bento-grid12-cell composable bento layout with 4 size variants and per-cell accent tinting on the top hairline. Hover lift in Vivid/Editorial; static in Quiet/Industrial.
v0.7.2 / 141 components · 4 moods × 6 palettes = 24 combinations
141 components. Four moods. Six palettes. One install command. Mix mood and palette independently — pick what fits the surface you're shipping.
Same component, two combinations of mood × palette. Drag to compare.
Mood / Vivid
Operator dashboard
Same component. Different mood × palette. Drag to compare.
Mood / Industrial
Operator dashboard
Same component. Different mood × palette. Drag to compare.
Mood
Vivid
Deep-black, cyan/violet/magenta, gradient mesh
Used by: Command Center · Capture · Codex · EnclaveWatch · Opportunities
Mood
Quiet
Off-white, indigo accent, document-restrained
Used by: Quality (QMS) · Governance · Proposal
Mood
Editorial
Warm beige, terracotta accent, Fraunces serif
“Calm clarity beats clever decoration.”
Used by: Training · clearD · Vetted
Mood
Industrial
Restrained · serious · documentation
Used by: Reserved
01 — BESPOKE· 20 components
bento-grid12-cell composable bento layout with 4 size variants and per-cell accent tinting on the top hairline. Hover lift in Vivid/Editorial; static in Quiet/Industrial.
breadcrumb-trailOverflow-aware breadcrumb with ResizeObserver-driven truncation. First and last crumbs always shown; middle crumbs collapse into a popover when the trail doesn't fit. Industrial swaps the chevron for a slash and forces mono caps.
brushable-chartMulti-series timeseries chart with drag-to-select range and hover crosshair. Three default colours map to --mt-accent / --mt-accent-2 / --mt-accent-3.
command-paletteFull-featured ⌘K palette with sections, recents, kbd hints, AI hint pill, footer. Distinct from mt-command — that's the cmdk primitive.
confirmation-dialogDestructive-action confirmation built on the native <dialog> element (free focus trap + Escape + inert background). Four severity levels. Optional 'type this phrase to confirm' field for critical actions. Honors prefers-reduced-motion.
cursor-spotlightSoft radial blur that lerps toward the cursor. Reads --mt-soft-accent for its color so it adapts to the active mood.
cursor-trailCanvas-based cursor particle trail with screen blend mode. Respects prefers-reduced-motion.
dropdown-menu-richRich dropdown menu — icons, kbd hints, separators, labels, sub-menus, checked items, destructive items. CSS Anchor Positioning where supported (Chromium 125+), JS-anchored fallback elsewhere. Keyboard-first.
ecosystem-mapCentral hub + N orbiting nodes with animated arcs spawning sibling-app → hub on every audit event. Status-coloured nodes (healthy/drift/down) with pulse + hover card.
empty-stateMood-aware empty state with a real SVG illustration per mood — orbital in Vivid, blueprint grid in Quiet, drop-cap in Editorial, technical stencil in Industrial. Honors prefers-reduced-motion.
error-boundary-displayFriendly error surface for React error boundaries and 500-style fallbacks. Severity strip + icon + try-again/report buttons. Diagnostic detail collapses behind a disclosure with a copy-stack button.
glow-pillAnimated rounded pill chip with a conic-gradient sweep around the border. Status (lime/amber/rose/cyan), brand, and mono variants. Sweep auto-disables in Industrial.
image-with-skeletonImage with a tasteful shimmer skeleton while loading and a graceful broken-image fallback. Crossfades on load; stable dimensions via aspect-ratio so layout doesn't jump. Honors prefers-reduced-motion.
inline-edit-tableKeyboard-navigable entitlement matrix. Click a cell to edit the seat count; Tab/Shift+Tab/Enter/Escape behaviors. Live total bar at the bottom.
kinetic-textCharacter-staggered hero typography with optional Instrument Serif italic em-phrase.
loading-overlayLoading overlay with three variants (container / scrim / inline). 250ms appear-delay to avoid flash on fast operations. Mood-aware spinner: gradient arc in Vivid, clean arc in Quiet, serif italic 'loading…' in Editorial, stepped mono blocks in Industrial.
magnetic-buttonButton that pulls toward the cursor when within ~80px. Cyan accent + glow. Cubic-bezier spring easing.
marquee-stripLooping horizontal marquee with edge fade and pause-on-hover. Half-speed in Industrial. Honors prefers-reduced-motion.
tabs-segmentedSegmented control with a sliding active-pill indicator (FLIP-style transform). Keyboard nav (Arrow / Home / End). Optional badges per segment. Industrial replaces the pill with a 2px black underline.
tilted-card3D parallax card on mousemove (max ±4°) with a cursor-following gradient highlight. Glass surface, hairline border.
