5 started, 16 carried live.
Busiest record: c125 Operations Wizard (19 entries) · 71 carried cycles have gone quiet · layer v0.9.36 → v0.9.36
The app.qpoint.io linear wizard kit replicated on the design site (ReplicasWizard*, Sequin), copied not redesigned
Commits
53 commits across 8 repos, on each repo's checked-out branch.
Cycles
Started 5
A final, hand-tuned pass over the policy surfaces in the phase-4 lab. We walk each aspect in turn (the listing, the policy header, mode and Until, severity, exceptions, frameworks, findings, history, Policy Config, team Policies) and sand each one by hand. Along the way, each fact about a policy gets one home, and every other place summarizes it and links there.
A tour-guide and self-documenting tool that attaches cleanly to any part of the UI, so the UI becomes the documentation. It has a hover help mode (after Ableton Live's Info View), a numbered-marker overlay for explaining a screen, step-by-step tours that move across pages and highlight what matters, and an AI tour guide over MCP from the start. Its first tour is the operations journey from the 2026-10-26 product session: install to enforcing on a pilot team.
Make the cycle detail page tell the cycle's story at a glance: why it happened, what changed (before → after, in plain words), and who made it better. External market specialists are credited first. Every outcome traces back through its decision to the meeting or conversation it came from. Collaborators get their own unlisted pages, where attributions and accolades build up.
Give the frameworks a good bath and a redress. We finalize the framework page designs and tune their details from the latest designs and what Mark Peterson made clear on 2026-10-26: Qpoint gives evidence, not compliance, under emerging regulatory pressure to govern AI. Most of the work is by hand. We export the current page to Illustrator, Mark reworks it there, and we build the result on a test page. The brief's Frankenstein list (X1–X11) is the checklist for the cleanup.
Still open 16
Tame our own design history before telling it. Catalog the Qpoint Design drive (sketches, Illustrator, Photoshop, InDesign, Sketch, Figma) so every file can be found, previewed and traced to its original. Tie each file to a cycle where one exists, otherwise to a startup phase and design generation. Write down an ingestion protocol that ends in a story. Then give the cycle detail page a story-first design pass.
Build the decisions from the week of Oct 19 into the phase-4 lab (/pages/phase4/mock/*). The governing scope is Mark Peterson's v1 guidelines: an exception changes mode only, publication is the whole shared draft, and resolving a finding records a decision.
A /briefs section on the design site, off the main menu, with one page per brief handed to a collaborator outside the org
Build the Phase II governance dashboard for qdash around the object model the ../intents repo describes, so that Findings, Policies, Scope, Groups, Exceptions, Enforcement and Frameworks appear as one coherent system rather than fourteen features
Re-evaluate the qdash /cost page against what the backend now serves, and re-draw it on the Organization / Inventory listing pattern
Design the three qdash "Design in progress" landings: Home /, /inventory and /team. Each is a 30 ft (300 ft for Home) view of its domain, made more of images than of text.
Reshape market-analyst into a design tool first — the source of truth for Qpoint's problem space — by adding a micro-problem layer (use case → micro problem → observations) on top of the existing market lens, with a curated registry, extraction-proposed candidates, computed standing, product surfaces, document intake, and briefs/stories that cite problems.
Downloadable logos on /brand/logo. Pick a logo, a format (SVG · PNG · GIF · JPG, in that order of preference) and a color (White · Black · Grape), then download a pre-built file generated from black master SVGs.
An ideas cycle. Gather sourced material on the Prometheus story as an analogue for AI; on ancient attitudes to fire; on David Deutsch and Karl Popper's error correction, set against our problem formation; and on modern voices about AI, from doom to salvation
Explore and integrate Avoma notes data into extraction pipeline and dashboard visualizations.
Refine how extracted data is displayed in the dashboard and improve extraction quality where gaps exist.
Add Google OAuth to restrict dashboard access to @qpoint.io team members.
Methods & tooling retro — evaluate how we work against the design methodology, restore order, modernize the skill/agent tooling, and make the philosophy load-bearing
Build-partner portal — research, ideation, and a plan for a page that makes partners insiders
Align the qcontrol agent-monitoring dashboard to specific personas and find market alignment — hypothesis-first, validated against calls later.
Closed 0
Nothing closed
Pages & components
What this week's captures picture — 12 pages, 1 component · 5 first captured this week. Each links to its evolution: every moment it was shot, across cycles.
Pages 12
Components 1
Log
Key Changes entries dated inside the week, from each cycle's record — newest first within a cycle.
c125 Operations Wizard
- mcp-guide, written up (2026-10-29): thread
mcp-guide(prompt, plan), raised from c123's session: tours a person's own agent can drive over MCP. The plan proposes an answer to OQ1, with three rules: actions stay with the person, the person's clicks win, and no dashboard changes. Its test ladder runs on the design site before anything reaches qdash: a demo page, a Playwright walk of every step, an MCP contract script, error and safety cases, Claude Code end to end, then the same script against qdash. Added as W7 intour-layer.md. Nothing built: the panel-iterations thread (tour-panel-iterations-prompt.md) is in the tour files the same day, so the build waits for them to be quiet.
- mcp-guide, built (2026-10-29): the same day, once the tour files had been quiet for about 12 minutes.
window.qpTour(useTourApi),<TourAgent />beside<TourHost />, a dev-only relay (server/api/tour/*,server/utils/tourRelay.ts) and the MCP endpoint/api/tour/mcp, with 11 tools and no verb for a step's action.TourHostanduseTourare unchanged; the panel-iterations thread had them open. The demo page is/pages/phase4/tour-mcp.scripts/tour-drive-check.mjspasses 62 checks across rungs 1–4. In rung 5, Claude Code walked stop 2 on the embedded lab and left Stage and Simulate violation to the person (transcript). The plan's § Built lists what's left: a recorded capture, a second harness, the no-tab case, andnuxt generatewith the new SDK dependency. Committed inf351ccdf7c.
