3 started, 1 closed, 23 carried live.
Busiest record: c123 Compliance Frameworks (12 entries) · 68 carried cycles have gone quiet · layer v0.9.37 → v0.9.37
Compliance & Frameworks after intents PR 5: Enforcement Posture, Exceptions and Compliance Score on tracked frameworks; name and description on untracked
Commits
36 commits across 4 repos, on each repo's checked-out branch.
Cycles
Started 3
Keep npm run deploy short as the lab grows. The prerender crawler renders every page it can reach, and the build's time goes wherever the crawl goes.
A time-windowed Reports section for qdash. It gives C-level people, auditors and others who see data but get no controls what the dashboard already shows, as documents they can hand on. The two categories are Security (Posture) and IT (Inventory, Deployment status). Every report reads one window: rolling, calendar or custom from–to, with a comparison period.
Visual look and feel, hierarchy, and labeling — tuned by hand
Still open 23
A final, hand-tuned pass over the policy surfaces in the phase-4 lab. We walk each aspect in turn (the listing, the policy header, mode and Until, severity, exceptions, frameworks, findings, history, Policy Config, team Policies) and sand each one by hand. Along the way, each fact about a policy gets one home, and every other place summarizes it and links there.
A tour-guide and self-documenting tool that attaches cleanly to any part of the UI, so the UI becomes the documentation. It has a hover help mode (after Ableton Live's Info View), a numbered-marker overlay for explaining a screen, step-by-step tours that move across pages and highlight what matters, and an AI tour guide over MCP from the start. Its first tour is the operations journey from the 2026-10-26 product session: install to enforcing on a pilot team.
Make the cycle detail page tell the cycle's story at a glance: why it happened, what changed (before → after, in plain words), and who made it better. External market specialists are credited first. Every outcome traces back through its decision to the meeting or conversation it came from. Collaborators get their own unlisted pages, where attributions and accolades build up.
Give the frameworks a good bath and a redress. We finalize the framework page designs and tune their details from the latest designs and what Mark Peterson made clear on 2026-10-26: Qpoint gives evidence, not compliance, under emerging regulatory pressure to govern AI. Most of the work is by hand. We export the current page to Illustrator, Mark reworks it there, and we build the result on a test page. The brief's Frankenstein list (X1–X11) is the checklist for the cleanup.
Build the Phase II governance dashboard for qdash around the object model the ../intents repo describes, so that Findings, Policies, Scope, Groups, Exceptions, Enforcement and Frameworks appear as one coherent system rather than fourteen features
A weekly view of the cycle atlas (started · still open · closed per week) beside the existing numerical view, plus a week details page designed as a _meta mock
Fold qmap into DataSurfaceSection. Draw a thing's Surface (what it reaches) as a scene of pixel pawns, as a second view beside the lists (Map ⇄ List). This starts with a design brief to a designer.
Tame our own design history before telling it. Catalog the Qpoint Design drive (sketches, Illustrator, Photoshop, InDesign, Sketch, Figma) so every file can be found, previewed and traced to its original. Tie each file to a cycle where one exists, otherwise to a startup phase and design generation. Write down an ingestion protocol that ends in a story. Then give the cycle detail page a story-first design pass.
Build the decisions from the week of Oct 19 into the phase-4 lab (/pages/phase4/mock/*). The governing scope is Mark Peterson's v1 guidelines: an exception changes mode only, publication is the whole shared draft, and resolving a finding records a decision.
A /briefs section on the design site, off the main menu, with one page per brief handed to a collaborator outside the org
Re-evaluate the qdash /cost page against what the backend now serves, and re-draw it on the Organization / Inventory listing pattern
Design the three qdash "Design in progress" landings: Home /, /inventory and /team. Each is a 30 ft (300 ft for Home) view of its domain, made more of images than of text.
Reshape market-analyst into a design tool first — the source of truth for Qpoint's problem space — by adding a micro-problem layer (use case → micro problem → observations) on top of the existing market lens, with a curated registry, extraction-proposed candidates, computed standing, product surfaces, document intake, and briefs/stories that cite problems.
Downloadable logos on /brand/logo. Pick a logo, a format (SVG · PNG · GIF · JPG, in that order of preference) and a color (White · Black · Grape), then download a pre-built file generated from black master SVGs.
An ideas cycle. Gather sourced material on the Prometheus story as an analogue for AI; on ancient attitudes to fire; on David Deutsch and Karl Popper's error correction, set against our problem formation; and on modern voices about AI, from doom to salvation
Explore and integrate Avoma notes data into extraction pipeline and dashboard visualizations.
Refine how extracted data is displayed in the dashboard and improve extraction quality where gaps exist.
Add Google OAuth to restrict dashboard access to @qpoint.io team members.
Methods & tooling retro — evaluate how we work against the design methodology, restore order, modernize the skill/agent tooling, and make the philosophy load-bearing
Build-partner portal — research, ideation, and a plan for a page that makes partners insiders
Align the qcontrol agent-monitoring dashboard to specific personas and find market alignment — hypothesis-first, validated against calls later.
Closed 1
Design the four product reports (Compliance, SLA Insights, Inventory, Board) and the fleet overview landing page as a summary of them.
Pages & components
What this week's captures picture — 9 pages · 6 first captured this week. Each links to its evolution: every moment it was shot, across cycles.
Pages 9
Log
Key Changes entries dated inside the week, from each cycle's record — newest first within a cycle.
c128 Reports
- intents PR 5 and PR 6 (2026-11-05): c123's thread
intents-pr5evaluated both against Reports: evaluation, plan, Phase 6. PR 5 (merged) changes the Framework evidence section. PR 6 (open) would replace the three live reports with four generated PDFs and overturn three 2026-11-03 rulings, so that part waits on Mark. PR 6 merged the same day, and Mark ruled: PR 6's four reports (Inventory, Findings, Compliance, Executive Summary) replace our three, as living pages rather than generated PDFs. That reverses this cycle's rulings that Findings is a section of Posture and that the Board folds into the catalog. The work is in the plan's Phase 6, framework section first.