02 — PRIMITIVES· 17 components
checkboxCheckbox primitive built on a real <input type=checkbox>. Three states (unchecked / checked / indeterminate) for select-all-rows headers, label + description block, three sizes (xs / sm / md), disabled state, and a destructive tone for destructive bulk actions. Indeterminate is set via the DOM property because HTML doesn't have a `indeterminate` attribute. AA-safe: every checkbox carries a visible label OR an aria-label and a glyph cue for state.
comboboxSearchable select primitive — input + filterable dropdown + selected pill. Single-select (default) and multi-select. Filter is substring over a label fallback; consumer can plug a custom filter function. Built on the popover primitive for positioning + outside-click + focus management. Keyboard navigation: arrow keys, Home/End, Enter to select, Esc to close. AA-safe: role=combobox + listbox + option, aria-activedescendant on the active option, aria-selected for picks. Use for control-picker, evidence-picker, owner-picker, and the SCTM filter bar's faceted dropdowns.
dialogCentered modal dialog primitive on top of @radix-ui/react-dialog — focus trap, esc-to-close, portal mount, scroll lock, animated overlay all handled. Composable subcomponents: Dialog, DialogTrigger, DialogContent, DialogHeader, DialogTitle, DialogDescription, DialogFooter, DialogClose. Complements mt-sheet (side drawer) — this one is the centered modal. Replaces every hand-rolled modal in the CMMC repo (AdjudicationBinModal, AttestationModal, BundleUploadModal, SmartMapperModal, etc.).
kbdKeyboard shortcut display primitive — the small key-cap chip used in tooltips, menu items, and command palettes. Renders a sequence of keys (Cmd+K, Ctrl+Shift+P, /, Esc) as joined chips, auto-substituting platform glyphs (⌘ ⌥ ⇧ ⌃ on macOS; Ctrl Alt Shift on Win/Linux when explicitly requested). Three sizes (xs / sm / md), inline + block layouts. AA-safe: every chip is a real <kbd> element with the printable key as its accessible name.
mt-buttonshadcn-flavored Button with cyan-gradient + glow primary variant. CVA-powered. asChild supported via Radix Slot.
mt-cardshadcn-flavored Card with the Vivid glass recipe: 1px hairline + top gradient highlight + backdrop blur + tone tinting.
mt-commandCommand palette with section grouping, fuzzy filter, and keyboard nav. Vivid backdrop, hairline border, mono hints. ⌘K-friendly.
mt-sheetRight-side drawer built on @radix-ui/react-dialog with the Vivid backdrop, hairline-bordered surface, and slide easing.
popoverPopover primitive on @radix-ui/react-popover — outside-click + esc dismiss, focus management, collision-aware positioning, portal mount. Composable: Popover / PopoverTrigger / PopoverContent / PopoverArrow / PopoverClose. Three visual densities (compact / default / rich) for different content sizes. Pairs with citation-chip for inline reference hover, with status-badge for tone explanations, and as the host shell for the upcoming combobox.
radio-groupRadio-group primitive built on a real <fieldset> + native <input type=radio> per option. Single-select by name attribute, full keyboard nav (arrow keys cycle), label + description per option. Two layouts (stacked default, inline for tight surfaces) and a card variant that turns each option into a rich tile (used by the closure-approval-flow's reviewer-decision picker). AA-safe — fieldset/legend semantics + each radio gets a real <label>.
role-badgeCMMC role pill — the canonical 'who is this person?' chip used in headers, audit logs, signature blocks, and access listings. Variants for the fixed CMMC role enum: Admin / Compliance Officer / Assessor / Auditor / Owner / Subcontractor / Read-Only / Service Account. Three sizes (xs / sm / md). AA-safe — every role ships icon + uppercase mono label + bordered chip. Optional avatar prefix when paired with a name display.
selectSingle-value select primitive built on @radix-ui/react-select — full keyboard navigation, typeahead, portal-mounted listbox, collision-aware positioning, scroll-area for long lists. Composable surface: Select, SelectTrigger, SelectValue, SelectContent, SelectItem, SelectGroup, SelectLabel, SelectSeparator. Per-item icon slot, optional 'code' prefix for control-style picks (e.g. AC.L2-3.1.1), disabled items. Distinct from combobox (which is searchable) — use Select when the option set is short and the user picks one of N.
skeletonLoading placeholder primitive. Five shapes (text / heading / circle / box / row), three animations (pulse default · shimmer · none for users on prefers-reduced-motion). Each shape renders the right element with aria-busy + aria-live so the loading state is announced. Composable: line up text shapes to mock paragraph load; combine row + circle for list items. Replaces the 'Loading controls…' plaintext that appears in CMMC modals.
status-badgeSingle-source-of-truth pill for CMMC vocabulary. Variants: adjudication (met / not-met / na / open / in-progress / planned / blocked / superseded), elevator (the 5 CMMC met_via paths — direct-evidence / poam / enduring-exception / dod-cio / esp-inheritance), and risk (critical / high / moderate / low / informational). AA-safe: every tone ships an icon + uppercase mono label + bordered chip — color is never the only cue. Replaces inlined tone maps (FINDING_TONES, VIA_TONES) that get redeclared across pages.
switchToggle primitive — the on/off switch used in settings panels, feature flags, and per-row enable/disable rows in admin lists. Wraps a real <input type=checkbox role=switch> so keyboard handling (Space + Enter) and form submission work for free. Three sizes (xs / sm / md), an optional inline label + description block, and a disabled state. AA-safe: the switch surface always pairs the on/off graphic with the visible label; aria-checked is always set.
tabsContent tabs primitive on @radix-ui/react-tabs — keyboard nav (arrow + home/end), aria-selected/aria-controls plumbing, focus management. Distinct from tabs-segmented (which is a segmented control selector that returns a value); this one is the tab-and-panel pattern. Composable: Tabs / TabsList / TabsTrigger / TabsContent. Per-tab badge slot for counts. Three visual styles: underline (default), pill, segmented-card.
toastToast notification stack — transient feedback (saved / failed / rejected / pointer registered) that doesn't interrupt the user. Mount one <Toaster /> at the app root; everywhere else call useToast() and dispatch via toast.success / .warning / .danger / .info. Auto-dismiss with hover-pause, manual dismiss, action slot per toast, configurable position. AA-safe — every toast ships icon + title + (optional) description and is announced via aria-live.
