Week of Aug 17 · Cycles

Cycles by week

Week of Aug 17

4 started, 1 closed, 42 carried live.

Busiest record: c78 fleet-overview-reports (7 entries) · 14 carried cycles have gone quiet

Started

Still open

Closed

Record entries

Commits

Captures

Releases · deploys

Anatomy v1 — the clean-run fixture at all four altitudes: receipt, chapters with beat spines, semantic transcript, raw events — c77Session View2 captures · 5 log entries — the week's busiest recordSee all 2 shots ↓
First c77 mock: the four-altitude ladder rendered over mechanically derived beats, with a four-scenario fixture picker

Commits

43 commits across 4 repos, on each repo's checked-out branch.

Cycles

Started 4

c78fleet-overview-reports

Design the four product reports (Compliance, SLA Insights, Inventory, Board) and the fleet overview landing page as a summary of them.

started Aug 207 in the log

c77Session View

Session viewer / replay mode for qcontrol AI agent sessions — mocks-first on the design site

started Aug 205 in the log

c9project-docsMarket Analyst

Clean up project documentation for sharing with team members

started Aug 202 in the log

c8Agent PivotMarket Analyst

Reorient pipeline and app around AI-agent-security pivot: archive phase 1, use-case-centric extraction, multi-source feedback, architecture debt paydown.

started Aug 205 in the log

Still open 42

c68index-overview

Design the qdash landing page — what the user is greeted with on login, resolving the Fleet Overview / Agent Inventory overlap.

started Aug 142 wks · moved this week

c72Integrations Create & Manage

Create/configure modal for 11 connectors with per-integration custom UI and step-by-step operator guidance

started Aug 152 wks · quiet 1

c20Build Partner PortalBob-Wire

started ≈ Aug 152 wks · quiet 1

c17OWASP LLM Top 10 — Policy PackBob-Wire

started ≈ Aug 152 wks · quiet 1

c5Selection ClipboardQpixel

started ≈ Aug 152 wks · quiet 1

c4SVG ExportQpixel

started ≈ Aug 152 wks · quiet 1

c67Teams

Refine the qdash /teams design — composition from c61 concepts, mapping workspace as the pre-SCIM write path, slim spend overview, credentials relocated

started Aug 142 wks · quiet 1

c66cost-center

Add unit-of-measurement toggle to qdash /cost page — switch display between currency ($) and tokens

started Aug 142 wks · quiet 1

c65control-center-v2

Shift the control center from infinitely-configurable controls to a compliance-driven system of pre-defined Policies — research the framework↔policy connection, then mock the policy catalog and per-policy config pages

started Aug 122 wks · quiet 1

c64control-center-consolidation

Consolidate the overlapping Control Center / Policy & Enforcement / Compliance work — current-state evaluation, ranked consolidation plan, initial-ideas mock

started Aug 102 wks · quiet 1

c19AI Asset InventoryBob-Wire

Precedent research for an AI asset inventory page — how existing products present inventories of agents, MCP servers, files, models, and related AI assets

started Jul 314 wks · quiet 1

c12qcontrol-live-viewQflow

Live qflow visualization of qcontrol agent events — agents pulsing to event-type nodes, fed by qdash SSE, with a growing timeline scrubber

started Jul 294 wks · quiet 1

c18Post-Mortem MapBob-Wire

Post-mortem incident map — visualizing an incident that already occurred: the actors involved (user, agent, MCP servers, files, repos) and their state, on an incident page alongside traditional detail sections

started Jul 245 wks · quiet 1

c15Agent DashboardBob-Wire

started ≈ Jun 911 wks · quiet 1

c16Agent Control PlaneBob-Wire

started ≈ Jun 412 wks · quiet 1

c14QControl Brochure SiteBob-Wire

started ≈ May 1115 wks · quiet 1

c13AI Agent PoliciesBob-Wire

started ≈ May 1115 wks · quiet 1

c27mcp-server-fleetQmap

Deterministic synthetic MCP server fleet views for screenshot capture

started May 416 wks · quiet 1

c26flatland-viewQmap

Add a flatland view (topdown camera + pitched 3D models) for VOX/OBJ-backed actors

