From 842b9cffcb1407541e7fe68bab611a56f87a1f4f Mon Sep 17 00:00:00 2001
From: Richard Hope <richmhope@gmail.com>
Date: Tue, 21 Jul 2026 18:37:26 +1000
Subject: [PATCH 1/2] =?UTF-8?q?feat(ux):=20P0=20of=20the=20UX=20review=20?=
 =?UTF-8?q?=E2=80=94=20header=20markings,=20actionable=20dashboard,=20/adm?=
 =?UTF-8?q?in=20hub,=20notebook=20phases?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implements the four P0 items from the Claude Design UX handoff
(design_handoff_iceberg_ux/README.md) as template + CSS + Alpine changes on the
existing stack. No route removed, no asset pin touched, no new design tokens.

Editor · markings promoted to the header. Intel level, TLP and analytic
confidence move out of the Citations dock footer into always-visible chips, so a
product's markings are one source of truth and are legible while writing. Each
chip lays its real <select form="reportform"> transparently over itself: a click
opens the native dropdown, so it stays keyboard/screen-reader navigable and
renders correctly before Alpine hydrates. The component only mirrors the chosen
option's own text back into the chip, so there is no label map to drift from the
enums.

Dashboard · actionable. Every KPI card links to the work behind it, and a "Needs
you now" queue leads: the review queue (for anyone who can review) ahead of the
viewer's own drafts, capped at five. Both halves are existing lifecycle state
surfaced as actions — no new model. Notebook creation is demoted to a collapsed
<details> so content leads.

Admin · Settings & integrations hub at GET /admin. One tile per configurable
subsystem with a live status pill, grouped Outbound integrations / Governance.
Status comes from effective_config.admin_hub_tiles(), which reads the same
settings singletons the config pages edit, so the hub cannot disagree with the
page it links to. The pill separates OFF (opt-in integration disabled) from NOT
CONFIGURED (enabled but missing an endpoint or its env-only secret) — the state
an operator most needs flagged. Secrets are consulted as set/not-set only.

Notebook · phase tabs. The nine stacked sections become Collect / Analyze /
Produce / Trace, one phase at a time, with the collection strip re-cut as the tab
bar. Nothing is gated: the tabs are real #section anchors, Collect is the
server-rendered default, and a <noscript> rule cancels x-cloak so a browser
without Alpine still gets every section.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ARCHITECTURE.md                            |   8 +-
 CLAUDE.md                                  |   4 +-
 src/iceberg/services/effective_config.py   | 203 +++++++++++++++++++++
 src/iceberg/static/css/iceberg.css         | 109 ++++++++---
 src/iceberg/static/js/tags.js              |  37 ++++
 src/iceberg/templates/admin_home.html      |  48 +++++
 src/iceberg/templates/base.html            |   3 +
 src/iceberg/templates/dashboard.html       |  73 ++++++--
 src/iceberg/templates/notebook_detail.html | 193 ++++++++++----------
 src/iceberg/templates/report_edit.html     |  84 +++++----
 src/iceberg/web/__init__.py                |   1 +
 src/iceberg/web/admin_home.py              |  35 ++++
 src/iceberg/web/notebooks.py               |  40 ++++
 tests/test_admin_home.py                   | 133 ++++++++++++++
 tests/test_dashboard_counts.py             | 113 +++++++++++-
 tests/test_portal.py                       |  65 +++++++
 vulture_whitelist.py                       |   4 +
 17 files changed, 974 insertions(+), 179 deletions(-)
 create mode 100644 src/iceberg/templates/admin_home.html
 create mode 100644 src/iceberg/web/admin_home.py
 create mode 100644 tests/test_admin_home.py

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index b37cce8..ff9735c 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -120,6 +120,8 @@ Security-relevant events are **persisted locally** (the `AuditEvent` table — t
 
 **Effective configuration (`services/effective_config.py`, `web/admin_config.py`, read-only `/admin/config`).** An admin-only viewer that answers "what config is this process using, where did each value come from, and which optional features are available?" without shell access. `snapshot(session)` introspects the pydantic `Settings` **and** the six admin-editable DB settings rows (Audit/Proxy/MISP/Webhook/AI/OIDC), emitting one row per operationally-meaningful field with a **provenance** — `database` (a settings row is authoritative), `environment` (`settings.model_fields_set`), or `built-in default`. **Secrets never cross the boundary**: a field in the explicit secret set is coerced to a plain `set`/`not set` string server-side (no value or prefix serialised). It also re-runs the prod boot-guards (`config._guard_production`'s checks) **non-fatally** to list every issue, surfaces startup advisories (no-login-path, console-email-in-prod, in-memory-rate-limit-in-prod), and renders feature-capability tiles (environment, AI backend, enabled SSO providers, dev-login, rate limiting, email, RSS poll, MISP/webhook, Typst-available). The page is server-rendered with a CSP-safe Alpine text filter (`configFilter` in `tags.js`, rows carry a `data-search` attribute — no JSON island needed). Read-only: no model, no save path.
 
+**Settings & integrations hub (`web/admin_home.py`, `templates/admin_home.html`, `/admin`).** The map on top of the deep config pages: one tile per admin-configurable subsystem (AI, MISP, proxy, RSS, webhook, SSO under *Outbound integrations*; audit/SIEM and effective config under *Governance*), each with a status pill and a link in, plus the two curation screens (taxonomy, audience groups). Status comes from `effective_config.admin_hub_tiles(session)`, which reads the *same* settings singletons the config pages themselves edit, so the hub can never disagree with the page it links to — it owns no state and has no save path. The pill distinguishes **OFF** (opt-in integration disabled) from **NOT CONFIGURED** (enabled but missing an endpoint or its env-only secret), which is the state an operator most needs flagged: it looks on but cannot deliver. Secrets are only ever consulted as set/not-set, never rendered.
+
 **Admin-configurable (`web/admin_audit.py`, `templates/admin_audit.html`).** Runtime routing config lives on the single `AuditSettings` DB row (enable, chosen methods, min severity, file path, syslog host/port/protocol/facility, http endpoint, verify-TLS), edited live at the admin-only **`/admin/audit`** console (settings form + filterable event trail + "Send test event"). **Secrets stay in env** (`ICEBERG_AUDIT_HTTP_TOKEN`) and are never written to the DB; `services/audit_settings.py` seeds the row from `ICEBERG_AUDIT_*` env defaults on first read. Rail link (`ic-audit`) is admin-only.
 
 ### Frontend / design system
@@ -133,7 +135,11 @@ The portal is a **"command-center" design** — a light, print-like, authoritati
 
 **⌘K command palette.** An additive Alpine overlay in `base.html` (jump-to over the role's nav items, built as a Jinja `jump_items` list); ⌘K/Ctrl-K or the topbar trigger opens it, arrow keys + Enter navigate, Esc closes. It follows the combobox/listbox dialog pattern: focus stays in the palette while open, the active result is exposed with `aria-activedescendant`, and focus returns to the invoking control on close. No backend dependency (live `/api/search` results are a noted future hook).
 
-**Report editor (`report_edit.html`).** A full-height 3-pane workspace (`.editor-shell`): a command header (inline title + lifecycle flow + save-state + Submit/Approve/Publish), then a `1fr 1fr 340px` grid of **markdown ∣ live preview ∣ docked tabbed panel** (Citations · Tags · AI review for editable drafts · Reqs · Audience for admins · Render), with intel-level/TLP/confidence pinned to the dock footer. The dock uses standard tab/tablist/tabpanel semantics with arrow/Home/End roving selection; the taxonomy picker is a combobox/listbox with keyboard add, removal and dismissal. The AI review tab requests advisory judgement, controlled-tag and analytic-challenge suggestions only: analysts edit them locally, explicitly apply them through the ordinary report/tag save flows, and accepted report fields receive AI provenance after a successful save. Disabled/TLP/provider messages remain inline and fail-soft. The markdown pane's **Insert ▾** toolbar drops `[[diamond|figure|ach:ID]]` tokens at the cursor. The single product `<form id="reportform">` is wired across header/pane/footer via the HTML `form=` attribute (no nested forms); it keeps the existing per-section POSTs and live-preview `POST /api/preview/product` binding verbatim, plus **debounced autosave** (1.2s) to the same `/reports/{id}` endpoint behind the header save-state indicator.
+**Report editor (`report_edit.html`).** A full-height 3-pane workspace (`.editor-shell`): a command header (inline title + **marking chips** + lifecycle flow + save-state + Submit/Approve/Publish), then a `1fr 1fr 340px` grid of **markdown ∣ live preview ∣ docked tabbed panel** (Citations · Tags · AI review for editable drafts · Reqs · Audience for admins · Render). Intel level, TLP and analytic confidence are the header chips and *only* the header chips — one source of truth, always visible while writing. Each chip lays its real `<select form="reportform">` transparently over itself, so a click opens the native dropdown: no popover code, keyboard- and screen-reader-navigable, and correct before Alpine hydrates (the component only mirrors the chosen option's own text back into the chip, so there is no label map to keep in sync with the enums). The dock uses standard tab/tablist/tabpanel semantics with arrow/Home/End roving selection; the taxonomy picker is a combobox/listbox with keyboard add, removal and dismissal. The AI review tab requests advisory judgement, controlled-tag and analytic-challenge suggestions only: analysts edit them locally, explicitly apply them through the ordinary report/tag save flows, and accepted report fields receive AI provenance after a successful save. Disabled/TLP/provider messages remain inline and fail-soft. The markdown pane's **Insert ▾** toolbar drops `[[diamond|figure|ach:ID]]` tokens at the cursor. The single product `<form id="reportform">` is wired across header/pane/footer via the HTML `form=` attribute (no nested forms); it keeps the existing per-section POSTs and live-preview `POST /api/preview/product` binding verbatim, plus **debounced autosave** (1.2s) to the same `/reports/{id}` endpoint behind the header save-state indicator.
+
+**Dashboard (`dashboard.html`, `web/notebooks.py`).** Every KPI card is a link to the work behind it, and a **"Needs you now"** queue sits above the fold: the products waiting on a reviewer (for anyone who can review) ahead of the viewer's own drafts, capped at five. Both halves are existing lifecycle state (`Report.status` / `author_id`) surfaced as actions — no new model, no new query pattern. Notebook creation is demoted to a collapsed `<details>` so content leads.
+
+**Notebook phases (`notebook_detail.html`, `notebookTabs` in `tags.js`).** The notebook is worked in phases rather than scrolled end to end: the nine sections are grouped into **Collect** (sources, notes, files, figures, indicators) · **Analyze** (Diamond, ACH) · **Produce** (products) · **Trace** (requirements), and one phase's sections render at a time. The old anchor-link collection strip becomes the phase tab bar, carrying the same per-section counts. Nothing is removed or gated: the tabs are real `#section` anchors, the server renders Collect as the default (the other phases are `x-cloak`ed), and a `<noscript>` rule cancels `x-cloak` so a browser without Alpine still gets every section on one page — exactly the previous behaviour.
 