- Four living reports (2026-11-05): built from c123's thread
intents-pr5, on PR 6's questions. Inventory (reports/inventory/Body.vue), Findings, Compliance and Executive Summary replace Posture, Inventory and Deployment status; the old URLs read the report their content moved to. R1–R6 hold.- Findings read the lab's own 22 (
data/reports-c128-findings.ts; Mark, 2026-11-05), with their real team, policy, outcome, reopens and reasons, so a report agrees with the pages (R3). The seeded 571 are gone. SLA goes, replaced by mean time to resolve on PR 6's definition. - Data protection and Egress stay, inside Findings (Mark, beyond PR 6). Their data is still seeded.
- Compliance reads c123's
enforcementPosture,exceptionsReadandpostureHistory, and never adds frameworks together. Compliance Score stays out. - Enforce-pilot candidates (
reports/Pilots.vue) are rule-based and show their evidence, or say why there are none. - A Team filter on every report, and Download PDF as a print of the page. CSV, JSON and the evidence pack are out for v1.
- The Board band left the catalog for the Executive Summary. Posture's own body and the summary band are deleted.
- Open calls are in c123's
intents-pr5-review.md.
- Findings read the lab's own 22 (
- histories (2026-11-04): at Mark's word, the histories caught up with the deploy.
- c128 has a story and pickup (
app/data/cycle-stories-survey/c128.json). c78's story now reads closed into c128, with its pickup removed. - Archived cycles no longer show the c124 audit's "ready to close" note, on the story page or in the explorer (
StoryView.vue,cycle-stories-mock.ts). The audit is dated, so anything closed after it was still being told to close. - c128 stays out of HISTORY.md because it's still active. c78's entry is there. Both are uncommitted.
- c78 closed into c128: its Outcome is written, it has a HISTORY entry, and it's off CYCLES.md. It has no captures.
- Uncommitted.
- c128 has a story and pickup (
- kick-off (2026-11-03):
- Cycle created from Mark's prompt.
- Two read passes:
- every qdash page's data and time handling
- the layer and design pieces for time, history and export, prior report cycles, and the problems and personas in market-analyst
data-inventory.mdmaps each candidate section to its source, time basis and gaps.plan.mdsets out rules R1–R6, decisions D1–D10, four clarifying questions and Phases 0–7.- Waiting on Mark's rulings before Phase 1.
- Uncommitted.
- answers (2026-11-03): Mark answered the four clarifying questions. Details are in
plan.mdunder Clarifying questions.- "Non-operator" is not a role. It means C-level and other people who see data but get no controls. Reports therefore hold no controls and must make sense on their own.
- Findings/SLA is a section of Posture.
- The Board report folds into the
/reportscatalog's top band: one sentence for the window, one highlight per report, and the trend in words. Its composite score is dropped. - History of 3–12 months comes when the backend is connected. The mock is designed for 12 months.
- rulings (2026-11-03): Mark ruled D1–D10. Details are in
plan.mdunder Decisions.- Defaults kept:
- the mock goes in the phase-4 lab
- rolling, calendar and custom windows, defaulting to the last 30 days
- compare with the previous period
- scope is the org, with an optional Team
- print/PDF, CSV and JSON this cycle
- c78 closes into c128
- the org's timezone
- D5 overturned: the window is shared with the global
when:pill, not separate. The picker becomes the pill's panel in the layerFilterand in qdashuseGlobalFilter, and every operator page has to take any window. The backend needsfrom/tofor every page. - Shared default: 30 days everywhere (Mark). qdash
DEFAULT_PERIODmoves from7dto30dat the port.
- Defaults kept:
- downloads move to Reports (2026-11-03): Mark ruled that downloads and reports are handled in Reports now.
- The "Forensic why-trail & evidence export — preview" panel is gone from the lab's Compliance page (
phase4/mock/compliance.vue), along with the subtitle's evidence-export sentence.GovernanceLiveComplianceEvidenceExportstays in the tree, unused, as the source for Phase 4. - At Mark's word, the panel is also out of qdash
/compliance(crates/qdash/ui/app/pages/compliance.vueonfeat/new-pages), along with the same subtitle sentence and the unuseddownloadbinding.- Checks:
npm run checkis clean, and vitest passes 593/593.:3030/compliancerenders with no console errors and no export panel. components/compliance/EvidenceExport.vueanduseCompliance().downloadstay in the tree, unused, as the source for the Reports port.- Until Reports ships, findings JSON/CSV can still be downloaded from the findings export card on
/integrations. - qdash is uncommitted.
- Checks:
- The old phase-0 mock
/pages/compliance.vueis left as an archive. - c123's X4 (merging the two evidence exports) now lands in Reports.
- The "Forensic why-trail & evidence export — preview" panel is gone from the lab's Compliance page (
- Phase 1, window picker (2026-11-03): the picker is built design-local, and its demo is at
/pages/phase4/time-window(a new Reports section on the Phase 4 index).- Model:
app/utils/time-window.tsis pure, with no Vue. Spec → resolved civil dates in the org timezone, plus compare, coverage, labels and URL encoding.- The defaults (30d, previous period) are left out of the URL, so the old
?period=7dstill reads. scripts/c128-time-window-check.mtsholds 9 checks: rolling, calendar, to-date compare, the month-end clip, coverage, the year compare, custom ranges, the year boundary, the URL round trip and the org-timezone anchor. All pass.
- The defaults (30d, previous period) are left out of the URL, so the old
- Parts:
app/components/time-window/holds Calendar, Panel, Popover, Pill (thewhen:pill, with FilterItem's chrome) and Line (the report header line).app/composables/useTimeWindow.tskeeps the window in the URL or locally. - Demo:
- One URL-synced window drives both the pill and a report line.
