Source: c124 cycle-stories, collaborator option A. Fixture: app/data/cycle-stories-mock.ts (records + market-analyst calls). Unlisted: not in the nav; reached from credit cards and the collaborators index.
Mark Peterson
Fractional CISO advisor · Moto
With us since Aug 20, 2026 · also recorded as Mark M
Wrote the fourteen Observe/Enforce intents (qpoint-io/intents) and the v1 scope for governance. Vanta advisory board member.
- Shaped 11 decisions in c121Governance v1 Scope · decision records
- Shaped 1 decision in c130Native App (program) · decision records
- Shaped 1 decision in c131Native App V1 · decision records
Hand-written accolades will live in content/collaborators/mark-peterson.md: the things no record captures. (To come.)
In their words
Verbatim from market-analyst call records, behind Access (c124 D3).
“If the local queue control can give end user feedback about. So, like, when policies are enforced, so it's just not, like, such a complete whiplash in vacuum of information, that. I think that would be actually really useful.”
“coverage. Like, are we ever gonna get to, like, you know, corporate manage, like, phones, tablets, things like that?”
“We don't wanna be, like, deploying that. Those two changes live. We sort of wanna, like, stage them.”
“It's super intuitive... everyone has that experience.”
Features contributed to
Outcomes their credits feed, and features the records name them on.
A policy now has one Off · Observe · Enforce switch with an optional end date, on the policy and on each exception.
Every edit shows the people and teams it touches, and the findings it would resolve or reopen, before you stage it.
The teams listing reads as a posture bar: each team's Enforced / Observed / Off against the organization.
Endpoints show how far each version has reached, so a laptop sitting offline on a shelf gets flagged.
Edits collect in one Policy Config draft; publishing makes the whole file live as the next version, viewable and importable as JSON.
Every lab page can show a new customer's onboarding stage or a mature deployment, and the docs explain both.
D1 to D10 ruled with Mark in session on 2026-11-09; three changed the defaults: three data sources, the message channel in V1, qmap as a link.
Five pages in the window's order and the tray, with a local state that edits and a connected state that reads and says so.
Trigger, lesson, check, record: who assigns, the assignment as a c137 message, the lesson and check on one web-app page, completion in the audit log as proof.
Two parties, four ports between them, one schema for every message, and the citizen's hand on the delivery.
One schema carries every message: three severities, five states, three sentences in every body, and the single required override, counted.
Every message the roadmap implies was listed and passed through the five questions; eight were dropped, three of them surviving as rules or port behaviours.
One finding, minted where the activity happened; the machine, the person and the plane each append their own events to it, and the record never changes.
Company → technology → instance (Anthropic → Claude Code → one person's copy); monitored and detected-only are both first-class.
Mark Peterson: none of a company's IP should ever go to a personal ChatGPT account.
The "Alexis — investigate" callout comes from Mark Peterson's own example on the call; each person also gets a plain-language summary of their AI use.
Matched: c124's completion audit traces these mocks through design c81, c90 and c92; the c21 record doesn't say so.
Four ways to draw the estate were tried on one shared world; the flowing (alluvial) one leads the composed page.
Spend, Pace and Rate lead the page, on a snapshot of real served data.
The Sessions and Harness Installs cards were put away; the per-day chart moved up as Total Sessions.
Six objects, five lifecycles, and three rulings on how scopes, re-checks and enforcement behave.
Mark redrew the generated page by hand in Illustrator: History as one table, a details strip, Related findings and the Session.
Built from the live findings page's own pieces, then reshaped around the model.
Earlier policy pages showed rules and violations; this one follows the model, with each section marked by the delivery phase it ships in.
The proposal's named drafts and approval reached the lab, then were cut back to one shared draft with no approval.
Conflict handling and approval come back only if customers show several admins editing often.
Mode sits on the policy, and exceptions vary it by team or person. The lab still showed a Snooze here; the next cycle replaced it with an optional end date.
Block and Ignore left the finding page. Resolve asks for a reason: false positive, by design, security testing or other.
It also sketches design additions, qmap views and pixel-pawn stories to bring to the meeting.
It's ours, not sent. Mark Peterson is revising the intents himself; when his draft lands we check it against this and suggest only what's missing. The intents repo was not edited.