 This is a skin + layout reorganisation over the same routes/forms/Alpine bindings (`tagPicker`/`taxonomyFilter`, the preview/ach/diamond `x-data` blocks, citation autosave) — no behavioural coupling. **Two additive read-only index routes** back the rail: `GET /notebooks` (`notebooks_list.html`, writer-only) and `GET /tags` (`entities_list.html`, named-threat entity browse).
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 30a2988..060d82c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -91,9 +91,9 @@ src/iceberg/
   web/             # portal routes (Jinja2): common (shared router + guards/helpers) + domain modules
                    #   (notebooks, analytics [diamond/ACH], reports, requirements, feed [stakeholder dissemination],
                    #    feeds [analyst RSS reader], discovery [search/taxonomy/audience], admin_audit, admin_feeds [RSS config],
-                   #    admin_proxy [outbound proxy config], admin_oidc [multi-provider SSO config], admin_ai [AI provider config], admin_misp [MISP push config], admin_webhook [publication webhook config], admin_config [read-only effective-config viewer])
+                   #    admin_proxy [outbound proxy config], admin_oidc [multi-provider SSO config], admin_ai [AI provider config], admin_misp [MISP push config], admin_webhook [publication webhook config], admin_config [read-only effective-config viewer], admin_home [/admin Settings & integrations hub: status-pill tiles over the config pages])
   auth/oidc/       # multi-provider OIDC adapters (base StandardOIDCAdapter + registry + entra/authentik/auth0/okta claim extraction)
-  services/        # users (OIDC provisioning keyed on (auth_provider,issuer,sub)), oidc_settings (multi-provider config row + enabled_providers resolver, env-only secrets), notebooks, lifecycle, citations/rendering (reports), publication (immutable publish snapshots + atomic publish), requirements, attachments, figures, upload_validation (magic-byte content sniffing for uploads), source_grading (offline Admiralty heuristic), diamond, ach, iocs (light-touch IOC staging CRUD + AI-candidate normalisation: refang + IOCType constraint), product_html (shared report-HTML assembler + inline-embed registry), dissemination (feed delivery + email/webhook job enqueue), jobs (durable OutboxJob outbox: enqueue/lease/retry + worker pass), singleton (conflict-safe settings-row seeding), webhook_settings (publication-webhook config row, env-only token), email, feed (stakeholder feed helpers), feedback (intel-cycle feedback loop / RFI-satisfaction), feeds (inbound RSS ingestion: admin CRUD + bounded SSRF-guarded fetch/parse/sanitise + send-to-notebook), inbound (writer-triggered TAXII/MISP pull → notebook sources/IOCs), misp + misp_settings (outbound MISP push: report indicators → one MISP event, env-only API key), proxy + proxy_settings (global outbound-proxy resolution for httpx), tags, search (FTS dispatch + paginated search_page), attack (ATT&CK Navigator export + coverage matrix), attack_import (Enterprise ATT&CK bundle → TECHNIQUE tags), stix, taxii (read-only TAXII 2.1-shaped serving), related, audience (fail-closed audience-group mutations), ai + ai_settings (governed AI assist + admin-editable provider config row, env-only key, resolver overlays row onto Settings), tradecraft (advisory estimative-language lint), maturity (CTI program maturity & effectiveness dashboard), audit + audit_settings + siem (security audit logging → SIEM), effective_config (read-only resolved-config snapshot for /admin/config: provenance + secret-redaction + prod-guard validation + feature tiles)
+  services/        # users (OIDC provisioning keyed on (auth_provider,issuer,sub)), oidc_settings (multi-provider config row + enabled_providers resolver, env-only secrets), notebooks, lifecycle, citations/rendering (reports), publication (immutable publish snapshots + atomic publish), requirements, attachments, figures, upload_validation (magic-byte content sniffing for uploads), source_grading (offline Admiralty heuristic), diamond, ach, iocs (light-touch IOC staging CRUD + AI-candidate normalisation: refang + IOCType constraint), product_html (shared report-HTML assembler + inline-embed registry), dissemination (feed delivery + email/webhook job enqueue), jobs (durable OutboxJob outbox: enqueue/lease/retry + worker pass), singleton (conflict-safe settings-row seeding), webhook_settings (publication-webhook config row, env-only token), email, feed (stakeholder feed helpers), feedback (intel-cycle feedback loop / RFI-satisfaction), feeds (inbound RSS ingestion: admin CRUD + bounded SSRF-guarded fetch/parse/sanitise + send-to-notebook), inbound (writer-triggered TAXII/MISP pull → notebook sources/IOCs), misp + misp_settings (outbound MISP push: report indicators → one MISP event, env-only API key), proxy + proxy_settings (global outbound-proxy resolution for httpx), tags, search (FTS dispatch + paginated search_page), attack (ATT&CK Navigator export + coverage matrix), attack_import (Enterprise ATT&CK bundle → TECHNIQUE tags), stix, taxii (read-only TAXII 2.1-shaped serving), related, audience (fail-closed audience-group mutations), ai + ai_settings (governed AI assist + admin-editable provider config row, env-only key, resolver overlays row onto Settings), tradecraft (advisory estimative-language lint), maturity (CTI program maturity & effectiveness dashboard), audit + audit_settings + siem (security audit logging → SIEM), effective_config (read-only resolved-config snapshot for /admin/config: provenance + secret-redaction + prod-guard validation + feature tiles; also `admin_hub_tiles` — the per-subsystem status pills behind /admin)
   rendering/       # markdown->HTML, report->PDF (typst), svg (shared diagram helpers: escape/fonts/wrap/placard)
   data/            # starter_tags.json (importable starter taxonomy)
   templates/       # Jinja2 + Alpine: base (command-center shell: rail+topbar+canvas+⌘K palette), _glyph, _macros,
diff --git a/src/iceberg/services/effective_config.py b/src/iceberg/services/effective_config.py
index c353514..5a00708 100644
--- a/src/iceberg/services/effective_config.py
+++ b/src/iceberg/services/effective_config.py
@@ -18,7 +18,10 @@
 import shutil
 from dataclasses import asdict, dataclass
 
+from sqlmodel import col, select
+
 from ..config import _INSECURE_DEFAULT_SECRET, get_settings
+from ..models import Feed, ProxyMode
 from . import (
     ai_settings,
     audit_settings,
@@ -250,6 +253,206 @@ def _advisories(s, providers: list[str], ai_row, ai_errors: list[str]) -> list[s
     return out
 
 
+@dataclass(frozen=True)
+class HubTile:
+    """One subsystem on the ``/admin`` Settings hub: where to configure it, what
+    state it is in right now, and one line of context."""
+
+    group: str  # "Outbound integrations" | "Governance"
+    title: str
+    href: str
+    status: str  # short pill label (OFF / ENABLED / 3 ACTIVE …)
+    tone: str  # tag modifier: is-neutral | is-warn | is-ok
+    meta: str
+
+
+def admin_hub_tiles(session) -> list[dict]:
+    """Status pills for the ``/admin`` hub — one per admin-configurable subsystem.
+
+    Reads the same settings singletons the deep config pages own, so the hub can
+    never disagree with them, and it introduces no new state. Secrets are only
+    ever reported as set/not-set (an unset env key is what makes an otherwise
+    "enabled" integration NOT CONFIGURED).
+    """
+    s = get_settings()
+    ai = ai_settings.get(session)
+    # Same discipline as the /admin/config AI tile: report what the runtime will
+    # actually use. ``ai_settings.resolve`` fail-closes an invalid selection to
+    # "none", so a green pill on a row that says "openai" would be a lie.
+    ai_errors = ai_settings.validate_selection(ai)
+    misp = misp_settings.get(session)
+    webhook = webhook_settings.get(session)
+    audit = audit_settings.get(session)
+    proxy = proxy_settings.get(session)
+    providers = [p.name for p in oidc_settings.enabled_providers(session)]
+    active_feeds = len(
+        list(session.exec(select(Feed).where(col(Feed.enabled).is_(True))).all())
+    )
+    issues = len(_validation(s)["errors"])
+
+    tiles = [
+        HubTile(
+            group="Outbound integrations",
+            title="AI provider",
+            href="/admin/ai",
+            status=(
+                "OFF"
+                if ai.backend == "none"
+                else "NOT CONFIGURED"
+                if ai_errors
+                else ai.backend.upper()
+            ),
+            tone=(
+                "is-neutral"
+                if ai.backend == "none"
+                else "is-warn"
+                if ai_errors
+                else "is-ok"
+            ),
+            meta=(
+                "Governed AI assist · backend not selected"
+                if ai.backend == "none"
+                else f"{ai.backend} selected but disabled at runtime: {ai_errors[0]}"
+                if ai_errors
+                else f"Governed AI assist · egress ceiling TLP:{ai.max_tlp}"
+            ),
+        ),
+        _integration_tile(
+            title="MISP push",
+            href="/admin/misp",
+            enabled=misp.enabled,
+            configured=bool(misp.url.strip() and s.misp_api_key),
+            ready_meta="Indicator egress · one event per report",
+            unconfigured_meta=(
+                "Indicator egress · no MISP URL set"
+                if not misp.url.strip()
+                else "Indicator egress · no API key set"
+            ),
+            off_meta="Indicator egress · push disabled",
+        ),
+        HubTile(
+            group="Outbound integrations",
+            title="Outbound proxy",
+            href="/admin/proxy",
+            status=(
+                "DIRECT"
+                if proxy.mode == ProxyMode.NONE
+                else ("EXPLICIT" if proxy.proxy_url.strip() else "NOT CONFIGURED")
+                if proxy.mode == ProxyMode.EXPLICIT
+                else "SYSTEM"
+            ),
+            tone=(
+                "is-warn"
+                if proxy.mode == ProxyMode.EXPLICIT and not proxy.proxy_url.strip()
+                else "is-ok"
+            ),
+            meta="RSS · SIEM · MISP · AI · webhook routing",
+        ),
+        HubTile(
+            group="Outbound integrations",
+            title="RSS feeds",
+            href="/admin/feeds",
+            status=f"{active_feeds} ACTIVE" if active_feeds else "NONE",
+            tone="is-ok" if active_feeds else "is-neutral",
+            meta="Inbound collection · SSRF-guarded fetcher",
+        ),
+        _integration_tile(
+            title="Publication webhook",
+            href="/admin/webhook",
+            enabled=webhook.enabled,
+            configured=bool(webhook.url.strip()),
+            ready_meta=f"{webhook.format.capitalize()} envelope on publish",
+            unconfigured_meta="No endpoint URL set",
+            off_meta="No publication callout",
+        ),
+        HubTile(
+            group="Outbound integrations",
+            title="Single sign-on",
+            href="/admin/oidc",
+            status=", ".join(p.upper() for p in providers) or "NOT CONFIGURED",
+            tone="is-ok" if providers else "is-warn",
+            meta=(
+                f"{len(providers)} provider{'' if len(providers) == 1 else 's'} · "
+                f"dev-login {'on' if s.dev_login_enabled else 'off'}"
+            ),
+        ),
+        HubTile(
+            group="Governance",
+            title="Audit log & SIEM",
+            href="/admin/audit",
+            status=(
+                "OFF"
+                if not audit.enabled
+                else "LOCAL ONLY"
+                if set(audit.methods) <= {"stdout"}
+                else ", ".join(m.upper() for m in audit.methods)
+            ),
+            tone=(
+                "is-neutral"
+                if not audit.enabled
+                else "is-warn"
+                if set(audit.methods) <= {"stdout"}
+                else "is-ok"
+            ),
+            meta=(
+                "Security events are not being recorded"
+                if not audit.enabled
+                else "No SIEM sink enabled"
+                if set(audit.methods) <= {"stdout"}
+                else "Forensic trail forwarded off-box"
+            ),
+        ),
+        HubTile(
+            group="Governance",
+            title="Effective config",
+            href="/admin/config",
+            status=f"{issues} ISSUE{'' if issues == 1 else 'S'}" if issues else "VIEW",
+            tone="is-warn" if issues else "is-neutral",
+            meta="Resolved runtime settings, provenance + prod guards",
+        ),
+    ]
+    return [asdict(t) for t in tiles]
+
+
+def _integration_tile(
+    *,
+    title: str,
+    href: str,
+    enabled: bool,
+    configured: bool,
+    ready_meta: str,
+    unconfigured_meta: str,
+    off_meta: str,
+) -> HubTile:
+    """An opt-in outbound integration: off → not configured → enabled."""
+    if not enabled:
+        return HubTile(
+            group="Outbound integrations",
+            title=title,
+            href=href,
+            status="OFF",
+            tone="is-neutral",
+            meta=off_meta,
+        )
+    if not configured:
+        return HubTile(
+            group="Outbound integrations",
+            title=title,
+            href=href,
+            status="NOT CONFIGURED",
+            tone="is-warn",
+            meta=unconfigured_meta,
+        )
+    return HubTile(
+        group="Outbound integrations",
+        title=title,
+        href=href,
+        status="ENABLED",
+        tone="is-ok",
+        meta=ready_meta,
+    )
+
+
 def _tiles(session, s, providers: list[str], ai_row, ai_errors: list[str]) -> list[dict]:
     def onoff(flag: bool) -> str:
         return "on" if flag else "off"
diff --git a/src/iceberg/static/css/iceberg.css b/src/iceberg/static/css/iceberg.css
index 3ab8c2c..0dc4f48 100644
--- a/src/iceberg/static/css/iceberg.css
+++ b/src/iceberg/static/css/iceberg.css
@@ -355,6 +355,10 @@ a:hover { color: var(--accent-deep); }
 .stat-delta { font-size: 12px; font-weight: 600; color: var(--muted); }
 .stat-delta.is-ok { color: var(--c-ok); }
 .stat-delta.is-crit { color: var(--c-crit); }
+/* A KPI that links to the work behind it (dashboard). */
+a.stat { display: block; text-decoration: none; transition: border-color 0.12s, box-shadow 0.12s, transform 0.12s; }
+a.stat:hover { border-color: var(--accent-line); box-shadow: var(--shadow-lift); transform: translateY(-1px); }
+a.stat .stat-cue { margin-left: auto; color: var(--accent-deep); }
 @media (max-width: 860px) { .stat-grid { grid-template-columns: repeat(2, 1fr); } }
 @media (max-width: 480px) { .stat-grid { grid-template-columns: 1fr; } }
 