started Apr 2817 wks · quiet 1

c12Inventory Deep DiveBob-Wire

started Apr 2418 wks · quiet 1

c10Security Overview BenchmarkBob-Wire

started Apr 2218 wks · quiet 1

c25ai-ecosystem-inventory-mapQmap

Build a qmap inventory/index view of the company-wide AI ecosystem using deterministic synthetic data first

started Apr 2118 wks · quiet 1

c9Meaning-Layer DashboardBob-Wire

started Apr 2018 wks · quiet 1

c24synthetic-live-session-replayQmap

Build a deterministic synthetic replay path for live-feeling qmap sessions

started Apr 1719 wks · quiet 1

c23custom-obj-modelsQmap

Validate import, normalization, and rendering of custom .obj actor models in qmap

started Apr 1719 wks · quiet 1

c22runtime-session-mapQmap

Visualize a single qcontrol runtime session as a qmap entity-type topology

started Apr 1519 wks · quiet 1

c21ai-session-mapQmap

Visualize a single AI agent session as a qmap entity-type topology

started Apr 321 wks · quiet 1

c4AI Agents EntityBob-Wire

started ≈ Apr 121 wks · quiet 1

c10Real DataQflow

started ≈ Mar 2322 wks · quiet 1

c8label controlsQflow

started ≈ Mar 2322 wks · quiet 1

c3DataflowsBob-Wire

started ≈ Mar 2322 wks · quiet 1

c1Situation RoomBob-Wire

Situation Room wireframe — problem-space command center for data governance

started Mar 325 wks · quiet 1

c70Thesis Kindle

Convert "Looking In" thesis to Kindle-compatible formats (EPUB + print-replica PDF) while preserving images and foundational status

started Aug 152 wks · quiet 2

c59inventory

Design qdash inventory page to surface agent status and footprint at a glance

started Aug 24 wks · quiet 2

c51App Consolidation

Understand the fractured qcontrol app ecosystem and consolidate it into a simple, clean, demoable product on a Nuxt + q-nuxt-layer front-end

started Jul 146 wks · quiet 2

c49Fix the Cloudflare Pages Deploy

Make push to main reliably deploy the design site to Cloudflare Pages *(2026-09-25: reframed as "make the build a manual local step", see PICKUP.md)*

started Jun 1111 wks · quiet 2

c7avoma-notesMarket Analyst

Explore and integrate Avoma notes data into extraction pipeline and dashboard visualizations.

started Feb 25parked

c4refinementMarket Analyst

Refine how extracted data is displayed in the dashboard and improve extraction quality where gaps exist.

started Feb 24parked

c3oauthMarket Analyst

Add Google OAuth to restrict dashboard access to @qpoint.io team members.

started Feb 20parked

c69Operating System

Methods & tooling retro — evaluate how we work against the design methodology, restore order, modernize the skill/agent tooling, and make the philosophy load-bearing

started Aug 15parked

c62build-partner

Build-partner portal — research, ideation, and a plan for a page that makes partners insiders

started Aug 8parked

c55agent-market-definition

Align the qcontrol agent-monitoring dashboard to specific personas and find market alignment — hypothesis-first, validated against calls later.

started Jul 24parked

Closed 1

c9project-docsMarket Analyst

Clean up project documentation for sharing with team members

closed Aug 20 · started Aug 202 in the log

Pages & components

What this week's captures picture — 61 pages · 59 first captured this week. Each links to its evolution: every moment it was shot, across cycles.

