycles.

Log

Key Changes entries dated inside the week, from each cycle's record — newest first within a cycle.

c128 Reports

Nov 5
  • intents PR 5 and PR 6 (2026-11-05): c123's thread intents-pr5 evaluated both against Reports: evaluation, plan, Phase 6. PR 5 (merged) changes the Framework evidence section. PR 6 (open) would replace the three live reports with four generated PDFs and overturn three 2026-11-03 rulings, so that part waits on Mark. PR 6 merged the same day, and Mark ruled: PR 6's four reports (Inventory, Findings, Compliance, Executive Summary) replace our three, as living pages rather than generated PDFs. That reverses this cycle's rulings that Findings is a section of Posture and that the Board folds into the catalog. The work is in the plan's Phase 6, framework section first.
Nov 5
  • Four living reports (2026-11-05): built from c123's thread intents-pr5, on PR 6's questions. Inventory (reports/inventory/Body.vue), Findings, Compliance and Executive Summary replace Posture, Inventory and Deployment status; the old URLs read the report their content moved to. R1–R6 hold.
    • Findings read the lab's own 22 (data/reports-c128-findings.ts; Mark, 2026-11-05), with their real team, policy, outcome, reopens and reasons, so a report agrees with the pages (R3). The seeded 571 are gone. SLA goes, replaced by mean time to resolve on PR 6's definition.
    • Data protection and Egress stay, inside Findings (Mark, beyond PR 6). Their data is still seeded.
    • Compliance reads c123's enforcementPosture, exceptionsRead and postureHistory, and never adds frameworks together. Compliance Score stays out.
    • Enforce-pilot candidates (reports/Pilots.vue) are rule-based and show their evidence, or say why there are none.
    • A Team filter on every report, and Download PDF as a print of the page. CSV, JSON and the evidence pack are out for v1.
    • The Board band left the catalog for the Executive Summary. Posture's own body and the summary band are deleted.
    • Open calls are in c123's intents-pr5-review.md.
Nov 4
  • histories (2026-11-04): at Mark's word, the histories caught up with the deploy.
    • c128 has a story and pickup (app/data/cycle-stories-survey/c128.json). c78's story now reads closed into c128, with its pickup removed.
    • Archived cycles no longer show the c124 audit's "ready to close" note, on the story page or in the explorer (StoryView.vue, cycle-stories-mock.ts). The audit is dated, so anything closed after it was still being told to close.
    • c128 stays out of HISTORY.md because it's still active. c78's entry is there. Both are uncommitted.
    • c78 closed into c128: its Outcome is written, it has a HISTORY entry, and it's off CYCLES.md. It has no captures.
    • Uncommitted.
Nov 3
  • kick-off (2026-11-03):
    • Cycle created from Mark's prompt.
    • Two read passes:
      • every qdash page's data and time handling
      • the layer and design pieces for time, history and export, prior report cycles, and the problems and personas in market-analyst
    • data-inventory.md maps each candidate section to its source, time basis and gaps.
    • plan.md sets out rules R1–R6, decisions D1–D10, four clarifying questions and Phases 0–7.
    • Waiting on Mark's rulings before Phase 1.
    • Uncommitted.
Nov 3
  • answers (2026-11-03): Mark answered the four clarifying questions. Details are in plan.md under Clarifying questions.
    • "Non-operator" is not a role. It means C-level and other people who see data but get no controls. Reports therefore hold no controls and must make sense on their own.
    • Findings/SLA is a section of Posture.
    • The Board report folds into the /reports catalog's top band: one sentence for the window, one highlight per report, and the trend in words. Its composite score is dropped.
    • History of 3–12 months comes when the backend is connected. The mock is designed for 12 months.
Nov 3
  • rulings (2026-11-03): Mark ruled D1–D10. Details are in plan.md under Decisions.