@@ -455,37 +459,16 @@ a:hover { color: var(--accent-deep); }
   font-size: 12.5px; color: var(--muted); line-height: 1.35;
 }
 
-.collection-strip {
-  display: grid; grid-template-columns: repeat(5, minmax(0, 1fr)); gap: 9px;
-}
-.collection-step {
-  display: grid; gap: 4px;
-  min-height: 92px;
-  padding: 12px;
-  color: var(--muted);
-  background: var(--surface);
-  border: 1px solid var(--line);
-  border-radius: var(--radius);
-  box-shadow: var(--shadow);
-}
-.collection-step:hover {
-  color: var(--accent-deep);
-  border-color: var(--accent-line);
-  box-shadow: var(--shadow-lift);
-}
-.collection-step strong {
-  font-family: var(--fs-mono); font-size: 20px; line-height: 1; color: var(--ink);
-}
-.collection-step span:last-child { font-size: 12px; line-height: 1.25; }
-.collection-step.is-done {
-  background: var(--accent-soft);
-  border-color: var(--accent-line);
-}
-.step-kicker {
-  font-family: var(--fs-mono);
-  font-size: 10px; font-weight: 700; letter-spacing: 0.11em; text-transform: uppercase;
-  color: var(--accent-deep);
+/* Notebook phase tab bar — the collection strip re-cut as Collect / Analyze /
+   Produce / Trace, each group labelled with an .eyebrow and holding the
+   sections of that phase (see notebook_detail.html). */
+.nb-phases {
+  display: flex; align-items: center; gap: 18px; flex-wrap: wrap;
+  padding-bottom: 12px; border-bottom: 1px solid var(--line);
 }
+.nb-phase-group { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; }
+.nb-count { font-family: var(--fs-mono); font-size: 11px; color: var(--muted); }
+.help-tab.is-active .nb-count { color: var(--accent-deep); }
 
 .status-note {
   background: var(--accent-soft);
@@ -546,6 +529,10 @@ a:hover { color: var(--accent-deep); }
 a.row:hover, .row-hover:hover { background: var(--surface-2); }
 .row-title { font-weight: 600; color: var(--ink); }
 .row-sub { font-size: 12.5px; color: var(--muted); }
+/* Leading state dot on an action-queue row (dashboard "Needs you now"). */
+.queue-dot { width: 8px; height: 8px; flex: none; border-radius: 50%; background: var(--faint); }
+.queue-dot.is-draft { background: var(--c-warn); }
+.queue-dot.is-review { background: var(--accent); }
 
 /* Audit log — one block per security event (admin console) */
 .audit-log { display: flex; flex-direction: column; }
@@ -577,6 +564,12 @@ a.row:hover, .row-hover:hover { background: var(--surface-2); }
   transition: border-color .14s, box-shadow .14s, transform .14s;
 }
 .tile:hover { border-color: var(--accent-line); box-shadow: var(--shadow-lift); transform: translateY(-1px); }
+/* Dashed "start something" affordance at the end of a tile grid. */
+.tile--new {
+  display: flex; align-items: center; justify-content: center;
+  border-style: dashed; box-shadow: none; color: var(--muted);
+}
+.tile--new:hover { color: var(--accent-deep); }
 .tile-title { font-weight: 700; color: var(--ink); letter-spacing: -0.01em; }
 .tile-meta { font-size: 12.5px; color: var(--muted); margin-top: 3px; }
 
@@ -869,6 +862,24 @@ a.tagk:hover { border-color: var(--k-line); box-shadow: var(--shadow); }
 
 .btn-link { font-size: 13px; font-weight: 600; color: var(--accent-ink); }
 .btn-link:hover { color: var(--accent-deep); }
+/* Leading glyph inside a button/summary (the rail sprite at button scale). */
+.btn-ic { width: 14px; height: 14px; opacity: 1; flex: none; }
+
+/* Collapsed "+ Add …" form block. A native <details>/<summary> so creation is
+   demoted without JS and without adding CSP surface; the summary is styled as
+   a ghost button and flips to "close" wording via the open state. */
+.add-block > summary { list-style: none; }
+.add-block > summary::-webkit-details-marker { display: none; }
+.add-toggle {
+  display: inline-flex; align-items: center; justify-content: center; gap: 7px;
+  font-family: var(--fs-sans); font-size: 12.5px; font-weight: 600;
+  padding: 6px 11px; border-radius: var(--radius-sm); cursor: pointer;
+  border: 1px solid var(--line-strong); background: var(--surface); color: var(--ink);
+  transition: background .13s, border-color .13s, color .13s;
+}
+.add-toggle:hover { border-color: var(--accent-line); color: var(--accent-deep); }
+.add-block[open] > .add-toggle { border-color: var(--accent-line); color: var(--accent-deep); background: var(--accent-soft); }
+.add-block[open] > .add-toggle .btn-ic { transform: rotate(45deg); }
 .link-danger { color: var(--tlp-red); font-size: 13px; font-weight: 600; }
 .link-danger:hover { color: oklch(0.46 0.2 25); }
 .backlink { font-size: 13px; font-weight: 600; color: var(--muted); }
@@ -1142,11 +1153,49 @@ select.field {
   border: 0; background: transparent; padding: 6px 4px; border-radius: 6px;
 }
 .editor-title-input:focus { outline: 0; background: var(--surface-2); box-shadow: var(--ring); }
+.editor-head-markings { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; }
 .editor-head-actions { display: flex; align-items: center; gap: 8px; margin-left: auto; }
 .save-state { font-size: 12px; color: var(--muted); white-space: nowrap; }
 .save-state.is-dirty { color: var(--c-warn); }
 .save-state.is-saved { color: var(--c-ok); }
 
+/* Marking chips — intel level / TLP / analytic confidence, editable in the
+   editor header (the single source of truth for a product's markings).
+   The real <select> is laid transparently over the chip, so a click opens the
+   native dropdown: no popover code, keyboard + screen-reader navigable, and
+   correct before Alpine hydrates. The current value drives the swatch/dot via
+   data-attributes (attribute bindings replace cleanly; :class would not). */
+.marking-chip {
+  position: relative; flex: none; display: inline-flex; align-items: center; gap: 6px;
+  padding: 4px 8px; border: 1px solid var(--line-strong); border-radius: var(--radius-sm);
+  font-family: var(--fs-mono); font-size: 11px; font-weight: 600; letter-spacing: 0.04em;
+  color: var(--ink); background: var(--surface); white-space: nowrap;
+}
+label.marking-chip { cursor: pointer; }
+label.marking-chip:hover { border-color: var(--accent-line); }
+.marking-chip:focus-within { border-color: var(--accent); box-shadow: var(--ring); }
+.marking-chip .caret { color: var(--faint); font-size: 9px; }
+.marking-chip .swatch {
+  width: 9px; height: 9px; flex: none; border-radius: 2px; background: var(--faint);
+  box-shadow: inset 0 0 0 1px oklch(0 0 0 / 0.08);
+}
+.marking-chip .dot { width: 6px; height: 6px; flex: none; border-radius: 50%; background: var(--faint); }
+.marking-chip--lvl { color: var(--accent-deep); background: var(--accent-soft); border-color: var(--accent-line); }
+.marking-chip[data-tlp="RED"] .swatch { background: var(--tlp-red); }
+.marking-chip[data-tlp="AMBER"] .swatch,
+.marking-chip[data-tlp="AMBER_STRICT"] .swatch { background: var(--tlp-amber); }
+.marking-chip[data-tlp="GREEN"] .swatch { background: var(--tlp-green); }
+.marking-chip[data-tlp="CLEAR"] .swatch { background: var(--tlp-clear); }
+.marking-chip[data-tlp="AMBER_STRICT"] { border-style: dashed; }
+.marking-chip[data-conf="LOW"] .dot { background: var(--muted); }
+.marking-chip[data-conf="MODERATE"] .dot { background: var(--accent); }
+.marking-chip[data-conf="HIGH"] .dot { background: var(--c-ok); }
+.marking-chip-select {
+  position: absolute; inset: 0; width: 100%; height: 100%;
+  padding: 0; border: 0; background: transparent; opacity: 0; cursor: pointer;
+  appearance: none;
+}
+
 .editor-subhead {
   flex: none; display: flex; align-items: center; gap: 14px;
   padding: 8px 20px; border-bottom: 1px solid var(--line); background: var(--surface-2);
diff --git a/src/iceberg/static/js/tags.js b/src/iceberg/static/js/tags.js
index ede9229..b5ac5cd 100644
--- a/src/iceberg/static/js/tags.js
+++ b/src/iceberg/static/js/tags.js
@@ -118,10 +118,36 @@ document.addEventListener('alpine:init', () => {
     generation: 0, savedGeneration: 0, savePromise: null, saveQueued: false,
     aiLoading: '', aiApplying: false, aiStatus: '', aiStatusKind: '',
     aiJudgements: null, aiTagIds: [], aiChallenge: '',
+    intelLevel: '', tlp: '', tlpKey: '', confidence: '', confKey: '',
 
     init() {
       this.tabOrder = [...this.$el.querySelectorAll('[data-editor-tab]')]
         .map(el => el.dataset.editorTab);
+      this.initMarkings();
+    },
+
+    /* ---- header marking chips (intel level / TLP / analytic confidence) ----
+       Each chip shows the selected option's own text, so the server-rendered
+       label and the hydrated one are identical and there is no label map to
+       keep in sync with the enums. */
+    initMarkings() {
+      this.$el.querySelectorAll('.marking-chip-select')
+        .forEach((sel) => { this.readMarking(sel); });
+    },
+    readMarking(sel) {
+      const opt = sel.options[sel.selectedIndex];
+      const label = opt ? opt.textContent.trim() : '';
+      if (sel.name === 'intel_level') {
+        this.intelLevel = label;
+      } else if (sel.name === 'tlp') {
+        this.tlp = label; this.tlpKey = sel.value;
+      } else if (sel.name === 'analytic_confidence') {
+        this.confidence = label; this.confKey = sel.value;
+      }
+    },
+    pickMarking(event) {
+      this.readMarking(event.target);
+      this.markDirty();
     },
     selectTab(id, focus = false) {
       if (this.tabOrder.length && !this.tabOrder.includes(id)) return;
@@ -378,6 +404,17 @@ document.addEventListener('alpine:init', () => {
   }));
 