The Board report turned out to be a summary of the others, so it became the top of this page, without its averaged score.
An auditor can see what is past its target and how old it is. The report holds no controls.
Mark M added a twelfth, the engineer at the keyboard, whom this analysis had missed.
A posture score and a count of open gaps update as you toggle.
The cards read the same data; switching to full visibility changes only the inventory card.
Each report has a period you can step through, a verdict, the detail, export buttons and a shelf of past runs; the Board report is worked out from the other three.
Repeats of the same problem count as occurrences of one finding, not new rows, and the status is a dropdown you change in place.
Accepting a risk pauses the clock, but the finding stays on the report's "not fixed, here's why" list until it expires.
Mark M's own deadlines are built in: 14 days for critical, 30 for high, 90 for medium, and low is advisory.
Tools are grouped by company and technology, with the ones we only detected, and never monitored, ranked first.
Teams & Users lost its Intensity labels and gained a short summary of how each person uses AI; it now states that browser AI is a known gap.
The backend doesn't know a company's full staff list yet, so the coverage figure carries a PROJECTED badge instead of a made-up total.
On Teams, the Assigned card went, Est. spend became Spend, and the quick filter gained a Columns picker.
Mark Peterson's question about predicting the month's spend was the example that showed the gap.
The rule runs in code and the analysis may not overrule it. Today 0 of 7 use cases pass, and each card says what's missing.
The Oct 19 session became the first decision brief, picked up by design as c118; Oct 21 and 23 were recorded in c114, c116, c118 and c121.
Phil Chen's relief at self-hosting made transcript governance recurring; Mark Peterson's intern-laptops story did the same for fleet compliance.
Sam Curry and Zscaler were tagged a prospect and possible build partner, not an advisor.
Pages
Surfaces their observations point at (artifactRef) and the routes of outcomes they're credited on.
| Page | Why it's here | Count |
|---|---|---|
| /pages/phase4/mock/policy-detail | their observations point here | 5 |
| /pages/phase4/finding-detail | their observations point here | 3 |
| /pages/qcontrol/session | their observations point here | 3 |
| /pages/phase4/mock/organization/teams | their observations point here | 2 |
| /pages/qcontrol/teams | their observations point here | 2 |
| /pages/phase4/governance-model | outcome: Day one and the goal, side by side | 2 |
| /pages/findings-regroup-v2 | outcome: The findings page, rebuilt in the product | 2 |
| /pages/phase4/mock/changes | their observations point here | 1 |
| /pages/phase4/mock/policies | their observations point here | 1 |
| /pages/phase4/mock/policy-config/proposed-changes | outcome: See who a change affects, first | 1 |
| /pages/phase4/mock/endpoints | outcome: Which laptops missed the update | 1 |
| /pages/phase4/mock/policy-config/config-file | outcome: One shared draft, published whole | 1 |
| /cycles/design/c130/doc/plan | outcome: Ten rulings in one walk | 1 |
| /cycles/design/sketches/c131-app-map | outcome: The app map and its two states | 1 |
| /cycles/design/sketches/c133-training | outcome: A training is four things | 1 |
| /cycles/design/sketches/c137-channel | outcome: Overseer, ports, citizen | 1 |
| /pages/phase4/messaging-bones | outcome: The bones, with ten voice-checked examples | 1 |
| /cycles/design/c137/doc/inventory | outcome: The inventory: 24 rows, 16 kept | 1 |
| /cycles/design/sketches/c147-common-tongue | outcome: The common tongue | 1 |
| /pages/phase3/mock/inventory | outcome: What our AI is made of | 1 |
| /pages/cost-center | outcome: Three answers first | 1 |
| /pages/phase4/findings | outcome: Findings, grouped by the rule that raised them | 1 |
| /pages/phase4/policy-detail | outcome: One page per policy | 1 |
| /pages/phase4/mock/finding-detail | outcome: Findings resolve with a reason | 1 |
| /pages/phase4/mock/reports | outcome: A Reports catalog with the Board report folded in | 1 |
| /pages/phase4/mock/reports/posture | outcome: The Posture report, drawn in full | 1 |
| /pages/policy-catalog | outcome: Frameworks pick the policies | 1 |
| /pages/index-three-cards-v1 | outcome: From verdict page to three cards | 1 |
| /pages/report-compliance-v1 | outcome: Four reports, one shape | 1 |
| /pages/findings-lifecycle-v1 | outcome: Only evidence closes a finding | 1 |
| /pages/phase1/inventory | outcome: Inventory opens with a verdict | 1 |
| /pages/phase1 | outcome: Four pages drawn again after the walkthrough | 1 |
Releases
What shipped with their input in it.