03 — SIGNATURE· 6 components
annotated-screenshotOverlay callout pins, curved SVG connectors, and mono-caps labels onto any image or component. Children pattern: declarative Annotation elements at (x,y) coordinates. Connectors draw in on scroll-into-view.
diff-viewerBefore/after slider with a draggable divider. Each side gets its own subtree with its own data-mt-mood / data-mt-palette, so the same component renders in two configurations without bleed. Double-click snaps to 50%.
noise-gradientSVG turbulence over an animated linear gradient. Three motion variants. Mood-aware: Industrial freezes the motion, Quiet drops to slow. Reads --mt-accent / --mt-accent-2 / --mt-accent-3, so swapping palette swaps the surface live.
scroll-reveal-stackCards that fade in and parallax-drift as they enter the viewport. Each card's depth prop scales the speed — back slowest, front fastest. Industrial disables parallax; cards still reveal.
stat-counter-grid4-up stat grid. Numbers tween 0 → final on scroll-into-view; sparklines draw in lockstep. Industrial uses linear easing + stepped sparkline; other moods spring + smooth curve.
timeline-railVertical timeline with scroll-driven draw-on of the rail line. Circle milestones (square in Industrial). Active milestone scales 1.02 when in viewport.
04 — DATA· 5 components
command-row-listAudit-feed / activity-stream list. Fixed-height rows with status dot, mono timestamp, actor avatar, action text, target, and right-aligned metadata. Optional sticky group headers.
data-tableProduction-grade data table on TanStack Table v8. Sticky header, sticky first column, multi-column sort, density modes (comfortable / compact / dense), row selection, pagination, empty + loading states. Tabular-nums on every numeric column.
faceted-filter-barTablesaw filter bar. Multi-select dropdowns per facet, in-list search, removable selection chips, optional global search input. Active-facet underline per mood.
mini-stat-railCompact KPI strip. Inline (with · separators) or card-row (auto-fit grid). Three densities. Tabular-nums everywhere; mono labels in caps.
timeline-density-chartHorizontal density strip showing event volume over time. Per-bucket bars (single or stacked-series), hover crosshair + tooltip, drag-to-select range, optional annotation lines.
05 — INTERACTIVES· 2 components
signature-chipOne chip component, five variants. Status (mood-aware pulse), Metric (number + label), Kbd (keyboard hint), Tag (removable filter chip), Trend (number + direction + sparkline). Plus ChipRow wrapper for clean horizontal stacking.
signature-inputOne input, three variants. Text (leading icon, trailing kbd, clearable). Search (live result preview, ⌘K hint). Number (+/- steppers + scrubbable label, drag horizontally to change value).
06 — COMPLIANCE· 45 components
adjudication-verdict-cardThe canonical 'this control was adjudicated' summary card. Renders the verdict (MET / NOT_MET / N/A) + the elevator path (direct evidence / POA&M / enduring exception / DoD CIO / ESP inheritance) + adjudicator + timestamp + evidence count, with a quoted rationale block and an actions slot (re-adjudicate, export, undo). Designed for the exported assessment package, the SCTM overview tab, and confirmation modals — anywhere the adjudication outcome itself is the headline.
agent-run-cardOne mactech-agent automation receipt — the artifact view of a single run by an agent like manifest-runner, evidence-validator, drift-scanner, or sprs-rollup. Header carries agent name + run id + status (running / succeeded / failed / cancelled / skipped), trigger (cron / manual / event), and live duration timer when running. Body shows a numeric stats strip (records scanned / changes detected / errors), the most recent N events streamed from the run, and a footer with Open log, Re-run, and Cancel-when-running actions. Pairs with audit-trail-strip + skeleton for streaming live runs.
assessor-readonly-frameWrapper that locks any editable UI into a read-only state for the C3PAO assessor view. Disables interactive controls inside the frame (pointer-events + aria-disabled), strips dangerous handlers via a context flag, paints a small assessor strip at the top and bottom, and renders the assessor's view-as identity in the corner. Works as a route-level wrapper or around individual cards. Pairs with cui-classification-banner mode=mute for stacking on top of any tenant surface.
attestation-record-cardSigned attestation as a first-class artifact — the RECORD that drops out of a dual-signoff workflow. Distinct from dual-signoff-block (the workflow surface) and signature-block (a single signature on a controlled document): this card represents one persisted attestation that lives in the evidence trail. Header carries attestation ref, scope kind (SSP-section / POA&M-closure / baseline-release / RAM / supply-chain-flowdown / mock-assessment / training-acknowledgement), validity state (active / expired / revoked / superseded), and a hash chip. Body shows the attestation text excerpt with the attester chip and signed-at; footer surfaces re-attest / revoke actions.