Pages 61

Integrations ideasnew

10 shots·c61

evolution · 1 →

Teams ideasnew

7 shots·c61 c67

evolution · 2 →

Control center

3 shots·c64

evolution · 5 →

Inventory agent expandnew

2 shots·c59

2 shots·c59

2 shots·c65

1 shot·c59

Arcade organism ideasnew

1 shot·c62

evolution · 1 →

Build partner portalnew

1 shot·c62

evolution · 1 →

Build partner tracks ideasnew

1 shot·c62

evolution · 1 →

Compliancenew

1 shot·c56

evolution · 6 →

Compliance frameworksnew

1 shot·c65

evolution · 1 →

Log

Key Changes entries dated inside the week, from each cycle's record — newest first within a cycle.

c78 fleet-overview-reports

Aug 21

Kick-off (2026-08-21): plan.md (approved staged plan), this CYCLE.md, reconciliation.md (c68 mapping + personas). Five scoping decisions recorded above.

Aug 21

Stage 1 — fixtures (2026-08-21): app/data/report-fixtures.ts — the Meridian world at report altitude. Compliance (SOC 2 + NIST 800-53 controls, evidence items, passing-% trends), SLA Insights (quarter rollups, findings with unresolved-reasons, 7/30/90/180d placeholder rubric, slaBreaches()), Inventory (harnesses, models, MCP servers, shadow installs with personal-vs-enterprise account flag, coverage trend), snapshot shelves per report. Board report and all four summary cards are derived (deriveBoardReport, deriveCardSummaries), never authored; 3/6-month windows are slices of one stored 12-month series (slicePeriod).

Aug 21

Stage 2 — chassis (2026-08-21): /pages/report-anatomy-v1 built and registered (new reports group). Six organs defined at Compliance depth: header (identity + observation-period cursor), verdict band (score + spark trend + delta), body (control rows expanding into period-scoped evidence, session drill link), export bar (PDF/JSON/CSV + schedule), snapshot shelf (retained runs, re-run, diff flagged as open thread), and the document face (white paper artifact + machine JSON stub). Chassis rulings recorded on-page: organs 1–4 are one object; period is a cursor not a filter; evidence sampled on screen, complete in the artifact; verdicts derived; instances swap body grain, never organ order. Smoke-checked: 200, clean log.

Aug 21

Stage 3 — the four instances (2026-08-21): /pages/report-compliance-v1, /pages/report-sla-v1, /pages/report-inventory-v1, /pages/report-board-v1 built and registered. Chassis organs factored into local components (app/components/report/ — Header with period cursor, Verdict, ExportBar, SnapshotShelf; layer extraction is an open thread). Body grains per audience: controls+evidence (auditors), findings-vs-SLA with quarter rollups and mandatory unresolved-reasons (compliance/security), asset tables with the personal-vs-enterprise shadow signal (IT ops), and the derived board view with document-forward packet (execs). Derivation check caught and fixed a real inconsistency: strict passing-only scoring (42%) contradicted the authored trend (83%) — ruled auditor semantics: failing = non-compliant, attention = compliant with a noted exception; marcus's sandbox finding downgraded to attention accordingly. All five report pages smoke-checked 200, clean log, derived numbers agree everywhere.

Aug 21

Stage 4 — card bake-off (2026-08-21): /pages/report-card-ideas built and registered — four treatments of "how does a full report compress to a card," each shown as its complete four-card landing row: (1) metric register (score · delta · spark), (2) worst-thing-first (single urgent line + open count), (3) last-run receipt (snapshot id/timestamp/score — the auditor's register), (4) mini-document (report-as-thumbnail, artifact identity). All values from deriveCardSummaries(); one attention device per card per c68's queue lesson. Judging law on-page: a card earns a device only if it answers "do I need to open this report?" better than a number would. Provisional verdict recorded (final pick is Mark's): merge register spine + one worst line, receipt id as footer whisper; mini-doc redirected to shelf/export surfaces. Smoke-checked 200, clean log.