   /* ---- Citation autosave form (report_edit.html) ------------------------- */
+  /* ---- Notebook phase tabs (notebook_detail.html) ------------------------
+     The notebook is worked in phases (collect → analyze → produce → trace)
+     rather than scrolled end to end, so one phase's sections render at a time.
+     The tabs are real anchors: without Alpine the <noscript> rule cancels
+     x-cloak and every section stays reachable by its #id, exactly as before. */
+  Alpine.data('notebookTabs', () => ({
+    phase: 'collect',
+    section: 'sources',
+    show(phase, section) { this.phase = phase; this.section = section; },
+  }));
+
   Alpine.data('citationForm', () => ({
     error: false,
     async save() {
diff --git a/src/iceberg/templates/admin_home.html b/src/iceberg/templates/admin_home.html
new file mode 100644
index 0000000..71c6f40
--- /dev/null
+++ b/src/iceberg/templates/admin_home.html
@@ -0,0 +1,48 @@
+{% extends "base.html" %}
+{% block title %}Settings &amp; integrations · {{ app_name }}{% endblock %}
+{% block crumb %}Settings &amp; integrations{% endblock %}
+{% block content %}
+
+<div class="head-row mb-7">
+  <div>
+    <div class="eyebrow eyebrow-accent">Administration</div>
+    <h1 class="page-title mt-2">Settings &amp; integrations</h1>
+    <div class="title-rule"></div>
+    <p class="text-sm mt-3" style="color:var(--muted);max-width:70ch;">Every admin-configurable
+      subsystem, its live status, and a way in. The deep config pages are unchanged — this is the
+      map on top of them. Secrets stay in the environment and are only ever reported as set or
+      not set.</p>
+  </div>
+</div>
+
+{% for group, tiles in groups %}
+  <div class="head-row mb-3{% if not loop.first %} mt-7{% endif %}">
+    <h2 class="section-title">{{ group }}</h2>
+  </div>
+  <div class="grid sm:grid-cols-2 gap-3">
+    {% for tile in tiles %}
+      <a href="{{ tile.href }}" class="tile">
+        <div class="head-row">
+          <span class="tile-title">{{ tile.title }}</span>
+          <span class="tag tag--c {{ tile.tone }}"><span class="dot"></span>{{ tile.status }}</span>
+        </div>
+        <div class="tile-meta">{{ tile.meta }}</div>
+      </a>
+    {% endfor %}
+  </div>
+{% endfor %}
+
+<div class="head-row mb-3 mt-7">
+  <h2 class="section-title">Curation</h2>
+</div>
+<div class="grid sm:grid-cols-2 gap-3">
+  <a href="/admin/tags" class="tile">
+    <div class="head-row"><span class="tile-title">Taxonomy</span></div>
+    <div class="tile-meta">Controlled CTI vocabulary — named threats, techniques, sectors</div>
+  </a>
+  <a href="/admin/audience" class="tile">
+    <div class="head-row"><span class="tile-title">Audience groups</span></div>
+    <div class="tile-meta">Need-to-know scoping for stakeholders and products</div>
+  </a>
+</div>
+{% endblock %}
diff --git a/src/iceberg/templates/base.html b/src/iceberg/templates/base.html
index c9db4de..bf124db 100644
--- a/src/iceberg/templates/base.html
+++ b/src/iceberg/templates/base.html
@@ -44,6 +44,7 @@
     <symbol id="ic-misp" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="5" r="2.2"/><circle cx="5" cy="18" r="2.2"/><circle cx="19" cy="18" r="2.2"/><path d="M12 7.2v3.3M11 12.2 6.5 16M13 12.2 17.5 16"/></symbol>
     <symbol id="ic-sso" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><path d="M15 7a4 4 0 1 0-4 4"/><path d="M10 14h9M19 14l-2.5-2.5M19 14l-2.5 2.5"/></symbol>
     <symbol id="ic-ai" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3l1.8 4.7L18.5 9.5 13.8 11.3 12 16l-1.8-4.7L5.5 9.5l4.7-1.8z"/><path d="M18 15l.8 2.2L21 18l-2.2.8L18 21l-.8-2.2L15 18l2.2-.8z"/></symbol>
+    <symbol id="ic-settings" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3.2"/><path d="M12 2.6v2.6M12 18.8v2.6M21.4 12h-2.6M5.2 12H2.6M18.6 5.4l-1.8 1.8M7.2 16.8l-1.8 1.8M18.6 18.6l-1.8-1.8M7.2 7.2 5.4 5.4"/></symbol>
     <symbol id="ic-webhook" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><path d="M9 9a3 3 0 1 1 4 2.83L10.5 16"/><path d="M15 13a3 3 0 1 1-2.5 4.66H8"/><path d="M7.5 12.5 5 17a3 3 0 1 0 3 1"/></symbol>
   </defs></svg>
 
@@ -78,6 +79,7 @@
       {'label': 'Entities', 'href': '/tags', 'group': 'Discovery'},
       {'label': 'ATT&CK matrix', 'href': '/matrix', 'group': 'Discovery'},
       {'label': 'Program maturity', 'href': '/maturity', 'group': 'Discovery'},
+      {'label': 'Settings & integrations', 'href': '/admin', 'group': 'Administration'},
       {'label': 'Taxonomy', 'href': '/admin/tags', 'group': 'Administration'},
       {'label': 'Audience groups', 'href': '/admin/audience', 'group': 'Administration'},
       {'label': 'Audit log', 'href': '/admin/audit', 'group': 'Administration'},
@@ -157,6 +159,7 @@
           </div>
           <div class="rail-group">
             <div class="rail-group-label">Administration</div>
+            {{ rail_link('/admin', 'ic-settings', 'Settings & integrations', path == '/admin') }}
             {{ rail_link('/admin/tags', 'ic-taxonomy', 'Taxonomy', path.startswith('/admin/tags')) }}
             {{ rail_link('/admin/audience', 'ic-entity', 'Audience', path.startswith('/admin/audience')) }}
             {{ rail_link('/admin/audit', 'ic-audit', 'Audit log', path.startswith('/admin/audit')) }}
diff --git a/src/iceberg/templates/dashboard.html b/src/iceberg/templates/dashboard.html
index a0cdd7c..85664f9 100644
--- a/src/iceberg/templates/dashboard.html
+++ b/src/iceberg/templates/dashboard.html
@@ -28,35 +28,68 @@ <h1 class="page-title mt-2">Good to see you, {{ user.display_name.split(' ')[0]
 
 {% if user.role != 'STAKEHOLDER' %}
   {% set in_flight = report_counts.draft + report_counts.in_review + report_counts.approved %}
+  {# Every KPI links to the work behind it — a number you can act on. #}
   <section class="stat-grid mb-7" aria-label="Workspace metrics">
-    <div class="stat">
+    <a href="/notebooks" class="stat">
       <div class="stat-label">Active notebooks</div>
-      <div class="stat-row"><span class="stat-num">{{ notebooks | length }}</span></div>
-    </div>
-    <div class="stat">
+      <div class="stat-row">
+        <span class="stat-num">{{ notebooks | length }}</span>
+        <span class="stat-delta stat-cue">Open →</span>
+      </div>
+    </a>
+    <a href="/reports" class="stat">
       <div class="stat-label">Reports in flight</div>
       <div class="stat-row">
         <span class="stat-num">{{ in_flight }}</span>
         <span class="stat-delta">{{ report_counts.in_review }} in review · {{ report_counts.approved }} approved</span>
+        <span class="stat-delta stat-cue">→</span>
       </div>
-    </div>
-    <div class="stat">
+    </a>
+    <a href="/requirements" class="stat">
       <div class="stat-label">Open tasking</div>
       <div class="stat-row">
         <span class="stat-num">{{ open_tasking }}</span>
-        {% if open_tasking %}<a href="/requirements" class="stat-delta">View board →</a>{% endif %}
+        <span class="stat-delta stat-cue">Board →</span>
       </div>
-    </div>
-    <div class="stat">
+    </a>
+    <a href="/reports" class="stat">
       <div class="stat-label">Published (30d)</div>
-      <div class="stat-row"><span class="stat-num">{{ published_30d }}</span></div>
-    </div>
+      <div class="stat-row">
+        <span class="stat-num">{{ published_30d }}</span>
+        <span class="stat-delta stat-cue">All →</span>
+      </div>
+    </a>
   </section>
 {% endif %}
 
 <div class="grid lg:grid-cols-3 gap-7">
   {% if user.role != 'STAKEHOLDER' %}
   <section class="lg:col-span-2">
+    {# What is waiting on you, above the fold: the review queue first, then your
+       own drafts. Both are existing lifecycle state, surfaced as actions. #}
+    {% if needs_you %}
+      <div class="head-row mb-4">
+        <h2 class="section-title">Needs you now</h2>
+        <span class="eyebrow">{{ needs_you | length }} item{{ '' if needs_you | length == 1 else 's' }}</span>
+      </div>
+      <div class="rows mb-6">
+        {% for item in needs_you %}
+          {% set r = item.report %}
+          <a href="/reports/{{ r.id }}/edit" class="row">
+            <span class="queue-dot {{ 'is-review' if item.kind == 'review' else 'is-draft' }}"
+                  aria-hidden="true"></span>
+            <span class="flex-1">
+              <span class="row-title">{{ r.title }}</span>
+              <span class="row-sub block">
+                {% if item.kind == 'review' %}In review · waiting on a reviewer{% else %}Draft · last edited {{ r.updated_at.strftime('%Y-%m-%d %H:%M') }}{% endif %}
+              </span>
+            </span>
+            <span class="btn btn--ghost btn--sm">{{ 'Review' if item.kind == 'review' else 'Resume' }} →</span>
+          </a>
+        {% endfor %}
+      </div>
+    {% endif %}
+
     <div class="head-row mb-4">
       <h2 class="section-title">Notebooks</h2>
       <span class="eyebrow">{{ notebooks | length }} active</span>
@@ -73,16 +106,24 @@ <h2 class="section-title">Notebooks</h2>
             <div class="tile-meta">{{ nb.topic or "No topic set" }}</div>
           </a>
         {% endfor %}
+        <a href="#new-notebook" class="tile tile--new">
+          <span class="eyebrow">+ Start a notebook</span>
+        </a>
       </div>
     {% else %}
       <div class="well card-pad text-center">
-        <p class="empty">No notebooks yet. {% if user.role != 'STAKEHOLDER' %}Create one below to start collecting sources, notes and products.{% endif %}</p>
+        <p class="empty">No notebooks yet. Start one below to begin collecting sources, notes and products.</p>
       </div>
     {% endif %}
 
-    {% if user.role != 'STAKEHOLDER' %}
-      <form method="post" action="/notebooks" class="card card-pad mt-4">
-        <div class="eyebrow mb-3">New notebook</div>
+    {# Collapsed by default so content leads; opens server-side when there is no
+       notebook to lead with. A native <details> keeps it working without JS and
+       adds no CSP surface (the same pattern as the notebook add-forms). #}
+    <details id="new-notebook" class="add-block mt-4"{% if not notebooks %} open{% endif %}>
+      <summary class="add-toggle">
+        <svg class="rail-ic btn-ic"><use href="#ic-plus"/></svg>New notebook
+      </summary>
+      <form method="post" action="/notebooks" class="card card-pad mt-3">
         <div class="grid sm:grid-cols-2 gap-3">
           <div>
             <label class="field-label">Title</label>
@@ -95,7 +136,7 @@ <h2 class="section-title">Notebooks</h2>
         </div>
         <button class="btn btn--ink mt-4">Create notebook</button>
       </form>
-    {% endif %}
+    </details>
   </section>
   {% endif %}
 
diff --git a/src/iceberg/templates/notebook_detail.html b/src/iceberg/templates/notebook_detail.html
index 92c36e1..0dabf53 100644
--- a/src/iceberg/templates/notebook_detail.html
+++ b/src/iceberg/templates/notebook_detail.html
@@ -12,103 +12,43 @@ <h1 class="page-title mt-2">{{ notebook.title }}</h1>
   <div class="title-rule"></div>
 </div>
 
-<nav class="collection-strip mb-6" aria-label="Notebook collection checklist">
-  <a href="#sources" class="collection-step {{ 'is-done' if sources else '' }}">
-    <span class="step-kicker">Sources</span>
-    <strong>{{ sources | length }}</strong>
-    <span>Evidence captured</span>
-  </a>
-  <a href="#notes" class="collection-step {{ 'is-done' if notes else '' }}">
-    <span class="step-kicker">Notes</span>
-    <strong>{{ notes | length }}</strong>
-    <span>Analyst observations</span>
-  </a>
-  <a href="#attachments" class="collection-step {{ 'is-done' if attachments else '' }}">
-    <span class="step-kicker">Files</span>
-    <strong>{{ attachments | length }}</strong>
-    <span>Reference material</span>
-  </a>
-  <a href="#diamonds" class="collection-step {{ 'is-done' if diamonds else '' }}">
-    <span class="step-kicker">Diamond</span>
-    <strong>{{ diamonds | length }}</strong>
-    <span>Intrusion models</span>
-  </a>
-  <a href="#ach" class="collection-step {{ 'is-done' if ach_models else '' }}">
-    <span class="step-kicker">ACH</span>
-    <strong>{{ ach_models | length }}</strong>
-    <span>Hypothesis matrices</span>
-  </a>
-  <a href="#figures" class="collection-step {{ 'is-done' if figures else '' }}">
-    <span class="step-kicker">Figures</span>
-    <strong>{{ figures | length }}</strong>
-    <span>Embeddable images</span>
-  </a>
-  <a href="#indicators" class="collection-step {{ 'is-done' if iocs else '' }}">
-    <span class="step-kicker">Indicators</span>
-    <strong>{{ iocs | length }}</strong>
-    <span>IOCs for MISP</span>
-  </a>
-  <a href="#products" class="collection-step {{ 'is-done' if reports else '' }}">
-    <span class="step-kicker">Products</span>
-    <strong>{{ reports | length }}</strong>
-    <span>Finished intelligence</span>
-  </a>
-  <a href="#requirements" class="collection-step {{ 'is-done' if linked_req_ids else '' }}">
-    <span class="step-kicker">Requirements</span>
-    <strong>{{ linked_req_ids | length }}</strong>
-    <span>Traceability links</span>
-  </a>
-</nav>
+{# The notebook is worked in phases, not scrolled end to end: the collection
+   strip becomes a phase tab bar and only one phase's sections render at a time.
+   Tabs stay real anchors, so without Alpine every section is still reachable
+   (the <noscript> below cancels the x-cloak that hides the other phases). #}
+{%- macro phase_tab(phase, section, label, count) -%}
+  <a href="#{{ section }}" class="help-tab" :class="section === '{{ section }}' ? 'is-active' : ''"
+     @click="show('{{ phase }}', '{{ section }}')">{{ label }} <span class="nb-count">{{ count }}</span></a>
+{%- endmacro -%}
 