- mcp-guide, the unscripted guide written up (2026-10-29): Mark asked whether an agent could answer "Where do I go to add a Slack integration?" with no tour, using the callout. It can. The plan's § The unscripted guide adds three tools:
find-in-app(searches an app map on the server),open-page(any page) andpoint(a ring plus aTourCalloutwith one sentence). It also adds IDs on the rail and the Connect button. The app map is Objective 1's annotation registry, started from the agent's side. One rule changes:pointputs a short label on screen, and the explanation stays in chat. The plan has rungs U0–U4, and U4 asks the exact question in Claude Code. Not built.
- mcp-guide, the unscripted guide built (2026-10-29):
app/data/app-map.ts, which covers 29 pages and 66 regions and is checked against the pages by U1. Four tools:find-in-app,read-page,open-page(rings the rail, then goes) andpoint(a ring and v4's callout). Rail IDs, plus Connect and connector IDs.scripts/tour-guide-ask.mjsasks a real harness any question. 166 checks pass. In Claude Code, three questions asked exactly as written each found the page, rang the way and read the region before answering; none pressed anything. For Slack it said "already connected; config changes it" (answers and captures). The map followed c123's port of qdash's pages, which landed mid-build. Committed inf351ccdf7c.
- lab knob
?draft=empty(2026-10-29): Mark asked to clear the seed's proposed changes from every page (and noted that demo mode, Shift+D, already hides the tray and the theme editor).useGovernanceMockgains?draft=empty: the stage's world with no lines in the shared draft and no saves in the log that made them.?draft=seededbrings the twelve back. It's kept in lab links like?stage, and it's sticky: a link without it leaves the draft as it is. The query is now watched, so a page that doesn't calluseGovernanceMockitself still reseeds on a stage or draft change. Committed inf351ccdf7c.
- tour runtime, from c123's tours (2026-10-29): c123's five tours (c123 CYCLE.md § tours) added to
TourHostand the v5 panel, with the panel thread's go-ahead. Follow the page: the person's own click onto the next step's page advances the tour. Clickable stop markers. Spots: buttons in the panel, each ringing one area. A safe area that stacks pinned chrome. The glide is ease-in-out quint. A step'sshortnames it on the Next button, in place of its beat. Committed with this cycle's panel and mcp-guide work on 2026-10-29.
- mcp-guide knows the dashboard (2026-10-29):
guide-knowledge.tsmakes the policy catalog (19 policies) and the frameworks (5, with 44 requirements) searchable in a customer's words, through rows onpolicies.rowandcompliance.framework. It adds a hand-written word list per policy, 17 concepts, and anexplaintool.open-pagetakes{ policyId }. New IDs on the Control Center's rows and eight on the policy page's sections. The server is renamedqpoint-guide. 189 checks pass. In Claude Code, SSH keys went to the P-FILES row, and DeepSeek went to P-PROVIDERS' Mode with its live state.
- focus only what's specific (2026-10-29): Mark: "I don't know that we gain anything by highlighting the whole page." A cloud session's
b3ebf9106f: a step rings the one region that answers its question, and Dim and Fade fall back to the ring past about half the viewport (effectiveFocusinTourHost). It was written against an olderHost.vueand reapplied by hand inf351ccdf7c. Rule intour-layer.md.
- mcp-guide, committed and deployed (2026-10-29): the c123 tours session's commit needed these files to build, so Mark approved including them:
f351ccdf7conc123/owasp-agentic-tour, pushed and deployed.nuxt generatepassed with the MCP SDK and needed no prerender exclusions. The live_deploy.jsonshowedf351ccdfwith 0 uncommitted. The guide only drives a page on the dev server; deployed, the relay isn't there.
- in-app chat, split off (2026-10-29): Mark asked how a chat window in the web app would work, then asked for a new cycle with initial thoughts and no plan: c127 Guide Chat.
- kick-off (2026-10-27): Stage 1 and Stage 2 written together from Mark's direction and the market-analyst brief, alongside c123 (frameworks) and c126 (policies). Nothing built yet.
- prior art located (2026-10-27): Mark named app.qpoint.io's simple linear wizard as the prior art and thought it might be in q-nuxt-layer. It isn't: the kit is still app-local in
app.qpoint.io/app/components/wizard/withutils/sequin.js, unchanged since c23 classed it app-local. Objective 4 and Phase 1 now replicate it first.
- before captures (2026-10-27): thread
c125-before:c125-before-home-adoption,-endpoints-adoption,-policies-adoptionand-governance-modelinpublic/cycles/design/. Programscripts/shot-programs/c125-before.json. They show the lab in adoption with no help, markers or tour: the pages the journey would start on. The app.qpoint.io wizard kit isn't shot yet, because its dev server isn't running and the project is stale.
- rulings (2026-10-27): Mark answered two kick-off questions. (1) The MCP tour guide drives the design-site lab first; qdash comes after. That settles Phase 4's target, though the transport question (open question 1) stays open. (2) The app.qpoint.io wizard kit is documented first (its own dev server, captures, a prior-art note), then copied onto the design site.