audit-trail-stripCompact horizontal who-when-what trail for a single record (proposal, doc, opportunity, control). Avatar dot + action + target + relative time. Industrial swaps relative time for ISO HH:MM:SS UTC and draws a 2px black through-line.
baseline-compareTwo-version SSP baseline diff at the section level — the 'what changed between v3.1 and v3.2?' view. Header strip names baseline A vs B with classification + signed-at for each. Body lists every SSP section grouped by change kind (added / modified / removed / unchanged) with a per-row chip + words-changed metric + open-redline action. Aggregate stats roll up at the top. Pairs with redline-diff-viewer for the per-section drill-down.
baseline-drift-cardOne classified drift event between an SSP release baseline and the current state. Names the section that drifted (SSP §3.1.1 / Access Control narrative), the source of drift (controlled-doc revision, evidence pointer changed, control verdict moved), severity (critical / high / moderate / informational), a before → after summary line, the detection mechanism, and an actions slot (acknowledge / open redline / suppress as expected). Drops into the drift event list reached from release-baseline-banner's drift indicator.
boundary-canvasFrame for a complete CMMC boundary diagram. Wraps positioned children (enclave-zone, boundary-component-node, data-flow-arrow) in a fixed-size scrollable canvas with a header strip (snapshot label + version + signed-at), an optional subtle grid background, and a legend strip that enumerates the zone kinds and flow classifications present in the diagram. Built to be both interactive (click a node) and exportable (print-friendly via CSS @media print).
boundary-component-nodeTyped asset card for CMMC boundary diagrams. Renders one component on the system map — its kind (server / store / gateway / external-service / identity-provider / endpoint / network-segment / esp / human-actor), its classification handling (inside / outside / DMZ / not-in-scope), the technology label, the owner, and a connection list. Works standalone in an inventory list or absolute-positioned inside a canvas. Pairs with a future data-flow-arrow component and the planned boundary-canvas.
citation-chipInline pill that lives in SSP prose, narrative drafts, and audit-package memos linking the surrounding sentence to a structured reference: an evidence pointer, a control, a controlled document, a policy, a POA&M, or an attestation. Each kind ships its own glyph + uppercase code so a reader scanning a paragraph sees what kind of source backs each claim. Footnote / inline / detail variants for different contexts.
closure-approval-flowThree-step closure flow purpose-built for POA&M closure (and reusable for baseline release, SSP sign-off): gather required artifacts (checklist), capture dual sign-off (Compliance Officer + CTO / tenant Admin), confirm close. Renders a stepped flow with per-step gating — gather step blocks Next until every required artifact is marked present, sign-off step blocks until both signers attest, confirm step exposes the final commit action. Per-step state surfaces as captured summaries. Composes with dual-signoff-block and milestone-timeline.
compliance-matrixRequirements × controls coverage matrix. Cells encode both status (full / partial / planned / N-A / gap) and strength via shade alpha. AA-safe: non-color cues (border + pattern + letter glyph) in addition to color. Sticky first column + header. Evidence counts per cell.
control-adjudication-historyTemporal trail of a single CMMC control's adjudication life. Distinct from a generic audit log: each event encodes a verdict transition (MET → NOT_MET → MET), an elevator change, an evidence-add/remove, or a reviewer sign-off — with before/after pills and the triggering actor. Drops into control-detail-panel's 'History' tab; also stands alone in audit packages and assessor read-only views.
control-detail-panelThe canonical 'one CMMC control, everything about it' surface — the body of the SCTM/CAE detail drawer or full-screen page. Sticky header with control ID + family + verdict badge; tab strip for Overview · Met Via · Evidence · History; scrollable body sections; footer actions slot for Adjudicate / Re-verify / Export. Presentational only — does not own the open/close mechanics, so it slots into any drawer, modal, or full page without coupling.
control-family-heatmap17 NIST 800-171 control families × verdict mix, rendered as a grid of tiles where each tile shows the family code, total controls, and a horizontal stack of MET / IN-PROGRESS / PLANNED / NOT-MET / N/A segments. Quick scan: which families are healthy, which are dragging the SPRS score. Click handler per family for drill-down into the SCTM filter. AA-safe: tile carries the family code + numeric counts, not just color.
control-traceability-rowThe SCTM (Security Control Traceability Matrix) row atom — one CMMC control, rendered as a single horizontal row. Control ID (mono) · family chip · requirement preview (truncated) · verdict slot · evidence-count chip · last-adjudicated · owner. Two densities (cozy default, dense for 100+ row tables). Whole-row click target with keyboard support; aria-selected for filter-bar selection state. Replaces hand-rolled rows in the CMMC repo's SCTMPage.
controlled-document-bannerThe strip at the top of a controlled document showing title, classification (public/internal/CUI/FOUO/controlled-secret), document number, version, effective date, status, owner, approver, supersedes. Classification color + uppercase label for AA-safe communication.