-<!-- Intelligence products -->
-<section id="products" class="card card-pad-lg mb-6">
-  <div class="head-row mb-4">
-    <h2 class="section-title">Intelligence products</h2>
-    <span class="eyebrow">{{ reports | length }}</span>
-  </div>
-  {% if reports %}
-    <div class="rows">
-      {% for r in reports %}
-        <div class="row">
-          <a href="/reports/{{ r.id }}" class="row-title flex-1 hover:text-accent-deep">{{ r.title }}</a>
-          <span class="flex gap-1.5 items-center flex-wrap">
-            {{ m.status_badge(r.status) }}
-            {{ m.level_badge(r.intel_level) }}
-            {{ m.tlp_badge(r.tlp) }}
-            {% if can_write %}<a href="/reports/{{ r.id }}/edit" class="btn btn--ghost btn--sm ml-1">Edit</a>{% endif %}
-          </span>
-        </div>
-      {% endfor %}
+<div x-data="notebookTabs()">
+  <noscript><style>[x-cloak] { display: revert; }</style></noscript>
+
+  <nav class="nb-phases mb-6" aria-label="Notebook phases">
+    <div class="nb-phase-group">
+      <span class="eyebrow">Collect</span>
+      {{ phase_tab('collect', 'sources', 'Sources', sources | length) }}
+      {{ phase_tab('collect', 'notes', 'Notes', notes | length) }}
+      {{ phase_tab('collect', 'attachments', 'Files', attachments | length) }}
+      {{ phase_tab('collect', 'figures', 'Figures', figures | length) }}
+      {{ phase_tab('collect', 'indicators', 'Indicators', iocs | length) }}
     </div>
-  {% else %}
-    <p class="empty">No products authored from this notebook yet. Start one when the collection has enough context for an assessment.</p>
-  {% endif %}
+    <div class="nb-phase-group">
+      <span class="eyebrow">Analyze</span>
+      {{ phase_tab('analyze', 'diamonds', 'Diamond', diamonds | length) }}
+      {{ phase_tab('analyze', 'ach', 'ACH', ach_models | length) }}
+    </div>
+    <div class="nb-phase-group">
+      <span class="eyebrow">Produce</span>
+      {{ phase_tab('produce', 'products', 'Products', reports | length) }}
+    </div>
+    <div class="nb-phase-group">
+      <span class="eyebrow">Trace</span>
+      {{ phase_tab('trace', 'requirements', 'Requirements', linked_req_ids | length) }}
+    </div>
+  </nav>
 
-  {% if can_write %}
-    <form method="post" action="/notebooks/{{ notebook.id }}/reports" class="well card-pad mt-4">
-      <div class="eyebrow mb-3">New product</div>
-      <div class="grid sm:grid-cols-12 gap-3 items-end">
-        <div class="sm:col-span-6">
-          <label class="field-label">Title</label>
-          <input name="title" required placeholder="Product title" class="field">
-        </div>
-        <div class="sm:col-span-3">
-          <label class="field-label">Intel level</label>
-          <select name="intel_level" class="field">
-            {% for lvl in IntelLevel %}<option value="{{ lvl.value }}">{{ lvl.value }}</option>{% endfor %}
-          </select>
-        </div>
-        <div class="sm:col-span-3">
-          <label class="field-label">TLP</label>
-          <select name="tlp" class="field">
-            {% for t in TLP %}<option value="{{ t.value }}" {% if t.value=='AMBER' %}selected{% endif %}>{{ tlp_label(t) }}</option>{% endfor %}
-          </select>
-        </div>
-      </div>
-      <button class="btn btn--ink mt-4">Create product</button>
-    </form>
-  {% endif %}
-</section>
+<div x-show="phase === 'collect'">
 
 <div class="grid md:grid-cols-2 gap-6 mb-6">
   <!-- Sources -->
@@ -446,6 +386,10 @@ <h3 class="text-sm" style="font-weight:600;">Suggest indicators with AI</h3>
   {% endif %}
 </section>
 
+</div><!-- /collect -->
+
+<div x-show="phase === 'analyze'" x-cloak>
+
 <!-- Diamond models -->
 <section id="diamonds" class="card card-pad-lg mb-6">
   <div class="head-row mb-4">
@@ -553,6 +497,64 @@ <h2 class="section-title">ACH analyses
   {% endif %}
 </section>
 
+</div><!-- /analyze -->
+
+<div x-show="phase === 'produce'" x-cloak>
+
+<!-- Intelligence products -->
+<section id="products" class="card card-pad-lg mb-6">
+  <div class="head-row mb-4">
+    <h2 class="section-title">Intelligence products</h2>
+    <span class="eyebrow">{{ reports | length }}</span>
+  </div>
+  {% if reports %}
+    <div class="rows">
+      {% for r in reports %}
+        <div class="row">
+          <a href="/reports/{{ r.id }}" class="row-title flex-1 hover:text-accent-deep">{{ r.title }}</a>
+          <span class="flex gap-1.5 items-center flex-wrap">
+            {{ m.status_badge(r.status) }}
+            {{ m.level_badge(r.intel_level) }}
+            {{ m.tlp_badge(r.tlp) }}
+            {% if can_write %}<a href="/reports/{{ r.id }}/edit" class="btn btn--ghost btn--sm ml-1">Edit</a>{% endif %}
+          </span>
+        </div>
+      {% endfor %}
+    </div>
+  {% else %}
+    <p class="empty">No products authored from this notebook yet. Start one when the collection has enough context for an assessment.</p>
+  {% endif %}
+
+  {% if can_write %}
+    <form method="post" action="/notebooks/{{ notebook.id }}/reports" class="well card-pad mt-4">
+      <div class="eyebrow mb-3">New product</div>
+      <div class="grid sm:grid-cols-12 gap-3 items-end">
+        <div class="sm:col-span-6">
+          <label class="field-label">Title</label>
+          <input name="title" required placeholder="Product title" class="field">
+        </div>
+        <div class="sm:col-span-3">
+          <label class="field-label">Intel level</label>
+          <select name="intel_level" class="field">
+            {% for lvl in IntelLevel %}<option value="{{ lvl.value }}">{{ lvl.value }}</option>{% endfor %}
+          </select>
+        </div>
+        <div class="sm:col-span-3">
+          <label class="field-label">TLP</label>
+          <select name="tlp" class="field">
+            {% for t in TLP %}<option value="{{ t.value }}" {% if t.value=='AMBER' %}selected{% endif %}>{{ tlp_label(t) }}</option>{% endfor %}
+          </select>
+        </div>
+      </div>
+      <button class="btn btn--ink mt-4">Create product</button>
+    </form>
+  {% endif %}
+</section>
+
+</div><!-- /produce -->
+
+<div x-show="phase === 'trace'" x-cloak>
+
 <!-- Requirements addressed -->
 <section id="requirements" class="card card-pad-lg">
   <h2 class="section-title mb-1">Requirements addressed</h2>
@@ -577,4 +579,7 @@ <h2 class="section-title mb-1">Requirements addressed</h2>
     <p class="empty">No open requirements to link. Stakeholder requirements will appear here when they are available for tasking.</p>
   {% endif %}
 </section>
+
+</div><!-- /trace -->
+</div><!-- /notebookTabs -->
 {% endblock %}
diff --git a/src/iceberg/templates/report_edit.html b/src/iceberg/templates/report_edit.html
index 7c26c49..568e13e 100644
--- a/src/iceberg/templates/report_edit.html
+++ b/src/iceberg/templates/report_edit.html
@@ -36,9 +36,55 @@
     {% else %}
       <span class="editor-title-input" style="cursor:default;">{{ report.title }}</span>
     {% endif %}
+    {# Markings live here — always visible, editable in place, single source of
+       truth. The real <select> is laid transparently over each chip so a click
+       opens the native dropdown (keyboard/AT-navigable, correct before Alpine
+       hydrates); `pickMarking` mirrors the chosen option into the chip. #}
+    <div class="editor-head-markings">
+      {% if can_edit %}
+        <label class="marking-chip marking-chip--lvl">
+          <span x-text="intelLevel">{{ report.intel_level.value }}</span>
+          <span class="caret" aria-hidden="true">▾</span>
+          <select form="reportform" name="intel_level" class="marking-chip-select"
+                  aria-label="Intelligence level" @change="pickMarking($event)">
+            {% for lvl in IntelLevel %}<option value="{{ lvl.value }}" {% if lvl == report.intel_level %}selected{% endif %}>{{ lvl.value }}</option>{% endfor %}
+          </select>
+        </label>
+        <label class="marking-chip" data-tlp="{{ report.tlp.value }}" :data-tlp="tlpKey">
+          <span class="swatch"></span>
+          <span x-text="tlp">{{ tlp_label(report.tlp) }}</span>
+          <span class="caret" aria-hidden="true">▾</span>
+          <select form="reportform" name="tlp" class="marking-chip-select"
+                  aria-label="TLP marking" @change="pickMarking($event)">
+            {% for t in TLP %}<option value="{{ t.value }}" {% if t == report.tlp %}selected{% endif %}>{{ tlp_label(t) }}</option>{% endfor %}
+          </select>
+        </label>
+        <label class="marking-chip" data-conf="{{ report.analytic_confidence.value if report.analytic_confidence else '' }}"
+               :data-conf="confKey" title="Analytic confidence in the judgements (ICD 203)">
+          <span class="dot"></span>
+          <span x-text="confidence">{% if report.analytic_confidence %}{{ report.analytic_confidence.value | capitalize }} confidence{% else %}Confidence not stated{% endif %}</span>
+          <span class="caret" aria-hidden="true">▾</span>
+          <select form="reportform" name="analytic_confidence" class="marking-chip-select"
+                  aria-label="Analytic confidence (ICD 203)" @change="pickMarking($event)">
+            <option value="" {% if not report.analytic_confidence %}selected{% endif %}>Confidence not stated</option>
+            {% for c in AnalyticConfidence %}<option value="{{ c.value }}" {% if c == report.analytic_confidence %}selected{% endif %}>{{ c.value | capitalize }} confidence</option>{% endfor %}
+          </select>
+        </label>
+      {% else %}
+        <span class="marking-chip marking-chip--lvl">{{ report.intel_level.value }}</span>
+        <span class="marking-chip" data-tlp="{{ report.tlp.value }}">
+          <span class="swatch"></span>{{ tlp_label(report.tlp) }}
+        </span>
+        {% if report.analytic_confidence %}
+          <span class="marking-chip" data-conf="{{ report.analytic_confidence.value }}"
+                title="Analytic confidence in the judgements (ICD 203)">
+            <span class="dot"></span>{{ report.analytic_confidence.value | capitalize }} confidence
+          </span>
+        {% endif %}
+      {% endif %}
+    </div>
     <div class="editor-head-actions">
       {{ m.status_badge(report.status) }}
-      {{ m.confidence_badge(report.analytic_confidence) }}
       {% if can_edit %}
         <span class="save-state" :class="saving ? '' : (dirty ? 'is-dirty' : 'is-saved')"
               x-text="saving ? 'Saving…' : (dirty ? 'Unsaved changes' : 'Saved')"></span>
@@ -598,38 +644,14 @@ <h2 class="section-title mb-1">Rendered products</h2>
         </div>
       </div>
 