- wizard kit, documented then copied (2026-10-27): app.qpoint.io ran on :3301, since its content watcher holds :3300. Thread
c125-wizard-kitshot the A–D demo in tab mode, the only/dev/wizardspage that still resolves.prior-art-wizard-kit.mdrecords the anatomy (Sequin, per-step overrides, the form, listener and end modes), the seven flows it shipped in, what it hands c125, and what was found while copying. The kit is replicated verbatim except for named changes inapp/components/replicas/wizard/(ReplicasWizard*, plus the app-local LinkBack) andapp/utils/sequin.js. It's demoed at/pages/phase4/wizard-kit(tab, centred and linear modes, the listener → end install shape, the pieces alone), and threadc125-wizard-replicaholds five shots of it working.
- the richer radar (2026-10-27): Mark's old branch was app.qpoint.io
origin/mask-image(d82388dand0bfe673, 2024-06-05, never merged). The twelve radar assets are lifted intoapp/assets/images/wizard/mask-image/. ItsRadar.vueis nowReplicasWizardRadar, a black disc with line and sweep layers turning at 12 s and 6 s, and it's grafted into the replica PingListener as the branch had it. Seeprior-art-wizard-kit.md§ The richer radar. Checked on :3000: both layers load and turn, and the console shows no errors.
- radar sizes (2026-10-27):
ReplicasWizardRadartakessize(px, default 38, as on the branch), and both layers fill the disc. The wizard-kit page's pieces section shows it at 38, 96, 160 and 280 px. The SVG layers stay crisp at 280.
- radar line colour (2026-10-27):
ReplicasWizardRadartakeslineColor(white, leaf, grape, grape-400 (added on request) or grey-500; default white, as on the branch). The two SVG layers are now inlined via?raw, with#fff→currentColorand theircls-*classes prefixed per layer, because inline SVG<style>is document-global and the two files' classes collide. The grey rings (#545454) stay grey. There's a select for it on the wizard-kit radar card. On leaf and grape, a hairline seam sometimes shows at the sweep's edge. It's in the branch artwork, and white hides it.
- the tour layer, prototyped from c123 (2026-10-27): c123's addressable OWASP® tour needed a tour runtime before this cycle's Phase 1, so a working prototype is in the lab. Pages carry
data-qp-id(and an optionaldata-qp-keyfor rows) and nothing else.<TourHost />is mounted once in a layout. The panel floats in its own dark-grape material, the ring and callouts follow targets by ID, and Examples float real components with example props over their live counterparts. Drills send a simulated violation through the alert path and are kept in the delivery log, never in findings. Content is data, and an adapter is the one seam to the app.tour-layer.mdhas the protocol, the materials, the drill rules and six work packages (W1–W6), each with where to pick it up and what done looks like. It answers Objective 1's attach protocol in favour of a data attribute; Phase 1 should confirm that or replace it.
c123 Compliance Frameworks
- owasp-agentic, driven by the person's own agent (2026-10-29): asked from this cycle's session. Can the tours be driven over MCP by a user's agent? It's c125's runtime, so the write-up is c125's thread
mcp-guide:mcp-guide-plan.md, W7 intour-layer.md. The OWASP tour is its first test subject.
- tours, five of them (2026-10-29): thread
tours(prompt, plan). Mark asked for four or five logical, clear tours, with a Start here among them. Each tour is one person with one question and ends with something changed. All five are written, built on the tour layer, and walked by script. Launcher:/pages/phase4/tours.Tour Steps Pages Start here (day 0, c125 J1–J3) 6 a new Organization › Endpoints › Add endpoints page: installer per platform with placeholder names and sizes, enrollment token, one test machine, the first signal (a mock button stands in for the machine), what it runs, MDM rollout against the directory Common AI risks (week 1) 11 Watch then Drill for four plain-language risks: secrets, unreviewed MCP servers, personal accounts, actions with consequences; then who heard, and what Qpoint can't see. No risk IDs, nothing staged Observe, then enforce (weeks 2–6, c125 J4–J7) 8 c121's ?stage=adoption: baseline at Observe, the Observed findings, Engineering's pilot, then stages Enforce for Finance and reads its Change impactAI spend (ongoing) 6 the new Cost Center mock ( mock/cost.vue,data/cost-tour-fixture.ts): $5,865 in 30 days, $1,543 a month to find (opus → sonnet $864, seats paid twice or idle $679), the Oct 21 runaway eval session, then stages P-SPEND at Observe with a $400/day fleet ceilingOWASP® Agentic (any time) 21 stops 3–5 written (W5), each with Watch, Tune, Drill and Prove (W6); the close rewritten - Three new drills in
owasp-tour-fixture.ts:secret-to-model,personal-account,unapproved-delete. Every drill has a shortlabeland an optionalblock(the policy that would stop it, and how "So, today" words it either way). The adapter's sentence readsblockinstead of assuming P-MCP. - Example cards follow the drill:
sensitiveExampleandsourcesExamplereadc.drills[id], so the panel thread's v5 scenario picker moves them. TOUR_CATALOGindata/tours/index.ts({ id, name, blurb }, customer order) feeds v4's tour menu.- New attach IDs:
endpoints.add,endpoints.band,add.*,findings.list,policies.list,team.policies,policy-config.versions,cost.*. - One correction found by testing: OWASP stop 5's kill switch first staged P-MCP to Enforce. That's already live in the established world, so it staged nothing. The step now says it's on, and points at the draft's pending relaxation to Observe until Dec 1.
- Test:
node scripts/tours-walk.mjs(Playwright, fresh visit per tour, v4 · Split · Dim). For every step it checks that:- the step's page loads;
- every region it names is there with a box;
- its blocks read;
- its stage grows the draft, or its drill lands in the log;
- there are no console errors.