- Nov 13, 2026c147Findings, a Common Tongue: Opened and kicked off 2026-11-13 (c137 closed into it); seven questions answered the same day; Phases 0–2 done (the shape, findings derived into the worlds, the copy of S2 and S1 in the native skin); review stop 1 ruled the same day (the defaults); Phase 3, the person's view, built the same night; review stop 2 walked the same night; Phase 4 the same night (Q4 in the prototype's model, HQ's half on real rows for Priya, plain whys); review stop 3 walked the same night (Phase 5 briefed for qnative; a finished training closes its finding; the app raises findings on a standalone machine); waiting on Petersoncited
- Nov 9, 2026c130Native App (program): Kicked off 2026-11-09; D1–D10 ruled the same day; the primer written; the spike done in ../qnative; the shape and the pitch nextcited
- Nov 9, 2026c131Native App V1: Phase 2 in motion in ../qnative as qnative c2 (2026-11-10): the skin, the native component docs, our layer in Rust and the Inventory section through Repos & Workspaces, the whole section, with the table expand row (the extra stretch) and the skill file; review stop 3 with the scorecard and the budget (qnative review-3.md), the brand ruling waiting on Mark; then the Tour stretch (2026-11-11): the engine, the native tour, Info View and the MCP guide served from inside the app, at its review stop (qnative review-tour.md); Mark ruled both stops the same evening (D18–D20) and they were built (qnative 71dd21a): the table at full fidelity, the panel at the window's edge, Getting started with the guide's token, the atlases released, nina-mbp the default world with pilot beside it; Claude Code walked the native guide from one prompt, and c2 closed (Phase 2 complete). The V1 build waits for shape.md and c0's namecited
- Nov 9, 2026c133Remediation Training: Kicked off 2026-11-11; Phase 0 (the brief) in flight in market-analyst; Phase 1 built the same day and its review stop ruled that evening (D10–D16); shape.md accepted at G1, so formally open; Phase 2 built the same night (the event shape for Tyler, Corrections in Reports and on the finding) and its review stop ruled (D17–D20); Phases 3 and 4 handed to an execution session, which built Phase 3 the same night (the collection, the preview page, /api/trainings with version and hash) and Phase 4, the three pilots of D6 (pilot 3 on F-G, the one finding added to the lab world for it); review stops 3 and 4 ruled 2026-11-12 (D28–D37); Phase 5 built 2026-11-12 by an execution session (the two small things, D34's reorder, the hand-off to c134 and c131, the library), now at its review stopcited
- Nov 9, 2026c137App Messaging, Overseer and Citizen: Closed 2026-11-13 into c147 (Findings, a Common Tongue): after the 2026-11-12 Product session an inbox read as another thing to check, and the notion it reached for already existed as design's findings. Carried on: the name Safety & Security, the voice rules, the noise control and qnative c4's notification plumbingcited
- Nov 3, 2026c128Reports: Kicked off 2026-11-03; the window picker, the catalog and the Posture report are built and live, waiting on Mark's review of Posturecited
- Oct 26, 2026c123Compliance Frameworks: Five product tours deployed 2026-10-29 and framework detail composed and deployed 2026-11-03; the rest of the frameworks cleanup is still opencited
- Oct 23, 2026c121Governance v1 Scope: Waves 1–2 committed 2026-10-23; Wave 3 nextcited
- Oct 20, 2026c118Policy Structure and Publishing: Closed 2026-10-21; most of its publishing work was superseded two days later by c121cited
- Oct 19, 2026c116Policy Changesets: Superseded as a proposal the same day; its premise lives on in c118 and c121cited
- Oct 9, 2026c114Governance Phase II lab deployedmatched · review
- Oct 2, 2026c110qdash TODOs — 2026-10-01 review: Plan executed and shipped 2026-10-02; the Outcome isn't writtencited
- Oct 1, 2026c105Cost Center: Mock round 2 built 2026-10-01; waiting on Mark's review before the app portcited
- Sep 28, 2026c100Landing Pages: Bake-offs and composed mocks built and deployed 2026-09-30; Inventory and Team landings later retired in favour of Home (c109)cited