-      <!-- pinned markings footer (submitted with the product form) -->
+      {# Markings moved to the always-visible header chips (single source of
+         truth); the dock footer now only points at the estimative-language
+         guidance that used to sit beside the confidence select. #}
       {% if can_edit %}
       <div class="dock-foot">
-        <div class="grid grid-cols-2 gap-2">
-          <div>
-            <label class="field-label">Intel level</label>
-            <select form="reportform" name="intel_level" class="field" @change="markDirty()">
-              {% for lvl in IntelLevel %}<option value="{{ lvl.value }}" {% if lvl == report.intel_level %}selected{% endif %}>{{ lvl.value }}</option>{% endfor %}
-            </select>
-          </div>
-          <div>
-            <label class="field-label">TLP</label>
-            <select form="reportform" name="tlp" class="field" @change="markDirty()">
-              {% for t in TLP %}<option value="{{ t.value }}" {% if t == report.tlp %}selected{% endif %}>{{ tlp_label(t) }}</option>{% endfor %}
-            </select>
-          </div>
-        </div>
-        <div>
-          <label class="field-label">Analytic confidence
-            <a href="/help#estimative-language" class="help-hint" target="_blank">?</a></label>
-          <select form="reportform" name="analytic_confidence" class="field" @change="markDirty()">
-            <option value="" {% if not report.analytic_confidence %}selected{% endif %}>— Not stated —</option>
-            {% for c in AnalyticConfidence %}<option value="{{ c.value }}" {% if c == report.analytic_confidence %}selected{% endif %}>{{ c.value | capitalize }}</option>{% endfor %}
-          </select>
-        </div>
-      </div>
-      {% else %}
-      <div class="dock-foot">
-        <div class="flex gap-1.5 flex-wrap items-center">
-          {{ m.level_badge(report.intel_level) }}
-          {{ m.tlp_badge(report.tlp) }}
-        </div>
+        <a href="/help#estimative-language" class="help-hint" target="_blank">
+          How should I word likelihood and confidence? →
+        </a>
       </div>
       {% endif %}
     </aside>
diff --git a/src/iceberg/web/__init__.py b/src/iceberg/web/__init__.py
index 260e653..c91567e 100644
--- a/src/iceberg/web/__init__.py
+++ b/src/iceberg/web/__init__.py
@@ -10,6 +10,7 @@
     admin_audit,
     admin_config,
     admin_feeds,
+    admin_home,
     admin_misp,
     admin_oidc,
     admin_proxy,
diff --git a/src/iceberg/web/admin_home.py b/src/iceberg/web/admin_home.py
new file mode 100644
index 0000000..00531bb
--- /dev/null
+++ b/src/iceberg/web/admin_home.py
@@ -0,0 +1,35 @@
+"""Admin-only Settings & integrations hub (read-only landing page).
+
+The map on top of the deep config pages: one tile per admin-configurable
+subsystem, its live status, and a way in. It owns no state and has no save path —
+every status pill is derived from the same settings singletons the config pages
+themselves edit (``services/effective_config.admin_hub_tiles``), so the hub can
+never disagree with the page it links to.
+"""
+
+from fastapi import Request
+
+from ..auth.dependencies import CurrentUser
+from ..services import effective_config
+from ..templating import templates
+from .common import SessionDep, _require_admin, router
+
+# Tile groups, in display order (a tile's ``group`` selects its section).
+HUB_GROUPS: tuple[str, ...] = ("Outbound integrations", "Governance")
+
+
+@router.get("/admin")
+def admin_home_view(request: Request, session: SessionDep, user: CurrentUser):
+    _require_admin(user)
+    tiles = effective_config.admin_hub_tiles(session)
+    return templates.TemplateResponse(
+        request,
+        "admin_home.html",
+        {
+            "user": user,
+            "groups": [
+                (group, [t for t in tiles if t["group"] == group])
+                for group in HUB_GROUPS
+            ],
+        },
+    )
diff --git a/src/iceberg/web/notebooks.py b/src/iceberg/web/notebooks.py
index 3941eb8..453544f 100644
--- a/src/iceberg/web/notebooks.py
+++ b/src/iceberg/web/notebooks.py
@@ -30,6 +30,7 @@
     SourceCredibility,
     SourceReliability,
     TLP,
+    User,
     ioc_type_label,
     utcnow,
 )
@@ -109,6 +110,42 @@ def _workspace_report_counts(session: Session) -> dict[str, int]:
     }
 
 
+# Rows shown in the dashboard's "Needs you now" queue.
+_NEEDS_YOU_LIMIT = 5
+
+
+def _needs_you_now(session: Session, user: User) -> list[dict]:
+    """The writer's own action queue: drafts they own, plus — for anyone who can
+    review — the products waiting on a reviewer.
+
+    Both halves are already-modelled state (``Report.status`` / ``author_id``);
+    this only surfaces them above the fold so the dashboard says what to do next
+    rather than only what the numbers are.
+    """
+    can_review = user.role in (Role.REVIEWER, Role.ADMIN)
+    statuses = [ReportStatus.DRAFT] + ([ReportStatus.IN_REVIEW] if can_review else [])
+    rows = session.exec(
+        select(Report)
+        .where(col(Report.status).in_(statuses))
+        .order_by(col(Report.updated_at).desc())
+    ).all()
+    queue: list[dict] = []
+    for report in rows:
+        status_ = ReportStatus(report.status)
+        if status_ is ReportStatus.DRAFT and report.author_id != user.id:
+            continue  # someone else's draft is not your work
+        queue.append(
+            {
+                "report": report,
+                "kind": "review" if status_ is ReportStatus.IN_REVIEW else "draft",
+            }
+        )
+    # Waiting on *you* (review) outranks work only you can resume (your drafts);
+    # within each half the most recently touched leads.
+    queue.sort(key=lambda item: (item["kind"] != "review", -item["report"].updated_at.timestamp()))
+    return queue[:_NEEDS_YOU_LIMIT]
+
+
 @router.get("/")
 def dashboard(request: Request, session: SessionDep, user: CurrentUser):
     is_stakeholder = user.role == Role.STAKEHOLDER
@@ -151,7 +188,9 @@ def dashboard(request: Request, session: SessionDep, user: CurrentUser):
     # KPI strip counts (writers only) — derived cheaply for the dashboard stats.
     open_tasking = 0
     published_30d = 0
+    needs_you = []
     if not is_stakeholder:
+        needs_you = _needs_you_now(session, user)
         open_tasking = len(
             session.exec(
                 select(Requirement).where(
@@ -182,6 +221,7 @@ def dashboard(request: Request, session: SessionDep, user: CurrentUser):
             "feed_unread": feed_unread,
             "open_tasking": open_tasking,
             "published_30d": published_30d,
+            "needs_you": needs_you,
         },
     )
 
diff --git a/tests/test_admin_home.py b/tests/test_admin_home.py
new file mode 100644
index 0000000..af91cef
--- /dev/null
+++ b/tests/test_admin_home.py
@@ -0,0 +1,133 @@
+"""The /admin Settings & integrations hub.
+
+The hub owns no state: every pill is derived from the same settings singletons
+the deep config pages edit, so these tests pin the derivation (off → not
+configured → enabled) and the admin-only gate rather than the copy.
+"""
+
+import pytest
+from sqlmodel import Session
+
+from iceberg.config import get_settings
+from iceberg.models import Feed
+from iceberg.services import effective_config, misp_settings, webhook_settings
+
+# Every config page the hub must offer a way into.
+HUB_HREFS = (
+    "/admin/ai",
+    "/admin/misp",
+    "/admin/proxy",
+    "/admin/feeds",
+    "/admin/webhook",
+    "/admin/oidc",
+    "/admin/audit",
+    "/admin/config",
+)
+
+
+def _tile(session, title: str) -> dict:
+    tiles = effective_config.admin_hub_tiles(session)
+    return next(t for t in tiles if t["title"] == title)
+
+
+@pytest.mark.parametrize("role", ["ANALYST", "REVIEWER", "STAKEHOLDER"])
+def test_hub_is_admin_only(client, login, role):
+    login(role)
+    assert client.get("/admin").status_code == 403
+
+
+def test_hub_links_to_every_config_page(client, login):
+    login("ADMIN")
+    page = client.get("/admin")
+    assert page.status_code == 200
+    assert "Settings &amp; integrations" in page.text
+    for href in HUB_HREFS:
+        assert f'href="{href}"' in page.text
+
+
+def test_disabled_integration_reads_off(engine):
+    with Session(engine) as session:
+        assert _tile(session, "MISP push")["status"] == "OFF"
+        assert _tile(session, "Publication webhook")["status"] == "OFF"
+
+
+def test_enabled_but_unconfigured_integration_warns(engine, monkeypatch):
+    """Enabled with no endpoint (or, for MISP, no env API key) is the state an
+    operator most needs flagged — it looks on but cannot deliver."""
+    monkeypatch.setattr(get_settings(), "misp_api_key", "")
+    with Session(engine) as session:
+        webhook_settings.update(session, enabled=True, url="")
+        misp_settings.update(session, enabled=True, url="https://misp.example.org")
+
+        webhook = _tile(session, "Publication webhook")
+        assert (webhook["status"], webhook["tone"]) == ("NOT CONFIGURED", "is-warn")
+        misp = _tile(session, "MISP push")
+        assert (misp["status"], misp["tone"]) == ("NOT CONFIGURED", "is-warn")
+        assert "no API key" in misp["meta"]
+
+
+def test_fully_configured_integration_reads_enabled(engine, monkeypatch):
+    monkeypatch.setattr(get_settings(), "misp_api_key", "k" * 16)
+    with Session(engine) as session:
+        webhook_settings.update(
+            session, enabled=True, url="https://hooks.example.org/x"
+        )
+        misp_settings.update(session, enabled=True, url="https://misp.example.org")
+
+        assert _tile(session, "Publication webhook")["status"] == "ENABLED"
+        assert _tile(session, "MISP push")["status"] == "ENABLED"
+
+
+def test_rss_tile_counts_only_enabled_feeds(engine):
+    with Session(engine) as session:
+        session.add(Feed(url="https://a.example/rss", title="A", enabled=True))
+        session.add(Feed(url="https://b.example/rss", title="B", enabled=True))
+        session.add(Feed(url="https://c.example/rss", title="C", enabled=False))
+        session.commit()
+        assert _tile(session, "RSS feeds")["status"] == "2 ACTIVE"
+
+
+def test_audit_tile_flags_a_local_only_trail(engine):
+    """stdout-only means nothing leaves the box — a governance gap worth a pill."""
+    with Session(engine) as session:
+        tile = _tile(session, "Audit log & SIEM")
+        assert (tile["status"], tile["tone"]) == ("LOCAL ONLY", "is-warn")
+
+
+def test_config_tile_surfaces_prod_guard_issues(engine, monkeypatch):
+    monkeypatch.setattr(get_settings(), "environment", "prod")
+    monkeypatch.setattr(get_settings(), "secret_key", "short")
+    with Session(engine) as session:
+        tile = _tile(session, "Effective config")
+        assert tile["tone"] == "is-warn"
+        assert "ISSUE" in tile["status"]
+
+
+def test_hub_never_leaks_a_secret(client, login, monkeypatch):
+    monkeypatch.setattr(get_settings(), "webhook_token", "TOP-SECRET-TOKEN")
+    monkeypatch.setattr(get_settings(), "misp_api_key", "TOP-SECRET-KEY")
+    login("ADMIN")
+    page = client.get("/admin").text
+    assert "TOP-SECRET-TOKEN" not in page
+    assert "TOP-SECRET-KEY" not in page
+
+
+def test_ai_hub_tile_reflects_the_resolved_backend(engine, monkeypatch):
+    """A provider selected but missing its env key resolves to "none" at runtime
+    (``ai_settings.resolve`` fail-closes), so the hub must not show it green —
+    the same defect the /admin/config tile was fixed for."""
+    from iceberg.services import ai_settings
+
+    monkeypatch.setattr(get_settings(), "ai_api_key", "")
+    with Session(engine) as session:
+        ai_settings.update(session, backend="openai", model="gpt-5")
+        assert ai_settings.resolve(session).ai_backend == "none"
+
+        tile = _tile(session, "AI provider")
+        assert (tile["status"], tile["tone"]) == ("NOT CONFIGURED", "is-warn")
+        assert "disabled at runtime" in tile["meta"]
+
+    monkeypatch.setattr(get_settings(), "ai_api_key", "k" * 20)
+    with Session(engine) as session:
+        tile = _tile(session, "AI provider")
+        assert (tile["status"], tile["tone"]) == ("OPENAI", "is-ok")
diff --git a/tests/test_dashboard_counts.py b/tests/test_dashboard_counts.py
index 062b581..eb8bfb4 100644
--- a/tests/test_dashboard_counts.py
+++ b/tests/test_dashboard_counts.py
@@ -3,9 +3,9 @@
 import re
 from datetime import timedelta
 
