Phase 4 — Governance

c114 Phase 1, the model page — the fourteen qpoint-io/intents as one object model, rendered live from governance-fixture.ts: the chain, object cards (stored vs derived), the Vanta MCP story run to its end by applyChange() under the D1–D3 rulings with each alternative one switch away, the effective-policies probe (scope paths, deciding enforcement, equal-specificity conflicts), derived framework coverage, and the lifecycle organ

c114 Phase 2, the surface map as blocks — the Govern rail proposal (Findings · Policies & Frameworks with Policies / Frameworks / Groups views), the eight surfaces as grey-box frames in reading order with the intent behind every block (Finding detail, Findings, Policy detail, Policies & Frameworks, Framework detail, the scope & enforcement sheet, Policy Groups, Resolve & Exception), what carries over and what is new per surface, the four states each mock renders, and the intents × surfaces matrix

c114 Phase 4 — the walk through the eight surfaces in dependency order: progress and the rulings so far (D0–D8) with Mark Peterson's delivery phases; per stop, where to look (every state linked), what to look for, the captures from the atlas by subject, and the questions the mock raises with what it does today and the ruling once given; cross-cutting questions on the phasing and the model; what follows the walk

c114 composed mocks — the Governance surfaces composed in the qdash shell (today's rail: Monitor · Govern + Secure · Admin) from the surface mocks, one surface at a time, on one shared world; the MOCK bar carries the finding, Mark Peterson's delivery phase (2 · 3 · 4) and show parts

S1 Finding detail composed in the qdash shell — the harness so far: the shell, the shared world and the finding the URL names (?findingId= F-A · F-S01 · F-S04 · F-NOPE); parts are lifted from the S1 surface mock as directed

S3 Policy detail composed in the qdash shell, section by section (?policyId= P-MCP · P-SENS-SANITIZE · P-TRANSPORT · P-NOPE). First part: Scope + enforcement (Where it applies and Enforcement in one UxTableList)

qdash's Security Findings copied into the lab (2026-10-29, so the tours walk the real page): stat cards, the filter bar (Open / Closed / All, framework, control, search; ?policy= reads as ?control=), the ledger grouped by control with members and the adjudication card, all on the lab world (data/qdash/findings.ts toQdashFindings). Adjudication is local to the page

S2 Findings composed in the qdash shell on the shared world, the governance design (Observed / Enforced, grouped by policy, Grouped ⇄ Individual, the member table with the adjudication card shared with S3). Moved here 2026-10-29 when the rail's Findings became qdash's copy

The live qdash /policies page (the Control Center) copied into the qdash shell and fed from the shared world: the frameworks strip, the Control Policies table with in-row config editors and Full details → the composed S3, custom controls, the evidence packet

The live qdash /compliance page copied into the qdash shell and fed from the shared world: the unmapped-findings guard, and the Tracked / Untracked framework listing: Enforcement Posture, Exceptions and Compliance Score on tracked frameworks, name and description on untracked ones (intents-pr5)

c123 S5 in the qdash shell, on the shared world: one framework from Compliance's Details + Configuration — who tracked it, with Untrack; Enforcement Posture, Exceptions and open findings; the step that stages Off policies; controls in their native groups with rationale; posture over time; what isn't mapped; supporting evidence (intents-pr5). ?frameworkId= picks the framework

The live qdash team page copied into the qdash shell and fed from the shared world (header, Coverage and Monitored Harnesses tiles, People, Endpoints, Sessions), plus a Policies section: what applies to the team, derived from the policies and their exceptions, the view that replaces policy groups (A5). History band and Surface are titled stand-ins

The teams in the mock world (people, policies on and enforcing, team exceptions, open findings); a row opens the team page

Every Governance part lifted out of the c114 surface mocks, rendered live on the shared world with its source and delivery phase — what the composed mocks are made from

qdash's Home copied into the lab (2026-10-29): the c109 index, Inventory · Organization · Activity sections of DataMachineMicros under qdash's keys, fed from data/qdash/home-index.ts (spend from the cost fixture, MCP from the MCP listing's fixture, endpoints and people from the world)