It passed 308 checks, 0 failures. Sample shots are intours-walk/. - Not done: phone width (the lab's mock shell is desktop-only), the formal
/captureprogram, and the installer's real names and sizes. - Follow the page (same day, Mark): clicking Add endpoints during Start here now takes the tour to the installer step and highlights it. In
components/tour/Host.vue(c125's file, edited with that thread's go-ahead), when the person reaches the next step's page by their own click, the tour advances. The URL is the only signal: pages stay tour-free, and the tour listens to no app events. A page that isn't the next step's leaves the tour where it is. The advance is recorded as the person's move. The walk checks all of this (39/39 on Start here). - Callouts that cover the step's own subject (same day, Mark): the installer's token callout sat over the Download buttons the step is about. c125's panel thread then made it a rule in
components/tour/Float.vue: a callout treats the step's highlighted regions, Example frames and every callout's target as obstacles. It takes the first clear side, else the least covered. The per-stepplacementhint was dropped as redundant, and the type stays for awkward layouts. - Demo mode for recording (same day, Mark):
?demo=1, Shift+D, or Demo → on/pages/phase4/tourshides the lab's meta nav: the MOCK bar with the tour row, the Policy Config tray, the theme editor, the dashed mock buttons, the rail's mock footer and the DevTools button. The tour panel keeps Back, Next, minimize and ✕.composables/useLabDemo.tssetshtml.qp-lab-demowhile the lab layout is mounted. The pieces carrydata-lab-chrome, so the rest of the site keeps its theme editor. The visit remembers the mode, and the param leaves the address bar. In demo, Start here's first signal arrives on its own 4 s after its section is in view. - Common AI risks reads violations on Findings (same day, Mark: "a much nicer place to see violations, especially for simulating specific violations"):
- The tour opens on Findings.
- Risk 1's Watch is the redactions (
P-SENS-SANITIZE, 16 caught), and risk 3's is the personal account, both in the individual view. - Each Drill now lands on Findings filtered to the policy it would raise. Its Example is the page's own
FindingsTablewith the simulated findings (DRILL-1, …) on top of the real open ones.data/tours/drill-findings.tsbuilds them: the drill's raised signals become findings in a copy of the world, folded withRULED. Their outcome and count match the panel's "So, today" sentence. - Drills gained
who(the person) and per-signalresource.findings.listnow also marks the individual table and the empty states, so a policy with no findings yet still has a list to float the Example over.
- The tours lead
/pages/phase4/tour-iterations(same day, Mark: "option 5 is now the de-facto design"): each tour has Start and Demo in v5, with v1–v4 as earlier links./pages/phase4/toursand the walk open v5 too. The walk passed 312 checks in v5. - Sticky nav and a stray callout (same day, Mark, on AI spend · Where it goes): the jump-pill nav (NavJumpPills' sticky row) stayed bright over the dim. When pinned, callouts could sit on it, and one callout pointed at the $/tokens toggle while it was hidden under the pinned title. Fixed in c125's files, with that thread's go-ahead:
useTourChromeBoxescovers a see-through sticky wrapper with its painted children, so the pill bar is tinted in flow and pinned.- The safe area in
Host.vuestacks the chrome pinned at the top: the band, then the pills. - The glide measures the pinned stack instead of a fixed 120 px.
Float.vuedraws no marker for a target that's under the pinned chrome or out of view.- The tour's callout now points at By model.
The walk passed 312/312 after the change. - Common AI risks' drills say what you're looking at (same day, Mark: "the 'simulate violation' button is confusing… we should have a few findings already in place"):
- Each drill step now shows all your open findings (7), not one policy's list, which was often empty. The Example puts the simulated ones on top and is titled "Your open findings" in the v5 panel.
- The panel's text says what each control does: "What if …? These are your open findings today. Tick Simulate to add the findings it would raise, at the top and marked Example; nothing is saved. Send test alerts to see who would hear about it."
- The drill action is renamed Send test alerts, so it no longer shares a name with the Simulate box.
- The tours walk real qdash pages (same day, Mark: "replace as many placeholder pages with real ones… exceptions like the installer page"; then "Use qdash's Findings"): see
tours-real-pages.mdfor the map and what was done.- Findings, Home and the MCP Servers listing are now copies of qdash. MCP server detail, Integrations and Cost have qdash's page on top, with the tours' own sections below, marked new.
- The governance Findings design moved to
/mock/findings-design. - Sources and Add endpoints are tagged as concepts.
- The drills' Examples are qdash's findings ledger.
- The walk passed all five tours (304 checks).
- Tour details, the same afternoon:
- Start here's opening is titled "Install Qpoint on your first machine". The token callout is gone. The test machine is Morgans-MacBook-Pro, and "What it's running" uses qdash's DataMachine band pattern.
- Findings drops qdash's severity cards.
- Common AI risks: each risk ends at Simulate, and Send test alerts happens once, at "Would anyone hear about it?" on Integrations.
- The panel's stop markers are clickable. The Policy Config tray hides while a tour runs.
- The OWASP opening is rewritten: "evidence, not a compliance verdict".
- Every step has its own title. Steps that shared one looked as if the panel hadn't moved. The walk now checks both points: the panel shows the step's title, and no two consecutive steps share a title.
- OWASP no longer uses Sources (off the rail too). Stop 1, now "Supply chain", opens on Home's real Inventory section, with spots: a new step field, shown as panel buttons, each highlighting one area with a line on why it's a risk (MCP servers, skills, model providers, harnesses). It then continues to the MCP Servers listing. Stop 5 walks postmark-mcp-server's detail.
- Scale-to-fit for wide Examples was built and removed, at Mark's call. Wide content is parked.