    • Defaults kept:
      • the mock goes in the phase-4 lab
      • rolling, calendar and custom windows, defaulting to the last 30 days
      • compare with the previous period
      • scope is the org, with an optional Team
      • print/PDF, CSV and JSON this cycle
      • c78 closes into c128
      • the org's timezone
    • D5 overturned: the window is shared with the global when: pill, not separate. The picker becomes the pill's panel in the layer Filter and in qdash useGlobalFilter, and every operator page has to take any window. The backend needs from/to for every page.
    • Shared default: 30 days everywhere (Mark). qdash DEFAULT_PERIOD moves from 7d to 30d at the port.
Nov 3
  • downloads move to Reports (2026-11-03): Mark ruled that downloads and reports are handled in Reports now.
    • The "Forensic why-trail & evidence export — preview" panel is gone from the lab's Compliance page (phase4/mock/compliance.vue), along with the subtitle's evidence-export sentence. GovernanceLiveComplianceEvidenceExport stays in the tree, unused, as the source for Phase 4.
    • At Mark's word, the panel is also out of qdash /compliance (crates/qdash/ui/app/pages/compliance.vue on feat/new-pages), along with the same subtitle sentence and the unused download binding.
      • Checks: npm run check is clean, and vitest passes 593/593. :3030/compliance renders with no console errors and no export panel.
      • components/compliance/EvidenceExport.vue and useCompliance().download stay in the tree, unused, as the source for the Reports port.
      • Until Reports ships, findings JSON/CSV can still be downloaded from the findings export card on /integrations.
      • qdash is uncommitted.
    • The old phase-0 mock /pages/compliance.vue is left as an archive.
    • c123's X4 (merging the two evidence exports) now lands in Reports.
Nov 3
  • Phase 1, window picker (2026-11-03): the picker is built design-local, and its demo is at /pages/phase4/time-window (a new Reports section on the Phase 4 index).
    • Model: app/utils/time-window.ts is pure, with no Vue. Spec → resolved civil dates in the org timezone, plus compare, coverage, labels and URL encoding.
      • The defaults (30d, previous period) are left out of the URL, so the old ?period=7d still reads.
      • scripts/c128-time-window-check.mts holds 9 checks: rolling, calendar, to-date compare, the month-end clip, coverage, the year compare, custom ranges, the year boundary, the URL round trip and the org-timezone anchor. All pass.
    • Parts: app/components/time-window/ holds Calendar, Panel, Popover, Pill (the when: pill, with FilterItem's chrome) and Line (the report header line). app/composables/useTimeWindow.ts keeps the window in the URL or locally.
    • Demo:
      • One URL-synced window drives both the pill and a report line.
      • The panel is laid flat across seven worlds: 90 days, 12 months kept, 16 months kept, fresh install, before the data, across the new year, month to date.
      • A table shows every preset resolved.
    • Calls made:
      • Last 24 hours and All time stay in the presets, because the window is shared and operators had them.
      • Presets apply in one click; a custom range and a compare change wait for Apply.
      • A to-date period compares with the same days of the period before (Nov 1–2 vs Oct 1–2).
      • A year compare the data can't support falls back to the previous period.
      • The compare button reads "A year earlier".
    • Finding for Tyler: with exactly 12 months of retention, same-period-last-year is never available. The year before any window starts before the data. Comparing Q3 with the Q3 before needs about 16 months. This pulls against Mark's 3–12 months.
    • Checked in the browser:
      • presets, the custom pick, Apply, URL sync, and every scenario's text
      • dark and light themes
      • phone width: the panel fits at 343px, and the calendar shows the month the window ends in
      • no console errors