- The panel is laid flat across seven worlds: 90 days, 12 months kept, 16 months kept, fresh install, before the data, across the new year, month to date.
- A table shows every preset resolved.
- Calls made:
- Last 24 hours and All time stay in the presets, because the window is shared and operators had them.
- Presets apply in one click; a custom range and a compare change wait for Apply.
- A to-date period compares with the same days of the period before (Nov 1–2 vs Oct 1–2).
- A year compare the data can't support falls back to the previous period.
- The compare button reads "A year earlier".
- Finding for Tyler: with exactly 12 months of retention, same-period-last-year is never available. The year before any window starts before the data. Comparing Q3 with the Q3 before needs about 16 months. This pulls against Mark's 3–12 months.
- Checked in the browser:
- presets, the custom pick, Apply, URL sync, and every scenario's text
- dark and light themes
- phone width: the panel fits at 343px, and the calendar shows the month the window ends in
- no console errors
The design site's own nav still overflows at 375px. That was already true before this cycle, and it widens the emulated layout. - Gotcha: functions imported from
~/utils/time-windowand used only in a template were dropped from the compiled<script setup>("$setup.isBakeable is not a function"). They are now read through local bindings (fmtDay,bakeable). - Uncommitted. Mark's review is next, then Phase 2 (chassis and catalog).
- Model:
- Phase 2, chassis and catalog (2026-11-03, started on Mark's word): Reports now has pages in the lab shell: the catalog at
/pages/phase4/mock/reportsand the three reports at/reports/posture,/reports/inventoryand/reports/deployment.- The report world (
app/data/reports-c128.ts) holds twelve months of daily history (Oct 30, 2025 to Oct 29, 2026) that ends on the lab's present, so a report agrees with the page behind it (R3).- The last 30 days of spend are the cost tour's ledger to the dollar: $5,865, Home's window.
- The fleet ends at Home's 100 hosts: 97 fully monitored, 3 partial, 0 unmonitored.
- The harnesses and models come from the ledger; the MCP servers are the lab's listing.
- Before that the history is generated and seeded, so it's the same on every load: a rollout from 8 to 100 hosts, posture 53 → 78 with a March dip and the Oct 21 eval-run dip, 571 findings with fix times by severity (SLA targets are c78's placeholders: 7, 30, 90 and 180 days), and
first_seendates for inventory. - Readers implement R2: flows sum in the window, states read at its end, trends span its days. Days before history begins come back null (R6).
- Specs and readers (
app/data/reports-c128-specs.ts):- Each report's sections carry a question, a time basis, a qdash source and a status: live, staged or missing.
- The readers produce the lede sentence, the lead metric with its change, the spark, the trend in words, the worst line and the facts.
- The catalog card, the Board band and the report verdict all read the same reader.
- Chassis parts (
app/components/reports/):- BasisTag: "in window", "over the window" or "as of Oct 29". It reads "current state" in amber when the window ends before the data does, since there are no snapshots yet.
- Section: title, question, tag, staged or "not in qdash yet", and the source line.
- Verdict: sentence, then number and change, spark, trend words and facts. Sparks are scaled to the window's own range.
- Footer: window, data through, timezone, generated, and the read-only note.
- Card: c78's mini-doc briefing, its provisional lean.
- SummaryBand: the Board fold-in. One derived sentence, three highlights, and the trend in words; no composite score.
- The catalog has the shared
when:pill, the Board band, then Security (Posture) and IT (Inventory, Deployment status). Links carry the window. - A report page has the breadcrumb title, Print/PDF and CSV·JSON stubs (Phase 4), the window line, the verdict, every section with a few real figures where the reader has them ("Phase 3 draws this section"), and the footer. A window with no data shows the window line's reason and the report's outline, with no sections.
- Checked in the browser:
- the catalog, all three reports, Q3 on Posture (76 ▲ 4 vs Q2, "current state" tags), year to date on Deployment (85 → 100%, no year-earlier data so no change), and a window before the data
- the spend matches Home
- light and dark themes
- no console errors
- Lab-wide, not changed here: the lab shell's rail doesn't collapse at phone width, and it highlights only exact paths, so Reports isn't lit on a report page.
- Uncommitted. Next is Phase 3: Posture first, one report at a time, preview → build → Mark's review.
- The report world (
- Phase 3 · Posture (2026-11-03, on Mark's word): all eight Posture sections are drawn, in
app/components/reports/posture/Body.vue. It is mounted from/reports/posture, while the other two reports keep the Phase 2 outline.- Posture score:
ReportsLineChartdraws one point a day with the comparison window as a dashed ghost aligned day for day (the c103 F6 idea). Days before the data are hatched. Start, end, low and high are shown with their dates. - What lowers the score: points lost by factor. They sum to 100 − 78, the state today.
- Critical and at-risk harnesses: installs under 80 with person, endpoint and top factor.
- Findings and SLA:
- the auditor's table by severity: target, opened (with its change), resolved, open at end, past target
- opened and resolved per day
- a past-target list on the window's last day, worst severity first, then oldest
- Data protection: sensitive opens and secrets in content against the comparison, split by kind.
- Egress: allowed, observed only and blocked. Blocks begin in July, when enforcement began, and a sentence explains the split. Risky destinations are listed.
- Policies in force: counts by mode and the mode changes in the window, read from the lab's governance world, so they match /policies.
- Framework evidence: counts by state for the tracked frameworks, with no % (c123). Read from the lab world, linking to Compliance.
- World extension (
reports-c128.ts, on its own seed so the Phase 2 numbers didn't move):POSTURE_FACTORS,AT_RISK,GUARD_DAYS(DLP and egress per day), splits, finding titles and harnesses,pastTargetAt,findingsPerDay. - Checked in the browser: last 30 days, Q3, all time, 24h with no comparison, and a custom range that starts before the data (hatched, comparison shown as —). No console errors.