cui-classification-bannerSystem-level classification marker that sits above an entire surface (page, route, dashboard) telling the viewer what tier of controlled data this view handles. Distinct from controlled-document-banner (which marks one document); this one marks the *system context*. Two-line strip: classification chip + dissemination tag (NOFORN, FEDCON, etc.) + boundary state (inside / outside / not-in-scope) + tenant + active assessment phase. Marquee mode for high-classification surfaces; mute mode for the assessor read-only frame.
data-flow-arrowSVG-based arrow connecting two coordinates in a CMMC boundary diagram. Carries the protocol label (HTTPS / S3 / IPSec / SAML), the classification of data in transit (CUI / non-CUI), the encryption state (encrypted / unencrypted), and the direction (forward / both). Three styles — solid (in-place), dashed (unencrypted or partial coverage), dotted (planned / proposed). Pairs with boundary-component-node and the boundary-canvas frame.
dual-signoff-blockTwo-approver attestation block used for POA&M closure, controlled-document approval, and any other action that requires both Compliance Officer + tenant Admin / CTO sign-off. Renders both signer slots with their state (pending / signed / rejected / recused), captures signed-at + comment, and exposes the open action handlers for each pending signer. Closure-ready chip flips on once both signatures land.
enclave-zoneVisual grouping inside a CMMC boundary diagram. Wraps a cluster of boundary-component-nodes in a labeled, tinted, colored-border zone — CUI enclave / DMZ / Trusted External / Out-of-Scope. Header carries zone name + classification + asset count; sits behind nodes in the stacking order so they remain interactive. Two visual densities — full zone (with footer summary) and chrome-only (just the bordered frame, for tight diagrams).
evidence-cardSingle artifact card supporting one or more controls. Type icon (document / spreadsheet / log / screenshot / link / etc.) + status badge (validated / stale / missing) + control refs + source-system label + capture & validation timestamps. Single primary navigation; cursor users get both card click and Open button.
evidence-coverage-matrixControl × evidence coverage view. Asks the one question every C3PAO defensibility review needs answered: which controls have evidence backing them, which are stale, which have nothing on file? Grouped by NIST 800-171 family, per-control row shows evidence count broken into validated / stale / missing pills plus a one-glance coverage chip. Filters to show only gaps, only stale, or full coverage. Family roll-up header per group. Pairs with evidence-pointer-card for drill-down.
evidence-manifest-uploaderUpload-a-manifest, never-upload-bodies pattern. Drag/drop zone accepts a CSV or JSON manifest describing evidence artifacts (title, sha256, path, control refs, source-system). Parses + row-level validates (sha256 format, control id format, duplicate vs already-registered, classification required). Renders a stats strip (total / new / duplicate / invalid) and a per-row preview table that the consumer reads to decide whether to register the batch. The artifact bodies stay where they are.
evidence-pointer-cardMetadata-only evidence pointer — the canonical row in a CMMC evidence registry that sits outside the CUI boundary. Distinct from evidence-card: this card foregrounds the SHA-256 + path + RunId identity, the source-system pointer, the validation status (validated / stale / missing / quarantined), and the classification of the artifact body it points at (CUI / CDI / FCI / FOUO / public). The artifact itself is NEVER held by the control plane; only its identity is.
export-bundle-cardManifest card for a single CMMC_Assessment_Package_<Date>.zip — the artifact a tenant hands to the C3PAO. Shows bundle id, generated-at, baseline version, SPRS snapshot, classification, manifest counts (controls / evidence / POA&Ms / RAMs / attestations / signatures), the bundle SHA-256, the two signers (Compliance Officer + CTO), status (Draft / Signed / Submitted / Withdrawn / Archived), and a footer of actions (Re-export, Download, Share with C3PAO, Verify hash). Pairs with mock-assessment-runner's 'finish dry-run' output and the sprs-score-meter snapshot at export time.
finding-cardAssessor finding from the C3PAO's perspective — the formal note the assessor enters during the audit. Distinct from a POA&M (which is the tenant's response). Severity vocabulary (critical / high / moderate / observation / commendation), lifecycle status (open / accepted / disputed / closed / withdrawn), Observation paragraph in the assessor's voice, Evidence reviewed list, Recommended remediation, and a Tenant Response panel that surfaces the linked POA&M or dispute. Pairs with assessor-readonly-frame and citation-chip.
flowdown-requirement-cardDFARS / NIST 800-171 flow-down requirement carded for the supply-chain dashboard. One row per clause that the prime must push down to subs (252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021). Status (required / met / negotiating / waived / not-applicable), applicability rule (contract size, CUI exposure), subcontractor coverage chip (8 of 12 attested), cadence label (one-time / annual / per-task-order), due date with overdue semantics. Drops into /dashboard/supply-chain.
gap-analysis-summaryThe 'what's blocking the audit?' surface. Headline points-deduction with SPRS-style math, three classified buckets — Blocking (NOT MET), At-risk (PLANNED / OPEN / IN PROGRESS past their due window), and Deferred (waived / N/A / DoD-CIO / ESP-inherited) — each grouped by NIST 800-171 family. Per-row reason chips (no-evidence / stale-evidence / poam-overdue / dual-signoff-pending / classification-shift). Freeze-for-audit affordance flips the headline to a locked snapshot. Pairs with sprs-score-meter, path-to-110-progress, and control-family-heatmap on the executive readiness page.