- Sep 25, 2026c94TODO Execution Process: Skill built and first run planned 2026-09-25; all 17 plans executed that day; Outcome never writtencited
- Sep 21, 2026c12Micro Problems: T0–T4 built 2026-09-21; October product sessions extracted and their decisions written into design c114/c116/c118/c121 (2026-10-26); the product-input plan awaits Mark's review.cited
- Sep 18, 2026c92qcontrol New Pages: Threads landed 2026-09-18→26 on the gen 2 qdash app; phase 3 left open; that app was archived at the c107 cutover (2026-10-02)cited
- Sep 3, 2026c11Conversation Profiles: All four threads landed 2026-09-03; Outcome still "(In progress)" and the cycle is still listed as active.cited
- Sep 1, 2026c81Phase 1 Pages: Cloud run built all 17 pages 2026-09-01→02; v2 of four pages 2026-09-08 from the Mark Peterson walkthrough; Outcome unfilledcited
- Aug 31, 2026c21Inventory + Users / Devices: Listed active in both bob-wire and design; three mocks built on the design site 2026-09-01; the cycle folder is untracked in bob-wirecited
- Aug 25, 2026c79Finding Lifecycle: Lifecycle and findings redesign ported to qdash 2026-08-27 (layer 0.9.11); Outcome pendingcited
- Aug 20, 2026c78Fleet Overview Reports: Closed into c128 Reports on 2026-11-03, with the card pick never madecited
- Aug 20, 2026c8Agent Pivot: Workstreams A and B complete, C substantially complete (2026-08-20); the architecture thread moved to c10; Outcome still "(In progress)".cited
- Aug 14, 2026c68Index Overview: Mocks done; three idea rounds awaiting picks since 2026-08-27. The landing later shipped through c78, c100 and c109. No Outcome.cited
- Aug 12, 2026c65Control-Center v2: Outcome written (shipped 2026-08-12, layer 0.9.8, qdash c13) but never moved to HISTORY.mdcited
- Jul 24, 2026c55Agent Market Definition: Outcome never written; persona work carried on in market-analyst (personas.json seeded from c55)cited
Decisions shaped
Each one is ruled in a cycle record and sourced to something they said or did.
| Decision | Cycle | What it says | Link |
|---|---|---|---|
| D1 | c121 | A reason is required when an edit loosens and when an exception is revoked. Tightening keeps it optional. | matched · review |
| D3 | c121 | Observed findings are hidden by default, with a one-click filter and a zero state that names what is hidden. | matched · review |
| D4 | c121 | Local staging stays, in front of one shared draft. Publish makes the whole draft live. No named drafts, approvals or promotes. | cited |
| D6 | c121 | Mode is Off · Observe · Enforce with an optional Until, on the policy and on its exceptions. Snooze goes. | cited |
| D7 | c121 | Expiry is optional. Mark Parson proposed requiring an end date when loosening; Mark Peterson kept it optional. (ruled) | cited |
| D13 | c121 | Import validates a pasted or uploaded JSON into the staged edits. A support export strips tokens. | cited |
| D19 | c121 | A change's impact states the facts and stops ("Loosens P-MCP for 3 people in Finance."). "Blast radius" stays out of the UI. | cited |
| D20 | c121 | The teams listing defaults to the posture bar, with its "Against the organization" departures column. | cited |
| D24 | c121 | The propagation footprint goes on Endpoints, team endpoints, the Changes version rows, the tray and the policy mode note. | cited |
| D25 | c121 | The adoption stage is a lab switch plus a docs section. | cited |
| D26 | c121 | Changes is renamed Policy Config: Proposed Changes, History and Config File. | matched · review |
| c130-D9 | c130 | The message channel's ports and bones ship in V1: sender and receiver, native message channels, the overseer and the citizen. The design is its own cycle, c137, kept simple, with the person in control of what reaches them. | cited |
| c131-D8 | c131 | The message channel's ports and bones ship in V1 (c137 designs them): the schema in types, the inbox store, the OS notification plumbing with per-type controls, the tray count. Only Connect confirmations flow in V1; more is Tyler's at G2. | matched · review |