- The walk passes all five tours (415 checks).
- Demo, the glide and plain step names (same day, late):
- Demo on the launcher and on tour-iterations now opens with
?draft=emptyas well as?demo=1, so the recorded pages carry none of the seed's proposed changes (c125's knob). - The glide is ease-in-out quint over 0.7–1.6 s by distance. Its slow start was the layer's
* { scroll-behavior: smooth }(shared.css) turning each frame'sscrollTointo a smooth scroll of its own; the glide now scrolls withbehavior: 'instant'. - "Drill" and "Tune" are gone from what a person reads (Mark: "confusing and ambiguous"). A step gains
short, a few words for what it does. The panel's Next names the next step ("Next: Simulate a look-alike →", "Next: Allow what's reviewed →"), or the next stop when the stop changes. The meta bar's beats read See it · Change it · What if · Prove it, and the launcher's chips use the short names. OWASP's stop 2 is "MCP servers and their tools". - The walk also checks that Next never shows a bare beat name. All five tours pass.
- Landed as
f351ccdf7c, with the c125 panel and mcp-guide threads' work on the shared tour files and c127's initial prompt, pushed onc123/owasp-agentic-tourand deployed. A cloud session had already pushedb3ebf9106f("focus only what's specific") from an olderHost.vue, so its change was reapplied by hand in the rebase: the OWASP opening rings nothing, stop 1's and stop 2's policy steps ring less, and Dim and Fade fall back to the ring when the focus covers more than about half the viewport. The walk passed 455 checks on the result. Stops 3 and 4 didn't exist when that commit was written, so their policy steps still ring two regions each.
- Demo on the launcher and on tour-iterations now opens with
- Three new drills in
- kick-off (2026-10-27): CYCLE.md written from Mark's kick-off prompt and the market-analyst brief, alongside c125 and c126. The cleanup is this cycle's Stage 2, not a new cycle, as the brief asked. Nothing built yet.
- before captures (2026-10-27): thread
c123-before:c123-before-compliance-{established,adoption},c123-before-framework-detailandc123-before-policies-frameworks-strip(with-fullrenders) inpublic/cycles/design/. Programscripts/shot-programs/c123-before.json. They show the Active/Available listing with its completeness % and Activate/Deactivate (X1, X2, X5), framework detail still an S5 record (X6), and the second activation strip on Policies (X1, X4).
- owasp-agentic (2026-10-27): thread
owasp-agentic(prompt). The OWASP Top 10 for Agentic Applications 2026 read in full, with both LLM Top 10 editions, inresearch/owasp/(PDFs, licensing README, close reading: every numbered mitigation tagged Enforced / Observed / Evidenced / Outside, the fit table ready for the fixture).owasp-agentic-tour.mdmaps each risk to a question, qdash surfaces and policies, and designs a c125 tour plus framework detail's "paper rail". UI concept canvas: https://claude.ai/artifact/V4qJ4c8sgfuTZv1nvcfmy1. All OWASP material is CC BY-SA 4.0 (ACS code Apache-2.0); no OWASP logo. Ruled the same day: Agentic joins v1 (F4 now four). It's ingovernance-fixture.tsasowasp-agentic(2026, risk taxonomy, untracked, ASI01–ASI10 from the reading's fit table), with short labels inFW_SHORTandFW_LABEL. It renders on the lab's compliance listing, framework detail and policy detail.
- ruling (2026-10-27): the cleanup runs at the page level. Mark looks at each page whole and names what feels off or hasn't caught up to our understanding. The X1–X11 checklist is a cross-check after his read, not the agenda. Illustrator exports follow his notes; they aren't prepared ahead.
- owasp-agentic, the addressable tour (2026-10-27): thread
owasp-agentic. Mark redirected the tour from all ten risks to the parts Qpoint can most address, framed by the customer's concern. The spec isowasp-agentic-tour-v2.md: five concern-led stops, each with Watch, Tune and Prove beats. The concept canvas has a new v2 row of five static boards: the route, and the Watch and Tune beats of stop 1 (Source health) and stop 2 (MCP). Source health is seven checks per source, each passing, failing, not yet known or not applying, with counts above the list and no score. Each Tune beat uses the fixture's real controls (mode and advanced exceptions,PolicyModeState, P-PROVENANCE, the severity override) and tags the missing ones new: a per-server tool list, an approval verb set, sanctioning a skill, severity per scope. The spec's new "What the artboards decided" section records the panel's v2 anatomy, the fixture-like numbers, and three asks found by checking the fixture. The Prove boards aren't drawn yet; the tour runtime belongs to c125.
- owasp-agentic, the Drill beat and the lab tour (2026-10-27): thread
owasp-agentic. Mark added a fourth beat, Drill: show the signals Qpoint would send for a violation, the card on Home that lights up, and the customer's notification settings, then Simulate violation to send real, clearly marked test messages through their channels. He wanted the tour layer as light as possible on the dashboard: IDs only, floating, and in a look of its own. He ruled the panel floats, the messages are real, drill receipts are kept, and row keys start light. He also asked to rebuild the canvas boards as lab mockups and keep the boards as sketches. Built:- The tour layer (
components/tour/*,composables/useTour.ts, the adapteruseTourAdapter.ts, content indata/tours/), mounted once in thegovernance-mocklayout. - Four new composed mocks: Home, Sources, the
githubMCP server detail with its Policy section, and Integrations with the delivery log. Their data is indata/owasp-tour-fixture.tsanduseNotificationsMock.ts, anddata-qp-idattributes are their only tie to the tour. - The route page
/pages/phase4/tour-owasp-agentic. - The Tune beats stage real changes in the shared draft, and the drills write to the delivery log.