-from sqlmodel import Session
+from sqlmodel import Session, select
 
-from iceberg.models import Notebook, Report, ReportStatus, utcnow
+from iceberg.models import Notebook, Report, ReportStatus, User, utcnow
 
 
 def test_dashboard_counts_all_in_flight_reports_not_only_the_recent_eight(
@@ -57,6 +57,109 @@ def test_dashboard_counts_all_in_flight_reports_not_only_the_recent_eight(
         response.text,
     )
     assert "0 in review · 1 approved" in response.text
-    # The display list is still presentation-capped, independently of the KPI.
-    assert response.text.count('class="row-title"') == 8
-    assert "Older approved report" not in response.text
+    # The display list is still presentation-capped, independently of the KPI
+    # (scoped to the recent-reports column — the "Needs you now" queue above it
+    # renders rows of its own).
+    recent = response.text.split("Recent reports", 1)[1]
+    assert recent.count('class="row-title"') == 8
+    assert "Older approved report" not in recent
+
+
+def _other_author(session) -> int:
+    """A second real author, so "someone else's draft" is a genuine FK row."""
+    user = User(email="other@example.com", display_name="Other")
+    session.add(user)
+    session.commit()
+    session.refresh(user)
+    return user.id
+
+
+def _seed(session, *, owner_id, title, status, author_id=None, age_minutes=0):
+    notebook = session.exec(select(Notebook)).first()
+    if notebook is None:
+        notebook = Notebook(title="Queue", owner_id=owner_id)
+        session.add(notebook)
+        session.commit()
+        session.refresh(notebook)
+    session.add(
+        Report(
+            notebook_id=notebook.id,
+            author_id=author_id if author_id is not None else owner_id,
+            title=title,
+            status=status,
+            updated_at=utcnow() - timedelta(minutes=age_minutes),
+        )
+    )
+    session.commit()
+
+
+def test_needs_you_now_lists_your_drafts_only(client, login, engine):
+    """An analyst's queue is their own unfinished work — another author's draft
+    is not theirs to resume, and they cannot review."""
+    login("ANALYST", email="mine@example.com")
+    me = client.get("/api/me").json()["id"]
+    with Session(engine) as session:
+        _seed(session, owner_id=me, title="My draft", status=ReportStatus.DRAFT)
+        _seed(
+            session,
+            owner_id=me,
+            author_id=_other_author(session),
+            title="Their draft",
+            status=ReportStatus.DRAFT,
+        )
+        _seed(session, owner_id=me, title="Awaiting review", status=ReportStatus.IN_REVIEW)
+
+    page = client.get("/").text
+    queue = page.split("Recent reports", 1)[0]
+    assert "Needs you now" in queue
+    assert "My draft" in queue
+    assert "Their draft" not in queue
+    assert "Awaiting review" not in queue  # an analyst is not a reviewer
+
+
+def test_needs_you_now_puts_the_review_queue_first(client, login, engine):
+    """For a reviewer, work waiting on *them* outranks their own drafts."""
+    login("REVIEWER", email="rev@example.com")
+    me = client.get("/api/me").json()["id"]
+    with Session(engine) as session:
+        _seed(
+            session,
+            owner_id=me,
+            title="My newer draft",
+            status=ReportStatus.DRAFT,
+            age_minutes=0,
+        )
+        _seed(
+            session,
+            owner_id=me,
+            author_id=_other_author(session),
+            title="Older submission",
+            status=ReportStatus.IN_REVIEW,
+            age_minutes=60,
+        )
+
+    queue = client.get("/").text.split("Recent reports", 1)[0]
+    assert queue.index("Older submission") < queue.index("My newer draft")
+    assert "Review →" in queue and "Resume →" in queue
+
+
+def test_needs_you_now_is_capped(client, login, engine):
+    login("ANALYST", email="many@example.com")
+    me = client.get("/api/me").json()["id"]
+    with Session(engine) as session:
+        for i in range(9):
+            _seed(
+                session,
+                owner_id=me,
+                title=f"Draft {i}",
+                status=ReportStatus.DRAFT,
+                age_minutes=i,
+            )
+
+    queue = client.get("/").text.split("Recent reports", 1)[0]
+    assert queue.count('class="queue-dot') == 5
+
+
+def test_stakeholder_dashboard_has_no_writer_queue(client, login):
+    login("STAKEHOLDER", email="reader@example.com")
+    assert "Needs you now" not in client.get("/").text
diff --git a/tests/test_portal.py b/tests/test_portal.py
index d7d3a56..c190cdf 100644
--- a/tests/test_portal.py
+++ b/tests/test_portal.py
@@ -446,3 +446,68 @@ def test_valid_token_for_deleted_user_is_anonymous(client, login, engine):
     )
     assert resp.status_code == 303
     assert resp.headers["location"] == "/auth/login"
+
+
+def test_editor_markings_live_in_the_header(client, login):
+    """TLP / intel level / confidence are edited from the always-visible header
+    chips, and only there — a second copy in the dock footer would be a second
+    source of truth for the same three form fields."""
+    login("ANALYST", email="marks@example.com")
+    nb = client.post("/api/notebooks", json={"title": "Markings nb"}).json()
+    rid = client.post(
+        "/api/reports", json={"notebook_id": nb["id"], "title": "Marked product"}
+    ).json()["id"]
+
+    page = client.get(f"/reports/{rid}/edit").text
+    head = page.split('class="editor-head-actions"', 1)[0]
+    for field in ("intel_level", "tlp", "analytic_confidence"):
+        assert page.count(f'name="{field}"') == 1
+        assert f'name="{field}"' in head
+    # Each chip's <select> still posts with the product form, so autosave and a
+    # plain submit both carry the markings.
+    assert head.count('class="marking-chip-select"') == 3
+    assert head.count('form="reportform"') == 4  # title input + three markings
+
+
+def test_editor_markings_are_read_only_for_a_non_author(client, login):
+    """A reviewer opening someone else's product sees the markings as static
+    chips — visible, but with no editable control smuggled into the page."""
+    login("ANALYST", email="author2@example.com")
+    nb = client.post("/api/notebooks", json={"title": "Read-only nb"}).json()
+    rid = client.post(
+        "/api/reports", json={"notebook_id": nb["id"], "title": "Someone else's"}
+    ).json()["id"]
+
+    login("REVIEWER", email="reviewer2@example.com")
+    page = client.get(f"/reports/{rid}/edit").text
+    assert "marking-chip" in page
+    assert "marking-chip-select" not in page
+    assert 'name="tlp"' not in page
+
+
+def test_notebook_phases_keep_every_section_reachable(client, login):
+    """The nine sections are re-cut into four phases, not removed: each section
+    id still renders, and the <noscript> rule cancels x-cloak so a browser
+    without Alpine still sees all of them."""
+    login("ANALYST", email="phases@example.com")
+    nb = client.post("/api/notebooks", json={"title": "Phased nb"}).json()
+
+    page = client.get(f"/notebooks/{nb['id']}").text
+    for section in (
+        "sources",
+        "notes",
+        "attachments",
+        "figures",
+        "indicators",
+        "diamonds",
+        "ach",
+        "products",
+        "requirements",
+    ):
+        assert f'id="{section}"' in page
+        assert f'href="#{section}"' in page  # its phase tab
+    for phase in ("collect", "analyze", "produce", "trace"):
+        assert f"phase === '{phase}'" in page
+    # Collect is the server-rendered default: it alone is not cloaked.
+    assert "x-show=\"phase === 'collect'\">" in page
+    assert "[x-cloak] { display: revert; }" in page
diff --git a/vulture_whitelist.py b/vulture_whitelist.py
index 46bd19a..18c18fc 100644
--- a/vulture_whitelist.py
+++ b/vulture_whitelist.py
@@ -119,3 +119,7 @@
 queue_dissemination  # unused function (src/iceberg/services/dissemination.py)
 fetch_all_enabled_once  # unused function (src/iceberg/services/feeds.py)
 _.connect_unix_socket  # unused attribute (httpcore backend protocol method)
+
+# /admin Settings-hub tile fields — read only in templates/admin_home.html.
+tone  # unused variable (src/iceberg/services/effective_config.py)
+meta  # unused variable (src/iceberg/services/effective_config.py)

From 4fdd0c60d1cc659ebba4d4f606bd89df3d45f977 Mon Sep 17 00:00:00 2001
From: Richard Hope <richmhope@gmail.com>
Date: Tue, 21 Jul 2026 20:05:53 +1000
Subject: [PATCH 2/2] fix(ux): notebook deep links must open their phase; hub
 pills must reflect readiness (review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two review findings on the P0 change set, both real.

**Notebook deep links landed on a cloaked phase.** `notebookTabs` always started
on Collect and ignored `location.hash`, but eleven routes redirect to
`/notebooks/{id}#<section>` — and `#diamonds` / `#ach` live in Analyze. Deleting
a Diamond model returned you to a page that appeared to have lost the whole
section. The component now resolves the hash to its owning phase, re-scrolls
once that phase is visible (the browser's own scroll happened while the target
was display:none), and re-applies on `hashchange`.

The section → phase map is no longer duplicated in JS: the template builds the
tab bar and the JSON island from one `phases` list, so adding a section cannot
leave the two out of step. Tests assert the map covers every rendered section id
and that the delete redirect's anchor resolves to Analyze.

**Hub pills called broken integrations healthy.** The AI tile was fixed in #264;
the same class of defect applied to two more:

- SSO went green on a client id alone. A provider with no env client secret
  cannot complete the authorization-code flow — it looks enabled and fails at
  login, which is precisely when a green pill sends you looking in the wrong
  place. Now NOT CONFIGURED, naming the provider.
- Audit claimed off-box forwarding whenever a non-stdout method was selected,
  including an HTTP sink with no endpoint. That is worse than "local only",
  because it looks solved. Now NOT CONFIGURED with the reason.

Transition tests for both, in the style of the existing MISP/webhook ones.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/iceberg/services/effective_config.py   | 31 +++++++++--
 src/iceberg/static/js/tags.js              | 23 +++++++-
 src/iceberg/templates/notebook_detail.html | 64 +++++++++++++---------
 tests/test_admin_home.py                   | 38 +++++++++++++
 tests/test_portal.py                       | 62 +++++++++++++++++++++
 5 files changed, 185 insertions(+), 33 deletions(-)

diff --git a/src/iceberg/services/effective_config.py b/src/iceberg/services/effective_config.py
index 5a00708..6b39ccf 100644
--- a/src/iceberg/services/effective_config.py
+++ b/src/iceberg/services/effective_config.py
@@ -284,10 +284,21 @@ def admin_hub_tiles(session) -> list[dict]:
     webhook = webhook_settings.get(session)
     audit = audit_settings.get(session)
     proxy = proxy_settings.get(session)
-    providers = [p.name for p in oidc_settings.enabled_providers(session)]
+    # A provider with a client id but no env client secret cannot complete the
+    # authorization-code flow — it looks enabled and fails at login, so it must
+    # not read green here either.
+    configs = oidc_settings.enabled_providers(session)
+    providers = [c.name for c in configs]
+    unusable_sso = [c.name for c in configs if not c.client_secret]
     active_feeds = len(
         list(session.exec(select(Feed).where(col(Feed.enabled).is_(True))).all())
     )
+    # An HTTP sink with no endpoint claims off-box forwarding it cannot perform.
+    audit_broken = (
+        "HTTP sink selected but no endpoint is set — nothing is forwarded"
+        if "http" in audit.methods and not audit.http_endpoint.strip()
+        else ""
+    )
     issues = len(_validation(s)["errors"])
 
