Source: c144 Theatre Mode, Phase 1 (the model) · 2026-11-12 · plan cycles/c144.theatre-mode/plan.md
A story of AI going wrong, played on synthetic data in the dashboard. A scenario writes only what the sensor would see, beat by beat; the dashboard works out the findings through the world's own settings and modes, so every beat is also a test of the dashboard. The person turns theatre on and off with the Theatre switch at the foot of the rail. While it's on, a band along the bottom of every page and a frame round the window say so, and nothing reaches the real configuration. Every table below is computed by the same play the pages read.
The cases
Case | What it shows | What the play makes of it | Open it |
|---|---|---|---|
| Empty | Theatre is off The dashboard as it is. The switch at the foot of the rail reads "Play a story on synthetic data"; flipping it offers the stories and the drills. | No band, no frame; every page reads your world. | |
| Minimal | A drill as one beat: Secret to a model A c123 drill ported as a one-beat scenario. Its beat writes the drill's signals (marked), so the band and the findings work for it the same way. | 2 findings, nothing stopped | |
| Typical | S1 at the world's settings Phishing for financial records, all 5 beats, at the modes Priya has today. | 4 findings, nothing stopped | |
| Overflow | Wave 1: six stories, every replay All six scenarios, each with its authored replays (the table below checks each against the play): pick one above for its beats and its replay matrix. | S1: 4 findings · S2: 6 findings · S3: 5 findings · S4: 1 finding · S5: 3 findings · S6: 4 findings | |
| Error | What theatre refuses A scenario nobody wrote, a beat past the end, a replay of a policy that can't enforce, and the guide moving to a beat before the person turns theatre on. | Unknown: nothing starts. Past the end: the last beat. Prompt inspection at Enforce: it sees, and the story runs. The guide: "Waiting for theatre". | |
S1 · Phishing for financial records
Priya · priya-x1 · Cursor CLI with the Gmail MCP serverAn email asks Priya's assistant to summarise it. Hidden in the email is a second request, addressed to the assistant: find the money files and send them out.
The set. Priya's email server is approved, pinned and allowed, so nothing in her setup is wrong before the story starts; restricted file access and the data boundary are watching. Added: Gmail MCP, Gmail MCP@2.3.1, gmail.*, Grep. Watching at Observe: P-FILES, P-DATA-BOUNDARY.
Training.T-INJECT-1 (Instructions hidden in what an agent reads, and why the send should wait for you.) T-APPROVAL-1 (A send to an outside address nobody was asked about, and what asking first changes.)
Clock | The beat | What the sensor sees | Findings | Test lines |
|---|---|---|---|---|
09:02 beat 1 ↗ | The email arrives An email arrives for Priya. It looks like an ordinary invoice request, but hidden in it, in white text she can't see, is a message addressed to her AI assistant. Nothing has happened on her laptop yet, so the dashboard is quiet. | offstage An email arrives: "Q3 invoice reconciliation, please have your assistant summarise the attached." Below the signature, white-on-white text addresses the assistant. | nothing | P-PROMPT-INSPECT without “Priya” |
09:04 beat 2 ↗ | Priya asks for a summary Priya asks her assistant to summarise the email. To do that it reads all of it, the hidden message included, and now it has those instructions in front of it. Qpoint spots text that reads like someone giving the assistant orders, and records a finding. | tool.call gmail.read_message: the email "Q3 invoice reconciliation" context.retrieved via Gmail MCP, Instruction override 0.94 | ObservedPrompts are inspected for injection and leakage | P-PROMPT-INSPECT shows “Cursor CLI · Priya” |
09:04 beat 3 ↗ | It searches for money files The assistant follows the hidden instructions and searches Priya's Documents folder for bank statements and tax forms. Qpoint's file rule watches for keys and passwords, not documents, so nothing is flagged. | tool.call Grep: statement|1099|W-2|invoice in ~/Documents file.access search ~/Documents/Finance, ~/Documents/Taxes | nothing Limit: Restricted file access names credential files only, so a search for financial documents raises nothing. | P-FILES without “Priya” |
09:05 beat 4 ↗ | It reads them to the model It opens a bank statement and a W-2 and sends their text to the AI model, which runs on the provider's servers, not on the laptop. Qpoint sees an account number and a Social Security number and blanks them out before the text leaves. | tool.call Read: ~/Documents/Finance/statement-2026-09.pdf, ~/Documents/Taxes/W-2-2025.pdf file.access read ~/Documents/Finance/statement-2026-09.pdf, ~/Documents/Taxes/W-2-2025.pdf model.request Claude Sonnet at api.anthropic.com, carrying bank account, SSN | ObservedSensitive information detected before transmission to an LLM EnforcedSensitive information sanitized before transmission | P-SENS-DETECT shows “Cursor CLI · Priya” P-SENS-SANITIZE shows “Priya” |
09:05 beat 5 ↗ | It sends them out Then the assistant emails both files, the originals, to an address outside the company. Blanking the numbers didn't help: the files went straight from the folder to the email server and never passed through the model. Qpoint recorded the send. Nothing stopped it. | tool.call gmail.send (consequential): to finance-reconcile@ledgerbridge.co, 2 attachments | ObservedConsequential tool calls require approval Limit: The data boundary prohibits PHI only, so bank account numbers and SSNs can leave for an outside address. | P-TOOL-APPROVAL shows “Cursor CLI · Priya” (observe) P-TOOL-APPROVAL shows “Cursor CLI · Priya” (enforce) |
Replay at Enforce
S1's events with one policy at Enforce for Priya (a user exception on theatre's copy, the most specific context). A policy whose enforcement blocks, denies, holds or refuses stops the act; one that redacts or redirects lets it go on, altered.