      The design site's own nav still overflows at 375px. That was already true before this cycle, and it widens the emulated layout.
    • Gotcha: functions imported from ~/utils/time-window and used only in a template were dropped from the compiled <script setup> ("$setup.isBakeable is not a function"). They are now read through local bindings (fmtDay, bakeable).
    • Uncommitted. Mark's review is next, then Phase 2 (chassis and catalog).
Nov 3
  • Phase 2, chassis and catalog (2026-11-03, started on Mark's word): Reports now has pages in the lab shell: the catalog at /pages/phase4/mock/reports and the three reports at /reports/posture, /reports/inventory and /reports/deployment.
    • The report world (app/data/reports-c128.ts) holds twelve months of daily history (Oct 30, 2025 to Oct 29, 2026) that ends on the lab's present, so a report agrees with the page behind it (R3).
      • The last 30 days of spend are the cost tour's ledger to the dollar: $5,865, Home's window.
      • The fleet ends at Home's 100 hosts: 97 fully monitored, 3 partial, 0 unmonitored.
      • The harnesses and models come from the ledger; the MCP servers are the lab's listing.
      • Before that the history is generated and seeded, so it's the same on every load: a rollout from 8 to 100 hosts, posture 53 → 78 with a March dip and the Oct 21 eval-run dip, 571 findings with fix times by severity (SLA targets are c78's placeholders: 7, 30, 90 and 180 days), and first_seen dates for inventory.
      • Readers implement R2: flows sum in the window, states read at its end, trends span its days. Days before history begins come back null (R6).
    • Specs and readers (app/data/reports-c128-specs.ts):
      • Each report's sections carry a question, a time basis, a qdash source and a status: live, staged or missing.
      • The readers produce the lede sentence, the lead metric with its change, the spark, the trend in words, the worst line and the facts.
      • The catalog card, the Board band and the report verdict all read the same reader.
    • Chassis parts (app/components/reports/):
      • BasisTag: "in window", "over the window" or "as of Oct 29". It reads "current state" in amber when the window ends before the data does, since there are no snapshots yet.
      • Section: title, question, tag, staged or "not in qdash yet", and the source line.
      • Verdict: sentence, then number and change, spark, trend words and facts. Sparks are scaled to the window's own range.
      • Footer: window, data through, timezone, generated, and the read-only note.
      • Card: c78's mini-doc briefing, its provisional lean.
      • SummaryBand: the Board fold-in. One derived sentence, three highlights, and the trend in words; no composite score.
    • The catalog has the shared when: pill, the Board band, then Security (Posture) and IT (Inventory, Deployment status). Links carry the window.
    • A report page has the breadcrumb title, Print/PDF and CSV·JSON stubs (Phase 4), the window line, the verdict, every section with a few real figures where the reader has them ("Phase 3 draws this section"), and the footer. A window with no data shows the window line's reason and the report's outline, with no sections.
    • Checked in the browser:
      • the catalog, all three reports, Q3 on Posture (76 ▲ 4 vs Q2, "current state" tags), year to date on Deployment (85 → 100%, no year-earlier data so no change), and a window before the data
      • the spend matches Home
      • light and dark themes
      • no console errors
    • Lab-wide, not changed here: the lab shell's rail doesn't collapse at phone width, and it highlights only exact paths, so Reports isn't lit on a report page.
    • Uncommitted. Next is Phase 3: Posture first, one report at a time, preview → build → Mark's review.
Nov 3
  • Phase 3 · Posture (2026-11-03, on Mark's word): all eight Posture sections are drawn, in app/components/reports/posture/Body.vue. It is mounted from /reports/posture, while the other two reports keep the Phase 2 outline.
    • Posture score: ReportsLineChart draws one point a day with the comparison window as a dashed ghost aligned day for day (the c103 F6 idea). Days before the data are hatched. Start, end, low and high are shown with their dates.
    • What lowers the score: points lost by factor. They sum to 100 − 78, the state today.
    • Critical and at-risk harnesses: installs under 80 with person, endpoint and top factor.
    • Findings and SLA:
      • the auditor's table by severity: target, opened (with its change), resolved, open at end, past target
      • opened and resolved per day
      • a past-target list on the window's last day, worst severity first, then oldest
    • Data protection: sensitive opens and secrets in content against the comparison, split by kind.
    • Egress: allowed, observed only and blocked. Blocks begin in July, when enforcement began, and a sentence explains the split. Risky destinations are listed.
    • Policies in force: counts by mode and the mode changes in the window, read from the lab's governance world, so they match /policies.
    • Framework evidence: counts by state for the tracked frameworks, with no % (c123). Read from the lab world, linking to Compliance.
    • World extension (reports-c128.ts, on its own seed so the Phase 2 numbers didn't move): POSTURE_FACTORS, AT_RISK, GUARD_DAYS (DLP and egress per day), splits, finding titles and harnesses, pastTargetAt, findingsPerDay.
    • Checked in the browser: last 30 days, Q3, all time, 24h with no comparison, and a custom range that starts before the data (hatched, comparison shown as —). No console errors.
    • Uncommitted. Mark's review of Posture is next, then Deployment status, then Inventory.
Nov 3
  • deploy (2026-11-03): deployed live at Mark's word ("it's all our lab").
    • What shipped: npm run deploy → deploy d39dd67b12, built from design c400dd2afe with 23 uncommitted paths included: all of c128 plus other sessions' lab edits. Layer 0.9.37. 6,258 routes prerendered in 1,023 s.
    • The first attempt collided with another session's deploy over .nuxt-deploy and aborted at cleanup. That other deploy never published.
    • Checked live on design-f39.pages.dev: /pages/phase4/mock/reports/ and the posture, deployment and inventory reports, plus /pages/phase4/time-window/, all return 200. Posture on ?period=last-quarter renders (76 ▲ 4).
    • The slow build came from the prerender crawler following about 19k query-string lab URLs. c129 fixed that (build 17.5 → about 4 min) and deployed again as bd48264c3e, built from 0a2cb25691 plus the same uncommitted paths, so c128 stays live.