Aug 21

Stage 5 — landing composition (2026-08-21): /pages/fleet-overview-v3 built and registered (overview group) — Tyler's concept composed: derived verdict line, four-card spine wearing the stage-4 merged treatment (register spine + worst line + receipt whisper), estate funnel as the quiet footer; cards link into their reports, reports drill onward. c68 reconciliation taken deliberately: queue distributed into card worst lines, trust band compressed to the funnel — both reversible if Mark's c68 picks say otherwise. Attention world derives from the report fixtures; the all-clear world is an authored second fixture world (calm, not empty). New finding recorded: cross-report double counting — one underlying event surfaces in several reports (the failing control is the open high finding; shadow installs are the coverage gap), so the verdict counts reports needing attention, never summed items; fleet-wide item counts need entity resolution first. Smoke-checked 200, clean log.

Aug 20

Stage 1 (2026-08-20): initial-prompt.md + background.md — capture from the Mark Peterson product review: the four reports, format/delivery requirements, personas, session-drill expectations.

c77 Session View

Aug 20

2026-08-20 — Cycle created; initial-prompt captured.

Aug 20

2026-08-20 — Framing plan (framing-plan.md): qcontrol data model verified at source (qevents/qdash), audiences ranked from market-analyst calls, four-altitude ladder hypothesis, playhead-as-protocol strategy, honest qmap/qflow fit read, semantic-transcript beat vocabulary, proposed arc. Seven questions ruled by Mark (engineer-first, no live, /sessions home, full text with standing considerations, dogfood fixtures, no engines yet, mechanical derivation only). CYCLE.md written — formal kick-off.

Aug 20

2026-08-20 — Fixtures + mechanical derivation (app/data/session-fixtures.ts): four authored scenario sessions at qevents grain — clean-run (webhook retry, 3 chapters, 40 events), blocked-tool (prod warehouse blocked → readonly reroute), sensitive-file (~/.aws/credentials redacted + high finding), runaway-cost (8-cycle error loop, $34.75, user interrupt) — plus the reference implementation of the mechanical-only ruling: deriveBeats (role + adjacency + decision events → ask/clarification/decision/action/outcome/violation/error/handoff), deriveChapters (ask→outcome brackets, ask text as title), sessionTotals. Verified: strict tsc clean; derived spines read correctly (e.g. blocked-tool: ask → decision → action → violation → decision → action → clarification → … → handoff; MCP bootstrap surfaces as a "Session start" chapter — the Cisco lifecycle-visibility point falls out for free).

Aug 20

2026-08-20 — session-anatomy-v1 (/pages/session-anatomy-v1, new sessions registry group): the four-altitude ladder as a live mock — receipt (designed evidence document: what happened ¶-lines, exceptions, accounting, derivation footer), chapters (ask→outcome cards wearing beat-glyph spines: ● ○ ◆ ▸ ✓ ✗ ▲ ■), semantic transcript (full dialogue text, collapsed expandable action bursts, violations/errors in place, spine down the left), raw events (the qdash events-table grain everything above derives from). Scenario picker swaps all four fixtures through the whole ladder. Verified: SSR clean, captured to public/cycles/c77/ (content + full, luminance-checked).

Aug 20

2026-08-20 — session-transcript-chat (/pages/session-transcript-chat): chat-grammar bake-off per Mark's familiarity direction — four borrowed idioms rendering the same derived beats: messenger bubbles (dialogue warm, machinery whispered), team channel (the pass's discovery: policy as an app persona — violations land as the red-bar Slack alerts engineers already know), agent console (the engineer's native tongue, no skim layer), and the carried candidate chat wearing the spine (channel rows for dialogue, beat-glyph rail for machinery — one rail, two readings). Three laws recorded: familiarity is the ramp not the destination; policy is a speaker; machinery stays one glance away, never zero. Verified: SSR clean, captured (content + full, luminance-checked).

c9 project-docs market-analyst

Aug 20

Phase 1 execution completed 2026-08-20 — commit adb585b (AGENTS.md fixed, .agents/skills resolved, .env.example + README setup section added, command surface documented in CLAUDE.md, root cleanup done, c3/c4/c7 parked with PICKUP.md re-entry notes)