- Uncommitted. Mark's review of Posture is next, then Deployment status, then Inventory.
- Posture score:
- deploy (2026-11-03): deployed live at Mark's word ("it's all our lab").
- What shipped:
npm run deploy→ deployd39dd67b12, built from designc400dd2afewith 23 uncommitted paths included: all of c128 plus other sessions' lab edits. Layer 0.9.37. 6,258 routes prerendered in 1,023 s. - The first attempt collided with another session's deploy over
.nuxt-deployand aborted at cleanup. That other deploy never published. - Checked live on design-f39.pages.dev:
/pages/phase4/mock/reports/and the posture, deployment and inventory reports, plus/pages/phase4/time-window/, all return 200. Posture on?period=last-quarterrenders (76 ▲ 4). - The slow build came from the prerender crawler following about 19k query-string lab URLs. c129 fixed that (build 17.5 → about 4 min) and deployed again as
bd48264c3e, built from0a2cb25691plus the same uncommitted paths, so c128 stays live.
- What shipped:
c126 Policies Final Pass
- intents PR 5 (2026-11-05): c123's thread
intents-pr5found three things on these pages: the frameworks strip has to go (already C5), the "Active frameworks" column andPolicyFrameworksneed PR 5's terms, andframework-trackleaves the Policy Config draft. Details in c123's plan, Phases 2 and 5. All three were built on these pages the same day; the title, Custom controls and the Evidence packet are still c126's.
c123 Compliance Frameworks
- intents-pr5, evaluation and plan (2026-11-05): thread
intents-pr5(prompt, evaluation, plan). Peterson's framework intents landed asqpoint-io/intentsPR 5, merged by Mark the same day, and the review this cycle's scope promised is done. Nothing is built, and nothing in this thread is committed.- PR 5 excludes what
posture-scorebuilt: a subject-weighted, exception-adjusted %, and compliance scoring. It defines one measure, Policy enforcement posture: Off / Observe / Enforce per policy-to-control mapping, by published default mode, with exceptions as annotations. On that rule OWASP LLM reads 5 / 21 / 2 of 28 mappings (18 / 75 / 7) where the bar says 50%. - It also reverses F8, c118 A6 and Q10: tracking changes no policy and saves outside the draft.
- Of the redline's six asks, the split, version pinning and most of per-mapping provenance landed. Evidence as a mapping target, the four coverage states and tracking moving Off to Observe were declined.
- Rulings the same day (Mark), all in the plan. Merging an intent doesn't rule over design work, so where these differ from PR 5 or PR 6, they hold in the lab and the differences are his to raise.
- Posture measures what Qpoint can know and govern. Enforcement Posture is progress toward each policy's best possible mode, so 100% can mean everything possible is at Observe. Exceptions get their own metric, led by direction. Established OWASP LLM reads 40%, 10 of 25 mappings at ideal, 10 policies to change.
- Tracking changes nothing, and a separate button stages Off policies at Observe. F8 retires as written.
- On the page: Controls on every framework; columns Control · Policies · Enforcement Posture · Compliance Score; green at 100%, orange for work left, red only when a policy is Off.
- Compliance Score stays as built, seeded and marked projected, and out of Reports.
- All five frameworks stay listed. Untracked ones show name and description only.
- Reports: PR 6's four, as living pages rather than generated PDFs (c128).
- Committed:
0d01a2ea9c(posture-scoreas built) andb228984aea(Findings fixed layout), both local. This thread's documents aren't committed, and Phase 1 is next.
- PR 5 excludes what
- intents-pr5, Phase 1: the shared calculation (2026-11-05): thread
intents-pr5. The model is ingovernance-fixture.ts; the pages don't read it until Phases 3 and 4, and the Nov 4 functions stay until they do.- New:
enforcementPosture,rowEnforcement,exceptionsRead,postureHistory,policyModeAt,controlGroups. A limited row is markedlimited(OWASP LLM04, LLM08, ASI06, ASI09). Frameworks gain a source link, native groups, mapping revisions and a tracking log, whichapplyChangenow writes. - Established world: OWASP LLM 40% (10 of 25, 10 policies to change; 7 exceptions: 3 tighten, 2 loosen, 2 neutral, 1 expiring); OWASP Agentic 40%; NIST AI RMF 47%; ISO 27001 50%; SOC 2 41%. With a pilot running, OWASP LLM reads 32% with 5 exceptions, all tightening.
- Seeded, and marked so: policy modes before October (
POSTURE_SOURCE: on through the spring, enforcing from July, agreeing with c128's report world), and mapping revisions, including one that moves OWASP LLM from 22 to 25 mappings on Jun 1. History before Jan 12, or before a framework's first mapping, is unavailable. - SOC 2 now has 11 criteria, 10 of them mapped. A lab proposal from
research/frameworks-dossier.md§3e, not a reviewed mapping: PR 5 leaves SOC 2's fixed scope open. This is the one visible change: SOC 2 shows data on Compliance, framework detail and policy detail, still under the Nov 4 formula until Phase 3. - Calls made: a framework's bar goes red only when all of it is Off, because nearly every framework holds something Off; a row goes red when any of its policies is.
labelsAbridgedon the framework replaces the plan'sofficialTitle, rather than writing official text from memory. - Checked:
scripts/c123-metrics-check.mts(62 checks),scripts/tours-walk.mjs(455 passed), and in the browser. "A draft change moves nothing" can only be checked in the browser, so it moves to Phase 2. - Found: the layer's
DataDonutChartrounds an arc differently on server and client in the last digit, which logs a hydration warning on SOC 2's framework detail. Harmless, and not from this work.