The spec's new § "The Drill beat, and the lab tour" maps each step to its page and lists the signals for stops 1 and 2. The protocol and the work packages for c125 are inc125 tour-layer.md. - The tour layer (
- NIST AI RMF in the fixture (2026-10-27):
nist-ai-rmf: version1.0 (Jan 2023), the new kindrisk-management framework, the source termsubcategory("Subcategories" on framework detail), untracked. It holds 18 subcategories: the 15 the dossier (§2e) says Qpoint can speak to, plus GOVERN 2.1, MEASURE 2.11 and MANAGE 4.3 as visible gaps. Labels abridge NIST AI 100-1 (a US government work), and the ids are NIST's own. This closes the "NIST AI RMF missing from the lab data" item. The layer'sFrameworkIconresolved "risk-management framework" through itsriskalias to the risk-taxonomy warn icon. Fixed in q-nuxt-layer 0.9.36: ariskmanagementalias, listed first, takes the governance ribbon. All six consumer lockfiles are refreshed and committed, not pushed.
- prep (2026-10-26):
meeting-prep.html(also published as an Artifact),intents-redline.mdandresearch/frameworks-dossier.md, ahead of the session with Mark Peterson. Seeinitial-prompt.md§ What came back.intents-redline.mdbecame our own gap-check the same day: Peterson revises the intents himself, and we check his draft against its §5 and suggest only what's missing.
c126 Policies Final Pass
- kick-off (2026-10-27): Stage 1 and Stage 2 written together from Mark's direction and the market-analyst brief, alongside c123 and c125. Nothing built yet. The tree already holds uncommitted lab edits in
governance/mock/Bar.vue,PublishTray.vue,useGovernanceMock.tsandgovernance-parts.tsfrom an earlier session. Check whose they are before the first stop touches those files.
- before captures (2026-10-27): thread
c126-before:c126-before-policies(stop 1),-policy-detailand-policy-detail-adoption(stops 2–9, P-MCP),-policy-config(stop 10),-policy-config-history(stop 9/10, C4) and-team-policies(stop 11), with-fullrenders, inpublic/cycles/design/. Programscripts/shot-programs/c126-before.json. These are the lab as c121 left it, before any stop.
- ruling (2026-10-27): the pass runs at the page level, not stop by stop. Mark looks at each page whole and names what feels off or hasn't caught up to our understanding. The eleven aspects and C1–C7 become a cross-check after his read. The pages, in order: Policies listing, policy detail, Policy Config (draft, history, config file), team Policies. Illustrator exports follow his notes; they aren't prepared ahead.
c124 Cycle Stories
- kick-off (2026-10-26): cycle opened with initial-prompt.md and plan.md, and D1–D4 ruled. c122 Phase 6 marked as moved. Uncommitted.
- design options (2026-10-26): Mark: design it in
/pages/_metawith multiple options. One fixture,app/data/cycle-stories-mock.ts, built from real records:- c121 is rich: four advisor calls, 12 decisions linked to the observations behind them (cited or matched), and c114 → c121 capture pairs.
- c115 is minimal: Sarah's sketch → hero.
The c124 set is in the page registry and the_metaindex:- the overview,
/pages/_meta/c124-cycle-stories; - cycle options A Editorial, B At a glance, C Pathways and D Before/after;
- collaborator options A Profile + ledger and B Contribution trail;
- the collaborators index.
Uncommitted.
- pass 2 (2026-10-26): Mark walked A–D. He likes B (At a glance) and wants it second. Every cycle should open with a really simple summary of why and what resulted. What changed felt dense with all the images, so it should be told in simple words that guide you through the important changes. Pathways are worth keeping only if they're legible, and any option may lend parts.
New option E Refined (/pages/_meta/c124-cycle-e-refined), in this order:- In short: why and what happened, two plain sentences; the ELI5 sits behind "Explain it like I'm new here".
- B's at-a-glance band: counts and who helped, external first.
- What changed: the changes that matter most as a numbered list of plain sentences, then the rest under "Also in this cycle". Pictures show only on "See it" / "See before and after".
- How we got here: one readable row per change, Someone said → We decided → So now, with cited / matched marks.
- Thanks to.
- The full record, folded.
The fixture gainedsummary,outcome.stepandoutcome.major, plus apathFor()helper. The A–D strips link to E, and the overview leads with E. Uncommitted.
- deployed (2026-10-26): options A–E and the collaborator pages committed
8c595fa5be(temp index; the foreign staged deletion and the Cost Center registry hunk left out), deployed904a382aca, and live on design-f39 (_deploy.jsonshows8c595fa5be).
- images (2026-10-26): Mark: find a hero before → after for each cycle; where none exists, use early → final, so every story still gets an image; and keep every image reachable.
Rule: a before → after pair is the surface before this cycle touched it against after. Failing that, early → final is the cycle's own first frame against its last. Otherwise the outcome is new in this cycle, with its final image.- c121: policy page, findings and adoption are before → after (c114 → c121). Teams (plain table → posture bar) and the shared draft (named drafts with approval → one draft) are early → final, from c121's
00-*step shots, now copied topublic/cycles/design/c121-steps/. Change impact and propagation are new. - c115: the hero is Sarah's sketch → the published hero.
E now shows:- the hero pair under In short;
- a small labelled pair on each top change;
- an All images section, with every pair, then everything captured (c121's 28 manifest captures; c115's sketches, hero, listing and live article), all stepping through one lightbox.