| c133-D1 | c133 | A training runs on the web app, opened from the native app's notice; inline in the native app later if the content model is small enough. | matched · review |
| c137-D5 | c137 | Contact IT is a reply that lands in the plane's inbox, later in Slack or email through integrations. The IT contact text comes from the plane's org settings. | matched · review |
| c105-D1 | c105 | Keep the rate card and all eight lenses for a review round. | matched · review |
| c110-D1 | c110 | Activity becomes two rows of three, counted in tokens; the Sessions and Harness Installs cards are put away. | matched · review |
| c114-D0 | c114 | Read the fourteen intents for one model, not one page per intent; screens follow from the model. | matched · review |
| c114-D4 | c114 | Use the intents' words everywhere: Policy, Framework, Finding, Resolution, Exception. | matched · review |
| c116-D1 | c116 | Personal, named changesets, with conflicts found at deploy. Overtaken the same day by one shared draft. | cited |
| c116-D3 | c116 | Approval as a per-company setting by risk. Dropped for v1: no approvers at first. | matched · review |
| c116-D6 | c116 | One company-wide version per publish, with a review page first. | cited |
| c118-D2 | c118 | Each policy has a mode: Off, Observe or Enforce. | matched · review |
| c118-D5 | c118 | Block leaves findings; Resolve takes a reason: false positive, by design, security testing or other. | cited |
| c78-D1 | c78 | Reports first, landing last; a full mock page for each of the four reports, Board included. Start with all the information, trim later. | cited |
| c79-D3 | c79 | Ignore is not an exception: ignore means "not a real finding"; an exception is real risk, formally accepted, with a required expiry. | cited |
| c79-D9 | c79 | The rubric is Mark M's real program: critical 14 days, high 30, medium 90, low advisory with no hard target. | cited |
| c79-D11 | c79 | Repeat occurrences never reset the clock; the first one starts it. | matched · review |
| c79-D24 | c79 | Terminology: Control → Finding → Occurrence. | matched · review |
| c81-D1 | c81 | For operators, inventory and visibility first; governance appears only as quiet links. | matched · review |
| c81-D5 | c81 | Session detail drops Chapters, minimizes dialogue by default, and states its encryption plainly: local data unencrypted, anything stored or shared encrypted with the customer's own key. | cited |
| c92-D8 | c92 | Teams are compared one measure at a time, with spend and tokens first. | cited |
Conversations
Calls, demos and briefs they were part of. Call pages live in market-analyst (local dev only for now).
| Date | Conversation | Kind | Their ideas | Record |
|---|---|---|---|---|
| Nov 5, 2026 | Roadmap: the native app and the control plane | working session | 2 | market-analyst /calls/1b21a3ce… |
| Oct 23, 2026 | Friday: walking the built lab | advisory call | 2 | market-analyst /calls/5b4bae13… |
| Oct 21, 2026 | Wednesday: the v1 model, by subtraction | advisory call | 9 | market-analyst /calls/5c8785e2… |
| Oct 19, 2026 | Mode moves to the policy | advisory call | 5 | market-analyst /calls/154b2679… |
| Oct 14, 2026 | Policies, groups, exceptions, the findings lifecycle | advisory call | 6 | market-analyst /calls/04e3d850… |
| Oct 12, 2026 | Sentinel and the findings wireframes | advisory call | 5 | market-analyst /calls/f06500e3… |
| Sep 3, 2026 | Dashboard mockups review with Mark Peterson | advisory call | 6 | market-analyst /calls/09ecfede… |
| Sep 3, 2026 | Pushed the dashboard mockups toward concrete governance signals | recorded call | — | record line |
| Aug 31, 2026 | Onboarding Mark Peterson as advisor | advisory call | 5 | market-analyst /calls/38075ead… |
| Aug 31, 2026 | Onboarding session: validated a visibility-first strategy, inventory before enforcement | recorded call | — | record line |
| Aug 20, 2026 | Product review with Mark M | advisory call | 10 | market-analyst /calls/2100ac03… |
| Aug 20, 2026 | First advisory session: reviewed the agent inventory, control center and findings flow | recorded call | — | record line |