ir-tabletop-runnerIncident Response tabletop exercise runner — guided walk through the 6 NIST phases (Detect / Analyze / Contain / Eradicate / Recover / Lessons Learned) with one scenario beat per phase, a decision prompt, and a captured-decision slot. Live mode shows the active phase + prompts; record mode renders a static, signed exercise artifact that satisfies IR.L2-3.6.3 (test the IR capability). Pairs with citation-chip for after-action references.
met-via-elevatorSelector for the 5 CMMC met_via 'elevators' — the paths a control can be adjudicated MET through. Each elevator card carries an icon, name, and the kind of evidence it implies (direct artifacts vs. a POA&M plan vs. an enduring exception vs. DoD CIO adjudication vs. ESP inheritance). Replaces ad-hoc radio groups that hide what each path requires. Pairs with status-badge (variant='elevator') for display contexts.
milestone-timelineVertical rail of POA&M milestones with rich per-step state — done / in-progress / not-started / blocked / skipped — plus due-date, owner, blocker reason, and dependency chain. Richer than timeline-rail: each milestone carries its own status badge, due-date pill, and optional dependency-on link. Drops into the POA&M detail page and the closure-approval-flow wizard.
mock-assessment-runnerGuided dry-run of a C3PAO assessment — the tenant walks each in-scope control with an assessor-style prompt, captures verdict + rationale + evidence pointer, and lands on a draft assessment package ready to compare against the real audit. Header carries scope, total progress (X of 110 reviewed), and a SPRS projection that updates as verdicts are captured. Per-control body: requirement quote + assessor question + verdict picker + evidence drop-zone + private notes. Saves as a versioned dry-run snapshot.
path-to-110-progressExecutive dashboard widget — 'how close are we to all 110 NIST 800-171 controls adjudicated MET?' Big number + stacked progress bar segmented by verdict (MET · NOT_MET · N/A · OPEN · IN PROGRESS). Per-segment counts and percentages with tabular-nums. Trend pill vs. last assessment date. Replaces the CMMC repo's one-off PathTo110Widget.
poam-entry-cardPlan of Action & Milestones entry — the daily-driver row in the POA&M tracker. POA&M ID + title + risk badge + linked control refs + milestone progress bar + due date with days-until/overdue indicator + owner + closure-readiness chip. Drawer/page click target; selected state for bulk operations. Replaces hand-rolled rows in the CMMC repo's /dashboard/poam.
policy-document-cardSummary card for one controlled policy document. Distinct from controlled-document-banner (the in-doc strip): this card represents the policy as a row in the policy register. Header carries policy id, title, status (active / draft / in-review / superseded / retired), version + effective date, classification. Body shows owner + approver, the lineage (supersedes / superseded-by), linked CMMC controls (which the policy implements), linked SOPs (procedures that operationalize it), and review cadence with next-review-due semantics. Pairs with controlled-document-banner and signature-block.
redline-diff-viewerWord-level redline diff for legal / policy / contract changes. Unified or side-by-side view. Strikethrough for removed, underline + warm color for added. AA-safe (non-color cues). Built-in LCS diff for paragraph-scale; pass customTokens for book-length docs.
release-baseline-bannerTop-of-page frame for an SSP (System Security Plan) baseline. Declares which version of the SSP the viewer is reading, its release state (Draft / In Review / Released / Superseded / Archived), version label, effective + release dates, released-by + counter-signer, supersedes / superseded-by references, and a 'sections drifted' indicator that hot-links to the drift event list. Pairs with baseline-drift-card and citation-chip.
risk-acceptance-memoFormal Risk Acceptance Memo (RAM) — the controlled-document artifact that backs an enduring-exception adjudication. Header carries RAM id, title, status (proposed / accepted / under-review / expired / superseded), classification, and review cadence. Body declares the affected control(s), the risk being accepted, the compensating control narrative, and the named signer(s) with their org role + decision date. Footer surfaces the renewal due date with overdue semantics, the linked enduring-exception elevator reference, and any related POA&Ms. Pairs with met-via-elevator (enduring-exception path) and citation-chip (kind=attestation).
scoping-wizardMulti-step wizard primitive purpose-built for the CMMC scoping + closure flows: boundary scoping (CUI flows → in-scope assets → enclaves → confirm), POA&M closure (gather → dual-signoff → close), evidence batch registration (manifest → review → register), and onboarding. Per-step state (pending / current / valid / blocked / complete), required-vs-optional gating, skippable steps, captured-summary chips per completed step, and a sticky footer with Back / Next / Save Draft / Cancel actions. Body is a content slot per step.
signature-blockDocument/proposal signature block. 1..N signatories with three capture modes (draw on canvas, type with script-italic render, upload image). Per-row status pill: PENDING / SIGNED / DECLINED. Industrial mode swaps script italics for stamped mono caps.
sprs-score-meterDoD-specific Supplier Performance Risk System (SPRS) scoring gauge. Renders the −203 to +110 scale with the current score, the deductions ledger (1pt / 3pt / 5pt findings), the threshold band (≥88 passes most DoD contracts), and the delta vs. last assessment. Tabular-nums everywhere; AA-safe scale (color + numeric label + threshold tick).