Stop 1 Watch of the addressable OWASP® Agentic tour: every source an agent loads or pulls from (MCP servers, skills, providers, harnesses, knowledge) with seven checks as four marks (pass, fail, not yet known, doesn't apply), not a score; a kind filter in the URL, a band of counts (41 · 35 healthy · 4 failing · 2 not yet known) and per-check fail counts in the headers, failing first. Heads the Inventory submenu; not in qdash yet

qdash's MCP Servers listing copied into the lab (2026-10-29): the band (Count · Tool Calls · Tools Used) and the ledger (source, transports, harnesses, calls, tools, installs, last used) for the lab's 14 servers, 2 of them configured-only; data/qdash/mcp-servers.ts

qdash's MCP server detail on top (header, tiles, tools, harnesses; 2026-10-29), then, marked new and for github only, the addressable tour's sections: calls this week by consequence, the tools ledger consequential first, who made the sends, deletes and executes, and the Policy section (Mode staged into the draft, per-team context, allow, per-server tool allow-list and approval verbs, pin, severity) over a Change impact

qdash's Integrations on top (connector groups, Live — working today, the setup modal; 2026-10-29), then, marked new, the notification routing by severity and the delivery log with drills tagged by id. Nothing is sent in the lab

qdash's Cost Center on top (tiles, spend guardrail with P-SPEND's mode from the world, spend over time, team · model · harness · user tables; 2026-10-29), then, marked new, the AI spend tour's sections: unit price and the opus → sonnet opportunity, seats paid twice and idle, cache rate and the Oct 21 runaway session. Every number from cost-tour-fixture.ts

c137 Phase 2 in the lab's qdash shell (not on the rail: c134 decides the place): the operator's inbox with what waits for an answer first and a reply box, what the plane sent with states per recipient and Recall, the honesty counter of required messages this month, and Send with the three-sentence fields, the required count and soft ceiling, the preview as the person sees it, the notification as the OS posts it, and the voice lint. A message sent here lands in the person's inbox mock

c133 Phase 1: one remediation training in the web app's frame, reached from the finding (the strip on S1) or from the assignment message (c137 training-assignment). The first pilot, Unapproved MCP servers, written for F-A: the lesson in four steps with the illustrations drawn from the pawns and the sketch kit, every sentence filled from the finding, the policy's sanctioned list and the GRC exception; the check of four questions on the idea (all right passes, retake keeps what was right); the result with the record shown before it is written; the record in the finding's history and the audit log. ?at= assigned · lesson · check · passed · retake · recorded; ?findingId= F-C or F-S01 shows the honest absence

c133 Phase 5: the library in the lab's qdash shell, as the person sees it on the web app. The three published trainings from the collection with title, minutes, what each covers and the person's record: Assigned when a finding of theirs waits for it (Start opens the training on that finding), Recorded with the latest record, or No record. Take it on your own opens a training with no finding: filled from the reader and the policy, the steps that need a finding left out and said so, the same check, the record shown before it is written and written with no finding and no assigner (training.completed.self). ?person= picks the reader; ?take=<id>&self=lesson · check · passed · retake · recorded opens a stage; ?findingId=F-A&at=recorded seeds F-A's record

c116 M1, the dirty state: edits across three policy pages (Policies, Severity, Exceptions) stay in a draft, and a small indicator in the lower right holds the change count, a net-diff review, Discard and Deploy, or Send for approval when risky changes need a reviewer (D3). Edits during review reset it (C5).

c116 M2, the summary before deploy and the page a reviewer approves from: at-a-glance tiles and effect lines, what changed by policy or by page (before → after, what it will do, risk, revert), the edit log with netted-out edits, a deploy panel (revision message, D3 approval rule, reviewer, note), the in-review and changes-requested states, and recent revisions. Reads the same draft as the indicator mock.