c126 Policies Final Pass

Nov 5
  • intents PR 5 (2026-11-05): c123's thread intents-pr5 found three things on these pages: the frameworks strip has to go (already C5), the "Active frameworks" column and PolicyFrameworks need PR 5's terms, and framework-track leaves the Policy Config draft. Details in c123's plan, Phases 2 and 5. All three were built on these pages the same day; the title, Custom controls and the Evidence packet are still c126's.

c123 Compliance Frameworks

Nov 5
  • intents-pr5, evaluation and plan (2026-11-05): thread intents-pr5 (prompt, evaluation, plan). Peterson's framework intents landed as qpoint-io/intents PR 5, merged by Mark the same day, and the review this cycle's scope promised is done. Nothing is built, and nothing in this thread is committed.
    • PR 5 excludes what posture-score built: a subject-weighted, exception-adjusted %, and compliance scoring. It defines one measure, Policy enforcement posture: Off / Observe / Enforce per policy-to-control mapping, by published default mode, with exceptions as annotations. On that rule OWASP LLM reads 5 / 21 / 2 of 28 mappings (18 / 75 / 7) where the bar says 50%.
    • It also reverses F8, c118 A6 and Q10: tracking changes no policy and saves outside the draft.
    • Of the redline's six asks, the split, version pinning and most of per-mapping provenance landed. Evidence as a mapping target, the four coverage states and tracking moving Off to Observe were declined.
    • Rulings the same day (Mark), all in the plan. Merging an intent doesn't rule over design work, so where these differ from PR 5 or PR 6, they hold in the lab and the differences are his to raise.
      • Posture measures what Qpoint can know and govern. Enforcement Posture is progress toward each policy's best possible mode, so 100% can mean everything possible is at Observe. Exceptions get their own metric, led by direction. Established OWASP LLM reads 40%, 10 of 25 mappings at ideal, 10 policies to change.
      • Tracking changes nothing, and a separate button stages Off policies at Observe. F8 retires as written.
      • On the page: Controls on every framework; columns Control · Policies · Enforcement Posture · Compliance Score; green at 100%, orange for work left, red only when a policy is Off.
      • Compliance Score stays as built, seeded and marked projected, and out of Reports.
      • All five frameworks stay listed. Untracked ones show name and description only.
      • Reports: PR 6's four, as living pages rather than generated PDFs (c128).
    • Committed: 0d01a2ea9c (posture-score as built) and b228984aea (Findings fixed layout), both local. This thread's documents aren't committed, and Phase 1 is next.
Nov 5
  • intents-pr5, Phase 1: the shared calculation (2026-11-05): thread intents-pr5. The model is in governance-fixture.ts; the pages don't read it until Phases 3 and 4, and the Nov 4 functions stay until they do.
    • New: enforcementPosture, rowEnforcement, exceptionsRead, postureHistory, policyModeAt, controlGroups. A limited row is marked limited (OWASP LLM04, LLM08, ASI06, ASI09). Frameworks gain a source link, native groups, mapping revisions and a tracking log, which applyChange now writes.
    • Established world: OWASP LLM 40% (10 of 25, 10 policies to change; 7 exceptions: 3 tighten, 2 loosen, 2 neutral, 1 expiring); OWASP Agentic 40%; NIST AI RMF 47%; ISO 27001 50%; SOC 2 41%. With a pilot running, OWASP LLM reads 32% with 5 exceptions, all tightening.
    • Seeded, and marked so: policy modes before October (POSTURE_SOURCE: on through the spring, enforcing from July, agreeing with c128's report world), and mapping revisions, including one that moves OWASP LLM from 22 to 25 mappings on Jun 1. History before Jan 12, or before a framework's first mapping, is unavailable.
    • SOC 2 now has 11 criteria, 10 of them mapped. A lab proposal from research/frameworks-dossier.md §3e, not a reviewed mapping: PR 5 leaves SOC 2's fixed scope open. This is the one visible change: SOC 2 shows data on Compliance, framework detail and policy detail, still under the Nov 4 formula until Phase 3.
    • Calls made: a framework's bar goes red only when all of it is Off, because nearly every framework holds something Off; a row goes red when any of its policies is. labelsAbridged on the framework replaces the plan's officialTitle, rather than writing official text from memory.
    • Checked: scripts/c123-metrics-check.mts (62 checks), scripts/tours-walk.mjs (455 passed), and in the browser. "A draft change moves nothing" can only be checked in the browser, so it moves to Phase 2.
    • Found: the layer's DataDonutChart rounds an arc differently on server and client in the last digit, which logs a hydration warning on SOC 2's framework detail. Harmless, and not from this work.
Nov 5
  • intents-pr5, Phase 2: tracking leaves the draft (2026-11-05): thread intents-pr5.
    • Track and Untrack apply at once, by whoever is acting, through trackFramework, and add no Policy Config line: framework-track is now in OPERATIONAL, and its draft handling is gone. No policy moves.
    • One verb: Untrack replaces Stop tracking on Compliance and framework detail. It asks first, on both, and says what it hides: "It leaves dashboards and new reports. No policy changes, and its history is kept."
    • Who tracked it: framework detail reads "Tracked by Dana (security admin), Apr 6, 2026", with History behind it listing actor, date and previous and new state.
    • The staging step (D3): on a tracked framework with something Off, framework detail offers "Add 4 to the draft at Observe". It lists each policy with Off → Observe first, then adds ordinary mode-set lines. They go straight into the shared draft through addToDraft, leaving the person's own unsaved edits alone. It reads published state, so the draft can't change what it says is Off. It's hidden when nothing is Off or the framework is untracked. Untrack never undoes it. The record page has no draft, so it doesn't offer this.
    • Checked: a new scripts/c123-track-walk.mjs (35 checks) walks all of it in a browser, through publishing, where the page finally moves. scripts/c123-metrics-check.mts (62) and scripts/tours-walk.mjs (455) still pass. Desktop width, light mode only.
    • Known and left: the OWASP tour's close still says Track stages policies (Phase 7, through c125). D4's "10 policies to change" link waits on Phase 5, when Policies learns to filter by framework. The band and rows still show the Nov 4 metrics until Phases 3 and 4, and they follow ?preview=draft until then.
Nov 5