ssp-section-editorFrame for editing one SSP section. Section header (section id + title + linked controls + classification + status), formatting toolbar slot, primary editor slot (textarea / contenteditable / WYSIWYG — consumer's choice), citations side panel slot (list of citation-chips with insert action), and a footer carrying word/char counts + last-modified-by + Save / Discard / Re-render preview actions. Pairs with citation-chip and the future redline-diff-viewer for the review pass.
subcontractor-response-panelOne subcontractor's stance across all flowdown clauses. Header carries sub name, tier (prime / sub / sub-sub), active contract refs, and the sub's current SPRS score with delta. Body lists each flowdown clause with response state (attested / declined / clarifying / pending), signer, signed-at, and the linked attestation evidence pointer. Drops into /dashboard/supply-chain/[sub] alongside flowdown-requirement-card.
training-record-cardOne CMMC Awareness & Training record (AT.L2-3.2.1 / 3.2.2 / 3.2.3). One record per trainee per training event: who took the course, when, with what score, against which curriculum, who delivered it, and where the completion certificate lives. Status vocabulary (current / expiring-soon / expired / not-yet-trained / waived) drives the renewal indicator. Pairs with role-badge for the trainee row chip, evidence-pointer-card for the linked certificate, and citation-chip for inline references in SSP §AT.x narratives.
07 — CAPTURE· 5 components
competitor-cardSide-by-side us-vs-competitor comparison with strength bars per dimension. Real numeric scores so the card reads on a printed page (not color alone). Net summary chip + competitor tag (incumbent / likely / wildcard).
pipeline-kanbanDrag-and-drop pipeline board with gates as columns and full keyboard support.
pricing-line-item-tableEditable proposal pricing grid with scenarios, margins, and totals.
pursuit-timelineTime-anchored horizontal timeline for opportunity milestones.
quote-summary-blockPrint-ready quote / proposal summary block. Vendor + customer headers, quote meta strip, line items, totals stack with discount + tax, footer slot. Tabular-nums everywhere. Print stylesheet baked in (drops shadows, forces page-break-inside: avoid on totals).
08 — TRAINING & CONTENT· 6 components
article-frameLong-form reading frame with editorial typography, drop cap, and byline strip.
chapter-navSticky chapter/TOC nav that highlights the active section as you scroll.
lesson-cardTraining lesson tile with progress, status, instructor, and tags.
progress-bar-stackPer-module progress bars with weighted rollup, AA-safe aria-meter semantics.
pull-quoteEditorial pull quote — slab, rule, or testimonial-card variants.
quiz-blockMulti-choice quiz with submit/instant modes, locking, and rationale reveal.
09 — SOCIAL· 6 components
comment-threadNested comment tree with depth-aware indent, inline reply forms, and collapse toggles.
mention-chipInline @mention pill with avatar and focus-driven hovercard.
notification-rowSingle notification with actor avatar, type pip, action body, preview, and relative time.
post-cardSocial feed post — author header, body, media grid, reactions, and action footer.
profile-cardCompact user profile card with avatar fallback, stat row, and action cluster.
reaction-barEmoji reaction pills with picker, optimistic toggle, and aria-live counts.
10 — MARKETING· 20 components
capability-cardCapability tile for the /capabilities page — icon + title + body + framework chips. When href is set, the whole card becomes a link with a trailing arrow that translates on hover. Two variants: soft (surface-1) and outlined.
contact-blockDirector contact card. Email + phone + mailing address + secure-routing note + optional scheduling CTA. Reads like a business card, not 'Contact Sales.' Pairs with lead-capture-form on the /contact page.
cta-bandSection-break call-to-action band. Two layouts (center, split) × three surfaces (subtle, accent, inverse). No background images or animations — the read on federal/defense pages is competence, not energy. Editorial heading goes serif; Industrial goes stamped mono caps.
differentiator-grid"Why us" value-proposition grid — icon + short title + 2–3 supporting sentences per tile. Two layouts (tiles or list) × two treatments (plain hairlines or contained cards). Distinct from capability-card: answers *why*, not *what*.
faq-accordionFAQ accordion. Defaults to native <details> for accessibility and no-JS support. Mode='accordion' enables one-at-a-time controlled behavior. Optional category chips filter the list. Hairline-only rows; plus icon rotates 45° on open.
flagship-feature-blockTwo-column flagship feature block — kicker pill + heading + body + checkmark feature list + CTA cluster on one side, visual on the other. Image side flips for alternating rhythm down a page. Matches the CUI Enclave + Trust Codex section on mactech.com.
framework-badgesRow or grid of compliance-framework badges (CMMC, NIST CSF, NIST RMF, FedRAMP, SOC 2, …). Three tones — attested (accent fill), aligned (hairline), in-progress (dashed) — and three sizes (sm / md / lg).
lead-capture-formFederal-flavored lead-capture form. Fields tuned for actual qualifying questions (name, work email, org, org type, program/boundary, message). Fully controlled — consumer owns submission. State prop drives idle / submitting / success / error UI. No dark patterns, no pre-checked consent.