The one time control shared by reports and operator pages (D5): rolling, calendar and custom from–to windows, compared with the previous period or the same period last year, in the org timezone, last 30 days by default. Shown as the when: pill and as a report's window line, plus the panel laid flat across seven worlds (90 days, 12 and 16 months kept, fresh install, before the data, across the new year, month to date) and every preset resolved

c137 Phase 2: the one message component over the ten example messages (and the two for the operator's inbox) across the five states (new · seen · acknowledged · done · expired), with the OS notification and the tray line each would become; the three-sentence rule (what happened, why it matters, what to do next) on every card; severity in orange, never red; the transitions table. Design-local components headed for the layer and the kit

c137 Phase 2: a web rendering standing in for the native app (c132 decides the medium): the inbox with the honesty line, open threads and the fold of ended ones; the settings (per kind off · inbox · tray · notify, the tray, quiet hours, mutes, the required count, what the app records); beside it the tray and the newest OS notification as the OS would post it, or dimmed with why it was held. Connected and local worlds. Shares state with the operator's page

c137 Phase 2 in the lab's qdash shell (not on the rail: c134 decides the place): the operator's inbox with what waits for an answer first and a reply box, what the plane sent with states per recipient and Recall, the honesty counter of required messages this month, and Send with the three-sentence fields, the required count and soft ceiling, the preview as the person sees it, the notification as the OS posts it, and the voice lint. A message sent here lands in the person's inbox mock

c133 Phase 3: the content collection of remediation trainings (app/data/trainings/<lang>/<slug>.md), as the lab and the API read them through one parser. Per training: title, id, policy, minutes, steps, questions, lang, version, the brand voice check on every sentence as written and as read on each finding of its policy, the slots it reads and the scenes it draws; links that open it on any of those findings in the mock; files with problems listed as withheld; the scene catalogue. Published at /api/trainings (D21)

c133 Phase 1: one remediation training in the web app's frame, reached from the finding (the strip on S1) or from the assignment message (c137 training-assignment). The first pilot, Unapproved MCP servers, written for F-A: the lesson in four steps with the illustrations drawn from the pawns and the sketch kit, every sentence filled from the finding, the policy's sanctioned list and the GRC exception; the check of four questions on the idea (all right passes, retake keeps what was right); the result with the record shown before it is written; the record in the finding's history and the audit log. ?at= assigned · lesson · check · passed · retake · recorded; ?findingId= F-C or F-S01 shows the honest absence

c133 Phase 5: the library in the lab's qdash shell, as the person sees it on the web app. The three published trainings from the collection with title, minutes, what each covers and the person's record: Assigned when a finding of theirs waits for it (Start opens the training on that finding), Recorded with the latest record, or No record. Take it on your own opens a training with no finding: filled from the reader and the policy, the steps that need a finding left out and said so, the same check, the record shown before it is written and written with no finding and no assigner (training.completed.self). ?person= picks the reader; ?take=<id>&self=lesson · check · passed · retake · recorded opens a stage; ?findingId=F-A&at=recorded seeds F-A's record

c114 S1, the spine — one finding read without its session: crumb + header with Resolve ▾, the band (status · severity at generation vs now · policy · applies via · enforcement for this subject · detected), What happened as immutable evidence, Why it violates computed from applicability() (paths, exceptions considered, still a violation now), the lifecycle organ (append-only rows with actor · time · what → state · cause → Change), related findings by policy, and the Respond aside with reach counts; Ignore (required duration, the blank-reason warning, Done / Create an exception) and Create exception (scope picker, derived preview) act against a page-local world; four states via ?findingId=

c114 S2, the worklist — the live qdash listing's pieces where they fit the model (D8): the four severity cards, the filter bar on URL state, group rows per policy (severity tag, ribbon, severity cells, harness pills, framework tags) with the policy section and the member rows on expand, the adjudication card with Ignore live; changed: Open and Resolved as independent toggles, Grouped ⇄ Individual, the group header linking to the policy, a status / resolution column, a last-event cell, the finding id linking to S1; groups with no findings under the filters disappear and the page says so; six states

c114 S3 — everything that hangs off a Policy, in its context: the policy-config shell's header, meta strip and condition disclosure (copied where they fit, D8), then Definition, Severity as the recommended / configured pair with Set and Reset, Where it applies as scope paths with specificity, enforcement at each scope, population, overlap and conflict callouts and the effective-for-a-person probe, Enforcement per scope with reach and observe-first guidance, Exceptions with resource · scope · reason · until · by and revoke, Groups, Frameworks as mapped requirements, Findings, and the History organ; every section tagged with its delivery phase; the change sheet (S6 / S8b) previews population, reach, overlaps, conflicts and what re-evaluation would do before applying; four states via ?policyId=