  • intents-pr5, Phases 3–8: the pages (2026-11-05): thread intents-pr5. Mark moved his review to the end, so these ran without stops. The open calls are in intents-pr5-review.md.
    • Compliance listing: Enforcement Posture, Exceptions and Compliance Score on tracked frameworks; name, publisher, edition and description on untracked ones. "Instrumented", the dead Add button and the auto-tagged claim are gone. Tracked / Untracked.
    • Framework detail is recomposed in PR 5's parts: the framework with a source link and mapping revision; both metrics and open findings; the staging step; the exceptions themselves; controls in native groups with rationale on every row, and limited rows marked; posture over time with mapping marks and reconstructed ranges; what isn't mapped; supporting evidence. Columns read Control · Policies · Enforcement Posture · Compliance Score. The Nov 4 weighted posture is gone from the fixture.
    • Policies: the frameworks strip leaves (X1, X2), a framework no longer "requires" a policy, and the band's "policies to change" opens the listing narrowed to them. The policy's Frameworks section reads Control and Untracked, with why each is mapped.
    • Reports (with c128): four living pages from PR 6. See c128.
    • Tours and guide: the OWASP close no longer says Track stages policies, and points at the Compliance report instead of the evidence export. The guide's Framework term no longer says "covered" and "gaps", and it gains Enforcement Posture.
    • Redline closed: see intents-redline.md.
    • Checked: 108 browser checks, 45 calculation, 455 tours, 9 time window. Dark at 1400px and light at 800px looked at. Captures c123-after-*, c128-after-*.
    • PR 6 merged the same day (6df1426), with the content this work read.
Nov 5
  • intents-pr5, Mark's notes (2026-11-05): thread intents-pr5, ahead of the decisions review.
    • A 100% example: example-complete, "Example: everything at ideal", tracked, made of the eight policy-to-control mappings the established world has at ideal. Clearly labelled as a lab example, and it shows in the reports because it's tracked. It reads 100% with 3 exceptions, 2 of them loosening, and with a pilot running it drops to 75%, because nothing enforces by default there.
    • Exceptions as a donut in the band, in the same colours as the chart, with expiring in the footer.
    • Over time became one part, part/PostureOverTime.vue, and moved to the top of framework detail for one pass.
    • The Compliance report carries it too: "The whole record" sits under each framework's window line, whatever the window, with mapping changes and reconstructed ranges.
    • Checked: 123 browser checks, 48 calculation.
Nov 5
  • intents-pr5, first review decisions (2026-11-05, Mark): thread intents-pr5.
    • The score joins Over time: a % line above the modes, on framework detail and in the Compliance report. Percentage charts now always read 0 to 100, so 40% sits at 40%. Mark tried it at 48px, found that too short, and went back to 110px.
    • Over time moves to the bottom of framework detail (Mark). It was at the top for one pass.
    • Not mapped by Qpoint and Supporting evidence are gone from framework detail (Mark). Controls with no policy are now only counted, in "How these are worked out".
    • Reports read the lab's own findings: 7 open of 22, the same as the pages, with their real teams, outcomes, reopens and reasons. c128's seeded 571 are gone, and with them the 188 against 22.
    • Data protection and Egress go into the Findings report, beyond PR 6. They're still seeded, scaled by team share. Spend, shadow installs, versions and the fleet posture score stay out.
    • Compliance Score is option A: severity box over seeded checks. Options B–F, the switch and their fields are gone.
    • The 100% example is untracked: out of the reports, and one Track away on Compliance.
    • Checked: 130 browser checks, 47 calculation, 455 tours.
Nov 5
  • intents-pr5, second review decisions (2026-11-05, Mark): thread intents-pr5.
    • Kept as built: a framework's bar goes red only when all of it is Off; the numbers read published state, not the draft; the Enforce-pilot thresholds stay flagged placeholders.
    • Policy pills read Off, not Inactive: PolicyTag's label, in the layer. Committed in q-nuxt-layer, not yet released, so the deployed site needs a release to show it.
    • The band's findings box matches Compliance Score: the last 30 days plus anything still open. OWASP LLM reads 7 High and 1 Med, with 6 still open, as the listing does.
Nov 5
  • intents-pr5, loosening reads orange (2026-11-05, Mark): everywhere: the Exceptions donut and chart, Policy Config's lines, Change impact, the Policy Config tray, Teams, team Policies and the reason prompts. This changes c121 D8's red. Red stays for what's actually blocked or failed: a refused edit, Publish is blocked, a failed import.
Nov 5
  • intents-pr5, light green for can-only-observe (2026-11-05, Mark): in the band's bar and Over time's mode chart, a mapping on a policy that can only observe shows light green, because there's nothing left to tighten. Green shades are done, and orange and grey are work left, so 100% is all greens. Applied per mapping at every score, not only at 100%. observeOnly and modeLine in the fixture, so the band and the Compliance and Executive reports word the counts the same way. The listing's and rows' bars stay one colour, for the %.
Nov 5
  • intents-pr5, a quick framework row on Policies (2026-11-05, Mark): part/PoliciesFrameworks.vue shows tracked frameworks with their % and offers Add framework, which tracks at once and changes no policy. Untrack stays on Compliance and framework detail. "Activate All", "Enable Required Policies" and the old % complete stay gone. This relaxes X1's one place to track.
Nov 4
  • posture-score, two compliance metrics (2026-11-04): thread posture-score (prompt, plan). Coverage and the completeness % give way to two metrics, which Mark asked for as an amendment to F1's "no percentage". Not yet taken to Peterson; hold any org-wide number and any qdash port until then. Uncommitted, not deployed.
    • Compliance Posture is how well we are set up, now: each person a mapped policy reaches counts by the mode they actually get (Enforce 1, Observe 0.25, Off 0), and a live advanced exception takes 10 points off. A policy that can only observe counts fully when observing. A row averages its policies, a framework averages its addressable rows. Green at exactly 100%, red under 25%, orange between. policyPosture(), requirementPosture(), frameworkPosture() in governance-fixture.ts.