- New:
- intents-pr5, Phase 2: tracking leaves the draft (2026-11-05): thread
intents-pr5.- Track and Untrack apply at once, by whoever is acting, through
trackFramework, and add no Policy Config line:framework-trackis now inOPERATIONAL, and its draft handling is gone. No policy moves. - One verb: Untrack replaces Stop tracking on Compliance and framework detail. It asks first, on both, and says what it hides: "It leaves dashboards and new reports. No policy changes, and its history is kept."
- Who tracked it: framework detail reads "Tracked by Dana (security admin), Apr 6, 2026", with History behind it listing actor, date and previous and new state.
- The staging step (D3): on a tracked framework with something Off, framework detail offers "Add 4 to the draft at Observe". It lists each policy with Off → Observe first, then adds ordinary mode-set lines. They go straight into the shared draft through
addToDraft, leaving the person's own unsaved edits alone. It reads published state, so the draft can't change what it says is Off. It's hidden when nothing is Off or the framework is untracked. Untrack never undoes it. The record page has no draft, so it doesn't offer this. - Checked: a new
scripts/c123-track-walk.mjs(35 checks) walks all of it in a browser, through publishing, where the page finally moves.scripts/c123-metrics-check.mts(62) andscripts/tours-walk.mjs(455) still pass. Desktop width, light mode only. - Known and left: the OWASP tour's close still says Track stages policies (Phase 7, through c125). D4's "10 policies to change" link waits on Phase 5, when Policies learns to filter by framework. The band and rows still show the Nov 4 metrics until Phases 3 and 4, and they follow
?preview=draftuntil then.
- Track and Untrack apply at once, by whoever is acting, through
- intents-pr5, Phases 3–8: the pages (2026-11-05): thread
intents-pr5. Mark moved his review to the end, so these ran without stops. The open calls are inintents-pr5-review.md.- Compliance listing: Enforcement Posture, Exceptions and Compliance Score on tracked frameworks; name, publisher, edition and description on untracked ones. "Instrumented", the dead Add button and the auto-tagged claim are gone. Tracked / Untracked.
- Framework detail is recomposed in PR 5's parts: the framework with a source link and mapping revision; both metrics and open findings; the staging step; the exceptions themselves; controls in native groups with rationale on every row, and limited rows marked; posture over time with mapping marks and reconstructed ranges; what isn't mapped; supporting evidence. Columns read Control · Policies · Enforcement Posture · Compliance Score. The Nov 4 weighted posture is gone from the fixture.
- Policies: the frameworks strip leaves (X1, X2), a framework no longer "requires" a policy, and the band's "policies to change" opens the listing narrowed to them. The policy's Frameworks section reads Control and Untracked, with why each is mapped.
- Reports (with c128): four living pages from PR 6. See c128.
- Tours and guide: the OWASP close no longer says Track stages policies, and points at the Compliance report instead of the evidence export. The guide's Framework term no longer says "covered" and "gaps", and it gains Enforcement Posture.
- Redline closed: see
intents-redline.md. - Checked: 108 browser checks, 45 calculation, 455 tours, 9 time window. Dark at 1400px and light at 800px looked at. Captures
c123-after-*,c128-after-*. - PR 6 merged the same day (
6df1426), with the content this work read.
- intents-pr5, Mark's notes (2026-11-05): thread
intents-pr5, ahead of the decisions review.- A 100% example:
example-complete, "Example: everything at ideal", tracked, made of the eight policy-to-control mappings the established world has at ideal. Clearly labelled as a lab example, and it shows in the reports because it's tracked. It reads 100% with 3 exceptions, 2 of them loosening, and with a pilot running it drops to 75%, because nothing enforces by default there. - Exceptions as a donut in the band, in the same colours as the chart, with expiring in the footer.
- Over time became one part,
part/PostureOverTime.vue, and moved to the top of framework detail for one pass. - The Compliance report carries it too: "The whole record" sits under each framework's window line, whatever the window, with mapping changes and reconstructed ranges.
- Checked: 123 browser checks, 48 calculation.
- A 100% example:
- intents-pr5, first review decisions (2026-11-05, Mark): thread
intents-pr5.- The score joins Over time: a % line above the modes, on framework detail and in the Compliance report. Percentage charts now always read 0 to 100, so 40% sits at 40%. Mark tried it at 48px, found that too short, and went back to 110px.
- Over time moves to the bottom of framework detail (Mark). It was at the top for one pass.
- Not mapped by Qpoint and Supporting evidence are gone from framework detail (Mark). Controls with no policy are now only counted, in "How these are worked out".
- Reports read the lab's own findings: 7 open of 22, the same as the pages, with their real teams, outcomes, reopens and reasons. c128's seeded 571 are gone, and with them the 188 against 22.
- Data protection and Egress go into the Findings report, beyond PR 6. They're still seeded, scaled by team share. Spend, shadow installs, versions and the fleet posture score stay out.
- Compliance Score is option A: severity box over seeded checks. Options B–F, the switch and their fields are gone.
- The 100% example is untracked: out of the reports, and one Track away on Compliance.
- Checked: 130 browser checks, 47 calculation, 455 tours.
- intents-pr5, second review decisions (2026-11-05, Mark): thread
intents-pr5.- Kept as built: a framework's bar goes red only when all of it is Off; the numbers read published state, not the draft; the Enforce-pilot thresholds stay flagged placeholders.
- Policy pills read Off, not Inactive:
PolicyTag's label, in the layer. Committed in q-nuxt-layer, not yet released, so the deployed site needs a release to show it. - The band's findings box matches Compliance Score: the last 30 days plus anything still open. OWASP LLM reads 7 High and 1 Med, with 6 still open, as the listing does.