c114 S4 — one area, three views on the ink switch: Policies (the Control Center's category sections and rows kept, D8; severity as effective with the recommended value and an inline Reset, an Applies column replacing the activation toggle, framework tags, open findings; group by Category or Policy Group; chips for severity, capability, in scope, framework), Frameworks (the Compliance listing's row kept; one list with Tracked, derived coverage counts per framework, open findings through mapped policies), Groups (S7's list: policies, scope with population, state, enforcement summary, open); six states

c114 S5 — where the gaps are: the live framework page's title row and requirements table kept (D8) with the per-control toggles and progress bar gone; Track as a declaration that changes no policy; the summary band (requirements · derived coverage fully / partially / not · mapped policies in scope and enforced · open findings through them); the source's own term heading the table (controls, criteria, subcategories; OWASP reads items); per requirement the coverage state, each mapped policy as a PolicyTag with its status, and open findings by severity (c123, 2026-11-03: the band became DataMachines, the Gap and capability columns left; body shared with the composed mock via GovernancePartFrameworkDetail); the Gaps list never hidden; filter by coverage; five states via ?frameworkId= and ?state=overflow

c123 exploration (2026-11-03) — framework detail's summary band against three revisions composed from the newer pages' DataMachine bands: A bars (the Endpoints band: coverage, mapped policies by status, open findings by severity as segment bars), B donuts (the Team tiles), C coverage leads (ranked bars, then the Findings ledger's severity box); Tracked leaves the band; five frameworks via ?frameworkId=

c114 S7 — one group, populations not duplication: header with state, Duplicate and Retire / Activate; the band (policies · scope with population · enforcement in scope · open findings in scope · overlaps); Scope with the change sheet; Policies as references with severity, capability, enforcement in this scope, open in scope and the other groups each is also in, with Add and remove; Overlaps naming every other group that shares people, the shared policies and any equal-specificity enforcement conflict, plus the effective-policies probe for a person in scope (bold through this group); History as the organ; the change sheet (S6 reused) previews population, re-evaluation and conflicts for scope, membership, state and duplicate; four states via ?groupId=

c125 prior art: app.qpoint.io's linear wizard kit, replicated (copied, not redesigned). Steps over a Sequin in tab, centred or linear mode, with per-step overrides; EduHarness and its edu slot; the install shape (choose environment → installation in listener mode with block, PingListener waiting for the first signal → end with FinalStep), with traffic detected as a toggle; the pieces alone; what it hands c125, and what was found while copying

The tour layer over the composed mocks: five concern-led stops against the OWASP® Agentic Top 10 (1 and 2 written: Watch · Tune · Drill), a floating dark panel, rings and callouts by data-qp-id, Example instances over live cards, and drills that send a simulated violation through the alert path. The route, a Start link, and the IDs each page carries

Every tour in the order a customer meets them: Start here (install on one machine, first signal), Common AI risks (four risks, Watch then Drill), Observe, then enforce (the adoption stage, a pilot, the next team staged), AI spend (the Cost Center, $1,543 a month to find, a ceiling at Observe) and the OWASP® Agentic Top 10 (five stops, Watch · Tune · Drill · Prove). Each stop's question, its steps as links (v4 · Split · Dim) and the pages it walks; checked by scripts/tours-walk.mjs

Stories of AI going wrong, played on synthetic data in the dashboard between the person's own switch on and off: the band and the frame while it's on, wave 1's six scenarios beat by beat at three registers, Replay at Enforce as a matrix, each scenario's authored replays against the play, and the guide's contract (no tool turns theatre on or plays a beat). Checked by scripts/theatre-check.mjs

The tour panel, three ways over the same steps: v1 the dark grape panel as first built; v2 the same panel light, every word in cyan; v3 a title and a description, with the controls moved to the mock bar. Ring + Dim focus and a slow scroll to each region in v2 and v3