    • Compliance Score is findings against what was checked, over 30 days, counting distinct findings and any older one still open. Check and session counts are seeded and marked projected; Qpoint doesn't count them yet. Six display options sit behind ?v.score= (?parts=1 shows the swap): A box + base (default), B two numbers, C sessions, D percent, E rate, F 0–100. scoreOf(), part/ComplianceScoreCell.vue.
    • Framework detail (part/FrameworkDetail.vue, shared with the record page): the Coverage machine and column went, as did the heading, filter and count above the table. Columns read Name · Enforcement Posture · Compliance Posture · Compliance Score, with Findings folded into Score and the two metrics sortable. Mapped policies became Enforcement Posture in the band and the table. Items Qpoint can't address leave the table and stay under Gaps (Mark, 2026-11-04), so SOC 2 shows an empty table and its three gaps. The pill now shows the policy's own mode, because standing() read "enforced" for a policy that is Off with one enforcing exception.
    • Compliance listing: Compliance Posture and Compliance Score replace Total Violations and the completeness %, which closes X5. Findings count once per framework. The two sorters now really sort. The plan left Score blank on untracked frameworks; it shows there, as Violations did.
    • Checked: scripts/c123-metrics-check.mts (24 checks), scripts/tours-walk.mjs (455 passed), and in the browser at 900–1500px in light, with dark seen on framework detail only at a glance. No captures yet.
    • Still open: pick a Score option; the band's Open findings (open only) and the row Score (window plus open) count differently, so OWASP LLM reads 5 High against 7 High on the listing; "Mostly out of scope" rows that still map to a policy stay in the table; a real count of checks needs the backend; the rest of the plan's "where else" list.
Nov 3
  • phase4-simple, framework detail composed (2026-11-03): thread phase4-simple (prompts). Started as a short list of page notes from Mark and became the first composed framework detail (X6), plus one verb on two of the three framework surfaces (X1, X2). Commits d9dac5fd95 and c400dd2afe, on layer 0.9.37.
    • Framework detail is composed. Its body moved out of the record page into part/FrameworkDetail.vue, which the record page and a new mock share: /pages/phase4/mock/compliance/detail, opened from Compliance's "Details + Configuration" and registered as S5's mock. The mock runs on the shared world, so its numbers can differ from the record page's (6 open findings against 4 on OWASP LLM). Track there stages a framework-track change in the Policy Config draft.
    • The table runs full width: Item · Coverage · "Policies governing this item" · Findings. The header follows the source's term ("…this control", "…this criterion"). Policies are PolicyTags with a status, which reads inactive when the policy is not in scope, observed at observe, and enforced at configured or confirmed. Findings are open counts by severity, in the Findings ledger's box. The capability and Gap columns are gone, and the Gaps section keeps the reasons. The filter is the standard FilterTriggerBar, and the search box is gone.
    • "Risk" leaves the page, except the kind. OWASP's entries read Items (sourceTerm: 'item'), which sets aside D8's source's-own-term for OWASP only; ISO, SOC 2 and NIST keep theirs. The OWASP descriptions say "security issues". The kind label still reads "risk taxonomy", awaiting a word (proposed: "Top 10 list"), and "NIST AI Risk Management Framework" is a name.
    • The summary band went from label-over-number cells to DataMachines, picked from three revisions at /pages/phase4/framework-summary (kept for comparison): Coverage as a segment bar (A; black, grey, white), Mapped policies as a donut (B; green, orange, grey), Open findings as the severity box (C). Tracked left the band. With nothing mapped, Open findings shows a grey 0, not a green one. The table's coverage dots and the "What coverage means" text match the bar. The guidance disclaimer moved from under the title to a footnote under Gaps.
    • Track is a state, not a toggle. Mark didn't understand the black Tracked button: it read as a status, stopped tracking without asking, and changed nothing on the page. Now it's a quiet "Tracked" with a separate Stop tracking link that asks first. Compliance reads "Tracked frameworks" and Track / Stop tracking. F8 (tracking stages policies at Observe) is still not built, so Track still changes no policy.
    • Tables shrink with the page. Compliance (min 560px) and Control Policies (min 600px) moved to fixed layout: columns keep their shares and shrink together, text ends in an ellipsis with the full text on hover, and numbers and actions stay whole. Compliance's compliance figures clip rather than ellipsize. This took three tries on Compliance. The first truncated only the name column, the second squeezed it to 29px or folded Kind to its icon, and Mark then asked for every column to give way. Framework detail stays in auto layout; its policy pills truncate through max-w-0.
    • Smaller: Compliance's section headers use qdash's h2 text-24; the mock rail stays lit on sub pages and on surfaces that name it as nav; mock/compliance.vue became mock/compliance/index.vue at the same URL.
    • Layer 0.9.37 (0d1ea8c): PolicyTag gains status, and UxTableListSorter's label is a truncating span, unchanged in auto-layout tables. Only design's lockfile moved; bob-wire, www and qdash are still on 0.9.36.
    • Deploy: my own npm run deploy built, then stopped at "Build produced no index.html" and pushed nothing. A second deploy had started at 12:32 in the same checkout, and c129 records the collision. That run shipped c400dd2afe as d39dd67b12 on deploy, with 23 uncommitted paths from other sessions. bd48264c3e (c129, from 0a2cb25691) has since replaced it and carries this work too.
    • Checked by hand in the browser at 768–1600px, in light mode, and by curling the deployed pages. No capture program was run, and there are no after captures yet.
    • Still open:
      • Policies' frameworks strip still says "Activate Frameworks" and "Activate All", so X1/X2 aren't finished.
      • Compliance still shows completeness as a percentage (X5).
      • PolicyTag names can't be read in dark mode: the name's ink flips while the pill stays light. This predates the thread and now shows on framework detail in the site's dark theme.
      • Evidence export is c128's: it removed the export from the Compliance mock, in its own uncommitted work.