The fixture gainedpairKind,story.heroandstory.captures. - c121: policy page, findings and adoption are before → after (c114 → c121). Teams (plain table → posture bar) and the shared draft (named drafts with approval → one draft) are early → final, from c121's
- image pass deployed (2026-10-26): committed
a2c3e5d70dand live on design-f39.
- definition + survey (2026-10-26): Mark: how does E fit today's cycle page (define that first), and how do the last two dozen cycles fit the structure?
- Definition, proposed in plan.md "Where the story lives" and waiting on Mark: one cycle, two views, same address. Story (E) becomes the default at
/cycles/<project>/<id>; today's page becomes Record at…/record; a Story · Record · Report strip sits under a shared header; thin cycles fall through to Record. - Survey: four parallel drafts of c100–c123 (22 new; c115 and c121 are the pilots) as
app/data/cycle-stories-survey/<id>.json, in E's shape plus asurveyblock (strength, story line, hero found, gaps). They merge into the fixture throughimport.meta.glob. New hero frames for c114 and c118 were copied topublic/cycles/design/<id>-steps/. - Result:
- strength: 7 strong, 13 good, 4 thin;
- hero: 11 before → after, 4 early → final, 1 new only, 8 told in words (c101, c105, c111, c112, c113, c117, c120, c123);
- 9 of 24 credit someone outside Qpoint (Mark Peterson, Phil Chen, AMZ, Sarah).
- Shown on
/pages/_meta/c124-story-survey, with cards, filters and the definition up top. E gains a picker over all 24. - Uncommitted.
- Definition, proposed in plan.md "Where the story lives" and waiting on Mark: one cycle, two views, same address. Story (E) becomes the default at
- D5 (Mark, 2026-10-26): stories open when you click a cycle. The Story · Record split is adopted and built:
/cycles/<project>/<id>rendersCyclesStoryView(E, extracted from the_metapage intoapp/components/cycles/StoryView.vue) whenever the cycle has a story, with Story · Record tabs (CyclesViewTabs)./cycles/<project>/<id>/recordrenders today's page, moved unchanged intoCyclesRecordView.- Cycles without a story (c1–c99, c124, sister projects) keep today's page at the same address, with no tabs.
/reportand/docare unchanged.- The
_metaoption E page and the survey now link to the real cycle pages. - Collaborator pages stay in
_metafor now. - Uncommitted.
- deployed (2026-10-26): the cycle page and survey were committed
45bc1a0c71and deployed. Live: c121 and c108 open on Story with tabs; c62 keeps today's page.
- earlier cycles + completion audit (2026-10-26): Mark: start updating the previous cycles, and note which should be completed.
- Stories for c76–c99: 25 drafts, with c97's duplicate harness-chip folder as
c97-harness-chip. Strength: 6 strong, 14 good, 5 thin. Hero: 11 before → after, 7 early → final, 1 new, 6 words only. Outside credits in c78, c79, c81, c92 and c94. One new person, Kamal Nasser (c80's fix, from qcontrol PR #714). Hero frames copied topublic/cycles/design/<id>-steps/for c85, c87, c88, c91, c98 and c99. Every story now inapp/data/cycle-stories-survey/(47 drafts + 2 pilots = 49) renders on its real cycle page. - Completion audit (
completion-audit.md/.json), covering all 47 entries under Active in CYCLES.md:- 26 complete, 9 superseded and 2 abandoned: 37 should close;
- 5 to park, 5 keep active.
- Hygiene findings: c97's duplicate number; c65 and c70 listed Active while their records say completed; orphans in neither index; never-committed c105 and c123; stale PICKUP notes.
- Shown: each story carries a completion note ("Looks done — ready to close", plus what closing needs). The survey gains a "Should close" filter and the full audit table.
- Nothing has been moved in CYCLES.md or HISTORY.md: the verdicts wait on Mark. Uncommitted.
- Stories for c76–c99: 25 drafts, with c97's duplicate harness-chip folder as
- survey view controls (2026-10-26): Mark, while reviewing the audit: a way to toggle, sort and organize the cycles. The survey gets a sticky control bar, remembered per viewer in localStorage:
- show: open and closed, plus a per-card hide for reviewed ones, with "show / reset";
- dim: closed, open, or all but should-close;
- size: S, M or L;
- sort: newest, open first, closed first;
- group by: week or month the cycle was opened, closed ("Still open" first), or was open during (a cycle appears in every week it ran).
"Open during" shows 33 cycles open in the week of Oct 26, which is the stale-active list the audit is closing. Uncommitted.
- all cycles drafted (2026-10-26): Mark: keep going down the list until all are done, then commit.
- c1–c75 were drafted from one shared brief by six parallel agents. With c76–c123, every design cycle now has a story: 122 drafts plus the 2 pilots. c124 itself keeps today's page.
- Totals:
- strength: 16 strong, 58 good, 50 thin;
- hero: 29 before → after, 23 early → final, 35 new only, 37 told in words.
- New people:
- Cam Esdaile (Cisco), the first build partner, cited in c55;
- Jon Friesen (qcontrol owner), name matched from commit authors;
- Kamal Nasser (c80's fix).
- Early-cycle notes for review:
- Most early heroes are the 2026-08-15 backfill captures, filed by filename prefix.
- The policy-card cycles (c15, c19–c22) pair bob-wire's March designs with the built parts.
c7-method.pngholds the pre-c120/methodtext, a true "before" for c120.- Several records conflict with HISTORY.md (c10, c22, c50).
- c14 (a lone PDF) and c73/c74/c75 need rulings.
- Every story renders on
/cycles/design/<id>.