- intents-pr5, loosening reads orange (2026-11-05, Mark): everywhere: the Exceptions donut and chart, Policy Config's lines, Change impact, the Policy Config tray, Teams, team Policies and the reason prompts. This changes c121 D8's red. Red stays for what's actually blocked or failed: a refused edit, Publish is blocked, a failed import.
- intents-pr5, light green for can-only-observe (2026-11-05, Mark): in the band's bar and Over time's mode chart, a mapping on a policy that can only observe shows light green, because there's nothing left to tighten. Green shades are done, and orange and grey are work left, so 100% is all greens. Applied per mapping at every score, not only at 100%.
observeOnlyandmodeLinein the fixture, so the band and the Compliance and Executive reports word the counts the same way. The listing's and rows' bars stay one colour, for the %.
- intents-pr5, a quick framework row on Policies (2026-11-05, Mark):
part/PoliciesFrameworks.vueshows tracked frameworks with their % and offers Add framework, which tracks at once and changes no policy. Untrack stays on Compliance and framework detail. "Activate All", "Enable Required Policies" and the old % complete stay gone. This relaxes X1's one place to track.
- posture-score, two compliance metrics (2026-11-04): thread
posture-score(prompt, plan). Coverage and the completeness % give way to two metrics, which Mark asked for as an amendment to F1's "no percentage". Not yet taken to Peterson; hold any org-wide number and any qdash port until then. Uncommitted, not deployed.- Compliance Posture is how well we are set up, now: each person a mapped policy reaches counts by the mode they actually get (Enforce 1, Observe 0.25, Off 0), and a live advanced exception takes 10 points off. A policy that can only observe counts fully when observing. A row averages its policies, a framework averages its addressable rows. Green at exactly 100%, red under 25%, orange between.
policyPosture(),requirementPosture(),frameworkPosture()ingovernance-fixture.ts. - Compliance Score is findings against what was checked, over 30 days, counting distinct findings and any older one still open. Check and session counts are seeded and marked projected; Qpoint doesn't count them yet. Six display options sit behind
?v.score=(?parts=1shows the swap): A box + base (default), B two numbers, C sessions, D percent, E rate, F 0–100.scoreOf(),part/ComplianceScoreCell.vue. - Framework detail (
part/FrameworkDetail.vue, shared with the record page): the Coverage machine and column went, as did the heading, filter and count above the table. Columns read Name · Enforcement Posture · Compliance Posture · Compliance Score, with Findings folded into Score and the two metrics sortable. Mapped policies became Enforcement Posture in the band and the table. Items Qpoint can't address leave the table and stay under Gaps (Mark, 2026-11-04), so SOC 2 shows an empty table and its three gaps. The pill now shows the policy's own mode, becausestanding()read "enforced" for a policy that is Off with one enforcing exception. - Compliance listing: Compliance Posture and Compliance Score replace Total Violations and the completeness %, which closes X5. Findings count once per framework. The two sorters now really sort. The plan left Score blank on untracked frameworks; it shows there, as Violations did.
- Checked:
scripts/c123-metrics-check.mts(24 checks),scripts/tours-walk.mjs(455 passed), and in the browser at 900–1500px in light, with dark seen on framework detail only at a glance. No captures yet. - Still open: pick a Score option; the band's Open findings (open only) and the row Score (window plus open) count differently, so OWASP LLM reads 5 High against 7 High on the listing; "Mostly out of scope" rows that still map to a policy stay in the table; a real count of checks needs the backend; the rest of the plan's "where else" list.
- Compliance Posture is how well we are set up, now: each person a mapped policy reaches counts by the mode they actually get (Enforce 1, Observe 0.25, Off 0), and a live advanced exception takes 10 points off. A policy that can only observe counts fully when observing. A row averages its policies, a framework averages its addressable rows. Green at exactly 100%, red under 25%, orange between.
- phase4-simple, framework detail composed (2026-11-03): thread
phase4-simple(prompts). Started as a short list of page notes from Mark and became the first composed framework detail (X6), plus one verb on two of the three framework surfaces (X1, X2). Commitsd9dac5fd95andc400dd2afe, on layer 0.9.37.- Framework detail is composed. Its body moved out of the record page into
part/FrameworkDetail.vue, which the record page and a new mock share:/pages/phase4/mock/compliance/detail, opened from Compliance's "Details + Configuration" and registered as S5'smock. The mock runs on the shared world, so its numbers can differ from the record page's (6 open findings against 4 on OWASP LLM). Track there stages aframework-trackchange in the Policy Config draft. - The table runs full width: Item · Coverage · "Policies governing this item" · Findings. The header follows the source's term ("…this control", "…this criterion"). Policies are
PolicyTags with a status, which reads inactive when the policy is not in scope, observed at observe, and enforced at configured or confirmed. Findings are open counts by severity, in the Findings ledger's box. The capability and Gap columns are gone, and the Gaps section keeps the reasons. The filter is the standardFilterTriggerBar, and the search box is gone. - "Risk" leaves the page, except the kind. OWASP's entries read Items (
sourceTerm: 'item'), which sets aside D8's source's-own-term for OWASP only; ISO, SOC 2 and NIST keep theirs. The OWASP descriptions say "security issues". The kind label still reads "risk taxonomy", awaiting a word (proposed: "Top 10 list"), and "NIST AI Risk Management Framework" is a name. - The summary band went from label-over-number cells to
DataMachines, picked from three revisions at/pages/phase4/framework-summary(kept for comparison): Coverage as a segment bar (A; black, grey, white), Mapped policies as a donut (B; green, orange, grey), Open findings as the severity box (C). Tracked left the band. With nothing mapped, Open findings shows a grey 0, not a green one. The table's coverage dots and the "What coverage means" text match the bar. The guidance disclaimer moved from under the title to a footnote under Gaps. - Track is a state, not a toggle. Mark didn't understand the black Tracked button: it read as a status, stopped tracking without asking, and changed nothing on the page. Now it's a quiet "Tracked" with a separate Stop tracking link that asks first. Compliance reads "Tracked frameworks" and Track / Stop tracking. F8 (tracking stages policies at Observe) is still not built, so Track still changes no policy.