c101 Qmap Surface

Nov 4
  • qmap takes it up (recorded 2026-11-04): qmap's c29 (look and feel) staged the sessions the day the handoff landed. Its own record has the detail; these are the parts that change this cycle's plans:
    • The working scene: scenario 1, the stranger on the phone, is c29's default scene. It's the only scenario with flows so far. c29 holds a copy of finding-sessions.json (identical on 2026-11-04), and design still owns it.
    • Fewer pawns in the default view: Mark's Zones hierarchy makes endpoint, account and repo rugs, not actors. The top-level rugs are AI Services, Internet and the Endpoint. A personal account's ⚑ now sits in its rug label. pawns-needed.md carries a note saying so.
    • Tools are in question: Mark: tools "as 3d objects with as much space as a harness feels wrong." c29 is comparing four treatments (labels on lines, tool belt, expanding stack, Tools box). MCP tools now sit on their server's rug. Nothing is picked yet.
    • The harness stand-in: the grey, red-hatted helper split from the voxel Helpers pair, not design's AgentPawn art. Every other actor is a grey placeholder sphere while rugs are tuned.
    • Still open here: the designer's first round isn't on record, and "qmap Phase 0" (commit qmap's old uncommitted work) is now tangled with c29's own uncommitted work.
Nov 3
  • qmap handoff (2026-11-03): Mark: "we're starting to work in the qmap project, save and update history, and make our example sessions available and clear so that project can know which pixel pawns are needed."
    • pawns-needed.md: what qmap must draw to stage the six sessions, derived from the data (79 actor instances, 11 kinds, 13 findings). That comes to 11 pawns plus the guard's marks. Each pawn gets its count, its sessions, the states the six need, the art today (from pawn-inventory.md) and a priority. First priority: helper (watched / no brakes / unknown), plug-in (configured / stranger / joins after an exception), file (ordinary / sensitive by severity), outside place (approved / weak TLS / blocked at a wall / crossed), and the guard's marks (severity, Observed vs Enforced, afterlife states). Skill and Team aren't needed. The non-pawn treatments the scenes lean on are listed separately.
    • finding-sessions.json: the six sessions as data. Each actor carries its beats and the findings on it. Generated from app/data/finding-sessions-c101.ts by npx tsx scripts/finding-sessions-export.mts.
    • qmap side: qmap/cycles/c29.look-and-feel/design-c101-finding-sessions.md, a self-contained note for qmap's newly opened c29 (look and feel, hierarchy, labeling). It has the six stories in one line each, the pawn short list, and paths to the JSON, the pawn list, the page and the brief. Only the new file was added: c29's CYCLE.md and qmap's other uncommitted work (c101's still-open "qmap Phase 0") were left alone, because c29's session and dev server are live.
    • The sessions page's footer links the pawn list and the JSON.
Nov 3
  • saved (2026-11-03): the sessions, page, JSON, pawn list and records went in as design 586ac2a13b (on branch c123/owasp-agentic-tour), and the handoff note as qmap 29b3de2. Neither is pushed, and the page isn't deployed, so /cycles/design/c101/sessions is local only for now. While updating cycles/CYCLES.md, a script of ours emptied it for about half a minute. It was rebuilt from HEAD plus c128's uncommitted diff.
Nov 2
  • finding sessions (2026-11-02): Mark asked for a narrower focus: violation findings, and the sessions that generated them, as material for small map "dioramas". finding-sessions.md holds six written sessions in the Meridian world, using real policy names (c114's fixture world plus qdash's seeded controls):
    1. The Vanta MCP (c114 Session 1)
    2. The SSN in the fixture (LLM02)
    3. Approvals off
    4. The paste that didn't leave
    5. The poisoned Sentry event
    6. The install we couldn't see

    Each scenario has beats, a cast and a Data line. Each diorama is two or three stills (before, the finding, the afterlife), not a timeline. This turns around the brief's "sessions are counted, not drawn": here the session is the stage. The doc ends with what the dioramas need that the brief lacks: a session rug, risk on lines (payload, gate, wall), an Observed/Enforced pair, step order, unknown as fog, and afterlife states. Prompt and plan are in finding-sessions-prompt.md and finding-sessions-plan.md. Committed in 586ac2a13b.
Nov 2
  • sessions page (2026-11-02): Mark: "let's start by creating a page in the design app that lists out all the actors and what happened. we're starting with pencil and paper." So the map waits. Finding Sessions at /cycles/design/c101/sessions (app/pages/cycles/design/c101/sessions.vue, data in app/data/finding-sessions-c101.ts) has:
    • The cast across all six: a matrix of actor kinds × sessions, with ⚑ where a finding's mark sits, plus actor and finding totals (79 actors, 13 findings).
    • Per session: the logline and facts, a finding badge for each policy (severity, and Observed vs Enforced), the actor list (kind, name, state in this session, and the beat times it appears in), what happened beat by beat (finding beats tinted, with the actors each beat touches as chips), and Afterwards.
    • Interaction: clicking an actor dims the beats it isn't in.

    Every beat names its actors, so each actor's story comes from the beats, and the data file is the start of a fixture. Checked on the live :3000 server: no console errors, and the actor filter works. Committed in 586ac2a13b.
Nov 2
  • plain words (2026-11-02): Mark: "the scenarios are a bit hard to understand, I'm looking to create a simple cast of characters and a ELI5 explanation about what happened / went wrong / etc." Then, mid-build: "I don't mind what we had, I just wanted to supplement with simple, quickly read overview." So the page now opens with an Overview, and everything below it is unchanged.
    • The cast of characters: twelve plain names. The person, the helper, the laptop, the brain, the brain's company, the badge, the plug-in, the tools, the project, the files, the outside places, and the guard (Qpoint itself).
    • Six story cards: each has a plain title (the stranger on the phone, the secret in the test file, no brakes, the door that stayed shut, the trick note, the invisible helper). Each card lists the four to six characters its story needs, then four short parts: what happened, what went wrong, what the guard did, what happened next. It links down to the full session.
    • Below the overview: the kinds × sessions table and the six detailed sessions, as before.
    • Data: characters and a per-session eli5 added to app/data/finding-sessions-c101.ts.
    • Markdown: finding-sessions.md gained an "In plain words" section.
    • Checked: in the browser, with no console errors. Committed in 586ac2a13b.
Nov 2
  • Side note, /cycles (2026-11-02): Micro is now the /cycles default layout (see c111).

