Source: c114 governance-phase2 — Phase 2, the surface map as blocks · 2026-10-09
Grey boxes, bob-wire grain: the eight surfaces the intents imply, each as blocks in reading order, with the intent that asks for each block. One rule from surface-map.md: every object has one home, every relationship one traversal, and every state change renders through the same lifecycle organ. Nothing here is styled; the argument is page shape.
Govern rail, proposed
Findings first (the journey starts in Observe); Policies & Frameworks as one area with three views; Groups a view, not a rail item.
Finding detail
/findings/detail?findingId=The spine. Evidence above the line, lifecycle below it, the response on the side. A finding read without opening the session.
Findings / policy / F-A. Title = policy name · resource. Joins the sticky band.
Rows append; reopen, expiry and revoke are rows, never edits.
c79 finding-detail-v1 (occurrence stream, audit record), finding-disposition-v1 (verb row); qdash AdjudicationCard, FindingsMembers; layer PageHeader, StickyBand, NavJumpPills, SeverityTag.
The organ (to extract), the Respond aside with reach counts, the "applies via" path, evidence / state as two blocks.
Unknown id · only its detect row · F-A at the end of the story (five rows) · a sanitization finding with 40 related and 12 rows.
Findings
/findingsOpen work first, grouped by the policy producing it. One table with two shapes; the switch never changes the filters.
Findings — open, grouped by policy (the default named in the subtitle).
Open on by default; Resolved includable; Open off + Resolved on = resolved only. Grouped ⇄ Individual on an ink switch; column picker on the right.
qdash /findings (FindingsFilterBar, FindingsLedger already group by control), design findings-regroup-v2, findings-status-column-v1; layer DataListingBar, UxTableListExpandRow, StateEmpty, FilterNoMatches.
Status filter semantics, the Grouped ⇄ Individual switch, the group header as a link to the policy.
Nothing open (resolved count as the hint) · filtered to nothing · the fixture, 19 in 2 groups · 400 findings in 9 groups, one collapsed.
Policy detail
/policies/detail?policyId=Everything that hangs off a Policy, configured in its context: severity, where it applies, enforcement per scope, exceptions, groups, frameworks, findings, history.
Policies & Frameworks / name · category · "Qpoint policy · v3".
Overrides, scope changes, enforcement changes, exceptions, versions. Anchors are the targets of S1's cause links.
qdash PolicyDetail (layer PolicyConfigShell), PolicyConfig shapes; design control-detail (definition / response split), policy-catalog-v3 (inline exceptions).
Recommended-vs-configured severity pair (to extract), the scope paths table, per-scope enforcement rows with reach, the organ.
Unknown id · applied nowhere (Add scope) · P-MCP (override, two groups, exception, scoped enforcement) · P-SENS-SANITIZE (org-wide confirmed, 16 findings, 3 frameworks).
Policies & Frameworks
/policies · ?view=policies | frameworks | groupsOne area, three distinct lists on an ink switch. The framework strip that activated policies retires; coverage is derived.
S7's list, embedded.
qdash ControlsPolicies (categories, toggles), ComplianceFrameworksListing; design policy-catalog v1–v3, compliance-frameworks, framework-listing; layer UxTabGroup, DataListingBar, ComplianceTag.
The three-view area; the inline Reset. Retired: the global framework strip, the "Control Center" title, custom controls and the evidence packet (to Reports).
Frameworks with none tracked · policies filtered to nothing · typical · 60 policies in 9 categories.
Framework detail
/framework?frameworkId=Where the gaps are. Capability, configuration and findings kept distinct per requirement; nothing hidden; a risk taxonomy is not a compliance standard.
name · publisher · version · type called out · tracked toggle
Derived from mapped Qpoint capability, never asserted. Qpoint alone satisfies nothing unless explicitly supported.
qdash FrameworkHeader, FrameworkRequirements; design framework-detail (addressability column).
Coverage states and gap reasons replace the completeness bar; per-control toggles leave (configuration happens on the Policy).
Untracked · zero mapped policies · OWASP LLM (fixture) · ISO 27001 with 93 requirements, filter on.
Scope & enforcement change
sheetOne flow for both, because the preview is the same: what will this touch, before the button.
The audit line as it will appear in History. Result: a Change; S3 rows update; enforcement counts configured → confirmed.
design policy-config-egress-allowlist (scoped entries); layer UxModal.
The change-preview panel (to extract; reused by S7 and S8b).
Scope with no population (warn) · already covered by a group (duplicate path) · a conflict · typical (Team Legal added; Finance enforced).
Policy Groups
/policies/groups · /policies/groups/detail?groupId=Populations, not duplication. A group references policies and carries a scope; overlaps are named, never hidden.
name · purpose · state
Membership, scope and state changes.
Nothing in qdash; design framework-picker-ideas (compact pickers); the S3 blocks.
The whole surface. Lifecycle states (draft · active · disabled · retired) are the open question.
No groups ("policies apply directly until you need populations") · a draft with no scope · Engineering (overlaps the baseline) · retired, read-only with its history.
Resolve with Ignore · Create exception
sheetsThe decided flow from the Ignore intent, and the missing Exceptions intent drafted as its secondary action.
Blank → "Providing a reason is a best practice for compliance…" with Confirm · Cancel · Don't ask again (per practitioner).
After success: Done (primary) · Create an exception (secondary). The policy is untouched; future matching activity still evaluates.
A Change; re-evaluation runs; S1's organ gains its row. Resolved: Enforced has no sheet — it is a system row linked to its Change (D3).
design finding-disposition-v1 (reason / expiry capture), policy-config-agent-registration (carve-out with reason + expiry); layer UxModal, UxInput, UxSelect.
The warning with Don't ask again; the Done / Create an exception pair; the exception builder with the preview.
Blank reason (the warning) · indefinite · F-C until 31 Oct (fixture) · an exception that would resolve 0 findings.
Intents × surfaces
● primary · ○ secondary. Every intent has one primary surface; nothing is homeless. Re-evaluation has no page: it is organ rows and preview counts.
Composition notes
- Scope, Enforcement, Exceptions and Change are not pages. They are configuration of a Policy and read in its context; a top-level Scopes page would be engine parts exposed.
- One flow for scope and enforcement changes (S6), because the preview is the same: population, broadens or narrows, overlaps and conflicts, findings that would re-evaluate. S8b reuses the preview.
- The organ is the same component in the same place on S1, S3 and S7, and the Apply step of every sheet shows the row it will gain.
- Frameworks stop activating policies. The strip that drove the Control Center goes; coverage is derived from mappings and configuration happens on the Policy.
- The eight mocks follow in this order; each renders the fixture world's four states (empty · minimal · typical · overflow).