Source: c78 fleet-overview-reports — the shared report anatomy, shown at Compliance depth, 2026-08-21
One chassis, four reports. Every report wears the same six organs: header → verdict → body → export → snapshot shelf → the document face. This page defines the chassis on the richest instance (Compliance — auditor-facing, per-framework); the other three reports are instances, not new designs. The observation period is the report's time cursor — switch it and every number on the page reframes.
Header — identity + the time cursor
Who this report is for, what it covers, and the observation period — a first-class control, not a filter buried in a menu. "12 months is usually the standard" for the auditor window; 3 and 6 months are working views. The period is one stored series, sliced — never re-authored.
Compliance Report
Meridian · SOC 2 Type II · AI agent estate · observation period rollingVerdict band — score + trajectory
Current state and time series, always together: "current state score, yes, obviously it's essential, but it is good to have that information in time series form — we wanna know if we're moving the needle." A score without its trajectory is half a verdict.
Body — controls + attached evidence
The evidence-collection pattern: go back to the start of the observation period, gather everything in scope, attach it to the control it proves. Every row expands into its period-scoped evidence — the report doesn't claim, it shows. Rows link onward: controls to their policy config, evidence to the specific agent session.
Export bar — human + machine, scheduled
Dashboard-first, "and then from there, let me export the report or schedule reports." Two faces of one report: a PDF you can hand someone, and JSON/CSV that stands beside Wiz and Aikido exports in a CISO's aggregate posture. Scheduling produces the shelf below.
Snapshot shelf — the auditor evidence trail
Retained, re-runnable snapshots: "I could set up reports in Wiz, and it'll retain the last whatever, and I could rerun… and then I'll grab that file." Each snapshot is the report frozen at its run — the file you hand the auditor. Re-running an old window and matching the retained score is the consistency check.
Open thread (c78): snapshot diff — re-run implies compare; not designed yet.
The document face — the artifact is a design surface
What "Export PDF" actually produces — designed, not generated as an afterthought. Paper register: it stays white in dark mode because it's an artifact, not a surface. Beside it, the machine face: the JSON shape a CISO's aggregation scripts consume.
Compliance Report — SOC 2 Type II
Meridian · observation period Sep 2025 – Aug 2026 · generated Aug 1, 2026
| Control | Requirement | Status |
|---|---|---|
| CC6.1 | Logical access to sensitive data restricted | FAILING |
| CC6.6 | Egress restricted to approved destinations | ATTENTION |
| CC6.8 | Unauthorized software detected and onboarded | ATTENTION |
| CC7.2 | Agent activity monitored for anomalies | PASSING |
| CC7.3 | Security events evaluated and triaged | PASSING |
| CC8.1 | Configuration changes authorized and logged | ATTENTION |
Generated by Qpoint from 576 evidence items · snapshot retained and re-runnable · appendix: full evidence set, CMP-2026-08.pdf
{
"report": "compliance",
"org": "Meridian",
"framework": "soc2",
"snapshot": "CMP-2026-08",
"observation": {
"period": "12mo",
"window": "Sep 2025 – Aug 2026"
},
"score": {
"passingPct": 83,
"delta": -4
},
"controls": [
{
"id": "CC6.1",
"status": "failing",
"evidence": 41
},
{
"id": "CC6.6",
"status": "attention",
"evidence": 128
}
],
"…": "4 more"
}"I grab my SLA insights from Aikido, the same from Wiz, and the same from you guys — together they are my continuous monitoring status." The schema is the composability contract.
Chassis rulings
- Organs 1–4 are one object — header, verdict, body, and export bar share a border and read as a single report; shelf and document face are its history and its artifact.
- The period is a cursor, not a filter — one stored 12-month series, sliced (`slicePeriod`); switching windows never re-fetches or re-authors.
- Evidence is sampled on screen, complete in the artifact — the dashboard shows enough to trust; the export carries the full set.
- Verdicts are derived — the score is `complianceScore(controls)`, the card summaries downstream reuse the same functions. Nothing on this page is hand-typed twice.
- Instances may swap the body grain (controls → findings → assets → highlights) but never the organ order.