leader-bio-cardLeadership bio card — headshot + name + role + credentials chips + bio + LinkedIn/email icons. Two layouts: portrait (headshot top, grid-of-equal-cards) and row (headshot left, denser one-column lists). No glow rings or gradients — restrained federal/defense aesthetic.
leader-profilePremium long-form leader profile. Portrait + name + pillar badge + role + bio + 'Areas of expertise' list + optional pillar callout box + LinkedIn/email. Three layouts (split / split-flip / stacked). Distinct from leader-bio-card (short-form team-grid tile) — this is the one-per-page premium profile.
logo-wallCustomer / agency / partner logo wall. Two modes (monochrome / color) × two layouts (grid / marquee). Logos without assets fall back to mono-caps text — good for federal program names that have no public mark. Marquee pauses on hover and honors prefers-reduced-motion.
marketing-heroTop-of-page hero for marketing surfaces. Asymmetric 7/5 grid with eyebrow + h1 + lede + dual CTA, plus a slot for a metadata strip (procurement IDs, framework badges). Editorial uses serif h1; Industrial uses stamped mono caps with a heavier hairline.
pillar-grid2/3/4-up grid of organizational pillars (departments, practice areas). Built-in tones for security / infrastructure / quality / governance map to token colors; pass `tint` for full control. Optional leader attribution, badge, icon, href. Two layouts (grid / list) × two surfaces (soft tinted / outlined hairline).
pillar-sectionPillar-themed content section with two layouts: compact (bulleted item list) for capabilities statements, and detailed (items as feature blocks with body + sub-bullets) for services-page sections. Built-in pillar tones drive border, leader name, and bullet colors. Optional NAICS/PSC procurement code chips at the bottom.
procurement-stripFederal procurement metadata strip (UEI / CAGE / SDVOSB / NAICS / PSC / GSA vehicles). Two densities: compact (sits in a hero's belowFold) or banded (full-width band with hairlines). Mono-caps labels with normal-case codes for legibility.
section-headerEyebrow + heading + lede rhythm that opens every marketing section. Three alignments (left, center, split). Heading level configurable. Editorial swaps the heading to serif; Industrial swaps it to stamped mono caps.
service-tier-cardSingle service tier card sized for a Foundation / Standard / Advanced three-up. Tier eyebrow + name + price + cadence + summary + included-feature list + CTA. featured=true adds an accent border, soft glow ring, and a 'Recommended' ribbon.
stat-proof-gridMarketing proof-bar — row of 2–6 stats with oversized number, mono-caps label, and optional support note. Three densities (compact / default / spacious) × two surfaces (plain hairline dividers / inset bg-2 panel). Agency-style and restrained, no counter animation.
team-gridWrapper that tiles leader-bio-cards (or any uniform person tiles) at 2 / 3 / 4 columns. Optional `sections` prop groups people under headings (Leadership / Practice Directors / Advisors) — useful for the /leadership page. Presentation-only; cards are passed as children.
testimonial-quoteCustomer/partner testimonial with structured attribution (name + role + organization + optional monochrome logo). Three layouts: stacked (default), side (quote left, attribution right), spotlight (large display quote). Federal/defense buyers read attribution as the proof — designed accordingly.
11 — IMPORTED · KOKONUT + KIBO· 6 components
kibo-code-blockAdapted from Kibo UI. Lightweight code chip with language label and copy-to-clipboard. Pairs with the install snippets in component docs.
kibo-marqueeAdapted from Kibo UI. Marquee that scrolls arbitrary ReactNode children at a configurable px/s. Pairs with chip rows; ours marquee-strip handles string-only variants.
kt-animated-numberAdapted from Kokonut UI. Counts from start to end with cubic ease-out. Used in stat tiles and hero counters.
kt-card-shineAdapted from Kokonut UI. Card with a sweeping diagonal shine highlight on hover. In Industrial, the shine is replaced with a static yellow accent border.
kt-gradient-textAdapted from Kokonut UI. Reads brand gradient from --mt-accent → --mt-accent-2 — same call site, different gradient per mood. Optional animated sweep (disabled in Industrial).
kt-particle-buttonAdapted from Kokonut UI. Button that emits a mood-aware particle burst on click — cyan in Vivid, indigo in Quiet, sienna in Editorial, yellow in Industrial.
12 — PATTERNS· 3 components
nav-barTop-of-page navigation. Sticky scroll-aware with backdrop-blur compact mode, dropdown menus, mobile drawer, optional dismissible announcement strip, skip-to-content link. Mood-aware brand wordmark (Editorial serif, Industrial stamped mono). Honors prefers-reduced-motion.
nav-l-shellUpside-down L app shell — sidebar on the left, top bar across the top, logo in the corner where they meet. The structural chrome for full-page surfaces in MacSuite, CaptureOS, Quality, and any other consumer that needs a persistent nav frame.
sidebar-navApp-shell sidebar. Collapsible to a 64px icon-only rail (state persists to localStorage). Section headings, nested items with accordion expand, badge slot, active-item accent border, footer slot. Mobile drawer with backdrop. Full keyboard nav (Arrow/Home/End/Right/Left). Tooltips on collapsed items. Honors prefers-reduced-motion.