Aug 20

Phase 2 execution completed 2026-08-20 (same day, integrated with c8's Workstream B):
- README.md fully rewritten with agent-security framing, phase-1 archive callout, "How to Interpret the Data" section rebuilt around observations[] stream, source-type taxonomy, use-case-evidence patterns (direction + evidenceKind), refreshed limitations (vocabularies encode thesis, restarted-sample caveats), skills tour (/analyze /extract /classify /pickup), and "Adding New Conversations" runbook with registry pre-flight (team roster, companies.json sourceType/domains allowlist, fetch flags, streaming/32K notes)
- goals.md rewritten for phase-2 use-case-honing lens: evidence weighting rules, use-case scoreboard questions; flagged as user-maintained draft for Mark to tune (closes c8's pending B4 decision item)
- .claude/skills/analyze/SKILL.md updated to phase-2 schema (loads use-cases.json, observation stream, evidence-kind weighting, phase-1 archive rules)
- .claude/skills/extract/SKILL.md updated with fetch-first note, registry pre-flight step, streaming/failure notes, phase-2 key files (vocabularies.ts, prompt.ts, use-cases.json)
- CLAUDE.md updated: pivot framing (QControl = internal code name only), architecture tree (vocabularies.ts, prompt.ts, model.ts, registries, archive/), sourceType resolution in data flow, phase-2 Key Schema section, vocabulary single-source + registry-completeness conventions

c8 Agent Pivot market-analyst

Aug 20

2026-08-20 — Workstream A complete. Phase-1 corpus (34 calls) archived to archive/phase-1/ with a browseable static site snapshot; first-ever analysis.json generated before freezing (top finding: agent/MCP governance demand); tagged phase-1-final.

Aug 20

2026-08-20 — Workstream B implemented. schemas/vocabularies.ts single source of truth (source types, unified observation stream with workflow routing, all category vocabularies); phase-2 call.ts/validation.ts; rewritten extract-call.md with generated vocab sections; shared prompt assembly (pipeline/prompt.ts) used by extract + batch; use-case registry seeded (7 hypotheses); feedback.json rollup skeleton; known-source import allowlist in avoma.ts (filters become taggers); batch.ts now honors call classifications; sourceType resolution at index build.

Aug 20

2026-08-20 — C pilot: first two phase-2 calls extracted. Moto (prospect, fractional CISO, interest 5/5) and Zscaler (ciso-advisory via Sam Curry person-override, interest 4/5). Both validated clean; use-case evidence tagged with direction/evidenceKind; product-feedback stream (feature requests, ideas, concern, praise) populated. Extraction runs streaming with 32K output budget.

Aug 20

2026-08-20 — c8 site pass shipped. Dashboard reworked around the use-case evidence rollup; new /feedback triage view (type chips, product-area groups, severity/status pills); observation-driven call detail (use-case evidence, product feedback, market-signal sections); company journey page (sourceType badge, accumulated evidence + feedback); sourceType filter in FilterBar; useCallData rewritten for the phase-2 schema; site labels imported from schemas/vocabularies.ts (D1 single-sourcing extended to the UI); shared formatDate fixes the UTC off-by-one; clearFilters date bug fixed; About + README updated. Visual record captured below.

Aug 20

2026-08-20 — end-of-day status. Workstreams A and B complete; C substantially complete (pilot + site pass + docs). Remaining in c8: first feedback-triage pass over the pilot's 8 feedback items (data/feedback.json curation), Apr–Aug 2026 Avoma backfill + A1 cut-line decision (re-extract agent-era Cisco calls under the phase-2 schema), callType tuning watch on next extractions, D2 architecture thread (own thread doc when started). Source-tag note: Sam Curry/Zscaler retagged prospect (potential build partner) per Mark; Moto's Mark M sits on Qpoint's security advisory board — tag decision pending.