Phase 4
Findings
Source: c114 governance-phase2 — S2, the worklist · surface-map.md §5 · 2026-10-09
The live qdash listing's pieces where they fit the model (D8): the severity cards, the filter bar, the group rows with their expand, the member rows and the adjudication card. What changed: Open and Resolved are independent toggles (Open on by default), a Grouped ⇄ Individual switch, the group header links to the policy, a status / resolution column, and the finding id links to its own page. Rendered from the fixture world at the story's end; Ignore acts for real.
statetypical — the story's end: 5 open in 2 policies; Open on, grouped
Findings
Open findings, grouped by the policy producing them. Every finding is independently addressable; grouping never merges them.
8 of 22 findings · 5 policies
Severity | Findings | Harnesses | Relevant Frameworks | |
|---|---|---|---|---|
| critical | Credentials must not be sent to a model P-CREDENTIALS · Data handling | 1 High 1 past SLA |  Cursor CLI |  OWASP LLMOWASP AgenticNIST AI RMFSOC 2 |
| high | Sensitive information sanitized before transmission P-SENS-SANITIZE · Data handling | 4 High 4 past SLA | Cursor CLIClaude Code | OWASP LLMOWASP AgenticNIST AI RMFExample: everything at idealISO 27001SOC 2 |
| high | Personal account is in use P-ACCT · Identity | 1 High | Claude Code | OWASP AgenticNIST AI RMFExample: everything at idealSOC 2 |
| medium | Prompts are inspected for injection and leakage P-PROMPT-INSPECT · Data handling | 1 Med | Claude Code | OWASP LLMOWASP AgenticNIST AI RMFExample: everything at ideal |
| medium | Consequential tool calls require approval P-TOOL-APPROVAL · Agents & harnesses | 1 Med | Claude Code | OWASP LLMOWASP AgenticNIST AI RMFSOC 2 |
1 policy has no findings under these filters and is not listed.
Composition notes
- Kept from the live page (D8): the four cards (past SLA as the fourth), the filter bar's shape and its URL state, the group row (severity tag with ink while open, ribbon, severity cells, harness pills, framework tags), the two expand sections, the member rows, the adjudication card's verb-then-capture pattern, the SLA clock. Live: Ignore with its required duration; Create exception and Block hand to S1 / S6.
- Changed: Open · Closed · All → Open and Resolved as independent toggles; the status word is Open / pending / Resolved: type; the handling select is gone (the c79 flag can return if asked); "control" reads Policy everywhere and the group header links to the policy.
- Added: Grouped ⇄ Individual on the ink switch (never changes the filters), a status / resolution column and a last-event cell on members, the finding id as a link to S1.
- Groups with no findings under the filters disappear and the page says how many ([findings] open question, answered). Groups open collapsed (the live default; the other open question). Severity on the group is the highest open severity, with the cells as the distribution.
- States: ?state=empty · ?q=zzz (filtered to nothing) · default · ?status=open,resolved · ?view=individual · ?state=overflow (400 findings over eight policies). Harness pill caps are flat (two + N) here; the live page's responsive tiers come back at port time.