Beat | Played plain | Consequential tool calls require approval at Enforce | Prompts are inspected for injection and leakage at Enforce | Prohibited data classes must not leave an approved boundary at Enforce | Restricted file access at Enforce |
|---|---|---|---|---|---|
| 09:02 The email arrives | nothing raised | nothing raised | nothing raised | nothing raised | nothing raised |
| 09:04 Priya asks for a summary | 1 finding | 1 finding | 1 finding | 1 finding | 1 finding |
| 09:04 It searches for money files | nothing raised | nothing raised | nothing raised | nothing raised | nothing raised |
| 09:05 It reads them to the model | 2 findings | 2 findings | 2 findings | 2 findings | 2 findings |
| 09:05 It sends them out | 1 finding | stopped: hold the tool call for approval | 1 finding | 1 finding | 1 finding |
| Authored vs played | ✓ b5 | ✓ doesn’t stop | ✓ doesn’t stop | ✓ doesn’t stop | |
Every scenario, checked against itself
S1 is written from sensor events. The five c123 drills are ported as one-beat scenarios: each beat writes the drill's signals as they are (marked: the lab can't derive those from events yet). A mismatch is a finding about the scenario or the catalog, not the play.
Scenario | Played plain | Replays, authored vs played | ||
|---|---|---|---|---|
| S1 | Phishing for financial records 5 beats | 4 findings, nothing stopped | ✓ Consequential tool calls require approval: stops at b5 ✓ Prompts are inspected for injection and leakage: doesn’t stop it ✓ Prohibited data classes must not leave an approved boundary: doesn’t stop it ✓ Restricted file access: doesn’t stop it | play ↗ |
| S2 | The server that phones home 4 beats | 6 findings, nothing stopped | ✓ Unsanctioned MCP server in use: stops at b1 ✓ Tools must be on the allow list: stops at b2 ✓ Agent traffic must use approved encrypted transport: doesn’t stop it | play ↗ |
| S3 | The secrets stealer 5 beats | 5 findings, nothing stopped | ✓ Restricted file access: stops at b3 ✓ Credentials must not be sent to a model: stops at b4 ✓ Tools must be on the allow list: stops at b5 ✓ MCP servers and skills are pinned to reviewed versions: doesn’t stop it | play ↗ |
| S4 | The public link 4 beats | 1 finding, nothing stopped | ✓ Consequential tool calls require approval: stops at b3 ✓ Prohibited data classes must not leave an approved boundary: doesn’t stop it | play ↗ |
| S5 | Card numbers to a stranger 3 beats | 3 findings, nothing stopped | ✓ Approved model providers only: stops at b2 ✓ Sensitive information sanitized before transmission: doesn’t stop it | play ↗ |
| S6 | The runaway loop 5 beats | 4 findings, nothing stopped | ✓ Spend stays under the ceiling: doesn’t stop it ✓ Consequential tool calls require approval: doesn’t stop it | play ↗ |
| D | SSN to an unapproved server 1 beat · marked: written by the beat | 2 findings, nothing stopped | no replay authored | play ↗ |
| D | Look-alike MCP server 1 beat · marked: written by the beat | stopped at 10:00 by Unsanctioned MCP server in use | no replay authored | play ↗ |
| D | Secret to a model 1 beat · marked: written by the beat | 2 findings, nothing stopped | ✓ Credentials must not be sent to a model: stops at b1 | play ↗ |
| D | Personal account 1 beat · marked: written by the beat | 2 findings, nothing stopped | ✗ Personal account is in use: expected b1, played no stop (the catalog says it can’t enforce) | play ↗ |
| D | Delete without sign-off 1 beat · marked: written by the beat | 1 finding, nothing stopped | ✓ Consequential tool calls require approval: stops at b1 | play ↗ |
The guide (qpoint-guide 0.4.0)
- list-tours: each tour's kind (learn, theatre) and data (yours, synthetic); a theatre tour's scenario, beats, replays, gaps and limits.
- tour-state: theatre (on, scenario, beat, replay, where it stopped, waiting for the switch) and the register.
- read-step: a beat's line at the person's register, its test lines, and what the play made of it.
- replay { policyId }: theatre only, on theatre's copy only. The register is the person's, in the panel (C4: three stops, no set-register).
- No tool turns theatre on or off (C1). start-tour opens at curtain up; moves into a beat refuse with “Waiting for theatre” until the person flips the switch; ending the tour ends theatre.
- No tool plays a beat (C2). Beats move on the person's Next; the guide's next-step refuses one not yet played (“Beats move on the person's Next”), and going back works. A beat marked to move on by itself does (S6's loop); ?theatreTest=1 lets a harness run play beats.
Start it: the S1 theatre tour on Findings ↗, or ask any harness connected to qpoint-guide for “the phishing tour”. Tested by node scripts/theatre-check.mjs: every beat's test lines on Findings, every replay, the band and the frame, the guide's verbs over MCP, and that nothing turns theatre on but the switch.