- Tables shrink with the page. Compliance (min 560px) and Control Policies (min 600px) moved to fixed layout: columns keep their shares and shrink together, text ends in an ellipsis with the full text on hover, and numbers and actions stay whole. Compliance's compliance figures clip rather than ellipsize. This took three tries on Compliance. The first truncated only the name column, the second squeezed it to 29px or folded Kind to its icon, and Mark then asked for every column to give way. Framework detail stays in auto layout; its policy pills truncate through
max-w-0. - Smaller: Compliance's section headers use qdash's
h2 text-24; the mock rail stays lit on sub pages and on surfaces that name it asnav;mock/compliance.vuebecamemock/compliance/index.vueat the same URL. - Layer 0.9.37 (
0d1ea8c):PolicyTaggainsstatus, andUxTableListSorter's label is a truncating span, unchanged in auto-layout tables. Only design's lockfile moved; bob-wire, www and qdash are still on 0.9.36. - Deploy: my own
npm run deploybuilt, then stopped at "Build produced no index.html" and pushed nothing. A second deploy had started at 12:32 in the same checkout, and c129 records the collision. That run shippedc400dd2afeasd39dd67b12ondeploy, with 23 uncommitted paths from other sessions.bd48264c3e(c129, from0a2cb25691) has since replaced it and carries this work too. - Checked by hand in the browser at 768–1600px, in light mode, and by curling the deployed pages. No capture program was run, and there are no after captures yet.
- Still open:
- Policies' frameworks strip still says "Activate Frameworks" and "Activate All", so X1/X2 aren't finished.
- Compliance still shows completeness as a percentage (X5).
PolicyTagnames can't be read in dark mode: the name's ink flips while the pill stays light. This predates the thread and now shows on framework detail in the site's dark theme.- Evidence export is c128's: it removed the export from the Compliance mock, in its own uncommitted work.
- Framework detail is composed. Its body moved out of the record page into
c101 Qmap Surface
- qmap takes it up (recorded 2026-11-04): qmap's c29 (look and feel) staged the sessions the day the handoff landed. Its own record has the detail; these are the parts that change this cycle's plans:
- The working scene: scenario 1, the stranger on the phone, is c29's default scene. It's the only scenario with flows so far. c29 holds a copy of
finding-sessions.json(identical on 2026-11-04), and design still owns it. - Fewer pawns in the default view: Mark's Zones hierarchy makes endpoint, account and repo rugs, not actors. The top-level rugs are AI Services, Internet and the Endpoint. A personal account's ⚑ now sits in its rug label. pawns-needed.md carries a note saying so.
- Tools are in question: Mark: tools "as 3d objects with as much space as a harness feels wrong." c29 is comparing four treatments (labels on lines, tool belt, expanding stack, Tools box). MCP tools now sit on their server's rug. Nothing is picked yet.
- The harness stand-in: the grey, red-hatted helper split from the voxel
Helperspair, not design'sAgentPawnart. Every other actor is a grey placeholder sphere while rugs are tuned. - Still open here: the designer's first round isn't on record, and "qmap Phase 0" (commit qmap's old uncommitted work) is now tangled with c29's own uncommitted work.
- The working scene: scenario 1, the stranger on the phone, is c29's default scene. It's the only scenario with flows so far. c29 holds a copy of
- qmap handoff (2026-11-03): Mark: "we're starting to work in the qmap project, save and update history, and make our example sessions available and clear so that project can know which pixel pawns are needed."
- pawns-needed.md: what qmap must draw to stage the six sessions, derived from the data (79 actor instances, 11 kinds, 13 findings). That comes to 11 pawns plus the guard's marks. Each pawn gets its count, its sessions, the states the six need, the art today (from
pawn-inventory.md) and a priority. First priority: helper (watched / no brakes / unknown), plug-in (configured / stranger / joins after an exception), file (ordinary / sensitive by severity), outside place (approved / weak TLS / blocked at a wall / crossed), and the guard's marks (severity, Observed vs Enforced, afterlife states). Skill and Team aren't needed. The non-pawn treatments the scenes lean on are listed separately. finding-sessions.json: the six sessions as data. Each actor carries its beats and the findings on it. Generated fromapp/data/finding-sessions-c101.tsbynpx tsx scripts/finding-sessions-export.mts.- qmap side:
qmap/cycles/c29.look-and-feel/design-c101-finding-sessions.md, a self-contained note for qmap's newly opened c29 (look and feel, hierarchy, labeling). It has the six stories in one line each, the pawn short list, and paths to the JSON, the pawn list, the page and the brief. Only the new file was added: c29's CYCLE.md and qmap's other uncommitted work (c101's still-open "qmap Phase 0") were left alone, because c29's session and dev server are live. - The sessions page's footer links the pawn list and the JSON.
- pawns-needed.md: what qmap must draw to stage the six sessions, derived from the data (79 actor instances, 11 kinds, 13 findings). That comes to 11 pawns plus the guard's marks. Each pawn gets its count, its sessions, the states the six need, the art today (from
- saved (2026-11-03): the sessions, page, JSON, pawn list and records went in as design
586ac2a13b(on branchc123/owasp-agentic-tour), and the handoff note as qmap29b3de2. Neither is pushed, and the page isn't deployed, so/cycles/design/c101/sessionsis local only for now. While updatingcycles/CYCLES.md, a script of ours emptied it for about half a minute. It was rebuilt from HEAD plus c128's uncommitted diff.
