Composition notes

• Question: where is AI working in our code — which repos have agents in them, who is working there, and did any of that work touch a sensitive file? Repo identity is derived from the session working directory (c59 T2); the page says so on the surface and claims nothing the cwd cannot tell it — no commits, no PRs, no "what this repo is about".
• Verdict line from reposVerdict(world) (a sharper twin of verdicts.repos, listed as a fold-in): repos from cwd, how many had sessions this week (6 of 7 — qpoint/infra's only session is 12 days old, so the brief's "7 with sessions this week" would be false), people and installs, and the credential read. Two grains of "sensitive" are kept apart: a flagged read (a policy-redacted file_access or a credential-category file — red, the same tone the verdict and band give it) vs a secret touched in the course of work (a receipt — counted, content-colored, pointed at Files). The clear state is calm because the receipt's home is the Files page.
• Framing band = the brief's four claims: repos (reset button), people working with AI in them (of 18 — denominator printed), installs (of 28), credential reads (the one attention device, a filter button, names the repo). People and installs are plain blocks — nobody filters repos by "has people".
• Table is the raw UxTableList family so ?id= can pre-open a row (inventory.vue pattern). Rows from repoRollup(world), pre-ranked flagged reads → sensitive touches → sessions this week; search rides the Repo header (name, cwd, owner, people). Owner is a team chip or a person chip (c12 owner routing). A cwd with no remote would render as a workspace — the cwd as its name, "workspace · no remote", no owner, no warning color; none exists in this world, and none was fabricated (an unreferenced workspace would be a row with zero installs, which the sensor could never produce).
• Expand = four UxTableListExpandSection cards on a bare row: header (identity caveat, owner, first/last seen, headline stats, the honest "view details →" stub — Surface pages are listing + expand in Phase 1), people & installs (person chips → User detail; agent chips → Agent detail, sub = detected-only / stale where true), sessions on record (→ Session detail; the row prints each session's own one-line summary — a session fact, not a repo narrative), and the sensitive-file cluster (file chips → Files, category, sensitivity, read/write/edit, the sessions that touched it, policy column). No prompt-topic mining anywhere: nothing aggregates session lines into "this repo is mostly X".
• Derivation: every number traces to repoRollup / reposBand / sensitiveTouchesForSessions; the band cross-foots with the visible rows under the sensitive filter; 7d and on-record are never mixed on one row; dollars are labelled estimates. The layer has no github icon (agent-expand-v2's known gap) — the repo glyph is mono ⑂.
• Open: workspaces have no carrier in the world (Stage 5 could add one repo with no remote and put it in one instance's repoIds); whether ordinary secrets should echo Files' attention tone here; defaultBranch is stored but unearned at T1 (cwd cannot know it) and stays off the surface.