- views (2026-10-26): Mark asked to size, fade and show cycles by tag. A first pass built a rules table, one row per tag with show / opacity / size, presets and a set-all row. Mark: "we went off the rails a bit". What he wants is a simple view. The survey's Show / Dim controls became one View picker:
- All, Open, Archived, Opened · 2 weeks, Closed · 2 weeks;
- "2 weeks" means the 14 days before the latest date in the data;
- a view sets the result structure. Matches are micro cards (image, id, title) at full opacity. Everything else is smaller than micro (a thumbnail and id) at 50% opacity, and comes back to full on hover.
- Under All, the S / M / L size control still applies.
- Kept per viewer in localStorage. Uncommitted.
- cycle explorer (2026-10-26): Mark: the survey's View UI "almost needs its own page". Keep the current cycles directory and link from it to a new explorer.
- The survey's filter, View, size, sort, group and card grid moved into
CyclesExplorer(app/components/cycles/Explorer.vue). Rows come from a sharedstoryRows()in the fixture. - It renders on a new page,
/cycles/explorer, linked first in the/cyclesintro ("Cycle explorer →"). The c124 survey uses the same component above its audit table. - The view is remembered under
cycles-explorer-view, falling back to the survey's old key. - Uncommitted.
- The survey's filter, View, size, sort, group and card grid moved into
- every project, and pickups (2026-10-26): Mark: create stories for all the cycles, even short ones waiting to be picked up.
- Every design cycle already had a story except c124. c124 now has its own, with three captures: the record as the page → the story, and the explorer.
- The 89 sister-project cycles were drafted by seven parallel agents from a shared brief. They cover:
- qmap 28, qflow 13, bob-wire 22 and market-analyst 12;
- qpixel 5, www 6 and app 3.
- Strength: 2 strong, 47 good, 40 thin.
- Hero: 13 before → after, 21 early → final, 24 new, 31 told in words.
- Pickup: a new story field
{ next, waitingOn, since }holds the next step, what it waits on and the last activity.- Every open cycle has one: 51 design (added by an eighth agent), 48 sister, plus the c115 and c121 pilots.
- The story page shows it as "Waiting to be picked up".
- Explorer cards show it as "Next:".
- Keys: stories are keyed by project, so design stays
c42and sister projects becomeqmap/c4. Their drafts sit inapp/data/cycle-stories-survey/<project>/./cycles/<project>/<id>opens on the story for every project, with Story · Record tabs.
- The explorer gains a project picker (All projects, Design 125, Qmap 28 …), 214 cards in all. It sorts by the date a cycle opened, and labels sister cards "qmap c4". The survey stays design-only.
- Review: the sister-project review items (outside credits, closes, uncommitted work, bad captures) are in
review-list.md§8.
c12 Micro Problems market-analyst
- session-decisions thread (2026-10-26): Mark asked for the latest product meetings, extracted, with their decisions written into the results sections of the design cycles that already carry the work. Another agent is redesigning the cycle pages, so this thread supplies the content and its intent, not the layout. Prompt:
session-decisions-prompt.md; hand-off note:session-decisions-handoff.md.- Fetched Wednesday Oct 21 (
5c8785e2) and Friday Oct 23 (5b4bae13) by--uuid. Today's 2026-10-26 session (frameworks) is later today and not yet fetched. - Triage: both declared ciso-advisory × roadmap-planning, as before. The
design-sessioncall type is still only planned. Shown mocks are declared asdesign/phase4/mock/*, the lab pages. - Extraction: both PASSED. Oct 21: 20 observations, 7 decisions, 3 todos, 6 ideas, 3 candidates. Oct 23: 20 observations, 7 decisions, 4 todos, 5 ideas, 2 candidates. The index now has 12 calls.
- Standing:
fleet-scale-compliance-statemoved observed → recurring (Moto + Zscaler). The cause is Mark Peterson's first-hand intern-laptops story on Oct 21, extracted as Moto evidence. It is the co-designer case the product-input plan (C) predicted, and it is left for Mark's review: 6 recurring / 9 observed. - No new brief. Oct 21 went straight into design c121 from four other sources (Logseq, Rob's summary, intents PR #4, Mark Peterson's Slack), and the transcript agrees with them. The one place c121 differs is deliberate: it requires a reason when loosening, where the session asked only for a nudge. Oct 23 reviewed c121's lab and sent the next questions forward: frameworks, explicit vs implicit rules inside a policy, control vs policy, action types, a naming convention, and starter configs.
- Design records: each of c114, c116, c118 and c121 gets a
### Product-session decisionssubsection under## Outcome. Each has a provenance line, the story, and grouped entries with a status (ruled / direction / open / idea / superseded) and where the decision landed. c116 and c118 had no CYCLE.md, so one was written for each from their prompts and plans, marked as written after the fact. - Found in passing: c114
object-model.mdstill describes the 2026-10-09 model, and c118's record steps R1, R2, R5 and R6 were never done.
- Fetched Wednesday Oct 21 (
- Oct 26 session + three briefs (2026-10-26, committed as
58a661a): Frameworks and onboarding (022c7156), ciso-advisory × roadmap-planning, no mocks shown (Mark Peterson shared outside references). Became briefsoperations-wizard,frameworks-cleanup(feeds design c123) andpolicies-final-pass. No standing moves. The index had 13 calls.
Captures
31 screengrabs taken this week, 12 of a subject with an evolution history.
The app.qpoint.io linear wizard kit replicated on the design site (ReplicasWizard*, Sequin), copied not redesigned








Before: the S5 record — framework detail was never composed in the mock shell (X6)




Before: the listing titled Control Center, with expanding rows, frameworks strip, Custom controls and Evidence packet (C2, C5)