     tiles = [
@@ -369,10 +380,16 @@ def admin_hub_tiles(session) -> list[dict]:
             group="Outbound integrations",
             title="Single sign-on",
             href="/admin/oidc",
-            status=", ".join(p.upper() for p in providers) or "NOT CONFIGURED",
-            tone="is-ok" if providers else "is-warn",
+            status=(
+                "NOT CONFIGURED"
+                if not providers or unusable_sso
+                else ", ".join(p.upper() for p in providers)
+            ),
+            tone="is-warn" if (not providers or unusable_sso) else "is-ok",
             meta=(
-                f"{len(providers)} provider{'' if len(providers) == 1 else 's'} · "
+                f"No client secret set for {', '.join(unusable_sso)} — sign-in will fail"
+                if unusable_sso
+                else f"{len(providers)} provider{'' if len(providers) == 1 else 's'} · "
                 f"dev-login {'on' if s.dev_login_enabled else 'off'}"
             ),
         ),
@@ -385,13 +402,15 @@ def admin_hub_tiles(session) -> list[dict]:
                 if not audit.enabled
                 else "LOCAL ONLY"
                 if set(audit.methods) <= {"stdout"}
+                else "NOT CONFIGURED"
+                if audit_broken
                 else ", ".join(m.upper() for m in audit.methods)
             ),
             tone=(
                 "is-neutral"
                 if not audit.enabled
                 else "is-warn"
-                if set(audit.methods) <= {"stdout"}
+                if set(audit.methods) <= {"stdout"} or audit_broken
                 else "is-ok"
             ),
             meta=(
@@ -399,6 +418,8 @@ def admin_hub_tiles(session) -> list[dict]:
                 if not audit.enabled
                 else "No SIEM sink enabled"
                 if set(audit.methods) <= {"stdout"}
+                else audit_broken
+                if audit_broken
                 else "Forensic trail forwarded off-box"
             ),
         ),
diff --git a/src/iceberg/static/js/tags.js b/src/iceberg/static/js/tags.js
index b5ac5cd..11bdc0d 100644
--- a/src/iceberg/static/js/tags.js
+++ b/src/iceberg/static/js/tags.js
@@ -409,9 +409,30 @@ document.addEventListener('alpine:init', () => {
      rather than scrolled end to end, so one phase's sections render at a time.
      The tabs are real anchors: without Alpine the <noscript> rule cancels
      x-cloak and every section stays reachable by its #id, exactly as before. */
-  Alpine.data('notebookTabs', () => ({
+  Alpine.data('notebookTabs', (dataId) => ({
     phase: 'collect',
     section: 'sources',
+    // {section: phase}, rendered by the template from the same list that builds
+    // the tab bar — so the two can never disagree about which phase owns a
+    // section.
+    sectionPhase: readJSON(dataId),
+
+    init() {
+      // Every post-action redirect lands on #<section> (e.g. creating a Diamond
+      // model returns to /notebooks/{id}#diamonds). Without this the target sits
+      // in a cloaked phase and the page looks like the work vanished.
+      this.applyHash();
+      window.addEventListener('hashchange', () => this.applyHash());
+    },
+    applyHash() {
+      const section = window.location.hash.slice(1);
+      const phase = this.sectionPhase[section];
+      if (!phase) return;
+      this.show(phase, section);
+      // The browser already tried to scroll here while the section was hidden,
+      // so re-run it once the phase is visible.
+      this.$nextTick(() => document.getElementById(section)?.scrollIntoView());
+    },
     show(phase, section) { this.phase = phase; this.section = section; },
   }));
 
diff --git a/src/iceberg/templates/notebook_detail.html b/src/iceberg/templates/notebook_detail.html
index 0dabf53..7435f12 100644
--- a/src/iceberg/templates/notebook_detail.html
+++ b/src/iceberg/templates/notebook_detail.html
@@ -15,37 +15,47 @@ <h1 class="page-title mt-2">{{ notebook.title }}</h1>
 {# The notebook is worked in phases, not scrolled end to end: the collection
    strip becomes a phase tab bar and only one phase's sections render at a time.
    Tabs stay real anchors, so without Alpine every section is still reachable
-   (the <noscript> below cancels the x-cloak that hides the other phases). #}
-{%- macro phase_tab(phase, section, label, count) -%}
-  <a href="#{{ section }}" class="help-tab" :class="section === '{{ section }}' ? 'is-active' : ''"
-     @click="show('{{ phase }}', '{{ section }}')">{{ label }} <span class="nb-count">{{ count }}</span></a>
-{%- endmacro -%}
+   (the <noscript> below cancels the x-cloak that hides the other phases).
 
-<div x-data="notebookTabs()">
+   `phases` is the single source of the section → phase mapping: it drives the
+   tab bar AND is handed to the Alpine component as JSON, so a deep link or a
+   post-action redirect to #diamonds / #ach opens the phase that owns it instead
+   of landing on a cloaked section. Adding a section in one place cannot leave
+   the two out of step. #}
+{% set phases = [
+  ('collect', 'Collect', [
+    ('sources', 'Sources', sources | length),
+    ('notes', 'Notes', notes | length),
+    ('attachments', 'Files', attachments | length),
+    ('figures', 'Figures', figures | length),
+    ('indicators', 'Indicators', iocs | length),
+  ]),
+  ('analyze', 'Analyze', [
+    ('diamonds', 'Diamond', diamonds | length),
+    ('ach', 'ACH', ach_models | length),
+  ]),
+  ('produce', 'Produce', [('products', 'Products', reports | length)]),
+  ('trace', 'Trace', [('requirements', 'Requirements', linked_req_ids | length)]),
+] %}
+{% set section_phase = {} %}
+{% for phase, _label, sections in phases %}
+  {% for section, _l, _c in sections %}{% set _ = section_phase.update({section: phase}) %}{% endfor %}
+{% endfor %}
+
+<div x-data="notebookTabs('notebook-phase-data')">
+  <script type="application/json" id="notebook-phase-data">{{ section_phase | tojson }}</script>
   <noscript><style>[x-cloak] { display: revert; }</style></noscript>
 
   <nav class="nb-phases mb-6" aria-label="Notebook phases">
-    <div class="nb-phase-group">
-      <span class="eyebrow">Collect</span>
-      {{ phase_tab('collect', 'sources', 'Sources', sources | length) }}
-      {{ phase_tab('collect', 'notes', 'Notes', notes | length) }}
-      {{ phase_tab('collect', 'attachments', 'Files', attachments | length) }}
-      {{ phase_tab('collect', 'figures', 'Figures', figures | length) }}
-      {{ phase_tab('collect', 'indicators', 'Indicators', iocs | length) }}
-    </div>
-    <div class="nb-phase-group">
-      <span class="eyebrow">Analyze</span>
-      {{ phase_tab('analyze', 'diamonds', 'Diamond', diamonds | length) }}
-      {{ phase_tab('analyze', 'ach', 'ACH', ach_models | length) }}
-    </div>
-    <div class="nb-phase-group">
-      <span class="eyebrow">Produce</span>
-      {{ phase_tab('produce', 'products', 'Products', reports | length) }}
-    </div>
-    <div class="nb-phase-group">
-      <span class="eyebrow">Trace</span>
-      {{ phase_tab('trace', 'requirements', 'Requirements', linked_req_ids | length) }}
-    </div>
+    {% for phase, label, sections in phases %}
+      <div class="nb-phase-group">
+        <span class="eyebrow">{{ label }}</span>
+        {% for section, section_label, count in sections %}
+          <a href="#{{ section }}" class="help-tab" :class="section === '{{ section }}' ? 'is-active' : ''"
+             @click="show('{{ phase }}', '{{ section }}')">{{ section_label }} <span class="nb-count">{{ count }}</span></a>
+        {% endfor %}
+      </div>
+    {% endfor %}
   </nav>
 
 <div x-show="phase === 'collect'">
diff --git a/tests/test_admin_home.py b/tests/test_admin_home.py
index af91cef..de88a6a 100644
--- a/tests/test_admin_home.py
+++ b/tests/test_admin_home.py
@@ -131,3 +131,41 @@ def test_ai_hub_tile_reflects_the_resolved_backend(engine, monkeypatch):
     with Session(engine) as session:
         tile = _tile(session, "AI provider")
         assert (tile["status"], tile["tone"]) == ("OPENAI", "is-ok")
+
+
+def test_sso_tile_warns_when_a_provider_has_no_client_secret(engine, monkeypatch):
+    """A provider with a client id but no env secret cannot complete the
+    authorization-code flow. It looks enabled and fails at login, so a green
+    pill would point an operator away from the actual cause."""
+    from iceberg.services import oidc_settings
+
+    monkeypatch.setattr(get_settings(), "oidc_client_secret", "")
+    with Session(engine) as session:
+        oidc_settings.update(session, entra_enabled=True, entra_client_id="abc123")
+        assert [c.name for c in oidc_settings.enabled_providers(session)] == ["entra"]
+
+        tile = _tile(session, "Single sign-on")
+        assert (tile["status"], tile["tone"]) == ("NOT CONFIGURED", "is-warn")
+        assert "entra" in tile["meta"]
+
+    monkeypatch.setattr(get_settings(), "oidc_client_secret", "s" * 24)
+    with Session(engine) as session:
+        tile = _tile(session, "Single sign-on")
+        assert (tile["status"], tile["tone"]) == ("ENTRA", "is-ok")
+
+
+def test_audit_tile_warns_when_the_http_sink_has_no_endpoint(engine):
+    """Selecting the HTTP sink without an endpoint claims off-box forwarding
+    that cannot happen — worse than 'local only', because it looks solved."""
+    from iceberg.services import audit_settings
+
+    with Session(engine) as session:
+        audit_settings.update(session, enabled=True, methods=["stdout", "http"])
+        tile = _tile(session, "Audit log & SIEM")
+        assert (tile["status"], tile["tone"]) == ("NOT CONFIGURED", "is-warn")
+        assert "no endpoint" in tile["meta"]
+
+        audit_settings.update(session, http_endpoint="https://siem.example.org/hec")
+        tile = _tile(session, "Audit log & SIEM")
+        assert tile["tone"] == "is-ok"
+        assert "HTTP" in tile["status"]
diff --git a/tests/test_portal.py b/tests/test_portal.py
index c190cdf..0432426 100644
--- a/tests/test_portal.py
+++ b/tests/test_portal.py
@@ -511,3 +511,65 @@ def test_notebook_phases_keep_every_section_reachable(client, login):
     # Collect is the server-rendered default: it alone is not cloaked.
     assert "x-show=\"phase === 'collect'\">" in page
     assert "[x-cloak] { display: revert; }" in page
+
+
+def test_notebook_phase_map_covers_every_section_and_redirect_target(client, login):
+    """Every post-action redirect lands on #<section> (creating a Diamond model
+    returns to /notebooks/{id}#diamonds). The component resolves that hash to the
+    owning phase via this map, so a section missing from it would leave the user
+    on a cloaked page that looks like their work vanished."""
+    import json
+    import re
+
+    login("ANALYST", email="deeplink@example.com")
+    nb = client.post("/api/notebooks", json={"title": "Deep link nb"}).json()
+    page = client.get(f"/notebooks/{nb['id']}").text
+
+    raw = re.search(
+        r'id="notebook-phase-data">(.*?)</script>', page, re.S
+    ).group(1)
+    mapping = json.loads(raw.replace("&#34;", '"'))
+    assert mapping == {
+        "sources": "collect",
+        "notes": "collect",
+        "attachments": "collect",
+        "figures": "collect",
+        "indicators": "collect",
+        "diamonds": "analyze",
+        "ach": "analyze",
+        "products": "produce",
+        "requirements": "trace",
+    }
+    # Every id the map claims really exists as a section on the page.
+    for section in mapping:
+        assert f'id="{section}"' in page
+
+
+def test_analyze_phase_redirects_land_on_a_resolvable_anchor(client, login):
+    """The regression this guards: #diamonds and #ach sit in the Analyze phase,
+    which is cloaked on load. Any route that redirects there must use an anchor
+    the phase map knows, or the user is returned to a page that looks empty."""
+    import json
+    import re
+
+    login("ANALYST", email="diamondlink@example.com")
+    nb = client.post("/api/notebooks", json={"title": "Diamond nb"}).json()
+    created = client.post(
+        f"/notebooks/{nb['id']}/diamonds",
+        data={"title": "Volt Typhoon", "confidence": "MODERATE"},
+        follow_redirects=False,
+    )
+    assert created.status_code == 303
+    # Creating lands on the model's own editor; deleting is what returns to the
+    # notebook's #diamonds anchor.
+    diamond_id = created.headers["location"].rstrip("/edit").rsplit("/", 1)[1]
+
+    resp = client.post(
+        f"/notebooks/{nb['id']}/diamonds/{diamond_id}/delete", follow_redirects=False
+    )
+    assert resp.status_code == 303
+    anchor = resp.headers["location"].split("#")[1]
+
+    page = client.get(f"/notebooks/{nb['id']}").text
+    raw = re.search(r'id="notebook-phase-data">(.*?)</script>', page, re.S).group(1)
+    assert json.loads(raw.replace("&#34;", '"'))[anchor] == "analyze"