c129 Deploy Build Time

Nov 3
  • 2026-11-03 — skip query links in the deploy crawl (commit a7323795df on claude/jovial-dubinsky-36e37e, unpushed). Under DESIGN_DEPLOY_OUT, nitro.prerender.ignore skips any link with a ? and queues its bare path instead (captured from the prerender:routes hook), so a page linked only with a query still prerenders. Dev is untouched.
    • Measured on c123/owasp-agentic-tour plus the main checkout's 23 uncommitted lab paths (nuxt generate, deploy.sh step 1):
      BeforeAfter
      Total build1,051 s262 s
      Prerender phase967 s191 s
      index.html3,1263,125
    • Gained pages/phase4/mock/inventory/agents/detail and inventory/tools/detail: they were linked only with a query, so the live site was missing them. Dropped /cycles/design/c0 and /cycles/design/c97-harness-chip (+ record): 404 pages reached only from ?cycle= links on the c124 mock. Posture report and time-window pages are byte-identical.
    • The 1,660-page figure in the original log came from a build that was cut short; a full build writes about 3,125 pages.
Nov 3
  • 2026-11-03 — DataTimeline demo fixed (same commit). The demo passed timeframe: 'week', but Timeline matches Time values ('7days'), so its computed was undefined and SSR threw reading 'labels'. The demo now passes Object.values(Time).
Nov 3
  • 2026-11-03 — where the rest of the time goes (from the baseline log, summed render time across 12 cores, so per-page numbers are inflated by queueing):
    BucketRoutesSummed render time
    Query permutations (now skipped)19,034~21,000 s
    Path-only pages3,516~10,100 s
    └ /cycles/design/*1,099~7,800 s (doc pages avg 11 s, cycle pages avg 3.7 s)
    └ /components/_demos/*386~80 s
    /pages/data-swarm-ideas, -2-, -3-3~284 s each

    Top query offenders before the fix: findings (2,160), compliance/detail (1,787), policy-config/config-file (1,515).
Nov 3
  • 2026-11-03 — first real deploy with the fix (bd48264c3e on deploy, from c123/owasp-agentic-tour 0a2cb25691 + 23 uncommitted). nuxt generate took about 4 min (client 29 s, server 34 s, prerender 176 s, 6,256 routes, 3,126 index.html), but deploy.sh ran 931 s end to end. The other ~11 min came after the build: committing 17,863 files (820 MB) as a fresh tree and force-pushing it. The build is no longer the slow part of a deploy; the commit and push are.

c111 Cycles by Week

Nov 2
  • 2026-11-02, Micro becomes the default: at Mark's request, /cycles opens in Micro. ?layout=cards and ?layout=list select the others, and old ?layout=micro links still work (app/pages/cycles/index.vue).

Captures

9 screengrabs taken this week, 4 of a subject with an evolution history.

Compliance & Frameworks after intents PR 5: Enforcement Posture, Exceptions and Compliance Score on tracked frameworks; name and description on untracked

After: two metrics on OWASP LLM, and untracked frameworks with name and description only
After: two metrics on OWASP LLM, and untracked frameworks with name and description only
intents PR 5 and PR 6, integratedNov 5evolution →
After: excluded from reporting, with controls and mapped policies in NIST's four functions
After: excluded from reporting, with controls and mapped policies in NIST's four functions
intents PR 5 and PR 6, integratedNov 5
After: 40% with mode counts, 7 exceptions by direction, the staging step, controls with rationale, and posture over time
After: 40% with mode counts, 7 exceptions by direction, the staging step, controls with rationale, and posture over time
intents PR 5 and PR 6, integratedNov 5evolution →
After: the strip is gone, and frameworks read as tracked tags
After: the strip is gone, and frameworks read as tracked tags
intents PR 5 and PR 6, integratedNov 5evolution →

Reports catalog: four living reports

After: Findings, Compliance, Inventory and Executive Summary, by reader
After: Findings, Compliance, Inventory and Executive Summary, by reader
intents PR 5 and PR 6, integratedNov 5
After: Enforcement Posture per tracked framework, how it changed, and the evidence
After: Enforcement Posture per tracked framework, how it changed, and the evidence
intents PR 5 and PR 6, integratedNov 5
After: one aggregate account, with no combined number and no people or devices
After: one aggregate account, with no combined number and no people or devices
intents PR 5 and PR 6, integratedNov 5
After: open now, resolved, backlog, time to resolve, and Enforce-pilot candidates
After: open now, resolved, backlog, time to resolve, and Enforce-pilot candidates
intents PR 5 and PR 6, integratedNov 5evolution →
After: the known surface, what isn't monitored, coverage over time, where to focus
After: the known surface, what isn't monitored, coverage over time, where to focus
intents PR 5 and PR 6, integratedNov 5

Releases & deploys

Layer releases 1

v0.9.37Nov 3v0.9.37: PolicyTag status segment (inactive · observed · enforced); sortable header label truncates in fixed-layout tables

Design-site deploys 3

Nov 4, 11:00 AM4f39d2c44clayer 0.9.37
Nov 3, 1:25 PM0a2cb25691layer 0.9.37
Nov 3, 12:51 PMc400dd2afelayer 0.9.37

Qpoint Brand Style Guide