- finding sessions (2026-11-02): Mark asked for a narrower focus: violation findings, and the sessions that generated them, as material for small map "dioramas". finding-sessions.md holds six written sessions in the Meridian world, using real policy names (c114's fixture world plus qdash's seeded controls):
- The Vanta MCP (c114 Session 1)
- The SSN in the fixture (LLM02)
- Approvals off
- The paste that didn't leave
- The poisoned Sentry event
- The install we couldn't see
Each scenario has beats, a cast and a Data line. Each diorama is two or three stills (before, the finding, the afterlife), not a timeline. This turns around the brief's "sessions are counted, not drawn": here the session is the stage. The doc ends with what the dioramas need that the brief lacks: a session rug, risk on lines (payload, gate, wall), an Observed/Enforced pair, step order, unknown as fog, and afterlife states. Prompt and plan are infinding-sessions-prompt.mdandfinding-sessions-plan.md. Committed in586ac2a13b.
- sessions page (2026-11-02): Mark: "let's start by creating a page in the design app that lists out all the actors and what happened. we're starting with pencil and paper." So the map waits. Finding Sessions at
/cycles/design/c101/sessions(app/pages/cycles/design/c101/sessions.vue, data inapp/data/finding-sessions-c101.ts) has:- The cast across all six: a matrix of actor kinds × sessions, with ⚑ where a finding's mark sits, plus actor and finding totals (79 actors, 13 findings).
- Per session: the logline and facts, a finding badge for each policy (severity, and Observed vs Enforced), the actor list (kind, name, state in this session, and the beat times it appears in), what happened beat by beat (finding beats tinted, with the actors each beat touches as chips), and Afterwards.
- Interaction: clicking an actor dims the beats it isn't in.
Every beat names its actors, so each actor's story comes from the beats, and the data file is the start of a fixture. Checked on the live:3000server: no console errors, and the actor filter works. Committed in586ac2a13b.
- plain words (2026-11-02): Mark: "the scenarios are a bit hard to understand, I'm looking to create a simple cast of characters and a ELI5 explanation about what happened / went wrong / etc." Then, mid-build: "I don't mind what we had, I just wanted to supplement with simple, quickly read overview." So the page now opens with an Overview, and everything below it is unchanged.
- The cast of characters: twelve plain names. The person, the helper, the laptop, the brain, the brain's company, the badge, the plug-in, the tools, the project, the files, the outside places, and the guard (Qpoint itself).
- Six story cards: each has a plain title (the stranger on the phone, the secret in the test file, no brakes, the door that stayed shut, the trick note, the invisible helper). Each card lists the four to six characters its story needs, then four short parts: what happened, what went wrong, what the guard did, what happened next. It links down to the full session.
- Below the overview: the kinds × sessions table and the six detailed sessions, as before.
- Data:
charactersand a per-sessioneli5added toapp/data/finding-sessions-c101.ts. - Markdown:
finding-sessions.mdgained an "In plain words" section. - Checked: in the browser, with no console errors. Committed in
586ac2a13b.
- Side note, /cycles (2026-11-02): Micro is now the
/cyclesdefault layout (see c111).
c129 Deploy Build Time
- 2026-11-03 — skip query links in the deploy crawl (commit
a7323795dfonclaude/jovial-dubinsky-36e37e, unpushed). UnderDESIGN_DEPLOY_OUT,nitro.prerender.ignoreskips any link with a?and queues its bare path instead (captured from theprerender:routeshook), so a page linked only with a query still prerenders. Dev is untouched.- Measured on
c123/owasp-agentic-tourplus the main checkout's 23 uncommitted lab paths (nuxt generate, deploy.sh step 1):Before After Total build 1,051 s 262 s Prerender phase 967 s 191 s index.html3,126 3,125 - Gained
pages/phase4/mock/inventory/agents/detailandinventory/tools/detail: they were linked only with a query, so the live site was missing them. Dropped/cycles/design/c0and/cycles/design/c97-harness-chip(+record): 404 pages reached only from?cycle=links on the c124 mock. Posture report and time-window pages are byte-identical. - The 1,660-page figure in the original log came from a build that was cut short; a full build writes about 3,125 pages.
- Measured on
- 2026-11-03 —
DataTimelinedemo fixed (same commit). The demo passedtimeframe: 'week', but Timeline matchesTimevalues ('7days'), so its computed was undefined and SSR threwreading 'labels'. The demo now passesObject.values(Time).
- 2026-11-03 — where the rest of the time goes (from the baseline log, summed render time across 12 cores, so per-page numbers are inflated by queueing):
Bucket Routes Summed render time Query permutations (now skipped) 19,034 ~21,000 s Path-only pages 3,516 ~10,100 s └ /cycles/design/*1,099 ~7,800 s (doc pages avg 11 s, cycle pages avg 3.7 s) └ /components/_demos/*386 ~80 s /pages/data-swarm-ideas,-2-,-3-3 ~284 s each
Top query offenders before the fix:findings(2,160),compliance/detail(1,787),policy-config/config-file(1,515).
- 2026-11-03 — first real deploy with the fix (
bd48264c3eondeploy, fromc123/owasp-agentic-tour0a2cb25691+ 23 uncommitted).nuxt generatetook about 4 min (client 29 s, server 34 s, prerender 176 s, 6,256 routes, 3,126index.html), butdeploy.shran 931 s end to end. The other ~11 min came after the build: committing 17,863 files (820 MB) as a fresh tree and force-pushing it. The build is no longer the slow part of a deploy; the commit and push are.
c111 Cycles by Week
- 2026-11-02, Micro becomes the default: at Mark's request,
/cyclesopens in Micro.?layout=cardsand?layout=listselect the others, and old?layout=microlinks still work (app/pages/cycles/index.vue).
Captures
9 screengrabs taken this week, 4 of a subject with an evolution history.
Compliance & Frameworks after intents PR 5: Enforcement Posture, Exceptions and Compliance Score on tracked frameworks; name and description on untracked




Reports catalog: four living reports




